Metasploit
7950db3358
automatic module_metadata_base.json update
2023-07-12 13:53:26 -05:00
Jack Heysel
10c1b79c37
Land #17861 , pfSense Config Data RCE as root
...
This module exploits a vulnerability in pfSense version
2.6.0 and below which allows for authenticated users to
execute arbitrary operating systems commands as root.
2023-07-12 14:32:06 -04:00
emirpolatt
34f25fbb65
pfSense Config Data Remote Command Execution as root (CVE-2023-27253) Module
2023-07-12 13:27:02 -04:00
adfoster-r7
6b06b77b5a
Land #18181 , Change dead links to live links, in documents
2023-07-12 17:57:05 +01:00
hahwul
3236aaf6c3
Change dead links to live links, in documents
2023-07-13 01:06:34 +09:00
Metasploit
27638d7409
automatic module_metadata_base.json update
2023-07-10 18:19:51 -05:00
adfoster-r7
5cb5c18550
Land #18170 , Add module for SmarterMail Build 6985 - dotNET Deserialization Remote Code Execution (CVE-2019-7214)
2023-07-10 23:56:09 +01:00
Metasploit
917adffb83
automatic module_metadata_base.json update
2023-07-10 17:46:41 -05:00
Jack Heysel
bd004e0831
Land #18178 , update refence format entry
...
This PR updates a reference on exploit/windows/smb/ms08_067_netapi
to the new URL format.
2023-07-10 18:19:52 -04:00
Jeffrey Martin
3635ce9c03
update reference format for entry in rapid7.com
2023-07-10 16:54:42 -05:00
Jack Heysel
420147d02e
Land #18164 , WooCommerce Payments auxiliary module
...
This module exploits an auth bypass and priv esc vulnerability
in order to create an admin wordpress user.
2023-07-10 17:19:56 -04:00
jheysel-r7
5261d842bc
Update documentation/modules/auxiliary/scanner/http/wp_woocommerce_payments_add_user.md
2023-07-10 14:18:50 -04:00
adfoster-r7
c3a0b0b1cb
Land #18177 , update the wiki to use https instead of http
2023-07-10 10:46:29 +01:00
ismaildawoodjee
025b37ce62
Replace other stale http:// links with https://
2023-07-10 03:29:08 -04:00
h00die
d6911f6b13
add new api endpoint, and checks for multiple versions
2023-07-09 19:48:16 -04:00
ismaildawoodjee
2aea7b2fda
Change exploit template comment header from http to https for Msftidy
...
* Msftidy complains about Line 2 of the exploit template comment having
* http:// protocol instead of https:// protocol
* Reference in PR #18170 , commit hash ad0d3e79 , where Msftidy lint test fails
* to pass, but in the next commit 591fee18 , the test passes.
2023-07-09 15:56:08 -04:00
Ismail Dawoodjee
0a9af48662
Merge branch 'rapid7:master' into smartermail_rce
2023-07-09 17:48:49 +03:00
ismaildawoodjee
e61342afac
Proper error handling for closing TCP socket and used Rex exceptions
2023-07-09 07:25:09 -04:00
adfoster-r7
b04ff3c579
Land #18172 , Tidy up capture plugin specs
2023-07-07 17:12:21 +01:00
Rory McKinley
5974801e14
Tidy up plugin specs
2023-07-07 17:14:29 +02:00
ismaildawoodjee
1706812099
Implemented requested changes
...
* Small fixes in Description - removed backticks
* Implemented Windows Command target
* Removed PowerShell Stager, in Targets and in exploit method
* Implemented Rex::Socket::Tcp in place of TCPSocket
* Updated TARGET section in documentation
* Added TARGET 0 - Windows Command scenario
* Removed PowerShell Stager scenario
* Replaced 'Using configured payload' lines to use Windows Command payload
for the 2nd, 3rd, and 4th scenarios. Did not rerun the scenarios, however
2023-07-07 04:14:20 -04:00
Metasploit
a0bdbce3c9
Bump version of framework to 6.3.25
2023-07-06 17:49:06 -05:00
Jeffrey Martin
00095fa495
update Pro version docs for 4.22.1 release
2023-07-06 15:02:56 -05:00
Grant Willcox
56cba64e4a
Land #18169 , Add centralized Metasploit plugin documentation
2023-07-06 14:11:51 -05:00
Grant Willcox
d16f38a59c
Add command syntax for captureg command reference
2023-07-06 13:14:49 -05:00
Grant Willcox
914818d372
Remove extra character from thread description.
2023-07-06 13:14:14 -05:00
adfoster-r7
bfcd5d0466
Add centralized Metasploit plugin documentation
2023-07-06 19:00:33 +01:00
Ismail Dawoodjee
f959dee046
Change module name
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-07-06 18:50:44 +03:00
Ismail Dawoodjee
24ef4e1b90
Update documentation/modules/exploit/windows/http/smartermail_rce.md
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-07-06 18:49:49 +03:00
Grant Willcox
81cf6c2a09
Fix up credential storing code
2023-07-06 10:43:20 -05:00
ismaildawoodjee
591fee1850
Fix msftidy complaining about https:// URL scheme in Line 2
2023-07-06 11:01:54 -04:00
Grant Willcox
c3aefe577b
Fix url_root loop code and user creation code
2023-07-06 09:36:19 -05:00
ismaildawoodjee
ad0d3e79a9
SmarterMail RCE module and documentation
2023-07-06 08:00:28 -04:00
adfoster-r7
88a539a82c
Land #18144 , update capture plugin to be more helpful, and add documentation
2023-07-06 11:17:14 +01:00
Metasploit
e3bdb7a917
automatic module_metadata_base.json update
2023-07-06 02:31:54 -05:00
Christophe De La Fuente
df4a03c79d
Land #18082 , Apache RocketMQ update config RCE (CVE-2023-33246)
2023-07-06 09:15:03 +02:00
Grant Willcox
3abcb3ebaa
Explain ADMINID field more
2023-07-05 13:10:41 -05:00
Grant Willcox
ce19ce5b72
Apply fixes from review
2023-07-05 12:24:51 -05:00
adfoster-r7
00aa2e63a0
Land #18166 , Handle nil error when creating adapted payloads
2023-07-05 18:07:12 +01:00
Jack Heysel
f1b5cd46f4
Apache RocketMQ update config RCE
2023-07-05 12:38:51 -04:00
Metasploit
83dc8e9012
automatic module_metadata_base.json update
2023-07-05 11:36:32 -05:00
Dean Welch
d452f49f09
Handle nil error when creating adapted payloads
2023-07-05 17:28:05 +01:00
Christophe De La Fuente
ae48236d07
Land #18122 , rocketmq version lib
2023-07-05 18:11:25 +02:00
Grant Willcox
da6cdd1d5b
Fix up datastore setting code
2023-07-05 10:55:14 -05:00
jheysel-r7
53a761a13d
Update lib/msf/core/auxiliary/rocketmq.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-07-05 11:13:08 -04:00
h00die
f77e7db637
woocommerce payments auth bypass
2023-07-04 13:09:27 -04:00
h00die
8d686e5a28
woocommerce payments auth bypass
2023-07-04 13:06:27 -04:00
h00die
375a315b3d
woocommerce payments auth bypass
2023-07-04 13:05:07 -04:00
Grant Willcox
d97c0fc8f7
Land #18153 , Remove Ruby 2.7 from Github actions
...
Ruby 2.7 has been EOL'd for 3 months now and is no longer supported.
2023-06-30 15:38:16 -05:00
adfoster-r7
d968d92e53
Remove Ruby 2.7 from Github actions
2023-06-30 14:10:07 +01:00
cgranleese-r7
badb710940
Land #18152 , Update PHP Meterpreter to correctly show file sizes for large files
2023-06-30 14:07:07 +01:00
adfoster-r7
fa0e53775f
Update PHP Meterpreter to correctly show file sizes for large files
2023-06-30 10:22:13 +01:00
Metasploit
dfbd14ea5b
automatic module_metadata_base.json update
2023-06-29 17:43:57 -05:00
Grant Willcox
859ff288fc
Land #18147 , Add Ruby 3.3.0-preview1 to test suite
2023-06-29 17:20:24 -05:00
adfoster-r7
085943bd78
Add Ruby 3.3.0-preview1 to test suite
2023-06-29 22:53:17 +01:00
Jack Heysel
cc1b7db773
Method documentation comments
2023-06-29 15:52:03 -04:00
jheysel-r7
35f5b19512
Apply suggestions from code review
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-06-29 15:23:27 -04:00
Metasploit
1426a5c12e
Bump version of framework to 6.3.24
2023-06-29 12:18:27 -05:00
Rory McKinley
1dff3e5e26
Copy blog post about capture plugin to docs
2023-06-29 14:58:37 +02:00
dwelch-r7
028660384a
Land #18146 , Fix windows Meterpreter clipboard manipulation access denied errors
2023-06-29 13:27:57 +01:00
adfoster-r7
50c675cc90
Fix windows Meterpreter clipboard manipulation access denied errors
2023-06-29 00:00:48 +01:00
adfoster-r7
0c8dff1ab0
Land #17901 , Add lazy loading for payloads on startup
2023-06-28 23:12:12 +01:00
Metasploit
0aa0bbadd6
automatic module_metadata_base.json update
2023-06-28 13:06:39 -05:00
Spencer McIntyre
740fe5f6c9
Land #18133 , Dotnet signature fix
...
The signature of the .NET executable will now be automatically
determined based on the .NET executable and not the parameters provided
to the module.
2023-06-28 13:50:26 -04:00
Rory McKinley
a967815397
Remove reliance on deprecated print_* methods
2023-06-28 17:56:57 +02:00
Rory McKinley
795fae2b81
Tweak help output to provide more detail
2023-06-28 16:52:07 +02:00
Ashley Donaldson
6772740f86
Fix bug in HostingCLR relating to the first argument passed to a dotnet assembly.
2023-06-28 09:24:33 +10:00
Ashley Donaldson
afe359281c
Remove manual signature handling, and figure it out for the user.
2023-06-28 09:22:01 +10:00
jheysel-r7
ce2629d4e1
Update spec/lib/msf/core/auxiliary/rocketmq_spec.rb
2023-06-27 16:53:36 -04:00
jheysel-r7
3e4b62a240
Update spec/lib/msf/core/auxiliary/rocketmq_spec.rb
2023-06-27 16:53:13 -04:00
jheysel-r7
f86f9c0440
Update lib/msf/core/auxiliary/rocketmq.rb
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-06-27 16:39:16 -04:00
dwelch-r7
36e0d8f915
Land #18121 , Add proper SubjectAltName parsing
2023-06-27 16:54:33 +01:00
Metasploit
3e999a1dc5
automatic module_metadata_base.json update
2023-06-27 08:48:05 -05:00
Spencer McIntyre
67f7a33d77
Land #18114 , .NET assembly execution enhancements
...
Allow .NET assembly execution within the meterpreter process
2023-06-27 09:32:43 -04:00
Spencer McIntyre
767b22f7ef
Recompile the DLL
2023-06-27 09:31:24 -04:00
Spencer McIntyre
df0f7de098
Fix an ARGUMENT handling error
...
`datastore['ARGUMENT']` can be `nil` when it's been unset. Avoid an
error when appending it to cln_params by checking that it's present.
2023-06-27 09:29:59 -04:00
Ashley Donaldson
0d0906840e
Fix memory protection bug
2023-06-27 09:59:52 +10:00
Metasploit
fb6ecdd2ab
automatic module_metadata_base.json update
2023-06-26 16:46:43 -05:00
Spencer McIntyre
7da9ea07aa
Land #17796 , AWS EC2 enum: implement reporting
2023-06-26 17:31:38 -04:00
Spencer McIntyre
fd89ac6893
Fix REGION related issues
...
Fixes hanging when REGION is invalid. Fixes a stack trace when REGION is
an empty string.
2023-06-26 17:18:13 -04:00
Jack Heysel
46629ca1d2
responded to comments
2023-06-26 14:01:12 -04:00
Grant Willcox
def6d644cc
Land #18141 , Remove flakey redundant test
2023-06-26 12:36:32 -05:00
Dean Welch
df5b26ea3a
Remove flaky redundant test
2023-06-26 16:32:41 +01:00
Ashley Donaldson
65a4dd3c39
Change ETW bypass method, so that CLR memory can be freed.
...
Fixed a crash and broken logic in hosting clr code.
2023-06-26 09:54:00 +10:00
Ashley Donaldson
624643be4a
Catch errors and give meaningful error messages
2023-06-25 22:12:22 +10:00
RageLtMan
60523c0f9b
Apply @smcintyre-r7's logic fix
...
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com >
2023-06-23 18:48:21 -04:00
Metasploit
0f593d881c
automatic module_metadata_base.json update
2023-06-23 16:17:47 -05:00
Jack Heysel
bf1e6bddd1
Land #18134 , Add exploit for CVE-2023-25194
...
This exploits a Java deserialization vulnerbility
in Apache Druid which arises from a JNDI injection
within Apache Kafka clients.
2023-06-23 16:52:04 -04:00
Grant Willcox
da34476a91
Land #17959 , rescue login scanner attempts
2023-06-23 14:49:26 -05:00
Grant Willcox
f48dadff62
Land #18139 , Fix windows python meterpreter getuid intermittent crash
2023-06-23 12:02:37 -05:00
adfoster-r7
7aa1dafc1f
Fix windows python meterpreter getuid intermittent crash
2023-06-23 15:30:02 +01:00
Metasploit
f641d64f2f
automatic module_metadata_base.json update
2023-06-23 05:07:35 -05:00
dwelch-r7
d68eb84334
Land #18065 , Updates jenkins_gather module to work with newer version of Jenkins
2023-06-23 10:44:06 +01:00
cgranleese-r7
9176d0d3e0
Updates jenkins_gather to work with newer version of Jenkins
2023-06-23 10:02:03 +01:00
Heyder Andrade
b026b38851
Apply suggestions from code review
...
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com >
2023-06-23 09:36:50 +02:00
Ashley Donaldson
977f8732c6
Fix cleanup code.
...
The _AppDomainPtr, _AssemblyPtr and _MethodInfoPtr variables are COM smart pointers which will auto-Release() when they go out of scope, so we should not directly Release() them.
2023-06-23 14:01:45 +10:00
Ashley Donaldson
a7ce4c7fa8
Free memory from the C++ side, rather than the Ruby side.
2023-06-23 09:57:53 +10:00
Metasploit
0f65368866
Bump version of framework to 6.3.23
2023-06-22 15:51:18 -05:00
Metasploit
5157897412
automatic module_metadata_base.json update
2023-06-22 13:39:14 -05:00
Spencer McIntyre
b5e028b47c
Land #18100 , Add MOVEit CVE-2023-34362
2023-06-22 14:23:44 -04:00
Spencer McIntyre
dfd450561e
Tweak some messages and cleanup markdown table
2023-06-22 14:23:25 -04:00
bwatters
a05bde217c
Ensure any users we create are deleted
2023-06-22 12:18:07 -05:00
Jack Heysel
4c73067dfe
Land #18104 , fix falsely caused empty file reads
...
This issue was happening frequently with the java metepreter.
The issue has been fixed and tested with test/file post module.
2023-06-22 13:07:19 -04:00
Redwaysecurity.com
77bb6759a6
Review suggestions
2023-06-22 18:12:13 +02:00
bwatters
5f667e1d79
Address code review
2023-06-22 10:22:43 -05:00
bwatters
a2c2a9193f
Update error catching logic
2023-06-22 08:27:44 -05:00
Metasploit
5b9f22181a
automatic module_metadata_base.json update
2023-06-22 08:18:59 -05:00
dwelch-r7
e298788a28
Land #18049 , Update jenkins login scanner to work with newer versions
2023-06-22 14:04:24 +01:00
Redwaysecurity.com
e2fc3c5eff
Fixed documentation offenses
2023-06-22 14:48:16 +02:00
Redwaysecurity.com
a8332e6064
Added exploit for CVE-2023-25194
2023-06-22 14:17:32 +02:00
cgranleese-r7
ace4c45c5d
Land #18118 , Update UA strings for June 2023
2023-06-22 12:31:09 +01:00
Ashley Donaldson
461240639c
Check PID validity before getting its bitness
2023-06-22 16:05:48 +10:00
Jack Heysel
64b441be2a
Rspec tests, get_broker_port addition
2023-06-22 01:29:33 -04:00
Metasploit
83e65b0ea3
automatic module_metadata_base.json update
2023-06-21 18:17:35 -05:00
Jack Heysel
969b5cd044
Land #18132 , this PR reverts #17942
...
The AMSI bypass improvements in #17942 for new versions of windows
broke psexec. This PR reverts the issue.
2023-06-21 18:49:47 -04:00
Jeffrey Martin
1b562dd02b
Revert "Improve AMSI bypass on new Windows"
...
This reverts commit f97ab80224 , reversing
changes made to c8f942cc03 .
This change impacted the default `psexec` powershell target and needs further
testing to be reintroduced.
2023-06-21 16:35:41 -05:00
bwatters
2adea08f67
Add documentation & code cleanup
2023-06-21 15:41:50 -05:00
Metasploit
889407354a
automatic module_metadata_base.json update
2023-06-21 13:57:04 -05:00
Spencer McIntyre
7cff25e639
Land #18117 , Consider Windows 10 Revision
...
Consider Windows 10 Revision number in version module
2023-06-21 14:32:59 -04:00
bwatters
52907ac794
Add space limitation
2023-06-21 12:56:59 -05:00
bwatters
10c6e6328f
Add user cleanup and update error handling
2023-06-21 12:00:34 -05:00
bwatters
9d16b0043b
Add check method
2023-06-21 11:26:04 -05:00
Spencer McIntyre
ea1641df85
Land #17576 , Update tag handling
...
Update add_host_tag and delete_host_tag to properly handle tagging multiple hosts and then deleting these tags
2023-06-21 11:49:11 -04:00
Grant Willcox
cd00585e12
Support properly handling tagging multiple hosts and then deleting those tags.
...
This involves updating add_host_tag and delete_host_tag and performing some refactoring.
2023-06-21 09:31:55 -05:00
bwatters
957339b3c0
Simplify output
2023-06-21 08:34:02 -05:00
cgranleese-r7
0609d246f3
adds more future proofing to implementation
2023-06-21 14:19:24 +01:00
Ashley Donaldson
6e438d338e
Modify execute_dotnet_assembly to run in existing processes (including our own process) and receive output.
2023-06-21 12:04:09 +10:00
bwatters
d63c14dc17
Ugly, but working
2023-06-20 20:06:57 -05:00
Jack Heysel
40bd729957
Land #18129 , Update metasploit-payloads gem
...
This PR bumps the metasploit-payloads gem to
version 2.0.143
2023-06-20 17:07:52 -04:00
Spencer McIntyre
5d96b23d19
Update metasploit-payloads gem to 2.0.143
...
Includes changes from:
* rapid7/metasploit-payloads#662
* rapid7/metasploit-payloads#660
2023-06-20 15:14:18 -04:00
cgranleese-r7
5611780d81
Land #18127 , Add railgun reverse lookup tests for osx and linux
2023-06-20 14:27:29 +01:00
cgranleese-r7
b1d437dfe6
Land #18126 , Add additional logging to post test file
2023-06-20 14:26:14 +01:00
Jack Heysel
965a758b48
Land #18124 , Fixes the broken test/extapi module.
2023-06-19 18:42:13 -04:00
adfoster-r7
c535d8081f
Add railgun reverse lookup tests for osx and linux
2023-06-19 16:30:26 +01:00
adfoster-r7
2ac257bcef
Add additional logging to post test file
2023-06-19 16:11:43 +01:00
adfoster-r7
f9b5ea75bc
Fix broken post test extapi tests
2023-06-19 14:11:29 +01:00
Ashley Donaldson
2a3cac051f
Suggestion from code review
2023-06-19 07:53:46 +10:00
h00die
e49e70ce93
update rocketmq tests
2023-06-16 16:26:35 -04:00
h00die
67225650de
convert _ to .
2023-06-16 16:13:36 -04:00
h00die
4f661ff230
rocketmq version lib
2023-06-16 15:36:06 -04:00
Spencer McIntyre
0ca978fe9d
Return arrays of values where applicable
...
Return arrays of values where applicable and update method docs.
2023-06-16 12:19:11 -04:00
Spencer McIntyre
44ffafcf62
Add more unit tests
2023-06-16 11:48:43 -04:00
Spencer McIntyre
2d800be5b1
Read the ORAddress definition
...
Note that there's a known issue that needs the changes from
sdaubert/rasn1#37 to work.
2023-06-16 11:48:36 -04:00
dwelch-r7
9ef9f98894
Land #18119 , Add support for only running user specified test names
2023-06-16 13:27:31 +01:00
Dean Welch
8527eea15d
Add lazy loading for payloads
2023-06-16 12:04:48 +00:00
adfoster-r7
92c15f8a6a
Add support for only running user specified test names
2023-06-16 11:00:38 +01:00
Ashley Donaldson
5832685f5e
Update UA strings for June 2023
2023-06-16 11:32:37 +10:00
Ashley Donaldson
8b91d729c4
Update tests
2023-06-16 11:29:31 +10:00
Ashley Donaldson
381d291da9
Use revision in MSF modules
2023-06-16 10:07:35 +10:00
Ashley Donaldson
ddbd24554d
Take into account Windows 10 revision number
2023-06-16 06:50:39 +10:00
Spencer McIntyre
16ef8c4eaa
Add a basic spec for the x509 SAN definition
2023-06-15 15:57:10 -04:00
Spencer McIntyre
9e8a8d7c25
Remove our BMPString definition
...
It was added in https://github.com/sdaubert/rasn1/pull/33 and is present
in RASN 0.12.1.
2023-06-15 15:57:10 -04:00
Spencer McIntyre
0555b4ada0
Add SAN parsing with a proper ASN.1 definition
...
The ORAddress field is left out because it's significantly more
complicated than the rest and doesn't appear to be necessary at this
time.
2023-06-15 15:57:02 -04:00
Spencer McIntyre
39c9355715
Add additional string primitives
2023-06-15 15:51:14 -04:00
adfoster-r7
50832bef97
Land #18094 , Fix an edge case in .to_win32pe
2023-06-15 20:39:07 +01:00
space-r7
9776a6eb4a
Land #18078 , add SID support for icpr_cert
...
pulls in latest changes
2023-06-15 13:39:31 -05:00
space-r7
a31a3513c1
resolve docs conflict
2023-06-15 13:36:21 -05:00
space-r7
5b77805d68
Land #18078 , add support for SID in icpr_cert
2023-06-15 13:17:09 -05:00
Metasploit
ea34db64af
Bump version of framework to 6.3.22
2023-06-15 12:15:30 -05:00
Jack Heysel
f014033321
Land #18054 , Fix info command IP address issue
...
This PR fixes the issue where an ArgumentError was thrown
when running the info command when using a fetch payload
2023-06-15 11:51:16 -04:00
Metasploit
c168890902
automatic module_metadata_base.json update
2023-06-15 09:28:15 -05:00
bwatters
03d59ba4e7
Land # 18084, Add x86 Linux Fetch Payloads
...
Merge branch 'land-18084' into upstream-master
2023-06-15 09:04:22 -05:00
bwatters
63abeb331d
Remove default value
2023-06-15 08:46:45 -05:00
bwatters
d5a986a4bc
Fix copy/pasta
2023-06-15 08:34:30 -05:00
dwelch-r7
cee72a81e3
Land #18110 , Add namespaced test module logging
2023-06-15 14:30:02 +01:00
dwelch-r7
bc61bbaf7f
Land #18109 , Update test post modules to always have a clean writable file system directory
2023-06-15 14:27:13 +01:00
dwelch-r7
62fd3ec536
Land #18108 , Fix flakey post test services module
2023-06-15 13:45:43 +01:00
dwelch-r7
3010b565ce
Land #18107 , Extract rspec wait for expect helper
2023-06-15 13:42:13 +01:00
dwelch-r7
8da6f1efb9
Land #18105 , Fix time command bug when running complex commands
2023-06-15 13:41:16 +01:00
cgranleese-r7
5afba17a79
Land #18115 , Update unknown windows errors on python meterpreter to include original error code
2023-06-15 12:52:13 +01:00
cgranleese-r7
c85b017c9e
Land #18106 , Update SessionTLVLogging to no longer truncate useful values
2023-06-15 12:50:33 +01:00
adfoster-r7
8f11798f5f
Update unknown windows errors on python meterpreter to include hex error code
2023-06-15 11:56:32 +01:00
cgranleese-r7
95d05e0e9c
Land #18111 , Fix initialised constant error when meterpreter registry key reads timeout
2023-06-15 10:23:29 +01:00
adfoster-r7
552b76aa8f
Initialize to an empty string
2023-06-15 01:44:42 +01:00
Metasploit
e7bbd34e0d
automatic module_metadata_base.json update
2023-06-14 17:53:56 -05:00
adfoster-r7
51dc30909a
Land #17670 , add module to exploit CVE-2019-16328
2023-06-14 23:30:33 +01:00
adfoster-r7
c93adfb697
Land #17781 , adds support for module writers to supply include_dir iquote options when compiling mingw
2023-06-14 22:47:10 +01:00
Jack Heysel
2632d33583
Land #18112 , fix symlink test bug
...
This PR fixes a symlink test bug when running
a python meterpreter on windows.
2023-06-14 16:42:53 -04:00
Spencer McIntyre
1823801510
Add some tests for NtdsCaSecurityExt
2023-06-14 16:18:10 -04:00
Spencer McIntyre
ae4faca1ba
Update module docs to discuss KB5014754 changes
2023-06-14 16:18:04 -04:00
Spencer McIntyre
6988227ee4
Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT
2023-06-14 16:18:04 -04:00
Spencer McIntyre
3ee02a0e41
Add the ALT_SID datastore option
2023-06-14 16:17:58 -04:00
adfoster-r7
2a66987e39
Fix symlink test bug when running python meterpreter on windows
2023-06-14 20:12:05 +01:00
adfoster-r7
bec47e8b59
Fix unitialized constant error when meterpreter registry key reads timeout
2023-06-14 19:50:28 +01:00
adfoster-r7
75d74d2e3c
Add namespaced test module logging
2023-06-14 19:35:54 +01:00
adfoster-r7
dc5a42bd7d
Update test post modules to always have a clean file system directory
2023-06-14 19:27:19 +01:00
adfoster-r7
5b18475457
Extract rspec wait for expect helper
2023-06-14 19:10:05 +01:00
adfoster-r7
95f30d1f3f
Fix flakey post test services module
2023-06-14 18:56:20 +01:00
Jack Heysel
6f297a8619
Land #18102 , bump metasploit-payloads 2.0.140
...
This metasploit-payloads bump is a fix for false negatives
on files not existing on windows python meterpreter
2023-06-14 13:51:27 -04:00
adfoster-r7
69b7635f0f
Update SessionTLVLogging to no longer truncate useful values
2023-06-14 18:39:58 +01:00
adfoster-r7
2d87447db7
Fix time command bug when running complex commands
2023-06-14 18:01:47 +01:00
adfoster-r7
fb6bb4031c
Fix issue that falsely caused empty file reads on meterpreter
2023-06-14 17:50:54 +01:00
Jeffrey Martin
d3fa7608db
Land #18103 , lock nokogiri due to compile issue
2023-06-14 11:40:08 -05:00
Jeffrey Martin
ceb85e08c9
update to latest nokogiri 1.14.x
2023-06-14 11:30:25 -05:00
Jeffrey Martin
b2d0cdaa28
lock nokogiri due to compile issue
2023-06-14 11:21:49 -05:00
adfoster-r7
00d1f03b8a
Fix false negatives on files not existing on windows python meterpreter
2023-06-14 17:09:06 +01:00
cgranleese-r7
966dec5b03
Land #18101 , Fix macOS route command when mac addresses are split by dots
2023-06-14 17:01:32 +01:00
adfoster-r7
793e0887ff
Fix osx route command when mac addresses are split by dots
2023-06-14 16:43:51 +01:00
bwatters
f5f61ca508
Start of MOVEit port
2023-06-14 10:04:07 -05:00
cgranleese-r7
9187b96756
Land #18099 , Fix python meterpreter subprocess deadlock and file descriptor leak
2023-06-14 15:40:10 +01:00
adfoster-r7
b9f260d0f7
Land #18089 , Add Masm support
2023-06-14 13:51:41 +01:00
dwelch-r7
de07c2eae2
Land #18098 , Fix rex-text crashes when running ruby 3.3
2023-06-14 13:26:02 +01:00
Jeffrey Martin
41429aec97
Land #18080 , Weekly dependency updates for Gemfile.lock
2023-06-14 07:16:48 -05:00
adfoster-r7
d6a50acf83
Fix python meterpreter subprocess deadlock and file descriptor leak
2023-06-14 13:10:46 +01:00
dwelch-r7
1b35a9f916
Land #18051 , Add appropriate skips to post test modules
2023-06-14 13:06:37 +01:00
adfoster-r7
f30bc86c8a
Fix rex-text crashes when running ruby 3.3
2023-06-14 13:04:20 +01:00
cgranleese-r7
fe737b55b9
Land #18097 , Fix python meterpreter crashing when extracting osx network configuration
2023-06-14 12:49:10 +01:00
adfoster-r7
d414eea087
Add appropriate skips to post test modules
2023-06-14 12:37:02 +01:00
adfoster-r7
21b2e3a597
Fix python meterpreter crashing when extracting osx network configuration
2023-06-14 12:28:15 +01:00
dwelch-r7
68c48ef984
Land #18050 , Add module for running all post test modules
2023-06-14 12:14:57 +01:00
Metasploit
968a151de9
automatic module_metadata_base.json update
2023-06-13 17:37:51 -05:00
Jack Heysel
c98cc00de9
Land #18075 , RocketMQ version scanner
2023-06-13 18:15:34 -04:00
Jeffrey Martin
efd49f07b0
update migration calls in spec
...
As of Rails 7.0.5 the `migrations_paths` are called once in spec run
2023-06-13 17:15:19 -05:00
space-r7
7af22bfd41
Land #18077 , add Symmetricom unauth cmd injection
2023-06-13 17:07:16 -05:00
space-r7
5535401345
add exploit rank
2023-06-13 17:05:30 -05:00
bwatters
cabae172f9
Remove superfluous setup_handler
2023-06-13 16:03:55 -05:00
bwatters
548d7e76a8
Fix accidental diff
2023-06-13 16:01:58 -05:00
Metasploit
9f276bd727
automatic module_metadata_base.json update
2023-06-13 15:57:29 -05:00
bwatters
38f542174d
Land #17336 , A more robust implementation for Windows version comparisons
...
Merge branch 'land-17336' into upstream-master
2023-06-13 15:38:56 -05:00
Steve Campbell
37bc9cd5a4
Update symmetricom_syncserver_rce.rb
...
Updated info to add allowed SRVPORT and LPORT, and fixed issue with srvport variable not used.
2023-06-13 16:22:08 -04:00
Metasploit
401820ddfb
automatic module_metadata_base.json update
2023-06-13 14:50:28 -05:00
space-r7
091ee36b44
Land #18086 , add TerraMaster cmd injection
2023-06-13 14:34:42 -05:00
space-r7
cbf7109c51
add rubocop fixes and some metadata
2023-06-13 13:44:23 -05:00
space-r7
0d85c9e380
add module documentation
2023-06-13 13:14:51 -05:00
Spencer McIntyre
c41483250f
Fix an edge case in .to_win32pe
...
When the entry point is after the payload, there woud occassionally be
cases where `poff` and `eidx` to be invalid, causing `entry` to be
truncated. `poff` should never be negative and `eidx` should reserve the
256 bytes that `entry` may occupy.
2023-06-13 13:41:47 -04:00
bwatters
1af9660296
Add routable address type
2023-06-13 10:29:15 -05:00
bwatters
9e773b3f35
Fix issue with info command and IP address check
2023-06-13 10:16:07 -05:00
Metasploit
09ae3828d0
automatic module_metadata_base.json update
2023-06-13 09:02:42 -05:00
Jeffrey Martin
fa33052cf8
Land #18090 , Update the exported keytab table entries to sort by db insert id
2023-06-13 08:13:25 -05:00
Professor Araout
1fbfc8e4d4
Update lib/metasploit/framework/compiler/mingw.rb
...
Error in github review, replaced line 39 instead of 37-38-39 -> Fixed
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-06-13 15:04:00 +02:00
Professor Araout
0b320f6209
Update lib/metasploit/framework/compiler/mingw.rb
...
Review made by @adfoster-r7 and tested by @ARaout
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-06-13 14:59:22 +02:00
Professor Araout
9d315af25e
Update lib/metasploit/framework/compiler/mingw.rb
...
Review made by @adfoster-r7 and tested by @ARaout
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-06-13 14:59:15 +02:00
Professor Araout
cb105d8978
Update lib/metasploit/framework/compiler/mingw.rb
...
Review made by @adfoster-r7 and tested by @araout
Works perfect
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-06-13 14:58:36 +02:00
adfoster-r7
7fe6b8f481
Update the exported keytab table entries to sort by db insert id
2023-06-13 09:14:06 +01:00
Ashley Donaldson
8d1e7a386c
Rubocop and code review suggestions
2023-06-13 15:58:30 +10:00
shellchocolat
0761f8f729
[+] add masm output support
2023-06-13 06:55:16 +02:00
Metasploit
96ba121973
automatic module_metadata_base.json update
2023-06-12 18:17:41 -05:00
Jack Heysel
f97ab80224
Land #17942 , Improve AMSI bypass on new Windows
...
The script generated by the web_delivery module is blocked
by the Antimalware Scan Interface (AMSI) on newer versions
of windows. This PR allows the script to bypass AMSI.
2023-06-12 18:50:48 -04:00
Jack Heysel
14dc102e31
Bump rex-powershell to 0.1.98
2023-06-12 16:34:28 -04:00
Steve Campbell
ed516faa93
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
...
Added link to CVE
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-06-12 16:34:24 -04:00
Steve Campbell
5b73c8fea1
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
...
Added CVE
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-06-12 16:33:57 -04:00
Steve Campbell
4e4d09862e
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
...
Fixed misspelling
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-06-12 16:32:12 -04:00
Steve Campbell
bc2fb0c919
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb
...
Updated heading
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-06-12 16:31:21 -04:00
h00die-gr3y
4479d94658
Updates based on review comments from space-r7 and jvoisin
2023-06-12 19:28:08 +00:00
adfoster-r7
c8f942cc03
Land #17955 , Golf a bit the php payload
2023-06-12 16:31:00 +01:00
h00die-gr3y
7cd3854208
Removed Webshell upload and updated documentation
2023-06-12 13:58:59 +00:00
Spencer McIntyre
834ad18d28
Land #18069 , Handle LDAP UnbindRequest
...
Remote::JndiInjection: handle LDAP UnbindRequest
2023-06-12 09:53:38 -04:00
RageLtMan
668b72a4ca
Rex::Proto::LDAP::Server handle LDAP UnbindRequest
2023-06-10 09:42:58 -04:00
RageLtMan
ead8a99d79
AWS EC2 Enum: handle limits properly
...
Get all instances if limit is not set, improve output slightly.
Note: `inst.network_interfaces.select {|iface| iface.association}`
appears to have problems with multiple calls at run time - says
that the AWS SDK is trying to call `:[]` on `nil` but works in Pry.
2023-06-10 08:45:25 -04:00
Jeffrey Martin
c33fe50bbb
remove overzealous error handler
...
Update the error handling around the EC2 sdk to follow official documentation:
https://github.com/aws/aws-sdk-ruby/blob/a350a9cf9946aadd1292df6936aecd706c6ddd85/gems/aws-sdk-ec2/lib/aws-sdk-ec2.rb#L68-L72
2023-06-10 08:45:25 -04:00
Jeffrey Martin
b1477a8616
add new notes metadata
2023-06-10 08:45:25 -04:00
RageLtMan
afdcf76ef6
AWS EC2 enum: rubocop pass
2023-06-10 08:45:25 -04:00
RageLtMan
a04b54486f
AWS EC2 enum: parse tags
2023-06-10 08:45:25 -04:00
RageLtMan
00eed69b92
AWS EC2 enum: implement reporting
2023-06-10 08:45:25 -04:00
h00die-gr3y
db8a49cc99
Updated documentation
2023-06-10 12:14:05 +00:00
h00die-gr3y
417c9fa591
init commit module and documentation
2023-06-10 09:42:32 +00:00
Metasploit
43003eefa8
automatic module_metadata_base.json update
2023-06-09 18:11:26 -05:00
space-r7
c9af514be4
Land #18063 , add TerraMaster webshell upload
2023-06-09 17:55:32 -05:00
Spencer McIntyre
c579c43b72
Update payloads_spec.rb for x86 fetch
2023-06-09 16:50:28 -04:00
Spencer McIntyre
0ba65b7393
Add the x86 fetch payloads
2023-06-09 16:47:45 -04:00
Metasploit
fce6450a95
automatic module_metadata_base.json update
2023-06-09 14:18:50 -05:00
Spencer McIntyre
4c817ce1de
Land #17946 , CVE-2023-21839 - Oracle Weblogic RCE
...
CVE-2023-21839 - Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization
2023-06-09 14:55:43 -04:00
Grant Willcox
50dfde1f7a
Land #18083 , Update metasploit-payloads gem to 2.0.136
2023-06-09 12:47:37 -05:00
Metasploit
5dba72cf5e
automatic module_metadata_base.json update
2023-06-09 12:46:16 -05:00
space-r7
c8609d7983
Land #18070 , add TerraMaster chained exp module
2023-06-09 12:29:47 -05:00
Grant Willcox
694c1006e4
Add more IPv6 support in to the module
2023-06-09 12:24:35 -05:00
Spencer McIntyre
eab324714d
Update metasploit-payloads gem to 2.0.136
...
Includes changes from:
* rapid7/metasploit-payloads#656
2023-06-09 12:57:02 -04:00
adfoster-r7
7ab610c7bd
Land #18058 , Improve code navigation docs and add debugging page
2023-06-09 15:59:05 +01:00
Grant Willcox
ae4e616c3b
Update Navigating-And-Undstanding-Metasploits-Codebase to add new code navigation tools and debugging tools
...
Move debugging info into same file and make markdown match standards
Add more info on Pry debugging using Alan David Foster's explaination
Fix up broken URL links and format new URL links correctly
Fix up formatting and add information on Debug.gem supported commands
2023-06-09 09:17:46 -05:00
Spencer McIntyre
296a7afc86
Land #18076 , Don't use length for freeing.
2023-06-09 10:10:29 -04:00
Spencer McIntyre
66d2477d62
Add some tests for NtdsCaSecurityExt
2023-06-09 09:27:35 -04:00
Metasploit
caba471cfb
automatic module_metadata_base.json update
2023-06-09 08:18:52 -05:00
Spencer McIntyre
1284cb39d0
Land #18016 , CVE-2023-28771 - Zyxel Cmd Injection
...
CVE-2023-28771 - Zyxel Command Injection
2023-06-09 09:03:03 -04:00
sfewer-r7
27f5a789c9
rework the exploit to use the new MIPS64 fetch payload adapters. Removed the seperate command and dropper targets in favor of a single default target which can do both thanks to fetch payloads. Removed the redundant IO select() call which was bad copy pasta on my part.
2023-06-09 09:47:57 +01:00
Stephen Fewer
a1528556e0
Merge branch 'rapid7:master' into CVE-2023-28771
2023-06-09 09:42:19 +01:00
Metasploit
31c65c8a35
automatic module_metadata_base.json update
2023-06-08 19:33:07 -05:00
bwatters
039f238dd4
Land #18068 , Fix VBS stager in shell_to_meterpreter
...
Merge branch 'land-18068' into upstream-master
2023-06-08 19:16:54 -05:00
h00die-gr3y
dfc366e022
Latest updates based on reviewers comments
2023-06-08 21:25:40 +00:00
h00die
3e538a34af
review comments
2023-06-08 16:38:22 -04:00
Grant Willcox
dce2965d3f
Bump up dependency versions
2023-06-08 14:20:59 -05:00
Metasploit
4b082b997b
automatic module_metadata_base.json update
2023-06-08 14:16:14 -05:00
Spencer McIntyre
238118e8b5
Update module docs to discuss KB5014754 changes
2023-06-08 15:10:35 -04:00
Spencer McIntyre
2acc014014
Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT
2023-06-08 15:10:35 -04:00
Spencer McIntyre
47835b57a7
Add the ALT_SID datastore option
2023-06-08 15:10:27 -04:00
Spencer McIntyre
5b5c29842c
Land #18022 , Add post/windows/manage/make_token
...
Add update_token to MSF + make_token post-ex module
2023-06-08 14:53:22 -04:00
Spencer McIntyre
d8870d7876
Address msftidy_docs complaints
2023-06-08 14:52:57 -04:00
Metasploit
92cf562950
Bump version of framework to 6.3.21
2023-06-08 12:12:50 -05:00
Metasploit
55e67ac5cd
automatic module_metadata_base.json update
2023-06-08 11:47:13 -05:00
Steve Campbell
229fc0c002
Added symmetricom_syncserver_rce.rb
2023-06-08 12:46:10 -04:00
Christophe De La Fuente
c08f1971cc
Land #18040 , Fix Python's payload issue with Windows
2023-06-08 18:28:07 +02:00
Metasploit
601306b795
automatic module_metadata_base.json update
2023-06-08 08:56:26 -05:00
Grant Willcox
a1e930397a
Land #18072 , Add CVE-2023-1133 - .NET Deserialization exploit for Delta Electronics InfraSuite Device Master
2023-06-08 08:42:07 -05:00
h00die-gr3y
0bcd930f61
Updated NAS model and version check
2023-06-08 09:12:45 +00:00
h00die-gr3y
b3b0cb4ccf
Updates based on space-r7 comments
2023-06-08 07:39:44 +00:00
Ashley Donaldson
717ceae45b
Don't use length for freeing.
...
MSDN says this will never succeed - should always be zero.
2023-06-08 15:02:41 +10:00
manishkumarr1017
6030f75b1a
fixing indentation for shell reverse tcp payload
2023-06-08 06:52:33 +05:30
manishkumarr1017
d454e23aa0
decoding bytes from all python payloads
2023-06-08 06:44:37 +05:30
space-r7
74dd134783
add options in scenarios output
2023-06-07 17:15:28 -05:00
Grant Willcox
4465582fee
Add in link to archived version of the installer
2023-06-07 16:51:01 -05:00
Shelby Pace
3bc145c02c
Update modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb
...
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com >
2023-06-07 16:42:01 -05:00
Shelby Pace
2738906f87
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
...
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com >
2023-06-07 16:41:44 -05:00
Shelby Pace
54649fb856
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
...
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com >
2023-06-07 16:41:37 -05:00
Shelby Pace
4377ff037a
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
...
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com >
2023-06-07 16:41:28 -05:00
Shelby Pace
60c642bcd0
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md
...
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com >
2023-06-07 16:41:19 -05:00
h00die
e3bcc9ac08
rocketmq version scanner
2023-06-07 17:29:53 -04:00
Metasploit
72102de2f2
automatic module_metadata_base.json update
2023-06-07 15:06:56 -05:00
Grant Willcox
5b39eaafc1
Land #18074 , Fix exception handling in gitlab_github_import_rce_cve_2022_2992 module
2023-06-07 14:52:21 -05:00
Metasploit
dbc7a8cb61
automatic module_metadata_base.json update
2023-06-07 14:48:34 -05:00
Grant Willcox
23451260af
Land #18064 , Add support for beta and prerelease versions to grafana_plugin_traversal
2023-06-07 14:33:31 -05:00
Grant Willcox
b923b0c8c3
Add in a typo fix
2023-06-07 11:34:00 -05:00
Grant Willcox
ffbd690a33
Add in ability to support detecting preview versions
2023-06-07 11:25:51 -05:00
space-r7
8f6b421dc1
add non-capture group
2023-06-07 10:52:58 -05:00
Metasploit
d3c662b42b
automatic module_metadata_base.json update
2023-06-07 08:35:09 -05:00
Christophe De La Fuente
82c8b5418e
Land #17936 , PaperCutNG Authentication Bypass with RCE
2023-06-07 15:05:51 +02:00
Christophe De La Fuente
991b9604e5
Add options to the documentation
2023-06-07 15:05:12 +02:00
Metasploit
aa1a014d89
automatic module_metadata_base.json update
2023-06-07 06:25:49 -05:00
Christophe De La Fuente
f88cb3b847
Land #18039 , gitlab file read CVE-2023-2825
2023-06-07 13:07:54 +02:00
h00die-gr3y
46fcdb76d5
Updates based on jvoisin comments
2023-06-07 08:27:55 +00:00
h00die
4950cb3424
review adjustments
2023-06-06 16:24:38 -04:00
space-r7
2fcd97f5ef
close socket
2023-06-06 14:37:58 -05:00
space-r7
102a32c87b
add SCREEN_EFFECTS and akb assessment
2023-06-06 14:12:21 -05:00
space-r7
3b53966caa
add installation steps
2023-06-06 12:14:14 -05:00
Christophe De La Fuente
451735ad15
Fix exception handler & add doc
2023-06-06 17:43:22 +02:00
catatonicprime
a03603d076
Documentation linting.
2023-06-06 15:35:20 +00:00
h00die-gr3y
2e34d69133
Added documentation
2023-06-06 12:18:59 +00:00
cgranleese-r7
18ddd72285
Update jenkins login scanner to work with newer versions
2023-06-06 11:54:55 +01:00
attl4s
ec948b5c16
add documentation
2023-06-06 10:04:57 +02:00
attl4s
a34c3cf055
linted - all offenses addressed
2023-06-06 09:07:57 +02:00
h00die-gr3y
3e6ae74886
init commit module
2023-06-06 07:07:36 +00:00
RageLtMan
e6b1ae2af8
Remote::JndiInjection: handle LDAP UnbindRequest
2023-06-06 00:54:40 -04:00
space-r7
5f7ae883f8
add documentation
2023-06-05 17:38:58 -05:00
space-r7
a12b58df22
add cmdstager usage, description, and metadata
2023-06-05 17:38:27 -05:00
Ashley Donaldson
61539ac260
Fix VBS stager in shell_to_meterpreter.
2023-06-06 07:23:58 +10:00
Metasploit
80e14846fe
automatic module_metadata_base.json update
2023-06-05 13:57:46 -05:00
Grant Willcox
0d094f8645
Land #17917 , shell_to_meterpreter: Support using bind payloads with PAYLOAD_OVERRIDE
2023-06-05 13:36:30 -05:00
Grant Willcox
d029b26b4f
Land #18062 , Created mixin to retrieve the architecture of the current shell.
2023-06-05 12:58:57 -05:00
h00die-gr3y
52745a96d7
Added documentation
2023-06-05 17:18:57 +00:00
Grant Willcox
94ef437f9f
Add in YARD documentation
2023-06-05 12:10:10 -05:00
Grant Willcox
9574c79d36
Remove extra code
2023-06-05 12:07:27 -05:00
Metasploit
70d0b5eee6
automatic module_metadata_base.json update
2023-06-05 11:20:27 -05:00
Grant Willcox
6f2f51bdc3
Land #18066 , refactor archer_c7_traversal as gather module
2023-06-05 10:57:50 -05:00
h00die-gr3y
00e39eb540
updated CMD stager order
2023-06-05 14:54:31 +00:00
Jeffrey Martin
4e91a4e93d
refactor archer_c7_traversal as gather module
...
* Update modules landed as a scanner into a more appropriate category.
* Adds a check method based on TP-link default `TITLE` html.
* Rename module consistent with existing exploit.
2023-06-05 09:07:11 -05:00
ErikWynter
ba3d6dc0f9
fix typo in print statement from original module
2023-06-05 16:21:00 +03:00
ErikWynter
12f59d54df
print the full version to the console
2023-06-05 15:49:06 +03:00
ErikWynter
c5ff96fdfe
grafana_plugin_traversal bugfix
2023-06-05 15:40:27 +03:00
h00die-gr3y
07def1c9f0
init commit module
2023-06-05 11:19:42 +00:00
Ashley Donaldson
795980260b
Created mixin to retrieve the architecture of the current shell.
...
Currently only supports Windows, but does work on Win2000 upwards.
2023-06-05 11:10:53 +10:00
space-r7
1c5f8e09c8
add check method and new options
2023-06-02 17:59:04 -05:00
h00die
8f3325bcf8
move gitlab_auth_subgroups to gahter instead of scanner
2023-06-02 18:06:44 -04:00
Grant Willcox
1a36b81ba0
Land #18057 , Update metasploit-payloads gem to 2.0.135
2023-06-02 13:03:34 -05:00
Metasploit
c9627a7274
automatic module_metadata_base.json update
2023-06-02 11:30:01 -05:00
Spencer McIntyre
734e0b099e
Land #18018 , Add in CVE-2023-29084
...
Add in CVE-2023-29084 - Zoho ManageEngine ADManager Plus ChangePasswordAction
Authenticated Command Injection
2023-06-02 12:14:43 -04:00
Metasploit
7a2505e6f8
automatic module_metadata_base.json update
2023-06-02 11:10:00 -05:00
bwatters
1e9d286c77
Land #18044 , Add MIPS64 Linux Fetch Payloads
...
Merge branch 'land-18044' into upstream-master
2023-06-02 10:53:43 -05:00
Grant Willcox
7728e1e2fb
Add in new library function for escaping PowerShell literals
2023-06-02 10:22:56 -05:00
Grant Willcox
617aff5a43
Fix up supported payloads and remove nonused parameter
2023-06-02 09:48:03 -05:00
Grant Willcox
f7d2cdae56
Add in ability to restore settings n documentation changes.
...
Previously there was not the ability to restore the server proxy setting.
This updates the code to do so. Additionally this also updates the documentation
to note that Fetch payloads are incompatible with this module since they
use HTTP connections that will be impacted by this module changing the server's
HTTP proxy settings. There is no way around this.
2023-06-02 09:48:03 -05:00
Grant Willcox
965311d09e
Fix documentation and fix bug in creating PARMS value
2023-06-02 09:48:02 -05:00
Grant Willcox
6e89f9b275
Address review comments
2023-06-02 09:48:02 -05:00
Grant Willcox
3ab4173d6c
Fix up base64 encoder to properly quote strings - credit to @smcintyre-r7 for the fix
2023-06-02 09:48:02 -05:00
Grant Willcox
8577f21e52
Add in documentation and updated code
2023-06-02 09:48:01 -05:00
Grant Willcox
05bb3cd182
Update again
2023-06-02 09:48:01 -05:00
Grant Willcox
c78a9bac1d
Remove dropper target and try expand potential BadChars and limit payload size???
2023-06-02 09:48:01 -05:00
Grant Willcox
6d066dc649
Add in initial copy of exploit
2023-06-02 09:47:49 -05:00
Spencer McIntyre
372f9cdcfc
Update metasploit-payloads gem to 2.0.135
...
Includes changes from:
* rapid7/metasploit-payloads#648
* rapid7/metasploit-payloads#637
* rapid7/metasploit-payloads#646
* rapid7/metasploit-payloads#645
* rapid7/metasploit-payloads#643
* rapid7/metasploit-payloads#640
2023-06-02 09:49:57 -04:00
Metasploit
93614513ec
automatic module_metadata_base.json update
2023-06-02 08:43:07 -05:00
Spencer McIntyre
8b641c4c97
Land #18055 , Update aws_keys to run against linux
...
Update post/multi/gather/aws_keys to run against linux sessions
2023-06-02 09:28:13 -04:00
Spencer McIntyre
a6f1be8efd
Add new payloads to payloads_spec.rb
2023-06-02 09:07:18 -04:00
Metasploit
48b86c2578
automatic module_metadata_base.json update
2023-06-02 06:11:26 -05:00
Christophe De La Fuente
4661e9721e
Land #18002 , Added cmd useradd payload
2023-06-02 12:53:49 +02:00
manishkumarr1017
f8460dcdd2
PR Review changes for removing platform specific code
2023-06-02 14:50:46 +05:30
h00die
da2e339ae8
review adjustments
2023-06-02 05:15:44 -04:00
space-r7
a66641da55
add delta electronics infrasuite deserialization
2023-06-01 17:57:57 -05:00
Grant Willcox
0f71613b66
Land #18056 , Modify command stagers to not go over 100%
2023-06-01 16:06:13 -05:00
Metasploit
9b929dab14
automatic module_metadata_base.json update
2023-06-01 15:28:09 -05:00
Grant Willcox
7f7c5ea1f1
Land #17868 , Improve check_host return code handling
2023-06-01 15:04:59 -05:00
Grant Willcox
f6dc2c007a
Fix up messages to more closely match check code messages and fix typos
2023-06-01 12:38:20 -05:00
adfoster-r7
c6816fceec
Update post agther aws keys to run against linux
2023-06-01 18:19:11 +01:00
Ryuuuuu
d535bb87ad
Fix up logic to handle check_host return codes
2023-06-01 12:17:59 -05:00
Metasploit
25e8cf8faf
Bump version of framework to 6.3.20
2023-06-01 12:10:08 -05:00
Zach Goldman
96f2c96a75
modify command stagers to not go over 100%
2023-06-01 12:07:07 -05:00
RadioLogic
4183cd444d
Added unixcrypt to payload
2023-06-01 12:30:26 -04:00
Grant Willcox
068e0f5192
Land #18052 , Fix broken file upload test on Windows sessions
2023-06-01 11:22:18 -05:00
Metasploit
2c987da8e1
automatic module_metadata_base.json update
2023-06-01 11:11:29 -05:00
Christophe De La Fuente
8ed981e575
Land #18003 , Archer c7 traversal
2023-06-01 17:37:13 +02:00
Spencer McIntyre
8378435051
Land #17430 , Add AWS SSM Sessions
2023-06-01 11:34:40 -04:00
RadioLogic
c336f179d6
Gave rootmethod option better description
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-06-01 11:32:39 -04:00
RadioLogic
d868d0ec14
Fixed double checking of sudoers
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-06-01 11:32:03 -04:00
adfoster-r7
4340245b14
Fix broken binary file upload test on windows sessions
2023-06-01 14:18:53 +01:00
adfoster-r7
46f7f8e7b0
Add module for running all post test modules
2023-06-01 11:51:33 +01:00
Ashley Donaldson
7f4bda193d
Support retrieving Service Pack version on older OSes
2023-06-01 10:48:17 +10:00
Spencer McIntyre
9349dd24e3
Add a proper definition for NtdsCaSecurityExt
2023-05-31 17:31:33 -04:00
Grant Willcox
2a410e126d
Land #18026 , Fix non-deterministic test module load failures
2023-05-31 15:09:17 -05:00
h00die
1267d067b3
move gitlab_subgroup to gitlab_authenticated_subgroup
2023-05-31 15:29:00 -04:00
Grant Willcox
ab12bee83e
Fix single quote issue
2023-05-31 14:25:02 -05:00
catatonicprime
3875947f7d
Removing unnecessary assignment
2023-05-31 19:17:30 +00:00
Metasploit
d60f21df24
automatic module_metadata_base.json update
2023-05-31 12:49:42 -05:00
RadioLogic
0e477bdc9a
Used unixcrypt to create encrypted password
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-05-31 13:47:29 -04:00
RadioLogic
2fab56f905
Made cachesize dynamic
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-05-31 13:46:05 -04:00
Grant Willcox
6756047f1f
Land #18028 , Add Apache NiFi login scanner module
2023-05-31 12:25:18 -05:00
Grant Willcox
ccbdd7870e
Update documentation
2023-05-31 11:57:42 -05:00
Catatonic Prime
6351c66b1e
Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-05-31 08:56:13 -07:00
Catatonic Prime
6ad9ebb5c0
Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-05-31 08:48:53 -07:00
Grant Willcox
1fd2d41835
Fix typos and add dig for safe navigation
2023-05-31 10:34:10 -05:00
shellchocolat
1fbba702de
add support to masm formatting
2023-05-31 17:17:17 +02:00
Ashley Donaldson
4b1158d5f1
Use existing shell registry logic
2023-05-31 11:24:33 +10:00
Grant Willcox
cf9f9905e3
Fix more typos
2023-05-30 17:30:57 -05:00
Ashley Donaldson
778a2c47b7
Updated unit tests to use registry
2023-05-31 08:09:54 +10:00
Grant Willcox
c0671c325a
Touch up typos in documentation
2023-05-30 15:27:31 -05:00
Spencer McIntyre
d7098aa06d
Add MIPS64 fetch adapters
2023-05-30 15:03:06 -04:00
Spencer McIntyre
8a0dfa57a0
Drop size requirement and fix descriptions
...
The size requriement is used when the adapted payload is executed from
the command line but that's not the case for the fetch payloads which
execute a command to fetch the payload from a URL. The payload size
doesn't matter because it's included in the executable file hosted at
the URL.
2023-05-30 15:03:06 -04:00
catatonicprime
530ed911f4
Fixing ZDI ID
2023-05-30 19:03:01 +00:00
catatonicprime
b376dac34b
okay linter
2023-05-30 18:40:59 +00:00
catatonicprime
cbf850b2b7
Apparently the comment after the rescue squelchs the linter.
2023-05-30 18:38:48 +00:00
Grant Willcox
3d63d0b097
Land #18030 , Fix missing return in HTTP CmdStagers
2023-05-30 13:14:21 -05:00
Grant Willcox
42d4c73cda
Land #18031 , Improve help for "edit" and "log" commands
2023-05-30 11:43:21 -05:00
Metasploit
490a30aa4a
automatic module_metadata_base.json update
2023-05-30 11:34:17 -05:00
Grant Willcox
d194cf28eb
Land #18032 , Escape braces after all in cmd/brace encoder
2023-05-30 11:18:34 -05:00
Metasploit
4da004938f
automatic module_metadata_base.json update
2023-05-30 10:27:30 -05:00
Grant Willcox
002c575ee1
Land #18036 , Fix incorrect error handling in IBM sametime enumerate users module
2023-05-30 09:53:54 -05:00
Christophe De La Fuente
ef89219715
Land #17899 , Dolibarr 16 unauthenticated contact database dump
2023-05-30 16:41:28 +02:00
Christophe De La Fuente
7bde39ae73
Fixes from code review
2023-05-30 13:26:56 +02:00
adfoster-r7
e2718eb40c
Land #18019 , Fixes validation for to_handler command for Evasion and Payload modules
2023-05-30 10:39:01 +01:00
Ashley Donaldson
568e346d11
Support Windows 2000 by using ver command
2023-05-30 13:23:44 +10:00
Ashley Donaldson
a94f78ec03
Use direct registry lookups to get version data, to cater for different language packs.
2023-05-30 12:21:12 +10:00
adfoster-r7
a5171ffa3a
Land #18041 , Minor fix in vsftpd_232.md docs
2023-05-29 23:59:54 +01:00
Metasploit
d74b221df3
automatic module_metadata_base.json update
2023-05-29 17:02:08 -05:00
Jack Heysel
b575f92d0a
Minor fix in vsftpd docs
2023-05-29 17:55:36 -04:00
Jack Heysel
0b9aff0661
Land #18004 , VSFTPD Dos Module
...
This PR adds a dos module for cve-2011-0762
which exploits the vsftpd server
2023-05-29 17:39:02 -04:00
jheysel-r7
1018ed1aaf
Update documentation/modules/auxiliary/dos/ftp/vsftpd_232.md
2023-05-29 15:40:42 -04:00
Metasploit
b9038bfbfb
automatic module_metadata_base.json update
2023-05-29 11:48:51 -05:00
Jack Heysel
fa6d168121
Land #18025 , Apache NiFi version scanner module
...
This PR adds a verion scanner for Apache Nifi
2023-05-29 12:21:39 -04:00
manishkumarr1017
bebf8d4db8
changing payload structure of python's reverse_tcp for fixing windows bytes args is not allowed issue
2023-05-29 21:38:16 +05:30
h00die
5f308e0176
gitlab file read CVE-2023-2825
2023-05-29 00:55:02 -04:00
h00die
01359e77a7
gitlab file read CVE-2023-2825
2023-05-29 00:52:07 -04:00
h00die
0ccfa4af87
gitlab file read CVE-2023-2825
2023-05-29 00:48:15 -04:00
adfoster-r7
489421f6be
Fix incorrect error handling in ibm sametime enumerate users
2023-05-28 00:29:17 +01:00
h00die
cf2ca434a8
spelling
2023-05-26 15:53:16 -04:00
h00die
93479be5e6
review comments
2023-05-26 15:47:22 -04:00
RadioLogic
573eb4bda4
Merge branch 'master' into archer_c7_traversal
2023-05-26 01:48:43 -04:00
wvu
f5bec517a0
Escape braces after all in cmd/brace encoder
...
Previously escaped only commas.
2023-05-25 23:46:18 -05:00
wvu
00451e3aec
Improve help for "edit" and "log" commands
...
Talking about `LocalEditor` and `LocalPager`.
2023-05-25 23:22:54 -05:00
wvu
9528339761
Fix missing return in HTTP CmdStagers
...
Fetch payloads are cooler, but this was missed in https://github.com/rapid7/metasploit-framework/pull/13426 .
2023-05-25 22:22:23 -05:00
RadioLogic
250a8768e3
Updated doc to appease msftidy
2023-05-25 21:28:19 -04:00
RadioLogic
61c4ba7503
Renamed module to correct name
2023-05-25 21:21:49 -04:00
RadioLogic
376ef7a8bc
Made several fixes for msftidy
2023-05-25 21:16:07 -04:00
h00die
48207dd9f1
apache nifi login module
2023-05-25 16:57:32 -04:00
Jack Heysel
d8255157c9
Land #18021 , Fix #cd for Powershell Sessions
2023-05-25 14:26:01 -04:00
RadioLogic
72ef6537ef
Added tested versions to description
2023-05-25 14:21:52 -04:00
RadioLogic
cb8d86651d
Added build setup for arch linux
2023-05-25 14:19:44 -04:00
RadioLogic
b11b31c9ae
Moved docker description into vulnerable application
2023-05-25 14:18:15 -04:00
RadioLogic
1d98cb0069
Added better description to documentation
2023-05-25 13:34:04 -04:00
Metasploit
8368b80ad6
Bump version of framework to 6.3.19
2023-05-25 12:05:49 -05:00
attl4s
217df628df
fix getting the username + use Failure::BadConfig instead of NoTarget
2023-05-25 19:05:42 +02:00
attl4s
39b45694af
Update datastore option USER -> USERNAME
...
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com >
2023-05-25 18:55:49 +02:00
Jeffrey Martin
2879dcaf14
Land #18024 , fix case-insensitive hash collisions
2023-05-25 10:42:39 -05:00
Zach Goldman
7215b88bad
bump credential version
2023-05-25 10:38:39 -05:00
Ashley Donaldson
75ba9110e2
Added module for Windows version comparisons
...
Utilised it in various existing modules - this should fix some subtle bugs in specific modules' version detection.
2023-05-25 14:36:46 +10:00
adfoster-r7
9f0032582a
Fix non-deterministic test module load failures
2023-05-25 02:44:03 +01:00
h00die
7c2790513d
apache nifi version scanner
2023-05-24 20:05:34 -04:00
Grant Willcox
7ca7c6aee1
Slight efficiency improvements
2023-05-24 17:36:39 -05:00
Grant Willcox
e80987ea59
First round of updates from review
2023-05-24 13:17:49 -05:00
Grant Willcox
e78cf054b8
Add in EITW notes
2023-05-24 13:17:49 -05:00
Grant Willcox
84961e6e09
Add in documentation
2023-05-24 13:17:49 -05:00
Grant Willcox
9e8d1ed2ea
Add in Java class file, raw source code, and tidy up the module a bit
2023-05-24 13:17:48 -05:00
Grant Willcox
155319d479
Save work
2023-05-24 13:17:48 -05:00
Grant Willcox
3faf96aa9d
Check return code on target server responses
2023-05-24 13:17:48 -05:00
Grant Willcox
5ded2adfb5
Add in code initial code to start supporting JNDI loading of remote classes, currently a bit broken though
2023-05-24 13:17:47 -05:00
Grant Willcox
d00d339de5
Initial copy with JNDI connection back to LDAP server.
2023-05-24 13:17:47 -05:00
RadioLogic
1c57019096
Merge branch 'master' into vsftpd_232
2023-05-24 10:58:22 -04:00
RadioLogic
9c58289b21
Added container info in documentation
2023-05-24 10:54:31 -04:00
RadioLogic
0aee634d67
Put authors on separate lines
2023-05-24 10:48:31 -04:00
attl4s
240fd65d0c
module, not exploit
2023-05-24 16:30:38 +02:00
attl4s
623657b072
Logontype changed to OptEnum + better meterpreter session requirement check
2023-05-24 16:28:56 +02:00
attl4s
42ef5ad322
remove TLV_TYPE_TOKEN_UPDATE_RESULT - update_token sends empty response when succeeds
2023-05-24 16:12:12 +02:00
attl4s
3a685849a8
add update_token bridge + make_token module
2023-05-24 10:33:52 +02:00
vtoutain
b327809450
Changes regarding auxiliary modules
...
Changed back some modifications of includes and functions definitions that were related to exploit modules.
2023-05-24 09:28:41 +02:00
vtoutain
e542c50154
Merge branch 'rapid7:master' into dolibarr_16_contact_dump
2023-05-24 09:26:03 +02:00
Spencer McIntyre
ed5d516c21
Sync the .NET working path for Powershell sessions
...
See: https://github.com/PowerShell/PowerShell/issues/10278
2023-05-23 15:21:52 -04:00
Spencer McIntyre
afb31b0f21
Add a function to escaple cmd.exe string literals
2023-05-23 15:17:39 -04:00
Grant Willcox
e749945b01
Land #18009 , Clearing http web data service credentials in msfconsole
2023-05-23 12:15:52 -05:00
Metasploit
5189c7af83
automatic module_metadata_base.json update
2023-05-23 08:57:43 -05:00
Spencer McIntyre
9e38ed4459
Land #17929 , Linux sudoedit LPE (CVE-2023-22809)
...
Linux sudoedit priv esc (CVE-2023-22809)
2023-05-23 09:30:18 -04:00
cgranleese-r7
3e327efdc4
Fixes validation for to_hanler command for Evasion and Payload modules
2023-05-23 10:16:06 +01:00
Spencer McIntyre
120dc877ad
Pr/collab/17430 ( #41 )
...
* Prevent using post modules with the session
It doesn't work reliably because of winpty and how the output is
mangled.
* Set the limit correctly
* Fix Linux PTY downgrade issues
* Remove filtering
The filtering implementation is incomplete and unnecessary.
Filtering is unnecessary because Linux sessions execute a stub on
session start up that uses a combiantion of stty and a fifo to emulate a
PTY-less session. Windows sessions do not need filtering because they
have been explictly marked as being incompatible with the Post API which
is confused by the extra characters.
The filtering implementation is incomplete because it does not account for
echo fragments that are split across lines. It also does not account for
all of the ANSI escape codes.
* Add module docs for enum_ssm
2023-05-22 17:11:16 -04:00
sfewer-r7
0205bb36d3
change ranking to GreatRanking as stability is CRASH_SERVICE_RESTARTS
2023-05-22 20:09:11 +01:00
adfoster-r7
f89de600be
Land #18015 , remove dead link from wiki
2023-05-22 18:44:09 +01:00
sfewer-r7
6b101b5a4d
make rubocop happy
2023-05-22 18:03:58 +01:00
adfoster-r7
1eb6996ea5
Land #17989 , Improves flag formatting for kerberos ticket presenter
2023-05-22 17:42:10 +01:00
Tom Kelley
4dcfe0a1cf
Remove dead link
2023-05-22 09:38:36 -07:00
Metasploit
d9cbe065ce
automatic module_metadata_base.json update
2023-05-22 10:15:11 -05:00
space-r7
60f6574bf3
Land #17965 , add module for AD CS cert management
2023-05-22 09:50:53 -05:00
dwelch-r7
e27a08a073
Land #18010 , Fix edgecase crash when running smb_login with Kerberos auth activated
2023-05-22 15:44:33 +01:00
Spencer McIntyre
0a3247f1a7
Add documentation
2023-05-22 10:29:03 -04:00
Spencer McIntyre
e3823691a1
Add module for AD CS template CRUD operations
2023-05-22 10:28:58 -04:00
Grant Willcox
ae430ff3db
Land #18013 , Exclude IDE development collateral from Gemspec
2023-05-22 09:03:10 -05:00
Jeffrey Martin
5a96979363
exclude IDE development collateral from gemspec
2023-05-22 08:28:23 -05:00
Spencer McIntyre
8258657a45
Add the ESC1 certificate template
2023-05-22 09:21:24 -04:00
Spencer McIntyre
a88751167b
Add specs for .from_sddl_text
2023-05-22 09:21:24 -04:00
Spencer McIntyre
ff4fafda2f
Add support for parsing SDDL
2023-05-22 09:21:24 -04:00
Spencer McIntyre
3af052390d
Add well known SID and RID constants
2023-05-22 09:21:24 -04:00
Spencer McIntyre
49fd6e876a
Add constants from MS-CRTD
2023-05-22 09:21:24 -04:00
Spencer McIntyre
1ffefcbea4
Treat the subauthority as optional
...
This allows some additional SIDs to function such as
SECURITY_CREATOR_SID_AUTHORITY.
2023-05-22 09:21:24 -04:00
Spencer McIntyre
d23f407c44
Monkey patch #modify to accept controls
2023-05-22 09:21:24 -04:00
Spencer McIntyre
dcbc6d19c5
Update #validate_query_result!
...
The function required a filter argument, but not every query has a
filter. By removing it, we can reuse the same logic for other operations
including modifications.
2023-05-22 09:21:20 -04:00
RadioLogic
f1468a83ed
Added forgotten end
2023-05-21 13:40:52 -04:00
RadioLogic
7a9f13c960
Added option to remove sudoers check
2023-05-21 12:18:32 -04:00
RadioLogic
4b3d6b59cc
Replaced fail_with with raised error
2023-05-21 12:10:18 -04:00
RadioLogic
dc11d818aa
Corrected failwith statement
2023-05-21 00:37:00 -04:00
RadioLogic
3dc9438b3a
Added firmware version to documentation
2023-05-21 00:33:33 -04:00
RadioLogic
33e59a291e
Added check for user
2023-05-21 00:26:18 -04:00
RadioLogic
e0e214e241
Merge branch 'master' into useradd
2023-05-20 18:21:18 -04:00
RadioLogic
ed026e52eb
Fixed echo option so sudo would work
2023-05-20 18:14:46 -04:00
RadioLogic
fffc7f514d
Fixed issue with description
2023-05-19 15:24:53 -04:00
RadioLogic
c42905fe92
Updated description
2023-05-19 13:45:45 -04:00
RadioLogic
d07f2ed633
Set default method to sudo
2023-05-19 13:45:11 -04:00
RadioLogic
b077167d73
Redesigned to not use exectuable at all
2023-05-19 13:34:12 -04:00
RadioLogic
a8fd4e7aba
Renamed to adduser for consistency
2023-05-19 13:31:55 -04:00
adfoster-r7
9dd10d6df7
Fix edgecase crash when running smb_login with Kerberos auth activated
2023-05-19 16:12:16 +01:00
cgranleese-r7
8d131f0a95
Updates the msfdb prompts for webservice
2023-05-19 12:57:35 +01:00
Metasploit
428229aede
Bump version of framework to 6.3.18
2023-05-18 12:10:55 -05:00
Metasploit
61569a0b2e
automatic module_metadata_base.json update
2023-05-18 11:43:04 -05:00
Spencer McIntyre
f464401dde
Land #17782 , Add fetch payloads
...
Add http wget cmd based fetch payload for Linux and Windows
2023-05-18 12:18:27 -04:00
cgranleese-r7
de6e26de8e
Land #18006 , Fix error when msfconsole opens browser links without a display present
2023-05-18 16:56:29 +01:00
bwatters
548a2d7ab4
Add fetch payloads for Windows and Linux x64
2023-05-18 10:47:29 -05:00
cgranleese-r7
26daa65c58
Land #18005 , Fix crash when running a module through socks 4a proxy
2023-05-18 13:25:33 +01:00
adfoster-r7
39f4ccd9f9
Fix error when msfconsole opens browser links without a display present
2023-05-18 10:29:22 +01:00
adfoster-r7
3e32c0e22d
Fix crash when running a module through socks 4a proxy
2023-05-18 10:25:56 +01:00
Metasploit
4df7551759
automatic module_metadata_base.json update
2023-05-17 19:11:48 -05:00
space-r7
6c88e85d02
Land #17993 , add invscout RPM privesc
2023-05-17 18:56:42 -05:00
Grant Willcox
2c0dc61bd2
Land #17991 , Add config for Solargraph to aid IDEs
2023-05-17 16:10:44 -05:00
Grant Willcox
d4b9473294
Ignore .solargraph.yml config file
2023-05-17 15:03:05 -05:00
RadioLogic
21273648a4
Fixed response using double quotes
2023-05-17 12:39:02 -04:00
RadioLogic
6882a7cc60
Shortened payload to be readable
2023-05-17 12:05:40 -04:00
RadioLogic
62f48c5933
Updated vsftpd_232 documentation
2023-05-17 12:01:59 -04:00
RadioLogic
ab0b8b8274
Ran msftidy on module
2023-05-17 11:48:09 -04:00
cgranleese-r7
73a33a9f73
Addresses PR feedback
2023-05-17 16:45:15 +01:00
RadioLogic
775173381c
Made progress show in dots rather than status
2023-05-17 11:44:37 -04:00
RadioLogic
9c888da5cb
Reverted from threading as payload finally works
2023-05-17 11:43:50 -04:00
RadioLogic
49e7c2459f
Fixed payload to properly function
2023-05-17 11:40:29 -04:00
RadioLogic
9a732a881b
Improve module description
...
Co-authored-by: bcoles <bcoles@gmail.com >
2023-05-17 08:09:25 -04:00
RadioLogic
789646dd65
Use better failwith lines
...
Co-authored-by: bcoles <bcoles@gmail.com >
2023-05-17 08:08:59 -04:00
bcoles
0bc1fdf51d
Add invscout RPM Privilege Escalation
2023-05-17 20:17:55 +10:00
RadioLogic
10dd1b8906
Updated scenarios for vsftpd_232
2023-05-17 00:44:46 -04:00
RadioLogic
6a846c2c94
Added stub since stopping doesnt exist
2023-05-17 00:44:18 -04:00
RadioLogic
e1a9f61ad9
Added documentation to scanner module
2023-05-17 00:00:00 -04:00
RadioLogic
f15c9a0bbb
Added cmd useradd payload
2023-05-16 23:16:54 -04:00
RadioLogic
4f70be41ae
Removed lib include line as it became redundant
2023-05-16 23:02:55 -04:00
RadioLogic
0bf5746bde
Added recommended folders to config
2023-05-16 18:25:37 -04:00
RadioLogic
6fdc86db19
Set max files to 0
2023-05-16 18:25:07 -04:00
h00die
2ca5ca1f63
stronger grep
2023-05-16 16:18:14 -04:00
RageLtMan
f929d2c90f
Drop redundant shell_command in powershell.rb
2023-05-16 15:43:16 -04:00
RageLtMan
713ec6ae76
Merge branch 'master' into feature/aws_ssm_sessions
2023-05-16 14:39:37 -04:00
Metasploit
571e3d5e99
automatic module_metadata_base.json update
2023-05-16 09:35:29 -05:00
cgranleese-r7
82bf51647d
Improves flag formatting for kerberos ticket presenter
2023-05-16 15:25:36 +01:00
Grant Willcox
459cf871cb
Land #17979 , Add exploit for Ivanti Avalanche file upload - CVE-2023-28128
2023-05-16 09:19:33 -05:00
h00die
6bee4f56d9
updates from review
2023-05-13 15:49:11 -04:00
Grant Willcox
560fc9000b
Fix up checks on responses to make sure they are more robust checks
2023-05-12 16:08:47 -05:00
Grant Willcox
ea988f0c78
Add more documentation on how to set the target up based on my own experience and so that we have a backup in case the link to external documentation breaks
2023-05-12 14:27:39 -05:00
Grant Willcox
3b2d23eeae
Fix up check method, unduplicate fail_with messages to make them unique, and add @cleanup_needed so we can check if cleanup is needed to avoid unnecessary messages when just checking if the target is vulnerable or not
2023-05-12 14:14:40 -05:00
RadioLogic
b7b1df23ea
Implemented threading into module
2023-05-12 14:28:10 -04:00
RadioLogic
04e6bf804f
Made stability involve service down
2023-05-12 14:27:58 -04:00
RadioLogic
0e9060e295
Added documentation for module
2023-05-12 14:27:12 -04:00
Metasploit
3c0222d7d0
automatic module_metadata_base.json update
2023-05-12 13:16:50 -05:00
adfoster-r7
f40a2e8dbc
Land #17990 , ibstat_path: Use AutoCheck, add Notes, resolve Rubocop violations
2023-05-12 19:03:22 +01:00
adfoster-r7
c723a2865e
Land #17987 , Split recalculate out into multiple functions
2023-05-12 18:27:46 +01:00
RadioLogic
2e5b38e718
Merge branch 'master' into solargraph
2023-05-12 13:02:36 -04:00
Dean Welch
3036a53697
Change name to single_name for consistency
2023-05-12 16:59:33 +01:00
Dean Welch
f6855f6aa4
Split recalculate out into multiple functions
2023-05-12 16:30:14 +01:00
RadioLogic
f46967e2c4
Added config for solargraph to aid IDEs
2023-05-12 11:29:32 -04:00
bcoles
004a72c32e
ibstat_path: Use AutoCheck, add Notes, resolve Rubocop violations
2023-05-13 01:27:53 +10:00
dwelch-r7
b752735db1
Land #17967 , Fix ruby 3.1 crashes and resource leaks when garbage collecting Meterpreter resources
2023-05-12 14:14:02 +01:00
Grant Willcox
cf5f90ac4f
Minor updates to documentation to tidy things up a bit
2023-05-11 16:48:16 -05:00
space-r7
722de33b6f
address feedback, use cleanup to restore path
...
fix bug where if config restore failed, module would
output that it was both a failure and a success
add akb topic as reference
2023-05-11 13:20:25 -05:00
Metasploit
20ac531254
automatic module_metadata_base.json update
2023-05-11 13:11:32 -05:00
adfoster-r7
ff1331c11b
Land #17985 , fix typo in sticky_keys.rb
2023-05-11 18:50:18 +01:00
Edmond Major III
d24f5873bd
Update sticky_keys.rb
...
Persistance -> Persistence
Fix a small typo
2023-05-11 12:22:54 -05:00
Metasploit
484639a2e0
Bump version of framework to 6.3.17
2023-05-11 12:13:25 -05:00
catatonicprime
a445b07233
removing unnecessary call to payload_uri
2023-05-11 16:35:53 +00:00
Shelby Pace
131f2519bc
Update modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-05-11 10:48:48 -05:00
Metasploit
3ffd072852
automatic module_metadata_base.json update
2023-05-11 10:24:58 -05:00
adfoster-r7
fa6a5e24f0
Land #17807 , Add in documentation on Metasploit's file system
2023-05-11 16:11:12 +01:00
Grant Willcox
63ffb850dd
Land #17984 , Fix kerberos datastore name typo in winrm docs
...
Fix kerberos datastore name typo in winrm docs
2023-05-11 09:56:22 -05:00
adfoster-r7
eb959e2e40
Land #17060 , GSoC Project: Implement HTTP-Trace enabled login scanners
2023-05-11 15:45:01 +01:00
Metasploit
e3e23d3d7c
automatic module_metadata_base.json update
2023-05-11 09:42:41 -05:00
Grant Willcox
020ee7ca5c
Land #17964 - Pentaho Business Server Auth Bypass and SSTI - CVE-2022-43769 and CVE-2022-43939
2023-05-11 09:28:55 -05:00
Spencer McIntyre
d8dd9bbe79
Move the publish timeout logic ( #40 )
...
This makes it accessible from enum_ssm so Linux sessions can be opened.
2023-05-11 09:58:16 -04:00
Spencer McIntyre
dbda20d40b
Land #17980 , Fix Powershell session's #exist?
...
Replace [System.IO.File]::Exists with Test-Path
2023-05-11 09:10:43 -04:00
adfoster-r7
fe63d80679
Fix issues: double encoding bug, nessus scanner logging, remove dead cgi option
2023-05-11 13:01:52 +01:00
adfoster-r7
55de00911f
Fix kerberos datastore name typo in winrm docs
2023-05-11 12:40:00 +01:00
catatonicprime
c43eaf86bc
Adding documentation.
2023-05-11 05:09:35 +00:00
catatonicprime
d50bd24c2f
Adding config cleanup.
2023-05-11 04:57:57 +00:00
catatonicprime
cb2c6a7d80
Prevent bypass_auth from being called twice when AutoCheck is true
2023-05-11 00:34:47 +00:00
Grant Willcox
9f6a1c18a1
Minor updates to fix URLs, disclosure date, description, and minor gramatical things
2023-05-10 18:22:00 -05:00
Spencer McIntyre
e92695149d
Fix linux tests, remove Windows support ( #39 )
...
* Revert "shell_command_token_base get 0th output index"
This reverts commit 3a4cb3560f .
* Correct the order of arguments to #set_term_size
* Fix paths for directory checks
The path C:\ ends with a trailing backslash which will cause bash to
wait for another line if input. This places the shell in an undesirable
state.
* Fix post module tests for Linux
* Remove the command document
This hasn't been tested and it's unclear under what conditions this
would be used.
* Fix Windows SSM sessions
---------
Co-authored-by: Spencer McIntyre <zeroSteiner@gmail.com >
2023-05-10 17:48:53 -04:00
Grant Willcox
9f0a6503b7
require.js is not the only way, account for this new discovery in code
2023-05-10 13:02:02 -05:00
Grant Willcox
5d4e68d36c
Add Metasploit payload example and remove message that may suggest successful exploitation occurred even when it didn't
2023-05-10 10:36:29 -05:00
Grant Willcox
1b8f1de7c8
Add in fixes from review, add archive of software, and use uri_encode_mode for encoding parameters.
2023-05-10 10:16:08 -05:00
RageLtMan
62e59e6250
Replace [System.IO.File]::Exists with Test-Path
...
The exists? method in post/file has a different implementation for
PSH sessions than other shells which are testing for the existence
of a path, not the presence of a file.
Fix this by replacing [System.IO.File]::Exists with Test-Path.
Testing:
```
PS C:\Windows\system32> [System.IO.File]::Exists("C:\")
False
PS C:\Windows\system32>test-path C:\
PS C:\Windows\system32> test-path C:\
True
```
2023-05-10 11:10:08 -04:00
vtoutain
e742df1c33
Rubocop warning fix
2023-05-10 16:18:33 +02:00
space-r7
e514de9aef
add comment about jsf substitution
2023-05-10 09:13:01 -05:00
Metasploit
87ba25c706
automatic module_metadata_base.json update
2023-05-10 05:06:35 -05:00
vtoutain
cfea6530a1
Merge branch 'rapid7:master' into dolibarr_16_contact_dump
2023-05-10 11:59:46 +02:00
vtoutain
d50993cd80
reviews from cdelafuente-r7
...
Used the AutoCheck mixin, removed the exploit function that was mileading, removed the hardcoded HttpTimeout, and refactored some code portions.
2023-05-10 11:59:09 +02:00
vtoutain
daee69e1d0
Fix msftidy errors
2023-05-10 11:55:50 +02:00
Christophe De La Fuente
a485a786ef
Land #17881 , Zyxel chained RCE using LFI and weak password derivation algorithm
2023-05-10 11:49:51 +02:00
h00die-gr3y
4f8024454c
Updates based on cdelafuente-r7 latest comments
2023-05-10 07:46:11 +00:00
catatonicprime
c5b0bc68d7
Improved automatic targeting, tested back to major version 14
2023-05-09 23:44:46 +00:00
catatonicprime
eff189f221
Ensuring csrf_token is initialized.
2023-05-09 23:43:56 +00:00
catatonicprime
43564b5267
Removing unneeded features/options.
2023-05-09 23:43:30 +00:00
Jack Heysel
79d35ad938
Fixed check method
2023-05-09 14:25:03 -05:00
Jack Heysel
eca87ea2eb
Updated side effects and fixed fail_withs
2023-05-09 14:25:03 -05:00
Jack Heysel
348750ea70
Updated Authors
2023-05-09 14:25:02 -05:00
Jack Heysel
07056a74bc
Pentaho Business Server Auth Bypass and SSTI
2023-05-09 14:24:51 -05:00
adfoster-r7
908f7ad3f3
Land #17972 , updates to some of the example modules to keep them in line with framework changes
2023-05-09 18:46:25 +01:00
space-r7
d60843f0eb
name versions that are vulnerable
2023-05-09 09:16:42 -05:00
space-r7
08a79a2f4e
add documentation
2023-05-08 17:42:23 -05:00
space-r7
d1e3ce1183
add Ivanti Avalanche file upload
2023-05-08 17:41:52 -05:00
Metasploit
4e85f9e4da
automatic module_metadata_base.json update
2023-05-08 17:36:25 -05:00
Grant Willcox
6dbee6e6f6
Land #17968 , Fix a bug in ACE processing when searching for ESC vulnerabilities
2023-05-08 17:12:12 -05:00
Grant Willcox
bc25907d1e
Add additional clarity to some segments of the module
2023-05-08 16:43:26 -05:00
Spencer McIntyre
cdab415ffb
Fix a bug in ACE processing
...
There was an issue in the ACE processing where only ACEs corresponding
to an object were processed for SIDs with enrollment rights. The
processing should also process ACEs that grant the enrollment right and
are not related to any objects. In other words, only ACEs associated
with an object that is neither the CERTIFICATE_ENROLLMENT_EXTENDED_RIGHT
or CERTIFICATE_AUTOENROLLMENT_EXTENDED_RIGHT right should be ignored.
2023-05-08 16:00:38 -05:00
h00die
12911d10fb
review comments
2023-05-08 15:25:31 -04:00
Metasploit
4fa6022adb
automatic module_metadata_base.json update
2023-05-08 13:49:17 -05:00
Grant Willcox
89889d5e79
Land #17133 , Add manageengine adaudit plus authenticated rce module and docs - CVE-2021-4284
2023-05-08 13:23:38 -05:00
Grant Willcox
f773d348e1
Add in notes about reliability of the module, and also add documentation on 7005 test on Windows 2022
2023-05-08 12:11:01 -05:00
Grant Willcox
c221edb1ec
Add in ADAudit Plus build 6077 testing examples
2023-05-08 11:45:44 -05:00
h00die
0ace550537
small updates to example modules
2023-05-07 13:02:30 -04:00
h00die-gr3y
51ab9746fb
Updates based on cdelafuente-r7 comments
2023-05-06 19:05:21 +00:00
catatonicprime
c69ca39748
consistent indenting
2023-05-06 05:07:59 +00:00
catatonicprime
0448d408ea
Match wording from "How to write a module using HttpServer and HttpClient" on docs.metasploit.com
2023-05-06 04:58:50 +00:00
catatonicprime
af3c482acd
heh, I probably should have tested that too
2023-05-06 04:55:23 +00:00
catatonicprime
e37e506fe2
heh, I probably should have tested this
2023-05-06 04:37:43 +00:00
space-r7
f04dababa2
add upload code
2023-05-05 18:59:46 -05:00
h00die
e692e927dc
review fixes
2023-05-05 16:43:47 -04:00
catatonicprime
f27648799b
Adding original ZDI reference. Minor formatting changes.
2023-05-05 18:19:53 +00:00
Catatonic Prime
5f12f0e0ba
Apply suggestions from code review
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-05-05 11:07:08 -07:00
adfoster-r7
069ad805c1
Fix ruby 3.1 crashes when garbage collecting meterpreter resources
2023-05-05 14:04:17 +01:00
ErikWynter
b8856bbb87
fix capitalization of Htlm_fileName JSON parram
2023-05-05 09:59:11 +03:00
Grant Willcox
19651633c4
Update the installation instructions to resolve some issues encountered during testing
2023-05-04 18:26:54 -05:00
space-r7
9fa0dac56c
add login and path change methods
2023-05-04 18:03:02 -05:00
Grant Willcox
adec2f4fbb
Update the login.rb code so we aren't as strict on cookies since older versions sometimes use JSESSIONIDADAPSSO instead of JSESSIONIDSSO for login cookies
2023-05-04 15:40:39 -05:00
jvoisin
3b66b3416f
Golf a bit the php payload
...
- Put all the error-disabling statements on a single line
- Remove some useless spaces
- Use `stristr(…)` (available since PHP4) instead of `strpos(strtolower(…))`
- Use `&&` instead of `and`
- Use backticks instead of `passthru`, since they're equivalent: https://www.php.net/manual/en/language.operators.execution.php
2023-05-04 22:25:32 +02:00
Grant Willcox
8c7ae1b6bb
Minor update to comments for clarity
2023-05-04 15:12:32 -05:00
ErikWynter
c088430bd9
improve sanity checks in login method and other code review fixes
2023-05-04 15:12:31 -05:00
Grant Willcox
f27fc28411
Perform review updates
2023-05-04 15:12:31 -05:00
ErikWynter
9b596b3efd
minor changes
2023-05-04 15:12:31 -05:00
ErikWynter
1c6c1dffc6
final code review fixes
2023-05-04 15:12:31 -05:00
ErikWynter
9fe7db4648
improve status codes handling
2023-05-04 15:12:30 -05:00
ErikWynter
86b7f97421
remove trailing whitespace
2023-05-04 15:12:30 -05:00
ErikWynter
aede036b02
additional changes from code review
2023-05-04 15:12:30 -05:00
Grant Willcox
8871b2955b
Fix up Active Directory name so we appropriately use uppercase
2023-05-04 15:12:30 -05:00
Grant Willcox
ba687c49aa
Fix a few typos
2023-05-04 15:12:29 -05:00
ErikWynter
a5e86a0c51
code review improvements, including renaming silent param
2023-05-04 15:12:29 -05:00
Grant Willcox
0fd743d851
Add in fixes from code review
2023-05-04 15:12:29 -05:00
ErikWynter
dd075d5c99
library improvements after code review, module update
2023-05-04 15:12:28 -05:00
ErikWynter
a2cf29ab98
partial fixes after library code review
2023-05-04 15:12:28 -05:00
Grant Willcox
61d1cf1460
Fix up things identified during review
2023-05-04 15:12:28 -05:00
Grant Willcox
d5032f0a5d
Minor touchups on documentation for review
2023-05-04 15:12:28 -05:00
ErikWynter
e639460b9f
fix library comments for json_post_data.rb
2023-05-04 15:12:27 -05:00
ErikWynter
32796b429b
add note about payload limitations for builds 7004 and 7005
2023-05-04 15:12:27 -05:00
ErikWynter
47d374497a
create adaudit plus mixin and move some stuff there
2023-05-04 15:12:27 -05:00
Grant Willcox
3b0d8b850b
Fix up some issues identified during review
2023-05-04 15:12:26 -05:00
ErikWynter
9f68a5f8d1
add manageengine_adaudit_plus_authenticated_rce exploit module and docs
2023-05-04 15:12:09 -05:00
Metasploit
783a1eb504
Bump version of framework to 6.3.16
2023-05-04 12:11:31 -05:00
Grant Willcox
e5c636f931
Move folder descriptions into README.md files
2023-05-03 14:06:13 -05:00
Grant Willcox
184ad67f79
Add in documentation on Metasploit's file system
2023-05-03 14:06:00 -05:00
Metasploit
b01c4d37f7
automatic module_metadata_base.json update
2023-05-03 12:04:07 -05:00
Grant Willcox
bf61718fe6
Land #17915 , Icinga Web 2 Arbitrary File Read (CVE-2022-24716)
2023-05-03 11:47:26 -05:00
Grant Willcox
818bd4837e
Add in additional information about testing on Docker
2023-05-03 10:17:16 -05:00
Jeffrey Martin
2059505ccd
improve login attempt guards
...
* tighted up rescue to catch individual attempt exceptions
* remove general rescue in SNMP
* ensure SNMP socket is released
2023-05-03 09:15:14 -05:00
adfoster-r7
3bf01f2cf2
Land #17911 , Update setting missing datastore values to a warning instead of an error
2023-05-03 13:04:03 +01:00
cgranleese-r7
67694c1ef7
Removes return false
2023-05-03 11:41:11 +01:00
Metasploit
c6547737a6
automatic module_metadata_base.json update
2023-05-03 04:28:17 -05:00
adfoster-r7
ed9b9cc502
Land #17963 , Add CVE-1999-0554 to nfsmount module
2023-05-03 10:05:26 +01:00
h00die
0c0ae00149
add cve to nfsmount
2023-05-02 19:58:47 -04:00
h00die
95562e04aa
sudoedit work
2023-05-02 18:39:59 -04:00
Grant Willcox
5b080f20b6
Land #17960 , lock msgpack until build resolved
2023-05-02 17:09:00 -05:00
Jeffrey Martin
0a85cba56d
lock msgpack until build resolved
...
MessagePack 1.7.0 gem introduced code not compatible with the current
build env used for nightly packages. This may be addressed in several
ways and has been reported upstream. Lock the version a until a path
forward is determined.
2023-05-02 15:53:26 -05:00
Grant Willcox
092e4f93ad
Fix up incorrect user who we are executing as
2023-05-02 15:50:46 -05:00
Jeffrey Martin
152f9460f9
rescue login scanner attempts
...
* Improve base login scanner to catch any Exception
* Catch any Exception in SNMP scanner that overrides base method
* Expand connection errors possible in PostgreSQL scanner
2023-05-02 15:43:57 -05:00
Grant Willcox
cf6b309904
Add in quick fixes from review
2023-05-02 15:17:02 -05:00
Metasploit
b90b0a75c6
automatic module_metadata_base.json update
2023-05-02 12:24:15 -05:00
adfoster-r7
7ec7a4c607
Land #17910 , Fixes couchdb_login false positives
2023-05-02 17:56:55 +01:00
Grant Willcox
40474ed88c
Land #17950 , Update Rubocop dependency
2023-05-01 09:19:01 -05:00
adfoster-r7
ca0739b3b2
Update rubocop dependency
2023-04-28 23:42:00 +01:00
Grant Willcox
41c75c2e30
Land #17906 , Weekly dependency updates for Gemfile.lock
2023-04-28 17:01:09 -05:00
Grant Willcox
22441f1064
Land #16390 , Implement Caching DNS Resolver in Rex
2023-04-28 16:42:44 -05:00
Grant Willcox
5169174c45
Remove Rubocop updates until we can fix underlying issues in our code
2023-04-28 15:19:03 -05:00
Grant Willcox
3e81408a24
Add support for getting IPv6 addresses from hosts files and saving them into the cache
2023-04-28 14:47:56 -05:00
Metasploit
e3e82f0db2
automatic module_metadata_base.json update
2023-04-28 14:28:52 -05:00
Spencer McIntyre
d3a903b8b3
Land #17945 , Add missing payload tests
2023-04-28 15:13:50 -04:00
Metasploit
e3963a2e5c
automatic module_metadata_base.json update
2023-04-28 12:51:28 -05:00
Christophe De La Fuente
60149259a2
Land #17856 , RCE exploit for CVE-2023-26359 (Adobe ColdFusion) and an auxiliary module for arbitrary file read via the same vuln.
2023-04-28 19:27:15 +02:00
Grant Willcox
6fa21d130f
Land #17944 , Update metasploit-payloads gem to 2.0.130
2023-04-28 11:56:33 -05:00
Christophe De La Fuente
f5b1b96d9a
Fix rubocop issues
2023-04-28 16:09:57 +02:00
Christophe De La Fuente
62806caeae
Update web_delivery
2023-04-28 16:09:51 +02:00
RageLtMan
867902e7d0
SSM start/stop publication
2023-04-28 09:00:37 -04:00
h00die-gr3y
cfb21e3de2
Added CVE-2023-28770 reference
2023-04-28 12:51:17 +00:00
Metasploit
680ccbfe2f
automatic module_metadata_base.json update
2023-04-28 05:55:18 -05:00
adfoster-r7
f6e1fcdd90
Land #17947 , feedback_assistant_root: Check if OSX version is blank in check method
2023-04-28 11:25:52 +01:00
bcoles
f6725dfc4e
feedback_assistant_root: Check if OSX version is blank in check method
2023-04-28 19:52:15 +10:00
catatonicprime
97a76e3883
linting changes. removing unnecessary success checks.
2023-04-28 00:07:47 +00:00
catatonicprime
4ba8d62d88
Removing unused documentation
2023-04-28 00:02:37 +00:00
catatonicprime
c0be991ed8
removing superfluous options
2023-04-28 00:00:57 +00:00
Jeffrey Martin
9f2105c06d
add sctp payload specs
...
Update sizes to match automation expectations
2023-04-27 16:42:46 -05:00
Jeffrey Martin
61a8481a0f
missing adapter for python Windows
2023-04-27 15:22:12 -05:00
catatonicprime
12f7134cc6
generating payloads on the fly is what we wanted originally
2023-04-27 19:38:12 +00:00
Spencer McIntyre
36f9025cea
Update metasploit-payloads gem to 2.0.130
...
Includes changes from:
* rapid7/metasploit-payloads#631
* rapid7/metasploit-payloads#639
* rapid7/metasploit-payloads#634
2023-04-27 13:47:37 -04:00
Metasploit
601d9cef96
Bump version of framework to 6.3.15
2023-04-27 12:03:50 -05:00
adfoster-r7
4d98499766
Land #17941 , Added CVE Identifier to SEC Consult Zyxel Exploit (CVE-2023-28769)
2023-04-27 17:46:38 +01:00
space-r7
63115c9415
Land #17857 , add T3S support for weblogic modules
2023-04-27 11:37:37 -05:00
catatonicprime
16ae6b71f4
Use the generated payload as is.
2023-04-27 15:21:21 +00:00
catatonicprime
feec15a482
full_uri has what we need for the origin header
2023-04-27 15:07:15 +00:00
Jacob Baines
ec5858c198
Added newly assigned CVE identifier
2023-04-27 09:54:48 -04:00
3V3RYONE
9c8bc4e124
added yard docs
2023-04-27 16:56:49 +05:30
catatonicprime
0be38eb3ab
method should do one thing and do it well
2023-04-26 19:32:57 +00:00
catatonicprime
5e93669d75
Enable AutoCheck
2023-04-26 19:28:56 +00:00
catatonicprime
9f6fe964e2
bypass_auth returns the anti-csrf token and vprints active session on success
2023-04-26 18:28:02 +00:00
catatonicprime
8694beebd1
Removing unnecessary search.
2023-04-26 18:17:46 +00:00
space-r7
03fcfa7559
Land #17914 , fix paths for directory checks
2023-04-26 12:20:46 -05:00
Spencer McIntyre
4b33fc5d64
Land #17839 , Cleanup documentation
2023-04-26 13:18:32 -04:00
catatonicprime
0cf5f4cacc
More accurate list of side effects.
2023-04-26 16:55:13 +00:00
catatonicprime
bcafd22997
Better defaults pattern for TARGETURI.
2023-04-26 16:54:19 +00:00
catatonicprime
8c87660eaa
Explicit stance.
2023-04-26 16:53:04 +00:00
catatonicprime
22238a0860
Adding references.
2023-04-26 16:52:26 +00:00
Christophe De La Fuente
8ab37b0b07
Consolidate the FileDropper Mixin doc
2023-04-26 18:04:43 +02:00
Spencer McIntyre
bb782a7120
Land #17937 , Fix a documentation error
...
Update setting up a Metasploit development environment documentation
2023-04-26 11:53:10 -04:00
adfoster-r7
7a1f761e84
Update setting up a Metasploit development environment
2023-04-26 11:06:06 +01:00
h00die
d454b2e195
cve-2023-22809
2023-04-25 20:54:48 -04:00
catatonicprime
8a9871f0d8
Default to a java payload.
2023-04-25 23:57:05 +00:00
catatonicprime
a229a0ed86
If you are receiving 200, that is hard-evidence of bypass. Also Fix typo.
2023-04-25 23:34:04 +00:00
catatonicprime
17271f1046
Adding documentation, expanding failure cases. Always struggle in the last mile. Here we go.
2023-04-25 23:00:33 +00:00
Spencer McIntyre
2dc5a94ab7
Land #17926 , Fix 64-bit pointer type
...
Update pointer type to support 64 bit calls
2023-04-25 16:20:43 -04:00
catatonicprime
1a823b05f1
Serve jar file for exploit.
2023-04-25 18:36:44 +00:00
Metasploit
c9a9b998d2
automatic module_metadata_base.json update
2023-04-25 10:48:05 -05:00
dwelch-r7
10577cf1e4
Land #17913 , Fix crash when running local exploit suggester
2023-04-25 16:31:59 +01:00
dwelch-r7
8f13040ce0
Land #17931 , Fix deadlock regression when printing multiple lines to console
2023-04-25 16:31:27 +01:00
dwelch-r7
e646c0c6e2
Land #17930 , Update attic issue text
2023-04-25 10:47:43 +01:00
h00die
e7725e7b6d
cve-2023-22809
2023-04-25 04:37:33 -04:00
adfoster-r7
6aad398e2b
Update attic issue text
2023-04-25 00:42:10 +01:00
adfoster-r7
e7c05eabe3
Fix deadlock regression when printing multiple lines to console
2023-04-25 00:39:44 +01:00
Metasploit
447f36ee37
automatic module_metadata_base.json update
2023-04-24 17:25:57 -05:00
bwatters
a8043adef0
Fix accidental copy/paste
2023-04-24 17:19:18 -05:00
bwatters
9215488d31
Update pointer type to support 64 bit calls
2023-04-24 17:14:50 -05:00
bwatters
b052386700
Land #17921 , resolve_sid: Add docs and resolve RuboCop violations
...
Merge branch 'land-17921' into upstream-master
2023-04-24 17:08:54 -05:00
vtoutain
3036b607b6
JSON output support
...
Added the prettyfied JSON output along with the CSV, refactored variables regarding the JSON contacts object.
2023-04-24 11:50:29 +02:00
vtoutain
df6c2bf7eb
Documentation update
...
Modified the layout according to reviews, updated scenarios output, and added the JSON example output.
2023-04-24 11:47:21 +02:00
vtoutain
e565a8f962
Merge branch 'rapid7:master' into dolibarr_16_contact_dump
2023-04-24 11:44:52 +02:00
Grant Willcox
708da64a68
Add back in the require for dnsruby
2023-04-23 13:56:24 -05:00
catatonicprime
20109932fd
Command injection PoC working.
2023-04-23 15:30:23 +00:00
bcoles
5a57ea131e
resolve_sid: Add docs and resolve RuboCop violations
2023-04-23 17:39:32 +10:00
RageLtMan
3a4cb3560f
shell_command_token_base get 0th output index
2023-04-22 18:00:44 -04:00
RageLtMan
d797e5ec2c
Simplify SSM shell output filtering
2023-04-22 17:18:21 -04:00
RageLtMan
5132302363
Filter control bytes from SSM output
2023-04-22 15:22:18 -04:00
RageLtMan
5b94077421
Merge remote-tracking branch 'origin/pr/38' into feature/aws_ssm_sessions
2023-04-22 15:20:46 -04:00
bcoles
538381bd4d
shell_to_meterpreter: Support using bind payloads with PAYLOAD_OVERRIDE
2023-04-22 15:44:56 +10:00
h00die
076760e011
cve-2022-24716
2023-04-21 16:31:07 -04:00
h00die
d6c2e4f528
cve-2022-24716
2023-04-21 16:27:52 -04:00
Spencer McIntyre
8c15c31b56
Fix paths for directory checks
...
The path C:\ ends with a trailing backslash which will cause bash to
wait for another line if input. This places the shell in an undesirable
state.
2023-04-21 14:39:00 -04:00
Metasploit
0436e8bad9
automatic module_metadata_base.json update
2023-04-21 10:14:29 -05:00
space-r7
365b7c099c
Land #17895 , add Joomla api scanner
2023-04-21 09:50:24 -05:00
h00die-gr3y
c39751094a
Updates based on review comments
2023-04-21 11:46:53 +00:00
cgranleese-r7
eb4107b5e2
Fixes couchdb login bug
2023-04-21 10:14:22 +01:00
adfoster-r7
f35b9e4fa5
Fix crash when running local exploit suggester
2023-04-21 10:13:37 +01:00
adfoster-r7
0908c85f1b
Land #17912 , Bump payloads to 2.0.127
2023-04-21 09:38:17 +01:00
catatonicprime
253f4e54bc
rough pseudo-coding
2023-04-21 03:53:03 +00:00
bwatters
f1602dd772
Bump payloads to 2.0.127
2023-04-20 18:50:36 -05:00
h00die
17f674e3fa
review comments
2023-04-20 16:23:52 -04:00
Metasploit
04df1ef7e8
Bump version of framework to 6.3.14
2023-04-20 12:11:36 -05:00
Metasploit
b224fd3ff3
automatic module_metadata_base.json update
2023-04-20 10:47:02 -05:00
cgranleese-r7
896058a147
Land #17908 , Update ftp login connect timeout option name
2023-04-20 16:23:42 +01:00
vtoutain
d6e921c414
Version regex fix
...
The previous fix was not matching numbers at the end of the version like "-rc2".
2023-04-20 16:20:40 +02:00
vtoutain
ea9019600a
Version regex update
...
Used a less greedy version of the regex based on reviews, as well as the `version.blank?` pattern for improved readability.
2023-04-20 16:00:24 +02:00
vtoutain
ecd56c7904
Check logic simplification
...
Moved most of the check logic inside the check function to make it easier to read.
2023-04-20 11:51:28 +02:00
h00die-gr3y
4131f1abf1
Fixed some bugs in module and added documentation
2023-04-20 08:23:55 +00:00
Spencer McIntyre
2e3a2b6f6d
Combine AWS SSM modules, autodetect platform
2023-04-19 18:05:50 -04:00
Spencer McIntyre
59b3c0e945
Set the platform in enum_ssm
...
Update the enum_ssm module to use the correct session type with the
appropriate platform. Also set the session information to the same
string which also removes the eye sore that is the shell banner.
2023-04-19 18:05:50 -04:00
Spencer McIntyre
a7d8bc6757
Fix sessions opening over and over again
...
Also make some code cleanups
2023-04-19 18:05:50 -04:00
Spencer McIntyre
15ff4875bc
Combine AWS SSM modules, autodetect platform
2023-04-19 17:58:59 -04:00
dwelch-r7
f6c8181b7f
Land #17909 , Fix Windows7 Meterpreter crash when in debug mode
2023-04-19 17:57:00 +01:00
adfoster-r7
8e77b70c99
Fix Windows7 Meterpreter crash when in debug mode
2023-04-19 17:30:05 +01:00
vtoutain
a2f3a719a9
Fixes from code reviews
...
Fixed some typos, took into account the comment from jvoisin to infer fields from the JSON reply, used fail_with as suggested by jheysel-r7, fixed a rubocop warning about a redundant begin block.
2023-04-19 11:45:03 +02:00
vtoutain
d875741c87
Fixed documentation typos
2023-04-19 11:43:08 +02:00
vtoutain
35c7d3918d
Merge branch 'rapid7:master' into dolibarr_16_contact_dump
2023-04-19 11:24:37 +02:00
Metasploit
61cfd770ed
automatic module_metadata_base.json update
2023-04-18 19:46:28 -05:00
bwatters
9c9eac28a7
Land #17874 , VMware Workspace One Access mr_me Hekate LPE
...
Merge branch 'land-17874' into upstream-master
2023-04-18 19:29:39 -05:00
Metasploit
ec025cbeda
automatic module_metadata_base.json update
2023-04-18 18:26:39 -05:00
adfoster-r7
34a6980e5e
Land #17907 , Add VMware Workspace RCE added missing require statement
2023-04-19 00:12:59 +01:00
Metasploit
4cb9a4c142
automatic module_metadata_base.json update
2023-04-18 17:47:12 -05:00
adfoster-r7
246de78f85
Update ftp login connect timeout option name
2023-04-18 23:44:58 +01:00
Jack Heysel
9563466037
Land #17873 , add ensure disconnect to ftp login
...
Add ensure disconnect to ftp login module and ftp timeout configuration
2023-04-18 18:31:12 -04:00
Jack Heysel
bd286dd147
Added missing require builder statement
2023-04-18 18:10:46 -04:00
Jack Heysel
de18ed438a
Removed unnecessary require statement
2023-04-18 18:05:11 -04:00
Zach Goldman
898a9f2f3d
add user mutability to connection timeout
2023-04-18 16:31:05 -05:00
Jack Heysel
a2c23d18ef
Added require builder statement
2023-04-18 16:01:14 -04:00
Jeffrey Martin
2de950c244
Weekly dependency updates for Gemfile.lock
2023-04-18 14:25:28 -05:00
h00die-gr3y
de9cd59ea5
added pwd derivation and report credential function including updates based on review comments
2023-04-18 19:17:00 +00:00
Spencer McIntyre
d8c8255120
Set the platform in enum_ssm
...
Update the enum_ssm module to use the correct session type with the
appropriate platform. Also set the session information to the same
string which also removes the eye sore that is the shell banner.
2023-04-18 14:07:04 -04:00
Spencer McIntyre
8ac5ae2a68
Fix sessions opening over and over again
...
Also make some code cleanups
2023-04-18 12:24:00 -04:00
Metasploit
40613a4741
automatic module_metadata_base.json update
2023-04-18 10:55:25 -05:00
cgranleese-r7
b65d3252e9
Land #17883 , Fix crash for lotus domino hashes module when database not active
2023-04-18 16:38:47 +01:00
Metasploit
2eaa31c402
automatic module_metadata_base.json update
2023-04-18 10:17:44 -05:00
bwatters
6ae00877ed
Land #17854 , VMware Workspace One Access mr_me Hekate RCE
...
Merge branch 'land-17854' into upstream-master
2023-04-18 09:49:41 -05:00
adfoster-r7
1b72de063e
Land #17903 , Add missing fields when reading metadata cache
2023-04-18 11:48:05 +01:00
adfoster-r7
7eb799bc89
Land #17904 , Remove active database check for module cache rebuild
2023-04-18 11:12:15 +01:00
Dean Welch
7667499011
Update comment and correctly format date
2023-04-18 11:06:19 +01:00
vtoutain
e4ae9e0997
Merge branch 'rapid7:master' into dolibarr_16_contact_dump
2023-04-18 11:37:13 +02:00
dsecbypass
413082a4d6
Linting
...
Simplified version regex, fixed rubocop findings.
2023-04-18 11:24:14 +02:00
Dean Welch
d17ab39748
Remove active database check for module cache rebuild
2023-04-17 23:55:37 +01:00
Dean Welch
e874731781
Pull out autofilter_ports and autofilter_services from metadata cache
2023-04-17 23:45:19 +01:00
Jack Heysel
78e80f8e32
docs fix
2023-04-17 16:41:35 -04:00
Jack Heysel
162fe21659
Documentation copy pasta correction
2023-04-17 16:39:57 -04:00
jheysel-r7
d4b668e27b
Update documentation/modules/exploit/linux/http/vmware_workspace_one_access_vmsa_2022_0011_chain.md
...
Co-authored-by: Brendan <bwatters@rapid7.com >
2023-04-17 16:36:31 -04:00
Metasploit
e54d602d4c
automatic module_metadata_base.json update
2023-04-17 14:56:35 -05:00
Jack Heysel
db853f9a68
Land #17711 , SPIP unauth RCE module
...
This module exploits a publically accessible endpoint in
SPIP that results in code execution in the context of the
user running the webapp (CVE-2023-27372).
2023-04-17 15:30:03 -04:00
jvoisin
a4e1952da3
Add a module for the latest SPIP vuln
2023-04-17 13:41:03 -04:00
RageLtMan
97c0fa7411
Split CachedResolver to own file per jmartin-r7
2023-04-17 13:14:47 -04:00
dsecbypass
a05aae3ebe
Support remote database storage
...
It's better to pass the CSV string to store_loot directly instead of using nil and writing to the local file path ourself.
2023-04-17 17:24:59 +02:00
dwelch-r7
6984c6c7d4
Land #17884 , Before running tests ensure database is migrated
2023-04-17 16:08:16 +01:00
Metasploit
cf68410e0e
automatic module_metadata_base.json update
2023-04-17 08:17:50 -05:00
adfoster-r7
dec705cc2a
Land #17898 , Adds support for attic label on issues
2023-04-17 13:55:20 +01:00
adfoster-r7
396a4b90cc
Land #17892 , update unified_remote_rce docs
2023-04-17 13:53:32 +01:00
dsecbypass
3b710293f5
Dolibarr 16 unauthenticated contact database dump
...
Auxiliary module and documentation.
2023-04-17 14:52:05 +02:00
cgranleese-r7
c1df987c0b
Adds support for attic label on issues
2023-04-17 13:45:39 +01:00
sfewer-r7
e54774fd20
ensure SRVHOST is a routable IP
2023-04-17 13:01:30 +01:00
h00die
2c7d54da2f
joomla api cve-2023-23752 with create_credential_and_login
2023-04-16 23:20:19 -04:00
h00die
32b6741cd8
joomla api cve-2023-23752
2023-04-16 22:54:54 -04:00
adfoster-r7
169d86e9ae
Land #17893 , move asan docs
2023-04-17 02:52:19 +01:00
h00die
37130e5a3d
move asan docs
2023-04-16 10:19:43 -04:00
h00die
4b176c8ef5
fix unified_remote_rce docs
2023-04-16 10:11:01 -04:00
adfoster-r7
879f94571e
Land #17888 , Msf::Ui::Console::CommandDispatcher::Core: Fix 'help setg' output
2023-04-15 23:05:27 +01:00
bcoles
1e23dffc5b
Msf::Ui::Console::CommandDispatcher::Core: Fix 'help setg' output
2023-04-15 20:35:15 +10:00
adfoster-r7
19c79bed18
Before running tests ensure database is migrated
2023-04-15 00:35:09 +01:00
adfoster-r7
71a058b555
Fix crash for lotus domino hashes module when database not active
2023-04-14 23:28:32 +01:00
Metasploit
66e58e395c
automatic module_metadata_base.json update
2023-04-14 15:48:41 -05:00
Grant Willcox
246a69e897
Remove unneeded return statement after raising an exception
2023-04-14 15:28:17 -05:00
Grant Willcox
da5a361d3f
Remove extra require that wasn't needed with Zeitwerk
2023-04-14 15:28:17 -05:00
Grant Willcox
2d90bdcecb
Fix up some YARD issues
2023-04-14 15:28:17 -05:00
RageLtMan
db08c5df11
Address @gwilcox-r7's notes
2023-04-14 15:28:17 -05:00
RageLtMan
4be8cd3752
Annotate skip of Debian IPv6 hosts
2023-04-14 15:28:16 -05:00
Grant Willcox
89a564c378
Fix up YARD documentation to account for potential nil being returned
2023-04-14 15:28:16 -05:00
Grant Willcox
b01b3a5ecd
Fix typo that prevented entries from being cached
2023-04-14 15:28:16 -05:00
RageLtMan
9a23e63365
DNS Resolver Improvements
...
Handle proxy connection resets over TCP (common w/ ENUM_BRT & TOR).
Ensure qtype is a string before passing to cache.
2023-04-14 15:28:16 -05:00
RageLtMan
6039affe0d
Address @gwilcox-r7's comments
2023-04-14 15:28:15 -05:00
RageLtMan
da93c9440f
Cleanup cache API
2023-04-14 15:28:15 -05:00
RageLtMan
3d49b4b429
Use ivar_set for answer setters
2023-04-14 15:28:15 -05:00
RageLtMan
513779fd3f
Drop vestigial #validate_path calls
2023-04-14 15:28:15 -05:00
RageLtMan
c4e29eaa94
Implement Caching DNS Resolver in Rex
...
Rex::Proto::DNS::Resolver is currently unable to approximate the
host OS' native resolver because:
1. It cannot cache responses and has to go out to its defined NS'
each time to query for the answers,
2. Because it is not aware of the system's hostsfile entries which
can result in leaks/mis-targeted execution, and a bunch of other
unpleasantly nuanced problems.
Address the concern by:
1. Creating a descendant CachedResolver class from
Rex::Proto::DNS::Resolver, with a #send method override which
performs cache query and population.
2. Moving the Cache class up one namespace to Rex::Proto::DNS and
updating the server accordingly.
3. Fixing the MATCH_HOSTNAME regex in Rex::Proto::DNS::Constants to
allow a short-name (vs FQDN) and creating a relevant MATCH_FQDN.
TODO:
1. Deal with adding search domains from the system to short-name
queries and records; if we decide this is a good idea (potential
for leaks).
2. Look at performance optimization for multiple concurrent queries
via singleton/refcounted/other optimized concurrent access patters.
Testing:
1. Pry-level tests of the objects edited/created in this PR. Needs
some runtime testing to QA.
2023-04-14 15:28:05 -05:00
Jack Heysel
cda2e9610b
Land #17820 , optimising the nagiosxi modules
...
This PR refactors the authenticated nagiosxi modules and mixins..
2023-04-14 16:21:26 -04:00
Jack Heysel
ace2f42387
Changed ranking to Good
2023-04-14 15:15:40 -04:00
Grant Willcox
f9bbf32447
Land #17882 , Update metasploit-payloads gem to 2.0.125
2023-04-14 11:58:41 -05:00
sfewer-r7
5d05754d9b
update the AKB URL to reference the changed CVE
2023-04-14 17:44:38 +01:00
Spencer McIntyre
afce19d378
Update metasploit-payloads gem to 2.0.125
...
Includes changes from:
* rapid7/metasploit-payloads#633
* rapid7/metasploit-payloads#625
2023-04-14 11:19:33 -04:00
sfewer-r7
e6211175b3
rename the files to the correct CVE
2023-04-14 15:52:13 +01:00
sfewer-r7
b5ea420760
On April 12 Adobe reclassified CVE-2023-26360 from an Improper Access Controll vuln to a Deserialization of Untrusted Data vuln. A private report has confirmed that CVE-2023-26359 is a similar yet seperate vuln, so I am changing the CVE associated with these two modules from CVE-2023-26359 to CVE-2023-26360 as we now beliee this is the correct CVE.
2023-04-14 15:49:10 +01:00
h00die-gr3y
e0926890ab
init commit module
2023-04-14 13:07:12 +00:00
h00die-gr3y
5584685f24
init commit module
2023-04-14 13:05:42 +00:00
dwelch-r7
2c8ad1f158
Land #17809 , Add bootsnap for bootup performance
2023-04-14 14:01:12 +01:00
Jack Heysel
b9cb33598c
Resource script for automagically running LPE
2023-04-13 14:30:55 -04:00
Jack Heysel
08788d3d82
Update logging with rc script info
2023-04-13 14:28:15 -04:00
Metasploit
fae910eb6b
Bump version of framework to 6.3.13
2023-04-13 12:11:45 -05:00
sfewer-r7
b7f46aab99
split the CFC_METHOD_PARAMETERS by comma and not amperstand
2023-04-13 16:55:34 +01:00
Metasploit
cc0a32cdda
automatic module_metadata_base.json update
2023-04-13 10:45:19 -05:00
dwelch-r7
f9d5459a9c
Land #17872 , Ensure identify hashes helper is accessible to modules
2023-04-13 16:20:20 +01:00
sfewer-r7
90dacd00ab
favor a staged meterpreter payload over the non staged payload as a default
2023-04-13 16:11:19 +01:00
sfewer-r7
8377cb7d6d
group multiple suffixes with one call to end_with?
2023-04-13 16:00:30 +01:00
sfewer-r7
ae87f35944
fix two typos in documentation
2023-04-13 15:57:48 +01:00
Metasploit
7feeb25ee1
automatic module_metadata_base.json update
2023-04-13 09:27:49 -05:00
adfoster-r7
aef2b8d314
Land #17804 , Fix incorrect module metadata CI and add validation automation
2023-04-13 15:11:46 +01:00
Metasploit
8cc6b88071
automatic module_metadata_base.json update
2023-04-12 19:47:46 -05:00
Grant Willcox
d19c9e7732
Land #17867 , fix always vulnerable in Auxiliary module surgenews_user_creds
2023-04-12 19:32:39 -05:00
Grant Willcox
0ed25cd2cc
Fix RuboCop issues
2023-04-12 19:05:30 -05:00
adfoster-r7
7a4fc4b58b
Land #17805 , Disable Lint/UnusedMethodArgument as it can break YARD definitions
2023-04-13 00:29:19 +01:00
Metasploit
9194e66737
automatic module_metadata_base.json update
2023-04-12 17:20:28 -05:00
Grant Willcox
0e3a341ac9
Land #17864 , Correct incorrect log format
2023-04-12 17:05:35 -05:00
Jack Heysel
30cf40a4f1
VMware Workspace One Acces LPE
2023-04-12 15:36:17 -04:00
Jack Heysel
bc57131b73
Moving LPE to separate PR
2023-04-12 15:23:51 -04:00
Grant Willcox
7ad6c425c0
Set Lint/UnusedMethodArgument rule to apply to everything but lib/ folder
2023-04-12 11:31:28 -05:00
Zach Goldman
87c0faa73a
Add ensure disconnect to ftp login module, ftp timeout configuration
2023-04-12 11:18:50 -05:00
cgranleese-r7
0dd8f94b31
Addresses PR comments
2023-04-12 14:21:07 +01:00
Metasploit
fef3796d43
automatic module_metadata_base.json update
2023-04-12 07:46:05 -05:00
adfoster-r7
8e2169ed47
Ensure identify hashes helper is accessible to modules
2023-04-12 13:28:56 +01:00
adfoster-r7
e8365aba85
Land #17870 , Fixes linting errors on SCTP payloads
2023-04-12 13:24:01 +01:00
dwelch-r7
275963eca2
Land #17353 , Persist icpr cert as pkcs12 credential
2023-04-12 13:16:18 +01:00
sfewer-r7
43bfdcd6b4
improve the aux file read module; add a default CFC endpoint option and support servers configured with the non-default setting 'Enable Request Debugging Output' enabled.
2023-04-12 12:39:00 +01:00
Metasploit
4ed5c59cf2
automatic module_metadata_base.json update
2023-04-12 04:58:37 -05:00
Christophe De La Fuente
a6b478e046
Land #17832 , Two modules for UniRPC - CVE-2023-28502 and CVE-2023-28503
2023-04-12 11:43:13 +02:00
Metasploit
0a0b11491a
automatic module_metadata_base.json update
2023-04-12 04:39:17 -05:00
cgranleese-r7
a313e36c1d
Fixes linting errors on SCTP payloads
2023-04-12 10:24:19 +01:00
cgranleese-r7
e6c1aecd26
Land #17502 , Adds SCTP Sessions
2023-04-12 10:15:43 +01:00
Ryuuuuu
585479474b
fix bug which prints always vulnerable (change code suggested code by @bcoles)
2023-04-12 08:25:34 +00:00
Ryuuuuu
e3983eac1f
Correct incorrect log format
2023-04-12 13:04:13 +09:00
Ryuuuuu
29c24438a6
Correct incorrect log format when no files found
2023-04-12 13:01:49 +09:00
Ron Bowes
6119330e29
Update documentation to match current version of modules
2023-04-11 09:48:53 -07:00
Ron Bowes
7dc1faa689
Better error handling, and fix version detection
2023-04-11 09:34:24 -07:00
Christophe De La Fuente
59ff65d58d
Land #17821 , DBManager: Import: Add Nuclei JSON database import
2023-04-11 17:51:22 +02:00
adfoster-r7
875ad34b62
Persist icpr cert as pkcs12 credential
...
Update creds command to support pkcs12
2023-04-11 16:25:25 +01:00
sfewer-r7
375d9b34f1
make on_request_uri compatible with both command staget and teh generic java target
2023-04-11 14:25:07 +01:00
adfoster-r7
b01e3ca324
Land #17858 , Update metasploit-payloads gem to 2.0.123
2023-04-11 14:08:12 +01:00
sfewer-r7
0022d0b8c3
Merge branch 'CVE-2023-26359-java-payload' into CVE-2023-26359
2023-04-11 13:59:37 +01:00
adfoster-r7
b9f3d2b1d5
Land #17862 , Msf::Payload::Apk: Bump apktool minimum required version to 2.7.0
2023-04-11 13:23:19 +01:00
sfewer-r7
0af2f00ca0
URI decode the (optional) CFC_METHOD_PARAMETER param names and values, as they will be encoded again during send_request_cgi.
2023-04-11 12:42:29 +01:00
sfewer-r7
1dc8eb2802
remove linemax option from execute_cmdstager as it was artifact from testing and is not needed here
2023-04-11 12:14:28 +01:00
sfewer-r7
296fd6fec7
add in bourne and printf command stager flavors for Linux target
2023-04-11 12:07:49 +01:00
sfewer-r7
70018f7543
add psh_invokewebrequest as a command stager flavor for Windows
2023-04-11 11:57:39 +01:00
sfewer-r7
5c1057dd58
use the rails method blank? here to check for both nil and empty
2023-04-11 11:48:27 +01:00
sfewer-r7
657c1446c4
dont check these datastore options for empty? as the default values will either be set or an empty value will be detected during configuration validation
2023-04-11 11:41:55 +01:00
sfewer-r7
fa1e7ae016
close all CMFL tags and chain the getRuntime and exec calls for berevity
2023-04-11 11:22:13 +01:00
bcoles
3b7cf035ea
DBManager: Import: Add Nuclei JSON database import
2023-04-10 22:22:19 +10:00
bcoles
8525849763
Msf::Payload::Apk: Bump apktool minimum required version to 2.7.0
2023-04-10 21:07:25 +10:00
Jack Heysel
a2d2946007
Rubocop
2023-04-07 13:53:12 -04:00
Jack Heysel
18170babc2
Fix RCE payloads and add autorunscript
2023-04-07 13:35:16 -04:00
Ron Bowes
1a8671311d
Move the offsets into a field separate from 'targets'
2023-04-07 10:26:56 -07:00
Ron Bowes
02072418f0
Expand the comment about why we're checking for \xff (since it can't appear in the payload)
2023-04-07 10:10:13 -07:00
Spencer McIntyre
eec0e71dd7
Update metasploit-payloads gem to 2.0.123
...
Includes changes from:
* rapid7/metasploit-payloads#628
2023-04-07 10:45:14 -04:00
Jack Heysel
056b0a0e8b
LPE and doc updates
2023-04-07 10:41:10 -04:00
Metasploit
599c8609a7
automatic module_metadata_base.json update
2023-04-07 08:47:12 -05:00
adfoster-r7
42902bb5e5
Land #17851 , fix check function which always prints vulnerable
2023-04-07 14:24:45 +01:00
Jack Heysel
665ba4aece
Add additional target
2023-04-06 23:41:36 -04:00
Ryuuuuu
9985538846
Update modules/exploits/linux/http/apache_couchdb_cmd_exec.rb
...
fix nil exception
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-04-07 09:55:00 +09:00
Jack Heysel
79d4021f31
Replaced janky XML building
2023-04-06 14:58:05 -04:00
Jack Heysel
544fb8ead6
Removed unecessary start_service proc
2023-04-06 14:26:02 -04:00
Ron Bowes
ce111f158a
Better error handling
2023-04-06 10:35:33 -07:00
Jack Heysel
d92fc41d29
Print out what command fails when attempting RCE
2023-04-06 13:31:17 -04:00
Jack Heysel
4984a3e2d3
Edit check method to raise errors instead of returning boolean
2023-04-06 13:25:20 -04:00
Metasploit
261fc5227d
Bump version of framework to 6.3.12
2023-04-06 12:13:28 -05:00
sfewer-r7
b05c9c6303
add a generic java target
2023-04-06 17:29:50 +01:00
Metasploit
3c7c2f1fbe
automatic module_metadata_base.json update
2023-04-06 11:27:31 -05:00
adfoster-r7
d08fa00c06
Land #17458 , Weblogic t3s support
2023-04-06 17:13:16 +01:00
Steve E
67b98b5120
merge tested exploits
2023-04-06 15:42:39 +01:00
sfewer-r7
43fe41bea5
RCE exploit for CVE-2023-26359 and an auxiliary module for arbitrary file read via the same vuln.
2023-04-06 14:02:01 +01:00
Steve E
f0189cc886
revert another get_once
2023-04-06 11:43:50 +01:00
Steve E
656c562816
Added notes, revert to get_once
2023-04-06 11:01:32 +01:00
Steve Embling
cc79fe039a
Merge branch 'rapid7:master' into weblogic-t3s-support
2023-04-06 10:38:29 +01:00
Jack Heysel
b7456e20d5
VMware Workspace One Access mr_me Hekate exploit
2023-04-05 23:10:34 -04:00
Ron Bowes
523931aa4c
Change target options for stack overflow exploit
2023-04-05 15:24:49 -07:00
Ron Bowes
c345fe78b8
Fix up error handling and other comments from the PR
2023-04-05 15:13:35 -07:00
Ron Bowes
c07ca83d6c
Fix the metadata and add an in-memory target
2023-04-05 14:07:12 -07:00
Ron Bowes
04a9ae7335
Add check methods
2023-04-05 10:55:28 -07:00
Ron Bowes
c22c2904c2
Fix msftidy_docs stuff
2023-04-05 10:53:58 -07:00
cgranleese-r7
e004be00fe
Converted to Active Support
2023-04-05 16:53:01 +01:00
Metasploit
452daf0b64
automatic module_metadata_base.json update
2023-04-05 10:10:02 -05:00
Christophe De La Fuente
5d63175b56
Land #17823 , php_cgi_arg_injection: Fix check regex match to detect code html tag
2023-04-05 16:44:52 +02:00
adfoster-r7
653234e1d0
Add bootsnap for bootup performance
2023-04-04 10:35:53 +01:00
cgranleese-r7
818046c6dd
wip
2023-04-04 10:27:15 +01:00
cgranleese-r7
769e2e760c
stop point
2023-04-04 10:27:15 +01:00
cgranleese-r7
c3a7da54d5
reduces code duplication
2023-04-04 10:27:11 +01:00
cgranleese-r7
40e6917b7f
tests passing
2023-04-04 10:24:09 +01:00
Ryuuuuu
8b3d799104
fix check function which always prints vulnerable
2023-04-04 10:07:06 +09:00
adfoster-r7
05d9e7f9d6
Land #17842 , Update docs for cmdstager
2023-04-03 21:33:01 +01:00
bwatters
917bbbc9e0
fix tagging issue
2023-04-03 15:06:26 -05:00
bwatters
c93a4d0e30
So we don't actually use an http server when we use cmdstager::flavor certutil
2023-04-03 15:06:26 -05:00
bwatters
2a0221a7ed
Attempt to update and clarify cmdstager docs
2023-04-03 15:06:26 -05:00
cgranleese-r7
2de5d4324f
Land #17849 , Update docs to use links for Github handles
2023-04-03 17:21:23 +01:00
adfoster-r7
7058d4c8ad
Land #17838 , Railgun documentation updates
2023-04-03 17:09:33 +01:00
Spencer McIntyre
9af0f5ca0c
Railgun documentation updates
2023-04-03 09:31:30 -04:00
Metasploit
a6159ccda5
automatic module_metadata_base.json update
2023-04-03 06:17:46 -05:00
adfoster-r7
f7cee703ce
Land #17835 , cisco_dcnm_auth_bypass: Fix TARGETURI URL normalization
2023-04-03 11:47:56 +01:00
adfoster-r7
728e1f1ea2
Land #17836 , Add session.platform example to post module docs
2023-04-03 11:45:11 +01:00
adfoster-r7
2b90337947
Land #17844 , fix broken module references
2023-04-03 11:34:13 +01:00
adfoster-r7
ffea12fe2c
Land #17837 , AutoCheck documentation
2023-04-03 11:31:35 +01:00
adfoster-r7
a853efb05f
Land #17840 , Add notes section to exploit template
2023-04-03 11:28:48 +01:00
adfoster-r7
c12ef82d35
Land #17841 , Update Assigning-Labels doc
2023-04-03 10:49:46 +01:00
Christophe De La Fuente
057fd1b74b
Remove instance variables from example code
2023-04-03 11:30:03 +02:00
adfoster-r7
b3d4812416
Update docs to use links for github handles
2023-04-03 10:29:51 +01:00
SubcomandanteMeowcos
a54f3d4707
fix broken module references
...
doing these "by domain" now, piecemeal.
this PR fixes all broken references to the "insecurety" website, which is long dead.
2023-04-01 05:17:02 -07:00
manishkumarr1017
812d3c7f35
PR Review Changes for optimizing the nagiosxi modules
2023-04-01 14:28:37 +05:30
Jack Heysel
18cfc42cb0
Update assigning labels doc
2023-03-31 16:21:12 -04:00
jheysel-r7
e112c9b610
Update docs/metasploit-framework.wiki/Get-Started-Writing-an-Exploit.md
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-03-31 14:54:20 -04:00
Jack Heysel
51fb3335c7
Removed unnecessary changes
2023-03-31 14:40:30 -04:00
Jack Heysel
b82bb572ca
Add notes section to exploit template
2023-03-31 14:35:06 -04:00
Christophe De La Fuente
a95ae383d0
Add cleanup doc
2023-03-31 19:56:16 +02:00
Christophe De La Fuente
6fdbc0b903
Add AutoCheck mixin doc
2023-03-31 18:25:57 +02:00
Jack Heysel
c41d44ac3c
Add session.platform example
2023-03-31 11:22:01 -04:00
bcoles
2711ba4b3a
cisco_dcnm_auth_bypass: Fix TARGETURI URL normalization
2023-03-31 23:53:41 +11:00
dwelch-r7
eb12cfec05
Land #17778 , Update brocade tests to pass locally
2023-03-31 10:51:31 +01:00
Metasploit
3aabb738bf
Bump version of framework to 6.3.11
2023-03-30 12:10:12 -05:00
Metasploit
fd4be04e28
automatic module_metadata_base.json update
2023-03-30 11:58:43 -05:00
Jack Heysel
15d267a233
Land #17826 , post module for CVE-2023-21768
...
This adds an exploit module for CVE-2023-21768 that
achieves local privilege escalation on Windows 11 2H22.
2023-03-30 12:27:28 -04:00
dwelch-r7
f40e843b4e
Land #17833 , Add check metadata to rpc module info
2023-03-30 17:08:04 +01:00
jheysel-r7
152ef4a86b
Update modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb
2023-03-30 11:28:46 -04:00
jheysel-r7
6f400052b1
Update modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb
2023-03-30 11:00:55 -04:00
Metasploit
6111d55504
automatic module_metadata_base.json update
2023-03-30 08:29:58 -05:00
dwelch-r7
ab08cd2d1c
Land #17753 , Update get_ticket to support using forged golden tickets
2023-03-30 14:15:48 +01:00
adfoster-r7
c926f4961b
Add check metadata to rpc module info
2023-03-30 10:24:31 +01:00
Metasploit
6f89d94759
automatic module_metadata_base.json update
2023-03-29 12:46:31 -05:00
space-r7
1f32004901
Land #17813 , ssh_enumusers set CHECK_FALSE to true
2023-03-29 12:31:31 -05:00
Ron Bowes
7cb6213334
Fix an msftidy error
2023-03-29 09:56:04 -07:00
Ron Bowes
54ed192401
Add URLs
2023-03-29 08:10:52 -07:00
Ron Bowes
4cab9b1a34
Make rubocop happy
2023-03-29 08:05:05 -07:00
Ron Bowes
41fe44ef1a
Merge branch 'master' into unirpc-auth-bypass
2023-03-29 08:03:05 -07:00
Ron Bowes
6897be4b01
Add two Metasploit modules for UniData vulnerabilities
2023-03-29 08:01:50 -07:00
Metasploit
51ea787f69
automatic module_metadata_base.json update
2023-03-29 09:49:46 -05:00
space-r7
9cd024a7a2
Land #17828 , add AMQP login scanner module
2023-03-29 09:24:48 -05:00
adfoster-r7
0a559bfded
Land #17704 , Apache Solr RCE via Velocity Template: Attempt fix for NoMethodError when exploiting
2023-03-29 15:12:04 +01:00
adfoster-r7
e1ecdac2a5
Land #17724 , Add ticket checksum to kerberos ticket creation
2023-03-29 09:01:39 +01:00
space-r7
72ec93d27a
Land #17827 , add AMQP version scanner module
2023-03-28 16:00:42 -05:00
adfoster-r7
aaa36e2651
Land #17831 , Fix dead reference links in rpc_cmsd_opcode21.rb
2023-03-28 19:38:46 +01:00
adfoster-r7
f626b55831
Land #17825 , Update zimbra_slapper_priv_esc.rb
2023-03-28 18:36:18 +01:00
adfoster-r7
f6c4679435
Land #17830 , tools: modules: committer_count: Parse date argument with Time.parse
2023-03-28 18:34:24 +01:00
dm-ct
1330913e33
Fix dead reference links in rpc_cmsd_opcode21.rb
...
Both the reference links in this one are dead, replacing with archive.org links.
Much like https://github.com/rapid7/metasploit-framework/pull/17825 , I'll be doing these ad-hoc for a little bit until I figure out a reliable way to do a load of them in one batch.
2023-03-28 18:15:26 +01:00
Jack Heysel
865251b8aa
Land #17818 , fix crash in RPC job info
2023-03-28 12:02:56 -04:00
bcoles
74bb908e56
tools: modules: committer_count: Parse date argument with Time.parse
2023-03-29 01:45:27 +11:00
Jack Heysel
fcb93fef58
Land #17806 , Optergy BMS Backdoor RCE module
...
This module exploits an undocumented backdoor vulnerability
(CVE-2019-7276) in the Optergy Proton and Enterprise Building
Management System (BMS) applications.
2023-03-28 10:27:35 -04:00
Jack Heysel
f3c12ba176
Land #17808 , Update broken secunia references
...
The Secunia links in the framework were dead. They have
now been restored using the wayback machine to grab
replacement links from the earliest date possible.
2023-03-27 17:20:13 -04:00
Spencer McIntyre
7a2643304e
Add a missing require line
2023-03-27 16:54:04 -04:00
Spencer McIntyre
97d67c6a79
Add an AMQP login scanner
2023-03-27 16:53:03 -04:00
Spencer McIntyre
5d0ae3e0c0
Add a missing require line
2023-03-27 16:48:40 -04:00
Spencer McIntyre
95e8a1c175
Initial AMQP version scanner
2023-03-27 16:44:11 -04:00
space-r7
f9c6caa804
Land #17785 , add SolarWinds (SWIS) deser RCE
2023-03-27 15:25:17 -05:00
Spencer McIntyre
a36a475111
Bump rex-socket to 0.1.49
...
This includes the SSL fix from rapid7/rex-socket#58
2023-03-27 16:02:57 -04:00
Christophe De La Fuente
6d4ee0c071
Add exploit for CVE-2023-21768
2023-03-27 20:08:22 +02:00
dm-ct
38f7cbdfc6
Update zimbra_slapper_priv_esc.rb
...
fixing reference to use an archive link as the sites down.
2023-03-27 16:46:07 +01:00
bcoles
abe5570902
php_cgi_arg_injection: Fix check regex match to detect code html tag
2023-03-27 15:21:04 +11:00
bcoles
8572053f0c
php_cgi_arg_injection: Add notes and resolve Rubocop violations
2023-03-27 15:16:51 +11:00
h00die-gr3y
bcef7ee357
updated module and documentation with SUDO option
2023-03-26 18:31:25 +00:00
manishkumarr1017
a67e894609
optimising the nagiosxi modules and also fixing the bug when autocheck is disabled
2023-03-26 15:58:45 +05:30
Jack Heysel
e2e8568860
Land #17789 , proftpd_modcopy_exec merge conflict
2023-03-24 23:19:18 -04:00
jheysel-r7
0d6195a9ae
Merge branch 'master' into proftpd_modcopy_exec
2023-03-24 21:16:54 -04:00
Jack Heysel
b7ac6d45d5
Land #17789 , proftpd_modcopy_exec enhancements
...
This PR add documentation, notes, a reference URL, and a few
general code improvements to the check and exploit methods.
2023-03-24 21:08:28 -04:00
adfoster-r7
5f382cedba
Fix crash in rpc job info command
2023-03-24 12:08:58 +00:00
Samuel Henrique
d77113dad5
ssh_enumusers.rb: Change default value of 'CHECK_FALSE' to true ( closes #17810 )
...
The default action "Malformed Packet" reports all users as found even
though they don't exist.
Setting "CHECK_FALSE" to true will make the scanner bail out as it
realizes the target is patched.
2023-03-23 22:24:59 +00:00
Spencer McIntyre
3ca177eb1f
Add the exploit for CVE-2022-38108
2023-03-23 17:28:58 -04:00
Spencer McIntyre
bfac7e6e0b
Add a formatter_compatible_gadget_chains function
2023-03-23 17:28:58 -04:00
Spencer McIntyre
ff3b68a352
Add the ObjectDataProvider+JsonNetFormatter
2023-03-23 17:28:58 -04:00
Spencer McIntyre
26d0f77379
Add the AMQP client
2023-03-23 17:28:53 -04:00
Metasploit
99aca10c8d
Bump version of framework to 6.3.10
2023-03-23 12:10:35 -05:00
adfoster-r7
d04c8e1bce
Update broken secunia references
2023-03-23 10:43:57 +00:00
h00die-gr3y
0c87b0b7cf
removed Windows reference from documentation
2023-03-23 10:34:51 +00:00
bcoles
69daea95d6
exploit/unix/ftp/proftpd_modcopy_exec: Add docs and resolve RuboCop violations
2023-03-23 18:13:20 +11:00
h00die-gr3y
820e625baa
updated documentation
2023-03-22 21:17:54 +00:00
h00die-gr3y
8226fb9022
fixed small typos documentation
2023-03-22 20:04:34 +00:00
h00die-gr3y
28459c286a
init commit module and documentation
2023-03-22 18:40:50 +00:00
Metasploit
b095a6ccd2
automatic module_metadata_base.json update
2023-03-22 13:15:21 -05:00
space-r7
67ac2dc584
Land #17771 , add monitorr file upload rce
2023-03-22 13:00:38 -05:00
space-r7
3fe0801d92
use target_uri.path in requests
2023-03-22 12:50:11 -05:00
Grant Willcox
8356837e0a
Land #17798 , Update debug command to correctly output datastore values
2023-03-22 10:58:56 -05:00
Metasploit
16ecb2e649
automatic module_metadata_base.json update
2023-03-22 10:34:00 -05:00
adfoster-r7
d6e9e8d3bb
Land #17735 , fix some incorrect YARD parameters
2023-03-22 15:20:12 +00:00
Grant Willcox
efd79bdd3a
Land #17800 , Update rubocop rule for module length limits
2023-03-22 09:44:12 -05:00
Metasploit
1918c856e1
automatic module_metadata_base.json update
2023-03-22 08:07:13 -05:00
adfoster-r7
e790b1aac6
Land #17802 , update Python pingback payloads to no longer crash
2023-03-22 12:52:55 +00:00
Spencer McIntyre
e02c80f10d
Land #17747 , Fix issues in wmap plugin
2023-03-21 17:19:23 -04:00
Spencer McIntyre
835f397f79
Add a missing include so the payloads generate
2023-03-21 16:49:25 -04:00
Metasploit
4c2b1c301f
automatic module_metadata_base.json update
2023-03-21 14:23:14 -05:00
Jack Heysel
1f2a889d0c
Land #17388 , Zyxel router RCE
...
This module adds a new exploit module for a buffer
overflow in roughly 45 different Zyxel router and VPN models.
2023-03-21 15:07:04 -04:00
Jack Heysel
f5d1aab01a
Changed send_request_cgi to raw
2023-03-21 14:26:05 -04:00
adfoster-r7
5d0b7c191c
Update rubocop rule for module length limits
2023-03-21 17:38:15 +00:00
adfoster-r7
dd576dd860
Update debug command to correctly output datastore values
2023-03-21 14:02:30 +00:00
adfoster-r7
56e5796157
Land #17784 , Performance regression eager load
2023-03-21 12:59:02 +00:00
adfoster-r7
236de61130
Land #17583 , Enhances info -d with references to AttackerKB
2023-03-21 12:38:36 +00:00
Dean Welch
acf23e9c61
Sets config.eager_load to false for production envs
2023-03-21 12:31:33 +00:00
dwelch-r7
feaddc09cc
Land #17795 , Add documentation on debugging and running external python modules
2023-03-21 11:12:17 +00:00
dwelch-r7
2f45c3baa8
Land #17794 , Update external modules to support python3.11
2023-03-21 11:09:55 +00:00
adfoster-r7
cf3d14d42f
Update external modules to support python 3.11
2023-03-21 11:00:56 +00:00
adfoster-r7
83cc0bf5a9
Add documentation on debugging and running external python modules
2023-03-21 10:59:55 +00:00
dwelch-r7
158fae2a2c
Land #17792 , Fix external module crash for att open proxy scanner
2023-03-21 10:53:53 +00:00
Metasploit
1764f0806e
automatic module_metadata_base.json update
2023-03-20 18:04:09 -05:00
bwatters
3b73adf05d
Land #17401 , Add encoder module x86/xor_poly
...
Merge branch 'land-17401' into upstream-master
2023-03-20 17:48:46 -05:00
h00die-gr3y
c5ed25cd6c
small update to documentation on vulnerable releases
2023-03-20 21:12:49 +00:00
h00die-gr3y
e3df74ee5b
Updates addressing review points of space-r7
2023-03-20 21:04:58 +00:00
H00die.Gr3y
871a251c94
Apply suggestions from code review
...
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-03-20 21:44:11 +01:00
Spencer McIntyre
e59a192a84
Restructure AMQP protocol definitions
2023-03-20 16:24:31 -04:00
Spencer McIntyre
c82af18e68
Set the class and method ID from the arguments
2023-03-20 16:24:30 -04:00
Spencer McIntyre
31e3f459d8
Add some basic AMQP protocol definitions
2023-03-20 16:24:30 -04:00
Grant Willcox
d257bae706
Land #17783 , Update reload_lib command to catch script errors
2023-03-20 13:56:27 -05:00
adfoster-r7
49f15527d1
Fix external module crash for att open proxy scanner
2023-03-20 15:43:54 +00:00
h00die-gr3y
5903addbd6
Updates adressing majority of review points
2023-03-19 15:13:09 +00:00
bcoles
1b7cee4589
exploit/unix/ftp/proftpd_modcopy_exec: Add docs and resolve RuboCop violations
2023-03-19 15:35:36 +11:00
Metasploit
668735e418
automatic module_metadata_base.json update
2023-03-17 16:59:16 -05:00
space-r7
9e1be62f06
Land #17462 , add WhatsUp Gold credential extractor
2023-03-17 16:44:17 -05:00
Jack Heysel
31a32ccd9b
linting and srvhost check fix
2023-03-17 14:39:02 -04:00
jheysel-r7
56761a2f6d
Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-03-17 13:01:02 -04:00
jheysel-r7
6b853b57c6
Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-03-17 13:00:15 -04:00
jheysel-r7
764abaf087
Update documentation/modules/exploit/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.md
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-03-17 12:59:48 -04:00
jheysel-r7
df365b55a4
Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
...
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com >
2023-03-17 12:57:06 -04:00
Metasploit
01204106e9
automatic module_metadata_base.json update
2023-03-17 05:03:20 -05:00
Christophe De La Fuente
0df12fd694
Land #17754 , Open web analytics 1.7.3 remote code execution
2023-03-17 10:15:33 +01:00
H00die.Gr3y
04e0fc70bf
Apply suggestions from code review
...
Co-authored-by: dwelch-r7 <Dean_Welch@rapid7.com >
2023-03-16 19:25:03 +01:00
Metasploit
8b26064855
Bump version of framework to 6.3.9
2023-03-16 12:14:04 -05:00
Pflegusch
3baa894840
Add DefangedMode to warn the user
2023-03-16 18:07:28 +01:00
Spencer McIntyre
0c567c474e
Land #17780 , Update GSoC-2023-Project-Ideas.md
...
Update GSoC-2023-Project-Ideas.md to remove my name from mentor list
2023-03-16 10:06:29 -04:00
adfoster-r7
6f6559dc2c
Update the reload_lib command to continue reloading the remaining files if a single file fails to load
2023-03-16 11:41:00 +00:00
Arthur RAOUT
4ecf222c95
add iquote join() for x64
2023-03-16 11:21:03 +01:00
Metasploit
335c00e2f9
automatic module_metadata_base.json update
2023-03-16 05:16:49 -05:00
Christophe De La Fuente
daadb4f523
Land #17775 - Add exploit for Bitbucket env var RCE (CVE-2022-43781)
2023-03-16 11:01:07 +01:00
Arthur RAOUT
5a1fdbab50
revert newline
2023-03-15 21:00:13 +01:00
Arthur RAOUT
58951196bc
Merge branch 'fix_mingw_includes' of github.com:araout42/metasploit-framework into fix_mingw_includes
2023-03-15 20:58:56 +01:00
Arthur RAOUT
3d3e3195a3
fix 1 eol space
2023-03-15 20:58:42 +01:00
Professor Araout
351b62cca6
Merge branch 'rapid7:master' into fix_mingw_includes
2023-03-15 20:55:36 +01:00
Arthur RAOUT
f73249f709
Added changes to mingw.rb to allow custom iquote include dirs
2023-03-15 20:54:27 +01:00
Arthur RAOUT
028cc8a909
Added changes to mingw.rb to allow custom iquote include dirs
2023-03-15 20:53:57 +01:00
Grant Willcox
1fef0ebdb1
Update GSoC-2023-Project-Ideas.md
...
I am no longer a mentor for this year, so remove my name from the mentor list.
2023-03-15 14:15:28 -05:00
space-r7
8a76dab0bd
update line numbers
2023-03-15 13:24:33 -05:00
Pflegusch
027793cce6
Remove unused variable res in check_connection
2023-03-15 19:00:26 +01:00
Pflegusch
ac72c12734
Set timeout of 1s to make session available much quicker
2023-03-15 18:59:22 +01:00
Pflegusch
d06e2d9e3d
Remove nvd url
2023-03-15 18:56:23 +01:00
space-r7
22c05105d3
address review comments
...
reduces some code duplication, sets privileged to true,
and modifies documentation to reflect lhost / rhost opts
2023-03-15 11:18:03 -05:00
3V3RYONE
9d60480d4e
make subscriber nil safe
2023-03-15 21:34:51 +05:30
adfoster-r7
90d4b660f7
Update brocade tests to pass locally
2023-03-15 13:23:01 +00:00
Pflegusch
3bf60a57ae
Fix typo
2023-03-15 01:54:36 +01:00
Pflegusch
cea8aa8e02
Update open_web_analytics_rce.md to work with latest code changes
2023-03-15 01:34:02 +01:00
Pflegusch
ee0334dd40
since file got deleted, one can not trigger the payload anymore by opening the php url
2023-03-15 01:05:10 +01:00
space-r7
fddcae3d93
don't always create repo
2023-03-14 19:03:58 -05:00
Pflegusch
0cbebc8a4c
Remove malicious .php file at the end of the exploit
2023-03-15 01:03:20 +01:00
Pflegusch
103def70e4
More detailed error message for failed regex match
2023-03-15 00:07:20 +01:00
Pflegusch
bb9e214282
Fix line too long in open_web_analytics_rce docs
2023-03-15 00:01:15 +01:00
Pflegusch
d72d47e502
Update Failure Codes and check for nil in the helper functions
2023-03-14 23:59:57 +01:00
Pflegusch
897aaf9572
Use Failure::UnexpectedReply when password cant be changed
2023-03-14 23:41:48 +01:00
Pflegusch
2310b0d942
Use Failure::NotFound when no valid cache file is found
2023-03-14 23:40:29 +01:00
Pflegusch
86f4a16cff
Check if cache_request is not nil
2023-03-14 23:38:57 +01:00
Pflegusch
e160e51711
Fix typos, update docs with advanced option SearchLimit, implement SearchLimit into module
2023-03-14 23:29:55 +01:00
Pflegusch
887551bf2c
Use UnexptectedReply instead of Unknown
2023-03-14 22:29:38 +01:00
Pflegusch
8db10af8c0
check if res is not nil in addition to res.code
2023-03-14 22:28:52 +01:00
Pflegusch
dff139d6d7
remove fail_with in check_connection as suggested
2023-03-14 22:24:08 +01:00
Pflegusch
2ce3aeed2b
Add CONFIG_CHANGES to the side effects
2023-03-14 22:16:10 +01:00
Pflegusch
c0ee250b6b
Add some more URL references
2023-03-14 22:14:16 +01:00
Pflegusch
cfaad7fb84
prepend AutoCheck
2023-03-14 22:10:44 +01:00
Pflegusch
9e64f02742
Use default values in option declaration instead of DefaultOptions
2023-03-14 22:08:05 +01:00
Pflegusch
ac6e94770e
use Failure::Unreachable and use unless instead of if/else
2023-03-14 22:03:31 +01:00
Pflegusch
311314984f
Remove base64 requirement
2023-03-14 21:47:29 +01:00
Pflegusch
cc4e455530
Remove directory datastore option and make username and password required
2023-03-14 21:46:45 +01:00
Pflegusch
3196a52bdf
fix msftidy_docs.rb issues
2023-03-14 21:43:07 +01:00
3V3RYONE
9c20d0f84b
Implemented HTTP-Trace for login scanners via HttpLoggerSubscriber API
2023-03-15 00:57:33 +05:30
Metasploit
c2c5c0c339
automatic module_metadata_base.json update
2023-03-14 11:24:18 -05:00
Grant Willcox
c53a22d3fb
Land #17750 , FortiNAC keyUpload.jsp arbitrary file write CVE-2022-39952
2023-03-14 11:09:40 -05:00
Grant Willcox
7217a60e41
Update documentation to provide better installation instructions
2023-03-14 10:13:27 -05:00
Grant Willcox
4a4b2a28d2
Update documentation to provide better installation instructions
2023-03-14 09:21:08 -05:00
Metasploit
d9c5a3debf
automatic module_metadata_base.json update
2023-03-14 05:44:22 -05:00
cgranleese-r7
ec7347cd49
Land #17509 , tomcat 7 priv esc on rhel based systems (cve-2016-5425)
2023-03-14 10:16:18 +00:00
space-r7
1eeaff255e
make username / password opts required
2023-03-13 16:45:48 -05:00
Grant Willcox
3bd4c15704
Correct architecture and do final fixes
2023-03-13 15:46:42 -05:00
space-r7
4bb843fe70
add documentation, adjust method of getting ids
2023-03-13 15:31:41 -05:00
h00die
8dfe58e617
review comment
...
Co-authored-by: cgranleese-r7 <69522014+cgranleese-r7@users.noreply.github.com >
2023-03-13 14:42:26 -04:00
space-r7
4eef052fcd
add usage of linux cmdstager, cleanup, description
2023-03-13 13:24:15 -05:00
Metasploit
192af217b6
Bump version of framework to 6.3.8
2023-03-13 13:23:26 -05:00
h00die-gr3y
015d79a4c2
added documentation
2023-03-13 18:05:08 +00:00
Grant Willcox
9ab335ee05
Land #17774 , Fix undefined method word_wrap error on msfconsole boot
2023-03-13 13:00:06 -05:00
adfoster-r7
18ecd8be18
Land #17773 , Fix kerberos tests failing in different timezones
2023-03-13 17:42:26 +00:00
adfoster-r7
ccf1a82664
Fix undefiend method word_wrap error on msfconsole boot
2023-03-13 17:24:57 +00:00
Dean Welch
db343e629d
Fix remaining hardcoded timezones in tests
2023-03-13 13:16:12 -04:00
Metasploit
bc002de9f2
automatic module_metadata_base.json update
2023-03-13 11:52:26 -05:00
adfoster-r7
4afa8515a8
Land #17770 , Revert "Added new Datastore options to ssh_login"
2023-03-13 16:30:05 +00:00
Grant Willcox
3a7da2ad8a
Revert "Added new Datastore options to ssh_login"
2023-03-13 10:05:22 -05:00
h00die-gr3y
07d7248de8
initial module commit
2023-03-13 13:32:14 +00:00
Metasploit
a26e839ef8
automatic module_metadata_base.json update
2023-03-13 06:35:38 -05:00
cgranleese-r7
29eec5733d
Land #17757 , Update formatting logic for info command
2023-03-13 11:12:58 +00:00
Pflegusch
ddd594ac62
Update example in docs for latest code changes
2023-03-11 17:26:21 +01:00
Pflegusch
94e9504727
Use metasploit payload instead of hardcoded one
2023-03-11 14:47:32 +01:00
Pflegusch
3f7f28dd4f
make use of full_uri and change regex
2023-03-11 14:25:04 +01:00
adfoster-r7
daef33fe33
Update formatting logic for info command
2023-03-09 23:23:16 +00:00
Aaron Meese
0a6ac589e4
Update modules/auxiliary/scanner/http/rpyc_rce.py
...
Renames `system` function to `remote_system`
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com >
2023-03-09 15:55:51 -07:00
Jack Heysel
2a9ddae531
Updated description
2023-03-09 17:43:14 -05:00
Jack Heysel
06e7c3d702
Responded to comments updated docs
2023-03-09 17:39:53 -05:00
space-r7
2fbc80a44f
add base cmdstager support for windows target
2023-03-09 16:24:12 -06:00
Metasploit
d188170169
Bump version of framework to 6.3.7
2023-03-09 14:03:37 -06:00
Christophe De La Fuente
4866c2b8b8
Land #17686 , Additional PetitPotam Methods
2023-03-09 19:29:16 +01:00
Grant Willcox
fdcf55ef58
Land #17758 , Update metasploit-payloads gem to 2.0.122
2023-03-09 11:34:18 -06:00
jheysel-r7
63e2376f64
Apply suggestions from code review
...
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com >
2023-03-09 12:31:30 -05:00
Metasploit
d2d99b5db7
automatic module_metadata_base.json update
2023-03-09 11:01:25 -06:00
Spencer McIntyre
0cbac03f91
Update ruby_smb gem to 3.2.5
2023-03-09 11:58:49 -05:00
Spencer McIntyre
876b7c2c0f
Update metasploit-payloads gem to 2.0.122
...
Includes changes from:
* rapid7/metasploit-payloads#621
* rapid7/metasploit-payloads#623
2023-03-09 11:40:45 -05:00
Grant Willcox
beb9f87d53
Land #17507 , SugarCRM webshell upload RCE [CVE-2023-22952] + Mixin for PNG embedded web shells
2023-03-09 10:16:57 -06:00
dwelch-r7
9961fffaa2
Land #17756 , Update secrets dump to generate kerberos rc4 key for machine account
2023-03-09 16:12:52 +00:00
dwelch-r7
01399e4818
Land #17749 , Add nthashes to keytab export
2023-03-09 16:09:13 +00:00
Pflegusch
38511f4d89
Rename establish_connection function
2023-03-09 17:06:07 +01:00
Pflegusch
e66fd8f5ae
Use rand_text_alphanumeric function
2023-03-09 17:03:48 +01:00
Pflegusch
69839d1924
Remove get_proxy_protocol function
2023-03-09 17:02:10 +01:00
Pflegusch
85185633b7
Use single back ticks and 3 instead of 4 at the end
2023-03-09 16:58:04 +01:00
Pflegusch
614f4b6d89
Make installation path of owa configurable
2023-03-09 16:32:28 +01:00
h00die-gr3y
fc711131a2
added MIME, added break in mixin and added link with installation instructions
2023-03-09 09:28:46 -06:00
Grant Willcox
deafceed00
Update documentation, library, and Gemspec from review
2023-03-09 09:28:27 -06:00
h00die-gr3y
d3f84af790
Included mixin for PHP code injection at PNGs
2023-03-09 09:28:14 -06:00
h00die-gr3y
dc8ebb722a
Added support for native PHP payloads and reengineered webshells
2023-03-09 09:28:03 -06:00
h00die-gr3y
c844d4d714
removed check and fix up some code
2023-03-09 09:27:29 -06:00
h00die-gr3y
771f32bd8a
Add documentation and apply code updates
2023-03-09 09:27:03 -06:00
h00die-gr3y
378a667f76
init commit module
2023-03-09 09:26:55 -06:00
Pflegusch
2de53712bd
Use Rex::Version for version comparison
2023-03-09 15:59:42 +01:00
Pflegusch
94ceeb075a
Redirect is not necessary - replace with simple send_request_cgi request
2023-03-09 15:41:15 +01:00
Jeffrey Martin
350984bc41
Land #17661 , Weekly dependency updates for Gemfile.lock
2023-03-09 08:36:26 -06:00
Pflegusch
ee95eb2883
fix typo: establish_connection
2023-03-09 15:09:32 +01:00
adfoster-r7
5c1fcc3a72
Update secrets dump to generate kerberos rc4 key for machine account
2023-03-09 14:05:12 +00:00
Pflegusch
14b5c08a62
Fix the double slash in the shell url
2023-03-09 14:28:15 +01:00
Pflegusch
ae7ca169fe
Use the same IP as in the example
2023-03-09 14:08:50 +01:00
Pflegusch
3847c410b0
Small changes to the open_web_analytics_rce documentation
2023-03-09 14:05:06 +01:00
Pflegusch
7b0a54bb56
Add the documentation for the module
2023-03-09 13:59:27 +01:00
Pflegusch
d59175a463
make it work for https and http and remove the tmp self signed cert bypass
2023-03-09 13:58:56 +01:00
adfoster-r7
ab57c09dc2
Update get_ticket to support using forged golden tickets
2023-03-09 12:21:29 +00:00
Dean Welch
540f28d71b
Fix crashes in wmap plugin
2023-03-09 12:07:40 +00:00
Pflegusch
f0dbf54c69
use fail_with in get_cache_content function
2023-03-09 11:04:00 +01:00
Pflegusch
7068d4c3f1
remove LPORT, RPORT and SSL from DefaultOptions
2023-03-09 11:03:24 +01:00
space-r7
c69b5c9363
add creation of projects and multiple commits
2023-03-08 17:46:25 -06:00
Grant Willcox
100cfbccf9
Fix up some more slight things in documentation. Also tidy up some things in the module
2023-03-08 17:25:56 -06:00
Grant Willcox
eeb30d2426
Fix up some typos etc from review in documentation
2023-03-08 16:44:06 -06:00
Pflegusch
76b05a7092
Change DisclosureDate according to nvd.nist.gov
2023-03-08 21:52:13 +01:00
Pflegusch
b37be28191
Working module open web analytics 1.7.3 rce
2023-03-08 21:30:52 +01:00
Jack Heysel
d31220ef1e
Updated references
2023-03-08 14:17:34 -05:00
Jack Heysel
263223b783
Last second file reorganization fix
2023-03-08 14:08:46 -05:00
Jack Heysel
dfae7e2fc4
FortiNAC keyUploap.jsp arbitrary file write CVE-2022-39952
2023-03-08 14:06:28 -05:00
Metasploit
05774d5f9c
automatic module_metadata_base.json update
2023-03-08 12:32:46 -06:00
Christophe De La Fuente
bbc071d254
Land #17737 , Add Gather Wowza Streaming Engine Credentials
2023-03-08 19:13:21 +01:00
Metasploit
924d5eabee
automatic module_metadata_base.json update
2023-03-08 12:10:57 -06:00
adfoster-r7
3bc4639235
Add nthashes to keytab export
2023-03-08 18:03:44 +00:00
Grant Willcox
fbda738da9
Land #17727 , Added new Datastore options to ssh_login
2023-03-08 11:43:57 -06:00
rohitkumarankam
599642bbb9
Updated variable names to be more specific
2023-03-08 10:53:24 -06:00
rohitkumarankam
28fb670d4d
added sane defaults for new variables
2023-03-08 10:53:23 -06:00
rohitkumarankam
71e142a5ee
updated variable names
2023-03-08 10:53:23 -06:00
rohitkumarankam
2c3005fee3
Added new Datastore options to ssh_login
2023-03-08 10:53:23 -06:00
Grant Willcox
0fc94f14e8
Bump up gems again
2023-03-08 10:26:29 -06:00
bcoles
f62994b4c0
Add Gather Wowza Streaming Engine Credentials
2023-03-09 01:31:23 +11:00
Metasploit
f8dbeb359a
automatic module_metadata_base.json update
2023-03-08 08:18:44 -06:00
Christophe De La Fuente
6ef92915d2
Land #17741 , Add in missing EDB reference to pfsense_pfblockerng_webshell
2023-03-08 14:53:09 +01:00
Arthur RAOUT
75002f16e6
Finally reverted bad changes
2023-03-08 13:45:25 +01:00
Arthur RAOUT
889aff9701
Revert accidental changes Merge branch 'upstream-master' into New_x86_xor_encoder
2023-03-08 13:41:26 +01:00
Grant Willcox
475209c768
Land #17746 , Add LastPass master password example
2023-03-07 14:01:19 -06:00
Tod Beardsley
de58b96d2a
Add "a good example" of a LastPass password
...
When setting a new master password, LastPass helpfully suggests "r50$K28vaIFiYxaY" as a good example.
Sure, sounds good to me.
2023-03-07 13:32:50 -06:00
Tod Beardsley
f5aa4296ff
Merge branch 'rapid7:master' into master
2023-03-07 13:29:11 -06:00
Grant Willcox
10af603858
Land #17673 , Msf::Payload::Apk: apktool: Decompile only main classes
2023-03-07 13:01:20 -06:00
Spencer McIntyre
7bcdf0386e
Land #17745 , Update metasploit-payloads gem to 2.0.120
...
Update metasploit-payloads gem to 2.0.120
2023-03-07 13:28:25 -05:00
Grant Willcox
92a91c759e
Land #17743 , Add documentation on profiling msfconsole and msfvenom performance
2023-03-07 12:25:40 -06:00
adfoster-r7
3338718f37
Add documentation on profiling msfconsole
2023-03-07 18:01:13 +00:00
Grant Willcox
795b9c9ebc
Land #17744 , Improve accuracy of msfconsole performance profiling
2023-03-07 11:36:47 -06:00
Grant Willcox
0bf809697c
Update metasploit-payloads gem to 2.0.120
2023-03-07 10:55:07 -06:00
Metasploit
a0accb2a36
automatic module_metadata_base.json update
2023-03-07 08:45:59 -06:00
Christophe De La Fuente
ecbeceb817
Land #17733 , Add Gather Wowza Streaming Engine Credentials
2023-03-07 15:27:52 +01:00
bcoles
3f781de8e9
Add Wowza Streaming Engine Manager Login Utility
2023-03-07 23:42:42 +11:00
adfoster-r7
6e06d1e6f8
Improve accuracy of msfconsole performance profiling
2023-03-07 12:41:07 +00:00
Grant Willcox
5c4d730cd3
Add in missing EDB reference
2023-03-06 14:32:01 -06:00
dwelch-r7
77c99da6d6
Land #17738 , Fix Ruby 3.2 crash when running certain tools
2023-03-06 14:20:35 +00:00
Dean Welch
d318a9e0d0
Add advanced option to include Ticket Checksum during forging
2023-03-06 13:21:23 +00:00
Dean Welch
48a5f33f35
Add option to include a ticket checksum while forging a ticket
2023-03-06 13:19:59 +00:00
Dean Welch
2aa74f9dfc
Add support for full pac and partial ticket checksum support
2023-03-06 13:14:09 +00:00
adfoster-r7
4f75a44581
Fix Ruby 3.2 crash when running certain tools
2023-03-06 11:03:12 +00:00
Metasploit
10ea667b8f
automatic module_metadata_base.json update
2023-03-06 05:00:24 -06:00
adfoster-r7
2c9aed6071
Land #17729 , Replace deprecated File.exists? with File.exist?
2023-03-06 10:37:48 +00:00
Grant Willcox
c5ef08b324
Add in additional YARD documentation fixes
2023-03-05 20:56:54 -06:00
Grant Willcox
08f07eccb6
Fix initial incorrect parameters in YARD documentation
2023-03-05 20:15:14 -06:00
bcoles
9dcaf93b29
Replace deprecated File.exists? with File.exist?
2023-03-05 14:30:47 +11:00
npm-cesium137-io
6adfc69b9a
Merge pull request #2 from space-r7/whatsupgold-changes
...
Suggested changes for module
2023-03-04 14:41:01 -05:00
adfoster-r7
a2a9cd76b3
Land #17725 , Fix number of OSX nightly installers we retain and fix typo
2023-03-04 00:23:12 +00:00
space-r7
99fb35fe84
refs/heads instead of refs/head
2023-03-03 17:24:39 -06:00
Grant Willcox
20003fd165
Land #17726 , Update metasploit-payloads gem to 2.0.118
2023-03-03 16:40:16 -06:00
bwatters
9a4f8c0e7f
Land #17716 , Fix the reverse port forward message
...
Merge branch 'land-17716' into upstream-master
2023-03-03 16:28:49 -06:00
Spencer McIntyre
2c1de9b2e4
Update metasploit-payloads gem to 2.0.118
...
Includes changes from:
* rapid7/metasploit-payloads#619
* rapid7/metasploit-payloads#617
* rapid7/metasploit-payloads#610
2023-03-03 17:19:05 -05:00
Grant Willcox
df4009c084
Fix number of OSX nightly installers we retain and fix typo
2023-03-03 14:12:27 -06:00
Metasploit
fe84cb0804
automatic module_metadata_base.json update
2023-03-03 12:08:47 -06:00
Grant Willcox
6579dcc977
Land #17723 , Fix PHP Base64 encoding
2023-03-03 11:53:46 -06:00
Metasploit
3b7a224f37
automatic module_metadata_base.json update
2023-03-03 08:32:09 -06:00
cgranleese-r7
252012f48d
Land #17675 , Add support for forging inter-realm Kerberos tickets
2023-03-03 14:17:48 +00:00
Metasploit
f8c67e9498
automatic module_metadata_base.json update
2023-03-03 07:46:21 -06:00
cgranleese-r7
6259f02051
Land #17684 , Add rbcd exploitation documentation to docs site
2023-03-03 13:31:53 +00:00
adfoster-r7
efd79eb638
Add support for forging inter-realm Kerberos tickets
2023-03-03 13:20:39 +00:00
adfoster-r7
0047ce5d3a
Add rbcd exploitation documentation to docs site
2023-03-03 13:18:29 +00:00
cgranleese-r7
d5f9ff14d2
Land #17688 , Fix broken wiki links, and add automation for future validation
2023-03-03 11:51:25 +00:00
adfoster-r7
31ca497e1f
Fix broken wiki links, and add automation for future validation
2023-03-03 10:51:23 +00:00
Grant Willcox
975de9d479
Supply exception message when raising BadcharError and fix typo
2023-03-02 17:46:21 -06:00
Grant Willcox
96c9f60cc1
Land #17715 , Update metasploit-payloads gem to 2.0.115
2023-03-02 16:52:24 -06:00
jvoisin
5b82c952ba
Rubocop pass
2023-03-02 21:43:41 +01:00
jvoisin
ae549ce1d4
Fix PHP base64 encoding
2023-03-02 21:40:27 +01:00
bwatters
5b4962e2bd
Land #17721 , Fix adapted payload stage encoding
...
Merge branch 'land-17721' into upstream-master
2023-03-02 14:03:06 -06:00
Metasploit
673a574b3d
Bump version of framework to 6.3.6
2023-03-02 12:11:53 -06:00
adfoster-r7
f3975e968f
Land #17635 , Add support for full pac ul_type 19 and partial ticket checksum support
2023-03-02 14:22:58 +00:00
Metasploit
ec2d71cbb7
automatic module_metadata_base.json update
2023-03-02 08:13:23 -06:00
Spencer McIntyre
a418bd9c65
Land #17638 , Lucee Scheduled Job RCE
2023-03-02 08:57:19 -05:00
Arthur RAOUT
7b7377257e
fixed 2 rubocop offenses
2023-03-02 13:08:09 +01:00
Arthur RAOUT
e178226efa
Merge branch 'New_x86_xor_encoder' of github.com:araout42/metasploit-framework into New_x86_xor_encoder
2023-03-02 12:31:21 +01:00
Arthur RAOUT
dd7e8328bb
no test.rb
2023-03-02 12:31:07 +01:00
Arthur RAOUT
1461f9fb03
slight changes in the comments
2023-03-02 12:30:38 +01:00
Arthur RAOUT
6a81e0f6cb
Merge branch 'upstream-master' into New_x86_xor_encoder
2023-03-02 12:10:00 +01:00
Professor Araout
83bcd1cc1b
Fix typo in the comments line 41
...
Co-authored-by: Brendan <bwatters@rapid7.com >
2023-03-02 11:50:56 +01:00
Spencer McIntyre
088f359cee
Make stage encoding optional
2023-03-01 12:24:46 -05:00
Spencer McIntyre
08cb115368
Handle encoding stages of different architectures
2023-03-01 12:17:37 -05:00
JBince
1245124afa
updated docs to reflect changes from smcintyre-r7
2023-02-28 19:58:39 -06:00
Alex
dde4445dab
Merge pull request #1 from smcintyre-r7/pr/collab/17638
...
Pr/collab/17638
2023-02-28 20:27:49 -05:00
Spencer McIntyre
3fabcc3421
Use coldfusion to decode base64 data
...
This means we don't need to rely on base64 being in the path. Also
invoke ARCH_CMD payloads on Windows through cmd.exe and not
powershell.exe.
2023-02-28 17:32:56 -05:00
Metasploit
82005fe3cf
automatic module_metadata_base.json update
2023-02-28 16:31:20 -06:00
Spencer McIntyre
c8aa491378
Fail with Unreachable when res is nil
2023-02-28 17:05:59 -05:00
Jack Heysel
3abd62076c
Land #17624 , Oracle E-Business Suite Module
...
This pull request adds an exploit module for CVE-2022-21587
an arbitrary file upload vulnerability in Oracle Web Applications
Desktop Integrator as shipped with 12.2.3 through to 12.2.11
which results in RCE
2023-02-28 17:04:20 -05:00
Metasploit
89d9da87bd
automatic module_metadata_base.json update
2023-02-28 15:56:29 -06:00
Spencer McIntyre
a916163b49
Cleanup files and fixup messages
2023-02-28 16:41:57 -05:00
space-r7
b3e6767125
Land #17676 , add SIS login module
2023-02-28 15:41:24 -06:00
space-r7
380a66916f
use print instead of vprint
2023-02-28 15:40:03 -06:00
Spencer McIntyre
636d89cf67
Fix the reverse port forward message
2023-02-28 15:08:00 -05:00
Spencer McIntyre
75ed29964e
Update metasploit-payloads gem to 2.0.115
...
Includes changes from:
* rapid7/metasploit-payloads#614
* rapid7/metasploit-payloads#611
2023-02-28 12:56:34 -05:00
Imran E. Dawoodjee
41c231b803
Convert to JSON before checks
2023-02-28 09:46:56 +08:00
Metasploit
b8178397a9
automatic module_metadata_base.json update
2023-02-27 15:49:35 -06:00
Spencer McIntyre
2be54376bc
Land #17699 , Add in SCHANNEL support for LDAP
2023-02-27 16:35:30 -05:00
Spencer McIntyre
d92b6e328a
Fix up error message
2023-02-27 16:14:00 -05:00
Metasploit
1f370b3c9e
automatic module_metadata_base.json update
2023-02-27 15:02:04 -06:00
bwatters
87f046f351
Land #17629 , Fix #17629 #query_ldap issues
...
Merge branch 'land-17698' into upstream-master
2023-02-27 14:39:19 -06:00
Jack Heysel
ac3e84d3fb
Land #17679 , Fix broken payload selection for RPC
...
Fix broken payload selection for Metasploit RPC
2023-02-27 15:19:50 -05:00
Grant Willcox
524f5e4e63
Check file exists first before trying to read
2023-02-27 14:12:09 -06:00
JBince
8b03f2fda8
Reworked payload execution logic
2023-02-27 11:09:34 -06:00
Grant Willcox
4cd50b4550
Address comments from review
2023-02-27 11:07:21 -06:00
Jack Heysel
fc76f5f039
Land #17680 , improve UX of metasploit docs site
...
Adds expand all and colapse all buttons to module
section of the docs site for a better UX
2023-02-27 11:31:46 -05:00
Imran E. Dawoodjee
3f1119c69e
Attempt fix for NoMethodError when exploiting
2023-02-26 22:02:08 +08:00
Imran E. Dawoodjee
2f08cf6c46
Improved version check, review round 1
2023-02-26 17:23:54 +08:00
Grant Willcox
47652e3b19
Land #17696 , Update metasploit-payloads gem to 2.0.113
2023-02-25 16:41:21 -06:00
Grant Willcox
3c56cf7a15
Land #17701 , Fix typo in psexec.rb
2023-02-25 10:42:37 -06:00
Grant Willcox
363a3415df
Land #17700 , Fix argument validation for the route command
2023-02-25 10:37:52 -06:00
Jeff McJunkin
b7d373d247
Typo in psexec.rb
2023-02-25 08:15:34 -08:00
Grant Willcox
50fdd4536e
Land #17695 , Remove LDAP collection project from GSOC 2023 list
2023-02-25 09:26:05 -06:00
Spencer McIntyre
49a2f481b6
Fix argument validation for the route command
2023-02-24 15:36:52 -05:00
Grant Willcox
fe8afed994
Change over to fail_with and add condition to fail when SSL is not enabled and SCHANNEL is the authentication mechanism
2023-02-24 14:13:13 -06:00
Metasploit
020d2d3302
automatic module_metadata_base.json update
2023-02-24 13:54:52 -06:00
Grant Willcox
f6bfa6a61b
Add in SCHANNEL support, and update modules to fix a hang when using to_json instead of get_operation_result.
2023-02-24 13:50:04 -06:00
Spencer McIntyre
20dbc175d1
Land #17697 , Froxlor 2.0.7 is actually vulnerable too
...
Froxlor 2.0.7 is actually vulnerable too
2023-02-24 14:32:32 -05:00
Spencer McIntyre
26d9026fc2
Fix a filter error
...
When FILTER was nil, the check would fail causing `()` to be appended to
the LDAP query filter which would cause it to fail.
2023-02-24 13:51:58 -05:00
Spencer McIntyre
fc8f94fff4
Fix #query_ldap to use the API
...
Fix #query_ldap to use the API provided by Windows instead of dealing
with the opaque BER data structures. This means that querying is now
reliant on documented APIs and will function on both 32-bit and 64-bit
Meterpreters.
2023-02-24 13:46:11 -05:00
Spencer McIntyre
9706ee9d9e
Need to use #native_arch
...
Using #arch instead of #native_arch means that the Python Meterpreter
will be misclassified as ARCH_PYTHON and will be unable to use util
functions correctly.
2023-02-24 13:46:11 -05:00
Jack Heysel
ca6faed172
Check method enhancement
2023-02-24 13:33:10 -05:00
Jack Heysel
5311a491e9
Froxlor 2.0.7 is actually vulnerable too
2023-02-24 13:18:34 -05:00
Spencer McIntyre
7db2d86147
Update metasploit-payloads gem to 2.0.113
...
Includes changes from:
* rapid7/metasploit-payloads#604
* rapid7/metasploit-payloads#605
* rapid7/metasploit-payloads#607
* rapid7/metasploit-payloads#606
* rapid7/metasploit-payloads#609
2023-02-24 12:09:21 -05:00
Spencer McIntyre
22ad9ebe7f
Remove the LDAP collection prject
2023-02-24 11:40:56 -05:00
bcoles
b19ab03da1
Msf::Payload::Apk: apktool: Decompile only main classes
2023-02-25 01:08:20 +11:00
adfoster-r7
a408e3e27f
Land #17687 , Add additional documentation for HTTPRawHeaders Option
2023-02-24 10:19:18 +00:00
Metasploit
011ffb87bd
automatic module_metadata_base.json update
2023-02-23 21:18:09 -06:00
Jack Heysel
5749b402af
Land #17672 , disable ClamAV on Linux
...
This PR includes a post module that will disable
ClamAV on Linux systems.
2023-02-23 21:51:48 -05:00
Jack Heysel
9a874c352b
Added missing space in fail_with statement
2023-02-23 20:57:19 -05:00
DLL_Cool_J
9e9e7ac938
Update docs/metasploit-framework.wiki/Metasploit-Guide-HTTP.md
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2023-02-23 20:33:10 -05:00
DLL_Cool_J
0479215373
Update docs/metasploit-framework.wiki/Metasploit-Guide-HTTP.md
...
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com >
2023-02-23 20:32:58 -05:00
space-r7
eec73fe394
add module changes
2023-02-23 16:34:43 -06:00
Jack Heysel
5e2f0965f3
Changed print_bad to fail_with
2023-02-23 17:33:52 -05:00
Jack Heysel
8db255288b
Spelling
2023-02-23 16:40:09 -05:00
Jack Heysel
2ed89dda7e
Added nc and python cmd techniques
2023-02-23 16:21:09 -05:00
Spencer McIntyre
fbf2e5d370
Land #17562 , Fix incorrect defs in def_wldap32.rb
...
Fix incorrect definitions for ldap_search functions in def_wldap32.rb
2023-02-23 14:03:26 -05:00
Metasploit
f4549b0a1e
Bump version of framework to 6.3.5
2023-02-23 12:11:22 -06:00
adfoster-r7
d21f6a10a2
Land #17690 , Update inspect ticket tests to use the local timezone
2023-02-23 16:02:55 +00:00
dwelch-r7
6c5c158607
Land #17691 , Fix module spec test failing on local machine
2023-02-23 14:52:05 +00:00
Spencer McIntyre
42bd87e0c1
Update how railgun handles pointer return types
...
Update railgun to handle pointer return types. If the type that is
pointed to is known (i.e. PCHAR, PULONG_PTR) and not LPVOID, the
contents returned to the caller. The raw address is also returned in the
&return key to enable the caller to free the buffer if necessary which
is determined by the function that was called.
2023-02-23 08:42:59 -06:00
Grant Willcox
4c25530afe
Fix up PCHAR and PWCHAR definitions to correctly handle cases where the return value may be 0. Also fix some definitions to be clearer and work on x64.
2023-02-23 08:41:26 -06:00
Grant Willcox
ae461c2395
Add in ULONG alias to DWORD and update definitions to fix some mistakes
2023-02-23 08:40:28 -06:00
Grant Willcox
59eb419d28
Make PULONG_PTR definitions PLPVOID to be more accurate, and correctly define some structures as PBLOB so they be handled correctly
2023-02-23 08:40:23 -06:00
Grant Willcox
d16905ca49
Fix incorrect definitions for ldap_search functions
2023-02-23 08:40:22 -06:00
Dean Welch
8a37cc6c88
Update inspect ticket tests to use the local timezone
2023-02-23 14:39:19 +00:00
Grant Willcox
8b27c2e8f7
Use start_tls for connections with SSL
2023-02-23 08:33:18 -06:00
adfoster-r7
b2cc84228f
Fix module spec test failing on local machine
2023-02-23 14:27:44 +00:00
Dean Welch
65c11bd8c8
Update inspect ticket tests to use the local timezone
2023-02-23 13:37:16 +00:00
Dean Welch
fd5d10e610
Update inspect ticket tests to use the local timezone
2023-02-23 12:43:43 +00:00
archcloudlabs
743e5ffd9f
adding an example for additional http-headers
2023-02-22 22:22:04 -05:00
archcloudlabs
10552cbc87
msftidy and notes
2023-02-22 21:48:35 -05:00
archcloudlabs
9ff4cdfd5c
updated w/ socat method
2023-02-22 21:40:26 -05:00
archcloudlabs
55371f9363
removing to_str
2023-02-22 20:36:55 -05:00
adfoster-r7
2de3142cde
Land #17685 , Fixed Broken Link for Metasploit Goliath in GSOC'23 page
2023-02-23 00:43:34 +00:00
samsepi0x0
b3f30f00a7
Update GSoC-2023-Project-Ideas.md
2023-02-23 05:13:27 +05:30
samsepi0x0
b38d51edca
Update GSoC-2023-Project-Ideas.md
2023-02-23 02:19:40 +05:30
samsepi0x0
6b36463086
Fixed Broken Link for Metasploit Goliath.
2023-02-23 01:34:16 +05:30
Metasploit
c0042ab0d2
automatic module_metadata_base.json update
2023-02-22 12:26:24 -06:00
space-r7
9621f77bac
Land #17640 , add Froxlor RCE
2023-02-22 12:11:38 -06:00
Jack Heysel
bf7884b2dc
Removed need to auth twice when AutoCheck enabled
2023-02-22 12:28:28 -05:00
Imran E. Dawoodjee
62439bbcd0
Update documentation
2023-02-22 22:52:43 +08:00
Imran E. Dawoodjee
2b5b17916f
Update docs, improved robustness of module+lib
2023-02-22 22:41:14 +08:00
sfewer-r7
690abcfe1f
improve the documentation, mention some steps required during setup.
2023-02-22 09:42:11 +00:00
Jack Heysel
f6ec3855b3
Removed space at EOL
2023-02-22 00:35:42 -05:00
Jack Heysel
0c8df1a67b
Updated docs and module suggetsions
2023-02-22 00:33:40 -05:00
jheysel-r7
42146fc4ec
Update modules/exploits/linux/http/froxlor_log_path_rce.rb
...
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-02-21 23:02:49 -05:00
jheysel-r7
80cec400bf
Update modules/exploits/linux/http/froxlor_log_path_rce.rb
...
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-02-21 22:59:23 -05:00
jheysel-r7
fc5f4983f6
Update modules/exploits/linux/http/froxlor_log_path_rce.rb
...
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-02-21 22:58:49 -05:00
jheysel-r7
647418745f
Update modules/exploits/linux/http/froxlor_log_path_rce.rb
...
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2023-02-21 22:58:41 -05:00
Metasploit
e1e39ad5bc
automatic module_metadata_base.json update
2023-02-21 15:44:56 -06:00
Jack Heysel
e625e2e474
Land #17652 , module for pyload js2py exploit
...
This adds an exploit for CVE-2023-0297 which is unauthenticated
Javascript injection in pyLoads Click N Load service.
2023-02-21 16:27:04 -05:00
Spencer McIntyre
6dbf22a5e7
Automatically rebind on STATUS_PIPE_DISCONNECTED
2023-02-21 15:51:10 -05:00
Spencer McIntyre
fa3baa40e6
Add three new petitpotam methods
2023-02-21 14:38:52 -05:00
sfewer-r7
963b9a9952
Merge remote-tracking branch 'origin/CVE-2022-21587' into CVE-2022-21587
2023-02-21 18:02:10 +00:00
sfewer-r7
3854c30a11
more specific testing of the response after upload to ensure it contains the expected EBS response data. infer the relative path traversal depth from the path to the upload folder, thanks @gwillcox-r7
2023-02-21 18:00:17 +00:00
Dean Welch
fc5d938d8c
Add support for full pac and partial ticket checksum support
2023-02-21 13:03:59 +00:00
adfoster-r7
1b44973c80
Improve UX of module explorer
2023-02-21 12:06:24 +00:00
adfoster-r7
239bc02db4
Fix broken payload selection for metasploit rpc
2023-02-21 11:04:11 +00:00
Imran E. Dawoodjee
6e9a7a9d07
Minor fixes
2023-02-20 23:45:59 +08:00
cgranleese-r7
31a5125d78
Land #17674 , Update basic discovery script database connection
2023-02-20 11:44:36 +00:00
adfoster-r7
5314d21e59
Update basic discovery script database connection
2023-02-20 09:42:59 +00:00
adfoster-r7
db290369a4
Land #17650 , Fix #17602 - Update basic_discovery.rc to support commas in RHOST values
2023-02-20 09:41:08 +00:00
archcloudlabs
bf5919f461
finisehd msftidy/rubocop fixs
2023-02-19 19:49:39 -05:00
archcloudlabs
f61c3bcefc
initial commit of disable_av documentation
2023-02-19 19:49:39 -05:00
archcloudlabs
fc5a38e870
Simplifying the module
2023-02-19 19:49:39 -05:00
archcloudlabs
1f45b1e4b7
initial commit of disable_clamav module
2023-02-19 19:49:39 -05:00
ajmeese7
a2026182e1
feat: created module to exploit CVE-2019-16328
2023-02-19 16:03:05 -05:00
JBince
75fb5e883d
Exploit update based on feedback
2023-02-19 09:16:56 -06:00
Imran E. Dawoodjee
bdc435f5c8
Add login module for Softing Secure Integration Server
2023-02-19 22:25:22 +08:00
Grant Willcox
066d0a6f7e
Land #17663 , fixing case insensitive issue for show options #17459
2023-02-18 13:26:47 -06:00
manishkumarr1017
c553f80cd9
fixing case insensitive issue for show options #17459
2023-02-18 05:51:46 +00:00
Grant Willcox
38d8b70873
Make msftidy_docs.rb happy and then also clarify where to find software download links
2023-02-17 14:56:51 -06:00
Grant Willcox
c713da368d
Add in a few fixes from the review
2023-02-17 14:52:57 -06:00
space-r7
871c9c57f3
add logic to retrieve email address
2023-02-17 14:13:29 -06:00
Metasploit
9cf2bbf352
automatic module_metadata_base.json update
2023-02-17 12:36:29 -06:00
Spencer McIntyre
c6e9c8e3db
Land #17660 , Move temp storage of reg hives
...
Move temp storage of reg hives to %TEMP%
2023-02-17 13:12:29 -05:00
Grant Willcox
676dd5cbbd
Bump up gems
2023-02-17 11:40:23 -06:00
cgranleese-r7
292c160abf
Land #17637 , Add module information to docs site
2023-02-17 14:32:10 +00:00
JBince
ce9933fc4c
Feedback changes + rubocop & msftidy changes
2023-02-17 08:16:49 -06:00
sfewer-r7
73e82274dd
changes as per @gwillcox-r7 review
2023-02-17 13:10:53 +00:00
space-r7
197124dd76
add Git usage, repository creation
2023-02-16 17:38:02 -06:00
JBince
a3a6ae9c4a
feedback fixes
2023-02-16 14:33:03 -06:00
Jonas Vestberg
c610949a5a
Move temp storage of reg hives to %TEMP%
2023-02-16 20:13:31 +01:00
Jack Heysel
44c393e2f1
Fixed netcat session cleanup
2023-02-16 13:14:24 -05:00
Metasploit
71cecfb1d4
Bump version of framework to 6.3.4
2023-02-16 12:12:20 -06:00
Jack Heysel
1c49b002d2
Changed get_csrf to use xpath
2023-02-16 10:47:04 -05:00
Jack Heysel
00d1637f3d
Changed check method to use xpath
2023-02-16 10:33:15 -05:00
Grant Willcox
e7da4c4612
Land #17594 , Add larger DLL templates
2023-02-15 19:35:37 -06:00
samsepi0x0
12c739b881
Update basic_discovery.rc
2023-02-16 03:53:21 +05:30
Metasploit
5a2ab6edd4
automatic module_metadata_base.json update
2023-02-15 15:32:23 -06:00
Spencer McIntyre
ecd5ad29a7
Add module docs
2023-02-15 16:29:42 -05:00
Grant Willcox
a8d2073eee
Land #17646 , Link Hadoop YARN exploit to documentation
2023-02-15 15:09:05 -06:00
samsepi0x0
86e8f5c484
Correctly parsed before the scan.
2023-02-15 14:47:24 -06:00
Arnout Engelen
5d8b1dc4a6
Link Hadoop YARN exploit to documentation
...
This exploit scans for misconfigured installations, link to the documentation
that describes how to properly secure it.
2023-02-15 21:17:26 +01:00
Spencer McIntyre
557042c91c
Initial exploit is working
2023-02-15 14:18:25 -05:00
Grant Willcox
b89602bb7b
Land #17645 , Fix bootup git warnings on arch
2023-02-15 11:49:57 -06:00
Spencer McIntyre
301d25ddfa
Raise more explicit errors for invalid arguments
2023-02-15 09:07:01 -05:00
adfoster-r7
a98368cfc5
Fix bootup git warnings on arch
2023-02-15 11:18:02 +00:00
Spencer McIntyre
5725dd2ded
Fix an off by one size error
2023-02-14 18:01:14 -05:00
Metasploit
165b0f8d61
automatic module_metadata_base.json update
2023-02-14 16:23:51 -06:00
Spencer McIntyre
ac9d60ce9e
Land #17281 , Added module for CVE-2022-2992
...
Added module for CVE-2022-2992 - Gitlab Remote Command Execution via Github import
2023-02-14 16:57:29 -05:00
Spencer McIntyre
5d254cc36b
Land heyder#2, Refactor namespaces
2023-02-14 16:44:29 -05:00
space-r7
78ae5f49ce
add gitlab prefix back to methods
2023-02-14 15:26:01 -06:00
space-r7
304b90ecc8
split mixins between forms and v4 api used
2023-02-14 12:37:43 -06:00
Jack Heysel
8aed02de3d
Linting
2023-02-14 10:39:47 -05:00
adfoster-r7
bf57918454
Add module information to docs site
2023-02-14 13:10:03 +00:00
sfewer-r7
d1463df3cc
fix documentation issues from msftidy_docs
2023-02-14 10:47:47 +00:00
Jack Heysel
ff159c8760
Updated TODO
2023-02-13 20:24:32 -05:00
Jack Heysel
ca0b1ffe05
Documentation fixes
2023-02-13 19:56:23 -05:00
Jack Heysel
2e195b2742
Initial commit Froxlor RCE
2023-02-13 19:39:18 -05:00
Metasploit
0e86cfa6c7
automatic module_metadata_base.json update
2023-02-13 18:13:40 -06:00
Grant Willcox
d012145726
Land #17599 , Cisco RV LAN Exploit - CVE-2022-20705 and CVE-2022-20707
2023-02-13 17:50:06 -06:00
Stephen Wildow
96fecb6048
Modified BadChars and FailWith codes
2023-02-13 17:49:09 -05:00
JBince
1dadd113dd
msftidy changes to documentation
2023-02-13 15:27:07 -06:00
JBince
9c3cfd8bdb
Added documentation, cleaned up functions, rubocop fixes
2023-02-13 15:19:45 -06:00
Grant Willcox
45e453d687
Fix up remaining review comments
2023-02-13 15:07:25 -06:00
space-r7
9605b4bb91
Merge branch 'heyder-pr-1' into heyder-cve-2022-2992
2023-02-13 14:59:45 -06:00
Spencer McIntyre
c3fa924cfa
Remove the NGROK_URL option
2023-02-13 14:31:44 -05:00
Spencer McIntyre
210b7a3254
Use #get_json_document instead of JSON.parse
...
Also fix typos
2023-02-13 14:00:13 -05:00
space-r7
d6419ee4fb
add check method, login, main logic
2023-02-13 11:31:06 -06:00
JBince
2a386981bd
Updated Module & Payloads + Rubocop Fixes
2023-02-13 09:03:57 -06:00
JBince
f4c5e34a1b
Added improved functionality on both Windows and Unix installs
2023-02-12 14:42:22 -06:00
JBince
fcfc39296f
Added improved functionality on both Windows and Unix installs
2023-02-12 14:39:11 -06:00
Stephen Wildow
79b1801a4f
Rewrote check method to only abuse authentication bypass. Added additional status checks.
2023-02-11 17:43:33 -05:00
JBince
d5b7ad30a1
Created module
2023-02-10 17:01:57 -06:00
sfewer-r7
a3f4dceb5b
clean up the check method; avoid using print_message in favor of the CheckCode reason. and use a CheckCode of Safe rather than Unknown if we dont find the expected version string. Thanks @bcoles for the review on this.
2023-02-10 13:03:23 +00:00
sfewer-r7
6b29b14c46
add in module documentation
2023-02-10 12:41:55 +00:00
sfewer-r7
dc8ee988f5
use Rex::Version in the check method for better version comparisons
2023-02-10 10:45:32 +00:00
sfewer-r7
a19bdde276
pass the 'bne:uueupload' param via the vars_get option
2023-02-10 10:44:21 +00:00
sfewer-r7
54c472ef18
fix typo in the description
2023-02-10 10:43:36 +00:00
Stephen Wildow
036ed7f467
Removed /etc/password. Modified check code and fail_with. Added proper checking for non-vulnerable versions of firmware.
2023-02-09 21:55:40 -05:00
Metasploit
86fc617259
automatic module_metadata_base.json update
2023-02-09 17:53:04 -06:00
Grant Willcox
0cf7dd850f
Land #17626 , Fix Frycos author name in fortra_goanywhere_rce_cve_2023_0669.rb
2023-02-09 17:38:34 -06:00
Frycos
e963582e18
Update fortra_goanywhere_rce_cve_2023_0669.rb
...
Name typo
2023-02-09 23:06:59 +01:00
Grant Willcox
f2a86327d0
Minor fixes from review
2023-02-09 15:34:25 -06:00
Metasploit
6343fc8f7c
automatic module_metadata_base.json update
2023-02-09 14:27:19 -06:00
Spencer McIntyre
fd6cd82f30
Upgrade DLL template size automatically
2023-02-09 15:09:50 -05:00
Spencer McIntyre
025ba6775d
Add a README file with some basic information
2023-02-09 15:09:50 -05:00
Spencer McIntyre
126e3a9c9a
Add larger 256KiB DLL templates
2023-02-09 15:09:50 -05:00
Spencer McIntyre
2608852d8c
Consolidate gdiplus build code
...
This references the main dll/template.c code as the mixed-mode variant
already does. This will make future changes easier as we won't need to
copy them from the main to this one.
See https://github.com/rapid7/metasploit-framework/pull/8509 for the
origin of these files.
2023-02-09 15:09:50 -05:00
Grant Willcox
aa9b3df6b3
Land #17625 , Add credit for CVE-2023-0669; fix path in docs
2023-02-09 14:02:52 -06:00
Metasploit
e420dc123d
Bump version of framework to 6.3.3
2023-02-09 12:10:37 -06:00
Spencer McIntyre
c7279e9a0a
Add credit for CVE-2023-0669; fix path in docs
2023-02-09 13:02:40 -05:00
Metasploit
73567cfbf6
automatic module_metadata_base.json update
2023-02-09 11:57:08 -06:00
Grant Willcox
43b4ee268c
Land #17592 , Fix bypassuac_injection_winsxs for x64
2023-02-09 11:41:51 -06:00
sfewer-r7
d4be663923
add the side effect flag ARTIFACTS_ON_DISK as during extraction of the UUE encoded zip file, some randomly names temp files are left in /u01/install/APPS/fs1/EBSapps/appl/bne/12.0.0/upload
2023-02-09 17:28:15 +00:00
sfewer-r7
86f11b09fb
avoid the upto loop when creating jsp_path
2023-02-09 17:18:58 +00:00
Spencer McIntyre
e6f4e96544
Close hFindFile
2023-02-09 11:43:20 -05:00
sfewer-r7
406574722a
satisfy Rubocop
2023-02-09 16:30:30 +00:00
sfewer-r7
b97a288102
add an exploit module for CVE-2022-21587 (Oracle E-Business Suite RCE)
2023-02-09 16:22:30 +00:00
adfoster-r7
139ad4a4be
Land #17623 , Move fortra_goanywhere_rce_cve_2023_0669 module documentation to documentation directory
2023-02-09 13:21:10 +00:00
bcoles
de8a6e1445
Move fortra_goanywhere_rce_cve_2023_0669 module documentation to documentation directory
2023-02-09 23:12:45 +11:00
Metasploit
2f20c9836f
automatic module_metadata_base.json update
2023-02-09 04:25:48 -06:00
cgranleese-r7
508f5c7e52
Land #17619 , Run rubocop on exploit modules
2023-02-09 10:11:53 +00:00
RageLtMan
ef53e3c52e
Python reverse command shell over SCTP
...
Implement reverse shell over SCTP in Python.
During testing against Arch Linux with Python 3.10.9, any attempt
to interact with the resulting shell produced:
```
Traceback (most recent call last):
File "/tmp/shell.py", line 12, in <module>
so.send(o)
OSError: [Errno 22] Invalid argument
```
Implement handling for OSError 22 on the send() method for the
abnormal stream socket.
Testing:
Tested against local KVM virtual machine running Arch Linux
2023-02-08 21:47:28 -05:00
RageLtMan
a215d64574
Linux x64 binary reverse SCTP stager
...
Implement binary SCTP stager for Linux x64.
Testing:
Successful test against Arch Linux x64 VM in local Libvirt
2023-02-08 21:47:28 -05:00
RageLtMan
8aef054dfd
SCTP Sessions
...
With the introduction of SCTP socket support in Rex::Socket via
https://github.com/rapid7/rex-socket/pull/56 , Framework can utilize
this protocol for session transports similarly to TCP as it is a
stream-wise transport.
Implement bind and reverse handlers for the new socket type.
Implement example bind and reverse payloads using socat copying
from the initial udp sessions implementation.
Testing:
Rudimentary bind session test against local Libvirt Linux VM
Next steps:
Implement the language-level payloads for the interpreters common
to POSIX environments supporting SCTP.
Implement meterpreter transports for SCTP in Python, PHP, Mettle,
and Java modalities (Windows doesn't support it without carrying
its own usermode protocol library).
2023-02-08 21:47:28 -05:00
Stephen Wildow
4b05ba6189
Update description and vulnerability listings. Cleaned up references. More randomization. Removed first unnecessary request in exploit portion of code. Added rescue section around json grabbing.
2023-02-08 21:26:18 -05:00
Stephen Wildow
427c181e9a
Utilized msftidy_docs.rb to clean up missing sections, excessively long lines, spaces at EOL, and space end of file. Removed credit section. Expanded on installation procedure. Modified steps procedure to include Verify options and removed failure status. Removed Targets section. Scenarios have device, target, and architecture.
2023-02-08 19:18:14 -05:00
Jack Heysel
19bcf8be7f
Working hardcoded payload
2023-02-08 18:14:11 -05:00
Metasploit
a9bd7e9f46
automatic module_metadata_base.json update
2023-02-08 13:31:52 -06:00
bwatters
01a78f972c
Land #17567 , ManageEngine Endpoint Central RCE (CVE-2022-47966)
...
Merge branch 'land-17567' into upstream-master
2023-02-08 13:06:53 -06:00
Metasploit
79a5481d9c
automatic module_metadata_base.json update
2023-02-08 12:10:30 -06:00
Spencer McIntyre
c997952d83
Land #17607 , Fortra RCE CVE-2023-0669
...
Fortra deserialization RCE CVE-2023-0669 (ETR)
2023-02-08 12:56:09 -05:00
Metasploit
810ef42bf0
automatic module_metadata_base.json update
2023-02-08 11:55:11 -06:00
Ron Bowes
0c6ebed3ac
Merge pull request #3 from smcintyre-r7/pr/collab/17607
...
Pr/collab/17607
2023-02-08 09:41:35 -08:00
cgranleese-r7
a878403a3e
Land #17618 , Run rubocop on auxiliary admin http modules
2023-02-08 17:40:26 +00:00
Metasploit
0de766498c
automatic module_metadata_base.json update
2023-02-08 10:49:50 -06:00
cgranleese-r7
c3e9e2751a
Land #17617 , Update linting on post modules
2023-02-08 16:35:20 +00:00
adfoster-r7
656ded4b86
Add module notes
2023-02-08 15:46:07 +00:00
Spencer McIntyre
2b008af097
Move the module to reflect it targets Windows too
2023-02-08 10:24:27 -05:00
adfoster-r7
25ee41df68
Run rubocop on exploit modules
2023-02-08 15:20:32 +00:00
adfoster-r7
9469c8394a
Update rubocop rules for moules
2023-02-08 15:18:25 +00:00
Spencer McIntyre
75ceb7b670
Refactor option handling.
...
Use CamelCase names for advaned options and add validation.
2023-02-08 10:17:16 -05:00
Spencer McIntyre
fef7c85518
Add Windows target compatibility
2023-02-08 09:47:37 -05:00
adfoster-r7
6e9b33dc88
Run rubocop on auxiliary admin http modules
2023-02-08 14:30:08 +00:00
Metasploit
716ba68b25
automatic module_metadata_base.json update
2023-02-08 08:24:26 -06:00
adfoster-r7
b56213b168
Update linting on post modules
2023-02-08 14:12:43 +00:00
dwelch-r7
11c886b30f
Land #17616 , Run rubocop on post modules
2023-02-08 14:09:16 +00:00
adfoster-r7
a81a71c5df
Run rubocop on post modules
2023-02-08 13:47:34 +00:00
adfoster-r7
488cfc84ef
Disable noisey or unsafe Rubocop rules
2023-02-08 13:42:49 +00:00
Metasploit
f8bb85ffe3
automatic module_metadata_base.json update
2023-02-08 07:06:26 -06:00
dwelch-r7
7909fe32c2
Land #17612 , Add exception handling for finalizer methods
2023-02-08 12:33:52 +00:00
cgranleese-r7
10144a9f13
Land #17615 , Add missing module notes for stability reliability and side effects
2023-02-08 12:28:47 +00:00
adfoster-r7
433bafdccf
Add missing module notes for stability reliability and side effects
2023-02-08 11:45:17 +00:00
adfoster-r7
d261aa6a2b
Land #17603 , Add ul_type 12 (UPN and DNS info) to pac bindata
2023-02-08 11:22:20 +00:00
adfoster-r7
4311c34a0b
Land #17614 , Weekly dependency updates for Gemfile.lock
2023-02-08 11:13:15 +00:00
Stephen Wildow
35749a000a
Added docs. Performed code linting with rubocop.
2023-02-07 20:27:07 -05:00
Grant Willcox
affe47957b
Bump up Gems
2023-02-07 17:21:16 -06:00
Metasploit
1168658f0e
automatic module_metadata_base.json update
2023-02-07 17:21:03 -06:00
dwelch-r7
782e4c0295
Add ul_type 12 (UPN and DNS info) to pac bindata
2023-02-07 23:14:00 +00:00
bwatters
8ee67085c8
Land #17556 , ManageEngine ADSelfService Plus RCE (CVE-2022-47966)
...
Merge branch 'land-17556' into upstream-master
2023-02-07 16:57:22 -06:00
Metasploit
a036c2fae0
automatic module_metadata_base.json update
2023-02-07 15:54:12 -06:00
Grant Willcox
c2e8f3fa69
Land #17494 , Add NagiosXI authenticated RCE (CVE-2021-25296, CVE-2021-25297,CVE-2021-25298) exploit module
2023-02-07 15:38:36 -06:00
adfoster-r7
f145a214ca
Add exception handling for finalizer methods
2023-02-07 20:28:15 +00:00
Matthew Dunn
52fa2e5be6
Add example for version 5.5.6 with CVE-2021-25297
2023-02-07 14:18:53 -06:00
Grant Willcox
489ab24876
Add in additional case documentation for the various targets and CVEs and fix a bug in the code
2023-02-07 14:18:45 -06:00
Matthew Dunn
8ba7a28caf
Add quotes to set-time command in docs
2023-02-07 14:18:45 -06:00
Grant Willcox
7c30889784
Refactor code to handle unsigned licenses in one central function
2023-02-07 14:18:39 -06:00
Grant Willcox
b14bcd40a2
Fix incorrect match logic grabbing the wrong entry from results for NSP
2023-02-07 14:18:38 -06:00
Grant Willcox
425da60b15
Add in missing case 5 check
2023-02-07 14:18:38 -06:00
Matthew Dunn
90e07ef5ed
Switch to match over scan and add troubleshooting steps
2023-02-07 14:18:37 -06:00
Matthew Dunn
8cddf56238
Verify auth_cookies before use
2023-02-07 14:18:37 -06:00
Matthew Dunn
a276659681
Use more encompassing single regex
2023-02-07 14:18:36 -06:00
Matthew Dunn
7554b5e4fd
Add failure condition for nsp's that fail to match the regex
2023-02-07 14:18:36 -06:00
Matthew Dunn
1cb06b11ac
Adjust exploit and docs to support versions 5.5.6-5.7.5
2023-02-07 14:18:09 -06:00
Matthew Dunn
87176f9d7f
Address Review Comments and add CVE-2021-25297 coverage
2023-02-07 14:18:06 -06:00
Matthew Dunn
c5914d8c99
Insert randomized strings to fix exploit with plugin_output_len
2023-02-07 14:18:05 -06:00
Matthew Dunn
990db5372f
Remove extra payload details, add config check
2023-02-07 14:18:05 -06:00
Matthew Dunn
b042e71b2a
Make Module work for both target url parameters
2023-02-07 14:18:04 -06:00
Matthew Dunn
b606d1ff6b
Add Documentation for Module
...
Fix CVE format
Add Documentation
2023-02-07 14:18:04 -06:00
Matthew Dunn
5846d95b25
Create nagios_xi_configwizards_authenticated_rce.rb
...
Add initial module
2023-02-07 14:18:03 -06:00
Ron Bowes
676bb2af02
Fix a couple requests from the PR
2023-02-07 09:05:44 -08:00
Ron Bowes
588bddc950
Fix a couple requests from the PR
2023-02-07 09:05:16 -08:00
Metasploit
4143e6ea92
automatic module_metadata_base.json update
2023-02-06 17:52:49 -06:00
bwatters
53c67653f5
Land #17527 , ManageEngine ServiceDesk Plus RCE (CVE-2022-47966)
...
Merge branch 'land-17527' into upstream-master
2023-02-06 17:37:31 -06:00
Ron Bowes
f7fb611bcc
Add documentation
2023-02-06 14:35:42 -08:00
bwatters
8b116a7dcd
Minor punctuation change
2023-02-06 16:32:39 -06:00
Ron Bowes
89485703dc
Make rubocop happy
2023-02-06 14:23:55 -08:00
Ron Bowes
9b90343480
Check in the module
2023-02-06 14:21:42 -08:00
Metasploit
b9bcf45a7d
automatic module_metadata_base.json update
2023-02-06 08:21:33 -06:00
adfoster-r7
4a2dc0d6b0
Land #17598 , modules/exploits/unix/local Add Notes and resolve RuboCop violations
2023-02-06 13:59:19 +00:00
adfoster-r7
215cfa27b0
Land #17483 , add tomcat 8 priv esc on ubuntu (cve-2016-1240)
2023-02-06 13:53:25 +00:00
Spencer McIntyre
6e6d8473b6
Land #17595 , Documentation update
...
Documentation update to reflect Address instead of Host in ReverseListener setup
2023-02-06 08:45:39 -05:00
h00die-gr3y
d763faf245
sync documentation
2023-02-06 06:56:59 +00:00
Stephen Wildow
475813eb33
Properly labing ZDI vulnerability
2023-02-05 21:48:48 -05:00
Stephen Wildow
59332da8ce
Randomized hard coded strings, modified cmd string, and updated references
2023-02-05 21:42:57 -05:00
Stephen Wildow
ac9caa8894
Removed unnecessary CVE listing
2023-02-05 14:32:04 -05:00
Stephen Wildow
7cff3cc2b0
Updated to include vulnerable versions of software
2023-02-05 13:20:52 -05:00
Stephen Wildow
4b3125d14b
Add module to exploit Cisco RV34x Small Business Routers
2023-02-05 10:15:16 -05:00
Metasploit
42e1bed3f5
automatic module_metadata_base.json update
2023-02-05 08:23:02 -06:00
adfoster-r7
af29786f1b
Land #17597 , qubes_mirage_firewall_dos: Fix notes for SideEffects and Reliability
2023-02-05 14:08:57 +00:00
h00die
a5a7d5dd10
correct cleanup and stabilization
2023-02-05 08:15:38 -05:00
bcoles
adf5091c7a
modules/exploits/unix/local: Add Notes and resolve RuboCop violations
2023-02-05 15:45:30 +11:00
RageLtMan
153f950f11
Add AwsSsmCommandShellBind session type
...
Create an AwsSsmCommandShellBind session type to provide intercept
points for shell command interactions and a wrapper class which is
used to register the new session.
Update Msf::Handler::BindAwsSsm with its own #create_session method
utilizing the new session type to provide direct control of session
initialization.
Restore standard handler attributes and thread nomenclature in an
attempt to resolve the repeating session creation when #to_handler
is called on the payloads.
Testing:
Tested in local framework, unfortunately the recurring session
init problem appears to persist. Requesting testing on an upstream
Framework by saner folks.
2023-02-04 20:57:26 -05:00
bcoles
19b526d584
qubes_mirage_firewall_dos: Fix notes for SideEffects and Reliability
2023-02-05 12:04:59 +11:00
RageLtMan
7e19141dfc
Standardize DS names and set OS platforms
...
Update SSM handler code to standardize datastore option names per
@zeroSteiner.
Update payload modules to reflect the OS targets against which they
are to execute.
2023-02-04 19:41:40 -05:00
h00die
561b42f105
use exploit retry function
2023-02-04 18:17:42 -05:00
h00die
6aa6f5176b
touch up verbiage and stuff
2023-02-04 18:17:42 -05:00
h00die
aff14e8e46
tocat to tomcat
2023-02-04 18:17:42 -05:00
h00die
e30cae2e40
uncomment needed code
2023-02-04 18:17:42 -05:00
h00die
34b1e66f90
tomcat 8 priv esc on ubuntu prebuilt so file
2023-02-04 18:17:41 -05:00
h00die
2b09af78e1
tomcat 8 priv esc on ubuntu
2023-02-04 18:17:41 -05:00
Matt Konda
c3393f30c3
Update to reflect Address instead of Host in
...
Update the name of the ReverseListenerBindAddress (instead of ReverseListenserBindHost) because that seems to be works.
```
msf6 exploit(multi/http/tomcat_jsp_upload_bypass) > set ReverseListenerBindHost 172.17.0.2
[-] Unknown datastore option: ReverseListenerBindHost. Did you mean ReverseListenerBindPort?
msf6 exploit(multi/http/tomcat_jsp_upload_bypass) > set ReverseListenerBindAddress 172.17.0.2
ReverseListenerBindAddress => 172.17.0.2
```
2023-02-03 23:27:32 -06:00
Grant Willcox
ad82437067
Land #17591 , Fix metasm_shell by requiring readline
2023-02-03 15:14:32 -06:00
Spencer McIntyre
687e82a9ed
Satisfy rubocop
2023-02-03 15:29:19 -05:00
Spencer McIntyre
dc179f6279
Fix stack trace on exit via Ctrl+D (EOF)
2023-02-03 14:38:07 -05:00
Spencer McIntyre
51fd9ee703
Require readline
2023-02-03 14:38:02 -05:00
Spencer McIntyre
f2e5e77e27
Fix bypassuac_injection_winsxs for x64
...
Tested on Windows 8.1, prior to these chagnes the bad railgun definition
would cause the session to crash.
2023-02-03 13:02:53 -05:00
adfoster-r7
fd43c43a30
Land #17452 , Deprecate import-dev-keys script
2023-02-03 17:49:57 +00:00
Grant Willcox
d576e77b70
Deprecate import-dev-keys.sh
2023-02-03 10:12:12 -06:00
cgranleese-r7
6d62362b82
Land #17587 , Update wiki to use latest ruby conventions
2023-02-03 14:30:16 +00:00
Metasploit
3b80e223b1
automatic module_metadata_base.json update
2023-02-03 07:57:50 -06:00
cgranleese-r7
80dbbca020
Land #17371 , Lenovo Diagnostics Driver Privilege Escalation (CVE-2022-3699)
2023-02-03 13:43:04 +00:00
adfoster-r7
c777b33fcb
Update wiki to use latest ruby conventions
2023-02-03 13:35:03 +00:00
adfoster-r7
c3c3987867
Land #17398 , Update cmdstager docs
2023-02-03 13:08:01 +00:00
cgranleese-r7
b789e00ea7
Enhances info -d with references to AttackerKB
2023-02-03 10:15:55 +00:00
Metasploit
87323134a5
automatic module_metadata_base.json update
2023-02-02 14:28:38 -06:00
Jack Heysel
6ab7e177f4
Land #17392 , add F5 Big-IP priv esc module
...
Add a privilege escalation module for F5 that uses
the unsecured MCP socket to create a new root account
2023-02-02 15:10:33 -05:00
Metasploit
feee510999
automatic module_metadata_base.json update
2023-02-02 13:03:49 -06:00
Jack Heysel
99e31c561a
Land #17585 , mac dirty cow add session types
...
Sets missing session types during module initialization
2023-02-02 13:36:43 -05:00
Jack Heysel
f4ad778bd0
Added missing session types
2023-02-02 13:29:43 -05:00
Metasploit
5d6e989e64
Bump version of framework to 6.3.2
2023-02-02 12:11:52 -06:00
Metasploit
83f9964e99
automatic module_metadata_base.json update
2023-02-02 12:03:09 -06:00
adfoster-r7
cfb5a55880
Land #16946 , Add row indicator to show targets command
2023-02-02 17:26:53 +00:00
Jack Heysel
af2ef53462
Land #17415 , macOS dirty cow priv esc
2023-02-02 12:15:19 -05:00
adfoster-r7
b408837b7f
Land #17575 , Load TGS tickets with a different sname
2023-02-02 17:02:48 +00:00
cgranleese-r7
d1e68e634a
Add row indicator to show targets command
2023-02-02 16:12:19 +00:00
Jack Heysel
1f224fd2d3
Rapid7 compiled binary
2023-02-02 11:11:06 -05:00
Jack Heysel
88caeddc8c
Fixed license
2023-02-02 11:10:06 -05:00
Jack Heysel
4de5e44bda
Documentation
2023-02-02 10:38:26 -05:00
Spencer McIntyre
3eaed76025
Land #17561 , Fix functions in def_iphlpapi.rb
...
Fix input and output buffers for some mislabeled functions in def_iphlpapi.rb
2023-02-02 09:10:28 -05:00
Metasploit
2b2406f9af
automatic module_metadata_base.json update
2023-02-02 05:05:42 -06:00
adfoster-r7
952a4fe37a
Land #17581 , modules: Check datastore ForceExploit before checking if session is root
2023-02-02 10:19:07 +00:00
adfoster-r7
56866ad09a
Land #17580 , update links to new docs website
2023-02-02 10:15:10 +00:00
bcoles
6f4a17230d
exploits/osx/local/vmware_fusion_lpe: Add notes
2023-02-02 18:46:08 +11:00
bcoles
a83d070396
exploits/freebsd/local/ip6_setpktopt_uaf_priv_esc: Add Reliability notes
2023-02-02 18:45:43 +11:00
bcoles
ef87a63bde
modules: Check datastore ForceExploit before checking if session is root
2023-02-02 18:17:02 +11:00
Grant Willcox
48a27ab555
Fix the remaining references to the old wiki site.
2023-02-01 21:25:06 -06:00
Metasploit
e752e1dbca
automatic module_metadata_base.json update
2023-02-01 18:12:49 -06:00
adfoster-r7
6870efc34a
Land #17426 , Update all references to old Wiki to point to new docs site
2023-02-01 23:49:20 +00:00
Spencer McIntyre
61c2726620
Fix NoMethodError for #opcode
2023-02-01 18:19:46 -05:00
Metasploit
f128640bf1
automatic module_metadata_base.json update
2023-02-01 16:59:01 -06:00
Jack Heysel
c90a6f9068
Land #17406 , veeam_credential_dump post module
...
Veeam Backup & Recovery and Veeam ONE Monitor credential
capture post module for versions 9.x and 11.x.
2023-02-01 17:29:05 -05:00
Metasploit
4418bcc673
automatic module_metadata_base.json update
2023-02-01 16:18:56 -06:00
Jack Heysel
f4c5632b6d
Cleaned up license file
2023-02-01 17:04:26 -05:00
Jack Heysel
076ffbcc65
Merge branch 'mac_dirty_cow' of github.com:timwr/metasploit-framework into mac_dirty_cow
2023-02-01 16:57:36 -05:00
Jack Heysel
3c7cbf62e6
Updated default payload
2023-02-01 16:56:28 -05:00
jheysel-r7
6037936869
Update LICENSE
2023-02-01 16:54:04 -05:00
jheysel-r7
595f34fc6f
Merge branch 'master' into mac_dirty_cow
2023-02-01 16:51:09 -05:00
Grant Willcox
e9fef56186
Land #17481 , Update HTTP options module
2023-02-01 15:49:27 -06:00
Jack Heysel
057f046186
Updated license file
2023-02-01 16:46:45 -05:00
h00die
4ba04df138
update http options
2023-02-01 15:12:39 -06:00
Ron Bowes
cf172d22c8
Get rid of #String.hash in favour of UnixCrypt
2023-02-01 11:02:04 -08:00
Grant Willcox
b5a83ffd0f
Add in PULONG alias to PDWORD and update definitions
2023-02-01 12:36:22 -06:00
Ron Bowes
1094221468
Merge branch 'rapid7:master' into f5-createuser-privesc
2023-02-01 10:20:43 -08:00
Jeffrey Martin
8d31b63f7a
update Pro version docs for 4.22.0 release
2023-02-01 12:19:59 -06:00
Ron Bowes
34d93e862c
Update modules/exploits/linux/local/f5_create_user.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-02-01 10:16:03 -08:00
Ron Bowes
e90b47fd17
Update modules/exploits/linux/local/f5_create_user.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-02-01 10:15:00 -08:00
Ron Bowes
d89c193db2
Update modules/exploits/linux/local/f5_create_user.rb
...
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com >
2023-02-01 10:14:38 -08:00
Ron Bowes
638a1c519d
Update documentation/modules/exploit/linux/local/f5_create_user.md
...
Better demo exploit
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com >
2023-02-01 10:14:25 -08:00
Metasploit
b922bb533b
automatic module_metadata_base.json update
2023-02-01 11:15:51 -06:00
adfoster-r7
014bdddd1a
Land #17564 , Fixed AnyConnect IPC message format
2023-02-01 16:34:44 +00:00
adfoster-r7
a5990a5a7d
Land #17578 , modules/exploits/openbsd Add notes and use CheckCodes messages
2023-02-01 16:26:59 +00:00
Metasploit
5af2689a0e
automatic module_metadata_base.json update
2023-02-01 10:16:55 -06:00
Jack Heysel
a6f0a8abe3
Land #17301 , module for cve-2022-1043, linux LPE
...
This module exploits a bug in io_uring leading to an additional put_cred
that can be exploited to hijack credentials of other processes.
2023-02-01 10:38:10 -05:00
Jack Heysel
690d22f759
Rapid7 compiled binary
2023-02-01 10:08:13 -05:00
Spencer McIntyre
994d41ac80
Update parts of the docs
2023-02-01 09:28:00 -05:00
adfoster-r7
5a1eb16018
Land #17574 , Use the new NDR types in RubySMB v3.2.4
2023-02-01 12:02:47 +00:00
Metasploit
4a04a86675
automatic module_metadata_base.json update
2023-02-01 05:46:09 -06:00
bcoles
86a6611e98
modules/exploits/openbsd: Add notes and use CheckCodes messages
2023-02-01 22:26:44 +11:00
adfoster-r7
1ff1cd1779
Land #17577 , modules/exploits/qnx Use AutoCheck, add Notes, resolve Rubocop violations
2023-02-01 11:20:49 +00:00
bcoles
c9012ae222
modules/exploits/qnx: Use AutoCheck, add Notes, resolve Rubocop violations
2023-02-01 20:51:44 +11:00
h00die
2c72cc145a
updates to module
2023-01-31 20:05:33 -05:00
Spencer McIntyre
84f798da32
Allow loading TGS tickets for other service names
...
Fixes #17571
2023-01-31 17:03:25 -05:00
h00die
fa687d3614
argv instead of hardcoded payload path
2023-01-31 16:02:25 -05:00
h00die
5a374533af
cve-2022-1043
2023-01-31 16:02:25 -05:00
h00die
8d58eb6279
cve-2022-1043
2023-01-31 16:02:25 -05:00
Metasploit
42542102e3
automatic module_metadata_base.json update
2023-01-31 13:59:14 -06:00
Jack Heysel
2306736383
Land #17300 , the latest commit in PR 17300
...
I made a mistake and was not up to date with the latest commit
in the PR before I landed, this fixes that mistake.
2023-01-31 14:18:01 -05:00
Jack Heysel
022760d24a
Land #17300 , linux LPE cve-2022-22942 module
...
This PR adds a linux priv esc against VMWare virtual machines
with kernel 4.14-rc1 - 5.17-rc1 due to a VMWare driver bug.
2023-01-31 14:07:55 -05:00
Jack Heysel
e99407fe26
Updated pre_compiled binary
2023-01-31 13:37:45 -05:00
Jeffrey Martin
9c7665a017
add GSoC 2023 to navigation
2023-01-31 11:00:26 -06:00
Grant Willcox
b866bf59c8
Land #17444 , Fix parsing of module options with special characters
2023-01-31 10:42:16 -06:00
Grant Willcox
8805ed2b5a
Last minute typo fixes
2023-01-31 10:41:47 -06:00
Jeffrey Martin
77dd6bd77e
add initial 2023 GSoC ideas doc
2023-01-31 10:18:12 -06:00
Spencer McIntyre
0d9a282237
Use the new NDR types in RubySMB v3.2.4
2023-01-31 10:08:27 -05:00
Metasploit
daa96f9fb7
automatic module_metadata_base.json update
2023-01-31 08:53:19 -06:00
adfoster-r7
56728fc7c2
Land #17573 , modules/exploits/linux/ssh Resolve Rubocop violations
2023-01-31 14:12:03 +00:00
adfoster-r7
bbf17c167c
Land #17511 , add exploit for CVE-2022-44877 command injection in CentOS Control Web Panel
2023-01-31 14:05:19 +00:00
adfoster-r7
5076518fe4
Land #17559 , add support for Ruby 3.2
2023-01-31 13:45:51 +00:00
cgranleese-r7
fb196cb378
Testing Ruby 3.2 against CI
2023-01-31 13:19:06 +00:00
bcoles
11cf391da8
modules/exploits/linux/ssh: Resolve Rubocop violations
2023-01-31 23:59:22 +11:00
adfoster-r7
7bb0eca931
Land #17545 , use strings in YAML files
2023-01-30 22:52:19 +00:00
Metasploit
42004c07bc
automatic module_metadata_base.json update
2023-01-30 16:43:35 -06:00
adfoster-r7
433099e539
Land #17563 , modules/exploits/multi/local: Resolve Rubocop and msftidy_docs violations
2023-01-30 22:16:41 +00:00
Grant Willcox
bfc5c563a1
Land #17570 , Add new queries and attributes for ldap_query
2023-01-30 16:14:26 -06:00
Spencer McIntyre
902eaa2562
Add new queries and attributes for ldap_query
2023-01-30 16:24:23 -05:00
dwelch-r7
e3a9e5a163
Land #17565 , Add Metasploit prompt color highlighting to docs
2023-01-30 13:05:08 +00:00
adfoster-r7
f3a372719c
Land #17568 , Plugins: Resolve Rubocop violations
2023-01-30 11:35:31 +00:00
Christophe De La Fuente
f676568d89
Fix CVE
2023-01-30 12:18:08 +01:00
Christophe De La Fuente
a5ba1245c2
Fix CVE
2023-01-30 12:15:14 +01:00
bcoles
db90604333
plugins/bescure: Replace 'initheaders' Hash key with Hash in Net::HTTP::Post.new calls
2023-01-30 22:11:21 +11:00
bcoles
4ff475f180
plugins: Resolve rubocop violations
2023-01-30 13:07:16 +11:00
bcoles
7cf37f5fb7
plugins: rubocop -A plugins
2023-01-30 13:05:34 +11:00
bcoles
dd20bcac77
plugins: rubocop -a plugins
2023-01-30 12:25:46 +11:00
h00die-gr3y
a2f4a27614
updated module and added documentation
2023-01-29 10:06:14 +00:00
h00die-gr3y
bf10b29a84
first drop module
2023-01-29 07:47:22 +00:00
adfoster-r7
c68ab9b77f
Add Metasploit prompt color highlighting to docs
2023-01-28 22:43:33 +00:00
h00die
62d43a6e96
use exploit retry function
2023-01-28 07:44:53 -05:00
Duarte Silva
a7ae3c9389
Fixed AnyConnect IPC message format:
...
- Made an error in the original research where the TLV had a type
and a index, when it only has a type and a modifier that makes
it into a TV (Type and Value, no Length).
- A TV has its value where the Length would be on a TLV.
- Also added a note on the endieness being correct/working because
endieness has no impact in the message being used to exploit the
vulnerability.
2023-01-28 09:08:51 +00:00
bcoles
e11aaa8027
modules/exploits/multi/local: Resolve Rubocop and msftidy_docs violations
2023-01-28 15:02:24 +11:00
Metasploit
1b20db8900
automatic module_metadata_base.json update
2023-01-27 14:39:53 -06:00
Grant Willcox
be85aa253d
Fix input and output buffers for some mislabeled functions
2023-01-27 14:09:45 -06:00
Jack Heysel
c3e73b9b11
Land #17557 , Fix the logon_time in the MS14-068
2023-01-27 15:08:49 -05:00
Christophe De La Fuente
85d5b041aa
Add minimum build number check
2023-01-27 18:03:19 +01:00
Grant Willcox
1782ae1ff2
Fix up links within Wiki site to make them relative links where possible
2023-01-27 10:09:02 -06:00
Grant Willcox
6043d0ffba
Update all links from Wiki site to new docs site.
2023-01-27 09:58:53 -06:00
Grant Willcox
6111852df8
Land #17504 , add 'favorite -l' and 'favorites' as aliases for show favorites
2023-01-27 09:37:06 -06:00
adfoster-r7
c681358f88
Land #17558 , Fixes analyze command crashing with a winrm session opened
2023-01-27 15:35:40 +00:00
Spencer McIntyre
647cf1d402
Return Time from #extract_logon_time
2023-01-27 10:05:02 -05:00
Metasploit
8d4d48e005
automatic module_metadata_base.json update
2023-01-27 08:14:45 -06:00
dwelch-r7
4c54fffaed
Land #17560 , Present unsupported ul_types in a clearer way to the user
2023-01-27 13:50:55 +00:00
adfoster-r7
020e221c42
Present unsupported ul_types in a clearer way to the user
2023-01-27 13:40:33 +00:00
cgranleese-r7
1d8c9d3690
Fixes analyze command crashing with a winrm session opened
2023-01-27 10:45:05 +00:00
Spencer McIntyre
f4976a0f9f
Fix the logon_time in the MS14-068 exploit
2023-01-26 16:16:55 -05:00
Christophe De La Fuente
e01239cf7b
Add exploit module and documentation
2023-01-26 21:53:14 +01:00
Metasploit
d80a18a00c
Bump version of framework to 6.3.1
2023-01-26 13:40:05 -06:00
Jeffrey Martin
dc6c1e333b
Land #17553 , Framework 6.3.0
2023-01-26 13:30:27 -06:00
Jeffrey Martin
bdb0cadc4f
Land #17291 , Add support for rails 7
2023-01-26 11:50:29 -06:00
adfoster-r7
672fb9ce9f
Land #17460 , add support for feature kerberos authentication
2023-01-26 17:47:27 +00:00
Christophe De La Fuente
ed2dd2fc0c
Add randomization in the XML when possible & fix BadChars issue
2023-01-26 18:42:09 +01:00
adfoster-r7
ab60df7cda
Land #17519 , improve SMTP delivery error handling
2023-01-26 17:02:02 +00:00
dwelch-r7
4254276c26
Land #17531 , Change kerberos option name namespacing convention to ::
2023-01-26 16:29:11 +00:00
Spencer McIntyre
1b34e5923f
Land #17551 , Fix issue on nil kerberos username
...
Fix force encoding issue on nil kerberos username
2023-01-26 11:23:05 -05:00
adfoster-r7
2d30909a2f
Change option name namespacing convention
2023-01-26 16:17:50 +00:00
adfoster-r7
d90398d217
Land #17549 , Catch Encryption Errors In inspect_ticket
2023-01-26 16:15:21 +00:00
cgranleese-r7
fb79a5f9d2
Land #17547 , Remove KRB5CCNAME env var on bootup
2023-01-26 16:11:03 +00:00
Grant Willcox
87b9152314
Continue fixing versions of Ruby in YAML files not being properly quoted like they should be.
2023-01-26 09:49:08 -06:00
Spencer McIntyre
fc0324f28b
Consistently print keys without \x
2023-01-26 10:49:05 -05:00
adfoster-r7
a2aef99bb2
Fix force encoding issue on nil kerberos username
2023-01-26 15:25:49 +00:00
adfoster-r7
9e218116c0
Land #17543 , update docs build to support relative links that start with ./
2023-01-26 15:23:45 +00:00
Jeffrey Martin
b295429fc9
latest metasploit-credential gem
2023-01-26 09:22:56 -06:00
Christophe De La Fuente
2be22752be
Add Linuc specifics and documentation
2023-01-26 16:16:00 +01:00
Jeffrey Martin
7d221af4a0
Land #17546 , deprecation warning for secrets dump
2023-01-26 08:28:22 -06:00
Spencer McIntyre
2da5d8ea43
Catch exceptions in inspect_ticket
2023-01-26 09:21:55 -05:00
adfoster-r7
992883b1a6
Remove KRB5CCNAME env on bootup
2023-01-26 12:09:55 +00:00
adfoster-r7
d5781ed021
Land #17532 , Fix bad DN discovery code and fix bug with querying schema data
2023-01-26 10:43:13 +00:00
adfoster-r7
25ba3304ab
Fix rails 7 deprecation warning for secrets dump module
2023-01-26 10:22:28 +00:00
dwelch-r7
2a73ac01e0
Land #17544 , Fix ticket cache client metadata
2023-01-25 21:58:36 +00:00
Grant Willcox
71aa4bdace
Update ldap_query with find_schema_dn function to find the schema DN which may not be the same as the base DN so we can query security attributes of entries
2023-01-25 15:19:29 -06:00
adfoster-r7
086e2f1b05
FIx ticket cache client metadata
2023-01-25 20:17:51 +00:00
Grant Willcox
3acae04042
Fix up relative path linking with paths that start with a / or ./ so they can now properly link without ambiguity cases.
2023-01-25 13:05:52 -06:00
Spencer McIntyre
f81195d0cc
Fix a typo
2023-01-25 13:45:18 -05:00
adfoster-r7
b9430da155
Land #17541 , Fixes a crash when running smb_login with a blank domain
2023-01-25 18:42:32 +00:00
adfoster-r7
3d003ff14c
Land #17540 , Handle KDC_ERR_CERTIFICATE_MISMATCH for certifried
2023-01-25 18:39:20 +00:00
adfoster-r7
ea96629925
Bump Metasploit version to 6.3.0
2023-01-25 18:36:48 +00:00
Spencer McIntyre
427e354328
Land #17538 , Fix smb login crash
...
Fix smb login crash with kerberos options set
2023-01-25 13:35:14 -05:00
dwelch-r7
e434b65d9d
Land #17535 , Add NTLM Hash Extraction via PKINIT to get_ticket
2023-01-25 18:34:18 +00:00
cgranleese-r7
cc0fbbc4e3
Fixes a bug were if realm was blank console would crash
2023-01-25 18:26:47 +00:00
Dean Welch
5b473e4ede
Handle KDC_ERR_CERTIFICATE_MISMATCH for certifried
2023-01-25 18:22:54 +00:00
dwelch-r7
dc76f66649
Land #17539 , Add additional kerberos error codes
2023-01-25 18:19:12 +00:00
adfoster-r7
eb59d08516
Add additional kerberos error codes
2023-01-25 18:08:07 +00:00
Spencer McIntyre
21f33296b7
Consolidate PKINIT hash extraction code
2023-01-25 12:16:42 -05:00
Spencer McIntyre
dba1198a09
Fix a definition in krb5_pac.rb
2023-01-25 11:18:54 -05:00
dwelch-r7
4f574d141a
Land #17533 , Combine pkinit_login with get_ticket
2023-01-25 15:43:12 +00:00
Spencer McIntyre
c7ba117fed
Land #17534 , Update kerberos cipher negotiattion
...
Update kerberos to negotiate rc4 if aes256 is disabled
2023-01-25 10:19:40 -05:00
Spencer McIntyre
44d8304beb
Report the PKCS12 error message
2023-01-25 10:02:37 -05:00
adfoster-r7
d57c56e4a4
Land #17496 , update klist to support deleting and deactivating by id
2023-01-25 14:53:05 +00:00
adfoster-r7
24a8582a7b
Fix smb login crash with kerberos options set
2023-01-25 13:58:29 +00:00
Spencer McIntyre
dbe9ee3a77
Update documentation
2023-01-25 08:39:52 -05:00
Spencer McIntyre
a5e2c5b3b7
Unify pkinit_login with get_ticket
2023-01-25 08:36:26 -05:00
Spencer McIntyre
785e2caa9f
Refactor #send_request_tgt_pkinit, clarify docs
2023-01-25 08:36:26 -05:00
Dean Welch
c143124344
Add feature to set the status of ticket/ccache via klist
2023-01-25 13:28:43 +00:00
adfoster-r7
8d4b1ce3c1
Use the credential etype instead of the encrypted ticket etype
2023-01-25 13:20:50 +00:00
dwelch-r7
effbfe8f58
Land #17536 , Update docs to support links with anchors
2023-01-25 12:43:37 +00:00
adfoster-r7
64339f9d4c
Land #17537 , improve rendered output of docs
2023-01-25 12:37:45 +00:00
adfoster-r7
4c50456b6a
Update docs to support links with anchors
2023-01-25 12:16:15 +00:00
cgranleese-r7
930ae1a8c2
Makes adjustments to how docs are formatted to improve rendered output
2023-01-25 12:07:52 +00:00
adfoster-r7
d18beb486d
Update kerberos to negotiate rc4 if aes256 is disabled
2023-01-25 00:27:00 +00:00
Spencer McIntyre
2b2e20bd78
Land #17399 , Document ESC attack workflow in Wiki
2023-01-24 19:18:50 -05:00
Spencer McIntyre
944645f6d4
Land #17528 , Add get user spns example docs
...
Add get user spns example to kerberoasting docs
2023-01-24 19:15:44 -05:00
Grant Willcox
de27166dc9
Move location of the Attacking AD CS writeup and update navigation.rb accordingly
2023-01-24 16:57:14 -06:00
Grant Willcox
86f2af53c9
Remove extra section and try fix up the relative references for the document
2023-01-24 16:39:09 -06:00
Spencer McIntyre
8c1370085d
Land #17530 , Add conditions to forge_ticket module
...
Add conditions metadata to forge_ticket module
2023-01-24 09:12:41 -05:00
adfoster-r7
9babcf3564
Add conditions to forge ticket
2023-01-24 13:28:10 +00:00
adfoster-r7
e81bed0378
Land #17526 , groups the show options command by their conditions
2023-01-24 13:21:17 +00:00
cgranleese-r7
854fc1400e
Improve show options to include options with conditions
2023-01-24 10:43:14 +00:00
adfoster-r7
772ee93612
Add get user spns example to kerberoasting docs
2023-01-24 01:03:13 +00:00
Christophe De La Fuente
38f0d33d6b
Add exploit module
2023-01-24 00:55:45 +01:00
Grant Willcox
4c4e6a5802
Fix up navigation issue again
2023-01-23 17:05:36 -06:00
Grant Willcox
05cc578fcd
Correct navigation.rb
2023-01-23 14:34:41 -06:00
Grant Willcox
148e591a4e
Add in overview about AD CS and what it is used for
2023-01-23 14:33:10 -06:00
Grant Willcox
3b357eed70
Move updated setup guide over to appropriate place and update some of the template with more details
2023-01-23 14:27:28 -06:00
Grant Willcox
5b2a7cc151
Update explanation to clarify ESC3 attacks and how to abuse them
2023-01-23 14:00:00 -06:00
Grant Willcox
e73836d4c3
Rename files to appropriate names, fix up typos and add better setup points
2023-01-23 13:59:55 -06:00
Grant Willcox
43aca85d4d
Add page on setting up an AD CS target to the navigation.rb file
2023-01-23 13:59:55 -06:00
Grant Willcox
71860a0ea8
Add in seperate page for setting up AD CS environment and also make explanation of ESC vulns clearer and higher up in document.
2023-01-23 13:59:54 -06:00
Grant Willcox
5df6d5d511
Fix navigation and some typos
2023-01-23 13:59:54 -06:00
Grant Willcox
1e8a289088
Add in initial commit of attacking ADCS ESC vulnerability documentation
2023-01-23 13:59:54 -06:00
Metasploit
8368accd55
automatic module_metadata_base.json update
2023-01-23 13:50:39 -06:00
space-r7
153af9fb68
Land #17407 , add Cacti unauth command injection
2023-01-23 13:06:46 -06:00
Grant Willcox
5106d33ca4
Land #17518 , Add the Python command adapter for Windows
2023-01-23 13:01:38 -06:00
bwatters
d356b34422
Land #17499 , Show extended error information for ICPR
...
Merge branch 'land-17499' into upstream-kerberos
2023-01-23 12:19:13 -06:00
space-r7
58cd5bb003
specify command stager flavors
2023-01-23 11:53:19 -06:00
Jeffrey Martin
90dc90cbab
future proof legacy connection
2023-01-23 10:03:32 -06:00
Jeffrey Martin
58172267ac
update to latest Rails 7 gem
2023-01-23 09:59:21 -06:00
Jeffrey Martin
6b64a15ab1
updated metasploit_data_models
2023-01-23 09:59:19 -06:00
Jeffrey Martin
1323889b65
update to released Rails 7 supported deps
2023-01-23 09:58:22 -06:00
Jeffrey Martin
5ce04e97e8
update Gemfile dev deps
2023-01-23 09:57:51 -06:00
Jeffrey Martin
149870d8a5
update Ruby version requirement
2023-01-23 09:57:16 -06:00
Jeffrey Martin
f78592bf3f
update db/schema.rb for Rails 7
2023-01-23 09:57:16 -06:00
Jeffrey Martin
177f1ec4d8
update that may need guards depending on execution
2023-01-23 09:57:15 -06:00
Jeffrey Martin
d9716ebecf
core updates for Rails 7
2023-01-23 09:57:09 -06:00
cgranleese-r7
bca40df16b
Land #17524 , Add additional documentation for mssql and ldap
2023-01-23 15:30:07 +00:00
Spencer McIntyre
ed69cb19b2
Land #17520 , Remove verbose info in LDAP output
...
Remove extra info from verbose mode of LDAP output
2023-01-23 09:30:36 -05:00
cgranleese-r7
af740aea85
Land #17515 , Use shared helper for creating kerberos options
2023-01-23 13:37:00 +00:00
dwelch-r7
2f6e45af16
Land #17525 , Fix deprecation warning in socks proxy
2023-01-23 12:55:04 +00:00
adfoster-r7
20408f4446
Fix deprecation warning in socks proxy
2023-01-23 12:05:57 +00:00
adfoster-r7
e119713c6f
Add additional documentation for mssql and ldap
2023-01-23 11:46:51 +00:00
adfoster-r7
9a6c298a43
Use shared helper for creating kerberos options
2023-01-23 11:04:01 +00:00
RageLtMan
27d6a89b99
Use keepalive in SSM aux module
2023-01-21 09:26:06 -05:00
RageLtMan
453baca109
Drop mask_write, tweak logging
2023-01-21 08:29:28 -05:00
RageLtMan
589c2257e3
Implement reporting and pretty output
2023-01-20 23:17:34 -05:00
RageLtMan
3e54ae6e69
Resolve crashes noted by @smcintyre-r7, simplify
...
Bail out of console resize operation if ::IO.console doesn't exist
Enforce REGION datastore option and remove the multi-region enum
code by Aaron - users can write resource scripts if they need
automation.
2023-01-20 22:33:51 -05:00
adfoster-r7
414a54886c
Land #17521 , Fix up text so we capitalize all words of Metasploit Framework
2023-01-21 00:23:50 +00:00
Grant Willcox
dcda0c2ebc
Fix up text so we capitalize all words of Metasploit Framework
2023-01-20 17:05:20 -06:00
Grant Willcox
1975c92e92
Remove extra info from verbose mode of LDAP output
2023-01-20 16:51:34 -06:00
Spencer McIntyre
9d07f206fc
Bump windows_error to 0.1.5
2023-01-20 16:29:24 -05:00
Spencer McIntyre
190249b993
Bump ruby_smb to 3.2.2
2023-01-20 16:29:24 -05:00
Spencer McIntyre
a37cec40fc
Show extended error information for ICPR
2023-01-20 16:29:18 -05:00
Grant Willcox
cd5842e3f4
Land #17340 , Warn On Ignoring Bind Information for Reverse Port Forwarding
2023-01-20 14:40:22 -06:00
Spencer McIntyre
81295e40fa
Report the host that's returned from Meterpreter
...
Report the host that's returned from Meterpreter because that's the most
accurate source of the information.
2023-01-20 14:15:14 -06:00
Spencer McIntyre
729de2478c
Warn that the remote host is ignored
2023-01-20 14:15:13 -06:00
Spencer McIntyre
17d8db43a9
Print IPv6 addresses correctly
2023-01-20 14:15:13 -06:00
Spencer McIntyre
7678e7c8ea
Pass bind address for reverse port forwards
2023-01-20 14:15:13 -06:00
Spencer McIntyre
2621775053
Add the Python command adapter for Windows
2023-01-20 15:10:39 -05:00
Grant Willcox
e537816132
Land #17516 , Update metasploit-payloads gem to 2.0.108
2023-01-20 13:55:33 -06:00
Jeffrey Martin
9be26eb0ff
improve SMTP delivery error handling
2023-01-20 11:26:25 -06:00
Spencer McIntyre
15237e5154
Update metasploit-payloads gem to 2.0.108
...
Includes changes from:
* rapid7/metasploit-payloads#599
* rapid7/metasploit-payloads#600
* rapid7/metasploit-payloads#602
2023-01-20 09:21:28 -05:00
Spencer McIntyre
6fe0933c1e
Add exploit for CVE-2022-44877
2023-01-20 09:04:24 -05:00
dwelch-r7
ebaf51108c
Land #17490 , Update impacket get user spns
2023-01-20 13:21:19 +00:00
Christophe De La Fuente
22f45c9a2e
Land #17513 , Update get ticket module to use aes_key and username convention
2023-01-20 12:44:23 +01:00
dwelch-r7
b2c20dfc51
Land #17514 , Fix crash in winrm_script_exec when using Kerberos authentication
2023-01-20 11:21:24 +00:00
adfoster-r7
aaad9436f2
Fix winrm offered etypes
2023-01-20 10:59:25 +00:00
adfoster-r7
4c17b93ca8
Update get ticket module to use aes_key and username convention
2023-01-20 10:47:35 +00:00
Jack Heysel
6ac0d9ba27
Trailing whitespace corrected
2023-01-19 22:16:54 -05:00
h00die
633c58a0ff
tomcat on rhel priv esc
2023-01-19 15:28:10 -05:00
Jack Heysel
0e0f62c002
Removed 22621
2023-01-19 14:47:20 -05:00
Jack Heysel
4da94325f3
Rubocop
2023-01-19 13:52:58 -05:00
Metasploit
3602a420d3
Bump version of framework to 6.2.37
2023-01-19 12:05:00 -06:00
Metasploit
bca837413f
automatic module_metadata_base.json update
2023-01-19 09:57:30 -06:00
Christophe De La Fuente
1e94adc3ab
Land #17479 , Wordpress paid membership pro unauthenticated sqli (CVE-2023-23488)
2023-01-19 15:36:00 +01:00
Jack Heysel
d7215b84b4
Added offsets for W11 22H2
2023-01-19 09:30:28 -05:00
Spencer McIntyre
0e6ae486d1
Land #17501 , Update AD CS spelling
...
Initial update of ADCS to be AD CS for appropriate spelling
2023-01-19 08:38:46 -05:00
ErikWynter
6419f2d5a5
add 'favorite -l' and 'favorites' as aliases for show favorites
2023-01-19 14:21:45 +02:00
Jack Heysel
63d9445911
Fix for Win Server 2022 and 2019
2023-01-19 00:52:38 -05:00
h00die
3a0b694790
better engrish
2023-01-18 20:12:49 -05:00
Grant Willcox
82fe7120d4
Update ADCS to be AD CS so we have appropriate spelling
2023-01-18 17:07:48 -06:00
bwatters
b406699c86
Land #17497 , Return if there is no certificate to process
...
Merge branch 'land-17497' into upstream-kerberos
2023-01-18 16:15:04 -06:00
h00die
642e6ee1cb
review
2023-01-18 16:21:11 -05:00
h00die
c823295915
cleanup better
2023-01-18 16:19:48 -05:00
npm-cesium137-io
d0feedadbf
Refine whatsupgold_credential_dump
...
Added CVE info to the References section.
Modified the registry routines to add sanity around x86 vs. x64 arch.
2023-01-18 15:47:26 -05:00
Spencer McIntyre
9bf7617409
Return if there is no certificate to process
2023-01-18 15:05:54 -05:00
Spencer McIntyre
ebfcfd4cb9
Land #17066 , Add module for Certifried
...
Add exploit module for Certifried exploit
2023-01-18 14:51:03 -05:00
npm-cesium137-io
8ed4f59c60
veeam_credential_dump refinement
...
Fixed stupid typo in markdown.
Fixed a bug in the export code that prevented the disposition column
from being exported.
2023-01-18 14:27:28 -05:00
Christophe De La Fuente
64ddc6bb4c
Land #17484 , Add additional kerberos documentation
2023-01-18 19:40:28 +01:00
Christophe De La Fuente
2072111713
Fix from code review & some improvments
...
- Improve option validation
- Always request an impersonated TGS for `cifs/...` SPN
- SPN option now is used to request an additional TGS for another SPN
- Add exception handling for Kerberos errors
- Only remove the computer account if it has been created
2023-01-18 19:28:06 +01:00
Grant Willcox
524ab66d2c
Land #17482 , Update min protocol for https server for openssl3
2023-01-18 11:01:32 -06:00
adfoster-r7
77b0fcb2f5
Update min protocol for https server for openssl3
2023-01-18 10:59:26 -06:00
bwatters
ed0ede0cad
Land #17472 , Always autocomplete options regardless of condition filtering
...
Merge branch 'land-17472' into upstream-kerberos
2023-01-18 10:59:16 -06:00
adfoster-r7
c55fcb6ca6
Add additional kerberos documentation
2023-01-18 16:58:34 +00:00
dwelch-r7
067126af44
Land #17493 , Add additional datastore validation to forge ticket
2023-01-18 12:33:12 +00:00
adfoster-r7
a28666d3c5
Add additional datastore validation to forge ticket
2023-01-18 10:46:32 +00:00
Jack Heysel
2c2bfec4a0
Tested on Windows Build 19044, 19045 and 22000
2023-01-18 01:41:30 -05:00
Grant Willcox
c0ddead75f
Land #17480 , Add payload exploit command
2023-01-17 17:52:32 -06:00
Spencer McIntyre
365b71d60f
Land #17471 , Update get_ticket cache logic
...
Update kerberos get_ticket cache logic
2023-01-17 18:49:08 -05:00
Grant Willcox
b8bea10296
Land #17491 , Fix LDAP Failure References
2023-01-17 17:22:10 -06:00
Metasploit
69464b3df2
automatic module_metadata_base.json update
2023-01-17 17:17:21 -06:00
bwatters
607dd9f081
Land #17348 , New exploit for CVE-2022-46770 Mirage firewall DoS
...
Merge branch 'land-17348' into upstream-master
2023-01-17 16:52:38 -06:00
adfoster-r7
235888b77e
Land #17492 , Remove CI crash example from Docs
2023-01-17 22:47:10 +00:00
bwatters
470972b91d
Land #17385 , Return success code for writing and appending file in command shells
2023-01-17 16:37:06 -06:00
Spencer McIntyre
d810267f8d
Pull in Dean's changes from #17443 to fix LDAP failure references.
2023-01-17 16:31:08 -06:00
h00die
d0abb5697b
re-add license stuff
2023-01-17 17:31:01 -05:00
bwatters
0dbb0dc8c9
Fix margins for readability and delete file
2023-01-17 17:28:27 -05:00
bwatters
d1f878c4f0
Fix spelling
2023-01-17 17:28:27 -05:00
bwatters
158c557d58
Update LICENSE file and location of source file
2023-01-17 17:28:22 -05:00
Grant Willcox
43d4a3ca7e
Remove CI crash example since its unneeded and extra overhead to maintain
2023-01-17 16:04:46 -06:00
h00die
e28ff3b160
minor fixes
2023-01-17 15:30:36 -05:00
h00die
be7ca91a8f
cve-2022-22942
2023-01-17 15:30:36 -05:00
adfoster-r7
7f62fa33f3
Update impacket get user spns
2023-01-17 19:53:42 +00:00
Metasploit
5dee00be0c
automatic module_metadata_base.json update
2023-01-17 13:33:02 -06:00
Grant Willcox
3b1380b164
Land #17449 , Ivanti Cloud Services Appliance unauthenticated cookie-based command injection [CVE-2021-44529]
2023-01-17 13:08:12 -06:00
Grant Willcox
7e23c34e6c
Apply fixes per code review
2023-01-17 12:44:22 -06:00
h00die-gr3y
541dab9365
simplified messaging
2023-01-17 12:44:20 -06:00
h00die-gr3y
da3ae22135
added documentation
2023-01-17 12:44:20 -06:00
h00die-gr3y
77687bff3f
init module
2023-01-17 12:44:20 -06:00
adfoster-r7
d8cf034d70
Land #17488 , Remove references to Travis CI
2023-01-17 17:20:44 +00:00
Grant Willcox
aceb4c57c6
Remove references to Travis CI since we no longer use it and now use GitHub Actions
2023-01-17 10:28:21 -06:00
Metasploit
c429113f5e
automatic module_metadata_base.json update
2023-01-17 08:23:26 -06:00
Spencer McIntyre
a10e313e26
Land #17343 , unquoted service path tweaks
2023-01-17 08:59:37 -05:00
adfoster-r7
5ed2fe9ad2
Update kerberos get_ticket cache logic
2023-01-17 00:32:18 +00:00
Hamilton Tobon Mosquera
d01060f40f
docs: how to set complex options using quotes
2023-01-16 17:38:20 -05:00
Metasploit
da22f18256
automatic module_metadata_base.json update
2023-01-16 14:17:56 -06:00
Christophe De La Fuente
0c8e83c34e
Land #17451 , Crack netntlm*
2023-01-16 20:52:53 +01:00
cgranleese-r7
202eb85066
Land #17470 , Update kerberos login to support diacritics
2023-01-16 12:22:44 +00:00
adfoster-r7
5ef1f9f4f4
Update kerberos login to support diacritics
2023-01-16 12:08:54 +00:00
cgranleese-r7
7a2f6fef86
Land #17477 , Merge 6.2.36 master into kerberos feature branch
2023-01-16 11:53:21 +00:00
adfoster-r7
b4797ba74f
Land #17422 , Add kerberoasting documentation
2023-01-16 10:30:20 +00:00
adfoster-r7
f637885f0a
Land #17468 , Fix error when printing ticket contents from a kirbi file format
2023-01-16 10:07:36 +00:00
adfoster-r7
5b3db9abc0
Update min protocol for https server for openssl3
2023-01-15 14:08:26 +00:00
h00die
a28b203f73
payload exploit command
2023-01-15 05:38:15 -05:00
h00die
1888264d4d
wordpress paid membership pro
2023-01-14 08:34:10 -05:00
h00die
0ac4d3d2e6
doc how to set permissions on service
2023-01-13 17:07:17 -05:00
Spencer McIntyre
3ddcf73c2b
Remove the QUICK option altogether
...
Use blocks to check whether each service is exploitable as they are
enumerated. With this change, it is the service and path enumeration
halts once an exploitable one is found that yields a session.
Also all files are registered for cleanup.
2023-01-13 17:06:42 -05:00
h00die
f98d1d838b
unquoted service path tweaks to check
2023-01-13 17:06:42 -05:00
h00die
90a12cf3b0
unquoted service path tweaks
2023-01-13 17:06:42 -05:00
h00die
a6ec7762ea
unquoted service path tweaks
2023-01-13 17:06:42 -05:00
h00die
c52eb09cbb
unquoted service path tweaks
2023-01-13 17:06:42 -05:00
Dean Welch
1470396f95
Refactor key validation for inspect_ticket and add module tests
2023-01-13 17:42:32 +00:00
adfoster-r7
eddac9321c
Merge 6.2.36 master into kerberos feature branch
2023-01-13 17:31:02 +00:00
cgranleese-r7
25550a4ef0
Land #17475 , Enable new datastore implementation by default
2023-01-13 16:40:58 +00:00
cgranleese-r7
436e1489c7
Land #17473 , Add edit link to docs website
2023-01-13 16:38:07 +00:00
Jeffrey Martin
99b2e1d709
add aws ssm gem to lock file
2023-01-13 09:59:05 -05:00
RageLtMan
14f992aa88
Address some of @smcityre-r7's comments
...
Explicitly `require 'aws-sdk-ec2'` in the aux module
Fix the hard-coded region to use datastore option
2023-01-13 09:55:51 -05:00
RageLtMan
274bf6dcb7
Make SSM keepalive optional
2023-01-13 09:54:34 -05:00
Christophe De La Fuente
3d22fbcad9
Add exploit module for Certifried exploit
...
- Move all the logic from `modules/auxiliary/admin/dcerpc/icpr_cert.rb`
to `lib/msf/core/exploit/remote/ms_icpr.rb` library
- Move all the logic from `modules/auxiliary/admin/dcerpc/samr_computer.rb`
to `lib/msf/core/exploit/remote/ms_samr.rb` library
- Add `modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb` module
- Update the SMB client to disable SSL by default
- Add documentation
- Kerbero client: pass `options` as argument to `send_request_as`
- `calculate_shared_key` returns an EncryptionKey instead of the raw key
- Update `pkinit_login` module to make it compatible
- Add support to `additional_tickets` when requesting tickets
- Add support to PAC CredentialInfo structures
- Add impersonation to escalate privileges
- Add ACTIONS
- Use elevated TGS to delete the computer account
- Update and add specs
2023-01-13 15:30:50 +01:00
adfoster-r7
e3cd004003
Add edit link to docs website
2023-01-13 14:01:40 +00:00
adfoster-r7
19d2e985ef
Enable new datastore implementation by default
2023-01-13 13:51:56 +00:00
adfoster-r7
a36882aee3
Always autocomplete options regardless of condition filtering
2023-01-13 13:11:32 +00:00
ErikWynter
8472efed02
fix typos, add reference, don't use methods to wrap datastore options
2023-01-13 14:53:29 +02:00
Dean Welch
75153aded3
Fix missing method error when printing ticket contents from a kirbi file format
2023-01-13 10:19:07 +00:00
Steve E
b67f001e2a
post-testing typo fix
2023-01-12 20:02:20 +00:00
Steve E
1afecd0884
force t3 over ssl option
2023-01-12 19:42:55 +00:00
Metasploit
c4d9206d9c
automatic module_metadata_base.json update
2023-01-12 12:41:33 -06:00
Spencer McIntyre
551990a945
Land #17466 , report smb version information
...
fix #16394 : SMB_Version Module does not report SMB Version into Notes
2023-01-12 13:16:05 -05:00
Metasploit
80016b2d22
Bump version of framework to 6.2.36
2023-01-12 12:10:45 -06:00
Metasploit
953621860a
automatic module_metadata_base.json update
2023-01-12 09:36:26 -06:00
Christophe De La Fuente
29968fb76e
Land #17337 , Gather Dbeaver Password
2023-01-12 16:06:00 +01:00
cgranleese-r7
9c2b8138a7
Land #17456 , Make the Kerberos Encryption Type Configurable
2023-01-12 13:25:48 +00:00
adfoster-r7
0669ee1f72
Land #17395 , Adds docs for RPC workflows to docs site
2023-01-12 12:50:55 +00:00
cgranleese-r7
e81b08563e
Add additional metasploit rpc documentation
2023-01-12 11:21:41 +00:00
Jack Heysel
145589f7a2
Add GetPteBaseW10
2023-01-12 01:15:23 -05:00
Wrathdemon
becf613022
fix #16394 : SMB_Version Module does not report SMB Version into Notes
2023-01-12 09:29:53 +05:30
三米前有蕉皮
0b2cf18197
Merge pull request #1 from cdelafuente-r7/dbeaver_gather_cred_fixes
...
Fix exception handler logic and small improvements
2023-01-12 07:38:09 +08:00
adfoster-r7
a484350fdf
Land #17455 , Fix Chunked Kerberos Responses
2023-01-11 22:09:06 +00:00
Spencer McIntyre
2f145769da
Actually, offered_etypes needs to be an array
2023-01-11 17:08:27 -05:00
Hamilton Tobon Mosquera
fd7fbb76af
fix: cmd_run: remove unnecessary map
...
Removing the call to .map over args[:datastore_options] avoids an unnecessary call to Msf::DataStore#import_options_from_s. args[:datastore_options] is already a hash, converting it to string and using Msf::DataStore#import_options_from_s converts it back to hash, which is not necessary. The Msf::Simple::Module mixin already offers support for Options, which is expected to be a hash.
This change also prevents sending corner case option strings to Msf::DataStore#import_options_from_s when using post modules, which does not support strings like: "COMMAND='date --date=2023-01-01'".
2023-01-11 16:54:13 -05:00
Hamilton Tobon Mosquera
03acb7e9f2
test: added rspec tests for 6074d1a4d3
2023-01-11 15:46:55 -05:00
Christophe De La Fuente
f9b1c17c39
Fix exception handler logic and small improvements
2023-01-11 20:00:09 +01:00
Spencer McIntyre
a4a5162b92
Remove the etype option in favor of offered_etypes
2023-01-11 10:17:52 -05:00
Metasploit
61ffb90954
automatic module_metadata_base.json update
2023-01-11 09:01:02 -06:00
Christophe De La Fuente
ada6e73af6
Land #17341 , MinIO_Client Post Exploitation Credential Gatherer
2023-01-11 15:36:23 +01:00
Christophe De La Fuente
43051a2811
Add missing curly bracket
2023-01-11 14:30:23 +01:00
cn-kali-team
6738ca2c43
Support multiple platforms
2023-01-11 18:04:29 +08:00
adfoster-r7
6f7d7bcd1c
Land #17394 , Add ticket converter docs
2023-01-11 02:11:59 +00:00
三米前有蕉皮
ce83086c00
Update modules/post/multi/gather/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-11 09:31:42 +08:00
三米前有蕉皮
633d807dbc
Update modules/post/multi/gather/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-11 09:29:13 +08:00
三米前有蕉皮
e00a86b6d6
Update modules/post/multi/gather/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-11 09:28:26 +08:00
三米前有蕉皮
3dd794a97f
Update modules/post/multi/gather/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-11 09:27:48 +08:00
三米前有蕉皮
8b6387867d
Update modules/post/multi/gather/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-11 09:27:08 +08:00
npm-cesium137-io
243c57c1fe
Add whatsupgold_credential_dump post module
...
Add a post module for credential extraction from WhatsUp Gold instances
on Windows hosts. The module should theoretically decrypt ciphertext
from any version of WhatsUp Gold, although it has only been verified
working on WhatsUp Gold versions 11.0 through 22.0.
2023-01-10 15:50:53 -05:00
adfoster-r7
760f5198ac
Add additional metasploit rpc documentation
2023-01-10 20:43:11 +00:00
Grant Willcox
87b1f3b602
Land #17386 , Ignore Content-Length header for the purpose of HEAD requests
2023-01-10 11:00:59 -06:00
Jeffrey Martin
a0738aaa02
Land #17447 , Bump up pry related gems post 2.6
2023-01-10 10:40:32 -06:00
Grant Willcox
8b102afd71
Rubocop fixes and some documentation additions
2023-01-10 10:07:51 -06:00
Jack Heysel
a61ecd6e40
Moved to wiki, added hashcat tutorial
2023-01-10 10:57:28 -05:00
cgranleese-r7
281020379c
Adds docs for RPC workflows to docs site
2023-01-10 10:31:24 +00:00
cn-kali-team
6ef38e305f
Support multiple platforms
2023-01-10 15:01:55 +08:00
三米前有蕉皮
5845c7cb1f
Update modules/post/windows/gather/credentials/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-10 09:22:50 +08:00
三米前有蕉皮
ba5b100fe5
Update modules/post/windows/gather/credentials/minio_client.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-10 09:20:32 +08:00
三米前有蕉皮
a14af52146
Update documentation/modules/post/windows/gather/credentials/minio_client.md
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-10 09:19:58 +08:00
三米前有蕉皮
b72bfec033
Update documentation/modules/post/windows/gather/credentials/minio_client.md
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2023-01-10 09:17:40 +08:00
Ashley Donaldson
f8b253dae1
Fix state machine for HEAD requests
2023-01-10 10:57:13 +11:00
Spencer McIntyre
138f3bb4b2
Make the encryption type configurable
2023-01-09 17:20:57 -05:00
Spencer McIntyre
b7f6fe584a
Add initial lib changes for configurable etypes
2023-01-09 16:43:42 -05:00
npm-cesium137-io
499d1ccfd7
Refactor veeam_credential_dump
...
Changed the SQL queries for DB dump to explicit VARCHAR(4096) to get
around sqlcmd's 256-char column limit.
Refactored the BATCH_DPAPI functionality because I can't seem to let
this pattern go: now actually batches with byte threshold set by
advanced option.
Reduced clutter and redundancy.
Various tweaks and bug fixes.
Updated documentation.
2023-01-09 16:31:44 -05:00
Steve E
990d5ccfad
Action linter warnings in changes
2023-01-09 21:17:22 +00:00
Steve Embling
16c176dbe0
Accept protocol option change to optenum from optstring
...
Co-authored-by: bcoles <bcoles@gmail.com >
2023-01-10 12:54:28 +00:00
Steve Embling
a368f76a2a
Update weblogic_deserialize_badattrval.rb
2023-01-10 10:47:31 +00:00
Krzysztof Burghardt
ca0a57124b
Add qubes_mirage_firewall_dos module documentation
2023-01-09 13:27:35 -06:00
Krzysztof Burghardt
551edbe0d1
Review and lint fixes
2023-01-09 13:27:35 -06:00
Krzysztof Burghardt
a1ee09d544
New exploit for CVE-2022-46770 Mirage firewall DoS
2023-01-09 13:27:35 -06:00
Steve E
60bfa329fa
Add t3s protocol support to weblogic_deserialize_badattrval
2023-01-09 18:47:43 +00:00
Metasploit
3beb3d775f
automatic module_metadata_base.json update
2023-01-09 11:49:22 -06:00
Grant Willcox
f6f3dd1af0
Land #17454 , fix #17436 : scanner/smb/smb_enumshares truncates file names
2023-01-09 11:23:50 -06:00
Grant Willcox
f8ce1219e1
Remove extra line
2023-01-09 11:23:26 -06:00
Wrathdemon
2df3920432
fix #17436 : truncated file names in the logged data in module auxiliary/scanner/smb/smb_enumshares
2023-01-09 22:11:25 +05:30
Spencer McIntyre
2494c367e7
Handle chunked Kerberos responses
...
Chunked responses from partial reads are possible when pivoting.
2023-01-09 11:24:53 -05:00
Grant Willcox
fd61e31cd3
Bump up additional Gems and bump Pry to support recent versions of Ruby
2023-01-09 09:54:41 -06:00
Wrathdemon
ade00718c6
fix #17436 : truncated file names in the logged data in module auxiliary/scanner/smb/smb_enumshares
2023-01-09 19:32:37 +05:30
h00die
0c418d05e8
jtr cracking of netntlm
2023-01-08 16:54:36 -05:00
h00die
8e1c29f444
jtr cracking of netntlm
2023-01-08 15:31:47 -05:00
h00die
0c3026c201
crack netntlm*
2023-01-08 14:32:04 -05:00
h00die
4c6c8fcf8b
crack netntlm*
2023-01-08 14:29:21 -05:00
Grant Willcox
ebdfabf35d
Bump up pry related gems post 2.6 lock removal
2023-01-06 16:53:04 -06:00
Grant Willcox
d076b9c7ab
Merge pull request #17166 from k0pak4/improve-golden-ticket-module
...
Improve golden ticket module with hash check and better loot storage
2023-01-06 16:39:29 -06:00
Matthew Dunn
8f302c8697
Complete requested PR changes
...
Clone the cc_principle
2023-01-06 14:48:53 -06:00
Grant Willcox
3d9ea4492f
Fix up extra blank lines and make ticket type being saved clearer
2023-01-06 14:48:53 -06:00
Matthew Dunn
d64c4b6e7e
Store the binary format of the ccache
...
update key to be correct
2023-01-06 14:48:53 -06:00
Matthew Dunn
ccfc253eb8
Updates to get ccache in golden ticket
...
Fix incorrect reference
Use proper encoding
2023-01-06 14:48:52 -06:00
Matthew Dunn
ff029842ce
Verify NT hash and store golden ticket as kirbi and ccache
2023-01-06 14:48:38 -06:00
Jeffrey Martin
07231a6a8e
Land #17425 , Weekly dependency updates for Gemfile.lock
2023-01-06 13:05:21 -06:00
Grant Willcox
9dce44f195
Merge pull request #17390 from dwelch-r7/move-debug-ticket-to-new_module
...
Move debug ticket to new module
2023-01-06 11:35:18 -06:00
Grant Willcox
d69564f3df
Minor update to merge output and example together.
2023-01-06 10:15:16 -06:00
Jeffrey Martin
bd1a6d44f2
Land #17441 , Remove lock on Pry version
2023-01-06 09:52:16 -06:00
Grant Willcox
0be28f64b4
Merge pull request #17443 from dwelch-r7/Fix-ldap-failure-constants
...
Use the correct constant names for ldap failures
2023-01-06 09:19:28 -06:00
Hamilton Tobon Mosquera
6074d1a4d3
fix: parse COMMAND with nested '=' in meterpreter
...
Fixes bug #16578
2023-01-06 09:27:25 -05:00
Dean Welch
8078616f5f
Use the correct constant names for ldap failures
2023-01-06 14:11:26 +00:00
Spencer McIntyre
138e0c697b
Land #17427 , YARD Document LDAP Libraries
2023-01-06 08:57:31 -05:00
dwelch-r7
75372dcdd3
Land #17374 , Add klist command
2023-01-06 12:57:20 +00:00
cn-kali-team
4a1c75ae73
dbeaver_store_config
2023-01-06 14:55:49 +08:00
Grant Willcox
0ae5aea9e8
Remove lock on Pry version since Ruby 2.6 is no longer supported by Metasploit and so this no longer applies
2023-01-05 18:55:39 -06:00
Grant Willcox
e03fd42a29
Update to fix some warnings in YARD, fix review comments, and also replace @see with proper links for easier navigation
2023-01-05 17:44:24 -06:00
Grant Willcox
0af0f6ea0a
Merge pull request #17440 from zeroSteiner/fix/smb-aes-256-kerberos
...
Fix SMB key calculation for AES-256 when authenticating with Kerberos
2023-01-05 17:05:28 -06:00
Metasploit
0a826323f7
automatic module_metadata_base.json update
2023-01-05 16:01:11 -06:00
Spencer McIntyre
1f938781d9
Land #17438 , exchange_proxylogon_collector bugfix
...
exchange_proxylogon_collector bugfix: prevent empty on nil by changing empty to blank
2023-01-05 16:24:58 -05:00
Metasploit
131d982cd2
automatic module_metadata_base.json update
2023-01-05 14:49:58 -06:00
Grant Willcox
98b3b29cc2
Land #17439 , Removing Rex::ConnectionError exception handler from module template
2023-01-05 14:24:58 -06:00
Spencer McIntyre
785c5a8f4d
Fix key calculation for Server 2022
...
Metasploit will negotiate the strongest mutually supported encryption
with the target. When the target supports AES-256 as Server 2022 and
Windows 11 do, the key needs to be 32-bytes long and not 16 as it is
when AES-128 is in use. This updates the logic to check if the
encryption algorithm is set to ensure that the key is the correct size.
2023-01-05 15:08:49 -05:00
Christophe De La Fuente
1ede6661d4
Land #17382 , Update pkinit tgt response to include key
2023-01-05 20:45:20 +01:00
Christophe De La Fuente
25f4c023b4
Removing Rex::ConnectionError exception handler
2023-01-05 20:26:11 +01:00
Grant Willcox
9585677d2c
Update Gemfile.lock with latest changes
2023-01-05 12:30:08 -06:00
Metasploit
1b093b6e17
Bump version of framework to 6.2.35
2023-01-05 12:10:17 -06:00
Spencer McIntyre
e555f3c28f
Land #17384 , Add missing entries to LICENSE
...
Update license file for all GPL I could find
2023-01-05 12:51:13 -05:00
Spencer McIntyre
964dbacb0f
Tweak whitespace in the LICENSE file
...
Tweak whitespace in the LICENSE file to wrap at 80 chars (when able to)
and to consistently use line breaks and alignment.
2023-01-05 12:50:40 -05:00
Grant Willcox
725f83601f
Land #17435 , Restore raw_send_recv for module using SMTP mixin
2023-01-05 11:29:53 -06:00
Dean Welch
2de3477eb0
Add msfconsole examples
2023-01-05 17:02:23 +00:00
Grant Willcox
e218210feb
Update ldap_connect documentation to set Object as the return type
2023-01-05 10:51:18 -06:00
bwatters
9ecf27a490
Rebase with Master and fix rebasing issues....
2023-01-05 09:48:17 -06:00
Grant Willcox
2cc43fa4ac
Land #17428 , Update .mailmap
2023-01-05 09:38:23 -06:00
Grant Willcox
4dd3e43f01
Remove wvu from list at his request, and move past contributors to appropriate section
2023-01-05 09:13:51 -06:00
Dean Welch
a18efb7882
Improve description and error messages
2023-01-05 14:24:08 +00:00
cn-kali-team
5eae5068cc
update
2023-01-05 20:56:06 +08:00
ErikWynter
f222bccf6c
prevent empty on nil by changing empty to blank
2023-01-05 10:38:09 +02:00
Metasploit
9d866a3784
automatic module_metadata_base.json update
2023-01-04 18:32:27 -06:00
Grant Willcox
ddc3435818
Land #17312 , Pre-Authenticated Remote Code Execution in Nortek Linear eMerge Access Controller (CVE-2019-7256)
2023-01-04 18:08:04 -06:00
Grant Willcox
f39973de86
Fix up missing option in documentation and also add some additional validation on server response.
2023-01-04 17:02:05 -06:00
h00die-gr3y
11b95b2094
added additional response check
2023-01-04 17:02:04 -06:00
h00die-gr3y
c7b59b4815
updates based on gwillcox-r7 review comments
2023-01-04 17:02:04 -06:00
h00die-gr3y
6801cbd21e
updated Limitation section
2023-01-04 17:02:03 -06:00
h00die-gr3y
f9ecaa92ae
updated references section
2023-01-04 17:02:03 -06:00
h00die-gr3y
fc6acdab6a
added documentation
2023-01-04 17:01:59 -06:00
h00die-gr3y
4db15346e1
init commit module
2023-01-04 17:01:58 -06:00
Jeffrey Martin
6b5948a69d
restore raw_send_recv for module using SMTP mixin
...
changes in #16153 adjusted modules that were not utilizing
`Exploit::Remote::SMTPDeliver` in error restore calls to `raw_send_recv`
that is no longer shadowed by in `SMTPDeliver`.
2023-01-04 14:45:58 -06:00
Grant Willcox
e99c406355
Merge pull request #17434 from dwelch-r7/fix-typo-keytab-docs
...
Fix keytab docs typo
2023-01-04 11:13:44 -06:00
Grant Willcox
c71ba23a10
Fix up incorrectly indented documentation, remove excess lines, and add in correct type return information from debugging sessions
2023-01-04 11:09:23 -06:00
Arthur RAOUT
d83c2c3a5d
Remove useless loop that select reg1, because we now have push/pop all regs to preserve them
2023-01-04 17:40:22 +01:00
Arthur RAOUT
676fda73b1
Remove useless loop that select reg1, because we now have push/pop all regs to preserve them
2023-01-04 17:39:59 +01:00
Arthur RAOUT
7494318ec4
Fix offset from entrypoint
2023-01-04 17:36:55 +01:00
Arthur RAOUT
93f579b180
Fixed shuffling of registers with generate preserve reg function
2023-01-04 17:33:24 +01:00
Arthur RAOUT
0a99e2be6a
Fixed 3 offense rubocop/msftidy
2023-01-04 17:25:25 +01:00
Arthur RAOUT
bdf5f8fbe4
Added preserver register through random order push and pop of the registers, change name to xor_poly.rb
2023-01-04 17:21:48 +01:00
Professor Araout
7cd68e8f06
Merge branch 'rapid7:master' into New_x86_xor_encoder
2023-01-04 17:04:30 +01:00
Dean Welch
cb95d92201
Fix keytab docs typo
2023-01-04 15:39:59 +00:00
RageLtMan
60c2f0a480
SSM enumeration module filter and throttle
...
Expand SSM enumeration module docs to explain full functionality.
Enable the LIMIT configuration option to restricte results per
region.
Implement FILTER_EC2_ID configuration option to permit targeting
of a specific instance for session initiation.
Testing:
Finds limtied sets of systems and initiates sessions
Finds desired system ID and initiates session
2023-01-03 22:00:14 -05:00
RageLtMan
955fb2ef3e
SSM WebSocket session keep-alive
...
The SSM session socket times out without data being sent at the
upper (SSM) WS layer. Implement keep-alive in a separate thread
which simply writes nothing into the channel at irregular intervals
to simulate user activity.
Testing:
Sessions established with this code running have not timed-out
in over 15m despite being completely unused
2023-01-03 21:20:07 -05:00
RageLtMan
eba4c4b047
Spoonfeed the skiddies: auto-sessions for SSM enum
...
Enable session acquisition from AWS SSM enumeration module simiar
to how the telnet login scanner acquires sessions on the sockets
exposed.
Testing
Tested execution - finds systems, gets shells, autopwn-capable
2023-01-03 20:40:30 -05:00
RageLtMan
7666b30b82
Rudimentary enumeration module for EC2+SSM
...
Coopt Aaron Soto's EC2 enum module & replace the guts with an SSM
query for not-terminated EC2 instances with SSM capability. This
will proide users with the instance IDs needed to test their SSM
shells and can be expanded to report information or even act as a
"brute-force" module which automatically starts SSM sessions.
Testing:
None - might eat your monitor lizard
2023-01-03 17:09:55 -05:00
RageLtMan
46c030a08b
Finalize SSM Shell via WebSocket
...
Implement terminal resizing to WebSocket shell
Reorganize code to ease later extension
Implement peerinfo in channel context from AWS EC2 SSM information
gathered during session validation
Implement echo-filtering for session inputs (hacky, but works)
Testing:
Verified console resizing, color/reset/etc
Verified peerinfo and interaction
Verified common session operations
Notes:
SSM WebSocket sessions time out pretty quickly, implementing
dedicated SSM session types which support suspend/resume to match
backgrounding/foregrounding operations in the console should help
to resolve this. Alternatively, a keep-alive using empty frames
may be implemented in the SsmChannel itself on a separate thread.
2023-01-03 15:10:31 -05:00
Christophe De La Fuente
868072e6c8
Land #17317 , Fix various WinRM modules
2023-01-03 19:57:07 +01:00
Christophe De La Fuente
9f869f5a11
Add a call to super in run
2023-01-03 19:54:06 +01:00
RageLtMan
43d746c404
Implement SSM WebSocket Sessions
...
Alter WebSocket::Interface::Channel to accept a mask_write flag to
set the Channel behavior for outgoing data (since the on_data_write
handler can only deal with the buffer provided, not how the wsframe
containing it is written to the "wire"). Set the flag to false for
SSM's WebSocket operations.
Extract Rex::Proto::Http::WebSocket::AmazonSsm from the handler to
permit reuse by other framework elements.
Implement SSM-specific UUID handling.
Create sane SsmFrame constructor to permit convenient operations.
Implement Http::WebSocket::AmazonSsm::Inteface::SsmChannel from
Http::WebSocket::Inferface::Channel with message-type handling and
output processing. Acknowledge incoming messages, process incoming
acknowledgements, increment sequence IDs appropriately, and handle
basic logging.
This new session type removes the 2500 char output restriction and
stateless peer cwd.
Testing:
Execution of handler now provides stateful interactive shells
Next steps:
More testing, preferably by other people with upstream framework.
Peerinfo and presentation updates for the session channel
Misc cleanup
Future work:
Implement new SSM session type with support for multi-console,
port-forwarding/socket routing, and custom SSM documents.
Implement FSM handlers for session suspension and resumption in
Http::WebSocket::AmazonSsm::Interface::SsmChannel
2023-01-03 09:34:14 -05:00
Ashley Donaldson
45c0af48c2
Suggested changes from code review
2023-01-03 11:26:07 +11:00
Ashley Donaldson
b05db8b82d
Keep signature of the read_response function as it was before, and add the original request as an opt
2023-01-03 09:46:43 +11:00
RageLtMan
c733dbc906
Start processing AWS SSM WebSocket session frames
...
Create BinData structure to handle the proprietary format of AWS'
SSM WebSocket protocol. Implement relevant inter-field dependencies
and a virtual payload_valid field to handle the SHA256 digest check
for the current state of r the payload_data field.
Implement user-accessible SSM document definition to permit use of
custom-defined command and session documents (stubbing for session
types such as port-forwarding) which may be of use when dealing
with restrictive IAM.
Restructure handler in preparation for moving the WebSocket code
into Rex::Proto for use by other consumers such as custom payloads
and session types like fully interactive (vs REPL) modalities, or
some form of "cloud-native" MeterSSM.
Testing:
Verified acquisition of SSM WS frame and relevant field ops
Next Steps:
Create WS loop to abstract shell communications
Wrap in Rex*Abstraction bowties for the session handler
Test -> ? -> Profit
2023-01-01 11:21:32 -05:00
RageLtMan
cfc24f138a
Implement SSM WebSocket init/auth
...
Using the implementation in https://github.com/humanmade/ssm , use
the onconnect websocket authenticator as a JSON string written as
a wstext Frame into the established WebSocket. This keeps the sock
open with AWS after returning it from the method, but subsequent
operations will require definition and encoding/decoding of SSM's
proprietary data structures.
Testing:
The initialized WebSocket is kept open and returns wsframes when
requested.
Next steps:
Port the various data structures from the JavaScript library
Implement encoding & decoding for their wire-level formats
Implement state management and data flow handling logic for
the WS SSM protocol.
2022-12-31 20:46:19 -05:00
RageLtMan
9850534d55
Initial WebSocket connection wrapper
...
Port WebSocket initiation routine from Exploit::Remote::HttpClient.
Currently inert since it appears to require a handshake procedure
along with its own type of data frame.
Implement graceful fail-down for session establishment which tries
to initiate a WebSocket session for proper functionality, failing
down to the script-execution style session abstraction if the WS
session does not marshal properly. Use this exception handling to
deal with the WIP WS session state.
Testing:
Gets the same kind of command-abstracted session as before
Interface-extended socket returns garbage from naive #write and
nothing from put_string or put_binary - not going to get anything
out of this thing until we establish the handshake procedure.
Next steps:
Figure out data frame structures for handshake and console IO
Implement handshake on-init, validate state
Implement IO abstraction for the resulting Channel for handoff
to #handle_connection
2022-12-31 19:05:06 -05:00
RageLtMan
3624bee263
Initial implementation for AWS SSM shells
...
Amazon Web Services provides conveniently privileged backdoors in
the form of their SSM agents which do not require connectivity with
the target instance, merely valid credentials to AWS' API. Due to
this indirect "connection" paradigm, this mechanism can be used to
control otherwise "air-gapped" targets.
This approach abstracts asynchronous request/response parsing for
SSM requests into an IO channel with which the AWS SSM client is
then wrapped to emulate the expected Stream. The mechanism is rather
raw and could use better error handling, retries on laggy output,
and a threadsafe cursor implementation. It may be possible to start
an actually interactive session using the #start_session method in
the AWS client library, but so far testing has not yielded positive
results.
There is a significant limitation with these sessions not present
in normal stream-wise abstractions: a response limit of 2500 chars.
This limitation can be overcome by utilizing an S3 bucket to store
command output; however, due to the nature of access we seek to
obtain, it would not only add to the logged event loads but retain
the results of our TTPs in a "buffer" accessible to other people.
This functionality can be added down the line in the form of S3
config options in the handler to be passed into the SSM client for
command execution and acquisition of output.
Testing:
Gets sessions, provides command IO, leaves a bunch of log entries
in CloudTrail (something to keep in mind for opsec considerations).
Next steps:
Reorganize our WebSocket code a bit to provide connection and WS
state management inside Rex::Proto::Http::Client which can then be
exposed to the Handler without having to mix-in other namespaces
from Exploit.
Use the #start_session SSM Client method to extract the WS URL
for the relevant channel, and utilize that as the underpinning for
our session comms.
2022-12-31 15:04:27 -05:00
wvu
852de5166e
Update .mailmap
2022-12-30 17:03:19 -06:00
Grant Willcox
bfb80db9db
Add in missing YARD documentation for lib/msf/core/exploit/remote/ldap.rb
2022-12-30 16:07:08 -06:00
Grant Willcox
86d4129edb
Add in missing YARD documentation for lib/rex/proto/ldap.rb
2022-12-30 13:41:33 -06:00
adfoster-r7
a8957bce49
Update tgt response to include key
2022-12-30 13:41:54 +00:00
Grant Willcox
e9f86ce6e8
Merge pull request #17421 from adfoster-r7/merge-6.2.33-master-into-kerberos-feature-branch
...
Merge 6.2.33 master into kerberos feature branch
2022-12-29 22:48:14 -06:00
Grant Willcox
8c25786023
Undo bundler version bump
2022-12-29 15:43:31 -06:00
Grant Willcox
0e2b0fd421
Weekly gem bump
2022-12-29 15:39:52 -06:00
Metasploit
cb682973f7
Bump version of framework to 6.2.34
2022-12-29 12:03:41 -06:00
Jack Heysel
5a8d330f80
Msftidy fixes
2022-12-28 17:11:55 -05:00
Jack Heysel
8f277abbf2
Add kerberoasting documentation
2022-12-28 16:55:57 -05:00
Jack Heysel
a8697cdffc
Land #17409 , rhost walker handle interupt signal
2022-12-28 14:46:13 -05:00
timwr
ce260f53f3
Add CVE-2022-46689 macOS dirty cow
2022-12-28 22:46:08 +07:00
adfoster-r7
95d361754f
Merge branch 'upstream-master' into merge-6.2.33-master-into-kerberos-feature-branch
2022-12-28 13:59:42 +00:00
Metasploit
28230c6335
automatic module_metadata_base.json update
2022-12-27 20:48:57 -06:00
Grant Willcox
7b25c753d6
Land #17416 , Use .blank? instead of .empty? when handling SSH Key details to prevent crashes
2022-12-27 20:24:54 -06:00
Joshua Rogers
615bba3d31
Update jenkins_gather.rb
...
blank? should be used instead of empty?
2022-12-27 19:31:49 -06:00
Grant Willcox
8678bb9db6
Land #17380 , Update User Agent strings December 2022
2022-12-27 18:18:24 -06:00
Grant Willcox
a49e8c7afb
Merge pull request #17405 from adfoster-r7/update-smb-enumshares-to-gracefully-fallover-from-139-to-445
...
Update smb enumshares to gracefully failover from port 139 to 445
2022-12-27 15:42:01 -06:00
bwatters
04f2db6376
Land #17419 , Fix GitHub Actions Verify Action Using Wrong Version of Ruby for 3.0.x Tests
...
Merge branch 'land-17419' into upstream-master
2022-12-27 15:15:14 -06:00
Grant Willcox
9e31190dce
Land #17414 , Fix typo: Replace patten with pattern
2022-12-27 13:50:42 -06:00
Grant Willcox
6057047384
fix: 🐛 Add quotes around Ruby version strings
...
This fixes issues where Ruby would interpret version strings as floats,
which could lead to casting errors. An example of this was when 3.0 would be interpreted
as the number 3, so instead of getting the latest Ruby 3.0.X release,
you would instead get the latest Ruby 3 release.
2022-12-27 12:27:54 -06:00
Dnidof
c117040705
Fix typo: Replace patten with pattern
...
Update How-to-Apply-to-GSoC.md
2022-12-26 16:37:59 +01:00
Metasploit
a526604bb3
automatic module_metadata_base.json update
2022-12-23 08:46:09 -06:00
adfoster-r7
7e1c3bc1bf
Update rhost walker to handle interrupt signal
2022-12-23 13:26:27 +00:00
Christophe De La Fuente
20d70799a7
Land #17298 , Add opentsdb_yrange_cmd_injection module and docs
2022-12-23 13:38:58 +01:00
Christophe De La Fuente
83b11a69a8
Make rubocop happy
2022-12-23 13:38:16 +01:00
ErikWynter
7fa557805e
add final code review suggestions
2022-12-23 11:29:29 +02:00
ErikWynter
8f96746551
fix typo and add credit for discovery
2022-12-23 11:11:31 +02:00
Metasploit
c0597fe1da
Bump version of framework to 6.2.33
2022-12-22 12:09:43 -06:00
ErikWynter
4c2dfe0279
add cacti_unauthenticated_cmd_injection
2022-12-22 17:55:45 +02:00
Metasploit
f8040754e1
automatic module_metadata_base.json update
2022-12-21 15:54:27 -06:00
Jack Heysel
63583af153
Land #17389 , Log4shell_header_injection bug fix
...
prevent .keys call on nil
2022-12-21 16:26:55 -05:00
npm-cesium137-io
9cc8d41388
veeam_credential_dump post module revisions
...
Cleanup for initial PR.
2022-12-21 15:53:46 -05:00
adfoster-r7
9d725b1e67
Update smb enumshares to gracefully failover from 139 to 445
2022-12-21 20:23:01 +00:00
Metasploit
15357e2289
automatic module_metadata_base.json update
2022-12-21 08:07:09 -06:00
Christophe De La Fuente
6758c8313f
Land #17258 , Update sharphound
2022-12-21 14:04:09 +01:00
Metasploit
32f26378ad
automatic module_metadata_base.json update
2022-12-20 17:16:03 -06:00
adfoster-r7
a6605d36a3
Land #17334 , enum_commands: Cleanup
2022-12-20 22:52:00 +00:00
Professor Araout
dcec717a9b
Merge branch 'rapid7:master' into New_x86_xor_encoder
2022-12-20 22:25:29 +01:00
Professor Araout
0a53cab369
Update xor.rb
...
Remove outdated comments
2022-12-20 17:03:50 +01:00
Metasploit
ed832f1a47
automatic module_metadata_base.json update
2022-12-20 09:24:38 -06:00
Arthur RAOUT
45d0eb8bb4
Add encoder module x86/xor at path modules/encoder/x86/xor.rb, Rubocop clean, msftidy clean, No documentation written
2022-12-20 15:54:01 +01:00
Christophe De La Fuente
fa5e4df3f5
Land #17278 , Add solarwinds_orion_dump post module
2022-12-20 15:42:25 +01:00
npm-cesium137-io
e3c6aa7820
solarwinds_orion_dump attribution update
...
Updated original research attribution to align with reality.
2022-12-20 08:55:19 -05:00
bcoles
78906a8217
enum_commands: Cleanup
2022-12-20 23:42:51 +11:00
npm-cesium137-io
03ca00e6e6
solarwinds_orion_dump refine CSV input handling
...
Improved CSV input error handling and various minor bug fixes.
2022-12-19 11:39:44 -05:00
bwatters
6b0805dc11
Update cmdstager docs
2022-12-16 15:55:30 -06:00
Grant Willcox
b01720dcba
Merge pull request #17397 from zeroSteiner/fix/pkinit-nameerror
...
Fix a NameError in pkinit_login
2022-12-16 15:28:45 -06:00
Spencer McIntyre
b2edf1108a
Fix a NameError in pkinit_login
2022-12-16 14:54:46 -05:00
Dean Welch
4e1e85f8ad
Add ticket converter docs
2022-12-16 13:53:05 +00:00
adfoster-r7
6f9ebe4068
Add klist command
2022-12-16 13:02:39 +00:00
adfoster-r7
20496aadc2
Land #17377 , Consolidate Kerberos Ticket Storage
2022-12-16 01:35:36 +00:00
Ashley Donaldson
5c2640178c
Suggested changes from code review
2022-12-16 10:36:26 +11:00
Spencer McIntyre
60a76da374
Allow deleting tickets by ID
2022-12-15 18:31:18 -05:00
Spencer McIntyre
75fc560d19
Handle cases where the framework module is nil
2022-12-15 18:31:18 -05:00
Spencer McIntyre
830e850160
Add more docs
2022-12-15 18:31:18 -05:00
Spencer McIntyre
663dee982e
Expose an abstract stored ticket object
2022-12-15 18:31:18 -05:00
Spencer McIntyre
fea259f6e7
Switch everything to use the ticket storage
2022-12-15 18:31:14 -05:00
Spencer McIntyre
b2a4bea761
Breakout the ticket storage backend drivers
2022-12-15 18:29:00 -05:00
Spencer McIntyre
686b946c5b
Use a new TicketStorage class
...
The goal is to provide an abstraction for how Kerberos tickets are
persisted to disk.
2022-12-15 18:28:54 -05:00
Spencer McIntyre
5f52ebeea7
Consolidate the loot_info UID string
2022-12-15 18:26:32 -05:00
Ron Bowes
2ec77e6d95
Merge branch 'master' into f5-createuser-privesc
2022-12-15 13:11:26 -08:00
Steffen Robertz
cc5c405941
Unauthenticated RCE for multiple Zyxel Router changes
2022-12-15 21:44:57 +01:00
Jack Heysel
3204caf618
Make use of session platform
2022-12-15 14:28:19 -05:00
Jack Heysel
87614cf2b3
Fixed spacing updated check method
2022-12-15 14:15:06 -05:00
Grant Willcox
37fe3b909a
Land #17931 , Bump IRB version to 1.6.1
...
Bring in changes mentioned at https://st0012.dev/whats-new-in-ruby-3-2-irb
2022-12-15 12:41:52 -06:00
Metasploit
f4a9090128
Bump version of framework to 6.2.32
2022-12-15 12:11:11 -06:00
Grant Willcox
0ab2d6020e
Bump IRB version to bring in changes mentioned at https://st0012.dev/whats-new-in-ruby-3-2-irb
2022-12-15 11:00:23 -06:00
Grant Willcox
159a4bc218
Land #17387 , Expand ~ for hosts and notes commands
2022-12-15 10:47:01 -06:00
Christophe De La Fuente
6e09236c97
Land #17381 , Update rasn1 dependency for pkinit
2022-12-15 17:38:49 +01:00
Grant Willcox
c0c8f955a8
Land #17366 , Fix Shell Upload Download Command For Directory Destinations
2022-12-15 09:42:02 -06:00
Spencer McIntyre
d1f5fa06cf
Don't use File in cmd_upload / cmd_download
...
It does not look like shell sessions define their own File class,
meaning that the local-platform specific one is always used. Instead
we'll define the separator ourselves since it's all we need to perform
the basic operations necessary to analyze the path string.
2022-12-15 10:05:02 -05:00
bwatters
3eb86b92e1
Land #17191 , Fix bug in linux reverse_tcp_x64 when running on WSL
...
Merge branch 'land-17191' into upstream-master
2022-12-15 09:02:57 -06:00
Dean Welch
cf332a2b20
Move DEBUG_TICKET action from forge ticket to it's own module inspect_ticket
2022-12-15 13:42:30 +00:00
ErikWynter
3c219c8a77
prevent .keys call on nil in log4shell_header_injection
2022-12-15 12:51:30 +02:00
Steffen Robertz
1b690283db
Unauthenticated RCE for multiple Zyxel Router
2022-12-15 11:50:48 +01:00
Ashley Donaldson
28bd03f971
Apply suggestions from code review
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2022-12-15 14:50:10 +11:00
Ashley Donaldson
57152fdd5f
Use framework's thread mechanism for background keepalive worker
2022-12-15 14:44:57 +11:00
Ashley Donaldson
89dd358d2d
Added unit test to check that HEAD responses don't hang
2022-12-15 14:34:01 +11:00
Jack Heysel
f015d1425a
Added update to common.h
2022-12-14 20:39:31 -05:00
Ashley Donaldson
bf307e552a
Resolves #14144 - expand ~ for hosts and notes commands
2022-12-15 12:31:25 +11:00
Ashley Donaldson
891ab225cc
Ignore Content-Length header for the purpose of HEAD requests
2022-12-15 11:22:48 +11:00
Ashley Donaldson
5716fd0f4d
Revert to use of set /p, but with dummy variable so that %errorlevel% is set to 0
2022-12-15 09:05:16 +11:00
Metasploit
e19d1b9231
automatic module_metadata_base.json update
2022-12-14 13:39:20 -06:00
Grant Willcox
d15ed9d2bd
Land #17370 , force mixin to utilize ruby_smb
2022-12-14 13:13:04 -06:00
dwelch-r7
243b9da3e6
Land #17344 , Update windows_secrets_dump and Keytab module to export kerberos keys
2022-12-14 15:03:15 +00:00
adfoster-r7
2783e92203
Update windows_secrets_dump and Keytab module to export kerberos keys
2022-12-14 13:40:39 +00:00
adfoster-r7
abcf4606a8
Land #17360 , document the kerberos forge_ticket DEBUG_TICKET action
2022-12-14 13:37:34 +00:00
cgranleese-r7
7face44638
Land #17379 , Merge 6.2.31 into kerberos feature branch
2022-12-14 13:34:36 +00:00
Metasploit
0032ba9e50
automatic module_metadata_base.json update
2022-12-14 07:08:11 -06:00
Christophe De La Fuente
2a28af208d
Land #16992 , Syncovery For Linux - Auth. RCE (CVE-2022-36534)
2022-12-14 13:43:00 +01:00
Metasploit
b76ed0f0ba
automatic module_metadata_base.json update
2022-12-14 06:04:56 -06:00
Christophe De La Fuente
9582411554
Land #16991 , Syncovery For Linux - Insecure Session Token Generation (CVE-2022-36536)
2022-12-14 11:30:47 +01:00
Ashley Donaldson
5fd6103a70
Use boolean output of write_file for cmd_upload
...
Also fixed powershell upload, which failed at around 20000 bytes per command.
I believe this is related to powerfun, which seems to truncate to 20000 bytes.
2022-12-14 20:46:31 +11:00
whoot
0f1e228f50
finalization
2022-12-14 08:59:53 +01:00
whoot
1f1b04e009
finalization
2022-12-14 08:38:20 +01:00
Jan Rude
0ae824e169
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-14 08:07:55 +01:00
Jan Rude
e16e689308
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-14 08:07:45 +01:00
Jan Rude
d6ba30adcf
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-14 08:07:35 +01:00
Jan Rude
911431c63b
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-14 08:07:24 +01:00
Ashley Donaldson
6ac1c305cc
Appropriate return values for windows (cmd and powershell) shells
2022-12-14 17:00:16 +11:00
Ashley Donaldson
b38af39660
Unix shell knows whether or not it has succeeded in writing or appending a file
2022-12-14 12:48:46 +11:00
adfoster-r7
28bd37b0a7
Update rasn1 dependency for pkinit
2022-12-14 00:32:26 +00:00
Ashley Donaldson
2f6c94b872
Update User Agent strings December 2022
2022-12-14 11:03:25 +11:00
Grant Willcox
f70f48c233
Land #17378 , Bump the version of msf-payload to 2.0.105
2022-12-13 16:58:52 -06:00
Grant Willcox
a63a98eea4
Bump the version of msf-payload to 2.0.105
2022-12-13 14:29:39 -06:00
adfoster-r7
a9ccfe31b7
Merge branch 'upstream-master' into merge-msf-6.2.31-into-kerberos-feature-branch
2022-12-13 19:40:39 +00:00
Metasploit
a653dbd51a
automatic module_metadata_base.json update
2022-12-13 12:16:12 -06:00
Christophe De La Fuente
d6a5590c06
Land #17265 , Add Exploit for CVE-2020-25736
2022-12-13 18:49:56 +01:00
cgranleese-r7
9b1513fca9
Land #17376 , Extract db command helpers to standalone module
2022-12-13 17:46:53 +00:00
adfoster-r7
f6ed9ef12d
Extract db command helpers to standalone module
2022-12-13 17:01:49 +00:00
Shelby Pace
0596620de7
Update modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-13 09:49:59 -06:00
Jan Rude
03a640fcec
Update modules/auxiliary/scanner/http/syncovery_linux_token_cve_2022_36536.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-13 16:06:42 +01:00
Jan Rude
f158cfaadd
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-13 16:05:56 +01:00
Jan Rude
c8e301224b
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-13 16:05:45 +01:00
Jan Rude
53cde6d2ef
Update modules/exploits/unix/http/syncovery_linux_rce_2022_36534.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-12-13 16:04:45 +01:00
dwelch-r7
fd555b218f
Land #17373 , Add ticket flags when outputting krb5 ccache
2022-12-13 12:46:25 +00:00
adfoster-r7
7625d4b08b
Add ticket flags when outputting krb5 ccache
2022-12-13 12:19:16 +00:00
Grant Willcox
c7ed5f4ba2
Land #17368 , Fix slow msfvenom payload generation for large payloads when outputting as hex format
2022-12-13 02:14:47 -06:00
Grant Willcox
5aaf159a50
Land #17364 , Bump docs ruby version to 3.0.5
2022-12-13 01:48:00 -06:00
Jack Heysel
2fa7e7b2d5
Lenovo Diagnostics Driver Privilege Escaltion (CVE-2022-3699)
2022-12-12 21:53:53 -05:00
Metasploit
69f47aa6a7
automatic module_metadata_base.json update
2022-12-12 17:09:12 -06:00
Spencer McIntyre
d09aef7dc5
Land #17350 , Remove unnecesary sleep
...
Remove unnecesary sleep in several bypassuac modules
2022-12-12 17:45:10 -05:00
space-r7
6885e576ed
add note about uninstalling the helper tool
2022-12-12 16:35:44 -06:00
Jeffrey Martin
0eec36200c
force mixin to utilize ruby_smb
...
When refactored recently the new code expects a `RubySMB` object
this ensures the client returned meets that expectation.
2022-12-12 16:14:09 -06:00
space-r7
cf9e54909c
use 2021 helper name in objective-c code too
2022-12-12 15:55:36 -06:00
space-r7
13a557013c
support 2021 version of software
...
specifically, the exploit will now search
for com.acronis.helpertool in addtion to the
2020 helper tool name. This also updates the
check() method to return CheckCode::Detected
for when we find the vulnerable service but
can't detect the build number
2022-12-12 15:53:35 -06:00
Spencer McIntyre
5a66666b4d
Fix check methods by using #present?
2022-12-12 16:53:34 -05:00
adfoster-r7
8013be1d07
Fix slow msfvenom payload generation for large payloads
2022-12-12 21:39:21 +00:00
Metasploit
f534168636
automatic module_metadata_base.json update
2022-12-12 13:46:17 -06:00
Spencer McIntyre
024fc87b4c
Land #17272 , Add F5 MCP post module
...
Add F5 MCP post module
2022-12-12 14:20:31 -05:00
Ron Bowes
5b1e37bf66
Merge pull request #2 from smcintyre-r7/pr/collab/17272
...
Store service credentials in the database
2022-12-12 10:10:03 -08:00
dwelch-r7
c9aab1201c
Land #17363 , Add enckrbkey database persistence support
2022-12-12 17:44:47 +00:00
Grant Willcox
2cb66a5c8b
Land #17355 , Update the creds command to allow viewing ssh key contents
2022-12-12 11:29:47 -06:00
adfoster-r7
1855306e14
Bump docs ruby version to 3.0.5
2022-12-12 17:28:29 +00:00
adfoster-r7
431bfdfc52
Add enckrbkey database persistence support
2022-12-12 17:19:17 +00:00
Spencer McIntyre
34451940c7
Fix uploading from shell sessions
2022-12-12 12:02:33 -05:00
Grant Willcox
c5439b85ef
Land #17361 , unlock concurrent-ruby
2022-12-12 10:36:48 -06:00
Grant Willcox
8a68111198
Land #17357 , Update docs site to support mermaid
2022-12-12 10:04:07 -06:00
npm-cesium137-io
d04111ad6f
solarwinds_orion_dump markdown update
...
Nuked the last embarrassing typo in the module description.
Updated the documentation to include detail on sqlcmd / CSV export
process when manually exporting the data.
2022-12-12 10:54:41 -05:00
Spencer McIntyre
59d4f9b7e9
Fix downloading from shells to a directory
...
Prior to this change if the destination argument issued to a shell
session's internal `download` command was a directory, the command would
crash and the shell would be lost.
2022-12-12 10:42:11 -05:00
Spencer McIntyre
a9cdb77a72
Use consistent casing and fix typos
2022-12-12 10:30:50 -05:00
Jeffrey Martin
60302e1f02
unlock concurrent-ruby
...
Version was locked due to yanked ver 1.1.0, this should have been unlocked long ago.
2022-12-12 08:58:22 -06:00
Spencer McIntyre
a80db73bab
Land #17325 , add impersonation for get_ticket
...
Enable the `get_ticket` module to impersonate a user with S4U2self and S4U2proxy
2022-12-12 09:10:37 -05:00
Dean Welch
4aaf540364
Add modules docs for TICKET_DEBUG
2022-12-12 13:39:09 +00:00
Christophe De La Fuente
86ec66c43d
Add decoding support
...
- for Rex::Proto::Kerberos::Model::Checksum
- for Rex::Proto::Kerberos::Model::PreAuthForUser
- add specs
2022-12-12 12:56:30 +01:00
adfoster-r7
fd3fb5f3a4
Update docs site to support mermaid
2022-12-11 01:22:30 +00:00
npm-cesium137-io
6eaa0bfab2
Add veeam_credential_dump post module
...
Post module for Veeam Backup and Replication / Veeam ONE Monitor Server
credential extract
2022-12-10 16:21:59 -05:00
adfoster-r7
2ea880c799
Show ssh key with verbose creds command
2022-12-10 00:08:54 +00:00
h00die
fc10a5c876
Merge pull request #21 from bwatters-r7/land-17258
...
Added purpose to License file for SharpHound
2022-12-09 17:38:31 -05:00
bwatters
cc3d5739ef
Added purpose to License file for SharpHound
2022-12-09 15:31:27 -06:00
Grant Willcox
c84b2a67d7
Land #17345 , Update report api to return nil when no active db
2022-12-09 14:02:28 -06:00
npm-cesium137-io
8075654f10
Revise solarwinds_orion_dump MKII
...
Fixed humiliating typos in the markdown doc.
Updated the Author section of the module per guidelines.
Changed credential type for AES key loot storage.
Updated database config code to include the case where the SQL password
is not encrypted (needs testing).
Additional tweaks and fixes.
2022-12-09 14:47:18 -05:00
Metasploit
90828ac2bb
automatic module_metadata_base.json update
2022-12-09 12:42:23 -06:00
Spencer McIntyre
d9b217e50b
Land #17351 , Fix bug in s4u_persistence module
...
Fix buggy default in s4u_persistence module
2022-12-09 13:16:53 -05:00
Grant Willcox
b65b0a7bc5
Land #17352 , Fixes crash in meterp when file_version asks for a file that doesn't exist
2022-12-09 12:10:29 -06:00
Grant Willcox
e29d9effba
Land #17346 , Update rspec thread counting logic
2022-12-09 10:32:55 -06:00
Jeffrey Martin
32a5c350cb
Land 17349, Update Ruby version to 3.0.5
2022-12-09 08:39:03 -06:00
whoot
771b7c58f9
change brute-forcer
2022-12-09 12:33:13 +01:00
Jan Rude
005d43f7d1
Merge branch 'rapid7:master' into syncovery_craftable_token
2022-12-09 09:34:42 +01:00
whoot
c1d090334c
apply suggestions
2022-12-09 09:31:20 +01:00
Ashley Donaldson
99e576d023
Fixes crash in meterp when file_version asks for a file that doesn't exist
2022-12-09 11:55:29 +11:00
Ashley Donaldson
8d097e0fd0
Fixes bug in s4u_persistence module
2022-12-09 11:24:16 +11:00
Ashley Donaldson
c54109586c
Remove unnecesary sleep in several bypassuac modules
2022-12-09 11:09:19 +11:00
Grant Willcox
f6beef9b23
Update Ruby version in Dockerfile
2022-12-08 14:59:58 -06:00
Grant Willcox
6126598d16
Update Ruby version to 3.0.5 from 3.0.2 to fix security issues and compatibility
2022-12-08 13:58:46 -06:00
Metasploit
9b62242974
automatic module_metadata_base.json update
2022-12-08 13:52:01 -06:00
Grant Willcox
70b9b94c23
Land #17255 , Add executable path for command payloads
2022-12-08 13:25:21 -06:00
JustAnda7
293a203a03
Added path option to cmd payloads
2022-12-08 12:19:31 -06:00
Metasploit
06b72a0b1c
Bump version of framework to 6.2.31
2022-12-08 12:12:22 -06:00
Metasploit
28cf7ea55c
automatic module_metadata_base.json update
2022-12-08 10:13:08 -06:00
Spencer McIntyre
dd3decb436
Land #17342 , Use LDAP_SERVER_SD_FLAGS_OID flag
...
Use LDAP_SERVER_SD_FLAGS_OID flag to prevent retrieving SACL as a non-admin user
2022-12-08 10:47:55 -05:00
Spencer McIntyre
2fc8b0a7a6
Add GitHub refereces to the patch details
2022-12-08 10:47:44 -05:00
adfoster-r7
46f7fc9288
Land #17313 , PAC Bindata Model + print ccache contents
2022-12-08 14:38:38 +00:00
Dean Welch
fc3bb585be
Move TypeSerialization1 to it's own file
2022-12-08 13:20:41 +00:00
Dean Welch
1e1580e346
Move TypeSerialization1 to it's own file
2022-12-08 13:11:47 +00:00
adfoster-r7
aba9cba9dd
Update rspec thread counting logic
2022-12-08 00:28:00 +00:00
adfoster-r7
8f22d24577
Update report api to return nil when no active db
2022-12-07 23:09:59 +00:00
Grant Willcox
e7b20ad155
Add in monkey patch to the search method of Net::LDAP::Connection to allow us to use controls when search whilst we await an upstream patch in Net::LDAP
2022-12-07 15:17:52 -06:00
Jeffrey Martin
115946cd06
Land #17339 , Weekly dependency updates for Gemfile.lock
2022-12-07 15:13:39 -06:00
Grant Willcox
77bda68932
Add in more constants for the SCAL flags and use them to make the code easier to read
2022-12-07 10:48:07 -06:00
npm-cesium137-io
2f3fd6c917
Revise solarwinds_orion_dump
...
Made modifications to documentation to add further detail for each
action.
Significant refactor of error handling, now with (hopefully) proper use
of exceptions.
Various suggested code improvements and optimization.
Fixed some redundant and buggy code.
2022-12-07 07:55:43 -05:00
Grant Willcox
e7d72e0ecf
Allow multiple controls to be specified
2022-12-06 23:21:48 -06:00
Grant Willcox
fd8bdf4daf
Make sure we use the LDAP_SERVER_SD_FLAGS_OID flag and set it to 7 when retrieving entries so that we don't retrieve the SACL, which cannot be retrieved by nonadmin users.
2022-12-06 22:54:03 -06:00
cn-kali-team
c81029a165
fix
2022-12-07 12:32:41 +08:00
cn-kali-team
7720119948
fix
2022-12-07 12:32:14 +08:00
三米前有蕉皮
bb3e5df6f5
Update modules/post/windows/gather/credentials/minio_client.rb
...
Co-authored-by: bcoles <bcoles@gmail.com >
2022-12-07 09:23:50 +08:00
三米前有蕉皮
9c94ce09da
Update modules/post/windows/gather/credentials/minio_client.rb
...
Co-authored-by: bcoles <bcoles@gmail.com >
2022-12-07 09:20:38 +08:00
space-r7
9c7355388c
add attackerkb link
2022-12-06 11:19:05 -06:00
Tod Beardsley
97a9fb6650
Update docs for Acronis module
...
Note that uninstalling the module doesn't necessarily uninstall the vulnerable service, so call that out to people who are testing this module so they have a chance to do more thorough cleanup after testing.
2022-12-06 11:08:31 -06:00
Heyder Andrade
cf6d5d3a14
It made the gadgets being used more readable
2022-12-06 17:47:49 +01:00
Metasploit
8fbb4d2fde
automatic module_metadata_base.json update
2022-12-06 09:03:45 -06:00
Christophe De La Fuente
e7e2849f6d
Land #17183 , Zimbra fixes
2022-12-06 15:38:37 +01:00
Christophe De La Fuente
ddaf5a3f0d
Remove unecessary return statement
2022-12-06 15:07:28 +01:00
Metasploit
ef31ab861f
automatic module_metadata_base.json update
2022-12-06 07:27:30 -06:00
Christophe De La Fuente
aaef7726db
Land #17330 , Fix enumerating emails via ProxyShell
2022-12-06 14:02:53 +01:00
Dean Welch
d239e9b007
Don't autoload krb5Pac
2022-12-06 13:01:47 +00:00
Dean Welch
1e2ada3cce
Add options validation depending on action in forge_ticket.rb
2022-12-06 12:55:42 +00:00
cn-kali-team
9b55f32474
MinIO_Client
2022-12-06 20:04:10 +08:00
Metasploit
009fd0deb5
automatic module_metadata_base.json update
2022-12-05 15:30:44 -06:00
Grant Willcox
d48319a867
Land #17242 , Add Gather Module for WP BookingPress Plugin unauth SQLi (CVE-2022-0739)
2022-12-05 15:04:31 -06:00
Grant Willcox
89009fa66e
Bump dependency versions
2022-12-05 14:48:02 -06:00
Grant Willcox
cb68c255bb
Fix up issues from review
2022-12-05 14:17:43 -06:00
Redouane NIBOUCHA
4b008d6ea8
revert the identify_hash line
2022-12-05 14:17:39 -06:00
Redouane NIBOUCHA
41edc92d5d
Update wp_bookingpress_category_services_sqli to use the SQLi library
2022-12-05 14:17:31 -06:00
Grant Willcox
1fec75621c
Fix up documentation from review
2022-12-05 14:04:22 -06:00
Jack Heysel
f29b4fad75
Add Gather Module for WP BookingPress Plugin SQLi (CVE-2022-0739)
2022-12-05 14:04:03 -06:00
Metasploit
e08b426537
automatic module_metadata_base.json update
2022-12-05 13:19:21 -06:00
bwatters
37540572e0
Land #17214 , add database functionality to vcenter post module
...
Merge branch 'land-17214' into upstream-master
2022-12-05 12:50:14 -06:00
Metasploit
2e4be42f57
automatic module_metadata_base.json update
2022-12-05 09:55:47 -06:00
bwatters
54cd055276
Land #17286 , CVE-2021-22015 vCenter priv esc
...
Merge branch 'land-17286' into upstream-master
2022-12-05 09:31:01 -06:00
Metasploit
085456eeaf
automatic module_metadata_base.json update
2022-12-05 08:07:19 -06:00
Dean Welch
405271a52f
Add pac BinData Model
2022-12-05 14:03:21 +00:00
Christophe De La Fuente
6e7d4edf02
Land #16990 , Syncovery for Linux - Login brute-force utility
2022-12-05 14:39:29 +01:00
h00die
373a97b099
add shaphound to license, sort license by file names
2022-12-05 08:33:27 -05:00
cgranleese-r7
8e9e8468f2
Land #17338 , Lint modules
2022-12-05 13:17:40 +00:00
adfoster-r7
7a46cff0a1
Land #17305 , Adds support to RPC for automatically choosing module payload defaults
2022-12-05 12:59:21 +00:00
Metasploit
dc604f1fcf
automatic module_metadata_base.json update
2022-12-05 06:31:39 -06:00
cgranleese-r7
4e539df3c3
Adds support to find default payloads
2022-12-05 11:52:11 +00:00
adfoster-r7
0d3c1dc122
Land #17333 , Fix typos: Replace 'the the' with 'the'
2022-12-05 11:46:27 +00:00
adfoster-r7
a4aff6537d
Land #17332 , enum_proxy - Cleanup and support non-Meterpreter sessions
2022-12-05 11:43:55 +00:00
adfoster-r7
14d05c9c6c
Lint modules
2022-12-05 10:41:31 +00:00
cn-kali-team
907612b41d
Dbeaver
2022-12-05 14:54:19 +08:00
Heyder Andrade
8aca86b816
Apply suggestions from code review
2022-12-04 17:29:05 +01:00
Heyder Andrade
5c3ac339d0
Apply suggestions from code review
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2022-12-04 12:13:50 +01:00
bcoles
c1ff9337c8
dnn_cookie_deserialization_rce: Remove empty 'Payload' Hash key
2022-12-04 17:50:24 +11:00
bcoles
431804ef15
Fix typos: Replace 'the the' with 'the'
2022-12-04 17:41:24 +11:00
bcoles
d90dee8235
enum_proxy: Cleanup and support non-Meterpreter sessions
2022-12-04 15:10:47 +11:00
RadioLogic
a3c82246a7
Added archer c7 traversal exploit
2022-12-03 20:03:11 -05:00
Spencer McIntyre
96da805014
Fix enumerating emails via ProxyShell
...
The ResolveNames endpoint used to gather emails addresses for targeting
only returns 100 at a time. This updates the module to check if the
search result contains all entries and when it does, it recurses into
itself with a refined search prefix. All results are returned to match
the original functionality instead of enumerating and halting once one
that's suitable for exploitation has been found.
2022-12-02 15:58:50 -05:00
whoot
04e5aa3033
apply suggestions
2022-12-02 16:05:01 +01:00
Christophe De La Fuente
c6f8bae1ab
Fix from code review and updates the KrbUseCachedCredentials logic
2022-12-02 15:28:08 +01:00
whoot
b32ec581d8
apply suggestions
2022-12-02 10:33:25 +01:00
Metasploit
364fb85e1d
automatic module_metadata_base.json update
2022-12-01 16:30:42 -06:00
Jack Heysel
271588bde9
Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master
2022-12-01 17:06:48 -05:00
Jack Heysel
04dc8e8455
Land #17310 , update checkvm post module
...
Add notes and add powershell to supported SessionTypes
2022-12-01 17:05:09 -05:00
Metasploit
a649c5b9d1
automatic module_metadata_base.json update
2022-12-01 15:54:53 -06:00
h00die
7ec7cdfb97
fix vcenter spec error
2022-12-01 16:43:58 -05:00
adfoster-r7
4207449382
Land #17323 , fix enlightenment check method
2022-12-01 20:26:16 +00:00
Christophe De La Fuente
69e08094cd
Update documentation
2022-12-01 21:23:25 +01:00
h00die
867059efe5
add super to cleanup command
2022-12-01 14:55:43 -05:00
Christophe De La Fuente
cc61a26668
Add S4U2Self and S4U2Proxy support to impersonate a user
2022-12-01 20:42:13 +01:00
h00die
62b484fdc7
blank over empty
2022-12-01 14:34:09 -05:00
Metasploit
fbc842693f
Bump version of framework to 6.2.30
2022-12-01 12:10:26 -06:00
Metasploit
03bb062c2e
automatic module_metadata_base.json update
2022-12-01 09:50:22 -06:00
bwatters
dcff4d37b6
Land #17163 , Pfsense PfBlockerNG RCE module check method improvement
...
Merge branch 'land-17163' into upstream-master
2022-12-01 09:25:18 -06:00
Metasploit
b9c18de4fe
automatic module_metadata_base.json update
2022-11-30 16:55:15 -06:00
adfoster-r7
13ab155545
Land #17322 , fix OpoenOffice description typo
2022-11-30 22:31:53 +00:00
h00die
039b611fae
fix enlightenment check method
2022-11-30 17:06:50 -05:00
Maik Ro
330cb2944b
fix typo
...
OptString.new('FILENAME', [true, 'The OpoenOffice Text document name', 'msf.odt']) -> OpoenOffice changed to OpenOffice
2022-11-30 22:10:18 +01:00
Metasploit
07a91df7a1
automatic module_metadata_base.json update
2022-11-30 11:43:21 -06:00
Christophe De La Fuente
d3057f15b2
Land #17275 , Add Exploit For CVE-2022-41082 (ProxyNotShell)
2022-11-30 18:16:19 +01:00
Spencer McIntyre
d491c10d22
Store service credentials in the database
2022-11-30 11:59:10 -05:00
Ashley Donaldson
2d397d37db
Removed warning that I think was actually just a bug - now fixed
2022-11-30 13:14:19 +11:00
Ashley Donaldson
0323d45737
More correct approach to encoding for command line
2022-11-30 11:54:42 +11:00
Ashley Donaldson
5fce80ed1d
Added comments to most functions
2022-11-30 11:53:57 +11:00
Ashley Donaldson
3a93fcb404
Rubocop'd
2022-11-30 11:32:23 +11:00
Ashley Donaldson
97aef31180
Removed vestigial code while we're at it
2022-11-30 11:31:27 +11:00
Ashley Donaldson
1231eefe55
Fixed WQL module while I'm at it
2022-11-30 10:26:19 +11:00
Ashley Donaldson
0d68ec5d1b
Fix formatting of winrm_script_exec
2022-11-30 07:48:30 +11:00
Ashley Donaldson
6a040e2ee5
#11456 Winrm Script Exec works again
2022-11-30 07:39:38 +11:00
Spencer McIntyre
013679d475
Land #17311 , Add Kerberos pkinit error codes
2022-11-29 13:19:03 -05:00
Spencer McIntyre
2daf11d521
Land #17309 , Fix Kerberos get ticket module
...
Fix crash in kerberos get ticket module
2022-11-29 13:17:16 -05:00
Heyder Andrade
704cee436b
Apply suggestions from code review
2022-11-29 15:25:14 +01:00
Heyder Andrade
c1236500f1
Apply suggestions from code review
...
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com >
2022-11-29 14:12:39 +01:00
adfoster-r7
750192afa4
Add pkinit error codes
2022-11-29 10:36:10 +00:00
bcoles
60180a4442
checkvm: Add notes and add powershell to supported SessionTypes
2022-11-29 21:28:15 +11:00
adfoster-r7
34d1b5b37e
Fix crash in kerberos get ticket module
2022-11-29 10:17:21 +00:00
Metasploit
35bbfc8af4
automatic module_metadata_base.json update
2022-11-28 15:47:01 -06:00
Spencer McIntyre
8ea8e2410d
Land #17299 , Fixes #17227
...
Fixes #17227 - polkit_dbus_auth_bypass module when run from a command…
2022-11-28 16:22:52 -05:00
Metasploit
8a66a359a6
automatic module_metadata_base.json update
2022-11-28 15:16:21 -06:00
adfoster-r7
a12090c566
Land #17308 , Fix the DH key construction for OpenSSL3
2022-11-28 21:03:52 +00:00
Jack Heysel
5d3cfa69b8
Land #17210 , add ParseError rescue to snmp modules
...
snmp_enum, snmp_enumshares and snmp_enumusers now rescue
SNMP ParseErrors
2022-11-28 15:37:02 -05:00
bwatters
3462dc6bf4
Land #17087 , remote control collection rce
...
Merge branch 'land-17087' into upstream-master
2022-11-28 14:29:52 -06:00
Spencer McIntyre
cd828a82c8
Fix the DH key construction for OpenSSL3
2022-11-28 14:54:10 -05:00
Spencer McIntyre
abe0549db6
Land #17226 , Module to request TGT/TGS tickets
...
Module to request TGT/TGS Kerberos tickets from the KDC
2022-11-28 11:59:17 -05:00
Spencer McIntyre
264d45e04a
Appease rubocop
2022-11-28 10:16:55 -05:00
Spencer McIntyre
f24df8a051
Change an exception class and drop DOMAIN passing
2022-11-28 10:06:14 -05:00
Spencer McIntyre
009c6c5350
Add the MaxBackendRetries datastore option
2022-11-28 09:45:04 -05:00
Heyder Andrade
ff63f0aa32
Added reference
2022-11-28 14:11:07 +01:00
Metasploit
c49dd0b6cd
automatic module_metadata_base.json update
2022-11-27 14:27:39 -06:00
adfoster-r7
de75f0ecbe
Land #17304 , added target uri in to "Authorization not requested" error message
2022-11-27 20:04:00 +00:00
omer citak
9aa1a84b3a
added target uri in to "Authorization not requested" error message
2022-11-27 15:35:34 +03:00
RadioLogic
6d676e9ac5
Added vsftpd dos module
2022-11-26 16:00:01 -05:00
Ashley Donaldson
638a1c8f78
Prevent double-delimiter situations in general
2022-11-25 15:32:55 +11:00
Ashley Donaldson
25a0d0ff0e
Fixes #17227 - polkit_dbus_auth_bypass module when run from a command shell
2022-11-25 15:13:57 +11:00
adfoster-r7
c218063a1a
Land #17280 , Weekly dependency updates for Gemfile.lock
2022-11-24 23:11:49 +00:00
ErikWynter
78dfaa12ef
add opentsdb_yrange_cmd_injection module and docs
2022-11-24 21:37:24 +02:00
Metasploit
ed954eec0c
Bump version of framework to 6.2.29
2022-11-24 12:09:06 -06:00
adfoster-r7
0aa0884e26
Land #17296 , add warning about external links
2022-11-24 10:30:44 +00:00
Metasploit
c9ba07e3a7
automatic module_metadata_base.json update
2022-11-23 17:20:29 -06:00
Spencer McIntyre
6350daf2d8
Land #17273 , F5 exploit module CVE-2022-41800
...
F5 exploit module CVE-2022-41800 (authenticated RCE in RPM code)
2022-11-23 17:57:18 -05:00
Ron Bowes
b7cf112d42
Fix an issue where the session handler would close too early on Zimbra modules
2022-11-23 13:09:47 -08:00
Ron Bowes
ffbf8b303a
Change a 'return 0' to 'fail_with', per Christophe's request
2022-11-23 12:51:51 -08:00
Ron Bowes
28a68ede8c
Merge branch 'master' into zimbra-fixes
2022-11-23 12:50:56 -08:00
Ron Bowes
e981dde15f
Move the mcp-objects out of the class and into a data/ file (per Jeffrey's request)
2022-11-23 12:49:00 -08:00
Spencer McIntyre
3805a79079
Add support for Exchange Data Access Group (DAG)
...
This updates the HttpSsrf class to retry requests to the Powershell
backend when they fail because they were routed to a new server. Now
when the transport is initialized, it will store the backend used by the
first successful request.
2022-11-23 15:37:58 -05:00
Jeffrey Martin
453cfc5939
spelling change per review
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2022-11-23 13:26:19 -06:00
Ron Bowes
aa3d8be77c
Remove Targets
2022-11-23 11:11:35 -08:00
Ron Bowes
4fd22226fe
Combine into one module with options to turn features on/off
2022-11-23 11:10:34 -08:00
Ron Bowes
cbb50ed902
Remove non-functioning Arch'es
2022-11-23 10:42:07 -08:00
Jeffrey Martin
cb8e023734
add warning about external links
...
Links to external resources not controlled by the project maintainers
are subject to bitrot and malicious take over. Warnings seem appropriate.
2022-11-23 12:08:05 -06:00
Spencer McIntyre
3f58bfe11e
Check that the target is Exchange Server 2019
2022-11-23 10:47:10 -05:00
Spencer McIntyre
45391b1714
Land #17279 , ducky-script format for msfvenom
...
ducky-script format for msfvenom (flipper zero compatible)
2022-11-23 09:05:57 -05:00
Jiashuo Liang
d32df1d3dc
Fix linux reverse_tcp_x64 rdx register value
2022-11-23 19:36:37 +08:00
Heyder Andrade
27f8f4fc47
Cleanup
2022-11-23 01:55:06 +01:00
Heyder Andrade
7880530989
The check method should report when finding a vulnerable product.
...
I think all exploit modules should "report" in the check method when finding a vulnerable
product. By doing that we can take advantage of all check methods in the exploit module
and use them as a "scanner". That would give the chance for the user to check multiple
simultaneously targets and save the result for further actions.
2022-11-23 01:29:38 +01:00
Heyder Andrade
0e5f8d49f9
Code cleanup and payload generation improvements
2022-11-23 00:29:10 +01:00
Heyder Andrade
13a3d9d1ca
Added documentation
2022-11-23 00:19:25 +01:00
h00die
b866917ee1
review
2022-11-22 16:57:01 -05:00
Spencer McIntyre
2265370c5f
Land #17288 , Add #bit_names to MsDtypAccessMask
...
Support for Windows Access mask to MsDtypAccessMask
2022-11-22 09:01:16 -05:00
Metasploit
0af1f95f5a
automatic module_metadata_base.json update
2022-11-22 06:52:15 -06:00
adfoster-r7
6446c1425b
Land #17283 , enum_psk: Cleanup
2022-11-22 12:28:55 +00:00
adfoster-r7
6c76fd7beb
Land #17284 , modules/post/linux/gather: Use Post::Linux::System.get_hostname method
2022-11-22 11:55:47 +00:00
adfoster-r7
390e58958c
Land #17285 , tor_hiddenservices - check locate command exists
...
: Check locate command exists
2022-11-22 11:42:50 +00:00
Heyder Andrade
7983c14166
Removed a bunch of hard-coded stuff and cleaned out fake smart server
2022-11-22 12:07:55 +01:00
JustAnda7
28157b677b
Support for Access Mask in MsDtypAccess
2022-11-22 04:50:54 -05:00
h00die
637ad5f809
make ducky more psh friendly
2022-11-21 17:55:48 -05:00
h00die
7227bec259
set autocheck false
2022-11-21 15:53:37 -05:00
bwatters
8c9e2c9fc7
Add check method, update hosting IP/port
2022-11-21 15:53:37 -05:00
h00die
d141efcbfe
screen effects
2022-11-21 15:53:37 -05:00
h00die
181b8e4eea
review comments
2022-11-21 15:53:37 -05:00
h00die
d4536b24a6
remote control collection rce
2022-11-21 15:53:37 -05:00
Spencer McIntyre
de8a396b3a
Land #17277 , Fix python reverse http stager crash
2022-11-21 12:41:25 -05:00
Spencer McIntyre
ed99f2f67f
Bypass EEMS M1
2022-11-21 11:13:16 -05:00
h00die
6877304bac
exploit for cve-2021-22015 vcenter priv esc
2022-11-20 11:29:49 -05:00
bcoles
651dd68439
tor_hiddenservices: Check locate command exists
2022-11-21 01:07:50 +11:00
bcoles
2dbd2043ec
modules/post/linux/gather: Use Post::Linux::System.get_hostname method
2022-11-21 00:46:44 +11:00
bcoles
ad36f28ec1
enum_psk: Cleanup
2022-11-21 00:28:34 +11:00
Heyder Andrade
3d73f574d4
Impreve error handling
2022-11-20 12:10:04 +01:00
Heyder Andrade
a05cbdbc30
Impreve error handling
2022-11-20 12:09:05 +01:00
h00die
5e93ed3bae
explicit check of CVE-2022-22948
2022-11-19 10:37:36 -05:00
h00die
40f97995f8
review comment
2022-11-19 10:37:36 -05:00
h00die
f12c660652
review comments
2022-11-19 10:37:36 -05:00
h00die
7a795c5adb
docs
2022-11-19 10:37:36 -05:00
h00die
9a19c4411d
wrap up module additions
2022-11-19 10:37:36 -05:00
h00die
dff9b35d56
add database stuff to vcenter post module
2022-11-19 10:37:36 -05:00
Heyder Andrade
c9eaa9af37
Added module for #CVE-2022-2992
2022-11-19 15:21:31 +01:00
Heyder Andrade
34d191b06c
Added Ruby serialized payload generator
2022-11-19 15:20:49 +01:00
Heyder Andrade
f1b97de78d
Added Gitlab mixin
2022-11-19 15:19:29 +01:00
Metasploit
234949bff8
automatic module_metadata_base.json update
2022-11-18 19:52:50 -06:00
Grant Willcox
8ca7550062
Land #17257 , Adding exploit for ChurchInfo 1.2.13-1.3.0 RCE (CVE-2021-43258)
2022-11-18 19:27:10 -06:00
Grant Willcox
237eb904d4
Add in fixes for documentation examples and then update the code to fix some bugs
2022-11-18 18:30:07 -06:00
Grant Willcox
713323f2cb
Add in Docker setup documentation
2022-11-18 18:22:11 -06:00
Grant Willcox
85a6770973
Add additional checks, a check method, and fix up some doc errors
2022-11-18 18:22:06 -06:00
m4lwhere
b9ecdb3bc2
Use TARGETURI, registered cleanup, implment cookie_jar, and perform response checks and documentation
2022-11-18 18:21:27 -06:00
m4lwhere
a33a313544
Adding exploit for ChurchInfo 1.3.0
2022-11-18 18:21:08 -06:00
Metasploit
2f2708e3fd
automatic module_metadata_base.json update
2022-11-18 16:42:50 -06:00
Spencer McIntyre
bc89721d7a
Add module docs, fix ProxyShell versions
2022-11-18 17:42:27 -05:00
Jeffrey Martin
f6bdbbd359
Weekly dependency updates for Gemfile.lock
2022-11-18 16:24:55 -06:00
space-r7
3d5708e3e6
Land #17271 , add f5 big-ip csrf exploit
2022-11-18 16:19:09 -06:00
space-r7
8b30ff3dce
remove CmdStager inclusion
2022-11-18 16:18:25 -06:00
h00die
29b7fa5336
ducky_script format for msfvenom
2022-11-18 17:02:52 -05:00
Spencer McIntyre
29d57dde66
Consolidate into ProxyMaybeShell
2022-11-18 17:01:01 -05:00
Spencer McIntyre
fc7594dbc8
Add exploit for CVE-2022-41082 AKA ProxyNotShell
2022-11-18 17:00:27 -05:00
Metasploit
e43951158c
automatic module_metadata_base.json update
2022-11-18 10:40:12 -06:00
bwatters
20e1788d97
Land #17145 , Add hashes option and better error handling to wmiexec
...
Merge branch 'land-17145' into upstream-master
2022-11-18 10:16:33 -06:00
npm-cesium137-io
6f885ba700
Add solarwinds_orion_dump post module
...
Post module for extracting encrypted credentials from SolarWinds Orion
NPM. Tested on the 2020 version.
2022-11-18 10:40:10 -05:00
adfoster-r7
7dcf65d7c3
Fix python reverse http stager crash
2022-11-18 14:32:36 +00:00
Christophe De La Fuente
0c05e82868
Land #17240 , Update icpr_cert for requesting certs on behalf of users
2022-11-18 11:58:56 +01:00
Christophe De La Fuente
5280580c08
Fixes from code review
2022-11-18 11:02:32 +01:00
space-r7
162b0daf3b
add new options and usage of pre-compiled exploit
...
also updates documentation with new option
descriptions
2022-11-17 17:20:41 -06:00
space-r7
d8f2b50b07
add compiled exploit and source
2022-11-17 17:16:08 -06:00
h00die
496a6f74ff
remove verbiage of list
2022-11-17 16:49:11 -05:00
Metasploit
39da40e4b5
Bump version of framework to 6.2.28
2022-11-17 12:21:32 -06:00
space-r7
ea486169b4
use erb template for objective-c code
2022-11-17 11:55:19 -06:00
Spencer McIntyre
41f9ba57b4
Add icpr_cert module specs
2022-11-17 12:12:35 -05:00
Spencer McIntyre
b2f6f0c792
Update the module docs for ESC2 and ESC3
2022-11-17 12:12:35 -05:00
Spencer McIntyre
f4a65a220a
Support ON_BEHALF_OF in icpr_cert
...
Add the code necessary to request certificates on behalf of other users.
This is necessary to exploit templates vulnerable to ESC2 and ESC3.
2022-11-17 12:12:35 -05:00
Spencer McIntyre
054878242a
Update ruby_smb gem to 3.2.1
2022-11-17 12:12:35 -05:00
Shelby Pace
f8dff82a78
Update modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
...
Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com >
2022-11-17 10:29:49 -06:00
Ron Bowes
93cba95170
Add URLs
2022-11-16 12:23:47 -08:00
Ron Bowes
6a8b94ee42
Merge branch 'f5-post-modules' into f5-createuser-privesc
2022-11-16 12:23:02 -08:00
Ron Bowes
c01c4c3cdd
Add URLs
2022-11-16 12:22:17 -08:00
Ron Bowes
7ebf84c66b
Add URLs
2022-11-16 12:20:37 -08:00
Ron Bowes
20e6c1b55e
Add URLs
2022-11-16 12:19:16 -08:00
Ron Bowes
fc579fe3f4
Add a privesc module for F5, using the MCP protocol
2022-11-16 12:12:16 -08:00
Ron Bowes
944fd07502
Add three post-modules and a mixin for communicating with F5's MCP
2022-11-16 12:09:58 -08:00
Ron Bowes
d0e109b842
Check in exploit module for CVE-2022-41800
2022-11-16 12:04:18 -08:00
Ron Bowes
99e661cfcf
Check in exploit script for CVE-2022-41622 (CSRF into SOAP)
2022-11-16 11:58:15 -08:00
space-r7
486e469682
add new reference
2022-11-16 10:32:08 -06:00
space-r7
27d4f45e09
add documentation and exploit file
2022-11-15 12:55:00 -06:00
space-r7
383e121f20
add FileDropper usage and module description
2022-11-15 12:37:39 -06:00
space-r7
e0c693c5a8
add objective-c code and pid code
2022-11-14 17:57:39 -06:00
h00die
f6eba6a836
updated bloodhound module
2022-11-13 14:29:28 -05:00
h00die
7abbdbe567
bloodhound module working with exe with sharphound v4
2022-11-13 10:26:15 -05:00
space-r7
8e59cac3a8
add check and exploit methods
2022-11-11 17:56:13 -06:00
adfoster-r7
8efc6c5304
Land #17103 , Consolidate KdcOptionFlags and TicketFlags
2022-11-09 17:27:17 +00:00
Dean Welch
7c2134d941
Consolidate KdcOptionFlags and TicketFlags
2022-11-09 17:08:26 +00:00
adfoster-r7
65f6aaca82
Land #17077 , Add support for AES keys for silver/golden ticket forging
2022-11-09 16:51:11 +00:00
Dean Welch
23ff829e52
Add support for AES keys for silver/golden ticket forging
2022-11-09 13:01:13 +00:00
Christophe De La Fuente
37fd441b0f
Land #17117 , Authenticate to Kerberos with PKINIT
2022-11-08 18:54:03 +01:00
Spencer McIntyre
e70861fc87
Land #17239 , Fix broken kerberos login module
2022-11-08 11:21:17 -05:00
adfoster-r7
30fe07801b
Fix broken kerberos login module
2022-11-08 15:49:21 +00:00
adfoster-r7
4c4762a84c
Land #17045 , Add module for converting kerberos ticket formats
2022-11-07 23:54:44 +00:00
Christophe De La Fuente
946eb1e546
Add documentation
2022-11-07 20:19:43 +01:00
Dean Welch
ee46d18505
Add yard docs and address review comments
2022-11-07 12:10:01 +00:00
Dean Welch
a110465fe4
Add module for converting kerberos ticket formats
2022-11-07 12:10:01 +00:00
Christophe De La Fuente
eb051ec9a7
Add get_ticket module
2022-11-04 18:46:47 +01:00
Spencer McIntyre
c6a1146314
Upgrade from RASN1 v0.10.0 to v0.11.0
...
This upgrades the RASN1 library to the latests as of today and fixes
compatibility issues. The issue introduced by v0.11 was that types are
initialized with an `options` hash, which the Name class was not set to
accept.
2022-11-03 12:22:16 -04:00
Spencer McIntyre
6e453a3f4f
Fix a bug in #extract_user_and_realm
...
While iterating over asn_san_seq, if the tag doesn't match either of the
two conditions, user and domain will be nil which leads to a problem
later on.
2022-11-03 10:51:52 -04:00
ErikWynter
771b66f570
update fork and rebase feature branch
2022-11-03 12:07:08 +02:00
ErikWynter
0065cff169
add rescuing for SNMP::ParseError to snmp enum modules
2022-11-03 12:04:33 +02:00
Spencer McIntyre
e00cab3f11
Land #17084 , Add Kerberos keytab module
2022-11-02 12:01:03 -04:00
adfoster-r7
e647bf8620
Namespace krb5 models
2022-11-02 13:04:52 +00:00
adfoster-r7
1307f01b76
Align with keytab instead of key_tab
2022-11-02 13:04:51 +00:00
adfoster-r7
98d2633859
Add Kerberos ktutil module
2022-11-02 13:04:50 +00:00
cgranleese-r7
725a3d50c7
Land #17208 , Merge 6.2.25 master into kerberos feature branch
2022-11-02 12:52:19 +00:00
adfoster-r7
7774b7ddcf
Merge remote-tracking branch 'upstream/master' into merge-6.2.25-master-into-kerberos-feature-branch
2022-10-31 23:15:11 +00:00
Spencer McIntyre
b6d46fbf5d
Land #17175 , kerberos support in smb_login
2022-10-28 13:58:18 -04:00
Spencer McIntyre
edf211e374
Set proof to the Kerberos error
2022-10-28 13:55:44 -04:00
Christophe De La Fuente
4ec7eea436
Fixes from code review
2022-10-28 15:33:34 +02:00
Ron Bowes
4624031aec
Remove errant puts
2022-10-25 10:21:47 -07:00
Ron Bowes
4979c0b74f
Add a check to the cve-2022-30333 module for Zimbra that aborts before generating artifacts if the server cannot be reached
2022-10-25 10:05:16 -07:00
Ron Bowes
ab2042f34e
Add patch notes to the Slapper module documentation
2022-10-25 10:04:52 -07:00
Ron Bowes
3ac3fa6c32
Move the Zimbra Slapper doc to the right folder (Windows -> Linux)
2022-10-25 09:51:27 -07:00
Jack Heysel
d6f27a8a71
Used vuln to remove test webshell in check method
2022-10-24 14:17:21 -04:00
Christophe De La Fuente
f1639797b9
Rubocop updates
2022-10-21 17:17:06 +02:00
Christophe De La Fuente
52904b8cb6
Add support to Kerberos
...
- Add kerberos authenticator to `scanner/smb/smb_login` and the
corresponding login scanner library
- Add new options: `UseCachedCredentials` and `StoreCredentialCache`
- Add `use_cached_credentials` attribute to
Kerberos::ServiceAuthenticator::Base. This enables/disables the use of
cached Kerberos credentials from the database.
- Add `store_credential_cache` attribute to
Kerberos::ServiceAuthenticator::Base. This enables/disables storing
Kerberos TGS MIT Credential Cache to the database.
2022-10-21 16:16:10 +02:00
Jack Heysel
11936affd1
Rubocop
2022-10-19 22:07:50 -04:00
Jack Heysel
b60b440697
Check method improvement
2022-10-19 22:03:43 -04:00
Ashley Donaldson
16a547d9ed
Moved all PKINIT structures into the one file
2022-10-17 18:34:30 +11:00
Ashley Donaldson
09e740d48d
Changes from code review
2022-10-17 17:19:50 +11:00
Matthew Dunn
4cda8a9d23
Add hashes and better error handling to wmiexec
2022-10-15 16:42:30 -04:00
Ashley Donaldson
c7bab60a3e
Fix to support DNS entries in certificate files
2022-10-07 15:17:07 +11:00
Ashley Donaldson
aa98c9d004
Removed vestigial test
2022-10-07 14:29:20 +11:00
Ashley Donaldson
80bb1867bc
Added documentation for the module
2022-10-07 14:24:37 +11:00
Ashley Donaldson
db12c7e0f0
Added tests for parsing new Kerberos structures
2022-10-07 14:04:24 +11:00
Ashley Donaldson
793a05f9f3
Added comments for new functions
2022-10-07 11:55:47 +11:00
Ashley Donaldson
b5a076a1f1
Neaten parameter and error handling
2022-10-07 11:24:39 +11:00
Ashley Donaldson
063a768959
Store ccache
2022-10-07 09:56:11 +11:00
Ashley Donaldson
58c30f10aa
Send and Receive PKINIT responses
2022-10-07 01:04:10 +11:00
adfoster-r7
e2ce631709
Land #17019 , Update CCache Reuse for TGTs (and Golden Tickets)
2022-10-05 11:40:25 +01:00
Spencer McIntyre
5d88a28fa4
Update YARD docs for TGT reuse
2022-10-03 09:04:30 -04:00
Spencer McIntyre
421121736d
Load and use cached TGTs
2022-09-30 13:23:52 -04:00
Spencer McIntyre
a619303f2c
Save tickets in a compatible way for retrieval
2022-09-30 13:23:52 -04:00
Spencer McIntyre
acbe644588
Document some of the parameter types
2022-09-30 13:23:52 -04:00
Spencer McIntyre
82912aad38
Support delegation from stored TGTs
2022-09-30 13:23:52 -04:00
Spencer McIntyre
081d66330b
Add a constructor method for Krb5Ccache
2022-09-30 13:23:52 -04:00
Spencer McIntyre
89c3792886
Allow authenticating with stored TGTs
2022-09-30 13:23:52 -04:00
Spencer McIntyre
6bd9de43d6
Add the #request_service_ticket method
2022-09-30 13:23:52 -04:00
Spencer McIntyre
c89d0a7b02
Land #17079 , Merge latest master
...
Merge latest master into Kerberos feature branch
2022-09-29 13:10:06 -04:00
adfoster-r7
5d345e6689
Merge branch 'upstream-master' into feature-kerberos-authentication
2022-09-29 16:42:58 +01:00
adfoster-r7
6cd2c6a82d
Land #17025 , Allow user_id to be configurable in ticket forging
2022-09-27 13:53:36 +01:00
cgranleese-r7
50685161ef
Allow user_id to be configurable in ticket forging
2022-09-22 14:18:17 +01:00
Jan Rude
2e5349b27f
use vars_get
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 13:50:44 +02:00
Jan Rude
f7c11eb84f
use correct CheckCode
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 13:49:41 +02:00
Jan Rude
ee67186488
compare rex::Version
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 13:47:58 +02:00
Jan Rude
f260636975
use safe navigation operator
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 13:47:04 +02:00
Jan Rude
6fe487c4b8
use one liner
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 13:46:02 +02:00
Jan Rude
e5e312199a
use correct checkcode
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 13:45:29 +02:00
Jan Rude
62e0500729
Update syncovery_file_sync_backup.rb
2022-09-16 13:38:37 +02:00
jrude
8f6fd55d9f
add review suggestions
2022-09-16 13:34:06 +02:00
Jan Rude
2fc637438f
use safe navigation operator
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 11:25:04 +02:00
Jan Rude
8332bff1d8
use correct if statement
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 11:21:35 +02:00
Jan Rude
2eb4c27d0c
remove unused proof
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2022-09-16 11:21:11 +02:00
Spencer McIntyre
3e65ba49ef
Land #16976 , Add documentation for ticket forging
...
Add documentation for kerberos ticket forging
2022-09-15 09:02:40 -04:00
Spencer McIntyre
c5c4cc0ebb
Fix a small doc typo left over from the rename
2022-09-15 08:58:16 -04:00
adfoster-r7
3891413f92
Update documentation
2022-09-14 17:20:57 +01:00
Jan Rude
476f18ff1f
add disclosure date
2022-09-12 10:07:02 +02:00
jrude
70ccbd8079
inform user about IOC
2022-09-12 09:30:50 +02:00
Jan Rude
fa2f2e6d5d
linting
...
This is getting ridiculous...
2022-09-08 19:51:56 +02:00
Jan Rude
d64719927b
linting
2022-09-08 19:42:31 +02:00
Jan Rude
25757d45be
linting again...
2022-09-08 19:36:17 +02:00
jrude
9ce9c63a03
use json
2022-09-08 19:24:41 +02:00
jrude
b649e26d84
corrections
2022-09-08 19:09:35 +02:00
Jan Rude
3179fc11b3
use json parser
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2022-09-08 17:55:48 +02:00
Jan Rude
8ba86a646c
linting
2022-09-08 11:28:27 +02:00
Jan Rude
b0a6c60684
linting
2022-09-08 11:15:08 +02:00
Jan Rude
4fc898e347
Update syncovery_linux_token_cve_2022_36536.rb
2022-09-08 11:03:25 +02:00
jrude
6fe97a8e74
linting
2022-09-08 08:50:50 +02:00
Jan Rude
90447d1832
Update syncovery_linux_rce_2022_36534.rb
2022-09-07 20:28:10 +02:00
Jan Rude
257d503525
Update syncovery_linux_rce_2022_36534.rb
2022-09-07 20:21:20 +02:00
Jan Rude
868f3d940c
use vars_get
2022-09-07 20:16:40 +02:00
Jan Rude
0fb289aa7b
Update syncovery_linux_rce_2022_36534.rb
2022-09-07 16:31:54 +02:00
jrude
01556b22d5
Syncovery For Linux - Auth. RCE (CVE-2022-36534)
2022-09-07 13:34:48 +02:00
jrude
8cf9af812b
Syncovery Insecure Session Token Generation (CVE-2022-36536)
2022-09-07 13:17:22 +02:00
Jan Rude
9cb136a209
Wording
2022-09-07 13:15:36 +02:00
jrude
1757a5dedf
Syncovery login brute-force utility
2022-09-07 12:46:32 +02:00
adfoster-r7
edef4022cd
Add documentation for kerberos ticket forging
2022-09-02 16:36:40 +01:00
adfoster-r7
e4c9721a32
Land #16707 , Add Silver and Golden ticket forging module
2022-09-02 11:29:36 +01:00
dwelch-r7
5f85175f56
Add module for golden/silver ticket forging
2022-09-01 16:12:07 +01:00
Christophe De La Fuente
223f21b114
Land #16770 , Kerberos CCache File Reuse
2022-08-18 19:18:27 +02:00
Spencer McIntyre
596fae611f
Fix an issue caused my a missing renew_till field
...
When #renew_till is nil, the encoding will fail. This should be encoded
as 0 in this case.
2022-08-18 11:35:39 -04:00
Spencer McIntyre
009ada3cc4
Fix issues from the rebase
2022-08-18 11:35:29 -04:00
Spencer McIntyre
7da5f2ad4a
Changes from PR feedback
2022-07-28 16:05:22 -04:00
Spencer McIntyre
1ed064c1ea
Log when a cached credential is used
2022-07-28 16:03:24 -04:00
Spencer McIntyre
52e84fa328
Add explicit ticket support for WinRM modules
2022-07-28 16:03:24 -04:00
Spencer McIntyre
942259d44b
Add logging for why credentials are filtered
2022-07-28 16:03:24 -04:00
Spencer McIntyre
95d8b7005e
Allow reusing cached and explicit CCACHE files
2022-07-28 16:03:22 -04:00
adfoster-r7
93ad8ae232
Land #16760 , Send delegated credentials using WinRM
2022-07-27 17:08:29 +01:00
Ashley Donaldson
f16e2cfb35
Send TGT to WinRM to allow further access of network resources (kerberos double hop)
2022-07-27 16:19:09 +01:00
Spencer McIntyre
1e903807bb
Land #16730 , Add mssql Kerberos auth support
2022-07-15 15:00:14 -04:00
adfoster-r7
37f7c15b1e
Update mssql login module to support kerberos authentication
2022-07-15 17:33:54 +01:00
adfoster-r7
f2ff7bb913
Add mssql kerberos authentication
2022-07-15 17:26:10 +01:00
adfoster-r7
9579e355c1
Land #16749 , Add winrm kerberos authentication support
2022-07-15 16:24:36 +01:00
adfoster-r7
f404fd9abe
Land #16700 , LDAP Kerberos and NTLM authentication
2022-07-11 13:27:55 +01:00
Ashley Donaldson
39f90d95b1
Create sessions for winrm_login successes.
...
Reuses the connection, so that authentication doesn't need to happen again
2022-07-08 16:57:09 +10:00
Ashley Donaldson
d3e7152954
Changes from code review
2022-07-08 11:47:54 +10:00
Spencer McIntyre
ade10650a8
Set the NTLM flags for LDAP authentication
...
The sign and seal flags need to be removed for LDAP. Because sign and
seal are not set, key56 and key128 can also be removed.
The rest of the flags are taken from
https://github.com/rapid7/ruby_smb/blob/cc5228730f9bc39215322ab6e07fd8da33602bb9/lib/ruby_smb/ntlm.rb#L31
2022-07-07 13:20:34 -04:00
Ashley Donaldson
f9f3be3644
Fix unit tests
2022-07-07 18:04:22 +10:00
Ashley Donaldson
b2eb348d94
Added WinRM using Kerberos, including encryption
2022-07-07 13:17:09 +10:00
Spencer McIntyre
b8ca08d3ce
Support NTLM and kerberos auth in LDAP
2022-07-06 17:12:27 -04:00
Spencer McIntyre
cfc24b3625
Land #16670 , Add initial smb kerberos auth support
2022-07-06 15:48:56 -04:00
Spencer McIntyre
4abef7d373
Remove an unused option and require SmbRhostname
2022-07-06 15:16:50 -04:00
Spencer McIntyre
e53bccae85
Set the session key for older SMB dialects too
2022-07-06 15:16:40 -04:00
adfoster-r7
aea37f7137
Add initial SMB Kerberos authentication support
2022-07-06 16:15:33 +01:00
adfoster-r7
5a6adf7c01
Land #16719 , Updated CCache Data Module
2022-07-04 17:52:04 +01:00
Spencer McIntyre
d31ffa27d3
Add and use a new kerberos CCache model definition
2022-07-01 11:57:30 -04:00
Spencer McIntyre
8c3d7ff42f
Rename Thrift related definitions
...
These definitions are only used by one exploit. BinData registers the
class name globally meaning that the Header and Data types were being
defined here which conflicted with those needed for Kerberos.
2022-07-01 11:56:55 -04:00
adfoster-r7
e40e835fd8
Land #16706 , Kerberos login enhancements
2022-06-30 14:51:30 +01:00
adfoster-r7
f508341155
Land #16705 , Fix bugs in previous etypes work
2022-06-29 18:11:25 +01:00
Ashley Donaldson
4f650e7c93
Rename parameter
2022-06-28 08:12:56 +10:00
Ashley Donaldson
997f9b92d9
Changes from code review
2022-06-24 09:33:57 +10:00
Ashley Donaldson
96046f9aec
Remove unnecessary freeze calls
...
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com >
2022-06-24 08:36:44 +10:00
Ashley Donaldson
2cce4ac1c1
Fix unit tests
2022-06-23 16:55:30 +10:00
Ashley Donaldson
bcd30b9be8
Don't error if it's not 12, as this can occur on older systems
2022-06-23 11:52:55 +10:00
Ashley Donaldson
2553bae018
Report correct password when clock is wrong or password has expired
2022-06-23 11:33:45 +10:00
Ashley Donaldson
3e33e2694d
Include information on whether account is disabled or locked.
...
We can do this more precisely for Windows' implementation of Kerberos
by using the undocumented PA-PW-SALT entry.
2022-06-23 10:46:25 +10:00
Ashley Donaldson
8d1d2d5aad
Fix bugs from #16685
2022-06-23 10:20:59 +10:00
adfoster-r7
89187c1fa9
Land #16685 , Add missing Kerberos encryption types
2022-06-22 13:13:30 +01:00
dwelch-r7
e672fad870
Land #16689 , Update Kerberos to support host addresses in tickets
2022-06-22 12:52:17 +01:00
Ashley Donaldson
a4a0fc3028
Changes from code review.
...
Use kwargs instead of default values for rarer crypto args.
Revert case-sensitivity change; we'll leave krb5 on Linux til later.
More constants
2022-06-22 16:03:36 +10:00
Ashley Donaldson
15446fd173
Incorporated new encryption methods into login scanner, including negotiating
2022-06-22 09:36:25 +10:00
Ashley Donaldson
19b62a5af6
Support several new encryption types for Kerberos.
...
Supports DES-CBC-MD5, DES3-CBC-SHA1, AES128, AES256
2022-06-22 09:13:33 +10:00
dwelch-r7
81a37ecf88
Land #16625 , Add Kerberos LoginScanner support
2022-06-20 17:14:52 +01:00
adfoster-r7
f8901a8b17
Add Kerberos LoginScanner support
2022-06-20 16:38:32 +01:00
adfoster-r7
3f56f9891d
Update keberos to support host addresses in tickets
2022-06-18 04:16:36 +01:00
dwelch-r7
ac5a885f16
Land #16660 , Fix Kerberos flags decoding logic
2022-06-17 17:38:09 +01:00
dwelch-r7
3ce8b2e3bc
Land #16678 , Support decoding pa_data as part of kdc enc response
2022-06-17 17:19:45 +01:00
adfoster-r7
5dd650fc76
Support decoding pa_data as part of kdc enc response
2022-06-15 20:46:45 +01:00
adfoster-r7
affc5bc294
Fix Kerberos flags decoding logic
2022-06-09 12:22:20 +01:00
Grant Willcox
34de5cf5e6
Land PR #16658 - Move kerberos tests to be under the remote folder
...
Move Kerberos tests to be under the remote folder to match the actual location of the respective library files in Metasploit Framework.
2022-06-08 11:01:05 -05:00
adfoster-r7
f1e5376414
Move kerberos tests to be under the remote folder
2022-06-08 03:21:25 +01:00
Tod Beardsley
54667a2424
Merge branch 'rapid7:master' into master
2022-01-30 09:13:37 -08:00
Tod Beardsley
1d400bd094
Merge remote-tracking branch 'upstream/master'
2021-06-04 20:23:30 -05:00