c660279963
Land #2259 , @wchen-r7's patch for [SeeRM #8319 ]
2013-08-26 16:36:45 -05:00
a58750fbbb
Land #2266 , @wchen-r7's patch forn [SeeRM #8345 ] and [SeeRM #8344 ]
2013-08-26 16:14:50 -05:00
6b15a079ea
Update for grammar in descriptions on new modules.
2013-08-26 14:52:51 -05:00
5b4890f5b9
Fix caps on typo3_winstaller module
2013-08-26 14:47:42 -05:00
3769da2722
Better fixes
2013-08-26 14:02:45 -05:00
6b8feaff8c
Type conversion
2013-08-26 13:56:11 -05:00
252f48aeee
Land #2272 , @jvennix-r7's exploit for CVE-2013-1775
2013-08-26 13:21:58 -05:00
0baaf989fb
Delete on_new_session cleanup, as discusses with @jlee-r7
2013-08-26 13:20:43 -05:00
bf89c956c4
Just the one file, please
2013-08-24 14:53:51 -05:00
757886bece
Remove some extra wip files.
2013-08-24 14:52:52 -05:00
29320f5b7f
Fix vn refs. Add juan as an @author.
2013-08-24 13:07:35 -05:00
5b812b0c22
Add references
2013-08-24 12:12:21 -05:00
b4ad8c8867
Beautify module
2013-08-24 12:08:38 -05:00
0e116730a1
Polishing module. Tested on 10.8, 10.8.2, and 10.8.4.
2013-08-24 12:01:38 -05:00
b13d357000
Add ranking
2013-08-24 11:35:35 -05:00
3ce23ffb49
Make a test before running the payload
2013-08-24 11:20:47 -05:00
ab293d2ad9
Make msftidy happy
2013-08-24 10:51:19 -05:00
480794a9ab
Make small fixes
2013-08-24 10:40:08 -05:00
832fa8838b
Change the command to launch after background the payload job
2013-08-24 09:57:33 -05:00
4532474309
Allow cleanup from the new session
2013-08-24 09:47:40 -05:00
3cdc6abec6
Clean up some code, get CMD working.
2013-08-23 20:19:21 -05:00
140d8ae42f
Need to set timezone first.
2013-08-23 20:09:18 -05:00
a4c2ba04f3
Pass cmd through /bin/sh to set default /Users/joe/.rvm/gems/ruby-1.9.3-p392@pro-dev/bin /Users/joe/.rvm/gems/ruby-1.9.3-p392@global/bin /Users/joe/.rvm/rubies/ruby-1.9.3-p392/bin /Users/joe/.rvm/bin /usr/local/sbin /usr/local/bin /usr/bin /bin /usr/sbin /sbin /usr/X11/bin /opt/bin /opt/X11/bin. CMD and native payloads now working.
2013-08-23 19:39:21 -05:00
fc91380ebc
Add work code
2013-08-23 17:54:21 -05:00
7b5e98d57e
Land #2269 - Oracle Endeca Server Remote Command Execution
2013-08-23 15:40:31 -05:00
a5c9f8d670
Beautify targets metadata
2013-08-23 15:15:04 -05:00
f3415f4147
Make msftidy compliant
2013-08-23 15:14:13 -05:00
413474f417
Move module to the correct path
2013-08-23 15:08:25 -05:00
ba27eab0d6
Comment out ctrl-z hax.
2013-08-23 19:44:39 +00:00
ad214da3de
Switch to powershell to exec payload
2013-08-23 14:39:29 -05:00
a45f49e3b7
Use a new Ranking
2013-08-23 08:49:58 -05:00
965e2d88fe
Use normalize_uri
2013-08-21 16:49:24 -05:00
b72566b8aa
Add module for ZDI-13-190
2013-08-21 12:47:47 -05:00
50e7d8015a
Validate datastore option "YEAR"
...
The YEAR option is a numeric value, so should be OptInt in order to
go through validation.
[FixRM #8345 ]
[FixRM #8344 ]
2013-08-21 01:38:16 -05:00
fe089030d4
Land #2257 , @wchen-r7's patch for [SeeRM #8317 ]
2013-08-20 13:43:37 -05:00
ceb0f56f42
Land #2258 , @wchen-r7's patch for [SeeRM #8318 ]
2013-08-20 13:26:34 -05:00
1702cf2af9
Use TARGETURI
2013-08-20 13:23:32 -05:00
3ac59fede7
Land #2251 , @wchen-r7's patch to use OptRegexp
2013-08-20 12:55:30 -05:00
202b31d869
Better fix based on feedback
...
Tell daddy how you want it.
2013-08-20 12:52:04 -05:00
42f774a064
Fix check method
2013-08-20 12:02:09 -05:00
533d98bd1b
Adding module for CVE 2013-5093, Graphite Web Exploit
2013-08-20 12:56:30 -04:00
546c523ed8
Land #2252 , @wchen-r7's patch for print_line vs print
2013-08-20 11:17:38 -05:00
8adc4f05dd
Land #2250 , @wchen-r7's clean up for mssql_ping
2013-08-20 10:38:01 -05:00
586ae8ded3
Land #2249 , @wchen-r7's patch for [SeeRM #8314 ]
2013-08-20 10:32:47 -05:00
277fc69a19
Land #2246 , @wchen-r7's patch for [SeeRM #8313 ]
2013-08-20 10:15:15 -05:00
f68d581b7a
[FixRM #8319 ] - Properly disable BLANK_PASSWORDS for ektron_cms400net
...
In module ektron_cms400net.rb, datastore option "BLANK_PASSWORDS" is
set to false by default, because according to the original author, a
blank password will result in account lockouts. Since the user should
never set "BLANK_PASSWORDS" to true, this option should never be
presented as an option (when issuing the "show options").
While fixing #8319 , I also noticed another bug at line 108, where
res.code is used when res could be nil due to a timeout, so I ended
up fixing it, too.
2013-08-20 01:20:52 -05:00
4790d8de50
Land #2256 , @wchen-r7's patch for [FixRM #8316 ]
2013-08-19 23:23:57 -05:00
246c2d82f9
[FixRM #8318 ] - Use normalize_uri properly
...
normalize_uri should be used when paths are being merged, not after.
2013-08-19 18:04:12 -05:00
3c27520e10
[FixRM #8317 ] - Fix possible double slash in file path
...
It is possible to have a double slash in the base path, shouldn't
happen.
2013-08-19 17:55:14 -05:00
268a3e769e
Missed this one
2013-08-19 17:45:05 -05:00
jvazquez-r7
Tod Beardsley
sinn3r
Joe Vennix
Charlie Eriksen