e70f9151e5
Merge remote-tracking branch 'upstream/master'
2012-02-02 07:13:03 -06:00
6b29af5c23
Add user-agent check. Auto-migrate.
2012-02-02 03:11:10 -06:00
6be65acfe2
Merge branch 'CVE-2008-2551_c6_DownloaderActiveX' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-CVE-2008-2551_c6_DownloaderActiveX
2012-02-02 02:54:02 -06:00
de675c349a
Upgrade exploit rank, because it fits the description
2012-02-02 02:49:06 -06:00
28b4f4b60d
Add Sunway ForceControl NetDBServer.exe Buffer Overflow (Feature #6331 )
2012-02-02 02:43:32 -06:00
82eacbe2fd
Added module for CVE-2008-2551
2012-02-01 23:26:28 +01:00
36e37e04fb
Fixes to post module cred reporting.
...
call to session.db_record.id would error if no db
was connected.
Fixes #6325
2012-02-01 12:26:35 -06:00
3f48e626a2
Adding a bunch of new VIM API auxiliary stuff
...
Work in progress.
2012-02-01 12:05:20 -06:00
e371f0f64c
MSFTidy commits
...
Whitespace fixes, grammar fixes, and breaking up a multiline SOAP
request.
Squashed commit of the following:
commit 2dfd2472f7afc1a05d3647c7ace0d031797c03d9
Author: Tod Beardsley <todb@metasploit.com>
Date: Wed Feb 1 10:58:53 2012 -0600
Break up the multiline SOAP thing
commit 747e62c5be2e6ba99f70c03ecd436fc444fda99e
Author: Tod Beardsley <todb@metasploit.com>
Date: Wed Feb 1 10:48:16 2012 -0600
More whitespace and indent
commit 12c42aa1efdbf633773096418172e60277162e22
Author: Tod Beardsley <todb@metasploit.com>
Date: Wed Feb 1 10:39:36 2012 -0600
Whitespace fixes
commit 32d57444132fef3306ba2bc42743bfa063e498df
Author: Tod Beardsley <todb@metasploit.com>
Date: Wed Feb 1 10:35:37 2012 -0600
Grammar fixes for new modules.
2012-02-01 10:59:58 -06:00
4aa52203da
Renamed, switched partially to store_loot
2012-02-01 08:50:50 -08:00
890885d034
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-02-01 03:42:27 -06:00
98fbf84dac
Module should inform where the files are saved
2012-02-01 03:41:19 -06:00
0c2a18d765
Fix up reverse_tcp ipv6 stager for freebsd
2012-02-01 01:41:24 -06:00
29d8feaa24
Use the ADDR6 type, not ADDR
2012-02-01 00:58:08 -06:00
aed27a2f82
Add missing trailing quote
2012-02-01 00:54:42 -06:00
45a785fde0
Adds BSD IPv6 payloads and stagers
2012-02-01 00:54:42 -06:00
06f7165ee6
Add Metasploit license header (it's already MSF licensed)
2012-02-01 00:49:45 -06:00
f23ebbc7b5
Change how creds are displayed and saved
2012-02-01 00:48:14 -06:00
187f630283
Merge branch 'netrc-creds' of https://github.com/jhartftw/metasploit-framework into jhartftw-netrc-creds
2012-01-31 22:45:47 -06:00
c3bd151197
add a ranking
2012-01-31 20:43:32 -06:00
47c7f47f4e
Merge branch 'master' of r7.github.com:rapid7/metasploit-framework
2012-01-31 20:38:30 -06:00
d9ee43d3dc
add disclosure date
2012-01-31 20:38:05 -06:00
a814a9dce7
add disclosure date
2012-01-31 20:35:58 -06:00
0ba7557865
Fix typo in seattlelab_pass.rb exploit.
...
Also remove the $ from the end of the regex which stopped
the exploit from being executed.
2012-01-31 21:09:51 +01:00
e392958d90
add osvdb ref
2012-01-31 07:06:33 -06:00
0b8987f2af
Merge results initialization fix
2012-01-31 01:29:44 -06:00
ec5fd723ba
Merge in additional IPv6 support for PHP payloads
2012-01-31 01:11:55 -06:00
b0df29c3ff
Switch to store_loot, since report_auth_info only works with Host
...
objects or IPs, currently (see
https://dev.metasploit.com/redmine/issues/6313 )
2012-01-30 23:08:02 -08:00
25fbe1c7d0
Merge branch 'master' of https://github.com/darkoperator/metasploit-framework
2012-01-30 19:57:29 -06:00
6068580813
Should fix the report_auth_info call -- needs a host, not a session. Be nice if it handled a session, though.
...
[See #146 ]
2012-01-30 19:23:05 -06:00
bfd4734cbf
Forgot to add CMD as a datastore option, here it is
2012-01-30 17:34:58 -06:00
24747e18e3
The directory path for the accounts.xml was not set properly for windows systems
2012-01-30 18:19:17 -04:00
08134ad600
Add Exploit-DB reference
2012-01-30 16:17:25 -06:00
f3c340a9ab
Add vBSEO proc_deutf() Remote Code Execution (Feature #6307 )
2012-01-30 16:15:27 -06:00
1dec4c0c45
These modules should use vprint_xxx() instead of print_xxx() ... if datastore['VERBOSE']
2012-01-30 13:08:35 -06:00
fed0df3552
Merge branch 'osx_x64_exec' of https://github.com/argp/metasploit-framework into argp-osx_x64_exec
2012-01-30 11:01:03 -06:00
a0ac4125cd
Add aux module CMS400 default pass scanner (feature #6301 )
2012-01-30 10:40:59 -06:00
1b03a48540
Use desired [at] format for email
2012-01-30 08:21:58 -08:00
16610d8852
Update email address to use desired [at] format
2012-01-30 08:05:08 -08:00
4e1029ae8b
Execute (execve) arbitrary command payload for Mac OS X x64
2012-01-30 11:01:57 +02:00
21a05ce1d6
Fix bug: NoMethodError undefined method `report_vm' ( #6298 )
2012-01-30 00:44:45 -06:00
ce7f93f5d9
Merge pull request #138 from claudijd/master
...
Added Sequence Filters and MSF Exploit Capture to BNAT Scan
2012-01-29 22:07:25 -08:00
37d467ea79
Loot .netrc files, generic enum_user_directories
2012-01-29 14:03:57 -08:00
5294fb57a4
Add post module to obtain SMB credentials stored for mount.smbfs
2012-01-29 12:04:26 -08:00
dda3453ac7
Correct a typo
2012-01-28 23:33:26 -06:00
774862508e
Handle another common error type
2012-01-28 23:31:20 -06:00
88298cf847
Added Sequence Filters and MSF Exploit Capture
...
-Sequence Filters (No More False Positives)
-Msf::Exploit::Capture (Use built-in MSF libs over manual threading)
-Immediate Feedback (Don't need to wait until complete to print results)
-Timeout (Includes user configurable timeout)
2012-01-28 22:44:12 -06:00
54ffb01080
This module should use the default list of tomcat users
2012-01-28 18:13:34 -06:00
ca7aa21202
Removed schema features from database hashdump modules
...
now that there are dedicated schemadump modules.
2012-01-28 16:55:39 -06:00
5a095e8ef5
Fixes for PCA modules
2012-01-28 14:35:07 -06:00
c63c7393e3
Print status output
2012-01-28 13:52:38 -06:00
f3eb78199b
Add TCP-based PCA probe
2012-01-28 13:52:38 -06:00
fbac9a7239
Forgot to remove this comment
2012-01-28 13:18:15 -06:00
2d7852ddef
Merge PCA scans into udp_sweep/udp_probe
2012-01-28 13:05:24 -06:00
4cd38c5555
Adds login scanner module for VMware Server and ESX
2012-01-27 16:23:56 -06:00
7b866eee86
Use the proper function for verbose prints
2012-01-27 12:50:01 -06:00
a2d20e25d3
Fix a regression in the workspace inclusion code (only affected
...
non-DB-connected instances). Add a PCA UDP scanner
2012-01-27 12:36:13 -06:00
64651e52a8
Credit Shane of X-Force for the discovery
2012-01-27 11:18:34 -06:00
c5e667a1dc
Post Module to enumerate VirtualBox VMs for the current user.
2012-01-27 11:12:59 -06:00
0e0aa33c47
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-27 11:12:35 -06:00
56be45f3a4
A few minor fixes to the find vmx module
2012-01-27 11:12:17 -06:00
b4e2228404
Fix exitfunc option name
2012-01-27 09:15:31 -06:00
298b94d397
Add MS12-004 MIDI Heap Overflow Remote Code Execution Exploit (CVE-2012-003)
2012-01-27 03:48:39 -06:00
a4c876a424
No need to manually add VERBOSE as an option, it already is (built-in)
2012-01-27 02:17:59 -06:00
3f4dbd9df6
Merge branch 'master' of https://github.com/averagesecurityguy/metasploit-framework
2012-01-27 01:58:42 -06:00
efda420e5f
Updates to enum_artifacts
2012-01-26 19:35:39 -05:00
9b78b6bd17
Hmm, the indent level of the description looks a bit funny. Fixing.
2012-01-26 17:24:05 -06:00
494c37c659
Adds a Multi-System post module for finding VMWare Virtual Machines
2012-01-26 16:25:50 -06:00
5afc164c39
Merge branch 'vm-stuff'
2012-01-26 13:04:44 -06:00
fe22090a12
Correct e-mail format
2012-01-26 13:04:38 -06:00
33c53b1f3f
Updates vm checking
2012-01-26 13:02:39 -06:00
3952a06292
Minor changes
2012-01-26 11:35:43 -06:00
8ce4ad49de
Correct e-mail format
2012-01-26 11:24:38 -06:00
67274e2e85
Merge branch 'hp_magentservice' of https://github.com/linuxgeek247/metasploit-framework into linuxgeek247-hp_magentservice
2012-01-26 11:00:36 -06:00
d0d964d8ab
Adds an error message if the module couldn't conenct to the target.
...
Fixes #6278
2012-01-26 10:56:07 -06:00
31fb7e7b28
Fallback to writing a new file if resuming fails
2012-01-25 14:49:30 -06:00
1af6740b24
Initial checking of hp_magentservice module
2012-01-25 13:04:30 -05:00
76ebbc48ec
Update modules/post/windows/gather/dumplinks.rb
2012-01-24 23:16:40 -06:00
49be9996bc
Merge remote-tracking branch 'upstream/master'
2012-01-24 20:23:58 -06:00
35de6a593b
Update modules/auxiliary/server/html_frame_payload.rb
2012-01-24 17:14:10 -06:00
2e2726c3c0
Update modules/auxiliary/server/html_frame_payload.rb
2012-01-24 17:06:49 -06:00
88b1cd6891
Update modules/auxiliary/server/html_frame_payload.rb
2012-01-24 17:03:33 -06:00
71648159a8
Update modules/auxiliary/server/html_frame_payload.rb
2012-01-24 17:00:47 -06:00
a20bd78f75
Adding html_frame_payload.rb
2012-01-24 16:56:32 -06:00
f6a6963726
Msftidy run over the recent changed+added modules
2012-01-24 15:52:41 -06:00
7ec5f98480
Adding jhart's natpimp libary and modules.
...
Made some minor corrections -- dropped the #vim splats, switched to msf
constants for service open etc, namely.
[See #106 ]
2012-01-24 10:32:30 -06:00
2f3e976173
Actually fix ruby loop syntax on d20pass
2012-01-24 10:08:19 -06:00
fc00398330
Yup, that's better
2012-01-23 16:02:35 -06:00
39a2a894ee
Fix fh, trailing comma, and ruby loop syntax
2012-01-23 15:15:49 -06:00
ea9e9852cf
ah man, typo!
2012-01-23 11:59:13 -06:00
621567dcc8
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-23 11:56:50 -06:00
afc547e0fb
Improve: Proper use of cmd_exec() and correct cmd path. More error handling for exec and rm. Fix bug with path setting, etc.
2012-01-23 11:54:19 -06:00
455bcda6e8
Print the port so we know which http service
2012-01-23 10:17:32 -07:00
60d5f6d0bd
Merge branch 'download_and_execute' of https://github.com/sempervictus/metasploit-framework into sempervictus-download_and_execute
2012-01-23 10:28:27 -06:00
c6eb104132
bug fix for hardcoded max command length
2012-01-23 10:24:22 +02:00
5671e2f691
Downloand and execute (railgun)
2012-01-22 23:25:49 -05:00
34491970b3
Adds a new VMWare Authentication Daemon login scanner module.
2012-01-22 15:39:53 -06:00
bcb19ab0a3
Fixes an issue with smb_login not properly dealing with abritrary guest access
...
on Samba.
2012-01-22 01:35:36 -06:00
06b1bffcea
Addresses an issue with udp sweep module that recorded services
...
from non-specified hosts when they respond to broadcast probes.
2012-01-20 15:34:15 -06:00
be906023dc
one register_options() should be fine.
2012-01-20 13:02:54 -06:00
d6566aa818
Add CVE-2011-4050 7-Technologies IGSS 9 IGSSdataServer.exe DoS module (Feature #6267 )
2012-01-20 12:57:13 -06:00
bbb4205683
Set default maxpage to 1, because it's faster.
2012-01-20 11:09:38 -06:00
5631774d92
Fix bug: NoMethodError undefined method `each' for nil:NilClass (line 155)
2012-01-20 10:58:02 -06:00
9e5d2ff60e
Improve URI, plus some other minor changes.
2012-01-19 13:26:25 -06:00
ca51492079
Merge branch 'master' of https://github.com/joernchen/metasploit-framework into joernchen-master
2012-01-19 13:17:06 -06:00
292332d355
Add some error handling for tns_version method
2012-01-19 13:03:19 -06:00
2199cd18d7
fine tuning thx to sinn3r
2012-01-19 19:50:30 +01:00
df9380500a
disclosure date added
2012-01-19 19:19:53 +01:00
8ce47ab832
Changing license for KillBill module
...
Talked with Solar Eclipse, and he's consented to change his module
license from GPL to BSD, thus striking a blow for freedom. Thanks!
2012-01-19 11:39:56 -06:00
a75b373d7a
Fixing e-mail format for antispam
2012-01-19 10:58:25 -06:00
ed3191bcfe
Adding d20pass module
2012-01-19 10:58:16 -06:00
197eb16f72
gitorious remote command exec exploit
2012-01-19 11:36:08 +01:00
bb035bfec2
Fix up API option names so they can be set globally
2012-01-18 15:05:39 -06:00
ad6f8257e1
MSFTidy fixes.
2012-01-18 15:01:32 -06:00
d6e8f0b54d
Add Felipe as an author (plus a reference) because looks like the PoC originally came from him.
2012-01-18 13:33:27 -06:00
064a71fb1d
Add CVE-2011-3167 HP OpenView NNM exploit (Feature #6245 )
2012-01-18 12:05:18 -06:00
9fe18cdc86
Add x64 LoadLibraryA payload. Because it should exist.
2012-01-17 21:16:26 -06:00
e4ed3c968d
Add OSVDB and BID references
2012-01-17 18:16:47 -06:00
75f543f3eb
Hilarious, I forgot to change the disclosure date.
2012-01-17 18:11:18 -06:00
7d9ba6f5e9
Fix bug #6256 : uninitialized class variable error
2012-01-17 17:58:53 -06:00
2e8122dc88
Better MSF style compliance
2012-01-17 14:54:50 -06:00
a682e68073
Add CVE-2011-4786 HP Easy Printer Care XMLCacheMgr exploit (Feature #6246 )
2012-01-17 12:28:47 -06:00
4f16caed0f
Change naming style for MS type bug
2012-01-17 03:00:07 -06:00
5761035371
This payload shouldn't be in here. Instead of adding a new one, exec.rb should be fixed
2012-01-16 22:41:27 -06:00
d5443159d7
Merge pull request #110 from jhartftw/soap_xml_6249
...
Improvements to auxiiliary/scanner/http/soap_xml to (#6249 )
2012-01-16 18:19:33 -08:00
7b8bfd401e
Merge branch 'argp-osx_mozilla_mchannel'
2012-01-16 20:02:35 -06:00
eb5641820f
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-16 19:56:10 -06:00
618097ba3d
Whitespace and keyword cleanup
2012-01-16 19:55:27 -06:00
17ffc06f60
Merge branch 'osx_mozilla_mchannel' of https://github.com/argp/metasploit-framework into argp-osx_mozilla_mchannel
2012-01-16 19:35:29 -06:00
d2dbf6007e
Merge pull request #111 from jhartftw/arp_poisoning_6250
...
Bug #6250
2012-01-16 17:34:11 -08:00
c15e7da0b8
Add ZDI-12-012 McAfee SaaS ShowReport code execution
2012-01-16 18:44:11 -06:00
fe901b3fb2
Clean up error messages when LOCALSIP isn't defined. Remove
...
now-duplicated code is_ipv4?, clarify SMAC error messages.
2012-01-16 14:32:15 -08:00
4689421201
Correct variable naming style
2012-01-16 16:03:48 -06:00
6a057560fa
Improvements to auxiiliary/scanner/http/soap_xml to:
...
* Detect additional SOAP faults to reduce false positives
* More obviously support SSL
* Report http/https
* Make it obvious when a SOAP endpoint falls over mid-scan
* Add a few more nouns/verbs
* Add an optional SLEEP to play nice with old/slow SOAP endpoints
https://dev.metasploit.com/redmine/issues/6249
2012-01-16 12:27:17 -08:00
11fc423339
Merge pull request #102 from cbgabriel/bsplayer-m3u
...
modules/exploits/windows/fileformat/bsplayer_m3u.rb
2012-01-16 11:24:48 -08:00
14a35da0fd
Merge pull request #104 from swtornio/master
...
add osvdb ref
2012-01-13 13:26:24 -08:00
4ac6c0c3ee
A great big pile of fixes to the ssh scanners
...
Not sure how this managed to fall out of master -- some of these fixes
are five days old, and should certianly have been merged in prior to
just now.
2012-01-13 13:49:21 -06:00
bd31f3f480
add osvdb ref
2012-01-13 13:21:33 -06:00
d52df50a77
Drop a spurious print_error line from smtp_version
2012-01-13 11:46:56 -06:00
2eb35728f6
Randomize nops
2012-01-12 18:37:25 -06:00
ffe81584d1
updated author
2012-01-12 19:02:34 -05:00
e42e0004a9
Merge branch 'ms05_054_onload' of https://github.com/SamSharps/metasploit-framework into SamSharps-ms05_054_onload
2012-01-12 17:46:50 -06:00
a8ef3417b5
Fixed the date
2012-01-12 20:54:55 -06:00
e75e23b963
Removed more unused variables and fixed some formatting
2012-01-12 18:13:28 -06:00
f22f54034a
Removed unused variables
2012-01-12 18:05:54 -06:00
87ee6905df
Modified exploit to not need egg hunter shellcode
2012-01-12 18:01:22 -06:00
6ad2eda24c
Windows artifacts module
2012-01-12 17:26:35 -06:00
02bd1f3407
Merge branch 'master' of https://github.com/averagesecurityguy/metasploit-framework
2012-01-12 17:06:14 -06:00
ad0b745b31
new file: modules/exploits/windows/fileformat/bsplayer_m3u.rb
2012-01-12 16:12:43 -05:00
6234d13f7c
Added Schema Dump Module for Postgres
2012-01-12 15:20:46 -05:00
cb146f9021
Used msf library for digest, fixed name.
2012-01-12 12:49:50 -05:00
a3749f1d80
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-11 12:17:11 -08:00
52be1c3a7a
Add schemadump module for MySql
2012-01-11 12:16:22 -08:00
500cfa6dd1
Removing telnet_encrypt_keyid_bruteforce.rb to unstable
...
can't ship for a few problems, will be fixed up soonish but
about to release a build.
2012-01-11 14:00:42 -06:00
1a03777538
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-11 09:11:48 -08:00
8c594798d7
Fix to the AIX jtr module title.
2012-01-11 09:11:23 -08:00
092b226cce
Updating tns_auth_sesskey to use a user-supplied SID
...
Applying the patch suggested by Lukas, here: http://mail.metasploit.com/pipermail/framework/2012-January/008374.html
2012-01-11 07:31:36 -06:00
13069990eb
Added module for dumping schema information from Microsoft SQL Server
...
and storing it as loot and notes.
2012-01-10 15:32:09 -08:00
7e25f9a6cc
Death to unicode
...
Apologies to the authors whose names I am now intentionally misspelling.
Maybe in another 10 years, we can guarantee that all terminals and
machine parsers are okay with unicode suddenly popping up in strings.
Also adds a check in msftidy for stray unicode.
2012-01-10 14:54:55 -06:00
ed0dbad243
Fix to MSSQL Ping that returns ALL known isntances onstead of jsut the first one.
...
Fixes #6066
2012-01-10 12:32:47 -08:00
bc9014e912
Add new v3.4 target by Michael Coppola (Feature #6207 )
2012-01-09 23:51:11 -06:00
b76767669c
Update Nenad's author name and e-mail
2012-01-09 20:14:47 -06:00
90eb2b9a75
Add CVE-2011-4862 encrypt_key_id using the brute-force method (Feature #6202 )
2012-01-09 19:35:06 -06:00
8eee54d1d0
Add e-mail addr for corelanc0d3r (found it in auxiliary/fuzzers/ftp/client_ftp.rb)
2012-01-09 14:23:37 -06:00
eeb3a442de
whitespace correctly smtp_version.rb
2012-01-09 14:11:10 -06:00
15990efd85
Removing useless (?) begin/rescue from smtp_version
...
Let the scanner mixin handle the exceptions.
2012-01-09 14:11:10 -06:00
e7d7302644
Dropping the umlaut, sacrificing accuracy for usability. Can't guarantee a viewer has a Unicode-capable terminal.
2012-01-09 11:22:44 -06:00
e12d5588c6
Set data on webdav scanner notes to include webdav path.
...
'Enabled' in the data field was useless since the note existing
already tells you webdav is enabled.
The path that webdav was running on wasn't kept anywhere though.
2012-01-09 08:33:45 -08:00
5a20b7d7ac
Fixed small typo
2012-01-09 14:19:00 +02:00
9a62b41ab7
Mac OS X x86 payload that executes Calculator.app
2012-01-09 12:12:20 +02:00
5d359785ae
Firefox 3.6.16 mChannel exploit for Mac OS X 10.6.8, 10.6.7 and 10.6.6
2012-01-09 12:10:25 +02:00
03a39f7fe8
Whitespace cleanup, also change print_status usage when verbose
2012-01-09 02:21:39 -06:00
2f9d563067
Update reference
2012-01-09 02:14:29 -06:00
a1668f2b23
Adds SSHKey gem and some other ssh goodies
...
Pubkeys are now stored as loot, and the Cred model has new and exciting
ways to discover which pubkeys match which privkeys.
Squashed commit of the following:
commit 036d2eb61500da7e161f50d348a44fbf615f6e17
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Jan 8 22:23:32 2012 -0600
Updates ssh credentials to easily find common keys
Instead of making the modules do all the work of cross-checking keys,
this introduces a few new methods to the Cred model to make this more
universal.
Also includes the long-overdue workspace() method for credentials.
So far, nothing actually implements it, but it's nice that it's there
now.
commit c28430a721fc6272e48329bed902dd5853b4a75a
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Jan 8 20:10:40 2012 -0600
Adding back cross-checking for privkeys.
Needs to test to see if anything depends on order, but should
be okay to mark up the privkey proof with this as well.
commit dd3563995d4d3c015173e730eebacf471c671b4f
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Jan 8 16:49:56 2012 -0600
Add SSHKey gem, convert PEM pubkeys to SSH pubkeys
commit 11fc363ebda7bda2c3ad6d940299bf4cbafac6fd
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Jan 8 13:51:55 2012 -0600
Store pubkeys as loot for reuse.
Yanked cross checking for now, will drop back in before pushing.
commit aad12b31a897db2952999f7be0161df1f59b6000
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Jan 8 02:10:12 2012 -0600
Fixes up a couple typos in ssh_identify_pubkeys
commit 48937728a92b9ae52d0b93cdcd20bb83f15f8803
Author: Tod Beardsley <todb@metasploit.com>
Date: Sat Jan 7 17:18:33 2012 -0600
Updates to ssh_identify_pubkeys and friends
Switches reporting to cred-based rather than note-based, accurately deal
with DSA keys, adds disable_agent option to other ssh modules, and
reports successful ssh_login attempts pubkey fingerprints as well.
This last thing Leads to some double accounting of creds, so I'm not
super-thrilled, but it sure makes searching for ssh_pubkey types a lot
easier.... maybe a better solution is to just have a special method for
the cred model, though.
2012-01-08 22:28:37 -06:00
243dbe50f0
Correct author name. Unfortunately not all editors can print unicode correctly.
2012-01-07 15:18:25 -06:00
181fe2d925
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-07 15:14:30 -06:00
4e858aba89
Add CVE-2012-0262 Op5 welcome.php Remote Code Execution
2012-01-07 15:13:45 -06:00
4645c1c2b9
Add CVE-2012-0261 Op5 license.php Remote Code Execution
2012-01-07 15:12:49 -06:00
b12baccc49
Quick update, added a research option
2012-01-07 01:13:23 -06:00
6d401b48d1
Fix typo
2012-01-07 00:02:51 -06:00
b7e29191f5
Add Drupal 'Views' module username enumeration (Feature #6194 )
2012-01-06 23:51:32 -06:00
40a1d8bcc8
Fixed issue with a missing nil check in ftp_login
2012-01-06 20:51:58 -08:00
81acfd2126
Adds hashdump and cracking modules for AIX
2012-01-06 20:31:22 -08:00
8e017fd4db
Merge branch 'master' of github.com:rapid7/metasploit-framework
2012-01-06 20:30:25 -08:00
bf425a6744
Fixed bug that prevented telnet sessions from opening with good creds
2012-01-06 16:59:08 -08:00
2e60d2e01a
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
2012-01-06 17:46:42 -05:00
72072c4ef3
Added enum_artifacts
2012-01-06 17:43:50 -05:00
6ceb2f04a3
Add CVE-2011-2474 Sybase EAServer directory traversal vulnerability
2012-01-06 14:24:49 -06:00
9cf2af6a94
Adds exploit/windows/htt/xampp_webdav_upload_php
...
This exploit abuses weak default passwords on XAMPP
for windows to uplaod a php payload and execute it.
Fixes #2170
2012-01-06 12:00:14 -08:00
06414c2413
changed author to my actual name
2012-01-06 01:03:20 -06:00
7b26e33e19
Initial version
2012-01-06 00:53:50 -06:00
b26ed37467
Added description, urls, and another author
2012-01-06 00:47:01 -06:00
5c05cebaf7
Added ms05_054_onload.rb IE 6 SP 2 exploit - CVE-2005-1790
2012-01-06 00:16:45 -06:00
f3a9bc2dad
Added ms05_054_onload.rb IE 6 SP 2 exploit - CVE-2005-1790
2012-01-06 00:12:28 -06:00
ba86e8a04f
Added PROPFIND support to http_login
...
This allows http_login to test against WebDAV.
Also added XAMPP default usernames and passwords to default wordlists
2012-01-05 12:10:53 -08:00
8315709fb6
Correct typo and set the disclosure date
2012-01-04 19:46:56 -06:00
7b692aa0b9
Adding references to vss modules.
2012-01-04 12:10:03 -06:00
8cced0a91e
Add CVE-2011-2462 Adobe Reader U3D exploit
2012-01-04 03:49:49 -06:00
12221b0433
UAC will disrupt these modules
...
Added checks for UAC.
UAC must be bypassed before using these modules.
2012-01-03 12:07:38 -08:00
958ffe6e1d
Fix stack trace from unknown agents
2012-01-02 03:41:49 -06:00
7bfdc9eff4
add osvdb ref
2012-01-01 09:10:10 -06:00
dd0b07b2cc
Adds mixin and post modules to manipulate Volume shadowcopy Service(VSS)
2011-12-30 15:03:04 -08:00
d9db03dba6
Add CoCSoft StreamDown buffer overflow (Feature #6168 ; no CVE or OSVDB ref)
2011-12-30 10:16:29 -06:00
bc22b7de99
MSFConsole should display hostless loot, also typo fix.
...
Fixes the console to display loot not associated with a host, as when
the CorpWatch modules save loot. Also fixes a typo on
corpwatch_lookup_id.rb
Fixes #6177
2011-12-29 15:11:15 -06:00
b202c29153
Correct e-mail format
2011-12-29 11:27:10 -06:00
d484e18300
Add e-mail for tecr0c
2011-12-29 11:14:15 -06:00
9972f42953
Add e-mail for mr_me for consistency
2011-12-29 11:01:38 -06:00
b5b2c57b9f
Correct e-mail format
2011-12-29 10:57:00 -06:00
a330a5c63a
Add e-mail for Brandon
2011-12-29 10:53:39 -06:00
778d396bc6
add osvdb ref
2011-12-29 07:54:15 -06:00
6d72dbb609
add osvdb ref
2011-12-29 07:54:01 -06:00
a00dad32fe
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
2011-12-29 07:50:33 -06:00
27d1601028
add osvdb ref
2011-12-29 07:49:16 -06:00
c88b582f97
Add CorpWatch Name lookup module by bperry
2011-12-28 15:43:21 -06:00
d896f128e5
Add CorpWatch ID Lookup module by bperry
2011-12-28 15:41:28 -06:00
0e3370f1fe
Grammar and spelling on splunk and oracle exploits
2011-12-28 13:42:56 -06:00
9e1e87508f
Fix to boundary validation for when no db is present
...
Fixes #6171
2011-12-28 08:47:22 -08:00
5dc647a125
Make it clear that this exploit is for RHEL 3 (White Box 3 uses the same
...
packages)
2011-12-28 02:02:03 -06:00
5d67bd2a5e
Phew. Exhaustive test of all i386 FreeBSD versions complete
2011-12-28 01:38:55 -06:00
1ff0cb2eef
More testing - looks like 5.5 is not exploitable, at least not the same
...
way
2011-12-28 01:30:25 -06:00
e071944a1a
Allow ff in payloads but double them back up
2011-12-28 00:04:24 -06:00
edb9843ef9
Add Linux exploit with one sample target (Whitebox Linux 3)
2011-12-28 00:00:10 -06:00
79103074cb
Add credit for Dan's advice
2011-12-27 23:39:02 -06:00
f9224d6010
Adds basic coverage for CVE-2011-4862. Ported from Jaime Penalba
...
Estebanez's code, mostly written by Brandon Perry, exploit method (jmp
edx) by Dan Rosenberg, and general mangling/targets by hdm.
2011-12-27 23:37:30 -06:00
2ad5c56d48
Typo in comment
2011-12-27 19:11:09 -06:00
617f3250cf
Handle patched systems accurately (requires actually triggering the bug)
2011-12-27 19:04:34 -06:00
f8e3119215
Add references
2011-12-27 17:50:06 -06:00
a2760b219d
Merge branch 'master' of github.com:rapid7/metasploit-framework
2011-12-27 11:34:36 -08:00
9b995bc0a5
Adds boundary validation to the framework
...
enforces boudnary checking on netbios probes
2011-12-27 11:33:52 -08:00
101eba6aa5
Add CVE-2011-3587 Plone/Zope Remote CMD Injection (Feature #6151 )
2011-12-27 00:59:26 -06:00
05f3af1e77
Fixed typo in the windows autlogin post module
2011-12-26 11:17:17 -08:00
a00937b4d8
Fix typo.
2011-12-24 15:32:08 -06:00
87cf4cefea
Fix bug #6164
2011-12-24 15:26:20 -06:00
062f661991
Fix bug #6161 - Must explicitly convert e to e.to_s
2011-12-24 15:11:26 -06:00
8a705c9223
Fix bug #6158 - session.db_record might return nil but wasn't checked
2011-12-24 15:06:43 -06:00
dcb66307be
Merge branch 'master' of github.com:rapid7/metasploit-framework
2011-12-24 14:58:40 -06:00
2e2e28afb8
Fix bug #6160 - undefined method '[] for nil:NilClass' due to an invalid path
2011-12-24 14:57:46 -06:00
06077a37f8
Fixes typo, variable name is paths not path.
2011-12-24 14:39:08 -06:00
4215ef3ae1
add osvdb ref
2011-12-24 06:54:39 -06:00
3fe076bcd6
Check nil before using .empty?
2011-12-23 17:42:58 -06:00
69570dada6
Add CVE-2008-2161 OpenTFTP SP 1.4 Buffer Overflow by steponequit
2011-12-23 16:28:36 -06:00
84c6739921
added initial opentftp 1.4 windows exploit
2011-12-23 11:27:11 -06:00
41697440c7
Add Oracle Job Scheduler Command Execution (CreateProcessA) - Feature #6079
2011-12-23 01:22:39 -06:00
ce6b1d6b8c
Improve:
...
- Use 'Actions' to configure which OWA version to try
- Fix a bug where the USER_AS_PASS option might overwrite PASSWORD (and not restoring it) even though a password is already set.
- Increase timeout to 25
- Update description
2011-12-22 16:26:02 -06:00
b5b24a1fbf
Add a check. I decided not to try to login in the check function in order to remain non-malicious.
...
However, this decision doesn't represent how modules should write their own check.
2011-12-22 13:16:54 -06:00
262fe75e0a
Add CVE-2011-4642 - Splunk Remote Code Execution (Feature #6129 )
2011-12-22 13:04:37 -06:00
a03f5e32f8
Merge branch 'master' of github_r7:rapid7/metasploit-framework
2011-12-22 11:11:29 -06:00
2f55f08ebe
Actually describe the module in the title/description
2011-12-22 11:10:24 -06:00
5e1efdcd73
Merge branch 'master' of github.com:rapid7/metasploit-framework
2011-12-22 10:49:53 -05:00
30141f3008
Fix typo in the oracle enum aux module
...
The password grace time query was not checking the right value,
spotted by user bNull in the IRC channel.
2011-12-22 10:47:57 -05:00
743a0546f1
Don't blow up if the user doesn't set a filename
...
Can't actually require FILENAME or REMOTE_FILENAME because I don't know
if you're going to upload or download. However, there shouldn't be a
stacktrace when you just try to go with neither.
2011-12-21 16:26:29 -06:00
2db697cd7a
Fixup on checkpoint firewall module
...
get() should get get_once() (intent is to get 4 bytes,
not timeout after 4 seconds), no need to escape equals
signs in regexes, no need to newline the unexpected
responses.
2011-12-21 11:21:46 -06:00
c6297458e6
Adding ref/disclosure date to checkpoint module
...
Talked with patrick, this all looks correct now.
2011-12-21 10:59:02 -06:00
1128c3ec6b
Checkpoint error msg should use res.inspect
...
Otherwise your terminal will go all wonky.
2011-12-20 15:46:31 -06:00
a58ddcae1b
Adds reporting to Patrick's Checkpoint module
...
Also refers to port 264/TCP as the SecuRemote service instead of the
Topology service (I believe this is correct)
Reporting is initially conservative -- if we don't get something for
fw_hostname, then don't bother reporting at all; assume we're
mis-identifying the target.
2011-12-20 15:44:05 -06:00
baaa1f6c82
Add US-Cert references to all these SCADA modules. The refers are based on this list:
...
http://www.scadahacker.com/resources/msf-scada.html
2011-12-20 14:07:29 -06:00
d439390aa2
Fix typo
2011-12-20 12:19:34 -06:00
c2d59f0307
Fix issue #6133
2011-12-20 11:32:33 -06:00
c83c3d5128
TFTP forgot to commit my rename.
...
Fixes #5291 for real.
2011-12-20 10:45:29 -06:00
1a396ba955
Merge pull request #70 from rapid7/tftp_client
...
Tftp client
2011-12-20 08:42:42 -08:00
11a27a1e61
Renaming TFTP transfer util.
...
See #5291 . Just renaming the file.
2011-12-20 10:06:44 -06:00
24d53efa7c
Final touches on TFTP client
...
See #5291 . Adds an option to mess with the block size in case someone
wants to write a fuzzer or exploit that leverages that. Adds a cleanup
method to the module (pretty much required, it turns out). Looking
nearly final, just need to rename the module and I think we're good to
push to master.
2011-12-20 10:03:04 -06:00
0200b6367a
Add OKI Scanner (Feature #6125 )
2011-12-20 03:09:09 -06:00
677cb4b152
Handle empty data sends sanely for TFTP.
...
Don't just hang forever -- let the user know they just send empty data.
TFTP servers don't like this of course.
2011-12-19 21:56:03 -06:00
2b3e3725ac
TFTP adding comment docs, ability to send w/out a file.
...
Commenting the tricksy parts a little better for general usage.
Adding the ability to set FILEDATA instead of FILENAME, in case
only short bits of data are desired and the user doesn't want
to go to the trouble of creating a source file to upload.
2011-12-19 18:15:19 -06:00
431ef826c9
TFTP client now uses constants, preserves trailing spaces/nulls in data
...
See #5291 , just rediscovered the bug on this.
2011-12-19 16:33:25 -06:00
5eaf2e7535
Adding download and loot functionality.
...
Still need to deal with the use case of not passing a block; blocks
should not be required, it should be okay to invoke and just wait for
the complete attribute to be true. You'll miss out on error messages but
eh, maybe those should be return values.
2011-12-19 15:50:50 -06:00
aecde6fea4
Updating TFTP client. Now with grown-up thread handling.
...
No longer blocks on successful connections.
2011-12-19 12:14:40 -06:00
902d7f5ea7
Adding more to TFTP. Still need a read tho
...
Adds error checking and some helpful messaging in the event of an error.
In the event of a failed transfer the module exits immediately, but in
success, I'm still hanging around for several seconds after. Not a deal
breaker but can be annoying.
Also, need to implement a read as well as a write and store it as loot,
to be actually useful for most TFTP checking.
2011-12-18 21:05:27 -06:00
23aadd04f7
Fixing merge conflict cruft
...
Dangit teach me to merge quickly. TFTP module now loads again.
2011-12-18 13:28:52 -06:00
b58097a2a7
Remove junk() because it's never used
2011-12-17 01:28:07 -06:00
1201d7fbf2
Merge branch 'tftp_client' of github_r7:rapid7/metasploit-framework into tftp_client
...
Conflicts:
modules/auxiliary/admin/tftp/tftp_upload_file.rb
2011-12-16 22:41:22 -06:00
0b8914021c
Switch to vprint_status, also add skeletal cleanup def.
2011-12-16 21:06:10 -06:00
50fa10679b
First draft of a TFTP client.
...
Could use some actual error checking and also needs to expose
more options.
2011-12-16 18:41:55 -06:00
a6867ef128
First draft of a TFTP client.
...
Could use some actual error checking and also needs to expose
more options.
2011-12-16 18:39:09 -06:00
fae80f8d49
typo
2011-12-16 11:10:46 -06:00
205637892b
Added checkpoint_hostname aux module.
2011-12-16 10:54:34 -06:00
e0c4afbf9e
Merge pull request #60 from darkoperator/master
...
Typo in the file opening option
2011-12-16 08:44:22 -08:00
208b93ce74
Merge pull request #58 from swtornio/master
...
add osvdb refs
2011-12-16 08:44:02 -08:00
3c08836f51
Typo on the file opening mode
2011-12-16 01:13:06 -04:00
bb2ea62de8
Add CVE-2008-0926: Novell eDirectory eMBox Unauthenticated Access (Feature #2729 )
2011-12-15 23:09:26 -06:00
e991094bd2
Fix host info for report_auth_info(). Change print_status vs print_line order
2011-12-15 13:05:03 -06:00
2648e533a2
nil bug fix
2011-12-15 12:58:21 -06:00
829d96ffbe
Add Windows Gather RazorSQL cred collector (Feature #6117 )
2011-12-15 11:15:44 -06:00
1712f2aa22
add osvdb ref
2011-12-14 07:23:11 -06:00
85caabbf5d
add osvdb ref
2011-12-14 07:19:34 -06:00
8dc85f1cc5
Fix up some nascent typos
2011-12-14 00:30:31 -06:00
866e2b6bf3
Additional IPv6 payload support
2011-12-14 00:27:38 -06:00
86b3409d47
Actually return
2011-12-13 20:01:13 -06:00
cb456337a0
Handle invalid http responses better, see #6113
2011-12-13 19:54:10 -06:00
fea4bfb85c
Repair dead milw0rm link to exploit-db
2011-12-13 16:13:53 -06:00
c1a4c4e584
Repair dead milw0rm link to exploit-db
2011-12-13 16:13:34 -06:00
acef9de711
Repair dead milw0rm link to exploit-db
2011-12-13 16:13:15 -06:00
e7ab48693c
Repair dead milw0rm link to exploit-db
2011-12-13 16:12:57 -06:00
94b736c76c
Repair dead milw0rm link to exploit-db
2011-12-13 16:12:38 -06:00
97b74101fb
Repair dead milw0rm link to exploit-db
2011-12-13 16:12:11 -06:00
7b2a1dc791
Repair dead milw0rm link to exploit-db
2011-12-13 16:11:33 -06:00
a5189917da
Add CVE-2005-4832: Oracle Database Server DBMS_CDC_SUBSCRIBE SUBSCRIPTION_NAME SQL Injection (Feature #6094 )
2011-12-13 15:44:39 -06:00
d246bfa4da
Credit Luigi Auriemma for the original discovery/poc, not Celil
2011-12-13 15:20:26 -06:00
d87d8d5799
Add CVE-2011-4453 (PmWiki Remote code exeuction - Feature #6103 )
2011-12-13 11:45:24 -06:00
Marcus J. Carey
sinn3r
juan
David Maloney
Tod Beardsley
Jon Hart
HD Moore
Jonathan Cran
Oliver-Tobias Ripka
Steve Tornio
Carlos Perez
Patroklos Argyroudis
sinn3r
Jonathan Claudius
Stephen Haywood
Joshua J. Drake
Christopher McBee
Dave Hull
Marcus J. Carey
James Lee
RageLtMan
joernchen of Phenoelit
scriptjunkie
Tod Beardsley
root
root
Sam Sharps
sam
Brandon Perry
steponequit
Patrick Webster