infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
27,749 Commits
7 Branches
556 Tags
421 MiB
Commit Graph

963 Commits (1996886ae91f19686b19ca07436d21d5e01c2281)

Author SHA1 Message Date
jiuweigui 2a0b503f06 Minor fix 2013-12-08 18:17:22 +02:00
William Vu 79e23a1e13
Land #2675, @JonValt's forensics/browser_history 
Great job!
 2013-12-05 09:35:53 -06:00
Joshua Harper PI GCFE GCFA GSEC cd5172384f Rename gather_browser_history.rb to browser_history.rb 2013-12-05 08:43:19 -06:00
Joshua Harper 3957bbc710 capitalization ("skype") 
(https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r8120307)

Removed some Chrome artifacts and renamed one to reflect "Archived History."  
(https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r8120314)
((Will include other doxxes in another module.))
 2013-12-05 08:33:47 -06:00
jiuweigui 717f45ac09 Minor modification 2013-12-05 09:07:28 +02:00
jiuweigui 902d48efab Delete debug prints 2013-12-05 09:03:42 +02:00
jiuweigui 492cd1ca07 Modifications how info is collected from pf files. 2013-12-05 08:56:26 +02:00
Joshua Harper d1dd7c291b cosmetic (indentation) 
https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r7977962
 2013-12-02 13:16:48 -06:00
Joshua Harper cdf6ffa70d Complete refactor with lots of help from @kernelsmith and @OJ. Thank you guys so much. 2013-11-27 21:02:48 -06:00
sinn3r a8af050c16 Update post module Apache Tomcat description 
This module's description needs to be more descriptive, otherwise
you kind of have to pull the source code to see what it actually
does for you.
 2013-11-27 19:21:27 -06:00
Joshua Harper 1c17383eff removed return file_loc 
removed extra space
 2013-11-27 15:04:31 -06:00
Joshua Harper 036cd8c5ad couple cosmetic changes per wvu-r7 2013-11-27 14:44:39 -06:00
jonvalt 9dbeb55b9a removed single quotes from inside %q{} on line 22 per https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r7913331 
removed empty advanced options registration on line 28 per https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r7913342
 2013-11-26 10:29:38 -06:00
sinn3r 48578c3bc0 Update description about suitable targets 
The same technique work for Microsoft Office 2013 as well. Tested.
 2013-11-24 23:02:37 -06:00
jvazquez-r7 49441875f3
Land #2683, @wchen-r7's module name consistency fix 2013-11-24 16:51:22 -06:00
Meatballs 23a267b65c
Undo move 2013-11-24 15:06:36 +00:00
Meatballs 23ac7ad75a
Merge remote-tracking branch 'upstream/master' into getaddrinfo 2013-11-24 15:00:00 +00:00
sinn3r ce8b63f240 Update module name to stay consistent 
This module is under the windows/gather, so must be named the same
way like the rest.
 2013-11-24 01:01:29 -06:00
Meatballs 72822cfa2d
Save egypt from eol comments 2013-11-23 22:11:46 +00:00
Meatballs 646f977888
Use post mixin 2013-11-23 22:07:07 +00:00
Meatballs 4d3e061e43
Merge branch 'enum_ad_perf' into enum_ad_users 2013-11-23 22:05:15 +00:00
Meatballs 699d13eef1
Share the wealth 
Move LDAP methods to a Post mixin.
 2013-11-23 21:42:09 +00:00
Meatballs 11f00cc50b
Backout small change 2013-11-23 21:23:25 +00:00
Meatballs 0c8fc657bb
Address @jlee-r7's comments 2013-11-23 19:42:33 +00:00
jonvalt b712c77413 capitalization 2013-11-22 14:37:54 -06:00
jonvalt 52a3b93f24 Hopefully final commit. 
ALL issues mentioned by todb in https://github.com/rapid7/metasploit-framework/pull/2663/ have been fixed or erased.

Only exception is comment https://github.com/rapid7/metasploit-framework/pull/2663/#discussion_r7837036 which if omitted as recommended, breaks the module.
 2013-11-22 14:17:20 -06:00
jonvalt 9addd37458 minor changes: 
s/grab/gather/g
 2013-11-22 14:03:54 -06:00
jonvalt b742ed13b9 junk commit 2013-11-22 12:38:06 -06:00
jiuweigui b2e7ff4587 Small change for filetime conversion 2013-11-17 22:26:30 +02:00
jiuweigui b73260b74c Add functionality to enum_prefetch post module 2013-11-17 22:10:55 +02:00
James Lee 5b96ad595f
Skip reg values with no secretes 
Also update header comment to match new standard
 2013-11-13 19:05:16 -06:00
James Lee cb10b4783b
Mark XP hashes as mscash for JtR to recognize 2013-11-13 19:04:16 -06:00
James Lee 0aef145f64 Merge remote-tracking branch 'upstream/master' into land-2532-enum-lsa 2013-11-13 18:11:21 -06:00
James Lee 8471f74b75
Refactor ivar to a more reasonable method 
Also changes jtr output for cachedump to produce hashes that can be
auto-detected as mscash2 format for a better user experience.
 2013-11-13 18:09:41 -06:00
James Lee 8bb72764ec
Rename credentials/lsa -> lsa_secrets 
Secrets are not necessarily credentials
 2013-11-13 15:23:15 -06:00
James Lee 16627c1bd3
Add spec for capture_lsa_key 2013-11-13 15:16:34 -06:00
James Lee 3168359a82
Refactor lsa and add a spec for its crypto methods 2013-11-13 11:55:39 -06:00
Meatballs d9fa092962
Initial commit 2013-11-07 20:48:15 +00:00
Meatballs 6415666830 Merge remote-tracking branch 'upstream/master' into enum_ad_perf 2013-11-07 17:00:56 +00:00
Tod Beardsley 4128aa8c08
Resplat and tabs 2013-10-28 14:03:15 -05:00
sinn3r a95425de08 Check dec instead 2013-10-25 10:47:41 -05:00
sinn3r 1d0a3aad70 [FixRM #8525] undefined method `+' for nil:NilClass in enum_ie 
Looks like for some reason if CryptUnprotectData fails, the decrypt_reg()
method will return "". And when you unpack "", you produce an array of nils.
Since you cannot add something to nil, this should cause an
"undefined method `+' for nil:NilClass" error.

This will check if we get an array of nils, we jump to the next iteration.
 2013-10-25 00:26:38 -05:00
sinn3r e1c4aef805
Land #1789 - Windows SSO Post Module 2013-10-22 15:48:15 -05:00
Rob Fuller e447aff0ec Fix misleading statement in Outlook post module 
Since this module doesn't retrieve domain exchange information as it isn't stored there it shouldn't say that Outlook isn't installed at all.
 2013-10-22 11:53:15 -04:00
Rob Fuller 8f2ba68934 move decrypt_lsa and decrypt_secret to priv too 2013-10-17 00:04:21 -04:00
Rob Fuller 541d932d77 move decrypt_lsa to priv as well 2013-10-16 23:53:33 -04:00
Rob Fuller 60d8ee1434 move capture_lsa_key to priv 2013-10-16 23:45:28 -04:00
Rob Fuller 1a9fcf2cbb move convert_des_56_to_64 to priv 2013-10-16 23:39:07 -04:00
Rob Fuller 26d07c0689 add a needed -end 2013-10-16 23:35:14 -04:00
Rob Fuller b318e32487 removed duplicate code for capture_boot_key functions 2013-10-16 23:17:20 -04:00
Rob Fuller 8be21a7413 remove the insane amount of rescues 2013-10-16 22:58:14 -04:00
Rob Fuller 1a85bd22a8 move capture_boot_key to post win priv 2013-10-16 22:46:15 -04:00
Rob Fuller b223504980 clean up run code - remove catchall rescue 2013-10-16 22:22:45 -04:00
Rob Fuller ca88c071cf remove unneeded railgun call and make vprints out of commented puts 2013-10-16 22:20:21 -04:00
Rob Fuller f672e2075b get rid of ID and Version 2013-10-16 22:18:24 -04:00
Rob Fuller 2fbd7ea0ba msftidy up 2013-10-16 22:17:05 -04:00
Rob Fuller b42687151f convert from tabs to spaces 2013-10-16 22:14:55 -04:00
Rob Fuller c59bdbf52e move Rob Bathurst enum_lsa module in from the unstable cold 2013-10-16 22:10:22 -04:00
Tod Beardsley f0aedd932d
More stragglers 2013-10-16 16:29:55 -05:00
Tod Beardsley f57032636e
Straggler on a weird boilerplate format 2013-10-15 14:57:04 -05:00
Tod Beardsley 5d86ab4ab8
Catch mis-formatted bracket comments. 2013-10-15 14:52:12 -05:00
Tod Beardsley ed0b84b7f7
Another round of re-splatting. 2013-10-15 14:14:15 -05:00
Tod Beardsley c83262f4bd
Resplat another common boilerplate. 2013-10-15 14:07:48 -05:00
Tod Beardsley 23d058067a
Redo the boilerplate / splat 
[SeeRM #8496]
 2013-10-15 13:51:57 -05:00
Meatballs 378f403fab
Land #2453, Add stdapi_net_resolve_host(s) to Python Meterpreter. 
Moves resolve_host post module to multi and depreciates Windows module.
Resolve will now return nil for failed lookups instead of an empty
string.
 2013-10-10 20:13:06 +01:00
Spencer McIntyre 6c382c8eb7 Return nil on error, and move the module to post/multi. 2013-10-09 16:52:53 -04:00
Tod Beardsley c2c6422078
Correct the name of "DynDNS" (not Dyn-DNS) 2013-10-09 09:56:07 -05:00
Tod Beardsley 4dc88cf60f Expand descriptions for ease of use. 2013-09-30 13:30:31 -05:00
Tod Beardsley 7cc2ad55a6
Land #1770, unattend.xml snarfing modules 2013-09-27 16:04:38 -05:00
Tod Beardsley d869b1bb70 Unless, unless everywhere. 2013-09-27 15:55:57 -05:00
Tod Beardsley ae655e42d2 Touchups: boolean check, unless, and TODO comment 2013-09-27 15:54:03 -05:00
Tod Beardsley 37e4d58f4a Call CSV text/plain so it can be viewed normally 
Otherwise, things parsing through the loot table will treat it as binary
data, and not display it in a normal texty way, even though it's totally
readable with just a little squinting.
 2013-09-27 15:48:48 -05:00
Tod Beardsley 5e77dccd48 Add a ref to an example unattend.xml 2013-09-27 15:45:57 -05:00
Meatballs f9359c9d88 Use meterpreter dns resolve 2013-09-24 21:58:04 +01:00
Meatballs 2eff44d7e1 Swap x64/x86 detection 2013-09-24 20:01:45 +01:00
Meatballs b6fd14fd66 Use meterp dns lookup 2013-09-24 19:58:09 +01:00
Meatballs f1e563d375 Merge branch 'master' of github.com:rapid7/metasploit-framework into enum_ad_perf 2013-09-24 19:08:52 +01:00
jvazquez-r7 7eecf7e6f0
Land #2415, @Meatballs1's fix for resolve_hosts platform list 2013-09-24 12:37:03 -05:00
Meatballs1 4b4ab3a6a0 Remove Linux Plat from ResolveHosts 2013-09-24 12:00:53 -05:00
Tod Beardsley 8db1a389eb
Land #2304 fix post module require order 
Incidentally resolve conflict on current_user_psexec to account for the
new powershell require.
 2013-09-23 16:52:23 -05:00
Tod Beardsley e885ab45b6
Land #1734 Metasploit side for ip resolv 2013-09-23 16:18:40 -05:00
James Lee 150f0f644e Merge branch 'rapid7' into bug/osx-mods-load-order 
Conflicts:
	modules/post/windows/gather/enum_dirperms.rb
 2013-09-17 18:21:13 -05:00
James Lee 58b634dd27 Remove unnecessary requires from post mods 2013-09-12 14:36:01 -05:00
Tab Assassin b3b8cee870 Retab changes for PR #1473 2013-09-05 16:19:05 -05:00
Tab Assassin 0ba4e1da65 Merge for retab 2013-09-05 16:18:56 -05:00
Tab Assassin 2e9096d427 Retab changes for PR #1734 2013-09-05 14:59:41 -05:00
Tab Assassin 322ed35bb4 Merge for retab 2013-09-05 14:59:34 -05:00
Tab Assassin 2846a5d680 Retab changes for PR #1770 2013-09-05 14:57:40 -05:00
Tab Assassin 269c1a26cb Merge for retab 2013-09-05 14:57:32 -05:00
Tab Assassin 26b8364dcb Retab changes for PR #1789 2013-09-05 14:44:21 -05:00
Tab Assassin 789be1fe3e Merge for retab 2013-09-05 14:44:14 -05:00
Meatballs c5daf939d1 Stabs tabassassin 2013-09-05 20:36:52 +01:00
Tab Assassin 874ed2ac17 Retab changes for PR #2107 2013-09-05 14:30:08 -05:00
Tab Assassin 27564b2de2 Merge for retab 2013-09-05 14:30:03 -05:00
Tab Assassin 845bf7146b Retab changes for PR #2304 2013-09-05 13:41:25 -05:00
Tab Assassin adf9ff356c Merge for retab 2013-09-05 13:41:23 -05:00
Meatballs a8e77c56bd Updates 2013-09-03 22:46:20 +01:00
Meatballs ac0c493cf9 Merge branch 'master' of github.com:rapid7/metasploit-framework into local_win_priv_keyring 2013-09-03 21:33:11 +01:00
Meatballs 13244efecf Spacing and bugfixes 2013-09-02 21:57:11 +01:00
Meatballs 051ef0bdfa Refactor to common post module 2013-09-02 20:24:54 +01:00
Tab Assassin 41e4375e43 Retab modules 2013-08-30 16:28:54 -05:00
James Lee 63adde2429 Fix load order in posts, hopefully forever 2013-08-29 13:37:50 -05:00
jvazquez-r7 1042dbe56a Land #2108, @jiuweigui's post module to get info from prefetch files 2013-08-28 10:01:06 -05:00
jvazquez-r7 0fbe411be7 Ensure use Ruby File 2013-08-28 09:55:21 -05:00
jvazquez-r7 5c32bb4a8e Beautify metadata 2013-08-28 09:32:23 -05:00
jvazquez-r7 4f8ba82d02 Make gather_pf_info return a prefetch entry 2013-08-28 09:29:49 -05:00
jvazquez-r7 904bd12663 Fix print over nil or empty string 2013-08-28 09:27:18 -05:00
jvazquez-r7 ef3085823c Use default timeout value 2013-08-28 09:26:46 -05:00
jvazquez-r7 8ac82b8b18 Beautify timezone_key_values function 2013-08-28 09:25:49 -05:00
jvazquez-r7 bc593aab4f Avoid confusion between variable and method name 2013-08-28 09:24:32 -05:00
jiuweigui 2ebfdcc84b Fix to description 2013-08-24 19:32:01 +03:00
jiuweigui 73f4259156 Fix based on suggestions 2013-08-24 19:14:48 +03:00
jiuweigui 514d2b4721 Fix to make msftidy happy. 2013-08-21 21:46:44 +03:00
jiuweigui 0cc499faf7 Minor deletes related to filetime change. 2013-08-21 14:47:50 +03:00
jiuweigui 3a2433dac9 Remove unneeded filetime read 2013-08-21 12:18:07 +03:00
sinn3r 86d6bce8c4 [FixRM #8312] - Fix file handle leaks 
Fix file handle leaks for [SeeRM #8312]
 2013-08-18 20:31:13 -05:00
jiuweigui 0063d4e06c Extend description & add Win2k3 section to WinXP section. 2013-08-16 14:44:08 +03:00
jiuweigui 8602e744da Add support for Win2k3 2013-08-16 02:46:16 +03:00
sinn3r 83a179ff08 [Fix RM 8224] - undefined method `include?' for nil:NilClass 
Bug due to registry_enumkeys returning nil.
 2013-08-15 16:04:35 -05:00
bmerinofe 98c8c16803 Change offset values and hostname length 2013-08-05 12:29:54 +02:00
bmerinofe 3e6de5d2e9 added a post-exploitation module to dump the cache dns entries 2013-08-03 13:37:32 +02:00
Tod Beardsley 7e539332db Reverting disaster merge to 593363c5f with diff 
There was a disaster of a merge at 6f37cf22eb that is particularly
difficult to untangle (it was a bad merge from a long-running local
branch).

What this commit does is simulate a hard reset, by doing thing:

 git checkout -b reset-hard-ohmu
 git reset --hard 593363c5f9
 git checkout upstream-master
 git checkout -b revert-via-diff
 git diff --no-prefix upstream-master..reset-hard-ohmy > patch
 patch -p0 < patch

Since there was one binary change, also did this:

 git checkout upstream-master data/exploits/CVE-2012-1535/Main.swf

Now we have one commit that puts everything back. It screws up
file-level history a little, but it's at least at a point where we can
move on with our lives. Sorry.
 2013-07-29 21:47:52 -05:00
jiuweigui f3bb0ec1ee moved table << 2013-07-17 02:53:24 +03:00
jiuweigui c0e594eb6a removed unnecessary begin-end 2013-07-16 20:09:21 +03:00
jiuweigui 9985ea3c3a Enumerates Windows Prefetch files through meterpreter session 2013-07-16 14:18:54 +03:00
jiuweigui e13f4f5b4e Minor fix 2013-07-16 13:46:42 +03:00
jiuweigui ef82308e07 Working versio 2013-07-16 12:45:03 +03:00
staaldraad d3903aaeac changed to use already defined netapi32.NetServerEnum - tested 2013-07-16 06:49:05 +02:00
staaldraad dfa8c86408 updated enum_domain_users with Meatballs1 suggestions 2013-07-16 06:41:58 +02:00
jiuweigui b32597620d Finally working. 2013-07-16 04:07:28 +03:00
jiuweigui 5f3d3a3956 still buggy 2013-07-16 01:05:08 +03:00
jiuweigui 4c56d8eba3 Still buggy 2013-07-15 23:55:24 +03:00
jiuweigui 315874a882 Minor fixes 2013-07-15 23:19:17 +03:00
staaldraad 7c48441d53 added enum_domain_users post module 2013-07-15 22:02:46 +02:00
jiuweigui 5d767fe319 Minor mods 2013-07-15 19:34:44 +03:00
jiuweigui 26f28ae47e Minor cleaup 2013-07-15 17:51:55 +03:00
jiuweigui 2349ee7276 Working version 2013-07-15 16:07:45 +03:00
jiuweigui 4801aab4c4 loot.txt broken 2013-07-15 15:38:42 +03:00
jiuweigui 4265141a11 minor modifications 2013-07-15 13:15:39 +03:00
jiuweigui 90107b82e1 Minor mods 2013-07-15 00:19:32 +03:00
jiuweigui 6956003949 Everything working on this version. 2013-07-14 17:24:27 +03:00
jiuweigui 52f9daf8c5 Renamed prefetch_tool to enum_prefetch 2013-07-14 15:33:54 +03:00
jiuweigui 6539b4e507 Working 2013-07-14 15:30:54 +03:00
jiuweigui b77ba64e88 Fixed WinXP registry timezone key 2013-07-14 13:53:18 +03:00
jiuweigui 398d5070b2 Fixed WinXP registry timezone key 2013-07-14 06:18:25 +03:00
jiuweigui 43740d7626 Minor edits 2013-07-14 04:55:57 +03:00
jiuweigui 742615f3a1 Working 2013-07-14 04:50:13 +03:00
jiuweigui 1f27a2b7bd Working version 2013-07-14 04:32:20 +03:00
jiuweigui ae60abd05b Minor changes 2013-07-13 20:19:01 +03:00
jiuweigui 45d49cdfe5 Time conversion broken, otherwise works. 2013-07-13 20:03:08 +03:00
jiuweigui 1f10d1ca05 Done. Needs final cleanup and rewrite. 2013-07-13 13:24:08 +03:00
jiuweigui 84f30b2379 Works. Needs just FILETIME converter 2013-07-12 23:31:52 +03:00
jiuweigui ce8f3d2a62 Tested on XP and Win7. Works, needs just Filetime convert 2013-07-12 23:29:54 +03:00
jiuweigui 5692cde57a Initial transfer 2013-07-12 21:19:44 +03:00
jvazquez-r7 6dec81cbdf Merge branch 'master' of https://github.com/rapid7/metasploit-framework 2013-07-06 10:38:19 -05:00
jvazquez-r7 b2e7f61814 Fix path build on total_commander 2013-07-06 10:15:30 -05:00
jvazquez-r7 df7209f28a Land #2067, @wchen-r7's fix for total_commander 2013-07-06 10:14:44 -05:00
jvazquez-r7 39f0359fa4 Land #2061, @wchen-r7's fix to make bitcoin_jacker use post mixins 2013-07-06 00:14:14 -05:00
sinn3r ca4e11c112 Use check_other more 2013-07-05 12:38:38 -05:00
sinn3r 98f49758af Don't need this line 2013-07-05 12:34:26 -05:00
sinn3r d3000c0066 These funcs want 'filename' 2013-07-05 12:29:16 -05:00
sinn3r 353db0884d Use expand_path from Msf::Post::File 2013-07-05 12:26:59 -05:00
sinn3r 18e5831ca8 Don't use begin/rescue to shut errors up and call it "file not found" 2013-07-05 12:22:05 -05:00
sinn3r dc90904e50 Avoid misleading error 2013-07-05 12:12:30 -05:00
jvazquez-r7 6477c6995d Merge branch 'enum_db_no_method' of https://github.com/wchen-r7/metasploit-framework 2013-07-05 09:35:34 -05:00
jvazquez-r7 a7d110367a Land #2064, @wchen-r7's fix for access uninitialized variable on enum_services 2013-07-05 09:30:23 -05:00
jvazquez-r7 b9dd3df05f Land #2068, @wchen-r7's fix to initialize variables on windows_autologin module 2013-07-05 09:09:17 -05:00
jvazquez-r7 4ed6a4d8d1 Land #2062, @wchen-r7's fix to avoid redundant check 2013-07-05 08:51:05 -05:00
jvazquez-r7 c459b0e937 Land #2045, @wchen-r7's fix for memory_grep module 2013-07-05 08:16:47 -05:00
sinn3r 2a32b59c88 Forgot to change var 'filename' 2013-07-05 01:37:35 -05:00
sinn3r 84050241f0 Fix target ID 2013-07-05 01:25:08 -05:00
sinn3r 1352731062 Make heap grep optional 2013-07-05 00:57:25 -05:00
sinn3r a52d38f359 Land #2052 - Fix regex 2013-07-03 16:55:07 -05:00
sinn3r 70c472fb7e [FixRM:#8134] - Handle registry_getvaldata return value properly 
registry_getvaldata can return nil, can't always assume it's
gonna throw a string.
 2013-07-03 12:23:14 -05:00
sinn3r 1064c050de [FixRM:#8132] - Fix undefined method '+' in total_commander.rb 
The return value of registry_getvaldata can return nil when a
RequestError occurs, so you can't always assume it's gonna throw
you a string.
 2013-07-03 12:10:23 -05:00
sinn3r 27653b661f [FixRM:#8131] & [FixRM:#8133] - Fix Base64 func usage 
Instead of using Base64, these modules should use Rex.
 2013-07-03 12:06:12 -05:00
sinn3r c40a605495 [FixRM:#8129] - Fix undefined method error in enum_services.rb 
srv_conf may not have the 'Startup' key because it's only assigned
in service_info() when srvstart is 4, therefore it's possible to
cause an undefined method 'downcase' error.
 2013-07-03 11:44:28 -05:00
sinn3r 534858a23b [FixRM:#8128] - Potential undefined method 'include' for nil 
A lot of return values aren't checked, may result in undefined method X
bugs. The same type of issue is all over the place.
 2013-07-03 11:40:24 -05:00
sinn3r 6198409e71 [FixRM:#8127] - Remove junk code that checks ARTIFACTS again 
ARTIFACTS uses OptPath, which already checks the path. We don't need
to do this again.
 2013-07-03 11:33:25 -05:00
sinn3r 944761a1dc [FixRM:#8126] - Use functions from Msf::Post::File 
Some functions already exist in Msf::Post::File, should use them.
 2013-07-03 11:30:05 -05:00
g0tmi1k 864f4e9d37 post/local_admin_search_enum~Regex fails,module 2 
If the regex fails then the entire moudle would too
 2013-07-03 00:43:08 +01:00
sinn3r 6815eef8f4 Fix multiple issues with memory_grep 
This fixes the following:
[FixRM:#8118] - Allows the module to be able to enumerate from
multiple processes with the same name.

[FixRM:#8120] - Allows the module to be able to actually read data
from the heap.
 2013-07-01 18:57:00 -05:00
sinn3r 43c4f07e06 Use "unless" 
Guidelines favor "unless".
 2013-06-30 18:32:15 -05:00
sinn3r 82eed1582f No need for the 2nd element 2013-06-28 17:05:43 -05:00
sinn3r a7ee95381b Updates module description, and uses the proper func for hex dump 
As an user, it's important to know that using this module may result
a lost session because it must migrate to grep memory, but does not
migrate back.

The module also has its own hex dump routine, which is no longer
needed because we have a built-in Rex::Text.to_hex_dump
 2013-06-28 16:28:00 -05:00
sinn3r ecfe083b0e Correct module naming style 
I was just looking at these modules on the web gui, and these names
need to be fixed to maintain style consistency.
 2013-06-25 00:26:53 -05:00
Meatballs ef56e48274 Fix datastore name 2013-06-20 22:22:00 +01:00
Meatballs 6c62463f83 Add ipv6 resolution and remove nix 2013-06-20 22:17:31 +01:00
Carlos Perez a9df55c27a Add Windows 2012 to regex matching 2013-06-09 20:46:44 -04:00
Carlos Perez 8e83f0ee30 Add Windows 8 and 2012 to regex matching 2013-06-09 20:41:46 -04:00
James Lee f4498c3916 Remove $Id tags 
Also adds binary coding magic comment to a few files
 2013-05-20 16:21:03 -05:00
Meatballs a96efb5f0d Small tidy 2013-05-18 16:21:00 +01:00
Meatballs a96739951b Filter out system users 2013-05-18 16:18:34 +01:00
Meatballs b10d216db2 Fix indent 2013-05-12 21:06:26 +01:00
Meatballs 37efad46bb Address feedback and reporting 2013-05-12 20:50:53 +01:00
James Lee 55fc1458de Simplify and clean up some 
I'd really love to make this work on Linux as well, since it's really
just a file grabber/parser. Unfortunately, the Post API for enumerating
users and homedirs isn't great for cross-platform stuff like this.

A few small changes, all verified on Windows 7:

* Reuse the key storing code instead of copy-paste with minor changes

* Use binary mode when opening the stored prefs

* Don't bother checking for incognito since we're using `steal_token`
  anyway

* Check for existence of directories instead of guessing based on OS
  match
 2013-05-10 16:58:35 -05:00
Rob Fuller 84ff72eb92 use file_exist? instead of fs.file.stat 2013-05-10 11:17:42 -04:00
Rob Fuller 25f7af43b4 use gsub instead of split/join 2013-05-10 11:12:56 -04:00
Rob Fuller 2f543d3080 extension and pref parsing 2013-05-09 13:23:28 -04:00
Meatballs 7fb092c58c Initial commit 2013-05-02 22:08:19 +01:00
jvazquez-r7 567d2bb14b Land #1687, @bmerinofe's forensic file recovery post module 2013-05-01 08:13:08 -05:00
jvazquez-r7 a201391ee6 Clean recovery_files 2013-04-30 13:18:32 -05:00
Meatballs e2bf4882f0 Add domain join parse 2013-04-26 00:20:10 +01:00
Meatballs 235887ccb5 Finished 2013-04-25 23:25:05 +01:00
Antoine 0115833724 SyntaxError fixes 2013-04-21 20:22:41 +00:00
root 830715dc07 Applying changes 2013-04-16 00:28:39 +02:00
Meatballs 4b4f77eb0f Finalize 2013-04-14 10:32:56 +01:00
Tod Beardsley ba86e14d43 Whitespace and caps fixes 2013-04-09 08:57:53 -05:00
root f369584bbd Timeout added 2013-04-08 23:32:07 +02:00
Meatballs 3660ad8c0a Initial attempt 2013-04-07 23:03:43 +01:00
Meatballs d94360c451 Merge remote branch 'upstream/master' into enum_ad_perf 2013-04-07 14:29:45 +01:00
James Lee ad46b46684 Landing #1463, Meatballs' cdecl fixes 2013-04-04 22:58:59 -05:00
Borja Merino d08640726b added post module forensics recovery files 2013-03-30 01:59:41 +01:00
jvazquez-r7 353f02cdcc move word_unc_injector to gather dir 2013-03-27 16:23:19 +01:00
Nathan Einwechter 096ec9a5d7 Fix to print out correct/full username 2013-03-22 10:22:24 -04:00
James Lee 2160718250 Fix file header comment 
[See #1555]
 2013-03-07 17:53:19 -06:00
sinn3r 3334257aa4 Merge branch 'bug/fix_screenspy' of github.com:kernelsmith/metasploit-framework into kernelsmith-bug/fix_screenspy 2013-02-26 13:54:47 -06:00
kernelsmith 8a91f0d7ec rescue ENOENT as well 2013-02-14 14:04:45 -06:00
Meatballs e958f588e5 Slight improvements 2013-02-12 20:22:23 +00:00
Meatballs cbbfa1765e Handling for 1000 limit 2013-02-11 23:27:03 +00:00
Meatballs 93449c55e2 msftidy 2013-02-10 21:52:31 +00:00
Meatballs 9764dd9a1a Added DB reporting 2013-02-10 21:42:15 +00:00
Meatballs d618513b5b x64 fix 2013-02-10 17:39:24 +00:00
Meatballs 6002759981 Info changes 2013-02-10 17:12:51 +00:00
Meatballs d1f63e6eac Info changes 2013-02-10 17:11:46 +00:00
Meatballs 6bef08f057 Significant speed improvement 2013-02-10 17:03:32 +00:00
Meatballs a6fea39583 Change to wldap to allow cdecl 2013-02-08 21:01:22 +00:00
sinn3r 4d7daacfb4 I wanna know where it's stored 2013-01-31 11:55:11 -06:00
sinn3r 13da4181c5 Merge branch 'feature/rm7605-version-for-MSCACHE-v1-and-v2' of github.com:lmercer-r7/metasploit-framework into lmercer-r7-feature/rm7605-version-for-MSCACHE-v1-and-v2 2013-01-31 11:51:55 -06:00
jvazquez-r7 174ab31010 Moving reused methods to Accounts mixin 2013-01-31 12:59:55 +01:00
kernelsmith 345c5f32cc keep it from migrating more than once into explorer.exe 
thanks for noticing egypt
we should add a migrate_explorer to the post api
 2013-01-30 15:40:02 -06:00
jvazquez-r7 1e1cbd7445 Merge branch 'wldap32_railgun' of https://github.com/Meatballs1/metasploit-framework into Meatballs1-wldap32_railgun 2013-01-30 21:01:31 +01:00
kernelsmith e1c037e523 Better error handling 2013-01-30 12:06:57 -06:00
kernelsmith f649cd53ad removed commented out code (again) 
thanks egypt
 2013-01-30 11:31:10 -06:00
kernelsmith 32a5a009d6 change loot type to image/jpg 
thanks egypt
 2013-01-30 11:28:47 -06:00
kernelsmith 6659459de5 del Version ref and change platform windows -> win 
per sinner's comments, thanks sinner.
 2013-01-30 10:56:49 -06:00
kernelsmith 80a0f0694d add 'auto' & 'none' VIEW_CMD, fixed looting, ch defaults 2013-01-30 00:49:48 -06:00
lmercer da5436e565 Made changes as described in Redmine issue 7605 2013-01-28 23:29:50 -05:00
sinn3r 933f807745 Msftidy cleanup + handling return values better 2013-01-22 23:53:00 -06:00
sinn3r dab2952d60 Merge branch 'picasa' of github.com:charles-n2netsec/metasploit-framework into charles-n2netsec-picasa 2013-01-22 22:54:45 -06:00
Charles Smith 9671df4488 Picasa 2 credentials are now also saved as loot 
This module used to save only Picasa 3 credentials as loot. Picasa
2 creds were displayed, but not saved. I've updated the module to
save Picasa 2 credentials, and I also updated the output code to
use print_good instead of print_status.
 2013-01-22 15:46:47 -05:00
jvazquez-r7 08062597b9 fix data added to table 2013-01-22 12:07:16 +01:00
jvazquez-r7 dce4e7fc08 Merge branch 'filezilla_server_bugs' of https://github.com/charles-n2netsec/metasploit-framework into charles-n2netsec-filezilla_server_bugs 2013-01-22 12:06:44 +01:00
Meatballs1 dcaf2abc53 Better feedback for x86 2013-01-20 00:22:30 +00:00
Meatballs1 567185ec65 Better cleanup and address comments 2013-01-20 00:19:17 +00:00
Meatballs1 771baa3181 Added x64 check and options to info 2013-01-19 23:23:45 +00:00
Tod Beardsley ef97b20cb7 Merge branch 'wds_unattend' 2013-01-18 14:42:00 -06:00
Charles Smith 892899acd5 Fixed loot formatting so data is under the proper column 
The credentials table was defined with the columns "User", "Password", "Host", "Port", and "SSL".  Credentials were not added in that order, however. They were added in the order "host, port, user, password, ssl" in this line:

credentials << [cred['host'], cred['port'], cred['user'], cred['password'], cred['ssl']]

I changed the order the columns were defined to fix this.

The permissions table had a similar issue. The "FileWrite" column was missing, so I added it. I also moved the "Home" column to after the "AutoCreate" column. Now the line:

permissions << [perm['host'], perm['user'], perm['dir'], perm['fileread'], perm['filewrite'], perm['filedelete'], perm['fileappend'],perm['dircreate'], perm['dirdelete'], perm['dirlist'], perm['dirsubdirs'], perm['autocreate']]

works correctly.
 2013-01-17 16:52:02 -05:00
jvazquez-r7 09b4a09ce1 module razer_synapse cleanup 2013-01-17 16:53:00 +01:00
jvazquez-r7 99296006c1 Merge branch 'razer_synapse.rb' of https://github.com/smilingraccoon/metasploit-framework into smilingraccoon-razer_synapse.rb 2013-01-17 16:52:26 +01:00