88ab836e15
Land #9987 , AF_PACKET chocobo_root exploit
2018-05-21 17:05:53 +08:00
294b263159
Land #9966 , Add Reliable Datagram Sockets (RDS) Privilege Escalation exploit
...
Merge branch 'land-9966' into upstream-master
2018-05-18 17:06:04 -05:00
eadb464a75
add licenses
2018-05-17 21:21:37 -05:00
e5c763f6bf
Add support for stdio.h, stdlib.h, and String.h
2018-05-17 14:40:49 -05:00
6594cbb5cc
Land #9947 , AF_PACKET packet_set_ring exploit
2018-05-17 18:43:52 +08:00
4322e56c71
Recompile pre-compiled exploit executable (stripped, no DEBUG)
2018-05-17 09:43:07 +00:00
da07113194
Land #10007 , add C interface for building Windows shell code (metasm-backed)
2018-05-16 22:58:32 -05:00
ce5b24eda0
fork early and cleanup files in module
2018-05-17 00:32:01 +08:00
ed5f2bffa9
Land #9919 , add libuser roothelper privilege escalation exploit
2018-05-12 17:11:21 +08:00
6cd59faa69
Namespace update
2018-05-11 10:27:54 -05:00
76865732c8
Namespace update
2018-05-11 10:26:59 -05:00
82c8138de0
Update naming and license
2018-05-11 10:08:16 -05:00
caf07116db
Add compiler support capable of including headers.
...
This is basically a wrapper for metasm, but supports built-in
headers so that as an user, I don't have manually do this
every time I compile something with metasm.
2018-05-10 00:33:01 -05:00
5ae9b0185d
Add AF_PACKET chocobo_root Privilege Escalation exploit
2018-05-07 07:11:07 +00:00
ce5be387c4
Land #8795 , Added CVE-2016-0040 Windows Privilege Escalation
...
Merge branch 'land-8795' into upstream-master
2018-05-03 16:33:53 -05:00
729461e448
Re-add compiled Binary
2018-05-03 15:50:15 -05:00
16432efd8f
Remove binary file
2018-05-03 14:45:58 -05:00
3a688451b6
Add Reliable Datagram Sockets (RDS) Privilege Escalation
2018-05-03 12:51:21 +00:00
f7504dd9d5
Add AF_PACKET packet_set_ring Privilege Escalation exploit
2018-04-28 01:40:17 +00:00
00583caadf
Add Libuser roothelper Privilege Escalation exploit
2018-04-23 17:49:11 +00:00
2914ebf631
lpe ufo
2018-04-17 20:39:59 -04:00
0faf2f4e04
Land # 8007, Added NTDSgrab module to metasploit.
...
Merge branch 'land-8007' into upstream-master
2018-04-03 15:56:37 -05:00
c5039251a2
add CVE-2016-4655
...
rebase
2018-04-03 14:58:57 +08:00
862a3ff74d
Land #9618 , pipe auditing improvements
2018-03-26 17:01:48 -05:00
6b0691a91a
cve-2017-16995
2018-03-23 21:09:56 -04:00
6e9a4916f5
scanner update
2018-03-13 00:23:18 +05:30
2b7364a637
Add wordlist
2018-03-09 21:46:07 +05:30
1342284dc9
Add wordlist
2018-03-09 21:38:59 +05:30
8453bc7f01
Correct metasploit heart banner filename
2018-03-02 17:23:34 -05:00
952c112f4a
Add metasploit heart banners
2018-03-01 15:18:58 -05:00
a01f0f3023
fix #9366 , fix osx x64 stage location
2018-02-20 13:50:44 +08:00
285b329ee1
Land #9422 abrt race condition priv esc on linux
2018-02-11 11:58:39 -05:00
2eca3b925b
Land #9491 , remove extra HTML from doc templates
2018-02-02 18:15:02 -05:00
955bb5e38a
remove extra HTML from doc markdown templates
2018-02-02 17:02:23 -06:00
0a3fe0c608
fix html escaping for UTF-8 module metadata
2018-02-02 16:35:50 -06:00
7cb0a118c1
Land #9399 a linux priv esc against apport and abrt
2018-02-01 21:54:54 -05:00
aae77fc1a4
Land #9349 , GoAhead LD_PRELOAD CGI Module
2018-01-22 23:10:36 -06:00
035cdb1bca
Add v5 under construction banner
2018-01-17 17:24:28 -06:00
5e11d36351
Add ABRT raceabrt Privilege Escalation module
2018-01-16 14:52:33 +00:00
2f3e3b486a
Use cross-compiled exploit
2018-01-13 05:44:42 +00:00
8bbffd20cd
Add Apport chroot Privilege Escalation exploit
2018-01-12 07:25:35 +00:00
a5fa63405f
Land #9206 , Add Xplico RCE exploit module
2018-01-03 16:02:51 -06:00
0b9fbe5a63
Resolve a bug in reverse_tcp and segfaults across payloads
2017-12-29 14:18:55 -06:00
ab8886e25c
Updated payloads and addition of payload stubs
2017-12-28 16:21:37 -06:00
d4bc98c13f
Merge branch 'upstream-master' into feature/mqtt-login
2017-12-22 08:07:40 -08:00
caae33b417
Land #9170 , Linux UDF for mysql_udf_payload
2017-12-21 20:48:24 -06:00
37ae5e1303
Add admin as a default unix passwd
2017-12-20 18:44:21 -08:00
e73ae9e1a4
Remove the useless findsock wrapper
2017-12-18 22:09:35 -06:00
a44010deb1
WIP for GoAhead LD_PRELOAD
2017-12-18 10:51:47 -06:00
942e44ceae
Added local copies of the static content
2017-12-02 10:14:14 +01:00
86e47589b0
Add xplico remote code execution
2017-11-14 09:30:57 +03:00
5a07be9b96
Land #9041 , Add LPE on Windows using CVE-2017-8464
2017-11-08 10:09:03 -06:00
4abe8ff0d9
recompile binaries
2017-11-08 09:33:48 -06:00
9b24ed8406
Removed binaries for recompile
2017-11-08 09:26:40 -06:00
c2578c1487
Refactor GetProcessSid to remove do while FALSE
2017-11-07 19:11:24 -05:00
697031eb36
mysql UDF now multi
2017-11-03 05:26:05 -04:00
294230c455
Land #8509 , add Winsxs bypass for UAC
2017-10-11 16:24:52 -05:00
fd963245a4
Recompiled old binaries that used
...
external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp
to make sure the changes don't break them later.
2017-10-10 11:28:49 -05:00
c63d5fb4fb
Recompiled binaries
2017-10-09 12:44:58 -05:00
0bf948e906
Removed binary files before recompiling
2017-10-09 11:35:41 -05:00
7df18e378d
Fix conflicts in PR 8509 by mergeing to master
2017-10-09 10:30:21 -05:00
3f6f70f820
Move the cve-2017-8464 source to external/source
2017-10-08 13:58:51 -04:00
d0ebfa1950
Change the template technicque to work as an LPE
2017-10-05 10:30:28 -04:00
949633e816
Cleanup cve-2017-8464 template and build script
2017-10-02 15:18:13 -04:00
831b148ac6
Fix consistency issue in 'r7-metasploit' banner
...
This has bugged me for a while, finally fixing it.
2017-09-15 22:19:00 -05:00
2ee94ca3d9
made changes based on PR feedback.
2017-09-01 16:49:17 -07:00
b7fc990d17
moved project to the source directory.
2017-09-01 16:09:53 -07:00
6fb0a06672
add pastebin IoT credentials
2017-08-25 08:57:20 -05:00
d2e6af1845
sort|uniq
2017-08-25 08:54:49 -05:00
605330faf6
Land #8842 , add linux/aarch64/shell_reverse_tcp
2017-08-21 15:44:28 -05:00
e734a7923a
Land #8267 , Handle multiple entries in PSModulePath
2017-08-20 17:44:30 -05:00
d5a5321a8c
Merge remote-tracking branch 'upstream/pr/8299' into land-8267-
2017-08-20 17:43:56 -05:00
dc358dd087
unknow to unknown
2017-08-18 11:33:48 -04:00
8b4ccc66c7
add linux/aarch64/shell_reverse_tcp
2017-08-17 18:55:37 +08:00
cad266d469
added source code for CVE-2016-0040
2017-08-11 15:54:01 -04:00
33d3fd20a1
added CVE-2016-0040 privilege escalation exploit.
2017-08-03 19:12:32 -04:00
81500f7336
Updated Mutex code, reduce the number of times the payload is executed
2017-08-03 10:26:55 -05:00
c3bc27385e
Added source code for DLL template
2017-08-02 15:47:22 -05:00
46ec04dd15
Removed This PC ItemID & increased timeout in WaitForSingleObject
...
Remove the This PC ItemID to bypass (some) AV.
Timeout for WaitForSingleObject is set to 2,5s. After this timeout a
mutex is released allowed a new payload to be executed.
2017-08-02 15:47:22 -05:00
e6e94bad4b
Replace CreateEvent with CreateMutex/WaitForSingleObject
...
Time out is set to 1500 ms to prevent running the payload multiple times
2017-08-02 15:47:22 -05:00
e51e1d9638
Added new DLL templates to prevent crashing of Explorer
2017-08-02 15:47:21 -05:00
6300758c46
use https for metaploit.com links
2017-07-24 06:26:21 -07:00
bc3b883758
Add docs, fix typo, add missing report mixin to avoid error.
2017-06-05 13:49:59 -05:00
6a3fc618a4
Add bypassuac_injection_winsxs.rb module
2017-06-03 12:59:50 +02:00
a01a2ead1a
Land #8467 , Samba CVE-2017-7494 Improvements
2017-05-30 00:15:03 -05:00
38491fd7ba
Rename payloads with os+libc, shrink array inits
2017-05-27 19:50:31 -05:00
b7b0c26f4a
Reduce minimum GLIBC versions where we can
2017-05-27 19:28:41 -05:00
184c8f50f1
Rework the Samba exploit & payload model to be magic.
2017-05-27 17:03:01 -05:00
d4ba28a20b
Land #8457 , Update multi/fileformat/office_word_macro to allow custom templates
2017-05-26 15:09:23 -05:00
ee13195760
Update office_word_macro exploit to support template injection
2017-05-25 15:53:45 -05:00
0520d7cf76
First crack at Samba CVE-2017-7494
2017-05-24 19:42:04 -05:00
afc804fa03
Quick Ghostscript module based on the public PoC
2017-04-28 09:56:52 -05:00
f3d6a8c456
split PSModulePath in multi strings with ';'
...
1、allows the HTA window to be invisible
2017-04-26 11:01:59 +08:00
5bbb4d755a
Land #8254 , Add CVE-2017-0199 - Office Word HTA Module
2017-04-24 16:05:00 -05:00
c724f0e05d
Handle multiple entries in PSModulePath
...
This commit handles the case where more than one entry exists in
the PSModulePath environment variable. The updated code will loop
through each entry in the PSModulePath checking for the presence of
powershell.exe. When one is encountered it will execute the payload
and exit the for loop.
2017-04-19 11:22:38 -04:00
637098466c
Hidden black flash windows / Close HTA windows
2017-04-16 22:53:17 -05:00
a9df917257
Fix rtf info author
2017-04-14 21:16:39 -05:00
8c662562d3
add CVE-2017-0199 format
2017-04-14 13:22:32 -05:00
437d9b6f02
Fixed newline error in powershell script.
2017-04-05 12:38:38 +02:00
64c06a512e
Land #8020 , ntfs-3g local privilege escalation
2017-04-04 09:48:15 -05:00
Tim W
bwatters-r7
Brent Cook
Wei Chen
Brendan Coles
h00die
William Vu
Auxilus
Matthew Kienow
dmohanty-r7
HD Moore
Jon Hart
Yorick Koster
Mehmet İnce
Spencer McIntyre
james
Kirk Swidowski
Kirk Swidowski
Brent Cook
Pearce Barry
L3cr0f
William Webb
anhilo
Brandon Knight
nixawk
Koen Riepe