infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
27,710 Commits
7 Branches
556 Tags
421 MiB
Commit Graph

14651 Commits (2fa02f5c444e8155da4148e3e96dd2267f3f4e61)

Author SHA1 Message Date
Christian Mehlmauer c51c19ca88 bugfix 2014-09-27 14:56:34 +02:00
Christian Mehlmauer 9a424a81bc fixed bug 2014-09-27 13:46:55 +02:00
Christian Mehlmauer 1c30c35717 Added WordPress custom_contact_forms module 2014-09-27 13:42:49 +02:00
sinn3r c75a0185ec
Land #3897 - Fix check for apache_mod_cgi_bash_env & apache_mod_cgi_bash_env_exec 2014-09-26 17:06:23 -05:00
jvazquez-r7 80d9af9b49 Fix spacing in description 2014-09-26 17:03:28 -05:00
jvazquez-r7 9e540637ba Add module for CVE-2014-5377 ManageEngine DeviceExpert User Credentials 2014-09-26 17:02:27 -05:00
jvazquez-r7 3259509a9c Use return 2014-09-26 16:04:15 -05:00
jvazquez-r7 0a3735fab4 Make it better 2014-09-26 16:01:10 -05:00
jvazquez-r7 3538b84693 Try to make a better check 2014-09-26 15:55:26 -05:00
jvazquez-r7 6e2d297e0c Credit the original vuln discoverer 2014-09-26 13:45:09 -05:00
jvazquez-r7 e1f00a83bc Fix Rex because domainname and domain_name were duplicated 2014-09-26 13:40:52 -05:00
jvazquez-r7 5044117a78 Refactor dhclient_bash_env to use the egypt's mixin mods 2014-09-26 13:34:44 -05:00
jvazquez-r7 a4bc17ef89 deregister options needed for exploitation 2014-09-26 10:15:46 -05:00
jvazquez-r7 54e6763990 Add injection to HOSTNAME and URL 2014-09-26 10:13:24 -05:00
jvazquez-r7 a31b4ecad9
Merge branch 'review_3893' into test_land_3893 2014-09-26 08:41:43 -05:00
James Lee 86f85a356d
Add DHCP server module for CVE-2014-6271 2014-09-26 01:24:42 -05:00
sinn3r 38c8d92131
Land #3888 - exploit module version of CVE-2014-6271 2014-09-26 00:31:41 -05:00
HD Moore b878ad2b75 Add a module to exploit bash via DHCP, lands #3891 
This module is just a starting point for folks to test their DHCP client implementations and we plan to significantly overhaul this once we get a bit of breathing room.
 2014-09-25 23:38:40 -05:00
Ramon de C Valle 9c11d80968 Add dhclient_bash_env.rb (Bash exploit) 
This module exploits a code injection in specially crafted environment
variables in Bash, specifically targeting dhclient network configuration
scripts through the HOSTNAME, DOMAINNAME, and URL DHCP options.
 2014-09-26 01:37:00 -03:00
jvazquez-r7 ad864cc94b Delete unnecessary code 2014-09-25 16:18:01 -05:00
Joe Vennix 2b02174999
Yank Android->jsobfu integration. Not really needed currently. 2014-09-25 16:00:37 -05:00
jvazquez-r7 9245bedf58 Make it more generic, add X86_64 target 2014-09-25 15:54:20 -05:00
Samuel Huckins be6552dae7
Clarifying VMware priv esc via bash module name 2014-09-25 14:34:09 -05:00
jvazquez-r7 d8c03d612e Avoid failures due to bad payload selection 2014-09-25 13:49:04 -05:00
jvazquez-r7 91e5dc38bd Use datastore timeout 2014-09-25 13:36:05 -05:00
jvazquez-r7 8a43d635c3 Add exploit module for CVE-2014-6271 2014-09-25 13:26:57 -05:00
jvazquez-r7 e0fc30c040
Land #3884, @wvu's check and reporting for apache_mod_cgi_bash_env 2014-09-25 09:52:17 -05:00
William Vu f66c854ad6
Fix description to be less lulzy 2014-09-25 07:09:08 -05:00
William Vu 9ed28408e1
Favor check_host for a scanner 2014-09-25 07:06:12 -05:00
William Vu 62b74aeaed
Reimplement old check code I was testing before 
I would like to credit @wchen-r7 for providing advice and feedback.

@jvazquez-r7, too! :)
 2014-09-25 06:38:25 -05:00
William Vu d9120cd586
Fix typo in description 
Running on fumes here...
 2014-09-25 01:22:08 -05:00
William Vu 790df96396
Fix missed var 2014-09-25 01:19:14 -05:00
Rob Fuller f13289ab65 remove debugging 2014-09-25 02:16:19 -04:00
William Vu e051cf020d
Add missed mixin 2014-09-25 01:14:58 -05:00
William Vu 27b8580f8d
Add protip to description 
This gets you lots of shells.
 2014-09-25 01:10:22 -05:00
Rob Fuller 8cb4ed4cb7 re-add quotes -oops 2014-09-25 02:09:12 -04:00
William Vu b1e9b3664e
Improve false positive check 2014-09-25 01:01:11 -05:00
Rob Fuller 6fb587ef96 update to use vmware-vmx-stats 2014-09-25 01:55:04 -04:00
William Vu 8daf8d4339 Report vuln for apache_mod_cgi_bash_env 
Now with fewer false positives! It's kinda like a check method.
 2014-09-25 00:42:14 -05:00
jvazquez-r7 37753e656e
Land #3882, @jvennix-r7's vmware/bash privilege escalation module 2014-09-25 00:42:12 -05:00
jvazquez-r7 456d731aa3 Fix processes check 2014-09-25 00:24:39 -05:00
William Vu 5a59b7cd89
Fix formatting 2014-09-24 23:12:11 -05:00
William Vu e6f0736797
Add peer 2014-09-24 22:48:51 -05:00
William Vu 8b6519b5b4
Revert shortened reference 
But it's so long. :(
 2014-09-24 22:43:33 -05:00
William Vu ecb10ebe28
Add variable HTTP method and other stuff 2014-09-24 22:41:01 -05:00
Joe Vennix f6708b4d83
Check for running vmware processes first. 2014-09-24 19:11:38 -05:00
William Vu a600a0655d
Scannerify the module 2014-09-24 18:58:39 -05:00
William Vu abadf65d8d
Clean up title and formatting 2014-09-24 18:42:43 -05:00
William Vu 2562964581
Revert to my original code of using CMD 2014-09-24 18:00:13 -05:00
Joe Vennix 99da950734
Adds osx vmware/bash priv escalation. 2014-09-24 17:44:14 -05:00
William Vu 6ae578f80f
Add Stephane Chazelas as an author 2014-09-24 17:14:18 -05:00
William Vu b2555408a4
Rename module 
I don't think we're gonna make a supermodule like we had hoped.
 2014-09-24 16:55:10 -05:00
William Vu 31e9e97146
Replace unnecessary reference with a better one 2014-09-24 16:52:43 -05:00
William Vu fc04bf9d48
Update description 
This is what I had when @todb-r7 beat me to the punch. >:P
 2014-09-24 16:22:58 -05:00
Tod Beardsley 2f788c2e0c
Fix description 2014-09-24 16:13:05 -05:00
Joe Vennix b96a7ed1d0
Install a global object in firefox payloads, bump jsobfu. 2014-09-24 16:05:00 -05:00
William Vu ca63fe931d
Add CVE-2014-6271 PoC 2014-09-24 16:02:59 -05:00
Joe Vennix 5d234c0e01
Pass #send in this so jsobfu is not confused. 2014-09-24 15:07:14 -05:00
jvazquez-r7 0247e4a521 Change RequiredCmd for reverse_bash_telnet_ssl cmd payload 2014-09-24 00:40:14 -05:00
jvazquez-r7 f2cfbebbfb Add module for ZDI-14-305 2014-09-24 00:22:16 -05:00
Brendan Coles 5f6e84580c Clean up and use Metasploit::Credential 2014-09-24 01:00:23 +00:00
sinn3r 11b9a8a6ae
Land #3814 - Advantech WebAccess dvs.ocx GetColor BoF 2014-09-23 15:06:21 -05:00
jvazquez-r7 b021ff4399 Add noche tags 2014-09-23 13:11:06 -05:00
jvazquez-r7 5c6236e874 Fix rop chain to allow VirtualAlloc when end of stack is too close 2014-09-23 13:08:26 -05:00
sinn3r 31ecbfdc4e
Land #3756 - EMC AlphaStor Device Manager Opcode 0x75 Command Injection 2014-09-23 12:57:46 -05:00
Jon Hart 259a368577
Land #3841, @jabra-'s modifications to ssdp_amp to support spoofing 2014-09-22 12:28:46 -07:00
Jon Hart fc4c1907d3 Land #3839, @jabra-'s updates to dns_amp to support spoofing 2014-09-22 12:14:39 -07:00
Jon Hart 8f63075da4
Land #3837, @jabra-'s update to chargen scanner to support spoofing 2014-09-22 12:02:01 -07:00
Jon Hart 4e9f1282de
Land #3834, @jabra-'s updates to UDPscanner to support spoofing 2014-09-22 11:49:53 -07:00
Joe Vennix d9e6f2896f
Add the JSObfu mixin to a lot of places. 2014-09-21 23:45:59 -05:00
sinn3r 2a714a7c4d Fix a typo 
Downloading and deleting are two very different things. Thanks Dan.
 2014-09-21 18:35:26 -05:00
Josh Abraham b7a0847114 SRC IP spoofing added to the SSDP amplification module 2014-09-20 21:37:01 -04:00
Josh Abraham bb018de3a1 chargen src IP spoofing 2014-09-20 16:08:52 -04:00
Josh Abraham 3fb00ece9e refactored the code based on PR feedback 2014-09-20 14:10:00 -04:00
jvazquez-r7 9acccfe9ba Fix description 2014-09-19 17:18:59 -05:00
jvazquez-r7 d826132f87 Delete CVE, add EDB 2014-09-19 17:16:03 -05:00
jvazquez-r7 7afbec9d6c
Land #2890, @Ahmed-Elhady-Mohamed module for OSVDB 93034 2014-09-19 17:12:49 -05:00
jvazquez-r7 1fa5c8c00c Add check method 2014-09-19 17:11:16 -05:00
jvazquez-r7 ce0b00bb0b Change module location and filename 2014-09-19 16:59:35 -05:00
jvazquez-r7 0267e889e2 Use FileDropper 2014-09-19 16:58:21 -05:00
jvazquez-r7 6fd5027e05 Avoid UploadPath datastore option, parse from response 2014-09-19 16:55:28 -05:00
jvazquez-r7 2ce9bdf152 Use target_uri.path.to_s instead of uri 2014-09-19 16:43:40 -05:00
jvazquez-r7 eb55c7108b Fix indentantion again 2014-09-19 16:41:07 -05:00
jvazquez-r7 cbfb7e600d Use Rex::MIME::Message 2014-09-19 16:29:09 -05:00
jvazquez-r7 cffb28b5d3 Fix indentantion 2014-09-19 16:18:46 -05:00
jvazquez-r7 c00094ba6e
Land #3345, @mvdevnull's auxiliary module for OSVDB 106815, Alienvault sqli 2014-09-19 15:01:21 -05:00
jvazquez-r7 62414e2214 Add Timeout to exploit sqli 2014-09-19 15:00:54 -05:00
jvazquez-r7 db6372ec8b Do minor module cleanup 2014-09-19 14:43:35 -05:00
jvazquez-r7 4a9294e3bf Mark module as not executable 2014-09-19 14:36:44 -05:00
jvazquez-r7 405ac34a16 Fix author name 2014-09-19 13:56:13 -05:00
jvazquez-r7 79d5fb56d4
Land #3829, @jhart-r7's UDP emtpy probe scanner 2014-09-19 13:54:35 -05:00
Jon Hart 737f77d31a
Cleaner output when PORTS is invalid 2014-09-19 11:12:14 -07:00
Jon Hart 3493987300
report_service when we find something this way 2014-09-19 10:45:06 -07:00
Josh Abraham 43171141da update for ntp modules 2014-09-19 11:14:11 -04:00
Jon Hart a54b23642e
Relocate empty UDP scanner 2014-09-18 12:31:52 -07:00
Brendan Coles 6cad5d9aeb Add ManageEngine DeviceExpert User Credentials 2014-09-18 19:18:59 +00:00
Tod Beardsley 5dad73a28f
Explicitly require credential_collection 
Otherwise, you run into a require ordering problem on some platforms.
This is not a great way to fix this -- but it's a fast way, and possibly
even a good way, since you're being explicit about what your module
requirements are.
 2014-09-17 15:47:30 -05:00
jvazquez-r7 64ac1e6b26 Rand padding 2014-09-17 08:09:09 -05:00
sinn3r 50fa5745bb Rm print_debug line 
I forgot to remove this line while testing the module
 2014-09-16 16:46:40 -05:00
jvazquez-r7 e593a4c898 Add comment about gadgets origin 2014-09-16 16:38:03 -05:00