11c10518b3
Bug fixes for better windows OS compatibility
...
git-svn-id: file:///home/svn/framework3/trunk@9002 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 14:57:51 +00:00
cd2760f2c2
Bug fixes and size improvements for the reverse_https stager
...
git-svn-id: file:///home/svn/framework3/trunk@9001 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 13:53:35 +00:00
e968c3894e
More size tweaks
...
git-svn-id: file:///home/svn/framework3/trunk@8999 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 08:03:28 +00:00
c8defe9716
Size tweaks to bring the ssl stager + encoder + target_id to exactly 400 bytes
...
git-svn-id: file:///home/svn/framework3/trunk@8998 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 07:48:53 +00:00
d2f44f4a22
Keywords
...
git-svn-id: file:///home/svn/framework3/trunk@8986 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 05:22:20 +00:00
b50d9049f0
Add the actual stager
...
git-svn-id: file:///home/svn/framework3/trunk@8985 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 05:21:42 +00:00
c6c956ab46
Small patch to enable a new stager
...
git-svn-id: file:///home/svn/framework3/trunk@8984 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 05:21:15 +00:00
5d0fb434b7
Adds a reverse_tcp_dns stager
...
git-svn-id: file:///home/svn/framework3/trunk@8983 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 03:38:57 +00:00
eb003518ce
add auto_target to apache_chunked exploit - should reduce run duration in most cases
...
git-svn-id: file:///home/svn/framework3/trunk@8980 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-02 16:26:01 +00:00
776259e3c6
bleh, fix comma
...
git-svn-id: file:///home/svn/framework3/trunk@8979 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-02 15:51:55 +00:00
5c34cce14a
add note about possibly incorrect references
...
git-svn-id: file:///home/svn/framework3/trunk@8978 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-02 15:38:11 +00:00
82b6f05fa9
add exploit module from m_101
...
git-svn-id: file:///home/svn/framework3/trunk@8975 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-01 17:10:07 +00:00
61b4500ffd
remove svn:executable from various files
...
git-svn-id: file:///home/svn/framework3/trunk@8974 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-01 16:20:34 +00:00
970efbc628
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8971 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-01 11:27:56 +00:00
b5ee26770b
Cameled all vars on accident, uncameling regular opts. Also, broke native osx payload, oops.
...
git-svn-id: file:///home/svn/framework3/trunk@8970 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-01 05:15:26 +00:00
f10d0fbb41
added exploit module hp_nnm_ovwebhelp.rb
...
git-svn-id: file:///home/svn/framework3/trunk@8969 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-01 00:47:31 +00:00
ff8cdc29aa
update description with a little history
...
git-svn-id: file:///home/svn/framework3/trunk@8968 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-31 22:36:10 +00:00
516a6f47e5
move USERNAME/PASSWORD setting to exploit instead of auto_target so manual targets work - fixes #1416
...
git-svn-id: file:///home/svn/framework3/trunk@8967 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-31 22:29:47 +00:00
c1fa8d60f7
Expose exe :template and :insert via advanced options plus formatting changes. Thanks MarkBagget for the kick in the pants and the example options to to_win32pe\!
...
git-svn-id: file:///home/svn/framework3/trunk@8966 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-31 22:05:32 +00:00
da874c323a
renamed and udpated "iepeers" vuln with latest information/name
...
git-svn-id: file:///home/svn/framework3/trunk@8965 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-31 20:15:22 +00:00
c9ad11fbe1
Fix typo in title. Thanks ragecyr!
...
git-svn-id: file:///home/svn/framework3/trunk@8961 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-30 17:57:22 +00:00
aaee658c3c
fix 1.8/1.9 compat issue
...
git-svn-id: file:///home/svn/framework3/trunk@8960 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-30 17:00:39 +00:00
477a424cab
silly comma...
...
git-svn-id: file:///home/svn/framework3/trunk@8959 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-30 06:42:59 +00:00
ee90abb049
author fix
...
git-svn-id: file:///home/svn/framework3/trunk@8958 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-30 04:26:14 +00:00
c9d321b352
clean up comments
...
git-svn-id: file:///home/svn/framework3/trunk@8957 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-30 01:40:26 +00:00
b2f3e91c8b
add a target for v8.6.0.1936
...
git-svn-id: file:///home/svn/framework3/trunk@8955 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-29 18:19:59 +00:00
0a6547045d
add exploit module for cve-2007-2888
...
git-svn-id: file:///home/svn/framework3/trunk@8953 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-29 17:21:15 +00:00
ba12ddd280
Allow authbrute modules to use a single username/password in a sane way
...
git-svn-id: file:///home/svn/framework3/trunk@8945 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 23:52:43 +00:00
9cc4cab9ec
Duplicate the datastore and manually set user/pass in the telnet/ssh modules
...
git-svn-id: file:///home/svn/framework3/trunk@8943 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 22:57:29 +00:00
b0425f10cd
Cleanup some of the output
...
git-svn-id: file:///home/svn/framework3/trunk@8942 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 22:13:50 +00:00
4bac76cc9e
Fix XOR encoding for this module
...
git-svn-id: file:///home/svn/framework3/trunk@8940 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 20:17:33 +00:00
79e277450a
add reliable IE7 trigger from Nanika
...
git-svn-id: file:///home/svn/framework3/trunk@8935 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 01:31:19 +00:00
3dc30aeed6
minor whitespace change
...
git-svn-id: file:///home/svn/framework3/trunk@8934 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 01:30:40 +00:00
89d6907a8f
fix typoez
...
git-svn-id: file:///home/svn/framework3/trunk@8933 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-27 00:35:48 +00:00
f649c4a92c
raise exception if unable to login
...
git-svn-id: file:///home/svn/framework3/trunk@8932 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-26 19:00:23 +00:00
4945d53500
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8931 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-26 11:37:59 +00:00
cae262e374
added cve reference. thanks Kurt.
...
git-svn-id: file:///home/svn/framework3/trunk@8924 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-26 00:47:13 +00:00
bcbfb5f900
added exploit module dbms_export_extension.rb
...
git-svn-id: file:///home/svn/framework3/trunk@8923 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 23:49:54 +00:00
cd71cfbad1
Handle buggy HTTP servers better
...
git-svn-id: file:///home/svn/framework3/trunk@8921 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 21:35:37 +00:00
25ec5fa444
Do a little better password management for services that don't ask for usernames -- fingerprint them ahead of time, and resort the credentials list in a usernameless way. Also, this allows telnet RST's to be treated just as busy services, since sometimes telnet servers get persnickety about a lot of login attempts, but they do come back shortly.
...
git-svn-id: file:///home/svn/framework3/trunk@8920 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 21:32:32 +00:00
22cb5a6bea
1.9 compatibility fixes for lpd exploits, clarification in the print messages that we are *trying* to exploit something, not absolutely doing so
...
git-svn-id: file:///home/svn/framework3/trunk@8916 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 14:52:35 +00:00
6d606a7587
Fixes #1304 . Removes the this_cred bit since that got swapped out for the new auth_brute scheme.
...
git-svn-id: file:///home/svn/framework3/trunk@8915 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 13:27:29 +00:00
a27c941714
targ_host -> target_host
...
git-svn-id: file:///home/svn/framework3/trunk@8909 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 01:09:04 +00:00
dd26a227ef
targ_host -> target_host
...
git-svn-id: file:///home/svn/framework3/trunk@8908 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 01:05:23 +00:00
fd97c89959
targ_host --> target_host for consistency with other modules
...
git-svn-id: file:///home/svn/framework3/trunk@8907 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 00:41:58 +00:00
282c2fb2b2
targ_host --> target_host for consistency with other modules
...
git-svn-id: file:///home/svn/framework3/trunk@8906 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-25 00:40:50 +00:00
f16b1b5b7a
Add CVE reference for open NFS shares
...
git-svn-id: file:///home/svn/framework3/trunk@8905 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 22:40:06 +00:00
af3ab0a260
Handle situations where any user/pass is allowed
...
git-svn-id: file:///home/svn/framework3/trunk@8904 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 21:11:00 +00:00
3a88909c06
Rename for consistency
...
git-svn-id: file:///home/svn/framework3/trunk@8903 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 20:33:21 +00:00
aa1c65f4e6
Add a quick and dirty HTTP scanner
...
git-svn-id: file:///home/svn/framework3/trunk@8901 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 20:28:09 +00:00
4f657ef868
add exploit module for cve-2009-1260
...
git-svn-id: file:///home/svn/framework3/trunk@8900 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 19:35:29 +00:00
1dc7a4a21f
i'm tired of support requests for oci libs not being installed
...
git-svn-id: file:///home/svn/framework3/trunk@8899 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 19:02:38 +00:00
24d93655bb
print the report results even if the db is not available. see #737
...
git-svn-id: file:///home/svn/framework3/trunk@8898 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 16:28:04 +00:00
2b419a421d
Add default timeouts to autopwn, control with -T
...
git-svn-id: file:///home/svn/framework3/trunk@8892 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 00:11:21 +00:00
75661291fa
and the bins, tiny modification to the ruby side and update the README.
...
git-svn-id: file:///home/svn/framework3/trunk@8891 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 00:03:32 +00:00
5c1cf6aefb
correction to target descriptions
...
git-svn-id: file:///home/svn/framework3/trunk@8889 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-23 06:54:45 +00:00
39537bfc53
add an office xp sp0 target
...
git-svn-id: file:///home/svn/framework3/trunk@8888 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-23 06:00:54 +00:00
3dbfd0b8e3
A little too verbose
...
git-svn-id: file:///home/svn/framework3/trunk@8884 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-22 22:44:58 +00:00
1458fbad54
Adds some fingerprinting to the tomcat manager login auxiliary module.
...
git-svn-id: file:///home/svn/framework3/trunk@8883 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-22 22:19:46 +00:00
83d96d713c
Refactoring Auxiliary::AuthBrute. Now that several modules actually use it, the real use cases have become obvious. So, refactored for simplicity and readability. Also touched up all the authentication modules to behave consistently.
...
git-svn-id: file:///home/svn/framework3/trunk@8879 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-22 20:07:26 +00:00
4c913a576d
Remove OS reporting, this is handled better elsewhere
...
git-svn-id: file:///home/svn/framework3/trunk@8871 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-22 00:20:09 +00:00
9632f8251a
Move OS-level fingerprints out, report note-level fingerprints instead
...
git-svn-id: file:///home/svn/framework3/trunk@8869 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-22 00:09:04 +00:00
480380003c
Make verbose status printing standardized across login modules
...
git-svn-id: file:///home/svn/framework3/trunk@8866 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-21 18:42:47 +00:00
b8b11338b1
add linux x86/x86_64 support for tomcat manger deploy, see #1016
...
git-svn-id: file:///home/svn/framework3/trunk@8853 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-19 02:13:02 +00:00
d270d8aa95
update author comments
...
git-svn-id: file:///home/svn/framework3/trunk@8852 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-18 23:52:28 +00:00
a940d9a810
add exploit module for VariCAD 2010-2.05 DWB bug
...
git-svn-id: file:///home/svn/framework3/trunk@8851 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-18 23:47:52 +00:00
c1976e22f3
Adding J Duenow's sport patch to synflood. Thanks!
...
git-svn-id: file:///home/svn/framework3/trunk@8849 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-18 16:30:57 +00:00
9311253e32
<pre>revert stty -echo execution -- it breaks telnets to some devices</pre>
...
git-svn-id: file:///home/svn/framework3/trunk@8848 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-18 15:40:15 +00:00
3f69bb8053
Fixes the handling for telnet services when the server is "busy" -- this is common wit HP JetDirect servers, where the server will respond with a busy message up to several seconds after the last connection logged off. While this does mean that credential tests will be skipped, they will at least not be scored incorrectly as false postives.
...
Also, this removes the disconnect() method in favor of self.sock.close(). Disconnect seems to have a tendency to leave sessions half-closed, which will cause a busy state to never clear. self.sock.close doesn't appear to have this effect if you use a slower bruteforce_speed option (3 seems to work all right).
git-svn-id: file:///home/svn/framework3/trunk@8835 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-16 18:45:50 +00:00
ef299e71d2
candy mountain whitespace fixes!
...
git-svn-id: file:///home/svn/framework3/trunk@8834 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-16 18:07:49 +00:00
7fcad1f4b8
add exploit module for cve-2010-0188 (possibly cve-2006-3549)
...
git-svn-id: file:///home/svn/framework3/trunk@8833 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-16 18:06:50 +00:00
0f7a6cd1f2
Store the name and domain in the service info
...
git-svn-id: file:///home/svn/framework3/trunk@8826 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-15 21:35:21 +00:00
1b54c0e493
Closes #1129 . Merges in Thomas's xdb_sid_brute patch
...
git-svn-id: file:///home/svn/framework3/trunk@8825 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-15 20:31:53 +00:00
9f4ba25823
Add shiny new Oracle 0day (found by David Litchfield, ported to Metasploit by sid)
...
git-svn-id: file:///home/svn/framework3/trunk@8822 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-15 16:34:46 +00:00
5c7045e680
Applied Patch provided by Rob Fuller Mubix
...
git-svn-id: file:///home/svn/framework3/trunk@8819 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-15 00:37:26 +00:00
b1af1feb3f
Use double not single quotes
...
git-svn-id: file:///home/svn/framework3/trunk@8815 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-14 04:13:00 +00:00
821a0bcf37
SMB share enumeration
...
git-svn-id: file:///home/svn/framework3/trunk@8813 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-14 03:44:50 +00:00
84b7f4bb85
Store the nfs service and export information into the db
...
git-svn-id: file:///home/svn/framework3/trunk@8812 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-14 00:34:46 +00:00
40dd65494e
add notes about vulnerable versions
...
git-svn-id: file:///home/svn/framework3/trunk@8811 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-13 18:15:06 +00:00
a6377cc63b
turn off echo for telnet sessions
...
git-svn-id: file:///home/svn/framework3/trunk@8801 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 23:03:44 +00:00
5b6442aa58
added a patch and added a new module from Thomas Ring.
...
git-svn-id: file:///home/svn/framework3/trunk@8800 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 22:55:37 +00:00
13410d4daa
Rename aurora module to the MSB naming convention
...
git-svn-id: file:///home/svn/framework3/trunk@8780 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 05:49:45 +00:00
a23344b5d0
Consistency in how IE/Internet Explorer is named
...
git-svn-id: file:///home/svn/framework3/trunk@8779 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 05:49:14 +00:00
b01f9ff233
adds a patch from Thomas Ring.
...
git-svn-id: file:///home/svn/framework3/trunk@8775 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 22:42:49 +00:00
d3da883aa2
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8774 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 22:07:04 +00:00
baf64ed999
Remove trailing
...
git-svn-id: file:///home/svn/framework3/trunk@8771 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 22:01:43 +00:00
3c57fe6e81
add exploit module for cve-2010-0806
...
git-svn-id: file:///home/svn/framework3/trunk@8770 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 22:01:32 +00:00
efbdaba298
Making telnet timeouts much less disasterous, since they can happen pretty commonly.
...
git-svn-id: file:///home/svn/framework3/trunk@8769 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 21:54:20 +00:00
542a9a0617
Report MySQL application-level protocol errors (such as host not allowed messages).
...
git-svn-id: file:///home/svn/framework3/trunk@8767 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 17:56:03 +00:00
aaea62bb92
Report the correct local/peer names for the session information. Fix a return value check
...
git-svn-id: file:///home/svn/framework3/trunk@8765 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 07:13:18 +00:00
b419a40c45
finished periodic missing CVE reference check (hint vulns w/o CVEs here!)
...
also some minor cleanups here and there
git-svn-id: file:///home/svn/framework3/trunk@8762 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 05:58:01 +00:00
3b9524697f
add verbose option
...
git-svn-id: file:///home/svn/framework3/trunk@8761 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-10 05:55:47 +00:00
4415e3fbbf
Fixing up ssh_login reporting.
...
git-svn-id: file:///home/svn/framework3/trunk@8759 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-09 22:07:04 +00:00
df395f3ff0
added Brett Gervasoni to authors
...
git-svn-id: file:///home/svn/framework3/trunk@8758 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-09 09:12:57 +00:00
52647260b3
add offset for alternative file open methods
...
git-svn-id: file:///home/svn/framework3/trunk@8757 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-09 05:57:22 +00:00
a239963a7d
Handle wrapped TCP services better
...
git-svn-id: file:///home/svn/framework3/trunk@8756 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-09 05:38:28 +00:00
fbc157df56
add exploit module for cve-2010-0688
...
git-svn-id: file:///home/svn/framework3/trunk@8754 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-09 01:04:44 +00:00
5543e4551f
add auxiliary dos module for apache mod_isapi bug
...
git-svn-id: file:///home/svn/framework3/trunk@8752 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 23:21:17 +00:00
b1973c6630
Adds detection and exploitation coverage for the Energizer Duo trojan
...
git-svn-id: file:///home/svn/framework3/trunk@8749 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 19:06:50 +00:00
46cc8e538f
The new x64 VNC inject payload stage.
...
git-svn-id: file:///home/svn/framework3/trunk@8746 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 14:51:43 +00:00
a35817f0cc
Store more information
...
git-svn-id: file:///home/svn/framework3/trunk@8742 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 13:52:39 +00:00
d5b85db27f
Fixes a false positive when the server always replies with 200 OK
...
git-svn-id: file:///home/svn/framework3/trunk@8740 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 05:26:33 +00:00
a5d05fc2fb
Fix up a typo
...
git-svn-id: file:///home/svn/framework3/trunk@8738 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 04:39:06 +00:00
5cc63cf983
Report the epm service as well
...
git-svn-id: file:///home/svn/framework3/trunk@8737 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 04:35:14 +00:00
a0d5ce473b
add (staged) to the descriptions of staged payloads, fixes #955
...
git-svn-id: file:///home/svn/framework3/trunk@8733 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-06 05:27:13 +00:00
83419da78b
check for vulnerable version in JS prior to triggering vuln, closes #1011
...
git-svn-id: file:///home/svn/framework3/trunk@8731 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-06 04:36:16 +00:00
5ce7b4d186
Pass this_cred for tomcat_mgr_login
...
git-svn-id: file:///home/svn/framework3/trunk@8730 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 20:05:01 +00:00
35c4a1d123
handle missing targets more gracefully, stub out linux and x86_64 support detection
...
git-svn-id: file:///home/svn/framework3/trunk@8729 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 17:35:18 +00:00
28f4eb2fd9
handle failed logins - fixes #1014
...
git-svn-id: file:///home/svn/framework3/trunk@8728 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 17:05:12 +00:00
de9e944ad9
fix compile error
...
git-svn-id: file:///home/svn/framework3/trunk@8723 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 06:47:19 +00:00
3d1f773f18
Reimplementing DB2's auth checker to use the same methods as the other auth_brute modules.
...
git-svn-id: file:///home/svn/framework3/trunk@8722 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 00:44:39 +00:00
73da75a931
big update to cmd stager
...
1. returns array of commands instead of big blob of lines
2. combine lines together when possible (to reduce # of commands to execute)
3. add cmd stager usage in mssql_payload
4. remove extraneous stuff here and there
git-svn-id: file:///home/svn/framework3/trunk@8721 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 00:29:44 +00:00
a5e187bd69
Add the ability to slow down brute force sessions.
...
git-svn-id: file:///home/svn/framework3/trunk@8719 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 23:29:26 +00:00
1629bf7bf0
move http_send_cmd into cmdweb test exploit
...
git-svn-id: file:///home/svn/framework3/trunk@8716 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 21:00:58 +00:00
0ed5fc1af1
change VERBOSE option from OptString to OptBool
...
git-svn-id: file:///home/svn/framework3/trunk@8715 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 20:59:49 +00:00
0900314a15
redirect requests without subdirectories
...
git-svn-id: file:///home/svn/framework3/trunk@8713 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 18:28:05 +00:00
4bd857b53e
add exploit module for cve-2008-3558
...
git-svn-id: file:///home/svn/framework3/trunk@8712 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 17:41:26 +00:00
bf2a64b3ac
use new argument list for get_host
...
git-svn-id: file:///home/svn/framework3/trunk@8711 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 07:59:55 +00:00
4f08e6fd25
treat the database as write-only and use the (improved) target cache, fixes 986
...
git-svn-id: file:///home/svn/framework3/trunk@8708 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 07:37:58 +00:00
e8f22a7136
add exploit module for cve-2008-3878
...
git-svn-id: file:///home/svn/framework3/trunk@8705 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-04 06:19:37 +00:00
5aebed8fe7
add exploit module for cve-2008-5002
...
git-svn-id: file:///home/svn/framework3/trunk@8703 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-03 21:17:31 +00:00
b70b17b42a
don't use undefined variables.
...
git-svn-id: file:///home/svn/framework3/trunk@8701 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-03 19:51:05 +00:00
fb5906385d
add exploit module for cve-2009-1534
...
git-svn-id: file:///home/svn/framework3/trunk@8698 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-03 18:12:37 +00:00
d86575701d
added CVE, KB references
...
git-svn-id: file:///home/svn/framework3/trunk@8696 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-03 03:20:58 +00:00
c07b47b30b
explicitly rescue timeouts since they inherit from ::Interrupt on ruby 1.8
...
git-svn-id: file:///home/svn/framework3/trunk@8694 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 23:08:05 +00:00
7d3ac25586
Adds Citrix-ICA to the UDP sweep discovery module.
...
git-svn-id: file:///home/svn/framework3/trunk@8693 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 18:48:28 +00:00
7a37934a01
process autorun scripts for telnet_login and ssh_login
...
1. create session.process_autoruns in Msf::Sessions::CommandShell
2. call process_autoruns from within the handler on_session code
4. set user_input and user_output in sessions base set_from_exploit method
5. remove on_session from Msf::Sessions::CommandShellOptions
6. include CommandShellOptions into telnet_login and ssh_login
7. call sess.process_autoruns from telnet_login and ssh_login
8. celebrate (while crossing fingers of course)!
git-svn-id: file:///home/svn/framework3/trunk@8692 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 18:07:50 +00:00
09a669875c
Bumping the minimum version of MySQL to try back to 4.1.20, no problems seen
...
on that build.
git-svn-id: file:///home/svn/framework3/trunk@8691 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 16:52:22 +00:00
074b4ada44
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8688 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 12:23:17 +00:00
4b59410507
rename module per ms bulletin
...
git-svn-id: file:///home/svn/framework3/trunk@8686 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 07:50:25 +00:00
d0153225a0
add exploit module for cve-2009-1612
...
git-svn-id: file:///home/svn/framework3/trunk@8685 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-02 02:26:55 +00:00
cc9113397c
add exploit for IE Windows Help vulnerability
...
git-svn-id: file:///home/svn/framework3/trunk@8682 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-01 23:14:20 +00:00
453451a26d
Check the version number of the remote MySQL server before attempting
...
to log in. Sadly, the library we're using right now doesn't know
how to correctly negotiate 4.x and 3.x versions of MySQL. Until that
gets resolved (by writing a new library for these old versions),
this will at least prevent false positives/negatives from getting
reported.
git-svn-id: file:///home/svn/framework3/trunk@8681 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-01 22:56:00 +00:00
e2af2f9ab9
Again.
...
git-svn-id: file:///home/svn/framework3/trunk@8680 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-01 20:20:37 +00:00
e1a02d602d
Fixing up the tomcat login scanner.
...
git-svn-id: file:///home/svn/framework3/trunk@8679 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-01 20:20:20 +00:00
e80df81350
correct the CVE reference
...
git-svn-id: file:///home/svn/framework3/trunk@8678 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-01 19:47:13 +00:00
cc891bce80
whitespace cleanups
...
git-svn-id: file:///home/svn/framework3/trunk@8677 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-01 15:13:04 +00:00
3b59bc7cfc
use the same option names for user/pass
...
git-svn-id: file:///home/svn/framework3/trunk@8674 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 22:14:58 +00:00
304a238d3e
Add pop3/imap4 scanners
...
git-svn-id: file:///home/svn/framework3/trunk@8664 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 19:06:26 +00:00
0d87003497
Rename for consistency
...
git-svn-id: file:///home/svn/framework3/trunk@8662 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 18:48:09 +00:00
2cbf64b85a
Fix up the stored banner for SMTP
...
git-svn-id: file:///home/svn/framework3/trunk@8661 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 18:47:48 +00:00
b4339930e7
rename this module with the updated MSB and swap out the hard coded kernel stager for the new kernel stager mixin.
...
git-svn-id: file:///home/svn/framework3/trunk@8656 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 13:42:17 +00:00
e1c5334d56
add register_autofilter_ports
...
git-svn-id: file:///home/svn/framework3/trunk@8652 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 01:53:02 +00:00
d5e07a3ba9
Change info
...
git-svn-id: file:///home/svn/framework3/trunk@8650 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-26 01:09:09 +00:00
7b7f3de307
allow a single user/pass
...
git-svn-id: file:///home/svn/framework3/trunk@8646 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 22:45:33 +00:00
3961b9a3dd
allow a single user/pass
...
git-svn-id: file:///home/svn/framework3/trunk@8645 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 22:44:13 +00:00
bd35a70017
Wrapping up the whole timeout sequence in a timeout to avoid getting stuck.
...
git-svn-id: file:///home/svn/framework3/trunk@8643 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 21:35:55 +00:00
138d45d095
more missing constant errors fixed, fixes #975
...
git-svn-id: file:///home/svn/framework3/trunk@8642 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 21:11:12 +00:00
dfe9698cb3
stop bruting if the page isn't there
...
git-svn-id: file:///home/svn/framework3/trunk@8641 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 20:50:46 +00:00
e7a7f254e4
Fixes SSH scanning in to recover in the face of tarpits and tcpwrappers and the like.
...
git-svn-id: file:///home/svn/framework3/trunk@8639 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 17:42:51 +00:00
4e7f242230
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8636 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 12:03:44 +00:00
75533423dd
add requires for 2 stages missing them
...
git-svn-id: file:///home/svn/framework3/trunk@8634 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 06:05:02 +00:00
ff703cdb73
fix whitespace and add keywords
...
git-svn-id: file:///home/svn/framework3/trunk@8633 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-25 00:13:56 +00:00
aa3836dbc2
vmware directory traversal module
...
git-svn-id: file:///home/svn/framework3/trunk@8632 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-24 23:58:51 +00:00
7d99a33b20
remove double-on_session call from generic payloads
...
git-svn-id: file:///home/svn/framework3/trunk@8621 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-24 20:57:09 +00:00
541a409f44
remove app_name variable
...
git-svn-id: file:///home/svn/framework3/trunk@8619 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-24 16:53:55 +00:00
b391abd32d
adds scripting for command shell sessions
...
1. InitialAutoRunScript and AutoRunScript vars work
2. scripts/shells was created to hold them
3. *_shell methods were renamed shell_*
4. added "shell_command" method to command shell sessions
5. converted all uses of *_shell to shell_*
6. all payloads that produce command shell sessions include Msf::Sessions::CommandShellOptions
git-svn-id: file:///home/svn/framework3/trunk@8615 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-24 01:19:59 +00:00
04ba28f403
add osvdb refs
...
git-svn-id: file:///home/svn/framework3/trunk@8609 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 19:26:07 +00:00
0a52de8e6b
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8608 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 19:15:45 +00:00
afd2df315b
rename module part deux!
...
git-svn-id: file:///home/svn/framework3/trunk@8607 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 18:12:10 +00:00
705a4626e4
remove dash from file name
...
git-svn-id: file:///home/svn/framework3/trunk@8605 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 18:06:35 +00:00
48d6e6d18b
Remove -'s
...
git-svn-id: file:///home/svn/framework3/trunk@8604 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 18:03:54 +00:00
d52589b2a3
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8602 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 17:29:52 +00:00
81f93d48e7
add german target from contributor, thx!
...
git-svn-id: file:///home/svn/framework3/trunk@8601 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 17:23:05 +00:00
4ae27e32b0
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8600 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 17:16:38 +00:00
d148c95c84
The ssh login code can now create sessions
...
git-svn-id: file:///home/svn/framework3/trunk@8598 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-23 07:12:54 +00:00
80f1f48b2d
Merge in loot and user, fix up telnet to handle eof better
...
git-svn-id: file:///home/svn/framework3/trunk@8594 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 23:45:43 +00:00
b810e9665f
add comment about autofilter mapping
...
git-svn-id: file:///home/svn/framework3/trunk@8592 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 22:30:38 +00:00
b818536e46
corrected comment text
...
git-svn-id: file:///home/svn/framework3/trunk@8590 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 22:27:15 +00:00
e3b009471b
move code in autofilter into check
...
git-svn-id: file:///home/svn/framework3/trunk@8589 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 22:26:28 +00:00
f8ca490b98
move meterpreter on_session functionality into a mixin
...
git-svn-id: file:///home/svn/framework3/trunk@8586 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 21:05:08 +00:00
479f2939fc
Track the target host/workspace through the entire tree, expose to RPC, and use this telnet_login
...
git-svn-id: file:///home/svn/framework3/trunk@8583 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 17:54:44 +00:00
1faec528de
fix InitAutoRunScript -> InitialAutoRunScript
...
git-svn-id: file:///home/svn/framework3/trunk@8582 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 17:52:19 +00:00
6e9a992396
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8580 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-22 17:26:09 +00:00
6414821ea8
add exploit modules for CVEs 2005-2877 and 2004-1037
...
git-svn-id: file:///home/svn/framework3/trunk@8578 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-21 20:31:09 +00:00
c9973be2d7
make the smb_login module smarted about lockouts, disabled accounts, and samba
...
git-svn-id: file:///home/svn/framework3/trunk@8577 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-21 19:31:20 +00:00
a2383611c2
Fix single user/pass usage
...
git-svn-id: file:///home/svn/framework3/trunk@8576 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-21 19:08:36 +00:00
865969e059
whitespace adjustments - finally closes #773
...
git-svn-id: file:///home/svn/framework3/trunk@8575 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-21 01:44:34 +00:00
32bf50c627
add exploit module to get code exec from jboss.system:MainDeployer access
...
git-svn-id: file:///home/svn/framework3/trunk@8574 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-21 01:41:24 +00:00
9fc58c1e1f
Collect command output and report it
...
git-svn-id: file:///home/svn/framework3/trunk@8569 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-20 16:06:01 +00:00
0ba3d18032
Updated the report format to match new syntax
...
git-svn-id: file:///home/svn/framework3/trunk@8566 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-20 05:50:05 +00:00
0a8696436e
Fix up the telnet login code to handle varied responses better
...
git-svn-id: file:///home/svn/framework3/trunk@8565 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-20 05:49:40 +00:00
8446a0c305
add auto-targeting to tomcat_mgr_deploy, fixes #887
...
git-svn-id: file:///home/svn/framework3/trunk@8564 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-20 01:14:39 +00:00
93acc977fe
fix osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8563 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 19:42:08 +00:00
6e8eddcf5e
add exploit module for cve-2008-0506
...
git-svn-id: file:///home/svn/framework3/trunk@8562 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 07:31:12 +00:00
007930c784
add svn keywords property
...
git-svn-id: file:///home/svn/framework3/trunk@8561 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 07:13:31 +00:00
1a53411282
Filter out the other test modules from automation
...
git-svn-id: file:///home/svn/framework3/trunk@8559 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 05:18:43 +00:00
0db3ada840
Filter this from automation
...
git-svn-id: file:///home/svn/framework3/trunk@8558 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 05:15:03 +00:00
5b3c87c9c5
Add option to save java code to file.
...
git-svn-id: file:///home/svn/framework3/trunk@8557 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 05:11:56 +00:00
ab3b173040
So, funny story with net-ssh. Turns out, there's insufficient housekeeping on closing out connections in the event of authentication failures, which means you can start sucking up connections pretty good when you fail authentication a whole bunch of times. Fixed in the library, so now, if you pass a block to Net::SSH.start, and the authentication fails, the connection will still close out correctly, just as it would when the authentication succeeds.
...
Protip: If you don't pass a block, it's *still on the caller* to deal with the connection somehow. You'll want to basically always assign the connection to someplace you control, like so: sock = Net::SSH.start(whatever); sock.close). Otherwise, if you just Net::SSH.start without a block /or/ without assignment, you'll be stuck with all these useless connections hanging around.
git-svn-id: file:///home/svn/framework3/trunk@8556 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-19 03:02:25 +00:00
78aa6f5ba4
Added DB2 remote administration scan to udp_sweep
...
git-svn-id: file:///home/svn/framework3/trunk@8554 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 21:21:17 +00:00
f58558f605
Updated all the brute force login modules to record successful logins and avoid duplicating credentials.
...
git-svn-id: file:///home/svn/framework3/trunk@8553 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 19:04:51 +00:00
2e77c76824
add exploit module to get code exec on a tomcat manager instance, closes #772
...
git-svn-id: file:///home/svn/framework3/trunk@8552 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 18:18:43 +00:00
38a3b8203e
Properly checking for credential duplication.
...
git-svn-id: file:///home/svn/framework3/trunk@8551 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 18:11:18 +00:00
534d56cdd8
adjust text wrap
...
git-svn-id: file:///home/svn/framework3/trunk@8550 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 18:04:11 +00:00
c24a708db6
See #859 . Adds keyboard-interactive as an acceptable method of authentication.
...
git-svn-id: file:///home/svn/framework3/trunk@8548 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 16:11:58 +00:00
350c189a34
Added exploit module qbik_wingate_wwwproxy.
...
git-svn-id: file:///home/svn/framework3/trunk@8547 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 15:58:26 +00:00
27c3266c0a
Serializes telnet brute forcing so it's a little bit faster (as it happens) and
...
about a zillion times more reliable.
git-svn-id: file:///home/svn/framework3/trunk@8543 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 00:22:02 +00:00
4197f00701
Moves @credentials_tried and @credentials_good into auth_brute proper, though modules still
...
need to handle them themselves... which telnet and ssh both do now.
git-svn-id: file:///home/svn/framework3/trunk@8542 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 21:55:02 +00:00
797ab55f52
add exploit module for cve-2009-2011
...
git-svn-id: file:///home/svn/framework3/trunk@8541 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 20:14:40 +00:00
443e82bc75
Reworked ssh_login to a) handle all SSH errors, b) cease trying users if we already guessed a password and c) cease trying the same user:pass combo more than once.
...
git-svn-id: file:///home/svn/framework3/trunk@8540 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 20:12:02 +00:00
a71a24b6d3
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8538 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 18:56:05 +00:00
ed395fcda4
add osvdb refs
...
git-svn-id: file:///home/svn/framework3/trunk@8537 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 18:48:34 +00:00
b17fc35986
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8536 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 18:35:01 +00:00
3314e6a10b
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8535 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 17:25:47 +00:00
fa877eb567
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8534 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 17:11:45 +00:00
e5609bbf82
add cve and osvdb refs
...
git-svn-id: file:///home/svn/framework3/trunk@8533 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 17:07:54 +00:00
1686931efe
More SSH versions
...
git-svn-id: file:///home/svn/framework3/trunk@8532 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 14:42:11 +00:00
b4ead057f6
add exploit module for cve-2000-0917
...
git-svn-id: file:///home/svn/framework3/trunk@8530 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-17 00:56:28 +00:00
5fce04ce22
See #843 , but this really just masks the problem. Investigate more thoroughly.
...
git-svn-id: file:///home/svn/framework3/trunk@8529 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 23:35:22 +00:00
25ec6e8021
Removing the require rescues for SSH, now that it's shipping in lib directly.
...
git-svn-id: file:///home/svn/framework3/trunk@8528 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 23:21:51 +00:00
206b70ace7
Indentation fixes (wrapping everything in a begin;rescue;end, didn't want
...
to obfuscate that with the last change).
git-svn-id: file:///home/svn/framework3/trunk@8522 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 18:09:51 +00:00
b45cfb8793
Fixes #808 . Removes the pre-connect test from login and version.
...
git-svn-id: file:///home/svn/framework3/trunk@8521 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 18:05:51 +00:00
ceb65d7dc0
Add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8519 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 16:38:58 +00:00
4800d6841c
commit cmd stager stuff from bannedit
...
git-svn-id: file:///home/svn/framework3/trunk@8518 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 16:38:19 +00:00
cf29ff333e
Added a path to prepend
...
git-svn-id: file:///home/svn/framework3/trunk@8514 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 05:24:31 +00:00
185ff610eb
Add an example of how to break out of the capture loop
...
git-svn-id: file:///home/svn/framework3/trunk@8513 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 01:32:25 +00:00
48b7aec12d
corrected cve reference
...
git-svn-id: file:///home/svn/framework3/trunk@8512 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 00:30:17 +00:00
a996668cfa
added payload notes
...
git-svn-id: file:///home/svn/framework3/trunk@8511 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 00:27:45 +00:00
82369aa9e8
add exploit module for cve-2007-2447
...
git-svn-id: file:///home/svn/framework3/trunk@8510 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 00:26:41 +00:00
8c59c9cfdc
fix typos
...
git-svn-id: file:///home/svn/framework3/trunk@8508 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-15 22:42:16 +00:00
b1ef6075c0
add exploit module for cve-2007-5208
...
git-svn-id: file:///home/svn/framework3/trunk@8507 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-15 22:38:50 +00:00
1857268af8
Uber-fast-get-me-a-php-shell mode :)
...
git-svn-id: file:///home/svn/framework3/trunk@8505 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-15 17:59:54 +00:00
5a5fb84e2c
strings, not constants
...
git-svn-id: file:///home/svn/framework3/trunk@8502 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-15 13:34:07 +00:00
32357b1f64
Skip the debugging target for automatic mode
...
git-svn-id: file:///home/svn/framework3/trunk@8499 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-15 01:02:12 +00:00
5d7139ad6f
Various module cleanups
...
git-svn-id: file:///home/svn/framework3/trunk@8498 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-15 00:48:03 +00:00
f9ae031055
Added piranha_passwd_exec exploit module.
...
git-svn-id: file:///home/svn/framework3/trunk@8497 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-14 20:27:24 +00:00
43e89bf3a2
Consistency fix
...
git-svn-id: file:///home/svn/framework3/trunk@8496 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-14 19:38:47 +00:00
ca4b9bbd52
Ignore lang/service pack for non-Windows hosts in the OS information
...
git-svn-id: file:///home/svn/framework3/trunk@8490 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-14 17:25:05 +00:00
337e00d57e
Swap flavor/name
...
git-svn-id: file:///home/svn/framework3/trunk@8489 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-14 17:13:55 +00:00
352a367857
Handle OS X better
...
git-svn-id: file:///home/svn/framework3/trunk@8488 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-14 17:13:00 +00:00
26bb74ad6e
file autopwn minor fixes
...
git-svn-id: file:///home/svn/framework3/trunk@8486 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-14 00:06:32 +00:00
11cc5b0a32
fix name
...
git-svn-id: file:///home/svn/framework3/trunk@8484 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 23:38:01 +00:00
24084024c0
Add file format exploits generator. Kind of a File autopwn. Next step add Emailer
...
git-svn-id: file:///home/svn/framework3/trunk@8483 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 23:32:33 +00:00
9c227ea0e7
Improved auxiliary detection
...
git-svn-id: file:///home/svn/framework3/trunk@8481 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 23:26:07 +00:00
ee4fd8c75d
Ported sambar6_search_results from v2.
...
git-svn-id: file:///home/svn/framework3/trunk@8480 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 20:15:19 +00:00
7aa7995da9
Autodetect and exploit 2003 SP0
...
git-svn-id: file:///home/svn/framework3/trunk@8479 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 20:04:24 +00:00
01cbe85468
Fixed OSVDB refs and added CA Server module.
...
git-svn-id: file:///home/svn/framework3/trunk@8478 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 16:16:13 +00:00
c8da073f80
Ported calicclnt_getconfig exploit module from msf2.
...
git-svn-id: file:///home/svn/framework3/trunk@8476 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 15:38:06 +00:00
1896c82e39
add exploit module for cve-2009-2484
...
git-svn-id: file:///home/svn/framework3/trunk@8475 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 06:58:27 +00:00
8c28d583aa
bump ranking up a notch
...
git-svn-id: file:///home/svn/framework3/trunk@8474 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-13 06:57:58 +00:00
0e48287310
Adding a quickie ssh_login checker.
...
This will certainly change -- it's mostly just a placeholder now (though it does work).
git-svn-id: file:///home/svn/framework3/trunk@8472 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 23:00:36 +00:00
d561b8e8ec
add references, update description
...
git-svn-id: file:///home/svn/framework3/trunk@8471 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 21:09:09 +00:00
f3c6b01bbd
add first exploit module using Rex::OLE (cve-2009-3129)
...
git-svn-id: file:///home/svn/framework3/trunk@8470 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 20:52:41 +00:00
49b0e8a077
Argh should be mssql not tcp.
...
git-svn-id: file:///home/svn/framework3/trunk@8469 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 19:58:14 +00:00
fb30d8e8c9
Renaming services to mssql-m and mssql because nobody uses ms-sql-s to talk about port 1433 except /etc/services
...
git-svn-id: file:///home/svn/framework3/trunk@8468 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 19:53:18 +00:00
58913b6a71
Trivial fixup on print_status
...
git-svn-id: file:///home/svn/framework3/trunk@8467 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 19:16:05 +00:00
3fd3d44ad6
Added barcode_ax49.rb exploit module.
...
git-svn-id: file:///home/svn/framework3/trunk@8466 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 18:06:49 +00:00
537007c9cb
Implementing database reporting for mssql_ping.
...
git-svn-id: file:///home/svn/framework3/trunk@8464 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 16:53:46 +00:00
3fe41a0d94
Fix a small typo
...
git-svn-id: file:///home/svn/framework3/trunk@8463 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 14:44:23 +00:00
9729b22972
Loopty version of the wireshark exploit. This will continually blast packets as a background job.
...
git-svn-id: file:///home/svn/framework3/trunk@8460 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-12 01:58:33 +00:00
993ba44fcf
SMB updates, better reporting of SSL status for HTTP
...
git-svn-id: file:///home/svn/framework3/trunk@8459 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 22:37:00 +00:00
c52b37ea17
Prettify the telnet banner display for db_services
...
git-svn-id: file:///home/svn/framework3/trunk@8458 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 20:14:38 +00:00
8a44f4b9d8
Using a proper variable instead of $1 token for ora version.
...
git-svn-id: file:///home/svn/framework3/trunk@8456 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 18:29:24 +00:00
53ce10ac12
Switching Oracle scanner to use db_service rather than db_note to record version numbers.
...
git-svn-id: file:///home/svn/framework3/trunk@8455 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 17:57:33 +00:00
6e80c7a62c
use Rex::Arch::pack_addr
...
git-svn-id: file:///home/svn/framework3/trunk@8454 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 09:03:48 +00:00
0f942df9cd
whitespace changes
...
git-svn-id: file:///home/svn/framework3/trunk@8451 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 06:00:12 +00:00
f82c53db2a
move 70k binary to data/exploits instead of hex encoded in the exploit
...
git-svn-id: file:///home/svn/framework3/trunk@8446 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 23:17:19 +00:00
eb6ce38e0c
old zero-day shows its age
...
git-svn-id: file:///home/svn/framework3/trunk@8445 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 20:41:07 +00:00
df55aee06f
add osvdb and cve refs
...
git-svn-id: file:///home/svn/framework3/trunk@8444 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 19:35:28 +00:00
a1ec895cee
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8443 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 19:26:18 +00:00
e4494d3582
Added a verbosity line to telnet.
...
git-svn-id: file:///home/svn/framework3/trunk@8442 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 19:06:01 +00:00
b37b409c3e
update osvdb refs
...
git-svn-id: file:///home/svn/framework3/trunk@8441 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 18:46:03 +00:00
d96a6a1f8f
add exploit module for cve-2009-2261 - first consumer of zip library!
...
git-svn-id: file:///home/svn/framework3/trunk@8440 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-10 17:28:25 +00:00
f93a8e878e
Auxiliary failed: NoMethodError undefined method `each' for "GET ([^ ?]+) HTTP":String
...
git-svn-id: file:///home/svn/framework3/trunk@8436 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 22:36:37 +00:00
65c5eae59e
Calling it postgres instead of postgresql for overall consistency.
...
git-svn-id: file:///home/svn/framework3/trunk@8435 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 20:44:23 +00:00
e2d70519d7
add the ability to check for a prompt before sending user/pass; now works with cisco, aix, solaris, linux, and windows telnetds
...
git-svn-id: file:///home/svn/framework3/trunk@8434 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 19:07:02 +00:00
a03b7c3feb
Commit the modified auxiliary modules to include a CHOST option so the relevant modules can avail of the new UDP pivoting.
...
git-svn-id: file:///home/svn/framework3/trunk@8432 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 16:47:38 +00:00
a92f5f207b
Handle null user lists
...
git-svn-id: file:///home/svn/framework3/trunk@8429 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 16:43:26 +00:00
11e8710a60
Catch OpenDomain failures
...
git-svn-id: file:///home/svn/framework3/trunk@8428 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 16:34:49 +00:00
48a159006a
Regenerate the payload with the specified AIX level, cleanups
...
git-svn-id: file:///home/svn/framework3/trunk@8427 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 04:15:47 +00:00
e7f7ac20ea
extended brute range, minor cleanups
...
git-svn-id: file:///home/svn/framework3/trunk@8426 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 04:15:15 +00:00
af978cbbdc
Regenerate the payload with the specified AIX level
...
git-svn-id: file:///home/svn/framework3/trunk@8424 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 03:59:20 +00:00
36c61ff5ed
Fix typo
...
git-svn-id: file:///home/svn/framework3/trunk@8423 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 01:10:29 +00:00
7bf3de2a3d
randomize filler
...
git-svn-id: file:///home/svn/framework3/trunk@8422 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 00:43:56 +00:00
40579ce936
it works! don't forget to "set AIX <version>"
...
git-svn-id: file:///home/svn/framework3/trunk@8421 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 00:41:49 +00:00
17bd4b8b7d
fixed aix payloads to REALLY do variable substitution
...
git-svn-id: file:///home/svn/framework3/trunk@8418 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 22:41:36 +00:00
c763052c57
See #816 . This came up while learning how to perform various postgre tasks via Metasploit.
...
This module in particular reads a text file on the remote machine, copies it to a temporary table, and then selects the table.
Looks like this:
http://pastie.org/private/uoxgaw7ibjpvuepolr1fuw
git-svn-id: file:///home/svn/framework3/trunk@8417 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 22:34:09 +00:00
ba34abc232
Fix unpack("H*") vs unpack("H*")[0]
...
git-svn-id: file:///home/svn/framework3/trunk@8416 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 21:37:07 +00:00
2860d57e01
Cosmetic change to print_status messages to be consistent with Postgres
...
git-svn-id: file:///home/svn/framework3/trunk@8414 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 20:12:35 +00:00
c6c1cda153
Try to delete the file (doesn't always work)
...
git-svn-id: file:///home/svn/framework3/trunk@8413 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 19:12:59 +00:00
bc62eaf99b
Adds a module to exploit insecure IIS configurations (PUT)
...
git-svn-id: file:///home/svn/framework3/trunk@8412 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 19:04:19 +00:00
d374c16662
Fixed up reporting for DB2 and tested; also added other default usernames for db2.
...
git-svn-id: file:///home/svn/framework3/trunk@8411 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 18:54:50 +00:00
f3ad1c0a15
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8410 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 18:53:21 +00:00
0b6c44b2cb
Adding reporting to postgres_login. Logging version info more verbosely for authenticated login, since it's way useful.
...
git-svn-id: file:///home/svn/framework3/trunk@8408 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 17:35:58 +00:00
67bb7a1926
Cleaning up print_status messages for Postgres SQL module and Postgres library.
...
git-svn-id: file:///home/svn/framework3/trunk@8407 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 16:43:44 +00:00
79c68e3784
Fix the description
...
git-svn-id: file:///home/svn/framework3/trunk@8406 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 13:53:50 +00:00
c28f15d02c
Quote the share name
...
git-svn-id: file:///home/svn/framework3/trunk@8405 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 13:36:35 +00:00
f04ae6f20d
minor cleanups -- getting closer
...
git-svn-id: file:///home/svn/framework3/trunk@8402 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 01:03:46 +00:00
7870638481
Expose the SunRPC socket; we need to overhaul the SunRPC code sometime
...
git-svn-id: file:///home/svn/framework3/trunk@8399 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 00:52:58 +00:00
8b63d506f7
initial commit of aix cmsd exploit (not fully working yet)
...
git-svn-id: file:///home/svn/framework3/trunk@8398 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 00:44:54 +00:00
d68efa61d2
initial commit of aix cmsd exploit (not fully working yet)
...
git-svn-id: file:///home/svn/framework3/trunk@8397 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 00:44:37 +00:00
9f174795d4
add exploit module for vermillion ftpd memory corruption
...
git-svn-id: file:///home/svn/framework3/trunk@8396 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-08 00:39:48 +00:00
a772bc2c85
minor cleanups
...
git-svn-id: file:///home/svn/framework3/trunk@8395 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-07 21:42:12 +00:00
c6c1afe543
open sessions when a telnet login succeeds; needs testing on more telnetd's
...
git-svn-id: file:///home/svn/framework3/trunk@8393 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-07 01:24:41 +00:00
3b0b2731fd
fix telnet scanner
...
git-svn-id: file:///home/svn/framework3/trunk@8392 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-07 00:14:29 +00:00
bd91871763
Correct credit for the advisory
...
git-svn-id: file:///home/svn/framework3/trunk@8391 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 23:22:28 +00:00
b2518b7c68
Remove the starting host verbage; it gets noisy in scanning mode
...
git-svn-id: file:///home/svn/framework3/trunk@8390 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 22:07:44 +00:00
715e2c4c2e
Add a link to the vendor response
...
git-svn-id: file:///home/svn/framework3/trunk@8389 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 21:54:57 +00:00
c48fe399f7
references have to be strings. fixes 815
...
git-svn-id: file:///home/svn/framework3/trunk@8387 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 21:41:06 +00:00
4c8dc37435
Add the OSVDB reference
...
git-svn-id: file:///home/svn/framework3/trunk@8382 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 14:51:56 +00:00
2c6b9c2800
Use the full \\host\share syntax to work with all versions of Samba. Thanks Eren!
...
git-svn-id: file:///home/svn/framework3/trunk@8381 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 14:45:43 +00:00
875a66553f
clean up a couple comments to save future pain
...
git-svn-id: file:///home/svn/framework3/trunk@8380 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 06:53:31 +00:00
bd3a4760da
fixes to adobe_pdf_embedded_exe
...
optimized the directory search, and cmdline in general
added the Documents (Vista/Win7) to the list of directories to check
fixes #767
git-svn-id: file:///home/svn/framework3/trunk@8379 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 06:51:13 +00:00
9b59f0e3c2
give the reported service a name
...
git-svn-id: file:///home/svn/framework3/trunk@8377 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 00:37:16 +00:00
509b2aab3a
use new api
...
git-svn-id: file:///home/svn/framework3/trunk@8376 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-05 23:00:51 +00:00
0e1af9ed6a
add reporting, see #385
...
git-svn-id: file:///home/svn/framework3/trunk@8375 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-05 21:13:07 +00:00
43bbfefa8f
Adding a Windows signature for Postgres.
...
git-svn-id: file:///home/svn/framework3/trunk@8374 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-05 18:02:13 +00:00
c8cdf9c938
Fixes #811 by implementing an enumerator for PostgreSQL.
...
git-svn-id: file:///home/svn/framework3/trunk@8371 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-05 15:20:59 +00:00
aeba7e0429
Store RPC information
...
git-svn-id: file:///home/svn/framework3/trunk@8370 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-05 14:53:09 +00:00
b3a588b8cc
Adds a module for kcope's samba filesystem traversal
...
git-svn-id: file:///home/svn/framework3/trunk@8369 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-05 06:38:24 +00:00
4f9490f63f
add default username/passwords for IBM Cognos Express Tomcat Manager
...
git-svn-id: file:///home/svn/framework3/trunk@8368 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-04 20:34:55 +00:00
9397c897ba
fix spoof support
...
git-svn-id: file:///home/svn/framework3/trunk@8367 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-04 04:56:18 +00:00
6e8e6ef16a
Fixes #769 by implementing a brute force module for Postgres. A couple notes: If you guess wrong at the database name, you still can try to login with a username and password -- you'll get a successful auth, but then get disconnected. So, that's pretty neat.
...
Also, since Postgres-PR uses the stock TCPSocket object, connection timeouts and other errors take forever. This is avoided in the brute forcer by pre-validating the connection with Rex::Socket, but this is a hack -- it would be better to convert Postgres-PR to a Rex::Socket flavor, so you also get nicer error messages and what all. I did fork it off the main distribute it already anyway, so may as well will open a feature bug on this, but it's pretty low priority.
git-svn-id: file:///home/svn/framework3/trunk@8366 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-03 21:45:13 +00:00
9b79ebd000
add a windows target, thx redsand!
...
also removed some cruft
git-svn-id: file:///home/svn/framework3/trunk@8364 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-03 18:24:42 +00:00
376e2ee62c
Gah!
...
git-svn-id: file:///home/svn/framework3/trunk@8363 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-03 13:53:47 +00:00
b785d5af00
Keywords.
...
git-svn-id: file:///home/svn/framework3/trunk@8362 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-03 13:53:12 +00:00
7538b93aae
add exploit module for cve-2006-6665
...
git-svn-id: file:///home/svn/framework3/trunk@8361 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-03 06:09:31 +00:00
a41647a922
add silly jmp esp target for wireshark gui on debian
...
git-svn-id: file:///home/svn/framework3/trunk@8360 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-03 00:08:28 +00:00
1ee79780e9
fix the http option scanner
...
git-svn-id: file:///home/svn/framework3/trunk@8355 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 23:11:18 +00:00
2ffe4abb5d
Fixes #730 by fixing up the Postgres query module and nicifying the output.
...
git-svn-id: file:///home/svn/framework3/trunk@8352 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 21:02:12 +00:00
44fbe35871
Fixing revision keyword
...
git-svn-id: file:///home/svn/framework3/trunk@8351 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 17:37:34 +00:00
4fcc9856d0
Adding a Juniper JunOS DoS exploit (no CVE, BID: 37670)
...
git-svn-id: file:///home/svn/framework3/trunk@8349 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 17:19:14 +00:00
2cbd6d152d
Add cve and osvdb refs
...
git-svn-id: file:///home/svn/framework3/trunk@8347 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 12:37:07 +00:00
98dd073368
add an exploit module for one of the wireshark lwres vulns
...
git-svn-id: file:///home/svn/framework3/trunk@8346 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 06:20:18 +00:00
746c4fc263
whitespace change
...
git-svn-id: file:///home/svn/framework3/trunk@8345 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 06:19:34 +00:00
01adf60550
See #730 . First pass at a Postgres Query module. Doesn't handle errors very well yet (still need to work all that out and create some test cases).
...
git-svn-id: file:///home/svn/framework3/trunk@8344 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-02 01:40:48 +00:00
fde3fbb2e3
add exploit module for cve-2009-1569
...
git-svn-id: file:///home/svn/framework3/trunk@8339 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-01 03:56:02 +00:00
c073cd707a
removed unecessary parameter, commented target
...
git-svn-id: file:///home/svn/framework3/trunk@8338 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-01 03:33:38 +00:00
edc64f824e
Added trace.axd scanner by C4an
...
git-svn-id: file:///home/svn/framework3/trunk@8337 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-01 02:49:18 +00:00
2783c5884e
add exploit module for cve-2009-1568
...
git-svn-id: file:///home/svn/framework3/trunk@8336 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-01 02:40:47 +00:00
7964d0f38a
Renaming wmap modules
...
git-svn-id: file:///home/svn/framework3/trunk@8335 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-01 02:12:30 +00:00
7e5793af2a
New enumeration modules by Mubix
...
git-svn-id: file:///home/svn/framework3/trunk@8331 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-31 00:52:51 +00:00
3ecabe1be9
Adds static signed jar and user messages letting them know.
...
git-svn-id: file:///home/svn/framework3/trunk@8328 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 19:47:40 +00:00
4863faf0a7
add reference to cve-2000-1209 (sa blank password)
...
git-svn-id: file:///home/svn/framework3/trunk@8324 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 16:37:06 +00:00
c514c2274b
typo, fixes #786 , see also r8315
...
git-svn-id: file:///home/svn/framework3/trunk@8316 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 01:06:06 +00:00
53fd14c9c0
updated description, added PATH variable
...
git-svn-id: file:///home/svn/framework3/trunk@8315 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 01:04:23 +00:00
a76480d42c
See #726 . Cleaning up my gross whitespace.
...
git-svn-id: file:///home/svn/framework3/trunk@8311 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 23:08:39 +00:00
69ad365b46
Added STDERR to pure java payload, cleaned up user's view.
...
git-svn-id: file:///home/svn/framework3/trunk@8308 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 22:53:36 +00:00
70c0cb7530
add osvdb ref
...
git-svn-id: file:///home/svn/framework3/trunk@8307 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 21:04:40 +00:00
a3f4d4f65e
add cve and osvdb refs
...
git-svn-id: file:///home/svn/framework3/trunk@8306 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 21:04:01 +00:00
c0e556f7ad
oops, broke the tree again!
...
git-svn-id: file:///home/svn/framework3/trunk@8305 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 20:37:44 +00:00
4751d83cb8
some cleanups, added some CVE references
...
git-svn-id: file:///home/svn/framework3/trunk@8304 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 20:15:32 +00:00
7789db860d
add exploit module for Audiotran .pls file bof
...
git-svn-id: file:///home/svn/framework3/trunk@8303 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 19:24:41 +00:00
d9e5de5683
note the CLSID of this control
...
git-svn-id: file:///home/svn/framework3/trunk@8302 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 19:17:50 +00:00
15e13348c0
add exploit module for AOL phobos bug
...
git-svn-id: file:///home/svn/framework3/trunk@8300 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 18:58:14 +00:00
0fbe42395f
added automatic target detection
...
git-svn-id: file:///home/svn/framework3/trunk@8287 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 07:34:47 +00:00
214d624ddc
Fix the report_host() code (broken by previous commit), add an advanced option to store db hosts from monlist
...
git-svn-id: file:///home/svn/framework3/trunk@8283 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 23:25:17 +00:00
008755b025
add exploit module for yassl CertDecoder::GetName vuln
...
also renames old mysql_yassl exploit to _hello
git-svn-id: file:///home/svn/framework3/trunk@8282 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 23:24:44 +00:00
9891d60dfc
Move applet generation up for slight speed improvement and less spamminess to the user.
...
git-svn-id: file:///home/svn/framework3/trunk@8281 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 23:15:36 +00:00
bedbc2c341
See #782 . Deregistering filter and pcapfile (not needed for these), moving GATEWAY to advanced options.
...
git-svn-id: file:///home/svn/framework3/trunk@8277 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:58:45 +00:00
5e4442a4d4
Fix a bug missed due to caching issues.
...
git-svn-id: file:///home/svn/framework3/trunk@8276 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:58:13 +00:00
e224d621aa
See #782 . Updating bailiwicked to use capture_sendo.
...
git-svn-id: file:///home/svn/framework3/trunk@8275 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:36:49 +00:00
c135462768
<@jduck> natron: you need some svn keywords magic
...
git-svn-id: file:///home/svn/framework3/trunk@8274 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:20:32 +00:00
8d64f8a10c
See #782 . Updating to use capture_sendto.
...
git-svn-id: file:///home/svn/framework3/trunk@8273 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:17:45 +00:00
246fe53ff4
See #782 . Updating the ntpd dos attack to use capture_sendto.
...
git-svn-id: file:///home/svn/framework3/trunk@8272 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:13:44 +00:00
170b9f7705
See #782 . Converted synflood.rb to use capture_sendto.
...
Note, this makes the SYN flooding significantly more sucky, since if it's a remote address, capture_sendto will always try to arp. Need to deal with this. I have a couple strategies in mind.
git-svn-id: file:///home/svn/framework3/trunk@8271 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 20:04:14 +00:00
e05e3d7248
Adding Id tag.
...
git-svn-id: file:///home/svn/framework3/trunk@8269 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 19:55:31 +00:00
3baeb9c199
See #782 . Updating chunked.rb to use capture_sendto. Also adjusted TTL's for ldap and chunked.
...
git-svn-id: file:///home/svn/framework3/trunk@8268 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 19:54:33 +00:00
cd5e5880d2
Initial commit of Msf::Exploit::Java mixin and multi/browser/java_signed_applet exploit.
...
git-svn-id: file:///home/svn/framework3/trunk@8267 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 19:46:39 +00:00
2f76affadb
See #782 . Updating ldap exploit to use capture_sendto. Also updating capture.rb to include RHOST.
...
git-svn-id: file:///home/svn/framework3/trunk@8266 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 19:37:22 +00:00
0f37a27fe4
See #782 . Updating ip_spoof to use capture_sendto
...
git-svn-id: file:///home/svn/framework3/trunk@8265 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 19:00:21 +00:00
71c44dadd8
See #782 . Updating rogue_send form capture_sendto
...
git-svn-id: file:///home/svn/framework3/trunk@8264 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 18:46:48 +00:00
4374b8ccc4
See #782 . Updating ipidseq to use capture_sendto.
...
git-svn-id: file:///home/svn/framework3/trunk@8263 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 18:40:38 +00:00
99f9cf76a8
See #782 . Updating syn to use capture_sendto.
...
git-svn-id: file:///home/svn/framework3/trunk@8262 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 18:34:35 +00:00
280e7f8bdd
See #782 . Revising ack to use the new capture_sendto.
...
git-svn-id: file:///home/svn/framework3/trunk@8261 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 18:31:36 +00:00
709c634bfa
Renaming sendto to capture_sendto to give the user a hint as to where it came from.
...
git-svn-id: file:///home/svn/framework3/trunk@8260 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 18:21:33 +00:00
3053bd702a
See #782 . Updated xmas.rb (again), now uses the nicer frontend function sendto. Diff against r8026 to get an idea of what's changed for module writers.
...
git-svn-id: file:///home/svn/framework3/trunk@8259 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 18:12:02 +00:00
393cf5becb
Add the NTP monlist scanner
...
git-svn-id: file:///home/svn/framework3/trunk@8255 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 06:53:24 +00:00
fb09655c42
See #782 . Fixing the packet send, but that's it (the module is still busted for other reasons).
...
git-svn-id: file:///home/svn/framework3/trunk@8251 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-27 03:03:51 +00:00
bf24295d1d
See #782 . Updating ipidseq.
...
git-svn-id: file:///home/svn/framework3/trunk@8248 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 22:36:27 +00:00
23f06ca8a6
See #782 . Updating syn scanner. Also, before I forget: should optimize the arp cache to keep negatives so we don't rearp all the time for nonexistant hosts.
...
git-svn-id: file:///home/svn/framework3/trunk@8247 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 22:16:03 +00:00
658e07a0de
See #782 . Updating ack scanner.
...
git-svn-id: file:///home/svn/framework3/trunk@8246 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 21:59:30 +00:00
4bb6e650da
See #782 . Implemented a more sensible arp cache so as not to spam with UDP probes and arps. Also refactored xmas to use the new methods.
...
git-svn-id: file:///home/svn/framework3/trunk@8245 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 21:37:40 +00:00
31949c4343
svn keywords fixups
...
fixed a bunch of $Id$ and $Revision$ typos
added keywords property to files missing it
git-svn-id: file:///home/svn/framework3/trunk@8242 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 20:12:13 +00:00
c003a663d1
See #782 . Extended the injection ARP query methods to handle local addresses more satisfactorially, fixed a couple errors, and added a bunch of inline documentation to explain how it all works together.
...
git-svn-id: file:///home/svn/framework3/trunk@8238 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 16:00:16 +00:00
cac3d6d56b
See #782 . This introduces some inject methods to the Capture mixin, and edits the ip_spoof module to take advantage of them.
...
git-svn-id: file:///home/svn/framework3/trunk@8237 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-26 06:38:41 +00:00
37c1441c6c
Formatting on db2 output.
...
git-svn-id: file:///home/svn/framework3/trunk@8225 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-25 16:37:56 +00:00
7cc01b07f3
See #726 . Post-commit fixes. Rename probe to version, clean up includes, fix verbosity on the probe and convert to single-line output.
...
git-svn-id: file:///home/svn/framework3/trunk@8224 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-25 16:25:29 +00:00
359e1ad53a
See #726 . Adds a DB2 scanner and brute forcer.
...
git-svn-id: file:///home/svn/framework3/trunk@8223 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-25 15:58:24 +00:00
1bdd286936
This bug actually affected 9.2 as well according to adobe, reference updated
...
git-svn-id: file:///home/svn/framework3/trunk@8222 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-25 14:22:13 +00:00
87adb7714f
fixed whitespace
...
git-svn-id: file:///home/svn/framework3/trunk@8219 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-25 04:52:49 +00:00
83f47796fe
add reference to ms09-032 (the mitigation)
...
git-svn-id: file:///home/svn/framework3/trunk@8212 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-24 00:05:19 +00:00
cc41516a79
don't wait for the client reporting
...
git-svn-id: file:///home/svn/framework3/trunk@8210 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-23 00:17:59 +00:00
14862e0106
added another target
...
git-svn-id: file:///home/svn/framework3/trunk@8204 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 21:43:40 +00:00
4bb3adc397
move new tomcat_mgr_login scanner into scanner/http
...
git-svn-id: file:///home/svn/framework3/trunk@8202 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 20:33:11 +00:00
40be42676b
new tomcat_mgr_login aux module
...
- uses auth_brute mixin
- has old and new default users/passes/pairs
- replaces older modules/auxiliary/admin/http/tomcat_manager.rb
git-svn-id: file:///home/svn/framework3/trunk@8201 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 20:31:51 +00:00
5ebb0c4b38
add CVE, two default users & passwords, see #711
...
git-svn-id: file:///home/svn/framework3/trunk@8194 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 16:22:12 +00:00
6fd20d411f
add exploit module for cve-2009-4179
...
git-svn-id: file:///home/svn/framework3/trunk@8192 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 05:52:53 +00:00
409d44bfad
fix another typo
...
git-svn-id: file:///home/svn/framework3/trunk@8190 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 19:26:04 +00:00
9cb3ac9340
fix typo
...
git-svn-id: file:///home/svn/framework3/trunk@8189 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 19:24:54 +00:00
ab1a1c58db
escape more format specifiers passed to util.printd
...
prevents mucking with the allocation size (hopefully)
a better solution would be to find a different way to allocate the freed memory..
git-svn-id: file:///home/svn/framework3/trunk@8188 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 18:32:01 +00:00
a87d4e7eb4
escape randomly generated format specifiers passed to util.printd
...
prevents mucking with the allocation size (hopefully)
git-svn-id: file:///home/svn/framework3/trunk@8186 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 17:09:46 +00:00
2b8a2d56a1
some variable renaming
...
git-svn-id: file:///home/svn/framework3/trunk@8184 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 04:55:16 +00:00
72e1b9bb50
added a couple better error messages
...
git-svn-id: file:///home/svn/framework3/trunk@8183 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 00:30:08 +00:00
97c3159293
fixed version command, check function
...
git-svn-id: file:///home/svn/framework3/trunk@8182 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 00:15:20 +00:00
e8048704be
add exploit module for cve-2009-1979 (oracle pre-auth bof)
...
git-svn-id: file:///home/svn/framework3/trunk@8181 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-21 00:05:18 +00:00
865a50594b
add a telnet login scanner
...
git-svn-id: file:///home/svn/framework3/trunk@8179 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-20 03:25:34 +00:00
4a54388119
use print_error for failed login
...
git-svn-id: file:///home/svn/framework3/trunk@8178 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-20 02:33:15 +00:00
e19f66ec1f
use the new authbrute mixin
...
git-svn-id: file:///home/svn/framework3/trunk@8176 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-20 01:43:01 +00:00
HD Moore
Joshua Drake
Steve Tornio
natron
Mario Ceballos
Tod Beardsley
James Lee
Stephen Fewer
Carlos Perez
Patrick Webster