ee28a3a8d7
Update http_login.rb
...
add parens around conditional to make bikeshed prettier
2013-05-21 11:28:23 -05:00
f4498c3916
Remove $Id tags
...
Also adds binary coding magic comment to a few files
2013-05-20 16:21:03 -05:00
d9bdf3d52e
Do final cleanup for sap_smb_relay
2013-05-16 14:25:10 -05:00
9dd582c526
Land #1656 , @nmonkee's module for SMB Relay attacks against SAP
2013-05-16 14:23:39 -05:00
c21035c0b9
Add final cleanup for sap_ctc_verb_tampering_user_mgmt
2013-05-16 10:42:09 -05:00
7823df0478
Change module filename
2013-05-16 10:41:25 -05:00
f3f0272395
Land #1652 , @nmonkee's SAP CTC Verb Tampering for User Mgmt module
2013-05-16 10:40:17 -05:00
4503a7af50
Don't save creds of anyuser:anypass
...
If http accepts any user and any pass, it's not a real auth
there is no reason to create cred objects for this.
These creds have been confusing our users
2013-05-16 10:25:32 -05:00
11286630d5
modifications to CLBA_ SOAP requests to fix XML kernel processor error
2013-05-16 11:24:29 +01:00
c82bb73347
Avoid super verbose output
2013-05-15 17:45:37 -05:00
649a8829d3
Add modules for Mutiny vulnerabilities
2013-05-15 09:02:25 -05:00
c410a54d44
Merge SAP SMB Relay abuses in just one module
2013-05-14 20:53:08 -05:00
357ef001cc
Change module filename
2013-05-14 20:52:33 -05:00
3d7c9a9a06
Changed the path from TARGETURI
2013-05-14 00:11:40 -03:00
5e997aaf80
Landing #1816 - lists essential information about CouchDB
2013-05-13 16:46:20 -05:00
cba045a604
Make additional changes to the module
2013-05-13 16:42:33 -05:00
e3384439ed
64-bit, not '64 bits'
2013-05-13 15:40:17 -05:00
e71e0c1c28
Land #1822 , @wchen-r7's module for Coldfusion HTP disclosed exploit
2013-05-13 12:41:54 -05:00
f04ca17bb9
Fix default action
2013-05-13 11:56:02 -05:00
5b64379553
Add Coldfusion 9 target, OSVDB ref and review
2013-05-13 11:55:11 -05:00
60299c2adb
Add EDB-25305 - That ColdFusion 10 sub0 0day stuff
...
This is just an aux module that extract passwords from
password.properties. Yes, this can leverage a shell too, but
obviously that's best implemented in #1737 , or as a new exploit.
We'll see.
2013-05-12 21:23:53 -05:00
feac292d85
Clean up for dlink_dsl320b_password_extractor
2013-05-12 17:35:59 -05:00
ee46771de5
Land #1799 , @m-1-k-3's auth bypass module for Dlink DSL320
2013-05-12 17:34:08 -05:00
a94d078bfd
Added the statement return to condition: if res.nil?
2013-05-11 00:59:05 -03:00
18ee9af59f
Added couchdb_enum.rb to list essential information about CouchDB
2013-05-10 23:18:48 -03:00
7a7f4a1727
Added couchdb_login.rb to try to brute-force credentials of CouchDB
2013-05-10 23:16:11 -03:00
d37d211ecc
Fix short escape sequences error
2013-05-09 17:29:55 -05:00
cf05602c6f
Land #1661 , @nmonkee's sap_soap_rfc_eps_get_directory_listing module
2013-05-09 16:46:13 -05:00
b18a98259b
Modify default rport
2013-05-09 16:24:54 -05:00
3e1d1a3f98
Land #1659 , @nmonkee's sap_soap_rfc_eps_delete_file module
2013-05-09 16:22:54 -05:00
53c08cd60f
fix incorrect printing typo
2013-05-09 21:37:04 +01:00
4c75354a6a
Land #1786 , request_cgi instead of request_raw
...
Also some other small changes to modules, such as sensible defaults for
options.
2013-05-08 14:58:04 -05:00
e3582887cf
OSVDB, Base64
2013-05-07 08:28:48 +02:00
fff8593795
Fix author name
2013-05-06 17:34:37 -05:00
c84febb81a
Fix extra character
2013-05-06 15:19:15 -05:00
92b4d23c09
Add Mariano as Author because of the abuse disclosure
2013-05-06 15:15:15 -05:00
db243e78c8
Land #1682 , sap_router_info_request fix from @nmonkee
2013-05-06 15:13:57 -05:00
85581a0b6f
Clean up sap_soap_rfc_eps_get_directory_listing
2013-05-06 13:21:42 -05:00
1fc0bfa165
Change module filename
2013-05-06 13:20:07 -05:00
0f2a3fc2d4
dsl320b authentication bypass - password extract
2013-05-06 14:31:47 +02:00
7b960a4f18
Add OSVDB reference
2013-05-06 00:54:00 -05:00
a17062405d
Clean up for sap_soap_rfc_eps_delete_file
2013-05-06 00:53:07 -05:00
5adc2879bf
Change module filename
2013-05-06 00:51:23 -05:00
66a5eb74c5
Move file to auxiliary/dos/sap
2013-05-06 00:50:50 -05:00
63b0eace32
Add a missing require
2013-05-04 22:39:57 -05:00
589be270bf
Land #1658 , @nmonkee's SAP module for PFL_CHECK_OS_FILE_EXISTENCE
2013-05-03 14:19:36 -05:00
7579b574cb
Rework parse_xml
...
We try to avoid using Nokogiri in modules due to the sometimes
uncomfortable dependencies it creates with particular compiled libxml
versions. Also, the previous parse_xml doesn't seem to be correctly
skipping item entries with blank names.
I will paste the test XML in the PR proper, but do check against a live
target to make sure I'm not screwing it up.
2013-05-02 14:43:30 -05:00
902cd7ec85
Revert removal of the SAP module
...
This reverts commit 26da7a6ee7
2013-05-02 14:42:35 -05:00
26da7a6ee7
Removing this from master due to test problems
...
This module was moved over to the unstable branch in commit
7106afdf7d
2013-05-02 13:43:02 -05:00
132c09af82
Add BID reference
2013-05-02 10:21:09 -05:00
6e68f3cf34
Clean up sap_soap_rfc_pfl_check_os_file_existence
2013-05-02 10:19:15 -05:00
244bf71d4a
Change module filename
2013-05-02 10:15:50 -05:00
d9cdb6a138
Fix more feedback provided by @nmonkee: CMD vs COMMAND
2013-05-02 09:08:48 -05:00
c6c7998e3b
Fix feedback provided by @nmonkee
2013-05-02 09:06:51 -05:00
4db81923bf
Update description
2013-05-02 08:45:01 -05:00
4054d91955
Land #1657 , @nmonkee's RZL_READ_DIR_LOCAL SAP dir listing module
2013-05-02 08:38:50 -05:00
e25057b64a
Fix indent level
2013-05-01 22:01:36 -05:00
c406271921
Cleanup sap_soap_rfc_rzl_read_dir
2013-05-01 21:51:06 -05:00
98dd96c57d
Change module filename
2013-05-01 21:50:24 -05:00
6b6b53240b
Fix SAP modules, mainly to make a better use of send_request_cgi
2013-05-01 14:06:53 -05:00
76e70adcff
Added Memcached Remote Denial of Service module
...
https://code.google.com/p/memcached/issues/detail?id=192
2013-04-30 17:45:09 +03:00
4227c23133
Add a reference for Safari module
2013-04-29 14:07:55 -05:00
431cba8f36
Update print_status labels.
2013-04-29 11:13:53 -05:00
c2a1d296a2
Rename DOWNLOAD_URI -> DOWNLOAD_PATH.
...
Conflicts:
modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
2013-04-29 11:11:06 -05:00
55e0ec3187
Add support for DOWNLOAD_URI option.
...
* Fixes some comments that were no longer accurate.
Conflicts:
modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
2013-04-29 11:10:19 -05:00
c27245e092
Touch descriptions for module and options
2013-04-26 13:05:16 -05:00
b4606ba60a
Remove unnecessary puts call.
2013-04-26 12:55:02 -05:00
ca6d6fbc84
msftidy for whitespace
2013-04-26 12:44:11 -05:00
16769a9260
Fixing path normalization
2013-04-26 12:40:24 -05:00
2fa16f4d36
Rewrite relative script URLs to be absolute.
...
* Adds rescue clauses around URI parsing/pulling
* Actually use the URI_PATH datastore option.
2013-04-26 11:25:20 -05:00
993356c73e
Add safari webarchive uxss to framework as an aux module.
2013-04-25 11:14:16 -05:00
b67fcd3219
Add OSVDB ref to sap_configservlet_exec_noauth
2013-04-25 08:13:32 -05:00
cae30bec23
Clean up all the whitespace found
2013-04-23 18:27:11 -05:00
1529dff3f3
Do final cleanup for sap_configservlet_exec_noauth
2013-04-22 21:43:41 -05:00
8c9715c2ed
Land #1751 , @andrewkabai's SAP Portal remote OS command exec
2013-04-22 21:41:53 -05:00
a09b3b8023
Lands #1169 - Adds a check
...
[Closes #1169 ]
Conflicts:
modules/auxiliary/dos/http/apache_range_dos.rb
2013-04-22 15:50:15 -05:00
882b084cba
Changes the default action
2013-04-22 15:47:38 -05:00
7e28a4ddb0
Uses "ACTIONS" keys instead of datastore options
...
It's better to use ACTIONS instead of datastore in this case. Also,
did some cleanup.
2013-04-22 15:41:47 -05:00
79eb2ff62d
add EDB ID to references
2013-04-22 18:37:28 +02:00
15b06c43aa
sap_configservlet_exec_noauth auxiliary module
...
the final module was moved from my master branch to here because of the
pull request needs
2013-04-22 17:40:27 +02:00
b4f1f3efbb
remove aux module from master branch
2013-04-22 17:34:01 +02:00
0115833724
SyntaxError fixes
2013-04-21 20:22:41 +00:00
49b055e5fd
make msftidy happy
2013-04-20 00:26:04 +02:00
e4d9c45ce9
remove unnecessary rank rating
2013-04-20 00:23:55 +02:00
c7fcd6931a
Use vprint_error
2013-04-19 16:22:07 -05:00
eaff87879e
added text
2013-04-19 22:03:05 +02:00
a6be72b019
fixes for mediawiki aux module
2013-04-19 21:43:12 +02:00
763d1ac2f1
remove unnecessary option declaration
2013-04-19 21:42:28 +02:00
85932a2445
improve URI path and parameter handling
...
switch from PATH to TARGETURI datastore;
use normalize_uri to build uri;
use query in send_request_cgi to to prepare query string (instead of
vars_get that escapes the necessary semicolons)
2013-04-19 21:37:39 +02:00
c52588f579
remove Scanner mixin
...
remove Scanner mixin because this module is not a scanner modul
2013-04-19 20:28:44 +02:00
7fdf84ac45
Landing #1744 - Checks nil before using resp.headers['Server']
...
[Closes #1744 ]
2013-04-19 10:37:05 -05:00
31586770a0
Added module for OSVDB 92490
2013-04-18 14:34:02 -05:00
8f76c436d6
SAP ConfigServlet OS Command Execution module
...
This module allows execution of operating system commands throug the
SAP ConfigServlet without any authentication.
2013-04-18 20:26:48 +02:00
15c6df1482
Check for nil before calling on value
2013-04-18 00:32:37 -04:00
a36c6d2434
Lands #1730 , adds a VERBOSE option checker
...
Also removes VERBOSE options from extant modules. There were only 5 of
them, and one was a commented option.
2013-04-15 15:32:56 -05:00
29101bad41
Removing VERBOSE offenders
2013-04-15 15:29:56 -05:00
76d4538d2a
Merge branch 'master' of github.com:rapid7/metasploit-framework
2013-04-09 10:24:54 -05:00
1e258170dc
It's a filename, so not trying to match any single char
2013-04-09 10:20:52 -05:00
50cf039170
Merge branch 'cve-2013-1899-not-auth' of github.com:jhart-r7/metasploit-framework into jhart-r7-cve-2013-1899-not-auth
2013-04-09 10:19:15 -05:00
ba86e14d43
Whitespace and caps fixes
2013-04-09 08:57:53 -05:00
225342ce8f
final cleanup for sysax_sshd_kexchange
2013-04-08 20:28:37 +02:00
5bc454035c
Merge remote-tracking branch 'origin/pr/1710' into landing-pr1710
2013-04-08 20:20:11 +02:00
b1152d1567
Improve Postgres CVE-2013-1899 to detect unauthorized connections
2013-04-08 09:55:23 -07:00
d24371eaff
Merge branch 'hp_imc_reportimgservlt_traversal' of github.com:jvazquez-r7/metasploit-framework into jvazquez-r7-hp_imc_reportimgservlt_traversal
2013-04-08 10:18:30 -05:00
1b5c34db1a
Merge branch 'hp_imc_ictdownloadservlet_traversal' of github.com:jvazquez-r7/metasploit-framework into jvazquez-r7-hp_imc_ictdownloadservlet_traversal
2013-04-08 10:17:19 -05:00
11253c8f3e
Merge branch 'hp_imc_faultdownloadservlet_traversal' of github.com:jvazquez-r7/metasploit-framework into jvazquez-r7-hp_imc_faultdownloadservlet_traversal
2013-04-08 10:16:52 -05:00
f96baa7e7e
Code Review Feedback
...
made the CLIENTVERSION always include the "SSH-2.0-OpenSSH_5.1p1 " to trigger DoS
2013-04-08 10:58:35 -04:00
4c8e19ad1a
Added reference
...
Removed final debug print statement
2013-04-08 08:28:53 -04:00
daba48035d
fix DEPTH description and basename
2013-04-05 11:05:46 +02:00
b6edad1f1d
fix DEPTH description and basename
2013-04-05 11:04:43 +02:00
d163e96d6a
fix DEPTH description and basename
2013-04-05 11:02:59 +02:00
30f44c3a24
final cleanup for dlink_dir_615h_http_login
2013-04-04 22:02:45 +02:00
8f60d12e46
Merge branch 'dlink_login_dir_615H' of https://github.com/m-1-k-3/metasploit-framework into m-1-k-3-dlink_login_dir_615H
2013-04-04 22:01:49 +02:00
7d1e9af728
final cleanup for dlink_dir_session_cgi_http_login
2013-04-04 21:41:42 +02:00
0b9fe53919
module filename changed
2013-04-04 21:41:10 +02:00
6ec6638568
Merge branch 'dlink_login_dir_300B_600B' of https://github.com/m-1-k-3/metasploit-framework into m-1-k-3-dlink_login_dir_300B_600B
2013-04-04 21:40:21 +02:00
498a0dc309
final cleanup for dlink_dir_300_615_http_login
2013-04-04 21:15:22 +02:00
cff70e41be
Merge branch 'dlink_login' of https://github.com/m-1-k-3/metasploit-framework into m-1-k-3-dlink_login
2013-04-04 21:14:56 +02:00
fe2b598503
Add the advisory URL
2013-04-04 10:22:31 -05:00
c8a6dfbda2
Add scanner module for the new PostgreSQL flaw
2013-04-04 10:19:47 -05:00
7b4cdf4671
make msftidy happy
2013-04-04 13:22:01 +02:00
78c492da20
is_dlink, more feedback included, msftidy
2013-04-04 13:18:32 +02:00
2f96a673cd
is_dlink, more feedback included
2013-04-04 13:17:45 +02:00
64f3e68310
is_dlink and some more feedback included
2013-04-04 13:01:18 +02:00
89de9fdf22
cleanup for dlink_dir_300_615_http_login
2013-04-03 10:04:01 +02:00
b4b3c82c86
delete space
2013-04-03 00:31:00 +02:00
54120a2d3a
delete space
2013-04-03 00:30:24 +02:00
85d9e3e9ee
delete space
2013-04-03 00:29:38 +02:00
0b4eab2499
added module for ZDI-13-053
2013-04-03 00:24:11 +02:00
018e147063
added module for ZDI-13-052
2013-04-03 00:22:38 +02:00
dc17b4931c
added module for ZDI-13-051
2013-04-03 00:21:01 +02:00
587170ae52
fixed author details - next try
2013-03-30 12:43:55 +01:00
1d6184cd63
fixed author details
2013-03-30 12:41:31 +01:00
8032a33cd5
report_auth_info - proof
2013-03-29 22:06:25 +01:00
1156194a6b
feedback included, server fingerprinting
2013-03-29 22:04:22 +01:00
2b4d6eb455
feedback included, server header check
2013-03-29 21:30:45 +01:00
b6a50da394
feedback included, server header check
2013-03-29 21:20:51 +01:00
9086c53751
Not an HttpClient, so doesn't have normalize_uri
...
[FixRM #7851 ]
2013-03-28 13:16:21 -05:00
5b30115336
vprint_status changed to vprint_error as requested
2013-03-28 14:27:51 +00:00
0f147dcf47
vprint_status changed to vprint_error as requested
2013-03-28 14:24:57 +00:00
eee702a329
vprint_status changed to vprint_error as requested
2013-03-28 14:23:21 +00:00
e2212ca8c9
vprint_status changed to vprint_error as requested
2013-03-28 14:22:01 +00:00
9594693ecb
vprint_status changed to vprint_error as requested
2013-03-28 14:16:19 +00:00
9d87db6831
vprint_status changed to vprint_error as requested
2013-03-28 14:08:24 +00:00
aae1d5933e
removed socket print, left over from debugging
2013-03-28 10:49:23 +00:00
376ca7b107
fixed issue with access denied condition thanks to @pho_bos
2013-03-28 10:41:37 +00:00
aa981cc991
DIR-645 also working
2013-03-27 12:11:14 +01:00
615aa57399
Dlink DIR615 HW rev B login module
2013-03-27 09:26:23 +01:00
680b551215
default to user admin
2013-03-27 08:59:19 +01:00
032214fb1d
default to user admin
2013-03-27 08:49:04 +01:00
dmaloney-r7
James Lee
jvazquez-r7
nmonkee
Roberto Soares Espreto
sinn3r
Tod Beardsley
m-1-k-3
HD Moore
Gregory Man
Joe Vennix
Andras Kabai
Antoine
Christian Mehlmauer
RageLtMan
Tod Beardsley
sinn3r
Jon Hart
Matt Andreko