07f7e5e148
Convert non-loginscanner MSSQL to rubyntlm
2016-06-22 10:15:22 -05:00
4b3f6c5d29
Use rubyntlm for mssql login scanner
2016-06-22 10:15:22 -05:00
fd4a51cadb
Bump version of framework to 4.12.8
2016-06-10 10:01:27 -07:00
815685992a
Bump version of framework to 4.12.7
2016-06-07 13:14:34 -07:00
c35322ec3f
Bump version of framework to 4.12.6
2016-05-30 22:34:13 -07:00
4dcddb2399
Fix #4885 , Support basic and form auth at the same time
...
When a module uses the HttpClient mixin but registers the USERNAME
and PASSWORD datastore options in order to perform a form auth,
it ruins the ability to also perform a basic auth (sometimes it's
possible to see both). To avoid option naming conflicts, basic auth
options are now HTTPUSERNAME and HTTPPASSWORD.
Fix #4885
2016-05-27 16:25:42 -05:00
54f4389d31
Bump version of framework to 4.12.5
2016-05-24 08:54:14 -07:00
100300c819
Bump version of framework to 4.12.4
2016-05-18 07:04:09 -07:00
c9dd863085
Bump version of framework to 4.12.3
2016-05-17 10:18:08 -07:00
621a908b2d
Bump version of framework to 4.12.2
2016-05-13 12:51:58 -07:00
ba4bfca806
Revert "arg bad build, resetting version back one"
...
This reverts commit d86392e96b
2016-05-13 14:48:35 -05:00
d86392e96b
arg bad build, resetting version back one
2016-05-13 14:44:02 -05:00
b6a83f734d
Bump version of framework to 4.12.1
2016-05-13 12:39:43 -07:00
31050a8da7
Rails upgrade to 4.2.6
...
lands all of the rails 4.2 upgrade work
Merge branch 'staging/rails-upgrade'
2016-05-13 14:34:50 -05:00
6c11054d5a
Bump version of framework to 4.12.0
2016-05-13 11:46:03 -07:00
6142d2cef1
Merge branch 'master' into staging/rails-upgrade
2016-05-09 09:27:17 -05:00
805f98f599
Bump version of framework to 4.11.27
2016-05-06 11:32:46 -07:00
19af279ce9
Merge branch 'master' into staging/rails-upgrade
2016-05-05 10:46:12 -05:00
e7ff4665e1
Bump version of framework to 4.11.26
2016-05-04 09:44:18 -07:00
7490ab1c78
Bump version of framework to 4.11.25
2016-05-03 17:09:07 -07:00
fb5b228984
Merge branch 'master' into staging/rails-upgrade
2016-05-02 11:33:35 -05:00
d4f1c78c5c
Bump version of framework to 4.11.24
2016-04-29 13:38:06 -07:00
d70dcbf4a4
Bump version of framework to 4.11.23
2016-04-22 09:34:10 -07:00
5e36a3128c
Fix #5197 , Fixed yard doc errors
...
Fix #5197 Fixed issues that caused errors during yard doc generation
2016-04-21 13:06:00 -05:00
d5085f6f0d
Bump version of framework to 4.11.22
2016-04-16 09:09:23 -07:00
c52f3dcb0e
update to rails 4.2.6
...
fix lost dep unlocks and upgrade rails to 4.2.6
MS-1400
2016-04-15 11:45:43 -05:00
16c599866c
Bump version of framework to 4.11.21
2016-04-08 16:23:33 -07:00
22d08fdf39
Revert #6748 , premature Gemfile* changes
2016-04-06 14:52:22 -05:00
8de58e4b80
Merge branch 'master' into staging/rails-upgrade
2016-04-04 09:30:01 -05:00
545cb11736
Bring #6409 up to date with upstream-master
2016-03-31 17:00:56 -05:00
5fdea91e93
Change naming
2016-03-31 17:00:29 -05:00
797acd625d
Land #6714 , Kill defanged mode
2016-03-30 10:54:56 -05:00
b8d53dde4a
Merge branch 'upstream-master' into staging/rails-upgrade
2016-03-29 15:56:50 -05:00
b41ac10fe8
Bump version of framework to 4.11.20
2016-03-29 12:43:20 -07:00
faaaf6b765
MS10-58 Call super in #set_sane_defaults for caidao login scanner
...
MS10-58
2016-03-29 13:40:51 -05:00
f1857d6350
Kill defanged mode
2016-03-28 09:02:07 -05:00
72bde63397
Bump version of framework to 4.11.19
2016-03-25 13:03:35 -07:00
7bd6d0c696
Merge branch 'master' into staging/rails-upgrade
2016-03-24 12:55:05 -05:00
e7b0c60e5c
Bump version of framework to 4.11.18
2016-03-23 07:55:29 -07:00
6e12e74e02
Bump version of framework to 4.11.17
2016-03-18 14:12:18 -07:00
e059f42094
Bump version of framework to 4.11.16
2016-03-11 14:17:28 -08:00
ca18996272
setup rails staging branch
...
rails 4.1 baby!
2016-03-09 15:35:00 -06:00
88697a5d3f
Merge branch 'master' into staging/rails-upgrade
2016-03-08 15:22:04 -06:00
a5cdd7e17f
Bump version of framework to 4.11.15
2016-03-04 16:56:02 -08:00
ce675330c0
Bump version of framework to 4.11.14
2016-03-04 14:49:55 -08:00
2e268a25da
Land #6596 , Apache Karaf Login Utility
2016-02-25 14:39:51 -06:00
7e25c7b87b
Handle OpenSSL::Cipher::CipherError
...
Our current net/ssh is petty outdated, so it is possible not being
able to connect to certain SSH servers.
2016-02-25 14:35:37 -06:00
2ec7149ae7
Logging deprecations to STDERR
2016-02-25 10:59:50 -06:00
b32f474e99
Bump version of framework to 4.11.13
2016-02-24 11:37:42 -08:00
b868f7cc89
Bump version of framework to 4.11.12
2016-02-19 20:19:43 -08:00
93cc7d58ba
Bump version of framework to 4.11.11
2016-02-12 15:38:50 -08:00
3c1ada46dd
Bump version of framework to 4.11.10
2016-02-05 13:40:02 -08:00
7079110964
Bump version of framework to 4.11.9
2016-01-29 10:51:46 -08:00
6187354392
Land #6226 , Add Wordpress XML-RPC system.multicall Credential BF
2016-01-23 00:12:46 -06:00
ad3eed525b
Handing newer version of WP, fallback CHUNKSIE to 1
2016-01-23 08:06:27 +03:00
0f9cf812b7
Bring wordpress_xmlrpc_login back, make wordpress_multicall as new
2016-01-22 18:54:20 -06:00
216986f7af
Do API documentation, rspec, and other small changes
2016-01-21 17:22:14 -06:00
5a0e11fb72
revert file check
2016-01-21 20:21:41 +01:00
d46ab29186
Don't name the method #send
2016-01-19 20:03:02 -06:00
390b46dd25
also check file for existance
2016-01-19 23:55:49 +01:00
b45e22b64d
use .any?
2016-01-19 23:16:10 +01:00
aaa1174ca5
fix rspec errors without database
2016-01-19 20:28:58 +01:00
98cfd2de90
remove PING authentication
2016-01-16 12:42:15 +08:00
a030179577
Bump version of framework to 4.11.8
2016-01-15 15:17:13 -08:00
59660dd6d0
Land #6465 , remove unneeded meterpreter extension post-installation copies
2016-01-15 17:04:14 -06:00
8479d01029
Land #6450 , add TLS support to MSSQL
2016-01-14 12:17:40 -06:00
f7ce0dfedf
remove the merge extension intialiser
...
this initialiser conflicts with the gemfication
of framework and causes permissions issues
MS-972
2016-01-12 14:08:54 -06:00
192505fe2d
killing threads and closing sockets more elegantly
2016-01-07 17:57:32 -06:00
dea4f35b0e
Bump to 4.11.7
2016-01-07 15:56:59 -08:00
5266860cec
Squashed more commits back into 1
2016-01-07 17:53:49 -06:00
675100946b
Initial SSL working OK
2016-01-07 17:53:48 -06:00
e38ff7079a
changing the require to start at metasploit_credentials
2016-01-07 15:49:49 -06:00
7f9b804060
Land #6410 , remove JtR binaries, update for independent framework releases
2016-01-06 14:16:49 -06:00
480913cb32
Add rspec
2016-01-06 01:41:13 -06:00
c3158497c0
rebuild / add check_setup / send_request
2016-01-05 15:10:26 +08:00
370351ca88
chinese caidao asp/aspx/php backdoor bruteforce
2015-12-31 15:17:01 +08:00
8090bbc750
Changes to support framework as a gem
2015-12-30 11:00:45 -06:00
a929dc0e35
add redis_login
2015-12-30 18:54:25 +08:00
4858ae63bd
Thread class name for debugger has changed, so add new name
...
MSP-13484
2015-12-10 21:47:22 -06:00
b1abfe898d
Update wordpress_xmlrpc_login
...
Replace the wordpress_xmlrpc_login code with
wordpress_xmlrpc_massive_bruteforce.rb, which should run a lot
faster.
2015-11-24 16:30:34 -06:00
f8a215e3cd
Adding changes to allow for easier version bumping
2015-11-09 15:56:03 -06:00
be23da1c1f
Merge branch 'upstream-master' into land-6120-python-stageless
2015-10-30 17:26:26 -05:00
f064fec0f1
Bumped version to 4.11.5
...
MSP-13377
2015-10-30 09:37:00 -05:00
810665847b
Add stageless python meterpreter to the payloads spec
2015-10-22 08:40:50 -04:00
bd96e0ded2
Improve get_hash for Framework version
2015-10-15 16:22:45 -05:00
3dd7fdfd95
Land #6055 , @wvu-r7's -q option for msfd
...
* Fixes #5770
2015-10-08 14:10:27 -05:00
77fae28cd4
Add -q option to msfd to disable banner
2015-10-07 01:57:58 -05:00
50249bd640
Update Metasploit::Framework::Tcp::Client to have SSLVerifyMode and SSLCipher into account
2015-09-28 13:57:08 -05:00
1e4e5c5bae
Update ACPP login scanner to have into account advanced options
2015-09-28 13:50:20 -05:00
3529cdad7b
Add attributes
2015-09-28 13:30:10 -05:00
0bb9324c8d
Pass HTTP::version_random_valid and HTTP::version_random_invalid
...
Fixes #5871
2015-08-20 10:05:42 -07:00
0b6a52e162
bump metasploit-framework gemspec version to match pro
2015-08-04 14:25:44 -05:00
e53419a911
use password_prompt? not @password_prompt
2015-07-27 19:21:59 -05:00
8349a274ea
use and include git hash of Framework as part of the version
...
Because we do not always update the version number, multiple releases have
shown version string, which is not useful for helping debug issues, or for
knowing what features are enabled.
This adds the git hash or reads from a file a copy of the git hash (useful for
doing packaged builds without git) so that it is clear the origin of a
particular metasploit-framework version.
2015-07-10 18:03:37 -05:00
174c90ccde
Updating version to match current
...
* This will be changed to the most recent git hash for next round,
at least making accurate for now.
2015-07-06 10:28:34 -05:00
b4656f43a4
Fix #5616 , Save username before stop_on_success breaks the task
...
Fix #5616
2015-06-26 18:04:18 -05:00
da779b1101
Fix login for 9.1
2015-06-26 13:52:44 -05:00
8e4fa80728
This looks good so far
2015-06-24 19:30:02 -05:00
d59c418df6
Fix #5591
...
Fix #5591
2015-06-23 19:10:14 -05:00
1af12fd11f
Glassfish version 9
2015-06-23 19:09:14 -05:00
e696d2f3dc
Merge branch 'master' into land-5348-ntds
2015-06-22 17:18:13 -05:00
732192aeaf
move ntds from priv to extapi
2015-06-22 09:04:08 -05:00
0b0cc3631b
Land #5569 , Correct service name for mssql for scanner detection
2015-06-19 15:33:05 -05:00
bd097e3264
Land #5497 , Refactor LoginScanner::SNMP to be fast and less buggy
2015-06-19 14:57:36 -05:00
d672ac1601
Correct service name for mssql for scanner detection
2015-06-19 13:54:31 -05:00
7f27fd0cf2
adjust for user name size changes
2015-06-18 11:17:08 -05:00
7c91aee7a8
Dont use a "connected" to keep compat with BSD
2015-06-09 20:33:46 -05:00
2a474c8375
Merge branch 'master' into feature/MSP-12358/ntds-dump-module
2015-06-08 11:42:03 -05:00
fe09d9888e
Small rework of the spinners, clear the line when done
2015-06-06 14:30:42 -05:00
cec20ec5d9
Handle a rare corner case
2015-06-06 11:46:19 -05:00
6b05302059
Fixes #5459 , refactors LoginScanner::SNMP
2015-06-06 00:50:55 -05:00
5d68a8167b
handle unicode changes
...
changed everything to utf-8 , so several sizes
on the ruby side needed to be changed to account for this
MSP-12358
2015-06-02 12:46:21 -05:00
4890882beb
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
2015-05-21 15:03:17 -05:00
e2c6742c1b
Merge branch 'master' of git://github.com/rapid7/metasploit-framework
2015-05-18 13:44:01 -05:00
7376d4d94e
account for public only credentials in #to_s
...
SNMP in particular will only have a public, so we need
to account for this so we don't output poorly formed text
with a trailing ':' char
5266
2015-05-18 13:42:15 -05:00
d05cae5faf
Land #5329 , @wchen-r7's add configurable options to jenkins_login
2015-05-15 11:38:21 -05:00
ac04b8d1e7
a little bit of cleanup
...
constantise some of the magic numbers in
the NTDS Account class
MSP-12358
2015-05-15 10:47:31 -05:00
724b7c6f16
save the ntlm hases as creds
...
the last step is now complete. the current and historical
hashes are all saved to the database for cracking and/or
replay
MSP-12358
2015-05-14 13:52:11 -05:00
6e813f6abd
Merge branch 'master' into feature/MSP-12357/meterp-ntds
2015-05-14 10:30:48 -05:00
9fafb645dd
Updating Rails version comment
2015-05-13 09:37:32 -05:00
9549d572cc
Land #5280 , update to Ruby on Rails 4.0
...
This upgrades a number of other gems as a side-effect.
2015-05-12 16:48:49 -05:00
f3effe5fbb
some minor cleanup
...
cleanup based on feedback from Kronicdeth
MSP-12357
2015-05-11 11:17:58 -05:00
1cc44cfc31
An alternative for normalize_uri
...
normalize_uri doesn't seem to work very well in our case, so
we do our own thing here.
2015-05-11 10:42:26 -05:00
10982f0a1a
Login url should normalize too
2015-05-11 10:18:09 -05:00
d8cc2c19d3
Fix #5315 , User configurable options for jenkins_login
...
Fix #5315 . This patch allows the user to configure the HTTP method
for the login, as well as the URL.
2015-05-11 10:15:49 -05:00
508574970c
Land #5307 , Brocade login scanner resurrection
2015-05-07 22:43:39 -05:00
8d3737d13c
Fix some stylistic issues
2015-05-07 22:43:23 -05:00
669df591f2
Pull default connection_timeout into constant
2015-05-06 13:18:00 -05:00
d4aed08260
Fix typo
2015-05-06 13:17:58 -05:00
0939bbc710
Set default retries/version for SNMP LoginScanner
...
Set in snmp_login but missed in the LoginScanner.
MSP-12668
2015-05-06 13:17:40 -05:00
93c785560b
remove brocade_telnet scanner, extend telnet
...
Rather than duplicate the entire telnet scanner, add a pre-login hook that a
module can use to extend the behavior on connect. This also adds a local
pass-through print_error method like http has.
2015-05-05 21:19:46 -05:00
6b5aaa5479
brocade enable command bruteforcer
2015-05-05 21:16:23 -05:00
1a8e8c624c
Merge branch 'master' into feature/MSP-12357/meterp-ntds
2015-05-05 11:07:36 -05:00
26e7fe15f9
Merge branch 'upstream' into staging/rails-4.0
...
Conflicts:
Gemfile.lock
2015-05-05 11:00:38 -05:00
c6806b4e5f
Land #5102 , @wchen-r7's ManageEngine Desktop Central Login Utility
2015-05-01 15:20:21 -05:00
3e7c790db8
Use constants
2015-05-01 15:15:18 -05:00
0b608e139a
Merge branch 'upstream' into staging/rails-4.0
2015-05-01 11:26:24 -05:00
2bbae6b9c2
add #to_s to ntds account
...
added to_s method to the NTDS account
for easy output
MSP-12357
2015-05-01 11:24:23 -05:00
acb833bd09
NTDS::Parser class built out
...
the NTDS Parser class will take a meterpreter
client and a fielpath and provide an enumerator for reading
out the user accounts as ruby objects
MSP-12357
2015-04-30 14:57:30 -05:00
4c9f44b00c
Revert "Land #4888 , @h00die's brocade credential bruteforcer"
...
There were some issues with this module that caused backtraces when run outside
of msfconsole. Reverting it for now so we can add some specs and ensure that it
works like the other login scanners.
2015-04-29 15:36:03 -05:00
2847bc8a6b
a little more yard
2015-04-29 14:53:08 -05:00
1f66840533
add YARD docs to NTDS Account
...
added yard around the attrs for the NTDS::Account
class
MSP-12357
2015-04-29 12:53:54 -05:00
8163c3cdda
Merge branch 'master' into staging/rails-4.0
...
Conflicts:
Gemfile.lock
plugins/nessus.rb
2015-04-28 15:33:46 -05:00
6c77c4bb52
opening groundwork
...
added a priv extension method to open
a stream channel to read ntdsaccounts from
and an NTDS account class to accept the
data and parse it into a useable structure
MSP-12357
2015-04-24 15:50:12 -05:00
3963289519
Land #4888 , @h00die's brocade credential bruteforcer
2015-04-21 18:27:03 -05:00
8aca4539c9
Land #5152 , undefined var in WinRM_Login
2015-04-20 23:01:11 -05:00
2bdcc178ef
Remove extraneous addition
2015-04-16 02:30:09 -05:00
42ff0decc7
Land #4722 , timing options for snmp_login
2015-04-16 02:25:29 -05:00
88062a578d
Clean up PR
2015-04-16 02:25:06 -05:00
e82fb5f836
Merge branch 'master' into staging/rails-4.0
...
Conflicts:
Gemfile.lock
lib/msf/ui/console/command_dispatcher/db.rb
metasploit-framework-db.gemspec
metasploit-framework.gemspec
2015-04-15 14:04:35 -05:00
926db59a8c
credential doesn't exist in this context
2015-04-15 15:48:21 +01:00
c971bc930c
Mark app/concerns as autoload
...
To work with metasploit-concern 0.4.0 prerelease not deriving
app/concerns from root and to ensure it is does not inherit eager_load
from app.
2015-04-14 15:06:59 -05:00
4c407ce962
Merge branch 'bug/MSP-12529/missing-require-metasploit-credential' into bug/MSP-12550/app-concerns-eager-load
...
MSP-12550
2015-04-14 14:42:54 -05:00
19fe226b30
Correct a minor typo
2015-04-10 22:37:14 +05:00
90d525088c
Green rspec
2015-04-10 11:36:23 -05:00
8c0d5d66d0
Add spec file
2015-04-10 15:32:03 +05:00
8b56286e66
Try to require 'metasploit/credential' when including Metasploit::Credential::Creation
...
MSP-12529
By convention, the top-level require of any gem should always be
required before trying to use any inner require.
2015-04-09 09:05:38 -05:00
b6e750d7eb
Nessus auxiliary scanner for updated REST API
2015-04-09 11:36:17 +05:00
59d89f4846
rm junk comments
2015-04-09 00:59:14 -05:00
f51eaef765
Add rspec
2015-04-08 02:33:27 -05:00
5f389cf3c2
Add ManageEngine Desktop Central Login Utility
2015-04-08 02:05:56 -05:00
5e2d6c27c3
Merge branch 'master' into staging/rails-4.0
...
Conflicts:
Gemfile.lock
db/schema.rb
lib/msf/core/db_manager/session.rb
metasploit-framework-db.gemspec
2015-04-06 11:27:00 -05:00
6c36a82f78
Land #5059 , @void-in's documentation clean up
2015-04-03 14:16:34 -05:00
fe5ddc01ad
Fix return documentation
2015-04-03 14:16:06 -05:00
6455862484
Merge branch 'staging/rails-4.0' of github.com:rapid7/metasploit-framework into staging/rails-4.0
...
Conflicts:
Gemfile.lock
metasploit-framework.gemspec
2015-04-03 13:56:38 -05:00
0dd987d873
Updated as per jlee-r7 feedback
2015-04-03 10:17:54 +05:00
1684bfec9e
add missing data to loginscanner results
...
the chef web ui and symantec web gateway
loginscanners do not save the target(host/port/proto) info
in the Result object. This can cause modules to break as they
expected the Result to contain that information
MSP-12499
2015-04-02 13:53:45 -05:00
4ba761986f
Correct YARD doc comments
2015-04-02 16:14:25 +05:00
103373a7eb
add back accidentally remvoed error
...
accidentally dropped Errno::ETIMEDOUT from the exception
handling
MSP-12389
2015-03-30 11:19:28 -05:00
441feec360
fix missing exception handling
...
a few of our http login scanners needed to
handle a couple of other exception classes
for when network communication errors occur
MSP-12389
2015-03-27 12:31:14 -05:00
6e3e696262
Use symantec_web_gateway as an example of using send_request
2015-03-25 10:55:46 -05:00
60f1d9c961
More yard doc
2015-03-25 10:50:11 -05:00
9b9e157e84
More yard doc
2015-03-25 02:26:06 -05:00
ded500a9ae
Use send_request
2015-03-25 02:13:40 -05:00
6984e5234e
Fix a typo
2015-03-25 02:01:25 -05:00
8a8d6fb5ab
Some more changes
2015-03-25 02:00:23 -05:00
855cadc6b1
Rescue more exceptions
...
The attempt_login method is rescuing these exceptions, so maybe
I should do the same.
2015-03-25 01:48:37 -05:00
8f95624bf7
Add #send_request to Metasploit::Framework::LoginScanner::HTTP
2015-03-25 01:40:02 -05:00
bef67d773c
Don't break untested_payloads.rb
2015-03-24 00:54:11 -05:00
1226b3656f
Land #4945 , @wchen-r7's login scanner for Symantec web gateway
2015-03-20 14:44:05 -05:00
62871255b0
Match class and file names
2015-03-20 14:25:20 -05:00
179177d5c0
Fix typo
2015-03-20 13:27:41 -05:00
f29a3f69e9
Merge branch 'master' into staging/rails-4.0
...
Conflicts:
Gemfile.lock
metasploit-framework-db.gemspec
2015-03-17 15:47:48 -05:00
608bf55b79
Update
2015-03-17 11:54:38 -05:00
27b6fbb648
I don't need :ssl and :ssl_version
2015-03-17 11:31:38 -05:00
69453c1955
Missing ?
2015-03-17 12:00:58 +00:00
fcc21ff928
Stylish like @limhoff-r7
2015-03-17 11:44:02 +00:00
d18224e3cb
Correct capitilzation of GitLab
2015-03-17 11:32:14 +00:00
25840c41cf
Rubocop
2015-03-17 11:21:05 +00:00
f4a1e981ab
Add gitlab login scanner
2015-03-17 11:19:23 +00:00
ff58f7d270
Add Symantec Web Gateway Login Module
2015-03-17 02:51:57 -05:00
591716e557
brocade enable command bruteforcer
2015-03-06 09:41:14 -05:00
75c075e32b
properly anchor regexes
...
duh
2015-03-03 19:15:29 -06:00
64490c746a
CredCollection now knows about postgres_md5
...
the cred collection can now identify a postgres_md5 hash string
and set the type on the Metasploit::Framework::Credential object
appropriately
MSP-12244
2015-03-03 16:43:52 -06:00
c836078292
allow credentials to have a type of postgres_md5
...
add postgres_md5 to the type validation on
Metasploit::Framework::Credential to account
for the new Private type
MSP-12244
2015-03-03 16:35:30 -06:00
aa4038d539
allow the postgres librry to take an md5 hash
...
allow the raw md5 password hash to be passed in instead of
a password for md5 authentication in postgres. Adds an extra exception
class for when an md5 hash is given but the server expects
a different form of authentication.
MSP-12244
2015-03-03 13:16:46 -06:00
8c5ff858d0
Land #4812 , hp_sys_mgmt_login configurable URIs
2015-02-23 19:04:14 -06:00
97ccf7e23f
Fixes SSL support for http_login (variable shadowing)
2015-02-23 14:00:29 -06:00
c39d6e152e
Land #4819 , Normalize HTTP LoginScanner modules
2015-02-23 11:43:42 -06:00
c60e2584bf
Comment typo
2015-02-22 02:51:18 -06:00
888c718f40
Fix two typos
2015-02-22 02:45:50 -06:00
8e8a366889
Pass Http::Client parameters into LoginScanner::Http (see #4803 )
2015-02-22 02:26:15 -06:00
bf2be7964b
Fix #4592 , print_* methods used in LoginScanner modules
...
Fix #4592
2015-02-20 22:46:21 -06:00
40c237f507
Fix #3982 , allow URIs to be user configurable
...
Fix #3982
2015-02-20 21:54:03 -06:00
e397ecec9d
Merge branch 'upstream-master' into staging/rails-4.0
2015-02-18 15:05:39 -06:00
ffa6550aec
Land #4787 , HD's new Zabbix and Chef LoginScanners
...
Lands the new LoginScanners HD wrote for Zabbix
and the Chef WebUI
2015-02-18 14:51:16 -06:00
804db0ff0c
add leixcal sorting to methods
...
lexical sort the new methods except for
msf module entrypoint methods which should always be at
the top
2015-02-18 14:50:33 -06:00
2847507f03
Add a chef brute force module
2015-02-17 23:49:57 -06:00
27d5ab45b4
Add a zabbix brute force module
2015-02-17 22:56:08 -06:00
85fd139ab0
Add missing context and a normalize_uri helper method
2015-02-17 22:55:53 -06:00
16932372db
Calls to Rex::Proto::Http::Client.new were passing in empty context
2015-02-17 20:44:37 -06:00
5fba54db99
Add addtional timing options
2015-02-16 19:07:55 +00:00
d4d1dc09f3
Merge branch 'master' into staging/rails-4.0
...
Conflicts:
Gemfile.lock
db/schema.rb
metasploit-framework-db.gemspec
metasploit-framework.gemspec
2015-02-13 16:13:18 -06:00
8d982e3286
Pass the framework/module down into LoginScanner
2015-02-07 11:50:30 -06:00
985641dbc4
Add missing Context, fixes #4723
2015-02-07 11:27:57 -06:00
7d1090baca
Convert #find(:all) to #where or #all
2015-02-01 00:31:58 -06:00
8f54e4d611
Implement "-" for msfconsole -r from stdin
...
More predictable than /dev/stdin, which is usually a symlink to
/proc/self/fd/0 or /dev/fd/0, but the feature is not guaranteed to be
present.
This isn't *terribly* useful, but it can be. -x is recommended, but it
doesn't allow for ERB directives. This is mostly for hax.
2015-01-29 19:26:56 -06:00
69f03f5c5d
Move ACPP default port into Rex
2015-01-12 19:43:57 -08:00
e9557ffe58
Simplify module in prep for some authbrute cleanups
2015-01-12 13:08:12 -08:00
97f5cbdf08
Add initial Airport ACPP login scanner
2015-01-12 13:08:12 -08:00
b4eef14ac6
Update metasploit gems
2015-01-08 15:33:23 -06:00
2cd5be021b
Merge branch 'master' into staging/rails-4.0
...
Conflicts:
Gemfile
Gemfile.lock
db/schema.rb
metasploit-framework-db.gemspec
metasploit-framework.gemspec
2015-01-08 13:12:27 -06:00
bdbb26ba31
Land #4540 , resolves #4532 , honour DB_ALL_* options
2015-01-07 21:12:23 +00:00
5d68d48ca5
Land #4385 , fixes bruteforce_speed validator
...
bruteforce_speed validator now accepts nil
2015-01-07 12:09:25 -06:00
702511dbc5
respect DB_ALL_USERS & DB_ALL_PASS
...
fix last few things in authbrute
and make the CredentialCollections understand the
additional seperate components
MSP-11986
2015-01-07 11:41:41 -06:00
7ff2ba0725
first pass on fixing DB_ALL authbrute stuff
...
DB_ALL_CREDS worked but DB_ALL_USER and DB_ALL_PASS
did not. working on fixing that.
This commit also does some nice DRY work in the auth_brute mixin
MSP-11986
2015-01-07 11:30:39 -06:00
6ded5a7eb4
Avoid spinner on Windows
...
Fixes #4147 , probably.
2014-12-30 10:17:56 -06:00
337b2d784f
Land #4416 , define rails version dep in one place
...
* Bump rails to 3.2.21
2014-12-19 15:17:54 -06:00
db0aeb2a05
Make the version constraint a range
2014-12-19 13:54:13 -06:00
c493ccfc06
Define the Rails version constraint in a library constant
2014-12-19 11:46:39 -06:00
80cd04d76a
Land #4332 , test optimization for Cucumber
...
* Make Cuke run faster on TravisCI
2014-12-18 09:34:55 -06:00
4c994d84e0
Updating version to 4.11 for Flood release
2014-12-15 14:42:09 -06:00
ac004d2770
Fix bruteforce validators to accept nil
...
bruteforce_speed isn't always required, because the speed checker
already handles nil (and presumes the user wants the fastest possible).
See also MSP-11842
2014-12-12 13:57:37 -06:00
4eaf64afef
Don't lie about stop_on_success
...
This absolutely needs to be honored too, though.
See #4365 .
2014-12-11 12:37:13 -06:00
edf541fabe
Fix some double spacing
2014-12-11 09:39:15 -06:00
09617f990b
Implement BRUTEFORCE_SPEED respect (telnet)
...
This implements just for telnet, but assuming this strategy is kosher,
it's not too painful to add for the rest of the LoginScanner using the
old defaults used by `AuthBrute`.
See #3904 , @dmaloney-r7 or @jlee-r7
2014-12-09 15:40:43 -06:00
8c0610cb7a
Merge branch 'master' into feature/MSP-11671/test-optimization
...
MSP-11671
Conflicts:
.travis.yml
2014-12-08 08:46:22 -06:00
9cc04e59eb
Fix #4304 - Blank password is tried when it shouldn't happen
...
Fix #4304
2014-12-04 12:59:51 -06:00
f696a5ab0e
msfconsole --defer-module-loads
...
MSP-11671
Add command line option --defer-module-loads to msfconsole. It will
stop `Msf::Ui::Console::Driver` from calling
`framework.modules.init_module_paths` AND
`framework.modules.refresh_cache_from_database`. This flag is only
meant to speed up msfconsole boot when modules do not need to accessed,
such as during cucumber testing of command help or command line options.
2014-12-02 14:41:32 -06:00
33b42389f0
Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-17 09:35:47 -06:00
e3869ee1ae
Include Thread status when printing leaked threads
...
MSP-11147
Sometime travis-ci is showing leaked threads even when
'Msf::Framework#threads cleaner' is being used, so I'm adding the
`Thread#status` to the data printed about the Thread to see if the
sometimes leaked threads have an odd status. There's still a chance
that there will be a race-condition between when I call Thread.list and
I ask for each Thread's status that the VM could finish aborting a
Thread so that status I print isn't the same as the one that caused the
Thread to be returned in Thread.list.
2014-11-17 09:30:46 -06:00
ba836f2383
Only calculate thread UUIDs if they are needed
...
MSP-11147
Only calculate thread UUIDs if the thread count exceeds
EXPECTED_THREAD_COUNT_AROUND_SUITE.
2014-11-17 09:17:44 -06:00
ceb7a63a5c
Merge branch 'master' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
2014-11-14 18:20:55 -06:00
3b558624f3
Merge branch 'landing/4129' into upstream-master
...
Landing #4129
* Detect leaked constants in spec runs
2014-11-14 12:55:56 -06:00
14fa1dba0b
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-14 11:58:16 -06:00
d9a25005a6
Wrap Msf::Framework#threads in Metasploit::Framework::ThreadFactoryProvider
...
MSP-11605
`Rex::ThreadFactory.provider` needs to be set in
`Msf::Framework#initialize`, but setting it directly to
`Msf::Framework#threads` eliminates the laziness of
`Msf::Framework#threads`. In order keep `framework.threads` lazy,
`framework` is wrapped in a
`Metasploit::Framework::ThreadFactoryProvider`, which responds to
`spawn`, which is needed by `Rex::ThreadFactory`, by calling
`framework.threads.spawn`, which lazily initialized `framework.threads`
when the first thread needs to be spawned.
2014-11-13 14:08:26 -06:00
b17b263cc7
Ignore debugger threads
...
MSP-11147
When using the debugger, it adds a thread that should be allowed and not
go towards the count.
2014-11-13 09:49:08 -06:00
535f69b56d
Append to RUBYOPT for debugger compatibility
...
MSP-11147
When using Rubymine's debugger, the tests would run and say there were
no tests and no break points would be hit. It was determined that this
was due the Rubymine's debugger injecting itself into RUBYOPTS and only
working if it's first in RUBYOPT, which means that
'metasploit:framework:spec:threads:suite' must inject '-Ilib
-rmetasploit/framework/spec/threads/logger' at the end of RUBOPT instead
of the beginning.
2014-11-13 09:19:07 -06:00
69043d51e0
Merge branch 'master' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
2014-11-12 12:34:25 -06:00
6b4eb9a8e2
Differentiate failed binds from connects, closes #4169
...
This change adds two new Rex exceptions and changes the local comm to raise the right one depending on the circumstances. The problem with the existing model is
that failed binds and failed connections both raised the same exception. This change is backwards compatible with modules that rescue Rex::AddressInUse in additi
on to Rex::ConnectionError. There were two corner cases that rescued Rex::AddressInUse specifically:
1. The 'r'-services mixin and modules caught the old exception when handling bind errors. These have been updated to use BindFailed
2. The meterpreter client had a catch for the old exception when the socket reports a bad destination (usually a network connection dropped). This has been updat
ed to use InvalidDestination as that was the intention prior to this change.
Since AddressInUse was part of ConnectionError, modules and mixins which caught both in the same rescue have been updated to just catch ConnectionError.
2014-11-11 14:59:41 -06:00
James Lee
Metasploit
wchen-r7
Jenkins
David Maloney
thao doan
William Vu
Brent Cook
Gregory Mikeska
darkbushido
KINGSABRI
Christian Mehlmauer
nixawk
Louis Sato
Jonathan Harms
Chris Doughty
Luke Imhoff
Samuel Huckins
Spencer McIntyre
jvazquez-r7
Jon Hart
HD Moore
root
Matt Buck
Meatballs
root
Fernando Arias
Christian Catalan
Tod Beardsley
Matt Buck
Trevor Rosen