d37d211ecc
Fix short escape sequences error
2013-05-09 17:29:55 -05:00
4147a27216
Land #1667 , @nmonkee's sap_soap_rfc_sxpg_command_exec exploit
2013-05-09 17:00:11 -05:00
6842432abb
Land #1678 , @nmonkee's sap_soap_rfc_sxpg_call_system_exec exploit
2013-05-09 16:52:01 -05:00
cf05602c6f
Land #1661 , @nmonkee's sap_soap_rfc_eps_get_directory_listing module
2013-05-09 16:46:13 -05:00
b18a98259b
Modify default rport
2013-05-09 16:24:54 -05:00
3e1d1a3f98
Land #1659 , @nmonkee's sap_soap_rfc_eps_delete_file module
2013-05-09 16:22:54 -05:00
53c08cd60f
fix incorrect printing typo
2013-05-09 21:37:04 +01:00
2f543d3080
extension and pref parsing
2013-05-09 13:23:28 -04:00
9043eeda66
A slight change for stability
...
While updating ie_cgenericelement_uaf earlier today, I noticed the
changes made it a tiny bit less stable. Juan's test log in #1809
also kinda shows that (with the first attempt failing), so I decided
to go back and move the string crafting part, that way between
CollectGarbage() and the overwrite, there is less noise, and hopefully
more stable. I did a few tests, seems better.
2013-05-08 20:02:55 -05:00
bdd2287daf
Land #1809 , @wchen-r7's modification for ie_cgenericelement_uaf
2013-05-08 16:21:11 -05:00
0e51042a01
Landing #1808 - ERS Viewer 2011 bof (CVE-2013-0726)
2013-05-08 15:51:46 -05:00
9a1400a75b
Forgot to remove this print_warning
2013-05-08 15:44:04 -05:00
075f6e8d45
Updates ROP chain and mstime_malloc usage
2013-05-08 15:42:45 -05:00
4c75354a6a
Land #1786 , request_cgi instead of request_raw
...
Also some other small changes to modules, such as sensible defaults for
options.
2013-05-08 14:58:04 -05:00
c7609ac7d1
Initial update
2013-05-08 14:24:52 -05:00
1aa80cd35e
Add module for CVE-2013-0726
2013-05-08 13:48:48 -05:00
e939de583c
Clean up and multi platform support for sap_soap_rfc_sxpg_command_exec
2013-05-07 22:46:39 -05:00
5f59d9f723
Move sap_soap_rfc_sxpg_command_exec to multi dir
2013-05-07 22:46:04 -05:00
ab60e0bfb7
Fix print message
2013-05-07 22:41:15 -05:00
24bad9c15c
Clean up sap_soap_rfc_sxpg_call_system_exec and make it multi platform
2013-05-07 17:03:10 -05:00
76f6d9f130
Move module to multi-platform location
2013-05-07 17:01:56 -05:00
e3582887cf
OSVDB, Base64
2013-05-07 08:28:48 +02:00
fff8593795
Fix author name
2013-05-06 17:34:37 -05:00
c84febb81a
Fix extra character
2013-05-06 15:19:15 -05:00
92b4d23c09
Add Mariano as Author because of the abuse disclosure
2013-05-06 15:15:15 -05:00
db243e78c8
Land #1682 , sap_router_info_request fix from @nmonkee
2013-05-06 15:13:57 -05:00
85581a0b6f
Clean up sap_soap_rfc_eps_get_directory_listing
2013-05-06 13:21:42 -05:00
1fc0bfa165
Change module filename
2013-05-06 13:20:07 -05:00
09bf23f4d6
linksys wrt160n tftp download module
2013-05-06 16:18:15 +02:00
22d850533a
dir615 down and exec exploit
2013-05-06 15:33:45 +02:00
0f2a3fc2d4
dsl320b authentication bypass - password extract
2013-05-06 14:31:47 +02:00
7b960a4f18
Add OSVDB reference
2013-05-06 00:54:00 -05:00
a17062405d
Clean up for sap_soap_rfc_eps_delete_file
2013-05-06 00:53:07 -05:00
5adc2879bf
Change module filename
2013-05-06 00:51:23 -05:00
66a5eb74c5
Move file to auxiliary/dos/sap
2013-05-06 00:50:50 -05:00
e40695769d
unbotch merge?
2013-05-05 16:43:56 -05:00
2d99167fe7
Merge commit 'b0f5255de8f78fb0d54be1ee49f43455968d6740' into upstream-master
2013-05-05 16:41:18 -05:00
b0f5255de8
fix ssh_creds username
...
ssh_creds post module as not saving
the username in the cred objects
2013-05-05 16:31:28 -05:00
8239998ada
Typo on URL for #1797 . Thx @Meatballs1
2013-05-05 12:26:06 -05:00
c9ea7e250e
Fix disclosure date, ref for #1897
2013-05-05 12:13:02 -05:00
e9841b216c
Land #1797 , IE8 DoL exploit module from @wchen-r7
...
Exploit for an in-the-wild unpatched vuln in IE8. @jvazquez-r7 already
reviewed functionality
2013-05-05 12:06:45 -05:00
a33510e821
Add MS IE8 DoL 0day exploit (CVE-2013-1347)
...
This module exploits a use-after-free vuln in IE 8, used in the
Department of Labor attack.
2013-05-05 12:04:17 -05:00
63b0eace32
Add a missing require
2013-05-04 22:39:57 -05:00
c3e9503c0b
tplink traversal - initial commit
2013-05-03 14:27:13 -05:00
589be270bf
Land #1658 , @nmonkee's SAP module for PFL_CHECK_OS_FILE_EXISTENCE
2013-05-03 14:19:36 -05:00
13202a3273
Add OSVDB reference
2013-05-03 09:46:29 -05:00
a95de101e7
Delete extra line
2013-05-02 22:04:27 -05:00
6210b42912
Port EDB 25141 to msf
2013-05-02 22:00:43 -05:00
a2e1fbe7a9
Make msftidy happy
2013-05-02 19:46:26 -05:00
f57b2de632
Land #1787 , @wchen-r7's mod to ie_cbutton_uaf to use the js_mstime_malloc API
2013-05-02 19:44:19 -05:00
7579b574cb
Rework parse_xml
...
We try to avoid using Nokogiri in modules due to the sometimes
uncomfortable dependencies it creates with particular compiled libxml
versions. Also, the previous parse_xml doesn't seem to be correctly
skipping item entries with blank names.
I will paste the test XML in the PR proper, but do check against a live
target to make sure I'm not screwing it up.
2013-05-02 14:43:30 -05:00
902cd7ec85
Revert removal of the SAP module
...
This reverts commit 26da7a6ee7
2013-05-02 14:42:35 -05:00
eb23b5feeb
Forgot to remove function ie8_smil. Don't need this anymore.
2013-05-02 14:04:15 -05:00
329e8228d1
Uses js_mstime_malloc to do the no-spray technique
2013-05-02 14:00:15 -05:00
26da7a6ee7
Removing this from master due to test problems
...
This module was moved over to the unstable branch in commit
7106afdf7d
2013-05-02 13:43:02 -05:00
132c09af82
Add BID reference
2013-05-02 10:21:09 -05:00
6e68f3cf34
Clean up sap_soap_rfc_pfl_check_os_file_existence
2013-05-02 10:19:15 -05:00
244bf71d4a
Change module filename
2013-05-02 10:15:50 -05:00
d9cdb6a138
Fix more feedback provided by @nmonkee: CMD vs COMMAND
2013-05-02 09:08:48 -05:00
c6c7998e3b
Fix feedback provided by @nmonkee
2013-05-02 09:06:51 -05:00
4db81923bf
Update description
2013-05-02 08:45:01 -05:00
4054d91955
Land #1657 , @nmonkee's RZL_READ_DIR_LOCAL SAP dir listing module
2013-05-02 08:38:50 -05:00
e25057b64a
Fix indent level
2013-05-01 22:01:36 -05:00
c406271921
Cleanup sap_soap_rfc_rzl_read_dir
2013-05-01 21:51:06 -05:00
98dd96c57d
Change module filename
2013-05-01 21:50:24 -05:00
6b6b53240b
Fix SAP modules, mainly to make a better use of send_request_cgi
2013-05-01 14:06:53 -05:00
567d2bb14b
Land #1687 , @bmerinofe's forensic file recovery post module
2013-05-01 08:13:08 -05:00
a201391ee6
Clean recovery_files
2013-04-30 13:18:32 -05:00
60e0cfb17b
Trivial description cleanup
2013-04-29 14:11:20 -05:00
4227c23133
Add a reference for Safari module
2013-04-29 14:07:55 -05:00
431cba8f36
Update print_status labels.
2013-04-29 11:13:53 -05:00
c2a1d296a2
Rename DOWNLOAD_URI -> DOWNLOAD_PATH.
...
Conflicts:
modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
2013-04-29 11:11:06 -05:00
55e0ec3187
Add support for DOWNLOAD_URI option.
...
* Fixes some comments that were no longer accurate.
Conflicts:
modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
2013-04-29 11:10:19 -05:00
1d9a695d2b
Landing #1772 - Adds phpMyadmin Preg_Replace module (CVE-2013-3238)
...
[Closes #1772 ]
2013-04-28 12:17:16 -05:00
ccb630eca2
Whitespace and change default user
2013-04-27 10:39:27 +01:00
209188bc22
Add refs and use targeturi
2013-04-27 10:35:49 +01:00
3ac041386b
Add php version to check
2013-04-26 23:59:49 +01:00
e25fdebd8d
Add php version to check
2013-04-26 23:58:08 +01:00
cd842df3e2
Correct phpMyAdmin
2013-04-26 23:38:27 +01:00
6bb2af7cee
Add pma url
2013-04-26 23:37:26 +01:00
6821c360b6
Landing #1761 - Adds Wordpress Total Cache module
...
[Closes #1761 ]
2013-04-26 16:08:04 -05:00
6c76bee02f
Trying to make the description sound smoother
2013-04-26 16:02:28 -05:00
9c8b93f1b7
Make sure LPORT is a string when subbing
...
* Gets rid of conversion errors like this:
[-] Exploit failed: can't convert Fixnum into String
* also removes comments from php meterp. Works for me with the
phpmyadmin_preg_replace bug, so seems legit.
2013-04-26 15:26:31 -05:00
a0c1b6d1ce
Clear out PMA's error handler
...
* Add an error_handler function that just returns true. This prevents eventual
ENOMEM errors and segfaults like these:
[Fri Apr 26 15:01:00 2013] [error] [client 127.0.0.1] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 44659282 bytes) in /home/egypt/repo/phpmyadmin/libraries/Error.class.php on line 156
[Fri Apr 26 15:01:16 2013] [notice] child pid 7347 exit signal Segmentation fault (11)
* clean up some whitespace
2013-04-26 15:25:09 -05:00
1f2cab7aef
Tidyup and getcookies
2013-04-26 20:26:04 +01:00
0901d00da5
Remove redundant pay opts
2013-04-26 19:26:29 +01:00
a17d61897d
Change to send_rq_cgi
2013-04-26 19:19:11 +01:00
bf6b1b4fbf
Land #1773 , fixes for Safari UXSS
...
Makes the module more user-friendly, doesn't barf on malformed paths for
keystroke logger catching.
2013-04-26 13:11:55 -05:00
c27245e092
Touch descriptions for module and options
2013-04-26 13:05:16 -05:00
b4606ba60a
Remove unnecessary puts call.
2013-04-26 12:55:02 -05:00
ca6d6fbc84
msftidy for whitespace
2013-04-26 12:44:11 -05:00
16769a9260
Fixing path normalization
2013-04-26 12:40:24 -05:00
54233e9fba
Better entropy
2013-04-26 17:46:43 +01:00
c8da13cfa0
Add some entropy in request
2013-04-26 17:34:17 +01:00
2fa16f4d36
Rewrite relative script URLs to be absolute.
...
* Adds rescue clauses around URI parsing/pulling
* Actually use the URI_PATH datastore option.
2013-04-26 11:25:20 -05:00
a043d3b456
Fix auth check and cookie handling
2013-04-26 17:10:24 +01:00
025315e4e4
Move to http
2013-04-26 15:42:26 +01:00
9ad19ed2bf
Final tidyup
2013-04-26 15:41:28 +01:00
99b46202b9
Do final cleanup for sap_configservlet_exec_noauth
2013-04-26 08:45:34 -05:00
308b880d79
Land #1759 , @andrewkabai's exploit for SAP Portal Command Execution
2013-04-26 08:44:11 -05:00
jvazquez-r7
nmonkee
Rob Fuller
sinn3r
Tod Beardsley
m-1-k-3
David Maloney
HD Moore
Joe Vennix
Meatballs
James Lee