infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
48,575 Commits
7 Branches
556 Tags
421 MiB
Commit Graph

2313 Commits (7f9b9be78b7de1be3cc941c36ee213681d16d54d)

Author SHA1 Message Date
Christian Mehlmauer c6012e7947
add jsp payload generator 2016-09-06 22:17:21 +02:00
Pearce Barry 9d5a276e91
Fix recent metasploit-framework.gemspec conflict. 2016-09-06 13:10:28 -05:00
wchen-r7 23a5d737fc Add password "vagrant" to wordlists 
The password "vagrant" is often used in Metasploitable3.
 2016-09-06 12:36:02 -05:00
Brendan 83160b7e49
Land #7173, Add post module to compress (zip) a file or directory 2016-08-24 09:38:04 -05:00
wchen-r7 e154aafaaa On Error Resume Next for zip.vbs 2016-08-17 17:08:38 -05:00
David Maloney 8bece28d00
remove *scan bins as well 
all *scan bins need to be removed as the rex-bin_tools
gem will now handle these and put them in PATH

MS-1691
 2016-08-15 14:04:00 -05:00
wchen-r7 8f7d0eae0c Fix #7155 - Add post module to compress (zip) a file or directory 
Fix #7155
 2016-08-02 14:44:58 -05:00
William Webb 21e6211e8d add exploit for cve-2016-0189 2016-08-01 13:26:35 -05:00
Brent Cook d1f65b27b8
Land #7151, Improve CVE-2016-0099 reliability 2016-07-29 09:22:11 -05:00
Brendan ee40c9d809
Land #6625, Send base64ed shellcode and decode with certutil (Actually MSXML) 2016-07-28 13:01:05 -07:00
wchen-r7 322fc11225 Fix whitespace 2016-07-27 12:37:14 -05:00
wchen-r7 dbe31766af Update CVE-2016-0099 Powershell 2016-07-27 12:35:43 -05:00
Brent Cook b08d1ad8d8
Revert "Land #6812, remove broken OSVDB references" 
This reverts commit 2b016e0216, reversing
changes made to 7b1d9596c7.
 2016-07-15 12:00:31 -05:00
wchen-r7 8f928c6ca1
Land #7006, Add MS16-032 Local Priv Esc Exploit 2016-07-12 15:22:35 -05:00
wchen-r7 621f3fa5a9 Change naming style 2016-07-12 15:18:18 -05:00
Brent Cook 2b016e0216
Land #6812, remove broken OSVDB references 2016-07-11 22:59:11 -05:00
William Webb b4b3a84fa5 refactor ms16-016 code 2016-07-05 20:50:43 -05:00
khr0x40sh df1a9bee13 Move ps1, Use Env var, Fix license, New Cleanup 
MS16-032 ps1 moved to external file.  This ps1 will now detect windir
to find cmd.exe.  The module now also detects windir to find
powershell.exe.  The license is now BSD_LICENSE, and the required
copyright has been moved to the ps1. The previous optional cleanup stage
 is now standard.  The optional 'W_PATH' assignment is corrected to
select the user's variable unless 'W_PATH' is nil.
 2016-06-22 09:25:48 -04:00
Brent Cook ba72d3fd92
Land #6988, Update banners to metasploit.com, not .pro 2016-06-17 15:29:30 -05:00
h00die cd207df6b8 adding karaf to unix lists per 4358 2016-06-15 20:31:48 -04:00
Tod Beardsley fe4cfd7e3e
Update banners to metasploit.com, not .pro 2016-06-14 15:11:04 -05:00
wwebb-r7 ab27c1b701 Merge pull request #6940 from samvartaka/master 
Exploit for previously unknown stack buffer overflow in Poison Ivy versions 2.1.x (possibly present in older versions too)
 2016-06-08 11:25:51 -05:00
samvartaka 5260031991 Modifications based on suggestions by @wchen-r7 2016-06-08 01:17:15 +02:00
William Vu 9128ba3e57 Add popen() vuln to ImageMagick exploit 
So... we've actually been sitting on this vuln for a while now. Now that
the cat's out of the bag [1], I'm updating the module. :)

Thanks to @hdm for his sharp eye. ;x

[1] http://permalink.gmane.org/gmane.comp.security.oss.general/19669
 2016-06-02 11:35:37 -05:00
Brent Cook 7b024d1a72
Land #6914, add siem to the namelist 2016-05-24 14:22:44 -05:00
x90" * 365 9d545b0a05 Update namelist.txt 2016-05-24 13:00:59 -04:00
William Vu 2bac46097f Remove url() for MVG 
Technically unnecessary here.
 2016-05-05 14:18:42 -05:00
William Vu 334c432901 Force https://localhost for SVG and MVG 
https: is all that's needed to trigger the bug, but we don't want wget
and curl to gripe. localhost should be a safe host to request.
 2016-05-05 14:18:42 -05:00
William Vu decd770a0b Encode the entire SVG string 
Because why not? Not like people care about what's around the command.
 2016-05-05 14:18:42 -05:00
William Vu 232cc114de Change placeholder text to something useful 
A la Shellshock. :)
 2016-05-05 14:18:42 -05:00
William Vu 5c04db7a09 Add ImageMagick exploit 2016-05-05 14:18:42 -05:00
wchen-r7 71c8ad555e Resolve #6839, Make Knowledge Base as default 
Resolve #6839
 2016-05-02 14:12:09 -05:00
wchen-r7 d80d2bb8d3 Land #6825, Fixed borders on code boxes 2016-04-27 11:59:52 -07:00
wchen-r7 816bc91e45 Resolve #6807, remove all OSVDB references. 
OSVDB is no longer a vulnerability database, therefore all the
references linked to it are invalid.

Resolve #6807
 2016-04-23 12:32:34 -05:00
Brent Cook 57ab974737 File.exists? must die 2016-04-21 00:47:07 -04:00
wchen-r7 22831695dd
Land #6721, Add additional SOLMAN default creds 2016-03-30 10:48:53 -05:00
Meatballs 4f84c5a3b7
Add additional SOLMAN default creds 2016-03-29 15:53:15 +01:00
f7b053223a9e 629bc00696 Use MSXML decoder instead 2016-03-25 22:52:16 +09:00
wchen-r7 57984706b8 Resolve merge conflict with Gemfile 2016-03-24 18:13:31 -05:00
wchen-r7 76c6f8c19d Move module_doc_template 2016-03-24 17:07:19 -05:00
l0gan e29fc5987f Add missing stream.raw for hp_sitescope_dns_tool 
This adds the missing stream.raw.
 2016-03-15 11:06:06 -05:00
wchen-r7 d6742c4097 Change <hr> color 2016-03-10 10:44:18 -06:00
wchen-r7 ad0a948ae7 Update module_doc_template 2016-03-08 12:21:20 -06:00
wchen-r7 58b8c35146 Escape HTML for KB and update rspec 2016-03-08 10:10:10 -06:00
wchen-r7 027315eeaa Update post_demo_template 2016-03-05 20:33:40 -06:00
wchen-r7 03eb568af7 Add --- to make sections to stand out more 2016-03-05 15:17:19 -06:00
wchen-r7 f4866fd5f0 Update template and web_delivery doc 2016-03-03 01:27:14 -06:00
wchen-r7 cececa749d Update css 2016-03-03 00:58:17 -06:00
wchen-r7 11964c5c1a Add remote exploit demo and web_delivery doc 2016-03-02 19:52:11 -06:00
f7b053223a9e 19bd7b98f4 Fix minor indenting issue 2016-03-01 11:50:56 +09:00
f7b053223a9e c8c5549b19 Send base64ed shellcode and decode with certutil 2016-03-01 10:48:25 +09:00
wchen-r7 fd8e3e719d real demo 2016-02-26 14:43:53 -06:00
wchen-r7 ed0dfa5725 basic usage 2016-02-26 14:35:07 -06:00
wchen-r7 250ce6fb17 lets be clear 2016-02-26 14:30:12 -06:00
wchen-r7 1c53e53d23 More info about how to write the doc 2016-02-26 14:24:24 -06:00
wchen-r7 e40f1e69db Update default template 2016-02-26 14:18:24 -06:00
wchen-r7 6060c7b09b We make this pretty 2016-02-26 14:15:54 -06:00
wchen-r7 95a9f42996 Add a template for future module documentation 2016-02-24 19:28:17 -06:00
wchen-r7 24530e2734 Scrollable list, tab name change, print_status 2016-02-19 20:46:39 -06:00
wchen-r7 34d10d7829 Should be fullname 2016-02-19 00:13:55 -06:00
wchen-r7 7444a0ff04 Make it more obvious which tab the user is viewing 2016-02-18 17:59:45 -06:00
wchen-r7 4fc7008561 Close div properly 2016-02-18 16:12:27 -06:00
wchen-r7 56c2ba9f75 Turn the HTML template into external 2016-02-18 15:41:14 -06:00
wchen-r7 e5ad6fa781 Support "knowledge base" 2016-02-18 15:02:24 -06:00
wchen-r7 f8d6a59cdc Change wording 2016-02-18 12:19:25 -06:00
wchen-r7 089d6985b6 Add more demo templates 2016-02-18 00:17:32 -06:00
wchen-r7 1bfe1ad140 More demos 2016-02-17 19:04:06 -06:00
wchen-r7 76f2c917ee Allow no GITHUB_OAUTH_TOKEN, and gsub for demo 2016-02-17 15:38:30 -06:00
wchen-r7 714106174e Do external erb template 2016-02-17 14:27:29 -06:00
wchen-r7 b0cfb4aacf Add info -d to show module documentation in .md 2016-02-16 22:44:03 -06:00
Jay Turla aeb1d80e0d Adding top 100 adobe passwords 2016-02-11 08:55:45 +08:00
Bigendian Smalls b3e8bd1dab
Updated zsploit screens to use std msf colors 
Using Rex::Ui::Text::Colors now instead of ansi codes
Thanks to @mainframed for the quick turnaround
 2016-02-09 12:01:25 -06:00
Bigendian Smalls 90e37ea749
Added three cool new mainframe themed screens 
Thanks to *Solider of Fortran* @mainframed for his amazing original artwork!
These set of 3 limited edition, original, one-of-a-kind screens will modernize
your msf installation to the 1960s and beyond.  No seriously they are super cool
and now that metasploit-framework supports System Z - it seemed only fitting.
 2016-01-20 06:10:51 -06:00
Brent Cook 7f9b804060
Land #6410, remove JtR binaries, update for independent framework releases 2016-01-06 14:16:49 -06:00
Chris Doughty 97ae09729c Add john.conf to data dir as referenced by: lib/metasploit/framework/jtr/cracker.rb 2016-01-06 13:00:05 -06:00
Chris Doughty ae57bce262 Adding wordlists back to path 2016-01-06 12:54:25 -06:00
JT bf764deefb Add SCADA Default UserPass List 
This list was based on SCADAPASS: https://github.com/scadastrangelove/SCADAPASS
 2016-01-06 12:25:29 +08:00
William Vu be340774ea
Land #6432, Piata SSH scanner wordlist 2016-01-05 10:15:17 -06:00
JT 66e2d945d8 Add more SAP ICM paths 2016-01-05 13:05:46 +08:00
JT 913e8ec525 Update piata_ssh_userpass.txt 2016-01-05 11:28:54 +08:00
JT 713828d0b6 Add piata wordlist 
Add user and pass wordlist from Piata Mass SSH scanner
 2016-01-05 11:27:04 +08:00
Chris Doughty 8090bbc750 Changes to support framework as a gem 2015-12-30 11:00:45 -06:00
wchen-r7 5f5b3ec6a1 Add MS15-134 Microsoft Windows Media Center MCL Information Disclosure 
CVE-2015-6127
 2015-12-17 22:41:58 -06:00
dmohanty-r7 eb4611642d Add Jenkins CLI Java serialization exploit module 
CVE-2015-8103
 2015-12-11 14:57:10 -06:00
Brent Cook c301c7c7b0 use wav with sounds plugin for windows / linux compat 2015-12-08 16:20:44 -06:00
wchen-r7 d44224142e Update audio files 2015-11-25 23:41:18 -06:00
wchen-r7 776455d10a Add another sound and event 
Add sound: "We've got a shell"
Add event on_session_fail
 2015-11-25 22:46:51 -06:00
wchen-r7 af8c557fa9 Add the MP3s 2015-11-25 18:09:27 -06:00
wchen-r7 fa32f43ee4 Muts says "Try harder!" or "Excellent" for the sounds plugin 
With the sounds plugin, muts will say "excellent!" when a session
is received. If a session is terminated (either exited or lost),
muts will say "try harder!"
 2015-11-25 18:06:58 -06:00
scriptjunkie 8703987535 Add HTTPS and new transport support for hop 2015-11-11 21:25:23 -06:00
Louis Sato 9c347fbaae
Land #6195, remove ff buildid from os.js 2015-11-05 15:01:15 -06:00
William Vu 2f65405a4e Fix missing brace and indent level 2015-11-05 14:30:26 -06:00
James Lee 1f73bbe7ca
Remove obsolete files in data/gui/ 2015-11-02 10:44:47 -06:00
scriptjunkie d90f87449a Fix merge 2015-09-22 16:55:01 -05:00
scriptjunkie 7d2a2a8b64 Fix issues with using hop for new core 2015-09-22 16:54:02 -05:00
Mo Sadek 48b06a2cd9 Fixed no detection error 2015-09-18 10:48:24 -05:00
Mo Sadek 858d3f5a55 Closes #3936, Remove Firefox buildid from os.js 2015-09-16 16:04:22 -05:00
wchen-r7 c7afe4f663
Land #5930, MS15-078 (atmfd.dll buffer overflow) 2015-09-16 15:33:38 -05:00
jvazquez-r7 9626596f85
Clean template code 2015-09-12 13:43:05 -05:00
jvazquez-r7 53f995b9c3
Do first prototype 2015-09-10 19:35:26 -05:00
jvazquez-r7 30cb93b4df
Land #5940, @hmoore-r7's fixes for busybox post modules 2015-09-08 15:12:23 -05:00
wchen-r7 122d57fc20
Land #5945, Add auto-accept to osx/enum_keychain 2015-09-08 10:56:08 -05:00
joev 1b320bae6a Add auto-accept to osx/enum_keychain. 2015-09-07 21:17:49 -05:00
HD Moore 091c4d5214 Expand and reorder 2015-09-05 22:51:32 -05:00
HD Moore 76d74576db Remove FTP-only default credentials 2015-09-05 22:39:51 -05:00
HD Moore 21b69b9430 Remove HP MPE/iX password defaults 2015-09-05 22:38:30 -05:00
jvazquez-r7 eaf51a2113
Land #5722, @vallejocc's busybox work 2015-09-04 13:36:44 -05:00
jvazquez-r7 b39575928e
Update reflective exploit 2015-09-03 11:01:41 -05:00
jvazquez-r7 b912e3ce65
Add exploit template 2015-09-02 17:28:35 -05:00
HD Moore 4090c2c8ea
Land #5880, adds ScriptHost UAC bypass for Win7/2008 2015-09-02 14:14:18 -05:00
James Lee 1b778d0650
Land #5898, use gem version of php & python meterp 2015-08-31 16:16:36 -05:00
Brent Cook 30830ad9e5
Land #5262, fix webcam_chat and tidy adjacent code 2015-08-31 14:21:24 -05:00
Brent Cook a51d3df753 typo 2015-08-31 14:18:55 -05:00
wchen-r7 9364982467
Land #5665, Add osx rootpipe entitlements exploit for 10.10.3 2015-08-28 13:33:16 -05:00
wchen-r7 11db9c2112
Land #5896, Update ms15_004_tswbproxy to use a Reflective DLL 2015-08-27 17:11:26 -05:00
Brent Cook 593f501571 finish move of php / python meterpreters to metasploit-payloads 2015-08-27 11:34:22 -05:00
HD Moore a2d5511e39
Land #5379, new post modules to load into powershell sessions 2015-08-26 17:11:40 -05:00
jvazquez-r7 5d0ed797a3
Update DLL 2015-08-26 15:15:32 -05:00
Meatballs 228087dced
Initial working scripthost bypass uac 2015-08-23 20:16:15 +01:00
Meatballs 129edd8b2e
Original bypass script 2015-08-23 19:46:24 +01:00
William Vu d54249370b Move tpwn source to external/source/exploits 2015-08-17 18:27:47 -05:00
William Vu efc980074c Add tpwn exploit files 2015-08-17 17:11:07 -05:00
Brent Cook 5dd015150c
Land #5748, refactor google geolocate, add wlan_geolocate and send_sms to android meterpreter 2015-08-16 10:58:17 -05:00
Brent Cook 1db376bed8 check if a process still exists before deleting it 2015-08-15 19:46:04 -05:00
jvicente 5ff61ca5f3 Added modules to jailbreak and control remotely BusyBox based devices. It was added to a word list with default credentials typically used by commercial routers. 2015-08-10 18:29:41 +02:00
OJ 121fe1adda
Land #5654 : Python Meterpreter Transport 2015-07-22 10:39:06 +10:00
wchen-r7 7113c801b1
Land #5732, reliability update for adobe_flash_hacking_team_uaf 2015-07-17 16:43:39 -05:00
wchen-r7 837eb9ea38
Land #5742, better quality coverage for adobe_flash_opaque_background_uaf 2015-07-17 16:25:14 -05:00
jvazquez-r7 255d8ed096
Improve adobe_flash_opaque_background_uaf 2015-07-16 14:56:32 -05:00
Spencer McIntyre 010e48919e Pymet immediately change transports on tcp failure 2015-07-16 11:00:43 -04:00
Spencer McIntyre 0cb5000e48 Pymet use incremental backoff for http recv pkt 2015-07-16 10:29:36 -04:00
OJ 986463e489 Fix killav post module, handle errors, better output 2015-07-16 11:35:01 +10:00
Marc-Andre Meloche 8bead8fd87 av_list.txt 
it's the av_list.txt, i sure hope this works.
 2015-07-15 20:26:42 -04:00
Spencer McIntyre 831cb904a9 Pymet fix the new transport position 2015-07-15 19:45:34 -04:00
jvazquez-r7 a637921305
Update swf 2015-07-15 18:35:41 -05:00
jvazquez-r7 b504f0be8e
Update adobe_flash_hacking_team_uaf 2015-07-15 18:18:04 -05:00
Spencer McIntyre 18cb55f1fa Pymet fix transport automatic roll over 2015-07-14 15:18:11 -04:00
Spencer McIntyre 00da619556 Pymet fix previous transport index logic 2015-07-14 14:32:57 -04:00
Spencer McIntyre 9f48853e00 Pymet fix the order in which transports are added 2015-07-14 14:26:27 -04:00
wchen-r7 d6565a9aee Merge branch 'bes_flash' into bapv2_flash_test 2015-07-14 00:34:54 -05:00
jvazquez-r7 b72ba7f51c
Add AS2 flash detection code 2015-07-13 18:26:02 -05:00
jvazquez-r7 8fb6bedd94
Delete as3 detecotr 2015-07-13 18:23:39 -05:00
jvazquez-r7 9116460cb0
Add prototype with AS3 2015-07-13 16:33:55 -05:00
jvazquez-r7 299978d0e2
Put again old exploiter 2015-07-11 00:36:32 -05:00
jvazquez-r7 63005a3b92
Add module for flash CVE-2015-5122 
* Just a fast port for the exploit leaked
* Just tested on win7sp1 / IE11
 2015-07-11 00:28:55 -05:00
Tod Beardsley 3d630de353
Replace with a real CVE number 2015-07-07 14:44:12 -05:00
wchen-r7 2cdaace42f
Land #5678, Land adobe_flash_hacking_team_uaf.r 2015-07-07 12:34:59 -05:00
jvazquez-r7 d9aacf2d41
Add module for hacking team flash exploit 2015-07-07 11:19:48 -05:00
Mo Sadek 9e2e64bba1
Land #5644, Windows 10 Detection for os.js 2015-07-06 16:19:06 -05:00
Spencer McIntyre 2a89e248d7 Pymet fix send uuid logic for Python 3.x 2015-07-06 11:20:34 -04:00
joev c993c70006 Remove sleep(), clean up WritableDir usage. 2015-07-05 18:59:00 -05:00
joev a8b56bb44a Oops, need to include the binary files. 2015-07-05 18:24:45 -05:00
Spencer McIntyre 841fbddfc6 Pymet fix packet polling interval 2015-07-02 11:51:53 -04:00
Spencer McIntyre 0af397217c Merge pymet transport feature into fresh branch 2015-07-02 08:43:13 -04:00
Spencer McIntyre 6ab7c314de Pymet fix reverse_tcp transport for IPv6 addresses 2015-07-02 08:33:11 -04:00
Spencer McIntyre dbe239bc75 Pymet fix transport next and prev for one transport 2015-07-02 08:23:02 -04:00
wchen-r7 482247771d Add a fingerprint for Windows 10 + IE11 2015-07-01 18:06:25 -05:00
wchen-r7 cd688437ac Add support for Windows 10 for os.js 
Resolves #4248
 2015-07-01 15:02:22 -05:00
Spencer McIntyre b1b21c4bef Pymet fixes for Python 3.x 2015-07-01 14:32:12 -04:00
jvazquez-r7 1de94a6865
Add module for CVE-2015-3113 2015-07-01 13:13:57 -05:00
Spencer McIntyre 2a891c50eb Pymet transport stabilty and correction 2015-07-01 11:12:30 -04:00
Spencer McIntyre 4b5b7c8a27 Pymet support for core_transport_remove 2015-06-30 15:46:33 -04:00
Spencer McIntyre 6a45e19636 Pymet fix bind and tcp socket cleanup logic 2015-06-30 15:25:23 -04:00
Spencer McIntyre 3d49781230 Pymet support for core_transport_sleep 2015-06-29 18:34:35 -04:00
Spencer McIntyre 9a8ffacfd1 Pymet transport changing improvements 2015-06-29 14:00:07 -04:00
Spencer McIntyre 00742ea924 Pymet cleaner transport switching with responses 2015-06-28 13:16:00 -04:00
Spencer McIntyre f6fa462bdc Pymet support for changing transports 2015-06-27 20:57:45 -04:00
Spencer McIntyre 175d9cdcb1 Pymet support for creating and listing transports 2015-06-26 16:52:55 -04:00
Spencer McIntyre 79185e91c6 Refactor the pymet to use transport objects 2015-06-26 14:56:31 -04:00
Spencer McIntyre 7aae9b210e Add pymet support for core_enumextcmd 2015-06-26 11:32:51 -04:00
jvazquez-r7 ee0377ca16
Add module for CVE-2015-3105 2015-06-25 13:35:01 -05:00
OJ ae41f2bfa0 Update exploit binaries for ms15-051 2015-06-25 09:33:15 +10:00
Brent Cook e75287875b hack android-specific commands back to life 2015-06-22 20:41:58 -05:00
OJ 3686accadd
Merge branch 'upstream/master' into cve-2015-1701 2015-06-22 07:52:17 +10:00
jvazquez-r7 04901baab8
Land #5572 @todb-r7's adds snowden's password to unix_passwords.txt 2015-06-19 17:01:22 -05:00
Tod Beardsley b580f93c22
New password from Snowden 2015-06-19 15:37:48 -05:00
jvazquez-r7 d116f1efd5
Land #5566, @wchen-r7 fixes #5565 modifying os.js 2015-06-19 11:07:00 -05:00
wchen-r7 308cad8c40 Fix #5565, Fix os.js service pack detection 
Fix #5565
 2015-06-18 18:51:16 -05:00
jvazquez-r7 de1542e589
Add module for CVE-2015-3090 2015-06-18 12:36:14 -05:00
wchen-r7 17b8ddc68a
Land #5524, adobe_flash_pixel_bender_bof in flash renderer 2015-06-15 02:42:16 -05:00
jvazquez-r7 72672fc8f7
Delete debug 2015-06-11 17:39:36 -05:00
jvazquez-r7 8ed13b1d1b
Add linux support for CVE-2014-0515 2015-06-11 16:18:50 -05:00
wchen-r7 ae21b0c260
Land #5523, adobe_flash_domain_memory_uaf in the flash renderer 2015-06-10 16:59:19 -05:00
wchen-r7 4c5b1fbcef
Land #5522, adobe_flash_worker_byte_array_uaf in the flash renderer 2015-06-10 14:49:41 -05:00
jvazquez-r7 7527aa4f34
Disable debug 2015-06-10 14:07:18 -05:00
jvazquez-r7 6c7ee10520 Update to use the new flash Exploiter 2015-06-10 13:52:43 -05:00
jvazquez-r7 7fba64ed14
Allow more search space 2015-06-10 12:26:53 -05:00
jvazquez-r7 ecbddc6ef8
Play with memory al little bit better 2015-06-10 11:54:57 -05:00
wchen-r7 d622c782ef
Land #5519, adobe_flash_uncompress_zlib_uninitialized in the flash renderer 2015-06-10 11:52:47 -05:00
jvazquez-r7 2b4fe96cfd Tweak Heap Spray 2015-06-10 10:56:24 -05:00
jvazquez-r7 a6fe383852
Use AS Exploiter 2015-06-10 09:32:52 -05:00
jvazquez-r7 e5d6c9a3cb Make last code cleanup 2015-06-09 16:01:57 -05:00
jvazquez-r7 cf8c6b510b
Debug version working 2015-06-09 15:46:21 -05:00
jvazquez-r7 39851d277d
Unset debug flag 2015-06-09 11:36:09 -05:00
jvazquez-r7 b7f0fad72f
Modify CVE-2014-0569 to use the flash exploitation code 2015-06-09 11:31:39 -05:00
Tod Beardsley f29b38b602
Add the top 20 keyboard patterns as passwords 
See https://wpengine.com/unmasked/ for lots more, but this
covers the gif at

https://wpengine.com/unmasked/assets/images/commonkeyboardpatterns.gif
 2015-06-05 16:46:08 -05:00
OJ b291d41b76 Quick hack to remove hard-coded offsets 2015-06-05 13:19:41 +10:00
jvazquez-r7 02181addc5
Update CVE-2014-0556 2015-06-04 18:23:50 -05:00
wchen-r7 23df66bf3a
Land #5481, no powershell. exec shellcode from the renderer process. 2015-06-04 15:45:09 -05:00
jvazquez-r7 ab68d8429b Add more targets 2015-06-04 12:11:53 -05:00
jvazquez-r7 80cb70cacf
Add support for Windows 8.1/Firefox 2015-06-03 22:46:04 -05:00
jvazquez-r7 74117a7a52
Allow to execute payload from the flash renderer 2015-06-03 16:33:41 -05:00
OJ 455a3b6b9d
Add butchered version of CVE-2015-1701 2015-06-03 21:48:23 +10:00
Brent Cook 64e86165ef remove android meterpreter bins, update to payloads 1.0.2 
This switches us to using the Android payload files from the
metasploit-payloads gem
 2015-06-01 09:14:31 -05:00
Brent Cook 7d5af66fa0 Merge branch 'master' into land-5367-uuid-stagers 2015-05-29 13:00:35 -05:00
wchen-r7 737559bcbb
Land #5180, VBA Powershell for Office Macro 2015-05-28 19:55:27 -05:00
jvazquez-r7 e9714bfc82
Solve conflics 2015-05-27 23:22:00 -05:00
wchen-r7 e749733eb6
Land #5419, Fix Base64 decoding on ActionScript 2015-05-27 23:13:51 -05:00
jvazquez-r7 e5d42850c1
Add support for Linux to CVE-2015-0336 2015-05-27 17:05:10 -05:00
jvazquez-r7 801deeaddf Fix CVE-2015-0336 2015-05-27 15:42:06 -05:00
jvazquez-r7 bd1bdf22b5
Fix CVE-2015-0359 2015-05-26 17:27:20 -05:00
jvazquez-r7 19c7445d9d
Fix CVE-2015-0336 2015-05-26 17:20:49 -05:00
jvazquez-r7 23d244b1fa
Fix CVE-2015-0313 2015-05-26 16:11:44 -05:00
jvazquez-r7 5c8c5aef37
Fix CVE-2014-8440 2015-05-26 16:05:08 -05:00
jvazquez-r7 d78d04e070
Fix CVE-2014-0569 2015-05-26 15:49:22 -05:00
jvazquez-r7 e0a1fa4ef6
Fix indentation 2015-05-26 15:38:56 -05:00
jvazquez-r7 1742876757
Fix CVE-2014-0556 2015-05-26 15:30:39 -05:00
jvazquez-r7 3e122fe87c
Fix b64 decoding 2015-05-26 15:15:33 -05:00
jvazquez-r7 29ccc8367b
Add More messages 2015-05-26 14:47:47 -05:00
jvazquez-r7 1bf1c37cfa
Add exception handling 2015-05-26 14:31:07 -05:00
jvazquez-r7 fb8a927941
Hardcode params 2015-05-26 14:20:43 -05:00
jvazquez-r7 f119da94ca
Add one more message 2015-05-26 14:14:38 -05:00
jvazquez-r7 15533fabe6
Log messages 2015-05-26 14:08:24 -05:00
jvazquez-r7 91357ee45b
Improve reliability 2015-05-26 13:47:33 -05:00
OJ 9e50114082
Merge branch 'upstream/master' into uuid-stagers 2015-05-25 11:22:35 +10:00
OJ 1c73c190fc Add machine_id support to windows php meterp 2015-05-22 14:55:29 +10:00
jvazquez-r7 f35d7a85d3
Adjust numbers 2015-05-21 15:56:11 -05:00
jvazquez-r7 80d4f3cfb0
Update swf 2015-05-21 14:55:00 -05:00
jvazquez-r7 8d6cbf0568
Make adobe_flash_uncompress_zlib_af multiplatform 2015-05-20 18:57:37 -05:00
benpturner c0b995cc97 new changes 2015-05-19 16:18:06 +01:00
benpturner b513304756 new changes 2015-05-19 15:47:30 +01:00
benpturner 0cda746bfb Updated size 2015-05-19 14:08:59 +01:00
benpturner 811c45ab90 new 2015-05-19 14:06:41 +01:00
OJ 24526c2ef9 Removed unused data files 2015-05-18 21:46:05 +10:00
OJ 9296a024e2 PHP meterpreter refactoring in prep for uuid work 2015-05-18 17:40:48 +10:00
OJ 0d56b3ee66 Stage UUIDs, generation options, php and python meterp uuid 2015-05-18 13:29:46 +10:00
Brent Cook 5cf6d28c34
Land #5426, use RAW for TLV hash binary data 2015-05-15 11:54:45 -05:00
wchen-r7 25099dd877
Land #5212, HTA Powershell template 2015-05-15 11:49:07 -05:00
wchen-r7 3bc3614be6 Do a check for powershell.exe before running it. 2015-05-15 11:48:21 -05:00
Brent Cook c614f6059d Merge branch 'master' into land-5326- 2015-05-15 11:29:54 -05:00
benpturner d4798a2500 Fix spacinG 2015-05-11 09:04:03 +01:00
benpturner c916021fc5 SSL Support for Powershell Payloads 2015-05-10 21:45:59 +01:00
Tim d3ba84b378
Add TLV_TYPE_FILE_HASH 2015-05-10 14:18:16 +01:00
jvazquez-r7 c103779eab
Land #5080, @bcook-r7's 'ls' and 'download' meterpreter improvements 2015-05-08 18:02:16 -05:00
William Vu 71518ef613
Land #5303, metasploit-payloads Java binaries 2015-05-07 22:39:54 -05:00
jvazquez-r7 51bb4b5a9b
Add module for CVE-2015-0359 2015-05-07 17:00:00 -05:00
jvazquez-r7 582919acac
Add module for CVE-2015-0336 2015-05-05 17:25:19 -05:00
Brent Cook f0c989c1b5 remove java payloads and jars 2015-05-05 15:01:00 -05:00
Brent Cook 05e4af8162
Land #5214, initial meterpreter session recovery support 2015-05-04 16:25:27 -05:00
Brent Cook cda7dc3494 remove old posix meterpreter bins 2015-05-04 09:44:37 -05:00