5e8a47ac00
Merge upstream/master into universal handler work
2016-11-28 15:26:43 +10:00
60210f57e9
Land #7505 , fixed some targets for cisco_asa_extrabacon
2016-11-27 22:19:45 -06:00
e8158bd200
Add multi platform type, wire into the multi stage
2016-11-28 09:34:09 +10:00
8824cc990a
Use Auxilliary Actions for different behaviors.
2016-11-26 13:04:04 -06:00
0935d31de1
Changed print_status to print_good
...
Changed line 315 print type to good instead of the general status indication, so that the result output is easier to see.
2016-11-25 16:54:58 -06:00
c286c708d9
Print file contents
...
Added a print_good statement at line 63 in order to print to contents of the newly discovered robots.txt file.
2016-11-25 15:57:37 -06:00
6f70323460
Minor misspelling mistakes and corrected the check of the mysqld process
2016-11-25 19:03:23 +00:00
1119dc4abe
Targets set to automatic
...
removed targets and set only automatic
the targets weren't used so there's no funcionallity loss
2016-11-25 17:35:28 +00:00
efa191dd10
fixed some spacing
2016-11-25 11:50:56 -05:00
e0ba903cd2
Merge remote-tracking branch 'upstream/master'
2016-11-25 16:13:57 +00:00
b4add59a3d
Moved metadata_creds() so Client can be included in Aux/Post modules
2016-11-24 21:03:38 -08:00
5fdd5a7326
More progress on http universal staged handler
2016-11-25 13:00:35 +10:00
00d9e69a98
potential double fix for #7582
2016-11-24 12:14:09 -05:00
ec020e3d07
Land #7611 , cisco_ironport_enum falsely claimed connection failed
...
Fixes #7610
2016-11-24 09:54:09 -06:00
fd11e7c4df
modified it as recommended (@brandonprry) and added Module Documentation
2016-11-24 10:36:32 +01:00
dc64f63517
Removed useless comments
2016-11-24 01:33:20 +00:00
5284e20a52
Optimised SQL vars, removed unneeded requires and changed the "exec" function name
2016-11-24 01:27:03 +00:00
65b858ac06
Fix issue 7610, cisco_ironport_enum falsely claimed connection failed.
...
Make sure we return 1 in check_conn method.
2016-11-23 14:59:07 -06:00
b7ae7a47be
Fix issue #7608 where the SSL option was not turned on by default
...
Set the SSL option to be on by default.
2016-11-23 14:45:42 -06:00
c48587066d
Added reference and minor fixes
2016-11-23 10:58:37 -08:00
0df3e17e0c
Fix the issue in MS2132 where OWA_LOGIN doesn't continue on connection error.
...
The possibility of temporary connnection disruption means this module should keep trying other user/pass pairs upon error.
2016-11-23 09:56:27 -06:00
43e1b5bdd1
Adds module to create an AWS IAM user from a pwned AWS host
2016-11-22 14:55:03 -08:00
c606eabbb9
Merge 'upstream/master' into universal-handlers
2016-11-22 14:06:46 +10:00
ce514ed3e5
Fixed broken fail_with function call and whitespace on line ending
2016-11-22 03:04:12 +00:00
e0f8d622ec
Added metasploit module for access OSX messages database
2016-11-22 02:53:38 +00:00
59f3c9e769
Land #7579 , rename netfilter_priv_esc to rename netfilter_priv_esc_ipv4
2016-11-21 17:59:29 -06:00
83a3a4e348
Fix #7463 , check nil return value when using redis_command
...
Fix #7463
2016-11-21 15:52:12 -06:00
6f8660f345
Land #7586 , NameError fix for brute_dirs
2016-11-21 14:46:19 -06:00
7b5c819430
Land #7588 , disclosure date fix for OpenNMS sploit
2016-11-21 14:01:18 -06:00
c8320d661f
Land #7590 , mixin order fix for buffalo_login
2016-11-21 13:57:27 -06:00
90d360a592
Fix the issue 7589, both RHOST and RHOSTS options are quired
...
Thanks to Will who found it's due to the order of mixin.
2016-11-21 11:06:32 -06:00
8869ebfe9b
Fix incorrect disclosure date for OpenNMS exploit
...
Disclosure date was Nov 2015, not Nov 2014
2016-11-21 16:44:36 +00:00
18b873be47
Fix the exception issue reported in issue #7585
...
Fix the exception by initialize a key variable that caused the exception.
2016-11-21 10:00:23 -06:00
6c6221445c
Land #7543 , Create exploit for CVE-2016-6563 / Dlink DIR HNAP Login
2016-11-21 09:59:50 -06:00
6ae8a2dd2e
Remove unused/empty function body
2016-11-21 17:59:49 +10:00
8c036885bc
Fix msftidy issues
2016-11-21 17:23:03 +10:00
e226047457
Merge 'upstream/master' into the bypassuac via eventvwr mod
2016-11-21 17:18:40 +10:00
0504cae21f
Land #7536 , fix get_ipv4_addr(@interface) usage
2016-11-21 01:09:05 -06:00
0a3acf57d1
update payload sizes
2016-11-20 19:47:17 -06:00
005d34991b
update architecture
2016-11-20 19:09:33 -06:00
f313389be4
Merge remote-tracking branch 'upstream/master' into land-7507-uuid-arch
2016-11-20 19:08:56 -06:00
acfd214195
Mysql privilege escalation
...
Documentation, compiled binary and final implementation.
Completed the documentation, added the missing compiled binary and a
final and tested implementation of the module.
2016-11-19 11:24:29 +00:00
6a35b366bc
Land #7577 , URPORT fix
2016-11-18 14:41:10 -06:00
cfd31e32c6
renaming per @bwatters-r7 comment in #7491
2016-11-18 13:52:09 -05:00
00e4a8881f
Land #7574 , Update open_proxy aux module
2016-11-18 11:41:43 -06:00
d3adfff663
Change syntax
2016-11-18 11:41:04 -06:00
f894b9a4c5
Fix typo
2016-11-18 11:39:26 -06:00
920ecf6fc5
finishing metacoms work for pdf-shaper-bo
2016-11-18 11:36:02 -06:00
8d1c718873
Land #7572 , wireshark dos typos
...
Lands mcantoni's pr for fixing typos in the
wireshark dos modules
2016-11-18 11:01:32 -06:00
4596785217
Land #7450 , PowerShellEmpire Arbitrary File Upload
2016-11-17 17:47:15 -06:00
22d70ddd09
Fix #7455 , handle the URIPORT option properly in is_uxss_injection
...
Fix #7455
2016-11-17 15:50:35 -06:00
abddeb5cd2
Land 7473, add censys search module
2016-11-17 13:44:00 -06:00
f2b9498643
Land #7576 , Fix RHOSTS use in auxiliary/scanner/ftp/titanftp_xcrc_traversal
2016-11-17 13:06:29 -06:00
c03f35ef13
Fix the hanging of module auxiliary/scanner/ftp/titanftp_xcrc_traversal.rb
...
Thanks for Wei who pointed out the error: in store_loop call, it used "rhosts", should have been ip.
2016-11-17 10:08:59 -06:00
c9b9be9328
Update open_proxy aux module
2016-11-17 15:44:03 +01:00
b3b89a57b5
Add WordPress Symposium Plugin SQL Injection module
2016-11-17 15:04:53 +01:00
30f7006b5b
Fixed typos of an old commit
2016-11-17 14:39:33 +01:00
c0af5b690d
Land #6638 , add local exploit module to execute payload w/ stealth
2016-11-16 16:25:15 -06:00
e1ff37f3eb
Title change and handling Rex::TimeoutError exception
2016-11-16 16:23:44 -06:00
18bafaa2e7
Land #7531 , Fix drb_remote_codeexec and create targets
2016-11-16 12:58:22 -06:00
be2aabb873
Merge updates to mettle stages from acammack-r7
2016-11-16 19:13:20 +10:00
7b83720b90
Bring #6638 up to date
2016-11-15 12:27:05 -06:00
f50e609d12
Land #7556 , Prevent psexec_command from dying when one host errors
2016-11-15 12:17:01 -06:00
e5d3289c18
Fix name for exception
2016-11-15 12:14:58 -06:00
b56b6a49ac
Land #7328 , Extend lsa_transname_heap exploit to MIPS
2016-11-15 07:37:19 -06:00
fa9f2b340e
def setup isn't needed
2016-11-14 15:52:02 -06:00
bab07b5691
Bring #7540 up to date
2016-11-14 14:59:21 -06:00
c458d662ed
report correct credential status as successful
2016-11-14 12:27:22 -06:00
4ae90cbbef
Land #7191 , Add exploit for CVE-2016-6267 - Trend Micro Smart Protection Server authenticated RCE.
2016-11-14 12:06:02 -06:00
4e40546958
Land #7502 , Disk Pulse Enterprise Login Buffer Overflow
2016-11-14 10:28:53 -06:00
4f323527c9
Land #7549 , Deprecate/move wp_ninja_forms_unauthenticated_file_upload
2016-11-14 03:00:02 -06:00
908713ce68
remove whitespace at end of module name
2016-11-14 08:35:34 +00:00
4e9802786c
Removed spaces causing build to fail
2016-11-13 21:46:24 -06:00
a8a09261e1
Use files for rescue error, because left is not available
2016-11-11 21:49:06 -07:00
9eb9d612ca
Minor typo fixups.
2016-11-11 16:54:16 -06:00
1dae206fde
Land #7379 , Linux Kernel BPF Priv Esc (CVE-2016-4557)
2016-11-11 16:50:20 -06:00
8e3888f20c
the template ref in this module was missed
...
when we cleaned up all the other powershell template refs
we missed the one in this module which seems to e replicating
large ammounts of library code
7533
2016-11-11 14:24:33 -06:00
2b5517f597
Land #7506 , Add gather AWS keys post module
2016-11-11 13:56:12 -06:00
db32c5fdcc
msftidy whitespace fixes
2016-11-11 10:28:37 -07:00
fddc2c221f
Catch the specific exception. Include the error code in the error message.
2016-11-11 10:24:05 -07:00
69a4a327b8
Add begin-rescue blocks that prevent individual hosts from bailing out a threaded multi-host execution
2016-11-11 10:15:36 -07:00
8cd9a9b670
Deprecate wp_ninja_forms_unauthenticated_file_upload
...
wp_ninja_forms_unauthenticated_file_upload actually supports
multiple platforms.
Instead of using:
exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload
Please use:
exploit/multi/http/wp_ninja_forms_unauthenticated_file_upload
2016-11-10 11:17:09 -06:00
268a72f210
Land #7193 Office DLL hijack module
2016-11-08 23:15:27 -06:00
50f578ba79
Add full disclosure link
2016-11-08 22:15:19 +00:00
3c1f642c7b
Moved PPSX to data/exploits folder
2016-11-08 16:04:46 +01:00
95bd950133
Point to proper link on github
2016-11-07 17:59:29 +00:00
f268c28415
Create dlink_hnap_login_bof.rb
2016-11-07 17:45:37 +00:00
099a5984f9
Updated with style suggestions from msftidy and rubocop.
...
Also updated with commented from other contributors.
2016-11-07 10:18:52 -06:00
4eb42a9171
Fix broken ternary in phoenix_command
2016-11-07 00:12:04 -06:00
689fc28d1b
Added WinaXe 7.7 FTP client Server Ready buffer overflow
2016-11-06 23:35:16 -06:00
92964c1f95
Update phoenix_command.rb
2016-11-06 21:22:54 +01:00
2c2729f0b2
Update phoenix_command.rb
...
Coded was messed up by MS Edge, don't use it :)
2016-11-06 21:21:20 +01:00
1b4409f950
Update phoenix_command.rb
...
Style fix: replace "ractionport == nil ?" with "ractionport.nil?"
Is it OK? Did not find time to install and run rubocop ...
2016-11-06 21:15:31 +01:00
4ea9214466
Fixed a small bug
2016-11-06 16:20:55 +01:00
e9d85750c2
fix get_ipv4_addr(@interface) usage
...
get_ipv4_addr(@interface) returns a string not list, so get_ipv4_addr(@interface)[0] only got the first character of IP, which raises an error.
2016-11-06 19:04:57 +08:00
da356e7d62
Remove Compat hash to allow more payloads
2016-11-04 13:57:05 -05:00
f0c89ffb56
Refactor module and use FileDropper
2016-11-04 13:57:05 -05:00
6d7cf81429
Update references
2016-11-04 13:57:05 -05:00
009d6a45aa
Update description
2016-11-04 13:57:05 -05:00
bf7936adf5
Add instance_eval and syscall targets
2016-11-04 13:57:05 -05:00
4bf966f695
Add module to bypassuac using eventvwr
...
This module was inspired by the work done by Matt Nelson and Matt
Graeber who came up with the method in the first place. This works
nicely on a fully patched Windows 10 at the time of writing.
2016-11-05 04:41:38 +10:00
5b810fae41
Update atg_client to identify responses that indicate the command was not understood
2016-11-04 10:12:02 -07:00
ca5610ccde
Land #7511 , Update jenkins_script_console to support newer versions
2016-11-04 11:24:25 -05:00
e5ea4a53d3
Fix typo in windows cred phish module
2016-11-04 13:26:10 +10:00
b0970783ff
Another interim commit moving towards universal handlers
2016-11-04 13:25:02 +10:00
5ed030fcf6
Land #7529 , nil.downcase fix for tomcat_mgr_deploy
...
Don't think it was ever needed, since the password is case-sensitive.
Fixed a minor merge conflict where PASSWORD became HttpPassword.
2016-11-03 15:39:46 -05:00
2f8d3c3cf3
Remove the bug where downcase() is invoked on password which is optional and can be empty.
2016-11-03 15:23:19 -05:00
dae1f26313
Land #7521 , Modernize TLS protocol configuration for SMTP / SQL Server
2016-11-03 12:56:50 -05:00
eca4b73aab
Land #7499 , check method for pkexec exploit
2016-11-03 10:59:06 -05:00
1c746c0f93
Prefer CheckCode::Detected
2016-11-03 11:14:48 +01:00
2cdff0f414
Fix check method
2016-11-03 11:14:48 +01:00
5169341f62
Land #7522 , Fix psh template to avoid 100% cpu spike on CTRL+C
2016-11-02 16:40:34 -05:00
7895ba810d
Update payload cached size for the powershell payload
2016-11-03 02:50:13 +10:00
cc8c1adc00
Add first pass of multi x86 http/s payload (not working yet)
2016-11-03 02:44:53 +10:00
a651985b4f
Land #7498 , Joomla account creation and privesc
2016-11-01 22:46:36 -05:00
f414db5d6d
Clean up module
2016-11-01 22:46:28 -05:00
494b4e67bd
Refactor http/s handler & payloads
...
This commit moves much of the platform-specific logic from the
reverse_http handler down into the payloads. This makes the handler
a bit more agnostic of what the payload is (which is a good thing).
There is more to do here though, and things can be improved.
Handling of datastore settings has been changed to make room for the
ability to override the datastore completely when generating the
payloads. If a datastore is given via the `opts` then this is used
instead otherwise it falls back to the settings specified in the usual
datatstore location.
Down the track, we'll have a payload that supports multiple stages, and
the datastore will be generated on the fly, along with the stage itself.
Without this work, there's no other nice way of getting datastore
settings to be contained per-stager.
2016-11-02 11:33:59 +10:00
a924981369
Landing #7516 , X11 print fixes
2016-11-01 19:50:05 -04:00
a79f860cb7
Add UUIDs to mettle stages
2016-11-01 16:58:21 -05:00
05e2aad837
Land #7497 , Add Kerberos domain user enumeration module
2016-11-01 14:34:47 -05:00
e4b4264d79
Fix psh template to avoid 100% cpu spike on CTRL+C
...
Fixes #7293
2016-11-02 05:19:52 +10:00
1b4cef10d1
Change creds_name to Kerberos
2016-11-01 17:59:51 +00:00
31b593ac67
Land #7402 , Add Linux local privilege escalation via overlayfs
2016-11-01 12:46:40 -05:00
f8912486df
fix typos
2016-11-01 05:43:03 -05:00
47ec362148
Small fixes for dbvis enum
2016-11-01 07:35:36 +10:00
5c065459ae
print_{good,error} more specifically in open_x11
2016-10-31 11:29:00 -05:00
ffb53b7ca3
Tidy arch check in meterpreter inject
2016-11-01 01:51:12 +10:00
557424d2ec
Small tidy of the multiport_egress_traffic module
2016-11-01 01:46:58 +10:00
ec8536f7e9
Fix firefox module to use symbols where appopriate
2016-11-01 01:43:25 +10:00
b9bbb5e857
Replace regex use with direct string checks in dbvis module
2016-11-01 01:35:01 +10:00
3c57ff5c59
Avoid internal constants for bypassuac file path generation
2016-11-01 01:32:24 +10:00
6ce7352c45
Revert silly change in applocker bypass
2016-11-01 01:30:54 +10:00
3c56f1e1f7
Remove commented x64 arch from sock_sendpage
2016-11-01 01:29:11 +10:00
6b264ce6c4
Land #7508 , Fix typo PAYLOAD_OVERWRITE vs PAYLOAD_OVERRIDE
...
Fixes #7504 .
2016-10-30 17:58:43 -05:00
45d6012f2d
fix check method
2016-10-30 14:57:42 -04:00
ccce361768
Remove accidentally included debug output
2016-10-29 18:46:51 -04:00
fa7cbf2c5a
Fix the jenkins exploit module for new versions
2016-10-29 18:19:14 -04:00
f754adad0c
Fix typo PAYLOAD_OVERWRITE vs PAYLOAD_OVERRIDE
2016-10-29 11:20:32 +01:00
640827c24b
Final pass of regex -> string checks
2016-10-29 14:59:05 +10:00
57eabda5dc
Merge upstream/master
2016-10-29 13:54:31 +10:00
8b97183924
Update UUID to match detected platform, fail exploit on invalid session
2016-10-29 13:45:28 +10:00
0737d7ca12
Tidy code, remove regex and use comparison for platform checks
2016-10-29 13:41:20 +10:00
8173e87756
Add references
2016-10-28 16:12:46 -07:00
5c12d55c84
Land #7484 , Add Telpho10 Credentials Dump Exploit
2016-10-28 17:41:46 -05:00
991a3fe448
Markdown docs added.
2016-10-28 17:38:00 -05:00
96c204d1ea
Add aws_keys docs; correct description
2016-10-28 15:27:47 -07:00
751742face
Fix typo in arch check for inject script
2016-10-29 08:25:23 +10:00
1ca2fe1398
More platform/arch/session fixes
2016-10-29 08:11:20 +10:00
d918e25bde
Land #7439 , Add Ghostscript support to ImageMagick Exploit
2016-10-28 17:07:13 -05:00
7dea613507
Initial commit of module for snagging AWS key material from shell/meterpreter sessions
2016-10-28 14:48:55 -07:00
971c8207bd
Update telpho10_credential_dump.rb
...
Code improvements suggested by @h00die
2016-10-28 16:45:14 -05:00
c9574a4707
Update telpho10_credential_dump.rb
...
output correction
2016-10-28 16:44:52 -05:00
05ee51a832
Update telpho10_credential_dump.rb
...
do not write to stdout
2016-10-28 16:44:40 -05:00
fb534a9e85
add telpho10_exploit
...
telpho10 credential dump exploit
2016-10-28 16:44:27 -05:00
5eca6866f2
Fix failing versions, specify version explicitly
2016-10-28 16:24:06 -05:00
c7b775ac1c
Fix detection following @bwatters-r7 recommendations. Remove safesync exploit that shouldn't be here.
2016-10-28 18:03:56 +00:00
88a2a770a3
Update to have checks in place
...
Add: added checks to the code
2016-10-28 11:24:39 +01:00
c153686465
Added Disk Pulse Enterprise Login Buffer Overflow
2016-10-27 21:49:17 -05:00
1d617ae389
Implement first pass of architecture/platform refactor
2016-10-28 07:16:05 +10:00
9eaaba1dea
Added user logging into the db and humored rubocop
2016-10-27 15:50:17 -05:00
16b7c77851
satisfying travis
2016-10-27 13:37:04 -05:00
a8ab7b09b0
Added Bassmaster batch Arbitrary JavaScript Injection Remote Code Execution Vulnerability (CVE-2014-720)
2016-10-27 13:22:39 -05:00
c2af2ab214
Move kerberos_enumusers module to aux/gather & add documentation
2016-10-27 19:11:22 +01:00
88beea0c56
updating code
...
Fix: changing to seggested fixes
2016-10-27 14:30:59 +01:00
23ab4f1fc1
Remove one last tab
2016-10-27 12:32:40 +02:00
d9f07183bd
Please h00die ;)
2016-10-27 12:18:33 +02:00
2ac54f5028
Add a check for the linux pkexec module
2016-10-27 10:28:13 +02:00
2851faefe8
Update module info
...
Fix: removed info that didn't belong
2016-10-27 03:11:38 +01:00
e522d7f5a4
Fixing issues regarding travis checks
...
Fix: EOL spaces;
2016-10-27 02:50:20 +01:00
8ad1c66bd3
Code update and file rename
...
Fix: clean up and improving code using all the comments.
Fix: rename file to a more meaning and more easy to search
2016-10-27 02:46:40 +01:00
0af47ef411
Fixing warning from travis checks
...
Fixing: Auxiliary modules have no 'Rank': Rank = ExcellentRanking
Fixing: Spaces at EOL
2016-10-26 23:29:17 +01:00
5a127886bb
Fixing issues regarding travis checks
...
Fixing unicode issues;
Fixing CVE format;
Fixing EOL spaces;
Fixing the way cookies are read.
2016-10-26 23:24:09 +01:00
94b05d7943
Joomla Account Creation and Privilege Escalation
...
This module allows to create an arbitrary account with administrative privileges in Joomla versions 3.4.4 through 3.6.3.
2016-10-26 23:11:38 +01:00
9672759be8
Land #7462 , Add support for Unicode domains
2016-10-26 16:47:09 -05:00
18c3d42aca
This commit adds the kerberos_enumusers module
2016-10-26 20:56:41 +01:00
1a1841d441
rebuilt metasploit-payloads without debug info
2016-10-26 05:43:36 -05:00
ed35bf5011
remove unneeded badchars from payload specification
2016-10-26 04:47:33 -05:00
342bfd628a
Dont' set default PORTS or PROBE options. Require user configuration.
2016-10-25 15:58:46 -05:00
2a18ea0e33
Initial commit of generic module for detecting UDP amplification vulnerabilities
2016-10-25 15:58:46 -05:00
f7f28a0833
Land #7480 , deprecation msg for udp_probe
2016-10-25 15:52:56 -05:00
6a31dad678
clean up some style guide issues with rubocop
...
applied rubocop to the module for some
tidying up
2016-10-25 11:24:32 -05:00
94979f4541
changed formatting for else statements
2016-10-25 09:42:00 -05:00
6f3c20069b
fixed formatting errors for travis
2016-10-25 09:42:00 -05:00
0ec153eb9c
changed formatting, changed to OptPath. cleaned unneeded code
2016-10-25 09:41:59 -05:00
3b9a441382
cleaned up write_target, and variables REXE
2016-10-25 09:41:59 -05:00
c3ada74728
changed formatting to comform with travis
2016-10-25 09:41:59 -05:00
0395d57512
formatting changes and design changes. tested
2016-10-25 09:41:58 -05:00
337e3b6cce
added persistence_exe.rb to windows post modules
2016-10-25 09:41:58 -05:00
c00df4dd71
Land #6969 , Regsrv cmd delivery server module
...
This Lands kn0's PR for the Regsrv32 command delivery server
2016-10-24 11:46:59 -05:00
7f65b28483
Deprecate udp_probe in favor of udp_sweep
2016-10-23 13:06:58 -07:00
b5ba862e98
parse ipv4 / website info
2016-10-23 10:53:43 -05:00
50284cf01b
parse domain/ip info from certificate
2016-10-23 10:33:17 -05:00
6a8da3223e
set payload file executable bit
2016-10-22 03:30:10 -05:00
c79c102998
remove unuse variable @uri
2016-10-21 23:59:09 -05:00
893a6ef82e
add censys search module
2016-10-21 23:45:44 -05:00
51ffea3e03
Land #7470 , fixes bad file refs for cmdstagers
2016-10-21 14:01:04 -05:00
e442f5f76b
Land #7460 , zoomeye search module
...
typo in previous land commit
2016-10-21 13:48:28 -05:00
264fe7b8f8
Land #7460 , zoomeye search module
2016-10-21 13:47:46 -05:00
9a0307b0c0
Land #7369 , Panda Antivirus Priv Esc
2016-10-21 13:20:41 -05:00
6b77f509ba
fixes bad file refs for cmdstagers
...
when moving to the rex-exploitation gem some of the
file references were missed, partially due to silly differences
between how each file was referenced
Fixes #7466
2016-10-21 12:31:18 -05:00
05ffa0074c
Land 37460, zoomeye search module
...
Lands nixawk's zoomeye search aux module
2016-10-21 10:25:58 -05:00
ada571bfdf
Fix login - check condition
2016-10-20 22:52:24 -05:00
344b688ae5
remove ZoomEye_APIKEY, add (USERNAME / PASSWORD)
2016-10-20 22:48:01 -05:00
12e4fe1c5c
updated dlls and docs
2016-10-20 20:45:50 -04:00
097a273abb
fix dork_search
2016-10-19 20:54:31 -05:00
72b2ba2e88
replace [Net::HTTP] with [rex/proto/http]
2016-10-19 20:40:45 -05:00
a77f415893
remove unuseful condition
2016-10-19 20:05:12 -05:00
9f3f0fd358
make [matches_records] simple
2016-10-19 19:59:02 -05:00
b5a41c3011
Convert ANSI data to UTF-8 char by char because MS might
...
put an invalid character in the WORKGROUP name during SMB
handshake
2016-10-19 17:42:26 -05:00
fcc22d9027
add module references info
2016-10-19 02:23:11 -05:00
2668a4a1cd
Fix #6993 , tnspoison_checker cleanup
2016-10-19 00:53:33 -05:00
3630388e91
zoomeye search
2016-10-18 22:52:23 -05:00
684feb6b50
moved STAGE0 and STAGE1 into datastore
2016-10-18 11:47:38 -04:00
e806466fe3
correct carriage return and link issue
2016-10-17 10:31:39 -04:00
7e68f7d2a4
EmpirePowerShell Arbitrary File Upload (Skywalker)
2016-10-17 10:03:07 -04:00
0d1fe20ae5
revamped
2016-10-15 20:57:31 -04:00
25238f1a26
Update capcom exploit module to support Windows 10
2016-10-15 11:56:48 +10:00
8e2ff8df80
Land #7433 , Add IP Addresses to HTTP PUT/DELETE scanner output
2016-10-14 13:27:17 -05:00
5e7d546fa2
Land #7094 , OpenNMS Java Object Deserialization RCE Module
2016-10-14 13:19:11 -05:00
cfddc734a8
Land #7286 , WiFi pineapple preconfig command injection module
2016-10-14 12:57:42 -05:00
e05a325786
Land #7285 , WiFi pineapple command injection via authentication bypass
2016-10-14 12:57:05 -05:00
1da40b5deb
Change HAVE_POPEN to USE_POPEN
...
PS target doesn't support it, so the option should be renamed.
2016-10-14 11:58:39 -05:00
4c248ebe9e
Merge branch 'master' into land-7430-
2016-10-14 09:48:33 -05:00
acec45c8b3
Land #7409 , CVE-2013-5093 Graphite Pickle Handling - Add Version Check
2016-10-14 08:54:57 -05:00
9fbe1ddd9d
Land #7384 , CVE-2016-6415 - Cisco IKE Information Disclosure
2016-10-14 08:41:34 -05:00
12493d5c06
moved c code to external sources
2016-10-13 20:37:03 -04:00
022830634b
Rejig platform to use windows instead of win32/win64
2016-10-14 10:10:04 +10:00
5b46e72aea
Update module logic
2016-10-13 17:40:16 -05:00
6f4f2bfa5f
Add PS target and remove MIFF
2016-10-13 17:39:55 -05:00
e70ba8110d
Update references
2016-10-13 17:35:55 -05:00
88bb2e2295
Update description
2016-10-13 17:35:30 -05:00
9e97febcd1
Land #7429 , Ruby on Rails Dynamic Render File Upload Remote Code Exec
2016-10-13 11:45:46 -05:00
b74539be44
check if isakmp payload is same to IKE Leak data
2016-10-13 04:20:23 -05:00
2014b2d2ab
Land #7432 , Fix erroneous cred reporting in SonicWALL exploit
2016-10-12 22:39:15 -05:00
a2a1d6c28a
Land #7411 , Add an HTA server module using Powershell
2016-10-12 13:05:40 -05:00
7536d1d94a
print leak data
2016-10-12 02:42:50 -05:00
70d4833654
Fix report_vuln
2016-10-12 02:16:00 -05:00
e78d3d6bf0
Fix erroneous cred reporting in SonicWALL exploit
...
A session ID will be returned in the parsed JSON if the login succeeded.
Bad user:
{"noldapnouser"=>1, "loginfailed"=>1}
Bad password:
{"loginfailed"=>1}
Good user/password:
{"userid"=>"1", "sessionid"=>"4WJ9cNg1TkBrwjzX"}
2016-10-11 19:25:52 -05:00
98d7b19ab9
Passed IP parameter to additional functions.
2016-10-11 15:09:50 -05:00
acff0fa9cf
Added IP addresses to output.
2016-10-11 14:43:42 -05:00
f0ff4a0721
Added IP addresses to output.
2016-10-11 14:42:06 -05:00
bd110430e9
Remove unnecessary require statements
2016-10-11 15:35:49 -04:00
bd646ded1b
fixed the check function
2016-10-11 14:06:03 -05:00
3fd806b87f
Merge remote-tracking branch 'upstream/pr/6993' into land-6993
2016-10-11 09:33:26 -05:00
95017cea0c
Merge remote-tracking branch 'upstream/master' into rails
2016-10-11 08:31:33 -05:00
157740ba06
update payload sizes
2016-10-11 07:01:17 -05:00
3d9cb7375c
store Android payload information in byte array
2016-10-11 14:41:32 +08:00
d8f98ccd4e
run through msftidy
2016-10-10 22:36:20 -05:00
f2252bb179
fixed a few things, thanks @h00die
2016-10-10 22:30:01 -05:00
3c3f424a4d
added a some references
2016-10-10 17:56:03 -05:00
bca3aab1db
added CVE-2016-0752
2016-10-10 17:36:20 -05:00
9d2355d128
removed debug line
2016-10-10 10:23:51 -04:00
2ad82ff8e3
more nagios versatility
2016-10-10 10:21:49 -04:00
e139a1ee8f
Land #7383 : Rebase/Fix + SSL stager support for python
2016-10-10 13:06:09 +10:00
7b84e961ed
Minor output correction.
2016-10-09 19:01:06 -05:00
d1a11f46e8
Land #7418 , Linux recvmmsg Priv Esc (CVE-2014-0038)
2016-10-09 18:37:52 -05:00
7e6facd87f
added wrong file
2016-10-09 09:49:58 -04:00
2c4a069e32
prepend fork fix
2016-10-09 09:40:44 -04:00
2dfebe586e
working cve-2014-0038
2016-10-08 23:58:09 -04:00
b77a910205
Land #7355 , allwinner post to local exploit conversion
2016-10-08 21:38:54 -05:00
e074669406
Land #7296 , Added a SCADA module for detecting Profinet devices, e.g. Siemens controllers
2016-10-08 21:34:40 -05:00
bd24e7eba0
more cleanups and print output on auto-run
2016-10-08 21:14:26 -05:00
5284db6b58
module cleanup
2016-10-08 20:17:29 -05:00
199bf8e726
cleanups and update to require 4.0 CLR by default
2016-10-08 15:24:13 -05:00
44c5fc3250
Sync build_net_code post module upstream
...
Fix merge conflicts and add missing lines to framework version of
the DotNet compiler example module.
Test output to come in PR #5393
2016-10-08 14:06:35 -05:00
0e57808914
Update to class name MetasploitModule
2016-10-08 14:06:35 -05:00
f24bfe7d4e
Import Powershell::exec_in_place
...
Allow passing exec_in_place parameter to cmd_psh_payload in order
to execute raw powershell without the commandline wrappers of
comspec or calling the powershell binary itself.
This is useful in contexts such as the web delivery mechanism or
recent powershell sessions as it does not require the creation of
a new PSH instance.
2016-10-08 14:06:35 -05:00
36b989e6d7
Initial import of .NET compiler and persistence
...
Add Exploit::Powershell::DotNet namespace with compiler and
runtime elevator.
Add compiler modules for payloads and custom .NET code/blocks.
==============
Powershell-based persistence module to compile .NET templates
with MSF payloads into binaries which persist on host.
Templates by @hostess (way back in 2012).
C# templates for simple binaries and a service executable with
its own install wrapper.
==============
Generic .NET compiler post module
Compiles .NET source code to binary on compromised hosts.
Useful for home-grown APT deployment, decoy creation, and other
misdirection or collection activities.
Using mimikatz (kiwi), one can also extract host-resident certs
and use them to sign the generated binary, thus creating a
locally trusted exe which helps with certain defensive measures.
==============
Concept:
Microsoft has graciously included a compiler in every modern
version of Windows. Although executables which can be easily
invoked by the user may not be present on all hosts, the
shared runtime of .NET and Powershell exposes this functionality
to all users with access to Powershell.
This commit provides a way to execute the compiler entirely in
memory, seeking to avoid disk access and the associated forensic
and defensive measures. Resulting .NET assemblies can be run
from memory, or written to disk (with the option of signing
them using a pfx cert on the host). Two basic modules are
provided to showcase the functionality and execution pipeline.
Usage notes:
Binaries generated this way are dynamic by nature and avoid sig
based detection. Heuristics, sandboxing, and other isolation
mechanisms must be defeated by the user for now. Play with
compiler options, included libraries, and runtime environments
for maximum entropy before you hit the temmplates.
Defenders should watch for:
Using this in conjunction with WMI/PS remoting or other MSFT
native distributed execution mechanism can bring malware labs
to their knees with properly crafted templates.
The powershell code to generate the binaries also provides a
convenient method to leave behind complex trojans which are not
yet in binary form, nor will they be until execution (which can
occur strictly in memory avoiding disk access for the final
product).
==============
On responsible disclosure: I've received some heat over the years
for prior work in this arena. Everything here is already public,
and has been in closed PRs in the R7 repo for years. The bad guys
have had this for a while (they do their homework religiously),
defenders need to be made aware of this approach and prepare
themselves to deal with it.
2016-10-08 14:05:53 -05:00
7c20f20493
remove unneeded bash
2016-10-07 21:12:27 -04:00
bbdb58eb00
Add an HTA server module using powershell
2016-10-06 19:25:22 -04:00
fb0a438fdf
Perform a version check to determine exploitability for graphite pickle
2016-10-05 16:08:02 -07:00
e8c3a61e72
Land #7405 , nil fix for ntp_protocol_fuzzer
2016-10-05 15:26:39 -05:00
8749eaf097
Fix the default num to be 0 when not specified.
2016-10-05 14:52:43 -05:00
b95cc7bbbe
Set correct default options; fix usage on OS X
...
Fixes 7404
2016-10-05 09:51:31 -07:00
27cf5c65c4
working module
2016-10-04 23:21:53 -04:00
75bea08e0e
changing branches
2016-10-04 21:08:12 -04:00
63ed5624ff
Land #7395 , Ninja Forms module update
2016-10-04 11:14:30 -05:00
f60d575d62
Add EOF newline back in
2016-10-04 11:14:15 -05:00
705d15037a
Land #7396 , Add Meterpreter API to list installed drivers
2016-10-04 07:17:10 -05:00
691a250d78
add reverse_tcp handler to fix bug in latest update
...
The payload was missing require 'msf/core/handler/reverse_tcp', latest update pulled with msfupdate broke the startup of the framework, where you got this kind of an error:
!master ~/4tools/metasploit-framework> msfconsole
/home/tony/4tools/metasploit-framework/modules/payloads/singles/android/meterpreter_reverse_tcp.rb:28:in `initialize': uninitialized constant Msf::Handler::ReverseTcp (NameError)
from /home/tony/4tools/metasploit-framework/lib/msf/core/payload_set.rb:198:in `new'
from /home/tony/4tools/metasploit-framework/lib/msf/core/payload_set.rb:198:in `add_module'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:71:in `on_module_load'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/base.rb:182:in `load_module'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/base.rb:237:in `block in load_modules'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:55:in `block (2 levels) in each_module_reference_name'
from /var/lib/gems/2.3.0/gems/rex-core-0.1.2/lib/rex/file.rb:127:in `block in find'
from /var/lib/gems/2.3.0/gems/rex-core-0.1.2/lib/rex/file.rb:126:in `catch'
from /var/lib/gems/2.3.0/gems/rex-core-0.1.2/lib/rex/file.rb:126:in `find'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:46:in `block in each_module_reference_name'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:34:in `foreach'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:34:in `each_module_reference_name'
from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/base.rb:236:in `load_modules'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:117:in `block in load_modules'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:115:in `each'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:115:in `load_modules'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:41:in `block in add_module_path'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:40:in `each'
from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:40:in `add_module_path'
from /home/tony/4tools/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:50:in `block in init_module_paths'
from /home/tony/4tools/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:49:in `each'
from /home/tony/4tools/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:49:in `init_module_paths'
from /home/tony/4tools/metasploit-framework/lib/msf/ui/console/driver.rb:204:in `initialize'
from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/console.rb:62:in `new'
from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/console.rb:62:in `driver'
from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in `start'
from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
from /home/tony/4tools/metasploit-framework/msfconsole:48:in `<main>'
2016-10-04 10:40:04 +02:00
3101564a0a
Enable support for windows 8 in the exploit
2016-10-04 16:27:33 +10:00
a4efa77878
Support driver list, adjust capcom exploit
...
This commit adds MSF-side support for listing currently loaded drivers
on the machine that Meterpreter is running on. It doesn't add a UI-level
command at this point, as I didn't see the need for it. It is, however,
possible to enumerate drivers on the target using the client API.
Also, the capcom exploit is updated so that it no longer checks for the
existence of the capcom.sys file in a fixed location on disk. Instead,
it enumerates the currently loaded drivers using the new driver listing
function, and if found it checks to make sure the MD5 of the target file
is the same as the one that is expected. The has is used instead of file
version information because the capcom driver doesn't have any version
information in it.
2016-10-04 11:27:20 +10:00
e6daef62b4
egypt
2016-10-03 20:24:59 -04:00
b1cb153c31
Make errors more meaningful
2016-10-03 15:29:40 -05:00
9853daeb4e
Land #7376 , mysql_writable_dir module #2
...
some comits got missed here somehow
2016-10-03 10:42:37 -05:00
2d361fabc6
No need to interpolate when using .to_s
2016-10-03 11:38:36 -04:00
e13a9667c2
Land #7376 , mysql_writable dirs mdoule
...
Lands avgsecurityguy's new mysql_writable_dirs module
2016-10-03 10:34:03 -05:00
95f9b778bd
Use standard status messages instead of verbose.
2016-10-03 11:01:51 -04:00
d088005d95
TABLE_NAME option not needed.
2016-10-03 10:58:13 -04:00
5f12c8e026
Incorrect warning message
...
The filename is not always test so the warning message and the note in the description are incorrect.
2016-10-03 10:57:25 -04:00
25996a16bb
Fixed file read block.
2016-10-03 10:47:03 -04:00
708eb0eb4f
Fixed syntax error.
2016-10-03 10:17:29 -04:00
fac03570d1
Use File.open block.
2016-10-03 10:09:45 -04:00
bc57537205
Add warning statement.
2016-10-03 10:07:40 -04:00
a627c3cd5e
Removed unnecessary return statements.
2016-10-03 10:02:26 -04:00
6fa8f40b31
Use unless instead of if (not ...)
2016-10-03 10:00:56 -04:00
3e01dbfded
Fixed Space-Tab mixed indent warning
2016-10-01 15:13:26 +05:30
4227cb76a8
Fixed stack trace bug & verified logic
...
- Fixed stack trace bug when value of "packet" is nill.
- Verified logic of Oracle TNS Listener poisoning which requires an ACCEPT response to be marked as vulnerable.
2016-10-01 15:01:02 +05:30
63c0b6f569
Login failure message.
2016-09-30 17:09:41 -04:00
3f9540d906
fix trailing whitespace
...
this commit got dropped during landing
2016-09-30 14:30:31 -05:00
OJ
Brent Cook
jjarmoc
John Q. Public
x2020
h00die
Javier Godinez
Pearce Barry
Cantoni Matteo
root
Jin Qian
wchen-r7
William Vu
Prateep Bandharangshi
William Webb
David Maloney
Louis Sato
Brian Patterson
Brendan
Jeffrey Martin
Pedro Ribeiro
Chris Higgins
Dylan Davis
dmohanty-r7
Jenna Magius
scriptjunkie
Yorick Koster
Tijl Deneut
朱雄宇
Jon Hart
Jin Qian
Adam Cammack
attackdebris
Alex Flores
Spencer McIntyre
Konrads Smelkovs
Jan Rude
Jeff
Quentin Kaiser
Filipe Reis
mr_me
Julien (jvoisin) Voisin
Brent Cook
drforbin
Vex Woo
nixawk
wolfthefallen
Alton J
Sonny Gonzalez
Tim
RageLtMan
funkypickle
“lvarela”
Tonimir Kisasondi
Stephen Haywood
Interference Security