There are still strong reservations about using Nokogiri to parse
untrusted XML data.
http://www.wireharbor.com/hidden-security-risks-of-xml-parsing-xxe-attack/
It is also believed that many desktop operating systems are still
shipping out-of-date and vulnerable libxml2 libraries, which become
exposed via Nokogiri. For example:
http://stackoverflow.com/questions/18627075/nokogiri-1-6-0-still-pulls-in-wrong-version-of-libxml-on-os-x
While this isn't a problem for binary builds of Metasploit (Metasploit
Community, Express, or Pro) it can be a problem for development
versions or Kali's / Backtrack's version.
So, the compromise here is to allow for modules that don't directly
expose XML parsing. I can't say for sure that the various libxml2
vulnerabilities (current and future) aren't also exposed via
`Nokogiri::HTML` but I also can't come up with a reasonable demo.
Metasploit committers should still look at any module that relies on
Nokogiri very carefully, and suggest alternatives if there are any. But,
it's sometimes going to be required for complex HTML parsing.
tl;dr: Use REXML for XML parsing, and Nokogiri for HTML parsing if you
absolutely must.
It's often you want counts of just WARN and ERROR messages, and don't
want to spam yourself with INFO messages that you don't intend to
address anyway. This is most often the case with CI, such as with
https://travis-ci.org/todb-r7/metasploit-framework
This correct msftidy's disclosure date check to do the following:
1. If the module has a disclosure date, the check should kick in.
2. If the module is an exploit, and doesn't have a disclosure
date, then it will be flagged.
3. If the module is an auxiliary, and doesn't have a disclosure
date, then it will NOT be flgged (because not all aux modules
target bugs/vulns like exploits do).
This will make it possible to run a post-merge check when
pre-commit-hook.rb is referenced as a symlink from .git/hooks/post-merge
The kind of check you're going to do is entirely dependant on the
basename of the file, which is a little weird but convenient.
Verification is a little tricky on this. Coming soon.
Nokogiri has a habit of shipping vulnerable builds of libxml2. For
example, see this:
http://www.ubuntu.com/usn/usn-1904-1/
and compare to Nokogiri's bundled requirements:
https://github.com/sparklemotion/nokogiri/blob/master/dependencies.yml
While Nokogiri is quite pleasant to use, it really shouldn't be trusted
to handle potentially malicious data. Imagine if a "vulnerable" target
was actually a malicious honeypot, lying in wait for a poor Metasploit
user to come along and parse out its payload. (OT: does such a thing
have a clever name? If not, I propose "beehive" to imply the offensive
capabilities of such a honeypot.)
Nokogiri is used elsewhere in Metasploit, but those functions handle
data sourced from the Metasploit user herself, so those XML hunks are
nominally trustworthy.
This change updates msftidy to be run automatically for new modules
added since the last tag release because we can't rely on folks using
tools/dev/pre-commit-hook before submitting a PR. Now, when one attempts
to open a PR with a non-tidy'ed module, the build will fail out of the
gate.
Related to the 100s of msftidy errors extant today.
[SeeRM #8498]
commit c894e52de5705a1133191be5e9caf3ebdee33621
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Fri Jan 31 14:17:02 2014 -0600
Add a jacked up title to test travis. Revert this!
commit 2f00c190be71aeb456a7a546071286fd6d670bc1
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Fri Jan 31 11:39:42 2014 -0600
Allow for checking and spotchecking.
commit db11e8dfad5381030b08c431a183dbafe7a5f304
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 17:16:37 2014 -0600
Whoops, need to exit an Integer always.
commit 12d131d3157a78ff11e597476138323ed0a062fc
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 16:59:35 2014 -0600
Allow for exit statuses from msftidy.
commit 2c3b294ff17416f49935472caf2b6be3dbdd93a4
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 15:36:43 2014 -0600
Be more dynamic about tag checking years
commit d5d8a0b05ac17fb18666a9c252dbb6928d6b5e56
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 14:36:44 2014 -0600
Don't warn when there's really nothing
commit fb44a3142fb01eb2647c1c240bb1cc2e7bf59120
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 14:21:50 2014 -0600
Revert the intentional failure
This reverts commit 99a7630b0da301b27ac495cb027009a8cd9e2caf.
Fun fact: Reverting a commit does not automatically sign with my current
aliases, one must git revert then git c --amend.
commit 99a7630b0da301b27ac495cb027009a8cd9e2caf
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 14:08:05 2014 -0600
Cause an exit status in precommit check
Maybe travis will see these and fail the build.
Don't forget to revert this commit @todb-r7 !
commit 5a3b2fcd9598fae51a0dd2c7c87680c703a85448
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 13:11:04 2014 -0600
Update msftidy pre-commit-hook for spotchecking
commit 3f255e36dad9ed3081aaf359f845525d96872ef0
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 12:35:16 2014 -0600
Travis should run msftidy via precommit hook
commit 0959d9d2d281590a94c0ac960e43b74354e4e21b
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu Jan 30 12:25:53 2014 -0600
Add SPOTCHECK_RECENT to msftidy.rb
In case it takes too long to get a report, the method will give up
checking after one hour. The user can still manually check the report
from the analysis link given earlier.
[SeeRM #8733] This a tool that uses VirusTotal's public API to submit
a malware sample for analysis. As an offensive tool developer, this
would provide a convenient way to check and see how AVs react to
something we write.
Also, enforce binary encoding like the other Metasploit tools.
This opens the door to fixing files that have things that could be fixed
programmatically.
[SeeRM #8497]
Instead of just relying on a filename of *.rb, use the file utility to
determine file type.
For systems that lack lack 'which' and 'file', fall back to filename
matching.
This is useful for retabbing things like 'msfconsole' that don't have a
.rb extension.
Local backups are generally not needed since you can just git checkout
old versions anyway before committing. It was nice to have during dev
but generally shouldn't be done now.
This signals a move to allowing for normal Ruby indentation (2 space
soft tabs). This change will check files for indentation of spaces or of
tabs, since we don't want to fail out all modules quite yet.
For more, see
https://github.com/rapid7/metasploit-framework/wiki/Indentation-Standards
where all details of the conversion plan will be documented in order to
minimize the amount of whitespace conflict we are sure to encounter over
this conversion.
Usage: tools/dev/retab.rb directory
will retab with 2-width spaces rather than tabs for indentation.
This utility should be used by the @tabassassin account when it's
unleashed on the Metasploit code base in order to make git blame a
little easier to spot. (diffs should use -b or -w to avoid seeing
@tabassassin's changes)
This merge adds four new tools:
* .mailmap : allows for easier identification of committers
* tools/module_count.rb : Spits out a current count of modules
* tools/module_commits.rb: Spits out who commited to a module
* tools/committer_counts.rb : Spits out commiters by commit counts
This was part of a long-running feature branch, which is why it's now
bundled up in one big squash merge.
Squashed commit of the following:
commit de201ff6a5b304d0fedec56d9f1930abf1a10d9e
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Jan 24 14:48:24 2013 -0600
Rename from scorecard to merely a count
commit 8028cf838b0b560831602e3163e92d0751a4c0a9
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Jan 24 14:36:42 2013 -0600
Some final comment docs
commit a69fd7883837849664bc8777d119ac760de4a43d
Merge: e288f13 3faf4b3
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Jan 24 13:21:14 2013 -0600
Merge branch 'master' into committer-scorecard
I think these conflicts came from a move or a rename or something.
Conflicts:
external/source/exploits/cve-2012-5076_2/Makefile
external/source/exploits/cve-2012-5088/Makefile
modules/exploits/multi/browser/java_jre17_method_handle.rb
modules/exploits/multi/http/jenkins_script_console.rb
commit e288f13d7f7bca7aa4ceddd555b88d971a9f65a2
Author: Tod Beardsley <todb@metasploit.com>
Date: Wed Jan 16 14:06:23 2013 -0600
Add FireFart's mail alias
commit 1b1792e84febf015a79c3beb3d2473953da56935
Author: Tod Beardsley <todb@metasploit.com>
Date: Fri Jan 18 22:41:44 2013 -0600
Fix grammar on description for webcam
commit 276388fac541f0eebb9a18a980c5b474f438d117
Author: Robin Wood <robin@digininja.org>
Date: Tue Jan 22 15:42:23 2013 +0000
added extra checking for strict databases
commit a40ea3d73e52ab822cb89052ef7575f7ac52abb6
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Tue Jan 22 12:07:16 2013 +0100
fix data added to table
commit 738d2fad5fccfbff23967ce219ad6bd4af90bbea
Author: HD Moore <hd_moore@rapid7.com>
Date: Tue Jan 22 00:27:03 2013 -0600
Fix a stack overflow in bidirectional pipe
commit aeec5a816b2f09f517930cdff074ea4b42ed5088
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Mon Jan 21 12:26:35 2013 +0100
Cleanup for mysql_file_enum.rb
commit 13f68f089b4f3dd7c58bb4d5cb5767ff3df12852
Author: sinn3r <msfsinn3r@gmail.com>
Date: Mon Jan 21 00:30:43 2013 -0600
Updates the progress function
Because the previous one was wrong.
commit d971fe0bb5f34667b6a621043838f7472e7255cd
Author: Robin Wood <robin@digininja.org>
Date: Sun Jan 20 21:32:02 2013 +0000
Brute force directory and file names with MySQL
commit a96ca2e96a3a34e302a6759ba48706c60b9724cd
Author: Robin Wood <robin@digininja.org>
Date: Sun Jan 20 00:13:42 2013 +0000
added a warning and using optpath
commit aa98d85abbc30166ce7d69a446bf78cddff92e0a
Author: Robin Wood <robin@digininja.org>
Date: Sun Jan 20 00:12:38 2013 +0000
added a warning and using optpath
commit 6dd5bb8532d0f68d44ca80099780428e0a3ad872
Author: Robin Wood <robin@digininja.org>
Date: Sun Jan 20 00:02:07 2013 +0000
stopped using fixed table name
commit 520aeb93119a77b4eb8d1187cac4084690d45613
Author: Robin Wood <robin@digininja.org>
Date: Sat Jan 19 23:41:38 2013 +0000
Fixed msftidy stuff
commit cec6a06c56444f12dc8b8985c2505b2d259d5077
Author: Robin Wood <robin@digininja.org>
Date: Sat Jan 19 22:48:00 2013 +0000
File/dir brute forcer using MySQL
commit 3cc0f3feaed87df11ab3695342af304d3b13d056
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Sun Jan 20 19:54:24 2013 +0100
finally it doesn't use FileDropper atm
commit 2670d5ca8fbe2b26b2073445537bf0bfacd079dd
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Sun Jan 20 17:38:37 2013 +0100
references and date updated
commit 1230d5267b3a8b33cfd64f6efb613986d6d13b31
Author: bcoles <bcoles@gmail.com>
Date: Mon Jan 21 02:12:42 2013 +1030
update php_charts_exec metadata
commit cf37c594e55b0130640f5aaea240b3aa936b7c8d
Author: bcoles <bcoles@gmail.com>
Date: Mon Jan 21 02:10:48 2013 +1030
move and update php_charts_exec metadata
commit 1e86429fa16a2f5d5003fbe6e69a74cac5efd767
Author: bcoles <bcoles@gmail.com>
Date: Sun Jan 20 23:51:17 2013 +1030
Add PHP-Charts v1.0 PHP Code Execution Exploit
commit fe60ee6dffc60a53b28bcfd08b5aada8bc8d4000
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Sun Jan 20 13:42:02 2013 +0100
linux stager plus little cleanup
commit 5900248f585e7a5e10d93a0672aa8d330d5581ee
Author: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Sat Jan 19 19:10:56 2013 -0500
use target_uri and normalize_uri as well as fix a cookie problem
commit a7ce0a500fe1ae4c71652191ee97ba1757cf65e0
Author: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Fri Jan 18 14:56:52 2013 -0500
add module to execute commands via Jenkins Script Console
commit 33b8aa49f4dbbfbcc275b5cc0dfc43db9fec08f8
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Fri Jan 18 18:42:27 2013 +0100
title updated
commit 63fe457fadf66ac27eac6210a26880c1f816d0ce
Author: Charles Smith <charles.smith@n2netsec.com>
Date: Thu Jan 17 16:52:02 2013 -0500
Fixed loot formatting so data is under the proper column
The credentials table was defined with the columns "User", "Password", "Host", "Port", and "SSL". Credentials were not added in that order, however. They were added in the order "host, port, user, password, ssl" in this line:
credentials << [cred['host'], cred['port'], cred['user'], cred['password'], cred['ssl']]
I changed the order the columns were defined to fix this.
The permissions table had a similar issue. The "FileWrite" column was missing, so I added it. I also moved the "Home" column to after the "AutoCreate" column. Now the line:
permissions << [perm['host'], perm['user'], perm['dir'], perm['fileread'], perm['filewrite'], perm['filedelete'], perm['fileappend'],perm['dircreate'], perm['dirdelete'], perm['dirlist'], perm['dirsubdirs'], perm['autocreate']]
works correctly.
commit b948559b5ae0090c9ecb704bfba2da219577d4f4
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Thu Jan 17 21:45:13 2013 +0100
cleanup
commit 199ab00a9c46295776b3f9c47d941721d5777a65
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Thu Jan 17 21:39:41 2013 +0100
cleanup
commit 8d5504475dbce315581e87f395c9453bbe624d2e
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Thu Jan 17 21:27:47 2013 +0100
Added new module for cve-2012-5076
commit 31ae18f392dea9fcfc4e1e6e1ec627aed2513d09
Author: jvazquez-r7 <juan.vazquez@metasploit.com>
Date: Thu Jan 17 21:14:49 2013 +0100
Added module for CVE-2012-5088
commit 6ac99f3db8f464767d15aaf60a2a5796b4ae8b30
Author: Tod Beardsley <todb@metasploit.com>
Date: Sat Jan 19 09:08:31 2013 -0600
Add a quick comment doc
commit 0c18f1c7cb53a77b4338e6014b76ea74749b41f9
Author: Tod Beardsley <todb@metasploit.com>
Date: Sat Jan 19 09:06:34 2013 -0600
Adds a per-module commit counter.
commit 44fa22832bb2e229f5a96a62658d7c4b0b88b966
Merge: fa288ff 9f42abd
Author: Tod Beardsley <todb@metasploit.com>
Date: Sat Jan 19 08:30:37 2013 -0600
Merge remote-tracking branch 'origin/master' into committer-scorecard
commit fa288ff007c1ead48ca011cda2488164d5103715
Author: Tod Beardsley <todb@metasploit.com>
Date: Fri Jan 18 14:05:47 2013 -0600
Make module_count execable
commit 6c1625ed709f505ec9e8be89820f9d6827a52567
Author: Tod Beardsley <todb@metasploit.com>
Date: Tue Jan 8 09:56:48 2013 -0600
Wrote a quick module counter, by type
commit af07ddc8184b85ecd43fb9e2cb2c607d54fb0c1b
Merge: 2ee5df8 2c3ccb5
Author: Tod Beardsley <todb@metasploit.com>
Date: Tue Jan 8 09:35:28 2013 -0600
Merge remote-tracking branch 'origin/master' into committer-scorecard
commit 2ee5df810313290a753344b83a9b9e591c30ef05
Merge: 501c678 b50e040
Author: Tod Beardsley <todb@metasploit.com>
Date: Fri Jan 4 10:24:27 2013 -0600
Merge remote-tracking branch 'origin/master' into committer-scorecard
commit 501c678b2ca6f67639d7d7425469d380ba6534cf
Merge: 8001401 c2586d0
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Dec 27 15:42:25 2012 -0600
Merge branch 'master' into committer-scorecard
commit 800140176686c8aa4e41629b259a1bcb8b7c9e0c
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Dec 27 11:13:04 2012 -0600
Adding shuckins and cjr to the mailmap
commit ab2db49c17b78616dc9199d62928e65d624e9e12
Merge: 8b6ecb3 daf5465
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Dec 27 10:29:19 2012 -0600
Merge remote branch 'origin/master' into committer-scorecard
commit 8b6ecb34bd2a1719bc51ab136cb9de1a8cd5c782
Author: Tod Beardsley <todb@metasploit.com>
Date: Mon Dec 17 21:58:37 2012 -0600
Comment docs on .mailmap
commit 8e245a086c2e91a80be31accdb6349837cba3dff
Author: Tod Beardsley <todb@metasploit.com>
Date: Mon Dec 17 21:56:06 2012 -0600
Another alias for h0ng10
commit aff6169602791a048cff2e41bac5cbb565abd341
Author: Tod Beardsley <todb@metasploit.com>
Date: Mon Dec 17 17:02:35 2012 -0600
A more useful committer score card
Now with aliases for anyone who hit the top 20 list of the last year,
six months, and twelve weeks.
Still needs some optparsey niceities, but it's good enough for an
intial push to GitHub.
commit bd4e00ee019cedfed2eb8af6b52786f5184193ca
Author: Tod Beardsley <todb@metasploit.com>
Date: Mon Dec 17 15:22:33 2012 -0600
Initial commit of a git commit scorecard
Sometimes the first letter of a word shouldn't be capitalized.
If you do, it may actually be technically incorrect. For example:
a function name, a filename, or even a software name like freeFTPd.
We should ignore scenarios like those.
It's not always possible or technically correct to uppercase every
word. For example, sometimes a module may contain a filename or
function name. We should allow these conditions to pass.
When File.executable?() is used, it checks if the file is an
executable AND that exe permission is set. Well, we don't really
have to set the permission we can still load/use the module. So
really, all we care is the module must be a ".rb" to make sure
it loads at startup. So that's what we need to check.
Changes include:
* Make invalid ranking an error, because it may affect module
search in msfconsole, or the metasploit site.
* Make invalid disclosure format an error, same concern as above.
* Plus other changes
- Adds a call to mprotect(2) to the reverse and bind stagers
- Adds accurate source for some other linux shellcode, including some
comments to make it more maintainable
- Adds tools/module_payload.rb for listing all payloads for each exploit
in a greppable format. Makes it easy to find out if a payload change
causes a payload to no longer be compatible with a given exploit.
- Missing from this commit is source for reverse_ipv6_tcp
This switches the Metasploit Framework to a Rails 3 backend. If you run
into new problems (especially around Active Record or your postgresql
gem) you should try first updating your Ruby installation to 1.9.3 and
use a more recent 'pg' gem.
If that fails, we'd love to see your bug report (just drop all the
detail you can into an issue on GitHub). In the meantime, you can
checkout the rails2 branch, which was branched from master immediately
before this cutover.
Squashed commit of the following:
commit 5802ec851580341c6717dfea529027c12678d35f
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 23:30:12 2012 -0500
Enable MSF_BUNDLE_GEMS mode by default (set to N/F/0 to disable)
commit 8102f98dce9eb0c73c4374e40dce09af7b51d060
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 23:30:03 2012 -0500
Add a method to expand win32 file paths
commit bda6479d154cf75572dd5de8b66bfde661a55de9
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 18:53:44 2012 -0500
Fix 1.8.x compatibility
commit 101ce4eb17bfdf755ef8c0a5198174668b6cd6fd
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 18:40:59 2012 -0500
Use verbose instead of stringio
commit 5db467ffb593488285576d183b1662093e454b3e
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 18:30:06 2012 -0500
Hide the iconv warning, were stuck with it due to EBCDIC support
commit 63b9cb20eb6a61daf4effb4c8d2761c16ff0c4e0
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 18:29:58 2012 -0500
Dont use GEM_HOME by default
commit ca49271c22c314a4465fff934334df18c704cbc0
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 18:23:34 2012 -0500
Move Gemfile to root (there be dragons, lets find them) and catch failed bundler loads
commit 34af04076a068e9f60c5526045ddbba5fca359fd
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 18:18:29 2012 -0500
Fallback to bundler when not running inside of a installer env
commit ed1066a4f3f12fae7d4afc03eb1ab70ffe2f9cf3
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 16:26:55 2012 -0500
Remove a mess of gems that were not actually required
commit 21290a73926809e9049a59359449168f740d13d2
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 15:59:10 2012 -0500
Hack around a gem() call that is well-intentioned but an obstacle in this case
commit 8e414a8bfab9641c81088d22f73033be5b37a700
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Apr 15 15:06:08 2012 -0500
Ruby, come on. Ducktype this. Please.
Use interpolated strings to get the to_s behavior you don't get with
just plussing.
commit 0fa92c58750f8f84edbecfaab72cd2da5062743f
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 15:05:42 2012 -0500
Add new eventmachine/thin gems
commit 819d5e7d45e0a16741d3852df3ed110b4d7abc44
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 15:01:18 2012 -0500
Purge (reimport in a second)
commit ea6f3f6c434537ca15b6c6674e31081e27ce7f86
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 14:54:42 2012 -0500
Cleanup uncessary .so files (ext vs lib)
commit d219330a3cc563e9da9f01fade016c9ed8cda21c
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 14:53:02 2012 -0500
PG gems built against the older installation environment
commit d6e590cfa331ae7b25313ff1471c6148a6b36f3b
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 14:06:35 2012 -0500
Rename to include the version
commit a893de222b97ce1222a55324f1811b0262aae2d0
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 13:56:47 2012 -0500
Detect older installation environments and load the arch-lib directories into the search path
commit 6444bba0a421921e2ebe2df2323277a586f9736f
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 13:49:25 2012 -0500
Merge in windows gems
commit 95efbcfde220917bc7ee08e6083d7b383240d185
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Apr 15 13:49:33 2012 -0500
Report_vuln shouldn't use :include in finder
find_or_create_by doesn't take :include as a param.
commit c5f99eb87f0874ef7d32fa42828841c9a714b787
Author: David Maloney <DMaloney@rapid7.com>
Date: Sun Apr 15 12:44:09 2012 -0500
One more msised Mdm namespace issue
commit 2184e2bbc3dd9b0993e8f21d2811a65a0c694d68
Author: David Maloney <DMaloney@rapid7.com>
Date: Sun Apr 15 12:33:41 2012 -0500
Fixes some mroe Mdm namespace confusion
Fixes#6626
commit 10cee17f391f398bb2be3409137ff7348c7a66ee
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 03:40:44 2012 -0500
Add robots gem (required by webscan)
commit 327e674c83850101364c9cca8f8d16da1de3dfb5
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 03:39:05 2012 -0500
Fix missing error checks
commit a5a24641866e47e611d7636a3f19ba3b3ed10ac5
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 01:15:37 2012 -0500
Reorder requires and add a method for injecting a new migration path
commit 250a5fa5ae8cb05807af022aa4168907772c15f8
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 00:56:09 2012 -0500
Remove missing constant (use string) and add gemcache cleaner
commit 37ad6063fce0a41dddedb857fa49aa2c4834a508
Merge: d47ee82 4be0361
Author: Tod Beardsley <todb@metasploit.com>
Date: Sun Apr 15 00:40:16 2012 -0500
Merge branch 'master-clone' into rails3-clone
commit d47ee82ad7e66de53dd3d3a65649cc37299a2479
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 00:30:03 2012 -0500
cleanup leftovers from gems
commit 6d883b5aa8a3a7ddbcde5bfd4521d57c5b30d3c2
Author: HD Moore <hd_moore@rapid7.com>
Date: Sun Apr 15 00:25:47 2012 -0500
MDM update with purged DBSave module
commit 71e4f2d81f6da221b76150562a16c730888f5925
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 23:19:37 2012 -0500
Add new mdm
commit 651cd5adac8211d65e0c8079371d8264e549533a
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 23:19:13 2012 -0500
Update mdm
commit 0191a8bd0acec30ddb2a9e9c291111a12378537f
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 22:30:40 2012 -0500
This fixes numerous cases of missed Mdm:: prefixes on db objects
commit a2a9bb3f2148622c135663dead80b3367b6f7695
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 18:30:18 2012 -0500
Add eventmachine
commit 301ddeb12b906ed3c508613ca894347bedc3b499
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 18:18:12 2012 -0500
A nicer error for folks who need to upgrade pg
commit fa6bde1e67b12e2d3d9978f59bbc98e0c1a1a707
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 17:54:55 2012 -0500
Remove bundler requirements
commit 2e3ab9ed211303f1116e602b9a450141b71e56a4
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 17:35:38 2012 -0500
Pull in eventmachine with actual .so's this time
commit 901fb33ff6b754ce2c2cfd51e3b0b669f6ec600b
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 17:19:12 2012 -0500
Update deps, still need to add eventmachine
commit 6b0e17068e8caa0601f3ef81e8dbdb672758fcbe
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 13:07:06 2012 -0500
Handle older installer environments and only allow binary gems when the
environment specifically asks for it
commit b98eb7873a6342834840424699caa414a5cb172a
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 04:05:13 2012 -0500
Bump version to -testing
commit 6ac508c4ba3fdc278aaf8cfe2c58d01de3395431
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 02:25:09 2012 -0500
Remove msf3 subdir
commit a27dac5067635a95b4cbb773df1985f2a2dc2c5a
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 02:24:39 2012 -0500
Remove the old busted external
commit 5fb5a0fc642b6c301934c319db854cc3145427a1
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 02:03:10 2012 -0500
Add the gemcache loader
commit 09e2d89dfd09b9ac0c123fcc4e19816c86725627
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Apr 14 02:02:23 2012 -0500
Purge gemfile/bundler configure in exchange for new gemcache setup
commit 3cc0264e1cfb027b515d7f24b95a74b023bd905c
Author: Tod Beardsley <todb@metasploit.com>
Date: Thu Apr 12 14:11:45 2012 -0500
Mode change on modicon_ladder.apx
commit c18b3d56efd639e461137acdc76b4b283fe978d4
Author: HD Moore <hd_moore@rapid7.com>
Date: Thu Apr 12 01:38:56 2012 -0500
The go faster button
commit ca2a67d51d6d4c7c3ca2e745f8b018279aef668a
Merge: 674ee09 b8129f9
Author: Tod Beardsley <todb@metasploit.com>
Date: Mon Apr 9 15:50:33 2012 -0500
Merge branch 'master-clone' into rails3-clone
Picking up Packetfu upstream changes, all pretty minor
commit 674ee097ab8a6bc9608bf377479ccd0b87e7302b
Merge: e9513e5 a26e844
Author: Tod Beardsley <todb@metasploit.com>
Date: Mon Apr 9 13:57:26 2012 -0500
Merge branch 'master-clone' into rails3-clone
Conflicts:
lib/msf/core/handler/reverse_http.rb
lib/msf/core/handler/reverse_https.rb
modules/auxiliary/scanner/discovery/udp_probe.rb
modules/auxiliary/scanner/discovery/udp_sweep.rb
Resolved conflicts with the reverse_http handlers and the udp probe /
scanners byt favoring the more recent changes (which happened to be the
intent anyway). The reverse_http and reverse_https changes were mine so
I know what the intent was, and @dmaloney-r7 changed udp_probe and
udp_sweep to use pcAnywhere_stat instead of merely pcAnywhere, so the
intent is clear there as well.
commit e9513e54f984fdb100c13b44a1724246779ccb76
Author: David Maloney <dmaloney@melodie.gateway.2wire.net>
Date: Fri Apr 6 18:21:46 2012 -0500
Some fixes to how services get reported to prevent issues with the web interface
commit adeb44e9aaf1a329a0e587d2b26e678398730422
Author: David Maloney <David_Maloney@rapid7.com>
Date: Mon Apr 2 15:39:46 2012 -0500
Some corrections to pcAnywhere discovery modules to distinguish between the two services
commit b13900176484fea8f5217a2ef925ae2ad9b7af47
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Mar 31 12:03:21 2012 -0500
Enable additional migration-path parameters, use a temporary directory to bring the database online
commit 526b4c56883f461417f71269404faef38639917c
Author: David Maloney <David_Maloney@rapid7.com>
Date: Wed Mar 28 23:24:56 2012 -0500
A bunch of Mdsm fixes for .kind_of? calls, to make sure we ponit to the right place
commit 2cf3143370af808637d164ce59400605300f922c
Author: HD Moore <hd_moore@rapid7.com>
Date: Mon Mar 26 16:22:09 2012 -0500
Check for ruby 2.0 as well as 1.9 for encoding override
commit 4d0f51b76d89f00f7acbce6b1f00dc6e4c4545ee
Author: HD Moore <hd_moore@rapid7.com>
Date: Mon Mar 26 15:36:04 2012 -0500
Remove debug statement
commit f5d2335e7745aa1a354f4d6c8fc9d0b3876c472a
Author: HD Moore <hd_moore@rapid7.com>
Date: Mon Mar 26 15:01:55 2012 -0500
Be explicit about the Mdm namespace
commit bc8be225606d6ea38dd2a85ab4310c1c181a94ee
Author: hdm <hdm@hypo.(none)>
Date: Mon Mar 26 11:49:51 2012 -0500
Precalculate some uri strings in case the 1000-round generation fails
commit 4254f419723349ffb93e4aebdaeabbd7d66bf8c0
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Sat Mar 24 14:03:44 2012 -0500
Removed some non-namespaced calls to Host
commit c8190e1bb8ad365fb0d7a1c4a9173e6c739be85c
Author: HD Moore <hd_moore@rapid7.com>
Date: Tue Mar 20 00:37:00 2012 -0500
Purge the rvmrc, this is causing major headaches
commit 76df18588917b7150a3bedf2569710a80bab51f8
Author: HD Moore <hd_moore@rapid7.com>
Date: Tue Mar 20 00:31:52 2012 -0500
Switch .rvmrc to the shipping 1.9.3 version
commit 7124971d0032b268f4ddf89aca125f15e284f345
Author: David Maloney <David_Maloney@rapid7.com>
Date: Mon Mar 12 16:56:40 2012 -0500
Adds mixin for looking up Mime Types by extension
commit b7ca8353164c43db6bacb2f3f16afa1269f66e43
Merge: a0b0c75 6b9a219
Author: Matt Buck <techpeace@gmail.com>
Date: Tue Mar 6 19:38:53 2012 -0600
Merge from develop.
commit a0b0c7528d2b8fabb76b2246a15004bc89239cf0
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Tue Mar 6 11:08:59 2012 -0600
Somehow migration file is new?
commit 84d2b3cb1ad6290413c3ea3222ddf9932270b105
Author: David Maloney <David_Maloney@rapid7.com>
Date: Wed Feb 29 16:38:55 2012 -0600
Added ability to specify headers to redirects in http server
commit e50d27cda83872c616722adb03dc1a6a5e685405
Author: HD Moore <hd_moore@rapid7.com>
Date: Sat Feb 4 04:44:50 2012 -0600
Tweak the event dispatcher to enable customer events without a category
and trigger http request events from the main exploit mixin.
Experimental
commit 0e4fd2040df49df2e6cb0e8d2c6240a03d108033
Author: Matt Buck <Matthew_Buck@rapid7.com>
Date: Thu Feb 2 22:09:05 2012 -0600
Change Msm -> Mdm in migrations. This is what was preventing migrations from finishing on first boot.
commit c94a2961d04eee84adfd42bb01ed7a3e3846b83a
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Wed Feb 1 12:48:48 2012 -0600
Changed Gemfile to use new gem name
commit 245c2063f06b4fddbfc607d243796669ef236136
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Wed Feb 1 12:47:42 2012 -0600
Did find/replace for final namespace of Mdm
commit 6ed9bf8430b555dcbe62daeddb2f33bd400ab5bc
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Tue Jan 24 10:47:44 2012 -0600
Fix a bunch of namespace issues
commit 2fe08d9e4226c27e78d07a00178c58f528cbc72e
Author: Matt Buck <Matthew_Buck@rapid7.com>
Date: Fri Jan 20 14:37:37 2012 -0600
Update Msm contstants in migrations for initial DB builds.
commit 4cc6b8fb0440c6258bf70de77a9153468fea4ea5
Author: Matt Buck <Matthew_Buck@rapid7.com>
Date: Fri Jan 20 14:37:25 2012 -0600
Update Gemfile.lock.
commit 1cc655b678f0a054a9a783da119237fe3f67faa4
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Thu Jan 19 11:48:29 2012 -0600
Errant Workspaces needed namespace
commit 607a78285582c530a68985add33ccf4d899c467a
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Tue Jan 17 15:44:02 2012 -0600
Refactored all models to use the new namespace
* Every model using DBManager::* namespace is now Msm namespace
* Almost all of this in msf/base/core
* Some in modules
commit a690cd959b3560fa2284975ca7ecca10c228fb05
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Tue Jan 17 13:41:44 2012 -0600
Move bundler setup
commit dae115cc8f7619ca7a827123079cb67fb4d9354b
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Mon Jan 9 15:51:07 2012 -0600
Moved ActiveSupport dep to gem
commit d32f8edb6e7f82079b775ffbc2b9a405d1f32b3b
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Mon Jan 9 14:40:05 2012 -0600
Removed model require file
commit d0c74cff8c44771e566ec63b03eda10d03b25c42
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Tue Jan 3 16:06:10 2012 -0600
Update some more finds
commit 4eb79ea6b58b74c309ab1f1bb0bd35fe9041de46
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date: Tue Jan 3 14:21:15 2012 -0600
Yet another dumb commit
commit a75febcb593d52fdfe930306b4275829759d81d1
Author: Trevor Rosen <trevor@catapult-creative.com>
Date: Thu Dec 29 19:20:51 2011 -0600
Fixing deletion
commit dc139ff2fdfc4e7cdee3901dfb863e70913d6b92
Author: Trevor Rosen <trevor@catapult-creative.com>
Date: Wed Dec 7 17:06:45 2011 -0600
Fixed erroneous commit
commit 531c1e611cf4d23aeb9c48350dabf7630d662d25
Author: Trevor Rosen <trevor@catapult-creative.com>
Date: Mon Nov 21 16:11:35 2011 -0600
Remove AR patch stuff; attempting to debug non-connection between MSF and Pro
commit 458611224189c7aa27e500aabd373d85dc2dc5c0
Author: Trevor Rosen <trevor@catapult-creative.com>
Date: Fri Nov 18 16:17:27 2011 -0600
Drop ActiveRecord/ActiveSupport in preparation for upgrade
commit 69bb41a8176fb814485225e0c3b0e1c44342e652
Author: matugm <matugm@gmail.com>
Date: Tue Jan 31 11:30:52 2012 +0100
indentation
commit 175d230a06dc58e2123f092d39f33063efdce83d
Author: matugm <matugm@gmail.com>
Date: Tue Jan 31 11:13:02 2012 +0100
Changed way of finding hive names so that it works with xp hives
Tod Beardsley
Jon Hart
William Vu
HD Moore
Christian Mehlmauer
sinn3r
Sagi Shahar
Rob Fuller
Joe Vennix
jvazquez-r7
Ethan Robish
Tab Assassin
James Lee
lsanchez-r7
jvazquez-r7
h0ng10
Brandon Turner
Trevor Rosen
Tod Beardsley
sinn3r
TADA Tadashi
Alexander Klink
Brandon Perry
matugm
Jonathan Cran