9ba0a72ea1
Rename file
2018-07-13 01:11:37 -05:00
e1e8444188
Clean up ruby code for CVE-2018-8897
2018-07-13 01:06:21 -05:00
a020d48caf
Move module documentation to documentation directory
2018-07-13 04:46:25 +00:00
f02c05e530
This one is the same as cve_2018_8897_exe.rb
2018-07-12 22:09:44 -05:00
c9001699cd
Land #10027 , Hadoop unauthed command execution
2018-07-12 21:58:49 -05:00
50252c75d6
Clean up module
...
With a little rubocop -a.
2018-07-12 21:58:00 -05:00
2f37482535
Land #10278 , gitlist_arg_injection fixes
2018-07-12 19:03:52 -05:00
9080b38dcc
Add Axis camera exploit (VDOO research)
2018-07-12 18:46:49 -05:00
e613b2570a
Land #10299 , Add 88 CVEs to various auxiliary and exploit modules
2018-07-12 18:26:07 -05:00
88bbc50104
Utilize uniq to make char array more readable
...
Hat tip @bcoles.
2018-07-12 17:59:12 -05:00
cfcb77afd0
Rename to please msftidy
2018-07-12 17:41:06 -05:00
3546286049
Add missed ARCH_CMD to top-level Arch array
...
It's not necessary because of targets, but it's required for printing.
2018-07-12 17:37:06 -05:00
1a3a4ef5e4
Revised 88 aux and exploit modules to add CVEs / references
2018-07-12 17:34:52 -05:00
156b822401
First stab at cve-2018-8897
2018-07-12 17:31:53 -05:00
4b62f41369
Add QNAP Q'Center change_passwd Command Execution exploit
2018-07-12 20:00:17 +00:00
3dda19f3c6
Update documentation in cmd/unix/reverse_bash
...
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=146464
https://bugs.launchpad.net/ubuntu/+source/bash/+bug/215034
2018-07-12 13:29:33 -05:00
1f0535618d
Document bareword string deprecation in php/base64
2018-07-12 13:29:33 -05:00
378930e5f4
Prefer %w array over quoted array in php/base64
...
irb(main):001:0> ["(",")",".","_","c","h","r","e","v","a","l","b","s","6","4","d","o"] == %w{( ) . _ c h r e v a l b s 6 4 d o}
=> true
irb(main):002:0>
2018-07-12 13:29:33 -05:00
904de2dd09
Land #10238 , Add ManageEngine Exchange Reporter Plus RCE exploit
2018-07-12 16:07:32 +00:00
486225c2a8
Code review changes
...
Use target_uri, split url inside normalize function, replace print with vprint, return CheckCode::Appears
2018-07-12 14:27:28 +02:00
acb20e5a29
Land #9780 , CouchDB auth bypass and RCE
2018-07-12 03:36:17 -05:00
a08420e0d0
Land #10286 , Docker server version scanner
2018-07-12 03:08:41 -05:00
cce3b6f369
Clean up module
2018-07-12 02:57:14 -05:00
f53080ee60
Fix exploit and do final cleanup
2018-07-12 02:13:30 -05:00
167745c124
Selectively add RuboCop fixes
2018-07-11 22:49:46 -05:00
ccc3267166
Correct rubocop -a
...
We'll update .rubocop.yml later.
2018-07-11 22:49:46 -05:00
ca5e496b8f
Run rubocop -a
2018-07-11 21:40:19 -05:00
7d8b9a90d7
Add more reporting
2018-07-11 17:22:48 -04:00
30c43e22d9
Fix typo
2018-07-11 17:04:31 -04:00
bb8ac4a7ab
Add info & update_info
2018-07-11 16:52:16 -04:00
1ded8ffb29
Land #10260 , Add phpMyAdmin v4.8.1/4.8.0 LFI RCE
2018-07-11 11:10:52 -05:00
c26fcc0af1
Merge branch 'master' into remote_creds_data
2018-07-11 10:27:49 -05:00
1f0045fa03
Improve Description
2018-07-11 01:27:10 -04:00
00f4d3967c
Add basic reporting
2018-07-11 00:47:43 -04:00
d488b51264
Use peer instead of ip & port
2018-07-11 00:41:55 -04:00
5a89642ddd
Simplify the module greatly
2018-07-11 00:15:56 -04:00
ffc2f044cc
Remove lines that were not required
2018-07-11 00:04:44 -04:00
7b1e7eb085
Minor improvement to description
2018-07-11 00:04:12 -04:00
2b2029b487
Align Hashrockets
2018-07-11 00:03:26 -04:00
9491c63778
Fix several minor details
2018-07-10 23:56:05 -04:00
66c207a124
Remove timeout of 25 seconds
2018-07-10 23:53:13 -04:00
718606c9f2
Add Auxiliary module to enumerate the Docker Server Version
2018-07-10 19:34:49 -04:00
ef3ea2dd44
Land #10280 , Use default CheckCode in ETERNALBLUE
2018-07-10 17:39:42 -05:00
10cd6c99d9
Land #10231 , Monstra Fileupload Exec
2018-07-10 14:23:15 -05:00
07dca243ff
changed grammar, removed redundant code
2018-07-10 14:13:57 -05:00
1af360d7e0
Land #10108 , add IBM QRadar SIEM exploit
2018-07-10 11:52:32 -05:00
171fa562a3
added parsing for repos in Gitlist source
2018-07-10 11:32:46 -05:00
f64c9588e9
Undefine check method and let the base class do it
...
Preserve the to-do without rewording - should be enough.
2018-07-10 11:05:00 -05:00
1fddbdb8ef
Specify the `command` option external modules
2018-07-10 10:24:07 -05:00
533d87efa4
Return CheckCode::Unsupported in ETERNALBLUE
...
Defining a check method in the module overrides it.
2018-07-09 16:01:24 -05:00
5776b64a1b
modified exploit
2018-07-09 13:56:33 -05:00
64ec8e96cb
Land #10275 , Update missing CVE references for exploit modules
2018-07-09 13:26:18 -05:00
f5e40b14a3
removed double eval as suggested
2018-07-09 13:24:31 -05:00
4f039de2fc
Fix CVE numbers
2018-07-09 13:22:08 -05:00
4403a4ab47
Fix CVE number
2018-07-09 12:56:00 -05:00
7d8a95de9f
Fixed requested changes for PR
2018-07-09 12:44:38 -05:00
44b9798afb
modified regex, id=filesmanager lines
2018-07-09 10:55:29 -05:00
bbc16e1873
Merge branch 'master' into remote_creds_data
2018-07-09 09:49:14 -05:00
bf24ce847a
Fix token issues
2018-07-09 09:29:11 -05:00
bc33078e01
fixed comma
...
fixed comma
2018-07-09 12:27:58 +05:30
6f6ad86e2c
fix tab
...
fix tab and space.
2018-07-09 11:49:11 +05:30
aff39e65d5
Update missing CVE references for auxiliary modules
...
Based on existing references such as BID, OSVDB, blog posts, etc
2018-07-08 19:00:11 -05:00
5fc5a47cd2
Update CVE references for exploit modules
...
These are based on cross references by EDB, OSVDB, module short
name, blog post and BID.
2018-07-08 18:46:04 -05:00
a634e6347d
minor code cleanup
2018-07-08 06:09:38 +00:00
4a835b2493
fix warning, and version
...
fix warning, and version and indentation
2018-07-07 17:27:09 +05:30
1c448de882
Land #10107 , Add the scanner/smb/impacket/secretsdump module
2018-07-06 14:59:33 -05:00
b5fb970aec
Land #10133 , Add HID discoveryd RCE exploit
2018-07-06 14:32:29 -05:00
545e91af00
Land #10262 , Add GitList argument injection exploit module
2018-07-06 14:28:20 -05:00
82c74eb765
Small changes
2018-07-06 14:25:58 -05:00
b1456df757
made suggested changes
2018-07-06 12:48:38 -05:00
fe1b17684a
Add Targets and Session file inclusion
2018-07-06 12:17:26 -05:00
b4b7bf03da
Land #10171 , Implement desktop shell and screensaver post modules
2018-07-05 17:33:06 -05:00
970c164e06
fix undefined method capitalize error for array
2018-07-05 14:33:51 -07:00
5d0652fab1
changed inconsistent capitalization
2018-07-05 15:56:41 -05:00
2b452d5681
added documentation and check
2018-07-05 15:47:21 -05:00
cb078b9586
Drop database
2018-07-05 14:58:30 -05:00
05a0d79be7
Land #10219 , Add HP VAN SDN Controller exploit
2018-07-05 14:21:44 -05:00
43096d9d78
Add phpMyAdmin v4.8.1/4.8.0 LFI RCE
...
Module and Doc
2018-07-05 13:33:35 -05:00
53d5d82498
Rename module to match new vector
2018-07-05 13:31:16 -05:00
507fd22958
added http post and generating payload
2018-07-05 13:21:22 -05:00
762b4b5e53
Simplify creds auth by checking X-Auth-Token alone
...
It's a lot more direct than checking for the redirect.
2018-07-05 13:20:27 -05:00
2b069f45ca
Clarify how we're using the auth token for creds
...
In the service token's case, the service token *is* the auth token.
2018-07-05 13:05:23 -05:00
b00f0e87e0
Add SonicWall XML-RPC Remote Code Execution exploit module
2018-07-05 12:06:13 -05:00
a272dcabd7
Fix typos and additional updates regarding to review
2018-07-05 13:33:40 +01:00
3b8149216f
print a verbose error message
2018-07-04 23:20:58 +01:00
4c1c2e9288
Adding Micro Focus Secure Messaging Gateway RCE
2018-07-04 17:47:13 +01:00
41b0adad88
Use uninstall action command injection
2018-07-03 18:07:22 -05:00
7d0b8dee4a
making request for Gitlist source
2018-07-03 14:27:46 -05:00
a25a656d28
Add "E" to HP to make HPE for better searches
...
We'll stick with calling it HP everywhere else.
2018-07-03 10:29:09 -05:00
e1a9aae109
Add Wordress Arbitrary File Deletion module
2018-07-03 12:21:38 +02:00
5946245d87
avoid using SMBv2 on Windows XP Native Upload targets
2018-07-02 16:07:27 -05:00
2ec091931a
Land #10237 , Add Boxoft WAV to MP3 Converter exploit module
2018-07-02 14:01:27 -05:00
3e33a6f0a4
Update moduel boxoft_wav_to_mp3
2018-07-02 14:00:33 -05:00
1bf94ac448
Spruce up check method and related
2018-07-02 13:59:24 -05:00
12141136d7
Land #9896 , Java JMX Package Name Randomization
...
Land #9896
2018-07-02 13:41:39 -05:00
6e090acc76
Stop joking with timeouts
2018-07-02 13:18:31 -05:00
78ca4d4217
Finally use Msf::Util::EXE.to_zip 8)
2018-07-02 13:04:59 -05:00
2196640de4
Add manageengine_adshacluster_rce
...
Manage Engine Exchange Reporter Plus <= 5310 Unauthenticated RCE
2018-07-02 19:11:08 +02:00
54fce378fa
added target versions to documentation
2018-07-02 09:20:17 -05:00
aa3fcea377
update check method to print error message normaliy
2018-07-01 23:17:34 -04:00
c3b71d4642
Update mismatch indentation and others
2018-07-01 22:43:07 -04:00
70eb943b5a
Update monstra_fileupload_exec.rb
2018-06-30 13:40:12 +05:30
89ba960309
username and password values removed
...
username and password values removed
2018-06-30 12:47:13 +05:30
128438f444
Merge pull request #2 from touhidshaikh/monstra_fileupload_exec
...
Monstra fileupload exec
2018-06-30 12:03:14 +05:30
6ace45e312
Add correct IBM CVE
...
Turns out IBM decided to revisit the advisory and attribute 3 different CVE numbers intead of 1.
2018-06-30 12:06:16 +07:00
85dc81a58b
Land #10185 , add SMBv1/2 support in psexec
2018-06-29 17:49:27 -05:00
3b5555542c
add exploit module and documentation
2018-06-29 15:17:12 -05:00
78cefe0528
Clarify original exploit credit
...
It's definitely more than a PoC (exploit). It's weaponized.
2018-06-29 13:02:40 -05:00
34f303187f
Drop privesc retval, since it's obsoleted by print
2018-06-29 12:53:59 -05:00
fc3199259b
Land #9958 , Nagios xi 2 electric
2018-06-29 12:16:18 -05:00
dbb502ae19
Refactor code and address review comments
2018-06-29 12:13:15 -05:00
675a736ab7
Update Docs
2018-06-29 11:08:31 -05:00
574c47cba6
Change Ranking
...
Command to change the database user
account could cause a DoS condition
if the credentials are incorrect.
2018-06-29 10:56:18 -05:00
57b89444f3
Additional style fixes
2018-06-29 10:53:57 -05:00
c508a5f7f3
Land #10213 , Add FTPShell client 6.70 Stack Buffer Overflow exploit
2018-06-29 14:40:51 +00:00
1e148a8862
Update ftpshell_cli_bof.rb
2018-06-29 14:22:40 +01:00
7532490a1e
Style/Whitespace fixes
2018-06-29 07:02:45 -05:00
40ac79ced0
Land #10218 , MS17-010 Windows Embedded Standard 7
2018-06-28 16:11:56 -05:00
1854793253
Update ftpshell_cli_bof.rb
2018-06-28 13:01:13 +01:00
bd2fb56adf
Update ftpshell_cli_bof.rb
2018-06-28 12:55:48 +01:00
36a37cf6ab
Add HP VAN SDN Controller exploit
2018-06-28 02:14:04 -05:00
f3e3d0c30b
monstra_fileupload_exec.rb
...
Monstra CMS - Authenticated Arbitrary File Upload / Remote Code Execution CVE 2017-18048
2018-06-28 10:55:41 +05:30
a5c0881c08
add Windows Embedded Standard 7 support
2018-06-27 19:17:18 -06:00
54c2bc36e9
fix: invert if else order
2018-06-28 01:33:56 +02:00
e614805948
chore: fix msftidy
2018-06-28 01:27:51 +02:00
2a31958f6a
Bump metasploit_payloads-mettle to version 0.4.1
2018-06-27 17:55:08 -04:00
e17744df8d
Land #10215 , add support for payload estimation for IPv6-specific modules
2018-06-27 16:46:54 -05:00
25b9f97a32
Update cached payload size update to support IPv6
2018-06-27 16:26:41 -05:00
dbb0748c1c
Land #9998 , customizable golden ticket duration
2018-06-27 15:51:56 -05:00
d7770a98b2
s/Seperated/Separated/
2018-06-27 15:36:41 -05:00
ce7d4cd280
Land #10109 , Teradata login scanner and SQL runner
2018-06-27 15:35:57 -05:00
9d8294fcc9
Mark Teradata login scanner executable
2018-06-27 15:35:13 -05:00
8b2bd35659
Fixup option references in Teradata SQL
2018-06-27 15:34:29 -05:00
1dbcf0fd09
Cleanup Teradata SQL options
2018-06-27 15:12:21 -05:00
3985191e0f
Add `userpass` option to Teradata login scanner
2018-06-27 15:10:02 -05:00
ef309e0d5f
Fixup metadata whitespace
2018-06-27 15:09:23 -05:00
837427ccae
Update ftpshell_cli_bof.rb
2018-06-27 16:42:29 +01:00
4a4e38a7b0
FTPShell client 6.70 (Enterprise edition)
2018-06-27 16:37:22 +01:00
da22b36997
chore: fix typo
2018-06-27 17:16:38 +02:00
53f158ef4f
refactor: universal check, payload platform check
2018-06-27 17:11:47 +02:00
9c38c9f63c
Land #10207 , msftidy fixes
2018-06-26 14:38:57 -05:00
c5e7184fdb
Land #10199 , Kace Systems Management Command Injection
2018-06-26 10:11:10 -05:00
c4bf12cbe0
ntds_grabber msftidy fixes
2018-06-26 08:22:11 -05:00
00102a7413
oscommerce msftidy fix
2018-06-26 08:21:10 -05:00
76535b5e51
Check hidden val && check auth requirement
2018-06-25 17:24:13 -05:00
2fd0d797ac
psexec smb2 support
2018-06-25 15:06:23 -05:00
10c36bbd7d
modified get_creds, renamed make_request
2018-06-25 12:45:06 -05:00
81bdbd712c
added disclosureDate and modified style
2018-06-22 15:58:21 -05:00
510c2d04ef
add auxiliary module and documentation - SickRage
2018-06-22 11:18:02 -05:00
6d3c141553
Update patched version check
2018-06-22 15:08:19 +00:00
Wei Chen
Brendan Coles
William Vu
bwatters-r7
asoto-r7
Kacper Szurek
Agora Security
Shelby Pace
James Barnett
Erin Bleiweiss
Brent Cook
Adam Cammack
Jacob Robles
flandini
Touhid M Shaikh
thesubtlety
Mehmet İnce
Aloïs Thévenot
Green-m
Ishaq Mohammed
Pedro Ribeiro
Daniel Teixeira
zerosum0x0
phra
Matthew Kienow