infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
20,557 Commits
7 Branches
556 Tags
421 MiB
Commit Graph

1061 Commits (8d50cc5099cec0559cedc6a4eaa0009023e4a4ab)

Author SHA1 Message Date
jvazquez-r7 4a92cc4641 jboss_invoke_deploy module cleanup 2012-09-04 18:49:11 +02:00
jvazquez-r7 cb40a0c362 Merge branch 'jboss-jmx-invoke-deploy' of https://github.com/h0ng10/metasploit-framework into h0ng10-jboss-jmx-invoke-deploy 2012-09-04 18:47:30 +02:00
sinn3r b3bfaec089 Add reference about the patch 2012-09-03 23:58:21 -05:00
sinn3r 9d97dc8327 Add Metasploit blogs as references, because they're useful. 2012-09-03 15:57:27 -05:00
h0ng10 2b6aa6bbdb Added Exploit for deployfilerepository via JMX 2012-09-03 13:50:16 -04:00
sinn3r f48fbaccb0 Add Oracle's security alert 2012-08-30 14:04:16 -05:00
sinn3r 4758eb0dc3 Merge branch 'jvazquez-r7-taget_host_glassflish_deployer' 2012-08-30 12:18:02 -05:00
jvazquez-r7 f99982a85e added java as platform to avoid confussion between target and payload 2012-08-30 18:39:20 +02:00
jvazquez-r7 4fd9f88304 avoid the redefinition of Module.target_host 2012-08-30 14:45:14 +02:00
sinn3r 5f64c55112 Update description 2012-08-29 11:10:35 -05:00
jvazquez-r7 363c0913ae changed dir names according to CVE 2012-08-28 16:33:01 +02:00
sinn3r 34b12c4f55 Update CVE/OSVDB refs 2012-08-28 01:21:32 -05:00
jvazquez-r7 6e2369680b Safari added 2012-08-28 02:04:03 +02:00
jvazquez-r7 30fd2cf256 Description updated 2012-08-28 02:01:26 +02:00
sinn3r 7e579db705 Add AlienVault reference 2012-08-27 13:29:27 -05:00
sinn3r 15a87a79f8 Add mihi's analysis 2012-08-27 13:24:43 -05:00
jvazquez-r7 52ca1083c2 Added java_jre17_exec 2012-08-27 11:25:04 +02:00
sinn3r 7ddcc787bd Merge branch 'jboss-exploits-revision2' of https://github.com/h0ng10/metasploit-framework into h0ng10-jboss-exploits-revision2 2012-08-21 14:37:09 -05:00
h0ng10 c6b9121f8b Added support for CVE-2010-0738 2012-08-15 15:47:44 -04:00
h0ng10 6965431389 Added support for CVE-2010-0738, msftidy 2012-08-15 15:47:14 -04:00
h0ng10 e5498e3e1d Added fix for CVE-2010-0738, corrections 2012-08-15 15:46:34 -04:00
Tod Beardsley 0e4e7dc903 Indentation fix 2012-08-14 12:27:27 -05:00
Tod Beardsley 6597d25726 Shortening an over-200 long line for readability 
It's a contrived fix, but scrolling over is a hassle. This comes up a
lot in long regexes, not sure the best way to address these.
 2012-08-14 12:27:27 -05:00
jvazquez-r7 d6b28dc44d ranking changed plus on_new_session handler added 2012-08-13 19:29:13 +02:00
jvazquez-r7 468030786f small fixes, mainly check res agains nil, res.code and use send_request_cgi 2012-08-13 18:57:59 +02:00
bcoles 8bb3181f68 Add TestLink v1.9.3 arbitrary file upload module 2012-08-13 16:30:10 +09:30
sinn3r b46fb260a6 Comply with msftidy 
*Knock, knock!*  Who's there? Me, the msftidy nazi!
 2012-08-07 15:59:01 -05:00
sinn3r ddcee6fee0 And the war between spaces and tabs goes on.... 2012-08-07 12:36:53 -05:00
jvazquez-r7 fb452d75a3 Added module for pbot RCE 2012-08-07 19:20:32 +02:00
Steve Tornio b646dcc87f add osvdb ref 2012-08-05 09:02:32 -05:00
Tod Beardsley d5b165abbb Msftidy.rb cleanup on recent modules. 
Notably, DisclosureDate is required for other module parsers, so let's
not ignore those, even if you have to guess at the disclosure or call
the module's publish date the disclosure date.
 2012-08-04 12:18:00 -05:00
h0ng10 8872ea693c real support for cve-2010-0738/verb bypass 2012-08-03 14:22:40 -04:00
h0ng10 52b1919315 Additional cleanups, verb tampering 2012-08-02 17:33:17 -04:00
sinn3r 9815faec37 Add OSVDB-83822 2012-07-31 13:31:06 -05:00
h0ng10 36be7cd9c4 removed unnecessary cleanup 2012-07-27 16:32:08 -04:00
sinn3r d67234bd03 Better regex and email format correction 2012-07-27 01:14:32 -05:00
sinn3r 2939e3918e Rename file 2012-07-27 01:06:57 -05:00
bcoles cec15aa204 Added CuteFlow v2.11.2 Arbitrary File Upload 
- modules/exploits/multi/http/cuteflow_2.11.2_upload_exec.rb
 2012-07-27 12:30:20 +09:30
HD Moore b133428bc1 Better error handling in two web app modules 2012-07-15 21:56:00 -05:00
jvazquez-r7 6c8ee443c8 datastore cleanup according to sinn3r 2012-07-12 09:31:22 +02:00
jvazquez-r7 65d15df9f9 Merge branch 'jboss-revision' of https://github.com/h0ng10/metasploit-framework into h0ng10-jboss-revision 2012-07-12 09:25:37 +02:00
h0ng10 87f5002516 added datastore cleanup 2012-07-11 12:56:23 -04:00
h0ng10 0d38a7e45f switched to Rex::Text.encode_base64() 2012-07-11 12:52:09 -04:00
LittleLightLittleFire 32fa8bdfcf Fixed typo in Stefan's last name 2012-07-11 14:53:26 +10:00
h0ng10 61ec07a10c additional targets, meterpreter, bugfixes 2012-07-10 13:33:28 -04:00
sinn3r 5b7d1f17c0 Correct juan's name and comments 2012-07-10 00:43:46 -05:00
sinn3r 54576a9bbd Last touch-up 
The contents of this pull request are very similar to what the msf
dev had in private, so everybody is credited for the effort.
 2012-07-10 00:37:07 -05:00
LittleLightLittleFire e9ac90f7b0 added CVE-2012-1723 2012-07-10 12:20:37 +10:00
sinn3r e2a2789f78 Support Ruby 1.8 syntax. Thanks M M. 2012-07-02 14:15:14 -05:00
sinn3r cf9a6d58cc Update missing OSVDB ref 2012-06-28 00:44:01 -05:00
sinn3r e605a35433 Make sure the check func is always returning the same data type 2012-06-27 17:07:55 -05:00
sinn3r cb1af5ab79 Final cleanup 2012-06-27 16:57:04 -05:00
jvazquez-r7 73360dfae3 minor fixes 2012-06-27 23:38:52 +02:00
jvazquez-r7 245205c6c9 changes on openfire_auth_bypass 2012-06-27 23:15:40 +02:00
jvazquez-r7 6ec990ed85 Merge branch 'Openfire-auth-bypass' of https://github.com/h0ng10/metasploit-framework into h0ng10-Openfire-auth-bypass 2012-06-27 23:09:26 +02:00
h0ng10 6cc8390da9 Module rewrite, included Java support, direct upload, plugin deletion 2012-06-26 11:56:44 -04:00
HD Moore e31a09203d Take into account an integer-normalized datastore 2012-06-24 22:59:14 -05:00
h0ng10 65197e79e2 added Exploit for CVE-2008-6508 (Openfire Auth bypass) 2012-06-24 07:35:38 -04:00
HD Moore d40e39b71b Additional exploit fail_with() changes to remove raise calls 2012-06-19 19:43:41 -05:00
HD Moore 664458ec45 No more crap :/ 2012-06-19 19:43:29 -05:00
HD Moore fb7f6b49f0 This mega-diff adds better error classification to existing modules 2012-06-19 12:59:15 -05:00
Tod Beardsley ae59f03ac9 Fixing print message in snort module 2012-06-13 14:04:05 -05:00
sinn3r a631e1fef1 Change the default state to make it work on Metasploitable by default 2012-06-13 00:43:59 -05:00
sinn3r 597726d433 Merge branch 'php_cgi_arg_injection' of https://github.com/jjarmoc/metasploit-framework into jjarmoc-php_cgi_arg_injection 2012-06-13 00:40:02 -05:00
Jeff Jarmoc bbfe0f8f49 " is 0x22, duh. 2012-06-12 20:00:28 -05:00
Jeff Jarmoc 12a28bd519 Fixed ruby 1.9 String Indexing issue, using Rex::Text.uri_encode 2012-06-12 14:59:06 -05:00
sinn3r c3c9051014 Merge branch 'php_cgi_arg_injection' of https://github.com/jjarmoc/metasploit-framework into jjarmoc-php_cgi_arg_injection 2012-06-11 11:15:15 -05:00
jvazquez-r7 02a5dff51f struts_code_exec_exception_delegator_on_new_session: on_new_session modified 2012-06-11 12:07:38 +02:00
Michael Schierl b4d33fb85a Add ARCH_JAVA support to struts_code_exec_exception_delegator 2012-06-09 21:53:43 +02:00
sinn3r a709fe1fe3 Fix regex escaping thanks to w3bd3vil 2012-06-07 16:00:59 -05:00
sinn3r 462a91b005 Massive whitespace destruction 
Remove tabs at the end of the line
 2012-06-06 00:44:38 -05:00
sinn3r a3048c7ae8 Clear whitespace 2012-06-05 11:28:47 -05:00
0a2940 dc6b2f4205 merged unstable-modules/exploits/incomplete/linux/ids/snortdcerpc.rb with exploits/windows/ids/snort_dce_rpc.rb 2012-06-05 04:14:40 -07:00
sinn3r a071d2805e Fix the rest of possible nil res bugs I've found 2012-06-04 14:56:27 -05:00
jvazquez-r7 b53a1396fc Use of TARGETURI 2012-06-03 22:36:23 +02:00
jvazquez-r7 659b030269 Verbose messages cleanup 2012-06-03 22:29:31 +02:00
jvazquez-r7 34f42bab17 Fix typo in the URI param 2012-06-03 22:14:13 +02:00
jvazquez-r7 efe4136e5b Added module for CVE-2012-0391 2012-06-03 22:08:31 +02:00
sinn3r 1817942aae Merge branch 'logcms_writeinfo' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-logcms_writeinfo 2012-06-02 17:43:51 -05:00
sinn3r 7bb36bfbde Fix typo thanks to juan 2012-06-02 16:57:53 -05:00
sinn3r 7e318e9787 Merge branch 'logcms_writeinfo' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-logcms_writeinfo 2012-06-02 14:14:56 -05:00
Christian Mehlmauer 3752c10ccf Adding FireFart's RPORT(80) cleanup 
This was tested by creating a resource script to load every changed
module and displaying the options, like so:

````
use auxiliary/admin/2wire/xslt_password_reset
show options
use auxiliary/admin/http/contentkeeper_fileaccess
show options
````

...etc. This was run in both the master branch and FireFart's branch
while spooling out the results of msfconsole, then diffing those
results. All modules loaded successfully, and there were no changes to
the option sets, so it looks like a successful fix.

Thanks FireFart!

Squashed commit of the following:

commit 7c1eea53fe3743f59402e445cf34fab84cf5a4b7
Author: Christian Mehlmauer <FireFart@gmail.com>
Date:   Fri May 25 22:09:42 2012 +0200

    Cleanup Opt::RPORT(80) since it is already registered by Msf::Exploit::Remote::HttpClient
 2012-06-02 09:53:19 -05:00
sinn3r 59468846e3 Change filename 2012-06-02 01:51:20 -05:00
sinn3r 522991f351 Correct name 2012-06-02 01:49:43 -05:00
sinn3r 7fd3644b8b Add CVE-2011-4825 module 2012-06-01 18:45:44 -05:00
James Lee 4681ed1c1e Whitespace, thanks msftidy.rb! 2012-05-31 18:18:27 -06:00
Steve Tornio 5105c1a4df add osvdb ref 2012-05-31 08:49:58 -05:00
Tod Beardsley 7e6c2f340e Minor updates; added BID, fixed grammar 
Modules should not refer to themselves in the first person unless they
are looking for Sarah Connor.
 2012-05-30 16:16:41 -05:00
sinn3r 54e14014c3 Merge pull request #428 from wchen-r7/php_volunteer 
Add PHP Volunteer Management System exploit
 2012-05-30 09:33:32 -07:00
sinn3r 59ea8c9ab9 Print IP/Port for each message 2012-05-30 11:30:55 -05:00
sinn3r 43dffbe996 If we don't get a new file, we assume the upload failed. This is 
possible when we actually don't have WRITE permission to the
'uploads/' directory.
 2012-05-30 11:26:06 -05:00
sinn3r efdcda55ef Don't really care about the return value for the last send_request_raw 2012-05-30 11:00:31 -05:00
sinn3r 13ba51db34 Allow the login() function to be a little more verbose for debugging purposes 2012-05-30 10:56:59 -05:00
sinn3r b81315790d Add PHP Volunteer Management System exploit 2012-05-30 10:38:45 -05:00
sinn3r ac0d22453a Merge pull request #414 from wchen-r7/apprain 
Add CVE-2012-1153
 2012-05-23 16:34:30 -07:00
sinn3r 8d837f5d20 Module description update. TARGETURI description update. 2012-05-23 18:33:32 -05:00
sinn3r fab3bfcea1 Add CVE-2012-1153 2012-05-23 17:50:13 -05:00
Tod Beardsley 87ce3fe2f7 Adding extra ref from jjarmoc 2012-05-22 11:17:57 -05:00
Tod Beardsley 1104dccde8 Noting rhost/rport, cli.peerhost where appropriate 
There's no msftidy check for this, and it's irritating to have to
remember to do this all the time.
 2012-05-21 11:19:02 -05:00
Tod Beardsley 7cc905832e Consistent caps on SVG in batik_svg_java exploit 
Also, modules should not refer to themselves as "I" or "me." It's
creepy.
 2012-05-21 11:14:03 -05:00
Tod Beardsley 5dd866ed4a Fixed print_status to include rhost:rport 
Also don't let the failed user:pass be a mystery to the user.
 2012-05-21 11:11:34 -05:00
Tod Beardsley 1fc7597a56 Msftidy fixes. 
Fixed up activecollab_chat, batik_svg_java, and foxit_reader_launch

All whitespace fixes.
 2012-05-21 10:59:52 -05:00
Steve Tornio ba2787df8a add osvdb ref 2012-05-20 07:13:56 -05:00
Steve Tornio c95a06e247 add osvdb ref 2012-05-20 07:13:31 -05:00
sinn3r 628233d15c Merge pull request #399 from wchen-r7/hp_storageworks 
Add HP StorageWorks VSA command execution vulnerability
 2012-05-19 14:14:49 -07:00
sinn3r d8c3edd316 Add HP StorageWorks VSA command execution vulnerability 2012-05-19 14:53:45 -05:00
sinn3r 964a6af423 Add Active Collab chat module PHP injection exploit, by mr_me 2012-05-19 02:06:30 -05:00
sinn3r 2fccf4674f Be explicit on what version we've tested 2012-05-17 11:04:40 -05:00
jvazquez-r7 0fd3f96720 errata fixed 2012-05-17 17:23:16 +02:00
jvazquez-r7 14d8ba00af Added batik svg java module 2012-05-17 16:48:38 +02:00
jlee-r7 fe7928c18d Merge pull request #390 from jlee-r7/consolidate-250-254-375 
Consolidate #250, #254, #375
 2012-05-16 17:07:33 -07:00
sinn3r 0b2a8e0b70 Correct e-mail format 2012-05-16 02:40:39 -05:00
James Lee 42719ab34b Squashed commit of the following: 
commit 6a3ad1d887df9d277e4878de94f8700ed8e404f9
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 16:22:49 2012 -0600

    Add register_command calls for md5 and sha1

commit dbd52c5a1edfe1818a580d4d46aac0a9ca038e9c
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 16:22:09 2012 -0600

    Read the file instead of downloading it

commit 55b84ad8e2a8532b3f8520ccb1162169b8e9c056
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 15:27:11 2012 -0600

    Re-compile linux meterp to support the loadlib api

commit d112e84e490aa30aa9533fb0bdb33a9713ce01a5
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 14:50:25 2012 -0600

    Re-compile java meterp to support the loadlib api

commit c137187b346b708487245a849b95343223e4e7b0
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 14:44:10 2012 -0600

    Don't try to get interfaces if this session doesn't implement it

commit 88bba1e6c360c5725c4174623f56bcb6d8b54228
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 14:38:17 2012 -0600

    Remove debugging load

commit 02954cbf93e2a13da967780cb703103b3f83ecf4
Merge: d9ef256 88b35a3
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 12:06:53 2012 -0600

    Merge branch 'rapid7' into feature/4905

    Conflicts:
    	data/meterpreter/ext_server_stdapi.php
    	modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb

commit d9ef2569b88ae8bce67f13316f6eff76311fd846
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 2 18:06:06 2012 -0600

    PHP doesn't support rev2self

commit bf13ea0ff25541da07b8c099218e5ad7ea6ae8ba
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 18:21:59 2012 -0600

    Add php support for returning new extension commands

commit 7e35f2d671d3797fc3fab12e54015387f44b0b33
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 16:03:26 2012 -0600

    Reset CVE-2012-0507 back to master

    Purges commits unrelated to this branch.

commit 86a77b3cd017e1e3a3f23d9fba3b9ed173761f80
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 15:59:35 2012 -0600

    Revert "Make building the jar for cve-2012-0507 a bit easier"

    This reverts commit 27ef76522ad10436ec785728445ed2cc0657f85f.

    Conflicts:

    	external/source/exploits/CVE-2012-0507/Makefile
    	external/source/exploits/CVE-2012-0507/src/msf/x/PayloadX.java

commit 8c259fb779f736be16fe972215ddff1dd32fd0f3
Merge: fe2c273 1c03c2b
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 15:35:44 2012 -0600

    Merge branch 'rapid7' into feature/4905

    Conflicts:
    	data/meterpreter/ext_server_stdapi.jar
    	data/meterpreter/meterpreter.jar
    	external/source/meterpreter/java/src/meterpreter/com/metasploit/meterpreter/Meterpreter.java
    	modules/auxiliary/server/browser_autopwn.rb

commit fe2c273a6d840c67040d6c9e337f908204337e18
Merge: 8caff47 4e955e5
Author: James Lee <egypt@metasploit.com>
Date:   Fri Apr 6 10:19:53 2012 -0600

    Merge branch 'rapid7' into feature/4905

commit 8caff47d97469f1a5459c04461fd1098487ea514
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 17:51:18 2012 -0600

    Fix requires to find the test library

commit 51c33574cee3c47f0b2900c388d3d1213dd0a90d
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 17:48:35 2012 -0600

    Fix a load order problem with solaris post mods

commit 81b658362e5e6bdd215d18b53d14429d163aff72
Merge: adad2cf 6ef4257
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 15:43:19 2012 -0600

    Merge branch 'master' into feature/4905

commit 6ef42579471c6fde4bba71d0d4ce2c6c3e836180
Merge: 70ab8c0 5852455
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 15:16:56 2012 -0600

    Merge branch 'rapid7'

    Conflicts:
    	lib/rex/exploitation/javascriptosdetect.rb

commit adad2cf04c501c2a787e5475b62abd31871c06a0
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 20:20:21 2012 -0600

    Deal with null data/jar

    Not sure why "" turns into null sometimes, but it was breaking shells;
    this fixes it.

commit 4f8a437b490e2b2774f9efd23b4891eaf007cf16
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:10:59 2012 -0600

    Prev commit moved these to src/a

commit 27ef76522ad10436ec785728445ed2cc0657f85f
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:08:32 2012 -0600

    Make building the jar for cve-2012-0507 a bit easier

    Mostly stolen from cve-2008-5353

commit db3dbad0a5ff20b05758be073c3502138ff095c2
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 14:52:23 2012 -0600

    Fix incorrect option name

commit 776976af31795bdf1b405e208a2d4b78a6b6c2cf
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:36:20 2012 -0600

    Add bap support to java_rhino

commit a611ab16e06bd324d6616d0bd69f2c09d671bca0
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:35:16 2012 -0600

    Put next_exploit on the window object so it's always in scope

    Solves some issues with Chrome not running more than one exploit

commit 5114d35de7c2f234ac7fe4288b344d4f2bb9731f
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 14:31:53 2012 -0600

    Pull common stuff up out of the body

commit 748309465a029593e2fe2fd445149745367513f4
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:04:03 2012 -0600

    Fix indentation level

commit 954d485e3b8ffea9a7451bd495c1956a098e0eda
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:02:42 2012 -0600

    Abstract out copy-pasted methods

    Need to do the same thing for OSX, but it's a different implementation.

commit cba8d7c911fb184f6358948022fd4a0e010878d0
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 23 18:04:50 2012 -0600

    Linux doesn't implement (drop|steal)_token

commit 1cfda3a7b045c08ecfae1ad688e0124e76bd0c8f
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 23 17:57:37 2012 -0600

    Add availability checks for net, sys, ui, and webcam

commit 4bdf39a8bf4b5aab293fc47cb8282d0346db0811
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 23 16:45:59 2012 -0600

    add requirement checking for fs and core commands

commit 42e35971c9f7348b57293b2b94a42dd0260ac7e4
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 21 17:20:59 2012 -0600

    Add a to_octal method that converts e.g. "A" to \0101

commit c3b9415a0a9e2b55b1effbaf2396e11f88301aaa
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 21 17:20:07 2012 -0600

    Don't use "echo -n"

    It's not portable

commit b0f3ceccfaedbeaf67fbbe76f1a0a9aec7b44548
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 20 17:01:10 2012 -0600

    Return a list of new commands after core_loadlib, java version

    Thanks mihi for the patch and the awesome responsiveness!

commit d65303e1b6458bd4b95138dc0d61e5354c4e8d3a
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 20 13:21:06 2012 -0600

    Make sure we have a response before doing stuff with it

commit 721001ead474a17d1a16de543f78b548879f5e7e
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 21:25:31 2012 -0600

    Add missing rmdir and mkdir protocol commands to PHP

    Now passes all the stdapi tests that it can
    	[*] Session type is meterpreter and platform is php/php
    	[+] should return a user id
    	[+] should return a sysinfo Hash
    	[-] FAILED: should return network interfaces
    	[-] Exception: Rex::Post::Meterpreter::RequestError : stdapi_net_config_get_interfaces: Operation failed: 1
    	[-] FAILED: should have an interface that matches session_host
    	[-] Exception: Rex::Post::Meterpreter::RequestError : stdapi_net_config_get_interfaces: Operation failed: 1
    	[-] FAILED: should return network routes
    	[-] Exception: Rex::Post::Meterpreter::RequestError : stdapi_net_config_get_routes: Operation failed: 1
    	[+] should return the proper directory separator
    	[+] should return the current working directory
    	[+] should list files in the current directory
    	[+] should stat a directory
    	[+] should create and remove a dir
    	[+] should change directories
    	[+] should create and remove files
    	[+] should upload a file
    	[-] Passed: 10; Failed: 3

commit 024e99167a025f4678a707e1ee809a1524007d4d
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 15:26:00 2012 -0600

    Use a proper TLV type instead of a generic one

commit 1836d915cbe0bfd2f536a667e74d8d6a6ccee72a
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 15:24:25 2012 -0600

    Fix a counting error that caused segfaults (Linux)

commit 1e419d3fc392e435ae0af703561ce10bd5a45eb0
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 15:06:02 2012 -0600

    Return a list of new commands after core_loadlib

    Gets Windows back in sync with Linux

commit 3d3959f720de68e2f36ebfabe8196e01f98fe904
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 14:50:55 2012 -0600

    Refactor extensionList -> extension_commands

    It's not the same as extension_list.

commit a7acb638af803732fc5f3975e0c0632f427e0deb
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sun Mar 18 00:07:27 2012 -0500

    Massive whitespace cleanup

commit ef8b9fd5cea7db43860a5b88d7397ba84393ecd5
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 16:00:20 2012 -0500

    Add back enum_protections with some new changes

commit d778eec36953bb9bf4985e967ad2c119a1acd79b
Author: ohdae <bindshell@live.com>
Date:   Sat Mar 17 13:28:31 2012 -0400

    Added fix for enum_protections

commit 64611819d43bf13ab2d68f4353513c39e5a64fe0
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 03:14:26 2012 -0500

    A bunch of fixes

commit bb1a0205d73e75a61a8fbf5ff6440dd09f9780f9
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 00:28:05 2012 -0500

    The comments in get_chatlogs need an update

commit 666477e42a734f3120dcc4282b01b5ab5819384a
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 00:25:41 2012 -0500

    Correct license format

commit 3c8eecbcd7b952abaca0b1ce14dca41e1d4cabb7
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 00:22:03 2012 -0500

    Add enum_adium.rb post module

commit d290cf4fef1309df9a1af748e7c6c259a6788576
Author: ohdae <bindshell@live.com>
Date:   Fri Mar 16 16:54:36 2012 -0300

    Changed store_note to store_loot. Fixed local/remote file retrieval

commit ccb830b594ea0f0a8ce7c29b24f2f137ecfd5c4c
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 16 11:29:07 2012 -0600

    Fall back to MIB method if we can't get netmasks

    Misses IPv6 addresses, but at least doesn't break everything.

    [Fixes #6525]

commit a9a30232dd5fcc0854c10b4d58df8511a23f3091
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Fri Mar 16 11:49:31 2012 -0500

    This module is not ready, yanked.

commit 6bb34f7fd0785d31902f1edc938a6b05b91a1495
Author: Gregory Man <man.gregory@gmail.com>
Date:   Fri Mar 16 18:09:08 2012 +0200

    sockso_traversal 1.8 compatibility fix

commit e76965ce565a8ae634dc0d3c743542f1a6d977d7
Author: ohdae <bindshell@live.com>
Date:   Fri Mar 16 09:17:35 2012 -0400

    fix

commit 61ce7b587de54363f7071bc19df5a29eb29e9aa7
Author: ohdae <bindshell@live.com>
Date:   Fri Mar 16 09:14:48 2012 -0400

    saves each config to loot instead of notes

commit f4713974fa82d8b13017cb0817b5fd36696194d9
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 16 03:46:10 2012 -0600

    Check for a 0 prefix length

    If the OnLinkPrefixLength is 0, something is wrong, try the value in the
    prefix linked list.  Appears to fix v4 addresses on XP but not 2k3.

    [See #6525]

commit cde7fcc012e04880f2faa28226a1fc5834a2e3d5
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 16 01:46:41 2012 -0600

    Return network prefixes when available

    Solves #6525 on Vista+.  Win2k still works using the old MIB method
    (which doesn't support ipv6).  Win2k3 and XP are still busted for
    unknown reasons.

commit 98bd9a7bd09149f524ebbe1501ec916bf99b078d
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 22:59:42 2012 -0400

    Enumerate important and interesting configuration files

commit 9336df2ac28ee2df10a0e66e7006df3d23493492
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Thu Mar 15 19:06:48 2012 -0500

    More Virtualisation SSL fixes

commit f24c378281ee6c85f687d4823f09ef5848812daf
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Thu Mar 15 18:15:29 2012 -0500

    Default SSL to true for esx_fingerprint module

commit d6e14c42120df0fd16b79709ac5723d0e2818810
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 15:56:24 2012 -0500

    Fix typo

commit b24dcfe43e625740ec8a1465f33be02f7ec40162
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 15:55:54 2012 -0500

    Add sockso dir traversal

commit 033052c1e075fcf43e9c17e5ee4a5006247cb375
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 15 14:31:25 2012 -0600

    Fix syntax error in 1.8, thanks Jun Koi for the patch

commit 4529efaeaa22e52c9c7c1528c68efb60af8af729
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 14:27:40 2012 -0500

    enum_protections is now find_apps

commit 49e823802bd8f2cb1940545e74db04f3788352d1
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 14:22:23 2012 -0500

    File rename, as well as design and cosmetic changes

commit ccf6b011145cf9db444f7e2d3fb3ec61738e88cb
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 15:29:52 2012 -0300

    added report_note, removed store_loot function, cleaned up info/author

commit 27d571932e51afbac0c0fcd95c52f038786a9a28
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 12:18:29 2012 -0300

    fixed output newline issue

commit 5a828e35d1629dc68825fe7d9322d1316888f8d7
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 01:05:35 2012 -0300

    fixed save line

commit 805c2ee9871c076a8c0ac62b028a7942af70b6a5
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 01:02:07 2012 -0300

    removed unneeded comments

commit 5861e1512f2949c0d7848d9ebed8241277462085
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 01:00:55 2012 -0300

    fixed output issue

commit 593a3648111f1db1f56a410250539261c2a7cd9f
Author: ohdae <bindshell@live.com>
Date:   Wed Mar 14 18:26:53 2012 -0300

    removed unneeded dependency

commit 05053e6e74b0ac99bbd4005c40ecc3b1196fd13f
Author: ohdae <bindshell@live.com>
Date:   Wed Mar 14 13:30:16 2012 -0400

    locates installed 3rd part av, fws, etc

commit 5bf512d0e9d2b412c4107228db178a7078111443
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Wed Mar 14 16:50:54 2012 -0500

    Add OSVDB-79863 NetDecision Directory Traversal

commit 18715d0367f4ef01b5998d732043cbe224e1787e
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 23:03:01 2012 -0600

    Store the retrieved commands on the session

commit b752cb8b31fd8dcd221fb6caa483f6202bf5a4fd
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 22:45:16 2012 -0600

    Retrieve the list of new commands

    The client side doesn't do anything with them yet

commit 69ce8ef42d4089a0b26644bd4d6bebf57c4cfd50
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 22:41:16 2012 -0600

    Return a list of the new commands in response to core_loadlib

    Linux

commit 354c754aa4cce63ffebb4567f3bbfd621ffef46c
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 15:13:45 2012 -0600

    Whitespace at EOL

commit 4afcb4cb9da1921ede29b03b149433cc65d680da
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 14:30:09 2012 -0600

    Create instance methods that return extensions

    Before this change, meterpreter sessions would not #respond_to? their
    extensions despite having a pseudo-accessor for them:
    ```
    >> client.respond_to? :sys
    => false
    >> client.sys
    => #<Rex::Post::Meterpreter::ObjectAliases:0x0000000e263488 @aliases={"config"=>#<Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Config:0x0000000e268dc8 @client=#<Session:meterpreter 192.168.99.1:55882 (192.168.99.1) "uid=1000, gid=1000, euid=1000, egid=1000, suid=1000, sgid=1000 @ wpad">>, "process"=>#<Class:0x0000000e268d20>, "registry"=>#<Class:0x0000000e266da0>, "eventlog"=>#<Class:0x0000000e2654e8>, "power"=>#<Class:0x0000000e263c30>}>

    ```

    After:
    ```
    >> client.respond_to? :sys
    => true
    ```

commit 70ab8c018f67d15929b6f41322540837ab7b37c5
Merge: a8a3938 5f2bace
Author: James Lee <egypt@metasploit.com>
Date:   Tue Apr 3 11:46:25 2012 -0600

    Merge branch 'master' into bap-refactor

    Conflicts:
    	external/source/exploits/CVE-2012-0507/Help.java
    	external/source/exploits/CVE-2012-0507/Makefile
    	external/source/exploits/CVE-2012-0507/msf/x/Help.java
    	external/source/exploits/CVE-2012-0507/src/a/Exploit.java
    	external/source/exploits/CVE-2012-0507/src/a/Help.java

commit a8a393891588a8b5c18e3c2173f1cd9c2480b2d0
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 20:20:21 2012 -0600

    Deal with null data/jar

    Not sure why "" turns into null sometimes, but it was breaking shells;
    this fixes it.

commit 5e5eb39d3ccb62a9fc006be8241cfb97723caa06
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:10:59 2012 -0600

    Prev commit moved these to src/a

commit 5074eadbea426fc4f83d6d165a01e640ef42b4de
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:08:32 2012 -0600

    Make building the jar for cve-2012-0507 a bit easier

    Mostly stolen from cve-2008-5353

commit bdb3fbe7fd19aa76b4069edca5a78c53fec668c0
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 14:52:23 2012 -0600

    Fix incorrect option name

commit 78824ef60084510d3befe0ded6eed314d55eeb12
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 13:24:33 2012 -0600

    Add the detected browser version to the DOM

    Doing it this way lets modules grab the info a bit more easily.

commit 9813ccb8d6b14e0e728b8a13bacf59dd31b9c4b9
Merge: 0faa3f6 b5fc8e4
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 13:19:05 2012 -0600

    Merge branch 'master' into bap-refactor

commit 0faa3f65240c3a2b3ab0e72f4aeb2e9f50ed54ee
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:36:20 2012 -0600

    Add bap support to java_rhino

commit 66ca27f994e3b11c9c8adae85642820768158860
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:35:16 2012 -0600

    Put next_exploit on the window object so it's always in scope

    Solves some issues with Chrome not running more than one exploit

commit 7fc2ca1a0690c7a973307772aed42ab3514e1761
Merge: 325d306 e48c47e
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:10:54 2012 -0600

    Merge branch 'master' into bap-refactor

commit 325d3060599bc79674e93dd5f55a4e60061e9bdb
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 14:31:53 2012 -0600

    Pull common stuff up out of the body

commit 4f2b3260bf7f14f4d763625792adb0c3cfd1ed7c
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:04:03 2012 -0600

    Fix indentation level

commit 9b905c53b4d46beb86da8168a1c2c5b2da340f6d
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:02:42 2012 -0600

    Abstract out copy-pasted methods

    Need to do the same thing for OSX, but it's a different implementation.
 2012-05-15 17:00:02 -06:00
Jeff Jarmoc c2c160f86c randomizes options from equivilants 2012-05-11 11:31:26 -05:00
sinn3r 2b13330483 Merge pull request #376 from wchen-r7/wikkawiki 
Add CVE-2011-4449
 2012-05-10 10:13:56 -07:00
sinn3r 6e8c3ad1e3 It's "inject", not "upload"... because technically that's what really happens. 2012-05-10 12:06:02 -05:00
sinn3r c69e34d407 Update description 2012-05-10 12:02:55 -05:00
sinn3r 86c3ad5e0c Add CVE-2011-4449 2012-05-10 11:57:40 -05:00
Jeff Jarmoc e1156834b9 Lots of encoding randomizations for php_cgi_arg_injection 2012-05-09 14:13:21 -05:00
Jeff Jarmoc 4909d8073a Added lots or encoding randomness 2012-05-09 11:01:15 -05:00
HD Moore 1a30e221a0 See #362 by changing the exitfunc arguments to be the correct type 2012-05-07 02:42:29 -05:00
Steve Tornio cef2da6110 add osvdb ref 2012-05-05 10:13:42 -05:00
James Lee 18a44148dc Randomize case for ini true/false values 2012-05-04 17:32:32 -06:00
HD Moore 423437c620 Woops, small typo in disable_functions 2012-05-04 12:17:41 -05:00
HD Moore c6b39e8e5c Add additional definitions to disable safe_mode, open_basedir, suhosin. (thanks @i0n1c) 2012-05-04 12:15:46 -05:00
HD Moore 2ce3558bb4 Bump the rank 2012-05-04 10:19:37 -05:00
HD Moore bed4846763 A little more module cleanup 2012-05-04 10:06:18 -05:00
HD Moore d668e2321d Rename this to a more suitable location 2012-05-04 09:59:40 -05:00
HD Moore 9988d6a430 Tabs. Sweet sweet tabs 2012-05-01 00:35:01 -05:00
HD Moore ffd91793b9 Make RMI easier to correlate, add a vulnerability check to the scanner module 2012-04-29 18:11:28 -05:00
David Maloney f1cd488f19 Overrirdes the autofilter results from the HTTPServer mixin for the rmi 
exploit
 2012-04-27 15:22:40 -05:00
HD Moore 67fe5b775a Bump this up 2012-04-27 01:23:40 -05:00
HD Moore ec831a1658 Smarter RMI class loader logic 2012-04-27 01:02:18 -05:00
HD Moore 4c2e1c2859 Small updates to the rmi modules 2012-04-27 00:07:00 -05:00
sinn3r cc76438a75 Merge branch 'jlee-r7-http-print-standardization' 2012-04-25 15:38:46 -05:00
sinn3r 711fb73048 Fix more print_* 2012-04-25 15:01:50 -05:00
sinn3r 5bebd01eb0 Tabs vs spaces war round 2 2012-04-24 16:06:08 -05:00
sinn3r bc42375565 Fix spaces to proper hard tabs. Not very fun to do. 2012-04-24 16:03:41 -05:00
sinn3r 0671fc9ea1 Merge branch 'axis2_mods' of https://github.com/ChrisJohnRiley/metasploit-framework into ChrisJohnRiley-axis2_mods 2012-04-24 15:49:34 -05:00
James Lee 9cdd8912c5 Remove spurious cli.peerhost in output 2012-04-20 13:31:42 -06:00
sinn3r 81b6e76619 Correct CVE/OSVDB/BID references, thanks Chad. 2012-04-19 00:24:56 -05:00
James Lee 3e0747f5d2 Randomize guid and payload filename 2012-04-16 12:09:25 -06:00
Chris John Riley f4f1ec70bc Altered regex to detect Jetty hosts 
Added in detection for 401 Authentication responses
Added alternative REST based run method (seen in Axis2 1.1.1)
Added check to prevent // from appearing at the start of the URI (causes issues on Jetty hosts)

There should be a default method for URI to prevent double / from appearing at the start of the path (can cause unknown issues).
 2012-04-15 15:13:21 +02:00
James Lee 810d496ade Chmod the payload executable 
Makes native payloads work on non-windows, thanks mihi!
 2012-04-11 12:48:14 -06:00
Tod Beardsley cbc12560a5 Leading tabs, not spaces 
There's a coding style in here that will make msftidy.rb cry, and
that's:

```
varfoo = %q|
    stuff
      thats
        html
|
```

Usually, you want something like

varfoo = ""
varfoo << %q|    stuff|
varfoo << %q|      thats|
varfoo << %q|        html|

That said, the Description field is usually written as tab-intended
multiline %q{} enclosures, so that's what I'll do here to make
msftidy.rb happy.
 2012-04-10 14:25:00 -05:00
Tod Beardsley cdc020ba9f Trailing space on xpi bootstrap module 2012-04-10 14:24:08 -05:00
Tod Beardsley 3cb7cbe994 Adding another ref and a disclosuredate to mihi's XPI module 
Calling the disclosure date 2007 since TippingPoint published a blog
post back then about this XPI confirm-and-install vector.
 2012-04-10 13:59:21 -05:00
sinn3r 0e1fff2c4b Change the output style to comply with egyp7's expectations. 2012-04-10 13:42:52 -05:00
sinn3r 76c12fe7e6 Whitespace cleanup 2012-04-10 13:22:10 -05:00
Michael Schierl 705cf41858 Add firefox_xpi_bootstrapped_addon exploit 
This is similar to java_signed_applet as it does not exploit a vulnerability, but
hope that the user will trust the addon.
 2012-04-10 13:39:54 +02:00
andurin 4e955e5870 replace spaces with tabs 2012-04-06 10:45:10 -05:00
andurin 67e6c7b850 tomcat_mgr_deploy may report successful creds 
Using following code for 'check' as 'exploit':
               report_auth_info(
                       :host   => rhost,
                       :port   => rport,
                       :sname  => (ssl ? "https" : "http"),
                       :user   => datastore['BasicAuthUser'],
                       :pass   => datastore['BasicAuthPass'],
                       :proof  => "WEBAPP=\"Tomcat Manager App\", VHOST=#{vhost}, PATH=#{datastore['PATH']}",
                       :active => true
               )

Resulting in:

Credentials
===========

host           port  user    pass    type      active?
----           ----  ----    ----    ----      -------
192.168.x.xxx  8080  tomcat  s3cret  password  true
 2012-04-06 10:45:10 -05:00
Tod Beardsley 14e3cd75dc Revert "tomcat_mgr_deploy may report successful creds" 
This reverts commit 937f8f035a.
 2012-04-05 16:17:06 -05:00
sinn3r 8628991b1d Merge pull request #305 from jlee-r7/bap-refactor 
Bap refactor
 2012-04-05 08:02:43 -07:00
andurin 937f8f035a tomcat_mgr_deploy may report successful creds 2012-04-05 11:09:56 +02:00
James Lee 974d95b175 Both of these are obsoleted by java_atomicreferencearray 2012-04-03 18:23:42 -06:00
sinn3r bd5f43c918 Add another good reference by @mihi42 2012-04-01 01:30:50 -05:00
sinn3r bab4cddd83 Add Jeroen Frijters for finding/reporting the bug 2012-03-31 03:01:09 -05:00
James Lee cc54a260f5 Merge remote branch 'upstream/master' 2012-03-30 14:31:12 -06:00
James Lee 0547369966 Add bap support for flash mp4 and new java bug 
Also fixes a silly issue where adobe_flash_mp4_cprt was adding the
/test.mp4 resource after every request instead of just once at startup.
 2012-03-30 12:59:07 -06:00
Steve Tornio ae21c05e69 add osvdb ref 2012-03-30 07:26:07 -05:00
sinn3r e018c6604f Modify CVE-2012-0507 2012-03-30 02:06:56 -05:00
Tod Beardsley f069a32223 Merge pull request #288 from wchen-r7/cve_2012_0507 
Adding sinn3r and juan's exploit for CVE-2012-0507. Blog post coming soon.
 2012-03-29 08:46:49 -07:00
sinn3r 791ebdb679 Add CVE-2012-0507 (Java) 2012-03-29 10:31:14 -05:00
Tod Beardsley 2f3bbdc00c Sed replacement of exploit-db links with EDB refs 
This is the result of:

find modules/ -name \*.rb -exec sed -i -e 's#\x27URL\x27,
\x27http://www.exploit-db.com/exploits/\([0-9]\+\).*\x27#\x27EDB\x27,
\1#' modules/*.rb {} \
 2012-03-21 16:43:21 -05:00
Tod Beardsley 23c9c51014 Fixing CVE format on sit_file_upload. 2012-03-21 09:59:20 -05:00
sinn3r aeb691bbee Massive whitespace cleanup 2012-03-18 00:07:27 -05:00
sinn3r 7c77fe20cc Some variables don't need to be in a double-quote. 2012-03-17 20:37:42 -05:00
Tod Beardsley e3f2610985 Msftidy run through on the easy stuff. 
Still have some hits, but that requires a little more code contortion to
fix.
 2012-03-15 17:06:20 -05:00
Tod Beardsley 9144c33345 MSFTidy check for capitalization in modules 
And also fixes up a dozen or so failing modules.
 2012-03-15 16:38:12 -05:00
sinn3r 5250b179c8 Add CVE and OSVDB ref 2012-03-15 04:40:27 -05:00
James Lee 8d93e3ad44 Actually use the password we were given... 2012-03-08 10:17:39 -07:00
James Lee 02ea38516f Add a check method for tomcat_mgr_deploy 2012-03-06 23:22:44 -07:00
sinn3r 22a12a6dfc Add Lotus CMS exploit (OSVDB-75095) 2012-03-06 11:36:28 -06:00
James Lee 464cf7f65f Normalize service names 
Downcases lots and standardizes a few.  Notably, modules that reported a
service name of "TNS" are now "oracle".  Modules that report http
now check for SSL and report https instead.

[Fixes #6437]
 2012-02-21 22:59:20 -07:00
HD Moore 4932a9ca25 Dont dump an HTML document to the console 2012-02-21 23:45:25 -06:00
Tod Beardsley 4a631e463c Module title normalization 
Module titles should read like titles. For
capitalization rules in English, see:
http://owl.english.purdue.edu/owl/resource/592/01/

The only exceptions are function names (like 'thisFunc()') and specific
filenames (like thisfile.ocx).
 2012-02-21 11:07:44 -06:00
HD Moore ceb4888772 Fix up the boilerplate comment to use a better url 2012-02-20 19:40:50 -06:00
HD Moore af56807668 Cleanup the titles of many exploit modules 2012-02-20 19:25:55 -06:00
sinn3r 5bb9afe789 Correct disclosure date format 2012-02-16 18:15:51 -06:00
Joshua J. Drake 01a6b02c3e Add exploit for CVE-2012-0209, thx eromang! 2012-02-16 03:10:55 -06:00
Joshua J. Drake d2444e1cf6 fix a few typos 2012-02-16 03:10:22 -06:00
Tod Beardsley 829040d527 A bunch of msftidy fixes, no functional changes. 2012-02-10 19:44:03 -06:00
Jonathan Cran c3bd151197 add a ranking 2012-01-31 20:43:32 -06:00
Steve Tornio e392958d90 add osvdb ref 2012-01-31 07:06:33 -06:00
sinn3r bfd4734cbf Forgot to add CMD as a datastore option, here it is 2012-01-30 17:34:58 -06:00
sinn3r 08134ad600 Add Exploit-DB reference 2012-01-30 16:17:25 -06:00
sinn3r f3c340a9ab Add vBSEO proc_deutf() Remote Code Execution (Feature #6307) 2012-01-30 16:15:27 -06:00
sinn3r 9e5d2ff60e Improve URI, plus some other minor changes. 2012-01-19 13:26:25 -06:00
joernchen of Phenoelit 2199cd18d7 fine tuning thx to sinn3r 2012-01-19 19:50:30 +01:00
joernchen of Phenoelit df9380500a disclosure date added 2012-01-19 19:19:53 +01:00
joernchen of Phenoelit 197eb16f72 gitorious remote command exec exploit 2012-01-19 11:36:08 +01:00
Tod Beardsley 7e25f9a6cc Death to unicode 
Apologies to the authors whose names I am now intentionally misspelling.
Maybe in another 10 years, we can guarantee that all terminals and
machine parsers are okay with unicode suddenly popping up in strings.

Also adds a check in msftidy for stray unicode.
 2012-01-10 14:54:55 -06:00
Tod Beardsley e7d7302644 Dropping the umlaut, sacrificing accuracy for usability. Can't guarantee a viewer has a Unicode-capable terminal. 2012-01-09 11:22:44 -06:00
sinn3r 243dbe50f0 Correct author name. Unfortunately not all editors can print unicode correctly. 2012-01-07 15:18:25 -06:00
sinn3r 4e858aba89 Add CVE-2012-0262 Op5 welcome.php Remote Code Execution 2012-01-07 15:13:45 -06:00
sinn3r 4645c1c2b9 Add CVE-2012-0261 Op5 license.php Remote Code Execution 2012-01-07 15:12:49 -06:00
sinn3r d484e18300 Add e-mail for tecr0c 2011-12-29 11:14:15 -06:00
sinn3r b5b2c57b9f Correct e-mail format 2011-12-29 10:57:00 -06:00
Steve Tornio a00dad32fe Merge branch 'master' of git://github.com/rapid7/metasploit-framework 2011-12-29 07:50:33 -06:00
Steve Tornio 27d1601028 add osvdb ref 2011-12-29 07:49:16 -06:00
Tod Beardsley 0e3370f1fe Grammar and spelling on splunk and oracle exploits 2011-12-28 13:42:56 -06:00
sinn3r 101eba6aa5 Add CVE-2011-3587 Plone/Zope Remote CMD Injection (Feature #6151) 2011-12-27 00:59:26 -06:00
sinn3r b5b24a1fbf Add a check. I decided not to try to login in the check function in order to remain non-malicious. 
However, this decision doesn't represent how modules should write their own check.
 2011-12-22 13:16:54 -06:00
sinn3r 262fe75e0a Add CVE-2011-4642 - Splunk Remote Code Execution (Feature #6129) 2011-12-22 13:04:37 -06:00
Steve Tornio 85caabbf5d add osvdb ref 2011-12-14 07:19:34 -06:00
HD Moore cb456337a0 Handle invalid http responses better, see #6113 2011-12-13 19:54:10 -06:00
sinn3r d87d8d5799 Add CVE-2011-4453 (PmWiki Remote code exeuction - Feature #6103) 2011-12-13 11:45:24 -06:00
sinn3r 32c8301c19 Add feature #6082 (Traq 2.3 Auth bypass remote code execution) 2011-12-12 15:45:19 -06:00
sinn3r e043fb52c2 Incrase timeout 2011-12-08 11:21:03 -06:00
sinn3r 5afba20c21 Merge pull request #43 from jduck/master 
Clear up how to use native payloads for tomcat_mgr_deploy
 2011-12-06 23:01:53 -08:00
sinn3r edec6b98ee Add feature #6067 Family Connections CMS 2.7.1 exploit 2011-12-07 00:00:56 -06:00
Joshua J. Drake ac7edc268a Add some more clear documentation for selecting payloads for this module. 2011-12-05 00:35:11 -06:00
Steve Tornio 2bb97791f7 Update OSVDF refs for servu module. 
* Added osvdb ref to servu module.
* Fixed rhino entry in osvdb, removed comment from module.

Squashed commit of the following:

commit 80ce65253f51e07a0bcb8900402a1b3d59eaeaa1
Author: Steve Tornio <swtornio@gmail.com>
Date:   Fri Dec 2 07:44:28 2011 -0600

    add osvdb ref

commit 558f20d84dd705b57b7f807a5ea3815e17b6f9f5
Author: Steve Tornio <swtornio@gmail.com>
Date:   Wed Nov 30 08:15:20 2011 -0600

    fixed in osvdb

[Closes #39]
 2011-12-02 13:21:41 -05:00
sinn3r 93a419c76b Having nothing on the webpage may probably confuse some novice users. But I do like stealth. 2011-12-01 03:02:35 -06:00
sinn3r f26f6da74b Add CVE-2011-3544 (feature #6023) Java Rhino exploit 2011-11-29 18:05:20 -06:00
Tod Beardsley f503bd9488 Fixes #5749 by converting to unix-style linefeeds and forcing jtr modules to read files as binary, and updating msftidy to allow for r+b as a ghetto append. 2011-11-28 17:52:34 -06:00
Rob Fuller c411c216c0 Solved most of msftidy issues with the /modules directory 2011-11-28 17:10:29 -06:00
David Maloney 4a22df4014 Fix to the axis2 Deployer exploit to add Default Target 2011-11-22 10:27:38 -08:00
David Maloney 30d1451159 Consolidation of the Axis2 Deployer Exploits 
Fixes #5276
 2011-11-22 08:47:53 -08:00
sinn3r 41d746a07a Add Support Incident Tracker (Feature #5964) by Juan 2011-11-12 12:36:21 -06:00
Matt Buck 16f45fc894 Add empty directories from svn repo. 2011-11-09 18:41:40 -06:00
Wei Chen e767214411 Fix: whitespaces, svn propset, author e-mail format 
git-svn-id: file:///home/svn/framework3/trunk@14175 4d416f70-5f16-0410-b530-b9f4589650da
 2011-11-06 22:02:26 +00:00
Wei Chen 0dff3f3e52 Add #5682 (phpscheduleit module). Thx Juan. 
git-svn-id: file:///home/svn/framework3/trunk@14073 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-26 18:06:12 +00:00
Will Vandevanter a0d8a08851 java meterpreter should be used when the target is set to automatic 
git-svn-id: file:///home/svn/framework3/trunk@14068 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-25 20:02:09 +00:00
Wei Chen 2b46420b36 check nil 
git-svn-id: file:///home/svn/framework3/trunk@14062 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-25 16:19:55 +00:00
Wei Chen 7ba5a8ec4e Module is busted when it loads, restoring to the original method. Mixin should not be loaded into an exploit 
git-svn-id: file:///home/svn/framework3/trunk@14061 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-25 16:04:33 +00:00
Wei Chen 9cb54e37c5 Handle payloads better, also add a cleanup routine specifically for php/exec 
git-svn-id: file:///home/svn/framework3/trunk@14060 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-25 05:25:39 +00:00
Wei Chen 2da07d4963 Fix bug #5834 (uri being nil in print_good) 
git-svn-id: file:///home/svn/framework3/trunk@14057 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-25 00:40:03 +00:00
Wei Chen 3da8bb8b69 Add feature #5820 by mr_me and tecr0c 
git-svn-id: file:///home/svn/framework3/trunk@14055 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-24 23:22:32 +00:00
Joshua Drake 62c8c6ea9f big msftidy pass, ping me if there are issues 
git-svn-id: file:///home/svn/framework3/trunk@14034 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-23 11:56:13 +00:00
Wei Chen 975cc52bac Fix spelling errors 
git-svn-id: file:///home/svn/framework3/trunk@13983 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-18 00:54:05 +00:00
Tod Beardsley c336d063da Mostly file format (unix linefeeds) and File.open() calls using binary. Fixed ranking for mozilla_nstreerange and disclosure and BID # for tugzip. 
git-svn-id: file:///home/svn/framework3/trunk@13971 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-17 04:20:53 +00:00
Tod Beardsley 94eb3ac14c Deleting a puts statement. 
git-svn-id: file:///home/svn/framework3/trunk@13968 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-17 03:52:10 +00:00
Tod Beardsley 30ac88694f More msftidy fixes. Now I'm going to get a little more surgical to get this to move faster. 
git-svn-id: file:///home/svn/framework3/trunk@13963 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-17 02:58:53 +00:00
Tod Beardsley 020abd926b A handful of rankings changes, also converting whitespace. 
git-svn-id: file:///home/svn/framework3/trunk@13941 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-15 22:58:20 +00:00
Wei Chen 14d7db1641 Add disclosure dates to all the exploit modules that didn't have one 
git-svn-id: file:///home/svn/framework3/trunk@13938 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-15 21:09:17 +00:00
Wei Chen f2d328d969 cmd exec module should receive ExcellentRanking 
git-svn-id: file:///home/svn/framework3/trunk@13935 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-15 20:10:53 +00:00
HD Moore 142ae9288b Fix title 
git-svn-id: file:///home/svn/framework3/trunk@13933 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-15 19:56:57 +00:00
Wei Chen 262b3bbe00 Use Rex to encode payload to base64 
git-svn-id: file:///home/svn/framework3/trunk@13846 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-09 20:31:51 +00:00
Wei Chen 98157272fd Fix indentation for exploit description 
git-svn-id: file:///home/svn/framework3/trunk@13843 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-09 06:12:54 +00:00
Wei Chen d1b1b26d01 Add Feature #5499 (Snortreport module) 
git-svn-id: file:///home/svn/framework3/trunk@13842 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-09 06:10:18 +00:00
Wei Chen 44ac9d67e0 svn propset 
git-svn-id: file:///home/svn/framework3/trunk@13831 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-07 17:45:15 +00:00
Steve Tornio 9ec92ee603 add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@13830 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-07 15:37:54 +00:00
HD Moore 9862987f45 Add a new module from joernchen 
git-svn-id: file:///home/svn/framework3/trunk@13829 4d416f70-5f16-0410-b530-b9f4589650da
 2011-10-07 15:30:24 +00:00
Wei Chen 612cdc8c73 No need to check if version is 'unknown' if nothing else (other than default) is assigned to it 
git-svn-id: file:///home/svn/framework3/trunk@13799 4d416f70-5f16-0410-b530-b9f4589650da
 2011-09-27 19:12:31 +00:00
Wei Chen 8bfdebeaf3 Handle the return value for send_request during the early stage 
git-svn-id: file:///home/svn/framework3/trunk@13791 4d416f70-5f16-0410-b530-b9f4589650da
 2011-09-25 19:28:15 +00:00
Wei Chen db79d21f75 Apply patch for non-default logins by jabra 
git-svn-id: file:///home/svn/framework3/trunk@13778 4d416f70-5f16-0410-b530-b9f4589650da
 2011-09-23 02:48:48 +00:00
Jonathan Cran 064255e910 fixup the payload encoding, per joernchen's comment in the #metasploit channel. 
git-svn-id: file:///home/svn/framework3/trunk@13747 4d416f70-5f16-0410-b530-b9f4589650da
 2011-09-17 17:48:51 +00:00
Mario Ceballos 6f28911d3d added patch from joshua taylor. 
git-svn-id: file:///home/svn/framework3/trunk@13698 4d416f70-5f16-0410-b530-b9f4589650da
 2011-09-06 19:58:40 +00:00
HD Moore 5fa7ddf5f4 Move this aux module out of the exploits tree 
git-svn-id: file:///home/svn/framework3/trunk@13657 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-29 15:30:13 +00:00
Joshua Drake 496170eac1 aDjUsT tHe CaSe 
git-svn-id: file:///home/svn/framework3/trunk@13644 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-26 23:46:49 +00:00
David Rude ab11d3e3eb Fix the CVE reference 
git-svn-id: file:///home/svn/framework3/trunk@13642 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-26 15:25:27 +00:00
David Rude 76f0226ff0 Adds the RealVNC Null Authentication Bypass exploit - gj thelightcosine =) 
git-svn-id: file:///home/svn/framework3/trunk@13641 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-26 04:40:21 +00:00
David Rude c78ba0e4d5 hehe remove debugging put call 
git-svn-id: file:///home/svn/framework3/trunk@13586 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-19 05:59:32 +00:00
David Rude 63e2b759e7 require the URI option 
git-svn-id: file:///home/svn/framework3/trunk@13585 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-19 05:54:58 +00:00
David Rude 402ca57bb4 Adds Struts2 Remote Code Execution exploit CVE-2010-1870 
git-svn-id: file:///home/svn/framework3/trunk@13584 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-19 05:52:09 +00:00
Steve Tornio 28177fd255 add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@13505 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-10 02:54:56 +00:00
HD Moore f1afbacb2a Cron'd 
git-svn-id: file:///home/svn/framework3/trunk@13485 4d416f70-5f16-0410-b530-b9f4589650da
 2011-08-04 17:36:01 +00:00
James Lee d58d061735 complain if the given applet name is not formatted correctly, fixes #5082 
git-svn-id: file:///home/svn/framework3/trunk@13389 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-28 17:46:36 +00:00
Tod Beardsley df52bfaa4f Ensure that we check for pcaprub before doing much anything else for those modules that actually require it. In some cases, that means moving open_pcap() up to be the first method call, in others, insert check_pcaprub_loaded first. Also removes a few cases of redundant checking (the Capture mixin does all this already anyway). 
git-svn-id: file:///home/svn/framework3/trunk@13381 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-27 20:21:47 +00:00
Tod Beardsley b22ca615c7 Fixes #5038, missed a couple mentions of Racket. Excised now for sure. 
git-svn-id: file:///home/svn/framework3/trunk@13371 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-27 17:44:36 +00:00
Tod Beardsley c54e18d757 Fixes #5038. Removes all instances of Racket objects, as far as I can tell. If I missed any through my mighty grep -ril racket . statement, please reopen! 
git-svn-id: file:///home/svn/framework3/trunk@13342 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-26 01:29:21 +00:00
Wei Chen f47a2c7565 Format dictatorship round 2: Fix author e-mail format for all exploit modules 
git-svn-id: file:///home/svn/framework3/trunk@13297 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-22 20:17:58 +00:00
Wei Chen d13654740a Update some jboss modules' metadata associated with CVE-2010-0738 
git-svn-id: file:///home/svn/framework3/trunk@13204 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-18 05:18:25 +00:00
James Lee 1d25a6d7d1 add an exploit for java's rmid and rmiregistry code-execution-by-design and supporting source. fixes #4378, thanks mihi! 
git-svn-id: file:///home/svn/framework3/trunk@13185 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-15 20:42:31 +00:00
Matt Weeks 1162aafa1e p function causes problems with rpc. 
git-svn-id: file:///home/svn/framework3/trunk@13184 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-15 18:45:05 +00:00
James Lee c412a836ed add VERBOSE option to all modules and vprint_* methods to use it 
git-svn-id: file:///home/svn/framework3/trunk@13183 4d416f70-5f16-0410-b530-b9f4589650da
 2011-07-15 15:33:35 +00:00
James Lee 8e5311cb61 File.read is not binary safe. replace it with File.open in a few places where it matters. 
git-svn-id: file:///home/svn/framework3/trunk@12957 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-16 22:02:00 +00:00
James Lee ea5dc1c85c use the right uri for our jar when other webserver modules are running 
git-svn-id: file:///home/svn/framework3/trunk@12944 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-14 23:57:10 +00:00
HD Moore eea05fcaaa Correct the parent class name 
git-svn-id: file:///home/svn/framework3/trunk@12930 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-12 19:31:38 +00:00
HD Moore 7f3e2d182d Fix Axis2 to inherit from the correct class, prevent a stack trace when a non-Remote exploit has the cleanup method called. 
git-svn-id: file:///home/svn/framework3/trunk@12928 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-12 18:32:27 +00:00
HD Moore 85f5e5fb98 Fix the disclosure date to match when signing was made available to the masses 
git-svn-id: file:///home/svn/framework3/trunk@12891 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-09 17:08:05 +00:00
HD Moore c3c061334d Add a "disclosure date" (applets were included in the first java release) and changing the title. 
git-svn-id: file:///home/svn/framework3/trunk@12883 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-08 03:31:49 +00:00
James Lee 1c4bf118e8 add a version check 
git-svn-id: file:///home/svn/framework3/trunk@12847 4d416f70-5f16-0410-b530-b9f4589650da
 2011-06-03 23:47:44 +00:00
James Lee 5b91eadb87 fix the string replacement and do it at setup time instead of for every request 
git-svn-id: file:///home/svn/framework3/trunk@12747 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-27 19:36:12 +00:00
James Lee cd3f306ef2 clarify info a bit; make APPLETNAME option actually do something. 
git-svn-id: file:///home/svn/framework3/trunk@12746 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-27 19:13:47 +00:00
James Lee 5a54a408f5 stupid debugging stuff 
git-svn-id: file:///home/svn/framework3/trunk@12736 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-26 19:10:54 +00:00
James Lee c5781ae515 add support for PKCS12 (.pfx) cert/key files and cert chains in PEM files 
git-svn-id: file:///home/svn/framework3/trunk@12735 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-26 17:52:12 +00:00
James Lee 11a1b5dcad fix the requires for java signing. 
git-svn-id: file:///home/svn/framework3/trunk@12719 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-25 18:02:02 +00:00
James Lee 812bae9df9 add support for signing applets (or any other jar) with openssl. this removes the need for a dependency on RJB 
git-svn-id: file:///home/svn/framework3/trunk@12718 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-25 16:45:20 +00:00
James Lee ef48240606 Make it obvious which exploit is handling a request 
git-svn-id: file:///home/svn/framework3/trunk@12693 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-23 17:05:44 +00:00
James Lee 04efaf9281 referencing navigator.javaEnabled breaks ie6, only check navigator.javaEnabled(); 
git-svn-id: file:///home/svn/framework3/trunk@12655 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-17 22:44:39 +00:00
David Rude a8b6c43636 reverting the disclosure dates for now need to clean up the patch 
git-svn-id: file:///home/svn/framework3/trunk@12540 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-04 20:43:19 +00:00
David Rude 3b7ea08f6a Fixes a ton of Disclosure Date discrepencies in various modules, thanks a ton to Michael Baker for spending the time to ensure accuracy 
git-svn-id: file:///home/svn/framework3/trunk@12539 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-04 19:17:31 +00:00
David Rude 3b5cf3826a Added TheLightCosines OpenSSL ChangeCipherSpec DoS aux module 
git-svn-id: file:///home/svn/framework3/trunk@12538 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-04 19:08:28 +00:00
Steve Tornio 319b4993a4 add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@12397 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-21 19:38:42 +00:00
David Rude 0f9a232025 Added Spreecommerce Remote Code Execution exploit module - thanks joernchen 
git-svn-id: file:///home/svn/framework3/trunk@12392 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-21 16:57:17 +00:00
Wei Chen 6d71990dfc Disclosure date change 
git-svn-id: file:///home/svn/framework3/trunk@12390 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-21 15:40:59 +00:00
Joshua Drake d2374a435f add .jar extension, thx for the contribution! 
git-svn-id: file:///home/svn/framework3/trunk@12285 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-09 17:03:41 +00:00
Steve Tornio 46d88f54f6 add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@12242 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-05 01:08:07 +00:00
David Rude 0bea0233a0 add the slash =) 
git-svn-id: file:///home/svn/framework3/trunk@12241 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-05 00:13:01 +00:00
David Rude ce7b72bfce Use get_uri instead of manually building the path 
git-svn-id: file:///home/svn/framework3/trunk@12240 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-05 00:08:36 +00:00
David Rude 7816b87595 Added Zend Java Bridge exploit module java meterpreter ftw 
git-svn-id: file:///home/svn/framework3/trunk@12239 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-04 23:39:27 +00:00
Joshua Drake f0673cb1ac Tweak to work with FreeBSD, thx for the patch! 
git-svn-id: file:///home/svn/framework3/trunk@12224 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-03 17:40:45 +00:00
David Rude c5ce597483 removing coldfusion until some general code fixes can be applied 
git-svn-id: file:///home/svn/framework3/trunk@11995 4d416f70-5f16-0410-b530-b9f4589650da
 2011-03-16 21:41:47 +00:00
Mario Ceballos dfd2df6b47 puts this in the appropiate place 
git-svn-id: file:///home/svn/framework3/trunk@11987 4d416f70-5f16-0410-b530-b9f4589650da
 2011-03-16 10:22:07 +00:00
amaloteaux 5f6995e8d3 enable ntlmv2 and signing for smb client stack (pth implementation is coming), fixes #11678 and #152 
git-svn-id: file:///home/svn/framework3/trunk@11893 4d416f70-5f16-0410-b530-b9f4589650da
 2011-03-07 19:57:53 +00:00
HD Moore f49e040a96 This patch adds a ListenerTimeout option to multi/handler that sets a maximum wait time for sessions. This is useful to prevent leftover background handlers by unsuccessful or misconfigured post modules. 
git-svn-id: file:///home/svn/framework3/trunk@11845 4d416f70-5f16-0410-b530-b9f4589650da
 2011-02-28 03:22:40 +00:00
Joshua Drake 1604b5616f apply some more changes from Konrads 
git-svn-id: file:///home/svn/framework3/trunk@11533 4d416f70-5f16-0410-b530-b9f4589650da
 2011-01-10 14:34:24 +00:00
Joshua Drake 9ef757bf17 Fixes #3387, add the PACKAGE option to allow 3.2 
git-svn-id: file:///home/svn/framework3/trunk@11518 4d416f70-5f16-0410-b530-b9f4589650da
 2011-01-08 04:11:01 +00:00
Joshua Drake 287f4c87fe style compliance fixes 
git-svn-id: file:///home/svn/framework3/trunk@11516 4d416f70-5f16-0410-b530-b9f4589650da
 2011-01-08 01:13:26 +00:00
James Lee a79092a0d3 this is really unlimited, but bump it a bit for possible larger payloads later. 
git-svn-id: file:///home/svn/framework3/trunk@11474 4d416f70-5f16-0410-b530-b9f4589650da
 2011-01-04 23:37:11 +00:00
James Lee fd1fb44bfc add targets for windows and linux 
git-svn-id: file:///home/svn/framework3/trunk@11345 4d416f70-5f16-0410-b530-b9f4589650da
 2010-12-15 22:46:22 +00:00
James Lee dd6afdc74c make these titles a little clearer 
git-svn-id: file:///home/svn/framework3/trunk@11330 4d416f70-5f16-0410-b530-b9f4589650da
 2010-12-14 17:26:44 +00:00
James Lee 05d073c467 move the evil-looking metasploit.PayloadApplet to the more inocuous SiteLoader.class, re-enable rjb compiling for the applet class 
git-svn-id: file:///home/svn/framework3/trunk@11249 4d416f70-5f16-0410-b530-b9f4589650da
 2010-12-07 20:43:53 +00:00
James Lee 62a425f6b6 add rjb signing back in to java_signed_applet 
git-svn-id: file:///home/svn/framework3/trunk@11186 4d416f70-5f16-0410-b530-b9f4589650da
 2010-12-01 01:29:08 +00:00
Joshua Drake 26a9fe6fc7 add some missing CVE references 
git-svn-id: file:///home/svn/framework3/trunk@11180 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-30 20:19:18 +00:00
Joshua Drake d5835fe7b0 remove commented out REST portion 
git-svn-id: file:///home/svn/framework3/trunk@11179 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-30 19:11:42 +00:00
Joshua Drake 98e8ec4cc9 add REST version of axis2 deployer 
git-svn-id: file:///home/svn/framework3/trunk@11178 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-30 18:17:33 +00:00
James Lee 191c4e8eb7 make java_signed_applet work with generic java payloads, but keep the default target as Windows/x86 since it is by far the most common victim. 
git-svn-id: file:///home/svn/framework3/trunk@11172 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-30 03:50:40 +00:00
Joshua Drake 1eda716b70 fix another ruby-ism problem checking modulus return 
git-svn-id: file:///home/svn/framework3/trunk@11166 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-30 00:16:53 +00:00
Joshua Drake e9faf75503 fix some more titles with periods 
git-svn-id: file:///home/svn/framework3/trunk@11127 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-24 19:35:38 +00:00
Joshua Drake f68fc02f9c include capture mixin for modules that use it 
git-svn-id: file:///home/svn/framework3/trunk@11126 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-24 19:25:18 +00:00
Joshua Drake 1d8e1e332c add better error reporting 
git-svn-id: file:///home/svn/framework3/trunk@11120 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-24 01:11:49 +00:00
Joshua Drake 2fe78ec685 double grammar fail 
git-svn-id: file:///home/svn/framework3/trunk@11053 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-16 20:23:11 +00:00
Joshua Drake f4d2af3e73 fix typo 
git-svn-id: file:///home/svn/framework3/trunk@11052 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-16 20:17:25 +00:00
Joshua Drake 25611afb6c add sap businessobject modules from jabra, woot! 
git-svn-id: file:///home/svn/framework3/trunk@11046 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-15 05:12:48 +00:00
Joshua Drake 4a5bee45c5 style compliance fixes 
git-svn-id: file:///home/svn/framework3/trunk@11015 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-12 23:14:46 +00:00
Mario Ceballos 2aca76ef66 added exploit module freenas_exec_raw.rb. php/meterpreter ftw. 
git-svn-id: file:///home/svn/framework3/trunk@11014 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-12 23:02:28 +00:00
James Lee 326dc42bca add EncodedPayload#encoded_exe, encoded_jar, and encoded_war. simplifies exploits that need java and native payloads. see #406 and #3009 
git-svn-id: file:///home/svn/framework3/trunk@10999 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-11 23:01:35 +00:00
Joshua Drake 3992eb7ef8 Mass RE-update: fix all framework URL references 
git-svn-id: file:///home/svn/framework3/trunk@10998 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-11 22:43:22 +00:00
Joshua Drake 9fc6f2f3a3 Mass update: fix all framework URL references 
git-svn-id: file:///home/svn/framework3/trunk@10996 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-11 22:25:13 +00:00
Mario Ceballos 58f62bedda fix load errors 
git-svn-id: file:///home/svn/framework3/trunk@10933 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-06 19:19:35 +00:00
Joshua Drake 2a69811344 raise RuntimeError instead of return 
git-svn-id: file:///home/svn/framework3/trunk@10932 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-06 18:09:28 +00:00
Joshua Drake 1f235a8c9b remove 64-bit targets since we dont have an x86_64 linux exe generator 
git-svn-id: file:///home/svn/framework3/trunk@10833 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-27 17:21:54 +00:00
Joshua Drake be841a4810 check for failed serverinfo result 
git-svn-id: file:///home/svn/framework3/trunk@10788 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-22 21:32:12 +00:00
James Lee 3b2c43fac4 get rid of the redundant second java target 
git-svn-id: file:///home/svn/framework3/trunk@10785 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-22 20:07:18 +00:00
James Lee f33d7cc670 revamp java payloads and make shells work with tomcat_mgr_deploy. tested java_trusted_chain and java_tester to verify that this doesn't break other java payload usage. see #3009 and #2973, meterpreter doesn't work yet, so not marking resolved. 
git-svn-id: file:///home/svn/framework3/trunk@10781 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-22 10:19:51 +00:00
Joshua Drake c6f1fa716d add a java target, fixes #2973 
git-svn-id: file:///home/svn/framework3/trunk@10755 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-19 22:36:59 +00:00
Joshua Drake 771ea5862c fix typo 
git-svn-id: file:///home/svn/framework3/trunk@10754 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-19 22:24:33 +00:00
Joshua Drake 1935f2007f fix exe generation for auto-targetting 
git-svn-id: file:///home/svn/framework3/trunk@10753 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-19 22:21:19 +00:00
Joshua Drake 042e71c357 add ports/refs for ZDI-10-214 
git-svn-id: file:///home/svn/framework3/trunk@10747 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-19 14:28:52 +00:00
Joshua Drake b49e81300a fix auto-target exe generation 
git-svn-id: file:///home/svn/framework3/trunk@10688 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-14 21:26:05 +00:00
Joshua Drake ae04e34cf7 fix some non-full-namespace includes 
git-svn-id: file:///home/svn/framework3/trunk@10617 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-09 06:55:52 +00:00
Joshua Drake 279c604015 missed a couple exe generater includes 
git-svn-id: file:///home/svn/framework3/trunk@10504 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-28 16:19:50 +00:00
James Lee 8c1f0713db regenerate the payload so we get the correct *lhost* 
git-svn-id: file:///home/svn/framework3/trunk@10490 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-27 00:09:17 +00:00
James Lee 4fbb0653a1 regenerate the payload so we get the correct rhost 
git-svn-id: file:///home/svn/framework3/trunk@10488 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-26 23:55:03 +00:00
Joshua Drake bd1eeb3722 rework to_jsp_war a bit, fix uses, default msfencode -t war to x86/win32 
git-svn-id: file:///home/svn/framework3/trunk@10397 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-20 15:59:46 +00:00
Joshua Drake 4590844871 tons of indentation fixes, some other style tweaks 
git-svn-id: file:///home/svn/framework3/trunk@10394 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-20 08:06:27 +00:00
Joshua Drake 19db412383 convert remaining EXE generation to use the mixin, fixes #2017 
git-svn-id: file:///home/svn/framework3/trunk@10389 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-20 04:38:13 +00:00
James Lee a9a312fa66 typo 
git-svn-id: file:///home/svn/framework3/trunk@10257 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-08 15:23:04 +00:00
James Lee 85126af521 add an exploit module for cve-2010-0094, thanks Matthias Kaiser. 
git-svn-id: file:///home/svn/framework3/trunk@10255 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-08 08:20:55 +00:00
Joshua Drake 330281eadd see #684, adds checksum support, updates modules to use it, fixes some wfs_delay/WfsDelay issues 
git-svn-id: file:///home/svn/framework3/trunk@10150 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-25 20:55:37 +00:00
Joshua Drake aac956db50 style compliance fixes 
git-svn-id: file:///home/svn/framework3/trunk@10128 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-24 18:22:48 +00:00
James Lee 2e13a330fa typo'd Matthias' name. i suck 
git-svn-id: file:///home/svn/framework3/trunk@10113 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-23 18:49:35 +00:00
James Lee 90e89622c6 make it a little easier to distinguish these two from their output 
git-svn-id: file:///home/svn/framework3/trunk@10096 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-21 07:53:25 +00:00
James Lee 7381ab8b6d duh, dont actually need this 
git-svn-id: file:///home/svn/framework3/trunk@10093 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-21 07:19:49 +00:00
James Lee 6b08dfed61 Add exploit module for cve-2010-08040. This is an awesome bug and my description field doesn't do it justice 
git-svn-id: file:///home/svn/framework3/trunk@10092 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-21 06:38:29 +00:00
James Lee 56396a6d8b add java support to browser_autopwn 
git-svn-id: file:///home/svn/framework3/trunk@10089 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-20 20:49:33 +00:00
Joshua Drake 2545410bc7 make exe template names more consistent 
git-svn-id: file:///home/svn/framework3/trunk@10065 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-19 21:08:51 +00:00
Joshua Drake dc3e099f5b remove custom function in favor of new NO RECV flags to smb client methods 
git-svn-id: file:///home/svn/framework3/trunk@10040 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-18 17:24:46 +00:00
James Lee 73081e319f allow multi/handler to work with java 
git-svn-id: file:///home/svn/framework3/trunk@10020 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-16 16:34:55 +00:00
Joshua Drake d540818f01 split http exploit mixin into http/server and http/client 
git-svn-id: file:///home/svn/framework3/trunk@9971 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-07 06:59:16 +00:00
Joshua Drake 2f384cde82 add alias for calling Msf::Exploit regenerate_payload explicitly -- fixes #2312 
git-svn-id: file:///home/svn/framework3/trunk@9950 4d416f70-5f16-0410-b530-b9f4589650da
 2010-08-03 15:14:34 +00:00
James Lee e1ed341136 remove debug prints 
git-svn-id: file:///home/svn/framework3/trunk@9938 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-27 21:05:41 +00:00
Joshua Drake f6033b9bd6 change some print_status to print_error, rename a few msft modules using msb convention 
git-svn-id: file:///home/svn/framework3/trunk@9929 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-25 21:37:54 +00:00
Joshua Drake 2482a83526 style compliance fixes 
git-svn-id: file:///home/svn/framework3/trunk@9927 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-25 19:14:00 +00:00
Joshua Drake 84e3a95d2b yield the session faster by not waiting for a response 
git-svn-id: file:///home/svn/framework3/trunk@9911 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-21 23:40:34 +00:00
Steve Tornio 018af7f690 add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@9906 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-21 21:09:54 +00:00
Joshua Drake 719ce5d551 use ntlm explicitly, fixes #2158 
git-svn-id: file:///home/svn/framework3/trunk@9900 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-21 06:04:20 +00:00
James Lee 08d705c1db add java meterpreter and update java_calendar_deserialize to be able to use it, see #406 
git-svn-id: file:///home/svn/framework3/trunk@9874 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-20 00:53:24 +00:00
James Lee 9891ea5374 Typo which caused this exploit never to get run in browser_autopwn 
git-svn-id: file:///home/svn/framework3/trunk@9802 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-13 09:03:56 +00:00
Joshua Drake 16ff17c9d1 add more http fingerprints -- thx mc 
git-svn-id: file:///home/svn/framework3/trunk@9797 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-12 23:25:31 +00:00
James Lee 9f37d46f7b minimize autopwn settings 
git-svn-id: file:///home/svn/framework3/trunk@9784 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-11 23:21:04 +00:00
James Lee 28e40bdc9f add java_calendar_deserialize to browser_autopwn 
git-svn-id: file:///home/svn/framework3/trunk@9783 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-11 23:16:51 +00:00
Joshua Drake 663b863b6d http fingerprint checking update 
git-svn-id: file:///home/svn/framework3/trunk@9719 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-07 17:38:59 +00:00
Joshua Drake a3d901a6b9 various minor fixes, some added fingerprinting 
git-svn-id: file:///home/svn/framework3/trunk@9671 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-03 06:21:31 +00:00
Joshua Drake 7d945ed9dc add lots of disclosure dates from OSVDB 
git-svn-id: file:///home/svn/framework3/trunk@9669 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-03 03:13:45 +00:00
Joshua Drake 9984b662e0 switch some URL references to US-CERT-VU type 
git-svn-id: file:///home/svn/framework3/trunk@9666 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-03 01:09:32 +00:00
Joshua Drake 0882838491 ensure binary mode when opening files, whitespace fixes 
git-svn-id: file:///home/svn/framework3/trunk@9653 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-01 23:33:07 +00:00
Joshua Drake 93b09648c7 add additional CVE reference, cleanup references 
git-svn-id: file:///home/svn/framework3/trunk@9642 4d416f70-5f16-0410-b530-b9f4589650da
 2010-07-01 19:42:11 +00:00
Joshua Drake 12fbdcd878 add http_fingerprint calls to modules that use various headers 
git-svn-id: file:///home/svn/framework3/trunk@9627 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-25 20:53:12 +00:00
Joshua Drake 48994d234a oops, remove java from platform list 
git-svn-id: file:///home/svn/framework3/trunk@9609 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-24 16:38:24 +00:00
Joshua Drake 099b90b0d6 another update for jboss stuff, thanks Patrick! 
git-svn-id: file:///home/svn/framework3/trunk@9596 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-23 22:25:03 +00:00
Joshua Drake 58cbf5d6ad oops, fixed app_base mistake 
git-svn-id: file:///home/svn/framework3/trunk@9586 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-22 23:10:30 +00:00
Tod Beardsley 9d46383040 Fixes #2134. Subs select for sleep in exploit modules. 
git-svn-id: file:///home/svn/framework3/trunk@9583 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-22 19:11:05 +00:00
Mario Ceballos 9780efabdd missed Version 
git-svn-id: file:///home/svn/framework3/trunk@9578 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-22 01:24:52 +00:00
Mario Ceballos ccece11b9b changed from the orignal method, thanks patrick. 
git-svn-id: file:///home/svn/framework3/trunk@9577 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-22 01:08:02 +00:00
Joshua Drake 752905a777 style compliance fixes 
git-svn-id: file:///home/svn/framework3/trunk@9571 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-21 16:53:52 +00:00
Joshua Drake 19742afb38 use pack instead of Base64 
git-svn-id: file:///home/svn/framework3/trunk@9569 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-21 16:45:26 +00:00
Joshua Drake 4ceb936533 some jboss updates, much thanks to Patrick Hof 
git-svn-id: file:///home/svn/framework3/trunk@9568 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-21 16:26:14 +00:00
Joshua Drake 79190edba3 throw an error when ExitOnSession is false with no job_id 
git-svn-id: file:///home/svn/framework3/trunk@9526 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-15 17:25:14 +00:00
Joshua Drake fa505a4069 various fixes, mostly consistency changes to disclosure dates 
git-svn-id: file:///home/svn/framework3/trunk@9525 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-15 07:18:08 +00:00
Joshua Drake 698da3bdea add CVE for cognos express 
git-svn-id: file:///home/svn/framework3/trunk@9502 4d416f70-5f16-0410-b530-b9f4589650da
 2010-06-12 09:37:21 +00:00
Steve Tornio 1192e0860e add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@9294 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-12 19:30:54 +00:00
Joshua Drake a964d403be merge patch from scriptjunkie, fixes #1875 
git-svn-id: file:///home/svn/framework3/trunk@9286 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-11 22:28:18 +00:00
Joshua Drake 711e08b5e9 make sure to use correct verbs, thanks mc! 
git-svn-id: file:///home/svn/framework3/trunk@9285 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-11 16:20:46 +00:00
Joshua Drake 7f758d5a02 add VERB option to enable exploiting cve-2010-0738 
git-svn-id: file:///home/svn/framework3/trunk@9282 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-11 09:14:36 +00:00
Joshua Drake 128e0515ef stop perpetuating the ambiguity! 
git-svn-id: file:///home/svn/framework3/trunk@9262 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-09 17:45:00 +00:00
Joshua Drake d7c99b107c RE-fix and add svnkeywords, MC!!! 
git-svn-id: file:///home/svn/framework3/trunk@9261 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-09 17:30:05 +00:00
Mario Ceballos d33dc27e26 updated.. thanks jmg. 
git-svn-id: file:///home/svn/framework3/trunk@9256 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-09 12:54:16 +00:00
Steve Tornio a47f7dcb2e add osvdb ref 
git-svn-id: file:///home/svn/framework3/trunk@9251 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-08 16:46:49 +00:00
Joshua Drake d296e0cdc3 minor cleanups 
git-svn-id: file:///home/svn/framework3/trunk@9245 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-07 22:28:21 +00:00
Mario Ceballos 579d35035b added exploit module for cve-2006-5750 
git-svn-id: file:///home/svn/framework3/trunk@9244 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-07 22:21:44 +00:00
James Lee e70dabf3e3 warn and remove commas from CERTCN to prevent a crash bug in Rjb's keytool, fixes 1543 
git-svn-id: file:///home/svn/framework3/trunk@9241 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-07 18:19:50 +00:00
Joshua Drake 0e72894e58 more cleanups 
git-svn-id: file:///home/svn/framework3/trunk@9212 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-03 17:13:09 +00:00
Joshua Drake 61402c4b55 add to description 
git-svn-id: file:///home/svn/framework3/trunk@9202 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-02 21:04:56 +00:00
Joshua Drake ff46c5d867 add exploit module for cve-2010-0361 on windows 
git-svn-id: file:///home/svn/framework3/trunk@9201 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-02 20:52:14 +00:00
HD Moore 42da9e899a Improvements to the cleanup process, close sockets properly for exploits and auxiliary 
git-svn-id: file:///home/svn/framework3/trunk@9187 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-01 16:26:24 +00:00
Joshua Drake 2e2142d345 add Maple exploit from scriptjunkie 
git-svn-id: file:///home/svn/framework3/trunk@9183 4d416f70-5f16-0410-b530-b9f4589650da
 2010-05-01 02:05:56 +00:00
Joshua Drake 0ea6eca4bc big module whitespace/formatting cleanup pass 
git-svn-id: file:///home/svn/framework3/trunk@9179 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-30 08:40:19 +00:00
Joshua Drake 54725099d5 oops it wasnt broken after all! 
git-svn-id: file:///home/svn/framework3/trunk@9178 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-30 06:38:48 +00:00
Joshua Drake 22529ae81b add USERNAME/PASSWORD options 
git-svn-id: file:///home/svn/framework3/trunk@9177 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-30 06:30:59 +00:00
Joshua Drake b6d9f2fac5 another ill-place "end" statement... 
git-svn-id: file:///home/svn/framework3/trunk@9176 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-30 06:13:26 +00:00
Joshua Drake 4cdb64f6b9 corrected version range 
samba.org reports 3.0.0 - 3.0.25rc3 but that is for the underlying cmd execution bugs
username map script wasnt introduced until 3.0.20


git-svn-id: file:///home/svn/framework3/trunk@9168 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-28 06:43:51 +00:00
Joshua Drake 4f364e2830 add description, versions, fix whitespace 
git-svn-id: file:///home/svn/framework3/trunk@9167 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-28 03:54:24 +00:00
Joshua Drake 1f8605e26d fix check method, lol? 
git-svn-id: file:///home/svn/framework3/trunk@9026 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-06 04:58:03 +00:00
Joshua Drake 1a47c436d3 support amd64 arch 
git-svn-id: file:///home/svn/framework3/trunk@9025 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-06 04:08:39 +00:00
HD Moore 7af2fdf42e Remove silly cases of print_good 
git-svn-id: file:///home/svn/framework3/trunk@9021 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-05 23:34:10 +00:00
natron b5ee26770b Cameled all vars on accident, uncameling regular opts. Also, broke native osx payload, oops. 
git-svn-id: file:///home/svn/framework3/trunk@8970 4d416f70-5f16-0410-b530-b9f4589650da
 2010-04-01 05:15:26 +00:00
Joshua Drake 516a6f47e5 move USERNAME/PASSWORD setting to exploit instead of auto_target so manual targets work - fixes #1416 
git-svn-id: file:///home/svn/framework3/trunk@8967 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-31 22:29:47 +00:00
natron c1fa8d60f7 Expose exe :template and :insert via advanced options plus formatting changes. Thanks MarkBagget for the kick in the pants and the example options to to_win32pe\! 
git-svn-id: file:///home/svn/framework3/trunk@8966 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-31 22:05:32 +00:00
HD Moore 2b419a421d Add default timeouts to autopwn, control with -T 
git-svn-id: file:///home/svn/framework3/trunk@8892 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-24 00:11:21 +00:00
Joshua Drake b8b11338b1 add linux x86/x86_64 support for tomcat manger deploy, see #1016 
git-svn-id: file:///home/svn/framework3/trunk@8853 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-19 02:13:02 +00:00
Joshua Drake b419a40c45 finished periodic missing CVE reference check (hint vulns w/o CVEs here!) 
also some minor cleanups here and there

git-svn-id: file:///home/svn/framework3/trunk@8762 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-10 05:58:01 +00:00
Joshua Drake 3b9524697f add verbose option 
git-svn-id: file:///home/svn/framework3/trunk@8761 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-10 05:55:47 +00:00
Joshua Drake 35c4a1d123 handle missing targets more gracefully, stub out linux and x86_64 support detection 
git-svn-id: file:///home/svn/framework3/trunk@8729 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-05 17:35:18 +00:00
Joshua Drake 28f4eb2fd9 handle failed logins - fixes #1014 
git-svn-id: file:///home/svn/framework3/trunk@8728 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-05 17:05:12 +00:00
Joshua Drake e80df81350 correct the CVE reference 
git-svn-id: file:///home/svn/framework3/trunk@8678 4d416f70-5f16-0410-b530-b9f4589650da
 2010-03-01 19:47:13 +00:00
James Lee 3b59bc7cfc use the same option names for user/pass 
git-svn-id: file:///home/svn/framework3/trunk@8674 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-26 22:14:58 +00:00
Joshua Drake 541a409f44 remove app_name variable 
git-svn-id: file:///home/svn/framework3/trunk@8619 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-24 16:53:55 +00:00
Joshua Drake 865969e059 whitespace adjustments - finally closes #773 
git-svn-id: file:///home/svn/framework3/trunk@8575 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-21 01:44:34 +00:00
Joshua Drake 32bf50c627 add exploit module to get code exec from jboss.system:MainDeployer access 
git-svn-id: file:///home/svn/framework3/trunk@8574 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-21 01:41:24 +00:00
Joshua Drake 8446a0c305 add auto-targeting to tomcat_mgr_deploy, fixes #887 
git-svn-id: file:///home/svn/framework3/trunk@8564 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-20 01:14:39 +00:00
natron 5b3c87c9c5 Add option to save java code to file. 
git-svn-id: file:///home/svn/framework3/trunk@8557 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-19 05:11:56 +00:00
Joshua Drake 2e77c76824 add exploit module to get code exec on a tomcat manager instance, closes #772 
git-svn-id: file:///home/svn/framework3/trunk@8552 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-18 18:18:43 +00:00
Joshua Drake 82369aa9e8 add exploit module for cve-2007-2447 
git-svn-id: file:///home/svn/framework3/trunk@8510 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-16 00:26:41 +00:00
natron 9729b22972 Loopty version of the wireshark exploit. This will continually blast packets as a background job. 
git-svn-id: file:///home/svn/framework3/trunk@8460 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-12 01:58:33 +00:00
Joshua Drake 6e80c7a62c use Rex::Arch::pack_addr 
git-svn-id: file:///home/svn/framework3/trunk@8454 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-11 09:03:48 +00:00
Joshua Drake 0f942df9cd whitespace changes 
git-svn-id: file:///home/svn/framework3/trunk@8451 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-11 06:00:12 +00:00
Joshua Drake d96a6a1f8f add exploit module for cve-2009-2261 - first consumer of zip library! 
git-svn-id: file:///home/svn/framework3/trunk@8440 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-10 17:28:25 +00:00
Joshua Drake 9397c897ba fix spoof support 
git-svn-id: file:///home/svn/framework3/trunk@8367 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-04 04:56:18 +00:00
Joshua Drake 9b79ebd000 add a windows target, thx redsand! 
also removed some cruft


git-svn-id: file:///home/svn/framework3/trunk@8364 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-03 18:24:42 +00:00
Joshua Drake a41647a922 add silly jmp esp target for wireshark gui on debian 
git-svn-id: file:///home/svn/framework3/trunk@8360 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-03 00:08:28 +00:00
Steve Tornio 2cbd6d152d Add cve and osvdb refs 
git-svn-id: file:///home/svn/framework3/trunk@8347 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-02 12:37:07 +00:00
Joshua Drake 98dd073368 add an exploit module for one of the wireshark lwres vulns 
git-svn-id: file:///home/svn/framework3/trunk@8346 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-02 06:20:18 +00:00
natron 3ecabe1be9 Adds static signed jar and user messages letting them know. 
git-svn-id: file:///home/svn/framework3/trunk@8328 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-29 19:47:40 +00:00
natron 69ad365b46 Added STDERR to pure java payload, cleaned up user's view. 
git-svn-id: file:///home/svn/framework3/trunk@8308 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-28 22:53:36 +00:00
natron 9891d60dfc Move applet generation up for slight speed improvement and less spamminess to the user. 
git-svn-id: file:///home/svn/framework3/trunk@8281 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-27 23:15:36 +00:00
natron 5e4442a4d4 Fix a bug missed due to caching issues. 
git-svn-id: file:///home/svn/framework3/trunk@8276 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-27 20:58:13 +00:00
natron c135462768 <@jduck> natron: you need some svn keywords magic 
git-svn-id: file:///home/svn/framework3/trunk@8274 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-27 20:20:32 +00:00
natron cd5e5880d2 Initial commit of Msf::Exploit::Java mixin and multi/browser/java_signed_applet exploit. 
git-svn-id: file:///home/svn/framework3/trunk@8267 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-27 19:46:39 +00:00
Joshua Drake 31949c4343 svn keywords fixups 
fixed a bunch of $Id$ and $Revision$ typos
added keywords property to files missing it



git-svn-id: file:///home/svn/framework3/trunk@8242 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-26 20:12:13 +00:00
Joshua Drake 310be42bfa try not to repeatedly load static files - see #694 
git-svn-id: file:///home/svn/framework3/trunk@8166 4d416f70-5f16-0410-b530-b9f4589650da
 2010-01-19 19:12:42 +00:00
Joshua Drake 5ef4545a1b fd.read -> fd.read(fd.stat.size) 
git-svn-id: file:///home/svn/framework3/trunk@7903 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-17 05:22:40 +00:00
Joshua Drake b37c34579b add exploit module for cve-2009-3869 
NOTE: no policy change is required for this exploit to succeed.



git-svn-id: file:///home/svn/framework3/trunk@7899 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-17 04:52:40 +00:00
James Lee 115899d24d add minver and maxver. slightly tricky because the vuln affects moz 1.7 and ff 1.0 
git-svn-id: file:///home/svn/framework3/trunk@7886 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-15 21:54:24 +00:00
James Lee 008c72e255 add proper version 
git-svn-id: file:///home/svn/framework3/trunk@7885 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-15 21:49:32 +00:00
Joshua Drake 56c2d32b1e typo fix 
git-svn-id: file:///home/svn/framework3/trunk@7883 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-15 20:37:15 +00:00
James Lee 2570fcee15 get rid of some more ^Ms 
git-svn-id: file:///home/svn/framework3/trunk@7880 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-15 18:47:29 +00:00
James Lee 48c3709a25 correct maxver 
git-svn-id: file:///home/svn/framework3/trunk@7879 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-15 18:46:53 +00:00
James Lee 0cf566c0b9 fixes 688. better return address for greater reliability, works against FF-1.0.4 and Moz-1.7.1 on XPSP3 and 2kAS-SP0 
git-svn-id: file:///home/svn/framework3/trunk@7865 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-14 23:27:28 +00:00
Joshua Drake f1a975a14e fix typo, remove automatic target 
git-svn-id: file:///home/svn/framework3/trunk@7834 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-12 21:44:04 +00:00
Joshua Drake 34408c5e3e add exploit module for CVE-2009-3867 (JRE getSoundbank) 
git-svn-id: file:///home/svn/framework3/trunk@7827 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-11 21:18:31 +00:00
Joshua Drake 4cb050010b add exploitability detection (by trying %n) 
git-svn-id: file:///home/svn/framework3/trunk@7791 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-09 23:53:26 +00:00
Joshua Drake 215879334a minor tweaks to targets 
git-svn-id: file:///home/svn/framework3/trunk@7788 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-09 23:19:19 +00:00
Joshua Drake d56daab7d8 little comment heh 
git-svn-id: file:///home/svn/framework3/trunk@7784 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-09 22:27:11 +00:00
Joshua Drake 164dd4201a updated badchars, rh6.2 target, added %8x detection check 
git-svn-id: file:///home/svn/framework3/trunk@7782 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-09 21:51:46 +00:00
Joshua Drake 88de26e46c re-enable pdf obfuscation 
git-svn-id: file:///home/svn/framework3/trunk@7771 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-09 06:19:32 +00:00
Joshua Drake e2f70c8928 detect fmt str specifier capabilities, rework stack dumping 
git-svn-id: file:///home/svn/framework3/trunk@7769 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-09 02:19:07 +00:00
Joshua Drake 1fec10cb44 finish and test target for redhat 6.2 
git-svn-id: file:///home/svn/framework3/trunk@7765 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-08 23:52:11 +00:00
Joshua Drake 4bcc8a93a3 attempt to improve reliability of u3d pdf exploits 
git-svn-id: file:///home/svn/framework3/trunk@7762 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-08 22:08:32 +00:00
Joshua Drake ff83f1cd2f add ranking to every exploit module, pfew! 
git-svn-id: file:///home/svn/framework3/trunk@7724 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-06 05:50:37 +00:00
Joshua Drake 619f82a420 ugh, rh6.1 isn't vulnerable either 
git-svn-id: file:///home/svn/framework3/trunk@7720 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-06 03:42:37 +00:00
Joshua Drake 576d55f821 added some missing CVE references 
git-svn-id: file:///home/svn/framework3/trunk@7719 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-06 02:30:42 +00:00
Joshua Drake e8e98b9be6 add exploit module for cve-2000-0573 
git-svn-id: file:///home/svn/framework3/trunk@7693 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-04 07:50:53 +00:00
James Lee 8e0eef03c6 see #594. remove some extraneous junk, don't run the shell in a terminal (it dies immediately). space is the only badchar. still doesn't actually work without a modification to encoder/cmd/generic_sh. 
git-svn-id: file:///home/svn/framework3/trunk@7680 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-03 09:09:56 +00:00
HD Moore b0403cfde2 OSVDB references from Steve Tornio 
git-svn-id: file:///home/svn/framework3/trunk@7658 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-01 16:44:25 +00:00
Joshua Drake 38d04631e6 recorded some additional test results 
git-svn-id: file:///home/svn/framework3/trunk@7657 4d416f70-5f16-0410-b530-b9f4589650da
 2009-12-01 16:42:58 +00:00
Joshua Drake f845a7db54 dissected most of the u3d data 
git-svn-id: file:///home/svn/framework3/trunk@7628 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-26 07:26:08 +00:00
Joshua Drake 3bcc51e155 added exloit module for cve-2009-2990 
git-svn-id: file:///home/svn/framework3/trunk@7580 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-22 01:15:13 +00:00
Joshua Drake 008fbedf93 created multi-platform fileformat dir 
git-svn-id: file:///home/svn/framework3/trunk@7579 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-22 01:14:52 +00:00
HD Moore 61e233df91 Keywords on all modules, plugins, and scripts 
git-svn-id: file:///home/svn/framework3/trunk@7550 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-17 00:05:19 +00:00
James Lee b4d04ab22d fix 1.9 str[idx] error; see #519 
git-svn-id: file:///home/svn/framework3/trunk@7534 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-16 18:28:34 +00:00
HD Moore ac14e84eb6 See #434. Fixes up the last of the modules using the wrong Timeout exception class 
git-svn-id: file:///home/svn/framework3/trunk@7326 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-02 18:22:50 +00:00
HD Moore e3f68f2639 Another large number of warnings fixed by Yoann Guillot 
git-svn-id: file:///home/svn/framework3/trunk@7248 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-25 17:18:23 +00:00
HD Moore b38a74c961 Another mega-patch from Yoann Guillot: fixes warnings generated by method calls with a space betwee the method and the parans, corrects a problem with the alpha encoders that causes them to overwrite the allowed charset, hardcodes the metasm output size of some modules in order to reduce load time, more to come 
git-svn-id: file:///home/svn/framework3/trunk@7246 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-25 16:40:19 +00:00
HD Moore a0fbc2914f Remove the milw0rm references, as the links are no longer valid. 
git-svn-id: file:///home/svn/framework3/trunk@7237 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-24 18:13:07 +00:00
HD Moore d3aa513773 Fixes #339. Cleans up author names for the most part - there are still some stragglers, but this should fix up the frequent contributors 
git-svn-id: file:///home/svn/framework3/trunk@7173 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-17 05:55:15 +00:00
Mario Ceballos aae4ac74c1 more adjusting of the cve entries. 
git-svn-id: file:///home/svn/framework3/trunk@7157 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-14 12:56:13 +00:00
Mario Ceballos 8e365c17fa fixed the cve entrys. 
git-svn-id: file:///home/svn/framework3/trunk@7156 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-14 11:45:14 +00:00
HD Moore 26db223636 OSVDB reference update from Steve Tornio 
git-svn-id: file:///home/svn/framework3/trunk@7149 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-12 14:39:51 +00:00
HD Moore 5972666f63 See #339. Massive cleanup of author names, make them consistent across modules 
git-svn-id: file:///home/svn/framework3/trunk@7075 4d416f70-5f16-0410-b530-b9f4589650da
 2009-09-27 21:30:45 +00:00
James Lee 9ace8f33eb OSVDB references from Steve Tornio 
git-svn-id: file:///home/svn/framework3/trunk@7030 4d416f70-5f16-0410-b530-b9f4589650da
 2009-09-12 04:22:58 +00:00
HD Moore 71d644e72e Fix the Payload->Space to match the new max size limit for the EXE generator. Thanks for catching it MC 
git-svn-id: file:///home/svn/framework3/trunk@7022 4d416f70-5f16-0410-b530-b9f4589650da
 2009-09-09 21:23:11 +00:00
HD Moore fd0f4ef65b Exploit from Kevin F. for CVE-2009-0695, a remote cmd execution flaw in the Wyse thin client platform. 
git-svn-id: file:///home/svn/framework3/trunk@6968 4d416f70-5f16-0410-b530-b9f4589650da
 2009-08-19 18:06:03 +00:00
James Lee e16647db74 make sure we're running on opera so we don't 404 on a suspicous-looking url if it isn't 
git-svn-id: file:///home/svn/framework3/trunk@6963 4d416f70-5f16-0410-b530-b9f4589650da
 2009-08-18 05:10:11 +00:00
James Lee bd2da7c12a revert overzealous commit 
git-svn-id: file:///home/svn/framework3/trunk@6961 4d416f70-5f16-0410-b530-b9f4589650da
 2009-08-18 04:53:35 +00:00
James Lee 08d50e0a5b fix a bug in colorization where %c gets replaced before %cya; wouldn't have been a problem until colorization gets put back in 
git-svn-id: file:///home/svn/framework3/trunk@6960 4d416f70-5f16-0410-b530-b9f4589650da
 2009-08-18 04:49:16 +00:00
James Lee c29af0197a make opera_historysearch work in an iframe and speed it up so it is less likely to tip off a user 
git-svn-id: file:///home/svn/framework3/trunk@6915 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-28 11:08:50 +00:00
HD Moore 876a80f601 Updated osvdb references from Steve Tornio, updated capture/eth_spoof modules 
git-svn-id: file:///home/svn/framework3/trunk@6907 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-27 14:05:23 +00:00
James Lee e805bbc3aa remove stupid debug alert 
git-svn-id: file:///home/svn/framework3/trunk@6882 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-23 08:58:51 +00:00
James Lee 739207bf4a merge browser_autopwn back into trunk. This changes the database schema slightly, so make sure to db_destroy and db_create before using the database features. 
git-svn-id: file:///home/svn/framework3/trunk@6873 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-22 20:14:35 +00:00
HD Moore e70ac6cc19 Added a new set of match flags for cmd injection exploits (RequiredCmds). This reduces the number of 'bad' payloads listed for explot modules. A good example is disabling the netcat -e payloads for old Solaris exploits 
git-svn-id: file:///home/svn/framework3/trunk@6854 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-21 15:20:35 +00:00
James Lee 529ded22ae reverting last commit; somebody didn't cross their fingers 
git-svn-id: file:///home/svn/framework3/trunk@6847 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-19 20:48:47 +00:00
James Lee c3dc1ecb55 reintegrate browser_autopwn into trunk; cross your fingers and hope this works 
git-svn-id: file:///home/svn/framework3/trunk@6846 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-19 17:27:36 +00:00
HD Moore 309acbaa22 Remove extraneous comma 
git-svn-id: file:///home/svn/framework3/trunk@6833 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-18 00:27:15 +00:00
HD Moore 282bcb4fae Updated with osvdb and bid references. 
git-svn-id: file:///home/svn/framework3/trunk@6832 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-18 00:15:48 +00:00
HD Moore 2d319e9b5b Updated to work better on OS X and avoid 'script is taking too long' errors on all platforms 
git-svn-id: file:///home/svn/framework3/trunk@6830 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-17 23:57:59 +00:00
HD Moore 99bc63b11d Adds support for Mac OS X intel (use the vforkshell payloads) 
git-svn-id: file:///home/svn/framework3/trunk@6828 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-17 21:28:59 +00:00
HD Moore f8c2a203fd OSVDB references updates from Steve Tornio 
git-svn-id: file:///home/svn/framework3/trunk@6812 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-16 16:02:24 +00:00
HD Moore 6624dbd5ff Adds coverage for SBerry's Firefox 3.5 exploit (win32 only atm). 
git-svn-id: file:///home/svn/framework3/trunk@6803 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-14 21:59:35 +00:00
James Lee d84c87fa36 updated version info and disclosure date for opera_historysearch 
git-svn-id: file:///home/svn/framework3/trunk@6788 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-13 23:12:25 +00:00
James Lee 3e072dd66e add Opera historysearch module; works on linux, windows will come later 
git-svn-id: file:///home/svn/framework3/trunk@6777 4d416f70-5f16-0410-b530-b9f4589650da
 2009-07-13 07:48:12 +00:00
HD Moore 2ec7693d94 Fix up the modules to pass in the framework object into the new API call 
git-svn-id: file:///home/svn/framework3/trunk@6687 4d416f70-5f16-0410-b530-b9f4589650da
 2009-06-20 18:18:04 +00:00
HD Moore 2283e0ffe4 Update executable template and API 
git-svn-id: file:///home/svn/framework3/trunk@6682 4d416f70-5f16-0410-b530-b9f4589650da
 2009-06-20 17:42:17 +00:00
HD Moore b8efb1bbf9 Add Stephen Fewer's shiny exploit for the Java deserialization flaw 
git-svn-id: file:///home/svn/framework3/trunk@6664 4d416f70-5f16-0410-b530-b9f4589650da
 2009-06-16 17:19:44 +00:00
HD Moore a5f567e76e Massive OSVDB reference update from Steve Tornio. 
git-svn-id: file:///home/svn/framework3/trunk@6629 4d416f70-5f16-0410-b530-b9f4589650da
 2009-06-07 20:20:42 +00:00
HD Moore b7cac075e0 Adds the itunes overflow from Will Drewry: http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html 
git-svn-id: file:///home/svn/framework3/trunk@6627 4d416f70-5f16-0410-b530-b9f4589650da
 2009-06-05 02:30:24 +00:00
James Lee 685535c61d add php compatibility to multi/handler 
git-svn-id: file:///home/svn/framework3/trunk@6558 4d416f70-5f16-0410-b530-b9f4589650da
 2009-05-17 00:26:17 +00:00
HD Moore 9d8581a17e More osvdb references from Steve Tornio 
git-svn-id: file:///home/svn/framework3/trunk@6550 4d416f70-5f16-0410-b530-b9f4589650da
 2009-05-13 17:39:42 +00:00
kris 37c2e301ed replacing defunct framework URL in header comments in most modules and pcap_log 
git-svn-id: file:///home/svn/framework3/trunk@6479 4d416f70-5f16-0410-b530-b9f4589650da
 2009-04-13 14:33:26 +00:00
HD Moore 1f523d78c9 Configure the architecture list to be ALL, not just a small set of archs 
git-svn-id: file:///home/svn/framework3/trunk@6171 4d416f70-5f16-0410-b530-b9f4589650da
 2009-01-22 05:35:19 +00:00
kris 85926eb4ff fix svn keywords 
git-svn-id: file:///home/svn/framework3/trunk@5923 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-16 03:09:22 +00:00
Patrick Webster 086e9fb89a Added veritas_netbackup_cmdexec module. 
git-svn-id: file:///home/svn/framework3/trunk@5914 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-13 09:45:47 +00:00
Patrick Webster 97ffd10f89 Updated to support Windows targets. 
git-svn-id: file:///home/svn/framework3/trunk@5912 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-13 09:01:24 +00:00
HD Moore e02f740277 Handle multiple sessions by default 
git-svn-id: file:///home/svn/framework3/trunk@5828 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-03 21:08:46 +00:00
Ramon de C Valle f124597a56 Code cleanups 
git-svn-id: file:///home/svn/framework3/trunk@5773 4d416f70-5f16-0410-b530-b9f4589650da
 2008-10-19 21:03:39 +00:00
HD Moore fd256ec4a1 This massive commit changes the metasploit 3 module format. The new syntax allows for greater scalability and future improvements to the metasploit module loader. This change also makes it easier for users to add new modules, since the class name no longer needs to match the directory structure. 
git-svn-id: file:///home/svn/framework3/trunk@5709 4d416f70-5f16-0410-b530-b9f4589650da
 2008-10-02 05:23:59 +00:00
James Lee 6e212a5981 I'm on crack. mozilla_navigatorjava is the one that works on 1.5.0.5; reverting from 5559 
git-svn-id: file:///home/svn/framework3/trunk@5562 4d416f70-5f16-0410-b530-b9f4589650da
 2008-07-22 06:02:03 +00:00
James Lee 324703669b typo fix -- really works on <1.5.0.5, not <1.0.5 
git-svn-id: file:///home/svn/framework3/trunk@5559 4d416f70-5f16-0410-b530-b9f4589650da
 2008-07-19 05:04:33 +00:00
James Lee a0a203fba7 don't hang the browser building the exploit buffer if we can't exploit it 
git-svn-id: file:///home/svn/framework3/trunk@5558 4d416f70-5f16-0410-b530-b9f4589650da
 2008-07-19 05:03:01 +00:00
James Lee 8800372e46 initial commit of browser_autopwn; 
revamp php payloads;
socks5 for IPv6 (untested)



git-svn-id: file:///home/svn/framework3/trunk@5546 4d416f70-5f16-0410-b530-b9f4589650da
 2008-07-01 01:44:56 +00:00
Patrick Webster 0adab629ba Added ntp module, linux egghunter 
git-svn-id: file:///home/svn/framework3/trunk@5502 4d416f70-5f16-0410-b530-b9f4589650da
 2008-05-12 14:49:45 +00:00
HD Moore cad72d16e4 Add the stackadjustment parameter 
git-svn-id: file:///home/svn/framework3/trunk@5214 4d416f70-5f16-0410-b530-b9f4589650da
 2007-12-04 20:13:50 +00:00
HD Moore 04c6dbc748 Updated svn:keywords 
git-svn-id: file:///home/svn/framework3/trunk@5100 4d416f70-5f16-0410-b530-b9f4589650da
 2007-09-10 01:01:20 +00:00
HD Moore d35adad50e Revision 1, still some bugs to work out 
git-svn-id: file:///home/svn/framework3/trunk@4977 4d416f70-5f16-0410-b530-b9f4589650da
 2007-05-29 22:56:18 +00:00
HD Moore 0984380230 This module was never finished 
git-svn-id: file:///home/svn/framework3/trunk@4975 4d416f70-5f16-0410-b530-b9f4589650da
 2007-05-29 15:03:55 +00:00
HD Moore d95a0d8d90 Updated svn:keywords, merging minor changes 
git-svn-id: file:///home/svn/framework3/trunk@4886 4d416f70-5f16-0410-b530-b9f4589650da
 2007-05-07 04:48:45 +00:00
HD Moore 3453b58820 Consistent use of handler(cli), removed the autofilter and dependency check stubs 
git-svn-id: file:///home/svn/framework3/trunk@4646 4d416f70-5f16-0410-b530-b9f4589650da
 2007-04-04 04:37:30 +00:00
HD Moore d14221898d Merge in the new generic PHP exploit with new targets 
Added type definitions to HTTP::Client



git-svn-id: file:///home/svn/framework3/trunk@4537 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-17 20:10:57 +00:00
HD Moore 207b1aec83 Removed the two app-specific modules and replaced with a generic module 
git-svn-id: file:///home/svn/framework3/trunk@4535 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-17 18:55:25 +00:00
HD Moore bd0210c863 Updated the check() function to also look at the Server. Added a PunBB module. 
git-svn-id: file:///home/svn/framework3/trunk@4534 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-17 18:08:41 +00:00
HD Moore d17b153e23 Adds check() support to this module 
git-svn-id: file:///home/svn/framework3/trunk@4533 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-17 04:43:25 +00:00
Matt Miller f8f191c9db authors vs author typo, fixes #53 
git-svn-id: file:///home/svn/framework3/trunk@4527 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-12 00:58:57 +00:00
HD Moore 4e78e6dae0 Added some targetting notes 
git-svn-id: file:///home/svn/framework3/trunk@4519 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-11 16:30:23 +00:00
HD Moore 4600da9b8e Tag-team effort by hdm and gml (based on stefan's PoC) 
git-svn-id: file:///home/svn/framework3/trunk@4515 4d416f70-5f16-0410-b530-b9f4589650da
 2007-03-11 01:03:02 +00:00
Matt Miller 99f9fb5353 add advanced option to control exiting after a session is created 
git-svn-id: file:///home/svn/framework3/trunk@4488 4d416f70-5f16-0410-b530-b9f4589650da
 2007-02-27 18:57:47 +00:00
HD Moore abbeb2e87e Adding an Id tag and a standard header to all modules 
git-svn-id: file:///home/svn/framework3/trunk@4419 4d416f70-5f16-0410-b530-b9f4589650da
 2007-02-18 00:10:39 +00:00
HD Moore 839ac9fc38 Do not exit after a session is obtained 
git-svn-id: file:///home/svn/framework3/trunk@4396 4d416f70-5f16-0410-b530-b9f4589650da
 2007-02-15 22:17:50 +00:00
HD Moore b278bef22d Reference updates 
git-svn-id: file:///home/svn/framework3/trunk@4266 4d416f70-5f16-0410-b530-b9f4589650da
 2007-01-05 14:44:09 +00:00
Matt Miller 8185f67cbd svnserve date 
git-svn-id: file:///home/svn/framework3/trunk@4264 4d416f70-5f16-0410-b530-b9f4589650da
 2007-01-05 06:36:26 +00:00
HD Moore 8fd09e3880 Renamed 
git-svn-id: file:///home/svn/framework3/trunk@4256 4d416f70-5f16-0410-b530-b9f4589650da
 2007-01-05 03:48:16 +00:00
HD Moore e936701a5a Updates 
git-svn-id: file:///home/svn/framework3/trunk@4255 4d416f70-5f16-0410-b530-b9f4589650da
 2007-01-05 03:47:44 +00:00
HD Moore b221af7791 Integration of the new HTTP Client API 
git-svn-id: file:///home/svn/framework3/trunk@4241 4d416f70-5f16-0410-b530-b9f4589650da
 2006-12-28 23:42:36 +00:00
HD Moore 5dc9f27618 Slight cleanups -- still not ready for real use 
git-svn-id: file:///home/svn/framework3/trunk@4216 4d416f70-5f16-0410-b530-b9f4589650da
 2006-12-17 08:02:35 +00:00
HD Moore ffc626675b Initial support for PHP payloads 
git-svn-id: file:///home/svn/framework3/trunk@4215 4d416f70-5f16-0410-b530-b9f4589650da
 2006-12-17 07:57:51 +00:00
HD Moore ea204ee0ff API change for the HTML mixin, the send_response method is no longer overloaded, instead exploits must call send_response_html to enable HTML evasion. The old method caused problems when a exploit needed HTML and non-HTML response capabilities 
git-svn-id: file:///home/svn/framework3/trunk@4173 4d416f70-5f16-0410-b530-b9f4589650da
 2006-12-10 03:26:53 +00:00
HD Moore 810f80612b Reference updates 
git-svn-id: file:///home/svn/framework3/trunk@4154 4d416f70-5f16-0410-b530-b9f4589650da
 2006-11-28 17:18:43 +00:00