f950633d32
renamed
2015-12-21 18:16:06 +00:00
e09c2944cf
Renamed module to be more descriptive
2015-12-21 18:15:39 +00:00
4c27f381dc
rubocop & msftidy
2015-12-21 18:15:19 +00:00
8438774077
Bug
2015-12-21 18:13:58 +00:00
0b6969afbc
Rubocop. This encoding mess was the only way I could find to deal with a number of parsing errors when testing this against a multilingual domain.
2015-12-21 17:30:32 +00:00
30e283b0ae
fixup
2015-12-21 17:28:36 +00:00
751a0708bf
rubocop
2015-12-21 13:32:29 +00:00
0c8aa0bd5c
msftidy - fixed module name
2015-12-21 13:32:11 +00:00
0081c79f39
Added comments
2015-12-21 13:31:26 +00:00
03b904cc4e
Initial version
2015-12-21 13:29:47 +00:00
16cf3c6207
Further messing about with unicode conversions
2015-12-21 13:28:27 +00:00
e8c8c54cb0
Use a regex with a negative lookbehind to cope with CNs that contain commas
2015-12-21 11:44:37 +00:00
d8b3b15da6
Trying to fix encoding errors
2015-12-21 11:43:12 +00:00
76f99cbc7f
Fixing UTF-8 encoding errors with some strangely named groups
2015-12-21 11:11:01 +00:00
b0fca769d7
capitalisation
2015-12-21 10:39:30 +00:00
4ed32ad3e8
Add manager user attribute
2015-12-20 22:51:37 +00:00
9493b333df
rubocop
2015-12-20 21:22:03 +00:00
c394caad27
actually made the securitygroups only option do something
2015-12-20 21:19:24 +00:00
07caaf352b
made comment match purpose
2015-12-20 21:18:21 +00:00
c0a93433af
msftidy
2015-12-20 21:16:42 +00:00
89728fd8fe
Working version
2015-12-20 21:16:17 +00:00
ae09549057
New module, strating with managedby_groups
2015-12-20 20:17:06 +00:00
28e563659f
Added managedBy to group acquisition
2015-12-20 20:16:18 +00:00
d79fd9a9f3
Renamed the comments attribute to comment
2015-12-20 19:53:36 +00:00
924017e606
Moved trust enumeration to separate PR
2015-12-20 19:46:20 +00:00
43f8a35b12
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into add_filter_to_ad_tools
2015-12-20 19:43:04 +00:00
2ddac42be7
Perform Rubocop cleanup
2015-12-19 23:33:32 -08:00
2fc940cc3e
Decrypt Chrome and Opera cookies and msdftify code
2015-12-19 22:19:20 -08:00
ab630166bb
Decrypt Chrome and Opera cookies and msdftify code
2015-12-19 21:40:30 -08:00
3a89d3cc70
Turns out that we dont need the report or accounts includes in there, so removing them for tidyness
2015-12-20 02:37:25 +00:00
c11c0ca7e0
Added comment about the UTF-8 encoding. This is an issue which is documented at https://github.com/rails/rails/issues/1965 ; namely that SQLite seems to treat ASCII text as a blob meaning that the text searches break. Encoding to UTF-8 seems to fix this.
2015-12-20 02:35:19 +00:00
2301658611
Working
2015-12-20 02:20:59 +00:00
7ce24969bb
rubocop fixes
2015-12-20 02:02:44 +00:00
d5436c6fae
msftidy is now silent
2015-12-20 02:01:11 +00:00
b8274cca01
Tested
2015-12-20 01:59:31 +00:00
b0eba24c5f
Fixed verbosity bug and tidied up
2015-12-20 01:55:44 +00:00
86294a869e
No longer need the sAMAccountType lookup table
2015-12-20 01:45:10 +00:00
cdf430e689
Fixed bug relating to forgetting to add columns to the schema
2015-12-20 01:44:26 +00:00
14f71eabdb
Completing processing the sAMAccountType value
2015-12-20 01:42:25 +00:00
5f5a297324
Adding u_, g_ and c_ parameters to the tables directly avoids most of the views
2015-12-20 01:30:24 +00:00
bb25c7606c
Restructuring to add SAM_ (userAccountControl) variables as fields directly
2015-12-20 01:28:25 +00:00
872aeccbb6
Significant simplified the hex-to-SID parsing code because we only want the RID out of it
2015-12-19 02:02:40 +00:00
07e5f03aba
Fixed
2015-12-19 01:58:29 +00:00
c7f8450775
Appears to work correctly
2015-12-19 01:11:20 +00:00
36392ac0cd
All works
2015-12-19 00:48:41 +00:00
82c3ec5f4b
Added views for users and groups table
2015-12-19 00:26:31 +00:00
ba9845818e
Appears to work for the computers table (tables and view)
2015-12-18 23:22:22 +00:00
cf8f0e2483
Added userAccountControl to the computer table. Note that computer and user LDAP entries are more or less the same (user is the parent for computer), but it makes sense just for sanity and ease of use to keep them separate.
2015-12-18 22:22:56 +00:00
eade245a9e
Added groupType attribute interpretation
2015-12-18 22:06:20 +00:00
e716cd79e3
Needed to use .zero? in the ? : if shorthand for the UAC variables
2015-12-18 21:55:55 +00:00
838f74ff74
Added table creation for userAccoutControl
2015-12-18 21:45:07 +00:00
6afcc13774
Requote file path
2015-12-18 15:41:38 -06:00
a065fc803c
fixed spacing
2015-12-18 21:38:54 +00:00
8821caa199
Added UserAccountControl constants
2015-12-18 21:37:31 +00:00
06a2bb53bd
Clean up module
2015-12-18 15:29:15 -06:00
6d6306f6e7
Added sAMAccountType constants from MSDN
2015-12-18 21:14:39 +00:00
5b07a35cef
Added LDAP filter to identify groups of interest
2015-12-18 14:10:00 +00:00
662010fce7
Added thread capability
2015-12-18 14:06:50 +00:00
0a75fa333c
msftidy
2015-12-18 12:14:22 +00:00
91c8c2b9dd
Trying to fix threads
2015-12-18 12:14:08 +00:00
6f50635ab2
Strange bug with memberOf param and trying to fix up threads
2015-12-18 11:49:17 +00:00
39bc23629a
Getting ready to add thread support
2015-12-18 10:56:41 +00:00
3c8ac89ba8
Added options to dump user membership and group membership to screen
2015-12-18 10:29:53 +00:00
8f95ad315e
Added extra user fields to database schema
2015-12-18 10:02:18 +00:00
fc45d70d25
Added extra user fields
2015-12-18 09:59:21 +00:00
b186aaa08d
Added extra computer fields
2015-12-18 09:55:13 +00:00
f8b402165c
Added extra computer fields
2015-12-18 09:51:04 +00:00
805ba1d7dd
Enumerate computers
2015-12-18 08:28:40 +00:00
98c6b56494
Added computer recon
2015-12-18 08:14:30 +00:00
ccb13a2ca6
Add full IE support and bug fixes
2015-12-17 20:29:50 -08:00
f13ca17de0
rubocop
2015-12-18 02:01:38 +00:00
38b6ad4dbf
msftidy
2015-12-18 02:00:57 +00:00
36adbadb11
Tidied up SQL searching and added file size indicator
2015-12-18 01:59:19 +00:00
eb38859ecc
Finally worked out how to use .map to make the SQL stuff far more elegant
2015-12-18 01:40:37 +00:00
1ba6b91968
More accurate description
2015-12-18 01:24:43 +00:00
0ddb40b55e
Added UNIQUE and FOREIGN KEY constraints to SQLite DB
2015-12-18 01:23:29 +00:00
15dc542544
Initial module works
2015-12-18 01:13:44 +00:00
f31c1c24db
Added schema and code to populate SQLite db
2015-12-18 01:01:20 +00:00
e3483a2ac3
Getting RIDs from hex mess to decimal. Needs fixing
2015-12-18 00:20:16 +00:00
460778738d
Initial version works
2015-12-18 00:00:21 +00:00
41c2d12e0c
Tidy up initial print
2015-12-17 23:41:18 +00:00
09fb37db6b
Add status updates (useful if there are a large number of groups)
2015-12-17 23:07:02 +00:00
2bcea91b15
Differentiate between user and group errors
2015-12-17 22:57:30 +00:00
85c4e89526
Process user levels
2015-12-17 22:55:02 +00:00
7c145c45e8
add LDAP_MATCHING_RULE_IN_CHAIN oid (from my adsi rework earlier)
2015-12-17 22:44:35 +00:00
f2b038f4b3
Begin loop to grab effective users of each group
2015-12-17 22:39:56 +00:00
c98519e0b9
Get groups using ADSI
2015-12-17 22:35:51 +00:00
7b019bddf4
Initial version, just basing it on the ad_users module
2015-12-17 22:14:14 +00:00
e17a7a5d8c
Fix attributes
2015-12-17 21:38:42 +00:00
59d5626ef7
Bugfix
2015-12-17 21:36:19 +00:00
cba1ddbdc2
rubocop
2015-12-16 22:38:05 +00:00
47e484408f
rubocop
2015-12-16 22:31:54 +00:00
9eef27e4c1
Removed snake case and added SID translation call
2015-12-16 22:31:22 +00:00
cc3ac3ad95
Removed trailing line spaces
2015-12-16 22:28:27 +00:00
58635be237
Try to unpack the SID from hex to normal cut/paste format. Its a mess.
2015-12-16 22:27:52 +00:00
421a29d998
Added the trust types from MSDN
2015-12-16 22:18:28 +00:00
fbe0cfde8f
Fixed URL for trustDirection reference
2015-12-16 22:16:33 +00:00
fd8405f52d
added trustDirection
2015-12-16 22:15:10 +00:00
4da8859e57
added trustAttributes
2015-12-16 22:13:00 +00:00
207a964117
Loop through results
2015-12-16 21:52:30 +00:00
087a01f27f
Templated table
2015-12-16 21:40:49 +00:00
fdf1a8c235
Updated with the LDAP fields to retrieve
2015-12-16 21:39:33 +00:00
ed4cf71ca8
Initial add (templated from Ben's bitlocker module)
2015-12-16 21:26:02 +00:00
c9c1dd22ee
Added custom LDAP filter to ad_groups and ad_users to save having to use meterpreter's adsi interface
2015-12-16 10:38:38 +00:00
2c29298485
undoing this, put in a separate module
2015-12-15 23:16:21 +00:00
5dd8cb7648
proper type conversions
2015-12-15 23:13:02 +00:00
fef9a84548
rubocop
2015-12-15 23:12:14 +00:00
a2b30ff16e
msftidy
2015-12-15 23:11:40 +00:00
281966023c
Final version
2015-12-15 23:10:06 +00:00
7fa453b7ff
Added module
2015-12-15 22:31:00 +00:00
059de62400
Editing an existing module rather than adding a new one
2015-12-15 21:36:39 +00:00
4a66b487de
Based on putty enum module
2015-12-15 21:28:13 +00:00
b085989923
Land #6266 , rsync creds scraper
2015-12-14 11:37:30 -06:00
39da306b1d
Land #6057 , @danilbaz's module for dumping Bitlocker master key (FVEK)
2015-12-08 18:16:39 -08:00
ed8076f361
Merge branch 'master' into pr/6197
2015-12-08 12:08:15 -08:00
2177b979fd
Update SessionTypes command to describe why shell is not listed
2015-12-08 12:06:47 -08:00
3890961155
Correct SEP client exclusion enumeration
2015-12-08 10:16:25 -08:00
be5f648969
manage-bde.exe path test if in System32 or sysnative
2015-12-08 16:14:13 +01:00
db788d1b7c
Land #6238 , CmdStager BOURNE_{PATH,FILE} options
2015-12-07 12:34:42 -06:00
f6417df9ba
Update enum_av_excluded to work properly under wow64
2015-12-04 17:13:43 -08:00
ad60a4118e
Put admin and client exclusions in different tables
2015-12-04 13:01:28 -08:00
c92365090f
Simpler
2015-12-04 12:38:25 -08:00
e7d2eb6ad9
Wire in support for showing process and file extension exclusions
2015-12-04 12:35:42 -08:00
78a303974f
Handle empty exclusions better
2015-12-04 12:19:17 -08:00
81ee01a93e
Simplify exclusion extraction and printing
2015-12-04 11:42:03 -08:00
1968a76863
Simplify AV enumeration code
2015-12-04 10:27:14 -08:00
fc9d818837
change youtube url
2015-12-04 10:15:56 +01:00
b4ade1989a
Add IE support for stored passwords
2015-12-04 00:13:42 -08:00
28ee056c32
Make enumeration of each individual AV optional
2015-12-03 16:07:49 -08:00
c007fffbce
Style cleanup
2015-12-03 15:55:12 -08:00
78d391fa10
Rubocop
2015-12-02 14:54:30 +00:00
99dceb33ac
Added 'ALL' support (to do TCP and UDP in one go)
2015-12-02 14:50:16 +00:00
15dd18dc4b
use single quotes, remove explicit nil
2015-12-02 09:36:07 +00:00
366b92a79e
Store rsync creds as creds, not loot
2015-12-01 15:30:39 -08:00
b66be85ccb
Rubocop
2015-12-01 22:32:04 +00:00
d5c0da5e19
Added 33434-33534 because this is the default udp range for traceroute (might be enabled by sysadmins to enbale traceroutes to work)
2015-12-01 22:31:12 +00:00
74a07709b8
Use the Comm param instead of adding a route as suggested by @jlee-r7 and hdm
2015-12-01 21:42:27 +00:00
c744b14a8a
Exclude python meterpreter, doesn't seem to work
2015-11-29 20:40:42 +00:00
6a3172268e
Fixed module metadata
2015-11-29 19:32:55 +00:00
2bc5b98d6e
Rubocop fixing alignment of ifs and ends
2015-11-29 19:17:49 +00:00
8b4649e75c
Working through rubocop issues
2015-11-29 19:11:10 +00:00
9267afc18b
Rubocop
2015-11-29 19:06:24 +00:00
9a6f0d6734
Reducing complexity (rubocop)
2015-11-29 19:06:07 +00:00
b5909852a9
Rubocop
2015-11-29 19:02:33 +00:00
d4bb5537b2
Fixed stupid paste error
2015-11-29 19:02:15 +00:00
fd7a6465c6
Attemping to simplify code
2015-11-29 19:01:34 +00:00
10f89239a5
rubocop
2015-11-29 18:59:40 +00:00
6a567845e0
Tidy up error messages
2015-11-29 18:54:46 +00:00
12dbe31bee
Apparently adding .close causes it to hang
2015-11-29 18:49:51 +00:00
41d963eeb1
Debugging
2015-11-29 18:34:26 +00:00
b6dfafaeb7
Stabilised code, still giving errors on threads>1 in native mode though
2015-11-29 18:14:19 +00:00
e18f8b5e21
Now works for both TCP and UDP
...
However, it gives 'interrupted by console user' as an error message for no reason (?timeouts?)
2015-11-29 17:53:04 +00:00
98e0050e8c
Fixed 'end' bugs (mismatched blocks)
2015-11-29 16:20:33 +00:00
af106737b9
Adding both native and winapi options, split out to functions & fix up
2015-11-29 16:17:07 +00:00
59bd88ff70
msftidy
2015-11-27 16:45:52 -05:00
9c016343c7
Update to logic and reliability
...
Included support for Windows Defender
Rewrote logic to support hosts with multiple AV products installed
2015-11-27 16:41:40 -05:00
f492a1d80a
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into post_multi_egress_traffic
2015-11-26 14:41:55 +00:00
5ffeaddf1e
Added help
2015-11-26 14:01:40 +00:00
1ce0386d01
Reusing port array generation code
2015-11-26 13:59:15 +00:00
9d747e67a3
Fix bugs in new Firefox creds storage
2015-11-25 21:28:07 -08:00
a692a5d36c
Remove Platform, this should work everywhere; correct grammar
2015-11-25 11:23:18 -08:00
55b3e10390
Land #6258 , smart_migrate enhancement
2015-11-24 11:30:29 -06:00
09d4bd8175
Added basic function definition for non-Win32API egress
2015-11-24 15:38:06 +00:00
4ea732716a
Added file
2015-11-24 15:37:44 +00:00
f0271c04ab
Merge remote-tracking branch 'origin/master' into post_multi_egress_traffic
2015-11-24 15:27:38 +00:00
16e6ced867
Land #6108 , OpenVPN creds scraper
2015-11-23 14:25:19 -06:00
601d4fda9f
Add note about --auth-nocache
2015-11-23 14:24:26 -06:00
718e928fe3
Control per-user config file
2015-11-23 11:11:03 -08:00
493e476a43
Land #6243 , check nil for sock.read
2015-11-23 11:15:51 -06:00
93bb31dfa0
Make path to rsyncd configuration file configurable
2015-11-21 19:50:33 -08:00
f34c7a8594
Support for new Firefox method to store credentials
2015-11-20 23:42:59 -08:00
aa962f30a9
Minor style/usability cleanup
2015-11-20 13:51:31 -08:00
a96102c20a
Minor cleanup
2015-11-20 13:19:38 -08:00
c75e3c8e84
Initial commit of a post module for looting rsync credentials
2015-11-20 12:57:33 -08:00
5592e4e4ea
seek_relative suppression (use seek instead)
2015-11-20 18:30:51 +01:00
dd027982ae
if recovery_key specified, only method that is tried
2015-11-20 18:30:50 +01:00
f49d6905a6
Fix comments by @jhart-r7
2015-11-20 18:30:50 +01:00
8f135c07aa
Remove hard coded C:\Windows and use %SYSTEMROOT%
2015-11-20 18:30:49 +01:00
7d9d74f609
msftidy...
2015-11-20 18:30:49 +01:00
c8847182d7
Add module to dump Bitlocker master key (FVEK)
2015-11-20 18:30:48 +01:00
f1675f9ae4
Minor enhancement to smart_migrate
...
Adding a check to see if the user is currently already migrated to the "explorer.exe" and "winlogon.exe" processes prior to attempting migration.
2015-11-19 13:30:12 +00:00
811167442c
Re-disable debugging nodelete
2015-11-17 13:10:03 +00:00
ac99f9c229
Fix condition
2015-11-17 00:52:42 -02:00
f69e7c0fb3
Fix condition
2015-11-17 00:49:04 -02:00
a48d0b275b
Added check if the commands executed successfully.
2015-11-17 00:07:31 -02:00
f6fdabfd77
Land #6239 , added Session info display to module output
...
MS-706
2015-11-16 18:10:58 -06:00
17a1f2ee8a
Fix #6242 , Check nil for sock.read
...
Fix #6242
2015-11-16 14:24:46 -06:00
a1ab8f1dc7
added Session info display to module output
...
output from the mssql_local_auth_bypass module
is now prefixed with the Session id and address
of the target host so it is explicitly clear
where it is performing each action
MS-706
2015-11-16 12:13:26 -06:00
2b99969f9a
quote paths to allow spaces
2015-11-15 00:14:30 +00:00
e3f25fd6e2
Add support for specifying path, file in bourne dropper
2015-11-14 18:31:11 +00:00
38ca943219
Remove unneeded width arg
2015-11-13 11:49:50 -08:00
4604f8cd83
Move cowsay to Rex::Text so that everyone can enjoy it ;)
2015-11-13 08:57:48 -08:00
211da2746e
Support cookie auth key decryption
2015-11-11 16:26:07 -08:00
15cfa925c8
Document the cloud mess
2015-11-11 12:06:53 -08:00
a328675f77
Add simulated cowsay support to wall
2015-11-11 11:54:46 -08:00
8d21a91f3e
Add initial wall module
2015-11-11 09:15:32 -08:00
8f86b2519f
Resolve 'duplicate key warning' for some modules
2015-11-09 18:40:32 -08:00
43229c16e7
Correct some authors with unbalanced angle brackets
2015-11-06 13:24:58 -08:00
c44ecfeb15
Spacing
2015-11-06 10:55:29 -05:00
e4d8909815
Initial Commit
2015-11-05 20:43:30 -05:00
Stuart Morgan
Martin Vigo
William Vu
Jon Hart
BAZIN-HSC
Christian Mehlmauer
Rory McNamara
Andrew Smith
Louis Sato
sammbertram
Roberto Soares
wchen-r7
David Maloney
PsychoMario