Commit Graph

11406 Commits (9b154972cfa97d25d5e54cc442a5b214a7f01ae1)

Author SHA1 Message Date
Jonathan Cran 5cec44bc43 Merge pull request #77 from rapid7/lab_temp2
squashed lab upload commit
2011-12-22 13:00:26 -08:00
Jonathan Cran e48031cf22 squashed lab upload commit 2011-12-22 14:56:45 -06:00
Tod Beardsley 9b45b9523e Merge branch 'master' of github_r7:rapid7/metasploit-framework 2011-12-22 13:25:02 -06:00
sinn3r b5b24a1fbf Add a check. I decided not to try to login in the check function in order to remain non-malicious.
However, this decision doesn't represent how modules should write their own check.
2011-12-22 13:16:54 -06:00
Tod Beardsley b6d56e8410 Fixes VBS executable creator util
Fixes #6152, using booleans instead of ints.

Tip o' the hat to cloder for the MSDN ref:
http://msdn.microsoft.com/en-us/library/aa265018%28v=vs.60%29.aspx

Tested works on winxp and win7 targets via the persistence meterpreter
script.
2011-12-22 13:13:34 -06:00
sinn3r 262fe75e0a Add CVE-2011-4642 - Splunk Remote Code Execution (Feature #6129) 2011-12-22 13:04:37 -06:00
Tod Beardsley a03f5e32f8 Merge branch 'master' of github_r7:rapid7/metasploit-framework 2011-12-22 11:11:29 -06:00
Tod Beardsley 2f55f08ebe Actually describe the module in the title/description 2011-12-22 11:10:24 -06:00
David Maloney 5e1efdcd73 Merge branch 'master' of github.com:rapid7/metasploit-framework 2011-12-22 10:49:53 -05:00
David Maloney 30141f3008 Fix typo in the oracle enum aux module
The password grace time query was not checking the right value,
spotted by user bNull in the IRC channel.
2011-12-22 10:47:57 -05:00
HD Moore 5f72a0a092 Add -n <process.exe> argument for compatibility 2011-12-22 01:46:35 -06:00
Joshua Smith ee94e3e697 lab_load now tab completes from data/lab (lab plugin), for real tho 2011-12-22 01:25:43 -05:00
Tod Beardsley 743a0546f1 Don't blow up if the user doesn't set a filename
Can't actually require FILENAME or REMOTE_FILENAME because I don't know
if you're going to upload or download. However, there shouldn't be a
stacktrace when you just try to go with neither.
2011-12-21 16:26:29 -06:00
Tod Beardsley ed4c6ded2c Fixup on checkpoint firewall module
get() should get get_once() (intent is to get 4 bytes,
not timeout after 4 seconds), no need to escape equals
signs in regexes, no need to newline the unexpected
responses.
2011-12-21 11:23:04 -06:00
Tod Beardsley f9471d6009 Adding ref/disclosure date to checkpoint module
Talked with patrick, this all looks correct now.
2011-12-21 11:22:58 -06:00
Tod Beardsley 2db697cd7a Fixup on checkpoint firewall module
get() should get get_once() (intent is to get 4 bytes,
not timeout after 4 seconds), no need to escape equals
signs in regexes, no need to newline the unexpected
responses.
2011-12-21 11:21:46 -06:00
Tod Beardsley c6297458e6 Adding ref/disclosure date to checkpoint module
Talked with patrick, this all looks correct now.
2011-12-21 10:59:02 -06:00
HD Moore d27e05e2d2 Merge pull request #72 from mbevand-r7/nexpose-pth-bugfix
Fix Nexpose plugin bug to allow pass the hash to work
2011-12-20 21:48:15 -08:00
Marc Bevand 2dc4319bba Fix Nexpose plugin bug to allow pass the hash to work 2011-12-20 17:51:47 -06:00
Tod Beardsley cfa3e9818e Merge pull request #68 from averagesecurityguy/master
Cosmetic changes to openvas plugin output. Replaced puts with print_line.
2011-12-20 15:37:09 -08:00
Tod Beardsley 1429de6edc Checkpoint error msg should use res.inspect
Otherwise your terminal will go all wonky.
2011-12-20 16:01:13 -06:00
Tod Beardsley 99556da7ef Adds reporting to Patrick's Checkpoint module
Also refers to port 264/TCP as the SecuRemote service instead of the
Topology service (I believe this is correct)

Reporting is initially conservative -- if we don't get something for
fw_hostname, then don't bother reporting at all; assume we're
mis-identifying the target.
2011-12-20 16:01:00 -06:00
Tod Beardsley 27d3edea63 Merge pull request #71 from rapid7/checkpoint_report
Checkpoint report
2011-12-20 13:54:47 -08:00
Tod Beardsley 1128c3ec6b Checkpoint error msg should use res.inspect
Otherwise your terminal will go all wonky.
2011-12-20 15:46:31 -06:00
Tod Beardsley a58ddcae1b Adds reporting to Patrick's Checkpoint module
Also refers to port 264/TCP as the SecuRemote service instead of the
Topology service (I believe this is correct)

Reporting is initially conservative -- if we don't get something for
fw_hostname, then don't bother reporting at all; assume we're
mis-identifying the target.
2011-12-20 15:44:05 -06:00
sinn3r baaa1f6c82 Add US-Cert references to all these SCADA modules. The refers are based on this list:
http://www.scadahacker.com/resources/msf-scada.html
2011-12-20 14:07:29 -06:00
sinn3r d439390aa2 Fix typo 2011-12-20 12:19:34 -06:00
sinn3r c2d59f0307 Fix issue #6133 2011-12-20 11:32:33 -06:00
Tod Beardsley f997a7fc31 Adding TFTP client and lib to the next release
Squashed commit of the following:

commit 11a27a1e61
Author: Tod Beardsley <todb@metasploit.com>
Date:   Tue Dec 20 10:06:44 2011 -0600

    Renaming TFTP transfer util.

    See #5291. Just renaming the file.

commit 24d53efa7c
Author: Tod Beardsley <todb@metasploit.com>
Date:   Tue Dec 20 10:03:04 2011 -0600

    Final touches on TFTP client

    See #5291. Adds an option to mess with the block size in case someone
    wants to write a fuzzer or exploit that leverages that. Adds a cleanup
    method to the module (pretty much required, it turns out). Looking
    nearly final, just need to rename the module and I think we're good to
    push to master.

commit 677cb4b152
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 19 21:56:03 2011 -0600

    Handle empty data sends sanely for TFTP.

    Don't just hang forever -- let the user know they just send empty data.
    TFTP servers don't like this of course.

commit 2b3e3725ac
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 19 18:15:19 2011 -0600

    TFTP adding comment docs, ability to send w/out a file.

    Commenting the tricksy parts a little better for general usage.

    Adding the ability to set FILEDATA instead of FILENAME, in case
    only short bits of data are desired and the user doesn't want
    to go to the trouble of creating a source file to upload.

commit 431ef826c9
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 19 16:33:25 2011 -0600

    TFTP client now uses constants, preserves trailing spaces/nulls in data

    See #5291, just rediscovered the bug on this.

commit 5eaf2e7535
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 19 15:50:50 2011 -0600

    Adding download and loot functionality.

    Still need to deal with the use case of not passing a block; blocks
    should not be required, it should be okay to invoke and just wait for
    the complete attribute to be true. You'll miss out on error messages but
    eh, maybe those should be return values.

commit aecde6fea4
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Dec 19 12:14:40 2011 -0600

    Updating TFTP client. Now with grown-up thread handling.

    No longer blocks on successful connections.

commit 902d7f5ea7
Author: Tod Beardsley <todb@metasploit.com>
Date:   Sun Dec 18 21:05:27 2011 -0600

    Adding more to TFTP. Still need a read tho

    Adds error checking and some helpful messaging in the event of an error.
    In the event of a failed transfer the module exits immediately, but in
    success, I'm still hanging around for several seconds after. Not a deal
    breaker but can be annoying.

    Also, need to implement a read as well as a write and store it as loot,
    to be actually useful for most TFTP checking.

commit 23aadd04f7
Author: Tod Beardsley <todb@metasploit.com>
Date:   Sun Dec 18 13:28:52 2011 -0600

    Fixing merge conflict cruft

    Dangit teach me to merge quickly. TFTP module now loads again.

commit 1201d7fbf2
Merge: 0b89140 a6867ef
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Dec 16 22:41:22 2011 -0600

    Merge branch 'tftp_client' of github_r7:rapid7/metasploit-framework into tftp_client

    Conflicts:
    	modules/auxiliary/admin/tftp/tftp_upload_file.rb

commit 0b8914021c
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Dec 16 21:06:10 2011 -0600

    Switch to vprint_status, also add skeletal cleanup def.

commit 50fa10679b
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Dec 16 18:39:09 2011 -0600

    First draft of a TFTP client.

    Could use some actual error checking and also needs to expose
    more options.

commit a6867ef128
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Dec 16 18:39:09 2011 -0600

    First draft of a TFTP client.

    Could use some actual error checking and also needs to expose
    more options.
2011-12-20 11:25:08 -06:00
Tod Beardsley c83c3d5128 TFTP forgot to commit my rename.
Fixes #5291 for real.
2011-12-20 10:45:29 -06:00
Tod Beardsley 1a396ba955 Merge pull request #70 from rapid7/tftp_client
Tftp client
2011-12-20 08:42:42 -08:00
Tod Beardsley 11a27a1e61 Renaming TFTP transfer util.
See #5291. Just renaming the file.
2011-12-20 10:06:44 -06:00
Tod Beardsley 24d53efa7c Final touches on TFTP client
See #5291. Adds an option to mess with the block size in case someone
wants to write a fuzzer or exploit that leverages that. Adds a cleanup
method to the module (pretty much required, it turns out). Looking
nearly final, just need to rename the module and I think we're good to
push to master.
2011-12-20 10:03:04 -06:00
sinn3r 0200b6367a Add OKI Scanner (Feature #6125) 2011-12-20 03:09:09 -06:00
HD Moore ff03f2de8d Merge pull request #69 from dirtyfilthy/ssh_forward_eof_fix
fix for ssh forwarding not handling the eof packet type
2011-12-20 00:09:39 -08:00
alhazred 3b44aa9e39 fix for ssh forwarding not handling the eof packet type 2011-12-20 19:42:54 +13:00
Tod Beardsley 677cb4b152 Handle empty data sends sanely for TFTP.
Don't just hang forever -- let the user know they just send empty data.
TFTP servers don't like this of course.
2011-12-19 21:56:03 -06:00
Tod Beardsley 2b3e3725ac TFTP adding comment docs, ability to send w/out a file.
Commenting the tricksy parts a little better for general usage.

Adding the ability to set FILEDATA instead of FILENAME, in case
only short bits of data are desired and the user doesn't want
to go to the trouble of creating a source file to upload.
2011-12-19 18:15:19 -06:00
Tod Beardsley 431ef826c9 TFTP client now uses constants, preserves trailing spaces/nulls in data
See #5291, just rediscovered the bug on this.
2011-12-19 16:33:25 -06:00
Tod Beardsley 5eaf2e7535 Adding download and loot functionality.
Still need to deal with the use case of not passing a block; blocks
should not be required, it should be okay to invoke and just wait for
the complete attribute to be true. You'll miss out on error messages but
eh, maybe those should be return values.
2011-12-19 15:50:50 -06:00
Tod Beardsley aecde6fea4 Updating TFTP client. Now with grown-up thread handling.
No longer blocks on successful connections.
2011-12-19 12:14:40 -06:00
Tod Beardsley 902d7f5ea7 Adding more to TFTP. Still need a read tho
Adds error checking and some helpful messaging in the event of an error.
In the event of a failed transfer the module exits immediately, but in
success, I'm still hanging around for several seconds after. Not a deal
breaker but can be annoying.

Also, need to implement a read as well as a write and store it as loot,
to be actually useful for most TFTP checking.
2011-12-18 21:05:27 -06:00
Stephen Haywood 18635387d5 Changed puts to print_line. 2011-12-18 20:03:49 -05:00
Tod Beardsley 23aadd04f7 Fixing merge conflict cruft
Dangit teach me to merge quickly. TFTP module now loads again.
2011-12-18 13:28:52 -06:00
Joshua Smith 9ab5becb63 a better test post mod (test/modules/post/test/railgun_reverse_lookups.rb), should have been in previous commit 2011-12-18 00:36:29 -05:00
Stephen Haywood a35564c723 cosmetic changes to openvas plugin output 2011-12-17 18:46:30 -05:00
Joshua Smith 8bdf76a87b Adds const_reverse_lookup and error_lookup methods to the railgun instance, also adds test/modules/post/test/railgun_reverse_lookups.rb, tested, working great 2011-12-17 16:19:32 -05:00
sinn3r b58097a2a7 Remove junk() because it's never used 2011-12-17 01:28:07 -06:00
Tod Beardsley 1201d7fbf2 Merge branch 'tftp_client' of github_r7:rapid7/metasploit-framework into tftp_client
Conflicts:
	modules/auxiliary/admin/tftp/tftp_upload_file.rb
2011-12-16 22:41:22 -06:00
Tod Beardsley 0b8914021c Switch to vprint_status, also add skeletal cleanup def. 2011-12-16 21:06:10 -06:00