103780c3da
Merge remote-tracking branch 'upstream/master' into mediawiki
2014-02-07 20:07:04 +00:00
f0fd2f0598
Land #2944 , add platforms to encoders
...
This allows encoders to advertise compatibility with a particular
platform (or more accurately, non-compatibility with everything that
isn't that platform).
See also #2939
2014-02-07 13:38:05 -06:00
aa3985c5e3
relign attribute tags
2014-02-07 11:04:17 -06:00
5d8dc76f48
put verbose messages to stderr
...
egypt pointed out we'll stomp on the payload output
otherwise. Good catch
2014-02-07 10:22:39 -06:00
27d7df554c
Use a single return statement defaulting to nil.
2014-02-06 14:50:59 -05:00
b9fb8decad
Support a (latest) session id of -1.
2014-02-06 14:11:38 -05:00
9d9305d2c0
more yardtag cleanup
2014-02-06 11:16:00 -06:00
34c4718e95
more style fixups
...
further kronicdeth appeasement
2014-02-05 18:12:44 -06:00
1bf11e5b92
some alpha-sorting
...
begining to appease KronicDeth
2014-02-05 17:47:32 -06:00
b226ecf591
Add block_api changes to prepend_migrate
2014-02-05 15:32:59 -06:00
ca48fb6590
fix encoding cycle if all encoders fail
...
we need to raise an exception if all encoders fail
2014-02-05 15:25:14 -06:00
1227a47342
fix exe template
...
don't pass an emtpy string for templates
this causes read errors. pass no value instead
2014-02-05 12:10:14 -06:00
508f251db2
add cli compat
...
add cli capability to putut verbose info to the console
2014-02-05 11:00:57 -06:00
293c231dfe
alpha-sort methods for ease
...
lexically sorted methods to make it easier to
look through code
2014-02-04 18:05:03 -06:00
fc9105d862
final generation and specs
...
generation wrapped method complete with specs
2014-02-04 17:52:20 -06:00
4dcae920f8
add specs for generate_java_payload
...
pretty self-explanatory
2014-02-04 17:40:59 -06:00
70d8246791
finish wiring up the final generation
...
formating and main generate methods wired up
still need to add some final tests
2014-02-04 15:52:18 -06:00
bda93c2bbc
Land #2811 - Add generate_war to jsp_shell payloads
2014-02-04 15:06:45 -06:00
80e7ae144b
Use the platform when selecting the payload
2014-02-04 14:34:11 -06:00
a58698c177
Land #2922 , multithreaded check command
2014-02-04 11:21:05 -06:00
0a3cb3377f
AppendEncoder
2014-02-04 15:41:10 +00:00
26c506da42
Naming of follow method
2014-02-04 15:25:51 +00:00
c8b7dc30b4
added encoding routines
...
now has a method for encoding the shellcode
and tests to go with
2014-02-03 17:51:22 -06:00
a8ff6eb429
Refactor send_request_cgi_follow_redirect
2014-02-03 21:49:49 +00:00
08493f2670
Merge remote-tracking branch 'upstream/master' into upgrade_psh
...
Conflicts:
lib/msf/core/post/file.rb
2014-02-03 18:02:09 +00:00
2ee1764ceb
Add method rhost, rport, and peer for post modules
...
[SeeRM #8761 ]
2014-02-03 01:05:43 -06:00
3b648346da
starting in on encoders
...
added get_encoders method to find propper encoders
started on encode_payload, incomplete
added specs
2014-02-03 00:59:08 -06:00
0d02f6d589
Add support for win shells for file?
2014-02-02 23:37:26 -06:00
4a82bc74cf
added nop sled generator
...
added code to prepend a nop sled
with tests to match
2014-02-02 22:51:12 -06:00
b9e234f62d
Log the size if it doesn't fit
2014-02-02 22:28:23 -06:00
bb5f5542f0
generating raw payload bits now
...
added raw payload generation, arch selection,
and specs for everything thus far
2014-02-02 21:09:17 -06:00
f9c31f988e
test platform selection
...
added tests around platform selection
2014-02-02 16:52:41 -06:00
f5d730e874
write specs around initialiser
...
added specs around object initialisation
2014-02-02 16:05:11 -06:00
e265d6f54c
begining of payload generator
...
started basics of generator
started adding specs
added option to simple framework to disable logging
2014-02-02 14:35:16 -06:00
95eb758642
Initial commit
2014-02-02 19:04:38 +00:00
9fa9402eb2
Better check and better follow redirect
2014-02-02 16:07:46 +00:00
0d3a40613e
Add auto 30x redirect to send_request_cgi
2014-02-02 15:03:44 +00:00
4d008ca3f3
Fix ::Interrupt exception handling
2014-01-30 18:57:27 -06:00
9f669a8e39
Make check_multiple() thread-safe
2014-01-30 16:46:36 -06:00
10ac7a22af
Land #2897 Sane address resolution [FixRM #7259 ]
2014-01-28 23:09:44 +10:00
6435ddd162
loop do this too
2014-01-26 16:35:44 -06:00
0ffacc3420
{ } block this
2014-01-26 16:33:21 -06:00
45bb336c51
Loop do it
2014-01-26 16:27:36 -06:00
eec01e79ff
No explicit "return"
2014-01-26 16:25:30 -06:00
48836b45cf
Last commit before PR
...
Code changes address these feature requests:
[SeeRM #8737 ]
[SeeRM #8752 ]
[SeeRM #8755 ]
2014-01-26 12:15:47 -06:00
a14dddd1ef
Show warning
2014-01-26 12:08:20 -06:00
f0ebd13447
Make sure all threads are killed after interrupt
...
If threads aren't killed, then when the user triggers interrupt,
the console will keep the threads (vuln checks) running, which
looks weird.
2014-01-26 02:49:16 -06:00
6ffb750633
Change Unsupported message
...
Auxiliary modules can use check, too. Not just exploits.
2014-01-26 01:14:11 -06:00
60f1688bb8
Fix option validation
2014-01-26 00:57:02 -06:00
2d12c0a368
NoMethod check and stuff
2014-01-25 20:25:01 -06:00
3bb17dad72
Check argument
2014-01-25 20:10:22 -06:00
33da3a414b
Remove unnecessary options
2014-01-25 13:52:52 +00:00
27a434205c
More flexible domain and DN
2014-01-25 13:17:00 +00:00
7dfd4ab22c
Change default thread count
2014-01-25 01:40:05 -06:00
2046209291
This one looks like is working
2014-01-25 01:27:48 -06:00
216fa4503a
Save progress
2014-01-24 23:32:29 -06:00
93fa58ed45
aux scanner support
2014-01-24 17:54:40 -06:00
08885bde19
Always forget debugging stuff
2014-01-24 23:45:12 +00:00
be1da0e8a8
Move print statement
2014-01-24 23:37:20 +00:00
cb53ca261f
Tidyup logic
...
ADSI doesn't care about distinguished names or domain and can take
either, but legacy API needs a domain for binding and a dn for
searching.
Send nil if we dont know the domain rather than a ptr to an empty
string.
2014-01-24 23:28:08 +00:00
856feb82e8
Land #2906 , check a given range
2014-01-24 16:01:57 -06:00
ae13d1f3e6
Grab the default domain to improve ldap
2014-01-24 16:36:37 +00:00
23ba52641b
Revert ldap
2014-01-24 16:25:48 +00:00
9fce617462
Fixup railgun utils
...
Implement DsGetDcNamea to return current domain using example
railgun utils techniques.
2014-01-24 16:22:05 +00:00
3c8d82e363
Ensure the rhost datastore option is restored
2014-01-23 21:12:59 -06:00
4bac297f66
Land #1473 , add LDAP hotness
2014-01-23 18:11:39 -06:00
4b21672b60
Remove hardcoded string
2014-01-23 23:55:09 +00:00
790e4d7559
Move options to mixin
2014-01-23 23:47:46 +00:00
398e8463b1
Add more informative errors
2014-01-23 23:19:00 +00:00
b5f61024c5
Land #2907 , fixes qual asset importer
...
Addresses MSP-9311
2014-01-23 13:32:22 -06:00
b07e87b1d6
Fix nil rhost
2014-01-23 10:33:05 -06:00
256f2b12eb
Land #2894 , @wchen-r7's CheckCode documentation update
2014-01-23 07:31:24 -06:00
c48595f239
Add support to scan a range of IPs for the check command
...
[SeeRM #8737 ] This allows the check command to scan multiple hosts.
2014-01-23 00:37:32 -06:00
58cf7193f9
fixing NameError undefined local variable in an import
2014-01-22 16:54:31 -06:00
9acd0f4b56
Merge remote-tracking branch 'upstream/master' into enum_ad_perf
2014-01-22 21:46:50 +00:00
90207628cc
Land #2666 , SSLCompression option
...
[SeeRM #823 ], where Stephen was asking for SSL compression for
Meterpreter -- this isn't that, but it's at least now possible for other
Metasploit functionality.
2014-01-22 10:42:13 -06:00
80452767c8
Comments
2014-01-22 10:24:24 +00:00
156e3c046e
Dont lookup twice
2014-01-22 10:14:56 +00:00
6d6d1e1033
No need to fiddle with naming context
2014-01-22 10:06:36 +00:00
e9ccec4755
Refactor load_session_info
...
All of this code is in sore need of some specs but I think this change
makes it a bit easier to understand what it is supposed to be doing.
2014-01-21 18:55:54 -06:00
0b6e03df75
More comment docs on SSLCompression
2014-01-21 16:48:26 -06:00
b8219e3e91
Warn the user about SSLCompression
2014-01-21 16:41:45 -06:00
720f892e2f
Merge remote-tracking branch 'upstream/master' into enum_ad_perf
2014-01-21 21:00:51 +00:00
ac151794f3
Make Meterpreter Session Address Resolution Sane
...
If MSF can not match the visible IP address of a Meterpreter session
to an interface--it will attempt to find an IP address associated
with a default route and use it as the session's address.
This commit fixes the logic associated with this process. The old
logic only considers one IP address per Interface, even though an
Interface may have multiple addresses/masks associated with it.
This flaw led to situations where MSF would favor an IPv6 link-local
address over the IPv4 address associated with the default route,
solely because the IPv4 address was not the first value in the
addresses array.
[FixRM #7259 ]
2014-01-21 00:32:50 -05:00
ea47da5682
Add wiki link "How to write a check() method" to documentation
2014-01-20 20:10:50 -06:00
e48b8ae14c
Use a better term
2014-01-19 16:01:38 -06:00
afd0e71457
Use the term "exploit" is a little more correctly
...
So Metasploit uses the term "exploit" to describe something, a module
or an action, that results popping a shell. A check normally doesn't
pop a shell, so avoid that language.
2014-01-17 13:50:23 -06:00
363c53e14e
Clearify when to use a specific CheckCode
...
An example of the biggest confusion module developers face is not
actually knowing the difference between Detected vs Appears vs
Vulnerable. For example: a module might flag something as a
vulnerable by simply doing a banner check, but this is often
unreliable because either 1) that banner can be fooled, or 2)
the patch does not actually update the banner. More reasons may
apply. Just because the banner LOOKS vulnearble doesn't mean it is.
2014-01-17 13:35:17 -06:00
68ccdc8386
Fix a stack trace when module_payloads.rb is run
...
This fixes a missing check for self.target being nil in the compatible_payloads method
2014-01-13 15:36:33 -08:00
4ccf1a4720
Land #2873 , Msf::Handler::ReverseHttp::UriChecksum
2014-01-13 15:38:56 -06:00
41807d7e4e
move rev_http uri checksum code
...
need access to the uri checksum
routines outside of the handler.
moved them to their own mixin
and then mixed into the handler.
added specs also
2014-01-13 15:18:16 -06:00
e6e6d7aae4
Land #2868 , fix Firefox mixin requires
2014-01-13 14:23:51 -06:00
3db143c452
Remove explicit requires for FF payload.
...
Adds ff payload require to msf/core/payload.rb
2014-01-13 13:07:55 -06:00
95a5d12345
Merge #2835 , #2836 , #2837 , #2838 , #2839 , #2840 , #2841 , #2842 into one branch
2014-01-13 10:57:09 -06:00
cacd7ff9d4
Land #2827 - Add firefox js xpcom payloads for universal ff shells
2014-01-10 14:29:32 -06:00
02018077ea
dangit odd number of ]s
2014-01-09 15:15:47 -06:00
25337888b0
Move back the expires date.
2014-01-09 14:51:23 -06:00
fe3fed1dba
Add a link to http://bit.ly/msfsurvey in banner
2014-01-09 14:37:41 -06:00
e4460278d2
Fix the closing brackets on the banner.
2014-01-09 14:37:25 -06:00
7af8fe9cd1
Catch exceptions in an XSS script and return the error.
2014-01-07 16:23:24 -06:00
Meatballs
James Lee
David Maloney
Spencer McIntyre
sinn3r
jvazquez-r7
William Vu
OJ
Tod Beardsley
lsanchez-r7
Raphael Mudge
HD Moore
Joe Vennix