infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
43,388 Commits
7 Branches
556 Tags
419 MiB
Commit Graph

22601 Commits (bd7ea1f90d1ac415a80f9de038820e0deb3bae29)

Author SHA1 Message Date
h00die bd7ea1f90d more updates, 465 more pages to go 2017-08-26 21:01:10 -04:00
h00die 3420633f29 @NickTyrer corrected my correction 2017-08-26 08:43:10 -04:00
h00die 32a4436ecd first round of spelling/grammar fixes 2017-08-24 21:38:44 -04:00
Brent Cook 821121d40b
Land #8871, improve compatibility and speed of JDWP exploit 2017-08-23 18:53:47 -05:00
Jeffrey Martin cba4d36df2
provide missing bits for R platform 2017-08-23 16:58:48 -05:00
William Vu 4c285c0129
Land #8827, QNAP Transcode Server RCE 2017-08-22 23:07:01 -05:00
Brent Cook 128949217e more osx 2017-08-22 16:48:09 -05:00
Brent Cook bb120962aa more osx support 2017-08-22 14:01:48 -05:00
Brent Cook 7263c7a66e add 64-bit, osx support 2017-08-22 13:51:28 -05:00
Louis Sato e01caac9ed
removing slice operators from jdwp_debugger 2017-08-21 16:36:54 -05:00
Brent Cook 031f48725f
add missing quotes 2017-08-21 16:16:03 -05:00
Brent Cook edbe8d73c2
Revert "Revert passive stance for multi/handler" 
This reverts commit 66a4ea4f0b.
 2017-08-21 16:14:23 -05:00
Brent Cook c14daf3fcc
Land #8857, Reverse and bind shells in R 2017-08-21 15:49:24 -05:00
Brent Cook 605330faf6
Land #8842, add linux/aarch64/shell_reverse_tcp 2017-08-21 15:44:28 -05:00
Brent Cook 430251b8f6
fix compatibility with php meterpreter 2017-08-21 15:37:31 -05:00
RageLtMan 2873a899db Address msftidy complaint 2017-08-21 03:39:03 -04:00
Tim d6d6c67f33 add stage_shell.s and cleanup 2017-08-21 14:42:30 +08:00
Tim e1a7494724 linux payloads should default to /bin/sh 2017-08-21 12:25:27 +08:00
Tim 9768a89bcd aarch64 staged shell 2017-08-21 11:14:42 +08:00
RageLtMan 7ab097a784 Unix cmd versions of R payloads 
Use R to connect back from a unix shell.

Notes:
  We need to DRY this up - tons of copy pasta here, when we should
  really be instantiating the language specific payloads and just
  wrapping them with CLI execution strings.

Testing:
  None, yet, just did the quick port to wrap this and push to CI
  now that rex-arch #4 is in.
 2017-08-20 21:25:57 -04:00
Brent Cook f961495860
Land #8625, Remove OpenSSL from Windows Meterp, packet header changes, and TLV packet encryption 2017-08-20 19:13:51 -05:00
Brent Cook b864083cbd
update payload sizes 2017-08-20 19:03:53 -05:00
Brent Cook eabe4001c2
Land #8492, Add IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution module 2017-08-20 18:48:22 -05:00
Brent Cook cbd7790e95
Land #8751, Add Asterisk Gather Credentials auxiliary module 2017-08-20 18:34:27 -05:00
Brent Cook 07ee33578d
Land 8804, tidy up mdaemon credential extraction module 2017-08-20 18:26:56 -05:00
Brent Cook 85df247c84 DRY up module, fix remaining style violations 2017-08-20 18:24:41 -05:00
Brent Cook 367c760927
window move is now directly in the template 2017-08-20 17:48:59 -05:00
Brent Cook e734a7923a
Land #8267, Handle multiple entries in PSModulePath 2017-08-20 17:44:30 -05:00
Brent Cook 1225555125
remove unnecessary require 2017-08-20 17:37:42 -05:00
Brent Cook 840c0d5f56
Land #7808, add exploit for VMware VDP with known ssh private key (CVE-2016-7456) 2017-08-20 17:36:45 -05:00
Brent Cook 88f39d924b
Land #8816, added Jenkins v2 cookie support 2017-08-20 14:58:38 -05:00
Brent Cook f7dc831e9a
Land #8799, Add module to detect Docker, LXC, and systemd-nspawn containers 2017-08-20 14:45:57 -05:00
Brent Cook aa797588e8
Land #8847, Look for sp_execute_external_script in mssql_enum 2017-08-20 14:32:35 -05:00
Brent Cook 2eba188166
Land #8789, Add COM class ID hijack method for bypassing UAC 2017-08-20 13:57:17 -05:00
Brent Cook e8ab518d76
Land #8853, Revert passive stance for multi/handler 2017-08-19 22:04:26 -05:00
RageLtMan d76616e8e8 Reverse and bind shells in R 
Initial implementation of bind and reverse TCP shells in R.
Supports IPv4 and 6, provides stateless sessions which wont change
the cwd when cd is invoked since each command invocation actually
spawns a pipe to execute that specific line's invocation.

R injections are common in academic software written in a hurry by
students or lab administrators. The language runtimes are also
commonly found adjacent to valuable data, and often used by teams
which are not directly responsible for information security.

Testing:
  Local testing with netcat bind and rev handlers.

TODO:
  Add the appropriate platform/language library definitions
 2017-08-19 06:12:05 -04:00
William Webb 6ecdb8f2cc
Land #8852, convert quest_pmmasterd_bof to cmd_interact/find 2017-08-18 13:20:17 -05:00
William Vu 66a4ea4f0b Revert passive stance for multi/handler 
It's gotten to be a bit annoying. ExitOnSession=false was good, but this
was too much. Typing run -j isn't difficult.
 2017-08-18 13:16:12 -05:00
h00die dc358dd087 unknow to unknown 2017-08-18 11:33:48 -04:00
William Vu d659cdc8f6 Convert quest_pmmasterd_bof to cmd_interact/find 2017-08-18 00:19:09 -05:00
Brent Cook ea5370486f minor unused variable fixes 2017-08-17 16:46:51 -04:00
Brent Cook 9c196041ce update youtube urls in post exploit module 2017-08-17 16:44:35 -04:00
Tim 8b4ccc66c7 add linux/aarch64/shell_reverse_tcp 2017-08-17 18:55:37 +08:00
james e642789674 Look for sp_execute_external_script in mssql_enum 
sp_execute_external_script can be used to execute code in MSSQL.
MSSQL 2016+ can be configured to execute R code. MSSQL 2017 can
be configured to execute Python code.

Documentation:
https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-execute-external-script-transact-sql
https://docs.microsoft.com/en-us/sql/advanced-analytics/tutorials/rtsql-using-r-code-in-transact-sql-quickstart

Interesting uses of sp_execute_external_script:
R - https://pastebin.com/zBDnzELT
Python - https://gist.github.com/james-otten/63389189ee73376268c5eb676946ada5
 2017-08-16 21:40:03 -05:00
Richard Claus f07318c976 Fix post/linux/gather/hashdump NoMethodError 2017-08-16 00:56:32 -07:00
Brent Cook 70a82b5c67
Land #8834, add resiliency to x64 linux reverse_tcp stagers 2017-08-15 08:04:32 -04:00
Brent Cook df98c2a3dd update cached sizes again 2017-08-15 08:02:51 -04:00
Brent Cook debbc31142 use separate module names for x86 and x64 generators 2017-08-15 08:02:01 -04:00
tkmru 4dbf94556e update CacheSize 2017-08-15 12:54:30 +09:00
Brendan Coles ac976eee8e Add author 2017-08-15 03:27:40 +00:00