720f892e2f
Merge remote-tracking branch 'upstream/master' into enum_ad_perf
2014-01-21 21:00:51 +00:00
f571d63088
Merge remote-tracking branch 'upstream/master' into enum_ad_users
2014-01-21 21:00:09 +00:00
eee716a6b3
Grab comments and descriptions ftw
2014-01-21 20:59:31 +00:00
cd989e5dc0
Initial commit
2014-01-21 17:08:31 +00:00
6cd4c66d85
Merge remote-tracking branch 'oj/updated_meterpreter_binaries' into service_principle_name
2014-01-21 15:47:04 +00:00
266b040457
Update cachedump.rb
...
Change to OpenSSL::Digest from deprecated OpenSSL::Digest::Digest
2014-01-07 22:14:10 +01:00
e75d87327f
Merge branch 'enum_ad_perf' into enum_ad_users
2014-01-07 12:21:39 +00:00
3bf728da61
Dont store in DB by default
2014-01-07 12:20:44 +00:00
1cb671b02e
Merge branch 'adjust_getenv_api' into stop_abusing_expand_path
2014-01-03 08:14:02 +10:00
4366d4da20
Delete comma
2013-12-30 11:45:52 -06:00
54a6a4aafa
Land #2807 , @todb-r7's armory support for bitcoin_jaker
2013-12-30 11:44:51 -06:00
88cf1e4843
Default false KILL_PROCESSES for bitcoin_jacker
...
I seem to able to read associated wallet files while these processes are
running with the greatest of ease. Maybe there was a file locking
concern, but I haven't run into it. Feel free to avoid landing this
particular commit if you disagree.
2013-12-29 14:12:00 -06:00
5e0c7e4741
DRY up bitcoin_jacker.rb, support Armory
...
Also, make the process killing optional.
2013-12-29 13:07:43 -06:00
9384a466c1
Retab bitcoin_jacker.rb
2013-12-29 10:59:15 -06:00
6fcd12e36c
Refactor for clearer syntax and variables
...
This was done on a barely configured Windows machine, so mind the tabs.
2013-12-29 10:15:48 -06:00
ef73ca537f
First, clean up the original a little
2013-12-28 18:57:04 -06:00
f2335b5145
Land #2792 - SSO/Mimikatz module overwrites password with N/A
2013-12-27 17:25:44 -06:00
bf8c0b10fa
Dont store n/a creds
2013-12-21 09:04:02 +00:00
a043d384d4
Land #2738 , @jiuweigui update to enum_prefetch
2013-12-20 10:26:54 -06:00
f99a5b8b47
Update for extapi
2013-12-20 13:18:01 +00:00
4ca25d5d89
Merge branch 'enum_ad_perf' into enum_ad_users
2013-12-20 12:54:24 +00:00
62ef810e7c
Use Extapi if available
2013-12-19 18:18:47 +00:00
737154c2fe
Update to use extapi
2013-12-19 16:46:09 +00:00
244cf3b3f6
Merge remote-tracking branch 'upstream/pr/2736' into enum_ad_perf
2013-12-19 13:59:57 +00:00
9fb081cb2d
Add getenvs, update getenv, change extract_path use
...
Stacks of modules were using `extract_path` where it wasn't really semantically correct
because this was the only way to expand environment variables. This commit fixes that
up a bit.
Also, I changed the existing `getenv` function in `stdapi` to `getenvs`, and had it
support the splat operator. I added a `getenv` function which is used just for a
single variable and uses `getenvs` behind the scenes.
The meterpreter console `getenv` command now uses `getenvs`
2013-12-19 11:54:34 +10:00
446db78818
Minor fix to gather_pf_info function
2013-12-16 21:33:07 +02:00
b532987b8f
Re-add file out to wmic_command
2013-12-14 20:58:33 +00:00
7902f061ca
Final tidyup
2013-12-14 20:18:14 +00:00
04496a539c
Fix up local wmi exploit.
2013-12-14 20:05:51 +00:00
12afdd2cbb
Get and parse result from clipboard
2013-12-14 18:30:43 +00:00
1b3bc878f8
Unscrew the author name
2013-12-09 21:32:03 -06:00
e737b136cc
Minor grammar/caps fixup for release
2013-12-09 14:01:27 -06:00
2a0b503f06
Minor fix
2013-12-08 18:17:22 +02:00
79e23a1e13
Land #2675 , @JonValt's forensics/browser_history
...
Great job!
2013-12-05 09:35:53 -06:00
cd5172384f
Rename gather_browser_history.rb to browser_history.rb
2013-12-05 08:43:19 -06:00
3957bbc710
capitalization ("skype")
...
(https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r8120307 )
Removed some Chrome artifacts and renamed one to reflect "Archived History."
(https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r8120314 )
((Will include other doxxes in another module.))
2013-12-05 08:33:47 -06:00
717f45ac09
Minor modification
2013-12-05 09:07:28 +02:00
902d48efab
Delete debug prints
2013-12-05 09:03:42 +02:00
492cd1ca07
Modifications how info is collected from pf files.
2013-12-05 08:56:26 +02:00
d1dd7c291b
cosmetic (indentation)
...
https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r7977962
2013-12-02 13:16:48 -06:00
cdf6ffa70d
Complete refactor with lots of help from @kernelsmith and @OJ. Thank you guys so much.
2013-11-27 21:02:48 -06:00
a8af050c16
Update post module Apache Tomcat description
...
This module's description needs to be more descriptive, otherwise
you kind of have to pull the source code to see what it actually
does for you.
2013-11-27 19:21:27 -06:00
1c17383eff
removed return file_loc
...
removed extra space
2013-11-27 15:04:31 -06:00
036cd8c5ad
couple cosmetic changes per wvu-r7
2013-11-27 14:44:39 -06:00
9dbeb55b9a
removed single quotes from inside %q{} on line 22 per https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r7913331
...
removed empty advanced options registration on line 28 per https://github.com/rapid7/metasploit-framework/pull/2675#discussion_r7913342
2013-11-26 10:29:38 -06:00
48578c3bc0
Update description about suitable targets
...
The same technique work for Microsoft Office 2013 as well. Tested.
2013-11-24 23:02:37 -06:00
49441875f3
Land #2683 , @wchen-r7's module name consistency fix
2013-11-24 16:51:22 -06:00
23a267b65c
Undo move
2013-11-24 15:06:36 +00:00
23ac7ad75a
Merge remote-tracking branch 'upstream/master' into getaddrinfo
2013-11-24 15:00:00 +00:00
ce8b63f240
Update module name to stay consistent
...
This module is under the windows/gather, so must be named the same
way like the rest.
2013-11-24 01:01:29 -06:00
72822cfa2d
Save egypt from eol comments
2013-11-23 22:11:46 +00:00
646f977888
Use post mixin
2013-11-23 22:07:07 +00:00
4d3e061e43
Merge branch 'enum_ad_perf' into enum_ad_users
2013-11-23 22:05:15 +00:00
699d13eef1
Share the wealth
...
Move LDAP methods to a Post mixin.
2013-11-23 21:42:09 +00:00
11f00cc50b
Backout small change
2013-11-23 21:23:25 +00:00
0c8fc657bb
Address @jlee-r7's comments
2013-11-23 19:42:33 +00:00
b712c77413
capitalization
2013-11-22 14:37:54 -06:00
52a3b93f24
Hopefully final commit.
...
ALL issues mentioned by todb in https://github.com/rapid7/metasploit-framework/pull/2663/ have been fixed or erased.
Only exception is comment https://github.com/rapid7/metasploit-framework/pull/2663/#discussion_r7837036 which if omitted as recommended, breaks the module.
2013-11-22 14:17:20 -06:00
9addd37458
minor changes:
...
s/grab/gather/g
2013-11-22 14:03:54 -06:00
b742ed13b9
junk commit
2013-11-22 12:38:06 -06:00
b2e7ff4587
Small change for filetime conversion
2013-11-17 22:26:30 +02:00
b73260b74c
Add functionality to enum_prefetch post module
2013-11-17 22:10:55 +02:00
5b96ad595f
Skip reg values with no secretes
...
Also update header comment to match new standard
2013-11-13 19:05:16 -06:00
cb10b4783b
Mark XP hashes as mscash for JtR to recognize
2013-11-13 19:04:16 -06:00
0aef145f64
Merge remote-tracking branch 'upstream/master' into land-2532-enum-lsa
2013-11-13 18:11:21 -06:00
8471f74b75
Refactor ivar to a more reasonable method
...
Also changes jtr output for cachedump to produce hashes that can be
auto-detected as mscash2 format for a better user experience.
2013-11-13 18:09:41 -06:00
8bb72764ec
Rename credentials/lsa -> lsa_secrets
...
Secrets are not necessarily credentials
2013-11-13 15:23:15 -06:00
16627c1bd3
Add spec for capture_lsa_key
2013-11-13 15:16:34 -06:00
3168359a82
Refactor lsa and add a spec for its crypto methods
2013-11-13 11:55:39 -06:00
d9fa092962
Initial commit
2013-11-07 20:48:15 +00:00
6415666830
Merge remote-tracking branch 'upstream/master' into enum_ad_perf
2013-11-07 17:00:56 +00:00
4128aa8c08
Resplat and tabs
2013-10-28 14:03:15 -05:00
a95425de08
Check dec instead
2013-10-25 10:47:41 -05:00
1d0a3aad70
[FixRM #8525 ] undefined method `+' for nil:NilClass in enum_ie
...
Looks like for some reason if CryptUnprotectData fails, the decrypt_reg()
method will return "". And when you unpack "", you produce an array of nils.
Since you cannot add something to nil, this should cause an
"undefined method `+' for nil:NilClass" error.
This will check if we get an array of nils, we jump to the next iteration.
2013-10-25 00:26:38 -05:00
e1c4aef805
Land #1789 - Windows SSO Post Module
2013-10-22 15:48:15 -05:00
e447aff0ec
Fix misleading statement in Outlook post module
...
Since this module doesn't retrieve domain exchange information as it isn't stored there it shouldn't say that Outlook isn't installed at all.
2013-10-22 11:53:15 -04:00
8f2ba68934
move decrypt_lsa and decrypt_secret to priv too
2013-10-17 00:04:21 -04:00
541d932d77
move decrypt_lsa to priv as well
2013-10-16 23:53:33 -04:00
60d8ee1434
move capture_lsa_key to priv
2013-10-16 23:45:28 -04:00
1a9fcf2cbb
move convert_des_56_to_64 to priv
2013-10-16 23:39:07 -04:00
26d07c0689
add a needed -end
2013-10-16 23:35:14 -04:00
b318e32487
removed duplicate code for capture_boot_key functions
2013-10-16 23:17:20 -04:00
8be21a7413
remove the insane amount of rescues
2013-10-16 22:58:14 -04:00
1a85bd22a8
move capture_boot_key to post win priv
2013-10-16 22:46:15 -04:00
b223504980
clean up run code - remove catchall rescue
2013-10-16 22:22:45 -04:00
ca88c071cf
remove unneeded railgun call and make vprints out of commented puts
2013-10-16 22:20:21 -04:00
f672e2075b
get rid of ID and Version
2013-10-16 22:18:24 -04:00
2fbd7ea0ba
msftidy up
2013-10-16 22:17:05 -04:00
b42687151f
convert from tabs to spaces
2013-10-16 22:14:55 -04:00
c59bdbf52e
move Rob Bathurst enum_lsa module in from the unstable cold
2013-10-16 22:10:22 -04:00
f0aedd932d
More stragglers
2013-10-16 16:29:55 -05:00
f57032636e
Straggler on a weird boilerplate format
2013-10-15 14:57:04 -05:00
5d86ab4ab8
Catch mis-formatted bracket comments.
2013-10-15 14:52:12 -05:00
ed0b84b7f7
Another round of re-splatting.
2013-10-15 14:14:15 -05:00
c83262f4bd
Resplat another common boilerplate.
2013-10-15 14:07:48 -05:00
23d058067a
Redo the boilerplate / splat
...
[SeeRM #8496 ]
2013-10-15 13:51:57 -05:00
378f403fab
Land #2453 , Add stdapi_net_resolve_host(s) to Python Meterpreter.
...
Moves resolve_host post module to multi and depreciates Windows module.
Resolve will now return nil for failed lookups instead of an empty
string.
2013-10-10 20:13:06 +01:00
6c382c8eb7
Return nil on error, and move the module to post/multi.
2013-10-09 16:52:53 -04:00
c2c6422078
Correct the name of "DynDNS" (not Dyn-DNS)
2013-10-09 09:56:07 -05:00
4dc88cf60f
Expand descriptions for ease of use.
2013-09-30 13:30:31 -05:00
Meatballs
Niel Nielsen
OJ
jvazquez-r7
Tod Beardsley
TabAssassin
Tod Beardsley
sinn3r
jiuweigui
William Vu
Joshua Harper PI GCFE GCFA GSEC
jonvalt
James Lee
Rob Fuller
Spencer McIntyre