2bd792f693
remove .rb file extension
2015-10-30 15:26:45 -05:00
82e600a53a
Suggest the correct replacement for the deprecated module
...
The deprecated module has been suggesting the wrong replacement,
it should be exploits/multi/browser/adobe_flash_pixel_bender_bof.rb
2015-10-29 16:24:29 -05:00
95920b7ff6
Bring back more working links
2015-10-29 15:57:16 -05:00
da52c36687
Put back some links
2015-10-29 15:48:47 -05:00
154fb585f4
Remove bad references (dead links)
...
These links are no longer available. They are dead links.
2015-10-27 12:41:32 -05:00
b2e3ce1f8a
Allow to finish when deletion fails
2015-10-26 16:40:36 -05:00
e188bce4c9
Update minishare_get_overflow.rb
2015-10-21 16:48:31 +02:00
8cb6cc57b5
Land #6094 , refs for another ManageEngine module
2015-10-15 22:49:05 -05:00
86dfbf23e8
Fix whitespace
2015-10-15 22:48:53 -05:00
018b515150
Add CVE/URL references to manageengine_eventlog_analyzer_rce
2015-10-16 10:41:39 +07:00
b1f2e40b98
Add CVE/URL references to module manage_engine_opmanager_rce
2015-10-16 10:36:13 +07:00
d67b55d195
Fix autofilter values for aggressive modules
2015-10-13 15:56:18 -07:00
6f3bd81b64
Enable 64-bit payloads for MSSQL modules
2015-10-11 12:52:46 -05:00
94bb94d33a
Working URL for real
2015-10-09 15:07:44 -05:00
b04f947272
Fix blog post date, derp
2015-10-09 14:59:57 -05:00
55ef6ebe91
HP SiteScope vuln, R7-2015-17
...
On behalf of @l0gan, already reviewed once by @jvazquez-r7, reviewed
again by me.
For details, see:
https://community.rapid7.com/community/metasploit/blog/2017/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection
2015-10-09 14:55:48 -05:00
eb597bb9f3
Land #5842 , watermark fileformat exploit
2015-10-07 19:29:04 +02:00
c5237617f2
Update buffer size for reliability
2015-10-06 18:12:40 -04:00
75d2a24a0a
Land #6019 , @pedrib's Kaseya VSA ZDI-15-449 exploit
2015-10-02 08:51:28 -05:00
cbbeef0f53
Update kaseya_uploader.rb
2015-10-02 13:20:59 +01:00
a88a6c5580
Add WebPges to the paths
2015-10-01 13:22:56 -05:00
f9a9a45cf8
Do code cleanup
2015-10-01 13:20:40 -05:00
7451cf390c
Add Windows 10 "support" to bypassuac_injection
2015-10-01 11:16:18 +10:00
47c79071eb
fix indention and typo
2015-09-29 22:41:36 -04:00
f18e1d69a1
Add x64 ret address and add to buffer
2015-09-29 22:36:30 -04:00
61c922c24d
Create kaseya_uploader.rb
2015-09-29 11:56:34 +01:00
b206de7708
Land #5981 , @xistence's ManageEngine EventLog Analyzer Remote Code Execution exploit
2015-09-27 00:42:17 -05:00
55f573b4c9
Do code cleanup
2015-09-27 00:33:40 -05:00
fd190eb56b
Land #5882 , Add Konica Minolta FTP Utility 1.00 CWD command module
2015-09-18 11:10:20 -05:00
0aea4a8b00
An SEH? A SEH?
2015-09-18 11:09:52 -05:00
ab8d12e1ac
Land #5943 , @samvartaka's awesome improvement of poisonivy_bof
2015-09-16 16:35:04 -05:00
af1cdd6dea
Return Appears
2015-09-16 16:34:43 -05:00
402044a770
Delete comma
2015-09-16 16:23:43 -05:00
75c6ace1d0
Use single quotes
2015-09-16 16:23:10 -05:00
88fdc9f123
Clean exploit method
2015-09-16 16:14:21 -05:00
d6a637bd15
Do code cleaning on the check method
2015-09-16 16:12:28 -05:00
c7afe4f663
Land #5930 , MS15-078 (atmfd.dll buffer overflow)
2015-09-16 15:33:38 -05:00
37d42428bc
Land #5980 , @xistence exploit for ManageEngine OpManager
2015-09-16 13:19:49 -05:00
8f755db850
Update version
2015-09-16 13:19:16 -05:00
1b50dfc367
Change module location
2015-09-16 11:43:09 -05:00
122103b197
Do minor metadata cleanup
2015-09-16 11:41:23 -05:00
aead0618c7
Avoid the WAIT option
2015-09-16 11:37:49 -05:00
0010b418d0
Do minor code cleanup
2015-09-16 11:31:15 -05:00
f3b6606709
Fix check method
2015-09-16 11:26:15 -05:00
24af3fa12e
Add rop chains
2015-09-15 14:46:45 -05:00
c99444a52e
ManageEngine EventLog Analyzer Remote Code Execution
2015-09-15 07:29:16 +07:00
7bf2f158c4
ManageEngine OpManager Remote Code Execution
2015-09-15 07:24:32 +07:00
ae5aa8f542
No FILE_CONTENTS option
2015-09-12 23:32:02 -05:00
0d52a0617c
Verify win32k 6.3.9600.17837 is working
2015-09-12 15:27:50 -05:00
9626596f85
Clean template code
2015-09-12 13:43:05 -05:00
01053095f9
Add MS15-100 Microsoft Windows Media Center MCL Vulnerability
2015-09-11 15:05:06 -05:00
53f995b9c3
Do first prototype
2015-09-10 19:35:26 -05:00
329e6f4633
Fix title
2015-09-08 15:31:14 -05:00
0a0e7ab4ba
This is a modification to the original poisonivy_bof.rb exploit
...
module removing the need for bruteforce in the case of an unknown
server password by (ab)using the challenge-response as an encryption
oracle, making it more reliable. The vulnerability has also been confirmed
in versions 2.2.0 up to 2.3.1 and additional targets for these versions
have been added as well.
See http://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/
for details.
## Console output
Below is an example of the new functionality (PIVY C2 server password is
set to 'prettysecure' and unknown to attacker). Exploitation of versions 2.3.0 and 2.3.1
is similar.
### Version 2.3.2 (unknown password)
```
msf > use windows/misc/poisonivy_bof
msf exploit(poisonivy_bof) > set RHOST 192.168.0.103
RHOST => 192.168.0.103
msf exploit(poisonivy_bof) > check
[*] Vulnerable Poison Ivy C&C version 2.3.1/2.3.2 detected.
[*] 192.168.0.103:3460 - The target appears to be vulnerable.
msf exploit(poisonivy_bof) > set PAYLOAD windows/shell_bind_tcp
PAYLOAD => windows/shell_bind_tcp
msf exploit(poisonivy_bof) > exploit
[*] Started bind handler
[*] Performing handshake...
[*] Sending exploit...
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\winxp\Desktop\Poison Ivy\Poison Ivy 2.3.2>
```
### Version 2.2.0 (unknown password)
```
msf exploit(poisonivy_bof) > check
[*] Vulnerable Poison Ivy C&C version 2.2.0 detected.
[*] 192.168.0.103:3460 - The target appears to be vulnerable.
msf exploit(poisonivy_bof) > show targets
Exploit targets:
Id Name
-- ----
0 Poison Ivy 2.2.0 on Windows XP SP3 / Windows 7 SP1
1 Poison Ivy 2.3.0 on Windows XP SP3 / Windows 7 SP1
2 Poison Ivy 2.3.1, 2.3.2 on Windows XP SP3 / Windows 7 SP1
msf exploit(poisonivy_bof) > set TARGET 0
TARGET => 0
msf exploit(poisonivy_bof) > exploit
[*] Started bind handler
[*] Performing handshake...
[*] Sending exploit...
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\winxp\Desktop\Poison Ivy\Poison Ivy 2.2.0>
```
2015-09-07 17:48:28 +02:00
ef6df5bc26
Use get_target_arch
2015-09-03 16:30:46 -05:00
2588439246
Add references for the win32k info leak
2015-09-03 15:35:41 -05:00
697a6cd335
Rescue the process execute
2015-09-03 13:03:36 -05:00
80a1e32339
Set Manual Ranking
2015-09-03 12:24:45 -05:00
9b51352c62
Land #5639 , adds registry persistence
2015-09-03 11:26:38 -05:00
dbe901915e
Improve version detection
2015-09-03 09:54:38 -05:00
de25a6c23c
Add metadata
2015-09-02 18:32:45 -05:00
8f70ec8256
Fix Disclosure date
2015-09-02 18:21:36 -05:00
b912e3ce65
Add exploit template
2015-09-02 17:28:35 -05:00
4090c2c8ea
Land #5880 , adds ScriptHost UAC bypass for Win7/2008
2015-09-02 14:14:18 -05:00
582cc795ac
Remove newlines
2015-09-02 19:42:04 +01:00
43d3e69fb2
Land #5917 , update local exploit checks
2015-09-02 12:55:45 -05:00
8f25a006a8
Change to automatic target
2015-09-02 09:13:25 +01:00
4275a65407
Update local exploit checks to follow the guidelines.
...
Please see wiki "How to write a check() method" to learn how
these checkcodes are determined.
2015-09-01 23:26:45 -05:00
27775fbe58
Restrict to 7 and 2k8
2015-09-01 22:23:37 +01:00
cd65478d29
Land #5826 , swap ExitFunction -> EXITFUNC
2015-09-01 13:58:12 -05:00
bfc24aea16
change exitfunc to thread
2015-09-01 10:52:25 +02:00
115f409fef
change exitfunc to thread
2015-09-01 10:48:07 +02:00
5398bf78eb
change exitfunc to thread
2015-09-01 10:46:54 +02:00
3e613dc333
change exitfunc to thread
2015-09-01 10:43:45 +02:00
648c034d17
change exitfunc to thread
2015-09-01 10:42:15 +02:00
1b4f4fd225
remove url reference
2015-08-27 19:47:37 +08:00
da4b360202
Fix typo
2015-08-26 15:29:34 -05:00
5d0ed797a3
Update DLL
2015-08-26 15:15:32 -05:00
dd529013f6
Update ruby side
2015-08-26 15:12:09 -05:00
b1ef560264
Merge payload_inject 64-bit inject fix from @Meatballs1
2015-08-24 09:26:00 -05:00
03b1ad7491
add reference info
2015-08-24 11:18:26 +08:00
73cb1383d2
amend banner info for check
2015-08-24 10:55:43 +08:00
1c91b126f1
X64 compat for payload_inject
2015-08-23 22:03:57 +01:00
228087dced
Initial working scripthost bypass uac
2015-08-23 20:16:15 +01:00
7587319602
run rubocop & msftidy
2015-08-23 23:32:30 +08:00
a5daa5c9be
added module descriptions
2015-08-23 23:12:41 +08:00
91a7531af8
konica minolta ftp server post auth cwd command exploit
2015-08-23 21:49:26 +08:00
45c7e4760a
Support x64 payloads
2015-08-20 02:09:58 -05:00
42e08cbe07
Fix bad use of get_profile (now browser_profile)
2015-08-14 19:50:42 -05:00
c02df6b39d
Land #5800 , @bperry's Symantec Endpoint Protection Manager RCE module
2015-08-14 17:03:48 -05:00
b33abd72ce
Complete description
2015-08-14 17:03:21 -05:00
4aa3be7ba2
Do ruby fixing and use FileDropper
2015-08-14 17:00:27 -05:00
33f1324fa9
Land #5813 , @jakxx adds VideoCharge SEH file exploit
2015-08-13 18:01:25 -04:00
e9d3289c23
EXITFUNC caps
2015-08-13 17:25:31 -04:00
6e1c714b2b
Update to leverage auto-NOP generation
2015-08-13 17:24:18 -04:00
361624161b
msftidy
2015-08-13 16:27:27 -04:00
03eb2d71b2
Add watermark fileformat exploit
2015-08-13 16:26:17 -04:00
02c6ea31bb
Use the more recent HD version as default target
2015-08-13 14:42:21 -05:00
80a22412d9
use EXITFUNC instead of ExitFunction
2015-08-13 21:22:32 +02:00
bb4116ed9d
Avoid msftidy.rb rule breaking on missing newline
2015-08-13 12:38:05 -05:00
e7566d6aee
Adding print_status line
2015-08-12 16:08:04 -04:00
979d7e6be3
improve module
2015-08-12 15:37:37 +02:00
2b225b2e7e
Added changes per feedback
...
Updated to include and use seh mixin
changed offset and space for reliability
got rand_text buffer junk working
removed double spaces and stupid fillers in file data
2015-08-12 01:34:45 -04:00
4c28cae5d1
updated to include recommendation from @zerosteiner
2015-08-10 18:38:23 -04:00
23f51bf265
specify junk data
2015-08-07 18:04:11 -04:00
28ad0fccbd
Added VideoCharge Studio File Format Exploit
2015-08-07 15:54:32 -04:00
74ed8cf0c9
actually that didn't work
2015-08-02 18:57:13 -05:00
06754c36a4
unless, not if not
2015-08-02 18:51:23 -05:00
527eaea6ec
single quotes and some error handling
2015-08-02 18:25:17 -05:00
a33724667c
small code cleanup
2015-08-02 16:36:41 -05:00
830aee8aa5
check if cookie is actually returned, and if not, fail
2015-08-02 15:22:40 -05:00
a534008ba6
add some status lines
2015-08-02 15:03:59 -05:00
fe20bc88ad
remove badchars
2015-08-02 11:37:06 -05:00
f7ceec36d0
set default RPORT and SSL
2015-08-02 08:59:36 -05:00
a33dff637d
exploit cve 2015-1489 to get SYSTEM
2015-08-02 08:31:03 -05:00
12ac6d81fa
add markus as the discoverer specifically
2015-08-02 08:17:12 -05:00
e70ec8c07b
no need to store res for the later requests
2015-08-01 18:00:35 -05:00
272d75e437
check res before calling get_cookies
2015-08-01 17:58:41 -05:00
6f31183904
Fix VSS Persistance to check integrity level
2015-08-01 23:13:05 +01:00
47e86000ee
randomize the file names
2015-08-01 16:50:06 -05:00
2bfc8e59be
remove printline
2015-08-01 16:43:31 -05:00
0067d25180
add the sepm auth bypass rce module
2015-08-01 16:40:03 -05:00
a6a8117e46
Revert "Land #5777 , fix #4558 vss_persistence"
...
This reverts commit ba4b2fbbeaaffc86bfd9
2015-08-01 22:35:24 +01:00
ba4b2fbbea
Land #5777 , fix #4558 vss_persistence
2015-07-31 16:46:01 -05:00
1ec960d8f9
Make the time to write flush configurable
2015-07-31 16:43:43 -05:00
672d83eaae
Land #5789 , Heroes of Might and Magic III .h3m Map File Buffer Overflow
2015-07-31 15:43:43 -05:00
7c5e5f0f22
add crc32 forging for Heroes III demo target
2015-08-01 04:53:49 -07:00
7af83a112d
fix unreliable address
2015-08-01 04:52:50 -07:00
908d6f946f
added target Heroes III Demo 1.0.0.0
2015-07-31 18:19:37 -07:00
16042cd45b
fix variable names in comment
2015-07-31 18:16:15 -07:00
66c92aae5d
fix documentation
2015-07-31 17:12:50 -07:00
6fdd2f91ce
rescue only Errno::ENOENT
2015-07-31 13:54:29 -07:00
6671df6672
add documentation
2015-07-31 13:53:56 -07:00
013201bd99
remove unneeded require
2015-07-31 13:49:27 -07:00
12a6bdb67b
Add Heroes of Might and Magic III .h3m map file Buffer Overflow module
2015-07-31 02:06:47 -07:00
d4c8d5884c
Fix a small typo
2015-07-31 11:47:46 -07:00
bf6975c01a
Fix #4558 by restoring the old wmicexec
2015-07-27 14:04:10 -05:00
a7b5890dc5
Fix URIPATH=/ and stack trace on missing ntdll version match
2015-07-25 15:39:20 -07:00
29defc979b
Fix #5740 , remove variable ROP for adobe_flashplayer_flash10o
2015-07-17 16:57:37 -05:00
ea4a7d98b9
Land #5728 , Arch specification for psexec
2015-07-15 15:36:27 +00:00
a7d866bc83
specify the 'Arch' values that psexec supports
2015-07-14 15:45:52 -06:00
e638d85f30
Merge branch 'upstream-master' into bapv2
2015-07-12 02:01:09 -05:00
c37b60de7b
Do some print_status with ms14_064
2015-07-07 00:57:37 -05:00
e355e56539
Add check
2015-07-02 10:54:44 +02:00
8051a99f4a
Merge branch 'upstream-master' into bapv2
2015-07-01 18:45:42 -05:00
56c3102603
That's what you get for making edits on github.com..
2015-07-01 17:51:57 +02:00
4847fb9830
Add a neater powershell command
2015-07-01 17:47:47 +02:00
822a46fee6
Merge branch 'master' of github:dmaasland/metasploit-framework
2015-07-01 17:47:33 +02:00
4f72df3202
Create a neater powershell command
2015-07-01 17:47:08 +02:00
ffe710af2d
Update registry_persistence.rb
...
Omg spaces
2015-07-01 17:21:12 +02:00
26e3ec0a5f
Add a switch for creating a cleanup rc file
2015-07-01 17:06:16 +02:00
20708ebc82
Add a check to prevent accidental deletion of existing registry keys
2015-07-01 16:45:03 +02:00
2e48bae71c
fixes
2015-07-01 16:15:13 +02:00
335487afa0
fixes
2015-07-01 16:09:55 +02:00
d0845b8c66
msftidy fix
2015-07-01 12:50:34 +02:00
a3db6c6ae3
Msftidy fix
2015-07-01 12:47:10 +02:00
bd94f50fb0
add registry_persistence.rb
2015-07-01 12:26:46 +02:00
3632cc44c5
Fix nil error when target not found
2015-06-30 11:48:41 -05:00
9bd920b169
Merge branch 'upstream-master' into bapv2
2015-06-27 12:19:55 -05:00
7ccc86d338
Use cmd_exec
2015-06-26 11:54:19 -05:00
2206a6af73
Support older targets x86 for MS15-051
2015-06-25 09:33:15 +10:00
a149fb5710
Land #5554 , @g0tmi1k's persistence improvements
...
age aborts
age aborts
2015-06-24 14:37:25 -05:00
e7e8135acd
Clean up module
2015-06-24 14:35:10 -05:00
dedfca163d
Change check()
2015-06-22 15:05:12 -05:00
3686accadd
Merge branch 'upstream/master' into cve-2015-1701
2015-06-22 07:52:17 +10:00
efece12b40
Minor clean ups for ruby strings and check method
2015-06-21 16:07:44 -04:00
74bc9f7a91
Land #5529 , @omarix's Windows 2003 SP1 & SP2 French targets for MS08-067
2015-06-19 16:57:07 -05:00
61ad4ada7d
Delete commas
2015-06-19 16:03:16 -05:00
9da99a8265
Merge branch 'upstream-master' into bapv2
2015-06-19 11:36:27 -05:00
6ec8488929
Land #5560 , @wchen-r7 Changes ExcellentRanking to GoodRanking for MS14-064
2015-06-19 11:15:41 -05:00
1c357e6b3c
Land #5478 , @wchen-r7 Updates ca_arcserve_rpc_authbypass to use the new cred API
2015-06-19 10:21:14 -05:00
0f17f622c3
Report last_attempted_at
2015-06-19 10:20:47 -05:00
357a3929a3
Trying to report more accurate status
2015-06-19 09:51:36 -05:00
7e91121afc
Change to Metasploit::Model::Login::Status::SUCCESSFUL
2015-06-18 23:44:45 -05:00
0b55a889d3
persistence - better ruby/msf fu
2015-06-18 21:10:16 +01:00
13a3f2781d
Change ExcellentRanking to GoodRanking for MS14-064
...
The ms14_064_ole_code_execution exploit's ranking is being lowered
to GoodRanking because of these two reasons:
1. The vulnerable component isn't in Internet Explorer. And BES can't
check it so the exploit still fires even if the target is patched.
2. Although rare, we've seen the exploit crashing IE, and since this
is a memory curruption type of bug, it should not be in Excellent
ranking anyway.
2015-06-18 13:07:44 -05:00
a3debe1621
persistence - more options, more verbose
...
...and less bugs!
+ Able to define the EXE payload filename
+ Able to setup a handler job
+ Able to execute persistence payload after installing
+ Performs various checks (should be more stable now)
+ Will display various warnings if your doing something 'different'
+ Added various verbose messages during the process
2015-06-17 13:57:06 +01:00
8d640a0c8f
Land #5527 , multi/handler -> exploit/multi/handler
2015-06-15 10:23:26 -05:00
17b8ddc68a
Land #5524 , adobe_flash_pixel_bender_bof in flash renderer
2015-06-15 02:42:16 -05:00
c7cda25582
Empty lines removed at line 624 and line 721.
...
Empty lines removed at line 624 and line 721.
2015-06-13 14:54:10 +01:00
7f0e334d78
Added Windows 2003 SP1 & SP2 French targets
...
msf exploit(ms08_067_netap) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows 2003 SP0 Universal
4 Windows XP SP2 English (AlwaysOn NX)
[...]
62 Windows 2003 SP1 French (NX)
63 Windows 2003 SP2 English (NO NX)
[...]
71 Windows 2003 SP2 French (NO NX)
72 Windows 2003 SP2 French (NX)
2015-06-13 13:30:02 +01:00
a53ca53a6a
Fix inconstancy - multi/handler
2015-06-12 21:23:51 +01:00
8ed13b1d1b
Add linux support for CVE-2014-0515
2015-06-11 16:18:50 -05:00
ae21b0c260
Land #5523 , adobe_flash_domain_memory_uaf in the flash renderer
2015-06-10 16:59:19 -05:00
4c5b1fbcef
Land #5522 , adobe_flash_worker_byte_array_uaf in the flash renderer
2015-06-10 14:49:41 -05:00
6c7ee10520
Update to use the new flash Exploiter
2015-06-10 13:52:43 -05:00
d622c782ef
Land #5519 , adobe_flash_uncompress_zlib_uninitialized in the flash renderer
2015-06-10 11:52:47 -05:00
fb531d0069
Update version coverage
2015-06-10 09:38:00 -05:00
a6fe383852
Use AS Exploiter
2015-06-10 09:32:52 -05:00
e5d6c9a3cb
Make last code cleanup
2015-06-09 16:01:57 -05:00
cf8c6b510b
Debug version working
2015-06-09 15:46:21 -05:00
b7f0fad72f
Modify CVE-2014-0569 to use the flash exploitation code
2015-06-09 11:31:39 -05:00
ee13a215e9
Merge branch 'upstream-master' into bapv2
2015-06-05 14:09:07 -05:00
318f67fcda
update descriptions
2015-06-05 09:01:20 -05:00
69968fc9f1
Merge branch 'upstream-master' into bapv2
2015-06-04 23:36:24 -05:00
02181addc5
Update CVE-2014-0556
2015-06-04 18:23:50 -05:00
be709ba370
Merge branch 'upstream-master' into bapv2
2015-06-04 10:33:07 -05:00
78e4677bb1
Oops it blew up
2015-06-03 20:10:01 -05:00
a0aa6135c5
Update ca_arcserve_rpc_authbypass to use the new cred API
2015-06-03 20:02:07 -05:00
a6467f49ec
Update description
2015-06-03 22:17:25 +10:00
Louis Sato
wchen-r7
jvazquez-r7
Boumediene Kaddour
William Vu
xistence
HD Moore
Tod Beardsley
Christian Mehlmauer
jakxx
Pedro Ribeiro
OJ
samvartaka
Meatballs
Muhamad Fadzil Ramli
Brent Cook
Spencer McIntyre
Brandon Perry
aakerblom
Donny Maasland
g0tmi1k
0xFFFFFF