Commit Graph

2057 Commits (cf33f482a1fae6fff98978be21326beeccd7fd57)

Author SHA1 Message Date
Brent Cook 2660a5b558 add missing osx specs 2017-08-20 19:25:22 -05:00
Brent Cook 5e8c2200ac Merge branch 'master' into land-8625-crypttlv2 2017-08-20 18:54:51 -05:00
Brent Cook 47dc3772a7 add OptFloat datastore option 2017-08-08 19:06:51 -05:00
OJ d7e8b32312
Merge branch 'upstream/master' into transport-agnostic-packet-encryption 2017-08-08 17:30:51 +10:00
Brent Cook 6300758c46 use https for metaploit.com links 2017-07-24 06:26:21 -07:00
OJ 4f054d25fc
Fix packet spec problems 2017-07-03 18:12:38 +10:00
Brent Cook 79657f5b5b remove silly spec 2017-06-24 16:00:46 -05:00
David Maloney 3a445655ae
Land #8511, console search options
lands sempervictus' console search command
enahncements and bug fixes
2017-06-22 12:07:10 -05:00
William Webb 47a659f554
Land #8185, Convert ntp modules to bindata 2017-06-22 09:37:58 -05:00
OJ a48f0fcec6
Remove references to Meterpreter CRYPTO TLVs
This feature wasn't supported, and so the TLVs are no longer needed.
2017-06-19 16:53:33 +10:00
RageLtMan 42d1fae2e6 Upstream console search additions and fixes
The -S flag for console commands, backed by search functionality
in Rex' tables, originally pushed upstream in #1604 (iirc), lacks
coverage for a number of commands which benefit a good deal from
inline filtering of the potentially large number of results.

Push more -S flags and surrounding table functionality upstream
to provide coverage for the console commands included in framework.

Include a fix for deleting hosts when DB references are a problem.

Include a fix for the upstream route command wherein scope must be
defined for the routing target by assuming a /32 without explicit
definition.

Note:
  With this in place, console behavior when filtering results is
roughly analagous to the R7 filtering in web UI, which should help
those of us trying to use both maintain corresponding workflows.

Testing:
  Used in-house for years, though changes to the diff from upstream
and our fork (expunging some internal code) are untested, so would
appreciate eyes and hands on.
2017-06-16 20:28:51 -04:00
Brent Cook 11b99d954d update specs 2017-05-27 00:34:12 -05:00
Jeffrey Martin 4a43e9bcb2
add spec for reverse_ncat_ssl 2017-05-22 18:34:18 -05:00
darkbushido 2f507cf52b removing some test code 2017-05-04 12:57:50 -05:00
darkbushido fbf1db590e Adding a tests
trying to find the first interface with a non local v4 ip address.
2017-05-04 12:57:50 -05:00
darkbushido a6afd0b9bf adding in a new option type
this will grab the first ipv4 address on a given iface
2017-05-04 12:55:46 -05:00
Brent Cook a191e12241 update specs 2017-04-26 17:06:35 -05:00
William Vu df306c1543 Fix spec (the irony!) 2017-04-26 03:56:10 -05:00
David Maloney aa9c037307
fix spec for reals this time 2017-04-18 14:30:29 -05:00
David Maloney db246e6076
update spec 2017-04-18 14:19:29 -05:00
Brent Cook 67047cf770 Revert "Fixes MS-1716, keep sessions in progress alive."
This reverts commit e5d0370a94.
2017-04-16 15:52:22 -05:00
Brent Cook 42122d2835
Land #8238, move SMB2 support back into smb_login, add simpler permissions checks 2017-04-14 14:06:46 -05:00
David Maloney 91fb3ce6b8
collapse SMB2 support into smb_login
converge the SMB and SMB loginscanners so that
there is only one SMB loginscanner that supports both

MS-2636
2017-04-13 15:22:03 -05:00
bigendiansmalls fa8011fd07 New mainframe privesc payload for z/OS
This module performs a privilege escaltion on mainframe systems
runing z/OS and using RACF for their security manager.  A user
with any non-privileged credentials and the ability to write to
an apf authorized library can use this payload to add "root level"
privileges (e.g. SPECIAL / BPX.SUPERUSER) to their profile.
2017-04-11 15:04:44 -05:00
Brent Cook 5f88971ca9 convert NTP modules to bindata 2017-04-04 02:57:38 -05:00
William Vu 7de2aa1a63 Update Nmap parser to handle masscan
masscan is missing <status>, meaning hosts aren't treated as alive.

Thanks to @jhart-r7 and @jlmurray for working on this previously.
2017-04-03 02:26:14 -05:00
Brent Cook 4c0539d129
Land #8178, Add support for non-Ruby modules 2017-04-02 21:02:37 -05:00
David Maloney 40ab82eea2
add specs for the smb2 login scanner
added some basic specs for the new smb loginscanner
class

MS-2557
2017-03-29 13:46:20 -05:00
Adam Cammack 71df231918
Add new loader for arbitrary executables
Still some kluges left in the shim and we have to hit the disk when
constructing the module path
2017-03-28 10:27:12 -05:00
dmohanty-r7 92c0748447
Land #8102, Add a plugin to notify new sessions via SMS 2017-03-24 11:17:59 -05:00
wchen-r7 bb4d6e17c8 Resolve #8026, Add a plugin to notify new sessions via SMS
This plugin will notify you of a new session via SMS.

It also changes the SMS text format to MIME.

Resolve #8026
2017-03-13 16:13:59 -05:00
wchen-r7 2a5815749c Update rspec 2017-03-08 13:39:24 -06:00
wchen-r7 702d1c2b7e Fix bug for subject 2017-03-08 11:43:36 -06:00
wchen-r7 ed22902fd4 Support the subject field 2017-03-08 11:40:08 -06:00
wchen-r7 a634fec8b3 Fix typo 2017-03-07 16:51:17 -06:00
wchen-r7 dc36bc4a0d Add rspec 2017-03-07 16:49:42 -06:00
wchen-r7 6ad8afb8b3 Add API to send a text message (SMS) to mobile devices 2017-03-02 16:47:55 -06:00
Pearce Barry e5d0370a94
Fixes MS-1716, keep sessions in progress alive. 2017-02-24 12:56:05 -06:00
Tim 7f759384ab fix missing payloads_spec 2017-02-07 15:02:29 +08:00
Brent Cook 64e475a4ee
Land #7892, Enhance the creds command to allow creating logins 2017-02-03 11:53:46 -06:00
Jeffrey Martin 1bb8c9bd93
missed userpass_file on CredentialCollection.empty? 2017-02-01 15:42:21 -06:00
Jeffrey Martin 0dcf0002ae
refactor empty test on CredentialCollection 2017-01-31 15:16:26 -06:00
darkbushido 1fcd20b7ef
adding a spec to show creating a core and login 2017-01-30 12:11:31 -06:00
darkbushido c20cdc2943 cleaning up some of the specs 2017-01-30 10:43:28 -06:00
Brent Cook 4480ea7877
Land #7827, Cisco Firepower Management Console LoginScanner 2017-01-27 16:26:40 -06:00
wchen-r7 781bc8420a Add Advantech WebAccess LoginScanner module 2017-01-26 13:54:50 -06:00
bwatters 253e39e18c
Land #7680, Fix #7679, LoginScanner should abort if there is no creds to try 2017-01-23 14:08:32 -06:00
wchen-r7 d9ead4484e Mock :password 2017-01-23 13:42:30 -06:00
Jeffrey Martin 7cf812ed99 add rspec test for inspect on all TLV_TYPE objects 2017-01-23 09:19:53 -06:00
Brent Cook ac2ceca5e3
Land #7804, Switch the creds command to use named options 2017-01-22 10:49:19 -06:00
Brent Cook 99047fa8a1 be stricter in what we accept for payload uri
datastore needs to contain something to produce a valid URI
2017-01-22 10:20:04 -06:00
Brent Cook 66e9f1d334 fix doc normalizer spec 2017-01-22 10:20:04 -06:00
Brent Cook f69b4a330e handle Ruby 2.4 Fixnum/Bignum -> Integer deprecations 2017-01-22 10:20:03 -06:00
wchen-r7 d7f43a2c66 Fix base_spec 2017-01-17 15:58:30 -06:00
wchen-r7 ecf246b380 Fix more prepended_creds issues 2017-01-17 15:41:24 -06:00
wchen-r7 9efa84298c Mock more methods for base_spec 2017-01-17 15:17:15 -06:00
wchen-r7 d79f4fbda2 Update cisco_firepower_spec 2017-01-17 13:33:56 -06:00
William Vu 77c78fa5f4 Move Rex::Text::Table workspace output to -v 2017-01-15 23:15:14 -06:00
William Vu 360ad26d9c Fix spec because I suck 2017-01-15 04:00:33 -06:00
wchen-r7 a687073416 Add Cisco Firepower Management Console LoginScanner 2017-01-13 16:59:20 -06:00
David Maloney 9b9d3127a8
cleanup leaked constants
use constant cleaner
7824
2017-01-12 15:49:24 -06:00
wchen-r7 08d529b818 Fix login_scanner_base rspec 2017-01-11 14:53:04 -06:00
wchen-r7 90c42b4740 Update rspec 2017-01-11 14:23:28 -06:00
wchen-r7 2377f17663 Fix typos 2017-01-11 14:05:22 -06:00
wchen-r7 9136e008bb Update rspec 2017-01-11 12:00:43 -06:00
wchen-r7 c97dba39f2 creds should mock these methods too 2017-01-11 11:48:52 -06:00
David Maloney 4029dbd5ca
try not to forget fixing the spec... 2017-01-10 14:33:18 -06:00
darkbushido 6bd2e03f37 dding realm tests showed a bug. its now squashed. 2017-01-09 13:04:34 -06:00
darkbushido fe3885f88a changing expect do end back to expect {} 2017-01-09 13:04:34 -06:00
darkbushido 30fe429ada fixing more whitespace issues
converting double quotes to single
2017-01-09 13:04:34 -06:00
darkbushido 0c3760a843 adding more tests
rubocoping the file
2017-01-09 13:04:34 -06:00
darkbushido 3674b25885 fixing the tests, more need to be added 2017-01-09 13:04:34 -06:00
darkbushido 18c7fc5a85 moving the cred tests out of the db tests 2017-01-09 13:04:34 -06:00
dmohanty-r7 5cba9b0034
Land #7747, Add LoginScanner module for BAVision IP cameras 2017-01-06 16:25:44 -06:00
David Maloney 2108913e77
target_host method had a name collision
this method appears to have been accidentaly overriding another
method causing sessions to never finish being established
2017-01-06 12:44:37 -06:00
David Maloney 9dc4ee57b6 minor fixes to linux example module
fixed a copy paste error in the linux_autotarget
test exploit and added actual linux targets to it
2017-01-03 14:38:52 -06:00
David Maloney 5fd531028c ome minor guards and spec fixes
some minor conditional guards and spec fixes
2017-01-03 14:38:51 -06:00
David Maloney a61b92aa3e tweak target selection
the target selection actually adjust the datastore
as if a user selected the target, this prevents
a mismatch between the target and the target index

MS-2325
2017-01-03 14:38:51 -06:00
David Maloney 3d2957dff1 tying it all together
insert our autotarget routine into
the main target selection process

MS-2325
2017-01-03 14:38:50 -06:00
David Maloney 44830dfc54 prefer authour's target over ours
if the module authour added an automatic target
we skip our routine, to let the module's own automatic targeting
take over as it likely be better

MS-2325
2017-01-03 14:38:50 -06:00
David Maloney 1afc57da40 determine most precise filter
drop back to our most precise level of filtering

MS-2325
2017-01-03 14:38:50 -06:00
David Maloney 201b65e43d remaining os filtering
now can filter by os name and service pack
need to do final logic to turn that into an actual
target selection

MS-2325
2017-01-03 14:38:50 -06:00
David Maloney 05ac2ee6ed convert first stage to os_family
added the new os-family column to Host
so now we use that as our first stage filter
for targets

MS-2325
2017-01-03 14:38:49 -06:00
David Maloney 95d5c7a778 filtering by os_name
targets now filtered by OS name, but a little
more processing may be needed on this part because
it looks like what you'd expect in os_flavor gets jammed
into name instead

MS-2325
2017-01-03 14:38:49 -06:00
David Maloney f107408389 target_host specs
add specs for finding the 'target host' ie.
the mdm::Host object related to the RHOST value
to see what we know about our target

MS-2325
2017-01-03 14:38:49 -06:00
David Maloney 4060e63b89 add tests for auto target addition
tests to make sure we add auto targets only
in the appropriate conditions

MS-2325
2017-01-03 14:38:49 -06:00
David Maloney 84d5e42e4f start gearing up for testing
start getting auto-targeting test framework in place
so we can have unit tests for this behaviour

MS-2325
2017-01-03 14:38:45 -06:00
wchen-r7 144f886e8b Add LoginScanner module for BAVision IP cameras 2016-12-23 16:22:17 -06:00
Brent Cook 9e75866188
Land #7738, Add sort by column to services and hosts commands 2016-12-22 01:10:45 -06:00
William Vu a8f36c2a2c Update spec 2016-12-20 23:32:28 -06:00
Brent Cook fa016de78a
Land #7634, Implement universal HTTP/S handlers for Meterpreter payloads 2016-12-13 18:13:22 -06:00
William Vu 4ad42784d3 Update spec 2016-12-12 14:24:24 -06:00
Adam Cammack ccba73b324
Add stageless mettle for Linux/zarch 2016-12-09 18:30:52 -06:00
Adam Cammack 24cf756f5b
Add stageless mettle for Linux/x86 2016-12-09 18:29:34 -06:00
Adam Cammack 62a9a31222
Add stageless mettle for Linux/x64 2016-12-09 18:28:29 -06:00
Adam Cammack 7d36d41b20
Add stageless mettle for Linux/ppc64le 2016-12-09 18:27:22 -06:00
Adam Cammack ee7d5fc0c9
Add stageless mettle for Linux/ppc 2016-12-09 18:25:57 -06:00
Adam Cammack 4570a7198c
Add stageless mettle for Linux/mipsle 2016-12-09 18:24:12 -06:00
Adam Cammack 25b069f6b4
Add stageless mettle for Linux/mipsbe 2016-12-09 18:23:03 -06:00
Adam Cammack 7aec68c1fe
Add stageless mettle for Linux/mips64 2016-12-09 18:21:52 -06:00