5687028f09
Land #4671 , @earthquake's exploit for achat buffer overflow
2015-02-09 17:50:09 -06:00
6165d623ff
Change module filename
2015-02-09 17:39:55 -06:00
eb0741d7a7
Modify reference
2015-02-09 17:39:18 -06:00
0a42ac947a
Land #4737 , fix Socket Context usages
2015-02-09 17:34:03 -06:00
86f3bcad11
Do minor cleanup
2015-02-09 17:33:05 -06:00
7ee5fd9b32
Fix lotus_domino to use get_cookies correctly.
2015-02-09 17:29:44 -06:00
ac6879cfe1
proper payload encoding from now on
2015-02-09 23:36:35 +01:00
c7880ab4e1
hex strings related explanations
2015-02-09 23:21:38 +01:00
9891026d30
sleep changed to Rex::sleep
2015-02-09 22:33:41 +01:00
81cad064ea
Land #4724 , @wchen-r7's AllowWin32SEH's change on alpha encoders
2015-02-09 11:01:00 -06:00
af405eeb7d
Land #4287 , @timwr's exploit form CVS-2014-3153
2015-02-09 10:33:14 -06:00
831a1494ac
Keep default behavior for modules forcing Msf::Encoder::Type::AlphanumUpper
2015-02-08 18:29:25 -06:00
3e7e9ae99b
Keep default behavior for modules forcing Msf::Encoder::Type::AlphanumMixed
2015-02-08 18:22:11 -06:00
133ae4cd04
Land #4679 , Windows Post Gather File from raw NTFS.
2015-02-08 18:50:50 +00:00
69e53a46cb
Final tidyups, description etc
2015-02-08 18:49:17 +00:00
9518090b8b
Ignore some error conditions
2015-02-08 18:46:48 +00:00
cc4fc1aefa
use GetFileAttributesW and CreateFileW
2015-02-08 17:36:49 +01:00
1f7bee35b5
Land #4731 , fix fail_with message
2015-02-07 22:27:17 -06:00
a5b2e99136
Correct punctuation on outlook, too.
2015-02-07 22:26:14 -06:00
6d46182c2f
Land #4570 , @rastating 's module for wp-easycart
2015-02-07 23:42:23 +01:00
f2b834cebe
remove check because the vuln is unpatched
2015-02-07 23:38:44 +01:00
d2421a2d75
wrong version
2015-02-07 23:34:19 +01:00
56d2bc5adb
correct version number
2015-02-07 23:22:43 +01:00
1390c81420
Fix fail_with text
...
Fix fail_with text, when the target system is locked.
2015-02-07 21:20:24 +01:00
345d5c5c08
Update version numbers to reflect latest release
2015-02-07 19:09:16 +00:00
b1726fd609
Missing comma
2015-02-07 11:56:22 -06:00
8d982e3286
Pass the framework/module down into LoginScanner
2015-02-07 11:50:30 -06:00
358ab2590e
Small tidyup
2015-02-07 11:35:47 +00:00
87775c6ee4
Fix description
2015-02-06 23:55:27 -06:00
76387eebe0
Use File.open
2015-02-06 21:35:07 -06:00
1ea4a326c1
Land #4656 , @nanomebia's fixes for sugarcrm_unserialize_exec
2015-02-06 16:42:01 -06:00
e511f72ab4
Delete final check
...
* A session is the best proof of success
2015-02-06 16:34:34 -06:00
a543d957d4
Fix #4717 - Change AllowWin32SEH's default to false
...
This is patch to change AllowWin32SEH to false.
Root cause:
The truely intended behavior is that if the user doesn't set a
BufferRegister and the encoder is for Windows, the AllowWin32SEH
code should kick in.
The problem here is that msfencode and msfvenom handle the platform
information differently, so we get different results.
With msfencode, the platform information isn't passed when alpha_mixed
is used, so even if you're using the encoder for Win32, the encoder
doesn't actually know about this. But everything works out just fine
anyway because people don't actually rely on AllowWin32SEH.
With msfvenom, the platform information is passed, so the encoder
actually knows it's for Windows. The two conditions are met (regster
and platform), so AllowWin32SEH kicks in. However, the AllowWin32SEH
technique enforces the BufferRegister to ECX, and that there's no
GetPC, so by default this isn't going to work.
The solution:
We are actually better off with setting AllowWin32SEH to false, mainly
because the SEH technique is pretty much dead (congrats MSFT!). And we
want the GetPC routine by default.
If people want to use AllowWin32SEH routine, they can simply set
AllowWin32SEH to true to bring it right back. For example:
e = framework.encoders.create('x86/alpha_mixed')
e.datastore.import_options_from_hash({'AllowWin32SEH'=>true})
buf = e.encode("AAAA", nil, nil, ::Msf::Module::PlatformList.win32)
Or in msfvenom:
msfvenom -p windows/meterpreter/bind_tcp -e x86/alpha_mixed
AllowWin32SEH=true -f raw
Fix #4717
2015-02-06 12:38:04 -06:00
f6933ed02c
Add module for EDB-35948
2015-02-06 11:05:29 -06:00
036cb77dd0
Land #4709 , fixed up some datastore mangling
2015-02-05 21:22:38 -06:00
7e649a919c
This version will actually work.
2015-02-05 21:00:54 -06:00
3e0ce4a955
Fix datastore mangling with instance variables
...
See rapid7/metasploit-framework #4709
2015-02-05 20:37:18 -06:00
4e0a62cb3a
Land #4664 , MS14-070 Server 2003 tcpip.sys priv esc
2015-02-05 18:49:15 -05:00
a359fe9acc
Minor fixup on the ms14-070 module description
2015-02-05 18:41:58 -05:00
f8c81e601c
Land #4710 for real.
...
This isn't a proper merge commit. Will need to figure out what I did to
wang up the last landing -- I'm guessing I didn't fetch enough first.
This should fix #4710 .
2015-02-05 17:18:51 -06:00
0a587c9f5a
Land #4710 , really
...
Looks like my publish script ended up rebasing wchen-r7/aux_ie_uxss and
didn't catch the file rename correctly.
Conflicts:
modules/auxiliary/gather/ie_uxss_injection.rb
2015-02-05 17:13:53 -06:00
79e0ddadf6
Rename file again
2015-02-05 17:09:11 -06:00
97aa9f9dd2
Credit @joevennix
2015-02-05 17:09:11 -06:00
7585c625fa
Another update
...
Thanks @joevennix
2015-02-05 17:09:11 -06:00
12aadb3132
Another update
2015-02-05 17:09:10 -06:00
17f2d8048d
Another update
2015-02-05 17:09:10 -06:00
01252078ea
Use store_loot to store coookie
2015-02-05 17:09:10 -06:00
6fd38307e7
An update
2015-02-05 17:09:10 -06:00
727fc51c0b
Don't need this line
2015-02-05 17:09:10 -06:00
4924749b96
Try to make the filename more self explanatory
2015-02-05 17:09:09 -06:00
26af10c3b6
Change public ip option name and store cookie to db
2015-02-05 17:09:09 -06:00
bfa7b61663
Final
2015-02-05 17:09:09 -06:00
b90515ae5d
IE UXSS
2015-02-05 17:09:09 -06:00
970c5d115a
spellcheck
2015-02-05 22:08:39 +01:00
d16cc843b2
Correct disclosure date
2015-02-05 15:00:13 -06:00
0955e14dad
Final, really, I think
2015-02-05 14:59:24 -06:00
dc13446536
Forgot to comment ret instruction
2015-02-05 14:09:01 -05:00
578423501a
Another update
2015-02-05 13:08:33 -06:00
5a39ba32f6
Make the ret instruction for token stealing optional
2015-02-05 14:00:38 -05:00
dabc163076
Modify the shellcode stub to save the process
2015-02-05 13:54:52 -05:00
c633c710bc
Mostly caps/grammar/spelling, GoodRanking on MBAM
2015-02-05 12:36:47 -06:00
562063c4d5
Rename file again
2015-02-05 12:26:17 -06:00
80ebde4fe1
Credit @joevennix
2015-02-05 12:25:38 -06:00
27b8d1057f
Another update
...
Thanks @joevennix
2015-02-05 12:23:32 -06:00
988b54f594
Another update
2015-02-05 12:01:19 -06:00
53134aeb17
Another update
2015-02-05 11:46:38 -06:00
871c8aa8d0
Use store_loot to store coookie
2015-02-05 11:36:35 -06:00
dbe99014f2
An update
2015-02-05 11:29:52 -06:00
08d796c5e3
Don't need this line
2015-02-05 10:53:29 -06:00
d6fe077f79
Try to make the filename more self explanatory
2015-02-05 09:53:38 -06:00
ed6ee27896
Change public ip option name and store cookie to db
2015-02-05 09:48:45 -06:00
75c697c4dc
Final
2015-02-05 04:36:44 -06:00
1ccfb6cb43
IE UXSS
2015-02-05 03:03:28 -06:00
b43522a2b8
Fix scadapro_cmdexe datastore
2015-02-05 02:54:03 -06:00
a12d1244b9
Fix zenworks_helplauncher_exec datastore
2015-02-05 02:53:47 -06:00
148ffaf55f
Fix real_arcade_installerdlg datastore
2015-02-05 02:53:38 -06:00
a7156cf4a8
Fix zabbix_script_exec datastore
2015-02-05 02:53:22 -06:00
9c1487c944
Fix dns_fuzzer datastore
2015-02-05 02:53:14 -06:00
c22865fb71
Fix nexpose_xxe_file_read datastore
2015-02-05 02:53:00 -06:00
5b2eb986c9
Land #4678 Add post module to phish credentials
2015-02-04 23:43:02 -06:00
434bca0b27
Land #4613 , auxiliary/server/capture/smb credential creation
2015-02-04 22:45:36 -06:00
aebf5056ac
Dont compare a string to an integer
2015-02-04 16:55:43 -05:00
47d4acd91d
Land #4605 , Malwarebytes fake update exploit
2015-02-04 10:28:17 -06:00
fbf32669c6
Use single quote
2015-02-04 09:47:27 -06:00
de09559cc8
Change HTTP requests to succeed when going through HTTP proxies
2015-02-04 15:32:14 +01:00
c366e7777d
Delete ternary operators
2015-02-03 17:43:00 -06:00
c0e1440572
Land #4685 , @FireFart's module for Wordpress Platform Theme RCE
2015-02-03 17:35:59 -06:00
28f303d431
Decrease timeout
2015-02-03 17:33:29 -06:00
34717d166d
Fix typo
2015-02-03 17:12:54 -06:00
a1c157a4db
Land #4609 , @h0ng10's module for Wordpress Pixabay Images PHP Code Upload
2015-02-03 17:01:32 -06:00
eebee7c066
Do better session creation handling
2015-02-03 17:00:37 -06:00
4ca4fd1be2
Allow to provide the traversal depth
2015-02-03 16:38:40 -06:00
e62a5a4fff
Make the calling payload code easier
2015-02-03 16:23:04 -06:00
61cdb5dfc9
Change filename
2015-02-03 16:13:10 -06:00
82be43ea58
Do minor cleanup
2015-02-03 16:07:27 -06:00
82eeec0946
Delete comments
2015-02-03 15:25:52 -06:00
52616a069a
Add support for NTLMSSP
2015-02-03 15:25:02 -06:00
b5794db973
Spelling
2015-02-03 14:10:47 -06:00
edd5ec3b0d
Refactor and rename of @sgabe's module
...
Renamed because it's not just MBAM, and having malwarebytes in the name
is more memorable anyway.
This refactor's @sgabe's original module to prefer if/else over
unless/else, clearly labelling variables, and wrapping up discrete
functionality into specific methods, and adds an OSVDB and the original
discoverer's URL.
2015-02-03 14:08:25 -06:00
54a5dd69a9
Land #4698 , WP GHOST scanner dead code removal
2015-02-02 16:54:09 -06:00
9e030143e7
Fix slow search due to method name conflict
...
Changed "search_filter" in enum_ad_users module to "query_filter" to
avoid conflicting with "search_filter" in command_dispatcher/core.rb.
2015-02-02 16:36:20 -06:00
c8864c93d7
remove unused code
2015-02-02 20:04:10 +01:00
d5c61c01f5
Land #4694 , uninit Rex::OLE fix
2015-02-02 05:33:40 -06:00
9112e70187
Fix #4693 - Uninit Rex::OLE in MS14-064 exploits
...
Fix #4693
2015-02-02 00:20:34 -06:00
d211488e5d
Add Initial version
2015-02-01 19:47:58 -06:00
d0cf316758
Land #4659 , @pedrib's ManageEngine directory listing module
2015-02-01 14:19:46 -06:00
128ca47aa7
Fix banner
2015-02-01 14:19:03 -06:00
41232c0f91
Land #4758 , @pedrib's ManageEngine arbitrary file download module
2015-02-01 14:17:04 -06:00
361aaa7551
Fix banner
2015-02-01 14:16:09 -06:00
904a99965d
Sleep 1 added
...
Sleep 1 added to reduce network usage
2015-02-01 11:55:01 +01:00
39a25fc549
Update manageengine_file_download.rb
2015-02-01 10:49:48 +00:00
e9b5aa94c3
Add OSVDB id and full disclosure URL
2015-02-01 10:49:11 +00:00
8740fd9015
Convert #find_all_by_X to #where
2015-01-31 21:07:50 -06:00
2c956c0a0f
add wordpress platform theme rce
2015-01-31 22:02:44 +01:00
03fcfc496a
add a test to check if the file exist
2015-01-31 06:00:02 +01:00
2cf9a17f25
variable name clarification (file, file_path, path)
2015-01-31 05:07:07 +01:00
5d4a8e2f90
using store_loot
2015-01-31 05:01:28 +01:00
d6fb445522
add begin...ensure block so that the CloseHandle call occurs
2015-01-31 04:46:02 +01:00
1205c0045f
using r['ErrorMessage']
2015-01-31 04:37:16 +01:00
f7d2e2a27a
twitter in comment
2015-01-31 04:36:07 +01:00
3471b43010
Land #4683 , @julianvilas's support for struts 1 on struts_code_exec_classloader
2015-01-30 18:47:56 -06:00
c831de35a2
Land #4392 , @Meatballs1's post module to enumerate AD users
2015-01-30 17:21:10 -06:00
253d8e60dd
Land #4388 , Meatballs1's golden ticket post module
2015-01-30 16:26:04 -06:00
11502bad39
Clean code
2015-01-30 15:26:25 -06:00
1916c92e3a
Clean metadata
2015-01-30 15:21:17 -06:00
c9ac56442d
No modify datastore option
2015-01-30 15:05:46 -06:00
bb640b90ef
Refactor login_it360
2015-01-30 15:02:23 -06:00
d4359c4f1c
Rework login_it360 code
2015-01-30 15:00:34 -06:00
efd7a8c962
Land #4670 , dns_amp RA flag fix
2015-01-30 14:46:15 -06:00
c5db13fba9
Do minor style fixes
2015-01-30 14:13:11 -06:00
89f760c94e
Clean metadata
2015-01-30 14:08:55 -06:00
25ac9c1ed9
Add post module to phish windows user credentials
2015-01-30 19:50:04 +01:00
68b735dbda
Add a NTFS parser and a post module to dump files
...
This commit add a draft of an NTFS Parser and a post module
to gather file using the raw NTFS device (\\.\C:)
bypassing restriction like already open file with lock
Can be used to retreive file like NTDS.DIT without volume shadow copy
2015-01-30 19:16:44 +01:00
7504358db3
code style and typos
2015-01-30 15:57:32 +01:00
9ce2dd9815
msftidy
2015-01-30 15:41:11 +01:00
a0eaf2f626
add wordpress ghost scanner module
2015-01-30 15:29:51 +01:00
f983c8171e
Modify description to match both Struts 1.x and 2.x versions
2015-01-30 12:35:38 +01:00
39004d265b
Increase default buffer sizes to reduce railgun calls
2015-01-30 11:20:03 +00:00
d4707b8e07
Spellingz
2015-01-30 11:20:03 +00:00
9670608380
Reformat, remove unnecessary guard statement
2015-01-30 11:20:02 +00:00
0e976041b7
Small description fix
2015-01-30 11:20:02 +00:00
14f6ef13f4
Remove hardcoded domain
2015-01-30 11:20:02 +00:00
79a3a48348
Correct description
2015-01-30 11:20:02 +00:00
e492f56ac0
Error if no database
2015-01-30 11:20:02 +00:00
e6dbc15f40
Line length modification
2015-01-30 11:20:02 +00:00
044e3bd608
Golden Ticketz Post module
2015-01-30 11:20:02 +00:00
42ef5716e8
Don't test ra flag to get upward referrals/additional RRs
2015-01-30 02:20:24 +01:00
1a11ae4021
Add new references about Struts 1
2015-01-29 23:27:52 +01:00
64ab11c6ba
Add Achat Beta v0.150 RCE for Win7/XPSP3
2015-01-29 23:20:31 +01:00
4cc5844baf
Add Struts 1 support
2015-01-29 23:12:34 +01:00
2c05b1ee50
Use QUERYTYPE instead of hardcode ANY type
2015-01-29 22:54:06 +01:00
6c529f8f6b
Addressed feedback from @OJ and @zeroSteiner
2015-01-29 11:57:03 -05:00
d04fd3b978
Fixing Indentation
...
Small indentation fix
2015-01-29 13:03:19 +08:00
064ca2d02e
Updated version checking
2015-01-28 18:25:30 -05:00
0f88d0ad75
Change print_* to vprint_*
...
According to our wiki doc, all print_* should be vprint_* for check()
2015-01-28 15:44:14 -06:00
a806cb401a
Create manageengine_dir_listing.rb
2015-01-28 19:44:48 +00:00
51764eb207
Add a check() for mssql_payload
2015-01-28 13:44:16 -06:00
62ac536b7d
Create manageengine_file_download.rb
2015-01-28 19:42:17 +00:00
37c08128dc
Add in MS14-070 Priv Escalation for Windows 2003
2015-01-28 13:24:39 -05:00
af90c6482b
Sanity Changes
...
Reverted failure behaviour on line 70
Removed a space that prevented line 98 from working as intended
2015-01-28 18:40:43 +08:00
27c412341f
Syntax Changes
...
Cleaned up this statement a tiny bit
2015-01-28 18:34:19 +08:00
fc3094ec9b
Syntax changes
...
Fixed some more syntax - failures
2015-01-28 18:30:21 +08:00
321eb452c5
Syntax Fixes
...
Fixed some or's to || - and's to &&.
Fixed failure if statement (fails using fail_with())
Fixed nested else (now and elsif)
Changed final execute logic - checks for success rather than failure.
2015-01-28 18:08:15 +08:00
fefc3d088c
Cookie fix and success display
...
Added handling for if the server doesn't correctly assign a cookie using
Set-Cookie by changing the regex and doing an additional check. Also
fixed the success display - changed the if statement to match others in
this module and fixed the text output based on server response.
2015-01-28 17:11:05 +08:00
ffd1257bff
Make sure this branch is up to date.
2015-01-27 12:16:15 -06:00
bb9c961847
Change description a bit
2015-01-27 12:14:55 -06:00
2dedaee9ca
Working version after the upgrade
2015-01-27 12:02:36 -06:00
7d7139d769
Consistent-ize whitespace
2015-01-27 11:11:02 -06:00
d8200c65a8
Strip safely, avoid nil.strip errors
2015-01-27 11:06:55 -06:00
5b3d877b25
Land #4648 , for real
2015-01-27 11:00:22 -06:00
a88a631b66
Fix #strip
2015-01-27 10:58:24 -06:00
d2bf1a73ff
Don't need to require YAML anymore either
2015-01-27 10:40:57 -06:00
cafbd1af51
Prefer a regex over YAML parsing
...
Fixes a bug introduced in #4645
2015-01-27 10:34:56 -06:00
9e3388df34
Use BES for MS13-037 and default to ntdll
2015-01-27 00:18:36 -06:00
d53f4e1178
Fix bugs and make final changes
2015-01-26 23:29:10 -06:00
2bb9314b4b
Switch to unless conditional
2015-01-27 00:10:33 -05:00
1f9286da69
Undo logic reversage
2015-01-26 23:54:41 -05:00
a9e480e44a
Fixed tilde
2015-01-26 23:53:08 -05:00
eed9fbe024
Lose assignment in conditional
2015-01-26 23:48:08 -05:00
c496d2c987
Remove nil check
2015-01-26 23:43:31 -05:00
c29b7488b2
Fix double new line
2015-01-26 23:40:19 -05:00
d77f112e82
Minor Formatting
2015-01-26 23:31:36 -05:00
06485d8c89
Fix naming of things
2015-01-26 23:17:44 -05:00
685c4804e5
Add trailing return
2015-01-26 23:15:00 -05:00
6b6e47a237
Fix sessiontypes, again
2015-01-26 23:13:17 -05:00
747349a57a
Fix sessiontypes
2015-01-26 23:11:48 -05:00
ee7ecb349d
Fix description
2015-01-26 23:10:08 -05:00
106170eddc
Add multi to name
2015-01-26 23:08:43 -05:00
a3c7cf70f8
Make MSF Tidy more happy
2015-01-26 22:30:26 -05:00
d37b3cf0c3
Use next instead of return
2015-01-26 22:26:56 -05:00
f58dc2789f
Remove creds
2015-01-26 22:13:15 -05:00
a27c376ae7
Add service port and host
2015-01-26 22:06:07 -05:00
dd34b58e49
Add add loot
2015-01-26 22:01:38 -05:00
3889ed5784
Add cred login
2015-01-26 21:50:10 -05:00
eead063375
Add RubyGems API Post Gather Module
2015-01-26 20:53:39 -05:00
46210a4963
Fix punctuation
2015-01-26 12:05:54 -06:00
bae19405a7
Various grammar, spelling, word choice fixes
2015-01-26 11:00:07 -06:00
d7375e84ea
Move modules/post/windows/escalate/net_runtime_modify.rb
...
This module was scheduled to be removed on 01/08/2015.
Please use exploit/windows/local/service_permissions instead.
2015-01-26 00:29:43 -06:00
f5916eba6d
Move modules/exploits/windows/misc/psh_web_delivery.rb
...
This module was scheduled to be removed on 10/23/2014.
Please use exploit/multi/script/web_delivery instead.
2015-01-26 00:28:40 -06:00
bbcc2eb07d
Move modules/exploits/windows/misc/pxecploit.rb
...
This module was scheduled to be removed on 10/31/2014.
Please use exploits/windows/local/pxeexploit instead.
2015-01-26 00:25:02 -06:00
jvazquez-r7
Tod Beardsley
Balazs Bucsay
Brent Cook
Meatballs
Bazin Danil
Christian Mehlmauer
wez3
rastating
HD Moore
sinn3r
Spencer McIntyre
William Vu
scriptjunkie
julianvilas
Pedro Ribeiro
Christian Catalan
Guillaume Delacour
Jay Smith
Nanomebia
James Lee
Jonathan Claudius