199bd20b95
Update CVE-2013-3893's Microsoft reference
...
Official patch is out:
http://technet.microsoft.com/en-us/security/bulletin/MS13-080
2013-10-08 13:00:03 -05:00
72a35d14f1
Mark broken tests as pending
...
These tests are broken a few different ways.
[SeeRM #8463 ]
also see: https://github.com/rapid7/metasploit-framework/pull/2477
2013-10-08 11:49:42 -05:00
7d0cf73af7
Fix multi-meter_inject error msg
...
Was trying to coerce the exception class
to string rather than calling .message
Results in a stacktrace.
FIXRM #8460
2013-10-08 11:11:38 -05:00
a5bace2425
Land #2485 - Removed extra bracket for scripts/meterpreter/vnc.rb
...
g0tmi1k's version was outdated, so I merged from my branch instead.
2013-10-08 10:17:49 -05:00
db92709d33
Remove extra bracket
2013-10-08 10:17:08 -05:00
2593c06e7c
Land #2412 , @mwulftange's printf cmd stager
2013-10-08 09:08:29 -05:00
6f7d513f6e
Another clean up and simplification of CmdStagerPrintf
2013-10-08 07:22:09 +02:00
8b9ac746db
Land #2481 , deprecate linksys cmd exec module
2013-10-07 20:44:04 -05:00
c10f0253bc
Land #2472 - Clean up the way Apple Safari UXSS aux module does data collection
2013-10-07 15:47:28 -05:00
e0ce444896
Merging release back to master
2013-10-07 15:33:16 -05:00
f7f6abc1dd
Land #2479 - Add Joev to the wolfpack
2013-10-07 15:30:23 -05:00
f4000d35ba
Use RopDb for ms13_069
...
Target tested
2013-10-07 15:24:01 -05:00
7222e3ca49
Use RopDb for ms13_055_canchor.
...
All targets tested.
2013-10-07 15:09:36 -05:00
67228bace8
Use RopDb for ie_cgenericelement_uaf.
...
All targets tested except for Vista, so additional testing will need
to be done during review.
2013-10-07 14:51:34 -05:00
4ba001d6dd
Put my short name to prevent conflicts.
2013-10-07 14:10:47 -05:00
ec6516d87c
Deprecate misnamed module.
...
* Renames to a linux linksys module.
2013-10-07 14:06:13 -05:00
aea63130a4
Use RopDb for ie_cbutton_uaf.
...
All targets tested except for Vista. Will need additional testing
during review.
2013-10-07 14:03:07 -05:00
61e02f3d79
Merge 'upstream-master' into release
...
Picks up #2480 as well.
2013-10-07 13:52:04 -05:00
0991b72a0e
Land #2480 , @todb-r7's changes for weekly update
2013-10-07 13:19:00 -05:00
5c5cf6dc57
Merge 'upstream-master' into release
...
Preliminary cut for release
2013-10-07 13:15:09 -05:00
219bef41a7
Decaps Siemens (consistent with other modules)
2013-10-07 13:12:32 -05:00
3215453522
Empty commit to trigger a close on #2476
...
If this commit lands, it'll close #2476 because it accomplishes the same
thing.
[Closes #2476 ]
2013-10-07 12:51:34 -05:00
4266b88a20
Move author name to just 'joev'
...
[See #2476 ]
2013-10-07 12:50:04 -05:00
ff6dec5eee
Promote joev to a first class citizen
...
[See #2476 ]
2013-10-07 12:40:43 -05:00
8b7d241dc3
Use a named subject
2013-10-07 12:28:50 -05:00
e016c9a62f
Use RopDb msvcrt ROP chain. Tested all targets.
2013-10-07 12:27:43 -05:00
293927aff0
msftidy fix for coldfusion exploit
2013-10-07 12:22:48 -05:00
d8dba8ee58
Fix ropdb spec according to @limhoff-r7's comments
2013-10-07 09:51:21 -05:00
da48565093
Add more payloads for nodejs.
...
* Adds a reverse and bind CMD payload
* Adds a bind payload (no bind_ssl for now).
2013-10-07 06:09:21 -05:00
47e7a2de83
Kill stray debugger statement.
2013-10-06 19:32:22 -05:00
c2a81907ba
Clean up the way Apple Safari UXSS aux module does data collection.
...
[FIXRM #7918 ]
2013-10-06 19:28:16 -05:00
5aa3709ca2
Land #2467 , @wchen-r7's code to allow dynamic size paylods on ropdb
2013-10-06 18:18:13 -05:00
991e82a78a
Land #2470 - Continue to run UAC level is 0
2013-10-05 23:20:55 -05:00
0799766faa
Fix UAC is not enabled, no reason to run module when UAC is enabled and vulnerable
...
The new changes when calling uac_level = open_key.query_value('ConsentPromptBehaviorAdmin') breaks UAC on Windows 7 and Windows 8 and shows that UAC is not enabled when it is:
Here is prior to the change on a fully patched Windows 8 machine:
msf exploit(bypassuac) > exploit
[*] Started reverse handler on 172.16.21.156:4444
[*] UAC is Enabled, checking level...
[-] UAC is not enabled, no reason to run module
[-] Run exploit/windows/local/ask to elevate
msf exploit(bypassuac) >
Here's the module when running with the most recent changes that are being proposed:
[*] Started reverse handler on 172.16.21.156:4444
[*] UAC is Enabled, checking level...
[!] Could not determine UAC level - attempting anyways...
[*] Checking admin status...
[+] Part of Administrators group! Continuing...
[*] Uploading the bypass UAC executable to the filesystem...
[*] Meterpreter stager executable 73802 bytes long being uploaded..
[*] Uploaded the agent to the filesystem....
[*] Sending stage (770048 bytes) to 172.16.21.128
[*] Meterpreter session 6 opened (172.16.21.156:4444 -> 172.16.21.128:49394) at 2013-10-05 15:49:23 -0400
meterpreter >
With the new changes and not having a return on when 0 (will not always return 0 - just in certain cases where you cannot query) - it works.
2013-10-05 15:56:55 -04:00
875e086d94
Land #2469 , @bcoles exploit for FlashChat
2013-10-05 14:51:49 -05:00
24efb55ba9
Clean flashchat_upload_exec
2013-10-05 14:50:51 -05:00
08243b277a
Add FlashChat Arbitrary File Upload exploit module
2013-10-05 22:30:38 +09:30
836ff24998
Clean and fix CmdStagerPrintf
...
Clean up of the CmdStagerPrintf as discussed in mwulftange#1
2013-10-05 10:39:55 +02:00
a8de9d5c8b
Land #2459 - Add HP LoadRunner magentproc.exe Overflow
2013-10-04 19:45:44 -05:00
f9eccae391
Land #2466 , don't try to lockout SMB
2013-10-04 16:47:26 -05:00
d6c74cd0ed
Land #2463 , fixes to gestoip
2013-10-04 16:43:37 -05:00
813013fef5
Make defaults sane for the lockoutable smb_login
...
See #2376
2013-10-04 15:53:16 -05:00
77cbb7cd19
Update function documentation
2013-10-04 15:18:27 -05:00
5f4e4de267
fix for bug 8456
...
On systems without bundled johntheripper (either by removing the bundled version or by no compatible version shipped) the system john is used. In this case, all of the checking for compatible bundled jtr makes no sense and as such we can shortcut out of this to not only reduce the size of msf (for embedded) but also to speed execution (saving multiple calls to some random bundled binary cpuinfo*.bin).
This patch makes it very easy to simply remove cpuinfo and msf will not try to run it when missing and default to running john from the path.
2013-10-04 15:58:47 -04:00
113f89e40f
First set of fixes for gestioip_exec
2013-10-04 13:29:27 -05:00
299dfe73f1
Land #2460 , @xistence's exploit for clipbucket
2013-10-04 12:26:30 -05:00
8e0a4e08a2
Fix author order
2013-10-04 12:25:38 -05:00
ff72f0af62
Land #2461 , GestioIP module
2013-10-04 11:07:08 -05:00
9b79bb99e0
Add references, correct disclosure date
2013-10-04 09:59:26 -05:00
ab786d1466
Imply authentication when a password is set
2013-10-04 09:54:04 -05:00
sinn3r
Tod Beardsley
David Maloney
jvazquez-r7
Markus Wulftange
joev
trustedsec
bcoles
James Lee
ZeroChaos