Vulnenv week10 - #11
Conversation
Nayeraneru
changed the title
|
relatively easy week :) |
yup, done most of it in the earlier weeks😃 |
|
Do you have instructions to test the new http modules? Just want this PR to be self contained (as opposed to looking back at previous weeks) |
| %w[SRVPORT FETCH_SRVPORT].each do |opt| | ||
| free_port = free_local_port | ||
| driver.run_single("set #{opt} #{free_port}") | ||
| if mod.type != 'auxiliary' |
There was a problem hiding this comment.
I'm curious about the guard here. FETCH_SRVPORT would, I'm pretty sure, always be a payload option that could be added to an exploit if the exploit is using a fetch payload. The FETCH_SRVPORT option should be independent of the target though since it's the port we're listening on. I guess in theory there could be an instance where we don't control the SRVPORT that the target sends credentials to or something that may not match a listening service.
There's a fair number of auxiliary modules that will need to listen on a particular port though to say collect credentials, e.g. modules/auxiliary/server/capture/*
There was a problem hiding this comment.
yeah, right.
I dropped the if mod.type != 'auxiliary' guard entirely. now it just checks mod.options.include?(opt) for both SRVPORT and FETCH_SRVPORT, so capture server aux modules get a fresh port too, and fetch-payload exploits still get FETCH_SRVPORT when they need it
3 participants
Refering to rapid7#20506
GSoC 2026 — Week 10 deliverables for the Automated Vulnerable Environment Provisioning project.
Summary
Adds
exploit/multi/misc/apache_activemq_rce_cve_2023_46604as a third reference module, provingactivemq.ymlworks as genuine shared config across independent modules/CVEs and new environment definitions & other reference modulesChanges
apache_activemq_rce_cve_2023_46604.rb(OpenWire deserialization RCE), patched withVulnerableEnvironmentmetadata.activemq.yml: added5.18.2as a second variant (this CVE only affects 5.18.0–5.18.2, patched in 5.18.3 — incompatible with Module 1's5.18.6). Image sourced fromdinifarb/activemqafter confirming the officialapache/activemq-classicorg doesn't publish that patch tag.activemq.yml: addedbroker-onlyas a second profile (type: tcphealth check against the broker port), replacing what was initially a module-leveloverrides.health_check. Represents a real deployment state — web console firewalled off, broker still reachable — matching the schema's own Decision Matrix guidance ("different health check type → new profile") rather than treating it as one module's quirk.overridesnow contains only what's genuinely module-specific:TARGET => 1, since this module'sDefaultTargetis Windows (index 0), unlike every other reference module.Duplication eliminated
Between the two ActiveMQ modules, only
port_mapping,default_variant,profile, and oneTARGEToverride differ. Image family, credentials,ci.exploit's payload recommendation, and both health-check definitions are written once and shared.New environment definitions
data/vuln_envs/httpd.ymldata/vuln_envs/openssh.ymlNew reference modules (patched with
VulnerableEnvironment)auxiliary/scanner/http/http_version→httpddefinitionauxiliary/scanner/http/http_header→httpddefinitionauxiliary/scanner/http/robots_txt→httpddefinitionauxiliary/scanner/ssh/ssh_version→opensshdefinitionTesting Results: