[Snyk] Fix for 6 vulnerabilities - #44

Open

busterb wants to merge 134 commits into

snyk-fix-4a16d2d61286845ebee4c5a223127399

Commits on Nov 27, 2024

lib post linux comments and specs
h00die
committed
b9c8c63
more specs for linux post libraries
h00die
committed
61705db

Commits on Dec 2, 2024

more specs for linux post libraries
h00die
committed
cde6600

Commits on Dec 5, 2024

lib spec progress
h00die
committed
9ccc0a3

Commits on Dec 11, 2024

more specs and progress
h00die
committed
80d15ae

Commits on Dec 17, 2024

Add initial NAA-cred-snarfing code.
smashery
committed
5dd55f0
Add crypto structures
smashery
committed
2d7985b
Working NAA retrieval on recent SCCM
smashery
committed
76c2983
Rubocop fixes
smashery
committed
03a4acf
Report multiple NAA creds, if present
smashery
committed
fd3f313
Get working without autodiscovery
smashery
committed
a8a782e
MsfTidy fixes
smashery
committed
6ec6909
Allow sessions to be not required. Added documentation.
smashery
committed
d52874a
Better error handling for NAA
smashery
committed
6054d7c
Properly support multiple NAA creds
smashery
committed
0a45480
Properly support there being no NAA creds
smashery
committed
c2495af
Search for all policies with secrets, rather than just NAAConfig
smashery
committed
335825a
Add missing option docs
smashery
committed
556e52d
Add support for older encryptions
smashery
committed
a11616d
Rubocop fixes
smashery
committed
ad44afe
Changes from code review
smashery
committed
4c7d1d8
Removed unused sccm file
smashery
committed
7badd24
Report creds to DB
smashery
committed
c6e3df8
Apply escaping args to other command shells
smashery
committed
25cb219

Commits on Dec 19, 2024

Change from code review

smashery
and
jvoisin
authored
851beb7

Commits on Dec 21, 2024

ignore sleeps
h00die
committed
262e4b8
rubocop specs
h00die
committed
2e3661a

Commits on Jan 10, 2025

Don't do any escaping on platforms with unknown escaping
smashery
committed
e024c11

Commits on Feb 12, 2025

post linux spec fixes
h00die
committed
66f49c2
post linux spec fixes
h00die
committed
4bb8c30

Commits on Feb 18, 2025

compile spec fixes
h00die
committed
1bb9fc9

Commits on Feb 19, 2025

better specs for packages lib
h00die
committed
b328d3f
additional specs for packages
h00die
committed
da06e5a
additional specs for packages
h00die
committed
e689d85

Commits on Feb 20, 2025

Remove comment
h00die
committed
df8ad37

Commits on Feb 23, 2025

Add D-Tale unauth RCE module (CVE-2025-0655)
Takahiro-Yoko
committed
4d4b88c

Commits on Feb 26, 2025

Commits on Feb 27, 2025

Update lib/msf/core/post/linux/packages.rb

h00die
and
jvoisin
authored
b8429cb
Switch to using Rex's Crypto module
zeroSteiner
committed
11818c2
Add some basic NIST SP 800 108 specs
zeroSteiner
committed
2fd0511

Commits on Feb 28, 2025

Land #19862, updating Linux post library - additional comments, specs and new package module
msutovsky-r7
authored
36b13f5
Moving HTTP Digest Authentication response counting moved into separate class, rubocop-ing
msutovsky-r7
committed
149c442
Vuln cert finder minor fix plus doc update
jheysel-r7
committed
62b8ded
Add docs for ESC4,13 and 15 vulnerable template configuration
jheysel-r7
committed
d2dd9a6
Adds scripts to find and replace dead module reference links
cgranleese-r7
committed
810e7c4
Adds two scripts to handle dead module reference links
cgranleese-r7
committed
acd692e
Updates more dead links
cgranleese-r7
committed
0017fbd
Fixes some invalid links
cgranleese-r7
committed
df8b0de
Merge pull request #19919 from jheysel-r7/fix/nil_check/esc_cert_finder
smcintyre-r7
authored
b3602b2
Merge pull request #19920 from jheysel-r7/docs/vuln_cert_finder_update
smcintyre-r7
authored
b4ca537
automatic module_metadata_base.json update
jenkins-metasploit
committed
8ac44d5
Fixes crash when searching modules by target
cgranleese-r7
committed
57e3045
Adds tests for nil scenarios
cgranleese-r7
committed
7a5ff2a

Commits on Mar 1, 2025

Commits on Mar 2, 2025

Update vulnerable version
Takahiro-Yoko
committed
65d2b63

Commits on Mar 3, 2025

Removing unnecessary function
msutovsky-r7
committed
94fcda9
Use FETCH_DELETE as default
Takahiro-Yoko
committed
47351e4
Land #19899, D-Tale remote code execution module
msutovsky-r7
authored
3c4d0aa
automatic module_metadata_base.json update
jenkins-metasploit
committed
c9421a6
Merge pull request #19922 from cgranleese-r7/fixes-crash-when-searching-modules-by-target
adfoster-r7
authored
b1b8ad3
Merge pull request #19926 from jheysel-r7/gem_bump_for_get_naa_module
adfoster-r7
authored
60e9cae
Merge pull request #19918 from msutovsky-r7/feat/separate_class_http_digest_auth
adfoster-r7
authored
eef2e4c
Enable LDAP sessions by default
zeroSteiner
committed
b94418a
Make timeout configurable and nil check content
jheysel-r7
committed
4d57710
Merge pull request #19933 from zeroSteiner/feat/enable-ldap-sessions
adfoster-r7
authored
b0fec4e
Merge pull request #19712 from smashery/naa_creds
jheysel-r7
authored
b1d0eed
automatic module_metadata_base.json update
jenkins-metasploit
committed
59b862c

Commits on Mar 4, 2025

Sonicwall module
msutovsky-r7
committed
8d7bbdd
include ERB::Util for html_escape
fabpiaf
authored
daf5e1c
Land #19917, Add NIST SP 800 Crypto Primitives
dledda-r7
authored
54465f3
Update ubuntu versions for github actions
adfoster-r7
committed
91f1db3
Merge pull request #19940 from adfoster-r7/update-ubuntu-versions-for-github-actions
smcintyre-r7
authored
d626886
Call #validate in run_simple like it is in call_simple
zeroSteiner
committed
8d3d8d8
Call #validate before walking the rhosts
zeroSteiner
committed
112b8f5
Remove dead code that shouldn't get hit anymore
zeroSteiner
committed
f2e29a3
Apply the same refactoring to posts
zeroSteiner
committed
f12ddc7
Apply the same refactoring to exploits
zeroSteiner
committed
f2bcf34
Add specs to test the #validate method
zeroSteiner
committed
2422f8b

Commits on Mar 5, 2025

Use dynamically generated session
Takahiro-Yoko
committed
bf5ae87
Add error handling on unknown shell type
smashery
committed
fa4dd1d
Land #19745, applying argument escaping to other shells
msutovsky-r7
authored
7a1892e
Update server.rb
fabpiaf
authored
58fbf9e
Addressing comments in PR
msutovsky-r7
committed
1bea1ba
Merge pull request #19896 from cgranleese-r7/adds-scripts-for-dead-module-references
adfoster-r7
authored
8102bed
Merge pull request #19895 from cgranleese-r7/update-dead-module-references
adfoster-r7
authored
8604c72
automatic module_metadata_base.json update
jenkins-metasploit
committed
c62f041
Land #19935, SonicWall NSv HTTP Login Module
dledda-r7
authored
c698979
automatic module_metadata_base.json update
jenkins-metasploit
committed
03277a4
Land #19927, get_sysinfo add support for several Linux distros
dledda-r7
authored
03b9070
Merge pull request #19925 from zeroSteiner/fix/auxiliary/validate
adfoster-r7
authored
95e8b31
Add a warning for MS08-068 when applicable
zeroSteiner
committed
dbce824
Use the existing #validate method for options
zeroSteiner
committed
7950d86
Add a new mixin for handling multiple targets
zeroSteiner
committed
5e3953e
Switch relay modules, add ESC8 check method
zeroSteiner
committed
b43dc8b
Actually count the hosts
zeroSteiner
committed
0116d0c
Add #signing_required to SMB::SimpleClient
zeroSteiner
committed
4004c1f
Update target_host information
zeroSteiner
committed
4422cb5
Add a check method to the smb_relay module
zeroSteiner
committed
04842ea
Finish up the ESC8 check after more research
zeroSteiner
committed
f6c8b98
Merge pull request #19639 from zeroSteiner/feat/mod/relay/checks
jheysel-r7
authored
37e92f7
automatic module_metadata_base.json update
jenkins-metasploit
committed
ef638ae
Merge pull request #19946 from zeroSteiner/feat/mod/relay/ms08-068-warning
jheysel-r7
authored
c3ffdb1

Commits on Mar 6, 2025

Bump version of framework to 6.4.53
msjenkins-r7
committed
787205e
Update modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb

Takahiro-Yoko
and
sjanusz-r7
authored
233c710
Update function name after applied suggestion
Takahiro-Yoko
committed
edb47d9

Commits on Mar 7, 2025

Land #19944, adding dynamic session for module CVE-2025-0655
msutovsky-r7
authored
196d95b
automatic module_metadata_base.json update
jenkins-metasploit
committed
da00168
Merge pull request #19937 from fabpiaf/patch-1
adfoster-r7
authored
992b01b
initial module and documentation
h00die-gr3y
committed
281b728

Commits on Mar 10, 2025

Commits on Mar 11, 2025

added base64 encoding in php payload execution
h00die-gr3y
committed
1ca57c8

Commits on Mar 12, 2025

Use real SiteReference instances
zeroSteiner
committed
f3d644c
Merge pull request #19955 from zeroSteiner/feat/lib/adcs-mm-updates/1
bwatters-r7
authored
661ac23
automatic module_metadata_base.json update
jenkins-metasploit
committed
7603b5d

Commits on Mar 13, 2025

automatic module_metadata_base.json update

jenkins-metasploit
authored and
adfoster-r7
committed
a5edf5b
Land #19956, Routine dependency updates
cgranleese-r7
authored
b228e3b
Enable longpaths on windows github actions runners
dwelch-r7
committed
557b2c7
Merge pull request #19959 from dwelch-r7/enable-longpaths
adfoster-r7
authored
a1093b0

Commits on Mar 14, 2025

update based on review comments
h00die-gr3y
committed
0ca2599
fixed invalid attackerkb reference
h00die-gr3y
committed
84012fd
Land #19950, module for InvoiceShelf unauthenticated PHP deserialization
msutovsky-r7
authored
9961bfb
automatic module_metadata_base.json update
jenkins-metasploit
committed
c382de8
Bump version of framework to 6.4.54
msjenkins-r7
committed
76289d9
Land #19961, fixing incorrect URL in the InvoiceNinja module
msutovsky-r7
authored
741a222
automatic module_metadata_base.json update
jenkins-metasploit
committed
ef79506

Commits on Jul 16, 2025

fix: Gemfile to reduce vulnerabilities
snyk-bot
committed
27d9ce3