Quick and dirty poc - #6

Open

dwelch-r7 wants to merge 521 commits into

refactor-payload-recalculationfrom

lazy-payload-gen-bootup

This pull request is big! We're only showing the most recent 250 commits

Commits on May 30, 2023

okay linter
catatonicprime
committed
b376dac
Fixing ZDI ID
catatonicprime
committed
530ed91
Drop size requirement and fix descriptions
zeroSteiner
committed
8a0dfa5
Add MIPS64 fetch adapters
zeroSteiner
committed
d7098aa
Touch up typos in documentation
gwillcox-r7
committed
c0671c3
Updated unit tests to use registry
smashery
committed
778a2c4
Fix more typos
gwillcox-r7
committed
cf9f990

Commits on May 31, 2023

Use existing shell registry logic
smashery
committed
4b1158d
add support to masm formatting
shellchocolat
authored
1fbba70
Fix typos and add dig for safe navigation
gwillcox-r7
committed
1fd2d41
Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb

catatonicprime
and
cdelafuente-r7
authored
6ad9ebb
Update modules/exploits/multi/http/papercut_ng_auth_bypass.rb

catatonicprime
and
cdelafuente-r7
authored
6351c66
Update documentation
gwillcox-r7
committed
ccbdd78
Land #18028, Add Apache NiFi login scanner module
gwillcox-r7
committed
6756047
Made cachesize dynamic

rad10
and
cdelafuente-r7
authored
2fab56f
Used unixcrypt to create encrypted password

rad10
and
cdelafuente-r7
authored
0e477bd
automatic module_metadata_base.json update
msjenkins-r7
committed
d60f21d
Removing unnecessary assignment
catatonicprime
committed
3875947
Fix single quote issue
gwillcox-r7
committed
ab12bee
move gitlab_subgroup to gitlab_authenticated_subgroup
h00die
committed
1267d06
Land #18026, Fix non-deterministic test module load failures
gwillcox-r7
committed
2a410e1
Add a proper definition for NtdsCaSecurityExt
zeroSteiner
committed
9349dd2

Commits on Jun 1, 2023

Support retrieving Service Pack version on older OSes
smashery
committed
7f4bda1
Add module for running all post test modules
adfoster-r7
committed
46f7f8e
Fix broken binary file upload test on windows sessions
adfoster-r7
committed
4340245
Fixed double checking of sudoers

rad10
and
cdelafuente-r7
authored
d868d0e
Gave rootmethod option better description

rad10
and
cdelafuente-r7
authored
c336f17
Land #17430, Add AWS SSM Sessions
smcintyre-r7
committed
8378435
Land #18003, Archer c7 traversal
cdelafuente-r7
committed
8ed981e
automatic module_metadata_base.json update
msjenkins-r7
committed
2c987da
Land #18052, Fix broken file upload test on Windows sessions
gwillcox-r7
committed
068e0f5
Added unixcrypt to payload
rad10
committed
4183cd4
modify command stagers to not go over 100%
zgoldman-r7
committed
96f2c96
Bump version of framework to 6.3.20
msjenkins-r7
committed
25e8cf8
Fix up logic to handle check_host return codes

Ryuuuuu
authored and
gwillcox-r7
committed
d535bb8
Update post agther aws keys to run against linux
adfoster-r7
committed
c6816fc
Fix up messages to more closely match check code messages and fix typos
gwillcox-r7
committed
f6dc2c0
Land #17868, Improve check_host return code handling
gwillcox-r7
committed
7f7c5ea
automatic module_metadata_base.json update
msjenkins-r7
committed
9b929da
Land #18056, Modify command stagers to not go over 100%
gwillcox-r7
authored
0f71613
add delta electronics infrasuite deserialization
space-r7
committed
a66641d

Commits on Jun 2, 2023

review adjustments
h00die
committed
da2e339
PR Review changes for removing platform specific code
manishkumar102317
committed
f8460dc
Land #18002, Added cmd useradd payload
cdelafuente-r7
committed
4661e97
automatic module_metadata_base.json update
msjenkins-r7
committed
48b86c2
Add new payloads to payloads_spec.rb
zeroSteiner
committed
a6f1be8
Land #18055, Update aws_keys to run against linux
smcintyre-r7
committed
8b641c4
automatic module_metadata_base.json update
msjenkins-r7
committed
9361451
Update metasploit-payloads gem to 2.0.135
zeroSteiner
committed
372f9cd
Add in initial copy of exploit
gwillcox-r7
committed
6d066dc
Remove dropper target and try expand potential BadChars and limit payload size???
gwillcox-r7
committed
c78a9ba
Update again
gwillcox-r7
committed
05bb3cd
Add in documentation and updated code
gwillcox-r7
committed
8577f21
Fix up base64 encoder to properly quote strings - credit to @smcintyre-r7 for the fix
gwillcox-r7
committed
3ab4173
Address review comments
gwillcox-r7
committed
6e89f9b
Fix documentation and fix bug in creating PARMS value
gwillcox-r7
committed
965311d
Add in ability to restore settings n documentation changes.
gwillcox-r7
committed
f7d2cda
Fix up supported payloads and remove nonused parameter
gwillcox-r7
committed
617aff5
Add in new library function for escaping PowerShell literals
gwillcox-r7
committed
7728e1e
Land #18044, Add MIPS64 Linux Fetch Payloads
bwatters-r7
committed
1e9d286
automatic module_metadata_base.json update
msjenkins-r7
committed
7a2505e
Land #18018, Add in CVE-2023-29084
smcintyre-r7
committed
734e0b0
automatic module_metadata_base.json update
msjenkins-r7
committed
c9627a7
Land #18057, Update metasploit-payloads gem to 2.0.135
gwillcox-r7
authored
1a36b81
move gitlab_auth_subgroups to gahter instead of scanner
h00die
committed
8f3325b
add check method and new options
space-r7
committed
1c5f8e0

Commits on Jun 5, 2023

Created mixin to retrieve the architecture of the current shell.
smashery
committed
7959802
init commit module
h00die-gr3y
committed
07def1c
grafana_plugin_traversal bugfix
ErikWynter
committed
c5ff96f
print the full version to the console
ErikWynter
committed
12f59d5
fix typo in print statement from original module
ErikWynter
committed
ba3d6dc
refactor archer_c7_traversal as `gather` module
jmartin-tech
committed
4e91a4e
updated CMD stager order
h00die-gr3y
committed
00e39eb
Land #18066, refactor archer_c7_traversal as `gather` module
gwillcox-r7
authored
6f2f51b
automatic module_metadata_base.json update
msjenkins-r7
committed
70d0b5e
Remove extra code
gwillcox-r7
committed
9574c79
Add in YARD documentation
gwillcox-r7
committed
94ef437
Added documentation
h00die-gr3y
committed
52745a9
Land #18062, Created mixin to retrieve the architecture of the current shell.
gwillcox-r7
authored
d029b26
Land #17917, shell_to_meterpreter: Support using bind payloads with PAYLOAD_OVERRIDE
gwillcox-r7
authored
0d094f8
automatic module_metadata_base.json update
msjenkins-r7
committed
80e1484
Fix VBS stager in shell_to_meterpreter.
smashery
committed
61539ac
add cmdstager usage, description, and metadata
space-r7
committed
a12b58d
add documentation
space-r7
committed
5f7ae88

Commits on Jun 6, 2023

Remote::JndiInjection: handle LDAP UnbindRequest
RageLtMan
committed
e6b1ae2
init commit module
h00die-gr3y
committed
3e6ae74
linted - all offenses addressed
attl4s
committed
a34c3cf
add documentation
attl4s
committed
ec948b5
Added documentation
h00die-gr3y
committed
2e34d69
Documentation linting.
catatonicprime
committed
a03603d
Fix exception handler & add doc
cdelafuente-r7
committed
451735a
add installation steps
space-r7
committed
3b53966
add SCREEN_EFFECTS and akb assessment
space-r7
committed
102a32c
close socket
space-r7
committed
2fcd97f
review adjustments
h00die
committed
4950cb3

Commits on Jun 7, 2023

Updates based on jvoisin comments
h00die-gr3y
committed
46fcdb7
Land #18039, gitlab file read CVE-2023-2825
cdelafuente-r7
committed
f88cb3b
automatic module_metadata_base.json update
msjenkins-r7
committed
aa1a014
Add options to the documentation
cdelafuente-r7
committed
991b960
Land #17936, PaperCutNG Authentication Bypass with RCE
cdelafuente-r7
committed
82c8b54
automatic module_metadata_base.json update
msjenkins-r7
committed
d3c662b
add non-capture group
space-r7
committed
8f6b421
Add in ability to support detecting preview versions
gwillcox-r7
committed
ffbd690
Add in a typo fix
gwillcox-r7
committed
b923b0c
Land #18064, Add support for beta and prerelease versions to grafana_plugin_traversal
gwillcox-r7
authored
2345126
automatic module_metadata_base.json update
msjenkins-r7
committed
dbc7a8c
Land #18074, Fix exception handling in gitlab_github_import_rce_cve_2022_2992 module
gwillcox-r7
authored
5b39eaa
automatic module_metadata_base.json update
msjenkins-r7
committed
72102de
rocketmq version scanner
h00die
committed
e3bcc9a
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md

space-r7
and
gwillcox-r7
authored
60c642b
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md

space-r7
and
gwillcox-r7
authored
4377ff0
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md

space-r7
and
gwillcox-r7
authored
54649fb
Update documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md

space-r7
and
gwillcox-r7
authored
2738906
Update modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb

space-r7
and
gwillcox-r7
authored
3bc145c
Add in link to archived version of the installer
gwillcox-r7
committed
4465582
add options in scenarios output
space-r7
committed
74dd134

Commits on Jun 8, 2023

decoding bytes from all python payloads
manishkumar102317
committed
d454e23
fixing indentation for shell reverse tcp payload
manishkumar102317
committed
6030f75
Don't use length for freeing.
smashery
committed
717ceae
Updates based on space-r7 comments
h00die-gr3y
committed
b3b0cb4
Updated NAS model and version check
h00die-gr3y
committed
0bcd930
Land #18072, Add CVE-2023-1133 - .NET Deserialization exploit for Delta Electronics InfraSuite Device Master
gwillcox-r7
authored
a1e9303
automatic module_metadata_base.json update
msjenkins-r7
committed
601306b
Land #18040, Fix Python's payload issue with Windows
cdelafuente-r7
committed
c08f197
Added symmetricom_syncserver_rce.rb
sdcampbell
authored
229fc0c
automatic module_metadata_base.json update
msjenkins-r7
committed
55e67ac
Bump version of framework to 6.3.21
msjenkins-r7
committed
92cf562
Address msftidy_docs complaints
smcintyre-r7
committed
d8870d7
Land #18022, Add post/windows/manage/make_token
smcintyre-r7
committed
5b5c298
Add the ALT_SID datastore option
zeroSteiner
committed
47835b5
Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT
zeroSteiner
committed
2acc014
Update module docs to discuss KB5014754 changes
zeroSteiner
committed
238118e
automatic module_metadata_base.json update
msjenkins-r7
committed
4b082b9
Bump up dependency versions
gwillcox-r7
committed
dce2965
review comments
h00die
committed
3e538a3
Latest updates based on reviewers comments
h00die-gr3y
committed
dfc366e

Commits on Jun 9, 2023

Land #18068, Fix VBS stager in shell_to_meterpreter
bwatters-r7
committed
039f238
automatic module_metadata_base.json update
msjenkins-r7
committed
31c65c8
Merge branch 'rapid7:master' into CVE-2023-28771
sfewer-r7
authored
a152855
rework the exploit to use the new MIPS64 fetch payload adapters. Removed the seperate command and dropper targets in favor of a single default target which can do both thanks to fetch payloads. Rem…
sfewer-r7
committed
27f5a78
Land #18016, CVE-2023-28771 - Zyxel Cmd Injection
smcintyre-r7
committed
1284cb3
automatic module_metadata_base.json update
msjenkins-r7
committed
caba471
Add some tests for NtdsCaSecurityExt
zeroSteiner
committed
66d2477
Land #18076, Don't use length for freeing.
smcintyre-r7
committed
296a7af
Update Navigating-And-Undstanding-Metasploits-Codebase to add new code navigation tools and debugging tools
gwillcox-r7
committed
ae4e616
Land #18058, Improve code navigation docs and add debugging page
adfoster-r7
authored
7ab610c
Update metasploit-payloads gem to 2.0.136
zeroSteiner
committed
eab3247
Add more IPv6 support in to the module
gwillcox-r7
committed
694c100
Land #18070, add TerraMaster chained exp module
space-r7
committed
c8609d7
automatic module_metadata_base.json update
msjenkins-r7
committed
5dba72c
Land #18083, Update metasploit-payloads gem to 2.0.136
gwillcox-r7
authored
50dfde1
Land #17946, CVE-2023-21839 - Oracle Weblogic RCE
smcintyre-r7
committed
4c817ce
automatic module_metadata_base.json update
msjenkins-r7
committed
fce6450
Add the x86 fetch payloads
zeroSteiner
committed
0ba65b7
Update payloads_spec.rb for x86 fetch
zeroSteiner
committed
c579c43
Land #18063, add TerraMaster webshell upload
space-r7
committed
c9af514
automatic module_metadata_base.json update
msjenkins-r7
committed
43003ee

Commits on Jun 10, 2023

init commit module and documentation
h00die-gr3y
committed
417c9fa
Updated documentation
h00die-gr3y
committed
db8a49c
Rex::Proto::LDAP::Server handle LDAP UnbindRequest
RageLtMan
committed
668b72a

Commits on Jun 12, 2023

Land #18069, Handle LDAP UnbindRequest
smcintyre-r7
committed
834ad18
Removed Webshell upload and updated documentation
h00die-gr3y
committed
7cd3854
Land #17955, Golf a bit the php payload
adfoster-r7
authored
c8f942c
Updates based on review comments from space-r7 and jvoisin
h00die-gr3y
committed
4479d94
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb

sdcampbell
and
space-r7
authored
bc2fb0c
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb

sdcampbell
and
space-r7
authored
4e4d098
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb

sdcampbell
and
space-r7
authored
5b73c8f
Update modules/exploits/linux/http/symmetricom_syncserver_rce.rb

sdcampbell
and
space-r7
authored
ed516fa
Bump rex-powershell to 0.1.98
jheysel-r7
committed
14dc102
Land #17942, Improve AMSI bypass on new Windows
jheysel-r7
committed
f97ab80
automatic module_metadata_base.json update
msjenkins-r7
committed
96ba121

Commits on Jun 13, 2023

[+] add masm output support
shellchocolat
committed
0761f8f
Rubocop and code review suggestions
smashery
committed
8d1e7a3
Update the exported keytab table entries to sort by db insert id
adfoster-r7
committed
7fe6b8f
Update lib/metasploit/framework/compiler/mingw.rb

araout42
and
adfoster-r7
authored
cb105d8
Update lib/metasploit/framework/compiler/mingw.rb

araout42
and
adfoster-r7
authored
9d315af
Update lib/metasploit/framework/compiler/mingw.rb

araout42
and
adfoster-r7
authored
0b320f6
Update lib/metasploit/framework/compiler/mingw.rb

araout42
and
adfoster-r7
authored
1fbfc8e
Land #18090, Update the exported keytab table entries to sort by db insert id
jmartin-tech
committed
fa33052
automatic module_metadata_base.json update
msjenkins-r7
committed
09ae382
Fix issue with info command and IP address check
bwatters-r7
committed
9e773b3
Add routable address type
bwatters-r7
committed
1af9660
Fix an edge case in .to_win32pe
zeroSteiner
committed
c414832
add module documentation
space-r7
committed
0d85c9e
add rubocop fixes and some metadata
space-r7
committed
cbf7109
Land #18086, add TerraMaster cmd injection
space-r7
committed
091ee36
automatic module_metadata_base.json update
msjenkins-r7
committed
401820d
Update symmetricom_syncserver_rce.rb
sdcampbell
authored
37bc9cd
Land #17336, A more robust implementation for Windows version comparisons
bwatters-r7
committed
38f5421
automatic module_metadata_base.json update
msjenkins-r7
committed
9f276bd
Fix accidental diff
bwatters-r7
committed
548d7e7
Remove superfluous setup_handler
bwatters-r7
committed
cabae17
add exploit rank
space-r7
committed
5535401
Land #18077, add Symmetricom unauth cmd injection
space-r7
committed
7af22bf
update migration calls in spec
jmartin-tech
committed
efd49f0
Land #18075, RocketMQ version scanner
jheysel-r7
committed
c98cc00
automatic module_metadata_base.json update
msjenkins-r7
committed
968a151

Commits on Jun 14, 2023

Land #18050, Add module for running all post test modules
dwelch-r7
authored
68c48ef
Fix python meterpreter crashing when extracting osx network configuration
adfoster-r7
committed
21b2e3a
Add appropriate skips to post test modules
adfoster-r7
committed
d414eea
Land #18097, Fix python meterpreter crashing when extracting osx network configuration
cgranleese-r7
authored
fe737b5
Fix rex-text crashes when running ruby 3.3
adfoster-r7
committed
f30bc86
Land #18051, Add appropriate skips to post test modules
dwelch-r7
authored
1b35a9f
Fix python meterpreter subprocess deadlock and file descriptor leak
adfoster-r7
committed
d6a50ac
Land #18080, Weekly dependency updates for Gemfile.lock
jmartin-tech
committed
41429ae
Land #18098, Fix rex-text crashes when running ruby 3.3
dwelch-r7
authored
de07c2e
Land #18089, Add Masm support
adfoster-r7
authored
b9f260d
Land #18099, Fix python meterpreter subprocess deadlock and file descriptor leak
cgranleese-r7
authored
9187b96
Fix osx route command when mac addresses are split by dots
adfoster-r7
committed
793e088
Land #18101, Fix macOS route command when mac addresses are split by dots
cgranleese-r7
authored
966dec5
Fix false negatives on files not existing on windows python meterpreter
adfoster-r7
committed
00d1f03
lock nokogiri due to compile issue
jmartin-tech
committed
b2d0cda
update to latest nokogiri 1.14.x
jmartin-tech
committed
ceb85e0
Land #18103, lock nokogiri due to compile issue
jmartin-tech
committed
d3fa760
Fix time command bug when running complex commands
adfoster-r7
committed
2d87447
Update SessionTLVLogging to no longer truncate useful values
adfoster-r7
committed
69b7635
Land #18102, bump metasploit-payloads 2.0.140
jheysel-r7
committed
6f297a8
Fix flakey post test services module
adfoster-r7
committed
95f30d1
Extract rspec wait for expect helper
adfoster-r7
committed
5b18475
Update test post modules to always have a clean file system directory
adfoster-r7
committed
dc5a42b
Add namespaced test module logging
adfoster-r7
committed
75d74d2
Fix unitialized constant error when meterpreter registry key reads timeout
adfoster-r7
committed
bec47e8
Fix symlink test bug when running python meterpreter on windows
adfoster-r7
committed
2a66987
Add the ALT_SID datastore option
zeroSteiner
committed
3ee02a0
Fix AS-REQ with PKINIT and NTDS_CA_SECURITY_EXT
zeroSteiner
committed
6988227
Update module docs to discuss KB5014754 changes
zeroSteiner
committed
ae4faca
Add some tests for NtdsCaSecurityExt
zeroSteiner
committed
1823801
Land #18112, fix symlink test bug
jheysel-r7
committed
2632d33
Land #17781, adds support for module writers to supply include_dir iquote options when compiling mingw
adfoster-r7
authored
c93adfb
Land #17670, add module to exploit CVE-2019-16328
adfoster-r7
authored
51dc309
automatic module_metadata_base.json update
msjenkins-r7
committed
e7bbd34

Commits on Jun 15, 2023

Commits on Jun 16, 2023

Add lazy loading for payloads
dwelch-r7
committed
8527eea