Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
126 commits
Select commit Hold shift + click to select a range
3477ec7
feat: add support for short command execution in bind_netcat module
dledda-r7 Jan 20, 2026
9459571
Update modules/payloads/singles/cmd/unix/bind_netcat.rb
dledda-r7 Jan 29, 2026
5ae18d1
Allow toggling the SACL in queries
zeroSteiner Nov 26, 2025
c8c7705
Add notes about the new option
zeroSteiner Feb 3, 2026
9610cdb
add x64 rc4 packer, sleep evasion routine and rc4 decrypter
litemars Feb 12, 2026
bfbc408
updating x64 rc4 packer to use Metasm
litemars Feb 13, 2026
02d31df
changing jmp/call/pop instructions
litemars Feb 13, 2026
57b17a4
add comment on support of memfd_create Kernel>3.17
litemars Feb 18, 2026
b9b2537
Update modules/evasion/linux/x64_rc4_packer.rb
litemars Feb 20, 2026
cdd6679
updating the sleep evasion and the rc4_decrypter for x64
litemars Feb 20, 2026
ce2e23c
add OptTimedelta datastore option and remove Kerberos-specific clock …
Nayeraneru Feb 20, 2026
a8f66a2
Feat: Add SPIP Saisies plugin RCE module (CVE-2025-71243)
Chocapikk Feb 21, 2026
b904419
Fix: Update SPIP saisies doc with working lab setup
Chocapikk Feb 21, 2026
53652b3
Fix: Update SPIP saisies doc with working lab setup
Chocapikk Feb 21, 2026
692a79a
Feat: Add LeakIX search module
Chocapikk Feb 21, 2026
a4d38cd
Fix: Resolve rubocop offenses in leakix_search module
Chocapikk Feb 21, 2026
d8d8449
Fix: Remove non-existent LeakPy GitHub reference
Chocapikk Feb 21, 2026
20dd4af
Refactor: DRY print_table and empty_array helpers
Chocapikk Feb 21, 2026
d069cba
Update Wordpress Mixin to log services
Nayeraneru Feb 12, 2026
9aa58fc
Refactor WordPress service reporting
Nayeraneru Feb 16, 2026
b227635
Fix service name reporting for WordPress exploit
Nayeraneru Feb 16, 2026
8fb5e4f
Update spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
Nayeraneru Feb 24, 2026
e6452f5
hashing adjustment
Nayeraneru Feb 24, 2026
c905ec6
Update modules/exploits/multi/http/spip_saisies_rce.rb
Chocapikk Feb 24, 2026
ece296b
Fix: Address jvoisin's PR review feedback
Chocapikk Feb 24, 2026
3d17c86
feat: exposing more configuration as advanced options in bind_netcat …
dledda-r7 Feb 25, 2026
a0cf8b4
Fix: Resolve protocol-relative URLs instead of skipping them
Chocapikk Feb 25, 2026
73bc6ef
feat: add netcat flavor option to bind_netcat module for linux and bs…
dledda-r7 Feb 25, 2026
efe3ef8
Running-Private-Modules.md: Remove duplicate cmds
g0tmi1k Feb 26, 2026
5c4e5e4
Fix: Use validate method with OptionValidateError instead of validate…
Chocapikk Feb 26, 2026
2bc2a3e
Fix: Remove extra empty line in run method
Chocapikk Feb 26, 2026
2540a16
Fix msfrpcd JSON-RPC SSL check incorrectly requiring msfdb init #21022
Aaditya1273 Feb 27, 2026
a6eb33b
Fix httpcookie constructor to handle non string value
Hemang360 Feb 27, 2026
b250044
Fix cookie jar documentation examples and add test
Hemang360 Feb 27, 2026
22b63ae
Fix reload_all failing with unknown command reload
SilentSobs Feb 27, 2026
b6acc1f
moved rc4_packer to x64 sub-directory
litemars Feb 27, 2026
003ac7b
changed description
litemars Feb 27, 2026
c5c67fa
new line for linter
litemars Feb 27, 2026
bfbc425
Remove type check
Hemang360 Mar 1, 2026
4b36301
minor change for CI
Nayeraneru Mar 3, 2026
9c7264b
Updates description
msutovsky-r7 Mar 3, 2026
6a97083
Refactor: Use option conditions for action-specific validation
Chocapikk Mar 4, 2026
77df1f1
Fix: Revert action-specific options to non-required with manual valid…
Chocapikk Mar 4, 2026
2eb160a
dhcp_server: Add DHCPINTERFACE
g0tmi1k Feb 11, 2026
4534a8a
Fix: Address msutovsky-r7 PR review feedback
Chocapikk Mar 5, 2026
3d38e9b
Fix: Fallback check to Detected when plugin version unavailable
Chocapikk Mar 5, 2026
3de421f
Update metasploit data models
adfoster-r7 Mar 5, 2026
dfe73bb
Add exploit for AVideo Encoder getImage.php command injection (CVE-20…
Chocapikk Mar 6, 2026
d2812ae
add documentation for the pop3_login.md module
jeanmtr Mar 6, 2026
81431ea
Update pop3_login.md
jeanmtr Mar 6, 2026
e369660
Update pop3_login.md
jeanmtr Mar 6, 2026
f091439
Fix incompatible encoding error when command contains utf-8 characters
Hemang360 Mar 7, 2026
f9b47d4
Merge pull request #21070 from adfoster-r7/update-metasploit-data-models
adfoster-r7 Mar 7, 2026
ef79927
Bump version of framework to 6.4.121
Mar 7, 2026
628275e
Revert "This adjusts module options that need a routable address"
adfoster-r7 Mar 8, 2026
2d908fe
Merge pull request #21083 from rapid7/revert-20989-feat/lib/mod-addre…
adfoster-r7 Mar 8, 2026
20473f4
automatic module_metadata_base.json update
Mar 8, 2026
5482e51
Bump version of framework to 6.4.122
Mar 8, 2026
c6aabc1
Land #21001, adds module for SPIP Saisies plugin (CVE-2025-71243)
msutovsky-r7 Mar 9, 2026
4c87d1a
automatic module_metadata_base.json update
Mar 9, 2026
1af0a49
Merge pull request #21002 from Chocapikk/add-module-leakix-search
dledda-r7 Mar 9, 2026
9283a25
automatic module_metadata_base.json update
Mar 9, 2026
b18611c
Merge pull request #20966 from litemars/add_Linux_evasion_module-rc4_…
dledda-r7 Mar 9, 2026
fef03d3
automatic module_metadata_base.json update
Mar 9, 2026
e6ee6a7
Land #20961, adds service reporting to Wordpress mixin
msutovsky-r7 Mar 10, 2026
e341db5
fix: default option for base64 encoder
jbx81-1337 Mar 10, 2026
437f738
Land #21088, Fix base64 encoder
cdelafuente-r7 Mar 10, 2026
04ff6f8
automatic module_metadata_base.json update
Mar 10, 2026
5092b21
Merge pull request #20885 from dledda-r7/feat/unix_bind_netcat_update
bwatters-r7 Mar 10, 2026
7dcec2e
Switch to false by default
zeroSteiner Mar 10, 2026
4f9b9d5
Revert "Land #21088, Fix base64 encoder"
adfoster-r7 Mar 10, 2026
eba2c59
Revert "Land #20852, exposes encoder options for exploit and payloads"
adfoster-r7 Mar 10, 2026
50fe3a5
Merge pull request #21094 from adfoster-r7/revert-choose-encoder-updates
adfoster-r7 Mar 10, 2026
777ce59
automatic module_metadata_base.json update
Mar 10, 2026
8ab51cf
Bump version of framework to 6.4.123
Mar 10, 2026
31665e1
Land #20730, Allow toggling the SACL in LDAP queries
cdelafuente-r7 Mar 11, 2026
1ff23f1
automatic module_metadata_base.json update
Mar 11, 2026
c266e68
Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)
Chocapikk Nov 22, 2025
36b2948
Simplify version extraction: use match directly and remove redundant …
Chocapikk Nov 23, 2025
b039d8a
Update modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
Chocapikk Nov 23, 2025
63c5221
Update modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
Chocapikk Nov 23, 2025
c42e44e
Optimize FreePBX module: cache auth/version, reduce verbosity, inline…
Chocapikk Nov 23, 2025
67642dd
Refactor authenticate method to raise exceptions instead of returning…
Chocapikk Nov 27, 2025
d088ab6
Simplify execute_command to take cookie as direct parameter instead o…
Chocapikk Nov 27, 2025
f59024c
Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)
Chocapikk Nov 22, 2025
6467b72
Fix: Auto-provision admin user and fix filestore version downgrade in…
Chocapikk Mar 11, 2026
2b0f1c3
Fix: Omit default port from Referer header in FreePBX mixin
Chocapikk Mar 11, 2026
16b5584
Fix: Remove duplicate Content-Type header from FreePBX requests
Chocapikk Mar 11, 2026
38e7474
Fix: Use correct commit hash for vulnerable getImage.php in lab setup
Chocapikk Mar 11, 2026
5150a4b
Docs: Clarify that .compose/encoder is a clone of AVideo-Encoder repo
Chocapikk Mar 11, 2026
b2f1e46
OptString -> OptAddress
g0tmi1k Feb 15, 2026
3852276
OptString -> OptAddressLocal
g0tmi1k Feb 15, 2026
f7c4aac
OptAddress -> OptAddressLocal
g0tmi1k Feb 15, 2026
6a831a0
autoroute.rb: OptAddress NETMASK - Drop CIDR
g0tmi1k Mar 10, 2026
33eb773
dhcp_server: Check to validate for _determine_server_comm
g0tmi1k Mar 12, 2026
ccf5643
Merge pull request #20960 from g0tmi1k/dhcp_server
smcintyre-r7 Mar 12, 2026
019b857
automatic module_metadata_base.json update
Mar 12, 2026
7a7db96
Merge pull request #21020 from g0tmi1k/docs
smcintyre-r7 Mar 12, 2026
2bd9356
Merge pull request #21081 from Hemang360/fix-utf8-encoding
adfoster-r7 Mar 13, 2026
c882d91
Merge pull request #21025 from Hemang360/cookie-jar-doc-fix
adfoster-r7 Mar 13, 2026
efa1c8b
Merge pull request #21028 from SilentSobs/fix/reload-all-unknown-command
adfoster-r7 Mar 13, 2026
fa75987
Merge pull request #21024 from Aaditya1273/fix-msfrpcd-json-rpc-ssl-c…
adfoster-r7 Mar 13, 2026
510ec29
Merge pull request #21046 from msutovsky-r7/exploit/beyondtrust/updat…
adfoster-r7 Mar 13, 2026
ee3d2da
automatic module_metadata_base.json update
Mar 13, 2026
b3aa45f
Land #20719, adds module for authenticated command injection in FreeP…
msutovsky-r7 Mar 13, 2026
29d876e
automatic module_metadata_base.json update
Mar 13, 2026
fed897a
Merge pull request #21074 from jeanmtr/pop3_login-doc
adfoster-r7 Mar 13, 2026
8d44dcd
Fix: Lab setup documentation for first-time environments
Chocapikk Mar 13, 2026
8ad5924
Fix: Use parent of fix commit (78178d1~1) for vulnerable Encoder chec…
Chocapikk Mar 13, 2026
3768efb
Improve payload size generation script
adfoster-r7 Mar 13, 2026
789b29d
Merge pull request #21124 from adfoster-r7/improve-payload-size-gener…
adfoster-r7 Mar 17, 2026
bf13628
automatic module_metadata_base.json update
Mar 17, 2026
d47a41c
Fix version check in ldap_esc_vulnerable_cert_finder
jheysel-r7 Mar 17, 2026
01d8879
Removed unnecessary code and module
Nayeraneru Mar 17, 2026
8b26a28
Merge pull request #21139 from jheysel-r7/fix/ldap_esc_version_check
smcintyre-r7 Mar 17, 2026
09bb033
Merge pull request #20997 from Nayeraneru/OptTD
smcintyre-r7 Mar 17, 2026
a1fa54e
automatic module_metadata_base.json update
Mar 17, 2026
5b5d1db
Merge pull request #21076 from Chocapikk/avideo-encoder-getimage-cmd-…
bwatters-r7 Mar 18, 2026
b263ba7
automatic module_metadata_base.json update
Mar 18, 2026
e836223
Bump version of framework to 6.4.124
Mar 19, 2026
ac46d36
Add KerberosTicketTrace support for AS/TGS/AP exchanges
eve0805 Mar 7, 2026
52a37a4
Address review feedback for Kerberos ticket trace logging
eve0805 Mar 8, 2026
911b5a3
Revert "Address review feedback for Kerberos ticket trace logging"
eve0805 Mar 8, 2026
0c08640
Improve Kerberos trace output consistency and spec
eve0805 Mar 8, 2026
4a421a2
Improve Kerberos readable trace formatting and spec
eve0805 Mar 25, 2026
d4c6871
Improve Kerberos readable trace formatting and spec
eve0805 May 15, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
1 change: 0 additions & 1 deletion .rubocop.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ require:
- ./lib/rubocop/cop/lint/detect_invalid_pack_directives.rb
- ./lib/rubocop/cop/lint/detect_metadata_trailing_leading_whitespace.rb
- ./lib/rubocop/cop/lint/detect_outdated_cmd_exec_api.rb
- ./lib/rubocop/cop/lint/datastore_srvhost_usage.rb

Layout/SpaceBeforeBrackets:
Enabled: true
Expand Down
6 changes: 3 additions & 3 deletions Gemfile.lock
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
PATH
remote: .
specs:
metasploit-framework (6.4.120)
metasploit-framework (6.4.124)
aarch64
abbrev
actionpack (~> 7.2.0)
Expand Down Expand Up @@ -47,7 +47,7 @@ PATH
metasploit-credential
metasploit-model
metasploit-payloads (= 2.0.240)
metasploit_data_models (>= 6.0.7)
metasploit_data_models (>= 6.0.15)
metasploit_payloads-mettle (= 1.0.46)
mqtt
msgpack (~> 1.6.0)
Expand Down Expand Up @@ -353,7 +353,7 @@ GEM
mutex_m
railties (~> 7.0)
metasploit-payloads (2.0.240)
metasploit_data_models (6.0.12)
metasploit_data_models (6.0.15)
activerecord (~> 7.0)
activesupport (~> 7.0)
arel-helpers
Expand Down
4 changes: 2 additions & 2 deletions LICENSE_GEMS
Original file line number Diff line number Diff line change
Expand Up @@ -97,10 +97,10 @@ memory_profiler, 1.1.0, MIT
metasm, 1.0.5, LGPL-2.1
metasploit-concern, 5.0.5, "New BSD"
metasploit-credential, 6.0.20, "New BSD"
metasploit-framework, 6.4.120, "New BSD"
metasploit-framework, 6.4.124, "New BSD"
metasploit-model, 5.0.4, "New BSD"
metasploit-payloads, 2.0.240, "3-clause (or ""modified"") BSD"
metasploit_data_models, 6.0.12, "New BSD"
metasploit_data_models, 6.0.15, "New BSD"
metasploit_payloads-mettle, 1.0.46, "3-clause (or ""modified"") BSD"
method_source, 1.1.0, MIT
mime-types, 3.7.0, MIT
Expand Down
Loading
Loading