Skip to content

Commit 2b99967

Browse files
jheysel-r7jheysel-r7
authored
Merge branch 'master' into fix/duplicate-netntlm
2 parents 1466506 + 5880a0d commit 2b99967

39 files changed

+2232
-213
lines changed

‎Gemfile.lock‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (6.2.1)
4+
metasploit-framework (6.2.2)
55
actionpack (~> 6.0)
66
activerecord (~> 6.0)
77
activesupport (~> 6.0)
@@ -29,7 +29,7 @@ PATH
2929
metasploit-concern
3030
metasploit-credential
3131
metasploit-model
32-
metasploit-payloads (= 2.0.87)
32+
metasploit-payloads (= 2.0.93)
3333
metasploit_data_models
3434
metasploit_payloads-mettle (= 1.0.18)
3535
mqtt
@@ -128,12 +128,12 @@ GEM
128128
activerecord (>= 3.1.0, < 8)
129129
ast (2.4.2)
130130
aws-eventstream (1.2.0)
131-
aws-partitions (1.588.0)
132-
aws-sdk-core (3.131.0)
131+
aws-partitions (1.590.0)
132+
aws-sdk-core (3.131.1)
133133
aws-eventstream (~> 1, >= 1.0.2)
134134
aws-partitions (~> 1, >= 1.525.0)
135135
aws-sigv4 (~> 1.1)
136-
jmespath (~> 1.0)
136+
jmespath (~> 1, >= 1.6.1)
137137
aws-sdk-ec2 (1.315.0)
138138
aws-sdk-core (~> 3, >= 3.127.0)
139139
aws-sigv4 (~> 1.1)
@@ -264,7 +264,7 @@ GEM
264264
activemodel (~> 6.0)
265265
activesupport (~> 6.0)
266266
railties (~> 6.0)
267-
metasploit-payloads (2.0.87)
267+
metasploit-payloads (2.0.93)
268268
metasploit_data_models (5.0.5)
269269
activerecord (~> 6.0)
270270
activesupport (~> 6.0)

‎LICENSE_GEMS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ memory_profiler, 1.0.0, MIT
7878
metasm, 1.0.5, LGPL-2.1
7979
metasploit-concern, 4.0.4, "New BSD"
8080
metasploit-credential, 5.0.7, "New BSD"
81-
metasploit-framework, 6.2.1, "New BSD"
81+
metasploit-framework, 6.2.2, "New BSD"
8282
metasploit-model, 4.0.4, "New BSD"
8383
metasploit-payloads, 2.0.87, "3-clause (or ""modified"") BSD"
8484
metasploit_data_models, 5.0.5, "New BSD"

‎data/exploits/word_msdtjs.docx‎

11.2 KB
Binary file not shown.

‎db/modules_metadata_base.json‎

Lines changed: 206 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16681,7 +16681,7 @@
1668116681
"https"
1668216682
],
1668316683
"targets": null,
16684-
"mod_time": "2021-11-11 11:37:55 +0000",
16684+
"mod_time": "2022-05-06 00:22:52 +0000",
1668516685
"path": "/modules/auxiliary/gather/billquick_txtid_sqli.rb",
1668616686
"is_install_path": true,
1668716687
"ref_name": "gather/billquick_txtid_sqli",
@@ -39835,7 +39835,7 @@
3983539835

3983639836
],
3983739837
"targets": null,
39838-
"mod_time": "2022-01-23 15:28:32 +0000",
39838+
"mod_time": "2022-05-30 13:03:03 +0000",
3983939839
"path": "/modules/auxiliary/scanner/nfs/nfsmount.rb",
3984039840
"is_install_path": true,
3984139841
"ref_name": "scanner/nfs/nfsmount",
@@ -81913,6 +81913,69 @@
8191381913
"session_types": false,
8191481914
"needs_cleanup": null
8191581915
},
81916+
"exploit_multi/http/dotcms_file_upload_rce": {
81917+
"name": "DotCMS RCE via Arbitrary File Upload.",
81918+
"fullname": "exploit/multi/http/dotcms_file_upload_rce",
81919+
"aliases": [
81920+
81921+
],
81922+
"rank": 600,
81923+
"disclosure_date": "2022-05-03",
81924+
"type": "exploit",
81925+
"author": [
81926+
"Shubham Shah",
81927+
"Hussein Daher",
81928+
"jheysel-r7"
81929+
],
81930+
"description": "When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the\n file down in a temp directory. In the case of this vulnerability, dotCMS does not sanitize the filename\n passed in via the multipart request header and thus does not sanitize the temp file's name. This allows a\n specially crafted request to POST files to dotCMS via the ContentResource (POST /api/content) that get\n written outside of the dotCMS temp directory. In the case of this exploit, an attacker can upload a special\n .jsp file to the webapp/ROOT directory of dotCMS which can allow for remote code execution.",
81931+
"references": [
81932+
"CVE-2022-26352",
81933+
"URL-https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/"
81934+
],
81935+
"platform": "Linux,Windows",
81936+
"arch": "",
81937+
"rport": 8443,
81938+
"autofilter_ports": [
81939+
80,
81940+
8080,
81941+
443,
81942+
8000,
81943+
8888,
81944+
8880,
81945+
8008,
81946+
3000,
81947+
8443
81948+
],
81949+
"autofilter_services": [
81950+
"http",
81951+
"https"
81952+
],
81953+
"targets": [
81954+
"Java Linux",
81955+
"Java Windows"
81956+
],
81957+
"mod_time": "2022-06-01 10:54:02 +0000",
81958+
"path": "/modules/exploits/multi/http/dotcms_file_upload_rce.rb",
81959+
"is_install_path": true,
81960+
"ref_name": "multi/http/dotcms_file_upload_rce",
81961+
"check": true,
81962+
"post_auth": false,
81963+
"default_credential": false,
81964+
"notes": {
81965+
"Stability": [
81966+
"crash-safe"
81967+
],
81968+
"Reliability": [
81969+
"repeatable-session"
81970+
],
81971+
"SideEffects": [
81972+
"artifacts-on-disk",
81973+
"ioc-in-logs"
81974+
]
81975+
},
81976+
"session_types": false,
81977+
"needs_cleanup": true
81978+
},
8191681979
"exploit_multi/http/drupal_drupageddon": {
8191781980
"name": "Drupal HTTP Parameter Key/Value SQL Injection",
8191881981
"fullname": "exploit/multi/http/drupal_drupageddon",
@@ -85958,6 +86021,74 @@
8595886021
"session_types": false,
8595986022
"needs_cleanup": true
8596086023
},
86024+
"exploit_multi/http/mybb_rce_cve_2022_24734": {
86025+
"name": "MyBB Admin Control Code Injection RCE",
86026+
"fullname": "exploit/multi/http/mybb_rce_cve_2022_24734",
86027+
"aliases": [
86028+
86029+
],
86030+
"rank": 600,
86031+
"disclosure_date": "2022-03-09",
86032+
"type": "exploit",
86033+
"author": [
86034+
"Cillian Collins",
86035+
"Altelus",
86036+
"Christophe De La Fuente"
86037+
],
86038+
"description": "This exploit module leverages an improper input validation\n vulnerability in MyBB prior to `1.8.30` to execute arbitrary code in\n the context of the user running the application.\n\n MyBB Admin Control setting page calls PHP `eval` function with an\n unsanitized user input. The exploit adds a new setting, injecting the\n payload in the vulnerable field, and triggers its execution with a\n second request. Finally, it takes care of cleaning up and removes the\n setting.\n\n Note that authentication is required for this exploit to work and the\n account must have rights to add or update settings (typically, myBB\n administrator role).",
86039+
"references": [
86040+
"URL-https://github.com/mybb/mybb/security/advisories/GHSA-876v-gwgh-w57f",
86041+
"URL-https://www.zerodayinitiative.com/advisories/ZDI-22-503/",
86042+
"URL-https://github.com/Altelus1/CVE-2022-24734",
86043+
"CVE-2022-24734"
86044+
],
86045+
"platform": "Linux,PHP,Unix,Windows",
86046+
"arch": "php, cmd, x86, x64",
86047+
"rport": 80,
86048+
"autofilter_ports": [
86049+
80,
86050+
8080,
86051+
443,
86052+
8000,
86053+
8888,
86054+
8880,
86055+
8008,
86056+
3000,
86057+
8443
86058+
],
86059+
"autofilter_services": [
86060+
"http",
86061+
"https"
86062+
],
86063+
"targets": [
86064+
"PHP",
86065+
"Unix (In-Memory)",
86066+
"Linux (Dropper)",
86067+
"Windows (In-Memory)",
86068+
"Windows (Dropper)"
86069+
],
86070+
"mod_time": "2022-05-30 16:24:18 +0000",
86071+
"path": "/modules/exploits/multi/http/mybb_rce_cve_2022_24734.rb",
86072+
"is_install_path": true,
86073+
"ref_name": "multi/http/mybb_rce_cve_2022_24734",
86074+
"check": true,
86075+
"post_auth": true,
86076+
"default_credential": false,
86077+
"notes": {
86078+
"Stability": [
86079+
"crash-safe"
86080+
],
86081+
"Reliability": [
86082+
"repeatable-session"
86083+
],
86084+
"SideEffects": [
86085+
"config-changes",
86086+
"artifacts-on-disk"
86087+
]
86088+
},
86089+
"session_types": false,
86090+
"needs_cleanup": null
86091+
},
8596186092
"exploit_multi/http/nas4free_php_exec": {
8596286093
"name": "NAS4Free Arbitrary Remote Code Execution",
8596386094
"fullname": "exploit/multi/http/nas4free_php_exec",
@@ -87306,7 +87437,7 @@
8730687437
"PHP",
8730787438
"Shell Command"
8730887439
],
87309-
"mod_time": "2021-11-23 07:58:07 +0000",
87440+
"mod_time": "2022-06-03 11:23:53 +0000",
8731087441
"path": "/modules/exploits/multi/http/php_fpm_rce.rb",
8731187442
"is_install_path": true,
8731287443
"ref_name": "multi/http/php_fpm_rce",
@@ -132278,6 +132409,66 @@
132278132409
"session_types": false,
132279132410
"needs_cleanup": null
132280132411
},
132412+
"exploit_windows/fileformat/word_msdtjs_rce": {
132413+
"name": "Microsoft Office Word MSDTJS",
132414+
"fullname": "exploit/windows/fileformat/word_msdtjs_rce",
132415+
"aliases": [
132416+
132417+
],
132418+
"rank": 600,
132419+
"disclosure_date": "2022-05-29",
132420+
"type": "exploit",
132421+
"author": [
132422+
"nao sec",
132423+
"mekhalleh (RAMELLA Sébastien)"
132424+
],
132425+
"description": "This module generates a malicious Microsoft Word document that when loaded, will leverage the remote template\n feature to fetch an `HTML` document and then use the `ms-msdt` scheme to execute `PowerShell` code.",
132426+
"references": [
132427+
"CVE-2022-30190",
132428+
"URL-https://www.reddit.com/r/blueteamsec/comments/v06w2o/suspected_microsoft_word_zero_day_in_the_wild/",
132429+
"URL-https://twitter.com/nao_sec/status/1530196847679401984?t=3Pjrpdog_H6OfMHVLMR5eQ&s=19",
132430+
"URL-https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/",
132431+
"URL-https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e",
132432+
"URL-https://twitter.com/GossiTheDog/status/1531608245009367040",
132433+
"URL-https://github.com/JMousqueton/PoC-CVE-2022-30190"
132434+
],
132435+
"platform": "Windows",
132436+
"arch": "x86, x64",
132437+
"rport": null,
132438+
"autofilter_ports": [
132439+
132440+
],
132441+
"autofilter_services": [
132442+
132443+
],
132444+
"targets": [
132445+
"Microsoft Office Word"
132446+
],
132447+
"mod_time": "2022-06-02 00:58:20 +0000",
132448+
"path": "/modules/exploits/windows/fileformat/word_msdtjs_rce.rb",
132449+
"is_install_path": true,
132450+
"ref_name": "windows/fileformat/word_msdtjs_rce",
132451+
"check": false,
132452+
"post_auth": false,
132453+
"default_credential": false,
132454+
"notes": {
132455+
"AKA": [
132456+
"Follina"
132457+
],
132458+
"Stability": [
132459+
"crash-safe"
132460+
],
132461+
"Reliability": [
132462+
"unreliable-session"
132463+
],
132464+
"SideEffects": [
132465+
"ioc-in-logs",
132466+
"artifacts-on-disk"
132467+
]
132468+
},
132469+
"session_types": false,
132470+
"needs_cleanup": null
132471+
},
132281132472
"exploit_windows/fileformat/word_mshtml_rce": {
132282132473
"name": "Microsoft Office Word Malicious MSHTML RCE",
132283132474
"fullname": "exploit/windows/fileformat/word_mshtml_rce",
@@ -186626,7 +186817,7 @@
186626186817
"autofilter_ports": null,
186627186818
"autofilter_services": null,
186628186819
"targets": null,
186629-
"mod_time": "2022-04-13 13:09:00 +0000",
186820+
"mod_time": "2022-05-17 10:51:20 +0000",
186630186821
"path": "/modules/payloads/singles/php/meterpreter_reverse_tcp.rb",
186631186822
"is_install_path": true,
186632186823
"ref_name": "php/meterpreter_reverse_tcp",
@@ -187004,7 +187195,7 @@
187004187195
"autofilter_ports": null,
187005187196
"autofilter_services": null,
187006187197
"targets": null,
187007-
"mod_time": "2022-05-05 18:44:20 +0000",
187198+
"mod_time": "2022-05-17 10:51:20 +0000",
187008187199
"path": "/modules/payloads/singles/python/meterpreter_bind_tcp.rb",
187009187200
"is_install_path": true,
187010187201
"ref_name": "python/meterpreter_bind_tcp",
@@ -187038,7 +187229,7 @@
187038187229
"autofilter_ports": null,
187039187230
"autofilter_services": null,
187040187231
"targets": null,
187041-
"mod_time": "2022-05-05 18:44:20 +0000",
187232+
"mod_time": "2022-05-17 10:51:20 +0000",
187042187233
"path": "/modules/payloads/singles/python/meterpreter_reverse_http.rb",
187043187234
"is_install_path": true,
187044187235
"ref_name": "python/meterpreter_reverse_http",
@@ -187072,7 +187263,7 @@
187072187263
"autofilter_ports": null,
187073187264
"autofilter_services": null,
187074187265
"targets": null,
187075-
"mod_time": "2022-05-05 18:44:20 +0000",
187266+
"mod_time": "2022-05-17 10:51:20 +0000",
187076187267
"path": "/modules/payloads/singles/python/meterpreter_reverse_https.rb",
187077187268
"is_install_path": true,
187078187269
"ref_name": "python/meterpreter_reverse_https",
@@ -187106,7 +187297,7 @@
187106187297
"autofilter_ports": null,
187107187298
"autofilter_services": null,
187108187299
"targets": null,
187109-
"mod_time": "2022-05-05 18:44:20 +0000",
187300+
"mod_time": "2022-05-17 10:51:20 +0000",
187110187301
"path": "/modules/payloads/singles/python/meterpreter_reverse_tcp.rb",
187111187302
"is_install_path": true,
187112187303
"ref_name": "python/meterpreter_reverse_tcp",
@@ -190003,7 +190194,7 @@
190003190194
"autofilter_ports": null,
190004190195
"autofilter_services": null,
190005190196
"targets": null,
190006-
"mod_time": "2022-04-29 15:18:51 +0000",
190197+
"mod_time": "2022-05-23 11:55:38 +0000",
190007190198
"path": "/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb",
190008190199
"is_install_path": true,
190009190200
"ref_name": "windows/meterpreter_bind_named_pipe",
@@ -190039,7 +190230,7 @@
190039190230
"autofilter_ports": null,
190040190231
"autofilter_services": null,
190041190232
"targets": null,
190042-
"mod_time": "2022-04-29 15:18:51 +0000",
190233+
"mod_time": "2022-05-23 11:55:38 +0000",
190043190234
"path": "/modules/payloads/singles/windows/meterpreter_bind_tcp.rb",
190044190235
"is_install_path": true,
190045190236
"ref_name": "windows/meterpreter_bind_tcp",
@@ -190075,7 +190266,7 @@
190075190266
"autofilter_ports": null,
190076190267
"autofilter_services": null,
190077190268
"targets": null,
190078-
"mod_time": "2022-04-29 15:18:51 +0000",
190269+
"mod_time": "2022-05-23 11:55:38 +0000",
190079190270
"path": "/modules/payloads/singles/windows/meterpreter_reverse_http.rb",
190080190271
"is_install_path": true,
190081190272
"ref_name": "windows/meterpreter_reverse_http",
@@ -190111,7 +190302,7 @@
190111190302
"autofilter_ports": null,
190112190303
"autofilter_services": null,
190113190304
"targets": null,
190114-
"mod_time": "2022-04-29 15:18:51 +0000",
190305+
"mod_time": "2022-05-23 11:55:38 +0000",
190115190306
"path": "/modules/payloads/singles/windows/meterpreter_reverse_https.rb",
190116190307
"is_install_path": true,
190117190308
"ref_name": "windows/meterpreter_reverse_https",
@@ -190147,7 +190338,7 @@
190147190338
"autofilter_ports": null,
190148190339
"autofilter_services": null,
190149190340
"targets": null,
190150-
"mod_time": "2022-04-29 15:18:51 +0000",
190341+
"mod_time": "2022-05-23 11:55:38 +0000",
190151190342
"path": "/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb",
190152190343
"is_install_path": true,
190153190344
"ref_name": "windows/meterpreter_reverse_ipv6_tcp",
@@ -190183,7 +190374,7 @@
190183190374
"autofilter_ports": null,
190184190375
"autofilter_services": null,
190185190376
"targets": null,
190186-
"mod_time": "2022-04-29 15:18:51 +0000",
190377+
"mod_time": "2022-05-23 11:55:38 +0000",
190187190378
"path": "/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb",
190188190379
"is_install_path": true,
190189190380
"ref_name": "windows/meterpreter_reverse_tcp",
@@ -202118,7 +202309,7 @@
202118202309
"autofilter_ports": null,
202119202310
"autofilter_services": null,
202120202311
"targets": null,
202121-
"mod_time": "2022-03-22 10:24:25 +0000",
202312+
"mod_time": "2022-05-27 10:21:59 +0000",
202122202313
"path": "/modules/post/multi/manage/shell_to_meterpreter.rb",
202123202314
"is_install_path": true,
202124202315
"ref_name": "multi/manage/shell_to_meterpreter",

0 commit comments

Comments
 (0)