File tree Expand file tree Collapse file tree 3 files changed +16
-12
lines changed
post/windows/gather/credentials Expand file tree Collapse file tree 3 files changed +16
-12
lines changed Original file line number Diff line number Diff line change @@ -13,15 +13,16 @@ def initialize(info = {})
13
13
info ,
14
14
'Name' => 'WordPress WPLMS Theme Privilege Escalation' ,
15
15
'Description' => %q{
16
- The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows authenticated users of
17
- any user level to set any system option via a lack of validation in the import_data function
18
- of /includes/func.php.
16
+ The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows an
17
+ authenticated user of any user level to set any system option due to a lack of
18
+ validation in the import_data function of /includes/func.php.
19
19
20
20
The module first changes the admin e-mail address to prevent any
21
- notifications being sent to the actual administrator during the attack, re-enables user
22
- registration in case it has been disabled and sets the default role to be administrator.
23
- This will allow for the user to create a new account with admin privileges via the default
24
- registration page found at /wp-login.php?action=register.
21
+ notifications being sent to the actual administrator during the attack,
22
+ re-enables user registration in case it has been disabled and sets the default
23
+ role to be administrator. This will allow for the user to create a new account
24
+ with admin privileges via the default registration page found at
25
+ /wp-login.php?action=register.
25
26
} ,
26
27
'Author' =>
27
28
[
Original file line number Diff line number Diff line change @@ -15,9 +15,9 @@ def initialize(info={})
15
15
super ( update_info ( info ,
16
16
'Name' => "MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure" ,
17
17
'Description' => %q{
18
- This module will use the Microsoft XMLDOM object to enumerate a remote user 's filenames.
18
+ This module will use the Microsoft XMLDOM object to enumerate a remote machine 's filenames.
19
19
It will try to do so against Internet Explorer 8 and Internet Explorer 9. To use it, you
20
- must supply your own list of file paths. Each file's format should look like this:
20
+ must supply your own list of file paths. Each file path should look like this:
21
21
c:\\\\windows\\\\system32\\\\calc.exe
22
22
} ,
23
23
'License' => MSF_LICENSE ,
Original file line number Diff line number Diff line change @@ -17,11 +17,14 @@ def initialize(info={})
17
17
super ( update_info ( info ,
18
18
'Name' => 'Windows Gather Local SQL Server Hash Dump' ,
19
19
'Description' => %q{ This module extracts the usernames and password
20
- hashes from a MSSQL server and stores them in the loot using the
21
- same technique in mssql_local_auth_bypass (Credits: Scott Sutherland)
20
+ hashes from an MSSQL server and stores them as loot. It uses the
21
+ same technique in mssql_local_auth_bypass.
22
22
} ,
23
23
'License' => MSF_LICENSE ,
24
- 'Author' => [ 'Mike Manzotti <mike.manzotti[at]dionach.com>' ] ,
24
+ 'Author' => [
25
+ 'Mike Manzotti <mike.manzotti[at]dionach.com>' ,
26
+ 'nullbind' # Original technique
27
+ ] ,
25
28
'Platform' => [ 'win' ] ,
26
29
'SessionTypes' => [ 'meterpreter' ] ,
27
30
'References' =>
You can’t perform that action at this time.
0 commit comments